@productbrain/cli 0.1.0-beta.72 → 0.1.0-beta.7204

package/dist/commands/outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.d.ts","sourceRoot":"","sources":["../../src/commands/outcome.ts"],"names":[],"mappings":"AAmCA;mGACmG;AACnG,QAAA,MAAM,aAAa,oDAAqD,CAAC;AACzE,KAAK,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IAC1B;;;mEAG+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,UAAU,kBAAkB;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,UAAU,EAAE,CAAC;CACvB;AAsBD,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAyEf;AAuCD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAAG,MAAM,CAa7F;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAchG;AAED,UAAU,iBAAiB;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,OAAO,EAAE;QACR,OAAO,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,iBAAiB,EAAE,MAAM,CAAC;QAC1B,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,YAAY,EAAE,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC;QAC3C,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,SAAS,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;QACtD,YAAY,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC;CACF;AAUD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,GAAG,MAAM,CA0B1E;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnE"}

package/dist/commands/outcome.js

@@ -0,0 +1,203 @@
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCall, kernelCallWithSession } from '../lib/client.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { runCliCommand } from '../lib/runner.js';
+import { sanitizeSingleLineField } from '../lib/strip.js';
+/** Mirrors the door's own `kind` union (`convex/outcomes/readings.ts`). Kept as a literal list so
+ *  a bad value is refused HERE, naming the legal set, rather than as an opaque validator error. */
+const READING_KINDS = ['measurement', 'estimate', 'correction'];
+const validation = (message, guidance) => new CLIError(message, { code: ErrorCode.VALIDATION_FAILED, category: 'validation', guidance });
+/** argv is strings; the door wants a number. `Number('')` is 0 and `Number(' ')` is 0, so the
+ *  blank cases are rejected explicitly rather than silently recorded as a reading of zero — which
+ *  would be a wrong MEASUREMENT, the one thing this table exists to get right. */
+function requireNumber(raw, flag) {
+    const trimmed = raw.trim();
+    const parsed = Number(trimmed);
+    if (trimmed === '' || !Number.isFinite(parsed)) {
+        throw validation(`${flag} must be a number (got "${raw}").`, 
+        // Placeholder, not a concrete id: a real-looking entry id in a user-facing string is a
+        // Chain-id leak (the pre-commit guard refuses it) and reads as a live reference.
+        `Example: pb outcome record <ENTRY-ID> 62${flag === '--limit' ? '' : ' --note "from the weekly dashboard"'}`);
+    }
+    return parsed;
+}
+export async function runOutcomeRecord(entryId, value, options) {
+    // Refuse everything refusable BEFORE the network call, so a malformed invocation costs no
+    // round trip and reports in the caller's own vocabulary rather than the validator's.
+    const numericValue = requireNumber(value, 'value');
+    if (options.kind !== undefined && !READING_KINDS.includes(options.kind)) {
+        throw validation(`--kind must be one of ${READING_KINDS.join(', ')} (got "${options.kind}").`, 'Use --kind estimate for a figure that is not directly measured, or --kind correction with --corrects to replace an earlier reading.');
+    }
+    // Both directions: the door refuses each, and a CLI that guards only one still sends a
+    // request it already knows will fail.
+    if (options.corrects !== undefined && options.kind !== 'correction') {
+        throw validation('--corrects is only meaningful with --kind correction.', 'Add --kind correction, or drop --corrects to record an ordinary reading.');
+    }
+    if (options.kind === 'correction' && options.corrects === undefined) {
+        throw validation('--kind correction requires --corrects <READING-ID>.', 'A correction must name the reading it replaces — find it with `pb outcome list <ENTRY-ID>`.');
+    }
+    let asOf;
+    if (options.asOf !== undefined) {
+        const parsed = Date.parse(options.asOf);
+        if (Number.isNaN(parsed)) {
+            throw validation(`--as-of must be a parseable date (got "${options.asOf}").`, 'Example: --as-of 2026-03-01. Back-dating is legitimate — a backfill shows up as asOf earlier than recordedAt.');
+        }
+        asOf = parsed;
+    }
+    const config = await getConfigOrGuide(() => runOutcomeRecord(entryId, value, options));
+    if (!config)
+        return;
+    await runCliCommand({
+        // Session-attributed on purpose: a reading's provenance is the point, and the plain caller
+        // would drop the session the tier derivation compares against the entry's created row.
+        // Every optional is spread conditionally — a key present-but-undefined is not the same as
+        // absent to the validator, and the door's own defaults must win when the caller is silent.
+        fn: () => kernelCallWithSession('outcomes.recordReading', {
+            entryId,
+            value: numericValue,
+            ...(asOf !== undefined ? { asOf } : {}),
+            ...(options.kind ? { kind: options.kind } : {}),
+            ...(options.corrects ? { correctsReadingId: options.corrects } : {}),
+            ...(options.byRole ? { recordedByRoleId: options.byRole } : {}),
+            ...(options.note ? { note: options.note } : {}),
+            ...(options.source ? { source: options.source } : {}),
+            ...(options.valueText ? { valueText: options.valueText } : {}),
+        }),
+        formatPretty: (value_) => {
+            const receipt = value_;
+            const tier = receipt?.independenceTier ?? 'unknown';
+            const lines = [
+                // Same sanitiser, same reason — this line is echoed straight to the terminal.
