@productbrain/cli 0.1.0-beta.6 → 0.1.0-beta.6046

package/dist/lib/captureGrounding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"captureGrounding.js","sourceRoot":"","sources":["../../src/lib/captureGrounding.ts"],"names":[],"mappings":"AA0CA;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAiC;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACjE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,+DAA+D;AAE/D,SAAS,qBAAqB,CAAC,SAA0B;IACvD,IAAI,SAAS,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,SAAS,CAAC,aAAa,KAAK,IAAI;QACrC,CAAC,CAAC,mFAAmF;QACrF,CAAC,CAAC,8EAA8E,CAAC;AACrF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,SAA0B;IAC7D,MAAM,kBAAkB,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,oBAAoB,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG;QACd,GAAG,SAAS,CAAC,OAAO;QACpB,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;KACjE,CAAC;IACF,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IAE5C,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/F,OAAO,CAAC,oCAAoC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC,CAAC;IAElD,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAC7F,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO;aAClB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC;aACtC,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAClF,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,gBAAgB,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,qBAAqB,CACnC,SAAiC,EACjC,SAAiB,EACjB,cAAsB;IAEtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,cAAc,MAAM,CAAC,CAAC;IAE5D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,YAAY;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,YAAY,MAAM,CAAC,CAAC;IAEhE,MAAM,kBAAkB,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,oBAAoB,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG;QACd,GAAG,SAAS,CAAC,OAAO;QACpB,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;KACjE,CAAC;IAEF,MAAM,aAAa,GAAG,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC;IACjD,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,yBAAyB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,OAAO,IAAI,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAChF,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpD,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/captureGrounding.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=captureGrounding.test.d.ts.map

package/dist/lib/captureGrounding.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"captureGrounding.test.d.ts","sourceRoot":"","sources":["../../src/lib/captureGrounding.test.ts"],"names":[],"mappings":""}

package/dist/lib/captureGrounding.test.js

@@ -0,0 +1,40 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { printGroundingBanner, printGroundingPreview } from './captureGrounding.js';
+const empty = { index: 0, related: [], duplicates: [], governance: [] };
+afterEach(() => vi.restoreAllMocks());
+describe('capture grounding completeness', () => {
+    it.each([true, undefined, false])('preview preserves completeness=%s without claiming uniqueness', (scanTruncated) => {
+        const output = vi.spyOn(process.stdout, 'write').mockReturnValue(true);
+        printGroundingPreview({ ...empty, scanTruncated }, 'Equipment maintenance', 'decisions');
+        const text = output.mock.calls.map(([chunk]) => String(chunk)).join('');
+        expect(text).toContain('No matches found in this check.');
+        expect(text).not.toContain('looks unique');
+        expect(text.includes('additional matching entries may exist')).toBe(scanTruncated !== false);
+        if (scanTruncated === undefined)
+            expect(text).toContain('completeness is unverified');
+    });
+    it.each([true, undefined, false])('normal-capture banner preserves completeness=%s', (scanTruncated) => {
+        const output = vi.spyOn(process.stderr, 'write').mockReturnValue(true);
+        printGroundingBanner({ ...empty, scanTruncated });
+        const text = output.mock.calls.map(([chunk]) => String(chunk)).join('');
+        expect(text.includes('additional matching entries may exist')).toBe(scanTruncated !== false);
+        if (scanTruncated === false)
+            expect(output).not.toHaveBeenCalled();
+    });
+    it('keeps known duplicate evidence alongside the truncation caveat', () => {
+        const output = vi.spyOn(process.stdout, 'write').mockReturnValue(true);
+        printGroundingPreview({ ...empty, scanTruncated: true, duplicates: [{ entryId: 'DEC-1', name: 'Maintenance plan', collectionSlug: 'decisions', matchType: 'possible_duplicate', overlapRatio: 0.9 }] }, 'Maintenance plan', 'decisions');
+        const text = output.mock.calls.map(([chunk]) => String(chunk)).join('');
+        expect(text).toContain('additional matching entries may exist');
+        expect(text).toContain('DEC-1');
+        expect(text).toContain('Possible duplicates:');
+    });
+    it('reports unavailable grounding without an absence claim', () => {
+        const output = vi.spyOn(process.stdout, 'write').mockReturnValue(true);
+        printGroundingPreview(null, 'Maintenance plan', 'decisions');
+        const text = output.mock.calls.map(([chunk]) => String(chunk)).join('');
+        expect(text).toContain('timeout or unavailable');
+        expect(text).not.toContain('No matches');
+    });
+});
+//# sourceMappingURL=captureGrounding.test.js.map

package/dist/lib/captureGrounding.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"captureGrounding.test.js","sourceRoot":"","sources":["../../src/lib/captureGrounding.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAwB,MAAM,uBAAuB,CAAC;AAE1G,MAAM,KAAK,GAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AACzF,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,+DAA+D,EAAE,CAAC,aAAa,EAAE,EAAE;QACnH,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,qBAAqB,CAAC,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,EAAE,uBAAuB,EAAE,WAAW,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC;QAC7F,IAAI,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,iDAAiD,EAAE,CAAC,aAAa,EAAE,EAAE;QACrG,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,oBAAoB,CAAC,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC;QAC7F,IAAI,aAAa,KAAK,KAAK;YAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,qBAAqB,CAAC,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;QACzO,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/client.d.ts

@@ -1,5 +1,93 @@
 /**
  * MCP HTTP client — POST to Convex gateway with Bearer auth.
