@productbrain/cli 0.1.0-beta.63 → 0.1.0-beta.6301

package/dist/lib/startup-signals.test.js

@@ -0,0 +1,165 @@
+/**
+ * WP-486 Slice 1 (FEAT-1371, TEN-2724) — `collectCliStartupSignals` unit tests. Mocks
+ * `child_process.execSync` so these are deterministic and never shell out to real git.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+const execSyncMock = vi.fn();
+vi.mock('node:child_process', () => ({
+    execSync: (...args) => execSyncMock(...args),
+}));
+import { collectCliStartupSignals } from './startup-signals.js';
+describe('collectCliStartupSignals', () => {
+    beforeEach(() => {
+        execSyncMock.mockReset();
+    });
+    function mockGitCommands(responses) {
+        execSyncMock.mockImplementation((command) => {
+            for (const [match, output] of Object.entries(responses)) {
+                if (command.includes(match))
+                    return output;
+            }
+            throw new Error(`unmocked git command: ${command}`);
+        });
+    }
+    it('collects changedPaths, branchName, worktreeName from git', () => {
+        mockGitCommands({
+            'git status --porcelain': ' M convex/agentKnowledge/orientView.ts\n?? packages/cli/src/lib/startup-signals.ts\n',
+            'git branch --show-current': 'ontology-r4-r5-signal-envelope\n',
+            'git rev-parse --show-toplevel': '/Users/randy/worktree/ontology-r4-r5-signal-envelope\n',
+        });
+        const signals = collectCliStartupSignals('/Users/randy/worktree/ontology-r4-r5-signal-envelope');
+        expect(signals).toEqual({
+            changedPaths: [
+                'convex/agentKnowledge/orientView.ts',
+                'packages/cli/src/lib/startup-signals.ts',
+            ],
+            branchName: 'ontology-r4-r5-signal-envelope',
+            worktreeName: 'ontology-r4-r5-signal-envelope',
+        });
+    });
+    it('resolves a rename line to the NEW path only', () => {
+        mockGitCommands({
+            'git status --porcelain': 'R  old-name.ts -> new-name.ts\n',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual(['new-name.ts']);
+    });
+    it('caps changedPaths at 25 entries', () => {
+        const lines = Array.from({ length: 40 }, (_, i) => ` M file-${i}.ts`).join('\n');
+        mockGitCommands({
+            'git status --porcelain': lines,
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toHaveLength(25);
+    });
+    it('is fail-open: a clean worktree yields no changedPaths key', () => {
+        mockGitCommands({
+            'git status --porcelain': '',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals).not.toHaveProperty('changedPaths');
+    });
+    it('is fail-open: git absence/error yields an empty signal set, never throws', () => {
+        execSyncMock.mockImplementation(() => {
+            throw new Error('git: command not found');
+        });
+        expect(() => collectCliStartupSignals('/not-a-repo')).not.toThrow();
+        expect(collectCliStartupSignals('/not-a-repo')).toEqual({});
+    });
+    // WP-486 Slice 1 — PR #369 review (Codex): two P2 findings, both reproduced live against a
+    // disposable git repo before being fixed here (see PR thread replies for the live evidence).
+    it('requests --untracked-files=all so a wholly-untracked directory expands to its files, not one directory entry', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': '?? src/routes/new-feature/page.svelte\n?? src/routes/new-feature/logic.ts\n',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual([
+            'src/routes/new-feature/page.svelte',
+            'src/routes/new-feature/logic.ts',
+        ]);
+        // Locks in the actual flag used — a regression back to bare `--porcelain` (default
+        // `--untracked-files=normal`, which collapses the directory to one `?? src/` entry) would
+        // fail this assertion even though the mock above still matches the substring.
+        const calledCommands = execSyncMock.mock.calls.map((c) => c[0]);
+        expect(calledCommands.some((c) => c.includes('--untracked-files=all'))).toBe(true);
+    });
+    it('includes committed branch paths (vs origin/main) when the worktree is clean — the normal re-orientation case', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': '',
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': 'convex/agentKnowledge/orientView.ts\0packages/cli/src/commands/orient.ts\0',
+            'git branch --show-current': 'ontology-r4-r5-signal-envelope\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual([
+            'convex/agentKnowledge/orientView.ts',
+            'packages/cli/src/commands/orient.ts',
+        ]);
+    });
+    it('unions dirty-worktree and committed-branch paths, de-duped', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': ' M convex/agentKnowledge/orientView.ts\n',
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': 'convex/agentKnowledge/orientView.ts\0packages/cli/src/commands/orient.ts\0',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual([
+            'convex/agentKnowledge/orientView.ts',
+            'packages/cli/src/commands/orient.ts',
+        ]);
+    });
+    it('parses -z NUL-separated branch-diff paths without quote-corruption on non-ASCII filenames (PR #369 review)', () => {
+        // `-z` disables git's default core.quotePath octal-escaping outright, so a non-ASCII path
+        // comes through as raw UTF-8 bytes, NUL-terminated — never as a quoted `"caf\303\251.txt"`
+        // string a newline-splitting parser would mis-glob against. This test locks in that the
+        // `-z` flag is actually present on the branch-diff git invocation (a regression back to
+        // bare `--name-only` would corrupt this exact case).
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': '',
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': 'café.txt\0src/edge-case.ts\0',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual(['café.txt', 'src/edge-case.ts']);
+    });
+    it('is fail-open: no origin/main (e.g. no network) yields dirty-worktree paths only, never throws', () => {
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': ' M convex/agentKnowledge/orientView.ts\n',
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+            // No 'git merge-base' entry — mockGitCommands throws "unmocked git command", simulating a
+            // real git failure (e.g. unknown revision origin/main); runGit's try/catch degrades this
+            // to undefined, same as any other fail-open git error.
+        });
+        expect(() => collectCliStartupSignals('/repo')).not.toThrow();
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toEqual(['convex/agentKnowledge/orientView.ts']);
+    });
+    it('caps the UNIONED changedPaths at 25 entries', () => {
+        const dirty = Array.from({ length: 15 }, (_, i) => ` M dirty-${i}.ts`).join('\n');
+        const branch = Array.from({ length: 15 }, (_, i) => `branch-${i}.ts`).join('\0');
+        mockGitCommands({
+            'git status --porcelain --untracked-files=all': dirty,
+            'git merge-base HEAD origin/main': 'abc1234\n',
+            'git diff --name-only -z abc1234 HEAD': branch,
+            'git branch --show-current': 'main\n',
+            'git rev-parse --show-toplevel': '/repo\n',
+        });
+        const signals = collectCliStartupSignals('/repo');
+        expect(signals.changedPaths).toHaveLength(25);
+    });
+});
+//# sourceMappingURL=startup-signals.test.js.map