+                `Recorded ${numericValue}${options.valueText ? ` ("${sanitizeSingleLineField(options.valueText)}")` : ''} on ${sanitizeSingleLineField(entryId)}.`,
+                // The tier is DERIVED server-side from the credential — printed here so the caller
+                // sees what was actually attributed, never what they might have assumed.
+                `  attributed: ${receipt?.actorKind ?? 'unknown'} · independence: ${tier}`,
+            ];
+            if (tier === 'provenance_unknown') {
+                lines.push('  (no session named, so provenance is unknown — that is the honest answer, not an error)');
+            }
+            return lines.join('\n');
+        },
+    });
+}
+/**
+ * Pretty rendering for `pb outcome list`. Exported so the spec'd behaviours here are asserted
+ * directly rather than only through a live walk: superseded rows are SHOWN (the ledger is
+ * append-only and the correction chain is the audit trail) and marked with the id that replaced
+ * them, and `pageExhausted: false` is reported rather than letting a bounded page read as the
+ * whole history.
+ *
+ * **Every value that did not originate in this file is sanitised** (PR #840 security review).
+ * `note` and `valueText` are free text written by ANY connector that can call
+ * `outcomes.recordReading` — agents included — and this rendering is the operator's AUDIT VIEW.
+ * An embedded newline would inject extra, unprefixed lines that look exactly like additional
+ * readings: forged evidence in the one surface someone would use to check evidence. `\r` can
+ * overwrite the line that was already drawn, and CSI/OSC sequences can retitle or clear the
+ * operator's terminal. `sanitizeSingleLineField` (`lib/strip.js`) is the package's shared,
+ * single-line-safe sanitiser — the same one `shape`, `conflicts`, `feedback`, `direction` and
+ * `questions` use — and its own docblock exists for precisely this case, because
+ * `stripControlChars` deliberately keeps `\n`. Not hand-rolled here on purpose.
+ *
+ * `entryId` is echoed from argv rather than stored, so it is self-inflicted — sanitised anyway,
+ * since it costs nothing and a pasted command is a real way to reach it. The remaining
+ * interpolations need no sanitising and it would obscure the reasoning to add it: `kind` and
+ * `independenceTier` are Convex union literals the validator constrains, `readingId` and
+ * `supersededByReadingId` are Convex document ids, `value` is a number, and `when` is derived
+ * from a number through `toISOString`.
+ */
+/** PR #872 review round 3 (Codex P2): mirrors `packages/mcp-server/src/tools/outcome.ts`'s
+ *  `safeDateSlice` — a reading written through the existing API route is validated only with
+ *  `v.number()`, so a finite-but-Date-invalid `asOf`/`nextDueAt` (e.g. `1e100`) can be persisted.
+ *  `new Date(x).toISOString()` throws `RangeError` for such a value, which would otherwise take
+ *  down the whole `pb outcome list`/`show` command over one malformed legacy row. Not shared code
+ *  with the MCP tool (the two packages do not cross-import, same door-parity precedent every
+ *  other CLI/MCP formatter pair in this codebase follows) — content-equal by construction. */
+function safeDateSlice(ms) {
+    const d = new Date(ms);
+    return Number.isNaN(d.getTime()) ? 'invalid-date' : d.toISOString().slice(0, 10);
+}
+export function formatReadingsList(entryId, result) {
+    const safeEntryId = sanitizeSingleLineField(entryId);
+    const rows = result?.readings ?? [];
+    if (rows.length === 0)
+        return `No readings recorded on ${safeEntryId} yet.`;
+    const lines = rows.map((row) => {
+        const when = safeDateSlice(row.asOf);
+        const superseded = row.supersededByReadingId ? `  <- superseded by ${row.supersededByReadingId}` : '';
+        const text = row.valueText ? ` ("${sanitizeSingleLineField(row.valueText)}")` : '';
+        const note = row.note ? `  - ${sanitizeSingleLineField(row.note)}` : '';
+        return `  ${when}  ${String(row.value).padStart(8)}${text}  [${row.kind}\u00b7${row.independenceTier}]  ${row.readingId}${note}${superseded}`;
+    });
+    const tail = result?.pageExhausted === false ? '\n  (older readings not loaded - raise --limit)' : '';
+    return `${rows.length} reading(s) on ${safeEntryId}, newest first:\n${lines.join('\n')}${tail}`;
+}
+export async function runOutcomeList(entryId, options) {
+    const limit = options.limit !== undefined ? requireNumber(options.limit, '--limit') : undefined;
+    const config = await getConfigOrGuide(() => runOutcomeList(entryId, options));
+    if (!config)
+        return;
+    await runCliCommand({
+        // A read: no session required. Demanding one would break `pb outcome list` for a caller
+        // holding a valid key who simply has not started a session.
+        fn: () => kernelCall('outcomes.listReadings', {
+            entryId,
+            ...(limit !== undefined ? { limit } : {}),
+        }),
+        formatPretty: (value_) => formatReadingsList(entryId, value_),
+    });
+}
+const pct = (v, unit = '%') => (v === undefined ? '—' : `${Math.round(v * 10) / 10}${unit}`);
+/** `role.name` is an `entries.name` resolved server-side, so it is stored content written by any
+ *  connector that can update entries — agents included — and reaches the operator's terminal
+ *  through this line. Same sink class as `note`/`valueText`, and it must be sanitised for the same
+ *  reason: an embedded newline injects an unprefixed line into the audit view. */
+const roleLabel = (role) => role === null ? 'not set' : role.name === null ? 'a role that no longer exists' : sanitizeSingleLineField(role.name);
+/**
+ * Pretty rendering for `pb outcome show`. Exported for the same reason `formatReadingsList` is:
+ * the honesty rules here are assertable claims, not styling.
