waterplane 0.0.1 → 0.1.6

package/node_modules/@waterplane/shared/dist/bookmark.js

@@ -0,0 +1,40 @@
+/** A note, and a remembered tab name, are one line of at most this. */
+export const BOOKMARK_NOTE_CAP = 160;
+/** One line, collapsed whitespace, clipped with an ellipsis; empty ⇒ undefined. */
+export function clipBookmarkText(v, cap = BOOKMARK_NOTE_CAP) {
+    if (typeof v !== "string")
+        return undefined;
+    const t = v.replace(/\s+/g, " ").trim();
+    if (!t)
+        return undefined;
+    return t.length > cap ? `${t.slice(0, cap - 1).trimEnd()}…` : t;
+}
+/**
+ * A bookmark read off disk or the wire. A missing or non-positive `at` drops
+ * the WHOLE bookmark (`null`) — a row that cannot say when it was set is not
+ * one somebody set; `note`/`name` are clipped to one line and dropped empty.
+ */
+export function cleanBookmark(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const r = raw;
+    if (typeof r.at !== "number" || !Number.isFinite(r.at) || r.at <= 0)
+        return null;
+    const out = { at: r.at };
+    const note = clipBookmarkText(r.note);
+    const name = clipBookmarkText(r.name);
+    if (note)
+        out.note = note;
+    if (name)
+        out.name = name;
+    return out;
+}
+/**
+ * Is `id` a bare conversation id — the jsonl basename the CLI writes, and the
+ * only shape the host will turn into a path (`transcriptPath`)? The same rule
+ * the archive's delete has always applied: no separators, no dots, ≤128 chars.
+ */
+export function isConversationId(id) {
+    return typeof id === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(id);
+}
+//# sourceMappingURL=bookmark.js.map

package/node_modules/@waterplane/shared/dist/bookmark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bookmark.js","sourceRoot":"","sources":["../src/bookmark.ts"],"names":[],"mappings":"AAWA,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,CAAU,EAAE,GAAG,GAAG,iBAAiB;IAClE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,GAAG,GAAa,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAW;IAC1C,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,mCAAmC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC"}

package/node_modules/@waterplane/shared/dist/brand.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Everything that says which product this is. Pure data, no fs, no env.
+ *
+ * The point of this file is that the NEXT rename edits the values below and
+ * nothing else in `packages/*\/src`: every brand-bearing identifier is a field
+ * here, and every reader of an old one falls back through `LEGACY`. The file's
+ * own name, the helper names and every identifier elsewhere stay free of the
+ * word on purpose. What cannot import this (JSON, XML, Java, shell, html) is
+ * enumerated by `tools/brand.test.mjs`, which is the next rebrand's checklist.
+ */
+/** The identifiers a running install depends on — one set per identity. */
+export interface BrandIds {
+    /** Display, UI, docs, log tag. */
+    name: string;
+    /** npm, skill id, binary, temp prefixes. */
+    slug: string;
+    /** Prefix of every environment knob, `<prefix>PORT`. */
+    envPrefix: string;
+    /** `~/.config/<x>`, `~/.local/share/<x>`, `~/.local/state/<x>` (the daemon's global state). */
+    configDirName: string;
+    /** `<repo>/<x>` (per-repo state); `<root>/<x>` only as the OLD home of the global state, moved out at boot. */
+    stateDirName: string;
+    /** localStorage keys; a parked host's keys sit under `<prefix>h.<id>.`. */
+    storagePrefix: string;
+    /** IndexedDB database and Cache API prefix. */
+    cacheName: string;
+    /** WebSocket subprotocol; the token rides as `<wsProtocol>-tok.<token>`. */
+    wsProtocol: string;
+    /** The LAN auth cookie. */
+    cookie: string;
+    /** The pairing deep-link scheme, `<scheme>://pair`. */
+    pairScheme: string;
+    /** The launchd job label. */
+    launchdLabel: string;
+    /** Android applicationId. */
+    appId: string;
