@productbrain/cli 0.1.0-beta.75 → 0.1.0-beta.7508

package/dist/lib/workspaceVocabCache.d.ts

@@ -0,0 +1,60 @@
+/**
+ * 5-minute TTL cache for workspace vocabulary context (WP-436 S2).
+ *
+ * Purpose (R2 mitigation): the CLI resolves vocabulary labels on every invocation.
+ * Without a cache, each `pb orient` / `pb get` / `pb capture` would call
+ * `chain.getVocabulary` — adding a Convex round-trip overhead and risking
+ * handshake-time staleness. A 5-min TTL short-circuits repeat calls within
+ * a typical session while staying fresh enough that label changes land quickly.
+ *
+ * PAT-230: the cache holds WorkspaceVocabCtx (pure data, no Convex imports here).
+ * DEC-1021: only Axis 2 (collectionLabels) lives here; Axis 1 (displayNames) is untouched.
+ *
+ * S4 note: when Cortex UI builds its `vocabularyStore`, it should mirror this
+ * contract — a keyed map by workspaceId with an expiresAt field (Cortex has
+ * direct access to workspaceId; the CLI uses apiKey as a 1:1 surrogate, since
+ * the HTTP gateway server-side injects workspaceId from authResult per
+ * convex/http.ts:675).
+ */
+import type { WorkspaceVocabCtx } from './canonicalRefs.js';
+/**
+ * Get a cached WorkspaceVocabCtx by cacheKey, or null if expired/missing.
+ * Prints a staleness warning when the entry is older than STALE_WARN_MS.
+ */
+export declare function getCachedVocabCtx(cacheKey: string): WorkspaceVocabCtx | null;
+/**
+ * Store a WorkspaceVocabCtx under cacheKey with a 5-min TTL.
+ */
+export declare function setCachedVocabCtx(cacheKey: string, ctx: WorkspaceVocabCtx): void;
+/**
+ * Explicitly invalidate a cached vocab context by cacheKey.
+ * Call this when `updateCollectionLabels` mutation succeeds (e.g. after `pb handshake`).
+ */
+export declare function invalidateVocabCtx(cacheKey: string): void;
+/**
+ * Clear all cached entries (useful for testing or `pb handshake --refresh`).
+ */
+export declare function clearVocabCache(): void;
+/**
+ * Get the cached vocab context, or fetch it via the provided async fetcher on cache miss.
+ *
+ * Usage pattern at CLI command sites:
+ * ```ts
+ * const vocabCtx = await getOrFetchVocabCtx(config.apiKey, async () => {
+ *   type VocabResult = { collectionLabels?: Record<string, unknown> };
+ *   const vocab = await kernelCall<VocabResult>('chain.getVocabulary', {});
+ *   return vocab?.collectionLabels
+ *     ? { collectionLabels: vocab.collectionLabels as WorkspaceVocabCtx['collectionLabels'] }
+ *     : null;
+ * });
+ * ```
+ *
+ * - `cacheKey`: use the API key as a surrogate for cacheKey (1:1 mapping at CLI layer).
+ * - `fetcher`: async function that resolves the vocab ctx; returns null on failure to signal
+ *   "don't cache, fall back to resolver literal". Fetcher errors are swallowed — vocabulary
+ *   labels are advisory (PAT-230 / fail-open principle).
+ *
+ * Returns WorkspaceVocabCtx on cache hit or successful fetch; undefined on error/null fetcher result.
+ */
+export declare function getOrFetchVocabCtx(cacheKey: string, fetcher: () => Promise<WorkspaceVocabCtx | null>): Promise<WorkspaceVocabCtx | undefined>;
+//# sourceMappingURL=workspaceVocabCache.d.ts.map

package/dist/lib/workspaceVocabCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceVocabCache.d.ts","sourceRoot":"","sources":["../../src/lib/workspaceVocabCache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAc5D;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAe5E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAEhF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAC/C,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAcxC"}

