@pathmode/mcp-server 1.20.1 → 1.21.0

package/dist/index.js

@@ -35783,6 +35783,7 @@ function State(input, options) {
   this.legacy    = options['legacy']    || false;
   this.json      = options['json']      || false;
   this.listener  = options['listener']  || null;
+  this.maxTotalMergeKeys = typeof options['maxTotalMergeKeys'] === 'number' ? options['maxTotalMergeKeys'] : 10000;
 
   this.implicitTypes = this.schema.compiledImplicit;
   this.typeMap       = this.schema.compiledTypeMap;
@@ -35792,6 +35793,7 @@ function State(input, options) {
   this.line       = 0;
   this.lineStart  = 0;
   this.lineIndent = 0;
+  this.totalMergeKeys = 0;
 
   this.documents = [];
 
@@ -35910,6 +35912,14 @@ function captureSegment(state, start, end, checkJson) {
   }
 }
 
+function chargeMergeWork(state) {
+  state.totalMergeKeys += 1;
+
+  if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+    throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')');
+  }
+}
+
 function mergeMappings(state, destination, source, overridableKeys) {
   var sourceKeys, key, index, quantity;
 
@@ -35917,11 +35927,16 @@ function mergeMappings(state, destination, source, overridableKeys) {
     throwError(state, 'cannot merge mappings; the provided source object is unacceptable');
   }
 
+  // Count the source mapping itself to bound sequences of empty mappings.
+  chargeMergeWork(state);
+
   sourceKeys = Object.keys(source);
 
   for (index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
     key = sourceKeys[index];
 
+    chargeMergeWork(state);
+
     if (!_hasOwnProperty.call(destination, key)) {
       setProperty(destination, key, source[key]);
       overridableKeys[key] = true;
@@ -35965,6 +35980,10 @@ function storeMappingPair(state, _result, overridableKeys, keyTag, keyNode, valu
 
   if (keyTag === 'tag:yaml.org,2002:merge') {
     if (Array.isArray(valueNode)) {
+      if (valueNode.length > 100) {
+        throwError(state, 'abnormal merge sequence size');
+      }
+
       for (index = 0, quantity = valueNode.length; index < quantity; index += 1) {
         mergeMappings(state, _result, valueNode[index], overridableKeys);
       }
@@ -38504,7 +38523,7 @@ var _toString       = Object.prototype.toString;
 function resolveYamlOmap(data) {
   if (data === null) return true;
 
-  var objectKeys = [], index, length, pair, pairKey, pairHasKey,
+  var objectKeys = {}, index, length, pair, pairKey, pairHasKey,
       object = data;
 
   for (index = 0, length = object.length; index < length; index += 1) {
@@ -38522,8 +38541,8 @@ function resolveYamlOmap(data) {
 
     if (!pairHasKey) return false;
 
-    if (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey);
-    else return false;
+    if (_hasOwnProperty.call(objectKeys, pairKey)) return false;
+    Object.defineProperty(objectKeys, pairKey, { value: true });
   }
 
