@productbrain/cli 0.1.0-beta.59 → 0.1.0-beta.5912

package/dist/commands/outcome.test.js

@@ -0,0 +1,308 @@
+/**
+ * WP-722 S2 — `pb outcome record | list`.
+ *
+ * The surface is thin on purpose: every rule that matters (credential-derived tier, session
+ * ownership, role validation) lives behind the gateway and was proven in S1. What THIS slice can
+ * get wrong is the surface — sending a string where the door wants a number, silently dropping a
+ * flag, or inventing a client-side default that contradicts the server's. So these tests assert
+ * the exact args crossing the wire, and the refusals that never reach it.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const { getConfigOrGuide, kernelCall, kernelCallWithSession, readSession, runCliCommand } = vi.hoisted(() => ({
+    getConfigOrGuide: vi.fn(),
+    kernelCall: vi.fn(),
+    kernelCallWithSession: vi.fn(),
+    readSession: vi.fn(),
+    runCliCommand: vi.fn(async ({ fn }) => fn()),
+}));
+vi.mock('../lib/config.js', () => ({ getConfigOrGuide }));
+vi.mock('../lib/client.js', () => ({ kernelCall, kernelCallWithSession }));
+vi.mock('../lib/runner.js', () => ({ runCliCommand }));
+vi.mock('../lib/session.js', () => ({ readSession }));
+import { runOutcomeRecord, runOutcomeList, formatReadingsList, formatOutcomeShow } from './outcome.js';
+describe('pb outcome record', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'pb_sk_test', siteUrl: 'https://example.test' });
+        kernelCallWithSession.mockResolvedValue({ readingId: 'r1', independenceTier: 'provenance_unknown', actorKind: 'agent', recordedAt: 1, asOf: 1 });
+        readSession.mockReturnValue({ sessionId: 's1' });
+    });
+    it('sends value as a NUMBER, not the raw argv string', async () => {
+        // The door declares `value: v.number()`. Forwarding argv verbatim would be refused by the
+        // validator at runtime, which is a wire-shape bug no server-side test can catch.
+        await runOutcomeRecord('KR-1', '62', {});
+        const [route, args] = kernelCallWithSession.mock.calls[0];
+        expect(route).toBe('outcomes.recordReading');
+        expect(args.value).toBe(62);
+        expect(args.value).not.toBe('62');
+        expect(args.entryId).toBe('KR-1');
+    });
+    it('refuses a non-numeric value BEFORE any network call', async () => {
+        await expect(runOutcomeRecord('KR-1', 'sixty-two', {})).rejects.toThrow(/number/i);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('accepts a negative and a decimal value (a reading is not always a positive integer)', async () => {
+        await runOutcomeRecord('KR-1', '-3.5', {});
+        expect(kernelCallWithSession.mock.calls[0][1].value).toBe(-3.5);
+    });
+    it('sends --as-of as an epoch-ms NUMBER, and refuses an unparseable date', async () => {
+        await runOutcomeRecord('KR-1', '1', { asOf: '2026-03-01' });
+        const args = kernelCallWithSession.mock.calls[0][1];
+        expect(typeof args.asOf).toBe('number');
+        expect(args.asOf).toBe(Date.parse('2026-03-01'));
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'k', siteUrl: 's' });
+        await expect(runOutcomeRecord('KR-1', '1', { asOf: 'not-a-date' })).rejects.toThrow(/as-of/i);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('omits every optional it was not given — never sends undefined keys', async () => {
+        // A key present-but-undefined is not the same as absent to a Convex validator, and the
+        // door's own defaults (kind, asOf, recordedByRoleId) must win when the caller is silent.
+        await runOutcomeRecord('KR-1', '5', {});
+        const args = kernelCallWithSession.mock.calls[0][1];
+        expect(Object.keys(args).sort()).toEqual(['entryId', 'value']);
+    });
+    it('forwards note, source, value-text and by-role verbatim', async () => {
+        await runOutcomeRecord('KR-1', '5', { note: 'n', source: 'dashboard', valueText: '~5', byRole: 'ROL-2' });
+        expect(kernelCallWithSession.mock.calls[0][1]).toMatchObject({
+            note: 'n', source: 'dashboard', valueText: '~5', recordedByRoleId: 'ROL-2',
+        });
+    });
+    it('refuses --corrects without --kind correction, and --kind correction without --corrects', async () => {
+        // Both directions, because the door refuses both and a CLI that only guards one sends a
+        // request it already knows will fail.
