@productbrain/cli 0.1.0-beta.92 → 0.1.0-beta.925

package/dist/commands/setup-ingest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-ingest.js","sourceRoot":"","sources":["../../src/commands/setup-ingest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAiBvD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0DAA0D;QAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC7F,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEhD,yDAAyD;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,kBAAkB,GAAa,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAEpD,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;YACtC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YACzB,IAAI,eAAe,EAAE,CAAC;gBACpB,WAAW,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;gBACrD,eAAe,GAAG,IAAI,CAAC;gBACvB,kBAAkB,GAAG,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC;YACrC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACxB,uBAAuB;gBACvB,eAAe,GAAG,GAAG,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,WAAW,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAE1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QACtC,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC;QACpC,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACtC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAe;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACjE,OAAO,SAAS,IAAI,CAAC,WAAW,EAAE,IAAI,SAAS,EAAE,CAAC;AACpD,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAA2B,EAAE;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAE1B,+BAA+B;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAEjD,uBAAuB;IACvB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,UAAU,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,QAAQ,CAAC,mBAAmB,OAAO,EAAE,EAAE;YAC/C,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,UAAU,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,QAAQ,CAAC,4BAA4B,OAAO,EAAE,EAAE;YACxD,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB;IACpB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEzG,sFAAsF;IACtF,yEAAyE;IACzE,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,IAAI,IAAI,GAAqB,eAAe,KAAK,QAAQ;QACvD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,GAAG,GAAG,IAAI,QAAQ,CACtB,mCAAmC,OAAO,KAAK;YAC7C,mEAAmE;YACnE,kEAAkE,EACpE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAC9D,CAAC;QACF,UAAU,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,oGAAoG;IACpG,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,UAAU,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChG,MAAM,IAAI,QAAQ,CAChB,mFAAmF;YACjF,2FAA2F,EAC7F,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtD,sCAAsC;IACtC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;QAC1B,UAAU,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,QAAQ,CAChB,wDAAwD,EACxD,EAAE,IAAI,EAAE,SAAS,CAAC,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAExC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,IAAI;gBACZ,OAAO;gBACP,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,IAAI;gBACf,WAAW;gBACX,IAAI,EAAE,OAAO;aACd,CAAC,GAAG,IAAI,CACV,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,IAAI,CAAC,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,YAAY,IAAI,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,WAAW,IAAI,CAAC,CAAC;YACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO;IACT,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAe,wBAAwB,EAAE;YAChE,WAAW;YACX,OAAO;YACP,aAAa,EAAE,EAAE;YACjB,IAAI,EAAE,YAAY;YAClB,WAAW;YACX,IAAI;YACJ,SAAS,EAAE,IAAI;YACf,QAAQ;YACR,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,UAAU,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,iBAAiB;IACjB,UAAU,CAAC,wBAAwB,EAAE;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,gBAAgB;IAChB,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACvG,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;QAC9G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC"}

