@productbrain/cli 0.1.0-beta.29 → 0.1.0-beta.2902

package/dist/__tests__/upgrade-runner.test.js

@@ -0,0 +1,54 @@
+import { EventEmitter } from 'node:events';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+const spawnMock = vi.fn();
+vi.mock('node:child_process', () => ({
+    spawn: (...args) => spawnMock(...args),
+}));
+vi.mock('../lib/telemetry.js', () => ({
+    trackEvent: vi.fn(),
+}));
+vi.mock('../lib/update-check.js', () => ({
+    writeUpgradePendingSentinel: vi.fn(),
+}));
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { buildUpgradeCommand, detectInstallChannel, spawnUpgrade } from '../lib/upgrade-runner.js';
+describe('upgrade-runner', () => {
+    beforeEach(() => {
+        spawnMock.mockReset();
+    });
+    it('detects package-manager channels from execPath fixtures', () => {
+        expect(detectInstallChannel('/Users/r/.local/share/pnpm/node', {})).toBe('pnpm');
+        expect(detectInstallChannel('/opt/yarn/bin/node', {})).toBe('yarn');
+        expect(detectInstallChannel('/Users/r/.bun/bin/bun', {})).toBe('bun');
+        expect(detectInstallChannel('/opt/homebrew/Cellar/node/25/bin/node', {})).toBe('brew');
+        expect(detectInstallChannel('/usr/local/lib/node_modules/npm/bin/node', {})).toBe('npm');
+    });
+    it('builds beta upgrade commands instead of @latest', () => {
+        expect(buildUpgradeCommand('npm').display).toBe('npm install -g @productbrain/cli@beta');
+        expect(buildUpgradeCommand('unknown').display).toBe('npm install -g @productbrain/cli@beta');
+        expect(buildUpgradeCommand('pnpm').args).toEqual(['add', '-g', '@productbrain/cli@beta']);
+    });
+    it('throws UPGRADE_FAILED on spawn failure', async () => {
+        const child = new EventEmitter();
+        child.stdout = new EventEmitter();
+        child.stderr = new EventEmitter();
+        spawnMock.mockReturnValue(child);
+        const promise = spawnUpgrade('npm');
+        child.emit('error', Object.assign(new Error('spawn npm ENOENT'), { code: 'ENOENT' }));
+        await expect(promise).rejects.toBeInstanceOf(CLIError);
+        await expect(promise).rejects.toMatchObject({ code: ErrorCode.UPGRADE_FAILED });
+    });
+});
+describe('buildUpgradeCommand version pin', () => {
+    it('pins npm-family channels to the resolved version', () => {
+        expect(buildUpgradeCommand('npm', '0.1.0-beta.140').args).toEqual(['install', '-g', '@productbrain/cli@0.1.0-beta.140']);
+        expect(buildUpgradeCommand('pnpm', '0.1.0-beta.140').args).toContain('@productbrain/cli@0.1.0-beta.140');
+    });
+    it('leaves brew unchanged (no @version)', () => {
+        expect(buildUpgradeCommand('brew', '0.1.0-beta.140').args).toEqual(['upgrade', 'productbrain']);
+    });
+    it('falls back to @beta when no version is resolved', () => {
+        expect(buildUpgradeCommand('npm').args).toEqual(['install', '-g', '@productbrain/cli@beta']);
+    });
+});
+//# sourceMappingURL=upgrade-runner.test.js.map

package/dist/__tests__/upgrade-runner.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-runner.test.js","sourceRoot":"","sources":["../../src/__tests__/upgrade-runner.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAE1B,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;CAClD,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;CACpB,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,2BAA2B,EAAE,EAAE,CAAC,EAAE,EAAE;CACrC,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAEnG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,UAAU,CAAC,GAAG,EAAE;QACd,SAAS,CAAC,SAAS,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,oBAAoB,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjF,MAAM,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,oBAAoB,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,oBAAoB,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvF,MAAM,CAAC,oBAAoB,CAAC,0CAA0C,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACzF,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAC7F,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,KAAK,GAAG,IAAI,YAAY,EAAmE,CAAC;QAClG,KAAK,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAClC,KAAK,CAAC,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAClC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEtF,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,kCAAkC,CAAC,CAAC,CAAC;QACzH,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/upgrade.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=upgrade.test.d.ts.map

package/dist/__tests__/upgrade.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/upgrade.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/upgrade.test.js