+ *
+ * TEN-729: Detects sandbox-blocked fetch (Claude Code, Cursor, etc.) and
+ * provides an actionable error instead of the opaque "fetch failed".
+ *
+ * Sandbox proxy support: Node.js fetch (undici) ignores proxy env vars by
+ * default. We detect HTTPS_PROXY and configure a ProxyAgent so pb works in
+ * sandboxed environments (Claude Code, Cursor) without requiring
+ * NODE_OPTIONS="--use-env-proxy".
  */
-export declare function mcpCall<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
+import type { ValidationErrorDetail } from './kernelEnvelope.js';
+import { CLIError } from './errors.js';
+import { type KernelCallOptions } from './rate-limit.js';
+/** Error thrown by kernelCall/kernelCallWithSession when the server returns a non-OK response. */
+export declare class McpError extends CLIError {
+    details?: ValidationErrorDetail[];
+    /** Present only when code === 'rate-limited' — seconds until the caller may retry. */
+    retryAfterSeconds?: number;
+    constructor(message: string, code?: string, details?: ValidationErrorDetail[], retryAfterSeconds?: number);
+}
+export { resetTouchThrottle, type KernelCallOptions } from './rate-limit.js';
+export type { KernelEnvelope, ValidationErrorDetail } from './kernelEnvelope.js';
+/** Result of validateKey — used by `pb login` to verify a key before saving. */
+export type ValidateKeyResult = {
+    valid: true;
+    workspaceId: string;
+} | {
+    valid: false;
+    error: string;
+};
+/**
+ * Validate an API key against the server before saving it.
+ * Uses `resolveWorkspace` as a lightweight health check — if it returns data, the key works.
+ *
+ * Returns { valid: true, workspaceId } on success.
+ * Returns { valid: false, error } on auth failure (401) or other server error.
+ * Throws on network/timeout errors so the caller can distinguish "bad key" from "can't reach server".
+ *
+ * WP-575: `timeoutMs` now DEFAULTS to `resolveWorkspace`'s declared budget instead of a
+ * local `5000` literal — that literal was the last connector-owned timeout on the gateway
+ * path, and the point of this work package is that no connector gets to pick its own. It
+ * stays an explicit parameter so a caller (or a test) can still override deliberately.
+ * Widening 5s -> the declared 10s costs nothing in the case people actually hit: an
+ * unreachable host fails with ECONNREFUSED/ENOTFOUND immediately, not by timeout. The
+ * timeout only governs a server that ACCEPTS the connection then stalls, where waiting the
+ * route's real declared budget before calling the key invalid is the correct behavior.
+ */
+export declare function validateKey(apiKey: string, siteUrl: string, timeoutMs?: number): Promise<ValidateKeyResult>;
+/** Get a human-friendly spinner label for an MCP function name. */
+export declare function spinnerLabel(fn: string): string;
+/**
+ * POST to the admin gateway (/api/admin) — separate from /api/aki (STD-101, BR-109).
+ * Admin operations are not knowledge operations — they target the operator surface.
+ *
+ * No built-in spinner: callers wrap with withSpinner when appropriate.
+ * Throws CLIError on auth failure or non-OK response.
+ */
+export declare function adminCall(command: string, args?: Record<string, unknown>): Promise<unknown>;
+export declare function kernelCall<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<T>;
+/**
+ * kernelCall variant that returns the full kernel envelope (data + summary + _meta) instead
+ * of stripping to just `data` — mirrors packages/mcp-server/src/client.ts's
+ * `kernelCallEnvelope`. Use when a caller needs `_meta` (e.g. a route-specific additive
+ * flag like chain.shapeAdvisories' `truncated`, WP-571 sweep) without changing `data`'s own
+ * shape — the reason `_meta` exists as a side-channel at all (convex/lib/envelopeContract.ts).
+ */
+export declare function kernelCallEnvelope<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<{
+    data: T;
+    summary?: string;
+    _meta?: {
+        durationMs?: number;
+        truncated?: boolean;
+    };
+}>;
+/**
+ * kernelCall variant for write operations. Callers that need server-side session
+ * validation (e.g. `chain.verifyEntry`) pass `sessionId` in `args` explicitly —
+ * it now travels in the request body, not a header (http.ts never read the old
+ * `X-Agent-Session-Id` header).
+ * All write commands (update, relate, unrelate, capture) should use this.
+ *
+ * WP-711/712: the binding guard lives in the shared fetchKernelEnvelope. TEN-3398 (follow-up)
+ * added the effective-tenant notice here too, alongside the post-write session-touch below.
+ *
+ * After a successful write, fires a non-blocking `agent.touchSession` call to
+ * renew the session TTL — mirroring MCP server behavior (DEC-299, BET-181 Slice 1).
+ * The touch is fire-and-forget: it does not block the write response, and errors
+ * are silently swallowed. No touch is attempted if no session is active or if
+ * the write itself fails.