+ *
+ * Two of them are load-bearing. **A blank is never printed as a zero** — `progressPct` is
+ * `undefined` for a never-measured key result and `—` says that, where `0%` would read as a
+ * measurement. And **the recorded completion is never called "confirmed" or "verified"** — it
+ * reports what was recorded and where that came from, because nothing in this run verifies a
+ * close, and a surface that implies otherwise is the failure the whole provenance field exists to
+ * prevent.
+ */
+export function formatOutcomeShow(result) {
+    if (!result)
+        return 'No outcome found.';
+    const o = result.outcome;
+    const unit = o.unit ? ` ${sanitizeSingleLineField(o.unit)}` : '';
+    const lines = [
+        `${sanitizeSingleLineField(result.entryId)} — ${sanitizeSingleLineField(result.name)}`,
+        `  metric      ${o.metric ? sanitizeSingleLineField(o.metric) : 'not set'}`,
+        // The honest blank: undefined is "never measured", which is not zero.
+        `  current     ${o.current ? `${o.current.value}${unit}` : 'no readings yet'}   (${o.readingCount} reading(s))`,
+        `  progress    ${pct(o.progressPct)}   direction ${o.direction}`,
+        `  pace        ${pct(o.pacePct)}   ${o.pacePct === undefined ? '(no cycle end set)' : o.pacePct >= 0 ? '(ahead of pace)' : '(behind pace)'}`,
+        `  state       ${o.state}${o.hasNoReadings ? ' — never read' : ''}${o.overdueByMs ? ` (by ${Math.floor(o.overdueByMs / 86400000)}d)` : ''}`,
+        `  next due    ${o.nextDueAt ? safeDateSlice(o.nextDueAt) : 'no cadence set'}`,
+        `  owner       ${roleLabel(o.ownerRole)}`,
+        `  reporter    ${roleLabel(o.reporterRole)}`,
+        // Recorded, with its provenance. Never "confirmed", never "verified".
+        `  completion  recorded as ${o.completion} (source: ${o.completionProvenance})`,
+        `  attestation weakest in cycle: ${o.weakestTierInCycle ?? 'none recorded'} — reported, not enforced`,
+    ];
+    if (o.currentResolution === 'page-exhausted') {
+        lines.push('  note        every loaded reading is superseded and more remain — this is not "never read"');
+    }
+    if (result.readyToCloseInstruction) {
+        lines.push('', `  ${result.readyToCloseInstruction}`);
+    }
+    return lines.join('\n');
+}
+export async function runOutcomeShow(entryId) {
+    const config = await getConfigOrGuide(() => runOutcomeShow(entryId));
+    if (!config)
+        return;
+    await runCliCommand({
+        fn: () => kernelCall('outcomes.showOutcome', { entryId }),
+        formatPretty: (value_) => formatOutcomeShow(value_),
+    });
+}
+//# sourceMappingURL=outcome.js.map

package/dist/commands/outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.js","sourceRoot":"","sources":["../../src/commands/outcome.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D;mGACmG;AACnG,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC;AA2CzE,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAY,EAAE,CAClE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEhG;;kFAEkF;AAClF,SAAS,aAAa,CAAC,GAAW,EAAE,IAAY;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,UAAU,CACf,GAAG,IAAI,2BAA2B,GAAG,KAAK;QAC1C,uFAAuF;QACvF,iFAAiF;QACjF,2CAA2C,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAC5G,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAAe,EACf,KAAa,EACb,OAA6B;IAE7B,0FAA0F;IAC1F,qFAAqF;IACrF,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,MAAM,UAAU,CACf,yBAAyB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,KAAK,EAC5E,qIAAqI,CACrI,CAAC;IACH,CAAC;IACD,uFAAuF;IACvF,sCAAsC;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrE,MAAM,UAAU,CACf,uDAAuD,EACvD,0EAA0E,CAC1E,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrE,MAAM,UAAU,CACf,qDAAqD,EACrD,6FAA6F,CAC7F,CAAC;IACH,CAAC;IAED,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,CACf,0CAA0C,OAAO,CAAC,IAAI,KAAK,EAC3D,+GAA+G,CAC/G,CAAC;QACH,CAAC;QACD,IAAI,GAAG,MAAM,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAC;QACnB,2FAA2F;QAC3F,uFAAuF;QACvF,0FAA0F;QAC1F,2FAA2F;QAC3F,EAAE,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAqD,wBAAwB,EAAE;YAC7G,OAAO;YACP,KAAK,EAAE,YAAY;YACnB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QACF,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YACxB,MAAM,OAAO,GAAG,MAAiF,CAAC;YAClG,MAAM,IAAI,GAAG,OAAO,EAAE,gBAAgB,IAAI,SAAS,CAAC;YACpD,MAAM,KAAK,GAAG;gBACb,8EAA8E;gBAC9E,YAAY,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,uBAAuB,CAAC,OAAO,CAAC,GAAG;gBAClJ,mFAAmF;gBACnF,yEAAyE;gBACzE,iBAAiB,OAAO,EAAE,SAAS,IAAI,SAAS,oBAAoB,IAAI,EAAE;aAC1E,CAAC;YACF,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH;;;;;;8FAM8F;AAC9F,SAAS,aAAa,CAAC,EAAU;IAChC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAiC;IACpF,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,2BAA2B,WAAW,OAAO,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,gBAAgB,MAAM,GAAG,CAAC,SAAS,GAAG,IAAI,GAAG,UAAU,EAAE,CAAC;IAC/I,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,EAAE,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,OAAO,GAAG,IAAI,CAAC,MAAM,kBAAkB,WAAW,oBAAoB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,OAA2B;IAChF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAC;QACnB,wFAAwF;QACxF,4DAA4D;QAC5D,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAoD,uBAAuB,EAAE;YAChG,OAAO;YACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC;QACF,