package/dist/commands/setup-resolver.d.ts

@@ -0,0 +1,58 @@
+/**
+ * WP-336 E2 (CLI side): Dual-mode setup asset resolver for `pb handshake`.
+ *
+ * SetupMode:
+ *   local — reads skills/rules from .productbrain/ (current builder behavior, default).
+ *   chain — calls the Convex API (setup.getActiveSurface) and returns Chain-backed assets.
+ *
+ * The env var PB_SETUP_MODE controls which path runs:
+ *   unset or 'local' → local mode (no network call, fully offline-safe)
+ *   'chain'          → chain mode (requires authenticated kernelCall, user workspace)
+ *
+ * Chain: WP-336 (Agent Surface Foundation), DEC-619 (setup_receipt infrastructure)
+ */
+export type SetupMode = 'local' | 'chain';
+/**
+ * Unified asset shape returned by resolveSetupAssets.
+ *
+ * Local mode:   assetKind derived from .productbrain/ directory (skills/ → 'skill', rules/ → 'rule').
+ * Chain mode:   assetKind comes from the entry's data.assetKind field (seeded by WP-336 E3 seed).
+ *
+ * The `body` field is the raw Markdown content that gets written to adapter files.
+ * The `source` field is informational — used for reporting/telemetry, not for write decisions.
+ */
+export interface SetupAsset {
+    assetKind: 'skill' | 'rule' | 'hook';
+    displayName: string;
+    body: string;
+    source: 'seeded' | 'authored' | 'imported';
+}
+/**
+ * Wire shape returned by the Convex getActiveSurface query.
+ * Must match the return type of convex/setup.ts:getActiveSurface.
+ */
+export interface GetActiveSurfaceResult {
+    assetId: string;
+    assetKind: string;
+    displayName: string;
+    shortDescription: string;
+    body: string;
+    version: number;
+    source: string;
+}
+/**
+ * Returns the active SetupMode.
+ * Reads PB_SETUP_MODE from process.env.
+ * Unknown values default to 'local' (fail-open for forward compat).
+ */
+export declare function getSetupMode(): SetupMode;
+/**
+ * Resolve setup assets for the current mode.
+ *
+ * @param mode      - 'local' | 'chain', from getSetupMode()
+ * @param kernelCall - authenticated kernelCall function (from packages/cli/src/lib/client.ts)
+ *                    Only called in chain mode.
+ * @param cwd       - current working directory (for .productbrain/ path resolution)
+ */
+export declare function resolveSetupAssets(mode: SetupMode, kernelCall: <T>(fn: string, args: Record<string, unknown>) => Promise<T>, cwd: string): Promise<SetupAsset[]>;
+//# sourceMappingURL=setup-resolver.d.ts.map

package/dist/commands/setup-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-resolver.d.ts","sourceRoot":"","sources":["../../src/commands/setup-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;CAC5C;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,SAAS,CAIxC;AA6HD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EACxE,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvB"}

