@unbrained/pm-cli 2026.10.14 → 2026.10.15

package/dist/sdk/linked-artifacts.d.ts

@@ -3,137 +3,137 @@ import type { LinkScope } from "../types/index.js";
 /** Restricts linked artifact values accepted by command, SDK, and storage contracts. */
 export type LinkedArtifact = {
 /** Filesystem path used for path resolution. */
-path: string;
+path:string;
 /** Value that configures or reports scope for this contract. */
-scope: LinkScope;
+scope:LinkScope;
 /** Value that configures or reports note for this contract. */
-note?: string;
+note?:string;
 };
 /** Allowed CSV/markdown keys for each structured linked-artifact option (GH-258). */
-export declare const LINKED_ARTIFACT_ADD_KEYS: readonly ["path", "scope", "note"];
+export declare const LINKED_ARTIFACT_ADD_KEYS:readonly ["path","scope","note"];
 /** Public contract for linked artifact add glob keys, shared by SDK and presentation-layer consumers. */
-export declare const LINKED_ARTIFACT_ADD_GLOB_KEYS: readonly ["pattern", "glob", "path", "scope", "note"];
+export declare const LINKED_ARTIFACT_ADD_GLOB_KEYS:readonly ["pattern","glob","path","scope","note"];
 /** Public contract for linked artifact remove keys, shared by SDK and presentation-layer consumers. */
-export declare const LINKED_ARTIFACT_REMOVE_KEYS: readonly ["path"];
+export declare const LINKED_ARTIFACT_REMOVE_KEYS:readonly ["path"];
 /** Public contract for linked artifact migrate keys, shared by SDK and presentation-layer consumers. */
-export declare const LINKED_ARTIFACT_MIGRATE_KEYS: readonly ["from", "to"];
+export declare const LINKED_ARTIFACT_MIGRATE_KEYS:readonly ["from","to"];
 /** Documents the linked artifact command options payload exchanged by command, SDK, and package integrations. */
 export interface LinkedArtifactCommandOptions {
 /** Value that configures or reports add for this contract. */
-add?: string[];
+add?:string[];
 /** Value that configures or reports add glob for this contract. */
-addGlob?: string[];
+addGlob?:string[];
 /** Value that configures or reports remove for this contract. */
-remove?: string[];
+remove?:string[];
 /** Value that configures or reports migrate for this contract. */
-migrate?: string[];
+migrate?:string[];
 /** GH-170 (pm-pfnx): standalone note applied to every link added by --add / --add-glob in the same invocation. A per-entry embedded note (the `path=...,note=...` pair syntax) takes precedence over this flag. Requires at least one --add/--add-glob; rejected otherwise. */
-note?: string;
+note?:string;
 /** Value that configures or reports list for this contract. */
-list?: boolean;
+list?:boolean;
 /** Value that configures or reports append stable for this contract. */
-appendStable?: boolean;
+appendStable?:boolean;
 /** Value that configures or reports validate paths for this contract. */
-validatePaths?: boolean;
+validatePaths?:boolean;
 /** Value that configures or reports author for this contract. */
-author?: string;
+author?:string;
 /** Human-readable explanation suitable for logs and agent-facing output. */
-message?: string;
+message?:string;
 /** Value that configures or reports force for this contract. */
-force?: boolean;
+force?:boolean;
 }
 /** Documents the path migration payload exchanged by command, SDK, and package integrations. */
 export interface PathMigration {
 /** Value that configures or reports from for this contract. */
-from: string;
+from:string;
 /** Value that configures or reports to for this contract. */
-to: string;
+to:string;
 }
 /** Documents the add glob entry payload exchanged by command, SDK, and package integrations. */
 export interface AddGlobEntry {
 /** Value that configures or reports pattern for this contract. */
-pattern: string;
+pattern:string;
 /** Value that configures or reports scope for this contract. */
-scope: LinkScope;
+scope:LinkScope;
 /** Value that configures or reports note for this contract. */
-note?: string;
+note?:string;
 }
 /** Documents the linked path validation payload exchanged by command, SDK, and package integrations. */
 export interface LinkedPathValidation {
 /** Value that configures or reports checked for this contract. */
-checked: number;
+checked:number;
