@productbrain/cli 0.1.0-beta.49 → 0.1.0-beta.4900

package/dist/lib/errors.js

@@ -20,17 +20,84 @@ export const ErrorCode = {
     CONFIG_INVALID: 'CONFIG_INVALID',
     // Session
     SESSION_REQUIRED: 'SESSION_REQUIRED',
+    /** Session close blocked: uncommitted drafts remain (TEN-2370). Non-zero exit unless --force. */
+    LOOP_UNFINISHED: 'LOOP_UNFINISHED',
     // Validation
     VALIDATION_FAILED: 'VALIDATION_FAILED',
+    /** Kernel / MCP quality gate (e.g. verify-before-commit). */
+    QUALITY_GATE_BLOCKED: 'QUALITY_GATE_BLOCKED',
+    /**
+     * Grounding gate refused a draft→active promotion (WP-455 E3 / WP-475 E2):
+     * verify grounding or accept via the audited acceptEntry override.
+     */
+    GROUNDING_GATE_BLOCKED: 'GROUNDING_GATE_BLOCKED',
+    /**
+     * Semantic quality gate refused a draft→active promotion on a gated
+     * collection (WP-475 E4 / DEC-1345): fix the draft per the returned coaching
+     * (weakest criterion + question) — or, when the verdict was missing/stale,
+     * retry once the scheduled fresh judgment lands. No override route.
+     */
+    SEMANTIC_QUALITY_GATE_BLOCKED: 'SEMANTIC_QUALITY_GATE_BLOCKED',
+    /**
+     * `paginationOpts.cursor` handed to `chain.listAutoLinkSuggestions` was not issued by that
+     * exact (workspaceId, status) query — undecodable, or minted for a different status
+     * (WP-477 / FEAT-1350). Pass the previous page's `continueCursor` back verbatim, or `null`
+     * to restart. Never silently reset: a reset re-walks rows the drain already handled.
+     */
+    CURSOR_QUERY_MISMATCH: 'CURSOR_QUERY_MISMATCH',
+    /**
+     * Convex could not return a complete page of `autoLinkSuggestions` even after the server's
+     * bounded halve-and-retry (WP-477 / FEAT-1350). Retry with a smaller
+     * `paginationOpts.numItems`. Never downgraded to a silent short page — resuming from an
+     * incomplete page's cursor would SKIP rows.
+     */
+    PAGE_SPLIT_REQUIRED: 'PAGE_SPLIT_REQUIRED',
+    /**
+     * Convex's OWN argument validator rejected the call shape — a required arg missing,
+     * an unknown extra arg, or a wrong-typed arg (TEN-2647). Fix the offending argument
+     * named in the message; never retry an unchanged call. A 400, not an internal fault.
+     * Mirror of convex/lib/errors.ts ErrorCodes.ARGUMENT_VALIDATION_FAILED.
+     */
+    ARGUMENT_VALIDATION_FAILED: 'ARGUMENT_VALIDATION_FAILED',
+    /**
+     * commitEntry's server-side contradiction gate (WP-485 Slice 2a, entries.ts) blocked the
+     * commit. DEAD-BUT-TYPED while DEC-1321 keeps `graduated: false` — disposition can only be
+     * allow/advisory, never block (evaluate.ts:533) — so this never fires today. Typed now so a
+     * future policy graduation needs no CLI retrofit. Mirror of the server's thrown
+     * `ConvexError({ code: 'CONTRADICTION_BLOCKED' })` (entries.ts, batchCommitConstellation too).
+     */
+    CONTRADICTION_BLOCKED: 'CONTRADICTION_BLOCKED',
+    /**
+     * Agent-submitted product feedback is switched off for this workspace
+     * (WP-494 / TEN-2742): `pb feedback submit` hits this when
+     * `productFeedbackPolicy.agentSubmissions` is off. Not a bug — an admin or
+     * owner disabled it; the message names the setting and the re-enable path.
+     * Mirror of convex/lib/errors.ts ErrorCodes.AGENT_FEEDBACK_DISABLED.
+     */
+    AGENT_FEEDBACK_DISABLED: 'AGENT_FEEDBACK_DISABLED',
+    /**
+     * Per-key API quota exceeded (TEN-656). Mirror of convex/lib/errors.ts
+     * ErrorCodes.RATE_LIMITED. Retryable — the caller waits `retryAfterSeconds`
+     * (on McpError) then retries the same call unchanged.
+     */
+    RATE_LIMITED: 'rate-limited',
     // Profile (WP-302 S2)
     PROFILE_NOT_FOUND: 'PROFILE_NOT_FOUND',
     PROFILE_ALREADY_EXISTS: 'PROFILE_ALREADY_EXISTS',
     PROFILE_IS_ACTIVE: 'PROFILE_IS_ACTIVE',
     PROFILE_IS_LAST: 'PROFILE_IS_LAST',
     PROFILE_NAME_INVALID: 'PROFILE_NAME_INVALID',
+    /**
+     * `pb connect` would overwrite an existing profile that holds DIFFERENT credentials
+     * (TEN-2851). Never a silent side-effect of a workspace-name slug collision — the caller
+     * must confirm interactively, or fails closed non-interactively with a named escape hatch
+     * (`PB_PROFILE=<other-name>`).
+     */
+    PROFILE_CREDENTIALS_CONFLICT: 'PROFILE_CREDENTIALS_CONFLICT',
     // Interactive
     NON_INTERACTIVE: 'NON_INTERACTIVE',
     // Internal
+    UPGRADE_FAILED: 'UPGRADE_FAILED',
     INTERNAL: 'INTERNAL',
 };
 /**