package/dist/lib/startup-signals.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-signals.test.js","sourceRoot":"","sources":["../../src/lib/startup-signals.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC7B,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,QAAQ,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;CACxD,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,UAAU,CAAC,GAAG,EAAE;QACd,YAAY,CAAC,SAAS,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,SAAS,eAAe,CAAC,SAAiC;QACxD,YAAY,CAAC,kBAAkB,CAAC,CAAC,OAAe,EAAE,EAAE;YAClD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,MAAM,CAAC;YAC7C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,eAAe,CAAC;YACd,wBAAwB,EAAE,sFAAsF;YAChH,2BAA2B,EAAE,kCAAkC;YAC/D,+BAA+B,EAAE,wDAAwD;SAC1F,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,sDAAsD,CAAC,CAAC;QAEjG,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,YAAY,EAAE;gBACZ,qCAAqC;gBACrC,yCAAyC;aAC1C;YACD,UAAU,EAAE,gCAAgC;YAC5C,YAAY,EAAE,gCAAgC;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,eAAe,CAAC;YACd,wBAAwB,EAAE,iCAAiC;YAC3D,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,eAAe,CAAC;YACd,wBAAwB,EAAE,KAAK;YAC/B,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,eAAe,CAAC;YACd,wBAAwB,EAAE,EAAE;YAC5B,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,YAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACpE,MAAM,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,6FAA6F;IAE7F,EAAE,CAAC,8GAA8G,EAAE,GAAG,EAAE;QACtH,eAAe,CAAC;YACd,8CAA8C,EAAE,6EAA6E;YAC7H,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YACnC,oCAAoC;YACpC,iCAAiC;SAClC,CAAC,CAAC;QACH,mFAAmF;QACnF,0FAA0F;QAC1F,8EAA8E;QAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8GAA8G,EAAE,GAAG,EAAE;QACtH,eAAe,CAAC;YACd,8CAA8C,EAAE,EAAE;YAClD,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,4EAA4E;YACpH,2BAA2B,EAAE,kCAAkC;YAC/D,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YACnC,qCAAqC;YACrC,qCAAqC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,eAAe,CAAC;YACd,8CAA8C,EAAE,0CAA0C;YAC1F,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,4EAA4E;YACpH,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YACnC,qCAAqC;YACrC,qCAAqC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4GAA4G,EAAE,GAAG,EAAE;QACpH,0FAA0F;QAC1F,2FAA2F;QAC3F,wFAAwF;QACxF,wFAAwF;QACxF,qDAAqD;QACrD,eAAe,CAAC;YACd,8CAA8C,EAAE,EAAE;YAClD,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,8BAA8B;YACtE,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,GAAG,EAAE;QACvG,eAAe,CAAC;YACd,8CAA8C,EAAE,0CAA0C;YAC1F,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;YAC1C,0FAA0F;YAC1F,yFAAyF;YACzF,uDAAuD;SACxD,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,eAAe,CAAC;YACd,8CAA8C,EAAE,KAAK;YACrD,iCAAiC,EAAE,WAAW;YAC9C,sCAAsC,EAAE,MAAM;YAC9C,2BAA2B,EAAE,QAAQ;YACrC,+BAA+B,EAAE,SAAS;SAC3C,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/state.d.ts