+ */
+export declare function kernelCallWithSession<T = unknown>(fn: string, args?: Record<string, unknown>, options?: KernelCallOptions): Promise<T>;
 //# sourceMappingURL=client.d.ts.map

package/dist/lib/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,wBAAsB,OAAO,CAAC,CAAC,GAAG,OAAO,EACvC,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CAiBZ"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAMjF,OAAO,EAAE,QAAQ,EAAa,MAAM,aAAa,CAAC;AAGlD,OAAO,EAAkC,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAkDzF,kGAAkG;AAClG,qBAAa,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAClC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM;CAe1G;AAID,OAAO,EAAE,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAK7E,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAoDjF,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,SAA8C,GACtD,OAAO,CAAC,iBAAiB,CAAC,CAqC5B;AA6BD,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,OAAO,CAAC,CAoClB;AAqFD,wBAAsB,UAAU,CAAC,CAAC,GAAG,OAAO,EAC1C,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC,CAIZ;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,GAAG,OAAO,EAClD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC,CAI9F;AA+BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,CAAC,CA8BZ"}

package/dist/lib/client.js

@@ -1,21 +1,427 @@
 /**
  * MCP HTTP client — POST to Convex gateway with Bearer auth.
+ *
+ * TEN-729: Detects sandbox-blocked fetch (Claude Code, Cursor, etc.) and
+ * provides an actionable error instead of the opaque "fetch failed".
+ *
+ * Sandbox proxy support: Node.js fetch (undici) ignores proxy env vars by
+ * default. We detect HTTPS_PROXY and configure a ProxyAgent so pb works in
+ * sandboxed environments (Claude Code, Cursor) without requiring
+ * NODE_OPTIONS="--use-env-proxy".
  */
+// WP-575 (TEN-2917): every gateway call is bounded by the budget DECLARED at the route
+// contract — see ./gatewayTimeout.ts for why a copy, and why the CLI had none before.
+import { latencyBudgetMsForRoute } from '../generated/routeLatencyBudget.generated.js';
+import { gatewayTimeoutError, isTimeoutAbort } from './gatewayTimeout.js';
+// The envelope's shape and how to read one off a Response — including the body-phase budget
+// abort (WP-575 review). Split out under STD-2/DEC-1504; see ./kernelEnvelope.ts's header for
+// why the seam is real and not a line-count dodge.
+import { parseKernelEnvelope, recordLatestFromResponse } from './kernelEnvelope.js';
 import { getConfig } from './config.js';
-export async function mcpCall(fn, args = {}) {
-    const { apiKey, siteUrl } = getConfig();
-    const res = await fetch(`${siteUrl}/api/mcp`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${apiKey}`,
-        },
-        body: JSON.stringify({ fn, args }),
+import { resolveAdminConfig } from './adminConfig.js';
+import { emitEffectiveTenantNotice, describeCurrentTenantForRefusal, guardAdminCall } from './workspaceNotice.js';
+import { readSession, readSessionBySessionId } from './session.js';
+import { assertSessionStillBound, fingerprintOf } from './sessionBinding.js';
+import { CLIError, ErrorCode } from './errors.js';
+import { withSpinner } from './spinner.js';
+import { maybeRetry, shouldTouchSession } from './rate-limit.js';
+/**
+ * Map MCP server error codes to CLIError categories.
+ * Keeps backward compat: McpError.code is still a free string from the server,
+ * but category and guidance are derived for the global error handler.
+ */
+function mcpCodeToCategory(code) {
+    if (!code)
+        return 'internal';
+    if (code.startsWith('AUTH') || code === 'UNAUTHORIZED')
+        return 'auth';
+    if (code === 'VALIDATION_FAILED' ||
+        code === 'QUALITY_GATE_BLOCKED' ||
+        code === 'HUMAN_ONLY_ACCEPT' ||
+        code === 'GROUNDING_GATE_BLOCKED' ||
+        code === 'SEMANTIC_QUALITY_GATE_BLOCKED' ||
+        code === 'CONTRADICTION_BLOCKED' ||
+        // WP-477 / FEAT-1350: both are 400s the caller fixes by changing an argument
+        // (pass the issued cursor verbatim / ask for a smaller numItems) — not internal faults.
+        code === 'CURSOR_QUERY_MISMATCH' ||
+        code === 'PAGE_SPLIT_REQUIRED' ||
+        // TEN-2647: Convex's own arg-validator rejection — a 400 the caller fixes by correcting
+        // the offending argument (missing/unknown/wrong-typed), not an internal fault.
+        code === 'ARGUMENT_VALIDATION_FAILED' ||
+        // WP-494 (TEN-2742): `pb feedback submit` refused because the workspace switched off
+        // agent-submitted feedback — a policy gate, not an internal fault (mirrors the
+        // GATE_BLOCKED family above).
+        code === 'AGENT_FEEDBACK_DISABLED')
+        return 'validation';
+    if (code === 'SESSION_REQUIRED')
+        return 'session';
+    // TEN-656: per-key API quota — a 429 the caller fixes by WAITING, not by changing the
+    // call. Categorized as network so the global handler renders it as retryable, never
+    // as an internal fault.
+    if (code === 'rate-limited')
+        return 'network';
+    return 'internal';
+}
+function normalizeMcpCode(code) {
+    // Convex names the internal protocol condition; the public CLI exposes its
+    // stable, harness-independent error taxonomy to people and agents.
