@productbrain/cli 0.1.0-beta.98 → 0.1.0-beta.9817

package/dist/lib/rate-limit.d.ts

@@ -0,0 +1,38 @@
+/**
+ * WP-579 — client-side rate-limit resilience for the gateway helpers in client.ts
+ * (TEN-2923 touch amplification, TEN-2924 no-backoff-on-429).
+ *
+ * Split out of client.ts rather than grown inside it: these are two self-contained
+ * policies (when to retry a throttled call, when a session touch is worth sending) with
+ * their own constants and module-level state, and client.ts is at its STD-2 budget.
+ *
+ * Depends only on the error taxonomy — NOT on client.ts's `McpError` — so the two modules
+ * don't form an import cycle. The retry keys off the error's `code`, which is exactly what
+ * the guard tested before the split (`McpError` is the only thing that sets
+ * `code === 'rate-limited'` alongside a `retryAfterSeconds`).
+ */
+/**
+ * TEN-2924: bounded, jittered retry for a rate-limited call. Honors the server's
+ * Retry-After rather than guessing a backoff curve. Only retries a rate-limit refusal —
+ * never a validation/auth/internal failure, which retrying unchanged would just repeat.
+ */
+export declare function withRateLimitRetry<T>(attempt: () => Promise<T>): Promise<T>;
+/**
+ * Per-call knobs for the gateway helpers.
+ *
+ * `retryOnRateLimit: false` is the opt-out a BACKGROUND (unawaited) call must pass. A
+ * pending retry timer keeps the Node event loop alive, so retrying a fire-and-forget call
+ * holds the CLI process open long after its foreground work finished — breaking the very
+ * "never block" contract those call sites are written against. A background call that
+ * loses to a 429 is simply dropped; it is observability, not the user's work.
+ */
+export type KernelCallOptions = {
+    retryOnRateLimit?: boolean;
+    skipSessionTouch?: boolean;
+};
+/** Applies the rate-limit retry unless the caller opted out (background calls). */
+export declare function maybeRetry<T>(attempt: () => Promise<T>, options?: KernelCallOptions): Promise<T>;
+export declare function shouldTouchSession(sessionId: string): boolean;
+/** Test-only escape hatch — mirrors packages/mcp-server/src/client.ts's resetTouchThrottle. */
+export declare function resetTouchThrottle(sessionId?: string | null): void;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/lib/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/lib/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAsBH;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAajF;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3F,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,CAEhG;AAYD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM7D;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAMlE"}

