@productbrain/cli 0.1.0-beta.14 → 0.1.0-beta.14010

package/dist/lib/config.js

@@ -1,21 +1,326 @@
 /**
  * CLI config — reads PRODUCTBRAIN_API_KEY + CONVEX_SITE_URL from:
+ * 0. The profile a subagent's conversation names (conversationKeyProfile below)
  * 1. Environment variables
- * 2. ~/.config/productbrain/.env (works from any directory)
- * 3. CWD .env.mcp / packages/mcp-server/.env.mcp / .env
+ * 2. Project local config: .productbrain/config.local.json (walked up from CWD, machine-local)
+ * 3. Project config: .productbrain/config.json (walked up from CWD, committed) — its presence
+ *    declares a project; its siteUrl never routes a key (TEN-4500)
+ * 4. Profile system (~/.config/productbrain/profiles/{name}.env)
+ * 5. Legacy ~/.config/productbrain/.env (auto-migrated to profiles on first use)
+ * 6. CWD .env.mcp / packages/mcp-server/.env.mcp / .env
+ *
+ * Config loading is lazy — loadEnv() runs on first getConfig()/getConfigOrGuide() call.
+ * This enables profile switching without import-time side effects (TEN-1276).
  *
  * When key is missing and retry is provided (TTY), runs guided flow per docs/cli-unauthenticated-user-journey.md.
+ *
+ * The repo's own config files (.productbrain/config.json, config.local.json) are located and
+ * read by projectConfig.ts — this module turns what they declare into a credential.
  */
-import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
+import { readFileSync, existsSync, mkdirSync } from 'fs';
+import { writePrivateFile } from './privateFile.js';
 import { resolve } from 'path';
 import { homedir } from 'os';
-import { createInterface } from 'readline';
-const DEFAULT_SITE_URL = 'https://trustworthy-kangaroo-277.convex.site';
+import { DEFAULT_SITE_URL } from './constants.js';
+import { API_KEY_FORMAT_LINE, isApiKeyShaped } from './tokenConstants.js';
+import { isEnvKeyBinding } from './envKeySnapshot.js';
+import { resolveProfileConfig, resolveNamedProfileConfig, getGlobalActiveProfile } from './profiles.js';
+import { findProjectRoot, readBoundPreviewKey, readLocalProjectConfig } from './projectConfig.js';
+import { declaresCompletePreviewBinding, refuseWhenProjectHasNoTenant, resolveLocalBinding, resolvePinnedProfile } from './localBinding.js';
+import { CLIError, ErrorCode } from './errors.js';
+import { normalizeConversationId } from './conversation.js';
+import { ConfigResolutionError, isInsecureSiteUrl, missingKeyError, pickSiteUrl, resolveConfigResult, } from './configResult.js';
 const HOME_CONFIG_DIR = resolve(homedir(), '.config', 'productbrain');
 const HOME_ENV_PATH = resolve(HOME_CONFIG_DIR, '.env');
 const CWD_ENV_PATHS = ['.env.mcp', 'packages/mcp-server/.env.mcp', '.env'];
-// Short error when not TTY (scripts/pipes must not hang)
-const NON_TTY_MESSAGE = 'No API key. Set PRODUCTBRAIN_API_KEY or run pb login.';
+/** Track whether env has been loaded to avoid redundant file reads. */
+let envLoaded = false;
+// Re-exported so callers keep importing the repo-config readers from here (they are part of
+// this module's long-standing public surface); the implementations live in projectConfig.ts.
+export { findProjectRoot, readLocalProjectConfig } from './projectConfig.js';
+/**
+ * Returns the preview binding metadata when pb is currently bound to a throwaway preview,
+ * or null when bound to the real Chain (the default).
+ *
+ * Effective-binding mirror: this only reports a preview binding when
+ * `resolveConfig()`/`loadEnv()` would actually honor it — `preview === true` AND
+ * an atomic apiKey+siteUrl pair (SF-3) AND no `PRODUCTBRAIN_API_KEY` env override
+ * (env always wins in resolveConfig step 1). Without these guards the PREVIEW
+ * banner could fire while writes still hit the real Chain, defeating the safety
+ * warning. Used by the PREVIEW banner (index.ts preAction hook) and the
+ * capture/update advisory.
+ *
+ * Security classification: reads only the gitignored machine-local config.local.json.
+ * The preview key in that file is a throwaway preview-scoped key, set by explicit
+ * `npm run pb:preview` opt-in and reversed by `npm run pb:real`. Never throws — returns
+ * null on any error so the banner/advisory path is never the source of a CLI crash.
+ */
+export function getPreviewBinding() {
+    try {
+        if (process.env.PRODUCTBRAIN_API_KEY)
+            return null;
+        return declaresCompletePreviewBinding(readLocalProjectConfig());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write/merge the profile pin into <projectRoot>/.productbrain/config.local.json,
+ * preserving any sibling keys. Single source of truth for the local pin write —
+ * used by `pb profile use --local`, the default reconcile path, and `pb connect`.
