@productbrain/cli 0.1.0-beta.49 → 0.1.0-beta.4900

package/dist/lib/gitEnvLeakKeysParity.test.js

@@ -0,0 +1,73 @@
+// Parity test for the two hand-synced GIT_ENV_LEAK_KEYS copies in packages/cli (review round 4,
+// PR #632 follow-up, PRRT_kwDORS4ils6YoYoM).
+//
+// packages/cli/src/commands/files.test.ts and packages/cli/src/lib/productbrain-files.test.ts
+// each carry a LOCAL inline copy of scripts/lib/gitFixtureEnv.mjs's canonical GIT_ENV_LEAK_KEYS
+// array — kept local (rather than a cross-package import) per the note on each copy. A future
+// git version bump updates the canonical array (its own superset test,
+// scripts/lib/gitFixtureEnv.node-test.mjs, would fail and prompt the fix there) but nothing
+// previously asserted the two packages/cli copies got updated too — they could silently rot out
+// of sync, each one individually still "passing" its own file's tests while quietly missing a
+// newer git-named env var.
+//
+// Reads all three sources as TEXT and extracts each array by regex (no cross-package import —
+// packages/cli is a separately published package, and scripts/lib/gitFixtureEnv.mjs lives
+// outside its rootDir; importing another *.test.ts file directly would also risk vitest
+// double-collecting its describe/it blocks). This is exactly the "reading the canonical file
+// from repo root is fine in a test" approach.
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const HERE = dirname(fileURLToPath(import.meta.url));
+// packages/cli/src/lib -> packages/cli/src -> packages/cli -> packages -> repo root
+const REPO_ROOT = resolve(HERE, '../../../..');
+// Review round 3 (PR #634, PRRT_kwDORS4ils6Yp28g): a commented-out quoted token inside the array
+// span (e.g. `// 'GIT_OLD_VAR', -- retired`) previously counted as a real list entry, since the
+// extraction regex below doesn't distinguish code from comments — making the parity check dishonest
+// (it could pass or fail based on comment text, not the actual arrays). Strips both comment forms
+// from the matched span before extracting; safe in this narrow context (a flat array of ALL-CAPS
+// env-var-name string literals — no regex literals or other content that a naive comment strip
+// could misparse, unlike the general-purpose scripts/lib/gitFixtureTextMask.mjs this repo uses
+// elsewhere for exactly that reason).
+function extractGitEnvLeakKeys(source) {
+    const match = /\bGIT_ENV_LEAK_KEYS[^=]*=\s*\[([\s\S]*?)\]/m.exec(source);
+    if (!match)
+        throw new Error('GIT_ENV_LEAK_KEYS array not found in source');
+    const withoutComments = match[1].replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/.*$/gm, '');
+    return [...withoutComments.matchAll(/'([^']+)'/g)].map((m) => m[1]);
+}
+describe('GIT_ENV_LEAK_KEYS parity across the canonical source and both packages/cli inline copies', () => {
+    const canonicalPath = resolve(REPO_ROOT, 'scripts/lib/gitFixtureEnv.mjs');
+    const canonical = extractGitEnvLeakKeys(readFileSync(canonicalPath, 'utf8'));
+    it('the canonical list itself is non-empty (sanity check on the extraction regex, not just the comparisons below)', () => {
+        expect(canonical.length).toBeGreaterThan(0);
+    });
+    it('packages/cli/src/commands/files.test.ts stays in sync with the canonical scripts/lib/gitFixtureEnv.mjs list', () => {
+        const source = readFileSync(resolve(REPO_ROOT, 'packages/cli/src/commands/files.test.ts'), 'utf8');
+        const copy = extractGitEnvLeakKeys(source);
+        expect([...copy].sort()).toEqual([...canonical].sort());
+    });
+    it('packages/cli/src/lib/productbrain-files.test.ts stays in sync with the canonical scripts/lib/gitFixtureEnv.mjs list', () => {
+        const source = readFileSync(resolve(REPO_ROOT, 'packages/cli/src/lib/productbrain-files.test.ts'), 'utf8');
+        const copy = extractGitEnvLeakKeys(source);
+        expect([...copy].sort()).toEqual([...canonical].sort());
+    });
+});
+describe('extractGitEnvLeakKeys ignores commented-out entries (review round 3, PRRT_kwDORS4ils6Yp28g)', () => {
+    it('a line-commented-out quoted token inside the array span is NOT counted as a real entry', () => {
+        const source = [
+            'export const GIT_ENV_LEAK_KEYS = [',
+            "\t'GIT_DIR',",
+            "\t// 'GIT_RETIRED_VAR', -- no longer needed",
+            "\t'GIT_WORK_TREE',",
+            '];',
+        ].join('\n');
+        expect(extractGitEnvLeakKeys(source)).toEqual(['GIT_DIR', 'GIT_WORK_TREE']);
+    });
+    it('a block-commented-out quoted token inside the array span is NOT counted as a real entry', () => {
+        const source = ["export const GIT_ENV_LEAK_KEYS = [", "\t'GIT_DIR',", "\t/* 'GIT_RETIRED_VAR', */", "\t'GIT_WORK_TREE',", '];'].join('\n');
+        expect(extractGitEnvLeakKeys(source)).toEqual(['GIT_DIR', 'GIT_WORK_TREE']);
+    });
+});
+//# sourceMappingURL=gitEnvLeakKeysParity.test.js.map