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAmC,CAAC;KAC1F,CAAC,CAAC;AACJ,CAAC;AA4BD,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,IAAI,GAAG,GAAG,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AACzH;;;kFAGkF;AAClF,MAAM,SAAS,GAAG,CAAC,IAAgD,EAAU,EAAE,CAC9E,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEtH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAgC;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,mBAAmB,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,KAAK,GAAa;QACvB,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACtF,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;QAC3E,sEAAsE;QACtE,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,YAAY,cAAc;QAC/G,iBAAiB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE;QAChE,iBAAiB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,EAAE;QAC5I,iBAAiB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3I,iBAAiB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE;QAC9E,iBAAiB,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;QACzC,iBAAiB,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;QAC5C,sEAAsE;QACtE,6BAA6B,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC,oBAAoB,GAAG;QAC/E,mCAAmC,CAAC,CAAC,kBAAkB,IAAI,eAAe,2BAA2B;KACrG,CAAC;IACF,IAAI,CAAC,CAAC,iBAAiB,KAAK,gBAAgB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe;IACnD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,aAAa,CAAC;QACnB,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAmD,sBAAsB,EAAE,EAAE,OAAO,EAAE,CAAC;QAC3G,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAkC,CAAC;KAC/E,CAAC,CAAC;AACJ,CAAC"}

package/dist/commands/outcome.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=outcome.test.d.ts.map

package/dist/commands/outcome.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.test.d.ts","sourceRoot":"","sources":["../../src/commands/outcome.test.ts"],"names":[],"mappings":""}

package/dist/commands/outcome.test.js

@@ -0,0 +1,308 @@
+/**
+ * WP-722 S2 — `pb outcome record | list`.
+ *
+ * The surface is thin on purpose: every rule that matters (credential-derived tier, session
+ * ownership, role validation) lives behind the gateway and was proven in S1. What THIS slice can
+ * get wrong is the surface — sending a string where the door wants a number, silently dropping a
+ * flag, or inventing a client-side default that contradicts the server's. So these tests assert
+ * the exact args crossing the wire, and the refusals that never reach it.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const { getConfigOrGuide, kernelCall, kernelCallWithSession, readSession, runCliCommand } = vi.hoisted(() => ({
+    getConfigOrGuide: vi.fn(),
+    kernelCall: vi.fn(),
+    kernelCallWithSession: vi.fn(),
+    readSession: vi.fn(),
+    runCliCommand: vi.fn(async ({ fn }) => fn()),
+}));
+vi.mock('../lib/config.js', () => ({ getConfigOrGuide }));
+vi.mock('../lib/client.js', () => ({ kernelCall, kernelCallWithSession }));
+vi.mock('../lib/runner.js', () => ({ runCliCommand }));
+vi.mock('../lib/session.js', () => ({ readSession }));
+import { runOutcomeRecord, runOutcomeList, formatReadingsList, formatOutcomeShow } from './outcome.js';
+describe('pb outcome record', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'pb_sk_test', siteUrl: 'https://example.test' });
+        kernelCallWithSession.mockResolvedValue({ readingId: 'r1', independenceTier: 'provenance_unknown', actorKind: 'agent', recordedAt: 1, asOf: 1 });
+        readSession.mockReturnValue({ sessionId: 's1' });
+    });
+    it('sends value as a NUMBER, not the raw argv string', async () => {
+        // The door declares `value: v.number()`. Forwarding argv verbatim would be refused by the
+        // validator at runtime, which is a wire-shape bug no server-side test can catch.
+        await runOutcomeRecord('KR-1', '62', {});
+        const [route, args] = kernelCallWithSession.mock.calls[0];
+        expect(route).toBe('outcomes.recordReading');
+        expect(args.value).toBe(62);
+        expect(args.value).not.toBe('62');
+        expect(args.entryId).toBe('KR-1');
+    });
+    it('refuses a non-numeric value BEFORE any network call', async () => {
+        await expect(runOutcomeRecord('KR-1', 'sixty-two', {})).rejects.toThrow(/number/i);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('accepts a negative and a decimal value (a reading is not always a positive integer)', async () => {
+        await runOutcomeRecord('KR-1', '-3.5', {});
+        expect(kernelCallWithSession.mock.calls[0][1].value).toBe(-3.5);
+    });
+    it('sends --as-of as an epoch-ms NUMBER, and refuses an unparseable date', async () => {
+        await runOutcomeRecord('KR-1', '1', { asOf: '2026-03-01' });
+        const args = kernelCallWithSession.mock.calls[0][1];
+        expect(typeof args.asOf).toBe('number');
+        expect(args.asOf).toBe(Date.parse('2026-03-01'));
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'k', siteUrl: 's' });
+        await expect(runOutcomeRecord('KR-1', '1', { asOf: 'not-a-date' })).rejects.toThrow(/as-of/i);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('omits every optional it was not given — never sends undefined keys', async () => {
+        // A key present-but-undefined is not the same as absent to a Convex validator, and the
+        // door's own defaults (kind, asOf, recordedByRoleId) must win when the caller is silent.
