@productbrain/cli 0.1.0-beta.47 → 0.1.0-beta.4721

package/dist/lib/canonicalRefs.d.ts

@@ -0,0 +1,160 @@
+/**
+ * Synced from convex/lib/canonicalRefs.ts (WP-345: canonical refs, NG4: CLI import boundary).
+ * GENERATED by scripts/generate-canonical-refs-copies.mjs — DO NOT EDIT BY HAND.
+ * Run `npm run refs:sync` to regenerate after editing the source.
+ */
+/**
+ * Canonical Refs — pure parser for semantic ref syntax.
+ *
+ * WP-640 S2 (TASK-63): THIS FILE IS THE SINGLE SOURCE. `packages/cli/src/lib/canonicalRefs.ts`
+ * and `packages/mcp-server/src/lib/canonicalRefs.ts` are GENERATED mirrors (scripts/generate-
+ * canonical-refs-copies.mjs) — never hand-edit them. Edit here, then `npm run refs:sync` (writes
+ * both copies) and `npm run refs:sync:check` to verify (no drift). Folding all three into a real
+ * shared package (e.g. `kernel`, which already declares "ZERO Convex imports" and is already a
+ * `cli` devDependency) was considered and DECLINED: `scripts/check-mcp-boundaries.mjs` (BR-25,
+ * TEN-174) unconditionally fails any `packages/mcp-server/src` file importing from outside the
+ * package — a live `kernel` import there is structurally blocked, not just risky — and a new
+ * kernel/ folder also needs a WP-537 kind-manifest row. This generate+check pair reuses the SAME
+ * "copy-free at the source-editing level, physically-copied at the build level" pattern
+ * `scripts/generate-mcp-embedded-copies.mjs` already established for flags_core.ts/logo-markup.ts
+ * for exactly this MCP-boundary reason — not a new mechanism, the established one. It collapses
+ * the "3 independently hand-copy-pasted files" problem the doneWhen names (a human previously had
+ * to remember to edit three files identically) down to ONE edited source with caught drift. NG4
+ * (WP-345) is UNCHANGED: CLI/MCP still must not import the resolver (convex/canonicalRefs.ts, no
+ * `lib/`) — only this pure parser.
+ *
+ * Zero Convex imports. This file is drift-synced to:
+ *   - packages/cli/src/lib/canonicalRefs.ts (CLI copy — identical logic)
+ *   - packages/mcp-server/src/lib/canonicalRefs.ts (MCP copy — identical logic)
+ *
+ * NG4 (WP-345): CLI/MCP MUST NOT import the resolver (convex/canonicalRefs.ts).
+ * They import only this pure parser module.
+ *
+ * DEC-A/WP-354: semantic refs syntax is {{ref:canonicalKey}},
+ * {{ref:canonicalKey:display}}, {{ref:domain:data/analytics}}, or
+ * {{ref:entry:DEC-123}}.
+ * Chain: WP-345 E4, DEC-K (projection hash trailer)
+ *
+ * WP-436 S1 — Axis 2 vocabulary resolver (DEC-1021, STD-253):
+ * {{vocab:<canonicalKey>.<form>}} tokens + getCollectionLabel resolver.
+ * PAT-230: resolver is pure — no Convex import, workspace context passed as arg.
+ */
+/**
+ * WP-354 Build-Order #6: Setup-ref resolver return shape.
+ *
+ * All consumers (CLI, MCP, handshake, editor health) must read
+ * the discriminated kind+status fields instead of an optional resolved object.
+ *
+ * Spec: docs/system/design/authority-domains-design-spec.md §632
+ * Chain: WP-354 Slice H, STD-101 (single source of truth)
+ *
+ * drift-synced to:
+ *   - packages/cli/src/lib/canonicalRefs.ts
+ *   - packages/mcp-server/src/lib/canonicalRefs.ts
+ */
+export type SetupRefResolution = {
+    ref: string;
+    kind: 'entry' | 'domain' | 'seed' | 'unknown';
+    status: 'resolved' | 'unresolved' | 'unsupported-future' | 'invalid';
+    /** Human-readable entryId (e.g. 'BR-5'). Only when status='resolved' for kind='entry' or 'domain'. */
+    localEntryId?: string;
+    /** Domain slug (e.g. 'engineering/backend'). Only when kind='domain' and status='resolved'. */
+    canonicalSlug?: string;
+    /** true when kind is 'entry' or 'domain'; false for seed/unknown */
+    required: boolean;
+    message?: string;
+    action?: string;
+};
+/**
+ * Extracts canonical keys from a body string.
