@unbrained/pm-cli 2026.10.11 → 2026.10.13

package/dist/core/shared/secret-rules.d.ts

@@ -5,106 +5,106 @@
  */
 /** One detector and any explicit repository-only scope exception. */
 export interface SecretRule {
-    /** Repository diagnostic identifier. */
-    name: string;
-    /** Compatible SDK diagnostic identifier. */
-    mutationRule: string;
-    /** Global pattern; consumers reset lastIndex before each scan. */
-    regex: RegExp;
-    /** Repository paths with deliberate fixture exemptions. */
-    excludeFiles?: RegExp;
-    /** Repository paths eligible for this rule. */
-    includeFiles?: RegExp;
-    /** Why the repository gate deliberately omits this mutation heuristic. */
-    mutationOnlyReason?: string;
-    /** Minimum Shannon entropy of the first capture group, when applicable. */
-    minimumEntropy?: number;
+/** Repository diagnostic identifier. */
+name: string;
+/** Compatible SDK diagnostic identifier. */
+mutationRule: string;
+/** Global pattern; consumers reset lastIndex before each scan. */
+regex: RegExp;
+/** Repository paths with deliberate fixture exemptions. */
+excludeFiles?: RegExp;
+/** Repository paths eligible for this rule. */
+includeFiles?: RegExp;
+/** Why the repository gate deliberately omits this mutation heuristic. */
+mutationOnlyReason?: string;
+/** Minimum Shannon entropy of the first capture group, when applicable. */
+minimumEntropy?: number;
 }
 /** Canonical patterns; repository exemptions never exempt mutation payloads. */
 export declare const SECRET_RULES: readonly [{
-    readonly name: "private-key";
-    readonly mutationRule: "private_key";
-    readonly regex: RegExp;
-}, {
-    readonly name: "github-token";
-    readonly mutationRule: "github_token";
-    readonly regex: RegExp;
-}, {
-    readonly name: "npm-token";
-    readonly mutationRule: "npm_token";
-    readonly regex: RegExp;
-}, {
-    readonly name: "aws-access-key";
-    readonly mutationRule: "aws_access_key";
-    readonly regex: RegExp;
-}, {
-    readonly name: "google-api-key";
-    readonly mutationRule: "google_api_key";
-    readonly regex: RegExp;
-}, {
-    readonly name: "slack-token";
-    readonly mutationRule: "slack_token";
-    readonly regex: RegExp;
-}, {
-    readonly name: "anthropic-api-key";
-    readonly mutationRule: "anthropic_api_key";
-    readonly regex: RegExp;
-}, {
-    readonly name: "openai-api-key";
-    readonly mutationRule: "openai_api_key";
-    readonly regex: RegExp;
-}, {
-    readonly name: "gitlab-token";
-    readonly mutationRule: "gitlab_token";
-    readonly regex: RegExp;
-}, {
-    readonly name: "jwt-like-token";
-    readonly mutationRule: "jwt_like_token";
-    readonly regex: RegExp;
-}, {
-    readonly name: "npm-auth-token-assignment";
-    readonly mutationRule: "npm_auth_token_assignment";
-    readonly regex: RegExp;
-}, {
-    readonly name: "sentry-user-token";
-    readonly mutationRule: "sentry_user_token";
-    readonly regex: RegExp;
-}, {
-    readonly name: "sentry-org-token";
-    readonly mutationRule: "sentry_org_token";
-    readonly regex: RegExp;
-}, {
-    readonly name: "private-ip";
-    readonly mutationRule: "private_ip";
-    readonly regex: RegExp;
-}, {
-    readonly name: "private-ssh-target";
-    readonly mutationRule: "private_ssh_target";
-    readonly regex: RegExp;
-}, {
-    readonly name: "sshpass-inline-password";
-    readonly mutationRule: "sshpass_inline_password";
-    readonly regex: RegExp;