package/dist/lib/workspaceVocabCache.js

@@ -0,0 +1,98 @@
+/**
+ * 5-minute TTL cache for workspace vocabulary context (WP-436 S2).
+ *
+ * Purpose (R2 mitigation): the CLI resolves vocabulary labels on every invocation.
+ * Without a cache, each `pb orient` / `pb get` / `pb capture` would call
+ * `chain.getVocabulary` — adding a Convex round-trip overhead and risking
+ * handshake-time staleness. A 5-min TTL short-circuits repeat calls within
+ * a typical session while staying fresh enough that label changes land quickly.
+ *
+ * PAT-230: the cache holds WorkspaceVocabCtx (pure data, no Convex imports here).
+ * DEC-1021: only Axis 2 (collectionLabels) lives here; Axis 1 (displayNames) is untouched.
+ *
+ * S4 note: when Cortex UI builds its `vocabularyStore`, it should mirror this
+ * contract — a keyed map by workspaceId with an expiresAt field (Cortex has
+ * direct access to workspaceId; the CLI uses apiKey as a 1:1 surrogate, since
+ * the HTTP gateway server-side injects workspaceId from authResult per
+ * convex/http.ts:675).
+ */
+const TTL_MS = 5 * 60 * 1000; // 5 minutes
+const STALE_WARN_MS = 4 * 60 * 1000; // warn after 4 minutes (1 minute before expiry)
+/** In-memory cache: cacheKey (CLI: apiKey; Cortex would use workspaceId) → CacheEntry. */
+const cache = new Map();
+/**
+ * Get a cached WorkspaceVocabCtx by cacheKey, or null if expired/missing.
+ * Prints a staleness warning when the entry is older than STALE_WARN_MS.
+ */
+export function getCachedVocabCtx(cacheKey) {
+    const entry = cache.get(cacheKey);
+    if (!entry)
+        return null;
+    const now = Date.now();
+    if (now >= entry.expiresAt) {
+        cache.delete(cacheKey);
+        return null;
+    }
+    if (now - (entry.expiresAt - TTL_MS) >= STALE_WARN_MS) {
+        // Staleness hint: labels were fetched > 4 min ago, will refresh within 1 min.
+        process.stderr.write(`[pb] Workspace vocabulary context is almost stale — will refresh on next invocation.\n`);
+    }
+    return entry.ctx;
+}
+/**
+ * Store a WorkspaceVocabCtx under cacheKey with a 5-min TTL.
+ */
+export function setCachedVocabCtx(cacheKey, ctx) {
+    cache.set(cacheKey, { ctx, expiresAt: Date.now() + TTL_MS });
+}
+/**
+ * Explicitly invalidate a cached vocab context by cacheKey.
+ * Call this when `updateCollectionLabels` mutation succeeds (e.g. after `pb handshake`).
+ */
+export function invalidateVocabCtx(cacheKey) {
+    cache.delete(cacheKey);
+}
+/**
+ * Clear all cached entries (useful for testing or `pb handshake --refresh`).
+ */
+export function clearVocabCache() {
+    cache.clear();
+}
+/**
+ * Get the cached vocab context, or fetch it via the provided async fetcher on cache miss.
+ *
+ * Usage pattern at CLI command sites:
+ * ```ts
+ * const vocabCtx = await getOrFetchVocabCtx(config.apiKey, async () => {
+ *   type VocabResult = { collectionLabels?: Record<string, unknown> };
+ *   const vocab = await kernelCall<VocabResult>('chain.getVocabulary', {});
+ *   return vocab?.collectionLabels
+ *     ? { collectionLabels: vocab.collectionLabels as WorkspaceVocabCtx['collectionLabels'] }
+ *     : null;
+ * });
+ * ```
+ *
+ * - `cacheKey`: use the API key as a surrogate for cacheKey (1:1 mapping at CLI layer).
+ * - `fetcher`: async function that resolves the vocab ctx; returns null on failure to signal
+ *   "don't cache, fall back to resolver literal". Fetcher errors are swallowed — vocabulary
+ *   labels are advisory (PAT-230 / fail-open principle).
+ *
+ * Returns WorkspaceVocabCtx on cache hit or successful fetch; undefined on error/null fetcher result.
+ */
+export async function getOrFetchVocabCtx(cacheKey, fetcher) {
+    const cached = getCachedVocabCtx(cacheKey);
+    if (cached)
+        return cached;
+    try {
+        const ctx = await fetcher();
+        if (ctx) {
+            setCachedVocabCtx(cacheKey, ctx);
+            return ctx;
+        }
+    }
+    catch {
+        // fail-open — vocabulary labels are advisory, never block the command
+    }
+    return undefined;
+}
+//# sourceMappingURL=workspaceVocabCache.js.map