package/dist/lib/rate-limit.js

@@ -0,0 +1,83 @@
+/**
+ * WP-579 — client-side rate-limit resilience for the gateway helpers in client.ts
+ * (TEN-2923 touch amplification, TEN-2924 no-backoff-on-429).
+ *
+ * Split out of client.ts rather than grown inside it: these are two self-contained
+ * policies (when to retry a throttled call, when a session touch is worth sending) with
+ * their own constants and module-level state, and client.ts is at its STD-2 budget.
+ *
+ * Depends only on the error taxonomy — NOT on client.ts's `McpError` — so the two modules
+ * don't form an import cycle. The retry keys off the error's `code`, which is exactly what
+ * the guard tested before the split (`McpError` is the only thing that sets
+ * `code === 'rate-limited'` alongside a `retryAfterSeconds`).
+ */
+import { ErrorCode } from './errors.js';
+const MAX_RATE_LIMIT_RETRIES = 3;
+const RATE_LIMIT_RETRY_JITTER_MS = 250;
+/**
+ * Ceiling on a single honored Retry-After. The server clamps its value to the tripped
+ * window (convex/rateLimiter.ts `retryAfterSeconds`) — 60s for the minute window, but
+ * 86_400s for the DAY window. Honoring that unconditionally would park the process for up
+ * to a day per attempt, three attempts deep. A day-quota denial is not something to wait
+ * out in-process: surface it so the caller can retry out of band.
+ */
+const MAX_RATE_LIMIT_RETRY_WAIT_SECONDS = 60;
+/** Seconds to wait, if this error is a rate-limit refusal that carries a Retry-After. */
+function rateLimitWaitOf(err) {
+    const candidate = err;
+    if (!candidate || candidate.code !== ErrorCode.RATE_LIMITED)
+        return undefined;
+    return typeof candidate.retryAfterSeconds === 'number' ? candidate.retryAfterSeconds : undefined;
+}
+/**
+ * TEN-2924: bounded, jittered retry for a rate-limited call. Honors the server's
+ * Retry-After rather than guessing a backoff curve. Only retries a rate-limit refusal —
+ * never a validation/auth/internal failure, which retrying unchanged would just repeat.
+ */
+export async function withRateLimitRetry(attempt) {
+    for (let retries = 0;; retries++) {
+        try {
+            return await attempt();
+        }
+        catch (err) {
+            const waitSeconds = rateLimitWaitOf(err);
+            if (waitSeconds === undefined || retries >= MAX_RATE_LIMIT_RETRIES)
+                throw err;
+            // Day-window denial (or any wait we won't sit on) — fail fast rather than hang.
+            if (waitSeconds > MAX_RATE_LIMIT_RETRY_WAIT_SECONDS)
+                throw err;
+            const delayMs = waitSeconds * 1000 + Math.random() * RATE_LIMIT_RETRY_JITTER_MS;
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
+    }
+}
+/** Applies the rate-limit retry unless the caller opted out (background calls). */
+export function maybeRetry(attempt, options) {
+    return options?.retryOnRateLimit === false ? attempt() : withRateLimitRetry(attempt);
+}
+/**
+ * TEN-2923: client-side throttle mirroring packages/mcp-server/src/client.ts's
+ * touchSessionActivity — the server already no-ops a touch made <5s after the last one
+ * for this session (TOUCH_SESSION_THROTTLE_MS, DEC-75), so a touch inside that window is
+ * pure wasted quota. Matching the server's own window here removes the waste without
+ * changing renewal semantics at all (a throttled call was already a server-side no-op).
+ */
+const _lastTouchAtBySession = new Map();
+const TOUCH_THROTTLE_MS = 5_000;
+export function shouldTouchSession(sessionId) {
+    const now = Date.now();
+    const lastTouchAt = _lastTouchAtBySession.get(sessionId) ?? 0;
+    if (now - lastTouchAt < TOUCH_THROTTLE_MS)
+        return false;
+    _lastTouchAtBySession.set(sessionId, now);
+    return true;
+}
+/** Test-only escape hatch — mirrors packages/mcp-server/src/client.ts's resetTouchThrottle. */
+export function resetTouchThrottle(sessionId) {
+    if (sessionId) {
+        _lastTouchAtBySession.delete(sessionId);
+        return;
+    }
+    _lastTouchAtBySession.clear();
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/lib/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/lib/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC;;;;;;GAMG;AACH,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAE7C,yFAAyF;AACzF,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,SAAS,GAAG,GAAwE,CAAC;IAC3F,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAC9E,OAAO,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAI,OAAyB;IACnE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,IAAI,sBAAsB;gBAAE,MAAM,GAAG,CAAC;YAC9E,gFAAgF;YAChF,IAAI,WAAW,GAAG,iCAAiC;gBAAE,MAAM,GAAG,CAAC;YAC/D,MAAM,OAAO,GAAG,WAAW,GAAG,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,0BAA0B,CAAC;YAChF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAaD,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAI,OAAyB,EAAE,OAA2B;IAClF,OAAO,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;AACxD,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,GAAG,GAAG,WAAW,GAAG,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACxD,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,SAAyB;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,qBAAqB,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC"}

package/dist/lib/readinessNotices.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The ONE served wording for a capped readiness scan — `chain.workspaceReadiness`'s
+ * accepted-entry sample hit its cap, so entry counts are floors and an apparent gap may already
+ * be covered. One declaration per package, imported by every surface that discloses it.
+ *
+ * Byte-identical to the MCP twin (packages/mcp-server/src/lib/readinessNotices.ts) but
+ * deliberately a separate constant: mcp-server's isolated Docker build resolves no private
+ * workspace package at runtime, the same constraint that keeps FEEDBACK_SUBMIT_HINT duplicated
+ * across the two packages (see scripts/check-notice-hint-drift.mjs for that pair's guard).
+ */
+export declare const READINESS_PROVISIONAL_LINE = "Readiness is provisional: its sample omitted accepted entries. Counts are lower bounds, apparent gaps may already be covered.";
+//# sourceMappingURL=readinessNotices.d.ts.map

package/dist/lib/readinessNotices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readinessNotices.d.ts","sourceRoot":"","sources":["../../src/lib/readinessNotices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,kIAC0F,CAAC"}

package/dist/lib/readinessNotices.js

@@ -0,0 +1,15 @@
+/**
+ * The ONE served wording for a capped readiness scan — `chain.workspaceReadiness`'s
+ * accepted-entry sample hit its cap, so entry counts are floors and an apparent gap may already
+ * be covered. One declaration per package, imported by every surface that discloses it.
+ *
+ * Byte-identical to the MCP twin (packages/mcp-server/src/lib/readinessNotices.ts) but
+ * deliberately a separate constant: mcp-server's isolated Docker build resolves no private
+ * workspace package at runtime, the same constraint that keeps FEEDBACK_SUBMIT_HINT duplicated
+ * across the two packages (see scripts/check-notice-hint-drift.mjs for that pair's guard).
+ */
+export const READINESS_PROVISIONAL_LINE = 'Readiness is provisional: its sample omitted accepted entries. Counts are lower bounds, apparent gaps may already be covered.';
+// TASK-435 (C4c): READINESS_PROVISIONAL_STAGE_SUFFIX deleted — it existed only to append onto
+// the deleted "Stage: X" line in formatters/orient.ts; that line is gone and this had no other
+// consumer (repo-wide grep, zero importers).
+//# sourceMappingURL=readinessNotices.js.map

