@productbrain/cli 0.1.0-beta.5083 → 0.1.0-beta.5105

package/dist/lib/reportedProfile.js

@@ -8,12 +8,100 @@
  * Lives outside config.ts (STD-2 / DEC-1504 shrink-only). Do not re-export
  * from config.ts — this module imports FROM config.ts.
  */
-import { getConfigSafe, resolveEffectiveProfile } from './config.js';
+import { resolveConfig, resolveEffectiveProfile } from './config.js';
+import { resolveConfigResult } from './configResult.js';
+import { declaresCompletePreviewBinding, declaresLocalBinding } from './localBinding.js';
+import { readLocalProjectConfig } from './projectConfig.js';
+import { getGlobalActiveProfile } from './profiles.js';
+import { isEnvKeyBinding } from './envKeySnapshot.js';
+// The snapshot itself lives in its own leaf so config.ts can use it too without a cycle.
+// Re-exported here because every label surface already imports it from this module.
+export { isEnvKeyBinding, resetReportedProfileSnapshot } from './envKeySnapshot.js';
 export function resolveReportedProfile() {
-    const cfg = getConfigSafe();
-    if (!cfg.ok && cfg.kind === 'missing-pin') {
-        return { profile: null, source: 'missing-pin' };
+    // Precedence mirrors the CREDENTIAL cascade (DEC-1607), so the label can never name a source
+    // that lost. An exported key wins resolveConfig() step 1 outright — ahead of the pin, ahead of
+    // the no-tenant refusal — so it is reported first, and `missing-pin` can never co-occur.
+    if (isEnvKeyBinding())
+        return { profile: null, source: 'env-key' };
+    // From here the answer comes from ONE place: the credential cascade re-run against the FILES.
+    //
+    // `ignoreEnvKey` is what makes that possible (TEN-3311). loadEnv() copies whichever credential
+    // won into PRODUCTBRAIN_API_KEY, so a plain getConfigSafe() after any kernel call reports every
+    // binding as `env` — which is why five review rounds each surfaced one more branch whose label
+    // was wrong. We have already established above that no OPERATOR export exists, so skipping
+    // step 1 recovers the branch that actually supplied the key, with the name it recorded.
+    const cfg = resolveConfigResult(() => resolveConfig(true));
+    if (!cfg.ok) {
+        // ONE RULE, and every refusal obeys it: a refusal is still an answer about WHICH binding is in
+        // play, so it must never be attributed to a source that binding already beat. Four review
+        // rounds found four refusals violating it, so they are handled by what the refusal KNOWS
+        // rather than case by case (Codex P2 r8, r16, r18, r20):
+        //   the no-tenant refusal   → say so; nothing is bound (r8).
+        //   it names the winner     → name it, even though the cascade then rejected what it held.
+        //                             Re-deriving returns a DIFFERENT profile when PB_PROFILE points
+        //                             at a missing one (r18).
+        //   it names only a source  → a dotenv file supplied it and then failed validation (r20).
+        //   config.local.json's own → an incomplete claim, or a complete one with a bad URL (r16).
+        // Only a DANGLING PIN falls through to the configured name, because naming the pin IS the
+        // diagnosis the operator needs there (TEN-2163).
+        if (cfg.kind === 'missing-pin')
+            return { profile: null, source: 'missing-pin' };
+        if (cfg.profileName)
+            return { profile: cfg.profileName, source: classifyProfileName(cfg.profileName) };
+        if (cfg.source === 'cwd')
+            return { profile: null, source: 'cwd-key' };
+        return classifyLocalBinding() ?? safeDerive();
     }
+    switch (cfg.source) {
+        case 'project': {
+            // config.local.json won. `profileName` present = the repo PIN; absent = a direct
+            // apiKey/siteUrl binding, which resolveLocalBinding() puts AHEAD of any sibling pin
+            // (Codex P2 r7) — so naming that pin would name a workspace pb is not using.
+            if (cfg.profileName)
+                return { profile: cfg.profileName, source: 'local' };
+            return classifyLocalBinding() ?? { profile: null, source: 'local-key' };
+        }
+        // resolveProfileConfig() falls PB_PROFILE → active-profile file → "default" → legacy and
+        // RECORDS the winner, so a PB_PROFILE naming a DELETED profile no longer reports that dead
+        // name. Absent only for the nameless legacy home file, which no profile describes.
+        case 'profile':
+            // No name only for the nameless legacy home file, which is auto-migrated on first use;
+            // leave that rare path on the configured-name behaviour rather than inventing a label.
+            return cfg.profileName
+                ? { profile: cfg.profileName, source: classifyProfileName(cfg.profileName) }
+                : safeDerive();
+        // A dotenv file here supplied the key. No profile involved — same lie as env-key, other file.
+        case 'cwd':
+            return { profile: null, source: 'cwd-key' };
+        // 'env' cannot reach here (the export returned above); 'default' means no credential at all.
+        default:
+            return safeDerive();
+    }
+}
+/**
+ * Name config.local.json's own direct binding, or null when it declares none. Shared by the
+ * success and refusal paths so a binding is described the same way whether it resolved or blew up.
+ */
+function classifyLocalBinding() {
+    try {
+        const local = readLocalProjectConfig();
+        // localBinding's OWN claim predicate, not a copy of it. Mine missed `apiKeyMalformed` — a
+        // wrong-prefix or non-string key, which resolveLocalBinding() still treats as a direct-binding
+        // claim that outranks the pin, so the label fell back to naming that pin (Codex P2 r17).
+        // Duplicating this test is what caused it; sharing it is what stops the next one.
+        if (!declaresLocalBinding(local))
+            return null;
+        const preview = declaresCompletePreviewBinding(local);
+        return preview
+            ? { profile: preview.workspaceName, source: 'preview' }
+            : { profile: null, source: 'local-key' };
+    }
+    catch {
+        return null;
+    }
+}
+/** The configured-name path, guarded: whoami must degrade on an unreadable/racing file, not throw. */
+function safeDerive() {
     try {
         return resolveEffectiveProfile();
     }
@@ -21,4 +109,26 @@ export function resolveReportedProfile() {
         return { profile: null, source: 'none' };
     }
 }
+/**
+ * Where a profile NAME that actually supplied the credential came from.
+ *
+ * Same precedence as `resolveEffectiveProfile()`: repo pin > PB_PROFILE > global > default. The
+ * pin came last-minute (Codex P2 r19) — without it, a pinned profile whose URL is then rejected
+ * was reported `global`, pointing the operator at the wrong file to repair.
+ */
+function classifyProfileName(name) {
+    try {
+        if (name === readLocalProjectConfig()?.profile)
+            return 'local';
+    }
+    catch { /* fall through */ }
+    if (name === process.env.PB_PROFILE?.trim())
+        return 'env';
+    try {
+        if (name === getGlobalActiveProfile())
+            return 'global';
+    }
+    catch { /* fall through */ }
+    return name === 'default' ? 'default' : 'global';
+}
 //# sourceMappingURL=reportedProfile.js.map