+        await runOutcomeRecord('KR-1', '5', {});
+        const args = kernelCallWithSession.mock.calls[0][1];
+        expect(Object.keys(args).sort()).toEqual(['entryId', 'value']);
+    });
+    it('forwards note, source, value-text and by-role verbatim', async () => {
+        await runOutcomeRecord('KR-1', '5', { note: 'n', source: 'dashboard', valueText: '~5', byRole: 'ROL-2' });
+        expect(kernelCallWithSession.mock.calls[0][1]).toMatchObject({
+            note: 'n', source: 'dashboard', valueText: '~5', recordedByRoleId: 'ROL-2',
+        });
+    });
+    it('refuses --corrects without --kind correction, and --kind correction without --corrects', async () => {
+        // Both directions, because the door refuses both and a CLI that only guards one sends a
+        // request it already knows will fail.
+        await expect(runOutcomeRecord('KR-1', '5', { corrects: 'x' })).rejects.toThrow(/correction/i);
+        await expect(runOutcomeRecord('KR-1', '5', { kind: 'correction' })).rejects.toThrow(/corrects/i);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('sends a well-formed correction', async () => {
+        await runOutcomeRecord('KR-1', '5', { kind: 'correction', corrects: 'abc123' });
+        expect(kernelCallWithSession.mock.calls[0][1]).toMatchObject({ kind: 'correction', correctsReadingId: 'abc123' });
+    });
+    it('refuses an unknown --kind, naming the legal set', async () => {
+        await expect(runOutcomeRecord('KR-1', '5', { kind: 'guess' })).rejects.toThrow(/measurement/);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('records through the SESSION-attributed caller, not the plain one', async () => {
+        // A reading is a workspace write whose provenance is the whole point; `kernelCall` would
+        // drop the session the tier derivation compares against.
+        await runOutcomeRecord('KR-1', '5', {});
+        expect(kernelCallWithSession).toHaveBeenCalledTimes(1);
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+});
+describe('pb outcome list', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'pb_sk_test', siteUrl: 'https://example.test' });
+        kernelCall.mockResolvedValue({ entryDocId: 'e1', pageExhausted: true, readings: [] });
+        readSession.mockReturnValue(null);
+    });
+    it('reads through the plain caller and sends the entry id', async () => {
+        await runOutcomeList('KR-1', {});
+        const [route, args] = kernelCall.mock.calls[0];
+        expect(route).toBe('outcomes.listReadings');
+        expect(args.entryId).toBe('KR-1');
+        // A read needs no session — requiring one would make `pb outcome list` fail for a caller
+        // who has a key but has not started a session.
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('sends --limit as a NUMBER and refuses a non-numeric one', async () => {
+        await runOutcomeList('KR-1', { limit: '25' });
+        expect(kernelCall.mock.calls[0][1].limit).toBe(25);
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'k', siteUrl: 's' });
+        await expect(runOutcomeList('KR-1', { limit: 'many' })).rejects.toThrow(/limit/i);
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+});
+describe('formatReadingsList — the rendering §8.2 specifies', () => {
+    const row = (over = {}) => ({
+        readingId: 'rd_1', value: 62, asOf: Date.parse('2026-03-01'), recordedAt: Date.parse('2026-03-01'),
+        kind: 'measurement', independenceTier: 'role_click', actorKind: 'person', ...over,
+    });
+    it('shows a superseded row AND names what replaced it', () => {
+        // The ledger is append-only and the correction chain IS the audit trail, so a superseded
+        // row is never hidden — it is marked, so a reader does not mistake it for the current value.
+        const out = formatReadingsList('KR-S1', {
+            entryDocId: 'e', pageExhausted: true,
+            readings: [row({ readingId: 'rd_2', value: 70 }), row({ supersededByReadingId: 'rd_2' })],
+        });
+        expect(out).toContain('superseded by rd_2');
+        expect(out).toContain('rd_1');
+        expect(out).toContain('2 reading(s)');
+    });
+    it('prints the readingId on every row — the id --corrects needs must be reachable from list', () => {
+        // This is the defect the S2 live walk found: without a printed id there is no way to name
+        // the reading a correction replaces, and --corrects is unusable.
+        const out = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row()] });
+        expect(out).toContain('rd_1');
+    });
+    it('says so when the page is NOT exhausted, rather than reading as the whole history', () => {
+        const bounded = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: false, readings: [row()] });
+        expect(bounded).toContain('older readings not loaded');
+        const whole = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row()] });
+        expect(whole).not.toContain('older readings not loaded');
+    });
+    it('renders the honest empty case, not an error', () => {
+        expect(formatReadingsList('KR-S2', { entryDocId: 'e', pageExhausted: true, readings: [] }))
+            .toBe('No readings recorded on KR-S2 yet.');
+    });
+    // PR #872 review round 3 (Codex P2): a legacy row written through the existing API route
+    // (validated only with v.number()) can carry a finite-but-Date-invalid asOf (e.g. 1e100).
+    // `new Date(x).toISOString()` throws RangeError for it — pre-fix, that propagated out of the
+    // `.map()` and killed `pb outcome list` entirely over one malformed row. Mirrors the MCP
+    // tool's own safeDateSlice fix (same PR).