package/dist/lib/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,sEAAsE;AACtE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,OAAO;IACP,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;IAC1B,UAAU;IACV,mBAAmB,EAAE,qBAAqB;IAC1C,eAAe,EAAE,iBAAiB;IAClC,SAAS;IACT,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,UAAU;IACV,gBAAgB,EAAE,kBAAkB;IACpC,aAAa;IACb,iBAAiB,EAAE,mBAAmB;IACtC,sBAAsB;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,sBAAsB,EAAE,wBAAwB;IAChD,iBAAiB,EAAE,mBAAmB;IACtC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,cAAc;IACd,eAAe,EAAE,iBAAiB;IAClC,WAAW;IACX,QAAQ,EAAE,UAAU;CACZ,CAAC;AAIX;;;;;;;;;GASG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAiB;IACrB,QAAQ,CAAgB;IACxB,QAAQ,CAAU;IAE3B,YACE,OAAe,EACf,OAIC;QAED,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,UAAU,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;IACpC,CAAC;IAED,uCAAuC;IACvC,MAAM;QACJ,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,sEAAsE;AACtE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,OAAO;IACP,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;IAC1B,UAAU;IACV,mBAAmB,EAAE,qBAAqB;IAC1C,eAAe,EAAE,iBAAiB;IAClC,SAAS;IACT,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,UAAU;IACV,gBAAgB,EAAE,kBAAkB;IACpC,iGAAiG;IACjG,eAAe,EAAE,iBAAiB;IAClC,aAAa;IACb,iBAAiB,EAAE,mBAAmB;IACtC,6DAA6D;IAC7D,oBAAoB,EAAE,sBAAsB;IAC5C;;;OAGG;IACH,sBAAsB,EAAE,wBAAwB;IAChD;;;;;OAKG;IACH,6BAA6B,EAAE,+BAA+B;IAC9D;;;;;OAKG;IACH,qBAAqB,EAAE,uBAAuB;IAC9C;;;;;OAKG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;;OAKG;IACH,0BAA0B,EAAE,4BAA4B;IACxD;;;;;;OAMG;IACH,qBAAqB,EAAE,uBAAuB;IAC9C;;;;;;OAMG;IACH,uBAAuB,EAAE,yBAAyB;IAClD;;;;OAIG;IACH,YAAY,EAAE,cAAc;IAC5B,sBAAsB;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,sBAAsB,EAAE,wBAAwB;IAChD,iBAAiB,EAAE,mBAAmB;IACtC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C;;;;;OAKG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc;IACd,eAAe,EAAE,iBAAiB;IAClC,WAAW;IACX,cAAc,EAAE,gBAAgB;IAChC,QAAQ,EAAE,UAAU;CACZ,CAAC;AAIX;;;;;;;;;GASG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAiB;IACrB,QAAQ,CAAgB;IACxB,QAAQ,CAAU;IAE3B,YACE,OAAe,EACf,OAIC;QAED,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,UAAU,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;IACpC,CAAC;IAED,uCAAuC;IACvC,MAAM;QACJ,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;CACF"}