package/dist/lib/reportedProfile.js.map

@@ -1 +1 @@
-{"version":3,"file":"reportedProfile.js","sourceRoot":"","sources":["../../src/lib/reportedProfile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAA+B,MAAM,aAAa,CAAC;AAIlG,MAAM,UAAU,sBAAsB;IAIpC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC"}
+{"version":3,"file":"reportedProfile.js","sourceRoot":"","sources":["../../src/lib/reportedProfile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAA+B,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKtD,yFAAyF;AACzF,oFAAoF;AACpF,OAAO,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEpF,MAAM,UAAU,sBAAsB;IAIpC,6FAA6F;IAC7F,+FAA+F;IAC/F,yFAAyF;IACzF,IAAI,eAAe,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACnE,8FAA8F;IAC9F,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,wFAAwF;IACxF,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,+FAA+F;QAC/F,0FAA0F;QAC1F,yFAAyF;QACzF,yDAAyD;QACzD,6DAA6D;QAC7D,2FAA2F;QAC3F,6FAA6F;QAC7F,sDAAsD;QACtD,0FAA0F;QAC1F,2FAA2F;QAC3F,0FAA0F;QAC1F,iDAAiD;QACjD,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAChF,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACvG,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACtE,OAAO,oBAAoB,EAAE,IAAI,UAAU,EAAE,CAAC;IAChD,CAAC;IACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,iFAAiF;YACjF,oFAAoF;YACpF,6EAA6E;YAC7E,IAAI,GAAG,CAAC,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1E,OAAO,oBAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC1E,CAAC;QACD,yFAAyF;QACzF,2FAA2F;QAC3F,mFAAmF;QACnF,KAAK,SAAS;YACZ,uFAAuF;YACvF,uFAAuF;YACvF,OAAO,GAAG,CAAC,WAAW;gBACpB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;gBAC5E,CAAC,CAAC,UAAU,EAAE,CAAC;QACnB,8FAA8F;QAC9F,KAAK,KAAK;YACR,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9C,6FAA6F;QAC7F;YACE,OAAO,UAAU,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;QACvC,0FAA0F;QAC1F,+FAA+F;QAC/F,yFAAyF;QACzF,kFAAkF;QAClF,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,OAAO,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,OAAO;YACZ,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE;YACvD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,sBAAsB,EAAE,EAAE,OAAO;YAAE,OAAO,OAAO,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,sBAAsB,EAAE;YAAE,OAAO,QAAQ,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC"}

