@unbrained/pm-cli 2026.10.11 → 2026.10.13

package/dist/sdk/linked-artifacts.d.ts

@@ -2,12 +2,12 @@ import type { GlobalOptions } from "../core/shared/command-types.js";
 import type { LinkScope } from "../types/index.js";
 /** Restricts linked artifact values accepted by command, SDK, and storage contracts. */
 export type LinkedArtifact = {
-    /** Filesystem path used for path resolution. */
-    path: string;
-    /** Value that configures or reports scope for this contract. */
-    scope: LinkScope;
-    /** Value that configures or reports note for this contract. */
-    note?: string;
+/** Filesystem path used for path resolution. */
+path: string;
+/** Value that configures or reports scope for this contract. */
+scope: LinkScope;
+/** Value that configures or reports note for this contract. */
+note?: string;
 };
 /** Allowed CSV/markdown keys for each structured linked-artifact option (GH-258). */
 export declare const LINKED_ARTIFACT_ADD_KEYS: readonly ["path", "scope", "note"];
@@ -19,87 +19,87 @@ export declare const LINKED_ARTIFACT_REMOVE_KEYS: readonly ["path"];
 export declare const LINKED_ARTIFACT_MIGRATE_KEYS: readonly ["from", "to"];
 /** Documents the linked artifact command options payload exchanged by command, SDK, and package integrations. */
 export interface LinkedArtifactCommandOptions {
-    /** Value that configures or reports add for this contract. */
-    add?: string[];
-    /** Value that configures or reports add glob for this contract. */
-    addGlob?: string[];
-    /** Value that configures or reports remove for this contract. */
-    remove?: string[];
-    /** Value that configures or reports migrate for this contract. */
-    migrate?: string[];
-    /** GH-170 (pm-pfnx): standalone note applied to every link added by --add / --add-glob in the same invocation. A per-entry embedded note (the `path=...,note=...` pair syntax) takes precedence over this flag. Requires at least one --add/--add-glob; rejected otherwise. */
-    note?: string;
-    /** Value that configures or reports list for this contract. */
-    list?: boolean;
-    /** Value that configures or reports append stable for this contract. */
-    appendStable?: boolean;
-    /** Value that configures or reports validate paths for this contract. */
-    validatePaths?: boolean;
-    /** Value that configures or reports author for this contract. */
-    author?: string;
-    /** Human-readable explanation suitable for logs and agent-facing output. */
-    message?: string;
-    /** Value that configures or reports force for this contract. */
-    force?: boolean;
+/** Value that configures or reports add for this contract. */
+add?: string[];
+/** Value that configures or reports add glob for this contract. */
+addGlob?: string[];
+/** Value that configures or reports remove for this contract. */
+remove?: string[];
+/** Value that configures or reports migrate for this contract. */
+migrate?: string[];
+/** GH-170 (pm-pfnx): standalone note applied to every link added by --add / --add-glob in the same invocation. A per-entry embedded note (the `path=...,note=...` pair syntax) takes precedence over this flag. Requires at least one --add/--add-glob; rejected otherwise. */
+note?: string;
+/** Value that configures or reports list for this contract. */
+list?: boolean;
+/** Value that configures or reports append stable for this contract. */
+appendStable?: boolean;
+/** Value that configures or reports validate paths for this contract. */
+validatePaths?: boolean;
+/** Value that configures or reports author for this contract. */
+author?: string;
+/** Human-readable explanation suitable for logs and agent-facing output. */
+message?: string;
+/** Value that configures or reports force for this contract. */
+force?: boolean;
 }
 /** Documents the path migration payload exchanged by command, SDK, and package integrations. */
 export interface PathMigration {
-    /** Value that configures or reports from for this contract. */