+    /** tmux `-L` server name; sessions are `<tmuxServer>_<id>`. */
+    tmuxServer: string;
+    /** A plugin's manifest file name. */
+    pluginManifest: string;
+    /** The `--plugin-dir` skill handed to every driven repo (`<skill>:<skill>`). */
+    skillName: string;
+}
+export interface Brand extends BrandIds {
+    /** `<repo>/<x>` — per-repo config meant to be COMMITTED (today `builds.json`), beside the
+     *  gitignored state dir. New with this identity, so no legacy name and no fallback. */
+    sharedDirName: string;
+    /** What a person reads in the UI. Lowercase is the decision, not an accident. */
+    displayName: string;
+    tagline: string;
+    domain: string;
+    githubOrg: string;
+    /** Short forms the repo-facing skill text accepts in prompts — never branding. */
+    promptAliases: readonly string[];
+    /** Seeded into the dictation prompt so the name is spelled right. */
+    dictationTerms: readonly string[];
+}
+export declare const BRAND: Brand;
+/** A past identity, plus the words a ratchet looks for to find what is left of it. */
+export interface LegacyBrand extends BrandIds {
+    words: readonly string[];
+}
+/** Cumulative: every past identity, NEWEST FIRST. Readers fall back through it
+ *  in order. An entry is removed only by the cleanup release that follows the
+ *  rename which made it legacy, never by the rename itself. */
+export declare const LEGACY: readonly LegacyBrand[];
+/** Every word, current and past, the brand-literal lint rule and the ratchet
+ *  test look for (lowercase; both match case-insensitively). */
+export declare const BRAND_WORDS: readonly string[];
+/** A localStorage key under the current prefix. */
+export declare const lsKey: (name: string) => string;
+/** Every legacy spelling of the same key, newest first. */
+export declare const legacyLsKeys: (name: string) => string[];
+/** An environment knob's current name: `envName("PORT")`. */
+export declare const envName: (key: string) => string;
+/** Every legacy name of the same knob, newest first. */
+export declare const legacyEnvNames: (key: string) => string[];
+/** A tmux session name on the current server. */
+export declare const tmuxName: (id: string) => string;
+/** The console tag every host log line opens with. */
+export declare const logTag: string;
+/** Every past identity's state dir name, newest first (`.<x>` under a root or a repo). */
+export declare const legacyStateDirNames: readonly string[];
+/** A path inside a REPO's current state dir: `stateRel("assess-in.json")`. */
+export declare const stateRel: (name: string) => string;
+/** A path inside a REPO's committed config dir: `sharedRel("builds.json")`. */
+export declare const sharedRel: (name: string) => string;
+/** The dev flavor's applicationId suffix (`applicationIdSuffix` in android/app/build.gradle). The
+ *  play flavor is the bare `BRAND.appId`; the release tooling refuses it as a sideload asset. */
+export declare const DEV_APPID_SUFFIX = ".dev";
+/** The sideloadable (dev flavor) APK's applicationId for a brand's appId. */
+export declare const devApplicationId: (appId?: string) => string;
+/** The release asset's file name: `release:build --apk` writes it, `pair.ts` `releaseApkUrl` links it. */
+export declare const releaseApkName: (slug: string, version: string) => string;

package/node_modules/@waterplane/shared/dist/brand.js

@@ -0,0 +1,88 @@
+/**
+ * Everything that says which product this is. Pure data, no fs, no env.
+ *
+ * The point of this file is that the NEXT rename edits the values below and
+ * nothing else in `packages/*\/src`: every brand-bearing identifier is a field
+ * here, and every reader of an old one falls back through `LEGACY`. The file's
+ * own name, the helper names and every identifier elsewhere stay free of the
+ * word on purpose. What cannot import this (JSON, XML, Java, shell, html) is
+ * enumerated by `tools/brand.test.mjs`, which is the next rebrand's checklist.
