@productbrain/cli 0.1.0-beta.47 → 0.1.0-beta.4721

package/dist/commands/proof-run.d.ts

@@ -0,0 +1,51 @@
+/**
+ * pb proof-run <proof-name> — run an admin-only proof against the seeded preview
+ * via the WP-459 proof bridge.
+ *
+ * NOT a kernel/MCP call: the bridge is a token-gated httpAction with a SIMPLER
+ * envelope than /api/aki. It authenticates with the short-lived preview admin
+ * token (pb_pat_…) minted into .productbrain/preview-admin.json by the seed
+ * (scripts/seed-preview.mjs step 7) — NOT the pb API key. So this command does
+ * not call getConfig()/kernelCall(); it reads the throwaway token from disk and
+ * POSTs directly to {siteUrl}/api/admin/proof-run.
+ *
+ *   Success → HTTP 200 { data: <verdict> } (verdict may carry zeroHandAuthoringProven)
+ *   Failure → non-200 { error, code }
+ *
+ * Chain: WP-459 (Admin-proof bridge).
+ */
+/** Resolved inputs for a proof-bridge call. */
+export interface ProofBridgeInputs {
+    siteUrl: string;
+    rawToken: string;
+    workspaceId: string;
+    /** Server-enforced expiry (ms epoch), if the token record carried one. */
+    expiresAt?: number;
+}
+/**
+ * Resolve the proof-bridge inputs (siteUrl, rawToken, workspaceId) from the
+ * worktree's seed sidecars. Pure + testable: takes the project root explicitly,
+ * throws CLIError with actionable guidance on any missing/invalid file.
+ */
+export declare function resolveProofBridgeInputs(projectRoot: string): ProofBridgeInputs;
+/** Parsed bridge response — discriminated on `ok`. */
+type BridgeResult = {
+    ok: true;
+    data: unknown;
+} | {
+    ok: false;
+    error: string;
+    code: string;
+};
+/**
+ * POST to the proof bridge and parse its simple envelope ({ data } / { error, code }).
+ * Uses an AbortController timeout (mirrors lib/client.js). Network / non-JSON
+ * failures surface as a structured { ok: false } so the caller can exit non-zero.
+ */
+export declare function callProofBridge(inputs: ProofBridgeInputs, proofName: string, timeoutMs?: number): Promise<BridgeResult>;
+interface ProofRunOptions {
+    proofName: string;
+}
+export declare function runProofRun(options: ProofRunOptions): Promise<void>;
+export {};
+//# sourceMappingURL=proof-run.d.ts.map

package/dist/commands/proof-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-run.d.ts","sourceRoot":"","sources":["../../src/commands/proof-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAuBH,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAeD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CA8E/E;AAED,sDAAsD;AACtD,KAAK,YAAY,GACb;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,EACzB,SAAS,EAAE,MAAM,EACjB,SAAS,SAAS,GACjB,OAAO,CAAC,YAAY,CAAC,CA8CvB;AAED,UAAU,eAAe;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAgEzE"}