+ *
+ * Co-writer note (SF-2): scripts/pb-binding.mjs is the OTHER writer of config.local.json — it
+ * merges/strips the preview-binding keys (apiKey, siteUrl, preview, workspaceName) for
+ * `npm run pb:preview` / `npm run pb:real`, plus previewKey*. Both writers keep the `profile` pin. If you add
+ * a preview-scoped key here or in readLocalProjectConfig(), update pb-binding.mjs's PREVIEW_KEYS.
+ */
+export function setLocalProfilePin(projectRoot, profile) {
+    const configDir = resolve(projectRoot, '.productbrain');
+    const localConfigPath = resolve(configDir, 'config.local.json');
+    let existing = {};
+    if (existsSync(localConfigPath)) {
+        try {
+            const parsed = JSON.parse(readFileSync(localConfigPath, 'utf8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                existing = parsed;
+        }
+        catch { /* ignore parse errors — we overwrite the pin below */ }
+    }
+    mkdirSync(configDir, { recursive: true });
+    writePrivateFile(localConfigPath, JSON.stringify({ ...existing, profile }, null, 2) + '\n'); // the file may hold a preview apiKey
+}
+/**
+ * WP-458 E2 — one-shot preview apiKey refresh from disk.
+ *
+ * After a worktree preview is reseeded, seed-preview.mjs Step 6 mints a NEW apiKey into the bound key
+ * file the binding recorded (`previewKey`), but `config.local.json` (and the live `process.env` binding it
+ * seeded via loadEnv) still carry the PRE-reseed key — so the next `pb session start` fails auth
+ * with an opaque INTERNAL. This re-reads the fresh key from that file so the caller can retry
+ * ONCE (session.ts). It is deliberately disk-to-disk: it compares that file's key against
+ * config.local.json's bound key, NOT against process.env (which loadEnv already populated from the
+ * stale binding), so it can't be confused by its own prior population. Never throws — any error
+ * degrades to 'unavailable'/'not-bound' so it can sit on the session-start path.
+ *
+ * Co-writer note (SF-2): mirrors pb-binding.mjs / setLocalProfilePin — preserves every sibling key
+ * in config.local.json (profile, preview, workspaceName, previewKey*) and only rewrites apiKey + siteUrl.
+ */
+export function refreshPreviewApiKeyFromDisk() {
+    try {
+        const projectRoot = findProjectRoot(process.cwd());
+        if (!projectRoot)
+            return 'not-bound';
+        const local = readLocalProjectConfig();
+        // Only act on a real preview binding (preview:true + atomic apiKey+siteUrl pair, SF-3).
+        if (!local?.preview || !local.apiKey || !local.siteUrl)
+            return 'not-bound';
+        // Never clobber a genuine env override. BOTH signals: the value comparison misses an operator
+        // who exported the SAME key the binding holds (Codex P2 r12); the snapshot misses one set
+        // after module load. An unset key is fine — loadEnv may not have run yet.
+        const liveKey = process.env.PRODUCTBRAIN_API_KEY;
+        if (isEnvKeyBinding() || (liveKey && liveKey !== local.apiKey))
+            return 'not-bound';
+        // Only the key file pb:preview bound, and only while it still names that person, workspace and seat (TEN-4883).
+        const fresh = local.previewKey ? readBoundPreviewKey(projectRoot, local.previewKey) : null;
+        if (!fresh)
+            return 'unavailable';
+        const freshKey = typeof fresh.apiKey === 'string' ? fresh.apiKey : '';
+        if (!isApiKeyShaped(freshKey))
+            return 'unavailable';
+        // Same key as the one already bound — retrying would just fail again; the failure is not a
+        // stale key, so the caller surfaces the real error rather than relabelling it.
+        if (freshKey === local.apiKey)
+            return 'unchanged';
+        const freshSite = typeof fresh.siteUrl === 'string' && fresh.siteUrl ? fresh.siteUrl : local.siteUrl;
+        // Merge the fresh preview key into config.local.json, preserving siblings.
+        const localConfigPath = resolve(projectRoot, '.productbrain', 'config.local.json');
+        let existing = {};
+        if (existsSync(localConfigPath)) {
+            try {
+                const parsed = JSON.parse(readFileSync(localConfigPath, 'utf8'));
+                if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                    existing = parsed;
+            }
+            catch { /* overwrite below */ }
+        }
+        writePrivateFile(localConfigPath, JSON.stringify({ ...existing, apiKey: freshKey, siteUrl: freshSite }, null, 2) + '\n');
+        // Update the live binding + drop the load cache so the next getConfig() uses the fresh key.
