@unbrained/pm-cli 2026.10.12 → 2026.10.14

package/dist/types.js

@@ -1,2 +1,2 @@
-(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d293b107-03ce-51f2-8ade-8a9f0ec0b4db")}catch{}})();const BUILTIN_ITEM_TYPE_VALUES=["Epic","Feature","Task","Chore","Issue","Decision","Event","Reminder","Milestone","Meeting","Plan"],ITEM_TYPE_VALUES=BUILTIN_ITEM_TYPE_VALUES,STATUS_VALUES=["draft","open","in_progress","blocked","closed","canceled"],RUNTIME_STATUS_ROLE_VALUES=["draft","active","blocked","terminal","terminal_done","terminal_canceled","default_open","default_close","default_cancel"],RUNTIME_FIELD_TYPE_VALUES=["string","number","boolean","string_array","array","object"],RUNTIME_FIELD_COMMAND_VALUES=["create","update","update_many","list","search","calendar","context"],RUNTIME_UNKNOWN_FIELD_POLICY_VALUES=["allow","warn","reject"],DEPENDENCY_KIND_VALUES=["blocks","parent","child","parent_child","child_of","related","related_to","discovered_from","blocked_by","incident_from","epic","implements","recurs_from","supersedes","task","verifies"],SCOPE_VALUES=["project","global"],RISK_VALUES=["low","medium","high","critical"],ISSUE_SEVERITY_VALUES=["low","medium","high","critical"],CONFIDENCE_TEXT_VALUES=["low","medium","high"],ITEM_FORMAT_VALUES=["toon","json_markdown"],SPRINT_RELEASE_FORMAT_POLICY_VALUES=["warn","strict_error"],PARENT_REFERENCE_POLICY_VALUES=["warn","strict_error"],VALIDATE_METADATA_PROFILE_VALUES=["core","strict","custom"],GOVERNANCE_PRESET_VALUES=["minimal","default","strict","custom"],GOVERNANCE_OWNERSHIP_ENFORCEMENT_VALUES=["none","warn","strict"],GOVERNANCE_CREATE_MODE_DEFAULT_VALUES=["progressive","strict"],GOVERNANCE_CLOSE_VALIDATION_DEFAULT_VALUES=["off","warn","strict"],GOVERNANCE_WORKFLOW_ENFORCEMENT_VALUES=["off","warn","strict"],GOVERNANCE_DUPLICATE_DETECTION_MODE_VALUES=["off","advisory","strict"],VALIDATE_METADATA_REQUIRED_FIELD_VALUES=["author","acceptance_criteria","estimated_minutes","close_reason","reviewer","risk","confidence","sprint","release"],RECURRENCE_FREQUENCY_VALUES=["daily","weekly","monthly","yearly"],RECURRENCE_WEEKDAY_VALUES=["mon","tue","wed","thu","fri","sat","sun"];function weekdayOrderIndex(value){return RECURRENCE_WEEKDAY_VALUES.indexOf(value)}const PLAN_MODE_VALUES=["draft","research","review","approved","executing","paused","completed","superseded"],PLAN_STEP_STATUS_VALUES=["pending","in_progress","completed","blocked","skipped","superseded"],PLAN_HARNESS_VALUES=["codex","claude-code","cursor","generic"],PLAN_STEP_LINK_KIND_VALUES=["related","blocks","blocked_by","depends_on","discovered_from","implements","recurs_from","verifies","supersedes"],CONTEXT_DEPTH_VALUES=["brief","standard","deep","full"],CONTEXT_SECTION_VALUES=["hierarchy","activity","progress","recently_created","unparented","blockers","files","workload","staleness","tests"];export{BUILTIN_ITEM_TYPE_VALUES,CONFIDENCE_TEXT_VALUES,CONTEXT_DEPTH_VALUES,CONTEXT_SECTION_VALUES,DEPENDENCY_KIND_VALUES,GOVERNANCE_CLOSE_VALIDATION_DEFAULT_VALUES,GOVERNANCE_CREATE_MODE_DEFAULT_VALUES,GOVERNANCE_DUPLICATE_DETECTION_MODE_VALUES,GOVERNANCE_OWNERSHIP_ENFORCEMENT_VALUES,GOVERNANCE_PRESET_VALUES,GOVERNANCE_WORKFLOW_ENFORCEMENT_VALUES,ISSUE_SEVERITY_VALUES,ITEM_FORMAT_VALUES,ITEM_TYPE_VALUES,PARENT_REFERENCE_POLICY_VALUES,PLAN_HARNESS_VALUES,PLAN_MODE_VALUES,PLAN_STEP_LINK_KIND_VALUES,PLAN_STEP_STATUS_VALUES,RECURRENCE_FREQUENCY_VALUES,RECURRENCE_WEEKDAY_VALUES,RISK_VALUES,RUNTIME_FIELD_COMMAND_VALUES,RUNTIME_FIELD_TYPE_VALUES,RUNTIME_STATUS_ROLE_VALUES,RUNTIME_UNKNOWN_FIELD_POLICY_VALUES,SCOPE_VALUES,SPRINT_RELEASE_FORMAT_POLICY_VALUES,STATUS_VALUES,VALIDATE_METADATA_PROFILE_VALUES,VALIDATE_METADATA_REQUIRED_FIELD_VALUES,weekdayOrderIndex};
+(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof globalThis<"u"?globalThis:typeof self<"u"?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="459c0cce-212f-5285-9c3b-13676d2388af")}catch{}})();const BUILTIN_ITEM_TYPE_VALUES=["Epic","Feature","Task","Chore","Issue","Decision","Event","Reminder","Milestone","Meeting","Plan"],ITEM_TYPE_VALUES=BUILTIN_ITEM_TYPE_VALUES,STATUS_VALUES=["draft","open","in_progress","blocked","closed","canceled"],RUNTIME_STATUS_ROLE_VALUES=["draft","active","blocked","terminal","terminal_done","terminal_canceled","default_open","default_close","default_cancel"],RUNTIME_FIELD_TYPE_VALUES=["string","number","boolean","string_array","array","object"],RUNTIME_FIELD_COMMAND_VALUES=["create","update","update_many","list","search","calendar","context"],RUNTIME_UNKNOWN_FIELD_POLICY_VALUES=["allow","warn","reject"],DEPENDENCY_KIND_VALUES=["blocks","parent","child","parent_child","child_of","related","related_to","discovered_from","blocked_by","incident_from","epic","implements","recurs_from","supersedes","task","verifies"],SCOPE_VALUES=["project","global"],RISK_VALUES=["low","medium","high","critical"],ISSUE_SEVERITY_VALUES=["low","medium","high","critical"],CONFIDENCE_TEXT_VALUES=["low","medium","high"],ITEM_FORMAT_VALUES=["toon","json_markdown"],SPRINT_RELEASE_FORMAT_POLICY_VALUES=["warn","strict_error"],PARENT_REFERENCE_POLICY_VALUES=["warn","strict_error"],VALIDATE_METADATA_PROFILE_VALUES=["core","strict","custom"],GOVERNANCE_PRESET_VALUES=["minimal","default","strict","custom"],GOVERNANCE_OWNERSHIP_ENFORCEMENT_VALUES=["none","warn","strict"],GOVERNANCE_CREATE_MODE_DEFAULT_VALUES=["progressive","strict"],GOVERNANCE_CLOSE_VALIDATION_DEFAULT_VALUES=["off","warn","strict"],GOVERNANCE_WORKFLOW_ENFORCEMENT_VALUES=["off","warn","strict"],GOVERNANCE_DUPLICATE_DETECTION_MODE_VALUES=["off","advisory","strict"],VALIDATE_METADATA_REQUIRED_FIELD_VALUES=["author","acceptance_criteria","estimated_minutes","close_reason","reviewer","risk","confidence","sprint","release"],RECURRENCE_FREQUENCY_VALUES=["daily","weekly","monthly","yearly"],RECURRENCE_WEEKDAY_VALUES=["mon","tue","wed","thu","fri","sat","sun"];function weekdayOrderIndex(value){return RECURRENCE_WEEKDAY_VALUES.indexOf(value)}const PLAN_MODE_VALUES=["draft","research","review","approved","executing","paused","completed","superseded"],PLAN_STEP_STATUS_VALUES=["pending","in_progress","completed","blocked","skipped","superseded"],PLAN_HARNESS_VALUES=["codex","claude-code","cursor","generic"],PLAN_STEP_LINK_KIND_VALUES=["related","blocks","blocked_by","depends_on","discovered_from","implements","recurs_from","verifies","supersedes"],CONTEXT_DEPTH_VALUES=["brief","standard","deep","full"],CONTEXT_SECTION_VALUES=["hierarchy","activity","progress","recently_created","unparented","blockers","files","workload","staleness","tests"];export{BUILTIN_ITEM_TYPE_VALUES,CONFIDENCE_TEXT_VALUES,CONTEXT_DEPTH_VALUES,CONTEXT_SECTION_VALUES,DEPENDENCY_KIND_VALUES,GOVERNANCE_CLOSE_VALIDATION_DEFAULT_VALUES,GOVERNANCE_CREATE_MODE_DEFAULT_VALUES,GOVERNANCE_DUPLICATE_DETECTION_MODE_VALUES,GOVERNANCE_OWNERSHIP_ENFORCEMENT_VALUES,GOVERNANCE_PRESET_VALUES,GOVERNANCE_WORKFLOW_ENFORCEMENT_VALUES,ISSUE_SEVERITY_VALUES,ITEM_FORMAT_VALUES,ITEM_TYPE_VALUES,PARENT_REFERENCE_POLICY_VALUES,PLAN_HARNESS_VALUES,PLAN_MODE_VALUES,PLAN_STEP_LINK_KIND_VALUES,PLAN_STEP_STATUS_VALUES,RECURRENCE_FREQUENCY_VALUES,RECURRENCE_WEEKDAY_VALUES,RISK_VALUES,RUNTIME_FIELD_COMMAND_VALUES,RUNTIME_FIELD_TYPE_VALUES,RUNTIME_STATUS_ROLE_VALUES,RUNTIME_UNKNOWN_FIELD_POLICY_VALUES,SCOPE_VALUES,SPRINT_RELEASE_FORMAT_POLICY_VALUES,STATUS_VALUES,VALIDATE_METADATA_PROFILE_VALUES,VALIDATE_METADATA_REQUIRED_FIELD_VALUES,weekdayOrderIndex};
 //# sourceMappingURL=types.js.map