+ * Handles {{ref:key}} and {{ref:key:display}}.
+ *
+ * Returns deduplicated array of canonical keys in order of first appearance.
+ */
+export declare function parseSemanticRefs(body: string): string[];
+/**
+ * Renders a resolved ref for display in projected output.
+ * Falls back to the raw key wrapped in brackets if no resolved name is available.
+ *
+ * Examples:
+ *   renderSemanticRef('bet', 'Active Bets')  → 'Active Bets'
+ *   renderSemanticRef('bet')                 → '[bet]'
+ *   renderSemanticRef('bet', undefined)      → '[bet]'
+ */
+export declare function renderSemanticRef(key: string, resolvedName?: string): string;
+/**
+ * Replaces all semantic refs in a body string with their resolved display names.
+ *
+ * resolvedMap: Map<canonicalKey, resolvedName> — keys not in the map are rendered
+ * as [unresolved: key] to make missing refs visible.
+ */
+export declare function replaceSemanticRefs(body: string, resolvedMap: Map<string, string>): string;
+/**
+ * Label set for a single canonical type (Axis 2, DEC-1021).
+ * All fields optional — undefined means "derive from next layer".
+ */
+export type LabelSet = {
+    singular?: string;
+    plural?: string;
+    verb_start?: string;
+    verb_commit?: string;
+    verb_review?: string;
+    verb_complete?: string;
+    verb_archive?: string;
+};
+/** Valid form names for a LabelSet. */
+export type LabelForm = keyof LabelSet;
+/**
+ * Minimal workspace context for Axis 2 resolution.
+ * Passed by the caller — keeps the resolver pure (PAT-230).
+ */
+export type WorkspaceVocabCtx = {
+    /** Per-workspace overrides: canonicalKey → LabelSet (partial). */
+    collectionLabels?: Record<string, LabelSet | undefined>;
+    /**
+     * Layer 2 defaults from system_collection_definitions.labels, keyed by canonicalKey.
+     * Fetched via chain.getVocabulary collectionDefaults and threaded through by the caller.
+     * Used as fallback when no workspace override exists and collectionCtx is not passed.
+     * WP-436 completion — wires dead Layer 2 to consumers.
+     */
+    collectionDefaults?: Record<string, LabelSet | undefined>;
+};
+/**
+ * Minimal collection context for Axis 2 resolution.
+ * Passed by the caller — keeps the resolver pure (PAT-230).
+ */
+export type CollectionVocabCtx = {
+    /** Collection-level default labels (from system_collection_definitions.labels). */
+    labels?: LabelSet;
+};
+/**
+ * Regex for matching vocab tokens: {{vocab:<canonicalKey>.<form>}}
+ * STD-253: canonicalKey + form are both lowercase snake_case.
+ * Captures: [1] canonicalKey, [2] form.
+ */
+export declare const VOCAB_TOKEN_REGEX: RegExp;
+/**
+ * Resolve the display label for a canonical type + form.
+ *
+ * Resolution chain (DEC-1021):
+ *   1. workspaceCtx.collectionLabels[canonicalKey][form]  — workspace override
+ *   2. collectionCtx.labels[form]                         — collection default
+ *   3. canonicalKey literal                               — fallback (no throw)
+ *
+ * Pure function. No Convex imports. No side effects. (PAT-230)
+ *
+ * @param canonicalKey - e.g. 'work_package', 'decision'
+ * @param form - e.g. 'singular', 'plural', 'verb_start'
+ * @param workspaceCtx - optional workspace-level override context
+ * @param collectionCtx - optional collection-level default context
+ * @returns resolved label string
+ */
+export declare function getCollectionLabel(canonicalKey: string, form: string, workspaceCtx?: WorkspaceVocabCtx, collectionCtx?: CollectionVocabCtx): string;
+/**
+ * Replace all {{vocab:<canonicalKey>.<form>}} tokens in a string.
+ *
+ * For each token, calls getCollectionLabel with the provided contexts.
+ * STD-253.