-    from: string;
-    /** Value that configures or reports to for this contract. */
-    to: string;
+/** Value that configures or reports from for this contract. */
+from: string;
+/** Value that configures or reports to for this contract. */
+to: string;
 }
 /** Documents the add glob entry payload exchanged by command, SDK, and package integrations. */
 export interface AddGlobEntry {
-    /** Value that configures or reports pattern for this contract. */
-    pattern: string;
-    /** Value that configures or reports scope for this contract. */
-    scope: LinkScope;
-    /** Value that configures or reports note for this contract. */
-    note?: string;
+/** Value that configures or reports pattern for this contract. */
+pattern: string;
+/** Value that configures or reports scope for this contract. */
+scope: LinkScope;
+/** Value that configures or reports note for this contract. */
+note?: string;
 }
 /** Documents the linked path validation payload exchanged by command, SDK, and package integrations. */
 export interface LinkedPathValidation {
-    /** Value that configures or reports checked for this contract. */
-    checked: number;
-    /** Value that configures or reports existing files for this contract. */
-    existing_files: string[];
-    /** Value that configures or reports missing paths for this contract. */
-    missing_paths: string[];
-    /** Value that configures or reports non file paths for this contract. */
-    non_file_paths: string[];
-    /** Remote references (https:// URLs and other `scheme://` paths) recorded as links — most often a PR/issue/design-doc URL added via `pm docs --add`. These are not local files, so they bypass the existence probe and are reported here rather than counted as missing. */
-    remote_references: string[];
+/** Value that configures or reports checked for this contract. */
+checked: number;
+/** Value that configures or reports existing files for this contract. */
+existing_files: string[];
+/** Value that configures or reports missing paths for this contract. */
+missing_paths: string[];
+/** Value that configures or reports non file paths for this contract. */
+non_file_paths: string[];
+/** Remote references (https:// URLs and other `scheme://` paths) recorded as links — most often a PR/issue/design-doc URL added via `pm docs --add`. These are not local files, so they bypass the existence probe and are reported here rather than counted as missing. */
+remote_references: string[];
 }
 /** Documents the linked artifact result payload exchanged by command, SDK, and package integrations. */
 export interface LinkedArtifactResult {
-    /** Stable identifier used to reference this record across commands and storage. */
-    id: string;
-    /** Value that configures or reports changed for this contract. */
-    changed: boolean;
-    /** Value that configures or reports count for this contract. */
-    count: number;
-    /** Value that configures or reports migrations applied for this contract. */
-    migrations_applied?: number;
-    /** Value that configures or reports validation for this contract. */
-    validation?: LinkedPathValidation;
-    /** Value that configures or reports artifacts for this contract. */
-    artifacts: LinkedArtifact[];
+/** Stable identifier used to reference this record across commands and storage. */
+id: string;
+/** Value that configures or reports changed for this contract. */
+changed: boolean;
+/** Value that configures or reports count for this contract. */
+count: number;
+/** Value that configures or reports migrations applied for this contract. */
+migrations_applied?: number;
+/** Value that configures or reports validation for this contract. */
+validation?: LinkedPathValidation;
+/** Value that configures or reports artifacts for this contract. */
+artifacts: LinkedArtifact[];
 }
 /** Replaces the generic artifacts field with a resource-specific result key while retaining the remaining result contract. */