@@ -0,0 +1,60 @@
+/**
+ * CLI setup state resolution — determines where the user is in the setup journey
+ * and what render tier to use for output.
+ *
+ * WP-325 S1: Foundation utilities consumed by S2 (index.ts) and S3 (connect.ts).
+ * No callers wired in this slice — this is the shared substrate.
+ *
+ * Stage model:
+ *   unconfigured     → no API key found anywhere
+ *   authenticated    → API key present, but workspace unreachable (offline or not yet connected)
+ *   workspace-bound  → key + workspace reachable, but no active session
+ *   active           → key + workspace + active session
+ */
+import { type ConfigFailureKind } from './config.js';
+/** Four-stage setup journey from cold start to active use. */
+export type SetupStage = 'unconfigured' | 'authenticated' | 'workspace-bound' | 'active';
+export interface SetupState {
+    stage: SetupStage;
+    /** Human-readable list of what is still missing. Empty when stage === 'active'. */
+    missingSteps: string[];
+    /** Single most important next command to run. */
+    nextAction: string;
+    /** Workspace name — populated when workspace probe succeeds. */
+    workspaceName?: string;
+    /** Total entry count from the workspace — populated when workspace probe succeeds. */
+    entryCount?: number;
+    /** Whether a write session is currently active. */
+    sessionActive?: boolean;
+    /** Exact local-binding failure, when this is more specific than ordinary first-time setup. */
+    configurationIssue?: {
+        kind: ConfigFailureKind;
+        reason: string;
+        guidance: string;
+    };
+}
+/** Output render tier for the current runtime context. */
+export type RenderTier = 'json' | 'plain' | 'ink';
+/**
+ * Determine the user's current setup stage and surface what's missing.
+ *
+ * Resolution order mirrors the config cascade (getConfigSafe → probeWorkspace → readSession).
+ * Each step is attempted only if the previous one succeeded, matching how the system
+ * actually behaves when a command runs.
+ *
+ * Network calls: probeWorkspace() makes one lightweight orient call. If the caller is in a
+ * context where network is unavailable, this returns 'authenticated' rather than throwing.
+ */
+export declare function resolveSetupState(): Promise<SetupState>;
+/**
+ * Determine the appropriate output rendering tier for the current process context.
+ *
+ * Priority:
+ *   json  → isJsonMode() is true (explicit --json flag or PB_JSON=1 env var — piping alone does
+ *           NOT switch modes, WP-744 / 1e-B; formerly `!process.stdout.isTTY` alone)
+ *   plain → stdout is not a TTY (but isJsonMode() was false — e.g. piped output with no --json/
+ *           PB_JSON=1, or --pretty on a pipe)
+ *   ink   → interactive TTY, Ink React rendering is safe
+ */
+export declare function detectRenderTier(): RenderTier;
+//# sourceMappingURL=state.d.ts.map

package/dist/lib/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/lib/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AASpE,8DAA8D;AAC9D,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAEzF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,mFAAmF;IACnF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE;QACnB,IAAI,EAAE,iBAAiB,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAMlD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,UAAU,CAAC,CAgD7D;AAMD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAI7C"}

