@productbrain/cli 0.1.0-beta.1428 → 0.1.0-beta.14280

package/dist/lib/workPackageList.d.ts

@@ -0,0 +1,138 @@
+/** What orient adds to a row: the stored priority token (absent for No priority) and, on a team list only,
+ *  yours when the seat's role owns the package. */
+export type WorkPackageListMarks = {
+    priority?: string;
+    yours?: true;
+};
+/** Served only on a team list: the team's live packages, the live packages exactly one other team owns, and
+ *  the live packages with no owner or two or more (they belong to no team), so the three add up to the live total. */
+export type WorkPackageTeamCounts = {
+    team: number;
+    otherTeams: number;
+    noSingleOwner: number;
+};
+export declare const WORK_PACKAGE_LIST_WORDS: {
+    readonly yours: "[yours]";
+    /** Printed once under the heading when a row carries the mark, so a cold reader need not guess it (DEC-2445). */
+    readonly legend: "[yours] = a package your role owns";
+    readonly count: (shown: number, { team, otherTeams, noSingleOwner }: WorkPackageTeamCounts, allCommand: string) => string;
+    /** The command each surface names at the end of the count line: every live work package of the workspace, under listHeading. */
+    readonly allCommand: {
+        readonly cli: "pb brief confidence";
+        readonly mcp: "`context action=brief briefType=\"confidence\"`";
+    };
+    /** The heading of that command's list, so the count line and the list use one word. */
+    readonly listHeading: "Live work packages";
+    /** That list's last line when it stopped at its cap; the brief has no way to continue past it. */
+    readonly listStops: (cap: number) => string;
+    /** A tension linked to a row, named and with its id so a reader can open it; each surface adds its own indent. */
+    readonly tension: (t: {
+        entryId: string | null;
+        name: string;
+    }) => string;
+    readonly setOne: "Set one (urgent, high, medium or low):";
+    /** The command each surface prints after setOne, ending the line so it pastes whole; a live priority change asks one line of why (DEC-2418). */
+    readonly setCommand: {
+        readonly cli: "pb update <WP-ID> -f priority=high --change-reason \"<why>\"";
+        readonly mcp: "`entries action=update entryId=\"<WP-ID>\" data={\"priority\":\"high\"} changeReason=\"<why>\"`";
+    };
+};
+/** The level word a row is listed under: one of the five, No priority for anything else. */
+export declare function priorityWord(value: unknown): string;
+export type WorkPackageListSurface<R> = {
+    /** The row's own lines; `mark` is the yours mark with its leading space, or ''. */
+    row: (row: R, mark: string) => string[];
+    heading: (word: string) => string;
+    /** The surface's command from WORK_PACKAGE_LIST_WORDS.setCommand, printed after setOne. */
+    setCommand: string;
+    /** The surface's command from WORK_PACKAGE_LIST_WORDS.allCommand, ending the count line. */
+    allCommand: string;
+};
+/**
+ * Rows arrive in orient's order (priority first). With no counts (no team bound) and no priority on any
+ * row, the lines are exactly the rows: the list a session saw before priorities existed. A heading is
+ * printed for each level present once any row has a priority; a team list leads with the count line,
+ * the yours legend when a row is marked, and the Set one hint when none of its rows has a priority.
+ */
+export declare function workPackageListLines<R extends WorkPackageListMarks>(rows: readonly R[], counts: WorkPackageTeamCounts | undefined, surface: WorkPackageListSurface<R>): string[];
+/** One open task a role owns outside a live package (DEC-2459): the stored priority token (absent for No priority), in progress
+ *  only on that stage, no owner only on the Team Lead's list for a task no role owns, packageClosed when its only packages are closed. */
+export type OpenTaskRow = {
+    entryId: string;
+    name: string;
+    priority?: string;
+    inProgress?: true;
+    noOwner?: true;
+    packageClosed?: true;
+};
+/** The read's answer: the role, its rows in the one order (priority, stage, last updated), and whether the read stopped at
+ *  its cap; `cappedAt` is how many records it had read when it stopped. */
+export type OpenTaskList = {
+    role: {
+        entryId: string | null;
+        name: string;
+    };
+    rows: OpenTaskRow[];
+    capped: boolean;
+    cappedAt?: number;
+};
+/** What orient serves: the first `shown` rows of the read, and how many it found in all, so the cut note can count the rest. */
+export type OrientOpenTasks = OpenTaskList & {
+    total: number;
+};
+/** The surface a list prints on: it picks the command below. */
+export type OpenTaskSurface = 'cli' | 'mcp';
+/** The words of a role's open-task list (DEC-2459, shaped by Product Design 2026-10-30): orient and the tasks list alike. */
+export declare const OPEN_TASK_LIST_WORDS: {
+    readonly heading: (roleName: string) => string;
+    readonly separator: " · ";
+    readonly inProgress: "(in progress)";
+    readonly noOwner: "(no owner)";
+    /** After a task whose package parents are all done or archived, so the agent finishes it or closes it (Product Design 2026-10-30). */
+    readonly packageClosed: "(its package is closed)";
+    /** Orient shows at most this many rows; the cut note names the command for the rest. */
+    readonly shown: 5;
+    readonly more: (hidden: number, capped: boolean, allCommand: string) => string;
+    readonly allCommand: {
+        readonly cli: "pb tasks list";
+        readonly mcp: "`context action=tasks`";
+    };
+    readonly compact: (count: number, capped: boolean, roleName: string) => string;
+    /** Only for a read that was not cut: a capped read that found none prints its capped line instead, never this. */
+    readonly empty: (roleName: string) => string;
+    /** The tasks list's last line when another page follows. */
+    readonly nextPage: (command: string) => string;
+    /** Printed whenever the read stopped at its cap, so rows it never read are not taken for none (signed by Voice, 2026-10-30).