 export type RenamedLinkedArtifactResult<Result extends LinkedArtifactResult, Key extends "files" | "docs"> = Omit<Result, "artifacts"> & {
-    [Field in Key]: Result["artifacts"];
+[Field in Key]: Result["artifacts"];
 };
 /** Configuration that adapts the shared linked-artifact command core to a specific resource kind (files or docs) while preserving every behavioral detail of the original twin implementations. */
 export interface LinkedArtifactKindConfig {
-    /** Metadata key under which the artifacts are stored (e.g. "files" | "docs"). */
-    metadataKey: "files" | "docs";
-    /** Mutation op recorded in history (e.g. "files_add" | "docs_add"). */
-    op: "files_add" | "docs_add";
-    /** Noun used in the "bare <noun> path" --add usage error (e.g. "file" | "doc"). */
-    bareNoun: "file" | "doc";
-    /** Whether this kind honors the append-stable option. files supports it; docs always sorts and must never expose append-stable behavior. */
-    supportsAppendStable: boolean;
+/** Metadata key under which the artifacts are stored (e.g. "files" | "docs"). */
+metadataKey: "files" | "docs";
+/** Mutation op recorded in history (e.g. "files_add" | "docs_add"). */
+op: "files_add" | "docs_add";
+/** Noun used in the "bare <noun> path" --add usage error (e.g. "file" | "doc"). */
+bareNoun: "file" | "doc";
+/** Whether this kind honors the append-stable option. files supports it; docs always sorts and must never expose append-stable behavior. */
+supportsAppendStable: boolean;
 }
 /** Implements ensure scope for the public runtime surface of this module. */
 export declare function ensureScope(raw: string | undefined): LinkScope;

package/dist/sdk/mcp/apps.d.ts

@@ -1,21 +1,21 @@
 import { type PmMcpRequestContext } from "./protocol.js";
 interface McpUiToolMeta {
-    /** MCP App resource displayed for this tool. */
-    resourceUri: string;
-    /** Principals allowed to discover and invoke the tool. */
-    visibility: Array<"model" | "app">;
+/** MCP App resource displayed for this tool. */
+resourceUri: string;
+/** Principals allowed to discover and invoke the tool. */
+visibility: Array<"model" | "app">;
 }
 interface McpUiResourceMeta {
-    /** Explicitly bounded network and embedding policy. */
-    csp: {
-        connectDomains: string[];
-        resourceDomains: string[];
-        frameDomains: string[];
-    };
-    /** Browser permissions requested by the app. */
-    permissions: Record<string, never>;
-    /** Whether the host should present a visible app boundary. */
-    prefersBorder: boolean;
+/** Explicitly bounded network and embedding policy. */
+csp: {
+connectDomains: string[];
+resourceDomains: string[];
+frameDomains: string[];
+};
+/** Browser permissions requested by the app. */
+permissions: Record<string, never>;
+/** Whether the host should present a visible app boundary. */
+prefersBorder: boolean;
 }
 /** Stable MCP Apps extension identifier. */
 export declare const PM_MCP_APPS_EXTENSION: "io.modelcontextprotocol/ui";
@@ -25,8 +25,8 @@ export declare const PM_MCP_APPS_SPEC_VERSION: "2026-01-26";
 export declare const PM_MCP_APP_MIME_TYPE: "text/html;profile=mcp-app";
 /** Server-side MCP Apps capability advertised through discovery. */
 export declare const PM_MCP_APPS_SERVER_CAPABILITY: Readonly<{
-    specVersion: "2026-01-26";
-    mimeTypes: "text/html;profile=mcp-app"[];
+specVersion: "2026-01-26";
+mimeTypes: "text/html;profile=mcp-app"[];
 }>;
 /**
  * Resolve whether a request negotiated MCP Apps, rejecting malformed explicit
@@ -35,20 +35,20 @@ export declare const PM_MCP_APPS_SERVER_CAPABILITY: Readonly<{
 export declare function hasPmMcpAppsCapability(context: PmMcpRequestContext): boolean;
 /** One optional pm view and the authoritative tool that supplies its data. */
 export interface PmMcpAppContract {
-    /** Stable view identifier. */
-    id: "context" | "graph" | "plan" | "assurance" | "operations";
-    /** Human-readable view name. */
-    name: string;
-    /** Concise purpose shown during resource discovery. */