-}, {
-    readonly name: "password-assignment";
-    readonly mutationRule: "password_assignment";
-    readonly regex: RegExp;
-}, {
-    readonly name: "absolute-home-path";
-    readonly mutationRule: "absolute_home_path";
-    readonly regex: RegExp;
-    readonly excludeFiles: RegExp;
-}, {
-    readonly name: "user-at-private-host";
-    readonly mutationRule: "user_at_private_host";
-    readonly regex: RegExp;
-    readonly excludeFiles: RegExp;
-}, {
-    readonly name: "high-entropy-assignment";
-    readonly mutationRule: "high_entropy_assignment";
-    readonly regex: RegExp;
-    readonly mutationOnlyReason: "Generic assignments in source code are not credentials; preserve the existing mutation heuristic without treating source identifiers as secrets.";
-    readonly minimumEntropy: 3.5;
+readonly name: "private-key";
+readonly mutationRule: "private_key";
+readonly regex: RegExp;
+}, {
+readonly name: "github-token";
+readonly mutationRule: "github_token";
+readonly regex: RegExp;
+}, {
+readonly name: "npm-token";
+readonly mutationRule: "npm_token";
+readonly regex: RegExp;
+}, {
+readonly name: "aws-access-key";
+readonly mutationRule: "aws_access_key";
+readonly regex: RegExp;
+}, {
+readonly name: "google-api-key";
+readonly mutationRule: "google_api_key";
+readonly regex: RegExp;
+}, {
+readonly name: "slack-token";
+readonly mutationRule: "slack_token";
+readonly regex: RegExp;
+}, {
+readonly name: "anthropic-api-key";
+readonly mutationRule: "anthropic_api_key";
+readonly regex: RegExp;
+}, {
+readonly name: "openai-api-key";
+readonly mutationRule: "openai_api_key";
+readonly regex: RegExp;
+}, {
+readonly name: "gitlab-token";
+readonly mutationRule: "gitlab_token";
+readonly regex: RegExp;
+}, {
+readonly name: "jwt-like-token";
+readonly mutationRule: "jwt_like_token";
+readonly regex: RegExp;
+}, {
+readonly name: "npm-auth-token-assignment";
+readonly mutationRule: "npm_auth_token_assignment";
+readonly regex: RegExp;
+}, {
+readonly name: "sentry-user-token";
+readonly mutationRule: "sentry_user_token";
+readonly regex: RegExp;
+}, {
+readonly name: "sentry-org-token";
+readonly mutationRule: "sentry_org_token";
+readonly regex: RegExp;
+}, {
+readonly name: "private-ip";
+readonly mutationRule: "private_ip";
+readonly regex: RegExp;
+}, {
+readonly name: "private-ssh-target";
+readonly mutationRule: "private_ssh_target";
+readonly regex: RegExp;
+}, {
+readonly name: "sshpass-inline-password";
+readonly mutationRule: "sshpass_inline_password";
+readonly regex: RegExp;
+}, {
+readonly name: "password-assignment";
+readonly mutationRule: "password_assignment";
+readonly regex: RegExp;
+}, {
+readonly name: "absolute-home-path";
+readonly mutationRule: "absolute_home_path";
+readonly regex: RegExp;
+readonly excludeFiles: RegExp;
+}, {
+readonly name: "user-at-private-host";
+readonly mutationRule: "user_at_private_host";
+readonly regex: RegExp;
+readonly excludeFiles: RegExp;
+}, {
+readonly name: "high-entropy-assignment";
+readonly mutationRule: "high_entropy_assignment";
+readonly regex: RegExp;
+readonly mutationOnlyReason: "Generic assignments in source code are not credentials; preserve the existing mutation heuristic without treating source identifiers as secrets.";
+readonly minimumEntropy: 3.5;
 }];
 /** Accept a pattern match, applying the declared entropy predicate when present. */
 export declare function acceptsSecretMatch(rule: SecretRule, match: RegExpMatchArray): boolean;