+    it('renders a malformed out-of-range asOf as a fallback instead of throwing', () => {
+        const out = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row({ asOf: 1e100 })] });
+        expect(out).toContain('invalid-date');
+    });
+});
+describe('formatReadingsList sanitises stored, agent-written content (PR #840 security review)', () => {
+    // The threat model is specific: an AGENT writes `note`/`valueText` through
+    // `outcomes.recordReading`, a HUMAN reads them in a terminal, and this rendering IS the audit
+    // view. Injected newlines do not just look untidy — they forge extra rows in the one surface
+    // someone would use to check the rows.
+    const row = (over = {}) => ({
+        readingId: 'rd_1', value: 62, asOf: Date.parse('2026-03-01'), recordedAt: Date.parse('2026-03-01'),
+        kind: 'measurement', independenceTier: 'role_click', actorKind: 'person', ...over,
+    });
+    const render = (over) => formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row(over)] });
+    it('a note with embedded newlines cannot forge extra reading lines', () => {
+        const out = render({ note: 'ok\n  2026-03-02      999  [measurement·role_click]  rd_FORGED' });
+        // One reading in, one rendered line out (plus the header) — the forged row is folded in.
+        expect(out.split('\n')).toHaveLength(2);
+        expect(out).not.toMatch(/\n\s+2026-03-02/);
+        expect(out).toContain('rd_FORGED'); // the TEXT survives; only its line-breaking power is removed
+    });
+    it('a carriage return cannot overwrite the rendered line', () => {
+        // \r alone redraws over what was printed — a note ending in \r plus spaces can blank the
+        // real value on a real terminal without adding a line at all.
+        const out = render({ note: 'benign\rSAFE — nothing to see' });
+        expect(out).not.toContain('\r');
+    });
+    it('CSI/OSC escape sequences are stripped, not passed to the terminal', () => {
+        const esc = String.fromCharCode(27);
+        const out = render({ note: `${esc}[31m${esc}[2Jred${esc}[0m`, valueText: `${esc}]0;pwned${esc}\\` });
+        expect(out).not.toContain(esc);
+    });
+    it('valueText is sanitised too — it is stored and agent-written, exactly like note', () => {
+        const out = render({ valueText: 'a\nb' });
+        expect(out.split('\n')).toHaveLength(2);
+    });
+    it('ordinary content still renders unchanged', () => {
+        // The sanitiser must not damage the normal case, or it will be removed by someone later.
+        expect(render({ note: 'from the weekly dashboard', valueText: '~62%' }))
+            .toContain('("~62%")');
+        expect(render({ note: 'from the weekly dashboard' })).toContain('from the weekly dashboard');
+    });
+});
+describe('formatOutcomeShow — the two honesty rules', () => {
+    const base = {
+        entryId: 'KR-S1', name: 'Weekly signups', readyToCloseInstruction: null,
+        outcome: {
+            currentResolution: 'no-rows', hasNoReadings: true, direction: 'up-is-good',
+            state: 'overdue', completion: 'open', completionProvenance: 'none',
+            readyToClose: null, weakestTierInCycle: null, ownerRole: null, reporterRole: null,
+            readingCount: 0, unit: null, metric: null,
+        },
+    };
+    const show = (over = {}) => formatOutcomeShow({ ...base, outcome: { ...base.outcome, ...over } });
+    it('a never-measured key result shows a BLANK, never 0%', () => {
+        // `0%` reads as a measurement. The blank is the honest answer and the distinction is the
+        // whole reason progressPct is undefined rather than zero.
+        const out = show();
+        expect(out).toContain('no readings yet');
+        expect(out).not.toContain('0%');
+        expect(out).toContain('never read');
+    });
+    it('a genuine zero reading DOES render as 0% — the other half of that distinction', () => {
+        expect(show({ current: { value: 0, asOf: Date.now() }, currentResolution: 'found', hasNoReadings: false, progressPct: 0, readingCount: 1 }))
+            .toContain('0%');
+    });
+    // PR #872 review round 3 (Codex P2): mirrors formatReadingsList's own safeDateSlice fix — a
+    // malformed stored nextDueAt must render a fallback, never throw RangeError.
+    it('renders a malformed out-of-range nextDueAt as a fallback instead of throwing', () => {
+        expect(show({ nextDueAt: 1e100 })).toContain('invalid-date');
+    });
+    it('the recorded completion is never called confirmed or verified', () => {
+        // Nothing in this run verifies a close. A surface implying otherwise is the failure the
+        // provenance field exists to prevent.