 /** Value that configures or reports existing files for this contract. */
-existing_files: string[];
+existing_files:string[];
 /** Value that configures or reports missing paths for this contract. */
-missing_paths: string[];
+missing_paths:string[];
 /** Value that configures or reports non file paths for this contract. */
-non_file_paths: string[];
+non_file_paths:string[];
 /** Remote references (https:// URLs and other `scheme://` paths) recorded as links — most often a PR/issue/design-doc URL added via `pm docs --add`. These are not local files, so they bypass the existence probe and are reported here rather than counted as missing. */
-remote_references: string[];
+remote_references:string[];
 }
 /** Documents the linked artifact result payload exchanged by command, SDK, and package integrations. */
 export interface LinkedArtifactResult {
 /** Stable identifier used to reference this record across commands and storage. */
-id: string;
+id:string;
 /** Value that configures or reports changed for this contract. */
-changed: boolean;
+changed:boolean;
 /** Value that configures or reports count for this contract. */
-count: number;
+count:number;
 /** Value that configures or reports migrations applied for this contract. */
-migrations_applied?: number;
+migrations_applied?:number;
 /** Value that configures or reports validation for this contract. */
-validation?: LinkedPathValidation;
+validation?:LinkedPathValidation;
 /** Value that configures or reports artifacts for this contract. */
-artifacts: LinkedArtifact[];
+artifacts:LinkedArtifact[];
 }
 /** Replaces the generic artifacts field with a resource-specific result key while retaining the remaining result contract. */
-export type RenamedLinkedArtifactResult<Result extends LinkedArtifactResult, Key extends "files" | "docs"> = Omit<Result, "artifacts"> & {
-[Field in Key]: Result["artifacts"];
+export type RenamedLinkedArtifactResult<Result extends LinkedArtifactResult,Key extends "files" | "docs"> = Omit<Result,"artifacts"> & {
+[Field in Key]:Result["artifacts"];
 };
 /** Configuration that adapts the shared linked-artifact command core to a specific resource kind (files or docs) while preserving every behavioral detail of the original twin implementations. */
 export interface LinkedArtifactKindConfig {
 /** Metadata key under which the artifacts are stored (e.g. "files" | "docs"). */
-metadataKey: "files" | "docs";
+metadataKey:"files" | "docs";
 /** Mutation op recorded in history (e.g. "files_add" | "docs_add"). */
-op: "files_add" | "docs_add";
+op:"files_add" | "docs_add";
 /** Noun used in the "bare <noun> path" --add usage error (e.g. "file" | "doc"). */
-bareNoun: "file" | "doc";
+bareNoun:"file" | "doc";
 /** Whether this kind honors the append-stable option. files supports it; docs always sorts and must never expose append-stable behavior. */
-supportsAppendStable: boolean;
+supportsAppendStable:boolean;
 }
 /** Implements ensure scope for the public runtime surface of this module. */
-export declare function ensureScope(raw: string | undefined): LinkScope;
+export declare function ensureScope(raw:string | undefined):LinkScope;
 /** Implements looks like structured path entry for the public runtime surface of this module. */
-export declare function looksLikeStructuredPathEntry(raw: string): boolean;
+export declare function looksLikeStructuredPathEntry(raw:string):boolean;
 /** Implements parse add entries for the public runtime surface of this module. */
-export declare function parseAddEntries(raw: string[] | undefined, bareNoun: "file" | "doc"): LinkedArtifact[];
+export declare function parseAddEntries(raw:string[] | undefined,bareNoun:"file" | "doc"):LinkedArtifact[];
 /** Implements parse add glob entries for the public runtime surface of this module. */
-export declare function parseAddGlobEntries(raw: string[] | undefined): AddGlobEntry[];
+export declare function parseAddGlobEntries(raw:string[] | undefined):AddGlobEntry[];
 /** Implements parse remove entries for the public runtime surface of this module. */
-export declare function parseRemoveEntries(raw: string[] | undefined): string[];
+export declare function parseRemoveEntries(raw:string[] | undefined):string[];