package/dist/commands/setup-resolver.js

@@ -0,0 +1,150 @@
+/**
+ * WP-336 E2 (CLI side): Dual-mode setup asset resolver for `pb handshake`.
+ *
+ * SetupMode:
+ *   local — reads skills/rules from .productbrain/ (current builder behavior, default).
+ *   chain — calls the Convex API (setup.getActiveSurface) and returns Chain-backed assets.
+ *
+ * The env var PB_SETUP_MODE controls which path runs:
+ *   unset or 'local' → local mode (no network call, fully offline-safe)
+ *   'chain'          → chain mode (requires authenticated kernelCall, user workspace)
+ *
+ * Chain: WP-336 (Agent Surface Foundation), DEC-619 (setup_receipt infrastructure)
+ */
+import { existsSync, readdirSync, readFileSync } from 'fs';
+import { join, basename } from 'path';
+// ── Mode resolution ───────────────────────────────────────────────────────────
+/**
+ * Returns the active SetupMode.
+ * Reads PB_SETUP_MODE from process.env.
+ * Unknown values default to 'local' (fail-open for forward compat).
+ */
+export function getSetupMode() {
+    const raw = process.env.PB_SETUP_MODE;
+    if (raw === 'chain')
+        return 'chain';
+    return 'local';
+}
+// ── Local mode ────────────────────────────────────────────────────────────────
+/**
+ * Read a single Markdown file from a .productbrain/ sub-directory.
+ * Returns the file body after stripping a minimal YAML frontmatter block
+ * (lines between opening and closing ---). If no frontmatter is found,
+ * returns the full file content unchanged.
+ *
+ * We intentionally keep this light — the local mode is a contract test pass-through
+ * that verifies parity with the existing handshake.ts lines 443–507 pipeline.
+ */
+function stripFrontmatter(raw) {
+    const lines = raw.split('\n');
+    if (lines[0]?.trim() !== '---')
+        return raw;
+    const closeIdx = lines.indexOf('---', 1);
+    if (closeIdx === -1)
+        return raw;
+    return lines.slice(closeIdx + 1).join('\n').trimStart();
+}
+/**
+ * Read skills from .productbrain/skills/ and map them to SetupAsset[].
+ * Mirrors the shape produced by readCanonicalSkills() in portable-knowledge.ts.
+ * Does NOT apply level/stage filtering — that remains in the handshake pipeline.
+ */
+function readLocalSkillAssets(pbDir) {
+    const skillsDir = join(pbDir, 'skills');
+    if (!existsSync(skillsDir))
+        return [];
+    const files = readdirSync(skillsDir).filter((f) => f.endsWith('.md'));
+    return files.map((file) => {
+        const raw = readFileSync(join(skillsDir, file), 'utf8');
+        const displayName = basename(file, '.md');
+        return {
+            assetKind: 'skill',
+            displayName,
+            body: stripFrontmatter(raw),
+            source: 'authored',
+        };
+    });
+}
+/**
+ * Read rules from .productbrain/rules/ and map them to SetupAsset[].
+ * Mirrors the shape produced by readCanonicalRules() in portable-knowledge.ts.
+ */
+function readLocalRuleAssets(pbDir) {
+    const rulesDir = join(pbDir, 'rules');
+    if (!existsSync(rulesDir))
+        return [];
+    const files = readdirSync(rulesDir).filter((f) => f.endsWith('.md'));
+    return files.map((file) => {
+        const raw = readFileSync(join(rulesDir, file), 'utf8');
+        const displayName = basename(file, '.md');
+        return {
+            assetKind: 'rule',
+            displayName,
+            body: stripFrontmatter(raw),
+            source: 'authored',
+        };
+    });
+}
+/**
+ * Local mode: return skills + rules from .productbrain/.
+ *
+ * This is the identity pass-through — the assets returned here are the same
+ * files that handshake.ts lines 443–507 already read via readCanonicalSkills()
+ * and readCanonicalRules(). The resolver does NOT replace those calls; it is a
+ * parallel view used for contract testing and mode-switching.
+ */
+function resolveLocalAssets(pbDir) {
+    return [
+        ...readLocalSkillAssets(pbDir),
+        ...readLocalRuleAssets(pbDir),
+    ];
+}
+// ── Chain mode ────────────────────────────────────────────────────────────────
+/**
+ * Map a raw GetActiveSurfaceResult to a typed SetupAsset.
+ * Falls back gracefully on unexpected assetKind values.
+ */
+function mapChainAsset(raw) {
+    const assetKind = raw.assetKind === 'rule' ? 'rule'
+        : raw.assetKind === 'hook' ? 'hook'
+            : 'skill'; // default — skill is the safe fallback
+    const source = raw.source === 'authored' ? 'authored'
+        : raw.source === 'imported' ? 'imported'
+            : 'seeded';
+    return {
+        assetKind,
+        displayName: raw.displayName,
+        body: raw.body,
+        source,
+    };
+}
+/**
+ * Chain mode: call setup.getActiveSurface via the AKI gateway and return assets.
+ *
+ * workspaceId is injected server-side by the gateway (BR-18).
+ * personId is injected server-side by injectSessionAuth — the CLI does not pass it.
+ *
+ * @param kernelCall - the authenticated kernelCall function from the handshake flow
+ */
+async function resolveChainAssets(kernelCall) {
+    const results = await kernelCall('setup.getActiveSurface', {});
+    return results.map(mapChainAsset);
+}
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Resolve setup assets for the current mode.
+ *
+ * @param mode      - 'local' | 'chain', from getSetupMode()
+ * @param kernelCall - authenticated kernelCall function (from packages/cli/src/lib/client.ts)
+ *                    Only called in chain mode.
+ * @param cwd       - current working directory (for .productbrain/ path resolution)
+ */
+export async function resolveSetupAssets(mode, kernelCall, cwd) {
+    if (mode === 'chain') {
+        return resolveChainAssets(kernelCall);
+    }
+    // local mode — read from .productbrain/ (synchronous, no network)
+    const pbDir = join(cwd, '.productbrain');
+    return resolveLocalAssets(pbDir);
+}
+//# sourceMappingURL=setup-resolver.js.map