   return true;
@@ -39199,6 +39218,7 @@ module.exports = function(str) {
  * the results in as plain data.
  */
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.renderOutcomeMeasurementDefinition = renderOutcomeMeasurementDefinition;
 exports.toSerializableChecks = toSerializableChecks;
 exports.renderAuthorizationGateText = renderAuthorizationGateText;
 exports.renderConfirmationsBody = renderConfirmationsBody;
@@ -39226,6 +39246,24 @@ function yamlScalar(value) {
 function outcomeOf(o) {
     return typeof o === 'string' ? { text: o } : o;
 }
+/** Compact, provider-neutral wording shared by every agent-facing export. */
+function renderOutcomeMeasurementDefinition(measurement) {
+    if (!measurement)
+        return '';
+    const { source, expectation, window } = measurement;
+    const target = `${expectation.operator} ${expectation.target}${expectation.unit ? ` ${expectation.unit}` : ''}`;
+    const windowValue = window.kind === 'rolling'
+        ? `${window.kind} ${window.duration}`
+        : window.kind === 'fixed'
+            ? `${window.kind} ${window.start}..${window.end}`
+            : window.kind;
+    return [
+        `measure via ${source.provider} ${source.queryRef.kind}:${source.queryRef.id}`,
+        measurement.resultSelector ? `select ${measurement.resultSelector}` : '',
+        `target ${target}`,
+        `window ${windowValue}`,
+    ].filter(Boolean).join('; ');
+}
 function constraintOf(c) {
     return typeof c === 'string' ? { text: c } : c;
 }
@@ -39337,9 +39375,14 @@ function renderConfirmationsBody(records) {
  */
 const FRONTMATTER_ORDER = [
     'id', 'version', 'status', 'readiness', 'source', 'specVersion',
-    'origin', 'authorization', 'authorizationNote', 'evidence', 'space', 'severity', 'created', 'updated',
+    'origin', 'authorization', 'authorizationNote', 'outcomeMeasurements',
+    'evidence', 'space', 'severity', 'created', 'updated',
 ];
 function serializeIntentMd(spec, opts = {}) {
+    const outcomeMeasurements = (spec.outcomes || [])
+        .map(outcomeOf)
+        .map((outcome, index) => outcome.measurement ? { outcome: index, ...outcome.measurement } : null)
+        .filter((entry) => entry !== null);
     const values = {
         id: spec.id,
         version: opts.version && opts.version >= 1 ? opts.version : 1,
@@ -39358,6 +39401,9 @@ function serializeIntentMd(spec, opts = {}) {
         authorizationNote: opts.origin === 'agent' && nonEmpty(opts.authorizationNote)
             ? opts.authorizationNote.replace(/\s+/g, ' ').trim()
             : undefined,
+        // Body outcomes stay plain, interoperable list items. The optional recipe is a generic
+        // extension in frontmatter, keyed by outcome position so old readers simply ignore it.
+        outcomeMeasurements: outcomeMeasurements.length ? outcomeMeasurements : undefined,
         evidence: opts.evidence?.length || undefined,
         space: opts.space?.name,
         severity: opts.severity,
@@ -39369,7 +39415,10 @@ function serializeIntentMd(spec, opts = {}) {
     // crash rather than an omitted key.
     const yamlLines = FRONTMATTER_ORDER
         .filter(key => values[key] !== undefined && values[key] !== null && values[key] !== '')
-        .map(key => `${key}: ${yamlScalar(values[key])}`)
+        .map(key => {
+        const value = values[key];
+        return `${key}: ${typeof value === 'object' ? JSON.stringify(value) : yamlScalar(value)}`;
+    })
         .join('\n');
     const sections = ['---', yamlLines, '---', ''];
     // Directly under the frontmatter: the `authorization` key is machine-readable, but the body
@@ -40054,6 +40103,25 @@ class PathmodeClient {
         });
         return res.json();
     }
+    async listIntentChangeRequests(intentId, status = 'open') {
+        const res = await this.fetch(`/intents/${intentId}/change-requests?status=${encodeURIComponent(status)}`);
+        return res.json();
+    }
+    async listWorkspaceIntentChangeRequests(status = 'open') {
+        const res = await this.fetch(`/change-requests?status=${encodeURIComponent(status)}`);
+        return res.json();
+    }
+    async getIntentChangeRequest(intentId, requestId) {
+        const res = await this.fetch(`/intents/${intentId}/change-requests/${requestId}`);
+        return res.json();
+    }
+    async rejectIntentChangeRequest(intentId, requestId, reason) {
+        const res = await this.fetch(`/intents/${intentId}/change-requests/${requestId}`, {
+            method: 'PATCH',
+            body: JSON.stringify({ action: 'reject', reason }),
+        });
+        return res.json();
+    }
     async queryEvidence(filters = {}) {
         const params = new URLSearchParams();
         for (const [key, val] of Object.entries(filters)) {
@@ -40445,6 +40513,9 @@ function getPriorityLabel(o) {
         return '';
     return `[${o.priority.toUpperCase()}] `;
 }
+function getOutcomeMeasurement(o) {
+    return typeof o === 'string' ? '' : (0, serializeIntentMd_1.renderOutcomeMeasurementDefinition)(o.measurement);
+}
 function getLiveQualityCheckPromptBlock() {
     return `LIVE QUALITY CHECKS:
 - After EVERY meaningful user answer, silently update your current draft and run a quality pass before asking the next question.
@@ -40631,6 +40702,9 @@ function formatCursorRules(spec) {
         sections.push('Your implementation MUST satisfy ALL of these:');
         for (const outcome of spec.outcomes) {
             sections.push(`- ${getPriorityLabel(outcome)}${getOutcomeText(outcome)}`);
+            const measurement = getOutcomeMeasurement(outcome);
+            if (measurement)
+                sections.push(`  - measurement: ${measurement}`);
         }
     }
     if (spec.scope?.inScope?.length || spec.scope?.outOfScope?.length) {
@@ -40711,7 +40785,10 @@ function formatClaudeMdSection(spec) {
     sections.push(...decisionLines(spec.decisions, '**Decisions**:'));
     if (spec.outcomes?.length) {
         sections.push('**Outcomes**:');
-        sections.push(spec.outcomes.map(o => `- [ ] ${getPriorityLabel(o)}${getOutcomeText(o)}`).join('\n'));
+        sections.push(spec.outcomes.map(o => {
+            const measurement = getOutcomeMeasurement(o);
+            return `- [ ] ${getPriorityLabel(o)}${getOutcomeText(o)}${measurement ? `\n  - measurement: ${measurement}` : ''}`;
+        }).join('\n'));
     }
     if (spec.scope?.inScope?.length || spec.scope?.outOfScope?.length) {
         const scopeParts = ['**Scope**:'];
@@ -40866,6 +40943,9 @@ function buildGraderRubric(spec, opts = {}) {
         for (const o of outcomes) {
             const bar = priorityToBar(getOutcomePriority(o));
             sections.push(`${i}. [${bar}] ${getOutcomeText(o)}`);
+            const measurement = getOutcomeMeasurement(o);
+            if (measurement)
+                sections.push(`   - Production signal: ${measurement}`);
             sections.push('   - Evidence: point to the specific value, state, or test result in the artifact that proves this. If you cannot, mark FAIL.');
             i++;
         }
@@ -41071,6 +41151,7 @@ exports.stripHtmlComments = stripHtmlComments;
 const fs_1 = __importDefault(__nccwpck_require__(9896));
 const path_1 = __importDefault(__nccwpck_require__(6928));
 const gray_matter_1 = __importDefault(__nccwpck_require__(9599));
+const measurement_schema_1 = __nccwpck_require__(1635);
 const CONFIRMATION_HEADER_RE = /^\*\*(objective|outcomes)\*\*\s*[—–-]\s*(confirmed|waived)\s+by\s+(agent|human)\s*$/i;
 const CONFIRMATION_FIELD_RE = /^\s*[-*]\s+(actor|problem|outcome|observable|reason|anchor|at)\s*:\s*(.+)$/i;
 /**
@@ -41198,6 +41279,22 @@ function preferSection(fromSection, fromFrontmatter) {
         .map((v) => v.trim())
         .filter(Boolean);
 }
+function attachOutcomeMeasurements(outcomes, rawEntries) {
+    if (!Array.isArray(rawEntries))
+        return outcomes;
+    const definitions = new Map();
+    for (const raw of rawEntries) {
+        const parsed = measurement_schema_1.outcomeMeasurementEntryShape.safeParse(raw);
+        if (!parsed.success || parsed.data.outcome >= outcomes.length)
+            continue;
+        const { outcome, ...definition } = parsed.data;
+        definitions.set(outcome, definition);
+    }
+    return outcomes.map((text, index) => {
+        const measurement = definitions.get(index);
+        return measurement ? { text, measurement } : text;
+    });
+}
 /** Coerce a structured frontmatter entry ({text}, {description}) to its text, else ''. */
 function coerceItemText(v) {
     if (!v || typeof v !== 'object')
@@ -41250,7 +41347,7 @@ function parseIntentMarkdown(content, fallbackId = 'intent') {
         title: data.title || data.userGoal || extractTitle(body) || 'Untitled Intent',
         stageName: data.stage || undefined,
         severity: data.severity || undefined,
-        outcomes: preferSection(extractListSection(sections, 'Outcomes'), data.outcomes),
+        outcomes: attachOutcomeMeasurements(preferSection(extractListSection(sections, 'Outcomes'), data.outcomes), data.outcomeMeasurements),
         decisions: extractDecisions(sections),
         constraints: preferSection(extractListSection(sections, 'Constraints'), data.constraints),
         edgeCases: (() => { const fromBody = extractEdgeCases(sections); return fromBody.length ? fromBody : frontmatterEdgeCases(data.edgeCases); })(),
@@ -41589,7 +41686,7 @@ function hasVerificationContent(v) {
  * units and source labels.
  */
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.recordOutcomeMeasurementInputSchema = exports.provenanceShape = exports.expectationShape = exports.windowShape = exports.queryRefShape = exports.windowKindEnum = exports.comparatorEnum = void 0;
+exports.recordOutcomeMeasurementInputSchema = exports.provenanceShape = exports.outcomeMeasurementEntryShape = exports.outcomeMeasurementDefinitionShape = exports.expectationShape = exports.windowShape = exports.queryRefShape = exports.windowKindEnum = exports.comparatorEnum = void 0;
 exports.outcomeSelectorError = outcomeSelectorError;
 const zod_1 = __nccwpck_require__(924);
 const MAX_TEXT = 500;
@@ -41626,6 +41723,19 @@ exports.expectationShape = zod_1.z.object({
     target: zod_1.z.number().finite(),
     unit: zod_1.z.string().trim().max(MAX_UNIT).optional(),
 });
+/** Mirrors the optional query recipe stored on a StructuredOutcome. */
+exports.outcomeMeasurementDefinitionShape = zod_1.z.object({
+    source: zod_1.z.object({
+        provider: zod_1.z.string().trim().min(1).max(MAX_SHORT).describe('System that owns the saved query, e.g. "posthog"'),
+        queryRef: exports.queryRefShape,
+    }),
+    resultSelector: zod_1.z.string().trim().min(1).max(MAX_TEXT).optional().describe('Optional path into a compound provider response'),
+    expectation: exports.expectationShape,
+    window: exports.windowShape,
+});
+exports.outcomeMeasurementEntryShape = exports.outcomeMeasurementDefinitionShape.extend({
+    outcome: zod_1.z.number().int().nonnegative(),
+});
 exports.provenanceShape = zod_1.z.object({
     provider: zod_1.z.string().trim().min(1).max(MAX_SHORT).describe('System the number came from, e.g. "posthog"'),
     queryRef: exports.queryRefShape,
@@ -42377,6 +42487,11 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.pushSpec = pushSpec;
 async function pushSpec(input) {
     const { client, id, existingSpecVersion, payload } = input;
+    // Confirmations are cloud-authored judgment. They are deliberately absent from the
+    // intent_save tool shape, and this last boundary keeps a future caller from accidentally
+    // turning a repo push into a replace-all confirmation import.
+    const identityPayload = { ...payload };
+    delete identityPayload.confirmations;
     let canonicalId;
     let specVersion;
     let sourceUrl;
@@ -42389,11 +42504,18 @@ async function pushSpec(input) {
         // quietly break the merge resolution that stamp exists for.
         let saved;
         if (existingSpecVersion) {
-            saved = await client.updateIntent(id, { ...payload, expectedVersion: existingSpecVersion });
+            saved = await client.updateIntent(id, {
+                ...identityPayload,
+                expectedVersion: existingSpecVersion,
+                ...(input.changeRequest ? {
+                    changeRequestId: input.changeRequest.id,
+                    expectedRepoBodyRevision: input.changeRequest.baseRepoBodyRevision,
+                } : {}),
+            });
         }
         else {
             try {
-                saved = await client.createIntent({ ...payload, id });
+                saved = await client.createIntent({ ...identityPayload, id });
             }
             catch (e) {
                 // The create may have COMMITTED and lost its response — a dropped connection after
@@ -42428,12 +42550,44 @@ async function pushSpec(input) {
     }
     input.onIdentitySettled({ canonicalId, specVersion, sourceUrl, origin, authorization, authorizationNote });
     const didNotTravel = [];
+    let pendingChangeRequest = input.changeRequest;
+    if (pendingChangeRequest && input.client.getIntentChangeRequest) {
+        try {
+            const settled = await input.client.getIntentChangeRequest(canonicalId, pendingChangeRequest.id);
+            if (settled.changeRequest?.status !== 'open')
+                pendingChangeRequest = undefined;
+        }
+        catch {
+            // Keep the original context. The write endpoint still performs the authoritative lock
+            // and stale-base check; a failed observation must not silently drop that guard.
+        }
+    }
     for (const d of input.decisions ?? []) {
         try {
-            await client.recordDecision(canonicalId, { choice: d.choice, reason: d.reason, ruledOut: d.ruledOut });
+            await client.recordDecision(canonicalId, {
+                choice: d.choice,
+                reason: d.reason,
+                ruledOut: d.ruledOut,
+                ...(pendingChangeRequest ? {
+                    changeRequestId: pendingChangeRequest.id,
+                    expectedRepoBodyRevision: pendingChangeRequest.baseRepoBodyRevision,
+                } : {}),
+            });
         }
         catch {
             didNotTravel.push(`decision "${d.choice.slice(0, 40)}" — save again to retry`);
+            continue;
+        }
+        if (pendingChangeRequest && input.client.getIntentChangeRequest) {
+            try {
+                const settled = await input.client.getIntentChangeRequest(canonicalId, pendingChangeRequest.id);
+                if (settled.changeRequest?.status !== 'open')
+                    pendingChangeRequest = undefined;
+            }
+            catch {
+                // The decision already persisted. A failed observation cannot turn that successful
+                // write into a false enrichment failure; the final status read reports uncertainty.
+            }
         }
     }
     if (input.implementationContext?.trim()) {
@@ -42443,12 +42597,30 @@ async function pushSpec(input) {
             await client.saveImplementationContext(canonicalId, {
                 currentBehavior: input.implementationContext,
                 ...(specVersion ? { expectedSpecVersion: specVersion } : {}),
+                ...(pendingChangeRequest ? {
+                    changeRequestId: pendingChangeRequest.id,
+                    expectedRepoBodyRevision: pendingChangeRequest.baseRepoBodyRevision,
+                } : {}),
             });
         }
         catch {
             didNotTravel.push('implementation context — call record_implementation_context to retry');
         }
     }
+    if (pendingChangeRequest && input.client.getIntentChangeRequest) {
+        try {
+            const finalRequest = await input.client.getIntentChangeRequest(canonicalId, pendingChangeRequest.id);
+            if (finalRequest.changeRequest?.status === 'open') {
+                didNotTravel.push(`change request ${pendingChangeRequest.id} remains open — the synced revision did not satisfy it`);
+            }
+            else if (finalRequest.changeRequest?.status === 'superseded') {
+                didNotTravel.push(`change request ${pendingChangeRequest.id} was superseded — re-read it before making another change`);
+            }
+        }
+        catch {
+            didNotTravel.push(`change request ${pendingChangeRequest.id} status could not be confirmed`);
+        }
+    }
     return { ok: true, canonicalId, specVersion, sourceUrl, didNotTravel };
 }
 
@@ -50110,9 +50282,24 @@ exports.AjvJsonSchemaValidator = AjvJsonSchemaValidator;
 "use strict";
 
 
-const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = __nccwpck_require__(5077)
+const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = __nccwpck_require__(5077)
 const { SCHEMES, getSchemeHandler } = __nccwpck_require__(5300)
 