package/docs/BUILD_AND_RELEASE_ACCEPTANCE.md

@@ -7,7 +7,7 @@ Trackers: [pm-cxc4jc](../.agents/pm/tasks/pm-cxc4jc.toon),
 
 ## Build ownership
 
-Build/test/coverage sessions own `.cache/build-lease` through completion;
+Build/test/coverage and distribution-packing sessions own `.cache/build-lease` through completion;
 other producers/consumers wait twenty minutes. Nested readers inherit a verified
 PID/token receipt; nested builds require independent workspaces. Direct stages
 and arbitrary `dist` reads bypass this protocol.
@@ -16,7 +16,10 @@ Leases never expire or get stolen. Two matching reads proving PID absence fail
 promptly with recovery guidance. Missing/malformed/changing/ambiguous receipts
 use the timeout; PID reuse is ambiguous. Inspect owner and children before
 abandoned-lease removal. Failed builds leave `.cache/build-incomplete`; prebuilt
-tests refuse it until a successful build.
+tests and distribution packing refuse it until a successful build. Packing holds
+the lease from source inventory through isolated staging and the final archive;
+its asynchronous helper validates inherited consumer receipts in the same
+physical workspace. See [SDK consumer receipts](SDK_CONSUMER_RECEIPTS.md).
 
 Interrupts stop the child and stage admission, allowing five seconds for
 settlement, lease release and cleanup; unsettled children retain storage.

package/docs/CONFIGURATION.md

@@ -226,8 +226,18 @@ Successful sampled reads defer their start until completion so both lifecycle ev
 
 `pm telemetry stats` reads the local queue and reports, per command bucket, latency percentiles (`duration_p50_ms`/`duration_p95_ms`/`duration_max_ms`, nearest-rank over `command_finish` `duration_ms`), outcome rates (`ok_count`/`error_count`/`error_rate`; a finish event whose `ok` is missing or not strictly `true` is counted conservatively as an error), and `command_resolution_counts`. These are an always-available, zero-network performance and reliability signal for the most recent queued window.
 
