@productbrain/cli 0.1.0-beta.14 → 0.1.0-beta.14010

package/dist/commands/profile.js

@@ -0,0 +1,351 @@
+/**
+ * pb profile — workspace profile management commands.
+ * WP-302 Slice 2: list, create, use, delete profiles.
+ *
+ * Uses runCliCommand pattern from runner.ts for JSON/pretty output.
+ * Uses CLIError from errors.ts for structured error reporting.
+ */
+import { runCliCommand } from '../lib/runner.js';
+import { listProfiles, getActiveProfile, createProfile, useProfile, deleteProfile, resolveNamedProfileConfig, } from '../lib/profiles.js';
+import { readSession, discardAllSessions, hasAnyActiveSession } from '../lib/session.js';
+import { resetConfigCache, findProjectRoot, readLocalProjectConfig, setLocalProfilePin } from '../lib/config.js';
+import { resolveReportedProfile, isEnvKeyBinding } from '../lib/reportedProfile.js';
+import { probeWorkspace } from '../lib/workspace-probe.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { DEFAULT_SITE_URL } from '../lib/constants.js';
+import { classifyDeployment, parseHostname } from '../lib/deployment.js';
+import { deploymentBadge } from '../lib/style.js';
+import { isatty } from 'tty';
+import { password } from '../lib/prompts.js';
+import { readStdinFully } from '../lib/conversation.js';
+import { API_KEY_FORMAT_LINE, isApiKeyShaped } from '../lib/tokenConstants.js';
+/** TEN-5778 (TASK-1177): what `pb profile create` says about the key. Voice: signed in the PR (RULE-705). */
+export const PROFILE_KEY_WORDS = {
+    prompt: "Paste the agent's key (it is not shown).",
+    flagWarning: 'A key on the command line stays in your shell history. Next time, paste it at the prompt.',
+    none: 'No key came in. Paste the key at the prompt, or pipe it in on one line.',
+};
+/**
+ * The key for a new profile, never from the command line unless `--api-key` named it (TEN-5778): at a terminal the masked
+ * prompt `pb login` uses; otherwise the first line of stdin, so a launcher or a password manager can pipe it in. Never echoed.
+ */
+export async function readProfileKey(io = { isTty: () => isatty(0), prompt: password, readStdin: readStdinFully }) {
+    const key = io.isTty()
+        ? await io.prompt({ message: PROFILE_KEY_WORDS.prompt, validate: (v) => (!v ? PROFILE_KEY_WORDS.none : isApiKeyShaped(v.trim()) ? undefined : API_KEY_FORMAT_LINE) })
+        : (io.readStdin().split('\n')[0] ?? '');
+    const trimmed = key.trim();
+    if (!trimmed)
+        throw new CLIError(PROFILE_KEY_WORDS.none, { code: ErrorCode.AUTH_MISSING, category: 'auth' });
+    if (!isApiKeyShaped(trimmed))
+        throw new CLIError(API_KEY_FORMAT_LINE, { code: ErrorCode.AUTH_MISSING, category: 'auth' });
+    return trimmed;
+}
+export function resolveProfileListState() {
+    const profiles = listProfiles();
+    const globalActive = getActiveProfile();
+    const localActive = readLocalProjectConfig()?.profile ?? null;
+    const reported = resolveReportedProfile();
+    // Four sources all mean NO profile is the active one: the CLI refuses (`missing-pin`), or an
+    // exported key / a dotenv file here / a preview binding outranks every profile file. In each
+    // case `globalActive` is still listed below, just never marked `(active)`.
+    const shadowed = ['missing-pin', 'env-key', 'preview', 'cwd-key', 'local-key'];
+    const noActiveProfile = shadowed.includes(reported.source);
+    const active = noActiveProfile ? null : reported.profile;
+    const activeSource = noActiveProfile ? reported.source
+        : reported.source === 'local' ? 'local'
+            : reported.profile ? 'global'
+                : 'none';
+    return { profiles, active, globalActive, localActive, activeSource };
+}
+/** The four sources that outrank EVERY profile file outright (DEC-1607) — shared between
+ *  `formatProfileList`'s "no profile below is in use" note and `runProfileCreate`'s receipt
+ *  (PRRT_kwDORS4ils6ih-Do, round 2: a freshly created profile is shadowed exactly the same way
+ *  an existing one is, so the two must never drift into two different explanations of the same
+ *  four conditions). `subjectClause` is the caller's own "<subject> is/is not in use" sentence —
+ *  kept as a whole clause (not interpolated into a fixed template) so each caller's grammar
+ *  ("no profile below is in use" vs "this profile is not in use") stays natural. */
+function describeShadowingBinding(source, subjectClause) {
+    switch (source) {
+        case 'env-key':
+            return `An exported PRODUCTBRAIN_API_KEY is the active binding — ${subjectClause}.\nUnset it (\`unset PRODUCTBRAIN_API_KEY\`) and re-run to see which binding takes over.`;
+        case 'preview':
+            return `This worktree is bound to a throwaway preview — ${subjectClause}.\nRun \`npm run pb:real\` to go back to the real Chain.`;
+        case 'cwd-key':
+            return `A dotenv file in this directory is the active binding — ${subjectClause}.\nRemove it, or run pb from your project directory, to use one.`;
+        case 'local-key':
+            return `.productbrain/config.local.json binds a credential directly — ${subjectClause}.\nRun \`npm run pb:real\` to strip it — re-pinning alone leaves that binding winning.`;
+    }
+}
+/**
+ * Pure pretty-printer for `pb profile list`. Exported (like formatWhoami) so the copy can be
+ * asserted directly — an inline lambda left the env-key case untestable and therefore wrong.