+const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u
+const MALFORMED_SCHEME_ERROR = 'URI scheme is malformed.'
+
+/**
+ * @param {string} scheme
+ * @returns {string}
+ */
+function decodeValidScheme (scheme) {
+  const decodedScheme = unescape(String(scheme))
+  if (!VALID_SCHEME.test(decodedScheme)) {
+    throw new TypeError(MALFORMED_SCHEME_ERROR)
+  }
+  return decodedScheme
+}
+
 /**
  * @template {import('./types/index').URIComponent|string} T
  * @param {T} uri
@@ -50121,7 +50308,7 @@ const { SCHEMES, getSchemeHandler } = __nccwpck_require__(5300)
  */
 function normalize (uri, options) {
   if (typeof uri === 'string') {
-    uri = /** @type {T} */ (serialize(parse(uri, options), options))
+    uri = /** @type {T} */ (normalizeString(uri, options))
   } else if (typeof uri === 'object') {
     uri = /** @type {T} */ (parse(serialize(uri, options), options))
   }
@@ -50136,7 +50323,50 @@ function normalize (uri, options) {
  */
 function resolve (baseURI, relativeURI, options) {
   const schemelessOptions = options ? Object.assign({ scheme: 'null' }, options) : { scheme: 'null' }
-  const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true)
+  const {
+    parsed: baseParsed,
+    malformedAuthorityOrPort: baseMalformed,
+    malformedPercentEncoding: baseMalformedPercentEncoding,
+    malformedSchemeSpecific: baseMalformedSchemeSpecific,
+    malformedHost: baseMalformedHost,
+    malformedScheme: baseMalformedScheme
+  } = parseWithStatus(baseURI, schemelessOptions)
+  const {
+    parsed: relativeParsed,
+    malformedAuthorityOrPort: relativeMalformed,
+    malformedPercentEncoding: relativeMalformedPercentEncoding,
+    malformedSchemeSpecific: relativeMalformedSchemeSpecific,
+    malformedHost: relativeMalformedHost,
+    malformedScheme: relativeMalformedScheme
+  } = parseWithStatus(relativeURI, schemelessOptions)
+  if (
+    baseMalformed ||
+    relativeMalformed ||
+    baseMalformedPercentEncoding ||
+    relativeMalformedPercentEncoding ||
+    baseMalformedSchemeSpecific ||
+    relativeMalformedSchemeSpecific ||
+    baseMalformedHost ||
+    relativeMalformedHost ||
+    baseMalformedScheme ||
+    relativeMalformedScheme
+  ) {
+    throw new Error(baseParsed.error || relativeParsed.error || 'URI is malformed.')
+  }
+  const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true)
+  const resolvedSchemeHandler = getSchemeHandler((options && options.scheme) || resolved.scheme)
+  const resolvedHost = resolved.host
+  const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== '' &&
+    (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6)
+  canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)
+  // Percent escapes in an ASCII reg-name are encoded data. The WHATWG hostname
+  // parser can reject them even though fast-uri preserves them safely as RFC
+  // 3986 data. A raw non-ASCII host must still fail closed if conversion fails.
+  const encodedASCIIHost = resolvedHost && resolvedHost.indexOf('%') !== -1 &&
+    !/\P{ASCII}/u.test(resolvedHost)
+  if (resolved.error && !encodedASCIIHost) {
+    throw new Error(resolved.error)
+  }
   schemelessOptions.skipEscape = true
   return serialize(resolved, schemelessOptions)
 }
@@ -50216,21 +50446,10 @@ function resolveComponent (base, relative, options, skipNormalization) {
  * @returns {boolean}
  */
 function equal (uriA, uriB, options) {
-  if (typeof uriA === 'string') {
-    uriA = unescape(uriA)
-    uriA = serialize(normalizeComponentEncoding(parse(uriA, options), true), { ...options, skipEscape: true })
-  } else if (typeof uriA === 'object') {
-    uriA = serialize(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true })
-  }
-
-  if (typeof uriB === 'string') {
-    uriB = unescape(uriB)
-    uriB = serialize(normalizeComponentEncoding(parse(uriB, options), true), { ...options, skipEscape: true })
-  } else if (typeof uriB === 'object') {
-    uriB = serialize(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true })
-  }
+  const normalizedA = normalizeComparableURI(uriA, options)
+  const normalizedB = normalizeComparableURI(uriB, options)
 
-  return uriA.toLowerCase() === uriB.toLowerCase()
+  return normalizedA !== undefined && normalizedB !== undefined && normalizedA === normalizedB
 }
 
 /**
@@ -50258,25 +50477,30 @@ function serialize (cmpts, opts) {
   const options = Object.assign({}, opts)
   const uriTokens = []
 
+  if (component.scheme) {
+    component.scheme = decodeValidScheme(component.scheme)
+  }
+
   // find scheme handler
   const schemeHandler = getSchemeHandler(options.scheme || component.scheme)
 
   // perform scheme specific serialization
   if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options)
 
+  const hasAuthority = component.userinfo !== undefined || component.host !== undefined || component.port !== undefined
+  const pathNoScheme = !options.skipEscape && component.scheme === undefined && !hasAuthority
+
   if (component.path !== undefined) {
     if (!options.skipEscape) {
-      component.path = escape(component.path)
-
-      if (component.scheme !== undefined) {
-        component.path = component.path.split('%3A').join(':')
-      }
+      component.path = serializePathEncoding(component.path, pathNoScheme)
     } else {
-      component.path = unescape(component.path)
+      component.path = normalizePercentEncoding(component.path)
     }
   }
 
   if (options.reference !== 'suffix' && component.scheme) {
+    // Scheme handlers may replace the scheme during serialization.
+    component.scheme = decodeValidScheme(component.scheme)
     uriTokens.push(component.scheme, ':')
   }
 
@@ -50299,6 +50523,13 @@ function serialize (cmpts, opts) {
       s = removeDotSegments(s)
     }
 
+    // Dot-segment removal can expose a colon that was not originally in the
+    // first segment (for example, "./a:b"). Reapply path-noscheme encoding so
+    // the serialized relative reference cannot be reparsed as a URI scheme.
+    if (pathNoScheme) {
+      s = serializePathEncoding(s, true)
+    }
+
     if (
       authority === undefined &&
       s[0] === '/' &&
@@ -50312,23 +50543,117 @@ function serialize (cmpts, opts) {
   }
 
   if (component.query !== undefined) {
-    uriTokens.push('?', component.query)
+    uriTokens.push('?', encodeQuery(component.query))
   }
 
   if (component.fragment !== undefined) {
-    uriTokens.push('#', component.fragment)
+    uriTokens.push('#', encodeFragment(component.fragment))
   }
   return uriTokens.join('')
 }
 
 const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u
 
+// Captures the authority component (between "//" and the next "/", "?" or "#"),
+// with or without a scheme prefix, for the literal-backslash rejection below.
+const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/
+
+// Captures the leading authority-introducer region after an optional scheme: a
+// run of forward slashes, backslashes, and the characters the WHATWG URL parser
+// removes before parsing (TAB U+0009, LF U+000A, CR U+000D). A valid introducer
+// is exactly "//". Node treats "\" as "/" on special schemes and strips those
+// characters first, so forms like "\\", "/\", "\/", "/<TAB>/", or a leading
+// "<TAB>//" reach an authority in Node while fast-uri's URI_PARSE folds them into
+// the path group (host confusion / SSRF / redirect bypass).
+const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/
+
+/**
+ * @param {import('./types/index').URIComponent} parsed
+ * @param {RegExpMatchArray} matches
+ * @returns {string|undefined}
+ */
+function getParseError (parsed, matches) {
+  if (matches[2] !== undefined && parsed.path && parsed.path[0] !== '/') {
+    return 'URI path must start with "/" when authority is present.'
+  }
+
+  if (typeof parsed.port === 'number' && (parsed.port < 0 || parsed.port > 65535)) {
+    return 'URI port is malformed.'
+  }
+
+  return undefined
+}
+
+/**
+ * Checks percent syntax without decoding the represented octets. RFC 3986
+ * percent-encoding is byte-oriented, so sequences such as `%FF` are valid even
+ * though they are not independently valid UTF-8.
+ *
+ * @param {string|undefined} component
+ * @returns {boolean}
+ */
+function hasMalformedPercentEncoding (component) {
+  if (component === undefined) return false
+
+  let percent = component.indexOf('%')
+  while (percent !== -1) {
+    if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
+      return true
+    }
+    percent = component.indexOf('%', percent + 3)
+  }
+
+  return false
+}
+
+/**
+ * @param {RegExpMatchArray} matches
+ * @returns {boolean}
+ */
+function hasMalformedComponentPercentEncoding (matches) {
+  // Bracketed IP literals use a raw "%" as the zone separator for historical
+  // compatibility. Their parsing is intentionally left to normalizeIPv6.
+  const host = matches[4]
+  return hasMalformedPercentEncoding(matches[3]) ||
+    (host !== undefined && !(host[0] === '[' && host[host.length - 1] === ']') && hasMalformedPercentEncoding(host)) ||
+    hasMalformedPercentEncoding(matches[6]) ||
+    hasMalformedPercentEncoding(matches[7]) ||
+    hasMalformedPercentEncoding(matches[8])
+}
+
+/**
+ * @param {import('./types/index').URIComponent} parsed
+ * @param {import('./types/index').Options} options
+ * @param {{ domainHost?: boolean, unicodeSupport?: boolean }|undefined} schemeHandler
+ * @param {boolean} isIP
+ * @returns {boolean} whether host conversion failed
+ */
+function canonicalizeHost (parsed, options, schemeHandler, isIP) {
+  if (
+    !options.unicodeSupport &&
+    (!schemeHandler || !schemeHandler.unicodeSupport) &&
+    parsed.host &&
+    parsed.host[0] !== '[' &&
+    (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
+    isIP === false &&
+    nonSimpleDomain(parsed.host)
+  ) {
+    try {
+      parsed.host = new URL('http://' + parsed.host).hostname
+    } catch (e) {
+      parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e
+      return true
+    }
+  }
+  return false
+}
+
 /**
  * @param {string} uri
  * @param {import('./types/index').Options} [opts]
- * @returns
+ * @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
  */
-function parse (uri, opts) {
+function parseWithStatus (uri, opts) {
   const options = Object.assign({}, opts)
   /** @type {import('./types/index').URIComponent} */
   const parsed = {
@@ -50341,6 +50666,13 @@ function parse (uri, opts) {
     fragment: undefined
   }
 
+  let malformedAuthorityOrPort = false
+  let malformedPercentEncoding = false
+  let malformedSchemeSpecific = false
+  let malformedHost = false
+  let malformedIPLiteral = false
+  let malformedScheme = false
+
   let isIP = false
   if (options.reference === 'suffix') {
     if (options.scheme) {
@@ -50350,6 +50682,41 @@ function parse (uri, opts) {
     }
   }
 
+  // A literal backslash (U+005C) is not a valid RFC 3986 URI character and is
+  // not an authority delimiter. Reject it in the authority rather than
+  // rewriting it: normalizing "\" -> "/" (WHATWG error recovery) could silently
+  // change the resource identified by an otherwise-invalid input, and lets "\"
+  // act as a host delimiter here while Node's native URL parses a different
+  // host (SSRF / redirect / origin-allowlist bypass). Percent-encoded %5C is
+  // untouched and remains valid encoded data.
+  const authorityMatch = uri.match(AUTHORITY_PREFIX)
+  if (authorityMatch !== null && authorityMatch[1].indexOf('\\') !== -1) {
+    parsed.error = 'URI authority must not contain a literal backslash.'
+    malformedAuthorityOrPort = true
+  }
+
+  // Reject a malformed or whitespace-smuggled authority introducer. fast-uri
+  // only recognizes a literal "//"; anything else in the leading separator run
+  // (a backslash, or a "//" that appears only after removing the TAB/LF/CR that
+  // Node strips) means the authority fast-uri parses differs from the one Node's
+  // URL resolves. Reject rather than rewrite, mirroring the literal-backslash
+  // guard above. Percent-encoded forms (%5C, %09) are untouched, valid data.
+  const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION)
+  if (introducerMatch !== null) {
+    const region = introducerMatch[1]
+    const normalizedRegion = region.replace(/[\t\n\r]/g, '')
+    // Two or more leading separators introduce an authority.
+    if (normalizedRegion.length >= 2) {
+      if (normalizedRegion.slice(0, 2) !== '//') {
+        parsed.error = parsed.error || 'URI authority must not contain a literal backslash.'
+        malformedAuthorityOrPort = true
+      } else if (region.length !== normalizedRegion.length) {
+        parsed.error = parsed.error || 'URI authority introducer must not contain whitespace.'
+        malformedAuthorityOrPort = true
+      }
+    }
+  }
+
   const matches = uri.match(URI_PARSE)
 
   if (matches) {
@@ -50362,16 +50729,45 @@ function parse (uri, opts) {
     parsed.query = matches[7]
     parsed.fragment = matches[8]
 
