@productbrain/cli 0.1.0-beta.77 → 0.1.0-beta.7707

package/dist/lib/projectConfig.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The repo's own Product Brain config files — locating them and reading what they declare.
+ *
+ * Split out of config.ts under STD-2 / DEC-1504. The seam is deliberate and worth keeping:
+ * this module answers "what does THIS REPO say about itself" from the filesystem alone, while
+ * config.ts answers "which credential do we therefore use". Nothing here reads a credential
+ * store, an env var, or the global active profile — so it has no dependency on config.ts and
+ * cannot participate in an import cycle.
+ *
+ * Split config design:
+ * - config.json (committed): siteUrl only — workspace gateway, safe to share with teammates.
+ * - config.local.json (gitignored): profile pin — machine-local, never committed. Because it
+ *   is gitignored, a fresh clone or worktree does NOT inherit it (INS-2462) — the caller must
+ *   treat "no pin" as an explicit state, never as permission to guess a workspace.
+ */
+/** Project config shape — .productbrain/config.json (committed, siteUrl only) */
+export interface ProjectConfig {
+    siteUrl?: string;
+}
+/** Local project config shape — .productbrain/config.local.json (gitignored, machine-local) */
+export interface LocalProjectConfig {
+    profile?: string;
+    /** Direct preview API key — set by `npm run pb:preview`, cleared by `npm run pb:real`. */
+    apiKey?: string;
+    /**
+     * An `apiKey` was present but failed the `API_KEY_PREFIX` bar, so it was not loaded.
+     * Kept apart from `apiKey` so a malformed key can never bind, while diagnostics can still
+     * say "malformed" instead of misreporting it as absent.
+     */
+    apiKeyMalformed?: boolean;
+    /** Preview site URL — set alongside apiKey by `npm run pb:preview`. */
+    siteUrl?: string;
+    /** Marks this config as preview-bound; the CLI shows a loud banner on every command. */
+    preview?: boolean;
+    /** Human-readable preview workspace name for the banner (e.g. "Preview Workspace"). */
+    workspaceName?: string;
+}
+/**
+ * Walk up the directory tree (git-style) to find the nearest CLI project root.
+ *
+ * A `.productbrain/` directory only counts as a CLI project root when it carries
+ * CLI configuration — `config.json` (committed siteUrl gateway) or
+ * `config.local.json` (machine-local profile pin or preview binding). A
+ * projection-only `.productbrain/` written by `pb handshake` (briefing.md,
+ * context.md, rules/, etc.) does NOT count — otherwise a subrepo like
+ * `packages/cli/.productbrain/` would shadow the real configuring root and
+ * `npm run pb:preview` writes (which always land at the repo-root
+ * `.productbrain/`) would be invisible to commands run from the subrepo.
+ *
+ * Stops at home directory or filesystem root. Returns the directory containing
+ * a config-bearing `.productbrain/`, or null if not found.
+ */
+export declare function findProjectRoot(startDir: string): string | null;
+/**
+ * Read .productbrain/config.json from the walked-up project root.
+ * Only reads siteUrl — profile and apiKey fields are ignored (legacy or misplaced).
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON but does not throw.
+ */
+export declare function readProjectConfig(): ProjectConfig | null;
+/**
+ * Does the committed `.productbrain/config.json` EXIST, independent of whether it parses?
+ *
+ * The project's self-declaration is the file's PRESENCE, not its contents. `readProjectConfig()`
+ * returns null for a malformed or non-object file exactly as it does for an absent one, so a
+ * caller asking "is this a project" through that value reads a DAMAGED declaration as no
+ * declaration at all — and falls through to whatever workspace the global profile names. A
+ * corrupt committed file must not be a way out of the project's own tenant rules, so callers
+ * deciding whether a repo has declared itself ask this instead (Codex review, WP-694 S2).
+ */
+export declare function projectConfigExists(): boolean;
+/**
+ * Read .productbrain/config.local.json from the walked-up project root.
+ * Returns the machine-local pin (`profile`) and any preview-binding fields
+ * (`apiKey`, `siteUrl`, `preview`, `workspaceName`) written by
+ * `npm run pb:preview` — all gitignored, never committed.
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON but does not throw.
+ */
+export declare function readLocalProjectConfig(): LocalProjectConfig | null;
+//# sourceMappingURL=projectConfig.d.ts.map