package/dist/commands/setup-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-resolver.js","sourceRoot":"","sources":["../../src/commands/setup-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAoCtC,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACtC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO;YACL,SAAS,EAAE,OAAgB;YAC3B,WAAW;YACX,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAC3B,MAAM,EAAE,UAAmB;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO;YACL,SAAS,EAAE,MAAe;YAC1B,WAAW;YACX,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAC3B,MAAM,EAAE,UAAmB;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO;QACL,GAAG,oBAAoB,CAAC,KAAK,CAAC;QAC9B,GAAG,mBAAmB,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,SAAS,aAAa,CAAC,GAA2B;IAChD,MAAM,SAAS,GACb,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM;QACjC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM;YACnC,CAAC,CAAC,OAAO,CAAC,CAAC,uCAAuC;IAEpD,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU;QACtC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU;YACxC,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO;QACL,SAAS;QACT,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAC/B,UAAwE;IAExE,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,wBAAwB,EACxB,EAAE,CACH,CAAC;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AACpC,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAe,EACf,UAAwE,EACxE,GAAW;IAEX,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACzC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/commands/setup-state.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `pb setup-state` — WP-431 S3.
+ *
+ * Calls the Convex `getPbSetupState` query and emits the result as compact JSON
+ * on stdout. Machine-readable always — the skill body parses this.
+ *
+ * Auth & userId injection (STD-234 perimeter):
+ *   The HTTP gateway derives `workspaceId` and `userId` from the API key and
+ *   passes them server-side; the CLI does not need to know the user's id.
+ *   Defense-in-depth equality check happens inside the query handler.
+ *
+ * Exit codes (CLI convention):
+ *   0  success — JSON written to stdout
+ *   2  auth/permission — AUTH_* / AUTHZ_* error class
+ *   3  network — host unreachable / fetch failed
+ *   1  other (validation / internal)
+ */
+export interface RunSetupStateOptions {
+    /** Pre-fetched state — used by `pb setup` to avoid a duplicate gateway round-trip. */
+    preloaded?: SetupStateResult;
+}
+export interface SetupStateResult {
+    phase: number | 'settings';
+    role: 'creator' | 'joiner';
+    expectedAction: string;
+    reasonForPhase: string;
+    isComplete: boolean;
+    /**
+     * WP-431 S3 review fix #1: structural surfaceCapability passthrough.
+     * Mirrors the resolver output (PbSetupStateOutput.surfaceCapability).
+     */
+    surfaceCapability: 'cli' | 'chat-only';
+}
+export declare function fetchSetupState(): Promise<SetupStateResult>;
+export declare function runSetupState(opts?: RunSetupStateOptions): Promise<void>;
+/**
+ * Map a setup-state failure to the documented exit-code contract.
+ * Always re-throws (typed `never`) so the global handler in index.ts can format
+ * the message; we route through CLIError so JSON mode reports `code` cleanly.
+ */
+export declare function handleSetupError(err: unknown): never;
+//# sourceMappingURL=setup-state.d.ts.map

package/dist/commands/setup-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-state.d.ts","sourceRoot":"","sources":["../../src/commands/setup-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,MAAM,WAAW,oBAAoB;IACnC,sFAAsF;IACtF,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3B,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,iBAAiB,EAAE,KAAK,GAAG,WAAW,CAAC;CACxC;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAEjE;AAED,wBAAsB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQlF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAiCpD"}