+ */
+export const BRAND = {
+    name: "waterplane",
+    displayName: "waterplane",
+    slug: "waterplane",
+    envPrefix: "WATERPLANE_",
+    configDirName: "waterplane",
+    stateDirName: ".waterplane",
+    sharedDirName: ".waterplane-shared",
+    storagePrefix: "waterplane.",
+    cacheName: "waterplane-cache",
+    wsProtocol: "waterplane",
+    cookie: "waterplane_auth",
+    pairScheme: "waterplane",
+    launchdLabel: "dev.waterplane.host",
+    appId: "dev.waterplane.app",
+    tmuxServer: "waterplane",
+    pluginManifest: "waterplane-plugin.json",
+    skillName: "waterplane",
+    tagline: "The CLI wasn't built for your phone. waterplane lands it anyway.",
+    domain: "waterplane.dev",
+    githubOrg: "waterplane-dev",
+    promptAliases: ["WP", "wp"],
+    dictationTerms: ["waterplane"],
+};
+/** Cumulative: every past identity, NEWEST FIRST. Readers fall back through it
+ *  in order. An entry is removed only by the cleanup release that follows the
+ *  rename which made it legacy, never by the rename itself. */
+export const LEGACY = [
+    {
+        name: "USMC",
+        slug: "usmc",
+        envPrefix: "USMC_",
+        configDirName: "usmc",
+        stateDirName: ".usmc",
+        storagePrefix: "usmc.",
+        cacheName: "usmc-cache",
+        wsProtocol: "usmc",
+        cookie: "usmc_auth",
+        pairScheme: "usmc",
+        launchdLabel: "com.usmc.host",
+        appId: "dev.unsuck.amc",
+        tmuxServer: "usmc",
+        pluginManifest: "usmc-plugin.json",
+        skillName: "usmc",
+        words: ["usmc", "unsuck", "un-suck"],
+    },
+];
+/** Every word, current and past, the brand-literal lint rule and the ratchet
+ *  test look for (lowercase; both match case-insensitively). */
+export const BRAND_WORDS = [
+    ...new Set([BRAND.name.toLowerCase(), BRAND.slug.toLowerCase(), ...LEGACY.flatMap((l) => l.words)]),
+];
+/** A localStorage key under the current prefix. */
+export const lsKey = (name) => `${BRAND.storagePrefix}${name}`;
+/** Every legacy spelling of the same key, newest first. */
+export const legacyLsKeys = (name) => LEGACY.map((l) => `${l.storagePrefix}${name}`);
+/** An environment knob's current name: `envName("PORT")`. */
+export const envName = (key) => `${BRAND.envPrefix}${key}`;
+/** Every legacy name of the same knob, newest first. */
+export const legacyEnvNames = (key) => LEGACY.map((l) => `${l.envPrefix}${key}`);
+/** A tmux session name on the current server. */
+export const tmuxName = (id) => `${BRAND.tmuxServer}_${id}`;
+/** The console tag every host log line opens with. */
+export const logTag = `[${BRAND.slug}]`;
+/** Every past identity's state dir name, newest first (`.<x>` under a root or a repo). */
+export const legacyStateDirNames = LEGACY.map((l) => l.stateDirName);
+/** A path inside a REPO's current state dir: `stateRel("assess-in.json")`. */
+export const stateRel = (name) => `${BRAND.stateDirName}/${name}`;
+/** A path inside a REPO's committed config dir: `sharedRel("builds.json")`. */
+export const sharedRel = (name) => `${BRAND.sharedDirName}/${name}`;
+/** The dev flavor's applicationId suffix (`applicationIdSuffix` in android/app/build.gradle). The
+ *  play flavor is the bare `BRAND.appId`; the release tooling refuses it as a sideload asset. */
+export const DEV_APPID_SUFFIX = ".dev";
+/** The sideloadable (dev flavor) APK's applicationId for a brand's appId. */
+export const devApplicationId = (appId = BRAND.appId) => `${appId}${DEV_APPID_SUFFIX}`;
+/** The release asset's file name: `release:build --apk` writes it, `pair.ts` `releaseApkUrl` links it. */
+export const releaseApkName = (slug, version) => `${slug}-${version}.apk`;
+//# sourceMappingURL=brand.js.map