package/dist/commands/proof-run.js

@@ -0,0 +1,209 @@
+/**
+ * pb proof-run <proof-name> — run an admin-only proof against the seeded preview
+ * via the WP-459 proof bridge.
+ *
+ * NOT a kernel/MCP call: the bridge is a token-gated httpAction with a SIMPLER
+ * envelope than /api/aki. It authenticates with the short-lived preview admin
+ * token (pb_pat_…) minted into .productbrain/preview-admin.json by the seed
+ * (scripts/seed-preview.mjs step 7) — NOT the pb API key. So this command does
+ * not call getConfig()/kernelCall(); it reads the throwaway token from disk and
+ * POSTs directly to {siteUrl}/api/admin/proof-run.
+ *
+ *   Success → HTTP 200 { data: <verdict> } (verdict may carry zeroHandAuthoringProven)
+ *   Failure → non-200 { error, code }
+ *
+ * Chain: WP-459 (Admin-proof bridge).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { findProjectRoot } from '../lib/config.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { green, red, bold, dim, icons } from '../lib/style.js';
+/** Convert a Convex `.cloud` URL to its `.site` sibling, trailing slash stripped. */
+function toSiteUrl(convexUrl) {
+    return convexUrl.replace('.convex.cloud', '.convex.site').replace(/\/$/, '');
+}
+function readJsonFile(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the proof-bridge inputs (siteUrl, rawToken, workspaceId) from the
+ * worktree's seed sidecars. Pure + testable: takes the project root explicitly,
+ * throws CLIError with actionable guidance on any missing/invalid file.
+ */
+export function resolveProofBridgeInputs(projectRoot) {
+    const seedPath = resolve(projectRoot, '.convex-seed.json');
+    if (!existsSync(seedPath)) {
+        throw new CLIError('No seeded preview found (.convex-seed.json missing).', {
+            code: ErrorCode.CONFIG_MISSING,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` first.',
+        });
+    }
+    const seed = readJsonFile(seedPath);
+    if (!seed) {
+        throw new CLIError('Could not parse .convex-seed.json.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Re-run `npm run convex:reprovision` to regenerate it.',
+        });
+    }
+    const adminPath = resolve(projectRoot, '.productbrain', 'preview-admin.json');
+    if (!existsSync(adminPath)) {
+        throw new CLIError('No preview admin token (.productbrain/preview-admin.json missing).', {
+            code: ErrorCode.CONFIG_MISSING,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` to mint one.',
+        });
+    }
+    const admin = readJsonFile(adminPath);
+    if (!admin?.rawToken) {
+        throw new CLIError('preview-admin.json is missing its rawToken.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` to mint a fresh token.',
+        });
+    }
+    // Stale-sidecar guard: both sidecars are written by the SAME seed run, so their
+    // workspaceIds MUST agree. A mismatch means preview-admin.json is left over from an
+    // earlier preview — and because we prefer its pinned values below, using it would aim
+    // the proof at that stale (possibly still-live) deployment while THIS worktree's preview
+    // goes unexercised. Fail closed rather than silently proving the wrong workspace.
+    if (seed.workspaceId && admin.workspaceId && seed.workspaceId !== admin.workspaceId) {
+        throw new CLIError(`Stale preview admin token: preview-admin.json is pinned to workspace ${admin.workspaceId}, ` +
+            `but the current seed (.convex-seed.json) is workspace ${seed.workspaceId}.`, {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Run `npm run convex:reprovision` to re-mint the admin token for the current preview.',
+        });
+    }
+    // Prefer the pinned values from preview-admin.json; fall back to the seed sidecar.
+    const siteUrl = admin.siteUrl ?? (seed.convexUrl ? toSiteUrl(seed.convexUrl) : undefined);
+    if (!siteUrl) {
+        throw new CLIError('Could not determine the preview site URL.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Re-run `npm run convex:reprovision` to regenerate the seed sidecars.',
+        });
+    }
+    const workspaceId = admin.workspaceId ?? seed.workspaceId;
+    if (!workspaceId) {
+        throw new CLIError('Could not determine the preview workspaceId.', {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Re-run `npm run convex:reprovision` to regenerate the seed sidecars.',
+        });
+    }
+    return {
+        siteUrl: siteUrl.replace(/\/$/, ''),
+        rawToken: admin.rawToken,
+        workspaceId,
+        expiresAt: typeof admin.expiresAt === 'number' ? admin.expiresAt : undefined,
+    };
+}
+/**
+ * POST to the proof bridge and parse its simple envelope ({ data } / { error, code }).
+ * Uses an AbortController timeout (mirrors lib/client.js). Network / non-JSON
+ * failures surface as a structured { ok: false } so the caller can exit non-zero.
+ */
+export async function callProofBridge(inputs, proofName, timeoutMs = 30_000) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    try {
+        res = await fetch(`${inputs.siteUrl}/api/admin/proof-run`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-pb-admin-token': inputs.rawToken,
+            },
+            body: JSON.stringify({ proofName, workspaceId: inputs.workspaceId }),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        clearTimeout(timer);
+        const msg = err instanceof Error ? err.message : String(err);
+        const reason = msg === 'The operation was aborted' || msg.includes('abort')
+            ? `Request timed out after ${timeoutMs}ms`
+            : `Could not reach the proof bridge (${msg})`;
+        return { ok: false, error: reason, code: 'NETWORK_UNREACHABLE' };
+    }
+    clearTimeout(timer);
+    const body = (await res.json().catch(() => null));
+    if (!body) {
+        return {
+            ok: false,
+            error: `Bridge returned a non-JSON response (HTTP ${res.status}).`,
+            code: 'BAD_RESPONSE',
+        };
+    }
+    if (res.ok) {
+        return { ok: true, data: body.data };
+    }
+    return {
+        ok: false,
+        error: body.error ?? res.statusText ?? `HTTP ${res.status}`,
+        code: body.code ?? `HTTP_${res.status}`,
+    };
+}
+export async function runProofRun(options) {
+    const proofName = options.proofName.trim();
+    if (!proofName) {
+        throw new CLIError('Proof name is required.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Usage: pb proof-run <proof-name>',
+        });
+    }
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot) {
+        throw new CLIError('Not inside a Product Brain project (no .productbrain/ found).', {
+            code: ErrorCode.CONFIG_MISSING,
+            category: 'config',
+            guidance: 'Run this from a worktree with a seeded preview (npm run convex:reprovision).',
+        });
+    }
+    const inputs = resolveProofBridgeInputs(projectRoot);
+    // Friendly pre-check — the server is the authority, so we still attempt the call.
+    if (inputs.expiresAt && Date.now() > inputs.expiresAt) {
+        process.stderr.write(`${icons.warn} preview admin token looks expired (${new Date(inputs.expiresAt).toISOString()}); ` +
+            `run \`npm run convex:reprovision\` to mint a fresh one.\n`);
+    }
+    const result = await callProofBridge(inputs, proofName);
+    if (!result.ok) {
+        throw new CLIError(`Proof bridge rejected the run: ${result.error}`, {
+            code: ErrorCode.INTERNAL,
+            category: 'internal',
+            guidance: `Bridge error code: ${result.code}`,
+        });
+    }
+    const verdict = result.data;
+    const proven = verdict && typeof verdict === 'object' && 'zeroHandAuthoringProven' in verdict
+        ? verdict.zeroHandAuthoringProven
+        : undefined;
+    if (typeof proven === 'boolean') {
+        const mark = proven ? green(icons.pass) : red(icons.fail);
+        process.stdout.write(`${mark} ${bold('zeroHandAuthoringProven')}: ${proven}\n`);
+    }
+    process.stdout.write(`${dim(`proof: ${proofName}`)}\n`);
+    process.stdout.write(JSON.stringify(verdict, null, 2) + '\n');
+    // A recognized proof boolean that came back `false` is a FAILED proof, not a successful
+    // run. This command is the agent-surface smoke proof, so its exit status must reflect the
+    // verdict — exit non-zero so operators/CI don't read a failed proof as passing. (We still
+    // print the full verdict above first.) Unrecognized verdicts (no boolean) stay exit-0:
+    // we can't adjudicate a proof we don't model.
+    if (proven === false) {
+        throw new CLIError(`Proof "${proofName}" did not hold: zeroHandAuthoringProven=false.`, {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'The seeded policy seam resolved away from the zero-hand-authoring default — inspect the verdict above.',
+        });
+    }
+}
+//# sourceMappingURL=proof-run.js.map