+        await expect(runOutcomeRecord('KR-1', '5', { corrects: 'x' })).rejects.toThrow(/correction/i);
+        await expect(runOutcomeRecord('KR-1', '5', { kind: 'correction' })).rejects.toThrow(/corrects/i);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('sends a well-formed correction', async () => {
+        await runOutcomeRecord('KR-1', '5', { kind: 'correction', corrects: 'abc123' });
+        expect(kernelCallWithSession.mock.calls[0][1]).toMatchObject({ kind: 'correction', correctsReadingId: 'abc123' });
+    });
+    it('refuses an unknown --kind, naming the legal set', async () => {
+        await expect(runOutcomeRecord('KR-1', '5', { kind: 'guess' })).rejects.toThrow(/measurement/);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('records through the SESSION-attributed caller, not the plain one', async () => {
+        // A reading is a workspace write whose provenance is the whole point; `kernelCall` would
+        // drop the session the tier derivation compares against.
+        await runOutcomeRecord('KR-1', '5', {});
+        expect(kernelCallWithSession).toHaveBeenCalledTimes(1);
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+});
+describe('pb outcome list', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'pb_sk_test', siteUrl: 'https://example.test' });
+        kernelCall.mockResolvedValue({ entryDocId: 'e1', pageExhausted: true, readings: [] });
+        readSession.mockReturnValue(null);
+    });
+    it('reads through the plain caller and sends the entry id', async () => {
+        await runOutcomeList('KR-1', {});
+        const [route, args] = kernelCall.mock.calls[0];
+        expect(route).toBe('outcomes.listReadings');
+        expect(args.entryId).toBe('KR-1');
+        // A read needs no session — requiring one would make `pb outcome list` fail for a caller
+        // who has a key but has not started a session.
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('sends --limit as a NUMBER and refuses a non-numeric one', async () => {
+        await runOutcomeList('KR-1', { limit: '25' });
+        expect(kernelCall.mock.calls[0][1].limit).toBe(25);
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'k', siteUrl: 's' });
+        await expect(runOutcomeList('KR-1', { limit: 'many' })).rejects.toThrow(/limit/i);
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+});
+describe('formatReadingsList — the rendering §8.2 specifies', () => {
+    const row = (over = {}) => ({
+        readingId: 'rd_1', value: 62, asOf: Date.parse('2026-03-01'), recordedAt: Date.parse('2026-03-01'),
+        kind: 'measurement', independenceTier: 'role_click', actorKind: 'person', ...over,
+    });
+    it('shows a superseded row AND names what replaced it', () => {
+        // The ledger is append-only and the correction chain IS the audit trail, so a superseded
+        // row is never hidden — it is marked, so a reader does not mistake it for the current value.
+        const out = formatReadingsList('KR-S1', {
+            entryDocId: 'e', pageExhausted: true,
+            readings: [row({ readingId: 'rd_2', value: 70 }), row({ supersededByReadingId: 'rd_2' })],
+        });
+        expect(out).toContain('superseded by rd_2');
+        expect(out).toContain('rd_1');
+        expect(out).toContain('2 reading(s)');
+    });
+    it('prints the readingId on every row — the id --corrects needs must be reachable from list', () => {
+        // This is the defect the S2 live walk found: without a printed id there is no way to name
+        // the reading a correction replaces, and --corrects is unusable.
+        const out = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row()] });
+        expect(out).toContain('rd_1');
+    });
+    it('says so when the page is NOT exhausted, rather than reading as the whole history', () => {
+        const bounded = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: false, readings: [row()] });
+        expect(bounded).toContain('older readings not loaded');
+        const whole = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row()] });
+        expect(whole).not.toContain('older readings not loaded');
+    });
+    it('renders the honest empty case, not an error', () => {
+        expect(formatReadingsList('KR-S2', { entryDocId: 'e', pageExhausted: true, readings: [] }))
+            .toBe('No readings recorded on KR-S2 yet.');
+    });
+    // PR #872 review round 3 (Codex P2): a legacy row written through the existing API route
+    // (validated only with v.number()) can carry a finite-but-Date-invalid asOf (e.g. 1e100).
+    // `new Date(x).toISOString()` throws RangeError for it — pre-fix, that propagated out of the
+    // `.map()` and killed `pb outcome list` entirely over one malformed row. Mirrors the MCP
+    // tool's own safeDateSlice fix (same PR).
+    it('renders a malformed out-of-range asOf as a fallback instead of throwing', () => {
+        const out = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row({ asOf: 1e100 })] });
+        expect(out).toContain('invalid-date');
+    });
+});
+describe('formatReadingsList sanitises stored, agent-written content (PR #840 security review)', () => {
+    // The threat model is specific: an AGENT writes `note`/`valueText` through
+    // `outcomes.recordReading`, a HUMAN reads them in a terminal, and this rendering IS the audit
+    // view. Injected newlines do not just look untidy — they forge extra rows in the one surface
+    // someone would use to check the rows.