package/node_modules/@waterplane/shared/dist/brand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand.js","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmDH,MAAM,CAAC,MAAM,KAAK,GAAU;IAC1B,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,YAAY;IACzB,IAAI,EAAE,YAAY;IAClB,SAAS,EAAE,aAAa;IACxB,aAAa,EAAE,YAAY;IAC3B,YAAY,EAAE,aAAa;IAC3B,aAAa,EAAE,oBAAoB;IACnC,aAAa,EAAE,aAAa;IAC5B,SAAS,EAAE,kBAAkB;IAC7B,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,iBAAiB;IACzB,UAAU,EAAE,YAAY;IACxB,YAAY,EAAE,qBAAqB;IACnC,KAAK,EAAE,oBAAoB;IAC3B,UAAU,EAAE,YAAY;IACxB,cAAc,EAAE,wBAAwB;IACxC,SAAS,EAAE,YAAY;IACvB,OAAO,EAAE,kEAAkE;IAC3E,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,gBAAgB;IAC3B,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IAC3B,cAAc,EAAE,CAAC,YAAY,CAAC;CAC/B,CAAC;AAOF;;+DAE+D;AAC/D,MAAM,CAAC,MAAM,MAAM,GAA2B;IAC5C;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,OAAO;QACrB,aAAa,EAAE,OAAO;QACtB,SAAS,EAAE,YAAY;QACvB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE,WAAW;QACnB,UAAU,EAAE,MAAM;QAClB,YAAY,EAAE,eAAe;QAC7B,KAAK,EAAE,gBAAgB;QACvB,UAAU,EAAE,MAAM;QAClB,cAAc,EAAE,kBAAkB;QAClC,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;KACrC;CACF,CAAC;AAEF;gEACgE;AAChE,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,GAAG,IAAI,EAAE,CAAC;AAC/E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAY,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,aAAa,GAAG,IAAI,EAAE,CAAC,CAAC;AACvG,6DAA6D;AAC7D,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;AAC3E,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAY,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC;AACnG,iDAAiD;AACjD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;AAC5E,sDAAsD;AACtD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;AACxC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AACxF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;AAClF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;AAEpF;iGACiG;AACjG,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,KAAK,CAAC,KAAK,EAAU,EAAE,CAAC,GAAG,KAAK,GAAG,gBAAgB,EAAE,CAAC;AACvG,0GAA0G;AAC1G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,OAAe,EAAU,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,MAAM,CAAC"}

package/node_modules/@waterplane/shared/dist/brandmigrate.d.ts

@@ -0,0 +1,30 @@
+/** The subset of `Storage` this needs. */
+export interface KeyValueStore {
+    readonly length: number;
+    key(index: number): string | null;
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+}
+/** Where the "already migrated" mark lives, and what it holds. */
+export declare const BRAND_MIGRATED_KEY: string;
+export interface BrandMigratedMark {
+    /** The legacy slugs whose keys were considered. */
+    from: string[];
+    /** When, ms since epoch. */
+    at: number;
+}
+/** The current-prefix key for a legacy-prefixed one, or null if `key` carries
+ *  no legacy prefix. Covers every shape under the prefix (parked hosts'
+ *  `<p>h.<id>.…`, `<p>trSeen.…`) because the rewrite is of the prefix only. */
+export declare function currentKeyFor(key: string): string | null;
+export interface BrandMigrateResult {
+    /** False when the mark said it had already run. */
+    ran: boolean;
+    /** `[legacyKey, newKey]` pairs that were copied. */
+    copied: [string, string][];
+    /** Legacy keys left alone because the new key already held a value. */
+    kept: string[];
+}
+/** Copy every legacy-prefixed key to the current prefix, once. `now` is the
+ *  caller's clock (this module has none). Never deletes, never overwrites. */
+export declare function migrateLegacyStorage(store: KeyValueStore, now: number): BrandMigrateResult;

package/node_modules/@waterplane/shared/dist/brandmigrate.js

@@ -0,0 +1,67 @@
+/**
+ * Copying the phone's localStorage from a legacy prefix to the current one —
+ * the pure half, over a Storage-shaped object, so a test hands it a Map. The
+ * web's boot calls it before anything reads a key.
+ *
+ * Rules, each because a draft is the last copy of words somebody typed:
+ *  - COPY, never move: an older bundle (the APK rolls back to its built-in
+ *    assets after failed boots) still reads the legacy keys. Deleting them is a
+ *    later release's job.
