@productbrain/cli 0.1.0-beta.5 → 0.1.0-beta.5060

package/dist/lib/profiles.js

@@ -0,0 +1,239 @@
+/**
+ * Profile storage and resolution — multi-workspace support for the Product Brain CLI.
+ * WP-302 Slice 2: Workspace Profiles + Config Refactor.
+ *
+ * Profile directory: ~/.config/productbrain/profiles/
+ * Active profile tracked in: ~/.config/productbrain/active-profile
+ * Resolution order: PB_PROFILE env > active-profile file > "default" > legacy .env
+ */
+import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, readdirSync } from 'fs';
+import { resolve } from 'path';
+import { homedir } from 'os';
+import { CLIError, ErrorCode } from './errors.js';
+const HOME_CONFIG_DIR = resolve(homedir(), '.config', 'productbrain');
+const PROFILES_DIR = resolve(HOME_CONFIG_DIR, 'profiles');
+const ACTIVE_PROFILE_PATH = resolve(HOME_CONFIG_DIR, 'active-profile');
+const LEGACY_ENV_PATH = resolve(HOME_CONFIG_DIR, '.env');
+/** Profile name validation: lowercase alphanumeric + hyphens, 1-32 chars. */
+const PROFILE_NAME_RE = /^[a-z0-9][a-z0-9-]{0,31}$/;
+/**
+ * Validate a profile name — lowercase alphanumeric + hyphens, 1-32 chars, no path
+ * separators. Exported so any caller that resolves a path from an UNTRUSTED name
+ * (e.g. `PB_PROFILE`) before it reaches a `createProfile`/`useProfile`/`deleteProfile`
+ * write can validate at the point of first path resolution, not only at the eventual
+ * write (TEN-2851 Copilot review: connect.ts's read-before-write called
+ * `resolveNamedProfileConfig()` — which resolves a path but never validated — before
+ * name validation ever ran).
+ */
+export function validateProfileName(name) {
+    if (!PROFILE_NAME_RE.test(name)) {
+        throw new CLIError(`Invalid profile name "${name}". Must be 1-32 chars, lowercase alphanumeric + hyphens, starting with alphanumeric.`, { code: ErrorCode.PROFILE_NAME_INVALID, category: 'profile' });
+    }
+}
+function profilePath(name) {
+    return resolve(PROFILES_DIR, `${name}.env`);
+}
+function parseEnvFile(content) {
+    const vars = {};
+    for (const line of content.split('\n')) {
+        const m = line.match(/^([^#=]+)=(.*)$/);
+        if (m) {
+            vars[m[1].trim()] = m[2].trim().replace(/^["']|["']$/g, '');
+        }
+    }
+    return vars;
+}
+function readProfileFile(path) {
+    if (!existsSync(path))
+        return null;
+    const vars = parseEnvFile(readFileSync(path, 'utf8'));
+    const apiKey = vars['PRODUCTBRAIN_API_KEY'] || '';
+    if (!apiKey)
+        return null;
+    return {
+        apiKey,
+        siteUrl: vars['CONVEX_SITE_URL'] || undefined,
+    };
+}
+/**
+ * Auto-migrate legacy ~/.config/productbrain/.env to profiles/default.env.
+ * Only runs if legacy file exists AND no profiles directory exists.
+ * If profiles already exist, silently removes the legacy .env (TEN-1343) — so any caller
+ * that might CREATE the profiles dir before this runs (e.g. `pb connect`'s named-profile
+ * create path) must call this FIRST, or the legacy file is deleted, unmigrated (Codex
+ * review, WP-628 P1).