+     *  The read goes newest ownership first, so what it leaves out is what the role has owned longest. */
+    readonly capped: (records: number) => string;
+    /** The read's refusal when no role is named and the session acts in none; each surface adds noRole with its own command. */
+    readonly noSessionRole: "This session acts in no role.";
+    readonly noRole: (command: string) => string;
+    /** A cursor that is not a page number; the CLI refuses it rather than reading page 1. */
+    readonly badCursor: (value: string) => string;
+};
+/** Each surface's command with its role and cursor inputs, built from allCommand so it is spelled once. */
+export declare function openTaskCommand(surface: OpenTaskSurface, input?: {
+    role?: string;
+    cursor?: number;
+}): string;
+/** `<priority word> · <TASK-id> — <name>`, then the in-progress, no-owner and package-closed marks; each surface adds its own bullet. */
+export declare function openTaskRowText(row: OpenTaskRow): string;
+/** The rows under the heading: at most `shown` (all when absent), then the cut note when rows were left out, then the
+ *  capped line whenever the read stopped at its cap; the cut note's count then reads "n+", since rows past the cap were never read. */
+export declare function openTaskListLines(list: OpenTaskList, surface: {
+    bullet: string;
+    surface: OpenTaskSurface;
+    shown?: number;
+    total?: number;
+}): string[];
+/** Orient's section: nothing when the role owns none and the read was not cut (a cut read that found none still prints the heading
+ *  and its capped line, never silence); otherwise the heading, at most `shown` rows, the cut note and the capped line. */
+export declare function openTaskSectionLines(list: OrientOpenTasks | undefined, surface: {
+    heading: (text: string) => string;
+    bullet: string;
+    surface: OpenTaskSurface;
+}): string[];
+/** Orient's compact count, on the same guard as the section. */
+export declare function openTaskCompactLines(list: OrientOpenTasks | undefined): string[];
+//# sourceMappingURL=workPackageList.d.ts.map

package/dist/lib/workPackageList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workPackageList.d.ts","sourceRoot":"","sources":["../../src/lib/workPackageList.ts"],"names":[],"mappings":"AAgBA;mDACmD;AACnD,MAAM,MAAM,oBAAoB,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAEvE;sHACsH;AACtH,MAAM,MAAM,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAKhG,eAAO,MAAM,uBAAuB;;IAEnC,iHAAiH;;4BAElG,MAAM,uCAAuC,qBAAqB,cAAc,MAAM;IAGrG,gIAAgI;;;;;IAKhI,uFAAuF;;IAEvF,kGAAkG;8BACjF,MAAM;IACvB,kHAAkH;0BACrG;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;;IAErD,gJAAgJ;;;;;CAKvI,CAAC;AAEX,4FAA4F;AAC5F,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGnD;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAAI;IACvC,mFAAmF;IACnF,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACxC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAClC,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,oBAAoB,EAClE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,qBAAqB,GAAG,SAAS,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAC/F,MAAM,EAAE,CAeV;AAED;0IAC0I;AAC1I,MAAM,MAAM,WAAW,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAExI;2EAC2E;AAC3E,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,EAAE,WAAW,EAAE,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvI,gIAAgI;AAChI,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,CAAC;AAE5C,6HAA6H;AAC7H,eAAO,MAAM,oBAAoB;iCACZ,MAAM;;;;IAI1B,sIAAsI;;IAEtI,wFAAwF;;4BAEzE,MAAM,UAAU,OAAO,cAAc,MAAM;;;;;8BAEzC,MAAM,UAAU,OAAO,YAAY,MAAM;IAC1D,kHAAkH;+BAChG,MAAM;IACxB,4DAA4D;iCACxC,MAAM;IAC1B;0GACsG;+BACpF,MAAM;IACxB,4HAA4H;;+BAE1G,MAAM;IACxB,yFAAyF;gCACtE,MAAM;CAChB,CAAC;AAEX,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAMhH;AAED,yIAAyI;AACzI,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAIxD;AAED;uIACuI;AACvI,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAQrJ;AAED;0HAC0H;AAC1H,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,EAAE,OAAO,EAAE;IAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAAG,MAAM,EAAE,CAI1K;AAED,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,GAAG,MAAM,EAAE,CAGhF"}

package/dist/lib/workPackageList.js

@@ -0,0 +1,139 @@
+// GENERATED by scripts/generate-mcp-embedded-copies.mjs from kernel/entries/workPackageList.ts.
+// DO NOT EDIT. Run `npm run mcp:embedded-copies` to regenerate.
+// Local runtime copy for the isolated connector build.