+ *  - copy ONLY IF the new key is absent: a value already under the new name was
+ *    written by the new bundle and is newer than anything legacy.
+ *  - run ONCE, marked: after the mark, a key the person cleared under the new
+ *    name must stay cleared, not be resurrected from its stale legacy copy.
+ */
+import { BRAND, LEGACY, lsKey } from "./brand.js";
+/** Where the "already migrated" mark lives, and what it holds. */
+export const BRAND_MIGRATED_KEY = lsKey("brand.migratedFrom");
+/** The current-prefix key for a legacy-prefixed one, or null if `key` carries
+ *  no legacy prefix. Covers every shape under the prefix (parked hosts'
+ *  `<p>h.<id>.…`, `<p>trSeen.…`) because the rewrite is of the prefix only. */
+export function currentKeyFor(key) {
+    for (const l of LEGACY) {
+        if (l.storagePrefix !== BRAND.storagePrefix && key.startsWith(l.storagePrefix)) {
+            return BRAND.storagePrefix + key.slice(l.storagePrefix.length);
+        }
+    }
+    return null;
+}
+/** Copy every legacy-prefixed key to the current prefix, once. `now` is the
+ *  caller's clock (this module has none). Never deletes, never overwrites. */
+export function migrateLegacyStorage(store, now) {
+    if (store.getItem(BRAND_MIGRATED_KEY) !== null)
+        return { ran: false, copied: [], kept: [] };
+    // Snapshot the key list first: setItem during iteration reorders `key(i)`.
+    const keys = [];
+    for (let i = 0; i < store.length; i++) {
+        const k = store.key(i);
+        if (k !== null)
+            keys.push(k);
+    }
+    const copied = [];
+    const kept = [];
+    // Newest legacy identity first, so when two past names both hold a key the
+    // newer one's value is the one copied.
+    for (const l of LEGACY) {
+        if (l.storagePrefix === BRAND.storagePrefix)
+            continue;
+        for (const k of keys) {
+            if (!k.startsWith(l.storagePrefix))
+                continue;
+            const to = BRAND.storagePrefix + k.slice(l.storagePrefix.length);
+            if (store.getItem(to) !== null) {
+                kept.push(k);
+                continue;
+            }
+            const v = store.getItem(k);
+            if (v === null)
+                continue;
+            store.setItem(to, v);
+            copied.push([k, to]);
+        }
+    }
+    const mark = { from: LEGACY.map((l) => l.slug), at: now };
+    store.setItem(BRAND_MIGRATED_KEY, JSON.stringify(mark));
+    return { ran: true, copied, kept };
+}
+//# sourceMappingURL=brandmigrate.js.map

package/node_modules/@waterplane/shared/dist/brandmigrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brandmigrate.js","sourceRoot":"","sources":["../src/brandmigrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAUlD,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAQ9D;;+EAE+E;AAC/E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;8EAC8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,KAAoB,EAAE,GAAW;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5F,2EAA2E;IAC3E,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,uCAAuC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAAE,SAAS;QACtD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;gBAAE,SAAS;YAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC3D,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAsB,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IAC7E,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/node_modules/@waterplane/shared/dist/budget.d.ts

@@ -0,0 +1,247 @@
+/**
+ * The usage BUDGET — "stop starting new work once the account is this close to
+ * its limit, and start again when the window resets."
+ *
+ * `limit.ts` handles the WALL: the CLI printed a usage-limit banner, the turn
+ * is already dead, and the only thing left to do is wait for the reset and
+ * resurrect. That is recovery, and it is always too late — a queue that drained
+ * into the last 10% of a session window spends the reserve on whatever happened
+ * to be next in line, and the one prompt you actually wanted to run is the one
+ * that hits the banner.
+ *
+ * This is the other half: a ceiling you set BEFORE the wall, checked by the two
+ * things that start work without a human present — the send queue draining and
+ * the backlog auto-firing. Neither is a decision anybody is making at the time;
+ * both are a decision made earlier, arriving now.