+ */
+export function autoMigrate() {
+    if (existsSync(PROFILES_DIR)) {
+        if (existsSync(LEGACY_ENV_PATH))
+            unlinkSync(LEGACY_ENV_PATH);
+        return false;
+    }
+    if (!existsSync(LEGACY_ENV_PATH))
+        return false;
+    mkdirSync(PROFILES_DIR, { recursive: true });
+    const content = readFileSync(LEGACY_ENV_PATH, 'utf8');
+    writeFileSync(profilePath('default'), content, { mode: 0o600 });
+    writeFileSync(ACTIVE_PROFILE_PATH, 'default', { mode: 0o600 });
+    unlinkSync(LEGACY_ENV_PATH);
+    return true;
+}
+/** List all profile names (sorted). */
+export function listProfiles() {
+    autoMigrate();
+    if (!existsSync(PROFILES_DIR))
+        return [];
+    return readdirSync(PROFILES_DIR)
+        .filter((f) => f.endsWith('.env'))
+        .map((f) => f.replace(/\.env$/, ''))
+        .sort();
+}
+/** Read the global active-profile file only (ignores PB_PROFILE). */
+export function getGlobalActiveProfile() {
+    if (existsSync(ACTIVE_PROFILE_PATH)) {
+        const name = readFileSync(ACTIVE_PROFILE_PATH, 'utf8').trim();
+        if (name)
+            return name;
+    }
+    return null;
+}
+/** Get the active profile name (PB_PROFILE env wins, then the global file). */
+export function getActiveProfile() {
+    const envProfile = process.env.PB_PROFILE?.trim();
+    if (envProfile)
+        return envProfile;
+    return getGlobalActiveProfile();
+}
+/**
+ * Create a new profile.
+ *
+ * TEN-2851: refuses to overwrite an existing profile file by default — a caller wanting to
+ * replace an occupied profile's credentials must pass `{ overwrite: true }` explicitly (the
+ * act stays deliberate at every call site, never a silent side-effect of a name collision).
+ * `pb connect`'s clobber gate (connect.ts saveKeyAsProfile) is the one caller that passes it,
+ * and only after an explicit interactive confirm.
+ */
+export function createProfile(name, apiKey, siteUrl, opts) {
+    validateProfileName(name);
+    mkdirSync(PROFILES_DIR, { recursive: true });
+    const lines = [
+        `# Product Brain CLI profile: ${name}`,
+        `PRODUCTBRAIN_API_KEY=${apiKey}`,
+    ];
+    if (siteUrl) {
+        lines.push(`CONVEX_SITE_URL=${siteUrl}`);
+    }
+    lines.push('');
+    const content = lines.join('\n');
+    // TEN-2851 TOCTOU (Copilot review): an existsSync() pre-check followed by a plain 'w'
+    // write leaves a race window — a concurrent process can create the file between the
+    // check and the write, and 'w' would silently truncate it. When NOT overwriting, use the
+    // exclusive-create flag 'wx' so the filesystem is the atomic guard: EEXIST (whether from
+    // a pre-existing file or one created in the race window) surfaces as the SAME
+    // PROFILE_ALREADY_EXISTS error every existing caller already handles. `{ overwrite: true }`
+    // is an explicit, already-confirmed replace (see connect.ts saveKeyAsProfile) and
+    // intentionally keeps the plain 'w' flag — it means to replace whatever is there.
+    if (opts?.overwrite) {
+        writeFileSync(profilePath(name), content, { mode: 0o600 });
+    }
+    else {
+        try {
+            writeFileSync(profilePath(name), content, { mode: 0o600, flag: 'wx' });
+        }
+        catch (err) {
+            if (err && typeof err === 'object' && 'code' in err && err.code === 'EEXIST') {
+                throw new CLIError(`Profile "${name}" already exists.`, { code: ErrorCode.PROFILE_ALREADY_EXISTS, category: 'profile' });
+            }
+            throw err;
+        }
+    }
+    // If this is the first profile, make it active. Scoped to !opts?.overwrite (Codex review,
+    // WP-628 P2): an overwrite call means the profile ALREADY existed — it can never be "the
+    // first profile ever created" — so it must never claim a missing active-profile marker.
+    // Without this guard, confirming an overwrite while that marker happens to be absent would
+    // silently activate the overwritten target globally, contradicting this function's own
+    // "does not activate globally" contract (connect.ts saveKeyAsProfile docstring).
