@productbrain/cli 0.1.0-beta.1428 → 0.1.0-beta.14295

package/dist/lib/limits.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The entry limits every surface shares, in CHARACTERS (`string.length`) except where a name says
+ * otherwise. One file, so a number cannot drift between the server, the CLI and the MCP schemas.
+ *
+ * Body: 150,000 characters is the founder's ruling of 2026-10-03 (DEC-1853): the only physical
+ * ceiling is Convex's 1 MiB document, and every version row copies the body. `getDefaultConstraints`
+ * reads it for every collection's `body` field whatever its display hint, and for the `hero` hint
+ * (guards.ts; DEC-1880); the server create/update doors, the deploy fold
+ * step and the MCP capture/workflow schemas read it too (TASK-536, TASK-537; WP-791).
+ *
+ * Dependency-free: scripts/generate-mcp-embedded-copies.mjs copies it verbatim into the MCP server,
+ * because the MCP package builds alone on Railway (packages/mcp-server/Dockerfile) and so cannot
+ * import the kernel at runtime (DEC-1481; bundling the kernel at publish is DEC-1455, post-launch).
+ */
+export declare const ENTRY_BODY_MAX_CHARS = 150000;
+/**
+ * A rule's title limit, in UTF-8 bytes (RULE-703, DEC-2219): the rule row of the name cap table below. It is defined here, with
+ * the other name caps, because this file is copied verbatim into the connectors and cannot import the rule lists; the rule
+ * lists (kernel/governance/ruleLists.ts) re-export it and the rule gate refuses with it, so the number lives once.
+ */
+export declare const RULE_TITLE_MAX_BYTES = 110;
+/**
+ * The cap on an entry's `name` (top-level, not a data field) per kind (DEC-2512, DEC-2343, DEC-2550, DEC-2552): the one table
+ * every surface reads, so no other file holds a cap number. Characters are code points; the rule row is bytes. An objective or
+ * key result holds one label line (the Rail's); working kinds one short line, purpose, vision and strategy a sentence; every
+ * other collection keeps 250 until a ruling names it.
+ */
+export declare const ENTRY_NAME_CAPS: {
+    readonly outcome: 40;
+    readonly working: 80;
+    readonly rule: 110;
+    readonly direction: 250;
+    readonly other: 250;
+};
+/** The longest name any kind may hold, derived from the table: the bound for a path that cannot know the kind (a schema, a platform seed). */
+export declare const ENTRY_NAME_MAX_CHARS: number;
+/** A name's length as a person counts it: code points, never bytes or UTF-16 units (one emoji is one character). */
+export declare function nameChars(name: string): number;
+/** The cap on a name in this collection (the catalog slug), in characters; a rule's is in bytes. A slug with no row of its own, or none, takes the `other` cap. */
+export declare function nameCapFor(collectionSlug: string | null | undefined): number;
+/** What a name refusal says to do, in words; the surface adds its own way to do it (DEC-1994). */
+export declare const NAME_REFUSAL_FIX = "Shorten the name; the detail goes in the body.";
+/**
+ * The one refusal for a name over its kind's cap, with the count and the cap (RULE-17), or null when the name fits. Every
+ * door that writes a name says this and nothing else (RULE-664). A rule's title is held in bytes by the rule gate, which
+ * refuses with its own sentence (`ruleLengthRefusal`), so this says nothing for the rule row.
+ */
+export declare function entryNameRefusal(name: string, collectionSlug: string | null | undefined): string | null;
+/** The help for a capture's name and body, the same words in the CLI and the MCP capture tool (RULE-664, DEC-2551). */
+export declare const ENTRY_NAME_HELP: string;
+/**
+ * The body cap of a kind that has one of its own, in characters (code points, as a name is counted), keyed by the catalog slug
+ * (DEC-2555): a key result's whole body is served to every agent beside its name, so its size is bounded at write, never cut at
+ * read (DEC-2219). 10 served key results at 4000 characters are about 40 KB, under a sixth of the 262,144-byte orient tier. Every
+ * other kind keeps ENTRY_BODY_MAX_CHARS.
+ */
+export declare const ENTRY_BODY_CAPS: Readonly<Record<string, {
+    word: string;
+    max: number;
+}>>;
+/** What a body refusal says to do, in words; the surface adds its own way to do it (DEC-1994). */
+export declare const BODY_REFUSAL_FIX = "Shorten the body; put longer detail in an entry linked to it.";
+/**
+ * The one refusal for a body over its kind's cap, with the count and the cap (RULE-17), or null when it fits or the kind has no cap
+ * of its own. Every write door says this and nothing else (RULE-664); the caller asks only when the body is new or changed, so an old
+ * longer body stays until it is next edited.
+ */
+export declare function entryBodyRefusal(body: unknown, collectionSlug: string | null | undefined): string | null;
+/** What a key result's body opens with and how long it may be (DEC-2555, DEC-2512, DEC-2551): agents are served the whole body beside the 40-character name, and the sentence of
+ *  what counts is the part they judge by (INS-3542). One sentence, the same in the CLI and the MCP capture tool; no field for it. */
+export declare const KEY_RESULT_BODY_HELP: string;
+export declare const ENTRY_BODY_HELP: string;
+/** The verbatim excerpt that backs an entry's claims (`sourceExcerpt`). */
+export declare const SOURCE_EXCERPT_MAX_CHARS = 4000;
+/** A label's `description` (the write site refuses more; the MCP schemas read the same number). */
+export declare const LABEL_DESCRIPTION_MAX_CHARS = 2000;
+/** Relations accepted in one batch call (`relations action=batch-create`, capture's `links`). */
+export declare const RELATION_BATCH_MAX = 25;
+/**
+ * Ids per `chain.batchGetEntries` call from pb get, pb orient's Bound scope and the MCP get, which split a longer list into
+ * calls of this size (TASK-1639). Every id in a call is a full entry read in one Convex query, which allows 4,096 database
+ * calls: a worst-case entry costs 820 of them, so 4 need 3,280, 5 would need 4,106 and 20 would need 16,400 (pinned in
+ * convex/agentKnowledge/batchGetEntries.existenceOnly.test.ts). The server still takes 20, so a published client keeps working.