package/dist/commands/proof-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-run.js","sourceRoot":"","sources":["../../src/commands/proof-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AA0B/D,qFAAqF;AACrF,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAI,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,sDAAsD,EAAE;YACzE,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,yCAAyC;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAa,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAAC,oCAAoC,EAAE;YACvD,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,uDAAuD;SAClE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,oEAAoE,EAAE;YACvF,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,+CAA+C;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAmB,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE;YAChE,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,oFAAoF;IACpF,sFAAsF;IACtF,yFAAyF;IACzF,kFAAkF;IAClF,IAAI,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QACpF,MAAM,IAAI,QAAQ,CAChB,wEAAwE,KAAK,CAAC,WAAW,IAAI;YAC3F,yDAAyD,IAAI,CAAC,WAAW,GAAG,EAC9E;YACE,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,sFAAsF;SACjG,CACF,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,2CAA2C,EAAE;YAC9D,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,sEAAsE;SACjF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC;IAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,8CAA8C,EAAE;YACjE,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,sEAAsE;SACjF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW;QACX,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KAC7E,CAAC;AACJ,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAyB,EACzB,SAAiB,EACjB,SAAS,GAAG,MAAM;IAElB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAE9D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,sBAAsB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,MAAM,CAAC,QAAQ;aACpC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YACpE,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,GAAG,KAAK,2BAA2B,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;YACzE,CAAC,CAAC,2BAA2B,SAAS,IAAI;YAC1C,CAAC,CAAC,qCAAqC,GAAG,GAAG,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;IACnE,CAAC;IACD,YAAY,CAAC,KAAK,CAAC,CAAC;IAEpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAExC,CAAC;IAET,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,6CAA6C,GAAG,CAAC,MAAM,IAAI;YAClE,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE;QAC3D,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE;KACxC,CAAC;AACJ,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE;YAC5C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,kCAAkC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,+DAA+D,EAAE;YAClF,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,8EAA8E;SACzF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAErD,kFAAkF;IAClF,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,CAAC,IAAI,uCAAuC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK;YAC/F,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAExD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,kCAAkC,MAAM,CAAC,KAAK,EAAE,EAAE;YACnE,IAAI,EAAE,SAAS,CAAC,QAAQ;YACxB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,sBAAsB,MAAM,CAAC,IAAI,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5B,MAAM,MAAM,GACV,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,yBAAyB,IAAI,OAAO;QAC5E,CAAC,CAAE,OAAgD,CAAC,uBAAuB;QAC3E,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,yBAAyB,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,UAAU,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9D,wFAAwF;IACxF,0FAA0F;IAC1F,0FAA0F;IAC1F,uFAAuF;IACvF,8CAA8C;IAC9C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,UAAU,SAAS,gDAAgD,EAAE;YACtF,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,wGAAwG;SACnH,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/commands/proposals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proposals.d.ts","sourceRoot":"","sources":["../../src/commands/proposals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAWlD"}
+{"version":3,"file":"proposals.d.ts","sourceRoot":"","sources":["../../src/commands/proposals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAWlD"}