package/dist/lib/workspaceVocabCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceVocabCache.js","sourceRoot":"","sources":["../../src/lib/workspaceVocabCache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAUH,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAC1C,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,gDAAgD;AAErF,0FAA0F;AAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QACtD,8EAA8E;QAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,GAAsB;IACxE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,OAAgD;IAEhD,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;QAC5B,IAAI,GAAG,EAAE,CAAC;YACR,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjC,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/writePerimeter.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Write perimeter — WP-421 S7 (STD-236, doneWhen #22). Re-homed from
+ * `setup/perimeter.ts` in WP-776 S3d/S3f: despite its original name, this guard was never
+ * setup-asset-specific — its job ("PB never writes outside its declared surfaces," STD-234)
+ * covers every handshake adapter write (`.claude/`, `.cursor/`, `.codex/`, etc.), which is why
+ * it survives the deletion of the setup-assets system while the module it used to live under
+ * does not.
+ *
+ * Single runtime guard for every disk write `pb handshake` makes. Writes are
+ * permitted ONLY within paths that the manifest explicitly declares safe:
+ *
+ *   - `path.resolve(process.cwd(), '.productbrain')` — hard-coded canonical
+ *     authoring root. Always allowed regardless of manifest contents (this is
+ *     where pb itself stores its own state).
+ *   - `path.resolve(process.cwd(), surface)` for every `surface` in
+ *     `manifest.surfaces[]` — explicit per-workspace allowlist.
+ *
+ * Anything else throws `setup-perimeter-violation` (name kept stable for tests —
+ * renaming the error code is a separate, non-mechanical change). This is the single
+ * choke point the S7 perimeter fixtures exercise (HOME-sandboxed) and is the
+ * only place we encode the "PB never writes outside its declared surfaces"
+ * promise (STD-234) as RUNTIME enforcement rather than convention.
+ *
+ * Chain: STD-234 (write perimeter), STD-236 (this guard), DEC-952 (adapters),
+ *        DEC-955 (manifest defaults).
+ */
+/**
+ * The minimal manifest shape this guard consults. Accepts the full
+ * `Manifest` from `generators/manifest.ts` or any structurally compatible
+ * subset (e.g. tests that synthesize just `{ surfaces: [...] }`).
+ */
+export interface PerimeterManifest {
+    surfaces?: string[];
+}
+/** Error code emitted when a write is refused. Stable string for tests. */
+export declare const SETUP_PERIMETER_VIOLATION: "setup-perimeter-violation";
+/**
+ * Optional argument bag — extends the manifest with a `cwd` override so callers
+ * can validate against an explicit repo root instead of `process.cwd()`. Added
+ * for WP-431 S3 (review fix #5) so the manifest writer no longer mutates global
+ * state via `process.chdir` to make the perimeter check land on the right root.
+ */
+export interface PerimeterOptions {
+    cwd?: string;
+}
+/**
+ * Asserts that `absPath` is inside the setup write perimeter for the supplied
+ * `cwd` (or `process.cwd()` when omitted) + manifest. Throws an Error with
+ * `code === 'setup-perimeter-violation'` (and a descriptive message containing
+ * the offending path) when the write is refused.
+ *
+ * The function is synchronous and pure aside from the optional `process.cwd()`
+ * read — adapters call it inline before every write.
+ *
+ * Per STD-236 the path argument MUST already be absolute. Callers pass the
+ * fully-resolved on-disk path they intend to write to; the guard does the
+ * containment check from that point. (Resolving relative paths inside the
+ * guard would mask call-site bugs where the caller meant to write inside the
+ * repo but accidentally produced an absolute path elsewhere.)
+ */
+export declare function assertSetupWritePath(absPath: string, manifest: PerimeterManifest, options?: PerimeterOptions): void;
+/**
+ * isSetupWritePathAllowed — non-throwing companion to assertSetupWritePath.
+ *
+ * Returns true iff `absPath` resolves inside the perimeter (.productbrain/ plus the
+ * manifest's declared surfaces). Use it to filter candidate paths BEFORE asserting —
+ * e.g. surface paths a workspace hasn't enabled — so excluded surfaces are skipped
+ * silently instead of throwing and being logged as a false warning on every run.
+ * Empty/non-string/NUL paths return false (the assert variant throws on those).
+ */
+export declare function isSetupWritePathAllowed(absPath: string, manifest: PerimeterManifest, options?: PerimeterOptions): boolean;
+//# sourceMappingURL=writePerimeter.d.ts.map

package/dist/lib/writePerimeter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePerimeter.d.ts","sourceRoot":"","sources":["../../src/lib/writePerimeter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB,EAAG,2BAAoC,CAAC;AA8B9E;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,gBAAqB,GAC7B,IAAI,CAuBN;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAmBT"}