+Background completion delivery is tracked by [pm-j8spis](../.agents/pm/issues/pm-j8spis.toon).
+The detached uploader continues draining due events and OTLP spans appended
+during an upload, so completion delivery does not require another command.
+It releases the upload lock between batches and rechecks consent and identity.
+Future retries remain queued, and unchanged eligible work stops the drain;
+foreground commands still perform no export network I/O.
+
 ### Sentry environment variables
 
+Tracing and privacy delivery: [pm-58yzil](../.agents/pm/features/pm-58yzil.toon) and
+[pm-geywoc](../.agents/pm/issues/pm-geywoc.toon).
+
 Crash and error diagnostics are reported to Sentry only when telemetry is enabled and the process is not opted out. These environment variables tune the Sentry client.
 
 | Variable                    | Values         | Use                                                                                                                                                                                                                         |
@@ -235,10 +245,43 @@ Crash and error diagnostics are reported to Sentry only when telemetry is enable
 | `PM_SENTRY_DISABLED`        | boolean        | Disable Sentry error reporting for this process (the Sentry SDK is not even imported). `PM_TELEMETRY_DISABLED` / `PM_NO_TELEMETRY` also disable it.                                                                         |
 | `SENTRY_DSN`                | URL            | Override the destination DSN. Defaults to the bundled pm-cli project DSN.                                                                                                                                                   |
 | `SENTRY_ENVIRONMENT`        | string         | Override the reported environment tag. Defaults to `test` under Vitest, `ci` when `CI` is set, otherwise `production`.                                                                                                      |
+| `PM_SENTRY_TRACE_COMMANDS`  | boolean        | Explicitly initialize Sentry for successful commands. Defaults to off, preserving lazy startup. All consent opt-outs and test isolation still apply; a zero trace sample rate avoids initialization. |
 | `SENTRY_TRACES_SAMPLE_RATE` | number `0`–`1` | Fraction of command spans sampled for performance tracing. Defaults to `0.2` (20%). Set to `1` for full-trace performance debugging or `0` to disable tracing. Non-numeric or out-of-range values fall back to the default. |
 
 > Sentry is hard-disabled under Vitest (`VITEST` / `VITEST_WORKER_ID`), so these knobs are no-ops inside the test suite.
 
+For a bounded diagnostic invocation use
+`PM_SENTRY_TRACE_COMMANDS=1 SENTRY_TRACES_SAMPLE_RATE=1 pm context --limit 3`.
+Completion flushes buffered spans within the existing three-second SDK timeout.
+The sample-rate variable alone does not enable successful-command initialization.
+Configured telemetry opt-outs also prevent it. The CLI skips command context and
+span creation when consent is disabled, including when an embedding caller has
+already initialized Sentry. SDK callers use
+`ensureSentryCommandTracing(telemetryEnabled)` from `@unbrained/pm-cli/sdk`,
+passing an explicit `true` only after confirming effective consent. Start a
+command span only when the returned permission is `true`; an existing client
+also requires the current opt-in, sampling and process policy. Other runtime
+values keep initialization disabled.
+Consent is checked again at command completion. A command that disables
+telemetry discards its span; SDK callers can use `sentryDiscardCommandSpan()`
+to clear a pending span without exporting it.
+A failed completion-time settings read also discards the span, so optional
+diagnostics cannot turn a successful command into a failure.
+If the SDK loader or initializer fails, tracing remains unavailable for that
+process and the command continues. The partial client is cleared and the
+failed initialization is not retried.
+Sentry sends streamed spans; its span and log hooks apply the same scrubbing
+as errors and breadcrumbs. A final envelope hook scrubs serialized log attributes
+after the SDK merges current and isolation scopes, preserving safe typed values
+without changing shared scopes. Template parameter attributes are always redacted.
+Command context retains option keys and redacted
+argument slots, including text that resembles a flag. Automatic user, cookie, HTTP header/body/query, AI, database,
+GraphQL, local-variable and source-context collection is explicitly
+disabled. Command taxonomy and outcome attributes remain available on spans.
+
+The separate local event and OTLP queues retain their existing formats. Turning
+off command tracing does not require deleting or rewriting those queues.
+
 Linked commands launched by `pm test --run` default
 `SENTRY_ENVIRONMENT=test`, even when the parent process is classified as
 production. This keeps sandbox failures out of production diagnostics. An

package/docs/DEFECT_RECURRENCE.md

@@ -47,10 +47,30 @@ The index and report are deterministic. `policy_fingerprint` identifies the vers
 
 Each report explains its exact matching signals, returns deduplicated local and hosted checks, and includes a small cost receipt. Package authors may keep their own recurrence policy and feed the same SDK from a custom command, extension, CI adapter, or application.
 
+File-pattern evaluation is tracked by [pm-0vqbl5](../.agents/pm/tasks/pm-0vqbl5.toon).
+Patterns treat punctuation and literal NUL characters literally, `*` matches any characters except `/`, and
+`**` also crosses separators while excluding line terminators. Matching covers
+the complete trimmed path; `**/` still requires its slash. A finite-state matcher
+uses at most pattern length times path length work and memory proportional to
+pattern length. The existing 256-character policy limit and bounded compiled
+pattern cache remain in force, including for custom SDK policy consumers.
+
 ## CLI and MCP Action
 
 `assurance risk` accepts one JSON request through the same `definition` transport already used by SDK and MCP hosts:
 
