@productbrain/cli 0.1.0-beta.984 → 0.1.0-beta.9860

package/dist/lib/style.js

@@ -113,36 +113,43 @@ export function formatCheck(status, label, detail) {
 // Admin UX framework (WP-312 S2, FEAT-972)
 // ---------------------------------------------------------------------------
 /**
- * Print an environment-aware admin banner. Suppressed in quiet mode.
+ * Colored deployment-tier tag — shared by `adminBanner` and any other surface (e.g. `pb profile
+ * create`'s receipt, WP-744 / 1e-B) that needs to name which tier a resolved host classifies as.
  *
  * Labels:
  * - [DEV] — localhost loopback
  * - [DEV·CLOUD] — known Convex Development (Cloud) deployment
  * - [PROD] — known production gateway / prod Convex deployment
  * - [CLOUD] — other remote URL (unknown tier)
- *
- * Format: "⚡ pb admin — [ENV] <host>"
  */
-export function adminBanner(siteUrl) {
-    if (isQuietMode())
-        return;
-    const host = parseHostname(siteUrl);
-    const tier = classifyDeployment(siteUrl);
-    let envTag;
+export function deploymentBadge(tier) {
     switch (tier) {
         case 'local':
-            envTag = green('[DEV]');
-            break;
+            return green('[DEV]');
         case 'prod':
-            envTag = red('[PROD]');
-            break;
+            return red('[PROD]');
         case 'dev-cloud':
-            envTag = cyan('[DEV·CLOUD]');
-            break;
+            return cyan('[DEV·CLOUD]');
         default:
-            envTag = yellow('[CLOUD]');
+            return yellow('[CLOUD]');
     }
-    process.stdout.write(`\n${bold(`\u26A1 pb admin`)} ${dim('\u2014')} ${envTag} ${dim(host)}\n\n`);
+}
+/**
+ * Print an environment-aware admin banner. Suppressed in quiet mode.
+ *
+ * Format: "⚡ pb admin — [ENV] <host>"
+ */
+export function adminBanner(siteUrl, profileLabel) {
+    if (isQuietMode())
+        return;
+    const host = parseHostname(siteUrl);
+    const envTag = deploymentBadge(classifyDeployment(siteUrl));
+    // WP-681: name WHICH credential resolved the target, not just the tier - the env tag alone
+    // never told you which of possibly several profiles put you there (the live-reproduced bug
+    // this closes: `pb admin run` silently resolving the operator's global profile - often prod -
+    // even inside a repo explicitly pinned to a dev-scoped one).
+    const profileSuffix = profileLabel ? ` ${dim(`(profile: ${profileLabel})`)}` : '';
+    process.stdout.write(`\n${bold(`\u26A1 pb admin`)} ${dim('\u2014')} ${envTag} ${dim(host)}${profileSuffix}\n\n`);
 }
 /**
  * Prompt for confirmation before a destructive admin operation (remote deployments).