package/dist/lib/writePerimeter.js

@@ -0,0 +1,128 @@
+/**
+ * Write perimeter — WP-421 S7 (STD-236, doneWhen #22). Re-homed from
+ * `setup/perimeter.ts` in WP-776 S3d/S3f: despite its original name, this guard was never
+ * setup-asset-specific — its job ("PB never writes outside its declared surfaces," STD-234)
+ * covers every handshake adapter write (`.claude/`, `.cursor/`, `.codex/`, etc.), which is why
+ * it survives the deletion of the setup-assets system while the module it used to live under
+ * does not.
+ *
+ * Single runtime guard for every disk write `pb handshake` makes. Writes are
+ * permitted ONLY within paths that the manifest explicitly declares safe:
+ *
+ *   - `path.resolve(process.cwd(), '.productbrain')` — hard-coded canonical
+ *     authoring root. Always allowed regardless of manifest contents (this is
+ *     where pb itself stores its own state).
+ *   - `path.resolve(process.cwd(), surface)` for every `surface` in
+ *     `manifest.surfaces[]` — explicit per-workspace allowlist.
+ *
+ * Anything else throws `setup-perimeter-violation` (name kept stable for tests —
+ * renaming the error code is a separate, non-mechanical change). This is the single
+ * choke point the S7 perimeter fixtures exercise (HOME-sandboxed) and is the
+ * only place we encode the "PB never writes outside its declared surfaces"
+ * promise (STD-234) as RUNTIME enforcement rather than convention.
+ *
+ * Chain: STD-234 (write perimeter), STD-236 (this guard), DEC-952 (adapters),
+ *        DEC-955 (manifest defaults).
+ */
+import { resolve, sep } from 'path';
+/** Error code emitted when a write is refused. Stable string for tests. */
+export const SETUP_PERIMETER_VIOLATION = 'setup-perimeter-violation';
+/**
+ * Hard-coded authoring root. Always allowed in addition to manifest surfaces.
+ * Resolved at call time against `process.cwd()` so the perimeter shifts
+ * correctly when tests override the working directory.
+ */
+const HARD_CODED_ALLOWED = '.productbrain';
+/**
+ * Resolve `pathSpec` against a base. Treats `pathSpec` as relative to `base`
+ * unless it is already absolute. Mirrors `path.resolve(base, spec)` semantics
+ * but is spelled out for clarity at the call site below.
+ */
+function resolveUnder(base, pathSpec) {
+    return resolve(base, pathSpec);
+}
+/**
+ * Returns true iff `candidate` is at or beneath `root`.
+ *
+ * Compares the resolved (canonical) forms with a path-separator-aware suffix
+ * check so `…/.productbrain` does not accidentally match `…/.productbrain-backup/`.
+ */
+function isWithin(root, candidate) {
+    if (candidate === root)
+        return true;
+    const rootWithSep = root.endsWith(sep) ? root : root + sep;
+    return candidate.startsWith(rootWithSep);
+}
+/**
+ * Asserts that `absPath` is inside the setup write perimeter for the supplied
+ * `cwd` (or `process.cwd()` when omitted) + manifest. Throws an Error with
+ * `code === 'setup-perimeter-violation'` (and a descriptive message containing
+ * the offending path) when the write is refused.
+ *
+ * The function is synchronous and pure aside from the optional `process.cwd()`
+ * read — adapters call it inline before every write.
+ *
+ * Per STD-236 the path argument MUST already be absolute. Callers pass the
+ * fully-resolved on-disk path they intend to write to; the guard does the
+ * containment check from that point. (Resolving relative paths inside the
+ * guard would mask call-site bugs where the caller meant to write inside the
+ * repo but accidentally produced an absolute path elsewhere.)
+ */
+export function assertSetupWritePath(absPath, manifest, options = {}) {
+    // Defensive: refuse non-absolute paths outright. The contract is "the
+    // caller resolves first, the guard checks containment" — accepting a
+    // relative path here would make the perimeter dependent on whatever
+    // `process.cwd()` happens to be when the guard runs.
+    if (!absPath || typeof absPath !== 'string') {
+        throw createPerimeterError('Empty or non-string path supplied to assertSetupWritePath.', absPath);
+    }
+    // Reject any path with NUL bytes outright — catches accidental binary
+    // payloads and also POSIX path-canonicalization tricks.
+    if (absPath.includes('\0')) {
+        throw createPerimeterError('Path contains NUL byte.', absPath);
+    }
+    if (isSetupWritePathAllowed(absPath, manifest, options))
+        return;
+    const surfaces = manifest.surfaces ?? [];
+    throw createPerimeterError(`Setup write refused: path is outside the declared perimeter ` +
+        `(.productbrain/ + manifest.surfaces[${surfaces.join(', ')}]).`, resolve(absPath));
+}
+/**
+ * isSetupWritePathAllowed — non-throwing companion to assertSetupWritePath.
+ *
+ * Returns true iff `absPath` resolves inside the perimeter (.productbrain/ plus the
+ * manifest's declared surfaces). Use it to filter candidate paths BEFORE asserting —
+ * e.g. surface paths a workspace hasn't enabled — so excluded surfaces are skipped
+ * silently instead of throwing and being logged as a false warning on every run.
+ * Empty/non-string/NUL paths return false (the assert variant throws on those).
+ */
+export function isSetupWritePathAllowed(absPath, manifest, options = {}) {
+    if (!absPath || typeof absPath !== 'string')
+        return false;
+    if (absPath.includes('\0'))
+        return false;
+    const resolvedTarget = resolve(absPath);
+    // WP-431 S3 review fix #5: prefer the explicit cwd argument so callers can
+    // validate against an absolute repo root without mutating global state via
+    // `process.chdir`. Falls back to `process.cwd()` for legacy adapter callers.
+    const cwd = options.cwd ?? process.cwd();
+    const allowedRoots = [resolveUnder(cwd, HARD_CODED_ALLOWED)];
+    const surfaces = manifest.surfaces ?? [];
+    for (const surface of surfaces) {
+        if (typeof surface !== 'string' || surface.length === 0)
+            continue;
+        allowedRoots.push(resolveUnder(cwd, surface));
+    }
+    return allowedRoots.some((root) => isWithin(root, resolvedTarget));
+}
+/**
+ * Build a tagged Error for a perimeter violation. The `code` field is the
+ * stable string tests assert against; the `message` carries human context.
+ */
+function createPerimeterError(reason, path) {
+    const err = new Error(`${reason} [path=${String(path)}]`);
+    err.code = SETUP_PERIMETER_VIOLATION;
+    err.path = path;
+    return err;
+}
+//# sourceMappingURL=writePerimeter.js.map