+    if (!opts?.overwrite && !existsSync(ACTIVE_PROFILE_PATH)) {
+        writeFileSync(ACTIVE_PROFILE_PATH, name, { mode: 0o600 });
+    }
+}
+/** Switch the active profile. */
+export function useProfile(name) {
+    validateProfileName(name);
+    if (!existsSync(profilePath(name))) {
+        throw new CLIError(`Profile "${name}" does not exist.`, { code: ErrorCode.PROFILE_NOT_FOUND, category: 'profile' });
+    }
+    mkdirSync(HOME_CONFIG_DIR, { recursive: true });
+    writeFileSync(ACTIVE_PROFILE_PATH, name, { mode: 0o600 });
+}
+/** Delete a profile. Cannot delete the last profile or the active profile. */
+export function deleteProfile(name) {
+    validateProfileName(name);
+    const path = profilePath(name);
+    if (!existsSync(path)) {
+        throw new CLIError(`Profile "${name}" does not exist.`, { code: ErrorCode.PROFILE_NOT_FOUND, category: 'profile' });
+    }
+    const profiles = listProfiles();
+    if (profiles.length <= 1) {
+        throw new CLIError(`Cannot delete the last profile "${name}".`, { code: ErrorCode.PROFILE_IS_LAST, category: 'profile' });
+    }
+    const active = getActiveProfile();
+    if (active === name) {
+        throw new CLIError(`Cannot delete the active profile "${name}". Switch to another profile first.`, { code: ErrorCode.PROFILE_IS_ACTIVE, category: 'profile', guidance: 'Run `pb profile use <other-profile>` first.' });
+    }
+    unlinkSync(path);
+}
+/**
+ * Resolve config from the active profile.
+ * Resolution order: PB_PROFILE env > active-profile file > "default" > legacy .env
+ * Returns null if no profile or config is available.
+ */
+export function resolveProfileConfig() {
+    autoMigrate();
+    // 1. Check PB_PROFILE env var
+    const envProfile = process.env.PB_PROFILE?.trim();
+    if (envProfile) {
+        const config = readProfileFile(profilePath(envProfile));
+        if (config)
+            return { ...config, profileName: envProfile };
+    }
+    // 2. Check active-profile file
+    if (existsSync(ACTIVE_PROFILE_PATH)) {
+        const name = readFileSync(ACTIVE_PROFILE_PATH, 'utf8').trim();
+        if (name) {
+            const config = readProfileFile(profilePath(name));
+            if (config)
+                return { ...config, profileName: name };
+        }
+    }
+    // 3. Check "default" profile
+    {
+        const config = readProfileFile(profilePath('default'));
+        if (config)
+            return { ...config, profileName: 'default' };
+    }
+    // 4. Fall back to legacy .env — not a named profile, so no profileName.
+    {
+        const config = readProfileFile(LEGACY_ENV_PATH);
+        if (config)
+            return { ...config, profileName: null };
+    }
+    return null;
+}
+/**
+ * Resolve config for a specific named profile.
+ * Returns null both when the profile file is absent AND when it exists but fails to parse
+ * (missing/empty PRODUCTBRAIN_API_KEY) — those two cases are NOT the same thing to a caller
+ * deciding whether it's safe to create; use `profileFileExists()` to tell them apart
+ * (Codex review, WP-628 P2).