+Discovery recovery is tracked by [pm-assurance-risk-help-policy](../.agents/pm/issues/pm-assurance-risk-help-policy.toon).
+Both `policy` and `change` are required. Help includes an executable minimal
+example with an explicitly empty family list; it demonstrates the request
+shape and makes no project coverage claim. Use the project's declared policy
+for real decisions, as below. A missing or invalid policy object returns
+structured help recovery without choosing a policy on the caller's behalf.
+SDK policy parsing throws `DefectRecurrencePolicyParseError`, a `TypeError`
+subclass exported by the root and governance entrypoints. This identifies
+policy validation without depending on message text; its stable `code` is
+`defect_recurrence_policy_invalid`. Change and lineage
+validation retain their separate error contracts.
+
 ```bash
 risk_request=$(jq -cn \
   --slurpfile policy config/defect-recurrence-policy.json \

package/docs/EXTENSIONS.md

@@ -304,12 +304,12 @@ Doctor JSON also includes `triage.collision_plan` with grouped surfaces, ranked
 Use the public SDK barrel. Do not deep-import from `src/core` or `dist/core`.
 
 - `api.extension` is a read-only identity (`name`, `layer`, `version`, `capabilities`, `pm_min_version?`, `pm_max_version?`, `source_package?`) for self-identifying logs and version gating without re-reading the manifest.
-- `api.registerCommand(definition)` adds package-owned commands.
+- `api.registerCommand(definition)` adds package-owned commands; `read_output` opts readers into the [SDK output contract](SDK.md#minimal-command-extension).
 - `api.registerFlags(command, flags)` adds runtime command flags. A flag may declare `value_type` (canonical; the legacy `type` alias is honored only when `value_type` is absent), `list: true` to accumulate repeated/comma-joined values like core `--tags`, and a `default` applied when the flag is omitted.
 - `api.registerItemFields(fields)` adds custom metadata fields. Agents can set declared fields with repeatable `pm create --field name=value` and `pm update <id> --field name=value`; undeclared names are rejected. `SchemaFieldDefinition.type` is the same closed union used by `pm schema add-field`: `string | number | boolean | string_array | array | object`. Unsupported values fail at compile time for TypeScript authors and at activation for JavaScript packages, with a did-you-mean hint on typos. `string_array` is the repeatable string collection; `array` and `object` require JSON containers.
 - Custom fields whose camel-case option name is already owned by a canonical MCP input remain usable through `options.<name>`, but authoring surfaces report the collision instead of allowing silent top-level shadowing. `pm schema add-field`, `pm profile lint`, and `pm package doctor` name the field, canonical `mcp_tool_input` owner, and nested recovery path. SDK authors can preflight the same rule with `resolvePmToolCustomFieldCollision`.
 - `api.registerItemTypes(types)` adds custom item types.
-- `api.registerRelationshipKinds(definitions)` adds validated graph semantics. Definitions declare direction, inverse spelling, ordering/precedence, hierarchy, cardinality, lifecycle, aliases, payload schema, compatibility version, and self-edge policy. Active definitions are merged into native CLI, MCP, and SDK workspace graph assembly. Requires the `schema` capability and is governed by the `schema.relationshipkinds` policy surface.
+- `api.registerRelationshipKinds(definitions)` adds validated graph semantics. Definitions declare direction, inverse spelling, ordering/precedence, hierarchy, cardinality, lifecycle, aliases, payload schema, compatibility version, and self-edge policy. Active definitions govern CLI, MCP, and SDK dependency mutation admission as well as workspace graph assembly; mutation aliases are stored canonically. Requires the `schema` capability and is governed by the `schema.relationshipkinds` policy surface. See [relationship mutation admission](RELATIONSHIP_GRAPH.md#contract), tracked by [pm-7dsolo](../.agents/pm/issues/pm-7dsolo.toon).
 - `api.registerMigration(definition)` adds schema migrations.
 - `api.registerProfile(profile)` contributes a project profile — a declarative archetype bundling item types, statuses, fields, per-type workflows, config, templates, and package recommendations. Once active it resolves by name through `pm profile list/show/apply` alongside the core `agile`/`ops`/`research` archetypes (built-in names are reserved; a colliding registration is ignored with a warning). Requires the `schema` capability.
 - `api.registerAssuranceMeasurementProvider(provider)` contributes typed measurements to assurance. It requires `services`; network providers also require manifest `permissions.network: true`. Gates allow providers and cost/network limits per trigger. See [Project Assurance Primitives](ASSURANCE.md#extension-measurement-providers) for examples.
@@ -325,7 +325,7 @@ Use the public SDK barrel. Do not deep-import from `src/core` or `dist/core`.
 
 The bundled `pm-lifecycle-hooks` package is the hook exemplar: it declares only `hooks` and registers a default-inert `afterCommand` hook so authors can copy a safe lifecycle pattern without changing command output.
 If a package calls a `register*` API without declaring the required manifest capability, `pm package doctor --project --detail deep --trace` reports `extension_capability_missing:<name>:<capability>` and shows the exact capability to add before publishing.
-Inline command flags require both `commands` and `schema` capabilities. Runtime schema changes should be verified with:
+Inline command flags require both `commands` and `schema` capabilities. See [Extension author contracts](EXTENSION_AUTHOR_CONTRACTS.md) for canonical flag spelling ([pm-gh1461](../.agents/pm/issues/pm-gh1461.toon)) and [SDK testing helpers](SDK.md#testing-helpers) for TOON output assertions ([pm-gh1462](../.agents/pm/features/pm-gh1462.toon)). Verify runtime schema changes and flag contracts with:
 
 ```bash
 pm schema list

package/docs/EXTENSION_AUTHOR_CONTRACTS.md

@@ -4,6 +4,25 @@ Tracker: pm-at83
 
 This page records runtime contracts package authors need when they build on the public SDK. For the install, manifest, lifecycle, and troubleshooting overview, see [Packages and Extensions](EXTENSIONS.md).
 
+## Flag Spelling and Output Assertions
+
+Tracked by [pm-gh1461](../.agents/pm/issues/pm-gh1461.toon) and
+[pm-gh1462](../.agents/pm/features/pm-gh1462.toon).
+Prefer `{ long: "--repo", value_name: "project", value_type: "string" }`.
+Legacy `--repo <project>`, `--repo=<project>` and `--label [name]` declarations
+retain one canonical identity, one value placeholder and one help listing.
+Optional brackets permit presence without a value. Explicit `value_name` wins
+over the inline label, and boolean types remain value-free. Runtime contracts
+omit inferred labels for boolean flags, including legacy dynamic `bool` aliases;
+explicit legacy `value_name` metadata remains compatible. The SDK owns the
+canonical long-name rule used by help, option dispatch and contract discovery.
+Typed authors should use canonical `value_type` names (`boolean`, `number`, `string`).
+
+Use `decodeToon` from `@unbrained/pm-cli/sdk/testing` to assert on host output
+semantically; `encodeToon` and the native codec option types are available from
+that subpath and `/sdk`. They use the host's pinned implementation, so a package
+does not need a separate TOON dependency or a private `dist/` import.
+
 ## Telemetry Capture Level
 
 Every `pm` command records a telemetry event. Extension commands use the same telemetry pipeline as core commands and inherit `telemetry.capture_level` from the active settings.

package/docs/MERGE_SAFETY.md

@@ -111,6 +111,14 @@ incompatible commands. A dry run changes neither configuration nor attributes.
 