package/dist/lib/projectConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../src/lib/projectConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB/D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,aAAa,GAAG,IAAI,CAuBxD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAI7C;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,GAAG,IAAI,CA8ClE"}

package/dist/lib/projectConfig.js

@@ -0,0 +1,157 @@
+/**
+ * The repo's own Product Brain config files — locating them and reading what they declare.
+ *
+ * Split out of config.ts under STD-2 / DEC-1504. The seam is deliberate and worth keeping:
+ * this module answers "what does THIS REPO say about itself" from the filesystem alone, while
+ * config.ts answers "which credential do we therefore use". Nothing here reads a credential
+ * store, an env var, or the global active profile — so it has no dependency on config.ts and
+ * cannot participate in an import cycle.
+ *
+ * Split config design:
+ * - config.json (committed): siteUrl only — workspace gateway, safe to share with teammates.
+ * - config.local.json (gitignored): profile pin — machine-local, never committed. Because it
+ *   is gitignored, a fresh clone or worktree does NOT inherit it (INS-2462) — the caller must
+ *   treat "no pin" as an explicit state, never as permission to guess a workspace.
+ */
+import { readFileSync, existsSync } from 'fs';
+import { resolve } from 'path';
+import { homedir } from 'os';
+import { API_KEY_PREFIX } from './tokenConstants.js';
+/**
+ * Walk up the directory tree (git-style) to find the nearest CLI project root.
+ *
+ * A `.productbrain/` directory only counts as a CLI project root when it carries
+ * CLI configuration — `config.json` (committed siteUrl gateway) or
+ * `config.local.json` (machine-local profile pin or preview binding). A
+ * projection-only `.productbrain/` written by `pb handshake` (briefing.md,
+ * context.md, rules/, etc.) does NOT count — otherwise a subrepo like
+ * `packages/cli/.productbrain/` would shadow the real configuring root and
+ * `npm run pb:preview` writes (which always land at the repo-root
+ * `.productbrain/`) would be invisible to commands run from the subrepo.
+ *
+ * Stops at home directory or filesystem root. Returns the directory containing
+ * a config-bearing `.productbrain/`, or null if not found.
+ */
+export function findProjectRoot(startDir) {
+    let dir = startDir;
+    const home = homedir();
+    while (true) {
+        const pbDir = resolve(dir, '.productbrain');
+        if (existsSync(pbDir) &&
+            (existsSync(resolve(pbDir, 'config.json')) ||
+                existsSync(resolve(pbDir, 'config.local.json')))) {
+            return dir;
+        }
+        const parent = resolve(dir, '..');
+        if (parent === dir || dir === home)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Read .productbrain/config.json from the walked-up project root.
+ * Only reads siteUrl — profile and apiKey fields are ignored (legacy or misplaced).
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON but does not throw.
+ */
+export function readProjectConfig() {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot)
+        return null;
+    const configPath = resolve(projectRoot, '.productbrain', 'config.json');
+    if (!existsSync(configPath))
+        return null;
+    try {
+        const raw = readFileSync(configPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            process.stderr.write('Warning: .productbrain/config.json is not a JSON object, skipping.\n');
+            return null;
+        }
+        const result = {};
+        if (typeof parsed.siteUrl === 'string' && parsed.siteUrl) {
+            result.siteUrl = parsed.siteUrl;
+        }