+ */
+export function resolveNamedProfileConfig(name) {
+    return readProfileFile(profilePath(name));
+}
+/** Does a profile FILE exist at this name, independent of whether it parses (see above). */
+export function profileFileExists(name) {
+    return existsSync(profilePath(name));
+}
+// Exported for testing
+export { PROFILES_DIR, ACTIVE_PROFILE_PATH, LEGACY_ENV_PATH, HOME_CONFIG_DIR };
+//# sourceMappingURL=profiles.js.map

package/dist/lib/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/lib/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACtE,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;AACvE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AAEzD,6EAA6E;AAC7E,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAoBpD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAChB,yBAAyB,IAAI,sFAAsF,EACnH,EAAE,IAAI,EAAE,SAAS,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,MAAM;QACN,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,SAAS;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,eAAe,CAAC;YAAE,UAAU,CAAC,eAAe,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACtD,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,aAAa,CAAC,mBAAmB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,YAAY;IAC1B,WAAW,EAAE,CAAC;IACd,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,WAAW,CAAC,YAAY,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,sBAAsB;IACpC,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAc,EACd,OAAgB,EAChB,IAA8B;IAE9B,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAG;QACZ,gCAAgC,IAAI,EAAE;QACtC,wBAAwB,MAAM,EAAE;KACjC,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjC,sFAAsF;IACtF,oFAAoF;IACpF,yFAAyF;IACzF,yFAAyF;IACzF,8EAA8E;IAC9E,4FAA4F;IAC5F,kFAAkF;IAClF,kFAAkF;IAClF,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;QACpB,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxG,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,sBAAsB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,yFAAyF;IACzF,wFAAwF;IACxF,2FAA2F;IAC3F,uFAAuF;IACvF,iFAAiF;IACjF,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzD,aAAa,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,aAAa,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,mCAAmC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,qCAAqC,IAAI,qCAAqC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,6CAA6C,EAAE,CAAC,CAAC;IAC1N,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,WAAW,EAAE,CAAC;IAEd,8BAA8B;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IAC5D,CAAC;IAED,+BAA+B;IAC/B,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,IAAI,MAAM;gBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,CAAC;QACC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC;IAED,wEAAwE;IACxE,CAAC;QACC,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,uBAAuB;AACvB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC"}

package/dist/lib/projectConfig.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The repo's own Product Brain config files — locating them and reading what they declare.
+ *
+ * Split out of config.ts under STD-2 / DEC-1504. The seam is deliberate and worth keeping:
+ * this module answers "what does THIS REPO say about itself" from the filesystem alone, while
+ * config.ts answers "which credential do we therefore use". Nothing here reads a credential
+ * store, an env var, or the global active profile — so it has no dependency on config.ts and
+ * cannot participate in an import cycle.
+ *
+ * Split config design:
+ * - config.json (committed): siteUrl only — workspace gateway, safe to share with teammates.
+ * - config.local.json (gitignored): profile pin — machine-local, never committed. Because it
+ *   is gitignored, a fresh clone or worktree does NOT inherit it (INS-2462) — the caller must
+ *   treat "no pin" as an explicit state, never as permission to guess a workspace.
+ */
+/** Project config shape — .productbrain/config.json (committed, siteUrl only) */
+export interface ProjectConfig {
+    siteUrl?: string;
+}
+/** Local project config shape — .productbrain/config.local.json (gitignored, machine-local) */
+export interface LocalProjectConfig {
+    profile?: string;
+    /** Direct preview API key — set by `npm run pb:preview`, cleared by `npm run pb:real`. */
+    apiKey?: string;
+    /**
+     * An `apiKey` was present but failed the `API_KEY_PREFIX` bar, so it was not loaded.
+     * Kept apart from `apiKey` so a malformed key can never bind, while diagnostics can still
+     * say "malformed" instead of misreporting it as absent.
+     */
+    apiKeyMalformed?: boolean;
+    /** Preview site URL — set alongside apiKey by `npm run pb:preview`. */
+    siteUrl?: string;
+    /** Marks this config as preview-bound; the CLI shows a loud banner on every command. */
+    preview?: boolean;
+    /** Human-readable preview workspace name for the banner (e.g. "Preview Workspace"). */
+    workspaceName?: string;
+}
+/**
+ * Walk up the directory tree (git-style) to find the nearest CLI project root.
+ *
+ * A `.productbrain/` directory only counts as a CLI project root when it carries
+ * CLI configuration — `config.json` (committed siteUrl gateway) or
+ * `config.local.json` (machine-local profile pin or preview binding). A
+ * projection-only `.productbrain/` written by `pb handshake` (briefing.md,
+ * context.md, rules/, etc.) does NOT count — otherwise a subrepo like
+ * `packages/cli/.productbrain/` would shadow the real configuring root and
+ * `npm run pb:preview` writes (which always land at the repo-root
+ * `.productbrain/`) would be invisible to commands run from the subrepo.
+ *
+ * Stops at home directory or filesystem root. Returns the directory containing
+ * a config-bearing `.productbrain/`, or null if not found.