package/dist/lib/style.js.map

@@ -1 +1 @@
-{"version":3,"file":"style.js","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,aAAa,EAAoB,IAAI,IAAI,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,QAAQ,EAAI,YAAY;IAC9B,IAAI,EAAE,QAAQ,EAAI,IAAI;IACtB,IAAI,EAAE,QAAQ,EAAI,mBAAmB;IACrC,KAAK,EAAE,QAAQ,EAAG,cAAc;IAChC,GAAG,EAAE,QAAQ,EAAK,aAAa;CACvB,CAAC;AAEX,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,oBAAoB;IACpB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,UAAU;IACnB,cAAc,EAAE,kBAAkB;IAClC,aAAa,EAAE,iBAAiB;IAEhC,kBAAkB;IAClB,SAAS,EAAE,kDAAkD;IAC7D,eAAe,EAAE,kDAAkD;IACnE,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,wBAAwB;IAEpC,oBAAoB;IACpB,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,gBAAgB,OAAO,EAAE;IACvD,UAAU,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,qBAAqB,UAAU,EAAE;CAC7D,CAAC;AAEX,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAgC,EAAE,KAAa,EAAE,MAAc;IACzF,MAAM,IAAI,GACR,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACnB,CAAC,CAAC,MAAM,KAAK,MAAM;YACjB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,WAAW,EAAE;QAAE,OAAO;IAE1B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAc,CAAC;IACnB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR,KAAK,MAAM;YACT,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM;QACR,KAAK,WAAW;YACd,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7B,MAAM;QACR;YACE,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAMvC;IACC,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IAClE,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"style.js","sourceRoot":"","sources":["../../src/lib/style.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAuB,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,aAAa,EAAoB,IAAI,IAAI,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,QAAQ,EAAI,YAAY;IAC9B,IAAI,EAAE,QAAQ,EAAI,IAAI;IACtB,IAAI,EAAE,QAAQ,EAAI,mBAAmB;IACrC,KAAK,EAAE,QAAQ,EAAG,cAAc;IAChC,GAAG,EAAE,QAAQ,EAAK,aAAa;CACvB,CAAC;AAEX,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,oBAAoB;IACpB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,UAAU;IACnB,cAAc,EAAE,kBAAkB;IAClC,aAAa,EAAE,iBAAiB;IAEhC,kBAAkB;IAClB,SAAS,EAAE,kDAAkD;IAC7D,eAAe,EAAE,kDAAkD;IACnE,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,wBAAwB;IAEpC,oBAAoB;IACpB,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,gBAAgB,OAAO,EAAE;IACvD,UAAU,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,qBAAqB,UAAU,EAAE;CAC7D,CAAC;AAEX,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,WAAW,EAAE;QAAE,OAAO;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAgC,EAAE,KAAa,EAAE,MAAc;IACzF,MAAM,IAAI,GACR,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACnB,CAAC,CAAC,MAAM,KAAK,MAAM;YACjB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvB,KAAK,WAAW;YACd,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B;YACE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,YAAqB;IAChE,IAAI,WAAW,EAAE;QAAE,OAAO;IAE1B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,2FAA2F;IAC3F,2FAA2F;IAC3F,8FAA8F;IAC9F,6DAA6D;IAC7D,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,YAAY,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,MAAM,CAAC,CAAC;AACnH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAMvC;IACC,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IAClE,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/lib/tokenConstants.d.ts

@@ -9,6 +9,8 @@
 export declare const API_KEY_PREFIX = "pb_sk_";
 /** Prefix for short-lived connect tokens (15-min, single-use). */
 export declare const CONNECT_TOKEN_PREFIX = "pb_ct_";
+/** Prefix for preview-only admin proof-bridge tokens (≤24h, workspace-pinned; WP-459). */
+export declare const PREVIEW_ADMIN_TOKEN_PREFIX = "pb_pat_";
 /**
  * Length of the random hex component in generated API keys.
  * 32 hex chars = 128-bit entropy.

package/dist/lib/tokenConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenConstants.d.ts","sourceRoot":"","sources":["../../src/lib/tokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qDAAqD;AACrD,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC"}
+{"version":3,"file":"tokenConstants.d.ts","sourceRoot":"","sources":["../../src/lib/tokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qDAAqD;AACrD,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC"}

package/dist/lib/tokenConstants.js

@@ -9,6 +9,8 @@
 export const API_KEY_PREFIX = 'pb_sk_';
 /** Prefix for short-lived connect tokens (15-min, single-use). */
 export const CONNECT_TOKEN_PREFIX = 'pb_ct_';
+/** Prefix for preview-only admin proof-bridge tokens (≤24h, workspace-pinned; WP-459). */
+export const PREVIEW_ADMIN_TOKEN_PREFIX = 'pb_pat_';
 /**
  * Length of the random hex component in generated API keys.
  * 32 hex chars = 128-bit entropy.