 ### Fence coverage contract
 
+Extension assets are tracked by [pm-gh1460](../.agents/pm/issues/pm-gh1460.toon).
+Files under `extensions/**` use Git's built-in `merge=text` driver, so separate
+text edits combine and overlapping edits retain normal conflict markers.
+Git still detects binary content and preserves its conflicted stages. The later
+`.managed-extensions.json` rule keeps the structured `pm-json` driver.
+The v2 fence grammar remains stable; `pm merge install` refreshes stale patterns
+without discarding sibling fences or restoring legacy unversioned markers.
+
 The fenced block is generated by one shared coverage contract (`buildMergeAttributePatterns`) covering every mergeable artifact class: tracker-wide `**/*.toon` and `**/*.md` item patterns, explicit per-type diagnostic patterns, all tracker `**/*.jsonl` paths under the relationship-event driver with the more-specific `history/*.jsonl` rule overriding history streams, root `settings.json`, and every nested `**/*.json` document. The tracker-wide item rules protect extension-defined type folders even when a receiving branch has not installed the package that registered them; explicit type rows still make active-registry drift diagnosable. The broad JSON rules automatically cover schema, managed-extension, evaluation-corpus, and future package-owned authoritative JSON without another hand-maintained allowlist. The broad JSONL rule is required because `RelationshipEventStore` supports package-owned custom relative paths anywhere below the tracker root. Two mechanisms keep the committed fence from drifting out of that contract:
 
 - `pm schema add-type` / `pm schema remove-type` refresh the fence automatically when it is installed (warning `merge_fence_refreshed`); repos inside git that never installed it get the actionable `merge_fence_not_installed` hint instead.
@@ -195,6 +203,20 @@ same complete receipt summary and disposition. An absent, unreadable, invalid,
 unsealed, or mismatched audit keeps the receipt pending in memory; inspection
 rewrites neither receipt nor history. History is verified once per affected
 item in each receipt scan.
+Historical receipt recovery is tracked by [pm-tknnzp](../.agents/pm/issues/pm-tknnzp.toon).
+Historical item-state hashes do not authenticate audit context. An older
+unsealed `merge_reconcile` summary therefore cannot retain settled state,
+even when its receipt identity, fields, and value hashes match. Editing that
+context leaves the legacy item chain valid. Keep these receipts pending for
+explicit reviewed migration to a modern sealed audit; never retroactively
+trust the old summary or synthesize an old signature during inspection.
+If compaction removed the audit, the receipt also stays pending. Preview with
+`pm merge reconcile --dry-run`; review its summaries and repair failures and
+re-apply any intended discarded values. Only with explicit review authority,
+use `pm merge reconcile --force --message "<reviewed receipt disposition and rationale>"`.
+That command appends acceptance evidence; it cannot recover missing evidence
+or restore discarded values. This migration guidance also applies to a
+lossless receipt whose snapshot proof is unavailable.
 Copy provenance includes normalized `requested_preference_applied`, so copies
 that disagree on whether preference participated cannot share lifecycle state
 even if history matches one copy. Inspection reports `copy_provenance_mismatch`,
@@ -210,6 +232,18 @@ pm merge report --include-reconciled
 
 The underlying public SDK exports are `mergeItemDocuments`, `mergeHistoryStreams`, `mergeRelationshipEventStreams`, `mergeJsonDocuments`, `runMergeDriver`, `runMergeInstall`, `installMergeFence`, `findGitWorkspaceRoot`, `runMergeReconcile`, `runMergeReceiptReport`, `runMergeReceiptEvidenceReport`, `inspectMergeReceiptEvidence`, `listMergeReceipts`, `auditMergeDriverConfiguration`, `refreshMergeAttributeFenceIfInstalled`, `buildMergeAttributePatterns`, and `auditMergeAttributeFence` from `@unbrained/pm-cli/sdk`. `installMergeFence` accepts explicit tracker and workspace roots, so custom init hosts do not depend on process cwd or CLI globals.
 
+Collection projection is tracked by [pm-pftgcz](../.agents/pm/issues/pm-pftgcz.toon).
+History union reconstructs each event in its original branch before merging
+collection values with the item driver's shared policy. Positional comment,
+doc and test patches from an earlier reconciliation therefore cannot overwrite
+an unrelated entry at the same array index on another branch. Original event
+attribution and patches remain in sealed rewrite evidence; replayed collections
+use the canonical item order and receiving-side linked-test provenance.
+The SDK reanchor primitive accepts `projectPatch` for this explicit projection
+boundary. It retains the replaced patch rather than erasing its source.
+Exact receipt settlement still requires an authoritative matching snapshot,
+and newly merged executable tests still require clone-local trust acknowledgement.
+
 `listMergeReceipts` is the compatibility projection for callers that only need
 validated receipts. It cannot distinguish an empty evidence store from a store
 whose candidates were all rejected. Gates and diagnostic integrations should
@@ -495,7 +529,7 @@ pm history-repair <item-id>
 pm merge reconcile --dry-run --json
 ```
 
-`history-repair` records the reconciliation patch and classifies its changed fields against the final item. Append-only collection unions and deterministic reordering are reported as preserved context without a data-loss warning. Fields whose replayed values are actually removed or replaced remain loud with discarded event authors/operations and recovery guidance. Re-apply any intended losing mutation as a normal `pm update` so it remains explicit and auditable.
+`history-repair` records the reconciliation patch and classifies its changed fields against the final item. Append-only collection unions and deterministic reordering are reported as preserved context without a data-loss warning. For native comments, docs and tests, duplicate copies of the same identified record and changes between the known `local_mutation`/`merge_union` display markers are also reported as preserved context. Author, creation time, origin, payload and unknown-field changes remain significant. This diagnosis does not authorize linked commands or relax exact receipt hashes. Fields whose replayed values are actually removed or replaced remain loud with discarded event authors/operations and recovery guidance. Re-apply any intended losing mutation as a normal `pm update` so it remains explicit and auditable.
 
 History events now declare an item-hash epoch. Epochs are immutable writer
 contracts, not aliases for the current item serializer: epoch 1 sorts linked

package/docs/RECURRENCE_RECOVERY_CONTRACTS.md

@@ -6,6 +6,8 @@ Tracked by [pm-83cz0o](../.agents/pm/features/pm-83cz0o.toon),
 [pm-h8tpeh](../.agents/pm/features/pm-h8tpeh.toon), and
 [pm-f05lsg](../.agents/pm/features/pm-f05lsg.toon).
 
+Planning recovery: [pm-reopen-planning-recovery](../.agents/pm/tasks/pm-reopen-planning-recovery.toon).
+
 ## Agent Quick Context
 
 - Reuse an active matching item; reopen a terminal matching item.
@@ -21,17 +23,28 @@ Tracked by [pm-83cz0o](../.agents/pm/features/pm-83cz0o.toon),
 