+    // WP-584 S4 review round 1 (P2-3): the WHOLE AUTHZ_* family maps here, not just the one
+    // literal AUTHZ_PERMISSION_DENIED — a narrower match let AUTHZ_INSUFFICIENT_ROLE (BR-227's
+    // own code, convex/http.ts's vendor-gate 403) fall through the `as` cast below and publish
+    // Convex's raw internal code as if it were a real CLI ErrorCodeValue. Mirrors
+    // mcpCodeToCategory's own `code.startsWith('AUTH')` breadth, above.
+    if (code?.startsWith('AUTHZ_'))
+        return ErrorCode.AUTH_DENIED;
+    return code ?? ErrorCode.INTERNAL;
+}
+/** Error thrown by kernelCall/kernelCallWithSession when the server returns a non-OK response. */
+export class McpError extends CLIError {
+    details;
+    /** Present only when code === 'rate-limited' — seconds until the caller may retry. */
+    retryAfterSeconds;
+    constructor(message, code, details, retryAfterSeconds) {
+        super(message, {
+            code: normalizeMcpCode(code),
+            category: mcpCodeToCategory(code),
+            // TEN-656 / TEN-2655: the rate-limit refusal must be agent-legible — say exactly
+            // what to do (wait, then retry unchanged), because autonomous chained runs have
+            // no human to interpret a bare 429.
+            guidance: code === 'rate-limited'
+                ? 'This API key hit its request quota (HTTP 429). Wait the number of seconds in the message (also in the Retry-After header), then retry the same call unchanged — it is safe to retry.'
+                : undefined,
+        });
+        this.name = 'McpError';
+        this.details = details;
+        this.retryAfterSeconds = retryAfterSeconds;
+    }
+}
+// WP-579: the rate-limit retry and touch throttle live in rate-limit.ts — two
+// self-contained policies with their own state, kept out of this module's budget (STD-2).
+export { resetTouchThrottle } from './rate-limit.js';
+// Configure proxy at module load — runs once, before any fetch call.
+// Node.js fetch (undici) ignores HTTPS_PROXY env vars. We detect the proxy
+// and install a ProxyAgent as the global dispatcher so all fetch() calls
+// route through the sandbox proxy automatically.
+try {
+    const _proxy = process.env.https_proxy || process.env.HTTPS_PROXY;
+    if (_proxy) {
+        const { ProxyAgent, setGlobalDispatcher } = await import('undici');
+        setGlobalDispatcher(new ProxyAgent(_proxy));
+    }
+}
+catch {
+    // undici unavailable or proxy config failed — rethrowWithGuidance handles it.
+}
+/** Detect a sandbox/network-blocked fetch and re-throw with guidance. */
+function rethrowWithGuidance(err, siteUrl, 
+// WP-575: the route being called, the budget it was given, and the call's own args, so a
+// budget abort can be reported as itself rather than collapsing into "Could not reach
+// <host>" — and so a dry run is never told its write may have landed (see ./gatewayTimeout.ts).
+route) {
+    const msg = err instanceof Error ? err.message : String(err);
+    // WP-575: a budget abort is not an unreachable host — the connection succeeded, we stopped
+    // waiting, and for a write route the server may have finished. See ./gatewayTimeout.ts.
+    if (route && isTimeoutAbort(err))
+        throw gatewayTimeoutError(route.fn, route.budgetMs, route.args);
+    if (msg === 'fetch failed' || msg.includes('ECONNREFUSED') || msg.includes('ENOTFOUND')) {
+        const host = new URL(siteUrl).hostname;
+        const proxy = process.env.https_proxy || process.env.HTTPS_PROXY;
+        const proxyHint = proxy
+            ? `A proxy is configured (${proxy}) but Node.js fetch() is not using it.\n` +
+                `Fix: set NODE_OPTIONS="--use-env-proxy" in your environment,\n` +
+                `  or re-run with: NODE_OPTIONS="--use-env-proxy" pb <command>`
+            : `If you are running inside an AI code editor sandbox (Claude Code, Cursor, etc.),\n` +
+                `the sandbox may be blocking outbound connections.\n\n` +
+                `Fix: add "${host}" to your sandbox network allowlist.\n` +
+                `  - Claude Code: run /sandbox -> add network host\n` +
+                `  - Or re-run: pb handshake --init (configures sandbox automatically)`;
+        throw new CLIError(`Could not reach ${host}.`, {
+            code: ErrorCode.NETWORK_UNREACHABLE,
+            category: 'network',
+            guidance: proxyHint,
+        });
+    }
+    throw err;
+}
+/**
+ * Validate an API key against the server before saving it.
+ * Uses `resolveWorkspace` as a lightweight health check — if it returns data, the key works.
+ *
+ * Returns { valid: true, workspaceId } on success.
+ * Returns { valid: false, error } on auth failure (401) or other server error.
+ * Throws on network/timeout errors so the caller can distinguish "bad key" from "can't reach server".
+ *
+ * WP-575: `timeoutMs` now DEFAULTS to `resolveWorkspace`'s declared budget instead of a
+ * local `5000` literal — that literal was the last connector-owned timeout on the gateway
+ * path, and the point of this work package is that no connector gets to pick its own. It
+ * stays an explicit parameter so a caller (or a test) can still override deliberately.