+    if (parsed.scheme !== undefined) {
+      const decodedScheme = unescape(parsed.scheme)
+      if (VALID_SCHEME.test(decodedScheme)) {
+        parsed.scheme = decodedScheme.toLowerCase()
+      } else {
+        parsed.error = parsed.error || MALFORMED_SCHEME_ERROR
+        malformedScheme = true
+      }
+    }
+
+    malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches)
+    if (malformedPercentEncoding) {
+      parsed.error = parsed.error || 'URI contains malformed percent-encoding.'
+    }
+
     // fix port number
     if (isNaN(parsed.port)) {
       parsed.port = matches[5]
     }
+
+    const parseError = getParseError(parsed, matches)
+    if (parseError !== undefined) {
+      parsed.error = parsed.error || parseError
+      malformedAuthorityOrPort = true
+    }
+
     if (parsed.host) {
       const ipv4result = isIPv4(parsed.host)
       if (ipv4result === false) {
+        const bracketedIPLiteral = parsed.host[0] === '[' && parsed.host[parsed.host.length - 1] === ']'
         const ipv6result = normalizeIPv6(parsed.host)
-        parsed.host = ipv6result.host.toLowerCase()
-        isIP = ipv6result.isIPV6
+        isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true
+        malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true
+        parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase()
+
+        if (malformedIPLiteral) {
+          parsed.error = parsed.error || 'URI host is malformed.'
+          malformedAuthorityOrPort = true
+        }
       } else {
         isIP = true
       }
@@ -50394,45 +50790,93 @@ function parse (uri, opts) {
     // find scheme handler
     const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme)
 
-    // check if scheme can't handle IRIs
-    if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-      // if host component is a domain name
-      if (parsed.host && (options.domainHost || (schemeHandler && schemeHandler.domainHost)) && isIP === false && nonSimpleDomain(parsed.host)) {
-        // convert Unicode IDN -> ASCII IDN
-        try {
-          parsed.host = URL.domainToASCII(parsed.host.toLowerCase())
-        } catch (e) {
-          parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e
-        }
-      }
-      // convert IRI -> URI
-    }
+    // convert Unicode IDN -> ASCII IDN when the effective scheme uses domain hosts
+    malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
 
     if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
       if (uri.indexOf('%') !== -1) {
-        if (parsed.scheme !== undefined) {
-          parsed.scheme = unescape(parsed.scheme)
-        }
-        if (parsed.host !== undefined) {
-          parsed.host = unescape(parsed.host)
+        if (parsed.host !== undefined && !malformedIPLiteral) {
+          const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
+          parsed.host = reescapeHostDelimiters(host, isIP)
         }
       }
       if (parsed.path) {
-        parsed.path = escape(unescape(parsed.path))
+        parsed.path = normalizePathEncoding(parsed.path)
+      }
+      if (parsed.query) {
+        parsed.query = normalizeQueryFragmentEncoding(parsed.query)
       }
       if (parsed.fragment) {
-        parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment))
+        parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment)
       }
     }
 
     // perform scheme specific parsing
     if (schemeHandler && schemeHandler.parse) {
       schemeHandler.parse(parsed, options)
+      if (schemeHandler === SCHEMES.urn && parsed.nid === undefined) {
+        malformedSchemeSpecific = true
+      }
     }
   } else {
     parsed.error = parsed.error || 'URI can not be parsed.'
   }
-  return parsed
+  return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme }
+}
+
+/**
+ * @param {string} uri
+ * @param {import('./types/index').Options} [opts]
+ * @returns
+ */
+function parse (uri, opts) {
+  return parseWithStatus(uri, opts).parsed
+}
+
+/**
+ * @param {string} uri
+ * @param {import('./types/index').Options} [opts]
+ * @returns {string}
+ */
+function normalizeString (uri, opts) {
+  return normalizeStringWithStatus(uri, opts).normalized
+}
+
+/**
+ * @param {string} uri
+ * @param {import('./types/index').Options} [opts]
+ * @returns {{ normalized: string, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
+ */
+function normalizeStringWithStatus (uri, opts) {
+  const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts)
+  return {
+    normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+    malformedAuthorityOrPort,
+    malformedPercentEncoding,
+    malformedSchemeSpecific,
+    malformedHost,
+    malformedScheme
+  }
+}
+
+/**
+ * @param {import ('./types/index').URIComponent|string} uri
+ * @param {import('./types/index').Options} [opts]
+ * @returns {string|undefined}
+ */
+function normalizeComparableURI (uri, opts) {
+  if (typeof uri !== 'string' && typeof uri !== 'object') {
+    return undefined
+  }
+
+  let value
+  try {
+    value = typeof uri === 'string' ? uri : serialize(uri, opts)
+  } catch {
+    return undefined
+  }
+  const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts)
+  return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized
 }
 
 const fastUri = {
@@ -50459,7 +50903,7 @@ module.exports.fastUri = fastUri
 
 
 const { isUUID } = __nccwpck_require__(5077)
-const URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu
+const URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu
 
 const supportedSchemeNames = /** @type {const} */ (['http', 'https', 'ws',
   'wss', 'urn', 'urn:uuid'])
@@ -50571,9 +51015,14 @@ function wsSerialize (wsComponent) {
 
   // reconstruct path from resource name
   if (wsComponent.resourceName) {
-    const [path, query] = wsComponent.resourceName.split('?')
+    const queryIndex = wsComponent.resourceName.indexOf('?')
+    const path = queryIndex === -1
+      ? wsComponent.resourceName
+      : wsComponent.resourceName.slice(0, queryIndex)
     wsComponent.path = (path && path !== '/' ? path : undefined)
-    wsComponent.query = query
+    wsComponent.query = queryIndex === -1
+      ? undefined
+      : wsComponent.resourceName.slice(queryIndex + 1)
     wsComponent.resourceName = undefined
   }
 
@@ -50590,7 +51039,7 @@ function urnParse (urnComponent, options) {
     return urnComponent
   }
   const matches = urnComponent.path.match(URN_REG)
-  if (matches) {
+  if (matches && matches[0] === urnComponent.path) {
     const scheme = options.scheme || urnComponent.scheme || 'urn'
     urnComponent.nid = matches[1].toLowerCase()
     urnComponent.nss = matches[2]
@@ -50739,6 +51188,44 @@ const isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\d
 /** @type {(value: string) => boolean} */
 const isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u)
 
+/** @type {(value: string) => boolean} */
+const isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu)
+
+/** @type {(value: string) => boolean} */
+const isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu)
+
+/** @type {(value: string) => boolean} */
+const isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u)
+
+/** @type {(value: string) => boolean} */
+const isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u)
+
+/** @type {(value: string) => boolean} */
+const isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u)
+
+const BYTE_HEX = new Array(256)
+{
+  const HEX_DIGITS = '0123456789ABCDEF'
+  for (let i = 0; i < 256; i++) {
+    BYTE_HEX[i] = '%' + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 0xF]
+  }
+}
+function percentEncodeNonAscii (cp) {
+  if (cp < 0x800) {
+    return BYTE_HEX[0xC0 | (cp >> 6)] +
+           BYTE_HEX[0x80 | (cp & 0x3F)]
+  }
+  if (cp < 0x10000) {
+    return BYTE_HEX[0xE0 | (cp >> 12)] +
+           BYTE_HEX[0x80 | ((cp >> 6) & 0x3F)] +
+           BYTE_HEX[0x80 | (cp & 0x3F)]
+  }
+  return BYTE_HEX[0xF0 | (cp >> 18)] +
+         BYTE_HEX[0x80 | ((cp >> 12) & 0x3F)] +
+         BYTE_HEX[0x80 | ((cp >> 6) & 0x3F)] +
+         BYTE_HEX[0x80 | (cp & 0x3F)]
+}
+
 /**
  * @param {Array<string>} input
  * @returns {string}
@@ -50770,12 +51257,14 @@ function stringArrayToHexStripped (input) {
   return acc
 }
 
-/**
- * @typedef {Object} GetIPV6Result
- * @property {boolean} error - Indicates if there was an error parsing the IPv6 address.
- * @property {string} address - The parsed IPv6 address.
- * @property {string} [zone] - The zone identifier, if present.
- */
+/** @type {(value: string) => boolean} */
+const isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/)
+
+/** @type {(value: string) => boolean} */
+const isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/)
+
+/** @type {(value: string) => boolean} */
+const isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/)
 
 /**
  * @param {string} value
@@ -50784,88 +51273,104 @@ function stringArrayToHexStripped (input) {
 const nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u)
 
 /**
- * @param {Array<string>} buffer
+ * @param {string} zone
  * @returns {boolean}
  */
-function consumeIsZone (buffer) {
-  buffer.length = 0
+function isZoneIdentifier (zone) {
+  if (zone.length === 0) return false
+
+  for (let i = 0; i < zone.length; i++) {
+    if (isZoneCharacter(zone[i])) continue
+    if (zone[i] === '%' && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
+      i += 2
+      continue
+    }
+    return false
+  }
+
   return true
 }
 
 /**
- * @param {Array<string>} buffer
- * @param {Array<string>} address
- * @param {GetIPV6Result} output
- * @returns {boolean}
+ * Compresses the longest run of zero hextets to "::" per RFC 5952. A run of a
+ * single zero hextet is left uncompressed. On ties the leftmost run wins.
+ *
+ * @param {string[]} hextets
+ * @returns {string}
  */
-function consumeHextets (buffer, address, output) {
-  if (buffer.length) {
-    const hex = stringArrayToHexStripped(buffer)
-    if (hex !== '') {
-      address.push(hex)
+function compressIPv6ZeroRun (hextets) {
+  let bestStart = -1
+  let bestLength = 0
+  let runStart = -1
+  let runLength = 0
+  for (let i = 0; i < hextets.length; i++) {
+    if (hextets[i] === '0') {
+      if (runStart === -1) runStart = i
+      runLength++
+      if (runLength > bestLength) {
+        bestLength = runLength
+        bestStart = runStart
+      }
     } else {
-      output.error = true
-      return false
+      runStart = -1
+      runLength = 0
     }
-    buffer.length = 0
   }
-  return true
+
+  if (bestLength < 2) return hextets.join(':')
+
+  const head = hextets.slice(0, bestStart).join(':')
+  const tail = hextets.slice(bestStart + bestLength).join(':')
+  return head + '::' + tail
 }
 