+    const row = (over = {}) => ({
+        readingId: 'rd_1', value: 62, asOf: Date.parse('2026-03-01'), recordedAt: Date.parse('2026-03-01'),
+        kind: 'measurement', independenceTier: 'role_click', actorKind: 'person', ...over,
+    });
+    const render = (over) => formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row(over)] });
+    it('a note with embedded newlines cannot forge extra reading lines', () => {
+        const out = render({ note: 'ok\n  2026-03-02      999  [measurement·role_click]  rd_FORGED' });
+        // One reading in, one rendered line out (plus the header) — the forged row is folded in.
+        expect(out.split('\n')).toHaveLength(2);
+        expect(out).not.toMatch(/\n\s+2026-03-02/);
+        expect(out).toContain('rd_FORGED'); // the TEXT survives; only its line-breaking power is removed
+    });
+    it('a carriage return cannot overwrite the rendered line', () => {
+        // \r alone redraws over what was printed — a note ending in \r plus spaces can blank the
+        // real value on a real terminal without adding a line at all.
+        const out = render({ note: 'benign\rSAFE — nothing to see' });
+        expect(out).not.toContain('\r');
+    });
+    it('CSI/OSC escape sequences are stripped, not passed to the terminal', () => {
+        const esc = String.fromCharCode(27);
+        const out = render({ note: `${esc}[31m${esc}[2Jred${esc}[0m`, valueText: `${esc}]0;pwned${esc}\\` });
+        expect(out).not.toContain(esc);
+    });
+    it('valueText is sanitised too — it is stored and agent-written, exactly like note', () => {
+        const out = render({ valueText: 'a\nb' });
+        expect(out.split('\n')).toHaveLength(2);
+    });
+    it('ordinary content still renders unchanged', () => {
+        // The sanitiser must not damage the normal case, or it will be removed by someone later.
+        expect(render({ note: 'from the weekly dashboard', valueText: '~62%' }))
+            .toContain('("~62%")');
+        expect(render({ note: 'from the weekly dashboard' })).toContain('from the weekly dashboard');
+    });
+});
+describe('formatOutcomeShow — the two honesty rules', () => {
+    const base = {
+        entryId: 'KR-S1', name: 'Weekly signups', readyToCloseInstruction: null,
+        outcome: {
+            currentResolution: 'no-rows', hasNoReadings: true, direction: 'up-is-good',
+            state: 'overdue', completion: 'open', completionProvenance: 'none',
+            readyToClose: null, weakestTierInCycle: null, ownerRole: null, reporterRole: null,
+            readingCount: 0, unit: null, metric: null,
+        },
+    };
+    const show = (over = {}) => formatOutcomeShow({ ...base, outcome: { ...base.outcome, ...over } });
+    it('a never-measured key result shows a BLANK, never 0%', () => {
+        // `0%` reads as a measurement. The blank is the honest answer and the distinction is the
+        // whole reason progressPct is undefined rather than zero.
+        const out = show();
+        expect(out).toContain('no readings yet');
+        expect(out).not.toContain('0%');
+        expect(out).toContain('never read');
+    });
+    it('a genuine zero reading DOES render as 0% — the other half of that distinction', () => {
+        expect(show({ current: { value: 0, asOf: Date.now() }, currentResolution: 'found', hasNoReadings: false, progressPct: 0, readingCount: 1 }))
+            .toContain('0%');
+    });
+    // PR #872 review round 3 (Codex P2): mirrors formatReadingsList's own safeDateSlice fix — a
+    // malformed stored nextDueAt must render a fallback, never throw RangeError.
+    it('renders a malformed out-of-range nextDueAt as a fallback instead of throwing', () => {
+        expect(show({ nextDueAt: 1e100 })).toContain('invalid-date');
+    });
+    it('the recorded completion is never called confirmed or verified', () => {
+        // Nothing in this run verifies a close. A surface implying otherwise is the failure the
+        // provenance field exists to prevent.