package/dist/lib/gitEnvLeakKeysParity.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitEnvLeakKeysParity.test.js","sourceRoot":"","sources":["../../src/lib/gitEnvLeakKeysParity.test.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,6CAA6C;AAC7C,EAAE;AACF,8FAA8F;AAC9F,gGAAgG;AAChG,8FAA8F;AAC9F,uEAAuE;AACvE,4FAA4F;AAC5F,gGAAgG;AAChG,8FAA8F;AAC9F,2BAA2B;AAC3B,EAAE;AACF,8FAA8F;AAC9F,0FAA0F;AAC1F,wFAAwF;AACxF,6FAA6F;AAC7F,8CAA8C;AAC9C,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,oFAAoF;AACpF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AAE/C,iGAAiG;AACjG,gGAAgG;AAChG,oGAAoG;AACpG,kGAAkG;AAClG,iGAAiG;AACjG,+FAA+F;AAC/F,+FAA+F;AAC/F,sCAAsC;AACtC,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,6CAA6C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,QAAQ,CAAC,0FAA0F,EAAE,GAAG,EAAE;IACxG,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,qBAAqB,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAE7E,EAAE,CAAC,+GAA+G,EAAE,GAAG,EAAE;QACvH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6GAA6G,EAAE,GAAG,EAAE;QACrH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,yCAAyC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qHAAqH,EAAE,GAAG,EAAE;QAC7H,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,iDAAiD,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3G,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6FAA6F,EAAE,GAAG,EAAE;IAC3G,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,MAAM,GAAG;YACb,oCAAoC;YACpC,cAAc;YACd,6CAA6C;YAC7C,oBAAoB;YACpB,IAAI;SACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,MAAM,MAAM,GAAG,CAAC,oCAAoC,EAAE,cAAc,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3I,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/glossary.js

@@ -14,7 +14,7 @@ export const GLOSSARY = [
     },
     {
         term: 'entry',
-        definition: 'A unit of product knowledge (bet, decision, tension, standard, etc.).',
+        definition: 'A unit of product knowledge (work package, decision, tension, standard, etc.).',
     },
     {
         term: 'collection',

package/dist/lib/glossary.js.map

@@ -1 +1 @@
-{"version":3,"file":"glossary.js","sourceRoot":"","sources":["../../src/lib/glossary.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAOvC,MAAM,CAAC,MAAM,QAAQ,GAAoB;IACvC;QACE,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,4DAA4D;KACzE;IACD;QACE,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,uEAAuE;KACpF;IACD;QACE,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,wEAAwE;KACrF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,sEAAsE;KACnF;IACD;QACE,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,wEAAwE;KACrF;IACD;QACE,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,iDAAiD;KAC9D;IACD;QACE,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,4DAA4D;KACzE;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"glossary.js","sourceRoot":"","sources":["../../src/lib/glossary.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAOvC,MAAM,CAAC,MAAM,QAAQ,GAAoB;IACvC;QACE,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,4DAA4D;KACzE;IACD;QACE,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,gFAAgF;KAC7F;IACD;QACE,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,wEAAwE;KACrF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,sEAAsE;KACnF;IACD;QACE,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,wEAAwE;KACrF;IACD;QACE,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,iDAAiD;KAC9D;IACD;QACE,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,4DAA4D;KACzE;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/hook-intents.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Hook intent model — WP-310 E3a.
+ * Defines the three pb hook intents and a composition function that returns
+ * only the hook entries not already present in existing settings.
+ *
+ * Also exposes getHookStatusForSurface (WP-310 E3b / S4) for multi-surface
+ * opt-in reporting in runHandshakeInit().
+ *
+ * Kept separate from handshake.ts so S4 (multi-surface opt-in) can import
+ * composeHooksFromIntents without pulling in the full handshake module.
+ */
+import type { SurfaceName } from '../surfaces/registry.js';
+export type HookIntent = 'session-start' | 'session-close' | 'pre-compact';
+export interface HookIntentConfig {
+    command: string;
+    statusMessage?: string;
+    hookEvent: 'SessionStart' | 'Stop' | 'PreCompact';
+}
+export declare const HOOK_INTENT_CONFIGS: Record<HookIntent, HookIntentConfig>;
+export interface HookAddition {
+    event: 'SessionStart' | 'Stop' | 'PreCompact';
+    entry: {
+        hooks: Array<{
+            type: string;
+            command: string;
+            statusMessage?: string;
+        }>;
+    };
+    label: string;
+}
+/**
+ * Returns the hook additions needed for the given intents.
+ * Only returns entries whose command is NOT already present in existingHooks.
+ *
+ * @param intents   - The hook intents to compose.
+ * @param existingHooks - The current hooks object from settings (e.g. settings.hooks ?? {}).
+ */
+export declare function composeHooksFromIntents(intents: HookIntent[], existingHooks: Record<string, unknown>): HookAddition[];
+export interface HookStatusResult {
+    writable: boolean;
+    reason: string;
+}
+/**
+ * Determines whether hook files can be written for a given surface.
+ *
+ * INS-740: Cursor and Copilot have empty hookEvents in SURFACE_REGISTRY,
+ * so no hook files are written for them. This function reports that status
+ * so runHandshakeInit() can surface an informational note to the user.
+ */
+export declare function getHookStatusForSurface(surface: SurfaceName): HookStatusResult;
+//# sourceMappingURL=hook-intents.d.ts.map