+        // Silently ignore `profile` and `apiKey` in config.json — those must be in config.local.json
+        return result;
+    }
+    catch {
+        process.stderr.write('Warning: .productbrain/config.json contains invalid JSON, skipping.\n');
+        return null;
+    }
+}
+/**
+ * Does the committed `.productbrain/config.json` EXIST, independent of whether it parses?
+ *
+ * The project's self-declaration is the file's PRESENCE, not its contents. `readProjectConfig()`
+ * returns null for a malformed or non-object file exactly as it does for an absent one, so a
+ * caller asking "is this a project" through that value reads a DAMAGED declaration as no
+ * declaration at all — and falls through to whatever workspace the global profile names. A
+ * corrupt committed file must not be a way out of the project's own tenant rules, so callers
+ * deciding whether a repo has declared itself ask this instead (Codex review, WP-694 S2).
+ */
+export function projectConfigExists() {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot)
+        return false;
+    return existsSync(resolve(projectRoot, '.productbrain', 'config.json'));
+}
+/**
+ * Read .productbrain/config.local.json from the walked-up project root.
+ * Returns the machine-local pin (`profile`) and any preview-binding fields
+ * (`apiKey`, `siteUrl`, `preview`, `workspaceName`) written by
+ * `npm run pb:preview` — all gitignored, never committed.
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON but does not throw.
+ */
+export function readLocalProjectConfig() {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot)
+        return null;
+    const configPath = resolve(projectRoot, '.productbrain', 'config.local.json');
+    if (!existsSync(configPath))
+        return null;
+    try {
+        const raw = readFileSync(configPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            process.stderr.write('Warning: .productbrain/config.local.json is not a JSON object, skipping.\n');
+            return null;
+        }
+        const result = {};
+        if (typeof parsed.profile === 'string' && parsed.profile) {
+            result.profile = parsed.profile;
+        }
+        // Preview binding fields — written by `npm run pb:preview`, cleared by `npm run pb:real`.
+        //
+        // Fail closed on ANY present-but-invalid apiKey, not just a wrong-prefix string: a number,
+        // an empty string, a boolean or an object is a corrupt or hand-written binding, and treating
+        // it as absent would let the caller skip the claimed binding and adopt a sibling profile pin
+        // — the workspace substitution this whole path exists to prevent. Only `undefined`/`null`
+        // count as absent: JSON `null` conventionally means "no value", and `npm run pb:real` strips
+        // the preview keys entirely rather than nulling them.
+        if (parsed.apiKey !== undefined && parsed.apiKey !== null) {
+            if (typeof parsed.apiKey === 'string' && parsed.apiKey.startsWith(API_KEY_PREFIX)) {
+                result.apiKey = parsed.apiKey;
+            }
+            else {
+                result.apiKeyMalformed = true;
+            }
+        }
+        if (typeof parsed.siteUrl === 'string' && parsed.siteUrl) {
+            result.siteUrl = parsed.siteUrl;
+        }
+        if (parsed.preview === true) {
+            result.preview = true;
+        }
+        if (typeof parsed.workspaceName === 'string' && parsed.workspaceName) {
+            result.workspaceName = parsed.workspaceName;
+        }
+        return result;
+    }
+    catch {
+        process.stderr.write('Warning: .productbrain/config.local.json contains invalid JSON, skipping.\n');
+        return null;
+    }
+}
+//# sourceMappingURL=projectConfig.js.map