+ */
+export declare const BATCH_GET_CHUNK = 4;
+/** The ids read BATCH_GET_CHUNK to a call, the calls in parallel: one answer per id, in the order asked. */
+export declare function readInChunks<T>(ids: string[], read: (chunk: string[]) => Promise<T[]>): Promise<T[]>;
+/**
+ * The longest answer a question holds, in characters (`string.length`, as the MCP schema counts), after trimming (DEC-2634): an
+ * answer is written in full on the question, so it gets the same 4,000 as a key result's body. The answer door, the field guard
+ * on the question's `answer` field, the CLI and the MCP schema read this one number.
+ */
+export declare const ANSWER_TEXT_MAX_CHARS = 4000;
+/** What an answer refusal says to do, in words (DEC-1994). */
+export declare const ANSWER_REFUSAL_FIX = "Shorten the answer.";
+/** The one refusal for an answer over the cap, with the count and the cap (RULE-17), or null when it fits. */
+export declare function answerTextRefusal(answer: string): string | null;
+/** The refusal for an answer that is only a link (DEC-2634): a link goes beside the full answer, never instead of it. Surface-free words
+ *  (DEC-1994); each surface adds its own way to write it (the CLI's command form, the MCP action spec). */
+export declare const ANSWER_POINTER_ONLY_REFUSAL = "An answer is written in full: write the answer, and add the link beside it.";
+/** The refusal for an answer with no text and no link. */
+export declare const ANSWER_EMPTY_REFUSAL = "Answer text cannot be empty.";
+/** The help for an answer's text and its optional link, the same words in the CLI and the MCP question tool (DEC-2551). */
+export declare const ANSWER_TEXT_HELP: string;
+export declare const ANSWER_ENTRY_HELP = "Link an entry beside the answer text; it resolves the question. Never instead of the text.";
+/**
+ * The line an entry list prints when its read budget left rows out (TASK-1148, TASK-1157), with rows shown or none. It
+ * states the fact only: each surface adds the command it supports to narrow, or says its counts are of the rows read.
+ */
+export declare function listCutLine(shown: number): string;
+/** What a surface that cannot narrow a cut list adds to the cut line. */
+export declare const LIST_COUNTS_OF_ROWS_READ = "The counts here are of the rows read.";
+/** The line an entry read prints when it left some of a hub's links out (TASK-1157); the spine and rests-on links are never left out. */
+export declare function relationsCutLine(shown: number): string;
+//# sourceMappingURL=limits.d.ts.map

package/dist/lib/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/lib/limits.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;CAAgG,CAAC;AAE7H,8IAA8I;AAC9I,eAAO,MAAM,oBAAoB,QAA8C,CAAC;AAsBhF,oHAAoH;AACpH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,mKAAmK;AACnK,wBAAgB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAE5E;AAED,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,mDAAmD,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQvG;AAkBD,uHAAuH;AACvH,eAAO,MAAM,eAAe,QAA0C,CAAC;AACvE;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAEnF,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,kEAAkE,CAAC;AAEhG;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAMxG;AAED;qIACqI;AACrI,eAAO,MAAM,oBAAoB,QAAiH,CAAC;AACnJ,eAAO,MAAM,eAAe,QAAqD,CAAC;AAElF,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,mGAAmG;AACnG,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC,4GAA4G;AAC5G,wBAAsB,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAG1G;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,8GAA8G;AAC9G,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG/D;AAED;2GAC2G;AAC3G,eAAO,MAAM,2BAA2B,gFAAgF,CAAC;AAEzH,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,iCAAiC,CAAC;AAEnE,2HAA2H;AAC3H,eAAO,MAAM,gBAAgB,QAA6F,CAAC;AAC3H,eAAO,MAAM,iBAAiB,+FAA+F,CAAC;AAE9H;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,0CAA0C,CAAC;AAEhF,yIAAyI;AACzI,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/lib/limits.js

@@ -0,0 +1,175 @@
+// GENERATED by scripts/generate-mcp-embedded-copies.mjs from kernel/entries/limits.ts.
+// DO NOT EDIT. Run `npm run mcp:embedded-copies` to regenerate.
+// Local runtime copy for the isolated connector build.
+/**
+ * The entry limits every surface shares, in CHARACTERS (`string.length`) except where a name says
+ * otherwise. One file, so a number cannot drift between the server, the CLI and the MCP schemas.
+ *
+ * Body: 150,000 characters is the founder's ruling of 2026-10-03 (DEC-1853): the only physical
+ * ceiling is Convex's 1 MiB document, and every version row copies the body. `getDefaultConstraints`
+ * reads it for every collection's `body` field whatever its display hint, and for the `hero` hint
+ * (guards.ts; DEC-1880); the server create/update doors, the deploy fold
+ * step and the MCP capture/workflow schemas read it too (TASK-536, TASK-537; WP-791).
+ *
+ * Dependency-free: scripts/generate-mcp-embedded-copies.mjs copies it verbatim into the MCP server,
+ * because the MCP package builds alone on Railway (packages/mcp-server/Dockerfile) and so cannot
+ * import the kernel at runtime (DEC-1481; bundling the kernel at publish is DEC-1455, post-launch).