package/dist/core/shared/serial-queue.d.ts

@@ -5,17 +5,17 @@
  */
 /** Defines the FIFO queue contract used to serialize asynchronous mutation-sensitive work. */
 export interface SerialQueue {
-    /** Schedule `task` to run after every previously-enqueued task has settled. Returns a promise for this task's result (or rejection) so callers can await individual outcomes. A rejected task never wedges the queue: later tasks still run in order. */
-    enqueue<T>(task: () => Promise<T> | T): Promise<T>;
-    /** Resolves once the queue has fully drained (no pending tasks remain). */
-    idle(): Promise<void>;
+/** Schedule `task` to run after every previously-enqueued task has settled. Returns a promise for this task's result (or rejection) so callers can await individual outcomes. A rejected task never wedges the queue: later tasks still run in order. */
+enqueue<T>(task: () => Promise<T> | T): Promise<T>;
+/** Resolves once the queue has fully drained (no pending tasks remain). */
+idle(): Promise<void>;
 }
 /** Coordinates concurrent readers with FIFO-exclusive writers without serializing independent read work. */
 export interface AsyncReadWriteGate {
-    /** Run work concurrently after every writer scheduled before this call has settled. */
-    read<T>(task: () => Promise<T> | T): Promise<T>;
-    /** Run work exclusively after all readers and writers scheduled before this call have settled. */
-    write<T>(task: () => Promise<T> | T): Promise<T>;
+/** Run work concurrently after every writer scheduled before this call has settled. */
+read<T>(task: () => Promise<T> | T): Promise<T>;
+/** Run work exclusively after all readers and writers scheduled before this call have settled. */
+write<T>(task: () => Promise<T> | T): Promise<T>;
 }
 /** Create an arrival-ordered asynchronous read/write gate. Readers may overlap, while writers exclude both modes and never starve behind later readers. */
 export declare function createAsyncReadWriteGate(): AsyncReadWriteGate;

package/dist/core/shared/split-comma-list.d.ts

@@ -5,12 +5,12 @@
  */
 /** Configures comma-list parsing for command flags that support escaped separators. */
 export interface SplitCommaListOptions {
-    /** Separator pattern. Defaults to `/,/`. */
-    separators?: RegExp | string;
-    /** De-duplicate entries while preserving first-seen order. Defaults to `true`. */
-    unique?: boolean;
-    /** Sort entries lexicographically (default JS string sort). Defaults to `false`. */
-    sort?: boolean;
+/** Separator pattern. Defaults to `/,/`. */
+separators?: RegExp | string;
+/** De-duplicate entries while preserving first-seen order. Defaults to `true`. */
+unique?: boolean;
+/** Sort entries lexicographically (default JS string sort). Defaults to `false`. */
+sort?: boolean;
 }
 /**
  * Split a comma-separated (or custom-separator) string into trimmed, non-empty entries.

package/dist/core/shared/time.d.ts

@@ -10,27 +10,27 @@ export declare function isMillisecondPrecisionRfc3339DateTime(input: string): bo
 export declare function compareTimestampStrings(left: string, right: string): number;
 /** Timestamp-bearing record accepted by shared inclusive bound filtering. */
 export interface TimestampedRecord {
-    /** Optional deadline timestamp. */
-    deadline?: string;
-    /** Last-update timestamp. */
-    updated_at: string;
-    /** Creation timestamp. */
-    created_at: string;
+/** Optional deadline timestamp. */
+deadline?: string;
+/** Last-update timestamp. */
+updated_at: string;
+/** Creation timestamp. */
+created_at: string;
 }
 /** Inclusive timestamp bounds shared by list and search filtering. */
 export interface TimestampFilterBounds {
-    /** Inclusive upper deadline bound. */
-    deadlineBefore?: string;
-    /** Inclusive lower deadline bound. */
-    deadlineAfter?: string;
-    /** Inclusive lower update-time bound. */
-    updatedAfter?: string;
-    /** Inclusive upper update-time bound. */
-    updatedBefore?: string;
-    /** Inclusive lower creation-time bound. */
-    createdAfter?: string;
-    /** Inclusive upper creation-time bound. */
-    createdBefore?: string;
+/** Inclusive upper deadline bound. */
+deadlineBefore?: string;
+/** Inclusive lower deadline bound. */
+deadlineAfter?: string;
+/** Inclusive lower update-time bound. */
+updatedAfter?: string;
+/** Inclusive upper update-time bound. */
+updatedBefore?: string;
+/** Inclusive lower creation-time bound. */
+createdAfter?: string;
+/** Inclusive upper creation-time bound. */
+createdBefore?: string;
 }
 /** Return whether a timestamp-bearing record satisfies every configured bound. */
 export declare function matchesTimestampFilters(item: TimestampedRecord, filters: TimestampFilterBounds): boolean;
@@ -43,10 +43,10 @@ declare function isWhitespaceCharacter(character: string | undefined): boolean;
 export declare function resolveIsoOrRelative(input: string, now?: Date, fieldLabel?: string): string;
 /** Public contract for test only, shared by SDK and presentation-layer consumers. */
 export declare const _testOnly: {
-    normalizeOffset: typeof normalizeOffset;
-    pushTimestampCandidate: typeof pushTimestampCandidate;
-    normalizeTimestampCandidates: typeof normalizeTimestampCandidates;
-    parseTimestampWithFallbacks: typeof parseTimestampWithFallbacks;
-    isWhitespaceCharacter: typeof isWhitespaceCharacter;
+normalizeOffset: typeof normalizeOffset;
+pushTimestampCandidate: typeof pushTimestampCandidate;
+normalizeTimestampCandidates: typeof normalizeTimestampCandidates;
+parseTimestampWithFallbacks: typeof parseTimestampWithFallbacks;
+isWhitespaceCharacter: typeof isWhitespaceCharacter;
 };
 export {};