package/dist/lib/hook-intents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-intents.d.ts","sourceRoot":"","sources":["../../src/lib/hook-intents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,eAAe,GAAG,aAAa,CAAC;AAE3E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,cAAc,GAAG,MAAM,GAAG,YAAY,CAAC;CACnD;AAID,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAgBpE,CAAC;AASF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,cAAc,GAAG,MAAM,GAAG,YAAY,CAAC;IAC9C,KAAK,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IACnF,KAAK,EAAE,MAAM,CAAC;CACf;AAQD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,UAAU,EAAE,EACrB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,YAAY,EAAE,CAyBhB;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,WAAW,GAAG,gBAAgB,CAS9E"}

package/dist/lib/hook-intents.js

@@ -0,0 +1,85 @@
+/**
+ * Hook intent model — WP-310 E3a.
+ * Defines the three pb hook intents and a composition function that returns
+ * only the hook entries not already present in existing settings.
+ *
+ * Also exposes getHookStatusForSurface (WP-310 E3b / S4) for multi-surface
+ * opt-in reporting in runHandshakeInit().
+ *
+ * Kept separate from handshake.ts so S4 (multi-surface opt-in) can import
+ * composeHooksFromIntents without pulling in the full handshake module.
+ */
+import { SURFACE_REGISTRY } from '../surfaces/registry.js';
+// Hook failure contract (TEN-712): all hook commands MUST end with '2>/dev/null || true'
+// so Claude Code always starts even if pb is unavailable. Never remove this suffix.
+export const HOOK_INTENT_CONFIGS = {
+    'session-start': {
+        command: 'pb session start 2>/dev/null || true',
+        statusMessage: 'Opening pb session...',
+        hookEvent: 'SessionStart',
+    },
+    'session-close': {
+        command: 'pb session close 2>/dev/null || true',
+        statusMessage: 'Closing pb session...',
+        hookEvent: 'Stop',
+    },
+    'pre-compact': {
+        command: 'pb session id > /dev/null 2>&1 && echo \'{"systemMessage": "pb session active — capture decisions/tensions before compacting: pb capture \\"DEC: ...\\""}\'  || true',
+        hookEvent: 'PreCompact',
+    },
+};
+function hasCommand(groups, cmd) {
+    return (groups ?? []).some((g) => g.hooks?.some((h) => h.command === cmd));
+}
+const INTENT_LABELS = {
+    'session-start': 'SessionStart → pb session start',
+    'session-close': 'Stop → pb session close',
+    'pre-compact': 'PreCompact → decision capture reminder',
+};
+/**
+ * Returns the hook additions needed for the given intents.
+ * Only returns entries whose command is NOT already present in existingHooks.
+ *
+ * @param intents   - The hook intents to compose.
+ * @param existingHooks - The current hooks object from settings (e.g. settings.hooks ?? {}).
+ */
+export function composeHooksFromIntents(intents, existingHooks) {
+    const additions = [];
+    for (const intent of intents) {
+        const cfg = HOOK_INTENT_CONFIGS[intent];
+        const existing = existingHooks[cfg.hookEvent];
+        if (hasCommand(existing, cfg.command))
+            continue;
+        const hookEntry = {
+            type: 'command',
+            command: cfg.command,
+        };
+        if (cfg.statusMessage !== undefined) {
+            hookEntry.statusMessage = cfg.statusMessage;
+        }
+        additions.push({
+            event: cfg.hookEvent,
+            entry: { hooks: [hookEntry] },
+            label: INTENT_LABELS[intent],
+        });
+    }
+    return additions;
+}
+/**
+ * Determines whether hook files can be written for a given surface.
+ *
+ * INS-740: Cursor and Copilot have empty hookEvents in SURFACE_REGISTRY,
+ * so no hook files are written for them. This function reports that status
+ * so runHandshakeInit() can surface an informational note to the user.
+ */
+export function getHookStatusForSurface(surface) {
+    const cap = SURFACE_REGISTRY[surface];
+    if (cap.hookEvents.length > 0) {
+        return { writable: true, reason: 'native hook events supported' };
+    }
+    return {
+        writable: false,
+        reason: `${surface} has no session hook events — run \`pb session start\` manually`,
+    };
+}
+//# sourceMappingURL=hook-intents.js.map