package/dist/lib/session.d.ts

@@ -27,6 +27,19 @@ export interface SessionState {
     closedAt?: string;
     /** Effective profile name at session start — backstop for detecting a profile switch. */
     profile?: string;
+    /**
+     * Fingerprint of the CREDENTIAL this session was started under (TEN-3240).
+     *
+     * `profile` alone cannot see a raw exported `PRODUCTBRAIN_API_KEY`: it names profiles, and an
+     * exported key supplies no profile name. Swap that key for another workspace's between two
+     * invocations and the name is unchanged, so the name-only backstop reports the OLD workspace's
+     * session as still active. This is derived from the resolved key + gateway, so it moves
+     * whenever the binding does — profile switch, preview flip, or bare key swap alike.
+     *
+     * Optional: sessions written before this field existed carry only `profile`, and the backstop
+     * still honours that. Never the key itself — a one-way digest, and only its head is kept.
+     */
+    bindingFingerprint?: string;
     /** WP-479 E2: the conversation identity this marker is scoped to, when one resolved. */
     conversationId?: string;
 }

package/dist/lib/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/lib/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;4FAE4F;AAC5F,eAAO,MAAM,gBAAgB,QAAqB,CAAC;AAEnD,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAiFD,wBAAgB,WAAW,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAahF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAUvF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CA6BlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAIpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAmBzC;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,OAAO,CAG1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAS7C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAkB7C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBrF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAKvF"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/lib/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;4FAE4F;AAC5F,eAAO,MAAM,gBAAgB,QAAqB,CAAC;AAEnD,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAiFD,wBAAgB,WAAW,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAahF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAUvF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CA6BlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAIpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAmBzC;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,OAAO,CAG1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAS7C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAkB7C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBrF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAKvF"}