package/dist/lib/readinessNotices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readinessNotices.js","sourceRoot":"","sources":["../../src/lib/readinessNotices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,+HAA+H,CAAC;AAElI,8FAA8F;AAC9F,+FAA+F;AAC/F,6CAA6C"}

package/dist/lib/repo-detect.d.ts

@@ -5,20 +5,26 @@
 /**
  * Workspace maturity profile derived from the Chain's workspaceReadiness signal.
  * Used by handshake to tailor generated context files (BET-170, DEC-291).
+ *
+ * WP-762 C4e-3 (DEC-1800): the `stage` ladder ('blank' | 'seeded' | 'grounded' | 'connected')
+ * is deleted from the backend response — no field on this profile derives from it any more.
  */
 export interface WorkspaceProfile {
-    stage: string;
     totalEntries: number;
     totalRelations: number;
     collectionCount: number;
     activeCount: number;
     draftCount: number;
     orphanedCount: number;
-    governanceMode: string;
 }
 /**
  * Extract a WorkspaceProfile from the raw workspaceReadiness API response.
  * Returns null on any failure — callers must handle null (fail-open pattern).
+ *
+ * WP-751 M3a-5b (TASK-210, DEC-1700): governanceMode is deleted from the required-fields
+ * gate below and the returned profile — the backend workspaceReadiness response no longer
+ * carries it at all (role is the only governance mode now), so requiring it truthy would
+ * have made this function return null unconditionally instead of just dropping one field.
  */
 export declare function extractWorkspaceProfile(response: unknown): WorkspaceProfile | null;
 export interface RepoContext {

package/dist/lib/repo-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-detect.d.ts","sourceRoot":"","sources":["../../src/lib/repo-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAsBlF;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,UAAU,CAAC,GAAG,SAAgB,GAAG,WAAW,CAiD3D"}
+{"version":3,"file":"repo-detect.d.ts","sourceRoot":"","sources":["../../src/lib/repo-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAoBlF;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,UAAU,CAAC,GAAG,SAAgB,GAAG,WAAW,CAiD3D"}

package/dist/lib/repo-detect.js

@@ -8,26 +8,31 @@ import { execSync } from 'child_process';
 /**
  * Extract a WorkspaceProfile from the raw workspaceReadiness API response.
  * Returns null on any failure — callers must handle null (fail-open pattern).
+ *
+ * WP-751 M3a-5b (TASK-210, DEC-1700): governanceMode is deleted from the required-fields
+ * gate below and the returned profile — the backend workspaceReadiness response no longer
+ * carries it at all (role is the only governance mode now), so requiring it truthy would
+ * have made this function return null unconditionally instead of just dropping one field.
  */
 export function extractWorkspaceProfile(response) {
     if (!response || typeof response !== 'object')
         return null;
     const r = response;
-    const stage = typeof r['stage'] === 'string' ? r['stage'] : null;
-    const governanceMode = typeof r['governanceMode'] === 'string' ? r['governanceMode'] : null;
-    if (!stage || !governanceMode)
+    // A sampled read cannot safely exclude portable guidance or describe workspace maturity.
+    // Reuse the existing unavailable-profile path instead of promoting it to an exact profile.
+    if (r['sampleTruncated'] === true)
+        return null;
+    const stats = r['stats'] && typeof r['stats'] === 'object' ? r['stats'] : null;
+    if (!stats || typeof stats['totalEntries'] !== 'number')
         return null;
-    const stats = r['stats'] && typeof r['stats'] === 'object' ? r['stats'] : {};
     const toNum = (v) => (typeof v === 'number' ? v : 0);
     return {
-        stage,
         totalEntries: toNum(stats['totalEntries']),
         totalRelations: toNum(stats['totalRelations']),
         collectionCount: toNum(stats['collectionCount']),
         activeCount: toNum(stats['activeCount']),
         draftCount: toNum(stats['draftCount']),
         orphanedCount: toNum(stats['orphanedCount']),
-        governanceMode,
     };
 }
 export function detectRepo(cwd = process.cwd()) {