package/dist/lib/hook-intents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-intents.js","sourceRoot":"","sources":["../../src/lib/hook-intents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAW3D,yFAAyF;AACzF,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAyC;IACvE,eAAe,EAAE;QACf,OAAO,EAAE,sCAAsC;QAC/C,aAAa,EAAE,uBAAuB;QACtC,SAAS,EAAE,cAAc;KAC1B;IACD,eAAe,EAAE;QACf,OAAO,EAAE,sCAAsC;QAC/C,aAAa,EAAE,uBAAuB;QACtC,SAAS,EAAE,MAAM;KAClB;IACD,aAAa,EAAE;QACb,OAAO,EACL,sKAAsK;QACxK,SAAS,EAAE,YAAY;KACxB;CACF,CAAC;AAKF,SAAS,UAAU,CAAC,MAAuC,EAAE,GAAW;IACtE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAQD,MAAM,aAAa,GAA+B;IAChD,eAAe,EAAE,iCAAiC;IAClD,eAAe,EAAE,yBAAyB;IAC1C,aAAa,EAAE,wCAAwC;CACxD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAqB,EACrB,aAAsC;IAEtC,MAAM,SAAS,GAAmB,EAAE,CAAC;IAErC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAoC,CAAC;QAEjF,IAAI,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAEhD,MAAM,SAAS,GAA8D;YAC3E,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC;QACF,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACpC,SAAS,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;QAC9C,CAAC;QAED,SAAS,CAAC,IAAI,CAAC;YACb,KAAK,EAAE,GAAG,CAAC,SAAS;YACpB,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YAC7B,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAoB;IAC1D,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG,OAAO,iEAAiE;KACpF,CAAC;AACJ,CAAC"}

package/dist/lib/inferSourceDate.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Synced from convex/lib/inferSourceDate.ts (FEAT-885: shared date inference, BR-108: CLI import boundary).
+ */
+/**
+ * Infer an ISO date (YYYY-MM-DD) from free-text values.
+ *
+ * Canonical source for MCP (packages/mcp-server/src/lib/inferSourceDate.ts)
+ * and CLI (packages/cli/src/lib/inferSourceDate.ts) — both are synced copies
+ * maintained by scripts/sync-convex-lib-to-mcp.mjs (FEAT-885, BR-108).
+ */
+export declare function inferSourceDate(...values: Array<string | undefined>): string | undefined;
+//# sourceMappingURL=inferSourceDate.d.ts.map

package/dist/lib/inferSourceDate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inferSourceDate.d.ts","sourceRoot":"","sources":["../../src/lib/inferSourceDate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;GAMG;AAEH,wBAAgB,eAAe,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAmCxF"}

package/dist/lib/inferSourceDate.js

@@ -0,0 +1,44 @@
+/**
+ * Synced from convex/lib/inferSourceDate.ts (FEAT-885: shared date inference, BR-108: CLI import boundary).
+ */
+/**
+ * Infer an ISO date (YYYY-MM-DD) from free-text values.
+ *
+ * Canonical source for MCP (packages/mcp-server/src/lib/inferSourceDate.ts)
+ * and CLI (packages/cli/src/lib/inferSourceDate.ts) — both are synced copies
+ * maintained by scripts/sync-convex-lib-to-mcp.mjs (FEAT-885, BR-108).
+ */
+export function inferSourceDate(...values) {
+    const combined = values
+        .filter((value) => typeof value === 'string' && value.trim().length > 0)
+        .join('\n');
+    if (!combined)
+        return undefined;
+    const isoMatch = combined.match(/\b(20\d{2}-\d{2}-\d{2})\b/);
+    if (isoMatch)
+        return isoMatch[1];
+    const monthMatch = combined.match(/\b(january|february|march|april|may|june|july|august|september|october|november|december)\s+(\d{1,2})(?:st|nd|rd|th)?(?:,?\s+(20\d{2}))?\b/i);
+    if (!monthMatch)
+        return undefined;
+    const monthIndex = [
+        'january',
+        'february',
+        'march',
+        'april',
+        'may',
+        'june',
+        'july',
+        'august',
+        'september',
+        'october',
+        'november',
+        'december',
+    ].indexOf(monthMatch[1].toLowerCase());
+    if (monthIndex < 0)
+        return undefined;
+    const inferredYear = monthMatch[3] ?? combined.match(/\b(20\d{2})\b/)?.[1] ?? String(new Date().getUTCFullYear());
+    const month = String(monthIndex + 1).padStart(2, '0');
+    const day = monthMatch[2].padStart(2, '0');
+    return `${inferredYear}-${month}-${day}`;
+}
+//# sourceMappingURL=inferSourceDate.js.map

package/dist/lib/inferSourceDate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inferSourceDate.js","sourceRoot":"","sources":["../../src/lib/inferSourceDate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;GAMG;AAEH,MAAM,UAAU,eAAe,CAAC,GAAG,MAAiC;IACnE,MAAM,QAAQ,GAAG,MAAM;SACrB,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACxF,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC7D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEjC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAChC,6IAA6I,CAC7I,CAAC;IACF,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,MAAM,UAAU,GAAG;QAClB,SAAS;QACT,UAAU;QACV,OAAO;QACP,OAAO;QACP,KAAK;QACL,MAAM;QACN,MAAM;QACN,QAAQ;QACR,WAAW;QACX,SAAS;QACT,UAAU;QACV,UAAU;KACV,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACvC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAErC,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,GAAG,YAAY,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;AAC1C,CAAC"}