package/dist/core/store/item-format-migration.d.ts

@@ -1,16 +1,16 @@
 import type { ItemFormat, RuntimeSchemaSettings } from "../../types/index.js";
 /** Documents the item format migration result payload exchanged by command, SDK, and package integrations. */
 export interface ItemFormatMigrationResult {
-    /** Value that configures or reports target format for this contract. */
-    target_format: ItemFormat;
-    /** Value that configures or reports scanned for this contract. */
-    scanned: number;
-    /** Value that configures or reports migrated for this contract. */
-    migrated: string[];
-    /** Value that configures or reports removed for this contract. */
-    removed: string[];
-    /** Value that configures or reports warnings for this contract. */
-    warnings: string[];
+/** Value that configures or reports target format for this contract. */
+target_format: ItemFormat;
+/** Value that configures or reports scanned for this contract. */
+scanned: number;
+/** Value that configures or reports migrated for this contract. */
+migrated: string[];
+/** Value that configures or reports removed for this contract. */
+removed: string[];
+/** Value that configures or reports warnings for this contract. */
+warnings: string[];
 }
 /** Implements migrate item files to format for the public runtime surface of this module. */
 export declare function migrateItemFilesToFormat(pmRoot: string, targetFormat: ItemFormat, op?: string, typeToFolder?: Record<string, string>, schema?: RuntimeSchemaSettings): Promise<ItemFormatMigrationResult>;