+/**
+ * The work-package list orient prints (DEC-2426, RULE-664): rows grouped under the level words in
+ * priority order, the yours mark and its legend, the count line with the command for every package, the
+ * tension lines and the Set one hint. Every word comes from here or from priority.ts (signed in DEC-2445);
+ * each surface renders its own row and heading and picks its commands from here. Beside it, a role's open tasks outside
+ * a package (DEC-2459): OPEN_TASK_LIST_WORDS and the rows orient and the tasks list print.
+ *
+ * Copied verbatim into both connector packages by scripts/generate-mcp-embedded-copies.mjs (the
+ * ./priority import rewritten to ./priority.js), since neither connector can import the kernel at runtime.
+ */
+import { NO_PRIORITY, PRIORITY_LEVELS, priorityOf } from './priority.js';
+/** What the command for every package prints, said after it so a cold reader trusts a command named for confidence (DEC-2445 amended 2026-10-30). */
+const ALL_COMMAND_SAYS = 'lists every live package';
+export const WORK_PACKAGE_LIST_WORDS = {
+    yours: '[yours]',
+    /** Printed once under the heading when a row carries the mark, so a cold reader need not guess it (DEC-2445). */
+    legend: '[yours] = a package your role owns',
+    count: (shown, { team, otherTeams, noSingleOwner }, allCommand) => `Showing ${shown} of your team's ${team} live package${team === 1 ? '' : 's'}; ${otherTeams} more in other teams`
+        + `${noSingleOwner > 0 ? `; ${noSingleOwner} more with no single owner` : ''}. All ${team + otherTeams + noSingleOwner}: ${allCommand} (${ALL_COMMAND_SAYS})`,
+    /** The command each surface names at the end of the count line: every live work package of the workspace, under listHeading. */
+    allCommand: {
+        cli: 'pb brief confidence',
+        mcp: '`context action=brief briefType="confidence"`',
+    },
+    /** The heading of that command's list, so the count line and the list use one word. */
+    listHeading: 'Live work packages',
+    /** That list's last line when it stopped at its cap; the brief has no way to continue past it. */
+    listStops: (cap) => `More than ${cap} live packages; the list stops here.`,
+    /** A tension linked to a row, named and with its id so a reader can open it; each surface adds its own indent. */
+    tension: (t) => `↳ tension${t.entryId ? ` ${t.entryId}` : ''}: ${t.name}`,
+    setOne: 'Set one (urgent, high, medium or low):',
+    /** The command each surface prints after setOne, ending the line so it pastes whole; a live priority change asks one line of why (DEC-2418). */
+    setCommand: {
+        cli: 'pb update <WP-ID> -f priority=high --change-reason "<why>"',
+        mcp: '`entries action=update entryId="<WP-ID>" data={"priority":"high"} changeReason="<why>"`',
+    },
+};
+/** The level word a row is listed under: one of the five, No priority for anything else. */
+export function priorityWord(value) {
+    const token = priorityOf(value);
+    return token ? PRIORITY_LEVELS[token].word : NO_PRIORITY.word;
+}
+/**
+ * Rows arrive in orient's order (priority first). With no counts (no team bound) and no priority on any
+ * row, the lines are exactly the rows: the list a session saw before priorities existed. A heading is
+ * printed for each level present once any row has a priority; a team list leads with the count line,
+ * the yours legend when a row is marked, and the Set one hint when none of its rows has a priority.
+ */
+export function workPackageListLines(rows, counts, surface) {
+    const lines = [];
+    const anyPriority = rows.some((row) => priorityOf(row.priority) !== null);
+    // TASK-1496: with nothing live there is no count line, so no command is named for a list that is empty.
+    if (counts && counts.team + counts.otherTeams + counts.noSingleOwner > 0)
+        lines.push(WORK_PACKAGE_LIST_WORDS.count(rows.length, counts, surface.allCommand));
+    if (rows.some((row) => row.yours))
+        lines.push(WORK_PACKAGE_LIST_WORDS.legend);
+    if (counts && rows.length > 0 && !anyPriority)
+        lines.push(`${WORK_PACKAGE_LIST_WORDS.setOne} ${surface.setCommand}`);
+    let level;
+    for (const row of rows) {
+        const word = priorityWord(row.priority);
+        if (anyPriority && word !== level)
+            lines.push(surface.heading(word));
+        level = word;
+        lines.push(...surface.row(row, row.yours ? ` ${WORK_PACKAGE_LIST_WORDS.yours}` : ''));
+    }
+    return lines;
+}
+/** The words of a role's open-task list (DEC-2459, shaped by Product Design 2026-10-30): orient and the tasks list alike. */
+export const OPEN_TASK_LIST_WORDS = {
+    heading: (roleName) => `${roleName}'s open tasks, not in a live package`,
+    separator: ' · ',
+    inProgress: '(in progress)',
+    noOwner: '(no owner)',
+    /** After a task whose package parents are all done or archived, so the agent finishes it or closes it (Product Design 2026-10-30). */
+    packageClosed: '(its package is closed)',
+    /** Orient shows at most this many rows; the cut note names the command for the rest. */
+    shown: 5,
+    more: (hidden, capped, allCommand) => `${hidden}${capped ? '+' : ''} more: ${allCommand}`,
+    allCommand: { cli: 'pb tasks list', mcp: '`context action=tasks`' },
+    compact: (count, capped, roleName) => `${count}${capped ? '+' : ''} open task(s) of ${roleName}, not in a live package`,
+    /** Only for a read that was not cut: a capped read that found none prints its capped line instead, never this. */
+    empty: (roleName) => `${roleName} has no open tasks outside a live package.`,
+    /** The tasks list's last line when another page follows. */
+    nextPage: (command) => `More: ${command}`,
+    /** Printed whenever the read stopped at its cap, so rows it never read are not taken for none (signed by Voice, 2026-10-30).