package/dist/lib/writePerimeter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePerimeter.js","sourceRoot":"","sources":["../../src/lib/writePerimeter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAWpC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAAoC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAE3C;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,QAAgB;IAClD,OAAO,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;IAC3D,OAAO,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAC3C,CAAC;AAYD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,QAA2B,EAC3B,UAA4B,EAAE;IAE9B,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,qDAAqD;IACrD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,oBAAoB,CAAC,4DAA4D,EAAE,OAAO,CAAC,CAAC;IACpG,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,oBAAoB,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;QAAE,OAAO;IAEhE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;IACzC,MAAM,oBAAoB,CACxB,8DAA8D;QAC5D,uCAAuC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EACjE,OAAO,CAAC,OAAO,CAAC,CACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,QAA2B,EAC3B,UAA4B,EAAE;IAE9B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,YAAY,GAAa,CAAC,YAAY,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,MAAc,EAAE,IAAa;IACzD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,MAAM,UAAU,MAAM,CAAC,IAAI,CAAC,GAAG,CAGvD,CAAC;IACF,GAAG,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACrC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/registerEntryCommands.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `pb entry propose|accept|archive` — the entry-lifecycle verbs, noun-scoped per
+ * DEC-1574 (WP-640 S4). Split out of index.ts (STD-2/DEC-1504: index.ts is
+ * grandfathered over-budget and shrink-only) — same "own every command group in
+ * its own file" split index.ts's other multi-command surfaces would benefit from.
+ *
+ * `propose` is a discoverable alias over the SAME draft-creating door `pb capture`
+ * already uses (DEC-1583: capturing creates a draft, which IS the propose act —
+ * both roads lead to one draft door; capture is NOT renamed or removed). `accept`
+ * is `pb promote`'s exact server route (chain.commitEntry) under its new name —
+ * pure rename, zero behavior change. `archive` is a friendlier front end over
+ * `pb update --status archived` requiring a DEC-1572 reason.
+ */
+import type { Command } from 'commander';
+export declare function registerEntryCommands(program: Command): void;
+export declare function registerRelateCommands(program: Command): void;
+//# sourceMappingURL=registerEntryCommands.d.ts.map

package/dist/registerEntryCommands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registerEntryCommands.d.ts","sourceRoot":"","sources":["../src/registerEntryCommands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmF5D;AAOD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgB7D"}