+ * Widening 5s -> the declared 10s costs nothing in the case people actually hit: an
+ * unreachable host fails with ECONNREFUSED/ENOTFOUND immediately, not by timeout. The
+ * timeout only governs a server that ACCEPTS the connection then stalls, where waiting the
+ * route's real declared budget before calling the key invalid is the correct behavior.
+ */
+export async function validateKey(apiKey, siteUrl, timeoutMs = latencyBudgetMsForRoute('resolveWorkspace')) {
+    return withSpinner('Validating API key', async () => {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const res = await fetch(`${siteUrl}/api/aki`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${apiKey}`,
+                },
+                body: JSON.stringify({ fn: 'resolveWorkspace', args: {} }),
+                signal: controller.signal,
+            });
+            clearTimeout(timer);
+            // Record header BEFORE the 401/403 short-circuit — auth-fail responses still carry the version skew signal.
+            recordLatestFromResponse(res);
+            if (res.status === 401 || res.status === 403) {
+                return { valid: false, error: 'Invalid API key.' };
+            }
+            const envelope = await parseKernelEnvelope(res);
+            if (!res.ok || envelope.ok === false) {
+                return { valid: false, error: envelope.message || envelope.error || `Server error (${res.status})` };
+            }
+            return { valid: true, workspaceId: envelope.data?._id ?? 'unknown' };
+        }
+        catch (err) {
+            clearTimeout(timer);
+            // Re-throw network/timeout errors — caller handles the "offline" case
+            throw err;
+        }
     });
-    const json = (await res.json());
-    if (!res.ok || json.error) {
-        throw new Error(json.error ?? res.statusText);
+}
+/**
+ * Map MCP function names to human-friendly spinner labels.
+ * Unknown functions get a generic fallback.
+ */
+const SPINNER_LABELS = {
+    orient: 'Loading workspace overview',
+    'entries.get': 'Loading entry',
+    'entries.search': 'Searching entries',
+    'entries.create': 'Creating entry',
+    'entries.update': 'Updating entry',
+    'capture-quick': 'Capturing to Chain',
+    'propose-capture': 'Preparing capture',
+    'commit-entry': 'Committing entry',
+    'agent.startSession': 'Starting session',
+    'agent.closeSession': 'Closing session',
+    'agent.touchSession': 'Refreshing session',
+    resolveWorkspace: 'Resolving workspace',
+    'onboarding.chat': 'Thinking',
+    context: 'Loading context',
+    'entries.relate': 'Creating relation',
+    'entries.unrelate': 'Removing relation',
+    constellation: 'Loading constellation',
+    'conflicts.list': 'Loading open conflicts',
+    'conflicts.resolve': 'Recording verdict',
+    'conflicts.summary': 'Loading precision summary',
+};
+/** Get a human-friendly spinner label for an MCP function name. */
+export function spinnerLabel(fn) {
+    return SPINNER_LABELS[fn] || `Loading ${fn.replace(/\./g, ' ')}`;
+}
+/**
+ * POST to the admin gateway (/api/admin) — separate from /api/aki (STD-101, BR-109).
+ * Admin operations are not knowledge operations — they target the operator surface.
+ *
+ * No built-in spinner: callers wrap with withSpinner when appropriate.
+ * Throws CLIError on auth failure or non-OK response.
+ */
+export async function adminCall(command, args) {
+    const { apiKey, siteUrl, source, profileName } = resolveAdminConfig();
+    // TEN-3398 (follow-up): `pb admin` previously carried neither the notice nor the binding
+    // guard — see workspaceNotice.ts's `guardAdminCall` doc comment for the full story.
+    guardAdminCall({ profileName, source }, boundSessionFor(args ?? {}), fingerprintOf(apiKey, siteUrl));
+    // WP-575 deliberately leaves /api/admin UNBOUNDED (PR #533 review, Codex P2 — an earlier
+    // round bounded it and that was the regression). Admin commands are long-running BULK
+    // operations (`manage:delete-workspace` cascading 100-row batches, `seed:backfill-starter`
+    // across workspaces) and are NOT in the route registry, so the fail-safe "widest" fallback
+    // is a real number for a route the contract describes and a guess for one it doesn't —
+    // an arbitrary ceiling on a destructive operation that can abort it mid-flight, which is
+    // worse than the hang it would prevent. (That fallback is whatever
+    // WIDEST_ROUTE_LATENCY_BUDGET_MS happens to be — today 330_000, since it spans the override
+    // table too — which is the point: a number that MOVES when an unrelated route's override
+    // changes is not a budget for this surface.) It needs its own MEASURED budget: follow-up work.
+    let res;
+    try {
+        res = await fetch(`${siteUrl}/api/admin`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({ command, args }),
+        });
+    }
+    catch (err) {
+        rethrowWithGuidance(err, siteUrl);
+    }
+    const response = (await res.json().catch(() => ({})));
+    if (response.ok === false || (!res.ok && response.ok == null)) {
+        throw new McpError((response.message ?? response.error ?? res.statusText) || 'Admin request failed', response.code);
+    }
+    return response.data;
+}
+/**
+ * Connector identity for the gateway's context.served shared seam (DEC-1207). Sent as the
+ * `x-pb-source` header on gateway calls so the server-side emit can attribute this connector;
+ * the gateway defaults to `api` if it is ever absent.