package/dist/lib/frontmatter.d.ts

@@ -0,0 +1,55 @@
+/**
+ * parseSetupFrontmatter — the single shared YAML-frontmatter parser for setup
+ * authoring assets (skills / rules / hooks).
+ *
+ * Unifies three previously-divergent copies that lived inline in:
+ *   - commands/handshake.ts    (parseSetupAuthoringFrontmatter)
+ *   - commands/migrate-setup.ts (parseFrontmatter)
+ *   - commands/setup-ingest.ts  (parseFrontmatter)
+ *
+ * The three were identical on scalar fields but DIVERGED on array items:
+ * handshake stripped surrounding quotes from each `- item`, the other two did
+ * not. That meant a trigger written as `- "triage: [anything]"` survived as
+ * `triage: [anything]` through handshake but as `"triage: [anything]"` through
+ * migrate/ingest — the same file produced different DB rows depending on path.
+ * This parser adopts handshake's quote-stripping as canonical for BOTH scalars
+ * and array items, closing the divergence.
+ *
+ * NOTE — intentionally out of scope: commands/method.ts and
+ * generators/portable-knowledge.ts each keep their own `parseFrontmatter`.
+ * They have different parsing semantics / return shapes and are NOT folded in.
+ *
+ * Supported shape (deliberately minimal, matching the originals):
+ *   - YAML-style `---` fences (CRLF or LF). No fence → name from H1, rest empty.
+ *   - Scalar fields: `key: value` (surrounding quotes stripped).
+ *   - Array fields: `key:` followed by indented `  - item` lines (quotes stripped).
+ *   - Multi-line `>-` block scalars are NOT expanded — the literal `>-` token is
+ *     stored as the value and continuation lines are ignored. This matches the
+ *     behavior of all three original parsers (e.g. triage.md's `description: >-`).
+ *
+ * Chain: TEN-1459 (handshake reads FS), WP-345.
+ */
+export interface ParsedSetupFrontmatter {
+    /** The frontmatter `id:` field, if present (handshake/setup-ingest use it). */
+    frontmatterId?: string;
+    /** `name:` field, falling back to the body's first H1, else ''. */
+    name: string;
+    /** `description:` field, else ''. */
+    description: string;
+    /** Everything after the closing `---` fence (the raw markdown body). */
+    body: string;
+    /** `triggers:` array (quotes stripped per item). */
+    triggers: string[];
+    /** `semanticRefs:` array (quotes stripped per item). */
+    semanticRefs: string[];
+    /** `assetKind:` field, if present (setup-ingest uses it). */
+    assetKind?: string;
+}
+/**
+ * Parse minimal YAML frontmatter from a .md file's raw contents.
+ *
+ * Returns the union of fields every setup-authoring caller needs. Callers that
+ * don't use a given field simply ignore it.
+ */
+export declare function parseSetupFrontmatter(raw: string): ParsedSetupFrontmatter;
+//# sourceMappingURL=frontmatter.d.ts.map

package/dist/lib/frontmatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../src/lib/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wDAAwD;IACxD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAOD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAoDzE"}

