@productbrain/cli 0.1.0-beta.49 → 0.1.0-beta.4902

package/dist/lib/startup-signals.test.js

@@ -0,0 +1,165 @@
+/**
+ * WP-486 Slice 1 (FEAT-1371, TEN-2724) — `collectCliStartupSignals` unit tests. Mocks
+ * `child_process.execSync` so these are deterministic and never shell out to real git.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+const execSyncMock = vi.fn();
+vi.mock('node:child_process', () => ({
+    execSync: (...args) => execSyncMock(...args),
+}));
+import { collectCliStartupSignals } from './startup-signals.js';
+describe('collectCliStartupSignals', () => {
+    beforeEach(() => {
+        execSyncMock.mockReset();
+    });
+    function mockGitCommands(responses) {
+        execSyncMock.mockImplementation((command) => {
+            for (const [match, output] of Object.entries(responses)) {
+                if (command.includes(match))
+                    return output;
+            }
+            throw new Error(`unmocked git command: ${command}`);
+        });
+    }
+    it('collects changedPaths, branchName, worktreeName from git', () => {
+        mockGitCommands({
+            'git status --porcelain': ' M convex/agentKnowledge/orientView.ts\n?? packages/cli/src/lib/startup-signals.ts\n',
+            'git branch --show-current': 'ontology-r4-r5-signal-envelope\n',
+            'git rev-parse --show-toplevel': '/Users/randy/worktree/ontology-r4-r5-signal-envelope\n',
+        });
+        const signals = collectCliStartupSignals('/Users/randy/worktree/ontology-r4-r5-signal-envelope');
+        expect(signals).toEqual({
+            changedPaths: [
+                'convex/agentKnowledge/orientView.ts',
+                'packages/cli/src/lib/startup-signals.ts',
+            ],
+            branchName: 'ontology-r4-r5-signal-envelope',
+            worktreeName: 'ontology-r4-r5-signal-envelope',
+        });
+    });
+    it('resolves a rename line to the NEW path only', () => {
+        mockGitCommands({
+            'git status --porcelain': 'R  old-name.ts -> new-name.ts\n',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual(['new-name.ts']);
+    });
+    it('caps changedPaths at 25 entries', () => {
+        const lines = Array.from({ length: 40 }, (_, i) => ` M file-${i}.ts`).join('\n');
+        mockGitCommands({
+            'git status --porcelain': lines,
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toHaveLength(25);
+    });
+    it('is fail-open: a clean worktree yields no changedPaths key', () => {
+        mockGitCommands({
+            'git status --porcelain': '',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals).not.toHaveProperty('changedPaths');
+    });
+    it('is fail-open: git absence/error yields an empty signal set, never throws', () => {
+        execSyncMock.mockImplementation(() => {
+            throw new Error('git: command not found');
+        });
+        expect(() => collectCliStartupSignals('/not-a-repo')).not.toThrow();
+        expect(collectCliStartupSignals('/not-a-repo')).toEqual({});
+    });
+    // WP-486 Slice 1 — PR #369 review (Codex): two P2 findings, both reproduced live against a
+    // disposable git repo before being fixed here (see PR thread replies for the live evidence).
+    it('requests --untracked-files=all so a wholly-untracked directory expands to its files, not one directory entry', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': '?? src/routes/new-feature/page.svelte\n?? src/routes/new-feature/logic.ts\n',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual([
+            'src/routes/new-feature/page.svelte',
+            'src/routes/new-feature/logic.ts',
+        ]);
+        // Locks in the actual flag used — a regression back to bare `--porcelain` (default
+        // `--untracked-files=normal`, which collapses the directory to one `?? src/` entry) would
+        // fail this assertion even though the mock above still matches the substring.
+        const calledCommands = execSyncMock.mock.calls.map((c) => c[0]);
+        expect(calledCommands.some((c) => c.includes('--untracked-files=all'))).toBe(true);
+    });
+    it('includes committed branch paths (vs origin/main) when the worktree is clean — the normal re-orientation case', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': '',
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': 'convex/agentKnowledge/orientView.ts\0packages/cli/src/commands/orient.ts\0',
+            'git branch --show-current': 'ontology-r4-r5-signal-envelope\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual([
+            'convex/agentKnowledge/orientView.ts',
+            'packages/cli/src/commands/orient.ts',
+        ]);
+    });
+    it('unions dirty-worktree and committed-branch paths, de-duped', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': ' M convex/agentKnowledge/orientView.ts\n',
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': 'convex/agentKnowledge/orientView.ts\0packages/cli/src/commands/orient.ts\0',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual([
+            'convex/agentKnowledge/orientView.ts',
+            'packages/cli/src/commands/orient.ts',
+        ]);
+    });
+    it('parses -z NUL-separated branch-diff paths without quote-corruption on non-ASCII filenames (PR #369 review)', () => {
+        // `-z` disables git's default core.quotePath octal-escaping outright, so a non-ASCII path
+        // comes through as raw UTF-8 bytes, NUL-terminated — never as a quoted `"caf\303\251.txt"`
+        // string a newline-splitting parser would mis-glob against. This test locks in that the
+        // `-z` flag is actually present on the branch-diff git invocation (a regression back to
+        // bare `--name-only` would corrupt this exact case).
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': '',
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': 'café.txt\0src/edge-case.ts\0',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual(['café.txt', 'src/edge-case.ts']);
+    });
+    it('is fail-open: no origin/main (e.g. no network) yields dirty-worktree paths only, never throws', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': ' M convex/agentKnowledge/orientView.ts\n',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+            // No 'git merge-base' entry — mockGitCommands throws "unmocked git command", simulating a
+            // real git failure (e.g. unknown revision origin/main); runGit's try/catch degrades this
+            // to undefined, same as any other fail-open git error.
+        });
+        expect(() => collectCliStartupSignals('/repo')).not.toThrow();
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual(['convex/agentKnowledge/orientView.ts']);
+    });
+    it('caps the UNIONED changedPaths at 25 entries', () => {
+        const dirty = Array.from({ length: 15 }, (_, i) => ` M dirty-${i}.ts`).join('\n');
+        const branch = Array.from({ length: 15 }, (_, i) => `branch-${i}.ts`).join('\0');
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': dirty,
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': branch,
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toHaveLength(25);
+    });
+});
+//# sourceMappingURL=startup-signals.test.js.map