+        const out = show({ completion: 'achieved', completionProvenance: 'legacy-data-status' });
+        expect(out).toContain('recorded as achieved');
+        expect(out).toContain('legacy-data-status');
+        expect(out.toLowerCase()).not.toContain('confirmed');
+        expect(out.toLowerCase()).not.toContain('verified');
+    });
+    it('the attestation line reports without claiming to enforce', () => {
+        const out = show({ weakestTierInCycle: 'agent_same_session' });
+        expect(out).toContain('reported, not enforced');
+        for (const word of ['blocked', 'refused', 'cannot'])
+            expect(out.toLowerCase()).not.toContain(word);
+    });
+    it('a deleted role renders as gone, not as a blank and not as an id', () => {
+        const out = show({ ownerRole: { id: 'q97abc', name: null }, reporterRole: { id: 'q97def', name: 'Data Steward' } });
+        expect(out).toContain('a role that no longer exists');
+        expect(out).toContain('Data Steward');
+    });
+    it('carries the close instruction verbatim when there is a proposal', () => {
+        const out = formatOutcomeShow({
+            ...base, readyToCloseInstruction: 'The readings say this is achieved. Surface this to the founder; do not write the status yourself.',
+            outcome: { ...base.outcome, readyToClose: 'achieved' },
+        });
+        expect(out).toContain('do not write the status yourself');
+    });
+    it('page-exhausted is called out rather than passing as never-read', () => {
+        expect(show({ currentResolution: 'page-exhausted', hasNoReadings: false }))
+            .toContain('this is not "never read"');
+    });
+});
+describe('formatOutcomeShow sanitises EVERY stored string sink (PR #840 review round 2)', () => {
+    // Round 1 I sanitised the fields I interpolated directly and missed `role.name`, which sits
+    // behind a helper. So this guard is STRUCTURAL rather than per-field: it drives control
+    // characters through every string-typed input at once and asserts on the SHAPE of the output,
+    // which means the next stored field someone adds is covered without anyone remembering to
+    // extend this test.
+    const ESC = String.fromCharCode(27);
+    const NASTY = `x${ESC}[31m\n  FORGED LINE\rover`;
+    it('no control characters and no injected lines, whatever the stored content says', () => {
+        const out = formatOutcomeShow({
+            entryId: NASTY, name: NASTY,
+            readyToCloseInstruction: null,
+            outcome: {
+                current: { value: 1, asOf: Date.now() }, currentResolution: 'found', hasNoReadings: false,
+                direction: 'up-is-good', progressPct: 10, state: 'on-time',
+                completion: 'open', completionProvenance: 'none', readyToClose: null,
+                weakestTierInCycle: 'role_click',
+                ownerRole: { id: 'q1', name: NASTY },
+                reporterRole: { id: 'q2', name: NASTY },
+                readingCount: 1, unit: NASTY, metric: NASTY,
+            },
+        });
+        expect(out).not.toContain(ESC);
+        expect(out).not.toContain('\r');
+        // The renderer emits a fixed number of lines; injected newlines would add more.
+        const lineCount = out.split('\n').length;
+        expect(lineCount).toBe(11);
+        // And no line may begin with the injected text — that is what "looks like another field" means.
+        expect(out.split('\n').every((l) => !l.startsWith('FORGED'))).toBe(true);
+    });
+    it('a role name specifically cannot inject a line — the round-2 miss', () => {
+        const out = formatOutcomeShow({
+            entryId: 'KR-S1', name: 'ok', readyToCloseInstruction: null,
+            outcome: {
+                currentResolution: 'no-rows', hasNoReadings: true, direction: 'undetermined',
+                state: 'overdue', completion: 'open', completionProvenance: 'none', readyToClose: null,
+                weakestTierInCycle: null,
+                ownerRole: { id: 'q1', name: 'Data Steward\n  reporter    Someone Else' },
+                reporterRole: null, readingCount: 0, unit: null, metric: null,
+            },
+        });
+        // Exactly one line that IS the reporter field, not two. The forged text survives as text on
+        // the owner line (which is correct — nothing is censored) but has lost its line-breaking
+        // power, so it can no longer masquerade as a field of its own.