package/dist/lib/tokenConstants.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenConstants.js","sourceRoot":"","sources":["../../src/lib/tokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEvC,kEAAkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC"}
+{"version":3,"file":"tokenConstants.js","sourceRoot":"","sources":["../../src/lib/tokenConstants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEvC,kEAAkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC"}

package/dist/lib/workspaceNotice.d.ts

@@ -0,0 +1,202 @@
+/**
+ * WP-1 — Loud workspace identity on every Chain write. WP-714 S3 extended this to every
+ * Chain READ too (see `emitEffectiveTenantNotice`'s doc comment below for the read-path wiring).
+ *
+ * Running `pb` from a directory with no repo pin (e.g. `~/`) silently resolves the
+ * GLOBAL profile and writes to whichever Chain that points at — proven live: captures
+ * meant for one workspace landed on another. This module makes every Chain read or write
+ * NAME its target workspace on stderr, and qualifies the line LOUDLY when the binding is an
+ * unpinned fallback (`global`/`default` — no repo pin) so a wrong-Chain call is never
+ * silent. An explicit binding (`local`/`env`) gets a plain, non-alarming line.
+ *
+ * Label source — the PROFILE SLUG only, via `resolveReportedProfile()`: it returns
+ * `missing-pin` when the credential cascade has ALREADY refused (nothing to name — see the
+ * formatter below), and otherwise delegates to `resolveEffectiveProfile()`, whose contract
+ * the rest of this paragraph describes.
+ * Deliberately NOT a workspace-name probe: `resolveEffectiveProfile()` reports the
+ * *configured* pin even when it dangles (TEN-2163), while a probe resolves what
+ * `resolveConfig()` actually binds. On a dangling local pin the two DISAGREE — the
+ * profile says `source='local'` (a plain, reassuring line) while the probe returns the
+ * GLOBAL workspace the write really drifts to. That would print a non-alarming line over
+ * the exact silent-drift this notice exists to expose. One resolution path means the
+ * label and its qualifier can never contradict — and there is no per-write network
+ * round-trip in front of the write.
+ *
+ * Output contract — follows capture.ts's grounding banner (the JSON-safety pattern):
+ *  - The notice is written to STDERR, never stdout, so strict-JSON stdout is byte-for-byte
+ *    unchanged in every mode.
+ *  - There is NO output-mode gate at all (WP-721). Every mode — `--json`, `--quiet`, plain TTY —
+ *    gets the one-line-per-process identity notice. `--json` used to suppress the plain line for
+ *    an explicit binding, which left an agent in a correctly pinned repo with a ZERO-BYTE stderr
+ *    and no tenant signal whatsoever (see `emitEffectiveTenantNotice` below). TEN-3238 had
+ *    already exempted the unpinned-fallback WARNING from that gate; WP-721 removed the gate.
+ *
+ * NOT compared here: the repo-local pin against the globally active `pb` profile (DEC-1632,
+ * TEN-3398/WP-720 — reversing part of WP-714 S3/PR #823). An earlier version of this module
+ * warned on that divergence on every read and write. But the pin exists precisely to OVERRIDE
+ * global, and `pb profile use` reconciles the two by default (`--local`/`--global` are the
+ * opt-in ways to diverge them) — so a divergence is only ever a deliberate act, never drift.
+ * Warning on it forever trained operators to ignore the warning: one global profile and ten
+ * pinned workspaces means nine permanent warnings on entirely correct setups. That comparison
+ * belongs at the POINT OF ACTION instead — `pb profile use --global <name>` says so once, right
+ * when an operator creates the divergence (see `commands/profile.ts`'s `pinnedElsewhere` note) —
+ * never ambiently on every read or write after the fact. The three comparisons that DO still
+ * belong here share one shape pin-vs-global didn't: *the effective tenant is not what your