-    description: string;
-    /** Existing SDK-backed tool whose result the view renders. */
-    toolName: string;
-    /** Stable MCP App resource URI. */
-    uri: string;
-    /** Tool metadata validated against the official MCP Apps package types. */
-    toolMeta: McpUiToolMeta;
-    /** Resource sandbox and presentation metadata. */
-    resourceMeta: McpUiResourceMeta;
+/** Stable view identifier. */
+id: "context" | "graph" | "plan" | "assurance" | "operations";
+/** Human-readable view name. */
+name: string;
+/** Concise purpose shown during resource discovery. */
+description: string;
+/** Existing SDK-backed tool whose result the view renders. */
+toolName: string;
+/** Stable MCP App resource URI. */
+uri: string;
+/** Tool metadata validated against the official MCP Apps package types. */
+toolMeta: McpUiToolMeta;
+/** Resource sandbox and presentation metadata. */
+resourceMeta: McpUiResourceMeta;
 }
 /** Canonical optional pm MCP Apps. */
 export declare const PM_MCP_APP_CONTRACTS: readonly PmMcpAppContract[];
@@ -56,8 +56,8 @@ export declare const PM_MCP_APP_CONTRACTS: readonly PmMcpAppContract[];
 export declare function findPmMcpAppByUri(uri: string): PmMcpAppContract | undefined;
 /** Attach negotiated MCP App metadata to matching tool definitions. */
 export declare function decoratePmMcpToolsWithApps<Tool extends {
-    name: string;
-    _meta?: Record<string, unknown>;
+name: string;
+_meta?: Record<string, unknown>;
 }>(tools: readonly Tool[]): Tool[];
 /**
  * Render a self-contained, sandbox-compatible MCP App document.

package/dist/sdk/mcp/authorization.d.ts

@@ -1,84 +1,84 @@
 import type { PmMcpHttpHeaders } from "./transport.js";
 /** Authorization failure with an HTTP status and disclosure-safe context. */
 export declare class PmMcpAuthorizationError extends Error {
-    /** HTTP status required at the remote MCP boundary. */
-    readonly httpStatus: 401 | 403;
-    /** Optional RFC 6750 challenge safe to send to an unauthenticated client. */
-    readonly challenge?: string;
-    /** Create one remote authorization refusal. */
-    constructor(message: string, httpStatus: 401 | 403, challenge?: string);
+/** HTTP status required at the remote MCP boundary. */
+readonly httpStatus: 401 | 403;
+/** Optional RFC 6750 challenge safe to send to an unauthenticated client. */
+readonly challenge?: string;
+/** Create one remote authorization refusal. */
+constructor(message: string, httpStatus: 401 | 403, challenge?: string);
 }
 /** RFC 9728 metadata served by a protected pm MCP resource. */
 export interface PmMcpProtectedResourceMetadata {
-    /** Canonical MCP resource URI used for token audience binding. */
-    resource: string;
-    /** Independent authorization-server issuers accepted by this resource. */
-    authorization_servers: string[];
-    /** Minimal scopes used for initial least-privilege authorization. */
-    scopes_supported?: string[];
+/** Canonical MCP resource URI used for token audience binding. */
+resource: string;
+/** Independent authorization-server issuers accepted by this resource. */
+authorization_servers: string[];
+/** Minimal scopes used for initial least-privilege authorization. */
+scopes_supported?: string[];
 }
 /** Validated authorization-server discovery fields needed by MCP clients. */
 export interface PmMcpAuthorizationServerMetadata {
-    /** Exact issuer identifier. */
-    issuer: string;
-    /** Authorization endpoint for code flows. */
-    authorization_endpoint?: string;
-    /** Token endpoint used to redeem authorization codes. */
-    token_endpoint?: string;
-    /** PKCE methods advertised by the authorization server. */
-    code_challenge_methods_supported: string[];
-    /** Whether URL-form Client ID Metadata Documents are supported. */
-    client_id_metadata_document_supported?: boolean;
-    /** Deprecated dynamic-registration fallback endpoint. */
-    registration_endpoint?: string;
+/** Exact issuer identifier. */