 /** Implements parse migrate entries for the public runtime surface of this module. */
-export declare function parseMigrateEntries(raw: string[] | undefined): PathMigration[];
+export declare function parseMigrateEntries(raw:string[] | undefined):PathMigration[];
 /** Implements apply path migrations for the public runtime surface of this module. */
-export declare function applyPathMigrations(artifactPath: string, migrations: PathMigration[]): string;
+export declare function applyPathMigrations(artifactPath:string,migrations:PathMigration[]):string;
 /** Reject a transaction that resolves the same linked path into both add and remove sets. */
-export declare function assertLinkedArtifactMutationIsUnambiguous(adds: LinkedArtifact[], removes: string[], migrations?: PathMigration[]): void;
+export declare function assertLinkedArtifactMutationIsUnambiguous(adds:LinkedArtifact[],removes:string[],migrations?:PathMigration[]):void;
 /** Implements normalize linked path for the public runtime surface of this module. */
-export declare function normalizeLinkedPath(value: string): string;
+export declare function normalizeLinkedPath(value:string):string;
 /** Anchor a local linked path to the project workspace while preserving remote references and absolute paths. */
-export declare function anchorLinkedPath(value: string, workspaceRoot: string, invocationRoot?: string): string;
+export declare function anchorLinkedPath(value:string,workspaceRoot:string,invocationRoot?:string):string;
 /** Match files from the invocation directory, then anchor and sort each entry while retaining its scope and note. Literal directories never expand recursively. */
-export declare function expandAddGlobEntries(entries: AddGlobEntry[], workspaceRoot?: string, invocationRoot?: string): Promise<LinkedArtifact[]>;
+export declare function expandAddGlobEntries(entries:AddGlobEntry[],workspaceRoot?:string,invocationRoot?:string):Promise<LinkedArtifact[]>;
 /** GH-170 (pm-pfnx): apply a standalone --note to the links added in this invocation. Semantics (documented on pm-pfnx): the note is attached to EVERY entry added via --add/--add-glob so a single flag annotates the whole batch predictably; a per-entry embedded `note=` wins over the standalone flag; and --note without any --add/--add-glob flag is a usage error because there is nothing to annotate (it never retro-edits existing links). `hasAddFlags` reflects flag presence, not match count, so a glob that legitimately matches zero files is not an error. */
-export declare function applyStandaloneNote(adds: LinkedArtifact[], note: string | undefined, hasAddFlags: boolean): LinkedArtifact[];
+export declare function applyStandaloneNote(adds:LinkedArtifact[],note:string | undefined,hasAddFlags:boolean):LinkedArtifact[];
 /** Implements artifact key for the public runtime surface of this module. */
-export declare function artifactKey(value: Pick<LinkedArtifact, "path" | "scope">): string;
+export declare function artifactKey(value:Pick<LinkedArtifact,"path" | "scope">):string;
 /** Implements sort linked artifacts for the public runtime surface of this module. */
-export declare function sortLinkedArtifacts(artifacts: LinkedArtifact[]): LinkedArtifact[];
+export declare function sortLinkedArtifacts(artifacts:LinkedArtifact[]):LinkedArtifact[];
 /** Implements dedupe linked artifacts for the public runtime surface of this module. */
-export declare function dedupeLinkedArtifacts(artifacts: LinkedArtifact[]): LinkedArtifact[];
+export declare function dedupeLinkedArtifacts(artifacts:LinkedArtifact[]):LinkedArtifact[];
 /** Implements validate linked paths for the public runtime surface of this module. */
-export declare function validateLinkedPaths(paths: string[], workspaceRoot?: string): Promise<LinkedPathValidation>;
+export declare function validateLinkedPaths(paths:string[],workspaceRoot?:string):Promise<LinkedPathValidation>;
 /** Shared linked-artifact list/mutate command core used by runFiles and runDocs. The kind config selects metadata key, op, bare-path noun, and whether append-stable ordering is honored, preserving each twin's exact semantics. */
-export declare function runLinkedArtifacts(id: string, options: LinkedArtifactCommandOptions, global: GlobalOptions, config: LinkedArtifactKindConfig): Promise<LinkedArtifactResult>;