package/dist/lib/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/lib/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAC7G,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAgB1D;;4FAE4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAYnD;;;;;;;;;GASG;AACH,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,yBAAyB,CAAC,cAAsB;IACvD,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,cAAc,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,4BAA4B,CAAC,cAAsB;IAC1D,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,cAAc,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,cAA6B;IAC/C,OAAO,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,aAAa,CAAC,cAA6B;IAClD,OAAO,cAAc,CAAC,CAAC,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B;IACnC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAiB,CAAC;YACnE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;gBAC9E,UAAU,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,sBAA+B;IACzD,4BAA4B,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;QAChE,qEAAqE;QACrE,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAmB,EAAE,sBAA+B;IAC/E,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,kFAAkF;IAClF,gGAAgG;IAChG,+DAA+D;IAC/D,KAAK,CAAC,cAAc,GAAG,cAAc,IAAI,SAAS,CAAC;IACnD,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,4BAA4B,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,sBAA+B;IAC1D,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO;IAC3B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;QACrE,qEAAqE;QACrE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,UAAU,CAAC,CAAC,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,eAAe,EAAE,EAAE;YACnB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,cAAc,EAAE,cAAc,IAAI,SAAS;SAC5C,CAAC;QACF,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAChE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAC1C,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,4BAA4B,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,sBAA+B;IAC5D,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,sBAA+B;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,OAAO,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAW,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,qDAAqD;QACrE,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,sBAA+B;IAC9D,4BAA4B,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;QAChE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,cAAc,EAAE,GAAG,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,sBAA+B;IAC/E,MAAM,OAAO,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/lib/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAC7G,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AA6B1D;;4FAE4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAYnD;;;;;;;;;GASG;AACH,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,yBAAyB,CAAC,cAAsB;IACvD,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,cAAc,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,4BAA4B,CAAC,cAAsB;IAC1D,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,cAAc,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,cAA6B;IAC/C,OAAO,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,aAAa,CAAC,cAA6B;IAClD,OAAO,cAAc,CAAC,CAAC,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B;IACnC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAiB,CAAC;YACnE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;gBAC9E,UAAU,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,sBAA+B;IACzD,4BAA4B,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;QAChE,qEAAqE;QACrE,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAmB,EAAE,sBAA+B;IAC/E,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,kFAAkF;IAClF,gGAAgG;IAChG,+DAA+D;IAC/D,KAAK,CAAC,cAAc,GAAG,cAAc,IAAI,SAAS,CAAC;IACnD,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,4BAA4B,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,sBAA+B;IAC1D,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO;IAC3B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;QACrE,qEAAqE;QACrE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,UAAU,CAAC,CAAC,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,eAAe,EAAE,EAAE;YACnB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,cAAc,EAAE,cAAc,IAAI,SAAS;SAC5C,CAAC;QACF,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAChE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAC1C,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,4BAA4B,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,sBAA+B;IAC5D,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,sBAA+B;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,OAAO,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAW,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,qDAAqD;QACrE,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,sBAA+B;IAC9D,4BAA4B,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;QAChE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,cAAc,EAAE,GAAG,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,sBAA+B;IAC/E,MAAM,OAAO,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AAChD,CAAC"}

package/dist/lib/sessionBinding.d.ts

@@ -0,0 +1,59 @@
+import type { SessionState } from './session.js';
+/**
+ * One-way digest of the credential + gateway currently bound, or undefined when nothing is.
+ *
+ * By the time this runs, `getConfigOrGuide()` has already called `loadEnv()`, so `process.env`
+ * holds the credential that actually WON — whatever supplied it (export, pin, profile, preview).
+ * That is exactly the property wanted here: the fingerprint moves whenever the effective binding
+ * moves, without this module having to know which source produced it.
+ *
+ * Head-truncated to 16 hex chars: this value is only ever COMPARED, so keeping more would store
+ * more of a secret than the job needs. Never the key itself, never sent anywhere.
+ */
+export declare function fingerprintBinding(): string | undefined;
+/**
+ * The digest itself, taken as arguments rather than read from the environment.
+ *
+ * Split out so the hashing rules can be tested WITHOUT mutating `process.env`: vitest runs test
+ * files in parallel inside shared workers, so a test that deletes `PRODUCTBRAIN_API_KEY` to set up
+ * a case yanks it out from under whatever unrelated file is running beside it (observed live —
+ * it broke the handshake suite while passing on its own).
+ */
+export declare function fingerprintOf(key: string, gateway: string | undefined): string;
+/**
+ * Has the workspace this session was started against changed underneath it?
+ *
+ * TWO signals, because neither alone is sufficient:
+ *
+ *  - **Profile name** (TEN-2163, the original backstop) — catches `pb profile use`, a preview
+ *    flip, a pin edit. Blind to a raw exported `PRODUCTBRAIN_API_KEY`, which carries no profile
+ *    name at all: repoint that key at another workspace and the name never moves, so the session
+ *    stayed "already active" while every write went to a foreign Chain (TEN-3240).
+ *  - **Binding fingerprint** (TEN-3240) — catches exactly that, because it tracks the credential
+ *    rather than a name for it.
+ *
+ * Either firing is enough. Both comparisons are skipped when one side is absent, which is what
+ * keeps a session marker written BEFORE `bindingFingerprint` existed on the original name-only
+ * behaviour instead of being discarded on every start.
+ */
+export declare function bindingChanged(existing: Pick<SessionState, 'profile' | 'bindingFingerprint'>, current: {
+    profile: string | null;
+    fingerprint: string | undefined;
+}): boolean;
+/**
+ * Refuse a session-attributed write whose credential has MOVED since the session opened.
+ *
+ * `pb session start`'s switch-backstop is not the only door (Codex P1 r9): an operator can
+ * repoint an exported PRODUCTBRAIN_API_KEY and then run `pb capture` / `relate` / `update`
+ * directly, never re-running start. The marker still names the old workspace while the gateway
+ * derives the new one from the key (BR-18) — a cross-workspace write with a stale session id.
+ *
+ * Compares the fingerprint only: `getConfig()` above has already resolved the credential into
+ * `process.env`, so this is arithmetic on values already in hand — no file, no network, on the
+ * hot path of every write. Markers written before the field existed carry no fingerprint and are
+ * skipped, exactly as the session-start backstop skips them.
+ */
+export declare function assertSessionStillBound(session: {
+    bindingFingerprint?: string;
+} | null, current?: string | undefined): void;
+//# sourceMappingURL=sessionBinding.d.ts.map