+ */
+export declare function findProjectRoot(startDir: string): string | null;
+/**
+ * Read .productbrain/config.json from the walked-up project root.
+ * Only reads siteUrl — profile and apiKey fields are ignored (legacy or misplaced).
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON but does not throw.
+ */
+export declare function readProjectConfig(): ProjectConfig | null;
+/**
+ * Does the committed `.productbrain/config.json` EXIST, independent of whether it parses?
+ *
+ * The project's self-declaration is the file's PRESENCE, not its contents. `readProjectConfig()`
+ * returns null for a malformed or non-object file exactly as it does for an absent one, so a
+ * caller asking "is this a project" through that value reads a DAMAGED declaration as no
+ * declaration at all — and falls through to whatever workspace the global profile names. A
+ * corrupt committed file must not be a way out of the project's own tenant rules, so callers
+ * deciding whether a repo has declared itself ask this instead (Codex review, WP-694 S2).
+ */
+export declare function projectConfigExists(): boolean;
+/**
+ * Read .productbrain/config.local.json from the walked-up project root.
+ * Returns the machine-local pin (`profile`) and any preview-binding fields
+ * (`apiKey`, `siteUrl`, `preview`, `workspaceName`) written by
+ * `npm run pb:preview` — all gitignored, never committed.
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON but does not throw.
+ */
+export declare function readLocalProjectConfig(): LocalProjectConfig | null;
+//# sourceMappingURL=projectConfig.d.ts.map

package/dist/lib/projectConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../src/lib/projectConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB/D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,aAAa,GAAG,IAAI,CAuBxD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAI7C;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,GAAG,IAAI,CA8ClE"}

package/dist/lib/projectConfig.js

@@ -0,0 +1,157 @@
+/**
+ * The repo's own Product Brain config files — locating them and reading what they declare.
+ *
+ * Split out of config.ts under STD-2 / DEC-1504. The seam is deliberate and worth keeping:
+ * this module answers "what does THIS REPO say about itself" from the filesystem alone, while
+ * config.ts answers "which credential do we therefore use". Nothing here reads a credential
+ * store, an env var, or the global active profile — so it has no dependency on config.ts and
+ * cannot participate in an import cycle.
+ *
+ * Split config design:
+ * - config.json (committed): siteUrl only — workspace gateway, safe to share with teammates.
+ * - config.local.json (gitignored): profile pin — machine-local, never committed. Because it
+ *   is gitignored, a fresh clone or worktree does NOT inherit it (INS-2462) — the caller must
+ *   treat "no pin" as an explicit state, never as permission to guess a workspace.
+ */
+import { readFileSync, existsSync } from 'fs';
+import { resolve } from 'path';
+import { homedir } from 'os';
+import { API_KEY_PREFIX } from './tokenConstants.js';
+/**
+ * Walk up the directory tree (git-style) to find the nearest CLI project root.
+ *
+ * A `.productbrain/` directory only counts as a CLI project root when it carries
+ * CLI configuration — `config.json` (committed siteUrl gateway) or
+ * `config.local.json` (machine-local profile pin or preview binding). A
+ * projection-only `.productbrain/` written by `pb handshake` (briefing.md,
+ * context.md, rules/, etc.) does NOT count — otherwise a subrepo like
+ * `packages/cli/.productbrain/` would shadow the real configuring root and
+ * `npm run pb:preview` writes (which always land at the repo-root
+ * `.productbrain/`) would be invisible to commands run from the subrepo.
+ *
+ * Stops at home directory or filesystem root. Returns the directory containing
+ * a config-bearing `.productbrain/`, or null if not found.
+ */
+export function findProjectRoot(startDir) {
+    let dir = startDir;
+    const home = homedir();
+    while (true) {
+        const pbDir = resolve(dir, '.productbrain');
+        if (existsSync(pbDir) &&
+            (existsSync(resolve(pbDir, 'config.json')) ||
+                existsSync(resolve(pbDir, 'config.local.json')))) {
+            return dir;
+        }
+        const parent = resolve(dir, '..');
+        if (parent === dir || dir === home)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Read .productbrain/config.json from the walked-up project root.