+        process.env.PRODUCTBRAIN_API_KEY = freshKey;
+        process.env.CONVEX_SITE_URL = freshSite.replace(/\/$/, '');
+        resetConfigCache();
+        return 'refreshed';
+    }
+    catch {
+        return 'unavailable';
+    }
+}
+/**
+ * The profile a subagent's conversation runs on (TASK-1177; DEC-2298): the session-start hook saves the profile's NAME, never
+ * a key, in ~/.config/productbrain/conversations/<conversation>, and removes it when the subagent stops. A subagent shares
+ * its parent's env, so only a pb command prefixed with the subagent's own PB_CONVERSATION_ID finds it; that command runs on
+ * the profile's key ahead of the parent's exported key, and one without the prefix stays on the parent's key. In the home
+ * folder, not the repo: a subagent works in another worktree than the one its hook ran in.
+ */
+export function conversationKeyProfile() {
+    const raw = process.env.PB_CONVERSATION_ID?.trim();
+    if (!raw)
+        return null;
+    try {
+        // Line 1 is the profile; line 2 is the hook's (the Claude process it clears the record by).
+        return readFileSync(resolve(HOME_CONFIG_DIR, 'conversations', normalizeConversationId(raw)), 'utf8').split('\n')[0].trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the effective profile NAME + where it came from. PRECEDENCE — local pin > env >
+ * global > default: the pin outranks `PB_PROFILE` because resolveConfig() 2b / loadEnv() 1b
+ * bind the pinned key before the profile system (the only step reading `PB_PROFILE`), so
+ * under both the env name never supplies the credential and must not be reported. Unlike
+ * resolveConfig() this names the *configured* pin even when unresolvable (deleted / missing
+ * key): a dangling pin must be surfaced by `pb whoami`, never masked by the global profile
+ * — the TEN-2163 silent-drift bug. Used by `pb whoami`, session labels, "now using" prints.
+ */
+export function resolveEffectiveProfile() {
+    const localProfile = readLocalProjectConfig()?.profile;
+    if (localProfile)
+        return { profile: localProfile, source: 'local' };
+    const envProfile = process.env.PB_PROFILE?.trim();
+    if (envProfile)
+        return { profile: envProfile, source: 'env' };
+    const globalProfile = getGlobalActiveProfile();
+    if (globalProfile)
+        return { profile: globalProfile, source: 'global' };
+    if (resolveNamedProfileConfig('default'))
+        return { profile: 'default', source: 'default' };
+    return { profile: null, source: 'none' };
+}
+/**
+ * Run the full config resolution cascade and return a typed result.
+ * Resolution order:
+ * 0. The profile this subagent's conversation names (highest priority; it holds no key of its own)
+ * 1. Environment variables
+ * 2. config.local.json profile → resolveNamedProfileConfig(profile) for apiKey + siteUrl
+ * 2c. Declared project naming no tenant — refuses (config.json names neither a tenant nor a gateway)
+ * 3. Profile system (~/.config/productbrain/profiles/{name}.env)
+ * 4. Legacy home config (~/.config/productbrain/.env)
+ * 5. CWD .env files (.env.mcp, packages/mcp-server/.env.mcp, .env)
+ *
+ * A key travels only with the site URL stored or exported beside it (TEN-4500): every branch
+ * reads its URL from the same source as its key, and a key with no URL of its own goes to
+ * DEFAULT_SITE_URL. `.productbrain/config.json` is committed, so a cloned repo controls its
+ * siteUrl; it never routes a key. Same rule as resolveAdminConfig() (TEN-1334). loadEnv()
+ * exports this function's answer, so `pb doctor` and the command path cannot name different
+ * hosts. `siteUrlSource` records which source supplied the URL.
+ *
+ * THROWS at step 2 rather than substituting a different workspace: CONFIG_INVALID at 2a
+ * (incomplete binding), AUTH_MISSING at 2b (dangling pin), missing-pin at 2c. getConfigSafe()
+ * reports each as `ok: false` with the kind preserved, for callers that must not crash.
+ */
+export function resolveConfig(ignoreEnvKey = false) {
+    // 0. A subagent's own role key: never fall back to the parent's key when the named profile is broken.
+    const keyProfile = conversationKeyProfile();
+    if (keyProfile) {
+        const named = resolveNamedProfileConfig(keyProfile);
+        if (!named?.apiKey || !isApiKeyShaped(named.apiKey)) {
+            throw new ConfigResolutionError(`This conversation runs on profile ${keyProfile}, which holds no valid key.`, {
+                code: ErrorCode.AUTH_MISSING, category: 'auth', kind: 'profile-pin',
+                nextCommand: `pb profile create ${keyProfile}`, guidance: `Save the agent's key again: pb profile create ${keyProfile}.`,
+            });
+        }
+        return { apiKey: named.apiKey, source: 'profile', profileName: keyProfile, ...pickSiteUrl([['profile', named.siteUrl]]) };
+    }
+    // 1. Env vars. `ignoreEnvKey`: reporting-only seam, rationale at its call site (TEN-3311).