package/dist/lib/sessionBinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionBinding.d.ts","sourceRoot":"","sources":["../../src/lib/sessionBinding.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAGvD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAS9E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,oBAAoB,CAAC,EAC9D,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACnE,OAAO,CAqBT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAG/C,OAAO,GAAE,MAAM,GAAG,SAAgC,GACjD,IAAI,CAiBN"}

package/dist/lib/sessionBinding.js

@@ -0,0 +1,118 @@
+/**
+ * Session binding identity — "is this session still pointed at the same Chain?"
+ *
+ * Lives outside commands/session.ts, which is grandfathered shrink-only (STD-2 / DEC-1504),
+ * and outside config.ts for the same reason. Pure and offline by construction: `process.env` and
+ * the stored marker, never a file and never the network — so the deliberately offline
+ * already-active session path (WP-696) can call it.
+ *
+ * It fingerprints the CREDENTIAL, always. An earlier version keyed a preview binding on its
+ * workspace NAME so a reseed would not read as a switch — that was unsound twice over (Codex r6
+ * P1, r8 P1): an exported key outranks the preview binding, and `seed-preview.mjs` hardcodes the
+ * name `Preview Workspace` while deliberately orphaning a stale workspace in the SAME deployment,
+ * so two genuinely different workspaces shared one fingerprint. The reseed nuisance it was buying
+ * — one extra session restart — is not worth trading a safety property for. Fail safe.
+ */
+import { createHash } from 'crypto';
+import { CLIError, ErrorCode } from './errors.js';
+import { DEFAULT_SITE_URL } from './constants.js';
+/**
+ * One-way digest of the credential + gateway currently bound, or undefined when nothing is.
+ *
+ * By the time this runs, `getConfigOrGuide()` has already called `loadEnv()`, so `process.env`
+ * holds the credential that actually WON — whatever supplied it (export, pin, profile, preview).
+ * That is exactly the property wanted here: the fingerprint moves whenever the effective binding
+ * moves, without this module having to know which source produced it.
+ *
+ * Head-truncated to 16 hex chars: this value is only ever COMPARED, so keeping more would store
+ * more of a secret than the job needs. Never the key itself, never sent anywhere.
+ */
+export function fingerprintBinding() {
+    const key = process.env.PRODUCTBRAIN_API_KEY;
+    return key ? fingerprintOf(key, process.env.CONVEX_SITE_URL) : undefined;
+}
+/**
+ * The digest itself, taken as arguments rather than read from the environment.
+ *
+ * Split out so the hashing rules can be tested WITHOUT mutating `process.env`: vitest runs test
+ * files in parallel inside shared workers, so a test that deletes `PRODUCTBRAIN_API_KEY` to set up
+ * a case yanks it out from under whatever unrelated file is running beside it (observed live —
+ * it broke the handshake suite while passing on its own).
+ */
+export function fingerprintOf(key, gateway) {
+    // Strip the trailing slash exactly as getConfigOrGuide()/loadEnv() do before using the URL.
+    // Without this, `https://x/` and `https://x` — the SAME effective endpoint — hash differently,
+    // and a session started under one form is spuriously discarded under the other (Codex P2 r2).
+    // Resolve the SAME way getConfigOrGuide() does — absent means DEFAULT_SITE_URL, not "no
+    // gateway". Hashing '' for the absent case made an explicit export of that exact default look
+    // like a different endpoint, discarding a valid session for no reason (Codex P2 r3).
+    const normalized = (gateway ?? DEFAULT_SITE_URL).replace(/\/$/, '');
+    return createHash('sha256').update(`${key} ${normalized}`).digest('hex').slice(0, 16);
+}
+/**
+ * Has the workspace this session was started against changed underneath it?
+ *
+ * TWO signals, because neither alone is sufficient:
+ *
+ *  - **Profile name** (TEN-2163, the original backstop) — catches `pb profile use`, a preview
+ *    flip, a pin edit. Blind to a raw exported `PRODUCTBRAIN_API_KEY`, which carries no profile