 ```bash
 pm item reopen pm-a1b2 "The production failure recurred after deployment"
-pm item reopen pm-a1b2 "The customer reproduced the issue" --status in_progress
+pm item reopen pm-a1b2 "The customer reproduced the issue" --status in_progress \
+  --expected-result "The recurrence is repaired and its regression passes"
 ```
 
 The command accepts only the workspace open or in-progress status. While
 holding the item lock it verifies that the current status is terminal, records
 one `reopen` history event with structured recurrence context, and delegates the
 state change to the normal update pipeline. Active metadata drops stale
-`closed_at`, `completed_at`, `close_reason`, `resolution`, `expected_result`,
-`actual_result`, and `fixed_version` values. Earlier history retains the exact
+`closed_at`, `completed_at`, `close_reason`, `resolution`, `actual_result`, and
+`fixed_version` values. It clears the prior `expected_result` and retains a new
+current expectation when explicitly supplied. Earlier history retains the exact
 closure values.
 
+Supply `--expected-result` (`--expected`) for the current active expectation.
+The SDK option and MCP parameter are `expectedResult`. This explicitly supplied
+planning value survives the reopen, while the previous terminal expectation
+remains in `recurrence.previous_terminal` and immutable history. Without the
+option, the compact receipt supplies `recovery.suggested_retry_args` for an
+update of the same tracker and item. Replace its outcome placeholder before
+executing it, then claim/start the item. Reopening does not infer a new
+expectation from the old closure or relax active planning assurance.
+
 Compact output keeps the recurrence receipt because the prior and next status,
 reason, and terminal evidence are the proof that this was a recurrence rather
 than a generic edit. An already-active item fails with
@@ -47,7 +60,7 @@ const pm = new PmClient({ pmRoot: "/workspace/.agents/pm" });
 const viaClient = await pm.reopen(
   "pm-a1b2",
   "The production failure recurred",
-  { status: "in_progress" },
+  { status: "in_progress", expectedResult: "The recurrence regression passes" },
 );
 
 const viaFunction = await reopen(

package/docs/RELATIONSHIP_GRAPH.md

@@ -10,6 +10,32 @@ The alternatives were rejected as follows: a closed enum cannot model applicatio
 
 ## Contract
 
+Dependency mutation admission is tracked by [pm-7dsolo](../.agents/pm/issues/pm-7dsolo.toon).
+`create --dep`, `update --dep`, `update --dep-remove`, bulk updates, and their
+SDK actions resolve kinds and aliases through the active workspace registry.
+For example, an extension can register `ships_before` with alias
+`precedes_ship`, then use `--dep id=<target>,kind=precedes_ship`; storage and
+history record `ships_before`. Ordering advice, self-edge refusals, and
+hierarchy validation use those same registered semantics. Disabling or
+uninstalling the registration refuses new dependency writes before item or history changes.
+The refusal lists active canonical kinds and explains how to enable the owning
+extension. `DependencyKind` is a string identifier: `DEPENDENCY_KIND_VALUES`
+describes built-in spellings rather than the complete workspace vocabulary.
+
+Non-hierarchy kinds with `outgoing: "one"` or `incoming: "one"` also reject
+new conflicting logical endpoints before persistence. Duplicate provenance
+rows do not consume another logical endpoint; unchanged historical debt and
+strict repairs remain allowed. One removal plus one addition is validated as
+the final dependency set. Limited-cardinality writers share the workspace
+integrity lock with hierarchy writers, so concurrent updates cannot both
+validate against the same empty snapshot.
+`assertNonHierarchyCardinalityMutationAllowed` and `RelationshipCardinalityItem`
+are public root/graph SDK exports for comparing minimal immutable item
+projections. The guard reports `dependency_cardinality_created` with a typed
+`relationship_cardinality` context. Native mutations compose it with the
+existing richer hierarchy validator; it does not infer semantics for an
+inactive or unknown kind.
+
 Each relationship kind declares direction, inverse, a traversal family,
 optional typed-outcome traversal direction, ordering and hierarchy
 participation, optional temporal order, incoming and outgoing cardinality,

package/docs/RELEASING.md

@@ -437,6 +437,12 @@ maintainer supplies
 pair that acknowledgement with migration guidance, compatible extension
 version bounds where applicable, and the next eligible date-based release.
 
+Build finalization removes redundant indentation from emitted `.d.ts` files
+([pm-chw71s](../.agents/pm/tasks/pm-chw71s.toon)). String and template type
+contents, comments, JSDoc, symbols and module boundaries retain their original
+tokens. Source declarations remain readable, and packed TypeScript consumers
+verify the emitted surface before publication. Artifact ceilings remain unchanged.
+
 5. Land the implementation through a reviewed pull request, then use hosted
    preparation for publication.
 

package/docs/SDK.md

@@ -1792,23 +1792,9 @@ Custom tools can evaluate the same behavior without shelling out:
 
 ```ts
 import {
-  runContextEvaluationCorpus, isReadOutputBudgetExceeded,
-  type ContextEvaluationReader,
+  runContextEvaluationCorpus,
 } from "@unbrained/pm-cli/sdk";
 