+    const envKey = ignoreEnvKey ? undefined : process.env.PRODUCTBRAIN_API_KEY;
+    const envSite = process.env.CONVEX_SITE_URL;
+    if (envKey) {
+        return { apiKey: envKey, source: 'env', ...pickSiteUrl([['env', envSite]]) };
+    }
+    // 2. Local project config — check for direct preview binding first, then profile pin.
+    const localConfig = readLocalProjectConfig();
+    // 2a. Direct preview binding (config.local.json apiKey) — set by `npm run pb:preview`.
+    // Security classification: gitignored machine-local file; throwaway preview-scoped key;
+    // explicit opt-in via `npm run pb:preview`; reversible via `npm run pb:real`;
+    // loud PREVIEW banner on every command makes it un-missable (index.ts preAction hook).
+    //
+    // Atomic apiKey+siteUrl (SF-3): only honor the preview key when its OWN siteUrl is present.
+    // Never let a preview key borrow config.json's (real-dev) siteUrl — that would send a
+    // preview credential to a non-preview gateway (STD-261). A claimed but incomplete binding
+    // refuses before the profile pin, so neither credential nor tenant can silently change.
+    const localBinding = resolveLocalBinding(localConfig);
+    if (localBinding) {
+        // The binding carries its own atomic siteUrl (SF-3), so it is also the URL's origin.
+        return {
+            apiKey: localBinding.apiKey,
+            siteUrl: localBinding.siteUrl,
+            source: 'project',
+            siteUrlSource: 'local-binding',
+        };
+    }
+    // 2b. Profile pin (config.local.json profile field, gitignored)
+    if (localConfig?.profile) {
+        const pinned = resolvePinnedProfile(localConfig.profile);
+        return {
+            apiKey: pinned.apiKey,
+            source: 'project', profileName: localConfig.profile,
+            ...pickSiteUrl([['profile-pin', pinned.siteUrl]]),
+        };
+    }
+    refuseWhenProjectHasNoTenant(); // 2c — declared project, no tenant named
+    // 3. Profile system
+    const profileConfig = resolveProfileConfig();
+    if (profileConfig?.apiKey) {
+        return {
+            apiKey: profileConfig.apiKey,
+            source: 'profile', profileName: profileConfig.profileName ?? undefined,
+            ...pickSiteUrl([['profile', profileConfig.siteUrl]]),
+        };
+    }
+    // 4. Legacy home config
+    if (existsSync(HOME_ENV_PATH)) {
+        const vars = parseEnvVars(readFileSync(HOME_ENV_PATH, 'utf8'));
+        if (vars['PRODUCTBRAIN_API_KEY']) {
+            return {
+                apiKey: vars['PRODUCTBRAIN_API_KEY'],
+                source: 'profile',
+                ...pickSiteUrl([['legacy', vars['CONVEX_SITE_URL']]]),
+            };
+        }
+    }
+    // 5. CWD .env files
+    for (const p of CWD_ENV_PATHS) {
+        const full = resolve(process.cwd(), p);
+        if (existsSync(full)) {
+            const vars = parseEnvVars(readFileSync(full, 'utf8'));
+            if (vars['PRODUCTBRAIN_API_KEY']) {
+                return {
+                    apiKey: vars['PRODUCTBRAIN_API_KEY'],
+                    source: 'cwd',
+                    ...pickSiteUrl([['cwd', vars['CONVEX_SITE_URL'], p]]),
+                };
+            }
+            break;
+        }
+    }
+    // 6. No API key found anywhere — siteUrl still resolves so diagnostics can report a gateway.
+    return {
+        apiKey: undefined,
+        source: 'default',
+        ...pickSiteUrl([['env', envSite]]),
+    };
+}
+/** Parse env file content and return key-value pairs (without mutating process.env). */
+function parseEnvVars(content) {
+    const vars = {};
+    for (const line of content.split('\n')) {
+        const m = line.match(/^([^#=]+)=(.*)$/);
+        if (m) {
+            vars[m[1].trim()] = m[2].trim().replace(/^["']|["']$/g, '');
+        }
+    }
+    return vars;
+}
 function parseEnvContent(content) {
     for (const line of content.split('\n')) {
         const m = line.match(/^([^#=]+)=(.*)$/);
@@ -25,6 +330,20 @@ function parseEnvContent(content) {
     }
 }
 function loadEnv() {
+    if (envLoaded)
+        return;
+    // 1. The credential and its site URL come from resolveConfig() as one pair, so the URL a key
+    // is sent to is decided in one place and `pb doctor` (getConfigSafe) names the same host this
+    // exports (TEN-4500). resolveConfig() throws the same refusals this path must raise: an
+    // incomplete preview binding, a dangling pin, a declared project with no pin.