package/dist/lib/kernelEnvelope.d.ts

@@ -0,0 +1,31 @@
+/** Structured field-level detail from a VALIDATION_FAILED response. */
+export interface ValidationErrorDetail {
+    fieldKey: string;
+    fieldLabel: string;
+    invalidValue: unknown;
+    validOptions?: string[];
+    errorType: 'type_mismatch' | 'invalid_option' | 'required';
+    message: string;
+}
+export type KernelEnvelope<T> = {
+    ok?: boolean;
+    data?: T;
+    summary?: string;
+    error?: string;
+    message?: string;
+    code?: string;
+    details?: ValidationErrorDetail[];
+    /** Present only when code === 'rate-limited' (TEN-656) — seconds until the caller may retry. */
+    retryAfterSeconds?: number;
+    _meta?: {
+        durationMs?: number;
+        truncated?: boolean;
+    };
+};
+export declare function recordLatestFromResponse(res: Response): void;
+export declare function parseKernelEnvelope<T>(res: Response, route?: {
+    fn: string;
+    budgetMs: number;
+    args?: unknown;
+}): Promise<KernelEnvelope<T>>;
+//# sourceMappingURL=kernelEnvelope.d.ts.map

package/dist/lib/kernelEnvelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernelEnvelope.d.ts","sourceRoot":"","sources":["../../src/lib/kernelEnvelope.ts"],"names":[],"mappings":"AAeA,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,UAAU,CAAC;IAC3D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI;IAC9B,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAClC,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAK3B,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACtD,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAE5D;AAED,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,GAAG,EAAE,QAAQ,EAIb,KAAK,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvD,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CA2B5B"}

package/dist/lib/kernelEnvelope.js

@@ -0,0 +1,52 @@
+/**
+ * The gateway envelope — its shape, and how to read one off a `Response`.
+ *
+ * Split out of client.ts in the WP-575 review round (STD-2 / DEC-1504: client.ts crossed the
+ * 500-LOC budget). The seam is a real one, not a line-count dodge: client.ts's job is to MAKE
+ * gateway calls — decide the budget, carry auth, retry a 429, drive the spinner. Deciding what
+ * the bytes coming back MEAN, and what a failure to read them means, is a different job. It is
+ * the same split the mcp-server connector already has between its `client.ts` and
+ * `gatewaySeam.ts`.
+ *
+ * The load-bearing part is `parseKernelEnvelope`'s body-phase abort branch — see its comment.
+ */
+import { recordServerLatest } from './update-check.js';
+import { gatewayTimeoutError, isTimeoutAbort } from './gatewayTimeout.js';
+export function recordLatestFromResponse(res) {
+    recordServerLatest(res.headers?.get?.('pb-latest-cli-version') ?? null);
+}
+export async function parseKernelEnvelope(res, 
+// WP-575 (PR #533 review, Codex P1): the route this body belongs to, so a BODY-phase budget
+// abort can be classified as the timeout it is. Optional — `validateKey` runs its own
+// AbortController and its own catch, and is deliberately left on the lenient path below.
+route) {
+    recordLatestFromResponse(res);
+    try {
+        return (await res.json());
+    }
+    catch (err) {
+        // `fetch` resolves at HEADERS while the budget signal is still live, so a stalled BODY
+        // aborts HERE, not at the fetch — outside the caller's timeout-classification try. The
+        // old blanket `.catch(() => ({}))` swallowed that into an empty envelope, which a 200
+        // status then read as SUCCESS with `undefined` data: a timed-out write reported as
+        // completed. That is the precise false-outcome this work package exists to remove, and
+        // the sibling of the MCP-side fix already landed as `throwClassifiedGatewayFailure`
+        // (mcp-server/src/gatewaySeam.ts) — the CLI had the same hole in all three call variants.
+        //
+        // Gated on `res.ok` (PR #533 review round 5): a NON-OK status means the server already
+        // reached a verdict and said so — only its error BODY stalled. Classifying that as a budget
+        // timeout would replace a real status and code (a 429's `retryAfterSeconds`, a 4xx's
+        // validation code) with "may have completed anyway, search before retrying", about a call
+        // the server explicitly failed. Falling through to the empty envelope hands it to the
+        // `!res.ok` check every caller already runs on the next line — the behaviour non-OK
+        // responses have always had. The timeout classification is for the case that is genuinely
+        // all we know: a 2xx whose body never arrived.
+        if (route && res.ok && isTimeoutAbort(err))
+            throw gatewayTimeoutError(route.fn, route.budgetMs, route.args);
+        // Any OTHER parse failure keeps the pre-existing lenient behavior on purpose: a non-JSON
+        // or empty body is already handled by the ok/status checks every caller runs against the
+        // empty envelope, and narrowing that here would change unrelated error paths.
+        return {};
+    }
+}
+//# sourceMappingURL=kernelEnvelope.js.map