+     *  The read goes newest ownership first, so what it leaves out is what the role has owned longest. */
+    capped: (records) => `Read stopped at ${records} records; the tasks this role has owned longest are not listed.`,
+    /** The read's refusal when no role is named and the session acts in none; each surface adds noRole with its own command. */
+    noSessionRole: 'This session acts in no role.',
+    noRole: (command) => `Name the role: ${command}`,
+    /** A cursor that is not a page number; the CLI refuses it rather than reading page 1. */
+    badCursor: (value) => `Cursor ${value} is not a page number. Use the number the last page printed.`,
+};
+/** Each surface's command with its role and cursor inputs, built from allCommand so it is spelled once. */
+export function openTaskCommand(surface, input = {}) {
+    if (surface === 'cli') {
+        return `${OPEN_TASK_LIST_WORDS.allCommand.cli}${input.role ? ` --role ${input.role}` : ''}${input.cursor !== undefined ? ` --cursor ${input.cursor}` : ''}`;
+    }
+    const bare = OPEN_TASK_LIST_WORDS.allCommand.mcp.slice(1, -1); // the command inside its backticks
+    return `${bare}${input.role ? ` roleId=${input.role}` : ''}${input.cursor !== undefined ? ` cursor=${input.cursor}` : ''}`;
+}
+/** `<priority word> · <TASK-id> — <name>`, then the in-progress, no-owner and package-closed marks; each surface adds its own bullet. */
+export function openTaskRowText(row) {
+    const w = OPEN_TASK_LIST_WORDS;
+    const marks = [row.inProgress && w.inProgress, row.noOwner && w.noOwner, row.packageClosed && w.packageClosed].filter(Boolean);
+    return `${priorityWord(row.priority)}${w.separator}${row.entryId} — ${row.name}${marks.map((m) => ` ${m}`).join('')}`;
+}
+/** The rows under the heading: at most `shown` (all when absent), then the cut note when rows were left out, then the
+ *  capped line whenever the read stopped at its cap; the cut note's count then reads "n+", since rows past the cap were never read. */
+export function openTaskListLines(list, surface) {
+    const shown = Math.min(surface.shown ?? list.rows.length, list.rows.length);
+    const total = surface.total ?? list.rows.length; // orient passes the read's total, since it serves only the first rows
+    const lines = list.rows.slice(0, shown).map((row) => `${surface.bullet}${openTaskRowText(row)}`);
+    const allCommand = surface.surface === 'cli' ? OPEN_TASK_LIST_WORDS.allCommand.cli : OPEN_TASK_LIST_WORDS.allCommand.mcp;
+    if (total > shown)
+        lines.push(OPEN_TASK_LIST_WORDS.more(total - shown, list.capped, allCommand));
+    if (list.capped)
+        lines.push(OPEN_TASK_LIST_WORDS.capped(list.cappedAt ?? total));
+    return lines;
+}
+/** Orient's section: nothing when the role owns none and the read was not cut (a cut read that found none still prints the heading
+ *  and its capped line, never silence); otherwise the heading, at most `shown` rows, the cut note and the capped line. */
+export function openTaskSectionLines(list, surface) {
+    if (!list || (list.total === 0 && !list.capped))
+        return [];
+    const rows = openTaskListLines(list, { bullet: surface.bullet, surface: surface.surface, shown: OPEN_TASK_LIST_WORDS.shown, total: list.total });
+    return [surface.heading(OPEN_TASK_LIST_WORDS.heading(list.role.name)), ...rows];
+}
+/** Orient's compact count, on the same guard as the section. */
+export function openTaskCompactLines(list) {
+    if (!list || (list.total === 0 && !list.capped))
+        return [];
+    return [OPEN_TASK_LIST_WORDS.compact(list.total, list.capped, list.role.name)];
+}
+//# sourceMappingURL=workPackageList.js.map

package/dist/lib/workPackageList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workPackageList.js","sourceRoot":"","sources":["../../src/lib/workPackageList.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,gEAAgE;AAChE,uDAAuD;AAEvD;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAUzE,qJAAqJ;AACrJ,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACtC,KAAK,EAAE,SAAS;IAChB,iHAAiH;IACjH,MAAM,EAAE,oCAAoC;IAC5C,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAyB,EAAE,UAAkB,EAAE,EAAE,CACxG,WAAW,KAAK,mBAAmB,IAAI,gBAAgB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,sBAAsB;UAC/G,GAAG,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,4BAA4B,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,GAAG,UAAU,GAAG,aAAa,KAAK,UAAU,KAAK,gBAAgB,GAAG;IAC9J,gIAAgI;IAChI,UAAU,EAAE;QACX,GAAG,EAAE,qBAAqB;QAC1B,GAAG,EAAE,+CAA+C;KACpD;IACD,uFAAuF;IACvF,WAAW,EAAE,oBAAoB;IACjC,kGAAkG;IAClG,SAAS,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,aAAa,GAAG,sCAAsC;IAClF,kHAAkH;IAClH,OAAO,EAAE,CAAC,CAA2C,