package/dist/lib/frontmatter.js

@@ -0,0 +1,92 @@
+/**
+ * parseSetupFrontmatter — the single shared YAML-frontmatter parser for setup
+ * authoring assets (skills / rules / hooks).
+ *
+ * Unifies three previously-divergent copies that lived inline in:
+ *   - commands/handshake.ts    (parseSetupAuthoringFrontmatter)
+ *   - commands/migrate-setup.ts (parseFrontmatter)
+ *   - commands/setup-ingest.ts  (parseFrontmatter)
+ *
+ * The three were identical on scalar fields but DIVERGED on array items:
+ * handshake stripped surrounding quotes from each `- item`, the other two did
+ * not. That meant a trigger written as `- "triage: [anything]"` survived as
+ * `triage: [anything]` through handshake but as `"triage: [anything]"` through
+ * migrate/ingest — the same file produced different DB rows depending on path.
+ * This parser adopts handshake's quote-stripping as canonical for BOTH scalars
+ * and array items, closing the divergence.
+ *
+ * NOTE — intentionally out of scope: commands/method.ts and
+ * generators/portable-knowledge.ts each keep their own `parseFrontmatter`.
+ * They have different parsing semantics / return shapes and are NOT folded in.
+ *
+ * Supported shape (deliberately minimal, matching the originals):
+ *   - YAML-style `---` fences (CRLF or LF). No fence → name from H1, rest empty.
+ *   - Scalar fields: `key: value` (surrounding quotes stripped).
+ *   - Array fields: `key:` followed by indented `  - item` lines (quotes stripped).
+ *   - Multi-line `>-` block scalars are NOT expanded — the literal `>-` token is
+ *     stored as the value and continuation lines are ignored. This matches the
+ *     behavior of all three original parsers (e.g. triage.md's `description: >-`).
+ *
+ * Chain: TEN-1459 (handshake reads FS), WP-345.
+ */
+/** Strip a single pair of surrounding single/double quotes. */
+function stripQuotes(value) {
+    return value.replace(/^['"]|['"]$/g, '');
+}
+/**
+ * Parse minimal YAML frontmatter from a .md file's raw contents.
+ *
+ * Returns the union of fields every setup-authoring caller needs. Callers that
+ * don't use a given field simply ignore it.
+ */
+export function parseSetupFrontmatter(raw) {
+    const fmMatch = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
+    if (!fmMatch) {
+        // No frontmatter — derive name from H1, leave everything else empty.
+        const h1 = raw.match(/^# (.+)$/m);
+        return { name: h1?.[1] ?? '', description: '', body: raw, triggers: [], semanticRefs: [] };
+    }
+    const fmBlock = fmMatch[1];
+    const body = fmMatch[2];
+    const fields = new Map();
+    const arrayFields = new Map();
+    // Parse simple `key: value` and `key:\n  - item` YAML arrays.
+    const lines = fmBlock.split('\n');
+    let currentArrayKey = null;
+    let currentArrayValues = [];
+    for (const line of lines) {
+        const arrayItemMatch = line.match(/^\s+-\s+(.+)$/);
+        const keyValueMatch = line.match(/^(\w+):\s*(.*)$/);
+        if (arrayItemMatch && currentArrayKey) {
+            currentArrayValues.push(stripQuotes(arrayItemMatch[1].trim()));
+        }
+        else if (keyValueMatch) {
+            if (currentArrayKey) {
+                arrayFields.set(currentArrayKey, currentArrayValues);
+                currentArrayKey = null;
+                currentArrayValues = [];
+            }
+            const [, key, value] = keyValueMatch;
+            if (value.trim() === '') {
+                // Start of an array block.
+                currentArrayKey = key;
+            }
+            else {
+                fields.set(key, stripQuotes(value.trim()));
+            }
+        }
+    }
+    if (currentArrayKey) {
+        arrayFields.set(currentArrayKey, currentArrayValues);
+    }
+    return {
+        frontmatterId: fields.get('id'),
+        name: fields.get('name') ?? body.match(/^# (.+)$/m)?.[1] ?? '',
+        description: fields.get('description') ?? '',
+        body,
+        triggers: arrayFields.get('triggers') ?? [],
+        semanticRefs: arrayFields.get('semanticRefs') ?? [],
+        assetKind: fields.get('assetKind'),
+    };
+}
+//# sourceMappingURL=frontmatter.js.map

package/dist/lib/frontmatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../src/lib/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAmBH,+DAA+D;AAC/D,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,qEAAqE;QACrE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC7F,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEhD,8DAA8D;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,kBAAkB,GAAa,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAEpD,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;YACtC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YACzB,IAAI,eAAe,EAAE,CAAC;gBACpB,WAAW,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;gBACrD,eAAe,GAAG,IAAI,CAAC;gBACvB,kBAAkB,GAAG,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC;YACrC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACxB,2BAA2B;gBAC3B,eAAe,GAAG,GAAG,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,WAAW,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IACvD,CAAC;IAED,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9D,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE;QAC5C,IAAI;QACJ,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;QAC3C,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QACnD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/lib/frontmatter.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * parseSetupFrontmatter regression tests.
+ *
+ * The load-bearing assertion: the array-item quote-stripping divergence between
+ * handshake (stripped) and migrate-setup / setup-ingest (did not strip) is
+ * closed. All three now route through this one function, so a trigger written
+ * as `- "triage: [anything]"` resolves to `triage: [anything]` on every path.
+ *
+ * We parse the REAL fixture `.productbrain/skills/triage.md` rather than a
+ * synthetic string so the test fails if that file's shape drifts.
+ *
+ * Chain: TEN-1459, WP-345.
+ */
+export {};
+//# sourceMappingURL=frontmatter.test.d.ts.map

package/dist/lib/frontmatter.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.test.d.ts","sourceRoot":"","sources":["../../src/lib/frontmatter.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/lib/frontmatter.test.js