package/dist/lib/kernelEnvelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernelEnvelope.js","sourceRoot":"","sources":["../../src/lib/kernelEnvelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA6B1E,MAAM,UAAU,wBAAwB,CAAC,GAAa;IACpD,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAa;AACb,4FAA4F;AAC5F,sFAAsF;AACtF,yFAAyF;AACzF,KAAwD;IAExD,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uFAAuF;QACvF,uFAAuF;QACvF,sFAAsF;QACtF,mFAAmF;QACnF,uFAAuF;QACvF,oFAAoF;QACpF,0FAA0F;QAC1F,EAAE;QACF,uFAAuF;QACvF,4FAA4F;QAC5F,qFAAqF;QACrF,0FAA0F;QAC1F,sFAAsF;QACtF,oFAAoF;QACpF,0FAA0F;QAC1F,+CAA+C;QAC/C,IAAI,KAAK,IAAI,GAAG,CAAC,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5G,yFAAyF;QACzF,yFAAyF;QACzF,8EAA8E;QAC9E,OAAO,EAAuB,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/lib/legalRelationTypes.d.ts

@@ -0,0 +1,25 @@
+/** Filters a workspace-declared `valid_relation_types` array down to verbs `pb relate`'s
+ *  generic door can actually create toward the given target. `targetIsDomain` should be
+ *  `true` when the link target entry's canonicalKey is 'domain'; `sourceIsStrategy` should be
+ *  `true` when the entry being captured has canonicalKey 'strategy'. */
+export declare function filterCreatableRelationTypes(declared: unknown, targetIsDomain: boolean, sourceIsStrategy: boolean): string[];
+type TypeRow = {
+    data?: {
+        canonical_key?: unknown;
+        valid_relation_types?: unknown;
+        description?: unknown;
+        cardinality_rule?: unknown;
+    } | null;
+    status?: string;
+};
+/** Resolves the declared `valid_relation_types` for `canonicalKey` out of a semantic-types
+ *  listEntries result the SAME way loadTypeMap does (convex/chain/semanticTypes.ts:81-99):
+ *  trust-accepted AND parsable rows only, and when duplicate canonical_key rows exist (a
+ *  supported state — backfillTypeRegistryReconcile.test.ts:175-199 exercises an active
+ *  duplicate) the LAST such match in listEntries' query order wins, mirroring loadTypeMap's
+ *  Map.set()-overwrite-per-match loop over the same by_collection-indexed query — a malformed
+ *  duplicate is skipped entirely rather than overwriting an earlier valid row (bcRICo). Then
+ *  filters to what `pb relate` can create. */
+export declare function resolveCreatableRelationTypes(typeRows: readonly TypeRow[] | null | undefined, canonicalKey: string, targetIsDomain: boolean): string[];
+export {};
+//# sourceMappingURL=legalRelationTypes.d.ts.map

package/dist/lib/legalRelationTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legalRelationTypes.d.ts","sourceRoot":"","sources":["../../src/lib/legalRelationTypes.ts"],"names":[],"mappings":"AAgDA;;;wEAGwE;AACxE,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,GAAG,MAAM,EAAE,CAS5H;AAQD,KAAK,OAAO,GAAG;IACb,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAC;QAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7H,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAcF;;;;;;;8CAO8C;AAC9C,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,GAAG,SAAS,EAC/C,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,OAAO,GACtB,MAAM,EAAE,CASV"}