 /**
+ * Validates an IPv6 address against the alternatives in RFC 3986 section
+ * 3.2.2 and returns the same address with leading hextet zeroes removed.
+ * An embedded IPv4 address counts as two hextets and is only valid at the end.
+ *
  * @param {string} input
- * @returns {GetIPV6Result}
+ * @returns {string|undefined}
  */
-function getIPV6 (input) {
-  let tokenCount = 0
-  const output = { error: false, address: '', zone: '' }
-  /** @type {Array<string>} */
-  const address = []
-  /** @type {Array<string>} */
-  const buffer = []
-  let endipv6Encountered = false
-  let endIpv6 = false
-
-  let consume = consumeHextets
-
-  for (let i = 0; i < input.length; i++) {
-    const cursor = input[i]
-    if (cursor === '[' || cursor === ']') { continue }
-    if (cursor === ':') {
-      if (endipv6Encountered === true) {
-        endIpv6 = true
-      }
-      if (!consume(buffer, address, output)) { break }
-      if (++tokenCount > 7) {
-        // not valid
-        output.error = true
-        break
-      }
-      if (i > 0 && input[i - 1] === ':') {
-        endipv6Encountered = true
-      }
-      address.push(':')
-      continue
-    } else if (cursor === '%') {
-      if (!consume(buffer, address, output)) { break }
-      // switch to zone detection
-      consume = consumeIsZone
-    } else {
-      buffer.push(cursor)
+function normalizeIPv6Address (input) {
+  const compression = input.indexOf('::')
+  if (compression !== -1 && input.indexOf('::', compression + 1) !== -1) return undefined
+
+  const left = compression === -1 ? input.split(':') : input.slice(0, compression).split(':')
+  const right = compression === -1 ? [] : input.slice(compression + 2).split(':')
+  if (compression !== -1) {
+    if (left.length === 1 && left[0] === '') left.length = 0
+    if (right.length === 1 && right[0] === '') right.length = 0
+  }
+
+  const parts = left.concat(right)
+  let hextetCount = 0
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i]
+    if (part === '') return undefined
+
+    if (part.indexOf('.') !== -1) {
+      if (i !== parts.length - 1 || (compression !== -1 && right.length === 0) || !isIPv4(part)) return undefined
+      hextetCount += 2
       continue
     }
+
+    if (!isHextet(part)) return undefined
+    parts[i] = parseInt(part, 16).toString(16)
+    hextetCount++
   }
-  if (buffer.length) {
-    if (consume === consumeIsZone) {
-      output.zone = buffer.join('')
-    } else if (endIpv6) {
-      address.push(buffer.join(''))
-    } else {
-      address.push(stringArrayToHexStripped(buffer))
-    }
+
+  if (compression === -1) {
+    if (hextetCount !== 8) return undefined
+    return compressIPv6ZeroRun(parts)
   }
-  output.address = address.join('')
-  return output
+  if (hextetCount >= 8) return undefined
+
+  // expand "::" then re-compress the longest run for a canonical result
+  const expanded = parts.slice(0, left.length)
+  for (let i = hextetCount; i < 8; i++) expanded.push('0')
+  for (let i = left.length; i < parts.length; i++) expanded.push(parts[i])
+  return compressIPv6ZeroRun(expanded)
 }
 
 /**
@@ -50873,26 +51378,49 @@ function getIPV6 (input) {
  * @property {string} host - The normalized host.
  * @property {string} [escapedHost] - The escaped host.
  * @property {boolean} isIPV6 - Indicates if the host is an IPv6 address.
+ * @property {boolean} [isIPVFuture] - Indicates if the host is an IPvFuture literal.
+ * @property {boolean} [error] - Indicates if a bracketed IP literal is malformed.
  */
 
 /**
+ * Validates and normalizes a bracketed IP literal. Raw zone separators remain
+ * accepted for backwards compatibility, while encoded separators and zone
+ * contents follow RFC 6874.
+ *
  * @param {string} host
  * @returns {NormalizeIPv6Result}
  */
 function normalizeIPv6 (host) {
-  if (findToken(host, ':') < 2) { return { host, isIPV6: false } }
-  const ipv6 = getIPV6(host)
+  const bracketed = host[0] === '[' && host[host.length - 1] === ']'
+  const hasBracket = host[0] === '[' || host[host.length - 1] === ']'
+  if (hasBracket && !bracketed) return { host, isIPV6: false, error: true }
 
-  if (!ipv6.error) {
-    let newHost = ipv6.address
-    let escapedHost = ipv6.address
-    if (ipv6.zone) {
-      newHost += '%' + ipv6.zone
-      escapedHost += '%25' + ipv6.zone
-    }
-    return { host: newHost, isIPV6: true, escapedHost }
-  } else {
-    return { host, isIPV6: false }
+  let input = bracketed ? host.slice(1, -1) : host
+  if (bracketed && isIPvFuture(input)) {
+    input = input.toLowerCase()
+    return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true }
+  }
+
+  if (findToken(input, ':') < 2) {
+    return { host, isIPV6: false, error: bracketed }
+  }
+
+  let zoneIdentifier = ''
+  const zoneSeparator = input.indexOf('%')
+  if (zoneSeparator !== -1) {
+    const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === '%25' ? 3 : 1
+    zoneIdentifier = input.slice(zoneSeparator + separatorLength)
+    if (!isZoneIdentifier(zoneIdentifier)) return { host, isIPV6: false, error: true }
+    input = input.slice(0, zoneSeparator)
+  }
+
+  const address = normalizeIPv6Address(input)
+  if (address === undefined) return { host, isIPV6: false, error: true }
+
+  return {
+    host: address + (zoneIdentifier ? '%' + zoneIdentifier : ''),
+    escapedHost: address + (zoneIdentifier ? '%25' + zoneIdentifier : ''),
+    isIPV6: true
   }
 }
 