@@ -0,0 +1,56 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+const { resolveLatestVersion } = vi.hoisted(() => ({
+    resolveLatestVersion: vi.fn(),
+}));
+vi.mock('../lib/update-check.js', async (orig) => ({
+    ...(await orig()),
+    resolveLatestVersion,
+}));
+import { runUpgrade } from '../commands/upgrade.js';
+import { setOutputMode } from '../lib/runner.js';
+import * as runner from '../lib/upgrade-runner.js';
+describe('runUpgrade anti-downgrade gate', () => {
+    let stdoutSpy;
+    let spawnSpy;
+    beforeEach(() => {
+        stdoutSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        spawnSpy = vi
+            .spyOn(runner, 'spawnUpgrade')
+            .mockResolvedValue({ channel: 'npm', command: 'x', exitCode: 0, output: [] });
+    });
+    afterEach(() => {
+        stdoutSpy.mockRestore();
+        spawnSpy.mockRestore();
+        setOutputMode('auto');
+        resolveLatestVersion.mockReset();
+    });
+    it('no-ops when resolved latest is not newer than current', async () => {
+        setOutputMode('json');
+        resolveLatestVersion.mockResolvedValue('0.1.0-beta.108'); // older than current
+        await runUpgrade({ currentVersion: '0.1.0-beta.109' });
+        const out = stdoutSpy.mock.calls.flat().join('');
+        expect(out).toContain('current');
+        expect(spawnSpy).not.toHaveBeenCalled();
+    });
+    it('never installs a bare @beta tag when latest resolves to null (P1: no downgrade fallback)', async () => {
+        // Stale/unreachable registry → resolveLatestVersion returns null. The old code fell through
+        // to a bare `@productbrain/cli@beta` install, which could downgrade a newer installed CLI.
+        setOutputMode('json');
+        resolveLatestVersion.mockResolvedValue(null);
+        await runUpgrade({ currentVersion: '0.1.0-beta.109' });
+        const out = stdoutSpy.mock.calls.flat().join('');
+        expect(spawnSpy).not.toHaveBeenCalled();
+        // JSON consumers see an explicit "current"/null-latest signal, never an auto-install.
+        expect(out).toContain('"status":"current"');
+        expect(out).toContain('"latest":null');
+    });
+    it('pins the resolved newer version in the JSON upgrade command', async () => {
+        setOutputMode('json');
+        resolveLatestVersion.mockResolvedValue('0.1.0-beta.140'); // strictly newer
+        await runUpgrade({ currentVersion: '0.1.0-beta.109' });
+        const out = stdoutSpy.mock.calls.flat().join('');
+        expect(out).toContain('@productbrain/cli@0.1.0-beta.140');
+        expect(out).toContain('"latest":"0.1.0-beta.140"');
+    });
+});
+//# sourceMappingURL=upgrade.test.js.map

package/dist/__tests__/upgrade.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.test.js","sourceRoot":"","sources":["../../src/__tests__/upgrade.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEzE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAgD;CAC5E,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,MAAM,IAAI,EAA2C,CAAC;IAC1D,oBAAoB;CACrB,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,0BAA0B,CAAC;AAEnD,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,IAAI,SAAsC,CAAC;IAC3C,IAAI,QAAqC,CAAC;IAE1C,UAAU,CAAC,GAAG,EAAE;QACd,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7E,QAAQ,GAAG,EAAE;aACV,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC;aAC7B,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAW,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,SAAS,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvB,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,oBAAoB,CAAC,SAAS,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,oBAAoB,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB;QAC/E,MAAM,UAAU,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,4FAA4F;QAC5F,2FAA2F;QAC3F,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,oBAAoB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,UAAU,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACxC,sFAAsF;QACtF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,oBAAoB,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB;QAC3E,MAAM,UAAU,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/verify-formatter.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=verify-formatter.test.d.ts.map

package/dist/__tests__/verify-formatter.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-formatter.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/verify-formatter.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/verify-formatter.test.js