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE;IACnH,MAAM,EAAE,wCAAwC;IAChD,gJAAgJ;IAChJ,UAAU,EAAE;QACX,GAAG,EAAE,4DAA4D;QACjE,GAAG,EAAE,yFAAyF;KAC9F;CACQ,CAAC;AAEX,4FAA4F;AAC5F,MAAM,UAAU,YAAY,CAAC,KAAc;IAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;AAC/D,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CACnC,IAAkB,EAAE,MAAyC,EAAE,OAAkC;IAEjG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1E,wGAAwG;IACxG,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,aAAa,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7J,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC9E,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACrH,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,WAAW,IAAI,IAAI,KAAK,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,KAAK,GAAG,IAAI,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAgBD,6HAA6H;AAC7H,MAAM,CAAC,MAAM,oBAAoB,GAAG;IACnC,OAAO,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,GAAG,QAAQ,sCAAsC;IAChF,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,YAAY;IACrB,sIAAsI;IACtI,aAAa,EAAE,yBAAyB;IACxC,wFAAwF;IACxF,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC,MAAc,EAAE,MAAe,EAAE,UAAkB,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,UAAU,EAAE;IAClH,UAAU,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,wBAAwB,EAAE;IACnE,OAAO,EAAE,CAAC,KAAa,EAAE,MAAe,EAAE,QAAgB,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oBAAoB,QAAQ,yBAAyB;IAChJ,kHAAkH;IAClH,KAAK,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,GAAG,QAAQ,4CAA4C;IACpF,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,SAAS,OAAO,EAAE;IACjD;0GACsG;IACtG,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,mBAAmB,OAAO,iEAAiE;IACxH,4HAA4H;IAC5H,aAAa,EAAE,+BAA+B;IAC9C,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,kBAAkB,OAAO,EAAE;IACxD,yFAAyF;IACzF,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,KAAK,8DAA8D;CAClG,CAAC;AAEX,2GAA2G;AAC3G,MAAM,UAAU,eAAe,CAAC,OAAwB,EAAE,QAA4C,EAAE;IACvG,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACvB,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7J,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,mCAAmC;IAClG,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5H,CAAC;AAED,yIAAyI;AACzI,MAAM,UAAU,eAAe,CAAC,GAAgB;IAC/C,MAAM,CAAC,GAAG,oBAAoB,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/H,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACvH,CAAC;AAED;uIACuI;AACvI,MAAM,UAAU,iBAAiB,CAAC,IAAkB,EAAE,OAAqF;IAC1I,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,sEAAsE;IACvH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjG,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC;IACzH,IAAI,KAAK,GAAG,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACjG,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACd,CAAC;AAED;0HAC0H;AAC1H,MAAM,UAAU,oBAAoB,CAAC,IAAiC,EAAE,OAAwF;IAC/J,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjJ,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,IAAiC;IACrE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC"}

package/dist/lib/workspace-probe.d.ts

@@ -12,8 +12,17 @@
  * Uses resolveWorkspace (registered in http.ts) rather than orient, which is
  * not exposed on the HTTP gateway — orient is MCP-server-only.
  */
+/** DEC-2226: the binding of a key bound to one role, as the gateway reports it (absent on a person key). */
+export type KeyBinding = {
+    name: string;
+    roleName: string;
+    roleRef: string | null;
+    delegatedBy: string | null;
+    line: string;
+};
 export declare function probeWorkspace(): Promise<{
     name: string;
     entryCount?: number;
+    key?: KeyBinding;
 } | null>;
 //# sourceMappingURL=workspace-probe.d.ts.map

package/dist/lib/workspace-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-probe.d.ts","sourceRoot":"","sources":["../../src/lib/workspace-probe.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;GAMG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAQ5F"}
+{"version":3,"file":"workspace-probe.d.ts","sourceRoot":"","sources":["../../src/lib/workspace-probe.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;GAMG;AACH,4GAA4G;AAC5G,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9H,wBAAsB,cAAc,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAAC,CAQ9G"}

package/dist/lib/workspace-probe.js

@@ -6,19 +6,12 @@
  * workspace info on success, null on any failure (network, auth, offline).
  */
 import { kernelCall } from './client.js';
-/**
- * Attempt to detect workspace connectivity via a lightweight API call.
- * Returns workspace info on success, null on any failure.
- *
- * Uses resolveWorkspace (registered in http.ts) rather than orient, which is
- * not exposed on the HTTP gateway — orient is MCP-server-only.