package/dist/lib/projectConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectConfig.js","sourceRoot":"","sources":["../../src/lib/projectConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA0BrD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC5C,IACE,UAAU,CAAC,KAAK,CAAC;YACjB,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACxC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAClD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,6FAA6F;QAC7F,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAuB,EAAE,CAAC;QACtC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,0FAA0F;QAC1F,EAAE;QACF,2FAA2F;QAC3F,6FAA6F;QAC7F,6FAA6F;QAC7F,0FAA0F;QAC1F,6FAA6F;QAC7F,sDAAsD;QACtD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACrE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC9C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACpG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/rate-limit.d.ts

@@ -0,0 +1,38 @@
+/**
+ * WP-579 — client-side rate-limit resilience for the gateway helpers in client.ts
+ * (TEN-2923 touch amplification, TEN-2924 no-backoff-on-429).
+ *
+ * Split out of client.ts rather than grown inside it: these are two self-contained
+ * policies (when to retry a throttled call, when a session touch is worth sending) with
+ * their own constants and module-level state, and client.ts is at its STD-2 budget.
+ *
+ * Depends only on the error taxonomy — NOT on client.ts's `McpError` — so the two modules
+ * don't form an import cycle. The retry keys off the error's `code`, which is exactly what
+ * the guard tested before the split (`McpError` is the only thing that sets
+ * `code === 'rate-limited'` alongside a `retryAfterSeconds`).
+ */
+/**
+ * TEN-2924: bounded, jittered retry for a rate-limited call. Honors the server's
+ * Retry-After rather than guessing a backoff curve. Only retries a rate-limit refusal —
+ * never a validation/auth/internal failure, which retrying unchanged would just repeat.
+ */
+export declare function withRateLimitRetry<T>(attempt: () => Promise<T>): Promise<T>;
+/**
+ * Per-call knobs for the gateway helpers.
+ *
+ * `retryOnRateLimit: false` is the opt-out a BACKGROUND (unawaited) call must pass. A
+ * pending retry timer keeps the Node event loop alive, so retrying a fire-and-forget call
+ * holds the CLI process open long after its foreground work finished — breaking the very
+ * "never block" contract those call sites are written against. A background call that
+ * loses to a 429 is simply dropped; it is observability, not the user's work.
+ */
+export type KernelCallOptions = {
+    retryOnRateLimit?: boolean;
+    skipSessionTouch?: boolean;
+};
+/** Applies the rate-limit retry unless the caller opted out (background calls). */
+export declare function maybeRetry<T>(attempt: () => Promise<T>, options?: KernelCallOptions): Promise<T>;
+export declare function shouldTouchSession(sessionId: string): boolean;
+/** Test-only escape hatch — mirrors packages/mcp-server/src/client.ts's resetTouchThrottle. */
+export declare function resetTouchThrottle(sessionId?: string | null): void;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/lib/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/lib/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAsBH;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAajF;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3F,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,CAEhG;AAYD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM7D;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAMlE"}