+        expect(out.split('\n').filter((l) => l.trim().startsWith('reporter')).length).toBe(1);
+        expect(out).toContain('Someone Else'); // the content is preserved, only its framing is removed
+    });
+});
+//# sourceMappingURL=outcome.test.js.map

package/dist/commands/outcome.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.test.js","sourceRoot":"","sources":["../../src/commands/outcome.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,qBAAqB,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7G,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;IACzB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;IACnB,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC9B,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAkC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;CAC5E,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;AAC1D,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;AAC3E,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;AACvD,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEvG,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAClC,UAAU,CAAC,GAAG,EAAE;QACf,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC9F,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACjJ,WAAW,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QACjE,0FAA0F;QAC1F,iFAAiF;QACjF,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAEjD,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9F,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QACnF,uFAAuF;QACvF,yFAAyF;QACzF,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1G,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC5D,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO;SAC1E,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACvG,wFAAwF;QACxF,sCAAsC;QACtC,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjG,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9F,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QACjF,yFAAyF;QACzF,yDAAyD;QACzD,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,qBAAqB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAChC,UAAU,CAAC,GAAG,EAAE;QACf,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC9F,UAAU,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACtF,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,yFAAyF;QACzF,+CAA+C;QAC/C,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,cAAc,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEnD,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClF,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAClE,MAAM,GAAG,GAAG,CAAC,OAAgC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAClG,IAAI,EAAE,aAAsB,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI;KAC1F,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,yFAAyF;QACzF,6FAA6F;QAC7F,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE;YACvC,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI;YACpC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC;SAChF,CAAC,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QAClG,0FAA0F;QAC1F,iEAAiE;QACjE,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAW,CAAC,CAAC;QAC9G,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC3F,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAW,CAAC,CAAC;QACnH,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAW,CAAC,CAAC;QAChH,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAW,CAAC,CAAC;aAClG,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,yFAAyF;IACzF,0FAA0F;IAC1F,6FAA6F;IAC7F,yFAAyF;IACzF,0CAA0C;IAC1C,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QAClF,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAW,CAAC,CAAC;QAC7H,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sFAAsF,EAAE,GAAG,EAAE;IACrG,2EAA2E;IAC3E,8FAA8F;IAC9F,6FAA6F;IAC7F,uCAAuC;IACvC,MAAM,GAAG,GAAG,CAAC,OAAgC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAClG,IAAI,EAAE,aAAsB,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI;KAC1F,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,IAA6B,EAAE,EAAE,CAChD,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAW,CAAC,CAAC;IAEvG,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,gEAAgE,EAAE,CAAC,CAAC;QAC/F,yFAAyF;QACzF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,6DAA6D;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC/D,yFAAyF;QACzF,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,GAAG,SAAS,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC,CAAC;QACrG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACzF,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QACnD,yFAAyF;QACzF,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;aACtE,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IAC1D,MAAM,IAAI,GAAG;QACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,IAAI;QACvE,OAAO,EAAE;YACR,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY;YAC1E,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM;YAClE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;YACjF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;SACzC;KACD,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,OAAgC,EAAE,EAAE,EAAE,CACnD,iBAAiB,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAW,CAAC,CAAC;IAEhF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC9D,yFAAyF;QACzF,0DAA0D;QAC1D,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACxF,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;aAC1I,SAAS,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,6EAA6E;IAC7E,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACvF,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACxE,wFAAwF;QACxF,sCAAsC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QACpH,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,iBAAiB,CAAC;YAC7B,GAAG,IAAI,EAAE,uBAAuB,EAAE,mGAAmG;YACrI,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE;SAC7C,CAAC,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;aACzE,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+EAA+E,EAAE,GAAG,EAAE;IAC9F,4FAA4F;IAC5F,wFAAwF;IACxF,8FAA8F;IAC9F,0FAA0F;IAC1F,oBAAoB;IACpB,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,2BAA2B,CAAC;IAEjD,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACxF,MAAM,GAAG,GAAG,iBAAiB,CAAC;YAC7B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK;YAC3B,uBAAuB,EAAE,IAAI;YAC7B,OAAO,EAAE;gBACR,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK;gBACzF,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS;gBAC1D,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI;gBACpE,kBAAkB,EAAE,YAAY;gBAChC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;gBACpC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;gBACvC,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;aAC3C;SACQ,CAAC,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,gFAAgF;QAChF,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,gGAAgG;QAChG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG,iBAAiB,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI;YAC3D,OAAO,EAAE;gBACR,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc;gBAC5E,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI;gBACtF,kBAAkB,EAAE,IAAI;gBACxB,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,0CAA0C,EAAE;gBACzE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;aAC7D;SACQ,CAAC,CAAC;QACZ,4FAA4F;QAC5F,yFAAyF;QACzF,+DAA+D;QAC/D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,wDAAwD;IAChG,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/commands/profile.d.ts

@@ -5,6 +5,19 @@
  * Uses runCliCommand pattern from runner.ts for JSON/pretty output.
  * Uses CLIError from errors.ts for structured error reporting.
  */
+type ProfileListResult = {
+    profiles: string[];
+    active: string | null;
+    globalActive: string | null;
+    localActive: string | null;
+    activeSource: 'local' | 'global' | 'none' | 'missing-pin' | 'env-key' | 'preview' | 'cwd-key' | 'local-key';
+};
+export declare function resolveProfileListState(): ProfileListResult;
+/**
+ * Pure pretty-printer for `pb profile list`. Exported (like formatWhoami) so the copy can be
+ * asserted directly — an inline lambda left the env-key case untestable and therefore wrong.