package/dist/lib/state.js

@@ -0,0 +1,97 @@
+/**
+ * CLI setup state resolution — determines where the user is in the setup journey
+ * and what render tier to use for output.
+ *
+ * WP-325 S1: Foundation utilities consumed by S2 (index.ts) and S3 (connect.ts).
+ * No callers wired in this slice — this is the shared substrate.
+ *
+ * Stage model:
+ *   unconfigured     → no API key found anywhere
+ *   authenticated    → API key present, but workspace unreachable (offline or not yet connected)
+ *   workspace-bound  → key + workspace reachable, but no active session
+ *   active           → key + workspace + active session
+ */
+import { getConfigSafe } from './config.js';
+import { probeWorkspace } from './workspace-probe.js';
+import { readSession } from './session.js';
+import { isJsonMode } from './runner.js';
+// ---------------------------------------------------------------------------
+// resolveSetupState
+// ---------------------------------------------------------------------------
+/**
+ * Determine the user's current setup stage and surface what's missing.
+ *
+ * Resolution order mirrors the config cascade (getConfigSafe → probeWorkspace → readSession).
+ * Each step is attempted only if the previous one succeeded, matching how the system
+ * actually behaves when a command runs.
+ *
+ * Network calls: probeWorkspace() makes one lightweight orient call. If the caller is in a
+ * context where network is unavailable, this returns 'authenticated' rather than throwing.
+ */
+export async function resolveSetupState() {
+    // Step 1 — is an API key configured?
+    const configResult = getConfigSafe();
+    if (!configResult.ok) {
+        return {
+            stage: 'unconfigured',
+            missingSteps: [configResult.reason],
+            nextAction: configResult.nextCommand,
+            configurationIssue: {
+                kind: configResult.kind,
+                reason: configResult.reason,
+                guidance: configResult.guidance,
+            },
+        };
+    }
+    // Step 2 — can we reach the workspace?
+    const wsInfo = await probeWorkspace();
+    if (!wsInfo) {
+        return {
+            stage: 'authenticated',
+            missingSteps: ['Workspace not connected or unreachable'],
+            nextAction: 'pb connect',
+        };
+    }
+    // Step 3 — is there an active write session?
+    const session = readSession();
+    if (!session) {
+        return {
+            stage: 'workspace-bound',
+            missingSteps: ['No active write session'],
+            nextAction: 'pb session start',
+            workspaceName: wsInfo.name,
+            entryCount: wsInfo.entryCount,
+            sessionActive: false,
+        };
+    }
+    // All steps satisfied — fully active
+    return {
+        stage: 'active',
+        missingSteps: [],
+        nextAction: 'pb orient -b',
+        workspaceName: wsInfo.name,
+        entryCount: wsInfo.entryCount,
+        sessionActive: true,
+    };
+}
+// ---------------------------------------------------------------------------
+// detectRenderTier
+// ---------------------------------------------------------------------------
+/**
+ * Determine the appropriate output rendering tier for the current process context.
+ *
+ * Priority:
+ *   json  → isJsonMode() is true (explicit --json flag or PB_JSON=1 env var — piping alone does
+ *           NOT switch modes, WP-744 / 1e-B; formerly `!process.stdout.isTTY` alone)
+ *   plain → stdout is not a TTY (but isJsonMode() was false — e.g. piped output with no --json/
+ *           PB_JSON=1, or --pretty on a pipe)
+ *   ink   → interactive TTY, Ink React rendering is safe
+ */
+export function detectRenderTier() {
+    if (isJsonMode())
+        return 'json';
+    if (!process.stdout.isTTY)
+        return 'plain';
+    return 'ink';
+}
+//# sourceMappingURL=state.js.map

package/dist/lib/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/lib/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAA0B,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgCzC,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,qCAAqC;IACrC,MAAM,YAAY,GAAG,aAAa,EAAE,CAAC;IACrC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,YAAY,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;YACnC,UAAU,EAAE,YAAY,CAAC,WAAW;YACpC,kBAAkB,EAAE;gBAClB,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC;SACF,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,CAAC,wCAAwC,CAAC;YACxD,UAAU,EAAE,YAAY;SACzB,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,iBAAiB;YACxB,YAAY,EAAE,CAAC,yBAAyB,CAAC;YACzC,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa,EAAE,KAAK;SACrB,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,cAAc;QAC1B,aAAa,EAAE,MAAM,CAAC,IAAI;QAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,UAAU,EAAE;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/strip.d.ts