+ */
+export function formatProfileList(data) {
+    // TEN-3240 (Codex P2): an exported key SHADOWS every profile here. Without this note the list
+    // prints with no active marker and no reason why — and the empty-list branch would recommend
+    // creating a profile the export would immediately shadow too.
+    // "…for these profiles to take effect" would be a promise this function cannot keep: in a
+    // preview-bound worktree the direct apiKey/siteUrl binding wins ahead of every profile
+    // (resolveConfig step 2a), so unsetting the key still leaves them unused (Codex P2 round 2).
+    const shadowingSources = ['env-key', 'preview', 'cwd-key', 'local-key'];
+    const envKeyNote = shadowingSources.includes(data.activeSource)
+        ? describeShadowingBinding(data.activeSource, 'no profile below is in use')
+        : null;
+    if (data.profiles.length === 0) {
+        return envKeyNote ?? 'No profiles configured. Run: pb profile create <name>, then paste the key.';
+    }
+    const lines = data.profiles.map((name) => {
+        const marker = name === data.active
+            ? data.activeSource === 'local' ? ' (active, local)' : ' (active)'
+            : '';
+        return `  ${name}${marker}`;
+    });
+    if (envKeyNote)
+        lines.push('', envKeyNote);
+    if (data.localActive && data.globalActive && data.localActive !== data.globalActive) {
+        lines.push('', `Repo local profile: ${data.localActive}`, `Global profile:     ${data.globalActive}`);
+    }
+    return `Profiles:\n${lines.join('\n')}`;
+}
+/** pb profile list — show all profiles, mark active one. */
+export async function runProfileList() {
+    await runCliCommand({
+        fn: async () => resolveProfileListState(),
+        formatPretty: formatProfileList,
+    });
+}
+/**
+ * pb profile create <name> [--url <url>], the key pasted or piped (readProfileKey); `--api-key <key>` still works and warns.
+ *
+ * `--url` defaults to the gateway of the profile this folder pins (a key minted on the deployment this repo works
+ * against is saved for that deployment), else production (`DEFAULT_SITE_URL`); never a profile with no
+ * `CONVEX_SITE_URL` line at all. The receipt names the host and its tier either way. A profile's key travels only with the URL
+ * stored beside it (TEN-4500), so once active the profile resolves to exactly the host its file
+ * holds — but writing the file does not by itself move the binding in a repo that pins another
+ * profile (H). The receipt reports that gap rather than a host that never takes effect.
+ *
+ * PRRT_kwDORS4ils6ih-Do (round 2): the file's host only takes effect when nothing outranks EVERY
+ * profile file outright. `resolveReportedProfile()` re-runs the SAME credential cascade
+ * `resolveConfig()` actually uses (DEC-1607) — when it reports one of the four shadowing
+ * sources (an exported key, a preview binding, a CWD dotenv file, or a direct
+ * config.local.json credential), THIS freshly created profile is shadowed exactly like every
+ * other profile file, so presenting the derived host as "the host this resolves to" would name
+ * a binding that never actually takes effect. Report the shadow instead.
+ */
+export async function runProfileCreate(opts, readKey = () => readProfileKey()) {
+    if (opts.apiKey !== undefined)
+        process.stderr.write(`${PROFILE_KEY_WORDS.flagWarning}\n`);
+    await runCliCommand({
+        fn: async () => {
+            const pin = readLocalProjectConfig()?.profile;
+            const siteUrl = opts.url ?? (pin ? resolveNamedProfileConfig(pin)?.siteUrl : undefined) ?? DEFAULT_SITE_URL;
+            createProfile(opts.name, opts.apiKey ?? (await readKey()), siteUrl);
+            // The FILE's own host — literally what createProfile just wrote — is also the host the
+            // profile resolves to once active: its key never travels to another URL (TEN-4500).
+            const host = parseHostname(siteUrl);
+            const tier = classifyDeployment(siteUrl);
+            const shadowingSources = ['env-key', 'preview', 'cwd-key', 'local-key'];
+            const reported = resolveReportedProfile();
+            const reportedSource = reported.source;
+            const shadowedBy = shadowingSources.includes(reportedSource)
+                ? reportedSource
+                : null;
+            // PRRT_kwDORS4ils6jBWYx (round 4): `missing-pin` is a FIFTH source that leaves no profile
+            // active — a repo with `.productbrain/config.json` but no tenant pin in `config.local.json`
+            // — but it is not itself a shadowing BINDING (nothing else is winning), so it never belonged
+            // in `shadowingSources`/`describeShadowingBinding` above. Every command still fails closed
+            // in `refuseWhenProjectHasNoTenant()` regardless of this new profile, so the receipt must
+            // say so instead of the unqualified "created. → host" line.