+ *    name at all: repoint that key at another workspace and the name never moves, so the session
+ *    stayed "already active" while every write went to a foreign Chain (TEN-3240).
+ *  - **Binding fingerprint** (TEN-3240) — catches exactly that, because it tracks the credential
+ *    rather than a name for it.
+ *
+ * Either firing is enough. Both comparisons are skipped when one side is absent, which is what
+ * keeps a session marker written BEFORE `bindingFingerprint` existed on the original name-only
+ * behaviour instead of being discarded on every start.
+ */
+export function bindingChanged(existing, current) {
+    const profileSwitched = Boolean(existing.profile && current.profile && existing.profile !== current.profile);
+    const credentialSwitched = Boolean(existing.bindingFingerprint && current.fingerprint && existing.bindingFingerprint !== current.fingerprint);
+    // MIGRATION BACKSTOP. A marker written before `bindingFingerprint` existed cannot be compared on
+    // the credential at all, so there is no evidence its workspace is unchanged — and a
+    // cross-workspace session survived the upgrade (Codex P1 r7, r8).
+    //
+    // A matching profile NAME is not that evidence, tempting as it looks: `pb connect` can overwrite
+    // an existing profile's credentials in place (connect.ts), so one name can point at two
+    // workspaces over time (Codex P1 r13). Treating it as proof was an escape hatch that could be
+    // wrong; without it the rule is both simpler and stricter.
+    //
+    // So it fails CLOSED, always: an unnecessary re-start costs one kernel call, once, while a
+    // missed switch costs a wrong-Chain write. It cannot fire on a marker this version wrote —
+    // those always carry a fingerprint — so it retires itself as old markers roll over.
+    const unprovable = !existing.bindingFingerprint && Boolean(current.fingerprint);
+    return profileSwitched || credentialSwitched || unprovable;
+}
+/**
+ * Refuse a session-attributed write whose credential has MOVED since the session opened.
+ *
+ * `pb session start`'s switch-backstop is not the only door (Codex P1 r9): an operator can
+ * repoint an exported PRODUCTBRAIN_API_KEY and then run `pb capture` / `relate` / `update`
+ * directly, never re-running start. The marker still names the old workspace while the gateway
+ * derives the new one from the key (BR-18) — a cross-workspace write with a stale session id.
+ *
+ * Compares the fingerprint only: `getConfig()` above has already resolved the credential into
+ * `process.env`, so this is arithmetic on values already in hand — no file, no network, on the
+ * hot path of every write. Markers written before the field existed carry no fingerprint and are
+ * skipped, exactly as the session-start backstop skips them.
+ */
+export function assertSessionStillBound(session, 
+// Injectable for the same reason `fingerprintOf` takes arguments: a test must not mutate the
+// shared process env to set this up (see that function's note).
+current = fingerprintBinding()) {
+    // Nothing bound, or a match: nothing to object to.
+    if (!session || !current || current === session.bindingFingerprint)
+        return;
+    // Falling through means either the fingerprints DISAGREE, or the marker carries none at all.
+    // A marker without one predates the field, so nothing can prove it still targets the workspace
+    // this credential belongs to — the same reasoning `bindingChanged` uses, and now the same answer
+    // (Codex P1 r15). Letting that through was the bigger hole of the two: `pb relate` sends no
+    // session id, so nothing downstream re-checks. `pb session start` restarts it once and stamps a
+    // fingerprint, after which this never fires again.
+    throw new CLIError('The workspace credential changed after this session started, so this write would land in a different workspace than the session belongs to.', {
+        code: ErrorCode.SESSION_REQUIRED,
+        category: 'session',
+        guidance: 'Run `pb session start` to open a session against the current workspace.',
+    });
+}
+//# sourceMappingURL=sessionBinding.js.map