+ *
+ * Three properties, all deliberate:
+ *
+ *   • **Nothing is armed with a timer.** The verdict is a pure function of the
+ *     usage reading and the clock, re-asked by every pass that would fire —
+ *     exactly like `schedule.ts` and `launch.ts`. So a host restart, a laptop
+ *     sleep and a reset that lands while the phone is off all resolve
+ *     themselves on the next tick rather than needing an event nobody was
+ *     awake for.
+ *   • **It FAILS OPEN.** An unreadable or stale usage scrape does not block.
+ *     The reading comes from screen-scraping `/usage` out of a short-lived
+ *     `claude` PTY (`host/usage.ts`), which is fragile by construction: an
+ *     upstream TUI change would otherwise silently freeze every queue and every
+ *     backlog on every host, for ever, with the CLI itself perfectly willing to
+ *     run. A budget that fails closed on a parse bug is worse than no budget —
+ *     and the wall is still there underneath, which is the safety net that lets
+ *     this one be optimistic.
+ *   • **Resume needs no observation.** Past a known reset instant the verdict
+ *     clears on the clock alone, without waiting for a fresh scrape to confirm
+ *     the percentage dropped. The cached number describes a window that has
+ *     ended; holding work back on it is holding it back on a fact that is no
+ *     longer true.
+ *
+ * Pure and DOM-free like everything else here, so `shared/dist` runs under node
+ * and `npm run test:unit` can pin the rule with no host to boot.
+ */
+import type { UsageInfo } from "./index.js";
+import { type BudgetPeriod, type PeriodId, type PeriodUnit } from "./period.js";
+/**
+ * One ceiling: `max` of `unit` on the period `periodId`. `pct` is percent of a
+ * scraped window (`session`, `weekly`); `usd` is period-to-date dollars from the
+ * local ledger. The list on `UsageBudget.ceilings` is the truth; `sessionMax` /
+ * `weeklyMax` are its mirrors for readers that predate periods (see `budgetLimits`).
+ */
+export interface BudgetLimit {
+    periodId: PeriodId;
+    max: number;
+    unit: PeriodUnit;
+}
+/** Period-to-date USD spend by period id, supplied by the caller (the host's
+ *  ledger fold). A missing or null entry is "nobody measured": never a trip, never 0. */
+export type BudgetSpend = Record<PeriodId, number | null | undefined>;
+/** The two ceilings, and the switch. Persisted host-side (`.waterplane/budget.json`). */
+export interface UsageBudget {
+    /** Master switch. Off ⇒ `budgetVerdict` never blocks anything. */
+    enabled: boolean;
+    /**
+     * Percent of the 5-hour SESSION window at which automatic work stops, 1..100.
+     * 100 disables this ceiling without turning the whole budget off.
+     *
+     * The session window is the one worth defending: it refills in hours, so a
+     * pause is a pause. Default 90 — enough headroom that a turn already running
+     * can finish, and that a human who picks up the phone can still send
+     * something by hand (an explicit send always overrides this).
+     */
+    sessionMax: number;
+    /**
+     * The same ceiling for the WEEKLY window, or null for "don't watch it".
+     *
+     * Off by default, and deliberately so: the weekly window resets days out, so
+     * a budget that trips on it stops automation until the weekend. That is a
+     * choice worth making explicitly, never one to inherit from a default.
+     */
+    weeklyMax: number | null;
+    /**
+     * The LEFTOVER ceiling, percent of the NEW weekly window, or null for off.
+     *
+     * A row let past last week's ceiling — timed before the weekly reset
+     * (`BudgetPass`) or waived by a person while the weekly cap held it — exists
+     * to spend allowance that would otherwise be thrown away at the reset. One
+     * that did not get to start before the reset (serial, slots)
+     * would otherwise fall to the ordinary ceilings, and a week that has just
+     * reset reads 0%: every leftover runs at once, spending the new week on work
+     * that was only ever worth the old week's spare. Such a row (`leftoverOf` in
+     * `intent.ts`) starts only while the week is under THIS, and otherwise waits
+     * for the next week's start or the next before-reset lift.
+     *
+     * Measured against the whole week's reading — a person's own sends count —
+     * because that is the number on the usage screen, and a person working by
+     * hand is the work the new week is for. Default 20.