package/dist/lib/legalRelationTypes.js

@@ -0,0 +1,94 @@
+/**
+ * WP-688 S4 review round 5 (bdB5K, cQFZ_): `pb capture`'s --link-type refusal door
+ * (commands/capture.ts) lists an entry's declared legal relation verbs as a `pb relate`
+ * recovery hint. "Declared" (the workspace's own semantic-type row, `valid_relation_types`)
+ * is NOT the same set as "creatable via pb relate's generic door" — guardRelation
+ * (convex/lib/guards.ts) hard-refuses some declared verbs outright:
+ *   - replaces / do_not_confuse_with: always refused, routed to a different command
+ *     (guards.ts:309-322).
+ *   - Any verb outside the kernel ALLOWED_RELATION_TYPES set: refused regardless of what a
+ *     workspace's own type row declares (guards.ts:302-307) — registry reconciliation
+ *     deliberately preserves a customized `valid_relation_types` value even when it contains
+ *     a verb the kernel allowlist doesn't recognize (registryReconcile.test.ts:131-147), so
+ *     this is a supported persisted state, not malformed data.
+ *   - belongs_to / authority_domain TOWARD a domain-tagged target (target canonicalKey ===
+ *     'domain'): requires ratification metadata (stagingEntryId + source) `pb relate` cannot
+ *     supply (guards.ts:349-363).
+ *   - anchored_to FROM a non-strategy source: its entire meaning is strategy-scope-anchor
+ *     (WP-641 S2a) — predictStrategyAnchorViolation unconditionally rejects it whenever the
+ *     source canonicalKey isn't 'strategy' (singletonCardinality.ts:339-341), regardless of
+ *     target (round-5 finding bcRgRI).
+ * Centralized here so the filter isn't duplicated (or drifts) if another connector ever needs
+ * the same "legal AND creatable" list.
+ *
+ * WP-688 S4 review round 5 (bcQWqA): ALLOWED_RELATION_TYPES is read at RUNTIME (a filter, not a
+ * type check), so it cannot come from a bare `kernel/entries/relationTypes` value import —
+ * `kernel` is a devDependency-only, unpublished workspace package (present locally via monorepo
+ * linking, absent from the published `@productbrain/cli` npm package), so that import resolves
+ * here in dev/test but throws ERR_MODULE_NOT_FOUND for every real npm-installed `pb` command
+ * (index.ts statically imports capture.ts, which statically imports this file). Import the
+ * generated, CLI-owned copy instead — same pattern as sourceSurfaces.generated.ts (see
+ * scripts/generate-kernel-value-sets.mjs's header for the full rationale + retirement rule).
+ */
+import { ALLOWED_RELATION_TYPES as ALLOWED_RELATION_TYPES_LIST } from '../generated/relationTypes.generated.js';
+const ALLOWED_RELATION_TYPES = new Set(ALLOWED_RELATION_TYPES_LIST);
+/** Verbs guardRelation refuses outright regardless of ALLOWED_RELATION_TYPES membership — each
+ *  routes to a different, specialized command instead of the generic relation door. */
+const DIRECT_DOOR_BLOCKED = new Set(['replaces', 'do_not_confuse_with']);
+/** Domain-tag verbs guardRelation only accepts via ratification metadata (guards.ts:349-363) —
+ *  `pb relate` cannot supply it, so never recommend these toward a domain-tagged target. */
+const DOMAIN_TAG_VERBS = new Set(['belongs_to', 'authority_domain']);
+/** anchored_to only exists as a strategy-scope-anchor verb (WP-641 S2a) — never legal from a
+ *  non-strategy source, regardless of target (bcRgRI). */
+const STRATEGY_ONLY_VERBS = new Set(['anchored_to']);
+/** Filters a workspace-declared `valid_relation_types` array down to verbs `pb relate`'s
+ *  generic door can actually create toward the given target. `targetIsDomain` should be
+ *  `true` when the link target entry's canonicalKey is 'domain'; `sourceIsStrategy` should be
+ *  `true` when the entry being captured has canonicalKey 'strategy'. */
+export function filterCreatableRelationTypes(declared, targetIsDomain, sourceIsStrategy) {
+    if (!Array.isArray(declared))
+        return [];
+    return declared.filter((t) => typeof t === 'string'
+        && !DIRECT_DOOR_BLOCKED.has(t)
+        && ALLOWED_RELATION_TYPES.has(t)
+        && !(targetIsDomain && DOMAIN_TAG_VERBS.has(t))
+        && !(!sourceIsStrategy && STRATEGY_ONLY_VERBS.has(t)));
+}
+/** Trust-accepted statuses (statusStateMachine.ts:67-69's isTrustAccepted, inlined rather than
+ *  imported — same devDependency-only/unpublished-kernel constraint as ALLOWED_RELATION_TYPES). */
+function isTrustAcceptedStatus(status) {
+    return status === 'accepted' || status === 'active';
+}
+/** Mirrors parseSemanticTypeDefData's validity rule (kernel/entries/semanticTypes.ts:65-77) —
+ *  loadTypeMap skips a malformed row (missing/non-string description, or a cardinality_rule
+ *  outside the 3-value enum) rather than letting it win, even when it's the LAST trust-accepted
+ *  duplicate (round-5 finding bcRICo). Inlined rather than imported: same devDependency-only/
+ *  unpublished-kernel constraint as ALLOWED_RELATION_TYPES above. */
+function isParsableSemanticTypeRow(data) {
+    return typeof data?.description === 'string'
+        && (data.cardinality_rule === 'singleton_per_workspace'
+            || data.cardinality_rule === 'singleton_per_scope'
+            || data.cardinality_rule === 'multiple');
+}
+/** Resolves the declared `valid_relation_types` for `canonicalKey` out of a semantic-types
+ *  listEntries result the SAME way loadTypeMap does (convex/chain/semanticTypes.ts:81-99):
+ *  trust-accepted AND parsable rows only, and when duplicate canonical_key rows exist (a
+ *  supported state — backfillTypeRegistryReconcile.test.ts:175-199 exercises an active
+ *  duplicate) the LAST such match in listEntries' query order wins, mirroring loadTypeMap's
+ *  Map.set()-overwrite-per-match loop over the same by_collection-indexed query — a malformed
+ *  duplicate is skipped entirely rather than overwriting an earlier valid row (bcRICo). Then
+ *  filters to what `pb relate` can create. */
+export function resolveCreatableRelationTypes(typeRows, canonicalKey, targetIsDomain) {
+    let declared;
+    for (const row of typeRows ?? []) {
+        if (row.data?.canonical_key !== canonicalKey)
+            continue;
+        if (!isTrustAcceptedStatus(row.status))
+            continue;
+        if (!isParsableSemanticTypeRow(row.data))
+            continue;
+        declared = row.data?.valid_relation_types;
+    }
+    return filterCreatableRelationTypes(declared, targetIsDomain, canonicalKey === 'strategy');
+}
+//# sourceMappingURL=legalRelationTypes.js.map