@@ -8,5 +8,22 @@
  * Chain: DEC-299 (JSON-default output), TEN-340 (Convex internal exposure)
  */
 export declare function stripControlChars(str: string): string;
+/** Round 4 (quiet-sweep item 1): stripControlChars deliberately excludes `\x0a` (newline) —
+ *  legitimate for multiline text, but a field rendered as ONE terminal line (a digest bullet,
+ *  a formatted label) must never let an embedded `\n`/`\r`/`\t` inject extra, unprefixed
+ *  lines. Collapses every whitespace run to a single space, after stripping control chars —
+ *  the same `stripControlChars(v).replace(/\s+/g, ' ').trim()` idiom already duplicated across
+ *  this package's formatters (shape.ts, conflicts.ts, direction.ts, feedback.ts, questions.ts,
+ *  sessionNotices.ts); centralized here as the shared, single-line-safe sanitizer. */
+export declare function sanitizeSingleLineField(str: string): string;
+/**
+ * Round 15 (Codex P2, PR #912/#916): reversibly escape control chars/non-printables in a
+ * filesystem-derived identifier (a path or filename) for terminal display. Unlike
+ * `sanitizeSingleLineField` — which DELETES control chars and COLLAPSES whitespace runs, fine
+ * for a Chain-entry label but lossy for a filename a user is told to go find and remove — this
+ * escapes each unsafe byte as `\t`/`\n`/`\r` or `\xNN`, byte-for-byte recoverable, and leaves
+ * ordinary spaces untouched so e.g. "safe  name.mdc" and "safe name.mdc" still render distinctly.
+ */
+export declare function renderFilesystemPath(value: string): string;
 export declare function stripConvexInternals<T>(data: T): T;
 //# sourceMappingURL=strip.d.ts.map

package/dist/lib/strip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strip.d.ts","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAelD"}
+{"version":3,"file":"strip.d.ts","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2BH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;;;;sFAMsF;AACtF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa1D;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAelD"}

package/dist/lib/strip.js

@@ -16,13 +16,60 @@ const STRIP_KEYS = new Set(['_id', '_creationTime']);
  *
  * BET-269: Security baseline — C3 (CLI terminal escaping).
  */
+// Note: the CSI/OSC alternatives MUST precede the bare control-char class. Regex
+// alternation takes the first matching alternative at a given position, not the
+// longest — with the control-char class first, a lone ESC (0x1b, inside \x0b-\x1f)
+// matches and consumes before the longer `\x1b\[...` sequence gets a chance,
+// stripping only the ESC and leaving the rest of the escape sequence (e.g. `[31m`)
+// behind as inert-but-visible text (found via PR #341 review Finding 2 testing).
+// Late-fix consolidation round 1 (PRRT_kwDORS4ils6Y0pz3, P1): the control-char class
+// used to jump \x0b\x0c straight to \x0e-\x1f, deliberately skipping \x0d (carriage
+// return) — but a bare \r moves the terminal cursor to column zero and lets the
+// remaining attacker-controlled text overwrite/spoof the start of the line, so (unlike
+// \t/\n, which carry a legitimate multiline-formatting use) it belongs in the stripped
+// set. \x0b-\x1f is now one contiguous range (still excludes \x09 tab and \x0a newline).
 // eslint-disable-next-line no-control-regex
-const ANSI_AND_CONTROL_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]|\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07]*\x07|\x1b[^[\]0-9;A-Za-z]?/g;
+const ANSI_AND_CONTROL_RE = /\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07]*\x07|\x1b[^[\]0-9;A-Za-z]?|[\x00-\x08\x0b-\x1f\x7f]/g;
 export function stripControlChars(str) {
     if (!str)
         return str;
     return str.replace(ANSI_AND_CONTROL_RE, '');
 }
+/** Round 4 (quiet-sweep item 1): stripControlChars deliberately excludes `\x0a` (newline) —
+ *  legitimate for multiline text, but a field rendered as ONE terminal line (a digest bullet,
+ *  a formatted label) must never let an embedded `\n`/`\r`/`\t` inject extra, unprefixed
+ *  lines. Collapses every whitespace run to a single space, after stripping control chars —
+ *  the same `stripControlChars(v).replace(/\s+/g, ' ').trim()` idiom already duplicated across
+ *  this package's formatters (shape.ts, conflicts.ts, direction.ts, feedback.ts, questions.ts,
+ *  sessionNotices.ts); centralized here as the shared, single-line-safe sanitizer. */
+export function sanitizeSingleLineField(str) {
+    return stripControlChars(str).replace(/\s+/g, ' ').trim();
+}
+const FILESYSTEM_PATH_ESCAPES = { '\t': '\\t', '\n': '\\n', '\r': '\\r' };
+/**
+ * Round 15 (Codex P2, PR #912/#916): reversibly escape control chars/non-printables in a
+ * filesystem-derived identifier (a path or filename) for terminal display. Unlike
+ * `sanitizeSingleLineField` — which DELETES control chars and COLLAPSES whitespace runs, fine
+ * for a Chain-entry label but lossy for a filename a user is told to go find and remove — this
+ * escapes each unsafe byte as `\t`/`\n`/`\r` or `\xNN`, byte-for-byte recoverable, and leaves
+ * ordinary spaces untouched so e.g. "safe  name.mdc" and "safe name.mdc" still render distinctly.
+ */
+export function renderFilesystemPath(value) {
+    let out = '';
+    for (const ch of value) {
+        const code = ch.codePointAt(0) ?? 0;
+        if (FILESYSTEM_PATH_ESCAPES[ch]) {
+            out += FILESYSTEM_PATH_ESCAPES[ch];
+        }
+        else if (code < 0x20 || code === 0x7f) {
+            out += `\\x${code.toString(16).padStart(2, '0')}`;
+        }
+        else {
+            out += ch;
+        }
+    }
+    return out;
+}
 export function stripConvexInternals(data) {
     if (Array.isArray(data)) {
         return data.map((item) => stripConvexInternals(item));