+            const missingPin = reportedSource === 'missing-pin';
+            // PRRT_kwDORS4ils6jG9FL (round 10) + jK6hP (round 16): a NAMED profile source that already
+            // resolves to a DIFFERENT profile still wins resolveEffectiveProfile()'s own precedence
+            // (local pin > env > global > default) over this freshly created one — 'env' (PB_PROFILE),
+            // 'local' (the repo's own config.local.json pin), and 'global' (~/.config/productbrain's
+            // active-profile file) ALL outrank a brand-new profile the same way; round 10 only ever
+            // checked 'env', so a repo pin or a global active-profile file naming something else still
+            // printed the false "created. → host" line. Only fires when the reported name differs from
+            // opts.name — re-creating a profile that source ALREADY names is a truthful receipt, not an
+            // override.
+            //
+            // Round 24 (jUmGx): 'default' outranks a brand-new profile too — when the global
+            // active-profile marker names a DELETED/missing profile, resolveProfileConfig() (profiles.ts)
+            // falls through past that dangling marker to the "default" profile file, and
+            // resolveReportedProfile()'s classifyProfileName reports that as source:'default'. Without
+            // this branch, creating any differently-named profile printed the unqualified "created. →
+            // host" line even though "default" — not the new profile — is what actually resolves.
+            const NAME_OVERRIDE_SOURCES = ['env', 'local', 'global', 'default'];
+            const nameOverride = NAME_OVERRIDE_SOURCES.includes(reportedSource) && reported.profile && reported.profile !== opts.name
+                ? { source: reportedSource, name: reported.profile }
+                : null;
+            return { name: opts.name, host, tier, shadowedBy, missingPin, nameOverride };
+        },
+        formatPretty: (data) => {
+            // Shadowed: never claim a host is "the one that would resolve" (PRRT_kwDORS4ils6ih-Do) —
+            // state what the file holds, plainly, then the reason it will not be used as written.
+            if (data.shadowedBy) {
+                return `Profile "${data.name}" created (file holds ${data.host}).\n` +
+                    describeShadowingBinding(data.shadowedBy, 'this profile is not in use');
+            }
+            if (data.missingPin) {
+                return `Profile "${data.name}" created (file holds ${data.host}).\n` +
+                    `This repo has no tenant pin, so every command still fails closed — run \`pb profile use --local ${data.name}\` to pin it here.`;
+            }
+            if (data.nameOverride) {
+                const { source, name } = data.nameOverride;
+                // jK6hP (round 16) originally offered `PB_PROFILE=${data.name}` as an inline env-prefix
+                // command — jLlcN (round 17) flagged that the command-forms rule file of that time forbade exactly
+                // this shape (no env-prefix wrappers, since a real user's shell parser prompts on it).
+                // Two genuinely separate steps instead: unset-and-select (`pb profile use`, the ordinary
+                // door), or `export PB_PROFILE=...` on its OWN line when the operator wants the env var.
+                const guidance = source === 'env'
+                    ? `PB_PROFILE=${name} is still exported in this shell — this profile is not in use.\n` +
+                        `Run \`unset PB_PROFILE\`, then \`pb profile use ${data.name}\` to use it.\n` +
+                        `To keep using PB_PROFILE instead, run this on its own line: \`export PB_PROFILE=${data.name}\`.`
+                    : source === 'local'
+                        ? `This repo is pinned to "${name}" (config.local.json) — this profile is not in use.\n` +
+                            `Run \`pb profile use --local ${data.name}\` to repin it here.`
+                        : source === 'default'
+                            ? `No repo pin, no PB_PROFILE, and the global active-profile marker names a profile that no longer exists — "default" is active instead, not this one.\n` +
+                                `Run \`pb profile use ${data.name}\` (or \`--global\`) to switch to it.`
+                            : `The global active profile is "${name}" — this profile is not in use.\n` +
+                                `Run \`pb profile use ${data.name}\` (or \`--global\`) to switch to it.`;
+                return `Profile "${data.name}" created (file holds ${data.host}).\n${guidance}`;
+            }
+            return `Profile "${data.name}" created. → ${data.host} ${deploymentBadge(data.tier)}`;
+        },
+    });
+}
+export async function runProfileUse(opts) {
+    if (opts.local && opts.global) {
+        throw new CLIError('Cannot use both --local and --global.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Pick one: --local (repo pin only), --global (global only), or neither (reconcile both).',
+        });
+    }
+    await runCliCommand({
+        fn: async () => {
+            const projectRoot = findProjectRoot(process.cwd());
+            const localPin = readLocalProjectConfig()?.profile ?? null;
+            // PB_PROFILE always wins resolution (by design). If it's set, ANY profile write
+            // here is shadowed — surface that instead of failing silently (the TEN-2163 trap).
+            const PB_PROFILE = process.env.PB_PROFILE?.trim() || null;
+            // An exported key outranks every profile file, so a switch made under one is SHADOWED in
+            // the parent shell exactly like PB_PROFILE above — report it rather than printing a
+            // "Now using …" the operator will never observe (Codex P2 r7).
+            const shadowingKey = isEnvKeyBinding();
+            const resetEnv = () => {
+                resetConfigCache();
+                delete process.env.PRODUCTBRAIN_API_KEY;
+                delete process.env.CONVEX_SITE_URL;
+                // NOTE: deliberately NOT re-snapshotting the reported source here. The delete above only
+                // affects THIS child process; the parent shell still exports the key, so re-snapshotting
+                // would record an absence that is true for nobody and label the next command's binding
+                // wrong. `shadowingKey` above keeps the startup truth.