@@ -50997,31 +51525,342 @@ function removeDotSegments (path) {
 }
 
 /**
- * @param {import('../types/index').URIComponent} component
- * @param {boolean} esc
- * @returns {import('../types/index').URIComponent}
+ * Re-escape RFC 3986 gen-delims that must not appear literally in the host.
+ * After the URI regex parses, these characters cannot be literal in the host
+ * field, so any that appear after decoding came from percent-encoding and
+ * must be restored to prevent authority structure changes.
+ *
+ * @param {string} host
+ * @param {boolean} isIP - true for IPv4/IPv6 hosts (skip colon re-escaping)
+ * @returns {string}
+ */
+const HOST_DELIMS = { '@': '%40', '/': '%2F', '?': '%3F', '#': '%23', ':': '%3A' }
+const HOST_DELIM_RE = /[@/?#:]/g
+const HOST_DELIM_NO_COLON_RE = /[@/?#]/g
+
+function reescapeHostDelimiters (host, isIP) {
+  const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE
+  re.lastIndex = 0
+  return host.replace(re, (ch) => HOST_DELIMS[ch])
+}
+
+/**
+ * Normalizes percent escapes and optionally decodes only unreserved ASCII bytes.
+ * Reserved delimiters such as `%2F` stay escaped; `%2E` is unreserved.
+ *
+ * @param {string} input
+ * @param {boolean} [decodeUnreserved=false]
+ * @returns {string}
  */
-function normalizeComponentEncoding (component, esc) {
-  const func = esc !== true ? escape : unescape
-  if (component.scheme !== undefined) {
-    component.scheme = func(component.scheme)
+function normalizePercentEncoding (input, decodeUnreserved = false) {
+  if (input.indexOf('%') === -1) {
+    return input
   }
-  if (component.userinfo !== undefined) {
-    component.userinfo = func(component.userinfo)
+
+  let output = ''
+
+  for (let i = 0; i < input.length; i++) {
+    if (input[i] === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3)
+      if (isHexPair(hex)) {
+        const normalizedHex = hex.toUpperCase()
+        const decoded = String.fromCharCode(parseInt(normalizedHex, 16))
+
+        if (decodeUnreserved && isUnreserved(decoded)) {
+          output += decoded
+        } else {
+          output += '%' + normalizedHex
+        }
+
+        i += 2
+        continue
+      }
+    }
+
+    output += input[i]
   }
-  if (component.host !== undefined) {
-    component.host = func(component.host)
+
+  return output
+}
+
+/**
+ * Normalizes path data without turning reserved escapes into live path syntax.
+ * Valid escapes are uppercased, raw unsafe characters are escaped, and only
+ * unreserved bytes that are not `.` are decoded.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function normalizePathEncoding (input) {
+  let output = ''
+
+  for (let i = 0; i < input.length; i++) {
+    const ch = input[i]
+    if (ch === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3)
+      if (isHexPair(hex)) {
+        const normalizedHex = hex.toUpperCase()
+        const decoded = String.fromCharCode(parseInt(normalizedHex, 16))
+
+        if (decoded !== '.' && isUnreserved(decoded)) {
+          output += decoded
+        } else {
+          output += '%' + normalizedHex
+        }
+
+        i += 2
+        continue
+      }
+    }
+
+    if (isPathCharacter(ch)) {
+      output += ch
+    } else {
+      const code = input.charCodeAt(i)
+      if (code < 0x80) {
+        output += isEscapeSafe(code) ? ch : BYTE_HEX[code]
+      } else if (code < 0xD800 || code > 0xDFFF) {
+        output += percentEncodeNonAscii(code)
+      } else if (code <= 0xDBFF && i + 1 < input.length) {
+        const low = input.charCodeAt(i + 1)
+        if (low >= 0xDC00 && low <= 0xDFFF) {
+          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+          i++
+        } else {
+          output += percentEncodeNonAscii(0xFFFD)
+        }
+      } else {
+        output += percentEncodeNonAscii(0xFFFD)
+      }
+    }
   }
-  if (component.path !== undefined) {
-    component.path = func(component.path)
+
+  return output
+}
+
+/**
+ * Serializes a path without rewriting reserved data. Raw RFC 3986 path
+ * characters remain literal, valid escapes are preserved and uppercased, and
+ * everything else is UTF-8 percent-encoded. In a path-noscheme, a colon in the
+ * first segment must be escaped so the result cannot be parsed as a scheme.
+ *
+ * @param {string} input
+ * @param {boolean} [pathNoScheme=false]
+ * @returns {string}
+ */
+function serializePathEncoding (input, pathNoScheme = false) {
+  let output = ''
+  let firstSegment = pathNoScheme && input[0] !== '/'
+
+  for (let i = 0; i < input.length; i++) {
+    const ch = input[i]
+    if (ch === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3)
+      if (isHexPair(hex)) {
+        output += '%' + hex.toUpperCase()
+        i += 2
+        continue
+      }
+    }
+
+    if (ch === '/') {
+      firstSegment = false
+    }
+
+    if (isPathCharacter(ch) && (ch !== ':' || !firstSegment)) {
+      output += ch
+    } else {
+      const code = input.charCodeAt(i)
+      if (code < 0x80) {
+        output += BYTE_HEX[code]
+      } else if (code < 0xD800 || code > 0xDFFF) {
+        output += percentEncodeNonAscii(code)
+      } else if (code <= 0xDBFF && i + 1 < input.length) {
+        const low = input.charCodeAt(i + 1)
+        if (low >= 0xDC00 && low <= 0xDFFF) {
+          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+          i++
+        } else {
+          output += percentEncodeNonAscii(0xFFFD)
+        }
+      } else {
+        output += percentEncodeNonAscii(0xFFFD)
+      }
+    }
   }
-  if (component.query !== undefined) {
-    component.query = func(component.query)
+
+  return output
+}
+
+/**
+ * Percent-encodes a URI component using its RFC 3986 literal character set.
+ * Existing valid escapes are preserved and normalized to uppercase hex.
+ *
+ * @param {string} input
+ * @param {(value: string) => boolean} isAllowed
+ * @returns {string}
+ */
+function encodeComponent (input, isAllowed) {
+  let output = ''
+
+  for (let i = 0; i < input.length; i++) {
+    const ch = input[i]
+    if (ch === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3)
+      if (isHexPair(hex)) {
+        output += '%' + hex.toUpperCase()
+        i += 2
+        continue
+      }
+    }
+
+    if (isAllowed(ch)) {
+      output += ch
+    } else {
+      const code = input.charCodeAt(i)
+      if (code < 0x80) {
+        output += BYTE_HEX[code]
+      } else if (code < 0xD800 || code > 0xDFFF) {
+        output += percentEncodeNonAscii(code)
+      } else if (code <= 0xDBFF && i + 1 < input.length) {
+        const low = input.charCodeAt(i + 1)
+        if (low >= 0xDC00 && low <= 0xDFFF) {
+          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+          i++
+        } else {
+          output += percentEncodeNonAscii(0xFFFD)
+        }
+      } else {
+        output += percentEncodeNonAscii(0xFFFD)
+      }
+    }
   }
-  if (component.fragment !== undefined) {
-    component.fragment = func(component.fragment)
+
+  return output
+}
+
+/**
+ * Encodes userinfo while preserving its RFC 3986 §3.2.1 literal characters.
+ * In particular, authority delimiters such as `@`, `/`, `?`, and `#` are data.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function encodeUserinfo (input) {
+  return encodeComponent(input, isUserinfoCharacter)
+}
+
+/**
+ * Encodes query data using the RFC 3986 §3.4 grammar. A literal `#` must be
+ * escaped because it would otherwise begin the fragment component.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function encodeQuery (input) {
+  return encodeComponent(input, isQueryFragmentCharacter)
+}
+
+/**
+ * Encodes fragment data using the RFC 3986 §3.5 grammar.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function encodeFragment (input) {
+  return encodeComponent(input, isQueryFragmentCharacter)
+}
+
+function isEscapeSafe (cp) {
+  return (
+    (cp >= 0x30 && cp <= 0x39) ||
+    (cp >= 0x41 && cp <= 0x5A) ||
+    (cp >= 0x61 && cp <= 0x7A) ||
+    cp === 0x2A || cp === 0x2B || cp === 0x2D || cp === 0x2E ||
+    cp === 0x2F || cp === 0x40 || cp === 0x5F
+  )
+}
+
+/**
+ * Normalizes the percent-encoding of a query or fragment component.
+ *
+ * Like `normalizePathEncoding`, but uses the query/fragment character set
+ * (which additionally allows `?`) and decodes `.` since it has no dot-segment
+ * meaning outside of a path.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function normalizeQueryFragmentEncoding (input) {
+  let output = ''
+
+  for (let i = 0; i < input.length; i++) {
+    const ch = input[i]
+    if (ch === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3)
+      if (isHexPair(hex)) {
+        const normalizedHex = hex.toUpperCase()
+        const decoded = String.fromCharCode(parseInt(normalizedHex, 16))
+
+        if (isUnreserved(decoded)) {
+          output += decoded
+        } else {
+          output += '%' + normalizedHex
+        }
+
+        i += 2
+        continue
+      }
+    }
+
+    if (isQueryFragmentCharacter(ch)) {
+      output += ch
+    } else {
+      const code = input.charCodeAt(i)
+      if (code < 0x80) {
+        output += isEscapeSafe(code) ? ch : BYTE_HEX[code]
+      } else if (code < 0xD800 || code > 0xDFFF) {
+        output += percentEncodeNonAscii(code)
+      } else if (code <= 0xDBFF && i + 1 < input.length) {
+        const low = input.charCodeAt(i + 1)
+        if (low >= 0xDC00 && low <= 0xDFFF) {
+          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00))
+          i++
+        } else {
+          output += percentEncodeNonAscii(0xFFFD)
+        }
+      } else {
+        output += percentEncodeNonAscii(0xFFFD)
+      }
+    }
   }
-  return component
+
+  return output
+}
+
+/**
+ * Escapes a component while preserving existing valid percent escapes.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function escapePreservingEscapes (input) {
+  let output = ''
+
+  for (let i = 0; i < input.length; i++) {
+    if (input[i] === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3)
+      if (isHexPair(hex)) {
+        output += '%' + hex.toUpperCase()
+        i += 2
+        continue
+      }
+    }
+
+    output += escape(input[i])
+  }
+
+  return output
 }
 
 /**
@@ -51032,18 +51871,24 @@ function recomposeAuthority (component) {
   const uriTokens = []
 
   if (component.userinfo !== undefined) {
-    uriTokens.push(component.userinfo)
+    uriTokens.push(encodeUserinfo(component.userinfo))
     uriTokens.push('@')
   }
 
   if (component.host !== undefined) {
-    let host = unescape(component.host)
+    let host = component.host
     if (!isIPv4(host)) {
-      const ipV6res = normalizeIPv6(host)
-      if (ipV6res.isIPV6 === true) {
+      let ipV6res = normalizeIPv6(host)
+      if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+        // Decode only unreserved bytes, once. In particular, keep %25 encoded
+        // so it cannot introduce a second escape during recomposition.
+        host = normalizePercentEncoding(host, true)
+        ipV6res = normalizeIPv6(host)
+      }
+      if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
         host = `[${ipV6res.escapedHost}]`
       } else {
-        host = component.host
+        host = reescapeHostDelimiters(host, false)
       }
     }
     uriTokens.push(host)
@@ -51060,7 +51905,15 @@ function recomposeAuthority (component) {
 module.exports = {
   nonSimpleDomain,
   recomposeAuthority,
-  normalizeComponentEncoding,
+  reescapeHostDelimiters,
+  normalizePercentEncoding,
+  normalizePathEncoding,
+  serializePathEncoding,
+  normalizeQueryFragmentEncoding,
+  encodeUserinfo,
+  encodeQuery,
+  encodeFragment,
+  escapePreservingEscapes,
   removeDotSegments,
   isIPv4,
   isUUID,
@@ -72013,7 +72866,7 @@ module.exports = /*#__PURE__*/JSON.parse('{"$schema":"http://json-schema.org/dra
 /***/ ((module) => {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@pathmode/mcp-server","version":"1.20.1","publishConfig":{"access":"public"},"mcpName":"io.github.pathmodeio/mcp-server","description":"Deterministic intent preflight before your agent builds: six calibrated gates, keyless, no model call. Draft and sharpen specs in conversation, or connect a Pathmode workspace to sync intent and evidence across a team.","main":"dist/index.js","bin":{"pathmode-mcp":"dist/index.js"},"files":["dist/","manifest.json","icon.svg","README.md","skills/"],"scripts":{"build":"rm -rf dist && ncc build src/index.ts -o dist","dev":"ts-node src/index.ts","prepublishOnly":"npm run build"},"keywords":["pathmode","mcp","model-context-protocol","claude-code","claude-code-skills","agent-skills","cursor","windsurf","intent-engineering","intent-compiler","ai-agents","product-development","dependency-graph","strategic-planning"],"author":"Pathmode","license":"MIT","type":"commonjs","engines":{"node":">=18.0.0"},"homepage":"https://pathmode.io","dependencies":{"@modelcontextprotocol/sdk":"^1.12.1","gray-matter":"^4.0.3","zod":"^3.24.0"},"devDependencies":{"@types/node":"^25.1.0","@vercel/ncc":"^0.38.4","ts-node":"^10.9.2","typescript":"^5.9.3"}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@pathmode/mcp-server","version":"1.21.0","publishConfig":{"access":"public"},"mcpName":"io.github.pathmodeio/mcp-server","description":"Deterministic intent preflight before your agent builds: six calibrated gates, keyless, no model call. Draft and sharpen specs in conversation, or connect a Pathmode workspace to sync intent and evidence across a team.","main":"dist/index.js","bin":{"pathmode-mcp":"dist/index.js"},"files":["dist/","manifest.json","icon.svg","README.md","skills/"],"scripts":{"build":"rm -rf dist && ncc build src/index.ts -o dist","dev":"ts-node src/index.ts","prepublishOnly":"npm run build"},"keywords":["pathmode","mcp","model-context-protocol","claude-code","claude-code-skills","agent-skills","cursor","windsurf","intent-engineering","intent-compiler","ai-agents","product-development","dependency-graph","strategic-planning"],"author":"Pathmode","license":"MIT","type":"commonjs","engines":{"node":">=18.0.0"},"homepage":"https://pathmode.io","dependencies":{"@modelcontextprotocol/sdk":"^1.12.1","gray-matter":"^4.0.3","zod":"^3.24.0"},"overrides":{"@hono/node-server":"^1.19.17","body-parser":"^2.3.0","fast-uri":"^3.1.6","hono":"^4.13.5","ip-address":"^10.7.0","js-yaml":"^3.15.2"},"devDependencies":{"@types/node":"^25.1.0","@vercel/ncc":"^0.38.4","ts-node":"^10.9.2","typescript":"^5.9.3"}}');
 
 /***/ })
 