+        const out = show({ completion: 'achieved', completionProvenance: 'legacy-data-status' });
+        expect(out).toContain('recorded as achieved');
+        expect(out).toContain('legacy-data-status');
+        expect(out.toLowerCase()).not.toContain('confirmed');
+        expect(out.toLowerCase()).not.toContain('verified');
+    });
+    it('the attestation line reports without claiming to enforce', () => {
+        const out = show({ weakestTierInCycle: 'agent_same_session' });
+        expect(out).toContain('reported, not enforced');
+        for (const word of ['blocked', 'refused', 'cannot'])
+            expect(out.toLowerCase()).not.toContain(word);
+    });
+    it('a deleted role renders as gone, not as a blank and not as an id', () => {
+        const out = show({ ownerRole: { id: 'q97abc', name: null }, reporterRole: { id: 'q97def', name: 'Data Steward' } });
+        expect(out).toContain('a role that no longer exists');
+        expect(out).toContain('Data Steward');
+    });
+    it('carries the close instruction verbatim when there is a proposal', () => {
+        const out = formatOutcomeShow({
+            ...base, readyToCloseInstruction: 'The readings say this is achieved. Surface this to the founder; do not write the status yourself.',
+            outcome: { ...base.outcome, readyToClose: 'achieved' },
+        });
+        expect(out).toContain('do not write the status yourself');
+    });
+    it('page-exhausted is called out rather than passing as never-read', () => {
+        expect(show({ currentResolution: 'page-exhausted', hasNoReadings: false }))
+            .toContain('this is not "never read"');
+    });
+});
+describe('formatOutcomeShow sanitises EVERY stored string sink (PR #840 review round 2)', () => {
+    // Round 1 I sanitised the fields I interpolated directly and missed `role.name`, which sits
+    // behind a helper. So this guard is STRUCTURAL rather than per-field: it drives control
+    // characters through every string-typed input at once and asserts on the SHAPE of the output,
+    // which means the next stored field someone adds is covered without anyone remembering to
+    // extend this test.
+    const ESC = String.fromCharCode(27);
+    const NASTY = `x${ESC}[31m\n  FORGED LINE\rover`;
+    it('no control characters and no injected lines, whatever the stored content says', () => {
+        const out = formatOutcomeShow({
+            entryId: NASTY, name: NASTY,
+            readyToCloseInstruction: null,
+            outcome: {
+                current: { value: 1, asOf: Date.now() }, currentResolution: 'found', hasNoReadings: false,
+                direction: 'up-is-good', progressPct: 10, state: 'on-time',
+                completion: 'open', completionProvenance: 'none', readyToClose: null,
+                weakestTierInCycle: 'role_click',
+                ownerRole: { id: 'q1', name: NASTY },
+                reporterRole: { id: 'q2', name: NASTY },
+                readingCount: 1, unit: NASTY, metric: NASTY,
+            },
+        });
+        expect(out).not.toContain(ESC);
+        expect(out).not.toContain('\r');
+        // The renderer emits a fixed number of lines; injected newlines would add more.
+        const lineCount = out.split('\n').length;
+        expect(lineCount).toBe(11);
+        // And no line may begin with the injected text — that is what "looks like another field" means.
+        expect(out.split('\n').every((l) => !l.startsWith('FORGED'))).toBe(true);
+    });
+    it('a role name specifically cannot inject a line — the round-2 miss', () => {
+        const out = formatOutcomeShow({
+            entryId: 'KR-S1', name: 'ok', readyToCloseInstruction: null,
+            outcome: {
+                currentResolution: 'no-rows', hasNoReadings: true, direction: 'undetermined',
+                state: 'overdue', completion: 'open', completionProvenance: 'none', readyToClose: null,
+                weakestTierInCycle: null,
+                ownerRole: { id: 'q1', name: 'Data Steward\n  reporter    Someone Else' },
+                reporterRole: null, readingCount: 0, unit: null, metric: null,
+            },
+        });
+        // Exactly one line that IS the reporter field, not two. The forged text survives as text on
+        // the owner line (which is correct — nothing is censored) but has lost its line-breaking
+        // power, so it can no longer masquerade as a field of its own.
+        expect(out.split('\n').filter((l) => l.trim().startsWith('reporter')).length).toBe(1);
+        expect(out).toContain('Someone Else'); // the content is preserved, only its framing is removed
+    });
+});
+//# sourceMappingURL=outcome.test.js.map

package/dist/commands/outcome.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.test.js","sourceRoot":"","sources":["../../src/commands/outcome.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,qBAAqB,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7G,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;IACzB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;IACnB,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC9B,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAkC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;CAC5E,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;AAC1D,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;AAC3E,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;AACvD,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEvG,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAClC,UAAU,CAAC,GAAG,EAAE;QACf,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC9F,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACjJ,WAAW,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QACjE,0FAA0F;QAC1F,iFAAiF;QACjF,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAEjD,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9F,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QACnF,uFAAuF;QACvF,yFAAyF;QACzF,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1G,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC5D,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO;SAC1E,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACvG,wFAAwF;QACxF,sCAAsC;QACtC,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjG,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9F,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QACjF,yFAAyF;QACzF,yDAAyD;QACzD,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,qBAAqB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAChC,UAAU,CAAC,GAAG,EAAE;QACf,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC9F,UAAU,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACtF,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,yFAAyF;QACzF,+CAA+C;QAC/C,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,cAAc,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEnD,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClF,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAClE,MAAM,GAAG,GAAG,CAAC,OAAgC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAClG,IAAI,EAAE,aAAsB,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI;KAC1F,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,yFAAyF;QACzF,6FAA6F;QAC7F,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE;YACvC,