package/dist/lib/startup-signals.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-signals.test.js","sourceRoot":"","sources":["../../src/lib/startup-signals.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC7B,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,QAAQ,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;CACxD,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,UAAU,CAAC,GAAG,EAAE;QACd,YAAY,CAAC,SAAS,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,SAAS,eAAe,CAAC,SAAiC;QACxD,YAAY,CAAC,kBAAkB,CAAC,CAAC,OAAe,EAAE,EAAE;YAClD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,MAAM,CAAC;YAC7C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,eAAe,CAAC;YACd,wBAAwB,EAAE,sFAAsF;YAChH,2BAA2B,EAAE,kCAAkC;YAC/D,+BAA+B,EAAE,wDAAwD;SAC1F,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,sDAAsD,CAAC,CAAC;QAEjG,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,YAAY,EAAE;gBACZ,qCAAqC;gBACrC,yCAAyC;aAC1C;YACD,UAAU,EAAE,gCAAgC;YAC5C,YAAY,EAAE,gCAAgC;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,eAAe,CAAC;YACd,wBAAwB,EAAE,iCAAiC;YAC3D,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,eAAe,CAAC;YACd,wBAAwB,EAAE,KAAK;YAC/B,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,eAAe,CAAC;YACd,wBAAwB,EAAE,EAAE;YAC5B,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,YAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACpE,MAAM,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,6FAA6F;IAE7F,EAAE,CAAC,8GAA8G,EAAE,GAAG,EAAE;QACtH,eAAe,CAAC;YACd,8CAA8C,EAAE,6EAA6E;YAC7H,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YACnC,oCAAoC;YACpC,iCAAiC;SAClC,CAAC,CAAC;QACH,mFAAmF;QACnF,0FAA0F;QAC1F,8EAA8E;QAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8GAA8G,EAAE,GAAG,EAAE;QACtH,eAAe,CAAC;YACd,8CAA8C,EAAE,EAAE;YAClD,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,4EAA4E;YACpH,2BAA2B,EAAE,kCAAkC;YAC/D,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YACnC,qCAAqC;YACrC,qCAAqC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,eAAe,CAAC;YACd,8CAA8C,EAAE,0CAA0C;YAC1F,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,4EAA4E;YACpH,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YACnC,qCAAqC;YACrC,qCAAqC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4GAA4G,EAAE,GAAG,EAAE;QACpH,0FAA0F;QAC1F,2FAA2F;QAC3F,wFAAwF;QACxF,wFAAwF;QACxF,qDAAqD;QACrD,eAAe,CAAC;YACd,8CAA8C,EAAE,EAAE;YAClD,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,8BAA8B;YACtE,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,GAAG,EAAE;QACvG,eAAe,CAAC;YACd,8CAA8C,EAAE,0CAA0C;YAC1F,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;YAC1C,0FAA0F;YAC1F,yFAAyF;YACzF,uDAAuD;SACxD,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,eAAe,CAAC;YACd,8CAA8C,EAAE,KAAK;YACrD,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,MAAM;YAC9C,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/state.d.ts