+ */
+export const ENTRY_BODY_MAX_CHARS = 150000;
+/**
+ * A rule's title limit, in UTF-8 bytes (RULE-703, DEC-2219): the rule row of the name cap table below. It is defined here, with
+ * the other name caps, because this file is copied verbatim into the connectors and cannot import the rule lists; the rule
+ * lists (kernel/governance/ruleLists.ts) re-export it and the rule gate refuses with it, so the number lives once.
+ */
+export const RULE_TITLE_MAX_BYTES = 110;
+/**
+ * The cap on an entry's `name` (top-level, not a data field) per kind (DEC-2512, DEC-2343, DEC-2550, DEC-2552): the one table
+ * every surface reads, so no other file holds a cap number. Characters are code points; the rule row is bytes. An objective or
+ * key result holds one label line (the Rail's); working kinds one short line, purpose, vision and strategy a sentence; every
+ * other collection keeps 250 until a ruling names it.
+ */
+export const ENTRY_NAME_CAPS = { outcome: 40, working: 80, rule: RULE_TITLE_MAX_BYTES, direction: 250, other: 250 };
+/** The longest name any kind may hold, derived from the table: the bound for a path that cannot know the kind (a schema, a platform seed). */
+export const ENTRY_NAME_MAX_CHARS = Math.max(...Object.values(ENTRY_NAME_CAPS));
+/** The kinds that have a cap of their own and the word a refusal and the help call each. A kind not listed takes the `other` cap. */
+const NAME_KINDS = {
+    decisions: { word: 'decision', tier: 'working' },
+    tensions: { word: 'tension', tier: 'working' },
+    insights: { word: 'insight', tier: 'working' },
+    tasks: { word: 'task', tier: 'working' },
+    questions: { word: 'question', tier: 'working' },
+    'work-packages': { word: 'work package', tier: 'working' },
+    purpose: { word: 'purpose', tier: 'direction' },
+    vision: { word: 'vision', tier: 'direction' },
+    strategy: { word: 'strategy', tier: 'direction' },
+    objectives: { word: 'objective', tier: 'outcome' },
+    'key-results': { word: 'key result', tier: 'outcome' },
+    rules: { word: 'rule', tier: 'rule' },
+    teams: { word: 'team', tier: 'other' },
+    labels: { word: 'label', tier: 'other' },
+};
+/** A name's length as a person counts it: code points, never bytes or UTF-16 units (one emoji is one character). */
+export function nameChars(name) {
+    return Array.from(name).length;
+}
+/** The cap on a name in this collection (the catalog slug), in characters; a rule's is in bytes. A slug with no row of its own, or none, takes the `other` cap. */
+export function nameCapFor(collectionSlug) {
+    return ENTRY_NAME_CAPS[(collectionSlug ? NAME_KINDS[collectionSlug]?.tier : undefined) ?? 'other'];
+}
+/** What a name refusal says to do, in words; the surface adds its own way to do it (DEC-1994). */
+export const NAME_REFUSAL_FIX = 'Shorten the name; the detail goes in the body.';
+/**
+ * The one refusal for a name over its kind's cap, with the count and the cap (RULE-17), or null when the name fits. Every
+ * door that writes a name says this and nothing else (RULE-664). A rule's title is held in bytes by the rule gate, which
+ * refuses with its own sentence (`ruleLengthRefusal`), so this says nothing for the rule row.
+ */
+export function entryNameRefusal(name, collectionSlug) {
+    const kind = collectionSlug ? NAME_KINDS[collectionSlug] : undefined;
+    if (kind?.tier === 'rule')
+        return null;
+    const chars = nameChars(name);
+    const cap = nameCapFor(collectionSlug);
+    if (chars <= cap)
+        return null;
+    const word = kind?.word ?? 'entry';
+    return `Name is ${chars} characters; the cap for ${/^[aeiou]/.test(word) ? 'an' : 'a'} ${word} is ${cap}. ${NAME_REFUSAL_FIX}`;
+}
+/** The kinds that share a cap, worded as one list: "a decision, tension or task". */
+function kindsWithCap(cap) {
+    const words = Object.values(NAME_KINDS).filter((k) => ENTRY_NAME_CAPS[k.tier] === cap && k.tier !== 'other').map((k) => k.word);
+    return words.length < 2 ? words.join('') : `${words.slice(0, -1).join(', ')} or ${words[words.length - 1]}`;
+}
+/**
+ * The longest name each kind may hold, worded from the table so the help cannot drift from the refusal (DEC-2551): one clause
+ * per cap in order, then the cap every other kind takes. A kind whose cap equals the `other` cap is left to that last clause.
+ */
+function nameLimitsSentence() {
+    const caps = [...new Set(Object.values(NAME_KINDS).map((k) => ENTRY_NAME_CAPS[k.tier]))].filter((cap) => cap !== ENTRY_NAME_CAPS.other).sort((a, b) => a - b);
+    const clauses = caps.map((cap, i) => `${cap}${cap === ENTRY_NAME_CAPS.rule ? ' bytes' : i === 0 ? ' characters' : ''} for ${/^[aeiou]/.test(kindsWithCap(cap)) ? 'an' : 'a'} ${kindsWithCap(cap)}`);
+    return `At most ${[...clauses, `${ENTRY_NAME_CAPS.other} for any other kind`].join(', ')}.`;
+}
+/** The help for a capture's name and body, the same words in the CLI and the MCP capture tool (RULE-664, DEC-2551). */
+export const ENTRY_NAME_HELP = `A short name. ${nameLimitsSentence()}`;
+/**
+ * The body cap of a kind that has one of its own, in characters (code points, as a name is counted), keyed by the catalog slug
+ * (DEC-2555): a key result's whole body is served to every agent beside its name, so its size is bounded at write, never cut at
+ * read (DEC-2219). 10 served key results at 4000 characters are about 40 KB, under a sixth of the 262,144-byte orient tier. Every
+ * other kind keeps ENTRY_BODY_MAX_CHARS.