@@ -72194,7 +73047,7 @@ function startMcpServer() {
         'A failing verdict names the exact blockers; repair them one targeted question at a time. Never block work on a failing verdict. ' +
         'To sync with a shared Pathmode workspace later, run: npx @pathmode/mcp-server setup pm_live_xxx';
     const CLOUD_MODE_INSTRUCTIONS = 'Pathmode is connected to a workspace (cloud mode). ' +
-        'First move: call check_intent_readiness before implementation starts. With no arguments it prefers this repo\'s intent.md and falls back to the workspace current intent only when no repo-bound file exists; a failing verdict names the exact blockers to repair. ' +
+        'First move: call check_intent_readiness before implementation starts. With no arguments it resolves this repo\'s intent.md from MCP workspace roots or the server launch directory. It falls back to the workspace current intent only after client-declared roots show that no repo-bound file exists; when the repository cannot be identified it refuses to guess. A failing verdict names the exact blockers to repair. ' +
         'If tools fail with API error (401), the configured key is invalid: re-run npx @pathmode/mcp-server setup with a fresh key from your workspace settings at https://pathmode.io, ' +
         'or remove PATHMODE_API_KEY and restart to fall back to free keyless local mode (specs live in intent.md, no account needed).';
     const server = new mcp_js_1.McpServer({
@@ -72338,6 +73191,39 @@ function startMcpServer() {
             return anyReady;
         return intents[0];
     }
+    /**
+     * Resolve the intent bound to the repository the MCP client says it is working in.
+     *
+     * Global MCP configurations launch the server from an arbitrary directory, so cwd is only a
+     * fallback for clients that do not advertise roots. Declared roots win even when cwd happens to
+     * contain a different intent.md. If roots cannot be resolved and cwd has no intent.md, callers
+     * must not silently substitute the workspace's heuristic "current" intent — that is how a
+     * preflight for one repository graded the demo shoe-return intent instead.
+     */
+    async function resolveRepoBoundIntent(intentId) {
+        const canListRoots = !!server.server.getClientCapabilities()?.roots;
+        if (canListRoots) {
+            const dirs = await (0, repo_id_1.resolveWorkspaceDirs)(() => server.server.listRoots(undefined, { timeout: 2000 }), {});
+            if (dirs.length > 0) {
+                const candidates = Array.from(new Set(dirs.map(dir => (0, path_1.resolve)(dir, 'intent.md'))))
+                    .map(path => ({ path, intent: (0, local_reader_1.readIntentFile)(path) }))
+                    .filter((candidate) => !!candidate.intent);
+                const matching = intentId
+                    ? candidates.filter(candidate => candidate.intent.id === intentId)
+                    : candidates;
+                if (matching.length === 1)
+                    return { kind: 'found', ...matching[0] };
+                if (matching.length > 1)
+                    return { kind: 'ambiguous', paths: matching.map(candidate => candidate.path) };
+                return { kind: 'absent', rootsInspected: true };
+            }
+        }
+        const path = (0, path_1.resolve)(process.cwd(), 'intent.md');
+        const intent = (0, local_reader_1.readIntentFile)(path);
+        if (intent && (!intentId || intent.id === intentId))
+            return { kind: 'found', intent, path };
+        return { kind: 'absent', rootsInspected: false };
+    }
     /** The union of evidence IDs an intent cites: directly linked + section anchors + decision-cited.
      *  Mirrors lib/intentSpecHelpers.collectSpecEvidenceIds (the MCP package can't import app/lib). */
     function collectCitedEvidenceIds(intent) {
@@ -72473,6 +73359,61 @@ function startMcpServer() {
             return { content: [{ type: 'text', text: `Failed to fetch intent: ${e.message}` }] };
         }
     });
+    cloudOnly.registerTool('list_intent_change_requests', {
+        title: 'List Intent Change Requests',
+        description: 'List structured PM requests waiting on this repository. Omit intentId to discover open requests across the connected workspace; pass it to narrow to one intent. Read these before editing intent.md. Each open request is bound to one baseRepoBodyRevision; pass its id and base revision to intent_save when you deliberately apply it.',
+        inputSchema: {
+            intentId: zod_1.z.string().optional().describe('Repository-authority intent to inspect. Omit to list workspace-wide.'),
+            status: zod_1.z.enum(['open', 'applied', 'rejected', 'withdrawn', 'superseded', 'all']).optional().describe('Lifecycle filter; defaults to open'),
+        },
+        annotations: READ_ONLY,
+    }, async ({ intentId, status }) => {
+        const cloud = requireCloudClient();
+        const result = intentId
+            ? await cloud.listIntentChangeRequests(intentId, status ?? 'open')
+            : await cloud.listWorkspaceIntentChangeRequests(status ?? 'open');
+        return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    });
+    cloudOnly.registerTool('get_intent_change_request', {
+        title: 'Get Intent Change Request',
+        description: 'Read one structured PM request with its exact base revision, operation, expected old value, proposed value, and reason. Reading records agent consumption; it does not claim the request was applied.',
+        inputSchema: {
+            intentId: zod_1.z.string().describe('The request intent'),
+            requestId: zod_1.z.string().describe('The change-request ID'),
+        },
+        annotations: READ_ONLY,
+    }, async ({ intentId, requestId }) => {
+        const result = await requireCloudClient().getIntentChangeRequest(intentId, requestId);
+        return { content: [{ type: 'text', text: JSON.stringify(result.changeRequest, null, 2) }] };
+    });
+    cloudOnly.registerTool('reject_intent_change_request', {
+        title: 'Reject Intent Change Request',
+        description: 'Report that an open PM request cannot or should not be applied. This records the API-key principal and requires a concrete reason. Do not use this for a stale base; re-read the current request instead.',
+        inputSchema: {
+            intentId: zod_1.z.string().describe('The request intent'),
+            requestId: zod_1.z.string().describe('The change-request ID'),
+            reason: zod_1.z.string().trim().min(1).describe('Why the repository agent cannot apply it'),
+        },
+        annotations: WRITE_OP,
+    }, async ({ intentId, requestId, reason }) => {
+        const result = await requireCloudClient().rejectIntentChangeRequest(intentId, requestId, reason);
+        return {
+            content: [{
+                    type: 'text',
+                    text: `Change request ${requestId} rejected: ${result.changeRequest.resolutionReason ?? reason}`,
+                }],
+        };
+    });
+    const outcomeInputShape = zod_1.z.union([
+        zod_1.z.string().trim().min(1),
+        zod_1.z.object({
+            id: zod_1.z.string().trim().min(1).optional(),
+            text: zod_1.z.string().trim().min(1),
+            priority: zod_1.z.enum(['must', 'should', 'could']).optional(),
+            /** Null is meaningful on update: deliberately remove the stored recipe. */
+            measurement: measurement_schema_1.outcomeMeasurementDefinitionShape.nullable().optional(),
+        }),
+    ]);
     cloudOnly.registerTool('get_intent_relations', {
         title: 'Get Intent Relations',
         description: 'Get the dependency graph for a specific intent. Shows what it depends on, enables, or blocks.',
@@ -72839,11 +73780,34 @@ function startMcpServer() {
         if (isLocalMode) {
             return { content: [{ type: 'text', text: 'Agent prompts require cloud mode for full context generation.' }] };
         }
-        const result = await requireCloudClient().getIntentPrompt(intentId, 'claude-code', mode || 'execute');
+        const cloud = requireCloudClient();
+        const [result, openRequests] = await Promise.all([
+            cloud.getIntentPrompt(intentId, 'claude-code', mode || 'execute'),
+            cloud.listIntentChangeRequests(intentId, 'open').catch(() => ({ changeRequests: [], count: 0 })),
+        ]);
+        const requestBlock = openRequests.changeRequests.length > 0
+            ? [
+                '# OPEN PM CHANGE REQUESTS — HANDLE BEFORE IMPLEMENTATION',
+                '',
+                'These requests are judgment against one exact intent.md revision. Read each request, update intent.md deliberately, then call intent_save with that request\'s exact `changeRequestId` and `baseRepoBodyRevision`. Do not start product implementation until the resulting revision is authorized. Reject an unworkable request with reject_intent_change_request and a concrete reason.',
+                '',
+                ...openRequests.changeRequests.flatMap((request) => [
+                    `## ${request.id}`,
+                    `- Base revision: ${request.baseRepoBodyRevision}`,
+                    `- Requested change: ${request.operation} ${request.targetField}${request.targetItemId ? ` (${request.targetItemId})` : ''}`,
+                    `- Reason: ${request.reason}`,
+                    ...(request.expectedOldValue !== undefined ? [`- Expected old value: ${JSON.stringify(request.expectedOldValue)}`] : []),
+                    ...(request.proposedValue !== undefined ? [`- Proposed value: ${JSON.stringify(request.proposedValue)}`] : []),
+                    '',
+                ]),
+                '---',
+                '',
+            ].join('\n')
+            : '';
         return {
             content: [{
                     type: 'text',
-                    text: result.prompt
+                    text: `${requestBlock}${result.prompt}`,
                 }]
         };
     });
@@ -73041,7 +74005,7 @@ function startMcpServer() {
             objective: zod_1.z.string().describe('Why this matters — the problem and who has it'),
             currentState: zod_1.z.string().optional().describe('How this works today, before the change: existing behavior, the workaround users rely on, what is broken. Tells implementing agents what must not regress. Omit for genuinely net-new capability.'),
             productId: zod_1.z.string().optional().describe('Product (Space) ID this intent belongs to. Omit it and the server resolves it when the workspace has exactly one real product. If it cannot, you get code PRODUCT_REQUIRED with the candidate list: ASK THE USER which product, then retry with an explicit id. Do not guess — a GitHub binding hangs off the product, so the product decides which repository the PR stamp and merge verification apply to, and a wrong guess surfaces much later as a merge that silently fails to verify.'),
-            outcomes: zod_1.z.array(zod_1.z.string()).optional().describe('Observable, testable state changes'),
+            outcomes: zod_1.z.array(outcomeInputShape).optional().describe('Observable, testable state changes. Use the structured form to attach a stable saved-query recipe; for PostHog, source.queryRef is typically kind "saved_insight" plus the insight id.'),
             constraints: zod_1.z.array(zod_1.z.string()).optional().describe('Hard limits the implementation must respect'),
             healthMetrics: zod_1.z.array(zod_1.z.string()).optional().describe('What to monitor after shipping'),
             edgeCases: zod_1.z.array(zod_1.z.object({
@@ -73082,7 +74046,7 @@ function startMcpServer() {
             title: zod_1.z.string().optional().describe('New title'),
             objective: zod_1.z.string().optional().describe('Updated objective'),
             currentState: zod_1.z.string().optional().describe('Updated as-is behavior (how it works today). Pass an empty string to clear it.'),
-            outcomes: zod_1.z.array(zod_1.z.string()).optional().describe('Replace all outcomes'),
+            outcomes: zod_1.z.array(outcomeInputShape).optional().describe('Replace all outcomes. Omit measurement on an outcome to preserve its stored recipe; send measurement: null to clear it.'),
             constraints: zod_1.z.array(zod_1.z.string()).optional().describe('Replace all constraints'),
             healthMetrics: zod_1.z.array(zod_1.z.string()).optional().describe('Replace all health metrics'),