+ */
+export declare function replaceVocabTokens(body: string, workspaceCtx?: WorkspaceVocabCtx, collectionCtxMap?: Map<string, CollectionVocabCtx>): string;
+//# sourceMappingURL=canonicalRefs.d.ts.map

package/dist/lib/canonicalRefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalRefs.d.ts","sourceRoot":"","sources":["../../src/lib/canonicalRefs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IAC9C,MAAM,EACH,UAAU,GACV,YAAY,GACZ,oBAAoB,GACpB,SAAS,CACV;IACF,sGAAsG;IACtG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAOF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBxD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAgB1F;AAOD;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,uCAAuC;AACvC,MAAM,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC;AAEvC;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC/B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;IACxD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;CAC1D,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAChC,mFAAmF;IACnF,MAAM,CAAC,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,QAAwC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CACjC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,iBAAiB,EAChC,aAAa,CAAC,EAAE,kBAAkB,GAChC,MAAM,CAyBR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,iBAAiB,EAChC,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAChD,MAAM,CASR"}

package/dist/lib/canonicalRefs.js

@@ -0,0 +1,169 @@
+/**
+ * Synced from convex/lib/canonicalRefs.ts (WP-345: canonical refs, NG4: CLI import boundary).
+ * GENERATED by scripts/generate-canonical-refs-copies.mjs — DO NOT EDIT BY HAND.
+ * Run `npm run refs:sync` to regenerate after editing the source.
+ */
+/**
+ * Canonical Refs — pure parser for semantic ref syntax.
+ *
+ * WP-640 S2 (TASK-63): THIS FILE IS THE SINGLE SOURCE. `packages/cli/src/lib/canonicalRefs.ts`
+ * and `packages/mcp-server/src/lib/canonicalRefs.ts` are GENERATED mirrors (scripts/generate-
+ * canonical-refs-copies.mjs) — never hand-edit them. Edit here, then `npm run refs:sync` (writes
+ * both copies) and `npm run refs:sync:check` to verify (no drift). Folding all three into a real
+ * shared package (e.g. `kernel`, which already declares "ZERO Convex imports" and is already a
+ * `cli` devDependency) was considered and DECLINED: `scripts/check-mcp-boundaries.mjs` (BR-25,
+ * TEN-174) unconditionally fails any `packages/mcp-server/src` file importing from outside the
+ * package — a live `kernel` import there is structurally blocked, not just risky — and a new
+ * kernel/ folder also needs a WP-537 kind-manifest row. This generate+check pair reuses the SAME
+ * "copy-free at the source-editing level, physically-copied at the build level" pattern
+ * `scripts/generate-mcp-embedded-copies.mjs` already established for flags_core.ts/logo-markup.ts
+ * for exactly this MCP-boundary reason — not a new mechanism, the established one. It collapses
+ * the "3 independently hand-copy-pasted files" problem the doneWhen names (a human previously had
+ * to remember to edit three files identically) down to ONE edited source with caught drift. NG4
+ * (WP-345) is UNCHANGED: CLI/MCP still must not import the resolver (convex/canonicalRefs.ts, no
+ * `lib/`) — only this pure parser.
+ *
+ * Zero Convex imports. This file is drift-synced to:
+ *   - packages/cli/src/lib/canonicalRefs.ts (CLI copy — identical logic)
+ *   - packages/mcp-server/src/lib/canonicalRefs.ts (MCP copy — identical logic)
+ *
+ * NG4 (WP-345): CLI/MCP MUST NOT import the resolver (convex/canonicalRefs.ts).
+ * They import only this pure parser module.
+ *
+ * DEC-A/WP-354: semantic refs syntax is {{ref:canonicalKey}},
+ * {{ref:canonicalKey:display}}, {{ref:domain:data/analytics}}, or
+ * {{ref:entry:DEC-123}}.
+ * Chain: WP-345 E4, DEC-K (projection hash trailer)
+ *
+ * WP-436 S1 — Axis 2 vocabulary resolver (DEC-1021, STD-253):
+ * {{vocab:<canonicalKey>.<form>}} tokens + getCollectionLabel resolver.
+ * PAT-230: resolver is pure — no Convex import, workspace context passed as arg.
+ */
+/**
+ * Regex for matching semantic refs. Captures: [1] ref key/path, [2] optional display label.
+ */
+const SEMANTIC_REF_REGEX = /\{\{ref:([a-zA-Z0-9_./-]+(?::[a-zA-Z0-9_./-]+)?)(?::([^}]+))?\}\}/g;
+/**
+ * Extracts canonical keys from a body string.
+ * Handles {{ref:key}} and {{ref:key:display}}.