package/dist/commands/proposals.js

@@ -6,7 +6,7 @@
  * Read-only — no active session required.
  */
 import { getConfigOrGuide } from '../lib/config.js';
-import { mcpCall } from '../lib/client.js';
+import { kernelCall } from '../lib/client.js';
 import { runCliCommand } from '../lib/runner.js';
 import { formatProposalsList } from '../formatters/proposals.js';
 export async function runProposals() {
@@ -15,7 +15,7 @@ export async function runProposals() {
         return;
     await runCliCommand({
         fn: async () => {
-            const proposals = await mcpCall('governance.listProposals', {});
+            const proposals = await kernelCall('governance.listProposals', {});
             return { proposals, count: proposals.length };
         },
         formatPretty: (data) => formatProposalsList(data),

package/dist/commands/proposals.js.map

@@ -1 +1 @@
-{"version":3,"file":"proposals.js","sourceRoot":"","sources":["../../src/commands/proposals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAA6C,MAAM,4BAA4B,CAAC;AAE5G,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAoB;QACrC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,SAAS,GAAG,MAAM,OAAO,CAAiB,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAChF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAChD,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;KAClD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"proposals.js","sourceRoot":"","sources":["../../src/commands/proposals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAA6C,MAAM,4BAA4B,CAAC;AAE5G,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAoB;QACrC,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,SAAS,GAAG,MAAM,UAAU,CAAuD,0BAA0B,EAAE,EAAE,CAAC,CAAC;YACzH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAChD,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;KAClD,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/quality.d.ts

@@ -0,0 +1,16 @@
+/**
+ * pb quality spine-check [--story] — A2, WP-581/FEAT-1402.
+ *
+ * Deterministic core (structural completeness + duplicate-singleton finding +
+ * per-strategy refusal heuristic + Roger Martin probe) ALWAYS runs. The
+ * one-story LLM pass (vision_serves_purpose/strategy_serves_vision/
+ * strategy_refuses) runs ONLY with --story — never scheduled, on-demand only.
+ *
+ * Renders from an INDEPENDENT read-back (quality.getLatestSpineVerdict), not
+ * the write action's own return value — the store-then-read-back proof
+ * discipline this codebase applies everywhere a verdict is claimed stored.
+ */
+export declare function runQualitySpineCheck(options: {
+    story?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=quality.d.ts.map