package/dist/lib/rate-limit.js

@@ -0,0 +1,83 @@
+/**
+ * WP-579 — client-side rate-limit resilience for the gateway helpers in client.ts
+ * (TEN-2923 touch amplification, TEN-2924 no-backoff-on-429).
+ *
+ * Split out of client.ts rather than grown inside it: these are two self-contained
+ * policies (when to retry a throttled call, when a session touch is worth sending) with
+ * their own constants and module-level state, and client.ts is at its STD-2 budget.
+ *
+ * Depends only on the error taxonomy — NOT on client.ts's `McpError` — so the two modules
+ * don't form an import cycle. The retry keys off the error's `code`, which is exactly what
+ * the guard tested before the split (`McpError` is the only thing that sets
+ * `code === 'rate-limited'` alongside a `retryAfterSeconds`).
+ */
+import { ErrorCode } from './errors.js';
+const MAX_RATE_LIMIT_RETRIES = 3;
+const RATE_LIMIT_RETRY_JITTER_MS = 250;
+/**
+ * Ceiling on a single honored Retry-After. The server clamps its value to the tripped
+ * window (convex/rateLimiter.ts `retryAfterSeconds`) — 60s for the minute window, but
+ * 86_400s for the DAY window. Honoring that unconditionally would park the process for up
+ * to a day per attempt, three attempts deep. A day-quota denial is not something to wait
+ * out in-process: surface it so the caller can retry out of band.
+ */
+const MAX_RATE_LIMIT_RETRY_WAIT_SECONDS = 60;
+/** Seconds to wait, if this error is a rate-limit refusal that carries a Retry-After. */
+function rateLimitWaitOf(err) {
+    const candidate = err;
+    if (!candidate || candidate.code !== ErrorCode.RATE_LIMITED)
+        return undefined;
+    return typeof candidate.retryAfterSeconds === 'number' ? candidate.retryAfterSeconds : undefined;
+}
+/**
+ * TEN-2924: bounded, jittered retry for a rate-limited call. Honors the server's
+ * Retry-After rather than guessing a backoff curve. Only retries a rate-limit refusal —
+ * never a validation/auth/internal failure, which retrying unchanged would just repeat.
+ */
+export async function withRateLimitRetry(attempt) {
+    for (let retries = 0;; retries++) {
+        try {
+            return await attempt();
+        }
+        catch (err) {
+            const waitSeconds = rateLimitWaitOf(err);
+            if (waitSeconds === undefined || retries >= MAX_RATE_LIMIT_RETRIES)
+                throw err;
+            // Day-window denial (or any wait we won't sit on) — fail fast rather than hang.
+            if (waitSeconds > MAX_RATE_LIMIT_RETRY_WAIT_SECONDS)
+                throw err;
+            const delayMs = waitSeconds * 1000 + Math.random() * RATE_LIMIT_RETRY_JITTER_MS;
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
+    }
+}
+/** Applies the rate-limit retry unless the caller opted out (background calls). */
+export function maybeRetry(attempt, options) {
+    return options?.retryOnRateLimit === false ? attempt() : withRateLimitRetry(attempt);
+}
+/**
+ * TEN-2923: client-side throttle mirroring packages/mcp-server/src/client.ts's
+ * touchSessionActivity — the server already no-ops a touch made <5s after the last one
+ * for this session (TOUCH_SESSION_THROTTLE_MS, DEC-75), so a touch inside that window is
+ * pure wasted quota. Matching the server's own window here removes the waste without
+ * changing renewal semantics at all (a throttled call was already a server-side no-op).
+ */
+const _lastTouchAtBySession = new Map();
+const TOUCH_THROTTLE_MS = 5_000;
+export function shouldTouchSession(sessionId) {
+    const now = Date.now();
+    const lastTouchAt = _lastTouchAtBySession.get(sessionId) ?? 0;
+    if (now - lastTouchAt < TOUCH_THROTTLE_MS)
+        return false;
+    _lastTouchAtBySession.set(sessionId, now);
+    return true;
+}
+/** Test-only escape hatch — mirrors packages/mcp-server/src/client.ts's resetTouchThrottle. */
+export function resetTouchThrottle(sessionId) {
+    if (sessionId) {
+        _lastTouchAtBySession.delete(sessionId);
+        return;
+    }
+    _lastTouchAtBySession.clear();
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/lib/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/lib/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC;;;;;;GAMG;AACH,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAE7C,yFAAyF;AACzF,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,SAAS,GAAG,GAAwE,CAAC;IAC3F,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAC9E,OAAO,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAI,OAAyB;IACnE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,IAAI,sBAAsB;gBAAE,MAAM,GAAG,CAAC;YAC9E,gFAAgF;YAChF,IAAI,WAAW,GAAG,iCAAiC;gBAAE,MAAM,GAAG,CAAC;YAC/D,MAAM,OAAO,GAAG,WAAW,GAAG,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,0BAA0B,CAAC;YAChF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAaD,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAI,OAAyB,EAAE,OAA2B;IAClF,OAAO,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;AACxD,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,GAAG,GAAG,WAAW,GAAG,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACxD,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,SAAyB;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,qBAAqB,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC"}

package/dist/lib/readinessNotices.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The ONE served wording for a capped readiness scan — `chain.workspaceReadiness`'s
+ * accepted-entry sample hit its cap, so entry counts are floors and an apparent gap may already
+ * be covered. One declaration per package, imported by every surface that discloses it.
+ *
+ * Byte-identical to the MCP twin (packages/mcp-server/src/lib/readinessNotices.ts) but
+ * deliberately a separate constant: mcp-server's isolated Docker build resolves no private
+ * workspace package at runtime, the same constraint that keeps FEEDBACK_SUBMIT_HINT duplicated
+ * across the two packages (see scripts/check-notice-hint-drift.mjs for that pair's guard).
+ */
+export declare const READINESS_PROVISIONAL_LINE = "Readiness is provisional: its sample omitted accepted entries. Counts are lower bounds, apparent gaps may already be covered.";
+//# sourceMappingURL=readinessNotices.d.ts.map

package/dist/lib/readinessNotices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readinessNotices.d.ts","sourceRoot":"","sources":["../../src/lib/readinessNotices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,kIAC0F,CAAC"}