+ */
+export const ENTRY_BODY_CAPS = {
+    'key-results': { word: 'key result', max: 4000 },
+};
+/** What a body refusal says to do, in words; the surface adds its own way to do it (DEC-1994). */
+export const BODY_REFUSAL_FIX = 'Shorten the body; put longer detail in an entry linked to it.';
+/**
+ * The one refusal for a body over its kind's cap, with the count and the cap (RULE-17), or null when it fits or the kind has no cap
+ * of its own. Every write door says this and nothing else (RULE-664); the caller asks only when the body is new or changed, so an old
+ * longer body stays until it is next edited.
+ */
+export function entryBodyRefusal(body, collectionSlug) {
+    const row = collectionSlug ? ENTRY_BODY_CAPS[collectionSlug] : undefined;
+    if (!row || typeof body !== 'string')
+        return null;
+    const chars = nameChars(body);
+    if (chars <= row.max)
+        return null;
+    return `Body is ${chars} characters; the cap for ${/^[aeiou]/.test(row.word) ? 'an' : 'a'} ${row.word} is ${row.max}. ${BODY_REFUSAL_FIX}`;
+}
+/** What a key result's body opens with and how long it may be (DEC-2555, DEC-2512, DEC-2551): agents are served the whole body beside the 40-character name, and the sentence of
+ *  what counts is the part they judge by (INS-3542). One sentence, the same in the CLI and the MCP capture tool; no field for it. */
+export const KEY_RESULT_BODY_HELP = `For a key result, open with what counts toward it; at most ${ENTRY_BODY_CAPS['key-results'].max} characters.`;
+export const ENTRY_BODY_HELP = `The detail, in Markdown. ${KEY_RESULT_BODY_HELP}`;
+/** The verbatim excerpt that backs an entry's claims (`sourceExcerpt`). */
+export const SOURCE_EXCERPT_MAX_CHARS = 4000;
+/** A label's `description` (the write site refuses more; the MCP schemas read the same number). */
+export const LABEL_DESCRIPTION_MAX_CHARS = 2000;
+/** Relations accepted in one batch call (`relations action=batch-create`, capture's `links`). */
+export const RELATION_BATCH_MAX = 25;
+/**
+ * Ids per `chain.batchGetEntries` call from pb get, pb orient's Bound scope and the MCP get, which split a longer list into
+ * calls of this size (TASK-1639). Every id in a call is a full entry read in one Convex query, which allows 4,096 database
+ * calls: a worst-case entry costs 820 of them, so 4 need 3,280, 5 would need 4,106 and 20 would need 16,400 (pinned in
+ * convex/agentKnowledge/batchGetEntries.existenceOnly.test.ts). The server still takes 20, so a published client keeps working.
+ */
+export const BATCH_GET_CHUNK = 4;
+/** The ids read BATCH_GET_CHUNK to a call, the calls in parallel: one answer per id, in the order asked. */
+export async function readInChunks(ids, read) {
+    const chunks = Array.from({ length: Math.ceil(ids.length / BATCH_GET_CHUNK) }, (_, i) => ids.slice(i * BATCH_GET_CHUNK, (i + 1) * BATCH_GET_CHUNK));
+    return (await Promise.all(chunks.map(read))).flat();
+}
+/**
+ * The longest answer a question holds, in characters (`string.length`, as the MCP schema counts), after trimming (DEC-2634): an
+ * answer is written in full on the question, so it gets the same 4,000 as a key result's body. The answer door, the field guard
+ * on the question's `answer` field, the CLI and the MCP schema read this one number.
+ */
+export const ANSWER_TEXT_MAX_CHARS = 4000;
+/** What an answer refusal says to do, in words (DEC-1994). */
+export const ANSWER_REFUSAL_FIX = 'Shorten the answer.';
+/** The one refusal for an answer over the cap, with the count and the cap (RULE-17), or null when it fits. */
+export function answerTextRefusal(answer) {
+    if (answer.length <= ANSWER_TEXT_MAX_CHARS)
+        return null;
+    return `Answer is ${answer.length} characters; the cap for an answer is ${ANSWER_TEXT_MAX_CHARS}. ${ANSWER_REFUSAL_FIX}`;
+}
+/** The refusal for an answer that is only a link (DEC-2634): a link goes beside the full answer, never instead of it. Surface-free words
+ *  (DEC-1994); each surface adds its own way to write it (the CLI's command form, the MCP action spec). */
+export const ANSWER_POINTER_ONLY_REFUSAL = 'An answer is written in full: write the answer, and add the link beside it.';
+/** The refusal for an answer with no text and no link. */
+export const ANSWER_EMPTY_REFUSAL = 'Answer text cannot be empty.';
+/** The help for an answer's text and its optional link, the same words in the CLI and the MCP question tool (DEC-2551). */
+export const ANSWER_TEXT_HELP = `The answer in full, at most ${ANSWER_TEXT_MAX_CHARS.toLocaleString('en-US')} characters.`;
+export const ANSWER_ENTRY_HELP = 'Link an entry beside the answer text; it resolves the question. Never instead of the text.';
+/**
+ * The line an entry list prints when its read budget left rows out (TASK-1148, TASK-1157), with rows shown or none. It
+ * states the fact only: each surface adds the command it supports to narrow, or says its counts are of the rows read.