+ *
+ * Returns deduplicated array of canonical keys in order of first appearance.
+ */
+export function parseSemanticRefs(body) {
+    if (!body || body.length === 0)
+        return [];
+    const keys = [];
+    const seen = new Set();
+    // Reset lastIndex for global regex before each use
+    const regex = new RegExp(SEMANTIC_REF_REGEX.source, 'g');
+    let match;
+    while ((match = regex.exec(body)) !== null) {
+        const key = match[1];
+        if (key && !seen.has(key)) {
+            seen.add(key);
+            keys.push(key);
+        }
+    }
+    return keys;
+}
+/**
+ * Renders a resolved ref for display in projected output.
+ * Falls back to the raw key wrapped in brackets if no resolved name is available.
+ *
+ * Examples:
+ *   renderSemanticRef('bet', 'Active Bets')  → 'Active Bets'
+ *   renderSemanticRef('bet')                 → '[bet]'
+ *   renderSemanticRef('bet', undefined)      → '[bet]'
+ */
+export function renderSemanticRef(key, resolvedName) {
+    if (resolvedName && resolvedName.trim().length > 0) {
+        return resolvedName.trim();
+    }
+    return `[${key}]`;
+}
+/**
+ * Replaces all semantic refs in a body string with their resolved display names.
+ *
+ * resolvedMap: Map<canonicalKey, resolvedName> — keys not in the map are rendered
+ * as [unresolved: key] to make missing refs visible.
+ */
+export function replaceSemanticRefs(body, resolvedMap) {
+    if (!body || body.length === 0)
+        return body;
+    const regex = new RegExp(SEMANTIC_REF_REGEX.source, 'g');
+    return body.replace(regex, (_match, key, displayLabel) => {
+        // If an inline display label is provided, it takes precedence over the resolved name
+        if (displayLabel && displayLabel.trim().length > 0) {
+            return displayLabel.trim();
+        }
+        const resolved = resolvedMap.get(key);
+        if (resolved) {
+            return resolved;
+        }
+        return `[unresolved: ${key}]`;
+    });
+}
+/**
+ * Regex for matching vocab tokens: {{vocab:<canonicalKey>.<form>}}
+ * STD-253: canonicalKey + form are both lowercase snake_case.
+ * Captures: [1] canonicalKey, [2] form.
+ */
+export const VOCAB_TOKEN_REGEX = /\{\{vocab:([a-z_]+)\.([a-z_]+)\}\}/g;
+/**
+ * Resolve the display label for a canonical type + form.
+ *
+ * Resolution chain (DEC-1021):
+ *   1. workspaceCtx.collectionLabels[canonicalKey][form]  — workspace override
+ *   2. collectionCtx.labels[form]                         — collection default
+ *   3. canonicalKey literal                               — fallback (no throw)
+ *
+ * Pure function. No Convex imports. No side effects. (PAT-230)
+ *
+ * @param canonicalKey - e.g. 'work_package', 'decision'
+ * @param form - e.g. 'singular', 'plural', 'verb_start'
+ * @param workspaceCtx - optional workspace-level override context
+ * @param collectionCtx - optional collection-level default context
+ * @returns resolved label string
+ */
+export function getCollectionLabel(canonicalKey, form, workspaceCtx, collectionCtx) {
+    // Layer 1: workspace override
+    const wsLabels = workspaceCtx?.collectionLabels?.[canonicalKey];
+    if (wsLabels) {
+        const wsVal = wsLabels[form];
+        if (wsVal !== undefined && wsVal.length > 0)
+            return wsVal;
+    }
+    // Layer 2: explicit collection ctx (granular call sites — handshake projector)
+    const colLabels = collectionCtx?.labels;
+    if (colLabels) {
+        const colVal = colLabels[form];
+        if (colVal !== undefined && colVal.length > 0)
+            return colVal;
+    }
+    // Layer 2.5: collection defaults from WorkspaceVocabCtx (threaded via chain.getVocabulary)
+    // New: wires the dead Layer 2 path for consumers that don't pass explicit collectionCtx.
+    const defaultLabels = workspaceCtx?.collectionDefaults?.[canonicalKey];
+    if (defaultLabels) {
+        const defVal = defaultLabels[form];
+        if (defVal !== undefined && defVal.length > 0)
+            return defVal;
+    }
+    // Layer 3: canonicalKey literal fallback
+    return canonicalKey;
+}
+/**
+ * Replace all {{vocab:<canonicalKey>.<form>}} tokens in a string.