package/dist/lib/strip.js.map

@@ -1 +1 @@
-{"version":3,"file":"strip.js","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAErD;;;;;;;GAOG;AACH,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG,kGAAkG,CAAC;AAE/H,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAI,IAAO;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAiB,CAAC;IACxE,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAsB,CAAC;IAChC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"strip.js","sourceRoot":"","sources":["../../src/lib/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAErD;;;;;;;GAOG;AACH,iFAAiF;AACjF,gFAAgF;AAChF,mFAAmF;AACnF,6EAA6E;AAC7E,mFAAmF;AACnF,iFAAiF;AACjF,qFAAqF;AACrF,oFAAoF;AACpF,gFAAgF;AAChF,uFAAuF;AACvF,uFAAuF;AACvF,yFAAyF;AACzF,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG,0FAA0F,CAAC;AAEvH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;sFAMsF;AACtF,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,uBAAuB,GAA2B,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAElG;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,uBAAuB,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,GAAG,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACxC,GAAG,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAI,IAAO;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAiB,CAAC;IACxE,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAsB,CAAC;IAChC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/style.d.ts

@@ -8,12 +8,15 @@
  * All color output respects NO_COLOR env (https://no-color.org/) and TTY detection.
  * Quiet mode suppresses banners, hints, and progress — only essential results show.
  */
+import { type DeploymentTier } from './deployment.js';
 /** Returns true if the terminal supports color output. */
 export declare function supportsColor(): boolean;
 export declare const green: (s: string) => string;
 export declare const red: (s: string) => string;
 export declare const yellow: (s: string) => string;
 export declare const cyan: (s: string) => string;
+export declare const magenta: (s: string) => string;
+export declare const blue: (s: string) => string;
 export declare const dim: (s: string) => string;
 export declare const bold: (s: string) => string;
 export declare const icons: {
@@ -63,17 +66,22 @@ export declare function heading(text: string): string;
  */
 export declare function formatCheck(status: 'pass' | 'fail' | 'warn', label: string, detail: string): string;
 /**
- * Print an environment-aware admin banner. Suppressed in quiet mode.
+ * Colored deployment-tier tag — shared by `adminBanner` and any other surface (e.g. `pb profile
+ * create`'s receipt, WP-744 / 1e-B) that needs to name which tier a resolved host classifies as.
  *
  * Labels:
  * - [DEV] — localhost loopback
  * - [DEV·CLOUD] — known Convex Development (Cloud) deployment
  * - [PROD] — known production gateway / prod Convex deployment
  * - [CLOUD] — other remote URL (unknown tier)
+ */
+export declare function deploymentBadge(tier: DeploymentTier): string;
+/**
+ * Print an environment-aware admin banner. Suppressed in quiet mode.
  *
  * Format: "⚡ pb admin — [ENV] <host>"
  */
-export declare function adminBanner(siteUrl: string): void;
+export declare function adminBanner(siteUrl: string, profileLabel?: string): void;
 /**
  * Prompt for confirmation before a destructive admin operation (remote deployments).
  *

package/dist/lib/style.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"style.d.ts","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,0DAA0D;AAC1D,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAMD,eAAO,MAAM,KAAK,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC1F,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACxF,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC3F,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACzF,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AACvF,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AAMxF,eAAO,MAAM,KAAK;;;;;;CAMR,CAAC;AAMX,eAAO,MAAM,IAAI;;;;;;;;;;;;;gCAkBI,MAAM;sCACA,MAAM;CACvB,CAAC;AAMX;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG1C;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvC;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG3C;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASnG;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAoBjD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CASnB"}
+{"version":3,"file":"style.d.ts","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAqC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAQzF,0DAA0D;AAC1D,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAMD,eAAO,MAAM,KAAK,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC1F,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACxF,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC3F,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACzF,eAAO,MAAM,OAAO,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AAC5F,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAuD,CAAC;AACzF,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AACvF,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AAMxF,eAAO,MAAM,KAAK;;;;;;CAMR,CAAC;AAMX,eAAO,MAAM,IAAI;;;;;;;;;;;;;gCAkBI,MAAM;sCACA,MAAM;CACvB,CAAC;AAMX;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG1C;AAED;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvC;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG3C;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASnG;AAMD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAW5D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAWxE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CASnB"}