@@ -0,0 +1,85 @@
+/**
+ * formatVerifyReceipt — honest qualifier on verify receipts (WP-A T8).
+ * Chain: attestation-model spec §5 (connectors never re-derive), §11 (rollout: optional fields).
+ */
+import { describe, it, expect } from 'vitest';
+import { formatVerifyReceipt } from '../formatters/verify.js';
+describe('formatVerifyReceipt', () => {
+    it('shows the honest qualifier', () => {
+        expect(formatVerifyReceipt({
+            entryId: 'TEN-1',
+            verificationStatus: 'verified',
+            alreadyVerified: false,
+            verifiedBy: 'agent for Randy Hereman',
+            attestation: { strength: 'delegated' },
+        })).toBe('Verified TEN-1 — by agent for Randy Hereman (delegated).');
+    });
+    it('already-verified names the standing record', () => {
+        expect(formatVerifyReceipt({
+            entryId: 'TEN-1',
+            verificationStatus: 'verified',
+            alreadyVerified: true,
+            verifiedBy: 'Randy Hereman',
+            attestation: { strength: 'human-direct' },
+        })).toBe('TEN-1 is already verified — by Randy Hereman (human-direct).');
+    });
+    it('falls back to the bare form when the server has no attestation data (old server, spec §11)', () => {
+        expect(formatVerifyReceipt({
+            entryId: 'TEN-1',
+            verificationStatus: 'verified',
+            alreadyVerified: false,
+        })).toBe('Verified TEN-1.');
+    });
+    it('bare already-verified form when attestation data is absent', () => {
+        expect(formatVerifyReceipt({
+            entryId: 'TEN-1',
+            verificationStatus: 'verified',
+            alreadyVerified: true,
+        })).toBe('TEN-1 is already verified.');
+    });
+    // Finding 1 (PR #341 review): a non-'attested' basis (the pre-branch legacy corpus)
+    // must render as a qualifier, never as "— by <legacy string>" — the shipped
+    // verifiedBy is already the resolved legacy string ("legacy — unclassified"), and
+    // rendering it after "by" reintroduces the misleading "by <person>" phrasing that
+    // formatEntry (formatters/entry.ts) explicitly avoids for legacy bases.
+    it('renders the honest legacy qualifier when basis is not attested', () => {
+        expect(formatVerifyReceipt({
+            entryId: 'TEN-1',
+            verificationStatus: 'verified',
+            alreadyVerified: false,
+            verifiedBy: 'legacy — unclassified',
+            attestation: { strength: 'delegated', basis: 'legacy-unclassified' },
+        })).toBe('Verified TEN-1 (legacy — unclassified).');
+    });
+    it('already-verified legacy basis renders the same qualifier form', () => {
+        expect(formatVerifyReceipt({
+            entryId: 'TEN-1',
+            verificationStatus: 'verified',
+            alreadyVerified: true,
+            verifiedBy: 'legacy — unclassified',
+            attestation: { strength: 'delegated', basis: 'legacy-unclassified' },
+        })).toBe('TEN-1 is already verified (legacy — unclassified).');
+    });
+    // Finding 2 (PR #341 review): verifiedBy is a server-provided string that may carry
+    // a workspace member's displayName/email — sanitize it the same way every other
+    // user-controlled string reaching the terminal is sanitized (BET-269 C3).
+    it('strips control/ANSI chars from verifiedBy before printing', () => {
+        expect(formatVerifyReceipt({
+            entryId: 'TEN-1',
+            verificationStatus: 'verified',
+            alreadyVerified: false,
+            verifiedBy: 'Evil\x1b[31mName',
+            attestation: { strength: 'human-direct' },
+        })).toBe('Verified TEN-1 — by EvilName (human-direct).');
+    });
+    it('strips control/ANSI chars from the legacy verifiedBy qualifier too', () => {
+        expect(formatVerifyReceipt({
+            entryId: 'TEN-1',
+            verificationStatus: 'verified',
+            alreadyVerified: false,
+            verifiedBy: 'legacy\x1b[31m — unclassified',
+            attestation: { strength: 'delegated', basis: 'legacy-unclassified' },
+        })).toBe('Verified TEN-1 (legacy — unclassified).');
+    });
+});
+//# sourceMappingURL=verify-formatter.test.js.map