package/dist/registerEntryCommands.js

@@ -0,0 +1,106 @@
+import { runCapture } from './commands/capture.js';
+import { runEntryAccept } from './commands/entryAccept.js';
+import { runEntryArchive } from './commands/entryArchive.js';
+import { runEntryOwn } from './commands/entryOwn.js';
+import { runEntryPreflight } from './commands/entryPreflight.js';
+import { runRelate, runUnrelate } from './commands/relate.js';
+export function registerEntryCommands(program) {
+    const entryCmd = program
+        .command('entry')
+        .description('Entry-lifecycle commands — noun-scoped per DEC-1574 (propose | accept | archive)');
+    entryCmd
+        .command('preflight')
+        .description('Read structural requirements before composing an entry; saves nothing')
+        .requiredOption('-c, --collection <slug>', 'Collection to inspect')
+        .option('--canonical-key <key>', 'Explicit semantic type')
+        .option('-l, --link <type:entry-id>', 'Selected context (repeatable); e.g. validates:KR-1 and commits_to:STR-1', (value, previous) => [...previous, value], [])
+        .option('-t, --link-type <type>', 'Type for any --link supplied as a bare entry ID')
+        .action(runEntryPreflight);
+    entryCmd
+        .command('propose [text...]')
+        .description('Propose (capture) a new draft entry — same draft door as `pb capture` (DEC-1583)')
+        .option('-n, --name <name>', 'Entry name (defaults to capture text)')
+        .option('-d, --description <desc>', 'Entry description (defaults to capture text)')
+        .option('-c, --collection <slug>', 'Explicit collection (skip auto-classification)')
+        .option('-f, --field <key=value>', 'Set a data field (repeatable; e.g. rationale="...")', (val, prev) => [...prev, val], [])
+        .option('-l, --link <entry-id>', 'Link new entry to an existing entry (TEN-705)')
+        .option('-t, --link-type <relation-type>', 'Relation type for --link — REQUIRED when --link is used (WP-688 S4): no default, the door refuses and lists the source entry\'s legal verbs if omitted')
+        .option('--source-ref <ref>', 'Source reference URI (BET-240 E2)')
+        .option('--source-excerpt <text>', 'Verbatim source excerpt (BET-240 E2)')
+        .option('--draft', 'Force the entry to draft regardless of workspace governance mode (TEN-2226)')
+        .option('--json', 'Output machine-readable JSON (deprecated: use global --json flag)')
+        .option('--suggest-only', 'Show grounding preview (possible duplicates, related entries) without creating entry (WP-319)')
+        .option('--strict', 'Prompt y/N before capturing when a possible duplicate is detected (WP-319)')
+        // WP-640 SWEEP (#653 review): `propose` is advertised as the same draft door as
+        // `pb capture` (DEC-1583), but this rung-2 ownership option was never registered or
+        // forwarded here — an ownership-scoped propose hit "unknown option" instead of reaching
+        // runCapture. Mirrors index.ts's `capture` registration exactly.
+        // WP-753 O1b (DEC-1715): --owner-team is deleted — an unnamed create resolves a default
+        // owner itself (the session's acting role, else the nearest Team Lead); --owner-role
+        // survives as the explicit override, its team now derived from the role's own placement.
+        .option('--owner-role <entry-id>', 'Existing Role entry ID to create AS OWNER of (WP-513 rung 2; its home team is derived automatically)')
+        .action(async (textParts = [], opts) => {
+        const text = textParts.join(' ').trim();
+        if (!text && !opts.name) {
+            entryCmd.commands.find((c) => c.name() === 'propose')?.help();
+            return;
+        }
+        await runCapture({
+            text: text || opts.name || '', name: opts.name, description: opts.description, collection: opts.collection,
+            field: opts.field, link: opts.link, linkType: opts.linkType, sourceRef: opts.sourceRef, sourceExcerpt: opts.sourceExcerpt,
+            draft: opts.draft, json: opts.json, suggestOnly: opts.suggestOnly, strict: opts.strict,
+            ownerRole: opts.ownerRole,
+        });
+    });
+    entryCmd
+        .command('accept <entry-ids...>')
+        .description('Accept one or more draft entries onto the Chain (commit to SSOT). Batch: a single failure does not abort the rest (INS-1813).')
+        .option('-m, --message <text>', 'Commit message (applied to every entry in the batch)')
+        .option('--override-reason <text>', 'Typed override (≥12 chars) clearing a steering coherency block at publish — recorded with author attribution (WP-465)')
+        .option('--acknowledge <response>', 'Respond to a coherency challenge: linked | accepted-fix | diverged (WP-465)')
+        .option('--ack-entry <entry-id>', 'Authorizing entry for --acknowledge linked / accepted-fix')
+        .option('--ack-reason <text>', 'Divergence rationale (≥12 chars) for --acknowledge diverged')
+        .action(async (entryIds, opts) => {
+        await runEntryAccept({ entryIds, message: opts.message, overrideReason: opts.overrideReason, acknowledge: opts.acknowledge, ackEntry: opts.ackEntry, ackReason: opts.ackReason });
+    });
+    entryCmd
+        .command('archive <entry-id>')
+        .description('Archive an entry with a DEC-1572 reason (superseded | resolved | no_longer_true | duplicate | never_adopted)')
+        .requiredOption('--reason <reason>', 'DEC-1572 archive reason (required, server-validated)')
+        .option('--note <text>', 'Change note for history')
+        .action(async (entryId, opts) => {
+        await runEntryArchive({ entryId, reason: opts.reason, note: opts.note });
+    });
+    // DEC-1710: the retired `pb organisation work own` re-homed under the entry noun — same
+    // judged door (organisation.setOwnership), no `own`'s `unown` sibling (an entry is never
+    // unowned; reassignment is the only way ownership changes).
+    entryCmd
+        .command('own <entry-id>')
+        .description('Assign an entry to one exact team and role (DEC-1710; judged by organisation.setOwnership)')
+        .requiredOption('--team <team-id>', 'Existing Team entry ID')
+        .requiredOption('--role <role-id>', 'Existing Role entry ID')
+        .action(async (entryId, opts) => {
+        await runEntryOwn(entryId, opts);
+    });
+}
+// --- Relate / Unrelate commands (TEN-704) — moved from index.ts (WP-688 S2a): index.ts is
+// grandfathered shrink-only (STD-2/DEC-1504), and this file already owns the "own every command
+// group in its own file" registrar pattern. `relate`/`unrelate` stay TOP-LEVEL commands (not
+// nested under `entry`) — this is a file-location move for LOC budget, not a DEC-1574 rename.
+export function registerRelateCommands(program) {
+    program
+        .command('relate <from-id> <type> <to-id>')
+        .description('Add a typed relation between two entries (requires active session)')
+        .option('--if-missing', 'Only create relation if it does not already exist')
+        .option('--dry-run', 'Preview the write (advisories, wouldBlock) without creating the relation (WP-688 S2a)')
+        .action(async (fromId, type, toId, opts) => {
+        await runRelate({ fromId, type, toId, ifMissing: opts.ifMissing, dryRun: opts.dryRun });
+    });
+    program
+        .command('unrelate <from-id> <type> <to-id>')
+        .description('Remove a typed relation between two entries (requires active session)')
+        .action(async (fromId, type, toId) => {
+        await runUnrelate({ fromId, type, toId });
+    });
+}
+//# sourceMappingURL=registerEntryCommands.js.map