package/dist/commands/quality.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality.d.ts","sourceRoot":"","sources":["../../src/commands/quality.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF"}

package/dist/commands/quality.js

@@ -0,0 +1,29 @@
+/**
+ * pb quality spine-check [--story] — A2, WP-581/FEAT-1402.
+ *
+ * Deterministic core (structural completeness + duplicate-singleton finding +
+ * per-strategy refusal heuristic + Roger Martin probe) ALWAYS runs. The
+ * one-story LLM pass (vision_serves_purpose/strategy_serves_vision/
+ * strategy_refuses) runs ONLY with --story — never scheduled, on-demand only.
+ *
+ * Renders from an INDEPENDENT read-back (quality.getLatestSpineVerdict), not
+ * the write action's own return value — the store-then-read-back proof
+ * discipline this codebase applies everywhere a verdict is claimed stored.
+ */
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCall } from '../lib/client.js';
+import { runCliCommand } from '../lib/runner.js';
+import { formatSpineVerdict } from '../formatters/spineCheck.js';
+export async function runQualitySpineCheck(options) {
+    const config = await getConfigOrGuide(() => runQualitySpineCheck(options));
+    if (!config)
+        return;
+    await runCliCommand({
+        fn: async () => {
+            await kernelCall('quality.spineCheck', { includeStory: Boolean(options.story) });
+            return await kernelCall('quality.getLatestSpineVerdict', {});
+        },
+        formatPretty: (row) => formatSpineVerdict(row),
+    });
+}
+//# sourceMappingURL=quality.js.map

package/dist/commands/quality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality.js","sourceRoot":"","sources":["../../src/commands/quality.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAwB,MAAM,6BAA6B,CAAC;AAEvF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA4B;IACrE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAyB;QAC1C,EAAE,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,UAAU,CAAC,oBAAoB,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO,MAAM,UAAU,CAAyB,+BAA+B,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC;KAC/C,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/questions.d.ts

@@ -0,0 +1,33 @@
+import { Command } from 'commander';
+export interface QuestionCreateOptions {
+    domain?: string;
+    blocks?: string[];
+}
+export declare function runQuestionCreateVerb(text: string, options: QuestionCreateOptions): Promise<void>;
+export interface QuestionAdoptOptions {
+    domain?: string;
+    blocks?: string[];
+}
+export declare function runQuestionAdopt(entryId: string, options: QuestionAdoptOptions): Promise<void>;
+export interface QuestionAssignOptions {
+    toRole?: string;
+    toPerson?: string;
+}
+export declare function runQuestionAssign(entryId: string, options: QuestionAssignOptions): Promise<void>;
+export declare function runQuestionSnooze(entryId: string): Promise<void>;
+export declare function runQuestionDecline(entryId: string, options: {
+    reason: string;
+}): Promise<void>;
+export interface QuestionAnswerOptions {
+    entry?: string;
+}
+export declare function runQuestionAnswer(entryId: string, text: string | undefined, options: QuestionAnswerOptions): Promise<void>;
+export declare function runQuestionForceClose(entryId: string, options: {
+    reason: string;
+}): Promise<void>;
+export interface QuestionListOptions {
+    mine?: boolean;
+}
+export declare function runQuestionList(options: QuestionListOptions): Promise<void>;
+export declare function createQuestionCommand(): Command;
+//# sourceMappingURL=questions.d.ts.map

package/dist/commands/questions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"questions.d.ts","sourceRoot":"","sources":["../../src/commands/questions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0FpC,MAAM,WAAW,qBAAqB;IAAG,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE;AAS7E,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBvG;AAID,MAAM,WAAW,oBAAoB;IAAG,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE;AAE5E,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBpG;AAID,MAAM,WAAW,qBAAqB;IAAG,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE;AAE7E,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBtG;AAID,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CActE;AAID,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBpG;AAID,MAAM,WAAW,qBAAqB;IAAG,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAEzD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoChI;AAID,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBvG;AAID,MAAM,WAAW,mBAAmB;IAAG,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE;AAEvD,wBAAsB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjF;AAID,wBAAgB,qBAAqB,IAAI,OAAO,CAoD/C"}