package/dist/lib/repo-detect.js.map

@@ -1 +1 @@
-{"version":3,"file":"repo-detect.js","sourceRoot":"","sources":["../../src/lib/repo-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAiBzC;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,QAAmC,CAAC;IAE9C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1G,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,OAAO;QACL,KAAK;QACL,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9C,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChD,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC5C,cAAc;KACf,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC5C,MAAM,GAAG,GAAgB;QACvB,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,KAAK;KAClB,CAAC;IAEF,eAAe;IACf,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;YACtD,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;YAC1C,IAAI,GAAG,CAAC,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACvC,CAAC;IAED,aAAa;IACb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxH,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC;QACvB,2CAA2C;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1D,IAAI,CAAC;YAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;IAE7C,kBAAkB;IAClB,MAAM,MAAM,GAA8B;QACxC,CAAC,WAAW,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QACvD,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC,CAAC;QACjC,CAAC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACnE,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAC9C,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;KAC1C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAExC,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"repo-detect.js","sourceRoot":"","sources":["../../src/lib/repo-detect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAkBzC;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,QAAmC,CAAC;IAC9C,yFAAyF;IACzF,2FAA2F;IAC3F,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,cAAc,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC1C,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9C,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChD,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;KAC7C,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC5C,MAAM,GAAG,GAAgB;QACvB,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,EAAE;QACjB,UAAU,EAAE,KAAK;KAClB,CAAC;IAEF,eAAe;IACf,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;YACtD,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;YAC1C,IAAI,GAAG,CAAC,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACvC,CAAC;IAED,aAAa;IACb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxH,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC;QACvB,2CAA2C;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1D,IAAI,CAAC;YAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;IAE7C,kBAAkB;IAClB,MAAM,MAAM,GAA8B;QACxC,CAAC,WAAW,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QACvD,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC,CAAC;QACjC,CAAC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACnE,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAC9C,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;KAC1C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAExC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/reportedProfile.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Reported profile — the label status surfaces print.
+ *
+ * Credential resolution already refuses a declared project with no tenant
+ * (`getConfigSafe().kind === 'missing-pin'`). Labels must read that result
+ * rather than re-guess a cascade that names a workspace the CLI will not use.
+ *
+ * Lives outside config.ts (STD-2 / DEC-1504 shrink-only). Do not re-export
+ * from config.ts — this module imports FROM config.ts.
+ */
+import { type EffectiveProfileSource } from './config.js';
+export type ReportedProfileSource = EffectiveProfileSource | 'missing-pin' | 'env-key' | 'preview' | 'cwd-key' | 'local-key';
+export { isEnvKeyBinding, resetReportedProfileSnapshot } from './envKeySnapshot.js';
+export declare function resolveReportedProfile(): {
+    profile: string | null;
+    source: ReportedProfileSource;
+};
+//# sourceMappingURL=reportedProfile.d.ts.map

package/dist/lib/reportedProfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reportedProfile.d.ts","sourceRoot":"","sources":["../../src/lib/reportedProfile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAA0C,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAOlG,MAAM,MAAM,qBAAqB,GAC7B,sBAAsB,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;AAI7F,OAAO,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEpF,wBAAgB,sBAAsB,IAAI;IACxC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,qBAAqB,CAAC;CAC/B,CAiEA"}