+ * binding SAYS* — no explicit binding at all (the unpinned-fallback warning below), a credential
+ * silently overriding the binding (`env-key`/`local-key`/`cwd-key`, in the loud set below), or
+ * the binding moving mid-session (`sessionBinding.ts`'s refusal). Pin-vs-global was a different
+ * comparison that got mistaken for one of these.
+ *
+ * SSOT: one pure formatter + one thin emitter — called explicitly from the 7 write-command
+ * files (8 call sites) and once per process from the shared kernel wrapper (`client.ts`'s
+ * `kernelCall`/`kernelCallEnvelope`/`kernelCallWithSession` — TEN-3398/WP-711 follow-up wired
+ * the write path in too, see `emitEffectiveTenantNotice`'s doc comment below) — no per-command
+ * copy-paste.
+ *
+ * `pb admin` is a SEPARATE credential cascade (`adminConfig.ts`'s `resolveAdminConfig`) that
+ * deliberately excludes CWD env files (TEN-1334); neither cascade reads committed `config.json`
+ * siteUrl (TEN-4500). It can resolve a different tenant than the cascade above, so it gets its own formatter-reusing
+ * emitter (`emitAdminTenantNotice`/`describeAdminTenantForRefusal` below) rather than sharing
+ * `emitEffectiveTenantNotice`'s guard or resolution path.
+ */
+import { type ReportedProfileSource } from './reportedProfile.js';
+import type { AdminConfigSource } from './adminConfig.js';
+import { assertSessionStillBound } from './sessionBinding.js';
+/** Inputs to the pure notice formatter. */
+export interface EffectiveTenantNoticeInput {
+    /** Effective profile name (the configured pin / identity), or null when unconfigured. */
+    profile: string | null;
+    /** Where that profile came from — see resolveReportedProfile(). */
+    source: ReportedProfileSource;
+}
+/**
+ * Build the one-line target-workspace notice — or null when there is nothing to say.
+ *
+ *  - `none`               → null (not configured: nothing to name, stay silent).
+ *  - `missing-pin`        → null (declared project, no pin: the CLI REFUSES this write, so
+ *                           there is no target workspace to name — and never `→ unknown`).
+ *  - `cwd-key`            → LOUD, unnamed (a dotenv file here picked the Chain — same shape as
+ *                           `env-key`, different file).
+ *  - `env-key`            → LOUD, unnamed (an exported PRODUCTBRAIN_API_KEY picked the Chain;
+ *                           no profile describes it, so the write goes somewhere this process
+ *                           cannot name from config — TEN-3240).
+ *  - `preview`            → named + disposable (a deliberate `npm run pb:preview` binding; the
+ *                           PREVIEW banner already shouts, so this does not shout twice).
+ *  - `global` / `default` → qualified + hint (no repo pin → an unpinned fallback binding).
+ *  - `local` / `env`      → plain (an explicit, intentional binding).
+ *
+ * Pure: no IO. The display label is the profile slug — a single resolution path, so the
+ * label and the qualifier can never contradict each other. DEC-1632/TEN-3398: no longer
+ * compares the pin against the globally active profile — see this module's header comment.
+ */
+export declare function formatEffectiveTenantNotice({ profile, source }: EffectiveTenantNoticeInput): string | null;
+/**
+ * The ONE place a `(profile, source)` pair maps to a human-readable label — no "→" prefix, so
+ * it can be embedded in prose (the tenant notice's base line, and WP-715's session-binding
+ * refusal message) rather than only ever printed as a standalone line. `formatEffectiveTenantNotice`
+ * above is the notice-line caller; `describeCurrentTenant` further down is the prose caller.
+ */
+export declare function describeReportedTenant(profile: string | null, source: ReportedProfileSource): string | null;
+/**
+ * Full prose description of the tenant CURRENTLY IN PLAY, for embedding in a message whose
+ * whole point is naming it — e.g. the session-binding refusal at `sessionBinding.ts` (WP-715).