@@ -0,0 +1,98 @@
+/**
+ * parseSetupFrontmatter regression tests.
+ *
+ * The load-bearing assertion: the array-item quote-stripping divergence between
+ * handshake (stripped) and migrate-setup / setup-ingest (did not strip) is
+ * closed. All three now route through this one function, so a trigger written
+ * as `- "triage: [anything]"` resolves to `triage: [anything]` on every path.
+ *
+ * We parse the REAL fixture `.productbrain/skills/triage.md` rather than a
+ * synthetic string so the test fails if that file's shape drifts.
+ *
+ * Chain: TEN-1459, WP-345.
+ */
+import { describe, expect, it } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { parseSetupFrontmatter } from './frontmatter.js';
+// repo root: packages/cli/src/lib → up four levels
+const here = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(here, '..', '..', '..', '..');
+const triagePath = join(repoRoot, '.productbrain', 'skills', 'triage.md');
+describe('parseSetupFrontmatter — array-quote divergence is closed', () => {
+    it('strips surrounding quotes from the triage.md `triggers` list item', () => {
+        const raw = readFileSync(triagePath, 'utf8');
+        const parsed = parseSetupFrontmatter(raw);
+        // The fixture contains a YAML list item: - "triage: [anything]"
+        // Quotes MUST be stripped (handshake's behavior, now canonical).
+        expect(parsed.triggers).toContain('triage: [anything]');
+        // And the un-stripped form must NOT survive.
+        expect(parsed.triggers).not.toContain('"triage: [anything]"');
+    });
+    it('extracts the scalar fields the callers depend on', () => {
+        const raw = readFileSync(triagePath, 'utf8');
+        const parsed = parseSetupFrontmatter(raw);
+        expect(parsed.name).toBe('triage');
+        // body is everything after the closing fence — contains the H1.
+        expect(parsed.body).toContain('# Triage');
+        // The multi-line `>-` block scalar is preserved as the literal token
+        // (the originals never expanded it; we keep that behavior).
+        expect(parsed.description).toBe('>-');
+    });
+    it('resolves the full triggers list to its canonical (quote-stripped) form', () => {
+        // The divergence is structurally gone because all three callers now invoke
+        // this one function. What that function MUST produce is asserted literally
+        // here: the quoted item `- "triage: [anything]"` strips to `triage:
+        // [anything]` while every bare item is untouched. Under the old
+        // migrate-setup / setup-ingest path the third item would have retained its
+        // quotes — so this exact array is what closes the bug, not a self-comparison.
+        const raw = readFileSync(triagePath, 'utf8');
+        const parsed = parseSetupFrontmatter(raw);
+        expect(parsed.triggers).toEqual([
+            'triage',
+            'triage this',
+            'triage: [anything]',
+            'what should I focus on?',
+            'what should I work on?',
+            'where do I start?',
+            'help me think about this',
+            'diagnose',
+        ]);
+    });
+});
+describe('parseSetupFrontmatter — boundary cases', () => {
+    it('returns empty fields and the raw body when there is no `---` fence', () => {
+        const parsed = parseSetupFrontmatter('# Heading Only\n\nbody text');
+        expect(parsed.name).toBe('Heading Only');
+        expect(parsed.description).toBe('');
+        expect(parsed.triggers).toEqual([]);
+        expect(parsed.semanticRefs).toEqual([]);
+        expect(parsed.frontmatterId).toBeUndefined();
+        expect(parsed.assetKind).toBeUndefined();
+        expect(parsed.body).toBe('# Heading Only\n\nbody text');
+    });
+    it('handles an empty frontmatter block', () => {
+        const parsed = parseSetupFrontmatter('---\n\n---\n# Title\n');
+        expect(parsed.name).toBe('Title');
+        expect(parsed.triggers).toEqual([]);
+    });
+    it('extracts id and assetKind scalar fields when present', () => {
+        const raw = [
+            '---',
+            'id: SETUP-SKILL-EXAMPLE',
+            'name: example',
+            'assetKind: skill',
+            'triggers:',
+            "  - 'quoted trigger'",
+            '  - bare trigger',
+            '---',
+            '# Example',
+        ].join('\n');
+        const parsed = parseSetupFrontmatter(raw);
+        expect(parsed.frontmatterId).toBe('SETUP-SKILL-EXAMPLE');
+        expect(parsed.assetKind).toBe('skill');
+        expect(parsed.triggers).toEqual(['quoted trigger', 'bare trigger']);
+    });
+});
+//# sourceMappingURL=frontmatter.test.js.map