package/dist/lib/reportedProfile.js

@@ -0,0 +1,144 @@
+/**
+ * Reported profile — the label status surfaces print.
+ *
+ * Credential resolution already refuses a declared project with no tenant
+ * (`getConfigSafe().kind === 'missing-pin'`). Labels must read that result
+ * rather than re-guess a cascade that names a workspace the CLI will not use.
+ *
+ * Lives outside config.ts (STD-2 / DEC-1504 shrink-only). Do not re-export
+ * from config.ts — this module imports FROM config.ts.
+ */
+import { resolveConfig, resolveEffectiveProfile } from './config.js';
+import { resolveConfigResult } from './configResult.js';
+import { declaresCompletePreviewBinding, declaresLocalBinding } from './localBinding.js';
+import { readLocalProjectConfig } from './projectConfig.js';
+import { getGlobalActiveProfile } from './profiles.js';
+import { isEnvKeyBinding } from './envKeySnapshot.js';
+// The snapshot itself lives in its own leaf so config.ts can use it too without a cycle.
+// Re-exported here because every label surface already imports it from this module.
+export { isEnvKeyBinding, resetReportedProfileSnapshot } from './envKeySnapshot.js';
+export function resolveReportedProfile() {
+    // Precedence mirrors the CREDENTIAL cascade (DEC-1607), so the label can never name a source
+    // that lost. An exported key wins resolveConfig() step 1 outright — ahead of the pin, ahead of
+    // the no-tenant refusal — so it is reported first, and `missing-pin` can never co-occur.
+    if (isEnvKeyBinding())
+        return { profile: null, source: 'env-key' };
+    // From here the answer comes from ONE place: the credential cascade re-run against the FILES.
+    //
+    // `ignoreEnvKey` is what makes that possible (TEN-3311). loadEnv() copies whichever credential
+    // won into PRODUCTBRAIN_API_KEY, so a plain getConfigSafe() after any kernel call reports every
+    // binding as `env` — which is why five review rounds each surfaced one more branch whose label
+    // was wrong. We have already established above that no OPERATOR export exists, so skipping
+    // step 1 recovers the branch that actually supplied the key, with the name it recorded.
+    const cfg = resolveConfigResult(() => resolveConfig(true));
+    if (!cfg.ok) {
+        // ONE RULE, and every refusal obeys it: a refusal is still an answer about WHICH binding is in
+        // play, so it must never be attributed to a source that binding already beat. Four review
+        // rounds found four refusals violating it, so they are handled by what the refusal KNOWS
+        // rather than case by case (Codex P2 r8, r16, r18, r20):
+        //   the no-tenant refusal   → say so; nothing is bound (r8).
+        //   it names the winner     → name it, even though the cascade then rejected what it held.
+        //                             Re-deriving returns a DIFFERENT profile when PB_PROFILE points
+        //                             at a missing one (r18).
+        //   it names only a source  → a dotenv file supplied it and then failed validation (r20).
+        //   config.local.json's own → an incomplete claim, or a complete one with a bad URL (r16).
+        // Only a DANGLING PIN falls through to the configured name, because naming the pin IS the
+        // diagnosis the operator needs there (TEN-2163).
+        if (cfg.kind === 'missing-pin')
+            return { profile: null, source: 'missing-pin' };
+        if (cfg.profileName)
+            return { profile: cfg.profileName, source: classifyProfileName(cfg.profileName) };
+        if (cfg.source === 'cwd')
+            return { profile: null, source: 'cwd-key' };
+        return classifyLocalBinding() ?? safeDerive();
+    }
+    const source = cfg.source;
+    switch (source) {
+        case 'project': {
+            // config.local.json won. `profileName` present = the repo PIN; absent = a direct
+            // apiKey/siteUrl binding, which resolveLocalBinding() puts AHEAD of any sibling pin
+            // (Codex P2 r7) — so naming that pin would name a workspace pb is not using.
+            if (cfg.profileName)
+                return { profile: cfg.profileName, source: 'local' };
+            return classifyLocalBinding() ?? { profile: null, source: 'local-key' };
+        }
+        // resolveProfileConfig() falls PB_PROFILE → active-profile file → "default" → legacy and
+        // RECORDS the winner, so a PB_PROFILE naming a DELETED profile no longer reports that dead
+        // name. Absent only for the nameless legacy home file, which no profile describes.
+        case 'profile':
+            // No name only for the nameless legacy home file, which is auto-migrated on first use;
+            // leave that rare path on the configured-name behaviour rather than inventing a label.
+            return cfg.profileName
+                ? { profile: cfg.profileName, source: classifyProfileName(cfg.profileName) }
+                : safeDerive();
+        // A dotenv file here supplied the key. No profile involved — same lie as env-key, other file.
+        case 'cwd':
+            return { profile: null, source: 'cwd-key' };
+        // 'env' cannot reach here — an operator export returned above. 'default' means no credential
+        // at all, so the configured name is the right thing to show.
+        case 'env':
+        case 'default':
+            return safeDerive();
+    }
+    // No `default:` on purpose. doneWhen asks for a CENSUS of every label path rather than sampling,
+    // and TEN-3311 is the record of what sampling cost: each review round turned up one more
+    // unmapped branch. A catch-all would let a NEW ConfigSource member join the union and silently
+    // fall through to the configured name — the same failure, one more time. This makes the compiler
+    // refuse to build until the new member is mapped, so the census cannot rot.
+    const unmapped = source;
+    return unmapped;
+}
+/**
+ * Name config.local.json's own direct binding, or null when it declares none. Shared by the
+ * success and refusal paths so a binding is described the same way whether it resolved or blew up.
+ */
+function classifyLocalBinding() {
+    try {
+        const local = readLocalProjectConfig();
+        // localBinding's OWN claim predicate, not a copy of it. Mine missed `apiKeyMalformed` — a
+        // wrong-prefix or non-string key, which resolveLocalBinding() still treats as a direct-binding
+        // claim that outranks the pin, so the label fell back to naming that pin (Codex P2 r17).
+        // Duplicating this test is what caused it; sharing it is what stops the next one.
+        if (!declaresLocalBinding(local))
+            return null;
+        const preview = declaresCompletePreviewBinding(local);
+        return preview
+            ? { profile: preview.workspaceName, source: 'preview' }
+            : { profile: null, source: 'local-key' };
+    }
+    catch {
+        return null;
+    }
+}
+/** The configured-name path, guarded: whoami must degrade on an unreadable/racing file, not throw. */
+function safeDerive() {
+    try {
+        return resolveEffectiveProfile();
+    }
+    catch {
+        return { profile: null, source: 'none' };
+    }
+}
+/**
+ * Where a profile NAME that actually supplied the credential came from.
+ *
+ * Same precedence as `resolveEffectiveProfile()`: repo pin > PB_PROFILE > global > default. The
+ * pin came last-minute (Codex P2 r19) — without it, a pinned profile whose URL is then rejected
+ * was reported `global`, pointing the operator at the wrong file to repair.
+ */
+function classifyProfileName(name) {
+    try {
+        if (name === readLocalProjectConfig()?.profile)
+            return 'local';
+    }
+    catch { /* fall through */ }
+    if (name === process.env.PB_PROFILE?.trim())
+        return 'env';
+    try {
+        if (name === getGlobalActiveProfile())
+            return 'global';
+    }
+    catch { /* fall through */ }
+    return name === 'default' ? 'default' : 'global';
+}
+//# sourceMappingURL=reportedProfile.js.map