package/dist/core/store/item-metadata-cache.d.ts

@@ -5,19 +5,19 @@ export declare const DEFAULT_DERIVED_INDEX_MINIMUM_ITEMS = 500;
 export declare const HEAVY_METADATA_KEYS: readonly ["comments", "notes", "learnings", "files", "tests", "test_runs", "docs"];
 /** Controls whether derived-index writers may skip the cross-process lock below the scale threshold. */
 export interface ItemMetadataDerivedIndexLockOptions {
-    /** Require serialization even when the derived index is absent or contains fewer than the normal locking threshold. */
-    required?: boolean;
+/** Require serialization even when the derived index is absent or contains fewer than the normal locking threshold. */
+required?: boolean;
 }
 /** Documents the cached document candidate payload exchanged by command, SDK, and package integrations. */
 export interface CachedDocumentCandidate {
-    /** Value that configures or reports metadata for this contract. */
-    metadata: ItemMetadata;
-    /** Value that configures or reports body for this contract. */
-    body?: string;
-    /** Value that configures or reports item format for this contract. */
-    item_format: ItemFormat;
-    /** Filesystem path used for item resolution. */
-    item_path: string;
+/** Value that configures or reports metadata for this contract. */
+metadata: ItemMetadata;
+/** Value that configures or reports body for this contract. */
+body?: string;
+/** Value that configures or reports item format for this contract. */
+item_format: ItemFormat;
+/** Filesystem path used for item resolution. */
+item_path: string;
 }
 /**
  * Drop memoized envelopes. Exposed for tests; production invalidation is stat-driven
@@ -43,27 +43,27 @@ export declare function shouldRecordCachedDocumentCandidate(existingFormat: Item
 export declare function acquireItemMetadataDerivedIndexLock(pmRoot: string, author: string, options?: ItemMetadataDerivedIndexLockOptions): Promise<() => Promise<void>>;
 /** One authoritative item commit projected into the rebuildable index. */
 export interface ItemMetadataDerivedIndexMutation {
-    /** Tracker root containing the derived cache. */
-    pmRoot: string;
-    /** Preferred item format folded into the cache schema fingerprint. */
-    preferredFormat: ItemFormat | undefined;
-    /** Runtime item-type folder mapping. */
-    typeToFolder: Record<string, string>;
-    /** Runtime schema folded into the cache schema fingerprint. */
-    schema: RuntimeSchemaSettings | undefined;
-    /** Committed item path, or deleted item path when document is null. */
-    itemPath: string;
-    /** Previous path removed by a format or type migration. */
-    previousItemPath?: string;
-    /** Committed document, or null for deletion. */
-    document: ItemDocument | null;
+/** Tracker root containing the derived cache. */
+pmRoot: string;
+/** Preferred item format folded into the cache schema fingerprint. */
+preferredFormat: ItemFormat | undefined;
+/** Runtime item-type folder mapping. */
+typeToFolder: Record<string, string>;
+/** Runtime schema folded into the cache schema fingerprint. */
+schema: RuntimeSchemaSettings | undefined;
+/** Committed item path, or deleted item path when document is null. */
+itemPath: string;
+/** Previous path removed by a format or type migration. */
+previousItemPath?: string;
+/** Committed document, or null for deletion. */
+document: ItemDocument | null;
 }
 /** Read-only identity of the effective rebuildable metadata projection. */
 export interface ItemMetadataDerivedIndexState {
-    /** Cursor shared by the base manifest and its collapsed mutation delta. */
-    source_cursor: string;
-    /** Number of authoritative rows recorded when the base manifest was built. */
-    entry_count: number;
+/** Cursor shared by the base manifest and its collapsed mutation delta. */
+source_cursor: string;
+/** Number of authoritative rows recorded when the base manifest was built. */
+entry_count: number;
 }
 /** Read the effective derived-index cursor without exposing cache file layout. */
 export declare function readItemMetadataDerivedIndexState(pmRoot: string, folders?: readonly string[]): Promise<ItemMetadataDerivedIndexState | null>;
@@ -79,16 +79,16 @@ export declare function readItemMetadataDerivedIndexState(pmRoot: string, folder
 export declare function refreshItemMetadataDerivedIndex(mutation: ItemMetadataDerivedIndexMutation): Promise<string[]>;
 /** Documents the list cache options payload exchanged by command, SDK, and package integrations. */
 export interface ListCacheOptions {
-    /** When false, item bodies are neither loaded from nor written to the separate body cache. Metadata-only callers (`pm list`, stats, deps, activity, …) skip the large body cache entirely; only body consumers (search/reindex) pay for it. */
-    includeBody?: boolean;
-    /** When false, heavy collection fields (comments/notes/learnings/files/tests/ test_runs/docs) are neither loaded from nor written to the separate collections cache, and are absent from the returned metadata. Light-only callers (`pm list` compact, stats, deps, activity, calendar, close) skip the large collections cache entirely. Defaults to true so any caller that does read those fields stays correct. */
-    includeCollections?: boolean;
-    /** Force canonical item enumeration and authoritative file reads even when stat-matched cache tiers or a fresh derived index are available. Validation, repair, migration, and equivalence tests use this correctness path. */
-    forceSourceScan?: boolean;
-    /** Minimum item count required before the directory-signature derived-index fast path is used. Defaults to 500 so small workspaces preserve per-file external-edit detection; tests and specialized SDK hosts may lower it explicitly. */
-    derivedIndexMinimumItems?: number;
-    /** Optional cache-rebuild diagnostics kept separate from item-read warnings. */
-    cacheDiagnostics?: string[];
+/** When false, item bodies are neither loaded from nor written to the separate body cache. Metadata-only callers (`pm list`, stats, deps, activity, …) skip the large body cache entirely; only body consumers (search/reindex) pay for it. */
+includeBody?: boolean;
+/** When false, heavy collection fields (comments/notes/learnings/files/tests/ test_runs/docs) are neither loaded from nor written to the separate collections cache, and are absent from the returned metadata. Light-only callers (`pm list` compact, stats, deps, activity, calendar, close) skip the large collections cache entirely. Defaults to true so any caller that does read those fields stays correct. */
+includeCollections?: boolean;
+/** Force canonical item enumeration and authoritative file reads even when stat-matched cache tiers or a fresh derived index are available. Validation, repair, migration, and equivalence tests use this correctness path. */
+forceSourceScan?: boolean;
+/** Minimum item count required before the directory-signature derived-index fast path is used. Defaults to 500 so small workspaces preserve per-file external-edit detection; tests and specialized SDK hosts may lower it explicitly. */
+derivedIndexMinimumItems?: number;
+/** Optional cache-rebuild diagnostics kept separate from item-read warnings. */
+cacheDiagnostics?: string[];
 }
 /**
  * List all item documents using a persistent on-disk metadata cache.