+issuer: string;
+/** Authorization endpoint for code flows. */
+authorization_endpoint?: string;
+/** Token endpoint used to redeem authorization codes. */
+token_endpoint?: string;
+/** PKCE methods advertised by the authorization server. */
+code_challenge_methods_supported: string[];
+/** Whether URL-form Client ID Metadata Documents are supported. */
+client_id_metadata_document_supported?: boolean;
+/** Deprecated dynamic-registration fallback endpoint. */
+registration_endpoint?: string;
 }
 /** Discovery metadata after endpoint and PKCE validation succeeds. */
 export interface PmMcpValidatedAuthorizationServerMetadata extends PmMcpAuthorizationServerMetadata {
-    /** Validated HTTPS authorization endpoint for code flows. */
-    authorization_endpoint: string;
-    /** Validated HTTPS token endpoint used to redeem authorization codes. */
-    token_endpoint: string;
+/** Validated HTTPS authorization endpoint for code flows. */
+authorization_endpoint: string;
+/** Validated HTTPS token endpoint used to redeem authorization codes. */
+token_endpoint: string;
 }
 /** Client registration strategy ordered by current MCP preference. */
 export type PmMcpClientRegistrationMode = "pre_registered" | "client_id_metadata_document" | "dynamic" | "user_supplied";
 /** Bound access-token facts returned by a host-provided verifier. */
 export interface PmMcpAccessTokenClaims {
-    /** Stable authenticated principal without raw token material. */
-    principal: string;
-    /** Issuer that minted the token. */
-    issuer: string;
-    /** Intended resource audiences. */
-    audience: string | string[];
-    /** Granted OAuth scopes. */
-    scopes: string[];
+/** Stable authenticated principal without raw token material. */
+principal: string;
+/** Issuer that minted the token. */
+issuer: string;
+/** Intended resource audiences. */
+audience: string | string[];
+/** Granted OAuth scopes. */
+scopes: string[];
 }
 /** Policy a Streamable HTTP adapter enforces before dispatching MCP. */
 export interface PmMcpHttpAuthorizationPolicy {
-    /** Exact accepted issuer. */
-    issuer: string;
-    /** Exact canonical MCP resource audience. */
-    resource: string;
-    /** Scopes required for this endpoint or operation. */
-    requiredScopes?: string[];
-    /** Protected-resource metadata location for RFC 6750 challenges. */
-    resourceMetadataUrl: string;
-    /** Validate an opaque or structured access token without passing it onward. */
-    verifyAccessToken: (token: string) => PmMcpAccessTokenClaims | Promise<PmMcpAccessTokenClaims>;
+/** Exact accepted issuer. */
+issuer: string;
+/** Exact canonical MCP resource audience. */
+resource: string;
+/** Scopes required for this endpoint or operation. */
+requiredScopes?: string[];
+/** Protected-resource metadata location for RFC 6750 challenges. */
+resourceMetadataUrl: string;
+/** Validate an opaque or structured access token without passing it onward. */
+verifyAccessToken: (token: string) => PmMcpAccessTokenClaims | Promise<PmMcpAccessTokenClaims>;
 }
 /** W3C trace context accepted from request `_meta`. */
 export interface PmMcpTraceContext {
-    /** W3C trace-parent value. */
-    traceparent?: string;
-    /** W3C trace-state value. */
-    tracestate?: string;
-    /** Allowlisted W3C baggage members only. */
-    baggage?: string;
+/** W3C trace-parent value. */
+traceparent?: string;
+/** W3C trace-state value. */
+tracestate?: string;
+/** Allowlisted W3C baggage members only. */
+baggage?: string;
 }
 /** Build and validate protected-resource metadata for a remote pm endpoint. */
 export declare function buildMcpProtectedResourceMetadata(input: {
-    resource: string;
-    authorizationServers: readonly string[];
-    scopes?: readonly string[];
+resource: string;
+authorizationServers: readonly string[];
+scopes?: readonly string[];
 }): PmMcpProtectedResourceMetadata;
 /** Construct OAuth and OIDC discovery URLs in the MCP-required order. */