package/dist/commands/setup-state.js

@@ -0,0 +1,93 @@
+/**
+ * `pb setup-state` — WP-431 S3.
+ *
+ * Calls the Convex `getPbSetupState` query and emits the result as compact JSON
+ * on stdout. Machine-readable always — the skill body parses this.
+ *
+ * Auth & userId injection (STD-234 perimeter):
+ *   The HTTP gateway derives `workspaceId` and `userId` from the API key and
+ *   passes them server-side; the CLI does not need to know the user's id.
+ *   Defense-in-depth equality check happens inside the query handler.
+ *
+ * Exit codes (CLI convention):
+ *   0  success — JSON written to stdout
+ *   2  auth/permission — AUTH_* / AUTHZ_* error class
+ *   3  network — host unreachable / fetch failed
+ *   1  other (validation / internal)
+ */
+import { kernelCall, McpError } from '../lib/client.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+export async function fetchSetupState() {
+    return await kernelCall('setup.getPbSetupState', {});
+}
+export async function runSetupState(opts = {}) {
+    let result;
+    try {
+        result = opts.preloaded ?? (await fetchSetupState());
+    }
+    catch (err) {
+        handleSetupError(err);
+    }
+    process.stdout.write(JSON.stringify(result) + '\n');
+}
+/**
+ * Map a setup-state failure to the documented exit-code contract.
+ * Always re-throws (typed `never`) so the global handler in index.ts can format
+ * the message; we route through CLIError so JSON mode reports `code` cleanly.
+ */
+export function handleSetupError(err) {
+    if (err instanceof McpError) {
+        const code = err.code;
+        if (code && (code.startsWith('AUTH') || code.startsWith('AUTHZ'))) {
+            const wrapped = new CLIError(err.message, {
+                code: ErrorCode.AUTH_DENIED,
+                category: 'auth',
+                guidance: 'Run `pb login` to refresh your API key, or check workspace membership.',
+            });
+            writeJsonError(wrapped);
+            process.exit(2);
+        }
+        writeJsonError(err);
+        process.exit(1);
+    }
+    if (err instanceof CLIError && err.category === 'network') {
+        writeJsonError(err);
+        process.exit(3);
+    }
+    if (err instanceof CLIError && err.category === 'auth') {
+        writeJsonError(err);
+        process.exit(2);
+    }
+    if (err instanceof CLIError) {
+        writeJsonError(err);
+        process.exit(1);
+    }
+    const wrapped = new CLIError(err instanceof Error ? err.message : String(err), {
+        code: ErrorCode.INTERNAL,
+        category: 'internal',
+    });
+    writeJsonError(wrapped);
+    process.exit(1);
+}
+/**
+ * Write a structured JSON error to stderr. WP-431 S3 review (Boy Scout #2):
+ * route every shape through CLIError.toJSON() so the stderr envelope is
+ * identical to every other CLI command (no per-call ad-hoc shapes).
+ */
+function writeJsonError(err) {
+    const cliErr = toCLIError(err);
+    process.stderr.write(JSON.stringify(cliErr.toJSON()) + '\n');
+}
+function toCLIError(err) {
+    if (err instanceof CLIError)
+        return err;
+    if (err instanceof Error) {
+        const code = err.code;
+        const errorCode = code && Object.values(ErrorCode).includes(code)
+            ? code
+            : ErrorCode.INTERNAL;
+        return new CLIError(err.message, { code: errorCode, category: 'internal' });
+    }
+    return new CLIError(String(err), { code: ErrorCode.INTERNAL, category: 'internal' });
+}
+//# sourceMappingURL=setup-state.js.map

package/dist/commands/setup-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-state.js","sourceRoot":"","sources":["../../src/commands/setup-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAoBvD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,MAAM,UAAU,CAAmB,uBAAuB,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B,EAAE;IACjE,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAA0B,CAAC;QAC5C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE;gBACxC,IAAI,EAAE,SAAS,CAAC,WAAW;gBAC3B,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,wEAAwE;aACnF,CAAC,CAAC;YACH,cAAc,CAAC,OAAO,CAAC,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1D,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACvD,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QAC7E,IAAI,EAAE,SAAS,CAAC,QAAQ;QACxB,QAAQ,EAAE,UAAU;KACrB,CAAC,CAAC;IACH,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,GAAG,YAAY,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAI,GAAiC,CAAC,IAAI,CAAC;QACrD,MAAM,SAAS,GACb,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAkD,CAAC;YAC3F,CAAC,CAAE,IAAmD;YACtD,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;QACzB,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;AACvF,CAAC"}

package/dist/commands/setup.d.ts

@@ -1,15 +1,23 @@
 /**
- * pb setup — guided first-time onboarding: npm install → first capture.
- * WP-301 Slice 3. Each step emits telemetry (STD-155 event names).
+ * `pb setup` — WP-431 S3 canonical entry point (DEC-995).
  *
  * Flow:
- *   0. Check existing config → offer health check or continue to login
- *   1. Account check → signup URL or login inline
- *   2. Workspace binding confirmation
- *   3. Guided first capture (starts a session, captures via MCP)
- *   4. Summary with next-step hint
+ *   1. Auto-detect surface markers and union-merge into `manifest.surfaces` (S3 #1).
+ *      Phase-1 users land here with empty surfaces; this single auto-detect lifts
+ *      them to Phase 2 without requiring a separate `pb setup-detect-surfaces` run.
+ *   2. Read pb-setup state via the Convex query (`setup.getPbSetupState`).
+ *   3. Record invocation receipt — first-write-wins per DEC-996, idempotent.
+ *   4. Emit the resolved state JSON on stdout for the skill body to consume.
  *
- * WP-303 Slice 1: migrated from readline to @clack/prompts via lib/prompts.ts.
+ * `pb start` (session-start alias) is unchanged and keeps the same call path it
+ * had before this slice.
+ *
+ * Legacy `pb setup` (WP-301) — guided onboarding via @clack/prompts — is removed
+ * from the canonical entry per DEC-995. The login flow remains reachable via
+ * `pb login`.
  */
-export declare function runSetup(): Promise<void>;
+export interface RunSetupOptions {
+    cwd?: string;
+}
+export declare function runSetup(opts?: RunSetupOptions): Promise<void>;
 //# sourceMappingURL=setup.d.ts.map