+ */
+export function listCutLine(shown) {
+    return shown > 0 ? `Only the first ${shown} entries were read.` : 'No entries matched in the part of the list that was read.';
+}
+/** What a surface that cannot narrow a cut list adds to the cut line. */
+export const LIST_COUNTS_OF_ROWS_READ = 'The counts here are of the rows read.';
+/** The line an entry read prints when it left some of a hub's links out (TASK-1157); the spine and rests-on links are never left out. */
+export function relationsCutLine(shown) {
+    return `Some links were left out: ${shown} are shown, every part_of, validates and rests-on link among them; no view shows the rest yet.`;
+}
+//# sourceMappingURL=limits.js.map

package/dist/lib/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/lib/limits.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,gEAAgE;AAChE,uDAAuD;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAW,CAAC;AAE7H,8IAA8I;AAC9I,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;AAIhF,qIAAqI;AACrI,MAAM,UAAU,GAA+D;IAC9E,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IAChD,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9C,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;IACxC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IAChD,eAAe,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1D,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE;IAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;IAC7C,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE;IACjD,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;IAClD,aAAa,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;IACtD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;IACrC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;IACtC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;CACxC,CAAC;AAEF,oHAAoH;AACpH,MAAM,UAAU,SAAS,CAAC,IAAY;IACrC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAChC,CAAC;AAED,mKAAmK;AACnK,MAAM,UAAU,UAAU,CAAC,cAAyC;IACnE,OAAO,eAAe,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC;AACpG,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;AAEjF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,cAAyC;IACvF,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACvC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC;IACnC,OAAO,WAAW,KAAK,4BAA4B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,GAAG,KAAK,gBAAgB,EAAE,CAAC;AAChI,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChI,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB;IAC1B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9J,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,GAAG,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpM,OAAO,WAAW,CAAC,GAAG,OAAO,EAAE,GAAG,eAAe,CAAC,KAAK,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7F,CAAC;AAED,uHAAuH;AACvH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,kBAAkB,EAAE,EAAE,CAAC;AACvE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4D;IACvF,aAAa,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE;CAChD,CAAC;AAEF,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,+DAA+D,CAAC;AAEhG;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAa,EAAE,cAAyC;IACxF,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,CAAC,GAAG,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,WAAW,KAAK,4BAA4B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;AAC5I,CAAC;AAED;qIACqI;AACrI,MAAM,CAAC,MAAM,oBAAoB,GAAG,8DAA8D,eAAe,CAAC,aAAa,CAAC,CAAC,GAAG,cAAc,CAAC;AACnJ,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,oBAAoB,EAAE,CAAC;AAElF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,mGAAmG;AACnG,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,YAAY,CAAI,GAAa,EAAE,IAAuC;IAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IACpJ,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAExD,8GAA8G;AAC9G,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC/C,IAAI,MAAM,CAAC,MAAM,IAAI,qBAAqB;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,aAAa,MAAM,CAAC,MAAM,yCAAyC,qBAAqB,KAAK,kBAAkB,EAAE,CAAC;AAC1H,CAAC;AAED;2GAC2G;AAC3G,MAAM,CAAC,MAAM,2BAA2B,GAAG,6EAA6E,CAAC;AAEzH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAEnE,2HAA2H;AAC3H,MAAM,CAAC,MAAM,gBAAgB,GAAG,+BAA+B,qBAAqB,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC;AAC3H,MAAM,CAAC,MAAM,iBAAiB,GAAG,4FAA4F,CAAC;AAE9H;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACxC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,KAAK,qBAAqB,CAAC,CAAC,CAAC,2DAA2D,CAAC;AAC/H,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,uCAAuC,CAAC;AAEhF,yIAAyI;AACzI,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC7C,OAAO,6BAA6B,KAAK,gGAAgG,CAAC;AAC3I,CAAC"}

package/dist/lib/localBinding.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Repo-local binding resolution — turns what `.productbrain/config.local.json` declares into a
+ * credential, or refuses outright.
+ *
+ * Ordinary commands (`resolveConfig()` / `loadEnv()`) and `resolveAdminConfig()` share
+ * `resolvePinnedProfile()` so the pin validity bar cannot drift (STA-3 / TEN-3239). Admin still
+ * owns its own cascade around that helper: it never reads config.json siteUrl, CWD .env files, or
+ * preview / local-binding keys. Fail loud, fail closed, fail fast (RULE-268); default closed,
+ * explicitly opened (PRI-22).
+ */
+import { type LocalProjectConfig } from './projectConfig.js';
+/**
+ * Resolve the repo-local profile pin to a credential, or refuse outright.
+ *
+ * FAILS CLOSED on a DANGLING pin: a pin naming a profile that has since been deleted, or whose
+ * file carries no key, must NEVER fall through to the global active profile. The repo has
+ * explicitly declared its tenant; substituting a different one silently retargets every read AND
+ * write at a foreign workspace, and the gateway derives the workspace from the credential (BR-18)
+ * — so nothing downstream catches it.
+ *
+ * INS-2455 is the admin-path instance of exactly this fall-through. Admin now calls this helper
+ * too; a present-but-malformed key is a broken pin, not a credential.
+ */
+export declare function resolvePinnedProfile(profileName: string): {
+    apiKey: string;
+    siteUrl?: string;
+};
+/**
+ * Does `config.local.json` CLAIM a direct credential binding of its own?
+ *
+ * The claim is the `preview` marker OR a credential — see `resolveLocalBinding()` below for why
+ * the marker alone is not the test. A claim is only a question, never an answer: it says the file
+ * MEANT to bind, not that it can. Use `bindsCompletely()` to decide whether a tenant is actually
+ * named.
+ */
+export declare function declaresLocalBinding(localConfig: LocalProjectConfig | null): localConfig is LocalProjectConfig;
+/**
+ * Does `config.local.json` declare a COMPLETE PREVIEW binding — independent of the environment?
+ *
+ * The env-independence is the whole point (Codex P2 r4). `config.ts`'s `getPreviewBinding()` asks
+ * a different question — "is a preview binding what pb is EFFECTIVELY using right now" — so it
+ * bails whenever `PRODUCTBRAIN_API_KEY` is set. But `loadEnv()` COPIES the preview key into that
+ * very variable, so after any command has resolved config, that question answers "no" on a
+ * genuinely preview-bound worktree. Reporting surfaces need the file's own declaration, and
+ * handle the env-override case separately and earlier (reportedProfile.ts's startup snapshot).