+    const resolved = resolveConfig();
+    if (resolved.apiKey) {
+        process.env.PRODUCTBRAIN_API_KEY = resolved.apiKey;
+        process.env.CONVEX_SITE_URL = resolved.siteUrl;
+    }
+    // 2. The legacy home file and the first CWD env file still seed any OTHER unset variable they
+    // hold. They cannot move the pair above: both variables are already set whenever a key
+    // resolved, and when none did, resolveConfig() already read these files and found no key.
     if (existsSync(HOME_ENV_PATH)) {
         parseEnvContent(readFileSync(HOME_ENV_PATH, 'utf8'));
     }
@@ -35,83 +354,68 @@ function loadEnv() {
             break;
         }
     }
+    // Marked loaded only on success: a dangling pin (step 1) throws, and latching the flag
+    // before that would leave the module "loaded" with no credential, so a caller that catches
+    // the refusal and retries would silently get the keyless path instead of the refusal again.
+    envLoaded = true;
 }
-loadEnv();
-function question(rl, prompt) {
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => resolve((answer ?? '').trim().toLowerCase()));
-    });
-}
-function questionRaw(rl, prompt) {
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => resolve((answer ?? '').trim()));
-    });
-}
-/**
- * Guided flow when key is missing (TTY only). Per docs/cli-unauthenticated-user-journey.md.
- * Returns true if we saved and ran retry; false if user said No (caller should exit).
- */
-async function runGuidedFlow(retry) {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    console.log('Do you have an API key from Product Brain? (y/n)');
-    console.log('  Get one: Product Brain app → Settings → API Keys');
-    const hasKey = await question(rl, '> ');
-    if (hasKey !== 'y' && hasKey !== 'yes') {
-        console.log('Get your key: Product Brain app → Settings → API Keys. Then run: pb login');
-        rl.close();
-        process.exit(0);
-    }
-    let apiKey = await questionRaw(rl, 'Paste your API key (pb_sk_...): ');
-    if (!apiKey || !apiKey.startsWith('pb_sk_')) {
-        console.log('Key must start with pb_sk_. Try again or run pb login.');
-        apiKey = await questionRaw(rl, 'Paste your API key (pb_sk_...): ');
-    }
-    rl.close();
-    if (!apiKey || !apiKey.startsWith('pb_sk_')) {
-        console.log('Get your key: Product Brain app → Settings → API Keys. Then run: pb login');
-        process.exit(0);
-    }
-    const content = [
-        `# Product Brain CLI — saved by guided setup`,
-        `PRODUCTBRAIN_API_KEY=${apiKey}`,
-        `CONVEX_SITE_URL=${DEFAULT_SITE_URL.replace(/\/$/, '')}`,
-        '',
-    ].join('\n');
-    mkdirSync(HOME_CONFIG_DIR, { recursive: true });
-    writeFileSync(HOME_ENV_PATH, content, { mode: 0o600 });
-    process.env.PRODUCTBRAIN_API_KEY = apiKey;
-    process.env.CONVEX_SITE_URL = DEFAULT_SITE_URL.replace(/\/$/, '');
-    console.log('Saved your key. Running your command…\n');
-    await retry();
-    return true;
+/** Reset env loaded state — used for profile switching. */
+export function resetConfigCache() {
+    envLoaded = false;
 }
 export function getConfig() {
+    loadEnv();
     const apiKey = process.env.PRODUCTBRAIN_API_KEY ?? '';
     const siteUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_SITE_URL).replace(/\/$/, '');
-    if (!apiKey || !apiKey.startsWith('pb_sk_')) {
-        throw new Error(NON_TTY_MESSAGE);
+    // TASK-562: no key throws the one missing-key sentence getConfigSafe reports (configResult.ts).
+    if (!apiKey)
+        throw missingKeyError();
+    if (!isApiKeyShaped(apiKey)) {
+        throw new CLIError(API_KEY_FORMAT_LINE, {
+            code: ErrorCode.AUTH_MISSING,
+            category: 'auth',
+            guidance: 'Run `pb doctor` to see which source supplied it.',
+        });
     }
-    if (!siteUrl.startsWith('https://')) {
-        throw new Error(`CONVEX_SITE_URL must use HTTPS (got "${siteUrl.slice(0, 30)}…"). API keys must not be sent over unencrypted connections.`);
+    if (isInsecureSiteUrl(siteUrl)) {
+        // loadEnv() exports a file-sourced URL into CONVEX_SITE_URL, so only `pb doctor` can name the origin.
+        throw new CLIError(`Site URL must use HTTPS (got "${siteUrl.slice(0, 30)}…"). API keys must not be sent over unencrypted connections.`, {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Run `pb doctor` to see which source supplied the URL, then set an https:// URL there.',
+        });
     }
     return { apiKey, siteUrl };
 }
 /**
- * Get config; if key is missing and stdin is a TTY, run guided flow (y/n → paste key → save → retry).
- * @param retry Called after saving key so the original command runs in-process.
- * @returns Config, or null if we ran retry (caller should return without running again).
+ * Non-throwing alternative to getConfig().
+ *
+ * Architecture: getConfig() is the primary path for commands that require auth — it
+ * throws CLIError when the key is missing, which is correct for API call paths.