+ * Unlike `formatEffectiveTenantNotice`, this never drops a shadowed repo pin: it states it explicitly, so
+ * a refusal reading "expected X, found Y" can never render the SAME tenant on both sides (the
+ * bug this closes — `resolveEffectiveProfile().profile` is blind to a credential override, so it
+ * always named the pin even while a foreign key was the one actually in play). Always returns a
+ * string — never null/undefined — so a caller building a "found ..." sentence never has to
+ * supply its own fallback.
+ *
+ * Deliberately UNQUOTED, including the shadowed pin: `sessionBinding.ts`'s
+ * `found "${found}"` template is the one place that wraps this whole value in quotes (the same
+ * template quotes `expected` too), so quoting the pin here as well double-quoted its closing
+ * mark (`...pin "product-brain""`) — cosmetic, but it reads like a typo in the exact message an
+ * agent surfaces to a human. This function owns zero quoting; the template owns all of it.
+ */
+export declare function describeCurrentTenant(profile: string | null, source: ReportedProfileSource): string;
+/**
+ * Live-resolving wrapper for `client.ts`'s `describeCurrent` thunk (WP-715): re-runs
+ * `resolveReportedProfile()` — never `resolveEffectiveProfile()`, which is blind to a
+ * credential override — so a session-binding refusal always names the tenant a call would
+ * actually land in. Kept here, not client.ts, so that call site stays a one-liner.
+ */
+export declare function describeCurrentTenantForRefusal(): string;
+/** Test-only: reset the once-per-process guard between cases (mirrors resetReportedProfileSnapshot). */
+export declare function resetEffectiveTenantNoticeForTests(): void;
+/**
+ * Resolve identity and write the target notice to STDERR — for every Chain read OR write, in
+ * EVERY output mode. WP-714 S3: originally called only from the 8 explicit write call sites;
+ * then ALSO called once per process from `client.ts`'s `kernelCall`/`kernelCallEnvelope` (the
+ * plain, non-session read path), so every read command that reaches the kernel announces too.
+ *
+ * ALSO wired into `kernelCallWithSession` (the write path) directly (TEN-3398 / WP-711
+ * follow-up). This comment used to claim that wiring was unnecessary because "every write
+ * command already calls this explicitly" — that premise was false: a census of every command
+ * module reaching `kernelCallWithSession` found 11 write commands (`accept-policy.ts`,
+ * `audit.ts`, `conflicts.ts`, `direction.ts`, `feedback.ts`, `handshake.ts`, `method.ts`,
+ * `questions.ts`, `rework.ts`, `shape.ts`, `verify.ts`) that never called this at all — a
+ * silent write with no target-workspace line, `chain.verifyEntry` and `rework.report` among
+ * them. A handful of write commands (`capture`/`promote`/`relate`/`restore`/`session`/
+ * `update`, plus the shared `organisationWrite.ts`/`runOrganisationWrite` helper used by
+ * `organisation.ts`/`organisationHierarchy.ts`) still call it explicitly, earlier in their own
+ * flow than any call `kernelCallWithSession` makes (e.g. `update`'s post-write
+ * `chain.getEntry` refresh) — the once-per-process guard makes `kernelCallWithSession`'s own
+ * call a no-op for those, so their output is unchanged bit-for-bit.
+ *
+ * Takes NO output-mode argument (WP-721). It used to take a `json` boolean that suppressed the
+ * plain line for an explicit binding; that parameter existed only to feed the gate, so it went
+ * with the gate rather than lingering as an ignored argument inviting the gate's return. The
+ * full reasoning is at the (now unconditional) emit inside the body — in short: `--json` is how
+ * agents invoke pb, agents are the bulk of both readers and writers, and a one-line-per-process
+ * stderr receipt naming the target Chain is the signal, not the noise. TEN-3238 had already made
+ * the unpinned-fallback WARNING survive `--json` for the same reason; WP-721 finished the job for
+ * the identity line itself. Safe in every mode because the notice goes to STDERR, so strict JSON