+            };
+            // Discard ANY session file (active OR stale closed marker) — a closed marker would
+            // let the 2h auto-resume re-pin the old workspace. Report only an ACTIVE session
+            // in the print line. Review fix (Codex): a profile switch changes the effective workspace,
+            // so clear ALL conversation markers, not just the current conversation's — otherwise a
+            // sibling conversation's active marker survives and could be reused against the new workspace.
+            const discardSessionState = () => {
+                // Report accurately whether an active session was cleared — including a SIBLING conversation's
+                // (Codex re-review): a profile switch from a shell whose current conversation has no marker
+                // still discards all markers, so `readSession()` (current only) would under-report and
+                // silently strand a sibling active session on the old workspace.
+                const hadActive = readSession() !== null || hasAnyActiveSession();
+                discardAllSessions();
+                return hadActive;
+            };
+            // --- --local: repo pin only ---
+            if (opts.local) {
+                if (!projectRoot) {
+                    throw new CLIError('No .productbrain/ directory found in this directory tree. Run `pb connect` first or use `pb use <name> --global` to switch globally.', { code: ErrorCode.CONFIG_INVALID, category: 'config',
+                        guidance: 'Run `pb connect <token>` to set up a project workspace, or use --global.' });
+                }
+                setLocalProfilePin(projectRoot, opts.name);
+                const sessionCleared = discardSessionState();
+                resetEnv();
+                return { name: opts.name, scope: 'local', reconciledLocalPin: false,
+                    sessionCleared, workspace: await safeProbe(), pinnedElsewhere: null, 'PB_PROFILE': PB_PROFILE, shadowedByApiKey: shadowingKey };
+            }
+            // --- --global: global only (does not change a locally-pinned repo) ---
+            if (opts.global) {
+                useProfile(opts.name);
+                const pinnedElsewhere = localPin && localPin !== opts.name ? localPin : null;
+                // The repo's effective workspace only changes when it is NOT pinned elsewhere.
+                const sessionCleared = pinnedElsewhere ? false : discardSessionState();
+                resetEnv();
+                const workspace = pinnedElsewhere ? null : await safeProbe();
+                return { name: opts.name, scope: 'global', reconciledLocalPin: false,
+                    sessionCleared, workspace, pinnedElsewhere, 'PB_PROFILE': PB_PROFILE, shadowedByApiKey: shadowingKey };
+            }
+            // --- default: flip global AND reconcile the repo pin if one exists ---
+            useProfile(opts.name);
+            let reconciledLocalPin = false;
+            if (projectRoot && localPin) {
+                setLocalProfilePin(projectRoot, opts.name);
+                reconciledLocalPin = true;
+            }
+            const sessionCleared = discardSessionState();
+            resetEnv();
+            return { name: opts.name, scope: 'reconcile', reconciledLocalPin,
+                sessionCleared, workspace: await safeProbe(), pinnedElsewhere: null, 'PB_PROFILE': PB_PROFILE, shadowedByApiKey: shadowingKey };
+        },
+        formatPretty: (d) => {
+            const lines = [];
+            if (d.scope === 'global') {
+                const arrow = d.workspace ? ` → ${d.workspace}` : '';
+                lines.push(`Switched global profile to "${d.name}"${arrow}.`);
+                if (d.pinnedElsewhere) {
+                    lines.push(`Note: this repo is pinned to "${d.pinnedElsewhere}" via config.local.json — the global switch won't change it here.`);
+                    lines.push(`Run \`pb use ${d.name}\` (no flag) to switch this repo too.`);
+                }
+            }
+            else {
+                const arrow = d.workspace ? ` → ${d.workspace}` : '';
+                const where = d.scope === 'local' ? ' (repo-local)' : '';
+                lines.push(`Now using "${d.name}"${where}${arrow}`);
+                if (d.reconciledLocalPin)
+                    lines.push('(updated repo-local pin in .productbrain/config.local.json)');
+            }
+            if (d.sessionCleared)
+                lines.push('(previous session closed)');
+            if (d['PB_PROFILE']) {
+                lines.push(`⚠ PB_PROFILE is set to "${d['PB_PROFILE']}" in your environment and overrides profile resolution.`);
+                // Only promise that unsetting PB_PROFILE is sufficient when it actually IS (Codex P2 r14):
+                // an exported API key outranks it too, so with both set, unsetting this one alone changes
+                // nothing — and the key's own warning below already names the step that does.
+                if (!d.shadowedByApiKey)
+                    lines.push(`  This switch won't take effect until you unset it: \`unset PB_PROFILE\`.`);
+            }
+            // Same trap one rung higher: an exported key outranks every profile file, so without this
+            // the command reports a switch the operator's shell will keep shadowing (Codex P2 r7).
+            if (d.shadowedByApiKey) {
+                lines.push('⚠ PRODUCTBRAIN_API_KEY is exported in your environment and outranks every profile.');
+                lines.push(d['PB_PROFILE']
+                    ? "  This switch won't take effect until you unset both: `unset PRODUCTBRAIN_API_KEY PB_PROFILE`."
+                    : "  This switch won't take effect until you unset it: `unset PRODUCTBRAIN_API_KEY`.");
+            }
+            return lines.join('\n');
+        },
+    });
+}
+/**
+ * Best-effort workspace name after a profile switch; null on any failure.