package/dist/__tests__/verify-formatter.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-formatter.test.js","sourceRoot":"","sources":["../../src/__tests__/verify-formatter.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACrC,MAAM,CACL,mBAAmB,CAAC;YACnB,OAAO,EAAE,OAAO;YAChB,kBAAkB,EAAE,UAAU;YAC9B,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE,yBAAyB;YACrC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SACtC,CAAC,CACF,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACrD,MAAM,CACL,mBAAmB,CAAC;YACnB,OAAO,EAAE,OAAO;YAChB,kBAAkB,EAAE,UAAU;YAC9B,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,eAAe;YAC3B,WAAW,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE;SACzC,CAAC,CACF,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACrG,MAAM,CACL,mBAAmB,CAAC;YACnB,OAAO,EAAE,OAAO;YAChB,kBAAkB,EAAE,UAAU;YAC9B,eAAe,EAAE,KAAK;SACtB,CAAC,CACF,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,MAAM,CACL,mBAAmB,CAAC;YACnB,OAAO,EAAE,OAAO;YAChB,kBAAkB,EAAE,UAAU;YAC9B,eAAe,EAAE,IAAI;SACrB,CAAC,CACF,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,oFAAoF;IACpF,4EAA4E;IAC5E,kFAAkF;IAClF,kFAAkF;IAClF,wEAAwE;IACxE,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,CACL,mBAAmB,CAAC;YACnB,OAAO,EAAE,OAAO;YAChB,kBAAkB,EAAE,UAAU;YAC9B,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE,uBAAuB;YACnC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE;SACpE,CAAC,CACF,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACxE,MAAM,CACL,mBAAmB,CAAC;YACnB,OAAO,EAAE,OAAO;YAChB,kBAAkB,EAAE,UAAU;YAC9B,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,uBAAuB;YACnC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE;SACpE,CAAC,CACF,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,oFAAoF;IACpF,gFAAgF;IAChF,0EAA0E;IAC1E,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACpE,MAAM,CACL,mBAAmB,CAAC;YACnB,OAAO,EAAE,OAAO;YAChB,kBAAkB,EAAE,UAAU;YAC9B,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE,kBAAkB;YAC9B,WAAW,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE;SACzC,CAAC,CACF,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,MAAM,CACL,mBAAmB,CAAC;YACnB,OAAO,EAAE,OAAO;YAChB,kBAAkB,EAAE,UAAU;YAC9B,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE,+BAA+B;YAC3C,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE;SACpE,CAAC,CACF,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/__tests__/vocabulary-leak.test.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Vocabulary leak test — WP-436 S2 + TEN-2053 S2 (PAT-229, DEC-1021).
+ *
+ * Asserts two classes of regression are absent from user-facing CLI/MCP output:
+ *
+ *   1. **Workspace-vocab leaks** (`bet`/`BET`) — caught when the workspace
+ *      vocabulary is overridden to non-bet labels. Any literal "bet"/"BET"
+ *      outside stored entry IDs means a label resolver was bypassed.
+ *
+ *   2. **Stale governance-ID leaks** (TEN-2053 S2) — bare governance-ID
+ *      prefixes without digits (e.g. typo'd "STD-" with no number, or
+ *      "DEC-foo"). Stored entry IDs (`STD-113`, `DEC-1021`, etc.) are
+ *      stripped BEFORE the leak check, so legitimate IDs don't false-
+ *      positive. We do NOT treat Product Brain Method vocabulary as a leak
+ *      (`Chain`, `Constellation`, `SSOT`, `shaping`, `handoff`, `gates`,
+ *      `verdict`, `blocking`, `advisory` are the product — not jargon).
+ *      The real leak class is OUR entry IDs (specific to our team's chain)
+ *      surfacing in customer-facing output.
+ *
+ * Coverage:
+ *   ALL_FIXTURES × { formatOrient, formatOrientBrief, formatSearchResults,
+ *                    formatCaptureReceipt, formatAudit (PASS/FAIL/verbose) }
+ *   plus runOrient end-to-end command wiring.
+ *
+ * MCP-side note: the MCP markdown response in
+ * `packages/mcp-server/src/tools/audit.ts:handleAuditRun` is structurally
+ * identical to `formatAudit` here — kept in sync by manual review; no
+ * dedicated MCP audit test currently exists (`find packages/mcp-server -name
+ * "*.test.ts" -path "*audit*"` returns empty as of TEN-2053 S2).
+ *
+ * Whitelist: stored entry IDs matching /\b[A-Z]+-\d+\b/ (e.g. WP-436, BET-42,
+ * DEC-1021) are stripped before the leak check — they're stable database
+ * references, not vocabulary labels.
+ *
+ * Perf: fixture workspaces are seeded purely in-memory (no Convex, no HTTP).
+ * BET-241: no fixture has >100 entries.
+ */
+export {};
+//# sourceMappingURL=vocabulary-leak.test.d.ts.map

package/dist/__tests__/vocabulary-leak.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vocabulary-leak.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/vocabulary-leak.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG"}