-const reader: ContextEvaluationReader = {
-  context: async options => {
-    const result = await pm.context(options);
-    if (isReadOutputBudgetExceeded(result)) throw new Error("Cannot grade omitted context");
-    return { ...result };
-  },
-  next: async options => {
-    const result = await pm.next(options);
-    if (isReadOutputBudgetExceeded(result)) throw new Error("Cannot grade omitted next");
-    return { ...result };
-  },
-};
-
 const report = await runContextEvaluationCorpus([{
   id: "returning-agent",
   surface: "context",
@@ -1818,16 +1804,21 @@ const report = await runContextEvaluationCorpus([{
   continuity_ids: ["pm-current", "pm-support"],
   token_budget: 1200,
   rationale: "Resume claimed work with its supporting context.",
-}], reader, {
+}], pm, {
   ndcg: 0.9, reciprocal_rank: 0.9, required_recall: 1,
   continuity_coverage: 1, token_budget_adherence: 1,
 });
 if (!report.passed) throw new Error(report.failures.join(", "));
 ```
 
-The adapter preserves the whole packet and refuses a universal budget omission
-before scoring. Direct reader-type composition is tracked by
+`PmClient` directly satisfies `ContextEvaluationReader`, including universal
+budget receipts. The evaluator preserves the complete packet and refuses
+whole-result omissions with `context_evaluation_read_incomplete` before scoring,
+including omissions caused by a shared session despite an unbounded per-read
+budget. Increase the budget or start a fresh session before retrying. Ordinary
+bounded row selection remains evaluable. Tracked by
 [pm-i4kxx1](../.agents/pm/tasks/pm-i4kxx1.toon).
+See [SDK consumer receipts](SDK_CONSUMER_RECEIPTS.md) for recovery and package-generation contracts.
 
 The evaluator calls only the public `context()` / `next()` reader contract. It
 scores nDCG, reciprocal rank, required-item recall, returning-agent continuity,
@@ -1990,6 +1981,40 @@ capability entry to add before publishing.
 
 ## Minimal Command Extension
 
+Read-only command handlers can opt into the host output contract with
+`read_output: { row_keys: ["items"] }`. This public declaration is tracked by
+[pm-extension-read-output-controls](../.agents/pm/features/pm-extension-read-output-controls.toon).
+It supports `outputInclude`, `outputLimit`, `outputBudget`, `outputFormat`,
+`outputSession`, `outputCursor`, and `outputRowContract` through CLI flags,
+`PmClient.run(action, { options })`, and MCP `pm_run`. Inspect the active
+command's flags and schemas with `pm contracts --command "<path>" --full`.
+
+```ts
+api.registerCommand({
+  name: "inventory rows",
+  read_output: { row_keys: ["items"] },
+  run: () => ({ items: [{ id: "asset-1", title: "Camera" }], count: 1, total: 1 }),
+});
+```
+
+The handler must return a structured object. Each declared path must contain
+an array or object map; paths may be nested, unique and non-overlapping. Use
+`row_keys: []` for a singleton result. Activation snapshots the declaration,
+and the host validates the returned collections before projecting them. Avoid
+reserved metadata and prototype property names. The declaration promises a
+read-only handler; writers and undeclared commands keep refusing read controls,
+and native commands/actions retain their existing contracts. A declaration
+cannot shadow native dispatch; choose a distinct package action.
+
+Receipts and continuation cursors identify the canonical extension command.
+Resume with the returned cursor and the same semantic inputs; changed rows
+refuse stale continuation. A budget that cannot fit useful content returns the
+shared `output_budget_exceeded` branch, and CLI exits 2. SDK consumers should
+check `isReadOutputBudgetExceeded` before treating the payload as their result.
+Packages can describe their own omitted groups with the existing
+`OutputProjectionDeclaration`; the host also discloses reductions caused by
+its output controls. JSON and TOON estimates include their receipts.
+
 ```ts
 import { defineExtension } from "@unbrained/pm-cli/sdk";
 
@@ -2645,6 +2670,22 @@ missing. Named expectations use `{ name }`; historical surface-specific aliases
 remain supported. Optional `extensionName` limits a match to one extension.
 The published surface snapshot contains the complete helper signatures.
 
+Output codecs are tracked by [pm-gh1462](../.agents/pm/features/pm-gh1462.toon).
+`decodeToon` and `encodeToon` use the exact TOON implementation shipped by the
+host. They are exported from `/sdk/testing` and `/sdk`, with `ToonDecodeOptions`,
+`ToonEncodeOptions` and `ToonJsonValue` types. Compare decoded values instead of
+matching spaces or quoted scalars, and retain strict decoder errors for malformed
+output:
+
+```ts
+import assert from "node:assert/strict";
+import { decodeToon, encodeToon } from "@unbrained/pm-cli/sdk/testing";
+
+const stdout = "status: open\n"; // Replace with captured host output.
+assert.deepEqual(decodeToon(stdout), { status: "open" });
+assert.deepEqual(decodeToon(encodeToon({ enabled: false })), { enabled: false });
+```
+
 Prefer `createExtensionTestHarness` when testing a package. Its bound methods
 select the correct registry, preventing accidental use of a command registry for
 hooks or services:
@@ -3102,6 +3143,9 @@ tracker and extension policy from any working directory.
 In-process callers of `runPmCli(args)` do not need to replace `process.argv`:
 usage and help recovery use the supplied invocation for command selection,
 tracker scope, extension policy and both text and JSON formatting.
+Eval hosts with no `process.argv[1]` also work: the CLI supplies an internal
+script label and preserves the host's argument array and exit status
+([pm-mor9pl](../.agents/pm/issues/pm-mor9pl.toon)).
 
 `runTest(id, { measure: [...] }, global)` requires `run: true`. A missing run
 returns `test_measure_requires_run` before linked-test mutation, with an executable