 export declare function buildMcpAuthorizationDiscoveryUrls(issuer: string): string[];
@@ -86,36 +86,36 @@ export declare function buildMcpAuthorizationDiscoveryUrls(issuer: string): stri
 export declare function validateMcpAuthorizationServerMetadata(value: unknown, expectedIssuer: string): PmMcpValidatedAuthorizationServerMetadata;
 /** Apply the current pre-registration, metadata-document, dynamic, prompt order. */
 export declare function selectMcpClientRegistrationMode(input: {
-    hasPreRegisteredClient: boolean;
-    metadata: Pick<PmMcpAuthorizationServerMetadata, "client_id_metadata_document_supported" | "registration_endpoint">;
+hasPreRegisteredClient: boolean;
+metadata: Pick<PmMcpAuthorizationServerMetadata, "client_id_metadata_document_supported" | "registration_endpoint">;
 }): PmMcpClientRegistrationMode;
 /** Validate a present authorization-response issuer before code redemption. */
 export declare function validateMcpAuthorizationResponseIssuer(input: {
-    expectedIssuer: string;
-    responseIssuer?: string;
-    issuerParameterSupported?: boolean;
+expectedIssuer: string;
+responseIssuer?: string;
+issuerParameterSupported?: boolean;
 }): void;
 /** Validate a self-hosted Client ID Metadata Document and exact redirect set. */
 export declare function validateMcpClientMetadataDocument(value: unknown, documentUrl: string): Record<string, unknown>;
 /** Build bounded dynamic-registration metadata for explicit legacy fallback. */
 export declare function buildMcpDynamicRegistrationMetadata(input: {
-    redirectUris: readonly string[];
-    applicationType: "native" | "web";
-    clientName: string;
+redirectUris: readonly string[];
+applicationType: "native" | "web";
+clientName: string;
 }): Record<string, unknown>;
 /** In-memory issuer-keyed credential primitive that never reuses cross-issuer state. */
 export declare class PmMcpIssuerCredentialStore<Credential extends Record<string, unknown>> {
-    #private;
-    /** Persist a cloned credential under the exact validated issuer. */
-    set(issuer: string, credential: Credential): void;
-    /** Read a cloned credential only for the exact issuer. */
-    get(issuer: string): Credential | undefined;
-    /** Remove credentials for one issuer during revocation or re-registration. */
-    delete(issuer: string): boolean;
+#private;
+/** Persist a cloned credential under the exact validated issuer. */
+set(issuer: string, credential: Credential): void;
+/** Read a cloned credential only for the exact issuer. */
+get(issuer: string): Credential | undefined;
+/** Remove credentials for one issuer during revocation or re-registration. */
+delete(issuer: string): boolean;
 }
 /** Extract W3C trace context with strict syntax, size, and baggage allowlists. */
 export declare function extractMcpTraceContext(params: unknown, options?: {
-    baggageAllowlist?: readonly string[];
+baggageAllowlist?: readonly string[];
 }): PmMcpTraceContext;
 /** Run one request with trace context isolated from every concurrent request. */
 export declare function runWithMcpTraceContext<Result>(context: PmMcpTraceContext, callback: () => Result): Result;
@@ -123,12 +123,12 @@ export declare function runWithMcpTraceContext<Result>(context: PmMcpTraceContex
 export declare function getActiveMcpTraceContext(): PmMcpTraceContext | undefined;
 /** Enforce bearer location, issuer, audience, and least-privilege scopes. */
 export declare function authorizeMcpHttpRequest(input: {
-    headers: PmMcpHttpHeaders;
-    requestUrl: string;
-    policy: PmMcpHttpAuthorizationPolicy;
+headers: PmMcpHttpHeaders;
+requestUrl: string;
+policy: PmMcpHttpAuthorizationPolicy;
 }): Promise<PmMcpAccessTokenClaims>;
 /** Create an exact opaque-token verifier without exposing token values in results. */
 export declare function createMcpStaticBearerVerifier(input: {
-    token: string;
-    claims: PmMcpAccessTokenClaims;
+token: string;
+claims: PmMcpAccessTokenClaims;
 }): (token: string) => PmMcpAccessTokenClaims;