+ * probeWorkspace() already swallows network/auth errors and returns null, so this is offline-safe.
+ */
+async function safeProbe() {
+    return (await probeWorkspace())?.name ?? null;
+}
+/** pb profile delete <name> */
+export async function runProfileDelete(opts) {
+    await runCliCommand({
+        fn: async () => {
+            deleteProfile(opts.name);
+            return { name: opts.name, deleted: true };
+        },
+        formatPretty: (data) => `Profile "${data.name}" deleted.`,
+    });
+}
+//# sourceMappingURL=profile.js.map

package/dist/commands/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/commands/profile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,aAAa,EACb,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACjH,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/E,6GAA6G;AAC7G,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,0CAA0C;IAClD,WAAW,EAAE,2FAA2F;IACxG,IAAI,EAAE,yEAAyE;CAChF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAiF,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE;IAExJ,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrK,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7G,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1H,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD,MAAM,UAAU,uBAAuB;IACrC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,sBAAsB,EAAE,EAAE,OAAO,IAAI,IAAI,CAAC;IAC9D,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,6FAA6F;IAC7F,6FAA6F;IAC7F,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;IACxF,MAAM,eAAe,GAAI,QAA8B,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzD,MAAM,YAAY,GAChB,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAmC;QAC5D,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO;YACrC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;gBAC3B,CAAC,CAAC,MAAM,CAAC;IAEjB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;oFAMoF;AACpF,SAAS,wBAAwB,CAC/B,MAAuD,EACvD,aAAqB;IAErB,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,4DAA4D,aAAa,0FAA0F,CAAC;QAC7K,KAAK,SAAS;YACZ,OAAO,mDAAmD,aAAa,0DAA0D,CAAC;QACpI,KAAK,SAAS;YACZ,OAAO,2DAA2D,aAAa,kEAAkE,CAAC;QACpJ,KAAK,WAAW;YACd,OAAO,iEAAiE,aAAa,wFAAwF,CAAC;IAClL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,8FAA8F;IAC9F,6FAA6F;IAC7F,8DAA8D;IAC9D,0FAA0F;IAC1F,uFAAuF;IACvF,6FAA6F;IAC7F,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;IACjF,MAAM,UAAU,GAAI,gBAAsC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QACpF,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,YAAiD,EAAE,4BAA4B,CAAC;QAChH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,IAAI,4EAA4E,CAAC;IACpG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC,MAAM;YACjC,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,KAAK,IAAI,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,IAAI,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,uBAAuB,IAAI,CAAC,WAAW,EAAE,EAAE,uBAAuB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,aAAa,CAAoB;QACrC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,uBAAuB,EAAE;QACzC,YAAY,EAAE,iBAAiB;KAChC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAItC,EAAE,UAAiC,GAAG,EAAE,CAAC,cAAc,EAAE;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,iBAAiB,CAAC,WAAW,IAAI,CAAC,CAAC;IAC1F,MAAM,aAAa,CAAC;QAClB,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,GAAG,GAAG,sBAAsB,EAAE,EAAE,OAAO,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC;YAC5G,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YACpE,uFAAuF;YACvF,oFAAoF;YACpF,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;YACjF,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;YAC1C,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;YACvC,MAAM,UAAU,GAAI,gBAAsC,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACjF,CAAC,CAAE,cAAoD;gBACvD,CAAC,CAAC,IAAI,CAAC;YACT,0FAA0F;YAC1F,4FAA4F;YAC5F,6FAA6F;YAC7F,2FAA2F;YAC3F,0FAA0F;YAC1F,4DAA4D;YAC5D,MAAM,UAAU,GAAG,cAAc,KAAK,aAAa,CAAC;YACpD,2FAA2F;YAC3F,wFAAwF;YACxF,2FAA2F;YAC3F,yFAAyF;YACzF,wFAAwF;YACxF,2FAA2F;YAC3F,2FAA2F;YAC3F,4FAA4F;YAC5F,YAAY;YACZ,EAAE;YACF,iFAAiF;YACjF,8FAA8F;YAC9F,6EAA6E;YAC7E,2FAA2F;YAC3F,0FAA0F;YAC1F,sFAAsF;YACtF,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;YAC7E,MAAM,YAAY,GAAI,qBAA2C,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI;gBAC9I,CAAC,CAAC,EAAE,MAAM,EAAE,cAAwD,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE;gBAC9F,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QAC/E,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YACrB,yFAAyF;YACzF,sFAAsF;YACtF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO,YAAY,IAAI,CAAC,IAAI,yBAAyB,IAAI,CAAC,IAAI,MAAM;oBAClE,wBAAwB,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO,YAAY,IAAI,CAAC,IAAI,yBAAyB,IAAI,CAAC,IAAI,MAAM;oBAClE,mGAAmG,IAAI,CAAC,IAAI,oBAAoB,CAAC;YACrI,