+ * getConfigSafe() is for status/probe surfaces (no-args dashboard, init) that need
+ * to check config availability without crashing. Both paths are intentional and
+ * coexist by design — see WP-303 review (DW#5).
+ *
+ * Uses resolveConfig() directly (no loadEnv) to avoid env var pollution affecting source attribution.
+ *
+ * A refusal from resolveConfig() (dangling repo pin) is reported as `ok: false` with the
+ * refusal as the reason — NOT rethrown. This surface is what `pb doctor` and the bare-`pb`
+ * dashboard use to *diagnose*, and a diagnostic that dies on the condition it exists to
+ * explain is useless. The refusal keeps its teeth either way: `ok: false` hands out no
+ * credential, so nothing can proceed against the wrong workspace.
+ */
+export function getConfigSafe() {
+    return resolveConfigResult(resolveConfig);
+}
+/**
+ * Get config for a command that needs auth. TASK-562: the paste-a-key guided flow is deleted; a
+ * missing key throws the same missing-key sentence as getConfig, in a TTY too (connect, never paste).
  */
-export async function getConfigOrGuide(retry) {
-    const apiKey = process.env.PRODUCTBRAIN_API_KEY ?? '';
-    const siteUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_SITE_URL).replace(/\/$/, '');
-    if (apiKey.startsWith('pb_sk_') && siteUrl.startsWith('https://')) {
-        return { apiKey, siteUrl };
-    }
-    if (!process.stdin.isTTY) {
-        throw new Error(NON_TTY_MESSAGE);
-    }
-    const didRetry = await runGuidedFlow(retry);
-    return didRetry ? null : null;
+export async function getConfigOrGuide() {
+    return getConfig();
 }
+// resolveAdminConfig() lives in adminConfig.ts (WP-681: split out to stay under the 500-LOC
+// budget). NOT re-exported here — that would be a circular import (adminConfig.ts imports
+// readLocalProjectConfig/HOME_ENV_PATH from this file); every caller imports it directly.
 export { HOME_CONFIG_DIR, HOME_ENV_PATH };
 //# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,gBAAgB,GAAG,8CAA8C,CAAC;AAExE,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACtE,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AAEvD,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,8BAA8B,EAAE,MAAM,CAAC,CAAC;AAE3E,yDAAyD;AACzD,MAAM,eAAe,GAAG,uDAAuD,CAAC;AAEhF,SAAS,eAAe,CAAC,OAAe;IACtC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,OAAO;IACd,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,eAAe,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED,OAAO,EAAE,CAAC;AAEV,SAAS,QAAQ,CAAC,EAAsC,EAAE,MAAc;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,EAAsC,EAAE,MAAc;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,KAA0B;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7E,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAExC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;QACzF,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACtE,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAC;IACrE,CAAC;IAED,EAAE,CAAC,KAAK,EAAE,CAAC;IAEX,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG;QACd,6CAA6C;QAC7C,wBAAwB,MAAM,EAAE;QAChC,mBAAmB,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE;QACxD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,aAAa,CAAC,aAAa,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvD,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,MAAM,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAElE,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACvD,MAAM,KAAK,EAAE,CAAC;IACd,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAErF,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,wCAAwC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8DAA8D,CAC3H,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA0B;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAErF,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAAC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACjI,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5I,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,mBAAmB,GAGpB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACtE,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AAEvD,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,8BAA8B,EAAE,MAAM,CAAC,CAAC;AAE3E,uEAAuE;AACvE,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB,4FAA4F;AAC5F,6FAA6F;AAC7F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAA2B,MAAM,oBAAoB,CAAC;AAGtG;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC;QAClD,OAAO,8BAA8B,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAe;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAChE,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;YACjE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;IACpE,CAAC;IACD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,gBAAgB,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,qCAAqC;AACpI,CAAC;AAkBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B;IAC1C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW;YAAE,OAAO,WAAW,CAAC;QAErC,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;QACvC,wFAAwF;QACxF,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC;QAE3E,8FAA8F;QAC9F,0FAA0F;QAC1F,0EAA0E;QAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACjD,IAAI,eAAe,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,WAAW,CAAC;QAEnF,gHAAgH;QAChH,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,IAAI,CAAC,KAAK;YAAE,OAAO,aAAa,CAAC;QAEjC,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;YAAE,OAAO,aAAa,CAAC;QACpD,2FAA2F;QAC3F,+EAA+E;QAC/E,IAAI,QAAQ,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,WAAW,CAAC;QAElD,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAErG,2EAA2E;QAC3E,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACnF,IAAI,QAAQ,GAA4B,EAAE,CAAC;QAC3C,