@@ -0,0 +1,58 @@
+/**
+ * CLI setup state resolution — determines where the user is in the setup journey
+ * and what render tier to use for output.
+ *
+ * WP-325 S1: Foundation utilities consumed by S2 (index.ts) and S3 (connect.ts).
+ * No callers wired in this slice — this is the shared substrate.
+ *
+ * Stage model:
+ *   unconfigured     → no API key found anywhere
+ *   authenticated    → API key present, but workspace unreachable (offline or not yet connected)
+ *   workspace-bound  → key + workspace reachable, but no active session
+ *   active           → key + workspace + active session
+ */
+import { type ConfigFailureKind } from './config.js';
+/** Four-stage setup journey from cold start to active use. */
+export type SetupStage = 'unconfigured' | 'authenticated' | 'workspace-bound' | 'active';
+export interface SetupState {
+    stage: SetupStage;
+    /** Human-readable list of what is still missing. Empty when stage === 'active'. */
+    missingSteps: string[];
+    /** Single most important next command to run. */
+    nextAction: string;
+    /** Workspace name — populated when workspace probe succeeds. */
+    workspaceName?: string;
+    /** Total entry count from the workspace — populated when workspace probe succeeds. */
+    entryCount?: number;
+    /** Whether a write session is currently active. */
+    sessionActive?: boolean;
+    /** Exact local-binding failure, when this is more specific than ordinary first-time setup. */
+    configurationIssue?: {
+        kind: ConfigFailureKind;
+        reason: string;
+        guidance: string;
+    };
+}
+/** Output render tier for the current runtime context. */
+export type RenderTier = 'json' | 'plain' | 'ink';
+/**
+ * Determine the user's current setup stage and surface what's missing.
+ *
+ * Resolution order mirrors the config cascade (getConfigSafe → probeWorkspace → readSession).
+ * Each step is attempted only if the previous one succeeded, matching how the system
+ * actually behaves when a command runs.
+ *
+ * Network calls: probeWorkspace() makes one lightweight orient call. If the caller is in a
+ * context where network is unavailable, this returns 'authenticated' rather than throwing.
+ */
+export declare function resolveSetupState(): Promise<SetupState>;
+/**
+ * Determine the appropriate output rendering tier for the current process context.
+ *
+ * Priority:
+ *   json  → isJsonMode() is true (explicit --json flag or non-TTY piped output)
+ *   plain → stdout is not a TTY (but isJsonMode() was false — e.g. --pretty on a pipe)
+ *   ink   → interactive TTY, Ink React rendering is safe
+ */
+export declare function detectRenderTier(): RenderTier;
+//# sourceMappingURL=state.d.ts.map

package/dist/lib/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/lib/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AASpE,8DAA8D;AAC9D,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAEzF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,mFAAmF;IACnF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE;QACnB,IAAI,EAAE,iBAAiB,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAMlD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,UAAU,CAAC,CAgD7D;AAMD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAI7C"}