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;gBAC3C,wFAAwF;gBACxF,mGAAmG;gBACnG,uFAAuF;gBACvF,yFAAyF;gBACzF,yFAAyF;gBACzF,MAAM,QAAQ,GAAG,MAAM,KAAK,KAAK;oBAC/B,CAAC,CAAC,cAAc,IAAI,kEAAkE;wBACpF,mDAAmD,IAAI,CAAC,IAAI,iBAAiB;wBAC7E,mFAAmF,IAAI,CAAC,IAAI,KAAK;oBACnG,CAAC,CAAC,MAAM,KAAK,OAAO;wBAClB,CAAC,CAAC,2BAA2B,IAAI,uDAAuD;4BACtF,gCAAgC,IAAI,CAAC,IAAI,sBAAsB;wBACjE,CAAC,CAAC,MAAM,KAAK,SAAS;4BACpB,CAAC,CAAC,uJAAuJ;gCACvJ,wBAAwB,IAAI,CAAC,IAAI,uCAAuC;4BAC1E,CAAC,CAAC,iCAAiC,IAAI,mCAAmC;gCACxE,wBAAwB,IAAI,CAAC,IAAI,uCAAuC,CAAC;gBACjF,OAAO,YAAY,IAAI,CAAC,IAAI,yBAAyB,IAAI,CAAC,IAAI,OAAO,QAAQ,EAAE,CAAC;YAClF,CAAC;YACD,OAAO,YAAY,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAyD;IAC3F,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,uCAAuC,EAAE;YAC1D,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,yFAAyF;SACpG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,CAAmB;QACpC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,sBAAsB,EAAE,EAAE,OAAO,IAAI,IAAI,CAAC;YAC3D,gFAAgF;YAChF,mFAAmF;YACnF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;YAE1D,yFAAyF;YACzF,oFAAoF;YACpF,+DAA+D;YAC/D,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,GAAG,EAAE;gBACpB,gBAAgB,EAAE,CAAC;gBACnB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;gBACxC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;gBACnC,yFAAyF;gBACzF,yFAAyF;gBACzF,uFAAuF;gBACvF,uDAAuD;YACzD,CAAC,CAAC;YACF,mFAAmF;YACnF,iFAAiF;YACjF,2FAA2F;YAC3F,uFAAuF;YACvF,+FAA+F;YAC/F,MAAM,mBAAmB,GAAG,GAAY,EAAE;gBACxC,+FAA+F;gBAC/F,4FAA4F;gBAC5F,uFAAuF;gBACvF,iEAAiE;gBACjE,MAAM,SAAS,GAAG,WAAW,EAAE,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;gBAClE,kBAAkB,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC;YAEF,iCAAiC;YACjC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,QAAQ,CAChB,sIAAsI,EACtI,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ;wBAClD,QAAQ,EAAE,0EAA0E,EAAE,CACzF,CAAC;gBACJ,CAAC;gBACD,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,cAAc,GAAG,mBAAmB,EAAE,CAAC;gBAC7C,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK;oBACjE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;YACpI,CAAC;YAED,wEAAwE;YACxE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,MAAM,eAAe,GAAG,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7E,+EAA+E;gBAC/E,MAAM,cAAc,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;gBACvE,QAAQ,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC;gBAC7D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK;oBAClE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;YAC3G,CAAC;YAED,wEAAwE;YACxE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,kBAAkB,GAAG,KAAK,CAAC;YAC/B,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;gBAC5B,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3C,kBAAkB,GAAG,IAAI,CAAC;YAC5B,CAAC;YACD,MAAM,cAAc,GAAG,mBAAmB,EAAE,CAAC;YAC7C,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,kBAAkB;gBAC9D,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;QACpI,CAAC;QACD,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;YAClB,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;gBAC9D,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,eAAe,mEAAmE,CAAC,CAAC;oBAClI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,uCAAuC,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,CAAC,kBAAkB;oBAAE,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACtG,CAAC;YACD,IAAI,CAAC,CAAC,cAAc;gBAAE,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,YAAY,CAAC,yDAAyD,CAAC,CAAC;gBAChH,2FAA2F;gBAC3F,0FAA0F;gBAC1F,8EAA8E;gBAC9E,IAAI,CAAC,CAAC,CAAC,gBAAgB;oBAAE,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YACnH,CAAC;YACD,0FAA0F;YAC1F,uFAAuF;YACvF,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;gBACjG,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,YAAY,CAAC;oBACb,CAAC,CAAC,gGAAgG;oBAClG,CAAC,CAAC,mFAAmF,CACxF,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS;IACtB,OAAO,CAAC,MAAM,cAAc,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AAChD,CAAC;AAED,+BAA+B;AAC/B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAsB;IAC3D,MAAM,aAAa,CAAC;QAClB,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,IAAI,YAAY;KAC1D,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/proof-run.d.ts

@@ -0,0 +1,51 @@
+/**
+ * pb proof-run <proof-name> — run an admin-only proof against the seeded preview
+ * via the WP-459 proof bridge.
+ *
+ * NOT a kernel/MCP call: the bridge is a token-gated httpAction with a SIMPLER
+ * envelope than /api/aki. It authenticates with the short-lived preview admin
+ * token (pb_pat_…) minted into .productbrain/preview-admin.json by the seed
+ * (scripts/seed-preview.mjs step 7) — NOT the pb API key. So this command does
+ * not call getConfig()/kernelCall(); it reads the throwaway token from disk and
+ * POSTs directly to {siteUrl}/api/admin/proof-run.