package/dist/lib/sessionBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionBinding.js","sourceRoot":"","sources":["../../src/lib/sessionBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,OAA2B;IACpE,4FAA4F;IAC5F,+FAA+F;IAC/F,8FAA8F;IAC9F,wFAAwF;IACxF,8FAA8F;IAC9F,qFAAqF;IACrF,MAAM,UAAU,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA8D,EAC9D,OAAoE;IAEpE,MAAM,eAAe,GAAG,OAAO,CAC7B,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAC5E,CAAC;IACF,MAAM,kBAAkB,GAAG,OAAO,CAChC,QAAQ,CAAC,kBAAkB,IAAI,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,kBAAkB,KAAK,OAAO,CAAC,WAAW,CAC1G,CAAC;IACF,iGAAiG;IACjG,oFAAoF;IACpF,kEAAkE;IAClE,EAAE;IACF,iGAAiG;IACjG,wFAAwF;IACxF,8FAA8F;IAC9F,2DAA2D;IAC3D,EAAE;IACF,2FAA2F;IAC3F,2FAA2F;IAC3F,oFAAoF;IACpF,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAChF,OAAO,eAAe,IAAI,kBAAkB,IAAI,UAAU,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA+C;AAC/C,6FAA6F;AAC7F,gEAAgE;AAChE,UAA8B,kBAAkB,EAAE;IAElD,mDAAmD;IACnD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,OAAO,CAAC,kBAAkB;QAAE,OAAO;IAC3E,6FAA6F;IAC7F,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,mDAAmD;IACnD,MAAM,IAAI,QAAQ,CAChB,6IAA6I,EAC7I;QACE,IAAI,EAAE,SAAS,CAAC,gBAAgB;QAChC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,yEAAyE;KACpF,CACF,CAAC;AACJ,CAAC"}

package/dist/lib/workspaceNotice.d.ts

@@ -48,6 +48,13 @@ export interface WriteTargetNoticeInput {
  *  - `none`               → null (not configured: nothing to name, stay silent).
  *  - `missing-pin`        → null (declared project, no pin: the CLI REFUSES this write, so
  *                           there is no target workspace to name — and never `→ unknown`).
+ *  - `cwd-key`            → LOUD, unnamed (a dotenv file here picked the Chain — same shape as
+ *                           `env-key`, different file).
+ *  - `env-key`            → LOUD, unnamed (an exported PRODUCTBRAIN_API_KEY picked the Chain;
+ *                           no profile describes it, so the write goes somewhere this process
+ *                           cannot name from config — TEN-3240).
+ *  - `preview`            → named + disposable (a deliberate `npm run pb:preview` binding; the
+ *                           PREVIEW banner already shouts, so this does not shout twice).
  *  - `global` / `default` → qualified + hint (no repo pin → an unpinned fallback binding).
  *  - `local` / `env`      → plain (an explicit, intentional binding).
  *

package/dist/lib/workspaceNotice.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceNotice.d.ts","sourceRoot":"","sources":["../../src/lib/workspaceNotice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE1F,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mEAAmE;IACnE,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI,CAQlG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE"}
+{"version":3,"file":"workspaceNotice.d.ts","sourceRoot":"","sources":["../../src/lib/workspaceNotice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE1F,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mEAAmE;IACnE,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI,CAuBlG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBxE"}