package/dist/lib/state.js

@@ -0,0 +1,95 @@
+/**
+ * CLI setup state resolution — determines where the user is in the setup journey
+ * and what render tier to use for output.
+ *
+ * WP-325 S1: Foundation utilities consumed by S2 (index.ts) and S3 (connect.ts).
+ * No callers wired in this slice — this is the shared substrate.
+ *
+ * Stage model:
+ *   unconfigured     → no API key found anywhere
+ *   authenticated    → API key present, but workspace unreachable (offline or not yet connected)
+ *   workspace-bound  → key + workspace reachable, but no active session
+ *   active           → key + workspace + active session
+ */
+import { getConfigSafe } from './config.js';
+import { probeWorkspace } from './workspace-probe.js';
+import { readSession } from './session.js';
+import { isJsonMode } from './runner.js';
+// ---------------------------------------------------------------------------
+// resolveSetupState
+// ---------------------------------------------------------------------------
+/**
+ * Determine the user's current setup stage and surface what's missing.
+ *
+ * Resolution order mirrors the config cascade (getConfigSafe → probeWorkspace → readSession).
+ * Each step is attempted only if the previous one succeeded, matching how the system
+ * actually behaves when a command runs.
+ *
+ * Network calls: probeWorkspace() makes one lightweight orient call. If the caller is in a
+ * context where network is unavailable, this returns 'authenticated' rather than throwing.
+ */
+export async function resolveSetupState() {
+    // Step 1 — is an API key configured?
+    const configResult = getConfigSafe();
+    if (!configResult.ok) {
+        return {
+            stage: 'unconfigured',
+            missingSteps: [configResult.reason],
+            nextAction: configResult.nextCommand,
+            configurationIssue: {
+                kind: configResult.kind,
+                reason: configResult.reason,
+                guidance: configResult.guidance,
+            },
+        };
+    }
+    // Step 2 — can we reach the workspace?
+    const wsInfo = await probeWorkspace();
+    if (!wsInfo) {
+        return {
+            stage: 'authenticated',
+            missingSteps: ['Workspace not connected or unreachable'],
+            nextAction: 'pb connect',
+        };
+    }
+    // Step 3 — is there an active write session?
+    const session = readSession();
+    if (!session) {
+        return {
+            stage: 'workspace-bound',
+            missingSteps: ['No active write session'],
+            nextAction: 'pb session start',
+            workspaceName: wsInfo.name,
+            entryCount: wsInfo.entryCount,
+            sessionActive: false,
+        };
+    }
+    // All steps satisfied — fully active
+    return {
+        stage: 'active',
+        missingSteps: [],
+        nextAction: 'pb orient -b',
+        workspaceName: wsInfo.name,
+        entryCount: wsInfo.entryCount,
+        sessionActive: true,
+    };
+}
+// ---------------------------------------------------------------------------
+// detectRenderTier
+// ---------------------------------------------------------------------------
+/**
+ * Determine the appropriate output rendering tier for the current process context.
+ *
+ * Priority:
+ *   json  → isJsonMode() is true (explicit --json flag or non-TTY piped output)
+ *   plain → stdout is not a TTY (but isJsonMode() was false — e.g. --pretty on a pipe)
+ *   ink   → interactive TTY, Ink React rendering is safe
+ */
+export function detectRenderTier() {
+    if (isJsonMode())
+        return 'json';
+    if (!process.stdout.isTTY)
+        return 'plain';
+    return 'ink';
+}
+//# sourceMappingURL=state.js.map

package/dist/lib/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/lib/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAA0B,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgCzC,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,qCAAqC;IACrC,MAAM,YAAY,GAAG,aAAa,EAAE,CAAC;IACrC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,YAAY,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;YACnC,UAAU,EAAE,YAAY,CAAC,WAAW;YACpC,kBAAkB,EAAE;gBAClB,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC;SACF,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,CAAC,wCAAwC,CAAC;YACxD,UAAU,EAAE,YAAY;SACzB,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,iBAAiB;YACxB,YAAY,EAAE,CAAC,yBAAyB,CAAC;YACzC,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa,EAAE,KAAK;SACrB,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,cAAc;QAC1B,aAAa,EAAE,MAAM,CAAC,IAAI;QAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,UAAU,EAAE;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/strip.d.ts

@@ -8,5 +8,13 @@
  * Chain: DEC-299 (JSON-default output), TEN-340 (Convex internal exposure)
  */
 export declare function stripControlChars(str: string): string;
+/** Round 4 (quiet-sweep item 1): stripControlChars deliberately excludes `\x0a` (newline) —
+ *  legitimate for multiline text, but a field rendered as ONE terminal line (a digest bullet,
+ *  a formatted label) must never let an embedded `\n`/`\r`/`\t` inject extra, unprefixed
+ *  lines. Collapses every whitespace run to a single space, after stripping control chars —
+ *  the same `stripControlChars(v).replace(/\s+/g, ' ').trim()` idiom already duplicated across
+ *  this package's formatters (shape.ts, conflicts.ts, direction.ts, feedback.ts, questions.ts,
+ *  sessionNotices.ts); centralized here as the shared, single-line-safe sanitizer. */
+export declare function sanitizeSingleLineField(str: string): string;
 export declare function stripConvexInternals<T>(data: T): T;
 //# sourceMappingURL=strip.d.ts.map

package/dist/lib/strip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strip.d.ts","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAelD"}
+{"version":3,"file":"strip.d.ts","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2BH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;;;;sFAMsF;AACtF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAelD"}