+ */
+export declare function formatProfileList(data: ProfileListResult): string;
 /** pb profile list — show all profiles, mark active one. */
 export declare function runProfileList(): Promise<void>;
 /** pb profile create <name> --api-key <key> [--url <url>] */
@@ -13,12 +26,14 @@ export declare function runProfileCreate(opts: {
     apiKey: string;
     url?: string;
 }): Promise<void>;
-/** pb profile use <name> — switch active profile, close any active session. */
 export declare function runProfileUse(opts: {
     name: string;
+    local?: boolean;
+    global?: boolean;
 }): Promise<void>;
 /** pb profile delete <name> */
 export declare function runProfileDelete(opts: {
     name: string;
 }): Promise<void>;
+export {};
 //# sourceMappingURL=profile.d.ts.map

package/dist/commands/profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/commands/profile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,4DAA4D;AAC5D,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAkBpD;AAED,6DAA6D;AAC7D,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB;AAED,+EAA+E;AAC/E,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BzE;AAED,+BAA+B;AAC/B,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E"}
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/commands/profile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;CAC7G,CAAC;AAEF,wBAAgB,uBAAuB,IAAI,iBAAiB,CAkB3D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CA8BjE;AAED,4DAA4D;AAC5D,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAKpD;AAED,6DAA6D;AAC7D,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB;AAeD,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyH5G;AAUD,+BAA+B;AAC/B,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E"}

package/dist/commands/profile.js

@@ -7,26 +7,69 @@
  */
 import { runCliCommand } from '../lib/runner.js';
 import { listProfiles, getActiveProfile, createProfile, useProfile, deleteProfile, } from '../lib/profiles.js';
-import { readSession, clearSession } from '../lib/session.js';
-import { resetConfigCache } from '../lib/config.js';
+import { readSession, discardAllSessions, hasAnyActiveSession } from '../lib/session.js';
+import { resetConfigCache, findProjectRoot, readLocalProjectConfig, setLocalProfilePin } from '../lib/config.js';
+import { resolveReportedProfile, isEnvKeyBinding } from '../lib/reportedProfile.js';
+import { probeWorkspace } from '../lib/workspace-probe.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+export function resolveProfileListState() {
+    const profiles = listProfiles();
+    const globalActive = getActiveProfile();
+    const localActive = readLocalProjectConfig()?.profile ?? null;
+    const reported = resolveReportedProfile();
+    // Four sources all mean NO profile is the active one: the CLI refuses (`missing-pin`), or an
+    // exported key / a dotenv file here / a preview binding outranks every profile file. In each
+    // case `globalActive` is still listed below, just never marked `(active)`.
+    const shadowed = ['missing-pin', 'env-key', 'preview', 'cwd-key', 'local-key'];
+    const noActiveProfile = shadowed.includes(reported.source);
+    const active = noActiveProfile ? null : reported.profile;
+    const activeSource = noActiveProfile ? reported.source
+        : reported.source === 'local' ? 'local'
+            : reported.profile ? 'global'
+                : 'none';
+    return { profiles, active, globalActive, localActive, activeSource };
+}
+/**
+ * Pure pretty-printer for `pb profile list`. Exported (like formatWhoami) so the copy can be
+ * asserted directly — an inline lambda left the env-key case untestable and therefore wrong.
+ */
+export function formatProfileList(data) {
+    // TEN-3240 (Codex P2): an exported key SHADOWS every profile here. Without this note the list
+    // prints with no active marker and no reason why — and the empty-list branch would recommend
+    // creating a profile the export would immediately shadow too.
+    // "…for these profiles to take effect" would be a promise this function cannot keep: in a
+    // preview-bound worktree the direct apiKey/siteUrl binding wins ahead of every profile
+    // (resolveConfig step 2a), so unsetting the key still leaves them unused (Codex P2 round 2).
+    const envKeyNote = data.activeSource === 'env-key'
+        ? 'An exported PRODUCTBRAIN_API_KEY is the active binding — no profile below is in use.\nUnset it (`unset PRODUCTBRAIN_API_KEY`) and re-run to see which binding takes over.'
+        : data.activeSource === 'preview'
+            ? 'This worktree is bound to a throwaway preview — no profile below is in use.\nRun `npm run pb:real` to go back to the real Chain.'
+            : data.activeSource === 'cwd-key'
+                ? 'A dotenv file in this directory is the active binding — no profile below is in use.\nRemove it, or run pb from your project directory, to use one.'
+                : data.activeSource === 'local-key'
+                    ? '.productbrain/config.local.json binds a credential directly — no profile below is in use.\nRun `npm run pb:real` to strip it — re-pinning alone leaves that binding winning.'