package/dist/lib/readinessNotices.js

@@ -0,0 +1,15 @@
+/**
+ * The ONE served wording for a capped readiness scan — `chain.workspaceReadiness`'s
+ * accepted-entry sample hit its cap, so entry counts are floors and an apparent gap may already
+ * be covered. One declaration per package, imported by every surface that discloses it.
+ *
+ * Byte-identical to the MCP twin (packages/mcp-server/src/lib/readinessNotices.ts) but
+ * deliberately a separate constant: mcp-server's isolated Docker build resolves no private
+ * workspace package at runtime, the same constraint that keeps FEEDBACK_SUBMIT_HINT duplicated
+ * across the two packages (see scripts/check-notice-hint-drift.mjs for that pair's guard).
+ */
+export const READINESS_PROVISIONAL_LINE = 'Readiness is provisional: its sample omitted accepted entries. Counts are lower bounds, apparent gaps may already be covered.';
+// TASK-435 (C4c): READINESS_PROVISIONAL_STAGE_SUFFIX deleted — it existed only to append onto
+// the deleted "Stage: X" line in formatters/orient.ts; that line is gone and this had no other
+// consumer (repo-wide grep, zero importers).
+//# sourceMappingURL=readinessNotices.js.map

package/dist/lib/readinessNotices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readinessNotices.js","sourceRoot":"","sources":["../../src/lib/readinessNotices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,+HAA+H,CAAC;AAElI,8FAA8F;AAC9F,+FAA+F;AAC/F,6CAA6C"}

package/dist/lib/repo-detect.d.ts

@@ -5,20 +5,26 @@
 /**
  * Workspace maturity profile derived from the Chain's workspaceReadiness signal.
  * Used by handshake to tailor generated context files (BET-170, DEC-291).
+ *
+ * WP-762 C4e-3 (DEC-1800): the `stage` ladder ('blank' | 'seeded' | 'grounded' | 'connected')
+ * is deleted from the backend response — no field on this profile derives from it any more.
  */
 export interface WorkspaceProfile {
-    stage: string;
     totalEntries: number;
     totalRelations: number;
     collectionCount: number;
     activeCount: number;
     draftCount: number;
     orphanedCount: number;
-    governanceMode: string;
 }
 /**
  * Extract a WorkspaceProfile from the raw workspaceReadiness API response.
  * Returns null on any failure — callers must handle null (fail-open pattern).
+ *
+ * WP-751 M3a-5b (TASK-210, DEC-1700): governanceMode is deleted from the required-fields
+ * gate below and the returned profile — the backend workspaceReadiness response no longer
+ * carries it at all (role is the only governance mode now), so requiring it truthy would
+ * have made this function return null unconditionally instead of just dropping one field.
  */
 export declare function extractWorkspaceProfile(response: unknown): WorkspaceProfile | null;
 export interface RepoContext {

package/dist/lib/repo-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-detect.d.ts","sourceRoot":"","sources":["../../src/lib/repo-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAsBlF;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,UAAU,CAAC,GAAG,SAAgB,GAAG,WAAW,CAiD3D"}
+{"version":3,"file":"repo-detect.d.ts","sourceRoot":"","sources":["../../src/lib/repo-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAoBlF;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,UAAU,CAAC,GAAG,SAAgB,GAAG,WAAW,CAiD3D"}

package/dist/lib/repo-detect.js

@@ -8,26 +8,31 @@ import { execSync } from 'child_process';
 /**
  * Extract a WorkspaceProfile from the raw workspaceReadiness API response.
  * Returns null on any failure — callers must handle null (fail-open pattern).
+ *
+ * WP-751 M3a-5b (TASK-210, DEC-1700): governanceMode is deleted from the required-fields
+ * gate below and the returned profile — the backend workspaceReadiness response no longer
+ * carries it at all (role is the only governance mode now), so requiring it truthy would
+ * have made this function return null unconditionally instead of just dropping one field.
  */
 export function extractWorkspaceProfile(response) {
     if (!response || typeof response !== 'object')
         return null;
     const r = response;
-    const stage = typeof r['stage'] === 'string' ? r['stage'] : null;
-    const governanceMode = typeof r['governanceMode'] === 'string' ? r['governanceMode'] : null;
-    if (!stage || !governanceMode)
+    // A sampled read cannot safely exclude portable guidance or describe workspace maturity.
+    // Reuse the existing unavailable-profile path instead of promoting it to an exact profile.
+    if (r['sampleTruncated'] === true)
+        return null;
+    const stats = r['stats'] && typeof r['stats'] === 'object' ? r['stats'] : null;
+    if (!stats || typeof stats['totalEntries'] !== 'number')
         return null;
-    const stats = r['stats'] && typeof r['stats'] === 'object' ? r['stats'] : {};
     const toNum = (v) => (typeof v === 'number' ? v : 0);
     return {
-        stage,
         totalEntries: toNum(stats['totalEntries']),
         totalRelations: toNum(stats['totalRelations']),
         collectionCount: toNum(stats['collectionCount']),
         activeCount: toNum(stats['activeCount']),
         draftCount: toNum(stats['draftCount']),
         orphanedCount: toNum(stats['orphanedCount']),
-        governanceMode,
     };
 }
 export function detectRepo(cwd = process.cwd()) {