package/dist/lib/strip.js

@@ -16,13 +16,35 @@ const STRIP_KEYS = new Set(['_id', '_creationTime']);
  *
  * BET-269: Security baseline — C3 (CLI terminal escaping).
  */
+// Note: the CSI/OSC alternatives MUST precede the bare control-char class. Regex
+// alternation takes the first matching alternative at a given position, not the
+// longest — with the control-char class first, a lone ESC (0x1b, inside \x0b-\x1f)
+// matches and consumes before the longer `\x1b\[...` sequence gets a chance,
+// stripping only the ESC and leaving the rest of the escape sequence (e.g. `[31m`)
+// behind as inert-but-visible text (found via PR #341 review Finding 2 testing).
+// Late-fix consolidation round 1 (PRRT_kwDORS4ils6Y0pz3, P1): the control-char class
+// used to jump \x0b\x0c straight to \x0e-\x1f, deliberately skipping \x0d (carriage
+// return) — but a bare \r moves the terminal cursor to column zero and lets the
+// remaining attacker-controlled text overwrite/spoof the start of the line, so (unlike
+// \t/\n, which carry a legitimate multiline-formatting use) it belongs in the stripped
+// set. \x0b-\x1f is now one contiguous range (still excludes \x09 tab and \x0a newline).
 // eslint-disable-next-line no-control-regex
-const ANSI_AND_CONTROL_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]|\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07]*\x07|\x1b[^[\]0-9;A-Za-z]?/g;
+const ANSI_AND_CONTROL_RE = /\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07]*\x07|\x1b[^[\]0-9;A-Za-z]?|[\x00-\x08\x0b-\x1f\x7f]/g;
 export function stripControlChars(str) {
     if (!str)
         return str;
     return str.replace(ANSI_AND_CONTROL_RE, '');
 }
+/** Round 4 (quiet-sweep item 1): stripControlChars deliberately excludes `\x0a` (newline) —
+ *  legitimate for multiline text, but a field rendered as ONE terminal line (a digest bullet,
+ *  a formatted label) must never let an embedded `\n`/`\r`/`\t` inject extra, unprefixed
+ *  lines. Collapses every whitespace run to a single space, after stripping control chars —
+ *  the same `stripControlChars(v).replace(/\s+/g, ' ').trim()` idiom already duplicated across
+ *  this package's formatters (shape.ts, conflicts.ts, direction.ts, feedback.ts, questions.ts,
+ *  sessionNotices.ts); centralized here as the shared, single-line-safe sanitizer. */
+export function sanitizeSingleLineField(str) {
+    return stripControlChars(str).replace(/\s+/g, ' ').trim();
+}
 export function stripConvexInternals(data) {
     if (Array.isArray(data)) {
         return data.map((item) => stripConvexInternals(item));

package/dist/lib/strip.js.map

@@ -1 +1 @@
-{"version":3,"file":"strip.js","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAErD;;;;;;;GAOG;AACH,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG,kGAAkG,CAAC;AAE/H,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAI,IAAO;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAiB,CAAC;IACxE,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAsB,CAAC;IAChC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"strip.js","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAErD;;;;;;;GAOG;AACH,iFAAiF;AACjF,gFAAgF;AAChF,mFAAmF;AACnF,6EAA6E;AAC7E,mFAAmF;AACnF,iFAAiF;AACjF,qFAAqF;AACrF,oFAAoF;AACpF,gFAAgF;AAChF,uFAAuF;AACvF,uFAAuF;AACvF,yFAAyF;AACzF,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG,0FAA0F,CAAC;AAEvH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;sFAMsF;AACtF,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAI,IAAO;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAiB,CAAC;IACxE,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAsB,CAAC;IAChC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/style.d.ts

@@ -14,6 +14,8 @@ export declare const green: (s: string) => string;
 export declare const red: (s: string) => string;
 export declare const yellow: (s: string) => string;
 export declare const cyan: (s: string) => string;
+export declare const magenta: (s: string) => string;
+export declare const blue: (s: string) => string;
 export declare const dim: (s: string) => string;
 export declare const bold: (s: string) => string;
 export declare const icons: {
@@ -73,7 +75,7 @@ export declare function formatCheck(status: 'pass' | 'fail' | 'warn', label: str
  *
  * Format: "⚡ pb admin — [ENV] <host>"
  */
-export declare function adminBanner(siteUrl: string): void;
+export declare function adminBanner(siteUrl: string, profileLabel?: string): void;
 /**
  * Prompt for confirmation before a destructive admin operation (remote deployments).
  *