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;gBACjE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,QAAQ,GAAG,MAAM,CAAC;YACxF,CAAC;YAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACnC,CAAC;QACD,gBAAgB,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAEzH,4FAA4F;QAC5F,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,gBAAgB,EAAE,CAAC;QACnB,OAAO,WAAW,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,4FAA4F;QAC5F,OAAO,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,eAAe,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACrI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAKD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,YAAY,GAAG,sBAAsB,EAAE,EAAE,OAAO,CAAC;IACvD,IAAI,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEpE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAE9D,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;IAC/C,IAAI,aAAa;QAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAEvE,IAAI,yBAAyB,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE3F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,YAAY,GAAG,KAAK;IAChD,sGAAsG;IACtG,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;IAC5C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,UAAU,6BAA6B,EAAE;gBAC5G,IAAI,EAAE,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa;gBACnE,WAAW,EAAE,qBAAqB,UAAU,EAAE,EAAE,QAAQ,EAAE,iDAAiD,UAAU,GAAG;aACzH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5H,CAAC;IAED,2FAA2F;IAC3F,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,sFAAsF;IACtF,MAAM,WAAW,GAAG,sBAAsB,EAAE,CAAC;IAE7C,uFAAuF;IACvF,wFAAwF;IACxF,8EAA8E;IAC9E,uFAAuF;IACvF,EAAE;IACF,4FAA4F;IAC5F,sFAAsF;IACtF,0FAA0F;IAC1F,wFAAwF;IACxF,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,YAAY,EAAE,CAAC;QACjB,qFAAqF;QACrF,OAAO;YACL,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,eAAe;SAC/B,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO;YACnD,GAAG,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,4BAA4B,EAAE,CAAC,CAAC,yCAAyC;IACzE,oBAAoB;IACpB,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAC7C,IAAI,aAAa,EAAE,MAAM,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,WAAW,IAAI,SAAS;YACtE,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;SACrD,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,sBAAsB,CAAC;gBACpC,MAAM,EAAE,SAAS;gBACjB,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;aACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACtD,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBACjC,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,sBAAsB,CAAC;oBACpC,MAAM,EAAE,KAAK;oBACb,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBACtD,CAAC;YACJ,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,SAAS;QACjB,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,OAAO;IACd,IAAI,SAAS;QAAE,OAAO;IAEtB,6FAA6F;IAC7F,8FAA8F;IAC9F,wFAAwF;IACxF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjD,CAAC;IAED,8FAA8F;IAC9F,uFAAuF;IACvF,0FAA0F;IAC1F,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,eAAe,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,2FAA2F;IAC3F,4FAA4F;IAC5F,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB;IAC9B,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,EAAE,CAAC;IACV,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAErF,gGAAgG;IAChG,IAAI,CAAC,MAAM;QAAE,MAAM,eAAe,EAAE,CAAC;IACrC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE;YACtC,IAAI,EAAE,SAAS,CAAC,YAAY;YAC5B,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,kDAAkD;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,sGAAsG;QACtG,MAAM,IAAI,QAAQ,CAChB,iCAAiC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8DAA8D,EACnH;YACE,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,uFAAuF;SAClG,CACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,mBAAmB,CAAC,aAAa,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED,4FAA4F;AAC5F,0FAA0F;AAC1F,0FAA0F;AAE1F,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC"}

package/dist/lib/configResult.d.ts

@@ -0,0 +1,110 @@
+/** Structured, non-throwing view of the CLI configuration cascade. */
+import { CLIError, type ErrorCategory, type ErrorCodeValue } from './errors.js';
+export type ConfigSource = 'env' | 'project' | 'profile' | 'cwd' | 'default';
+/**
+ * Where the resolved `siteUrl` came from — tracked SEPARATELY from `ConfigSource`.
+ *
+ * A key travels only with the URL stored beside it (TEN-4500), so the URL's source is the key's
+ * own file or variable, or `default` when that source holds no URL. It still needs its own
+ * field: `project` covers both a direct binding and a pin, and `cwd` covers three files, so the
+ * repair must name the one that actually supplied the URL.
+ */
+export type SiteUrlSource = 'env' | 'local-binding' | 'profile-pin' | 'profile' | 'legacy' | 'cwd' | 'default';
+export interface ResolvedConfig {
+    apiKey?: string;
+    siteUrl: string;
+    source: ConfigSource;
+    /**
+     * Which candidate supplied `siteUrl`. Optional because a caller may construct a
+     * ResolvedConfig without observing the cascade; diagnostics must then name NO source
+     * rather than guess one.
+     */
+    siteUrlSource?: SiteUrlSource;
+    /**
+     * The concrete file a source resolved to, where the source alone is ambiguous — `cwd` covers
+     * three different candidate paths, so naming the generic one would point the operator at a
+     * file that is not the one being read.
+     */
+    siteUrlDetail?: string;
+    /**
+     * Which named profile supplied a `profile`-sourced credential or URL. Absent when the profile
+     * cascade landed on the nameless legacy `~/.config/productbrain/.env`, so diagnostics can name
+     * the profile that actually won instead of an "active profile" that may not be the one read.