+                    : null;
+    if (data.profiles.length === 0) {
+        return envKeyNote ?? 'No profiles configured. Run: pb profile create <name> --api-key <key>';
+    }
+    const lines = data.profiles.map((name) => {
+        const marker = name === data.active
+            ? data.activeSource === 'local' ? ' (active, local)' : ' (active)'
+            : '';
+        return `  ${name}${marker}`;
+    });
+    if (envKeyNote)
+        lines.push('', envKeyNote);
+    if (data.localActive && data.globalActive && data.localActive !== data.globalActive) {
+        lines.push('', `Repo local profile: ${data.localActive}`, `Global profile:     ${data.globalActive}`);
+    }
+    return `Profiles:\n${lines.join('\n')}`;
+}
 /** pb profile list — show all profiles, mark active one. */
 export async function runProfileList() {
     await runCliCommand({
-        fn: async () => {
-            const profiles = listProfiles();
-            const active = getActiveProfile();
-            return { profiles, active };
-        },
-        formatPretty: (data) => {
-            if (data.profiles.length === 0) {
-                return 'No profiles configured. Run: pb profile create <name> --api-key <key>';
-            }
-            const lines = data.profiles.map((name) => {
-                const marker = name === data.active ? ' (active)' : '';
-                return `  ${name}${marker}`;
-            });
-            return `Profiles:\n${lines.join('\n')}`;
-        },
+        fn: async () => resolveProfileListState(),
+        formatPretty: formatProfileList,
     });
 }
 /** pb profile create <name> --api-key <key> [--url <url>] */
@@ -39,36 +82,129 @@ export async function runProfileCreate(opts) {
         formatPretty: (data) => `Profile "${data.name}" created.`,
     });
 }
-/** pb profile use <name> — switch active profile, close any active session. */
 export async function runProfileUse(opts) {
+    if (opts.local && opts.global) {
+        throw new CLIError('Cannot use both --local and --global.', {
+            code: ErrorCode.VALIDATION_FAILED,
+            category: 'validation',
+            guidance: 'Pick one: --local (repo pin only), --global (global only), or neither (reconcile both).',
+        });
+    }
     await runCliCommand({
         fn: async () => {
-            // Close active session before switching (TEN-1277: session orphaning)
-            const session = readSession();
-            if (session) {
-                clearSession();
+            const projectRoot = findProjectRoot(process.cwd());
+            const localPin = readLocalProjectConfig()?.profile ?? null;
+            // PB_PROFILE always wins resolution (by design). If it's set, ANY profile write
+            // here is shadowed — surface that instead of failing silently (the TEN-2163 trap).
+            const PB_PROFILE = process.env.PB_PROFILE?.trim() || null;
+            // An exported key outranks every profile file, so a switch made under one is SHADOWED in
+            // the parent shell exactly like PB_PROFILE above — report it rather than printing a
+            // "Now using …" the operator will never observe (Codex P2 r7).
+            const shadowingKey = isEnvKeyBinding();
+            const resetEnv = () => {
+                resetConfigCache();
+                delete process.env.PRODUCTBRAIN_API_KEY;
+                delete process.env.CONVEX_SITE_URL;
+                // NOTE: deliberately NOT re-snapshotting the reported source here. The delete above only
+                // affects THIS child process; the parent shell still exports the key, so re-snapshotting
+                // would record an absence that is true for nobody and label the next command's binding
+                // wrong. `shadowingKey` above keeps the startup truth.
+            };
+            // Discard ANY session file (active OR stale closed marker) — a closed marker would
+            // let the 2h auto-resume re-pin the old workspace. Report only an ACTIVE session
+            // in the print line. Review fix (Codex): a profile switch changes the effective workspace,
+            // so clear ALL conversation markers, not just the current conversation's — otherwise a
+            // sibling conversation's active marker survives and could be reused against the new workspace.
+            const discardSessionState = () => {
+                // Report accurately whether an active session was cleared — including a SIBLING conversation's
+                // (Codex re-review): a profile switch from a shell whose current conversation has no marker
+                // still discards all markers, so `readSession()` (current only) would under-report and
+                // silently strand a sibling active session on the old workspace.
+                const hadActive = readSession() !== null || hasAnyActiveSession();
+                discardAllSessions();
+                return hadActive;
+            };
+            // --- --local: repo pin only ---
+            if (opts.local) {
+                if (!projectRoot) {
+                    throw new CLIError('No .productbrain/ directory found in this directory tree. Run `pb connect` first or use `pb use <name> --global` to switch globally.', { code: ErrorCode.CONFIG_INVALID, category: 'config',
+                        guidance: 'Run `pb connect <token>` to set up a project workspace, or use --global.' });
+                }
+                setLocalProfilePin(projectRoot, opts.name);
+                const sessionCleared = discardSessionState();
+                resetEnv();
+                return { name: opts.name, scope: 'local', reconciledLocalPin: false,
+                    sessionCleared, workspace: await safeProbe(), pinnedElsewhere: null, 'PB_PROFILE': PB_PROFILE, shadowedByApiKey: shadowingKey };
+            }
+            // --- --global: global only (does not change a locally-pinned repo) ---
+            if (opts.global) {
+                useProfile(opts.name);
+                const pinnedElsewhere = localPin && localPin !== opts.name ? localPin : null;
+                // The repo's effective workspace only changes when it is NOT pinned elsewhere.