package/dist/lib/reportedProfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reportedProfile.js","sourceRoot":"","sources":["../../src/lib/reportedProfile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAA+B,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKtD,yFAAyF;AACzF,oFAAoF;AACpF,OAAO,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEpF,MAAM,UAAU,sBAAsB;IAIpC,6FAA6F;IAC7F,+FAA+F;IAC/F,yFAAyF;IACzF,IAAI,eAAe,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACnE,8FAA8F;IAC9F,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,wFAAwF;IACxF,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,+FAA+F;QAC/F,0FAA0F;QAC1F,yFAAyF;QACzF,yDAAyD;QACzD,6DAA6D;QAC7D,2FAA2F;QAC3F,6FAA6F;QAC7F,sDAAsD;QACtD,0FAA0F;QAC1F,2FAA2F;QAC3F,0FAA0F;QAC1F,iDAAiD;QACjD,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAChF,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACvG,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACtE,OAAO,oBAAoB,EAAE,IAAI,UAAU,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,iFAAiF;YACjF,oFAAoF;YACpF,6EAA6E;YAC7E,IAAI,GAAG,CAAC,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1E,OAAO,oBAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC1E,CAAC;QACD,yFAAyF;QACzF,2FAA2F;QAC3F,mFAAmF;QACnF,KAAK,SAAS;YACZ,uFAAuF;YACvF,uFAAuF;YACvF,OAAO,GAAG,CAAC,WAAW;gBACpB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;gBAC5E,CAAC,CAAC,UAAU,EAAE,CAAC;QACnB,8FAA8F;QAC9F,KAAK,KAAK;YACR,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9C,6FAA6F;QAC7F,6DAA6D;QAC7D,KAAK,KAAK,CAAC;QACX,KAAK,SAAS;YACZ,OAAO,UAAU,EAAE,CAAC;IACxB,CAAC;IACD,iGAAiG;IACjG,yFAAyF;IACzF,+FAA+F;IAC/F,iGAAiG;IACjG,4EAA4E;IAC5E,MAAM,QAAQ,GAAU,MAAM,CAAC;IAC/B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;QACvC,0FAA0F;QAC1F,+FAA+F;QAC/F,yFAAyF;QACzF,kFAAkF;QAClF,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,OAAO,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,OAAO;YACZ,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE;YACvD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,sBAAsB,EAAE,EAAE,OAAO;YAAE,OAAO,OAAO,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,sBAAsB,EAAE;YAAE,OAAO,QAAQ,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC"}