+ */
+const PB_TELEMETRY_SOURCE = 'cli';
+/**
+ * Resolve the session to check the binding guard against: the ambient marker, unless `args`
+ * names a DIFFERENT session explicitly (TEN-3315 — e.g. `pb rework report --conversation A`
+ * selects a session other than the ambient one, and judging the ambient marker there would
+ * judge the wrong session). No extra IO on the ordinary path: the lookup only runs when an
+ * explicit id names a session different from the ambient marker.
+ */
+function boundSessionFor(args) {
+    const session = readSession();
+    const explicitSessionId = typeof args.sessionId === 'string' ? args.sessionId : null;
+    return explicitSessionId && explicitSessionId !== session?.sessionId
+        ? readSessionBySessionId(explicitSessionId)
+        : session;
+}
+/**
+ * The ONE gateway fetch every kernelCall path routes through (WP-711/712). Resolves config,
+ * runs the binding guard, POSTs to /api/aki, and returns the raw envelope.
+ *
+ * Before this slice only kernelCallWithSession ran assertSessionStillBound, so a moved tenant
+ * pin refused writes but not reads: `pb get`/`search`/`orient`/`context`/`brief`/`constellation`
+ * all go through plain kernelCall and silently followed a repointed pin. Two write commands
+ * (migrate-setup.ts, setup-ingest.ts) send their writes through plain kernelCall too and had
+ * each hand-duplicated the same guard call to cover that gap — exactly the "N copies of the pin
+ * cascade" shape WP-692's TEN-3239 warned about. Folding the check in here removes all three
+ * duplicates; every caller, read or write, now shares this one call site.
+ */
+async function fetchKernelEnvelope(fn, args, options) {
+    const { apiKey, siteUrl } = getConfig();
+    // The ONE guard call site. `describeCurrentTenantForRefusal()` only runs inside the thunk, so
+    // it costs nothing on the ordinary (no session, or unchanged binding) path — invoked only
+    // once the guard has already decided to refuse. WP-715: names the credential ACTUALLY in
+    // play (sees an env/local/cwd-key override), never the pin it may shadow — see that
+    // function's doc comment in workspaceNotice.ts.
+    assertSessionStillBound(boundSessionFor(args), undefined, describeCurrentTenantForRefusal);
+    const label = spinnerLabel(fn);
+    const budgetMs = latencyBudgetMsForRoute(fn);
+    // Spinner OUTSIDE the retry: withSpinner reports a terminal `— failed` line on any throw,
+    // so a spinner per attempt would paint up to MAX_RATE_LIMIT_RETRIES false failures for a
+    // call that ultimately succeeds, then sit silent through each Retry-After wait.
+    const envelope = await withSpinner(label, () => maybeRetry(async () => {
+        let res;
+        try {
+            res = await fetch(`${siteUrl}/api/aki`, {
+                method: 'POST',
+                signal: AbortSignal.timeout(budgetMs),
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${apiKey}`,
+                    // DEC-1207: attribute this connector for the gateway's context.served seam.
+                    'x-pb-source': PB_TELEMETRY_SOURCE,
+                },
+                body: JSON.stringify({ fn, args }),
+            });
+        }
+        catch (err) {
+            rethrowWithGuidance(err, siteUrl, { fn, budgetMs, args });
+        }
+        const parsed = await parseKernelEnvelope(res, { fn, budgetMs, args });
+        if (!res.ok || parsed.ok === false) {
+            throw new McpError(parsed.message || parsed.error || res.statusText, parsed.code, parsed.details, parsed.retryAfterSeconds);
+        }
+        return parsed;
+    }, options));
+    // apiKey/siteUrl travel out alongside the envelope (PR #810 review, Copilot) — kernelCallWithSession
+    // needs them AFTER this resolves, for the post-write touch. Returning them here means getConfig()
+    // is called exactly ONCE per kernelCall*, never re-resolved by a caller that already has them.
+    return { envelope, apiKey, siteUrl };
+}
+export async function kernelCall(fn, args = {}, options) {
+    const { envelope } = await fetchKernelEnvelope(fn, args, options);
+    await emitEffectiveTenantNotice(); // WP-714 S3: the read path announces too (once/process).
+    return envelope.data;
+}
+/**
+ * kernelCall variant that returns the full kernel envelope (data + summary + _meta) instead
+ * of stripping to just `data` — mirrors packages/mcp-server/src/client.ts's
+ * `kernelCallEnvelope`. Use when a caller needs `_meta` (e.g. a route-specific additive
+ * flag like chain.shapeAdvisories' `truncated`, WP-571 sweep) without changing `data`'s own
+ * shape — the reason `_meta` exists as a side-channel at all (convex/lib/envelopeContract.ts).
+ */
+export async function kernelCallEnvelope(fn, args = {}, options) {
+    const { envelope } = await fetchKernelEnvelope(fn, args, options);
+    await emitEffectiveTenantNotice(); // WP-714 S3: the read path announces too (once/process).
+    return { data: envelope.data, summary: envelope.summary, _meta: envelope._meta };
+}
+/**
+ * Raw fetch to the gateway — no spinner, swallows errors.
+ * Used for fire-and-forget operations (e.g. session touch) where visible feedback is noise.