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI;YACpC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC;SAChF,CAAC,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QAClG,0FAA0F;QAC1F,iEAAiE;QACjE,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAW,CAAC,CAAC;QAC9G,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC3F,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAW,CAAC,CAAC;QACnH,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,EAAW,CAAC,CAAC;QAChH,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAW,CAAC,CAAC;aAClG,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,yFAAyF;IACzF,0FAA0F;IAC1F,6FAA6F;IAC7F,yFAAyF;IACzF,0CAA0C;IAC1C,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QAClF,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAW,CAAC,CAAC;QAC7H,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sFAAsF,EAAE,GAAG,EAAE;IACrG,2EAA2E;IAC3E,8FAA8F;IAC9F,6FAA6F;IAC7F,uCAAuC;IACvC,MAAM,GAAG,GAAG,CAAC,OAAgC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAClG,IAAI,EAAE,aAAsB,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI;KAC1F,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,IAA6B,EAAE,EAAE,CAChD,kBAAkB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAW,CAAC,CAAC;IAEvG,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,gEAAgE,EAAE,CAAC,CAAC;QAC/F,yFAAyF;QACzF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,6DAA6D;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC/D,yFAAyF;QACzF,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,GAAG,SAAS,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC,CAAC;QACrG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACzF,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QACnD,yFAAyF;QACzF,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;aACtE,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IAC1D,MAAM,IAAI,GAAG;QACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,IAAI;QACvE,OAAO,EAAE;YACR,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY;YAC1E,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM;YAClE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;YACjF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;SACzC;KACD,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,OAAgC,EAAE,EAAE,EAAE,CACnD,iBAAiB,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAW,CAAC,CAAC;IAEhF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC9D,yFAAyF;QACzF,0DAA0D;QAC1D,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACxF,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;aAC1I,SAAS,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,6EAA6E;IAC7E,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACvF,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACxE,wFAAwF;QACxF,sCAAsC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QACpH,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,iBAAiB,CAAC;YAC7B,GAAG,IAAI,EAAE,uBAAuB,EAAE,mGAAmG;YACrI,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE;SAC7C,CAAC,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;aACzE,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+EAA+E,EAAE,GAAG,EAAE;IAC9F,4FAA4F;IAC5F,wFAAwF;IACxF,8FAA8F;IAC9F,0FAA0F;IAC1F,oBAAoB;IACpB,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,2BAA2B,CAAC;IAEjD,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACxF,MAAM,GAAG,GAAG,iBAAiB,CAAC;YAC7B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK;YAC3B,uBAAuB,EAAE,IAAI;YAC7B,OAAO,EAAE;gBACR,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK;gBACzF,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS;gBAC1D,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI;gBACpE,kBAAkB,EAAE,YAAY;gBAChC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;gBACpC,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;gBACvC,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;aAC3C;SACQ,CAAC,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,gFAAgF;QAChF,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,gGAAgG;QAChG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG,iBAAiB,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI;YAC3D,OAAO,EAAE;gBACR,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc;gBAC5E,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI;gBACtF,kBAAkB,EAAE,IAAI;gBACxB,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,0CAA0C,EAAE;gBACzE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;aAC7D;SACQ,CAAC,CAAC;QACZ,4FAA4F;QAC5F,yFAAyF;QACzF,+DAA+D;QAC/D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,wDAAwD;IAChG,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/commands/profile.d.ts

@@ -5,20 +5,52 @@
  * Uses runCliCommand pattern from runner.ts for JSON/pretty output.
  * Uses CLIError from errors.ts for structured error reporting.
  */
+type ProfileListResult = {
+    profiles: string[];
+    active: string | null;
+    globalActive: string | null;
+    localActive: string | null;
+    activeSource: 'local' | 'global' | 'none' | 'missing-pin' | 'env-key' | 'preview' | 'cwd-key' | 'local-key';
+};
+export declare function resolveProfileListState(): ProfileListResult;
+/**
+ * Pure pretty-printer for `pb profile list`. Exported (like formatWhoami) so the copy can be
+ * asserted directly — an inline lambda left the env-key case untestable and therefore wrong.
+ */
+export declare function formatProfileList(data: ProfileListResult): string;
 /** pb profile list — show all profiles, mark active one. */
 export declare function runProfileList(): Promise<void>;
-/** pb profile create <name> --api-key <key> [--url <url>] */
+/**
+ * pb profile create <name> --api-key <key> [--url <url>]
+ *
+ * WP-744 / 1e-B: `--url` defaults to production (`DEFAULT_SITE_URL`) rather than writing a
+ * profile with no `CONVEX_SITE_URL` line at all. The receipt names the host this profile would
+ * ACTUALLY resolve to if activated — running the same precedence `resolveConfig` applies at
+ * config.ts:288 (`.productbrain/config.json` outranks the profile's own URL, `CONVEX_SITE_URL`
+ * outranks both) — because writing a URL into the profile file does not by itself move the
+ * binding in a repo that pins one (H). This is the fix's only honest surface for that gap.
+ *
+ * PRRT_kwDORS4ils6ih-Do (round 2): that precedence only holds when nothing outranks EVERY
+ * profile file outright. `resolveReportedProfile()` re-runs the SAME credential cascade
+ * `resolveConfig()` actually uses (DEC-1607) — when it reports one of the four shadowing
+ * sources (an exported key, a preview binding, a CWD dotenv file, or a direct
+ * config.local.json credential), THIS freshly created profile is shadowed exactly like every
+ * other profile file, so presenting the derived host as "the host this resolves to" would name
+ * a binding that never actually takes effect. Report the shadow instead.
+ */
 export declare function runProfileCreate(opts: {
     name: string;
     apiKey: string;
     url?: string;
 }): Promise<void>;
-/** pb profile use <name> — switch active profile, close any active session. */
 export declare function runProfileUse(opts: {
     name: string;
+    local?: boolean;
+    global?: boolean;
 }): Promise<void>;
 /** pb profile delete <name> */
 export declare function runProfileDelete(opts: {
     name: string;
 }): Promise<void>;
+export {};
 //# sourceMappingURL=profile.d.ts.map