package/dist/lib/frontmatter.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.test.js","sourceRoot":"","sources":["../../src/lib/frontmatter.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,mDAAmD;AACnD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAE1E,QAAQ,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACxE,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAE1C,gEAAgE;QAChE,iEAAiE;QACjE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACxD,6CAA6C;QAC7C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAE1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,gEAAgE;QAChE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1C,qEAAqE;QACrE,4DAA4D;QAC5D,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,2EAA2E;QAC3E,2EAA2E;QAC3E,oEAAoE;QACpE,gEAAgE;QAChE,2EAA2E;QAC3E,8EAA8E;QAC9E,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAE1C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YAC9B,QAAQ;YACR,aAAa;YACb,oBAAoB;YACpB,yBAAyB;YACzB,wBAAwB;YACxB,mBAAmB;YACnB,0BAA0B;YAC1B,UAAU;SACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,MAAM,GAAG,qBAAqB,CAAC,6BAA6B,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,GAAG,GAAG;YACV,KAAK;YACL,yBAAyB;YACzB,eAAe;YACf,kBAAkB;YAClB,WAAW;YACX,sBAAsB;YACtB,kBAAkB;YAClB,KAAK;YACL,WAAW;SACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/gatewayTimeout.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Gateway latency-budget aborts on the CLI — WP-575 (TEN-2917, TEN-1126).
+ *
+ * Before this, `./client.ts` set NO timeout on any gateway call: the same missing-declaration
+ * defect as MCP's blanket 10s constant, in the opposite direction (hang forever instead of
+ * give up too early). Both now derive their budget from the route contract; this module owns
+ * what to SAY when one is hit.
+ *
+ * Split out of client.ts at the 500-LOC ratchet's insistence (STD-2 / DEC-1504), and the
+ * ratchet read it correctly: "how do we explain a timeout, and is it safe to retry" is a
+ * decision with its own reason to change, separate from how a request is sent.
+ *
+ * The budget itself is DECLARED once at the route contract
+ * (packages/kernel-client/src/routeLatencyBudget.ts) and reaches this connector as a
+ * drift-checked generated copy. A runtime value import from @productbrain/kernel-client is
+ * impossible here — it is a devDependency and this package is PUBLISHED, so the specifier
+ * would be unresolvable in dist/ for every installed user.
+ */
+import { CLIError } from './errors.js';
+/**
+ * Does this route mutate state?
+ *
+ * Read off the route contract's own Convex function type — `mutation` and `action` can write,
+ * `query` cannot — never inferred from the route's NAME. This decides whether the user is told
+ * a timed-out call may have landed, so an UNKNOWN route fails safe to `true`: telling someone
+ * "nothing was written" when something was is the worse error, and it is the one that invites
+ * a duplicating retry.
+ */
+export declare function routeMayMutate(fn: string): boolean;
+/**
+ * Was this call a DRY RUN? (PR #533 review, Codex P2)
+ *
+ * `preview: true` is a gateway-wide contract meaning "run every validation, write nothing" —
+ * every registered route accepting it returns before its first write (the routes are
+ * enumerated with line citations in the mcp-server twin of this function,
+ * packages/mcp-server/src/gatewaySeam.ts).
+ *
+ * MIRRORED, NOT SHARED, and deliberately so: a runtime value import from
+ * @productbrain/kernel-client is impossible in both connectors (see this module's header for
+ * the CLI's reason, DEC-701 for mcp-server's), and this derivation needs no route data, so
+ * routing it through the generated-copy pipeline would buy codegen machinery for two
+ * three-line functions. What must not drift is the ANSWER — pinned by a parity test asserting
+ * both connectors classify the same (fn, args) identically.
+ */
+export declare function isDryRunCall(args: unknown): boolean;
+/**
+ * Could a timed-out call have LANDED A WRITE?
+ *
+ * The route's type answers "can this route write at all"; the call's own arguments answer
+ * "was this particular call asking it to". `pb capture` never sends `preview: true` today and
+ * says so loudly (../commands/capture.ts:445-450), so the CLI has no live defect here — but
+ * the two connectors holding DIFFERENT answers to the same question is the exact failure mode
+ * WP-575 exists to remove, so the derivation is kept identical on both sides rather than added
+ * only where a bug was observed.
+ */
+export declare function mayHaveLandedOnTimeout(fn: string, args: unknown): boolean;
+/**
+ * Did this throw come from the budget signal firing?
+ *
+ * `AbortSignal.timeout` rejects with a DOMException named "TimeoutError", but an abort that
+ * lands while the response BODY is streaming can surface as "AbortError" instead, depending on
+ * where in undici the signal is observed. Matching only the first name left that case falling
+ * through `parseKernelEnvelope`'s lenient branch into an empty envelope — which a 200 status
+ * then reads as SUCCESS with `undefined` data, the exact false-completion this work package
+ * exists to remove, surviving in the one phase it was fixed for.
+ *
+ * Accepting both is also what the mcp-server twin already does
+ * (`throwClassifiedGatewayFailure`, packages/mcp-server/src/gatewaySeam.ts), and the two
+ * connectors disagreeing about what a budget abort IS is the same defect class as them
+ * disagreeing about how long a route may take.
+ *
+ * Safe to widen because of WHERE this is consulted: both call sites are guarded on a `route`
+ * being present (./client.ts and ./kernelEnvelope.ts), and `route` is supplied only for the
+ * gateway fetches that carry `AbortSignal.timeout(budgetMs)`. On those paths there is no other
+ * abort to confuse this with — the caller-driven `controller.abort()` surfaces
+ * (`/api/admin`, proof-run, connect) never pass a route and never reach here.
+ */
+export declare function isTimeoutAbort(err: unknown): boolean;
+/**
+ * The error a budget abort deserves.
+ *
+ * A budget abort is NOT an unreachable host. The connection succeeded; we stopped waiting.
+ * Reporting "could not reach" would be a false statement about the server AND would imply
+ * nothing ran — but for a write route the server may well have finished. Say what is actually
+ * known, and name the one action that resolves it.
+ */
+export declare function gatewayTimeoutError(fn: string, budgetMs: number, args?: unknown): CLIError;
+//# sourceMappingURL=gatewayTimeout.d.ts.map