package/dist/registerEntryCommands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registerEntryCommands.js","sourceRoot":"","sources":["../src/registerEntryCommands.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,kFAAkF,CAAC,CAAC;IAEnG,QAAQ;SACL,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,uEAAuE,CAAC;SACpF,cAAc,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;SAClE,MAAM,CAAC,uBAAuB,EAAE,wBAAwB,CAAC;SACzD,MAAM,CAAC,4BAA4B,EAAE,yEAAyE,EAAE,CAAC,KAAa,EAAE,QAAkB,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAc,CAAC;SAC5L,MAAM,CAAC,wBAAwB,EAAE,iDAAiD,CAAC;SACnF,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE7B,QAAQ;SACL,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,kFAAkF,CAAC;SAC/F,MAAM,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;SACpE,MAAM,CAAC,0BAA0B,EAAE,8CAA8C,CAAC;SAClF,MAAM,CAAC,yBAAyB,EAAE,gDAAgD,CAAC;SACnF,MAAM,CAAC,yBAAyB,EAAE,qDAAqD,EAAE,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,EAAc,CAAC;SACzJ,MAAM,CAAC,uBAAuB,EAAE,+CAA+C,CAAC;SAChF,MAAM,CAAC,iCAAiC,EAAE,wJAAwJ,CAAC;SACnM,MAAM,CAAC,oBAAoB,EAAE,mCAAmC,CAAC;SACjE,MAAM,CAAC,yBAAyB,EAAE,sCAAsC,CAAC;SACzE,MAAM,CAAC,SAAS,EAAE,6EAA6E,CAAC;SAChG,MAAM,CAAC,QAAQ,EAAE,mEAAmE,CAAC;SACrF,MAAM,CAAC,gBAAgB,EAAE,+FAA+F,CAAC;SACzH,MAAM,CAAC,UAAU,EAAE,4EAA4E,CAAC;QACjG,gFAAgF;QAChF,oFAAoF;QACpF,wFAAwF;QACxF,iEAAiE;QACjE,wFAAwF;QACxF,qFAAqF;QACrF,yFAAyF;SACxF,MAAM,CAAC,yBAAyB,EAAE,sGAAsG,CAAC;SACzI,MAAM,CAAC,KAAK,EAAE,YAAsB,EAAE,EAAE,IAAgQ,EAAE,EAAE;QAC3S,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC;YACf,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;YAC1G,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa;YACzH,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;YACtF,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,uBAAuB,CAAC;SAChC,WAAW,CAAC,+HAA+H,CAAC;SAC5I,MAAM,CAAC,sBAAsB,EAAE,sDAAsD,CAAC;SACtF,MAAM,CAAC,0BAA0B,EAAE,uHAAuH,CAAC;SAC3J,MAAM,CAAC,0BAA0B,EAAE,6EAA6E,CAAC;SACjH,MAAM,CAAC,wBAAwB,EAAE,2DAA2D,CAAC;SAC7F,MAAM,CAAC,qBAAqB,EAAE,6DAA6D,CAAC;SAC5F,MAAM,CAAC,KAAK,EAAE,QAAkB,EAAE,IAAgH,EAAE,EAAE;QACrJ,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACpL,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,8GAA8G,CAAC;SAC3H,cAAc,CAAC,mBAAmB,EAAE,sDAAsD,CAAC;SAC3F,MAAM,CAAC,eAAe,EAAE,yBAAyB,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAuC,EAAE,EAAE;QACzE,MAAM,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEL,wFAAwF;IACxF,yFAAyF;IACzF,4DAA4D;IAC5D,QAAQ;SACL,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,4FAA4F,CAAC;SACzG,cAAc,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;SAC5D,cAAc,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAoC,EAAE,EAAE;QACtE,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACP,CAAC;AAGD,2FAA2F;AAC3F,gGAAgG;AAChG,6FAA6F;AAC7F,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,iCAAiC,CAAC;SAC1C,WAAW,CAAC,oEAAoE,CAAC;SACjF,MAAM,CAAC,cAAc,EAAE,mDAAmD,CAAC;SAC3E,MAAM,CAAC,WAAW,EAAE,uFAAuF,CAAC;SAC5G,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,IAA+C,EAAE,EAAE;QAC5G,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,mCAAmC,CAAC;SAC5C,WAAW,CAAC,uEAAuE,CAAC;SACpF,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE;QAC3D,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/registerHistoryCommand.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `pb history <entry-id>` — WP-753 V2 (TASK-203). Split out of index.ts (STD-2/DEC-1504:
+ * index.ts is grandfathered over-budget and shrink-only) — same "own every command group in
+ * its own file" split registerEntryCommands.ts already documents.
+ */
+import type { Command } from 'commander';
+export declare function registerHistoryCommand(program: Command): void;
+//# sourceMappingURL=registerHistoryCommand.d.ts.map

package/dist/registerHistoryCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registerHistoryCommand.d.ts","sourceRoot":"","sources":["../src/registerHistoryCommand.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAW7D"}

package/dist/registerHistoryCommand.js

@@ -0,0 +1,14 @@
+import { runHistory } from './commands/history.js';
+export function registerHistoryCommand(program) {
+    program
+        .command('history <entry-id>')
+        .description('Published version history (person, role, change note)')
+        .action(async (entryId) => {
+        if (!entryId?.trim()) {
+            program.commands.find((c) => c.name() === 'history')?.help();
+            return;
+        }
+        await runHistory({ entryId: entryId.trim() });
+    });
+}
+//# sourceMappingURL=registerHistoryCommand.js.map