+     */
+    leftoverMax: number | null;
+    /**
+     * The ceilings as a list over periods - the canonical shape. Absent on a
+     * budget written before periods existed; `cleanBudget` fills it from
+     * `sessionMax`/`weeklyMax` and writes BOTH shapes, so an older reader keeps
+     * working. Use `budgetLimits` to read it, `withLimit`/`withoutLimit` to edit it.
+     */
+    ceilings?: BudgetLimit[];
+    /** Configured periods beyond the built-in `session`/`weekly` (month, week,
+     *  day, rolling30d, span). The definitions `ceilings` refer to by id. */
+    periods?: BudgetPeriod[];
+}
+export declare const DEFAULT_USAGE_BUDGET: UsageBudget;
+/**
+ * How old a usage reading may be and still be acted on.
+ *
+ * `UsageChecker` refreshes every 8 minutes while polling. Twenty-five is three
+ * missed polls: long enough that a slow scrape or a host that was busy doesn't
+ * flip the gate open, short enough that a reading from before a reset can never
+ * hold work back for a whole window.
+ */
+export declare const BUDGET_STALE_MS: number;
+/** Why a budget verdict says what it says. A code, not a sentence — the UI owns
+ *  the wording (`budgetReasonText`), the same split as `SendBlockReason`. */
+export type BudgetState = 
+/** The switch is off. */
+"off"
+/** Both ceilings are set to 100 — enabled, but watching nothing. */
+ | "unset"
+/** No usable reading (never scraped, `ok:false`, or older than
+ *  `BUDGET_STALE_MS`). Work proceeds — see "fails open" above. */
+ | "unknown"
+/** Under the ceiling. */
+ | "ok"
+/** At or over a ceiling. This is the only state that blocks. */
+ | "over";
+export interface BudgetVerdict {
+    /** The one thing callers act on. True only in state `over`. */
+    blocked: boolean;
+    state: BudgetState;
+    /** Which ceiling was tripped, or which one is closest when `ok`. */
+    which?: PeriodId;
+    /** Unit of `pct`/`max`: absent = percent of a scraped window. */
+    unit?: PeriodUnit;
+    /** The reading and the ceiling behind the verdict, for the UI's sentence
+     *  (`pct` holds dollars when `unit` is `usd`). */
+    pct?: number;
+    max?: number;
+    /**
+     * When this block is expected to clear, if the reading said. Advisory: the
+     * verdict is re-asked, never scheduled — nothing fires ON this instant.
+     */
+    resumeAt?: number | null;
+}
+/**
+ * One tripped ceiling: which window, the reading, the line it crossed, and when
+ * that window resets (if the reading said).
+ *
+ * A separate shape from `BudgetVerdict` because the verdict names only the
+ * FIRST ceiling over — which is the right sentence for a person, and the wrong
+ * fact for the ladder: a row exempt from the session ceiling must still be held
+ * by a weekly one that is also over (`intent.ts`'s `budgetHold`).
+ */
+export interface BudgetCeiling {
+    which: PeriodId;
+    /** The reading, in `unit` (percent used, or dollars spent). */
+    pct: number;
+    max: number;
+    resetAt: number | null;
+    /** Absent = percent of a scraped window (every ceiling before periods). */
+    unit?: PeriodUnit;
+}
+/**
+ * Every ceiling at or over its max right now, session first. `[]` when the
+ * budget is off, unset, unreadable or stale, or simply under — the same
+ * fail-open reading `budgetVerdict` makes, because `budgetVerdict`'s `over`
+ * branch IS this list's first entry.
+ */
+export declare function budgetCeilings(cfg: UsageBudget, usage: UsageInfo | null | undefined, now: number, spend?: BudgetSpend): BudgetCeiling[];
+/**
+ * The ceilings as a list, one reading. The `session`/`weekly` entries are built
+ * from the mirrors `sessionMax`/`weeklyMax`, which are ALWAYS present and
+ * therefore always the truth for those two: a reader that predates the list can
+ * only edit the mirrors, and losing its edit to a stale list entry would be the
+ * worse failure. Every other entry (the dollar ceilings) comes from `ceilings`.