- */
 export async function probeWorkspace() {
     try {
         const result = await kernelCall('resolveWorkspace', {});
         if (!result)
             return null;
-        return { name: result.name || 'unknown' };
+        return { name: result.name || 'unknown', ...(result.key ? { key: result.key } : {}) };
     }
     catch {
         return null;

package/dist/lib/workspace-probe.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-probe.js","sourceRoot":"","sources":["../../src/lib/workspace-probe.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAA0C,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"workspace-probe.js","sourceRoot":"","sources":["../../src/lib/workspace-probe.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAYzC,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAA4D,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACnH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/workspaceNotice.d.ts

@@ -0,0 +1,201 @@
+/**
+ * WP-1 — Loud workspace identity on every Chain write. WP-714 S3 extended this to every
+ * Chain READ too (see `emitEffectiveTenantNotice`'s doc comment below for the read-path wiring).
+ *
+ * Running `pb` from a directory with no repo pin (e.g. `~/`) silently resolves the
+ * GLOBAL profile and writes to whichever Chain that points at — proven live: captures
+ * meant for one workspace landed on another. This module makes every Chain read or write
+ * NAME its target workspace on stderr, and qualifies the line LOUDLY when the binding is an
+ * unpinned fallback (`global`/`default` — no repo pin) so a wrong-Chain call is never
+ * silent. An explicit binding (`local`/`env`) gets a plain, non-alarming line.
+ *
+ * Label source — the PROFILE SLUG only, via `resolveReportedProfile()`: it returns
+ * `missing-pin` when the credential cascade has ALREADY refused (nothing to name — see the
+ * formatter below), and otherwise delegates to `resolveEffectiveProfile()`, whose contract
+ * the rest of this paragraph describes.
+ * Deliberately NOT a workspace-name probe: `resolveEffectiveProfile()` reports the
+ * *configured* pin even when it dangles (TEN-2163), while a probe resolves what
+ * `resolveConfig()` actually binds. On a dangling local pin the two DISAGREE — the
+ * profile says `source='local'` (a plain, reassuring line) while the probe returns the
+ * GLOBAL workspace the write really drifts to. That would print a non-alarming line over
+ * the exact silent-drift this notice exists to expose. One resolution path means the
+ * label and its qualifier can never contradict — and there is no per-write network
+ * round-trip in front of the write.
+ *
+ * Output contract — follows capture.ts's grounding banner (the JSON-safety pattern):
+ *  - The notice is written to STDERR, never stdout, so strict-JSON stdout is byte-for-byte
+ *    unchanged in every mode.
+ *  - There is NO output-mode gate at all (WP-721). Every mode — `--json`, `--quiet`, plain TTY —
+ *    gets the one-line-per-process identity notice. `--json` used to suppress the plain line for
+ *    an explicit binding, which left an agent in a correctly pinned repo with a ZERO-BYTE stderr
+ *    and no tenant signal whatsoever (see `emitEffectiveTenantNotice` below). TEN-3238 had
+ *    already exempted the unpinned-fallback WARNING from that gate; WP-721 removed the gate.
+ *
+ * NOT compared here: the repo-local pin against the globally active `pb` profile (DEC-1632,
+ * TEN-3398/WP-720 — reversing part of WP-714 S3/PR #823). An earlier version of this module
+ * warned on that divergence on every read and write. But the pin exists precisely to OVERRIDE
+ * global, and `pb profile use` reconciles the two by default (`--local`/`--global` are the
+ * opt-in ways to diverge them) — so a divergence is only ever a deliberate act, never drift.
+ * Warning on it forever trained operators to ignore the warning: one global profile and ten
+ * pinned workspaces means nine permanent warnings on entirely correct setups. That comparison
+ * belongs at the POINT OF ACTION instead — `pb profile use --global <name>` says so once, right
+ * when an operator creates the divergence (see `commands/profile.ts`'s `pinnedElsewhere` note) —
+ * never ambiently on every read or write after the fact. The three comparisons that DO still
+ * belong here share one shape pin-vs-global didn't: *the effective tenant is not what your
+ * binding SAYS* — no explicit binding at all (the unpinned-fallback warning below), a credential
+ * silently overriding the binding (`env-key`/`local-key`/`cwd-key`, in the loud set below), or
+ * the binding moving mid-session (`sessionBinding.ts`'s refusal). Pin-vs-global was a different
+ * comparison that got mistaken for one of these.
+ *
+ * SSOT: one pure formatter + one thin emitter — called explicitly from the 7 write-command
+ * files (8 call sites) and once per process from the shared kernel wrapper (`client.ts`'s
+ * `kernelCall`/`kernelCallWithSession` — TEN-3398/WP-711 follow-up wired
+ * the write path in too, see `emitEffectiveTenantNotice`'s doc comment below) — no per-command
+ * copy-paste.
+ *
+ * `pb admin` is a SEPARATE credential cascade (`adminConfig.ts`'s `resolveAdminConfig`) that
+ * deliberately excludes CWD env files (TEN-1334); neither cascade reads committed `config.json`
+ * siteUrl (TEN-4500). It can resolve a different tenant than the cascade above, so it gets its own formatter-reusing
+ * emitter (`emitAdminTenantNotice`/`describeAdminTenantForRefusal` below) rather than sharing
+ * `emitEffectiveTenantNotice`'s guard or resolution path.