+ *
+ * Shared rather than copied so the completeness bar cannot drift (STA-3) — it is the same
+ * `bindsCompletely` (SF-3 atomic apiKey+siteUrl) both callers already depend on.
+ */
+export declare function declaresCompletePreviewBinding(localConfig: LocalProjectConfig | null): {
+    workspaceName: string | null;
+} | null;
+/**
+ * Refuse when a project has declared itself (committed config.json) but named no tenant.
+ *
+ * A dangling pin is a different refusal (`resolvePinnedProfile`). This is the no-tenant case:
+ * config.json says "I am a Product Brain project" and nothing in config.local.json — neither a
+ * pin nor a direct/preview binding — says which workspace. Falling through to the global profile
+ * is the incident. A directory with no config.json is not a project — personal capture and
+ * `pb login` stay open.
+ *
+ * Call after the pin / preview-binding steps, before any global fallback. Those earlier steps
+ * already returned or threw when a tenant was claimed; this still re-checks the binding claim
+ * because `resolveAdminConfig()` has no binding step of its own and must not mistake a
+ * preview-bound worktree for an unpinned one.
+ */
+export declare function refuseWhenProjectHasNoTenant(): void;
+/**
+ * Resolve the direct credential binding in config.local.json, or null when the file does not
+ * claim one (the profile pin then owns resolution).
+ *
+ * The claim is the `preview` marker OR a credential of its own — deliberately NOT the marker
+ * alone. A file carrying an apiKey is asserting which workspace this repo talks to whether or not
+ * `pb:preview` stamped the marker, so gating on the marker would let a hand-written or
+ * partially-scrubbed binding be skipped and a sibling profile pin silently supply a different
+ * tenant's credential instead (the failure class TEN-3237/TEN-3238 closed for the pin path).
+ *
+ * Once claimed, only the atomic apiKey+siteUrl pair (SF-3) may bind — never a preview key paired
+ * with config.json's real-dev gateway (STD-261). Anything else refuses here, ahead of the pin, so
+ * a broken binding is named rather than routed around.
+ */
+export declare function resolveLocalBinding(localConfig: LocalProjectConfig | null): {
+    apiKey: string;
+    siteUrl: string;
+} | null;
+//# sourceMappingURL=localBinding.d.ts.map

package/dist/lib/localBinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localBinding.d.ts","sourceRoot":"","sources":["../../src/lib/localBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG1G;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAqB9F;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,kBAAkB,GAAG,IAAI,GACrC,WAAW,IAAI,kBAAkB,CAKnC;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,kBAAkB,GAAG,IAAI,GACrC;IAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAGzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CAiCnD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,kBAAkB,GAAG,IAAI,GACrC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAwB5C"}

package/dist/lib/localBinding.js

@@ -0,0 +1,173 @@
+/**
+ * Repo-local binding resolution — turns what `.productbrain/config.local.json` declares into a
+ * credential, or refuses outright.
+ *
+ * Ordinary commands (`resolveConfig()` / `loadEnv()`) and `resolveAdminConfig()` share
+ * `resolvePinnedProfile()` so the pin validity bar cannot drift (STA-3 / TEN-3239). Admin still
+ * owns its own cascade around that helper: it never reads config.json siteUrl, CWD .env files, or
+ * preview / local-binding keys. Fail loud, fail closed, fail fast (RULE-268); default closed,
+ * explicitly opened (PRI-22).
+ */
+import { ConfigResolutionError } from './configResult.js';
+import { ErrorCode } from './errors.js';
+import { resolveNamedProfileConfig } from './profiles.js';
+import { readLocalProjectConfig, projectConfigExists } from './projectConfig.js';
+import { AGENT_KEY_PREFIX, API_KEY_PREFIX, isApiKeyShaped } from './tokenConstants.js';
+/**
+ * Resolve the repo-local profile pin to a credential, or refuse outright.
+ *
+ * FAILS CLOSED on a DANGLING pin: a pin naming a profile that has since been deleted, or whose
+ * file carries no key, must NEVER fall through to the global active profile. The repo has
+ * explicitly declared its tenant; substituting a different one silently retargets every read AND
+ * write at a foreign workspace, and the gateway derives the workspace from the credential (BR-18)
+ * — so nothing downstream catches it.
+ *
+ * INS-2455 is the admin-path instance of exactly this fall-through. Admin now calls this helper
+ * too; a present-but-malformed key is a broken pin, not a credential.
+ */
+export function resolvePinnedProfile(profileName) {
+    const namedConfig = resolveNamedProfileConfig(profileName);
+    // A present-but-malformed key is a broken pin, not a credential. Accepting it here would
+    // surface as a generic "no API key, run pb login" far downstream, pointing the operator
+    // away from the pin that actually broke.
+    if (!namedConfig?.apiKey || !isApiKeyShaped(namedConfig.apiKey)) {
+        throw new ConfigResolutionError(`This repo is pinned to profile "${profileName}" (.productbrain/config.local.json), ` +
+            `but that profile has no valid API key — it may have been deleted or never fully set up. ` +
+            `Refusing to silently fall back to a different workspace. ` +
+            `Run \`pb profile use --local <profile>\` to fix the pin, or \`pb profile create ${profileName}\` to restore it.`, {
+            code: ErrorCode.AUTH_MISSING,
+            category: 'auth',
+            kind: 'profile-pin',
+            nextCommand: 'pb profile use --local <profile>',
+            guidance: 'Run `pb profile use --local <profile>` to fix the repo pin.',
+        });
+    }
+    return { apiKey: namedConfig.apiKey, siteUrl: namedConfig.siteUrl };
+}
+/**
+ * Does `config.local.json` CLAIM a direct credential binding of its own?