+ * Writers use `withLimit`/`withoutLimit`, which keep both shapes in step.
+ */
+export declare function budgetLimits(cfg: UsageBudget): BudgetLimit[];
+/** Set (or replace) one ceiling, keeping the legacy mirrors in step. */
+export declare function withLimit(cfg: UsageBudget, limit: BudgetLimit): UsageBudget;
+/** Remove one ceiling (session: back to 100 = unwatched; weekly: null). */
+export declare function withoutLimit(cfg: UsageBudget, periodId: PeriodId): UsageBudget;
+/**
+ * The LEFTOVER ceiling, when it is tripped: the week's reading at or over
+ * `leftoverMax`. `null` when it is off, the budget is off, the reading is
+ * unreadable or stale, or the week has reset since the reading — the same
+ * fail-open posture as `budgetCeilings`, and for the same reason: a row this
+ * holds runs anyway under the wall, so a parse bug must not freeze it.
+ *
+ * Never part of `budgetCeilings`: it holds only rows `leftoverOf` names, so it
+ * is not a reason for the account to read as paused.
+ */
+export declare function leftoverCeiling(cfg: UsageBudget, usage: UsageInfo | null | undefined, now: number): BudgetCeiling | null;
+/** The sentence a leftover row wears while the leftover ceiling holds it. LEADS
+ *  with why this row and not the rest: every other row is running under the
+ *  ordinary ceilings, so a bare "paused" would read as the account's. */
+export declare function budgetLeftoverText(c: BudgetCeiling, now: number, afterReset?: boolean): string;
+/**
+ * Should automatic work start right now?
+ *
+ * The session ceiling is checked first because it is the one that clears
+ * soonest: if both are over, the sentence a human wants is "back in 40
+ * minutes", not "back on Thursday".
+ */
+export declare function budgetVerdict(cfg: UsageBudget, usage: UsageInfo | null | undefined, now: number, spend?: BudgetSpend): BudgetVerdict;
+/**
+ * One sentence for a verdict. Lives here so the queue sheet, the backlog's
+ * `waiting()` and the usage sheet all say the same thing about the same fact —
+ * the rule this file exists to keep (see `blockedReasonText`).
+ */
+/** The word a period goes by in a sentence. */
+export declare function periodWord(id: PeriodId | undefined): string;
+export declare function budgetReasonText(v: BudgetVerdict): string;
+/**
+ * The *resumes …* clause of a budget hold. Formatted on the HOST, in the host's
+ * locale and zone, like the clause it replaces in `main.ts` — which printed a
+ * bare time for a weekly reset days out, and a bare time reads as *today*. So a
+ * reset on another local day names the day.
+ */
+export declare function budgetResumesText(resetAt: number | null | undefined, now: number): string;
+/** The sentence a budget-held row wears for one tripped ceiling — the `over`
+ *  wording plus when it lifts. One of the three wordings of a budget hold. */
+export declare function budgetHoldText(c: BudgetCeiling, now: number): string;
+/** A row timed BEFORE a reset its pass covers this ceiling for, and not yet at
+ *  its time: held now, and told it will not be held then. `passWindow` is the
+ *  window the row is timed ahead of — a weekly pass also covers the session cap.
+ *  LEADS with the lift and carries no *resumes …* clause: read on a phone, a
+ *  sentence opening "paused … resumes Thu 18:59" said the row would wait for the
+ *  reset, when it runs at its own time, BEFORE it. `now` is kept for the
+ *  signature the other two wordings share. */
+export declare function budgetPassPendingText(c: BudgetCeiling, _now: number, passWindow?: PeriodId): string;
+/** A row exempt from ONE window's ceiling, held by the OTHER window's. */
+export declare function budgetOtherCapText(c: BudgetCeiling, passWindow: PeriodId, now: number): string;
+/**
+ * Sanitize a budget that came off disk or off the wire.
+ *
+ * Same posture as `cleanIntentRow` in `intent.ts`: a stored file is not a trusted
+ * value — a hand-edited `sessionMax: 0` would block every send for ever with no
+ * way back through the UI, so the range is clamped rather than believed.
+ */
+export declare function cleanBudget(raw: unknown): UsageBudget;