package/dist/commands/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA+BH,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAE9C"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BxE"}

package/dist/commands/setup.js

@@ -1,148 +1,69 @@
 /**
- * pb setup — guided first-time onboarding: npm install → first capture.
- * WP-301 Slice 3. Each step emits telemetry (STD-155 event names).
+ * `pb setup` — WP-431 S3 canonical entry point (DEC-995).
  *
  * Flow:
- *   0. Check existing config → offer health check or continue to login
- *   1. Account check → signup URL or login inline
- *   2. Workspace binding confirmation
- *   3. Guided first capture (starts a session, captures via MCP)
- *   4. Summary with next-step hint
+ *   1. Auto-detect surface markers and union-merge into `manifest.surfaces` (S3 #1).
+ *      Phase-1 users land here with empty surfaces; this single auto-detect lifts
+ *      them to Phase 2 without requiring a separate `pb setup-detect-surfaces` run.
+ *   2. Read pb-setup state via the Convex query (`setup.getPbSetupState`).
+ *   3. Record invocation receipt — first-write-wins per DEC-996, idempotent.
+ *   4. Emit the resolved state JSON on stdout for the skill body to consume.
  *
- * WP-303 Slice 1: migrated from readline to @clack/prompts via lib/prompts.ts.
+ * `pb start` (session-start alias) is unchanged and keeps the same call path it
+ * had before this slice.
+ *
+ * Legacy `pb setup` (WP-301) — guided onboarding via @clack/prompts — is removed
+ * from the canonical entry per DEC-995. The login flow remains reachable via
+ * `pb login`.
  */
-import { getConfig } from '../lib/config.js';
+import { runSetupDetectSurfaces, formatDetectSurfacesSummary } from './setup-detect-surfaces.js';
+import { fetchSetupState, handleSetupError } from './setup-state.js';
 import { kernelCall } from '../lib/client.js';
-import { readSession, writeSession } from '../lib/session.js';
-import { trackEvent } from '../lib/telemetry.js';
-import { runLogin } from './login.js';
-import { initTelemetry } from '../lib/telemetry.js';
-import { confirm as promptConfirm } from '../lib/prompts.js';
-import { bold } from '../lib/style.js';
-/** Mask an API key for display: show prefix + last 4 chars. */
-function maskKey(key) {
-    if (key.length <= 10)
-        return key.slice(0, 6) + '****';
-    return key.slice(0, 6) + '...' + key.slice(-4);
-}
-export async function runSetup() {
-    await runSetupFlow();
-}
-async function runSetupFlow() {
-    console.log('');
-    console.log('Product Brain — Setup');
-    console.log('=====================');
-    console.log('');
-    // Step 1: Check existing config
-    let hasValidConfig = false;
+export async function runSetup(opts = {}) {
+    const cwd = opts.cwd ?? process.cwd();
+    const isTty = Boolean(process.stdout.isTTY);
+    let initialState;
     try {
-        const config = getConfig();
-        hasValidConfig = true;
-        console.log(`Already configured: ${maskKey(config.apiKey)}`);
-        console.log(`API endpoint: ${config.siteUrl}`);
-        console.log('');
-        // Verify workspace connectivity
-        let wsName = 'your workspace';
-        let wsId;
-        try {
-            const workspace = await kernelCall('resolveWorkspace', {});
-            if (workspace?.name) {
-                console.log(`Connected to workspace: ${workspace.name}`);
-                wsName = workspace.name;
-                wsId = workspace._id;
-            }
-            else {
-                console.log('Workspace connection verified.');
-            }
-            trackEvent('workspace_bound');
-        }
-        catch {
-            console.log('Warning: Could not verify workspace connection. Your key may be invalid.');
-            console.log('Run `pb login` to re-enter your API key.');
-            return;
-        }
-        console.log('');
-        // Already configured — go straight to onboarding conversation (WP-304)
-        await ensureSessionAndOnboard(wsName, wsId);
-        return;
+        initialState = await fetchSetupState();
     }
-    catch {
-        // No valid config — continue to login
+    catch (err) {
+        handleSetupError(err);
     }
-    // Step 2: Account check + login (only if no valid config)
-    if (!hasValidConfig) {