+ */
+async function mcpFetchRaw(fn, args, apiKey, siteUrl) {
+    try {
+        await fetch(`${siteUrl}/api/aki`, {
+            method: 'POST',
+            // WP-575: fire-and-forget still gets the declared budget. Errors are swallowed either
+            // way, so this is not about the message — it is about not leaving a socket and a
+            // pending promise open indefinitely on a stuck backend behind an already-returned
+            // command. "Best-effort" was never meant to mean "unbounded".
+            signal: AbortSignal.timeout(latencyBudgetMsForRoute(fn)),
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({ fn, args }),
+        });
+    }
+    catch {
+        // Best-effort — silently swallow all errors
+    }
+}
+/**
+ * kernelCall variant for write operations. Callers that need server-side session
+ * validation (e.g. `chain.verifyEntry`) pass `sessionId` in `args` explicitly —
+ * it now travels in the request body, not a header (http.ts never read the old
+ * `X-Agent-Session-Id` header).
+ * All write commands (update, relate, unrelate, capture) should use this.
+ *
+ * WP-711/712: the binding guard lives in the shared fetchKernelEnvelope. TEN-3398 (follow-up)
+ * added the effective-tenant notice here too, alongside the post-write session-touch below.
+ *
+ * After a successful write, fires a non-blocking `agent.touchSession` call to
+ * renew the session TTL — mirroring MCP server behavior (DEC-299, BET-181 Slice 1).
+ * The touch is fire-and-forget: it does not block the write response, and errors
+ * are silently swallowed. No touch is attempted if no session is active or if
+ * the write itself fails.
+ */
+export async function kernelCallWithSession(fn, args = {}, options) {
+    // Ambient session, for the post-write touch below — deliberately NOT `boundSessionFor(args)`:
+    // the touch always renews the marker actually in play locally, regardless of which session an
+    // explicit `sessionId` in `args` asked the guard to validate against.
+    const session = readSession();
+    // apiKey/siteUrl come back FROM fetchKernelEnvelope rather than a second getConfig() call here
+    // (PR #810 review, Copilot): the old code called getConfig() once here and again inside the
+    // shared fetch, so the touch below could in principle read a different resolution than the
+    // write it is renewing. Reusing the pair fetchKernelEnvelope already resolved makes that
+    // impossible by construction, not just unlikely.
+    const { envelope, apiKey, siteUrl } = await fetchKernelEnvelope(fn, args, options);
+    // TEN-3398 (follow-up): the write path announces too — see workspaceNotice.ts's doc comment
+    // on emitEffectiveTenantNotice for what this closes and why it's safe to call here.
+    await emitEffectiveTenantNotice();
+    const result = envelope.data;
+    // Fire-and-forget session touch — best-effort, never blocks the write response.
+    // Uses mcpFetchRaw (not kernelCall) to avoid recursion and suppress the visible spinner
+    // that would appear if kernelCall were used here (background ops are silent noise).
+    // TEN-2923: throttled to match the server's own no-op window (shouldTouchSession) — a
+    // touch inside that window would just burn quota on a call the server already discards.
+    // WP-688 S2a review fix (thread bb1oj): `skipSessionTouch` opts a --dry-run-style caller
+    // out entirely — the door itself may not write, but this touch is a REAL session-row
+    // patch, and "no write" must mean none, not "none except telemetry".
+    if (!options?.skipSessionTouch && session?.sessionId && shouldTouchSession(session.sessionId)) {
+        void mcpFetchRaw('agent.touchSession', { sessionId: session.sessionId }, apiKey, siteUrl);
     }
-    return json.data;
+    return result;
 }
 //# sourceMappingURL=client.js.map

package/dist/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IAExC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,MAAM,EAAE;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;IAChE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC,IAAS,CAAC;AACxB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,uFAAuF;AACvF,sFAAsF;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1E,4FAA4F;AAC5F,8FAA8F;AAC9F,mDAAmD;AACnD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAClH,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAA0B,MAAM,iBAAiB,CAAC;AAGzF;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC;IACtE,IACE,IAAI,KAAK,mBAAmB;QAC5B,IAAI,KAAK,sBAAsB;QAC/B,IAAI,KAAK,mBAAmB;QAC5B,IAAI,KAAK,wBAAwB;QACjC,IAAI,KAAK,+BAA+B;QACxC,IAAI,KAAK,uBAAuB;QAChC,6EAA6E;QAC7E,wFAAwF;QACxF,IAAI,KAAK,uBAAuB;QAChC,IAAI,KAAK,qBAAqB;QAC9B,wFAAwF;QACxF,+EAA+E;QAC/E,IAAI,KAAK,4BAA4B;QACrC,qFAAqF;QACrF,+EAA+E;QAC/E,8BAA8B;QAC9B,IAAI,KAAK,yBAAyB;QAClC,OAAO,YAAY,CAAC;IACtB,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAClD,sFAAsF;IACtF,oFAAoF;IACpF,wBAAwB;IACxB,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACtC,2EAA2E;IAC3E,mEAAmE;IACnE,wFAAwF;IACxF,2FAA2F;IAC3F,2FAA2F;IAC3F,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC,WAAW,CAAC;IAC7D,OAAQ,IAAmC,IAAI,SAAS,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,kGAAkG;AAClG,MAAM,OAAO,