+     */
+    profileName?: string;
+}
+/**
+ * Pick the first present siteUrl candidate and record which one won, so the URL and its
+ * reported origin are produced by one expression and cannot disagree. Candidates are given
+ * in the caller's existing precedence order; `DEFAULT_SITE_URL` closes every chain.
+ */
+export declare function pickSiteUrl(candidates: ReadonlyArray<readonly [SiteUrlSource, string | undefined, string?]>): {
+    siteUrl: string;
+    siteUrlSource: SiteUrlSource;
+    siteUrlDetail?: string;
+};
+export type ConfigFailureKind = 'missing-key' | 'invalid-key' | 'profile-pin' | 'missing-pin' | 'preview-binding' | 'invalid-url' | 'unknown';
+export type ConfigResult = 
+/**
+ * `profileName` carries through from `ResolvedConfig`: it is the profile that ACTUALLY supplied
+ * the credential, after `resolveProfileConfig()`'s own fallback (PB_PROFILE → active-profile
+ * file → "default" → legacy). Reporting surfaces need it because re-deriving the name from
+ * `PB_PROFILE` alone reports an UNVALIDATED name — a `PB_PROFILE` pointing at a deleted profile
+ * falls through to the active one, and the label then names a workspace pb is not using. This
+ * is the rule profiles.ts's own ResolvedProfileConfig doc already states; it just was not
+ * reaching the label layer. Absent when the nameless legacy home file won.
+ */
+{
+    ok: true;
+    apiKey: string;
+    siteUrl: string;
+    source: ConfigSource;
+    profileName?: string;
+} | {
+    ok: false;
+    kind: ConfigFailureKind;
+    reason: string;
+    guidance: string;
+    nextCommand: string;
+    /**
+     * Carried on POST-resolution failures (`invalid-key` / `invalid-url`) only — the cascade got
+     * far enough to know which profile won, it just then rejected what that profile held. Label
+     * surfaces need it for the same reason the ok branch does: re-deriving the name gets a
+     * DIFFERENT answer (a PB_PROFILE naming a missing profile falls through to the active one),
+     * so a validation failure would otherwise be attributed to the wrong profile. Absent on
+     * refusals raised before a winner exists.
+     */
+    profileName?: string;
+    /** Companion to `profileName`, for the branches that HAVE no profile name — a dotenv file
+     *  in this directory, say. Same reason: the failure still knows which binding it rejected. */
+    source?: ConfigSource;
+};
+/**
+ * The transport-security bar every cascade enforces: HTTPS, or http://localhost while in dev mode.
+ * Both the structured result below and `getConfigOrGuide()`'s throwing path read it from here so
+ * the two can never diverge on what counts as a safe gateway to send an API key to.
+ */
+export declare function isInsecureSiteUrl(siteUrl: string): boolean;
+/** A resolution refusal that diagnostic surfaces must preserve instead of relabelling. */
+export declare class ConfigResolutionError extends CLIError {
+    readonly kind: ConfigFailureKind;
+    readonly nextCommand: string;
+    constructor(message: string, options: {
+        kind: ConfigFailureKind;
+        nextCommand: string;
+        code?: ErrorCodeValue;
+        category?: ErrorCategory;
+        guidance: string;
+    });
+}
+/** Convert a throwing resolution cascade into the single diagnostic contract. */
+export declare function resolveConfigResult(resolveConfig: () => ResolvedConfig): ConfigResult;
+/**
+ * TASK-562 (RULE-657): the one no-key next step. getConfigSafe reports it and getConfig /
+ * getConfigOrGuide throw it, so every surface says connect in the project folder, never paste a key.
+ */
+export declare function missingKeyResult(): Extract<ConfigResult, {
+    ok: false;
+}>;
+export declare function missingKeyError(): CLIError;
+//# sourceMappingURL=configResult.d.ts.map

package/dist/lib/configResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configResult.d.ts","sourceRoot":"","sources":["../../src/lib/configResult.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAGtE,OAAO,EAAE,QAAQ,EAAa,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAG3F,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GACrB,KAAK,GACL,eAAe,GACf,aAAa,GACb,SAAS,GACT,QAAQ,GACR,KAAK,GACL,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,GAC/E;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,aAAa,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAK3E;AAED,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,MAAM,YAAY;AACtB;;;;;;;;GAQG;AACD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACzF;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;kGAC8F;IAC9F,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB,CAAC;AA0EN;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,0FAA0F;AAC1F,qBAAa,qBAAsB,SAAQ,QAAQ;IACjD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAG3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,IAAI,EAAE,iBAAiB,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,CAAC,EAAE,cAAc,CAAC;QACtB,QAAQ,CAAC,EAAE,aAAa,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;KAClB;CAOJ;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,cAAc,GAAG,YAAY,CAiErF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,YAAY,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAQvE;AAED,wBAAgB,eAAe,IAAI,QAAQ,CAG1C"}