package/dist/lib/style.js

@@ -25,6 +25,8 @@ export const green = (s) => (supportsColor() ? `\x1b[32m${s}\x1b[0m` : s);
 export const red = (s) => (supportsColor() ? `\x1b[31m${s}\x1b[0m` : s);
 export const yellow = (s) => (supportsColor() ? `\x1b[33m${s}\x1b[0m` : s);
 export const cyan = (s) => (supportsColor() ? `\x1b[36m${s}\x1b[0m` : s);
+export const magenta = (s) => (supportsColor() ? `\x1b[35m${s}\x1b[0m` : s);
+export const blue = (s) => (supportsColor() ? `\x1b[34m${s}\x1b[0m` : s);
 export const dim = (s) => (supportsColor() ? `\x1b[2m${s}\x1b[0m` : s);
 export const bold = (s) => (supportsColor() ? `\x1b[1m${s}\x1b[0m` : s);
 // ---------------------------------------------------------------------------
@@ -111,36 +113,43 @@ export function formatCheck(status, label, detail) {
 // Admin UX framework (WP-312 S2, FEAT-972)
 // ---------------------------------------------------------------------------
 /**
- * Print an environment-aware admin banner. Suppressed in quiet mode.
+ * Colored deployment-tier tag — shared by `adminBanner` and any other surface (e.g. `pb profile
+ * create`'s receipt, WP-744 / 1e-B) that needs to name which tier a resolved host classifies as.
  *
  * Labels:
  * - [DEV] — localhost loopback
  * - [DEV·CLOUD] — known Convex Development (Cloud) deployment
  * - [PROD] — known production gateway / prod Convex deployment
  * - [CLOUD] — other remote URL (unknown tier)
- *
- * Format: "⚡ pb admin — [ENV] <host>"
  */
-export function adminBanner(siteUrl) {
-    if (isQuietMode())
-        return;
-    const host = parseHostname(siteUrl);
-    const tier = classifyDeployment(siteUrl);
-    let envTag;
+export function deploymentBadge(tier) {
     switch (tier) {
         case 'local':
-            envTag = green('[DEV]');
-            break;
+            return green('[DEV]');
         case 'prod':
-            envTag = red('[PROD]');
-            break;
+            return red('[PROD]');
         case 'dev-cloud':
-            envTag = cyan('[DEV·CLOUD]');
-            break;
+            return cyan('[DEV·CLOUD]');
         default:
-            envTag = yellow('[CLOUD]');
+            return yellow('[CLOUD]');
     }
-    process.stdout.write(`\n${bold(`\u26A1 pb admin`)} ${dim('\u2014')} ${envTag} ${dim(host)}\n\n`);
+}
+/**
+ * Print an environment-aware admin banner. Suppressed in quiet mode.
+ *
+ * Format: "⚡ pb admin — [ENV] <host>"
+ */
+export function adminBanner(siteUrl, profileLabel) {
+    if (isQuietMode())
+        return;
+    const host = parseHostname(siteUrl);
+    const envTag = deploymentBadge(classifyDeployment(siteUrl));
+    // WP-681: name WHICH credential resolved the target, not just the tier - the env tag alone
+    // never told you which of possibly several profiles put you there (the live-reproduced bug
+    // this closes: `pb admin run` silently resolving the operator's global profile - often prod -
+    // even inside a repo explicitly pinned to a dev-scoped one).
+    const profileSuffix = profileLabel ? ` ${dim(`(profile: ${profileLabel})`)}` : '';
+    process.stdout.write(`\n${bold(`\u26A1 pb admin`)} ${dim('\u2014')} ${envTag} ${dim(host)}${profileSuffix}\n\n`);
 }
 /**
  * Prompt for confirmation before a destructive admin operation (remote deployments).