package/dist/lib/ruleListRender.d.ts

@@ -0,0 +1,188 @@
+/**
+ * Rule delivery — served-row TEXT RENDERING (DEC-1774, TASK-436; B4b pre-review, findings 1+3).
+ *
+ * ONE implementation, generated into both connectors (`packages/cli/src/lib/ruleListRender.ts`,
+ * `packages/mcp-server/src/lib/ruleListRender.ts` — `scripts/generate-mcp-embedded-copies.mjs`)
+ * instead of two independently hand-maintained twins. Finding 3: the CLI and MCP copies had
+ * already drifted ("  Label:"/"    • " vs "Label:"/"  - ") with nothing pinning them — the same
+ * class of bug Constitution §13 exists to prevent ("connector copies are generated, never
+ * hand-edited on one side"). Living in `kernel/` rather than `convex/lib/` is deliberate: kernel
+ * has zero Convex/package build edges (STD-K1, INS-2092), so this file defines its OWN
+ * structural row/bucket/view shape rather than importing `convex/lib/ruleLists.ts`'s — a real
+ * `RuleListServedRow`/`ClientRuleListsResult` (or `@productbrain/kernel-client`'s type-only
+ * re-export of the former) satisfies these shapes structurally, no cast needed. Still a
+ * generated copy, not a live import, for the SAME reason every other kernel/ generator target
+ * is (see that generator's own header): Railway's isolated MCP Docker build cannot resolve a
+ * private workspace package at runtime, kernel included — TEN-3891 (no new convex/ module) does
+ * not apply here since this file is not under convex/, but the connector-isolation constraint
+ * still does.
+ *
+ * Finding 1 (silent truncation): `kernel/governance/ruleLists.ts:131`'s own contract — "a caller
+ * must not treat these lists as complete when `truncated` is true" — was being violated by
+ * BOTH connector renderers: `truncated`/`unassigned` reached every payload (declared on
+ * `RuleListsRenderView` since day one) but neither renderer ever printed them, so a truncated
+ * read looked identical to a complete one. Fixed here, once: a top-level trailer when
+ * `truncated`, a top-level trailer when `unassigned > 0`, and the per-bucket over-cap line says
+ * "at least +N more" (not a bare count) when `truncated` — the true trim count could be larger
+ * than what this capped-and-possibly-incomplete read could see.
+ */
+export interface RuleListRenderRow {
+    entryId: string;
+    bucket: 'everyone' | 'team' | 'role';
+    ownerRoleId?: string;
+    teamId?: string;
+    servedAt?: number;
+    /** TASK-551: present on a live serve; a served-log read (session show) carries ids only. */
+    name?: string;
+    why?: string;
+    date?: string;
+    confirmedBy?: string;
+    ownerRoleName?: string;
+}
+export interface RuleListRenderBucket {
+    rows: RuleListRenderRow[];
+    /** How many rules the list holds beyond its cap; every one of them is in `rows` (DEC-1890). */
+    overCap: number;
+}
+export interface RuleListsRenderView {
+    everyone: RuleListRenderBucket;
+    team: RuleListRenderBucket | null;
+    role: RuleListRenderBucket;
+    unassigned: number;
+    truncated: boolean;
+    /** True when some rows carry no owner or verifier name (the server's per-serve lookup bound). */
+    namesTruncated?: boolean;
+    /** The server's answer to "was this read served for an acting role?" (INS-2674). `false` prints
+     *  the no-acting-role line. Absent only on a view that withholds team and role by design and
+     *  says so itself (the shared handshake files, a served-log read). */
+    actingRoleBound?: boolean;
+}
+/** INS-2674 (WP-777, DEC-1888): a read with no acting role says why it shows only the everyone list. */
+export declare const NO_ACTING_ROLE_LINE = "(Team and role lists not served: this read has no acting role, because no active session with a role was found. Start a session, then orient again.)";
+/** One line per served rule, the ONE place it is formatted (TASK-551, DEC-1888): a live serve
+ *  prints "RULE-n — <name>. Why: <why> — <Role>, <date>"; a row with no name (a served-log read)
+ *  prints its ids. `—` stands for an owner the source does not carry, never a guessed one. */
+export declare function formatRuleListRow(row: RuleListRenderRow): string;
+/** One list ("Everyone"/"Team"/"Role") as a label line + one bullet per served row (every rule on
+ *  the list, DEC-1890) + one overflow line when the list is above its cap. `truncated` (finding 1)
+ *  makes the counts a floor, since the read may have missed rows. Empty/null bucket renders nothing. */
+export declare function formatRuleListBucketLines(label: string, bucket: RuleListRenderBucket | null | undefined, truncated: boolean): string[];
+/** All three buckets as text lines, plus the two finding-1 trailers — empty array only when
+ *  every bucket is empty/absent AND neither trailer applies. */
+export declare function formatRuleListsLines(ruleLists: RuleListsRenderView | undefined): string[];
+export interface BriefingFactsView {
+    purpose?: string;
+    vision?: string;
+    /** TASK-669 (TEN-4574): the purpose and vision ids, so every rung is one get away. */
+    purposeEntryId?: string;
+    visionEntryId?: string;
+    strategy?: {
+        entryId?: string;
+        name: string;
+        notDo?: string;
+    };
+    objective?: {
+        entryId: string | null;
+        name: string;
+        keyResults: Array<{
+            name: string;
+            currentValue: number | null;
+            targetValue: number | null;
+            readingUnresolved?: true;
+        }>;
+    };
+    currentWorkPackage?: {
+        entryId?: string;
+        name: string;
+    };
+    truncated?: true;
+    spineUnavailable?: true;
+    /** Round 3: the whole facts read failed; distinct from the objectives read alone failing. */
+    briefingUnavailable?: true;
+    /** TASK-620 (WP-801, DEC-1945): the acting role, served by session start only. */
+    role?: BriefingRoleView;
+}
+/** TASK-620 (WP-801, DEC-1945): the acting role a session opens with — its name and id, the team it
+ *  lives in (DEC-1944's placement; absent when the role has no single live placement) and its body.