+ * Only reads siteUrl — profile and apiKey fields are ignored (legacy or misplaced).
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON but does not throw.
+ */
+export function readProjectConfig() {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot)
+        return null;
+    const configPath = resolve(projectRoot, '.productbrain', 'config.json');
+    if (!existsSync(configPath))
+        return null;
+    try {
+        const raw = readFileSync(configPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            process.stderr.write('Warning: .productbrain/config.json is not a JSON object, skipping.\n');
+            return null;
+        }
+        const result = {};
+        if (typeof parsed.siteUrl === 'string' && parsed.siteUrl) {
+            result.siteUrl = parsed.siteUrl;
+        }
+        // Silently ignore `profile` and `apiKey` in config.json — those must be in config.local.json
+        return result;
+    }
+    catch {
+        process.stderr.write('Warning: .productbrain/config.json contains invalid JSON, skipping.\n');
+        return null;
+    }
+}
+/**
+ * Does the committed `.productbrain/config.json` EXIST, independent of whether it parses?
+ *
+ * The project's self-declaration is the file's PRESENCE, not its contents. `readProjectConfig()`
+ * returns null for a malformed or non-object file exactly as it does for an absent one, so a
+ * caller asking "is this a project" through that value reads a DAMAGED declaration as no
+ * declaration at all — and falls through to whatever workspace the global profile names. A
+ * corrupt committed file must not be a way out of the project's own tenant rules, so callers
+ * deciding whether a repo has declared itself ask this instead (Codex review, WP-694 S2).
+ */
+export function projectConfigExists() {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot)
+        return false;
+    return existsSync(resolve(projectRoot, '.productbrain', 'config.json'));
+}
+/**
+ * Read .productbrain/config.local.json from the walked-up project root.
+ * Returns the machine-local pin (`profile`) and any preview-binding fields
+ * (`apiKey`, `siteUrl`, `preview`, `workspaceName`) written by
+ * `npm run pb:preview` — all gitignored, never committed.
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON but does not throw.
+ */
+export function readLocalProjectConfig() {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot)
+        return null;
+    const configPath = resolve(projectRoot, '.productbrain', 'config.local.json');
+    if (!existsSync(configPath))
+        return null;
+    try {
+        const raw = readFileSync(configPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            process.stderr.write('Warning: .productbrain/config.local.json is not a JSON object, skipping.\n');
+            return null;
+        }
+        const result = {};
+        if (typeof parsed.profile === 'string' && parsed.profile) {
+            result.profile = parsed.profile;
+        }
+        // Preview binding fields — written by `npm run pb:preview`, cleared by `npm run pb:real`.
+        //
+        // Fail closed on ANY present-but-invalid apiKey, not just a wrong-prefix string: a number,
+        // an empty string, a boolean or an object is a corrupt or hand-written binding, and treating
+        // it as absent would let the caller skip the claimed binding and adopt a sibling profile pin
+        // — the workspace substitution this whole path exists to prevent. Only `undefined`/`null`
+        // count as absent: JSON `null` conventionally means "no value", and `npm run pb:real` strips
+        // the preview keys entirely rather than nulling them.
+        if (parsed.apiKey !== undefined && parsed.apiKey !== null) {
+            if (typeof parsed.apiKey === 'string' && parsed.apiKey.startsWith(API_KEY_PREFIX)) {
+                result.apiKey = parsed.apiKey;
+            }
+            else {
+                result.apiKeyMalformed = true;
+            }
+        }
+        if (typeof parsed.siteUrl === 'string' && parsed.siteUrl) {
+            result.siteUrl = parsed.siteUrl;
+        }
+        if (parsed.preview === true) {
+            result.preview = true;
+        }
+        if (typeof parsed.workspaceName === 'string' && parsed.workspaceName) {
+            result.workspaceName = parsed.workspaceName;
+        }
+        return result;
+    }
+    catch {
+        process.stderr.write('Warning: .productbrain/config.local.json contains invalid JSON, skipping.\n');
+        return null;
+    }
+}
+//# sourceMappingURL=projectConfig.js.map

package/dist/lib/projectConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectConfig.js","sourceRoot":"","sources":["../../src/lib/projectConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA0BrD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC5C,IACE,UAAU,CAAC,KAAK,CAAC;YACjB,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACxC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAClD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,6FAA6F;QAC7F,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAuB,EAAE,CAAC;QACtC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,0FAA0F;QAC1F,EAAE;QACF,2FAA2F;QAC3F,6FAA6F;QAC7F,6FAA6F;QAC7F,0FAA0F;QAC1F,6FAA6F;QAC7F,sDAAsD;QACtD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACrE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC9C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACpG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/prompts.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Prompt gate — TTY-aware, cancel-safe, mode-aware.