+ *
+ * For each token, calls getCollectionLabel with the provided contexts.
+ * STD-253.
+ */
+export function replaceVocabTokens(body, workspaceCtx, collectionCtxMap) {
+    if (!body || body.length === 0)
+        return body;
+    const regex = new RegExp(VOCAB_TOKEN_REGEX.source, 'g');
+    return body.replace(regex, (_match, canonicalKey, form) => {
+        const collectionCtx = collectionCtxMap?.get(canonicalKey);
+        return getCollectionLabel(canonicalKey, form, workspaceCtx, collectionCtx);
+    });
+}
+//# sourceMappingURL=canonicalRefs.js.map

package/dist/lib/canonicalRefs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalRefs.js","sourceRoot":"","sources":["../../src/lib/canonicalRefs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAkCH;;GAEG;AACH,MAAM,kBAAkB,GAAG,oEAAoE,CAAC;AAEhG;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,mDAAmD;IACnD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,YAAqB;IACnE,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,GAAG,GAAG,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAAgC;IACjF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEzD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAW,EAAE,YAAgC,EAAE,EAAE;QACpF,qFAAqF;QACrF,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,OAAO,gBAAgB,GAAG,GAAG,CAAC;IAC/B,CAAC,CAAC,CAAC;AACJ,CAAC;AAiDD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CACjC,YAAoB,EACpB,IAAY,EACZ,YAAgC,EAChC,aAAkC;IAElC,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,YAAY,EAAE,gBAAgB,EAAE,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAI,QAA+C,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3D,CAAC;IAED,+EAA+E;IAC/E,MAAM,SAAS,GAAG,aAAa,EAAE,MAAM,CAAC;IACxC,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAI,SAAgD,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IAC9D,CAAC;IAED,2FAA2F;IAC3F,yFAAyF;IACzF,MAAM,aAAa,GAAG,YAAY,EAAE,kBAAkB,EAAE,CAAC,YAAY,CAAC,CAAC;IACvE,IAAI,aAAa,EAAE,CAAC;QACnB,MAAM,MAAM,GAAI,aAAoD,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IAC9D,CAAC;IAED,yCAAyC;IACzC,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,IAAY,EACZ,YAAgC,EAChC,gBAAkD;IAElD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAExD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,YAAoB,EAAE,IAAY,EAAE,EAAE;QACzE,MAAM,aAAa,GAAG,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1D,OAAO,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/lib/client.d.ts

@@ -9,21 +9,18 @@
  * sandboxed environments (Claude Code, Cursor) without requiring
  * NODE_OPTIONS="--use-env-proxy".
  */
+import type { ValidationErrorDetail } from './kernelEnvelope.js';
 import { CLIError } from './errors.js';
-/** Structured field-level detail from a VALIDATION_FAILED response. */
-export interface ValidationErrorDetail {
-    fieldKey: string;
-    fieldLabel: string;
-    invalidValue: unknown;
-    validOptions?: string[];
-    errorType: 'type_mismatch' | 'invalid_option' | 'required';
-    message: string;
-}
-/** Error thrown by mcpCall/mcpCallWithSession when the server returns a non-OK response. */
+import { type KernelCallOptions } from './rate-limit.js';
+/** Error thrown by kernelCall/kernelCallWithSession when the server returns a non-OK response. */
 export declare class McpError extends CLIError {
     details?: ValidationErrorDetail[];
-    constructor(message: string, code?: string, details?: ValidationErrorDetail[]);
+    /** Present only when code === 'rate-limited' — seconds until the caller may retry. */
+    retryAfterSeconds?: number;
+    constructor(message: string, code?: string, details?: ValidationErrorDetail[], retryAfterSeconds?: number);
 }
+export { resetTouchThrottle, type KernelCallOptions } from './rate-limit.js';
+export type { KernelEnvelope, ValidationErrorDetail } from './kernelEnvelope.js';
 /** Result of validateKey — used by `pb login` to verify a key before saving. */
 export type ValidateKeyResult = {
     valid: true;
@@ -39,21 +36,48 @@ export type ValidateKeyResult = {
  * Returns { valid: true, workspaceId } on success.
  * Returns { valid: false, error } on auth failure (401) or other server error.
  * Throws on network/timeout errors so the caller can distinguish "bad key" from "can't reach server".