+ *  The role body is free text printed verbatim; no code parses, validates, routes or judges on it,
+ *  and no field is added to roles or teams until a TEN-3658 trigger is recorded as a real occurrence. */
+export interface BriefingRoleView {
+    name: string;
+    entryId?: string;
+    team?: string;
+    body?: string;
+}
+/** DEC-1945: the four headings the roles collection's bodyTemplate offers (dev-system-collections.json),
+ *  as one line of text. The one place every role hint takes them from (TASK-622); nothing checks a body against them. */
+export declare const ROLE_BODY_HEADINGS = "Purpose, Decides, Routes elsewhere, Does not";
+/** TASK-620 (DEC-1945, DEC-1755): an empty body is a hint, never a refusal. Text only. */
+export declare function emptyRoleBodyHint(roleRef: string): string;
+/** TASK-622 (DEC-1945): printed when a role is captured and its caller wrote no body text in that command.
+ *  An offer, not a claim about the stored body (a capture may copy the name into it). */
+export declare function roleBodyOfferHint(roleRef: string): string;
+/** TASK-620 (DEC-1945): the acting role's lines — "Acting as role", "Team:", then the whole body
+ *  verbatim. The body is never truncated (the only cap is the entry body cap, ENTRY_BODY_MAX_CHARS)
+ *  and keeps its newlines and tabs. The body arrives already cleaned of control characters by its
+ *  kernel read (readActingRoleFacts, convex/agentKnowledge/briefingFacts.ts, review round 2), so the
+ *  text, structured and --json outputs all carry one clean body; this renderer only quotes it inside
+ *  the data tags. */
+export declare function formatActingRoleLines(role: BriefingRoleView): string[];
+/** TASK-625 (DEC-1947, DEC-1863): the one answer to "what is governance here", a label and five
+ *  sentences. The only copy: the session-start briefing prints it after the acting role (if any)
+ *  and before the rule lists; the connector instructions do not repeat it (RULE-657). */
+export declare const GOVERNANCE_HERE_LINES: readonly ["How governance works here:", string];
+/** TASK-669 (WP-820; TEN-4573, TEN-4581, TEN-4572): how an agent works with a person, a label and
+ *  one sentence per line. Session start prints it right after GOVERNANCE_HERE_LINES, never inside it
+ *  (DEC-1947 keeps that answer at five sentences); orient and the shared workspace files do not.
+ *  Who accepts is said once, in GOVERNANCE_HERE_LINES sentence 2 (RULE-657), never repeated here. */
+export declare const WORKING_WITH_PEOPLE_LINES: readonly ["Working with people:", "For facts about this organisation (people, roles, decisions, work), Product Brain outranks your memory and project files; when they disagree, say so and go with Product Brain.", "A draft is work in progress everyone in the organisation can see; accepted means true for the whole organisation.", "When you talk to a person, name things first and put the id in brackets, and say a role's name, not its id."];
+/** TASK-669 (WP-820; TEN-4574): the spine lines are entry titles; printed under them on every surface. */
+export declare const TITLES_LINE = "These are titles: read an entry in full before you explain or judge it.";
+export interface BriefingQuestionView {
+    entryId: string;
+    /** The question's title (its entry name). */
+    title: string;
+    ageDays?: number;
+}
+export interface BriefingView {
+    workspaceName?: string;
+    facts?: BriefingFactsView;
+    ruleLists?: RuleListsRenderView;
+    openQuestions?: BriefingQuestionView[];
+    /** The question read was capped: more open questions may exist than are listed. */
+    openQuestionsTruncated?: boolean;
+    /** Which surface prints the pull commands: the CLI's `pb …` or the MCP tools. */
+    surface: 'cli' | 'mcp';
+    /** TASK-554: a shared file states an empty rule list instead of dropping the section. */
+    rulesEmptyLine?: string;
+    /** TASK-625 (DEC-1947): set only by the two session-start renderers (CLI and connector); prints GOVERNANCE_HERE_LINES. */
+    sessionStart?: boolean;
+}
+/** How an agent pulls more than the briefing: one task-shaped orient, one entry, one search. */
+export declare const BRIEFING_PULL_COMMANDS: {
+    readonly cli: "pb orient --task \"<what you are doing>\" · pb get <ID> · pb search <query>";
+    readonly mcp: "orient task=\"<what you are doing>\" · context action=get entryId=<ID> · context action=search query=<query>";
+};
+/** How the agent answers an open question on each surface (reassign and force-close stay in the full question tools). */
+export declare const BRIEFING_ANSWER_COMMANDS: {
+    readonly cli: "pb question answer <ID> \"<answer>\"";
+    readonly mcp: "question action=answer entryId=<ID> text=\"<answer>\"";
+};
+/** Round 3 ruling: the briefing lists questions compactly; asker, why-you, dependents and the
+ *  legal actions are one pull away in the full question tool. */
+export declare const BRIEFING_QUESTION_DETAIL_COMMANDS: {
+    readonly cli: "pb question list";
+    readonly mcp: "question action=list";
+};
+/** The briefing as text lines, in one fixed order: where; purpose and vision whole; the
+ *  strategy and its NOT-DO line; the current objective with its key results; the current work
+ *  package; the titles line (TASK-669); the acting role, its team and its whole body (TASK-620);
+ *  what governance is here (TASK-625) and how to work with a person (TASK-669); the rule lists (one sentence
+ *  per rule); open questions; the three pull commands. */
+export declare function formatBriefingLines(view: BriefingView): string[];
+/** The briefing a file shared by every session in a worktree carries: `pb handshake`'s
+ *  context.md, everyone-rules.md and chain.mdc (TASK-554, WP-777, DEC-1888). The spine and the
+ *  Everyone list only; team and role lists are session-scoped, served by session start and orient,
+ *  never written into a shared file. The server decided every list; this only picks which one. */
+export declare function formatWorkspaceBriefingLines(facts: BriefingFactsView, ruleLists: RuleListsRenderView | undefined): string[];
+//# sourceMappingURL=ruleListRender.d.ts.map