package/dist/lib/style.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"style.d.ts","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,0DAA0D;AAC1D,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAMD,eAAO,MAAM,KAAK,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC1F,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACxF,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC3F,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACzF,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AACvF,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AAMxF,eAAO,MAAM,KAAK;;;;;;CAMR,CAAC;AAMX,eAAO,MAAM,IAAI;;;;;;;;;;;;;gCAkBI,MAAM;sCACA,MAAM;CACvB,CAAC;AAMX;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG1C;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvC;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG3C;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASnG;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAoBjD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CASnB"}
+{"version":3,"file":"style.d.ts","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,0DAA0D;AAC1D,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAMD,eAAO,MAAM,KAAK,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC1F,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACxF,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC3F,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACzF,eAAO,MAAM,OAAO,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC5F,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACzF,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AACvF,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AAMxF,eAAO,MAAM,KAAK;;;;;;CAMR,CAAC;AAMX,eAAO,MAAM,IAAI;;;;;;;;;;;;;gCAkBI,MAAM;sCACA,MAAM;CACvB,CAAC;AAMX;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG1C;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvC;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG3C;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASnG;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAyBxE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CASnB"}

package/dist/lib/style.js

@@ -25,6 +25,8 @@ export const green = (s) => (supportsColor() ? `\x1b[32m${s}\x1b[0m` : s);
 export const red = (s) => (supportsColor() ? `\x1b[31m${s}\x1b[0m` : s);
 export const yellow = (s) => (supportsColor() ? `\x1b[33m${s}\x1b[0m` : s);
 export const cyan = (s) => (supportsColor() ? `\x1b[36m${s}\x1b[0m` : s);
+export const magenta = (s) => (supportsColor() ? `\x1b[35m${s}\x1b[0m` : s);
+export const blue = (s) => (supportsColor() ? `\x1b[34m${s}\x1b[0m` : s);
 export const dim = (s) => (supportsColor() ? `\x1b[2m${s}\x1b[0m` : s);
 export const bold = (s) => (supportsColor() ? `\x1b[1m${s}\x1b[0m` : s);
 // ---------------------------------------------------------------------------
@@ -121,7 +123,7 @@ export function formatCheck(status, label, detail) {
  *
  * Format: "⚡ pb admin — [ENV] <host>"
  */
-export function adminBanner(siteUrl) {
+export function adminBanner(siteUrl, profileLabel) {
     if (isQuietMode())
         return;
     const host = parseHostname(siteUrl);
@@ -140,7 +142,12 @@ export function adminBanner(siteUrl) {
         default:
             envTag = yellow('[CLOUD]');
     }
-    process.stdout.write(`\n${bold(`\u26A1 pb admin`)} ${dim('\u2014')} ${envTag} ${dim(host)}\n\n`);
+    // WP-681: name WHICH credential resolved the target, not just the tier - the env tag alone
+    // never told you which of possibly several profiles put you there (the live-reproduced bug
+    // this closes: `pb admin run` silently resolving the operator's global profile - often prod -
+    // even inside a repo explicitly pinned to a dev-scoped one).
+    const profileSuffix = profileLabel ? ` ${dim(`(profile: ${profileLabel})`)}` : '';
+    process.stdout.write(`\n${bold(`\u26A1 pb admin`)} ${dim('\u2014')} ${envTag} ${dim(host)}${profileSuffix}\n\n`);
 }
 /**
  * Prompt for confirmation before a destructive admin operation (remote deployments).