+ *
+ * WP-575: `timeoutMs` now DEFAULTS to `resolveWorkspace`'s declared budget instead of a
+ * local `5000` literal — that literal was the last connector-owned timeout on the gateway
+ * path, and the point of this work package is that no connector gets to pick its own. It
+ * stays an explicit parameter so a caller (or a test) can still override deliberately.
+ * Widening 5s -> the declared 10s costs nothing in the case people actually hit: an
+ * unreachable host fails with ECONNREFUSED/ENOTFOUND immediately, not by timeout. The
+ * timeout only governs a server that ACCEPTS the connection then stalls, where waiting the
+ * route's real declared budget before calling the key invalid is the correct behavior.
  */
 export declare function validateKey(apiKey: string, siteUrl: string, timeoutMs?: number): Promise<ValidateKeyResult>;
 /** Get a human-friendly spinner label for an MCP function name. */
 export declare function spinnerLabel(fn: string): string;
 /**
- * POST to the admin gateway (/api/admin) — separate from /api/mcp (STD-101, BR-109).
+ * POST to the admin gateway (/api/admin) — separate from /api/aki (STD-101, BR-109).
  * Admin operations are not knowledge operations — they target the operator surface.
  *
  * No built-in spinner: callers wrap with withSpinner when appropriate.
  * Throws CLIError on auth failure or non-OK response.
  */
 export declare function adminCall(command: string, args?: Record<string, unknown>): Promise<unknown>;
-export declare function mcpCall<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
+export declare function kernelCall<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<T>;
+/**
+ * kernelCall variant that returns the full kernel envelope (data + summary + _meta) instead
+ * of stripping to just `data` — mirrors packages/mcp-server/src/client.ts's
+ * `kernelCallEnvelope`. Use when a caller needs `_meta` (e.g. a route-specific additive
+ * flag like chain.shapeAdvisories' `truncated`, WP-571 sweep) without changing `data`'s own
+ * shape — the reason `_meta` exists as a side-channel at all (convex/lib/envelopeContract.ts).
+ */
+export declare function kernelCallEnvelope<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<{
+    data: T;
+    summary?: string;
+    _meta?: {
+        durationMs?: number;
+        truncated?: boolean;
+    };
+}>;
 /**
- * mcpCall variant that injects X-Agent-Session-Id header for write operations.
+ * kernelCall variant for write operations. Callers that need server-side session
+ * validation (e.g. `chain.verifyEntry`) pass `sessionId` in `args` explicitly —
+ * it now travels in the request body, not a header (http.ts never read the old
+ * `X-Agent-Session-Id` header).
  * All write commands (update, relate, unrelate, capture) should use this.
  *
  * After a successful write, fires a non-blocking `agent.touchSession` call to
@@ -62,5 +86,5 @@ export declare function mcpCall<T = unknown>(fn: string, args?: Record<string, u
  * are silently swallowed. No touch is attempted if no session is active or if
  * the write itself fails.
  */
-export declare function mcpCallWithSession<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
+export declare function kernelCallWithSession<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<T>;
 //# sourceMappingURL=client.d.ts.map

package/dist/lib/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,QAAQ,EAAa,MAAM,aAAa,CAAC;AAIlD,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,UAAU,CAAC;IAC3D,OAAO,EAAE,MAAM,CAAC;CACjB;AAeD,4FAA4F;AAC5F,qBAAa,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;gBAEtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,EAAE;CAQ9E;AAwCD,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpC;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,SAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAuC5B;AA0BD,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED,wBAAsB,OAAO,CAAC,CAAC,GAAG,OAAO,EACvC,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CAyBZ;AA0BD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,GAAG,OAAO,EAClD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CAwCZ"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAIjF,OAAO,EAAE,QAAQ,EAAa,MAAM,aAAa,CAAC;AAGlD,OAAO,EAAkC,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAoDzF,kGAAkG;AAClG,qBAAa,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAClC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM;CAe1G;AAID,OAAO,EAAE,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAK7E,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAoDjF,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,SAA8C,GACtD,OAAO,CAAC,iBAAiB,CAAC,CAqC5B;AA6BD,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,OAAO,CAAC,CAgClB;AASD,wBAAsB,UAAU,CAAC,CAAC,GAAG,OAAO,EAC1C,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC,CAgCZ;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,GAAG,OAAO,EAClD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC,CA4B9F;AA+BD;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC,CA+CZ"}