package/dist/lib/legalRelationTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legalRelationTypes.js","sourceRoot":"","sources":["../../src/lib/legalRelationTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,sBAAsB,IAAI,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AAEhH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;AAEzF;uFACuF;AACvF,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAE9F;4FAC4F;AAC5F,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAE1F;0DAC0D;AAC1D,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAE1E;;;wEAGwE;AACxE,MAAM,UAAU,4BAA4B,CAAC,QAAiB,EAAE,cAAuB,EAAE,gBAAyB;IAChH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CACxC,OAAO,CAAC,KAAK,QAAQ;WAClB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;WAC3B,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;WAC7B,CAAC,CAAC,cAAc,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;WAC5C,CAAC,CAAC,CAAC,gBAAgB,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;mGACmG;AACnG,SAAS,qBAAqB,CAAC,MAA0B;IACvD,OAAO,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,QAAQ,CAAC;AACtD,CAAC;AAOD;;;;qEAIqE;AACrE,SAAS,yBAAyB,CAAC,IAAqB;IACtD,OAAO,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ;WACvC,CAAC,IAAI,CAAC,gBAAgB,KAAK,yBAAyB;eAClD,IAAI,CAAC,gBAAgB,KAAK,qBAAqB;eAC/C,IAAI,CAAC,gBAAgB,KAAK,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;8CAO8C;AAC9C,MAAM,UAAU,6BAA6B,CAC3C,QAA+C,EAC/C,YAAoB,EACpB,cAAuB;IAEvB,IAAI,QAAiB,CAAC;IACtB,KAAK,MAAM,GAAG,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY;YAAE,SAAS;QACvD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACjD,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACnD,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAC5C,CAAC;IACD,OAAO,4BAA4B,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,KAAK,UAAU,CAAC,CAAC;AAC7F,CAAC"}

package/dist/lib/localBinding.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Repo-local binding resolution — turns what `.productbrain/config.local.json` declares into a
+ * credential, or refuses outright.
+ *
+ * Both cascades that serve ordinary commands (`resolveConfig()`'s return path and `loadEnv()`'s
+ * process.env path) call these two helpers, so the refusal rules cannot drift apart between them
+ * (STD-3). The shared rule is the same in both: when the repo has declared a tenant, resolution
+ * either honors that declaration or fails loudly — it never substitutes a different workspace and
+ * carries on. Fail loud, fail closed, fail fast (PRI-24); default closed, explicitly opened
+ * (PRI-22).
+ *
+ * `adminConfig.ts` keeps its own inline copy on purpose: it excludes config.json's siteUrl and the
+ * CWD .env files, so it is a narrower cascade, not this one. Folding it in is the remaining step
+ * toward a single code path (STA-3).
+ */
+import type { LocalProjectConfig } from './projectConfig.js';
+/**
+ * Resolve the repo-local profile pin to a credential, or refuse outright.
+ *
+ * FAILS CLOSED on a DANGLING pin: a pin naming a profile that has since been deleted, or whose
+ * file carries no key, must NEVER fall through to the global active profile. The repo has
+ * explicitly declared its tenant; substituting a different one silently retargets every read AND
+ * write at a foreign workspace, and the gateway derives the workspace from the credential (BR-18)
+ * — so nothing downstream catches it.
+ *
+ * INS-2455 is the admin-path instance of exactly this fall-through: `resolveAdminConfig()` was
+ * hardened on its own, which left the two cascades every other command uses still fail-open.
+ */
+export declare function resolvePinnedProfile(profileName: string): {
+    apiKey: string;
+    siteUrl?: string;
+};
+/**
+ * Resolve the direct credential binding in config.local.json, or null when the file does not
+ * claim one (the profile pin then owns resolution).
+ *
+ * The claim is the `preview` marker OR a credential of its own — deliberately NOT the marker
+ * alone. A file carrying an apiKey is asserting which workspace this repo talks to whether or not
+ * `pb:preview` stamped the marker, so gating on the marker would let a hand-written or
+ * partially-scrubbed binding be skipped and a sibling profile pin silently supply a different
+ * tenant's credential instead (the failure class TEN-3237/TEN-3238 closed for the pin path).
+ *
+ * Once claimed, only the atomic apiKey+siteUrl pair (SF-3) may bind — never a preview key paired
+ * with config.json's real-dev gateway (STD-261). Anything else refuses here, ahead of the pin, so
+ * a broken binding is named rather than routed around.
+ */
+export declare function resolveLocalBinding(localConfig: LocalProjectConfig | null): {
+    apiKey: string;
+    siteUrl: string;
+} | null;
+//# sourceMappingURL=localBinding.d.ts.map

package/dist/lib/localBinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localBinding.d.ts","sourceRoot":"","sources":["../../src/lib/localBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7D;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAqB9F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,kBAAkB,GAAG,IAAI,GACrC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA2B5C"}