package/dist/lib/style.js.map

@@ -1 +1 @@
-{"version":3,"file":"style.js","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,aAAa,EAAoB,IAAI,IAAI,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,QAAQ,EAAI,YAAY;IAC9B,IAAI,EAAE,QAAQ,EAAI,IAAI;IACtB,IAAI,EAAE,QAAQ,EAAI,mBAAmB;IACrC,KAAK,EAAE,QAAQ,EAAG,cAAc;IAChC,GAAG,EAAE,QAAQ,EAAK,aAAa;CACvB,CAAC;AAEX,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,oBAAoB;IACpB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,UAAU;IACnB,cAAc,EAAE,kBAAkB;IAClC,aAAa,EAAE,iBAAiB;IAEhC,kBAAkB;IAClB,SAAS,EAAE,kDAAkD;IAC7D,eAAe,EAAE,kDAAkD;IACnE,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,wBAAwB;IAEpC,oBAAoB;IACpB,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,gBAAgB,OAAO,EAAE;IACvD,UAAU,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,qBAAqB,UAAU,EAAE;CAC7D,CAAC;AAEX,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAgC,EAAE,KAAa,EAAE,MAAc;IACzF,MAAM,IAAI,GACR,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACnB,CAAC,CAAC,MAAM,KAAK,MAAM;YACjB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,WAAW,EAAE;QAAE,OAAO;IAE1B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAc,CAAC;IACnB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR,KAAK,MAAM;YACT,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM;QACR,KAAK,WAAW;YACd,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7B,MAAM;QACR;YACE,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAMvC;IACC,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IAClE,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"style.js","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,aAAa,EAAoB,IAAI,IAAI,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,QAAQ,EAAI,YAAY;IAC9B,IAAI,EAAE,QAAQ,EAAI,IAAI;IACtB,IAAI,EAAE,QAAQ,EAAI,mBAAmB;IACrC,KAAK,EAAE,QAAQ,EAAG,cAAc;IAChC,GAAG,EAAE,QAAQ,EAAK,aAAa;CACvB,CAAC;AAEX,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,oBAAoB;IACpB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,UAAU;IACnB,cAAc,EAAE,kBAAkB;IAClC,aAAa,EAAE,iBAAiB;IAEhC,kBAAkB;IAClB,SAAS,EAAE,kDAAkD;IAC7D,eAAe,EAAE,kDAAkD;IACnE,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,wBAAwB;IAEpC,oBAAoB;IACpB,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,gBAAgB,OAAO,EAAE;IACvD,UAAU,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,qBAAqB,UAAU,EAAE;CAC7D,CAAC;AAEX,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAgC,EAAE,KAAa,EAAE,MAAc;IACzF,MAAM,IAAI,GACR,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACnB,CAAC,CAAC,MAAM,KAAK,MAAM;YACjB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,YAAqB;IAChE,IAAI,WAAW,EAAE;QAAE,OAAO;IAE1B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAc,CAAC;IACnB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR,KAAK,MAAM;YACT,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM;QACR,KAAK,WAAW;YACd,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7B,MAAM;QACR;YACE,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IACD,2FAA2F;IAC3F,2FAA2F;IAC3F,8FAA8F;IAC9F,6DAA6D;IAC7D,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,YAAY,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,MAAM,CAAC,CAAC;AACnH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAMvC;IACC,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IAClE,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/lib/tokenConstants.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Token prefix constants — single source of truth for token format strings.
+ * keep in sync with convex/lib/tokenConstants.ts
+ * (Monorepo boundary: Convex cannot import from packages/cli and vice versa.)
+ *
+ * DEC-549
+ */
+/** Prefix for permanent API keys (bearer tokens). */
+export declare const API_KEY_PREFIX = "pb_sk_";
+/** Prefix for short-lived connect tokens (15-min, single-use). */
+export declare const CONNECT_TOKEN_PREFIX = "pb_ct_";
+/** Prefix for preview-only admin proof-bridge tokens (≤24h, workspace-pinned; WP-459). */
+export declare const PREVIEW_ADMIN_TOKEN_PREFIX = "pb_pat_";
+/**
+ * Length of the random hex component in generated API keys.
+ * 32 hex chars = 128-bit entropy.
+ */
+export declare const API_KEY_HEX_LENGTH = 32;
+//# sourceMappingURL=tokenConstants.d.ts.map

package/dist/lib/tokenConstants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenConstants.d.ts","sourceRoot":"","sources":["../../src/lib/tokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qDAAqD;AACrD,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC"}

package/dist/lib/tokenConstants.js

@@ -0,0 +1,19 @@
+/**
+ * Token prefix constants — single source of truth for token format strings.
+ * keep in sync with convex/lib/tokenConstants.ts
+ * (Monorepo boundary: Convex cannot import from packages/cli and vice versa.)
+ *
+ * DEC-549
+ */
+/** Prefix for permanent API keys (bearer tokens). */
+export const API_KEY_PREFIX = 'pb_sk_';
+/** Prefix for short-lived connect tokens (15-min, single-use). */
+export const CONNECT_TOKEN_PREFIX = 'pb_ct_';
+/** Prefix for preview-only admin proof-bridge tokens (≤24h, workspace-pinned; WP-459). */
+export const PREVIEW_ADMIN_TOKEN_PREFIX = 'pb_pat_';
+/**
+ * Length of the random hex component in generated API keys.
+ * 32 hex chars = 128-bit entropy.
+ */
+export const API_KEY_HEX_LENGTH = 32;
+//# sourceMappingURL=tokenConstants.js.map