+ */
+import { type ReportedProfileSource } from './reportedProfile.js';
+import type { AdminConfigSource } from './adminConfig.js';
+import { assertSessionStillBound } from './sessionBinding.js';
+/** Inputs to the pure notice formatter. */
+export interface EffectiveTenantNoticeInput {
+    /** Effective profile name (the configured pin / identity), or null when unconfigured. */
+    profile: string | null;
+    /** Where that profile came from — see resolveReportedProfile(). */
+    source: ReportedProfileSource;
+}
+/**
+ * Build the one-line target-workspace notice — or null when there is nothing to say.
+ *
+ *  - `none`               → null (not configured: nothing to name, stay silent).
+ *  - `missing-pin`        → null (declared project, no pin: the CLI REFUSES this write, so
+ *                           there is no target workspace to name — and never `→ unknown`).
+ *  - `cwd-key`            → LOUD, unnamed (a dotenv file here picked the Chain — same shape as
+ *                           `env-key`, different file).
+ *  - `env-key`            → LOUD, unnamed (an exported PRODUCTBRAIN_API_KEY picked the Chain;
+ *                           no profile describes it, so the write goes somewhere this process
+ *                           cannot name from config — TEN-3240).
+ *  - `preview`            → named + disposable (a deliberate `npm run pb:preview` binding; the
+ *                           PREVIEW banner already shouts, so this does not shout twice).
+ *  - `global` / `default` → qualified + hint (no repo pin → an unpinned fallback binding).
+ *  - `local` / `env`      → plain (an explicit, intentional binding).
+ *
+ * Pure: no IO. The display label is the profile slug — a single resolution path, so the
+ * label and the qualifier can never contradict each other. DEC-1632/TEN-3398: no longer
+ * compares the pin against the globally active profile — see this module's header comment.
+ */
+export declare function formatEffectiveTenantNotice({ profile, source }: EffectiveTenantNoticeInput): string | null;
+/**
+ * The ONE place a `(profile, source)` pair maps to a human-readable label — no "→" prefix, so
+ * it can be embedded in prose (the tenant notice's base line, and WP-715's session-binding
+ * refusal message) rather than only ever printed as a standalone line. `formatEffectiveTenantNotice`
+ * above is the notice-line caller; `describeCurrentTenant` further down is the prose caller.
+ */
+export declare function describeReportedTenant(profile: string | null, source: ReportedProfileSource): string | null;
+/**
+ * Full prose description of the tenant CURRENTLY IN PLAY, for embedding in a message whose
+ * whole point is naming it — e.g. the session-binding refusal at `sessionBinding.ts` (WP-715).
+ * Unlike `formatEffectiveTenantNotice`, this never drops a shadowed repo pin: it states it explicitly, so
+ * a refusal reading "expected X, found Y" can never render the SAME tenant on both sides (the
+ * bug this closes — `resolveEffectiveProfile().profile` is blind to a credential override, so it
+ * always named the pin even while a foreign key was the one actually in play). Returns undefined
+ * when no tenant can be named, and the rebound line then says "a different workspace".
+ *
+ * Deliberately UNQUOTED, including the shadowed pin: the rebound line in `style.ts`'s `copy`
+ * is the one place that wraps this whole value in quotes (the same
+ * line quotes `expected` too), so quoting the pin here as well double-quoted its closing
+ * mark (`...pin "product-brain""`) — cosmetic, but it reads like a typo in the exact message an
+ * agent surfaces to a human. This function owns zero quoting; the template owns all of it.
+ */
+export declare function describeCurrentTenant(profile: string | null, source: ReportedProfileSource): string | undefined;
+/**
+ * Live-resolving wrapper for `client.ts`'s `describeCurrent` thunk (WP-715): re-runs
+ * `resolveReportedProfile()` — never `resolveEffectiveProfile()`, which is blind to a
+ * credential override — so a session-binding refusal always names the tenant a call would
+ * actually land in. Kept here, not client.ts, so that call site stays a one-liner.
+ */
+export declare function describeCurrentTenantForRefusal(): string | undefined;
+/** Test-only: reset the once-per-process guard between cases (mirrors resetReportedProfileSnapshot). */
+export declare function resetEffectiveTenantNoticeForTests(): void;
+/**
+ * Resolve identity and write the target notice to STDERR — for every Chain read OR write, in
+ * EVERY output mode. WP-714 S3: originally called only from the 8 explicit write call sites;
+ * then ALSO called once per process from `client.ts`'s `kernelCall` (the
+ * plain, non-session read path), so every read command that reaches the kernel announces too.
+ *
+ * ALSO wired into `kernelCallWithSession` (the write path) directly (TEN-3398 / WP-711
+ * follow-up). This comment used to claim that wiring was unnecessary because "every write
+ * command already calls this explicitly" — that premise was false: a census of every command
+ * module reaching `kernelCallWithSession` found 11 write commands (`accept-policy.ts`,
+ * `audit.ts`, `conflicts.ts`, `direction.ts`, `feedback.ts`, `handshake.ts` (since deleted), `method.ts`,
+ * `questions.ts`, `rework.ts`, `shape.ts`, `verify.ts`) that never called this at all — a
+ * silent write with no target-workspace line, `chain.verifyEntry` and `rework.report` among
+ * them. A handful of write commands (`capture`/`promote`/`relate`/`restore`/`session`/
+ * `update`, plus the shared `organisationWrite.ts`/`runOrganisationWrite` helper used by
+ * `organisation.ts`/`organisationHierarchy.ts`) still call it explicitly, earlier in their own
+ * flow than any call `kernelCallWithSession` makes (e.g. `update`'s post-write
+ * `chain.getEntry` refresh) — the once-per-process guard makes `kernelCallWithSession`'s own
+ * call a no-op for those, so their output is unchanged bit-for-bit.