package/dist/registerHistoryCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registerHistoryCommand.js","sourceRoot":"","sources":["../src/registerHistoryCommand.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;QAChC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/registerOutcomeCommands.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `pb outcome record | list` — registration (WP-722 S2).
+ *
+ * Its own file rather than more lines in `packages/cli/src/index.ts`, which is 1,069 LOC and
+ * shrink-only — the same `register*Commands.ts` split `registerEntryCommands.ts` and
+ * `registerProposalCommands.ts` already use, and for the same stated reason.
+ *
+ * **`show` arrives now, with the derivation it reads (S3).** It was deliberately absent in S2:
+ * every field it prints — direction, progress, pace, next due, state, recorded completion and its
+ * provenance, weakest tier, resolved role names, `readyToClose` and its instruction — is produced
+ * by the derivation slice, and shipping the verb before that would have meant a `show` that
+ * printed what `list` prints and stayed silent about the rest. Nothing was renamed to add it,
+ * which is the whole reason the noun is `outcome` rather than `reading`.
+ *
+ * **Door-parity consequence, and it is the registration** (historical — the WP-639 door
+ * registry, including `kernel/doors/rows/surfaceSets.ts`, was deleted in WP-756 B1/TASK-227/
+ * DEC-1724; the shape below predates that and the reasoning stays accurate as history).
+ * `kernel/doors/rows/surfaceSets.ts`'s S6 CLI class row recorded a `count` that had to equal
+ * the live `[E7]` enumerator output, and the enumerator counted raw `.command(` occurrences
+ * across `packages/cli/src`. In THIS registration shape the noun is itself a `.command(` call
+ * (`program.command('outcome')`, matching `registerEntryCommands.ts`), so a noun plus two verbs
+ * is THREE calls, not two. The count was re-derived by running the gate rather than taken from
+ * any written number.
+ */
+import type { Command } from 'commander';
+export declare function registerOutcomeCommands(program: Command): void;
+//# sourceMappingURL=registerOutcomeCommands.d.ts.map

package/dist/registerOutcomeCommands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registerOutcomeCommands.d.ts","sourceRoot":"","sources":["../src/registerOutcomeCommands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2B9D"}

package/dist/registerOutcomeCommands.js

@@ -0,0 +1,27 @@
+import { runOutcomeRecord, runOutcomeList, runOutcomeShow } from './commands/outcome.js';
+export function registerOutcomeCommands(program) {
+    const outcomeCmd = program
+        .command('outcome')
+        .description('Key-result outcomes — record and read the measured readings behind a number (WP-722)');
+    outcomeCmd
+        .command('record <entry-id> <value>')
+        .description('Record a reading — evidence, not a verdict; any connector may record one')
+        .option('--as-of <date>', 'When the world was in this state (default: now). Back-dating a backfill is legitimate and stays visible')
+        .option('--kind <kind>', 'measurement | estimate | correction (default: measurement)')
+        .option('--corrects <reading-id>', 'Required with --kind correction — the reading this replaces. Refused if that row is already superseded')
+        .option('--by-role <role-id>', "The accountable role (default: the key result's reporterRoleId, then its owning role)")
+        .option('--note <text>', 'Free-text note recorded with the reading')
+        .option('--source <text>', 'Where the number came from — a dashboard name, a query, a URL')
+        .option('--value-text <text>', 'Verbatim as-reported form when the source was not clean ("~62%", "62 of 100"). Display only')
+        .action(runOutcomeRecord);
+    outcomeCmd
+        .command('list <entry-id>')
+        .description('List readings, newest first; superseded rows are shown and marked with their replacement')
+        .option('--limit <n>', 'Max rows to return (default and maximum 200)')
+        .action(runOutcomeList);
+    outcomeCmd
+        .command('show <entry-id>')
+        .description('The derived view — current, progress, pace, staleness, recorded completion and its provenance, and any close proposal')
+        .action(runOutcomeShow);
+}
+//# sourceMappingURL=registerOutcomeCommands.js.map

package/dist/registerOutcomeCommands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registerOutcomeCommands.js","sourceRoot":"","sources":["../src/registerOutcomeCommands.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEzF,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACvD,MAAM,UAAU,GAAG,OAAO;SACxB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,sFAAsF,CAAC,CAAC;IAEtG,UAAU;SACR,OAAO,CAAC,2BAA2B,CAAC;SACpC,WAAW,CAAC,0EAA0E,CAAC;SACvF,MAAM,CAAC,gBAAgB,EAAE,yGAAyG,CAAC;SACnI,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,yBAAyB,EAAE,wGAAwG,CAAC;SAC3I,MAAM,CAAC,qBAAqB,EAAE,uFAAuF,CAAC;SACtH,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;SACnE,MAAM,CAAC,iBAAiB,EAAE,+DAA+D,CAAC;SAC1F,MAAM,CAAC,qBAAqB,EAAE,6FAA6F,CAAC;SAC5H,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE3B,UAAU;SACR,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,0FAA0F,CAAC;SACvG,MAAM,CAAC,aAAa,EAAE,8CAA8C,CAAC;SACrE,MAAM,CAAC,cAAc,CAAC,CAAC;IAEzB,UAAU;SACR,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,uHAAuH,CAAC;SACpI,MAAM,CAAC,cAAc,CAAC,CAAC;AAC1B,CAAC"}

package/dist/registerProposalCommands.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `pb promote` retirement + `pb proposal accept|reject|list` — noun-scoped consent-
+ * proposal governance commands (DEC-1574/1578, WP-640 S4). Split out of index.ts
+ * (STD-2/DEC-1504: index.ts is grandfathered over-budget and shrink-only), same
+ * "own every command group in its own file" precedent as registerEntryCommands.ts.
+ *
+ * `pb promote` and the bare `pb accept` / `pb reject` / `pb proposals` retire with a
+ * CLEAN BREAK — no warning alias, no telemetry shim (DEC-1578's own precedent). Every
+ * caller must move to the noun-scoped form.
+ */
+import type { Command } from 'commander';
+export declare function registerProposalCommands(program: Command): void;
+//# sourceMappingURL=registerProposalCommands.d.ts.map