package/dist/lib/workspaceNotice.js

@@ -41,6 +41,13 @@ import { resolveReportedProfile } from './reportedProfile.js';
  *  - `none`               → null (not configured: nothing to name, stay silent).
  *  - `missing-pin`        → null (declared project, no pin: the CLI REFUSES this write, so
  *                           there is no target workspace to name — and never `→ unknown`).
+ *  - `cwd-key`            → LOUD, unnamed (a dotenv file here picked the Chain — same shape as
+ *                           `env-key`, different file).
+ *  - `env-key`            → LOUD, unnamed (an exported PRODUCTBRAIN_API_KEY picked the Chain;
+ *                           no profile describes it, so the write goes somewhere this process
+ *                           cannot name from config — TEN-3240).
+ *  - `preview`            → named + disposable (a deliberate `npm run pb:preview` binding; the
+ *                           PREVIEW banner already shouts, so this does not shout twice).
  *  - `global` / `default` → qualified + hint (no repo pin → an unpinned fallback binding).
  *  - `local` / `env`      → plain (an explicit, intentional binding).
  *
@@ -50,7 +57,23 @@ import { resolveReportedProfile } from './reportedProfile.js';
 export function formatWriteTargetNotice({ profile, source }) {
     if (source === 'none' || source === 'missing-pin')
         return null;
+    // Deliberately NOT `→ unknown`: that reads as "a workspace whose name we failed to look up".
+    // Here there is no name to look up — the credential itself chose the Chain, so the honest
+    // line names the credential and the repair (TEN-3240).
+    if (source === 'env-key') {
+        return '→ unnamed workspace (PRODUCTBRAIN_API_KEY — the exported key picks the Chain, not a profile)';
+    }
+    if (source === 'cwd-key') {
+        return '→ unnamed workspace (a dotenv file in this directory picks the Chain, not a profile)';
+    }
+    if (source === 'local-key') {
+        return '→ unnamed workspace (config.local.json binds a credential directly, not a profile)';
+    }
     const name = profile?.trim() || 'unknown';
+    // Deliberate and disposable: the operator ran `npm run pb:preview`, and index.ts already prints
+    // a loud PREVIEW banner on every command — so this names the workspace without a second alarm.
+    if (source === 'preview')
+        return `→ ${name} (throwaway preview — \`npm run pb:real\` to go back)`;
     if (source === 'global' || source === 'default') {
         return `→ ${name} (global default — run from your project dir to use its workspace)`;
     }
@@ -85,7 +108,11 @@ export async function emitWriteTargetNotice(json) {
     }
     if (source === 'none' || source === 'missing-pin')
         return;
-    const isUnpinnedFallback = source === 'global' || source === 'default';
+    // `env-key` joins the LOUD set (TEN-3240): the write lands in a workspace this process cannot
+    // name from config, which is a stronger version of the drift the unpinned fallback warns about
+    // — so it must survive `--json`, the mode agents write in.
+    const isUnpinnedFallback = source === 'global' || source === 'default' || source === 'env-key'
+        || source === 'cwd-key' || source === 'local-key';
     if (json && !isUnpinnedFallback)
         return;
     const notice = formatWriteTargetNotice({ profile, source });

package/dist/lib/workspaceNotice.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceNotice.js","sourceRoot":"","sources":["../../src/lib/workspaceNotice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,sBAAsB,EAA8B,MAAM,sBAAsB,CAAC;AAU1F;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,EAA0B;IACjF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC1C,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,KAAK,IAAI,oEAAoE,CAAC;IACvF,CAAC;IACD,sDAAsD;IACtD,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAa;IACvD,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,MAAM,GAA0B,MAAM,CAAC;IAC3C,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,oEAAoE;IAC9E,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO;IAE1D,MAAM,kBAAkB,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC;IACvE,IAAI,IAAI,IAAI,CAAC,kBAAkB;QAAE,OAAO;IAExC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"workspaceNotice.js","sourceRoot":"","sources":["../../src/lib/workspaceNotice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,sBAAsB,EAA8B,MAAM,sBAAsB,CAAC;AAU1F;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,EAA0B;IACjF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC/D,6FAA6F;IAC7F,0FAA0F;IAC1F,uDAAuD;IACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,8FAA8F,CAAC;IACxG,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,sFAAsF,CAAC;IAChG,CAAC;IACD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,oFAAoF,CAAC;IAC9F,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC1C,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,IAAI,uDAAuD,CAAC;IAClG,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,KAAK,IAAI,oEAAoE,CAAC;IACvF,CAAC;IACD,sDAAsD;IACtD,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAa;IACvD,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,MAAM,GAA0B,MAAM,CAAC;IAC3C,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,oEAAoE;IAC9E,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO;IAE1D,8FAA8F;IAC9F,+FAA+F;IAC/F,2DAA2D;IAC3D,MAAM,kBAAkB,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;WACzF,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,WAAW,CAAC;IACpD,IAAI,IAAI,IAAI,CAAC,kBAAkB;QAAE,OAAO;IAExC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@productbrain/cli",
-  "version": "0.1.0-beta.5083",
+  "version": "0.1.0-beta.5105",
   "description": "Product Brain — Chain knowledge and write-back CLI",
   "type": "module",
   "bin": {