+ * on stdout stays byte-for-byte unchanged (and the CLI already writes unconditional stderr
+ * warnings elsewhere, e.g. the preview-scrub misroute in config.ts).
+ *
+ * DEC-1632/TEN-3398: does NOT compare the repo-local pin against the globally active profile —
+ * removed entirely (see this module's header comment). A prior version attached a "differs
+ * from the globally active Chain profile" line here that survived `--json` (WP-714 S3, PR
+ * #823); that line is gone, not just re-gated, because the pin existing to override global was
+ * never a warning-worthy condition in the first place.
+ *
+ * Never throws and does no network IO: a wrong/unreadable config degrades to silence, and
+ * the label comes from `resolveReportedProfile()` — only fast local config reads (no probe)
+ * in front of the call. It is safe to call immediately before any Chain read or write.
+ */
+export declare function emitEffectiveTenantNotice(): Promise<void>;
+/**
+ * `pb admin`'s own identity, as `resolveAdminConfig()` actually resolved it — for
+ * `emitAdminTenantNotice`/`describeAdminTenantForRefusal` below (TEN-3398 / WP-711 follow-up).
+ */
+export interface AdminTenantIdentity {
+    profileName: string | null;
+    source: AdminConfigSource;
+}
+/** Test-only: reset admin's once-per-identity guard between cases. */
+export declare function resetAdminTenantNoticeForTests(): void;
+/**
+ * Resolve identity and write `pb admin`'s target notice to STDERR — once per DISTINCT identity
+ * per process (TEN-3398 / WP-711 follow-up: `adminCall` previously carried no notice at all,
+ * the one gap left after WP-712/WP-714 S3 covered every other kernel path).
+ *
+ * Unlike `emitEffectiveTenantNotice`, this NEVER suppresses under `--json` and has no
+ * "unpinned fallback" vs "explicit binding" distinction: every `pb admin` command can be a
+ * destructive bulk operation (`manage:delete-workspace`, `seed:backfill-starter`), so the
+ * identity line is never noise to cut, in any mode.
+ */
+export declare function emitAdminTenantNotice(admin: AdminTenantIdentity): void;
+/**
+ * Prose description of `pb admin`'s CURRENT tenant, for embedding in the
+ * `assertSessionStillBound` refusal message — mirrors `describeCurrentTenantForRefusal`'s role
+ * on the non-admin path, but resolved off `resolveAdminConfig()`'s own identity rather than
+ * `resolveReportedProfile()`, for the same reason `adminSourceToReportedSource` exists.
+ */
+export declare function describeAdminTenantForRefusal(admin: AdminTenantIdentity): string;
+/**
+ * Announce AND guard one `pb admin` call in a single call (TEN-3398 / WP-711 follow-up) — kept
+ * here, not `client.ts`'s `adminCall` (STD-2/DEC-1504 module-health budget), so `adminCall`
+ * stays a one-liner and this module owns the whole admin-identity story end to end.
+ */
+export declare function guardAdminCall(admin: AdminTenantIdentity, session: Parameters<typeof assertSessionStillBound>[0], fingerprint: string): void;
+//# sourceMappingURL=workspaceNotice.d.ts.map

package/dist/lib/workspaceNotice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceNotice.d.ts","sourceRoot":"","sources":["../../src/lib/workspaceNotice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IACzC,yFAAyF;IACzF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mEAAmE;IACnE,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,0BAA0B,GAAG,MAAM,GAAG,IAAI,CAG1G;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAuB3G;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAInG;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,IAAI,MAAM,CAGxD;AAYD,wGAAwG;AACxG,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAuC/D;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAwCD,sEAAsE;AACtE,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAStE;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAEhF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,EACtD,WAAW,EAAE,MAAM,GAClB,IAAI,CAGN"}