+ *
+ *   Success → HTTP 200 { data: <verdict> } (verdict may carry zeroHandAuthoringProven)
+ *   Failure → non-200 { error, code }
+ *
+ * Chain: WP-459 (Admin-proof bridge).
+ */
+/** Resolved inputs for a proof-bridge call. */
+export interface ProofBridgeInputs {
+    siteUrl: string;
+    rawToken: string;
+    workspaceId: string;
+    /** Server-enforced expiry (ms epoch), if the token record carried one. */
+    expiresAt?: number;
+}
+/**
+ * Resolve the proof-bridge inputs (siteUrl, rawToken, workspaceId) from the
+ * worktree's seed sidecars. Pure + testable: takes the project root explicitly,
+ * throws CLIError with actionable guidance on any missing/invalid file.
+ */
+export declare function resolveProofBridgeInputs(projectRoot: string): ProofBridgeInputs;
+/** Parsed bridge response — discriminated on `ok`. */
+type BridgeResult = {
+    ok: true;
+    data: unknown;
+} | {
+    ok: false;
+    error: string;
+    code: string;
+};
+/**
+ * POST to the proof bridge and parse its simple envelope ({ data } / { error, code }).
+ * Uses an AbortController timeout (mirrors lib/client.js). Network / non-JSON
+ * failures surface as a structured { ok: false } so the caller can exit non-zero.
+ */
+export declare function callProofBridge(inputs: ProofBridgeInputs, proofName: string, timeoutMs?: number): Promise<BridgeResult>;
+interface ProofRunOptions {
+    proofName: string;
+}
+export declare function runProofRun(options: ProofRunOptions): Promise<void>;
+export {};
+//# sourceMappingURL=proof-run.d.ts.map

package/dist/commands/proof-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-run.d.ts","sourceRoot":"","sources":["../../src/commands/proof-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAuBH,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAeD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CA8E/E;AAED,sDAAsD;AACtD,KAAK,YAAY,GACb;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,EACzB,SAAS,EAAE,MAAM,EACjB,SAAS,SAAS,GACjB,OAAO,CAAC,YAAY,CAAC,CA8CvB;AAED,UAAU,eAAe;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAgEzE"}

package/dist/commands/proof-run.js

@@ -0,0 +1,209 @@
+/**
+ * pb proof-run <proof-name> — run an admin-only proof against the seeded preview
+ * via the WP-459 proof bridge.
+ *
+ * NOT a kernel/MCP call: the bridge is a token-gated httpAction with a SIMPLER
+ * envelope than /api/aki. It authenticates with the short-lived preview admin
+ * token (pb_pat_…) minted into .productbrain/preview-admin.json by the seed
+ * (scripts/seed-preview.mjs step 7) — NOT the pb API key. So this command does
+ * not call getConfig()/kernelCall(); it reads the throwaway token from disk and
+ * POSTs directly to {siteUrl}/api/admin/proof-run.
+ *
+ *   Success → HTTP 200 { data: <verdict> } (verdict may carry zeroHandAuthoringProven)
+ *   Failure → non-200 { error, code }
+ *
+ * Chain: WP-459 (Admin-proof bridge).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { findProjectRoot } from '../lib/config.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { green, red, bold, dim, icons } from '../lib/style.js';
+/** Convert a Convex `.cloud` URL to its `.site` sibling, trailing slash stripped. */
+function toSiteUrl(convexUrl) {
+    return convexUrl.replace('.convex.cloud', '.convex.site').replace(/\/$/, '');
+}
+function readJsonFile(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the proof-bridge inputs (siteUrl, rawToken, workspaceId) from the
+ * worktree's seed sidecars. Pure + testable: takes the project root explicitly,
+ * throws CLIError with actionable guidance on any missing/invalid file.
+ */
+export function resolveProofBridgeInputs(projectRoot) {
+    const seedPath = resolve(projectRoot, '.convex-seed.json');
+    if (!existsSync(seedPath)) {
+        throw new CLIError('No seeded preview found (.convex-seed.json missing).', {
+            code: ErrorCode.CONFIG_MISSING,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` first.',
+        });
+    }
+    const seed = readJsonFile(seedPath);
+    if (!seed) {
+        throw new CLIError('Could not parse .convex-seed.json.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Re-run `npm run convex:reprovision` to regenerate it.',
+        });
+    }
+    const adminPath = resolve(projectRoot, '.productbrain', 'preview-admin.json');
+    if (!existsSync(adminPath)) {
+        throw new CLIError('No preview admin token (.productbrain/preview-admin.json missing).', {
+            code: ErrorCode.CONFIG_MISSING,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` to mint one.',
+        });
+    }
+    const admin = readJsonFile(adminPath);
+    if (!admin?.rawToken) {
+        throw new CLIError('preview-admin.json is missing its rawToken.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` to mint a fresh token.',
+        });
+    }
+    // Stale-sidecar guard: both sidecars are written by the SAME seed run, so their
+    // workspaceIds MUST agree. A mismatch means preview-admin.json is left over from an
+    // earlier preview — and because we prefer its pinned values below, using it would aim
+    // the proof at that stale (possibly still-live) deployment while THIS worktree's preview
+    // goes unexercised. Fail closed rather than silently proving the wrong workspace.