package/dist/lib/tokenConstants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenConstants.js","sourceRoot":"","sources":["../../src/lib/tokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEvC,kEAAkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC"}

package/dist/lib/update-check.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Ambient update notification for the Product Brain CLI (WP-322 S1 / FEAT-1012).
+ *
+ * Checks npm registry for the latest version of @productbrain/cli and prints
+ * a one-line notification when a newer version is available.
+ *
+ * Rules:
+ *   - Synchronous: reads cache only, never awaits network, never delays the command
+ *   - Multi-source cache at ~/.config/productbrain/update-check.json:
+ *     server header is authoritative within 48h; npm is an isNewer-gated fallback
+ *   - Silent on any error (network down, registry unreachable, etc.)
+ *   - JSON/agent mode: notice goes to stderr (stdout stays bare JSON), throttled once per session
+ *   - Does NOT use undici/fetch directly; uses Node.js built-in https
+ */
+/**
+ * Emit `cli.version_skew.detected` at most once per process when a strictly newer
+ * version has been observed. Exported so callers (e.g. doctor's freshness check)
+ * can fire it from their own discovery path while sharing the dedup guard.
+ */
+export declare function reportVersionSkewIfNew(latest: string | null, current?: string): void;
+/**
+ * Hot-path resolution from cache only — NEVER fetches. The **newest** in-window source wins: the
+ * server header is preferred only when it is actually the highest version, so a server that lags
+ * npm (its committed `cliVersion.ts` value trails the run-numbered npm publish — see TEN-2199) can
+ * no longer mask a newer npm latest. Returns the best available value even when every source is
+ * stale ("better than nothing"), because the hot path (checkForUpdate) cannot block on a refresh.
+ */
+export declare function resolveCachedLatest(): string | null;
+/** @deprecated use resolveCachedLatest. Kept for callers migrating. */
+export declare function readCachedLatestVersion(): string | null;
+/** Clear the post-upgrade sentinel and stale update cache on next CLI startup. */
+export declare function clearPendingUpgradeCache(): void;
+/** Written after a successful self-upgrade so the next CLI process drops stale cache. */
+export declare function writeUpgradePendingSentinel(installedVersion?: string): void;
+/** Test-only: reset module-level per-process guards so each test starts clean. */
+export declare function _resetProcessGuardsForTest(): void;
+/**
+ * Compare two semver strings. Returns true if `b` is strictly newer than `a`.
+ * Handles standard x.y.z and x.y.z-beta.N formats (numeric comparison per part).
+ */
+export declare function isNewer(current: string, latest: string): boolean;
+/** Record the server-supplied latest version (authoritative source). */
+export declare function recordServerLatest(latestVersion: string | null): void;
+/** Record an npm-resolved latest version — gated so it never stores <= installed. */
+export declare function recordNpmLatest(latestVersion: string | null, currentVersion: string): void;
+/** LIVE resolve — fetches npm and records it (gated). Call ONLY from doctor/upgrade, never the hot path. */
+export declare function resolveLatestVersion(currentVersion?: string): Promise<string | null>;
+/**
+ * Synchronously prints at most one update line. Reads cache only — never fetches.
+ * Reaches agents (JSON mode) on stderr; stdout stays bare JSON. Throttled once per
+ * session (agent) / once per UTC day (human TTY) via O_EXCL markers. Never throws.
+ * NOTE: a session with no authenticated server call writes no cache and fires no
+ * notice; `pb doctor` live-resolves as the backstop. DEC-2.
+ */
+export declare function checkForUpdate(currentVersion: string): void;
+//# sourceMappingURL=update-check.d.ts.map

package/dist/lib/update-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../../src/lib/update-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAyCH;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAQpF;AA+BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAUnD;AAYD,uEAAuE;AACvE,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAEvD;AAMD,kFAAkF;AAClF,wBAAgB,wBAAwB,IAAI,IAAI,CAU/C;AAED,yFAAyF;AACzF,wBAAgB,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAK3E;AAED,kFAAkF;AAClF,wBAAgB,0BAA0B,IAAI,IAAI,CAIjD;AA2BD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAuBhE;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAMrE;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAM1F;AAED,4GAA4G;AAC5G,wBAAsB,oBAAoB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB1F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAiB3D"}