package/dist/lib/repo-detect.js.map

@@ -1 +1 @@
-{"version":3,"file":"repo-detect.js","sourceRoot":"","sources":["../../src/lib/repo-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAiBzC;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,QAAmC,CAAC;IAE9C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1G,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,OAAO;QACL,KAAK;QACL,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9C,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChD,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC5C,cAAc;KACf,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC5C,MAAM,GAAG,GAAgB;QACvB,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,KAAK;KAClB,CAAC;IAEF,eAAe;IACf,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;YACtD,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;YAC1C,IAAI,GAAG,CAAC,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACvC,CAAC;IAED,aAAa;IACb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxH,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC;QACvB,2CAA2C;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1D,IAAI,CAAC;YAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;IAE7C,kBAAkB;IAClB,MAAM,MAAM,GAA8B;QACxC,CAAC,WAAW,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QACvD,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC,CAAC;QACjC,CAAC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACnE,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAC9C,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;KAC1C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAExC,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"repo-detect.js","sourceRoot":"","sources":["../../src/lib/repo-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAkBzC;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,QAAmC,CAAC;IAC9C,yFAAyF;IACzF,2FAA2F;IAC3F,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,cAAc,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9C,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChD,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;KAC7C,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC5C,MAAM,GAAG,GAAgB;QACvB,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,KAAK;KAClB,CAAC;IAEF,eAAe;IACf,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;YACtD,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;YAC1C,IAAI,GAAG,CAAC,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACvC,CAAC;IAED,aAAa;IACb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxH,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC;QACvB,2CAA2C;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1D,IAAI,CAAC;YAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;IAE7C,kBAAkB;IAClB,MAAM,MAAM,GAA8B;QACxC,CAAC,WAAW,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QACvD,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC,CAAC;QACjC,CAAC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACnE,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAC9C,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;KAC1C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAExC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/reportedProfile.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Reported profile — the label status surfaces print.
+ *
+ * Credential resolution already refuses a declared project with no tenant
+ * (`getConfigSafe().kind === 'missing-pin'`). Labels must read that result
+ * rather than re-guess a cascade that names a workspace the CLI will not use.
+ *
+ * Lives outside config.ts (STD-2 / DEC-1504 shrink-only). Do not re-export
+ * from config.ts — this module imports FROM config.ts.
+ */
+import { type EffectiveProfileSource } from './config.js';
+export type ReportedProfileSource = EffectiveProfileSource | 'missing-pin' | 'env-key' | 'preview' | 'cwd-key' | 'local-key';
+export { isEnvKeyBinding, resetReportedProfileSnapshot } from './envKeySnapshot.js';
+export declare function resolveReportedProfile(): {
+    profile: string | null;
+    source: ReportedProfileSource;
+};
+//# sourceMappingURL=reportedProfile.d.ts.map

package/dist/lib/reportedProfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reportedProfile.d.ts","sourceRoot":"","sources":["../../src/lib/reportedProfile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAA0C,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAOlG,MAAM,MAAM,qBAAqB,GAC7B,sBAAsB,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;AAI7F,OAAO,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEpF,wBAAgB,sBAAsB,IAAI;IACxC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,qBAAqB,CAAC;CAC/B,CAiEA"}