+ *
+ * The claim is the `preview` marker OR a credential — see `resolveLocalBinding()` below for why
+ * the marker alone is not the test. A claim is only a question, never an answer: it says the file
+ * MEANT to bind, not that it can. Use `bindsCompletely()` to decide whether a tenant is actually
+ * named.
+ */
+export function declaresLocalBinding(localConfig) {
+    if (!localConfig)
+        return false;
+    return (localConfig.preview === true || Boolean(localConfig.apiKey) || localConfig.apiKeyMalformed === true);
+}
+/**
+ * Does `config.local.json` carry a COMPLETE binding — the atomic apiKey+siteUrl pair (SF-3)?
+ *
+ * This, not the claim above, is what "the repo names a tenant" means. `resolveLocalBinding()`
+ * rejects a claimed-but-incomplete binding, but `resolveAdminConfig()` has no binding step to do
+ * that rejecting — so if `refuseWhenProjectHasNoTenant()` accepted a mere claim, a broken binding
+ * (`{ preview: true }` alone, a key with no siteUrl, a malformed key) would wave admin straight
+ * past the refusal into the global profile, which defaults to production (WP-681/INS-2455 is that
+ * exact incident). Shared by both so the bar cannot drift (STA-3), and it is the spec's own word:
+ * a *complete* preview binding is what stays unchanged.
+ */
+function bindsCompletely(localConfig) {
+    return Boolean(localConfig?.apiKey && localConfig.siteUrl);
+}
+/**
+ * Does `config.local.json` declare a COMPLETE PREVIEW binding — independent of the environment?
+ *
+ * The env-independence is the whole point (Codex P2 r4). `config.ts`'s `getPreviewBinding()` asks
+ * a different question — "is a preview binding what pb is EFFECTIVELY using right now" — so it
+ * bails whenever `PRODUCTBRAIN_API_KEY` is set. But `loadEnv()` COPIES the preview key into that
+ * very variable, so after any command has resolved config, that question answers "no" on a
+ * genuinely preview-bound worktree. Reporting surfaces need the file's own declaration, and
+ * handle the env-override case separately and earlier (reportedProfile.ts's startup snapshot).
+ *
+ * Shared rather than copied so the completeness bar cannot drift (STA-3) — it is the same
+ * `bindsCompletely` (SF-3 atomic apiKey+siteUrl) both callers already depend on.
+ */
+export function declaresCompletePreviewBinding(localConfig) {
+    if (localConfig?.preview !== true || !bindsCompletely(localConfig))
+        return null;
+    return { workspaceName: localConfig.workspaceName ?? null };
+}
+/**
+ * Refuse when a project has declared itself (committed config.json) but named no tenant.
+ *
+ * A dangling pin is a different refusal (`resolvePinnedProfile`). This is the no-tenant case:
+ * config.json says "I am a Product Brain project" and nothing in config.local.json — neither a
+ * pin nor a direct/preview binding — says which workspace. Falling through to the global profile
+ * is the incident. A directory with no config.json is not a project — personal capture and
+ * `pb login` stay open.
+ *
+ * Call after the pin / preview-binding steps, before any global fallback. Those earlier steps
+ * already returned or threw when a tenant was claimed; this still re-checks the binding claim
+ * because `resolveAdminConfig()` has no binding step of its own and must not mistake a
+ * preview-bound worktree for an unpinned one.
+ */
+export function refuseWhenProjectHasNoTenant() {
+    // The declaration is the FILE, not its contents — a corrupt config.json must not read as
+    // "not a project" and reopen the fall-through exactly when the committed file is damaged.
+    if (!projectConfigExists())
+        return;
+    const localConfig = readLocalProjectConfig();
+    if (localConfig?.profile)
+        return;
+    // A COMPLETE direct/preview binding names a tenant too: `npm run pb:preview` writes apiKey +
+    // siteUrl and no `profile` field. resolveConfig()/loadEnv() already returned at their own
+    // binding step, so this only reaches the admin cascade — which by design does not consume
+    // preview keys, and without this would call a legitimately preview-bound worktree untenanted.
+    // COMPLETE, not merely claimed: an incomplete binding names nothing usable, and admin has no
+    // binding step to reject it, so accepting a claim here would route admin to the global profile
+    // (Codex review round 2 — a regression this line introduced and this word closes).
+    if (bindsCompletely(localConfig))
+        return;
+    // Deliberately NOT excepted: `PB_PROFILE`. It looks like an explicit tenant, but exported from
+    // a shell rc it is exactly as ambient as the global active profile whose silent substitution is
+    // the incident — so WP-694 names only an exported PRODUCTBRAIN_API_KEY as the escape hatch, and
+    // this refusal outranks the profile system that reads PB_PROFILE (Codex review, declined).
+    throw new ConfigResolutionError(`This repo is a Product Brain project (.productbrain/config.json) but has no tenant pin ` +
+        `in .productbrain/config.local.json. Refusing to silently use a different workspace. ` +
+        `Run \`pb profile use --local <profile>\` to pin this repo, or \`pb profile list\` to see your profiles.`, {
+        code: ErrorCode.AUTH_MISSING,
+        category: 'auth',
+        kind: 'missing-pin',
+        nextCommand: 'pb profile use --local <profile>',
+        guidance: 'Run `pb profile use --local <profile>` to pin this repo to a workspace.',
+    });
+}
+/**
+ * Resolve the direct credential binding in config.local.json, or null when the file does not
+ * claim one (the profile pin then owns resolution).