package/docs/SDK_CONSUMER_RECEIPTS.md

@@ -0,0 +1,67 @@
+# SDK Consumer Receipts
+
+Trackers: [pm-i4kxx1](../.agents/pm/tasks/pm-i4kxx1.toon),
+[pm-by83yj](../.agents/pm/issues/pm-by83yj.toon),
+[pm-distribution-consumer-lease](../.agents/pm/issues/pm-distribution-consumer-lease.toon),
+[pm-ty5i58](../.agents/pm/issues/pm-ty5i58.toon).
+
+Project management is context management: consumers must distinguish useful
+context from an omission and follow recoveries that the host can execute.
+
+`PmClient` directly implements `ContextEvaluationReader`. Structural readers can
+return their complete context or next packet plus universal read receipts.
+`runContextEvaluationScenario` refuses a universal budget-exceeded result or a
+whole-result omission in either `read_output` or `context_intent` before it
+computes ranking metrics. This also covers an exhausted shared output session
+when the individual read requests an unbounded budget. Reader refusals, including
+a completely exhausted session, propagate with their original diagnosis. Retry with an adequate
+budget or a fresh session. Ordinary bounded row selection is still evaluated;
+complete packets retain token accounting and served-item attribution.
+
+Core metadata is reserved from extension `--field` assignments. Create and
+update recoveries resolve actual flags from the command registration contracts,
+including aliases such as `--estimate` for `estimated_minutes`. Collection routes
+reuse the same mapping as structured item IO, such as `comments` to `--comment`
+and `type_options` to `--type-option`. Recovery names only declared mutation
+routes and retains the other required-option policy. A stored
+field does not imply a CLI flag. `external_ref` has no dedicated create/update
+CLI mutation flag; its refusal says so and points to the owning lifecycle,
+evidence, or importer API. Existing imported references remain readable and
+preserved. Extension authors should register a distinct field for custom data.
+The standalone SDK field parser also declines to invent host command flags.
+
+Typed schema customization also preserves the declared storage type.
+`PmClient.schemaAddField(name, { type: "number" })` and the functional
+`schemaAddField` export translate the documented `type` option to the schema
+action's `fieldType` input. Number and boolean registrations therefore retain
+those persisted types and their coercion rules. An omitted type still defaults
+to string. Generic `client.run("schema", ...)` consumers continue to use
+`fieldType`. Installed Node and Bun acceptance exercises registration, reads the
+persisted definitions, and creates typed custom values before evaluating context.
+Schema-managed fields use their declared dynamic create/update options: for
+example, `sdkNumeric: "7"` follows the generated `--sdk-numeric` option and stores
+the number `7`. Inspect the schema and command contracts for those names.
+Extension-registered fields use the separate `field` assignment collection.
+
+Distribution packing acquires the same checkout lease as builds and tests before
+reading manifests, inventorying source files, and staging the physical package.
+It retains the lease until packing finishes. A nested packer can reuse the
+consumer token only when its physical root matches the root named by the
+inherited lease receipt and the live owner's receipt validates. Validation runners supply
+`PM_BUILD_CONSUMER_LEASE_ROOT`; legacy tokens are scoped to the script workspace.
+Linked commands cannot override lease controls through stored environment
+directives. Snapshot and isolated execution clear both inherited lease variables,
+keeping source ownership and its workspace path outside those child contexts.
+Foreign workspaces acquire their own lease. An inherited owner path that no
+longer resolves also takes this independent path; it never authorizes token reuse.
+Interrupted builds retain an incomplete
+marker and are refused until a complete rebuild succeeds. Packing never steals
+a lease by age or removes another owner's receipt. Source-path checks, exact
+runtime-ledger verification, and lossless metadata staging remain enforced.
+
+`packDistribution` is an asynchronous repository helper; callers await its
+receipt. The CLI entrypoint also awaits it before reporting an artifact. The
+independent-process regression starts the real build entrypoint with owned
+fixture build stages, verifies contention against the producer's live receipt,
+and compares both archive files with the completed generation. Timing alone is
+not the overlap oracle.

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,12 +4,12 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 402
+- Catalog error codes: 405
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 383
-- Coverage fraction: 0.047264
+- Uncovered error codes: 386
+- Coverage fraction: 0.046914
 - Closed-domain probes: 19
 - Grammar probes: 117
 
@@ -55,12 +55,14 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `config_key_unknown` | `config_key_unknown` | uncovered | none | 0 |
 | `config_value_invalid` | `config_value_invalid` | uncovered | none | 0 |
 | `conflicting_lifecycle_owner` | `conflicting_lifecycle_owner` | uncovered | none | 0 |
+| `context_evaluation_read_incomplete` | `context_evaluation_read_incomplete` | uncovered | none | 0 |
 | `context_signal_store_invalid` | `context_signal_store_invalid` | uncovered | none | 0 |
 | `context_signal_store_stale` | `context_signal_store_stale` | uncovered | none | 0 |
 | `context_signal_store_write_failed` | `context_signal_store_write_failed` | uncovered | none | 0 |
 | `context_takes_no_item_argument` | `context_takes_no_item_argument` | uncovered | none | 0 |
 | `core_item_field_requires_dedicated_flag` | `core_item_field_requires_dedicated_flag` | uncovered | none | 0 |
 | `create_positional_type_without_title` | `create_positional_type_without_title` | uncovered | none | 0 |
+| `dependency_cardinality_created` | `dependency_cardinality_created` | uncovered | none | 0 |
 | `dependency_edge_not_allowed` | `dependency_edge_not_allowed` | uncovered | none | 0 |
 | `dependency_flag_value_invalid` | `dependency_flag_value_invalid` | uncovered | none | 0 |
 | `dependency_remove_no_match` | `dependency_remove_no_match` | uncovered | none | 0 |
@@ -97,6 +99,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `extension_mutation_guard_invalid_decision` | `extension_mutation_guard_invalid_decision` | uncovered | none | 0 |
 | `extension_mutation_guard_invalid_denial` | `extension_mutation_guard_invalid_denial` | uncovered | none | 0 |
 | `extension_mutation_guard_timed_out` | `extension_mutation_guard_timed_out` | uncovered | none | 0 |
+| `extension_read_output_invalid` | `extension_read_output_invalid` | uncovered | none | 0 |
 | `extension_update_health_partial_coverage` | `extension_update_health_partial_coverage` | uncovered | none | 0 |
 | `extensions_unreadable` | `extensions_unreadable` | uncovered | none | 0 |
 | `field_duplicate` | `field_duplicate` | uncovered | none | 0 |

package/marketplace.json

@@ -1 +1 @@
-{"name":"pm","owner":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"description":"Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.","version":"2026.10.12","plugins":[{"name":"pm-claude","source":"./plugins/pm-claude","description":"Native pm CLI integration for Claude Code — 32 MCP tools, 14 workflow skills with slash invocations, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.","version":"2026.10.12","author":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"homepage":"https://github.com/unbraind/pm-cli","repository":"https://github.com/unbraind/pm-cli","license":"MIT","keywords":["pm-cli","project-management","mcp","tasks","agents","workflows","git-native","task-tracker","ai"],"category":"productivity"}]}
+{"name":"pm","owner":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"description":"Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.","version":"2026.10.14","plugins":[{"name":"pm-claude","source":"./plugins/pm-claude","description":"Native pm CLI integration for Claude Code — 32 MCP tools, 14 workflow skills with slash invocations, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.","version":"2026.10.14","author":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"homepage":"https://github.com/unbraind/pm-cli","repository":"https://github.com/unbraind/pm-cli","license":"MIT","keywords":["pm-cli","project-management","mcp","tasks","agents","workflows","git-native","task-tracker","ai"],"category":"productivity"}]}

package/node_modules/@opentelemetry/core/build/esm/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "2.11.0";
+export declare const VERSION = "2.12.0";
 //# sourceMappingURL=version.d.ts.map

package/node_modules/@opentelemetry/core/build/esm/version.js

@@ -3,5 +3,5 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 // this is autogenerated file, see scripts/version-update.js
-export const VERSION = '2.11.0';
+export const VERSION = '2.12.0';
 //# sourceMappingURL=version.js.map

package/node_modules/@opentelemetry/core/build/esnext/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "2.11.0";
+export declare const VERSION = "2.12.0";
 //# sourceMappingURL=version.d.ts.map