package/dist/lib/style.js.map

@@ -1 +1 @@
-{"version":3,"file":"style.js","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,aAAa,EAAoB,IAAI,IAAI,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,QAAQ,EAAI,YAAY;IAC9B,IAAI,EAAE,QAAQ,EAAI,IAAI;IACtB,IAAI,EAAE,QAAQ,EAAI,mBAAmB;IACrC,KAAK,EAAE,QAAQ,EAAG,cAAc;IAChC,GAAG,EAAE,QAAQ,EAAK,aAAa;CACvB,CAAC;AAEX,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,oBAAoB;IACpB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,UAAU;IACnB,cAAc,EAAE,kBAAkB;IAClC,aAAa,EAAE,iBAAiB;IAEhC,kBAAkB;IAClB,SAAS,EAAE,kDAAkD;IAC7D,eAAe,EAAE,kDAAkD;IACnE,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,wBAAwB;IAEpC,oBAAoB;IACpB,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,gBAAgB,OAAO,EAAE;IACvD,UAAU,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,qBAAqB,UAAU,EAAE;CAC7D,CAAC;AAEX,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAgC,EAAE,KAAa,EAAE,MAAc;IACzF,MAAM,IAAI,GACR,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACnB,CAAC,CAAC,MAAM,KAAK,MAAM;YACjB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,WAAW,EAAE;QAAE,OAAO;IAE1B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAc,CAAC;IACnB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR,KAAK,MAAM;YACT,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM;QACR,KAAK,WAAW;YACd,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7B,MAAM;QACR;YACE,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAMvC;IACC,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IAClE,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"style.js","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAuB,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,aAAa,EAAoB,IAAI,IAAI,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,QAAQ,EAAI,YAAY;IAC9B,IAAI,EAAE,QAAQ,EAAI,IAAI;IACtB,IAAI,EAAE,QAAQ,EAAI,mBAAmB;IACrC,KAAK,EAAE,QAAQ,EAAG,cAAc;IAChC,GAAG,EAAE,QAAQ,EAAK,aAAa;CACvB,CAAC;AAEX,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,oBAAoB;IACpB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,UAAU;IACnB,cAAc,EAAE,kBAAkB;IAClC,aAAa,EAAE,iBAAiB;IAEhC,kBAAkB;IAClB,SAAS,EAAE,kDAAkD;IAC7D,eAAe,EAAE,kDAAkD;IACnE,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,wBAAwB;IAEpC,oBAAoB;IACpB,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,gBAAgB,OAAO,EAAE;IACvD,UAAU,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,qBAAqB,UAAU,EAAE;CAC7D,CAAC;AAEX,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAgC,EAAE,KAAa,EAAE,MAAc;IACzF,MAAM,IAAI,GACR,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACnB,CAAC,CAAC,MAAM,KAAK,MAAM;YACjB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvB,KAAK,WAAW;YACd,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B;YACE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,YAAqB;IAChE,IAAI,WAAW,EAAE;QAAE,OAAO;IAE1B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,2FAA2F;IAC3F,2FAA2F;IAC3F,8FAA8F;IAC9F,6DAA6D;IAC7D,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,YAAY,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,MAAM,CAAC,CAAC;AACnH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAMvC;IACC,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IAClE,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/lib/tokenConstants.d.ts

@@ -9,6 +9,8 @@
 export declare const API_KEY_PREFIX = "pb_sk_";
 /** Prefix for short-lived connect tokens (15-min, single-use). */
 export declare const CONNECT_TOKEN_PREFIX = "pb_ct_";
+/** Prefix for preview-only admin proof-bridge tokens (≤24h, workspace-pinned; WP-459). */
+export declare const PREVIEW_ADMIN_TOKEN_PREFIX = "pb_pat_";
 /**
  * Length of the random hex component in generated API keys.
  * 32 hex chars = 128-bit entropy.

package/dist/lib/tokenConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenConstants.d.ts","sourceRoot":"","sources":["../../src/lib/tokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qDAAqD;AACrD,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC"}
+{"version":3,"file":"tokenConstants.d.ts","sourceRoot":"","sources":["../../src/lib/tokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qDAAqD;AACrD,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC"}

package/dist/lib/tokenConstants.js

@@ -9,6 +9,8 @@
 export const API_KEY_PREFIX = 'pb_sk_';
 /** Prefix for short-lived connect tokens (15-min, single-use). */
 export const CONNECT_TOKEN_PREFIX = 'pb_ct_';
+/** Prefix for preview-only admin proof-bridge tokens (≤24h, workspace-pinned; WP-459). */
+export const PREVIEW_ADMIN_TOKEN_PREFIX = 'pb_pat_';
 /**
  * Length of the random hex component in generated API keys.
  * 32 hex chars = 128-bit entropy.

package/dist/lib/tokenConstants.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenConstants.js","sourceRoot":"","sources":["../../src/lib/tokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEvC,kEAAkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC"}
+{"version":3,"file":"tokenConstants.js","sourceRoot":"","sources":["../../src/lib/tokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEvC,kEAAkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC"}