package/dist/lib/gatewayTimeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatewayTimeout.d.ts","sourceRoot":"","sources":["../../src/lib/gatewayTimeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAa,MAAM,aAAa,CAAC;AAGlD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGlD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAEzE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGpD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,CAmB1F"}

package/dist/lib/gatewayTimeout.js

@@ -0,0 +1,118 @@
+/**
+ * Gateway latency-budget aborts on the CLI — WP-575 (TEN-2917, TEN-1126).
+ *
+ * Before this, `./client.ts` set NO timeout on any gateway call: the same missing-declaration
+ * defect as MCP's blanket 10s constant, in the opposite direction (hang forever instead of
+ * give up too early). Both now derive their budget from the route contract; this module owns
+ * what to SAY when one is hit.
+ *
+ * Split out of client.ts at the 500-LOC ratchet's insistence (STD-2 / DEC-1504), and the
+ * ratchet read it correctly: "how do we explain a timeout, and is it safe to retry" is a
+ * decision with its own reason to change, separate from how a request is sent.
+ *
+ * The budget itself is DECLARED once at the route contract
+ * (packages/kernel-client/src/routeLatencyBudget.ts) and reaches this connector as a
+ * drift-checked generated copy. A runtime value import from @productbrain/kernel-client is
+ * impossible here — it is a devDependency and this package is PUBLISHED, so the specifier
+ * would be unresolvable in dist/ for every installed user.
+ */
+import { CLIError, ErrorCode } from './errors.js';
+import { ROUTE_TYPE_BY_NAME } from '../generated/routeLatencyBudget.generated.js';
+/**
+ * Does this route mutate state?
+ *
+ * Read off the route contract's own Convex function type — `mutation` and `action` can write,
+ * `query` cannot — never inferred from the route's NAME. This decides whether the user is told
+ * a timed-out call may have landed, so an UNKNOWN route fails safe to `true`: telling someone
+ * "nothing was written" when something was is the worse error, and it is the one that invites
+ * a duplicating retry.
+ */
+export function routeMayMutate(fn) {
+    const type = ROUTE_TYPE_BY_NAME[fn];
+    return type === undefined || type !== 'query';
+}
+/**
+ * Was this call a DRY RUN? (PR #533 review, Codex P2)
+ *
+ * `preview: true` is a gateway-wide contract meaning "run every validation, write nothing" —
+ * every registered route accepting it returns before its first write (the routes are
+ * enumerated with line citations in the mcp-server twin of this function,
+ * packages/mcp-server/src/gatewaySeam.ts).
+ *
+ * MIRRORED, NOT SHARED, and deliberately so: a runtime value import from
+ * @productbrain/kernel-client is impossible in both connectors (see this module's header for
+ * the CLI's reason, DEC-701 for mcp-server's), and this derivation needs no route data, so
+ * routing it through the generated-copy pipeline would buy codegen machinery for two
+ * three-line functions. What must not drift is the ANSWER — pinned by a parity test asserting
+ * both connectors classify the same (fn, args) identically.
+ */
+export function isDryRunCall(args) {
+    return args?.preview === true;
+}
+/**
+ * Could a timed-out call have LANDED A WRITE?
+ *
+ * The route's type answers "can this route write at all"; the call's own arguments answer
+ * "was this particular call asking it to". `pb capture` never sends `preview: true` today and
+ * says so loudly (../commands/capture.ts:445-450), so the CLI has no live defect here — but
+ * the two connectors holding DIFFERENT answers to the same question is the exact failure mode
+ * WP-575 exists to remove, so the derivation is kept identical on both sides rather than added
+ * only where a bug was observed.
+ */
+export function mayHaveLandedOnTimeout(fn, args) {
+    return routeMayMutate(fn) && !isDryRunCall(args);
+}
+/**
+ * Did this throw come from the budget signal firing?
+ *
+ * `AbortSignal.timeout` rejects with a DOMException named "TimeoutError", but an abort that
+ * lands while the response BODY is streaming can surface as "AbortError" instead, depending on
+ * where in undici the signal is observed. Matching only the first name left that case falling
+ * through `parseKernelEnvelope`'s lenient branch into an empty envelope — which a 200 status
+ * then reads as SUCCESS with `undefined` data, the exact false-completion this work package
+ * exists to remove, surviving in the one phase it was fixed for.
+ *
+ * Accepting both is also what the mcp-server twin already does
+ * (`throwClassifiedGatewayFailure`, packages/mcp-server/src/gatewaySeam.ts), and the two
+ * connectors disagreeing about what a budget abort IS is the same defect class as them
+ * disagreeing about how long a route may take.
+ *
+ * Safe to widen because of WHERE this is consulted: both call sites are guarded on a `route`
+ * being present (./client.ts and ./kernelEnvelope.ts), and `route` is supplied only for the
+ * gateway fetches that carry `AbortSignal.timeout(budgetMs)`. On those paths there is no other
+ * abort to confuse this with — the caller-driven `controller.abort()` surfaces
+ * (`/api/admin`, proof-run, connect) never pass a route and never reach here.
+ */
+export function isTimeoutAbort(err) {
+    const name = err?.name;
+    return name === 'TimeoutError' || name === 'AbortError';
+}
+/**
+ * The error a budget abort deserves.
+ *
+ * A budget abort is NOT an unreachable host. The connection succeeded; we stopped waiting.
+ * Reporting "could not reach" would be a false statement about the server AND would imply
+ * nothing ran — but for a write route the server may well have finished. Say what is actually
+ * known, and name the one action that resolves it.
+ */
+export function gatewayTimeoutError(fn, budgetMs, args) {
+    return new CLIError(`"${fn}" exceeded its ${budgetMs}ms latency budget.`, {
+        // PR #533 review (Copilot + Codex, same finding independently): this was
+        // NETWORK_UNREACHABLE, which contradicted the very distinction this module exists to
+        // make — the host WAS reachable. The taxonomy already had the right code and nothing
+        // used it. A caller branching on the code (retry policy, error reporting) would have
+        // been told "unreachable" about a server that answered the connection.
+        code: ErrorCode.NETWORK_TIMEOUT,
+        category: 'network',
+        guidance: mayHaveLandedOnTimeout(fn, args)
+            ? `The server was reachable — this client stopped waiting, so the operation may have\n` +
+                `COMPLETED anyway. Check before retrying (a blind retry can duplicate the write):\n` +
+                `  pb search "<what you were writing>"   # or: pb get <ID>`
+            : isDryRunCall(args)
+                ? `The server was reachable but did not respond in time. This was a preview, so\n` +
+                    `nothing was written — safe to retry.`
+                : `The server was reachable but did not respond in time. This is a read, so nothing\n` +
+                    `was written — safe to retry.`,
+    });
+}
+//# sourceMappingURL=gatewayTimeout.js.map