+ * All interactive CLI prompts flow through this module.
+ * WP-303 Slice 1: replaces raw readline with @clack/prompts.
+ */
+export interface PromptOptions {
+    message: string;
+    placeholder?: string;
+    defaultValue?: string;
+    validate?: (value: string) => string | undefined;
+}
+export interface ConfirmOptions {
+    message: string;
+    initialValue?: boolean;
+}
+export interface SelectOptions<T> {
+    message: string;
+    options: {
+        value: T;
+        label: string;
+        hint?: string;
+    }[];
+}
+export interface PasswordOptions {
+    message: string;
+    validate?: (value: string) => string | undefined;
+}
+/** Returns true if the CLI is running in a context where prompts are safe. */
+export declare function isInteractive(): boolean;
+/** Text input — wraps clack.text(). */
+export declare function ask(opts: PromptOptions): Promise<string>;
+/** Yes/no confirmation — wraps clack.confirm(). */
+export declare function confirm(opts: ConfirmOptions): Promise<boolean>;
+/** Single-select menu — wraps clack.select(). */
+export declare function select<T>(opts: SelectOptions<T>): Promise<T>;
+/** Password input (masked) — wraps clack.password(). */
+export declare function password(opts: PasswordOptions): Promise<string>;
+export interface MultiSelectOptions<T> {
+    message: string;
+    options: {
+        value: T;
+        label: string;
+        hint?: string;
+    }[];
+    required?: boolean;
+    initialValues?: T[];
+}
+/** Multi-select menu — wraps clack.multiselect(). */
+export declare function multiselect<T>(opts: MultiSelectOptions<T>): Promise<T[]>;
+/** Open a titled session — wraps clack.intro(). No-op in non-interactive. */
+export declare function intro(title?: string): void;
+/** Close a session — wraps clack.outro(). No-op in non-interactive. */
+export declare function outro(message?: string): void;
+/** Styled information box — wraps clack.note(). No-op in non-interactive. */
+export declare function note(message: string, title?: string): void;
+/** Structured log helpers — degrade to plain stdout/stderr in non-interactive. */
+export declare const log: {
+    step: (msg: string) => void;
+    success: (msg: string) => void;
+    warn: (msg: string) => void;
+    error: (msg: string) => void;
+    info: (msg: string) => void;
+    message: (msg?: string) => void;
+};
+//# sourceMappingURL=prompts.d.ts.map

package/dist/lib/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../src/lib/prompts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QAAE,KAAK,EAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAClD;AA0CD,8EAA8E;AAC9E,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,uCAAuC;AACvC,wBAAsB,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAU9D;AAED,mDAAmD;AACnD,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpE;AAED,iDAAiD;AACjD,wBAAsB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CASlE;AAED,wDAAwD;AACxD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrE;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QAAE,KAAK,EAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;CACrB;AAED,qDAAqD;AACrD,wBAAsB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAW9E;AAED,6EAA6E;AAC7E,wBAAgB,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAG1C;AAED,uEAAuE;AACvE,wBAAgB,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAG5C;AAED,6EAA6E;AAC7E,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAG1D;AAED,kFAAkF;AAClF,eAAO,MAAM,GAAG;gBACC,MAAM;mBACN,MAAM;gBACN,MAAM;iBACN,MAAM;gBACN,MAAM;oBACL,MAAM;CAGvB,CAAC"}