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAA2B;IAClC,sFAAsF;IACtF,iBAAiB,CAAU;IAE3B,YAAY,OAAe,EAAE,IAAa,EAAE,OAAiC,EAAE,iBAA0B;QACvG,KAAK,CAAC,OAAO,EAAE;YAChB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;YACzB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC;YACjC,iFAAiF;YACjF,gFAAgF;YAChF,oCAAoC;YACpC,QAAQ,EAAE,IAAI,KAAK,cAAc;gBAC/B,CAAC,CAAC,sLAAsL;gBACxL,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;CACF;AAED,8EAA8E;AAC9E,0FAA0F;AAC1F,OAAO,EAAE,kBAAkB,EAA0B,MAAM,iBAAiB,CAAC;AAO7E,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AACjD,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnE,mBAAmB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAAC,MAAM,CAAC;IACP,8EAA8E;AAChF,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAC1B,GAAY,EACZ,OAAe;AACf,yFAAyF;AACzF,sFAAsF;AACtF,gGAAgG;AAChG,KAAwD;IAExD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE7D,2FAA2F;IAC3F,wFAAwF;IACxF,IAAI,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAElG,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACjE,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,0BAA0B,KAAK,0CAA0C;gBACzE,gEAAgE;gBAChE,+DAA+D;YACjE,CAAC,CAAC,oFAAoF;gBACpF,uDAAuD;gBACvD,aAAa,IAAI,wCAAwC;gBACzD,qDAAqD;gBACrD,uEAAuE,CAAC;QAC5E,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,mBAAmB;YACnC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAOD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe,EACf,SAAS,GAAG,uBAAuB,CAAC,kBAAkB,CAAC;IAEvD,OAAO,WAAW,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;iBAClC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC1D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,4GAA4G;YAC5G,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACrD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAmB,GAAG,CAAC,CAAC;YAElE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YACvG,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,sEAAsE;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,4BAA4B;IACpC,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,mBAAmB;IACrC,gBAAgB,EAAE,gBAAgB;IAClC,gBAAgB,EAAE,gBAAgB;IAClC,eAAe,EAAE,oBAAoB;IACrC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,kBAAkB;IAClC,oBAAoB,EAAE,kBAAkB;IACxC,oBAAoB,EAAE,iBAAiB;IACvC,oBAAoB,EAAE,oBAAoB;IAC1C,gBAAgB,EAAE,qBAAqB;IACvC,iBAAiB,EAAE,UAAU;IAC7B,OAAO,EAAE,iBAAiB;IAC1B,gBAAgB,EAAE,mBAAmB;IACrC,kBAAkB,EAAE,mBAAmB;IACvC,aAAa,EAAE,uBAAuB;IACtC,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,mBAAmB;IACxC,mBAAmB,EAAE,2BAA2B;CACjD,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,cAAc,CAAC,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,IAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAEtE,yFAAyF;IACzF,oFAAoF;IACpF,cAAc,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAErG,yFAAyF;IACzF,sFAAsF;IACtF,2FAA2F;IAC3F,2FAA2F;IAC3F,uFAAuF;IACvF,yFAAyF;IACzF,mEAAmE;IACnE,4FAA4F;IAC5F,yFAAyF;IACzF,+FAA+F;IAC/F,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAEG,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAsF,CAAC;IAC/I,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAA6B;IACpD,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,iBAAiB,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,OAAO,iBAAiB,IAAI,iBAAiB,KAAK,OAAO,EAAE,SAAS;QAClE,CAAC,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,mBAAmB,CAChC,EAAU,EACV,IAA6B,EAC7B,OAA2B;IAE3B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,8FAA8F;IAC9F,0FAA0F;IAC1F,yFAAyF;IACzF,oFAAoF;IACpF,gDAAgD;IAChD,uBAAuB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAE7C,0FAA0F;IAC1F,yFAAyF;IACzF,gFAAgF;IAChF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACrC,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;oBACjC,4EAA4E;oBAC5E,aAAa,EAAE,mBAAmB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAI,GAAG,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC9H,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAEb,qGAAqG;IACrG,kGAAkG;IAClG,+FAA+F;IAC/F,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,OAAgC,EAAE,EAClC,OAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,yBAAyB,EAAE,CAAC,CAAC,yDAAyD;IAC5F,OAAO,QAAQ,CAAC,IAAS,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,OAAgC,EAAE,EAClC,OAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,yBAAyB,EAAE,CAAC,CAAC,yDAAyD;IAC5F,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,EAAU,EACV,IAA6B,EAC7B,MAAc,EACd,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,sFAAsF;YACtF,iFAAiF;YACjF,kFAAkF;YAClF,8DAA8D;YAC9D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAU,EACV,OAAgC,EAAE,EAClC,OAA2B;IAE3B,8FAA8F;IAC9F,8FAA8F;IAC9F,sEAAsE;IACtE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,+FAA+F;IAC/F,4FAA4F;IAC5F,2FAA2F;IAC3F,yFAAyF;IACzF,iDAAiD;IACjD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,mBAAmB,CAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtF,4FAA4F;IAC5F,oFAAoF;IACpF,MAAM,yBAAyB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAS,CAAC;IAElC,gFAAgF;IAChF,wFAAwF;IACxF,oFAAoF;IACpF,sFAAsF;IACtF,wFAAwF;IACxF,yFAAyF;IACzF,qFAAqF;IACrF,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,gBAAgB,IAAI,OAAO,EAAE,SAAS,IAAI,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9F,KAAK,WAAW,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}