-        console.log('To get started, you need a Product Brain account and API key.');
-        console.log('');
-        const hasAccount = await promptConfirm({ message: 'Do you have a Product Brain account?', initialValue: false });
-        if (!hasAccount) {
-            console.log('');
-            console.log('Create an account at: https://productbrain.io');
-            console.log('Then come back and run: pb setup');
-            console.log('');
-            return;
+    // Always record invocation — first-write-wins per DEC-996.
+    await recordInvocationBestEffort(initialState);
+    let finalState = initialState;
+    if (initialState.phase === 1) {
+        const detect = await runSetupDetectSurfaces({ cwd });
+        if (isTty) {
+            process.stderr.write(formatDetectSurfacesSummary(detect) + '\n');
         }
-        // Run login flow — handles key prompt, validation, and saving
-        console.log('');
-        await runLogin();
-        trackEvent('key_validated');
-        await runSetupPostLogin();
-        return;
-    }
-}
-async function runSetupPostLogin() {
-    console.log('');
-    let wsName = 'your workspace';
-    let wsId;
-    try {
-        const workspace = await kernelCall('resolveWorkspace', {});
-        if (workspace?.name) {
-            console.log(`Connected to workspace: ${workspace.name}`);
-            wsName = workspace.name;
-            wsId = workspace._id;
+        if (detect.manifestUpdated) {
+            try {
+                finalState = await fetchSetupState();
+            }
+            catch (err) {
+                handleSetupError(err);
+            }
         }
-        trackEvent('workspace_bound');
-    }
-    catch {
-        console.log('Could not reach workspace. Try: pb orient -b');
-        return;
     }
-    await ensureSessionAndOnboard(wsName, wsId);
+    process.stdout.write(JSON.stringify(finalState) + '\n');
 }
-/** Ensure a session exists, then run the onboarding conversation. */
-async function ensureSessionAndOnboard(workspaceName, workspaceId) {
-    let session = readSession();
-    if (!session) {
-        try {
-            const resolvedWs = workspaceId
-                ? { _id: workspaceId, keyId: null }
-                : await kernelCall('resolveWorkspace', {});
-            if (!resolvedWs)
-                return;
-            const result = await kernelCall('agent.startSession', {
-                workspaceId: resolvedWs._id,
-                apiKeyId: resolvedWs.keyId,
-                clientKind: 'cli',
-            });
-            session = {
-                sessionId: result.sessionId,
-                workspaceId: resolvedWs._id,
-                workspaceName: workspaceName,
-                startedAt: new Date().toISOString(),
-                entriesCaptured: [],
-            };
-            writeSession(session);
-        }
-        catch {
-            // Session start failed — onboarding can still work for reads
-        }
-    }
-    // Initialize telemetry with workspace context
-    if (session?.workspaceId) {
-        initTelemetry(session.workspaceId);
+async function recordInvocationBestEffort(state) {
+    // WP-431 S3 review fix #1: surfaceCapability is now a structural field on the
+    // resolver output (PbSetupStateOutput.surfaceCapability) — read it directly
+    // rather than string-grepping reasonForPhase strings the producer never
+    // emits. The pre-fix `inferSurfaceCapability` always returned 'cli' for
+    // chat-only users, silently breaking KEY-32 dual-threshold telemetry.
+    const surfaceCapability = state.surfaceCapability;
+    try {
+        await kernelCall('setup.recordSetupInvocation', { surfaceCapability });
     }
-    else if (workspaceId) {
-        initTelemetry(workspaceId);
+    catch (err) {
+        // Best-effort — invocation receipt is telemetry, never block the state
+        // read. WP-431 S3 review (Boy Scout #1): log to stderr so a silent failure
+        // doesn't strand KEY-32 dual-threshold attribution.
+        const message = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[pb setup] invocation attribution failed: ${message}\n`);
     }
-    process.stdout.write(`\n  Setup complete. Run ${bold('pb session start')} to begin a session.\n\n`);
 }
 //# sourceMappingURL=setup.js.map