+                const sessionCleared = pinnedElsewhere ? false : discardSessionState();
+                resetEnv();
+                const workspace = pinnedElsewhere ? null : await safeProbe();
+                return { name: opts.name, scope: 'global', reconciledLocalPin: false,
+                    sessionCleared, workspace, pinnedElsewhere, 'PB_PROFILE': PB_PROFILE, shadowedByApiKey: shadowingKey };
             }
+            // --- default: flip global AND reconcile the repo pin if one exists ---
             useProfile(opts.name);
-            // Reset config cache so next getConfig() reads the new profile
-            resetConfigCache();
-            // Clear env vars so they get re-read from the new profile
-            delete process.env.PRODUCTBRAIN_API_KEY;
-            delete process.env.CONVEX_SITE_URL;
-            return {
-                name: opts.name,
-                active: true,
-                sessionClosed: session !== null,
-            };
+            let reconciledLocalPin = false;
+            if (projectRoot && localPin) {
+                setLocalProfilePin(projectRoot, opts.name);
+                reconciledLocalPin = true;
+            }
+            const sessionCleared = discardSessionState();
+            resetEnv();
+            return { name: opts.name, scope: 'reconcile', reconciledLocalPin,
+                sessionCleared, workspace: await safeProbe(), pinnedElsewhere: null, 'PB_PROFILE': PB_PROFILE, shadowedByApiKey: shadowingKey };
         },
-        formatPretty: (data) => {
-            let msg = `Switched to profile "${data.name}".`;
-            if (data.sessionClosed) {
-                msg += ' (previous session closed)';
+        formatPretty: (d) => {
+            const lines = [];
+            if (d.scope === 'global') {
+                const arrow = d.workspace ? ` → ${d.workspace}` : '';
+                lines.push(`Switched global profile to "${d.name}"${arrow}.`);
+                if (d.pinnedElsewhere) {
+                    lines.push(`Note: this repo is pinned to "${d.pinnedElsewhere}" via config.local.json — the global switch won't change it here.`);
+                    lines.push(`Run \`pb use ${d.name}\` (no flag) to switch this repo too.`);
+                }
+            }
+            else {
+                const arrow = d.workspace ? ` → ${d.workspace}` : '';
+                const where = d.scope === 'local' ? ' (repo-local)' : '';
+                lines.push(`Now using "${d.name}"${where}${arrow}`);
+                if (d.reconciledLocalPin)
+                    lines.push('(updated repo-local pin in .productbrain/config.local.json)');
             }
-            return msg;
+            if (d.sessionCleared)
+                lines.push('(previous session closed)');
+            if (d['PB_PROFILE']) {
+                lines.push(`⚠ PB_PROFILE is set to "${d['PB_PROFILE']}" in your environment and overrides profile resolution.`);
+                // Only promise that unsetting PB_PROFILE is sufficient when it actually IS (Codex P2 r14):
+                // an exported API key outranks it too, so with both set, unsetting this one alone changes
+                // nothing — and the key's own warning below already names the step that does.
+                if (!d.shadowedByApiKey)
+                    lines.push(`  This switch won't take effect until you unset it: \`unset PB_PROFILE\`.`);
+            }
+            // Same trap one rung higher: an exported key outranks every profile file, so without this
+            // the command reports a switch the operator's shell will keep shadowing (Codex P2 r7).
+            if (d.shadowedByApiKey) {
+                lines.push('⚠ PRODUCTBRAIN_API_KEY is exported in your environment and outranks every profile.');
+                lines.push(d['PB_PROFILE']
+                    ? "  This switch won't take effect until you unset both: `unset PRODUCTBRAIN_API_KEY PB_PROFILE`."
+                    : "  This switch won't take effect until you unset it: `unset PRODUCTBRAIN_API_KEY`.");
+            }
+            return lines.join('\n');
         },
     });
 }
+/**
+ * Best-effort workspace name after a profile switch; null on any failure.
+ * probeWorkspace() already swallows network/auth errors and returns null, so this is offline-safe.
+ */
+async function safeProbe() {
+    return (await probeWorkspace())?.name ?? null;
+}
 /** pb profile delete <name> */
 export async function runProfileDelete(opts) {
     await runCliCommand({