+ *
+ * Takes NO output-mode argument (WP-721). It used to take a `json` boolean that suppressed the
+ * plain line for an explicit binding; that parameter existed only to feed the gate, so it went
+ * with the gate rather than lingering as an ignored argument inviting the gate's return. The
+ * full reasoning is at the (now unconditional) emit inside the body — in short: `--json` is how
+ * agents invoke pb, agents are the bulk of both readers and writers, and a one-line-per-process
+ * stderr receipt naming the target Chain is the signal, not the noise. TEN-3238 had already made
+ * the unpinned-fallback WARNING survive `--json` for the same reason; WP-721 finished the job for
+ * the identity line itself. Safe in every mode because the notice goes to STDERR, so strict JSON
+ * on stdout stays byte-for-byte unchanged (and the CLI already writes unconditional stderr
+ * warnings elsewhere, e.g. the preview-scrub misroute in config.ts).
+ *
+ * DEC-1632/TEN-3398: does NOT compare the repo-local pin against the globally active profile —
+ * removed entirely (see this module's header comment). A prior version attached a "differs
+ * from the globally active Chain profile" line here that survived `--json` (WP-714 S3, PR
+ * #823); that line is gone, not just re-gated, because the pin existing to override global was
+ * never a warning-worthy condition in the first place.
+ *
+ * Never throws and does no network IO: a wrong/unreadable config degrades to silence, and
+ * the label comes from `resolveReportedProfile()` — only fast local config reads (no probe)
+ * in front of the call. It is safe to call immediately before any Chain read or write.
+ */
+export declare function emitEffectiveTenantNotice(): Promise<void>;
+/**
+ * `pb admin`'s own identity, as `resolveAdminConfig()` actually resolved it — for
+ * `emitAdminTenantNotice`/`describeAdminTenantForRefusal` below (TEN-3398 / WP-711 follow-up).
+ */
+export interface AdminTenantIdentity {
+    profileName: string | null;
+    source: AdminConfigSource;
+}
+/** Test-only: reset admin's once-per-identity guard between cases. */
+export declare function resetAdminTenantNoticeForTests(): void;
+/**
+ * Resolve identity and write `pb admin`'s target notice to STDERR — once per DISTINCT identity
+ * per process (TEN-3398 / WP-711 follow-up: `adminCall` previously carried no notice at all,
+ * the one gap left after WP-712/WP-714 S3 covered every other kernel path).
+ *
+ * Unlike `emitEffectiveTenantNotice`, this NEVER suppresses under `--json` and has no
+ * "unpinned fallback" vs "explicit binding" distinction: every `pb admin` command can be a
+ * destructive bulk operation (`manage:delete-workspace`, `seed:backfill-starter`), so the
+ * identity line is never noise to cut, in any mode.
+ */
+export declare function emitAdminTenantNotice(admin: AdminTenantIdentity): void;
+/**
+ * Prose description of `pb admin`'s CURRENT tenant, for embedding in the
+ * `assertSessionStillBound` refusal message — mirrors `describeCurrentTenantForRefusal`'s role
+ * on the non-admin path, but resolved off `resolveAdminConfig()`'s own identity rather than
+ * `resolveReportedProfile()`, for the same reason `adminSourceToReportedSource` exists.
+ */
+export declare function describeAdminTenantForRefusal(admin: AdminTenantIdentity): string | undefined;
+/**
+ * Announce AND guard one `pb admin` call in a single call (TEN-3398 / WP-711 follow-up) — kept
+ * here, not `client.ts`'s `adminCall` (STD-2/DEC-1504 module-health budget), so `adminCall`
+ * stays a one-liner and this module owns the whole admin-identity story end to end.
+ */
+export declare function guardAdminCall(admin: AdminTenantIdentity, session: Parameters<typeof assertSessionStillBound>[0], fingerprint: string): void;
+//# sourceMappingURL=workspaceNotice.d.ts.map

package/dist/lib/workspaceNotice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceNotice.d.ts","sourceRoot":"","sources":["../../src/lib/workspaceNotice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IACzC,yFAAyF;IACzF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mEAAmE;IACnE,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,0BAA0B,GAAG,MAAM,GAAG,IAAI,CAG1G;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAuB3G;AAmBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,GAAG,MAAM,GAAG,SAAS,CAK/G;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,IAAI,MAAM,GAAG,SAAS,CAGpE;AAYD,wGAAwG;AACxG,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAuC/D;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAwCD,sEAAsE;AACtE,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAStE;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAE5F;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,EACtD,WAAW,EAAE,MAAM,GAClB,IAAI,CAGN"}