+    if (seed.workspaceId && admin.workspaceId && seed.workspaceId !== admin.workspaceId) {
+        throw new CLIError(`Stale preview admin token: preview-admin.json is pinned to workspace ${admin.workspaceId}, ` +
+            `but the current seed (.convex-seed.json) is workspace ${seed.workspaceId}.`, {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` to re-mint the admin token for the current preview.',
+        });
+    }
+    // Prefer the pinned values from preview-admin.json; fall back to the seed sidecar.
+    const siteUrl = admin.siteUrl ?? (seed.convexUrl ? toSiteUrl(seed.convexUrl) : undefined);
+    if (!siteUrl) {
+        throw new CLIError('Could not determine the preview site URL.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Re-run `npm run convex:reprovision` to regenerate the seed sidecars.',
+        });
+    }
+    const workspaceId = admin.workspaceId ?? seed.workspaceId;
+    if (!workspaceId) {
+        throw new CLIError('Could not determine the preview workspaceId.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Re-run `npm run convex:reprovision` to regenerate the seed sidecars.',
+        });
+    }
+    return {
+        siteUrl: siteUrl.replace(/\/$/, ''),
+        rawToken: admin.rawToken,
+        workspaceId,
+        expiresAt: typeof admin.expiresAt === 'number' ? admin.expiresAt : undefined,
+    };
+}
+/**
+ * POST to the proof bridge and parse its simple envelope ({ data } / { error, code }).
+ * Uses an AbortController timeout (mirrors lib/client.js). Network / non-JSON
+ * failures surface as a structured { ok: false } so the caller can exit non-zero.
+ */
+export async function callProofBridge(inputs, proofName, timeoutMs = 30_000) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    try {
+        res = await fetch(`${inputs.siteUrl}/api/admin/proof-run`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-pb-admin-token': inputs.rawToken,
+            },
+            body: JSON.stringify({ proofName, workspaceId: inputs.workspaceId }),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        clearTimeout(timer);
+        const msg = err instanceof Error ? err.message : String(err);
+        const reason = msg === 'The operation was aborted' || msg.includes('abort')
+            ? `Request timed out after ${timeoutMs}ms`
+            : `Could not reach the proof bridge (${msg})`;
+        return { ok: false, error: reason, code: 'NETWORK_UNREACHABLE' };
+    }
+    clearTimeout(timer);
+    const body = (await res.json().catch(() => null));
+    if (!body) {
+        return {
+            ok: false,
+            error: `Bridge returned a non-JSON response (HTTP ${res.status}).`,
+            code: 'BAD_RESPONSE',
+        };
+    }
+    if (res.ok) {
+        return { ok: true, data: body.data };
+    }
+    return {
+        ok: false,
+        error: body.error ?? res.statusText ?? `HTTP ${res.status}`,
+        code: body.code ?? `HTTP_${res.status}`,
+    };
+}
+export async function runProofRun(options) {
+    const proofName = options.proofName.trim();
+    if (!proofName) {
+        throw new CLIError('Proof name is required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Usage: pb proof-run <proof-name>',
+        });
+    }
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot) {
+        throw new CLIError('Not inside a Product Brain project (no .productbrain/ found).', {
+            code: ErrorCode.CONFIG_MISSING,
+            category: 'config',
+            guidance: 'Run this from a worktree with a seeded preview (npm run convex:reprovision).',
+        });
+    }
+    const inputs = resolveProofBridgeInputs(projectRoot);
+    // Friendly pre-check — the server is the authority, so we still attempt the call.
+    if (inputs.expiresAt && Date.now() > inputs.expiresAt) {
+        process.stderr.write(`${icons.warn} preview admin token looks expired (${new Date(inputs.expiresAt).toISOString()}); ` +
+            `run \`npm run convex:reprovision\` to mint a fresh one.\n`);
+    }
+    const result = await callProofBridge(inputs, proofName);
+    if (!result.ok) {
+        throw new CLIError(`Proof bridge rejected the run: ${result.error}`, {
+            code: ErrorCode.INTERNAL,
+            category: 'internal',
+            guidance: `Bridge error code: ${result.code}`,
+        });
+    }
+    const verdict = result.data;
+    const proven = verdict && typeof verdict === 'object' && 'zeroHandAuthoringProven' in verdict
+        ? verdict.zeroHandAuthoringProven
+        : undefined;
+    if (typeof proven === 'boolean') {
+        const mark = proven ? green(icons.pass) : red(icons.fail);
+        process.stdout.write(`${mark} ${bold('zeroHandAuthoringProven')}: ${proven}\n`);
+    }
+    process.stdout.write(`${dim(`proof: ${proofName}`)}\n`);
+    process.stdout.write(JSON.stringify(verdict, null, 2) + '\n');
+    // A recognized proof boolean that came back `false` is a FAILED proof, not a successful
+    // run. This command is the agent-surface smoke proof, so its exit status must reflect the
+    // verdict — exit non-zero so operators/CI don't read a failed proof as passing. (We still
+    // print the full verdict above first.) Unrecognized verdicts (no boolean) stay exit-0:
+    // we can't adjudicate a proof we don't model.
+    if (proven === false) {
+        throw new CLIError(`Proof "${proofName}" did not hold: zeroHandAuthoringProven=false.`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'The seeded policy seam resolved away from the zero-hand-authoring default — inspect the verdict above.',
+        });
+    }
+}
+//# sourceMappingURL=proof-run.js.map