+ *
+ * The claim is the `preview` marker OR a credential of its own — deliberately NOT the marker
+ * alone. A file carrying an apiKey is asserting which workspace this repo talks to whether or not
+ * `pb:preview` stamped the marker, so gating on the marker would let a hand-written or
+ * partially-scrubbed binding be skipped and a sibling profile pin silently supply a different
+ * tenant's credential instead (the failure class TEN-3237/TEN-3238 closed for the pin path).
+ *
+ * Once claimed, only the atomic apiKey+siteUrl pair (SF-3) may bind — never a preview key paired
+ * with config.json's real-dev gateway (STD-261). Anything else refuses here, ahead of the pin, so
+ * a broken binding is named rather than routed around.
+ */
+export function resolveLocalBinding(localConfig) {
+    if (!declaresLocalBinding(localConfig))
+        return null;
+    if (bindsCompletely(localConfig)) {
+        return { apiKey: localConfig.apiKey, siteUrl: localConfig.siteUrl.replace(/\/$/, '') };
+    }
+    // A malformed key is present-but-unusable, not absent — readLocalProjectConfig() withholds it
+    // from `apiKey` so it can never bind, and flags it so this refusal can name the real fault.
+    const fault = localConfig.apiKeyMalformed
+        ? `its API key does not start with ${API_KEY_PREFIX} or ${AGENT_KEY_PREFIX}`
+        : !localConfig.apiKey
+            ? 'missing API key'
+            : 'missing deployment URL';
+    throw new ConfigResolutionError(`This repo has an incomplete preview binding (.productbrain/config.local.json): ` +
+        `${fault}. Refusing to use its profile pin or another workspace instead.`, {
+        code: ErrorCode.CONFIG_INVALID,
+        category: 'config',
+        kind: 'preview-binding',
+        nextCommand: 'npm run pb:preview',
+        guidance: 'Run `npm run pb:preview` to repair the preview binding, or `npm run pb:real` to return to the repo pin.',
+    });
+}
+//# sourceMappingURL=localBinding.js.map

package/dist/lib/localBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localBinding.js","sourceRoot":"","sources":["../../src/lib/localBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAA2B,MAAM,oBAAoB,CAAC;AAC1G,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,WAAW,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC3D,yFAAyF;IACzF,wFAAwF;IACxF,yCAAyC;IACzC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,qBAAqB,CAC7B,mCAAmC,WAAW,uCAAuC;YACnF,0FAA0F;YAC1F,2DAA2D;YAC3D,mFAAmF,WAAW,mBAAmB,EACnH;YACE,IAAI,EAAE,SAAS,CAAC,YAAY;YAC5B,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,kCAAkC;YAC/C,QAAQ,EAAE,6DAA6D;SACxE,CACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAsC;IAEtC,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,CACL,WAAW,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,eAAe,KAAK,IAAI,CACpG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CACtB,WAAsC;IAEtC,OAAO,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAAsC;IAEtC,IAAI,WAAW,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B;IAC1C,yFAAyF;IACzF,0FAA0F;IAC1F,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO;IAEnC,MAAM,WAAW,GAAG,sBAAsB,EAAE,CAAC;IAC7C,IAAI,WAAW,EAAE,OAAO;QAAE,OAAO;IAEjC,6FAA6F;IAC7F,0FAA0F;IAC1F,0FAA0F;IAC1F,8FAA8F;IAC9F,6FAA6F;IAC7F,+FAA+F;IAC/F,mFAAmF;IACnF,IAAI,eAAe,CAAC,WAAW,CAAC;QAAE,OAAO;IAEzC,+FAA+F;IAC/F,gGAAgG;IAChG,gGAAgG;IAChG,2FAA2F;IAC3F,MAAM,IAAI,qBAAqB,CAC7B,yFAAyF;QACvF,sFAAsF;QACtF,yGAAyG,EAC3G;QACE,IAAI,EAAE,SAAS,CAAC,YAAY;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,yEAAyE;KACpF,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAsC;IAEtC,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,8FAA8F;IAC9F,4FAA4F;IAC5F,MAAM,KAAK,GAAG,WAAW,CAAC,eAAe;QACvC,CAAC,CAAC,mCAAmC,cAAc,OAAO,gBAAgB,EAAE;QAC5E,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM;YACnB,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,wBAAwB,CAAC;IAC/B,MAAM,IAAI,qBAAqB,CAC7B,iFAAiF;QAC/E,GAAG,KAAK,iEAAiE,EAC3E;QACE,IAAI,EAAE,SAAS,CAAC,cAAc;QAC9B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,oBAAoB;QACjC,QAAQ,EAAE,yGAAyG;KACpH,CACF,CAAC;AACJ,CAAC"}

package/dist/lib/nameFromText.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A name made from a text (TASK-1419, DEC-2512; TEN-3332, DEC-1622): the text's first sentence when it fits `cap`, else the
+ * text cut back to the last word that fits. The question door (convex/questions/routingFacet.ts) and `pb capture` both name an
+ * entry this way, so a long capture text lands as a short name over the whole text as its body. Dependency-free:
+ * scripts/generate-mcp-embedded-copies.mjs copies it into the CLI, which builds alone.
+ *
+ * Lengths are code points (as `nameChars` in limits.ts counts them), so a cut never splits an emoji. Line breaks and runs of
+ * spaces fold to one space first: a name is one line.
+ *
+ * The first sentence wins whenever one exists within `cap`, however short (WP-707 S1 round 2, DEC-1622, operator ruling #10);
+ * an abbreviation such as "Dr." ending a sentence early is the accepted trade-off of a punctuation-only rule. Word-boundary
+ * cutting applies only when no sentence fits.
+ */
+export declare function deriveNameFromText(text: string, cap: number): string;
+//# sourceMappingURL=nameFromText.d.ts.map

package/dist/lib/nameFromText.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nameFromText.d.ts","sourceRoot":"","sources":["../../src/lib/nameFromText.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAepE"}