package/dist/lib/gatewayTimeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatewayTimeout.js","sourceRoot":"","sources":["../../src/lib/gatewayTimeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,IAAI,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,OAAQ,IAAiD,EAAE,OAAO,KAAK,IAAI,CAAC;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAU,EAAE,IAAa;IAC9D,OAAO,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,IAAI,GAAI,GAA4C,EAAE,IAAI,CAAC;IACjE,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAU,EAAE,QAAgB,EAAE,IAAc;IAC9E,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,kBAAkB,QAAQ,oBAAoB,EAAE;QACxE,yEAAyE;QACzE,qFAAqF;QACrF,qFAAqF;QACrF,qFAAqF;QACrF,uEAAuE;QACvE,IAAI,EAAE,SAAS,CAAC,eAAe;QAC/B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC;YACxC,CAAC,CAAC,qFAAqF;gBACrF,oFAAoF;gBACpF,2DAA2D;YAC7D,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;gBAClB,CAAC,CAAC,gFAAgF;oBAChF,sCAAsC;gBACxC,CAAC,CAAC,oFAAoF;oBACpF,8BAA8B;KACrC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/gitEnvLeakKeysParity.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gitEnvLeakKeysParity.test.d.ts.map

package/dist/lib/gitEnvLeakKeysParity.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitEnvLeakKeysParity.test.d.ts","sourceRoot":"","sources":["../../src/lib/gitEnvLeakKeysParity.test.ts"],"names":[],"mappings":""}