             edgeCases: zod_1.z.array(zod_1.z.object({
@@ -73263,7 +74227,7 @@ function startMcpServer() {
                     role: 'user',
                     content: {
                         type: 'text',
-                        text: `I need to implement intent ${intentId}. Please:\n1. Use the get_agent_prompt tool to fetch the full execution prompt for this intent\n2. Use get_constitution to check for workspace constraints I must respect\n3. Review the intent details and create an implementation plan\n4. Name the work so the merge can find it: branch \`intent/${intentId}\`, or put \`pathmode:${intentId}\` in the pull request body\n5. After implementation, use verify_implementation to AI-grade your work against the spec\n6. If this change goes through a pull request, STOP there — the merge grades the real diff and moves the intent to Shipped. Do NOT call update_intent_status: an intent already at shipped is skipped by the merge, so an early flip replaces a diff-backed verdict with an unverified one\n7. Only if there will be no pull request, use update_intent_status to mark it "shipped"\n8. Use log_implementation_note to document key technical decisions`,
+                        text: `I need to implement intent ${intentId}. Please:\n1. Use get_agent_prompt to fetch the full execution prompt; it includes any open PM change requests\n2. If a change request is open, read it, apply it to intent.md, and call intent_save with its exact changeRequestId and baseRepoBodyRevision. If it cannot be applied, use reject_intent_change_request with a concrete reason\n3. After any requested spec change, STOP until a signed-in product owner authorizes that exact new revision. Do not implement from a pending or stale revision\n4. Use get_constitution to check for workspace constraints I must respect\n5. Review the authorized intent details and create an implementation plan\n6. Name the work so the merge can find it: branch \`intent/${intentId}\`, or put \`pathmode:${intentId}\` in the pull request body\n7. After implementation, use verify_implementation to AI-grade your work against the spec\n8. If this change goes through a pull request, STOP there — the merge grades the real diff and moves the intent to Shipped. Do NOT call update_intent_status: an intent already at shipped is skipped by the merge, so an early flip replaces a diff-backed verdict with an unverified one\n9. Only if there will be no pull request, use update_intent_status to mark it "shipped"\n10. Use log_implementation_note to document key technical decisions`,
                     },
                 }],
         };
@@ -73313,7 +74277,7 @@ function startMcpServer() {
         currentState: zod_1.z.string().optional().describe('How this works today, before the change — existing behavior and workarounds, so the implementation knows what must not regress. Omit for net-new capability.'),
         implementationContext: zod_1.z.string().optional().describe('What the repo actually looks like where this change lands: the files and modules involved, what already exists, what it would touch, how to verify it. You are in the working tree — go read it. Markdown, sub-headings welcome. Advisory: it never changes the readiness verdict, it just stops the implementing agent from rediscovering the codebase.'),
         productId: zod_1.z.string().optional().describe('Which product this intent belongs to (cloud mode only). Omit it and the server resolves it when the workspace has exactly one real product; if it cannot, the save fails with PRODUCT_REQUIRED and the candidate list, and you should ask the user which one and retry with an explicit id rather than guessing — a GitHub binding hangs off the product, so it decides which repository merge verification applies to.'),
-        outcomes: zod_1.z.array(zod_1.z.string()).describe('Observable, testable state changes'),
+        outcomes: zod_1.z.array(outcomeInputShape).describe('Observable, testable state changes. The structured form may carry an optional provider-neutral saved-query measurement recipe.'),
         decisions: zod_1.z.array(zod_1.z.object({
             choice: zod_1.z.string(),
             ruledOut: zod_1.z.string().optional(),
@@ -73370,9 +74334,9 @@ function startMcpServer() {
     }
     server.registerTool('check_intent_readiness', {
         title: 'Check Intent Readiness (Preflight)',
-        description: 'Run the deterministic preflight on an intent spec before handing it to an implementation agent. Six calibrated checks — title, objective, outcomes, constraints, edge cases, verification — computed by pure functions: no model call, no network, the same spec always gets the same verdict. Pass a spec inline to check before saving, pass intentId to check a specific saved intent, or pass nothing to prefer the repo-bound intent.md and fall back to the workspace current intent only when that file is absent. A failing verdict names the exact blockers; repair the fields and re-run. This is the gate that runs at preflight.pathmode.io.',
+        description: 'Run the deterministic preflight on an intent spec before handing it to an implementation agent. Six calibrated checks — title, objective, outcomes, constraints, edge cases, verification — computed by pure functions: no model call, no network, the same spec always gets the same verdict. Pass a spec inline to check before saving, pass intentId to check a specific saved intent, or pass nothing to resolve the repo-bound intent.md from MCP workspace roots or the launch directory. Cloud mode falls back to the workspace current intent only after declared roots show no repo file; when the repository cannot be identified it refuses to guess. A failing verdict names the exact blockers; repair the fields and re-run. This is the gate that runs at preflight.pathmode.io.',
         inputSchema: {
-            spec: zod_1.z.object(intentSpecSchema).optional().describe('Check this spec directly (before saving). When omitted, prefer the repo-bound intent.md; in cloud mode, fall back to the workspace current intent only when that file is absent.'),
+            spec: zod_1.z.object(intentSpecSchema).optional().describe('Check this spec directly (before saving). When omitted, resolve the repo-bound intent.md from MCP roots or cwd. Cloud fallback is allowed only when declared roots are known to contain no intent.md; unresolved repositories are never guessed.'),
             intentId: zod_1.z.string().optional().describe('Check a specific saved intent by id. Ignored when spec is passed.'),
         },
         annotations: READ_ONLY,
@@ -73384,9 +74348,18 @@ function startMcpServer() {
             // "current" intent is only a heuristic, so it must not outrank the repo binding.
             // An explicit different id still wins: the caller deliberately selected another
             // saved intent rather than asking us to infer the current one.
-            const repoIntent = (0, local_reader_1.readIntentFile)((0, path_1.resolve)(process.cwd(), 'intent.md'));
-            if (repoIntent && (!intentId || repoIntent.id === intentId)) {
-                subject = repoIntent;
+            const repoResolution = await resolveRepoBoundIntent(intentId);
+            if (repoResolution.kind === 'ambiguous') {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: `More than one MCP workspace root contains an intent.md (${repoResolution.paths.join(', ')}). Pass intentId or spec explicitly; Pathmode will not guess which repository governs this preflight.`,
+                        }],
+                    isError: true,
+                };
+            }
+            if (repoResolution.kind === 'found') {
+                subject = repoResolution.intent;
                 sourceNote = 'repo-bound intent.md';
             }
             else if (isLocalMode) {
@@ -73405,6 +74378,15 @@ function startMcpServer() {
                 }
             }
             else {
+                if (!intentId && !repoResolution.rootsInspected) {
+                    return {
+                        content: [{
+                                type: 'text',
+                                text: 'Pathmode could not resolve this repository: the MCP client declared no usable workspace roots and the server launch directory has no intent.md. Pass intentId or spec explicitly, or launch the server from the repository root. The workspace current intent was not used because it may belong to a different repository.',
+                            }],
+                        isError: true,
+                    };
+                }
                 const cloud = requireCloudClient();
                 // The list projection (INTENT_LIST_SELECT) omits intent_spec_edge_cases, so
                 // grading a listed row fails the edge-case gate unconditionally — no saved
@@ -73439,7 +74421,11 @@ function startMcpServer() {
         spec: zod_1.z.object(intentSpecSchema),
         path: zod_1.z.string().optional().describe('File path relative to the project root. Must stay inside the project (absolute paths and ".." are rejected). Defaults to intent.md'),
         overwrite: zod_1.z.boolean().optional().describe('Replace the file even when it already holds a DIFFERENT intent. Default false — the save is refused instead, so an unrelated spec is never clobbered.'),
-    }, async ({ spec, path, overwrite }) => performIntentSave(spec, path, overwrite));
+        changeRequestId: zod_1.z.string().uuid().optional().describe('Structured PM request this save deliberately applies. Requires baseRepoBodyRevision.'),
+        baseRepoBodyRevision: zod_1.z.string().regex(/^[a-f0-9]{64}$/i).optional().describe('Exact base revision carried by the change request. Requires changeRequestId.'),
+    }, async ({ spec, path, overwrite, changeRequestId, baseRepoBodyRevision }) => performIntentSave(spec, path, overwrite, 'intent_save', changeRequestId || baseRepoBodyRevision
+        ? { id: changeRequestId, baseRepoBodyRevision }
+        : undefined));
     /**
      * The whole save path — collision policy, verdict stamp, confirmation carry-forward, cloud push
      * with identity settlement — extracted so intent_import can reuse it EXACTLY. Import must not be
@@ -73447,8 +74433,17 @@ function startMcpServer() {
      * write path costs, and the confirmation carry-forward here is load-bearing (M1's tool boundary
      * assumes every writer goes through this).
      */
-    async function performIntentSave(spec, path, overwrite, retryTool = 'intent_save') {
+    async function performIntentSave(spec, path, overwrite, retryTool = 'intent_save', changeRequest) {
         {
+            if (changeRequest && (!changeRequest.id || !changeRequest.baseRepoBodyRevision)) {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: '✗ changeRequestId and baseRepoBodyRevision are required together. Re-read the open request and pass both exact values.',
+                        }],
+                    isError: true,
+                };
+            }
             const filePath = resolveWithinProject(path || 'intent.md');
             const existing = (0, local_reader_1.readIntentMeta)(filePath);
             const decision = (0, save_policy_1.decideSave)({
@@ -73471,6 +74466,15 @@ function startMcpServer() {
                         }],
                 };
             }
+            if (changeRequest && decision.action !== 'update') {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: '✗ A change request can only be applied from the already-connected intent.md that carries its cloud identity and specVersion. Pull the intent first, then retry.',
+                        }],
+                    isError: true,
+                };
+            }
             const { id, version, status, created } = decision;
             // The preflight verdict travels with the file: stamped into frontmatter on every save,
             // recomputed from the spec alone (deterministic). A failing verdict never blocks the
@@ -73553,6 +74557,9 @@ function startMcpServer() {
                     },
                     decisions: spec.decisions,
                     implementationContext: spec.implementationContext,
+                    changeRequest: changeRequest?.id && changeRequest.baseRepoBodyRevision
+                        ? { id: changeRequest.id, baseRepoBodyRevision: changeRequest.baseRepoBodyRevision }
+                        : undefined,
                     onIdentitySettled: writeSpecFile,
                 });
                 if (!result.ok) {