+export declare function runLinkedArtifacts(id:string,options:LinkedArtifactCommandOptions,global:GlobalOptions,config:LinkedArtifactKindConfig):Promise<LinkedArtifactResult>;
 /** Re-key the generic `artifacts` field to the resource-specific name (files/docs) while preserving the original key order and presence so kind-specific result shapes (and their deterministic JSON key ordering) stay byte-identical. */
-export declare function renameArtifactsResultKey<Result extends LinkedArtifactResult, const Key extends "files" | "docs">(result: Result, key: Key): RenamedLinkedArtifactResult<Result, Key>;
+export declare function renameArtifactsResultKey<Result extends LinkedArtifactResult,const Key extends "files" | "docs">(result:Result,key:Key):RenamedLinkedArtifactResult<Result,Key>;

package/dist/sdk/mcp/apps.d.ts

@@ -1,64 +1,64 @@
 import { type PmMcpRequestContext } from "./protocol.js";
 interface McpUiToolMeta {
 /** MCP App resource displayed for this tool. */
-resourceUri: string;
+resourceUri:string;
 /** Principals allowed to discover and invoke the tool. */
-visibility: Array<"model" | "app">;
+visibility:Array<"model" | "app">;
 }
 interface McpUiResourceMeta {
 /** Explicitly bounded network and embedding policy. */
-csp: {
-connectDomains: string[];
-resourceDomains: string[];
-frameDomains: string[];
+csp:{
+connectDomains:string[];
+resourceDomains:string[];
+frameDomains:string[];
 };
 /** Browser permissions requested by the app. */
-permissions: Record<string, never>;
+permissions:Record<string,never>;
 /** Whether the host should present a visible app boundary. */
-prefersBorder: boolean;
+prefersBorder:boolean;
 }
 /** Stable MCP Apps extension identifier. */
-export declare const PM_MCP_APPS_EXTENSION: "io.modelcontextprotocol/ui";
+export declare const PM_MCP_APPS_EXTENSION:"io.modelcontextprotocol/ui";
 /** Stable MCP Apps specification revision implemented by pm. */
-export declare const PM_MCP_APPS_SPEC_VERSION: "2026-01-26";
+export declare const PM_MCP_APPS_SPEC_VERSION:"2026-01-26";
 /** Official MIME type for MCP App HTML resources. */
-export declare const PM_MCP_APP_MIME_TYPE: "text/html;profile=mcp-app";
+export declare const PM_MCP_APP_MIME_TYPE:"text/html;profile=mcp-app";
 /** Server-side MCP Apps capability advertised through discovery. */
-export declare const PM_MCP_APPS_SERVER_CAPABILITY: Readonly<{
-specVersion: "2026-01-26";
-mimeTypes: "text/html;profile=mcp-app"[];
+export declare const PM_MCP_APPS_SERVER_CAPABILITY:Readonly<{
+specVersion:"2026-01-26";
+mimeTypes:"text/html;profile=mcp-app"[];
 }>;
 /**
  * Resolve whether a request negotiated MCP Apps, rejecting malformed explicit
  * declarations instead of silently serving a different extension revision.
  */
-export declare function hasPmMcpAppsCapability(context: PmMcpRequestContext): boolean;
+export declare function hasPmMcpAppsCapability(context:PmMcpRequestContext):boolean;
 /** One optional pm view and the authoritative tool that supplies its data. */
 export interface PmMcpAppContract {
 /** Stable view identifier. */
-id: "context" | "graph" | "plan" | "assurance" | "operations";
+id:"context" | "graph" | "plan" | "assurance" | "operations";
 /** Human-readable view name. */
-name: string;
+name:string;
 /** Concise purpose shown during resource discovery. */
-description: string;
+description:string;
 /** Existing SDK-backed tool whose result the view renders. */
-toolName: string;
+toolName:string;
 /** Stable MCP App resource URI. */
-uri: string;
+uri:string;
 /** Tool metadata validated against the official MCP Apps package types. */
-toolMeta: McpUiToolMeta;
+toolMeta:McpUiToolMeta;
 /** Resource sandbox and presentation metadata. */
-resourceMeta: McpUiResourceMeta;
+resourceMeta:McpUiResourceMeta;
 }
 /** Canonical optional pm MCP Apps. */
-export declare const PM_MCP_APP_CONTRACTS: readonly PmMcpAppContract[];
+export declare const PM_MCP_APP_CONTRACTS:readonly PmMcpAppContract[];
 /** Return the app contract for a resource URI. */
-export declare function findPmMcpAppByUri(uri: string): PmMcpAppContract | undefined;
+export declare function findPmMcpAppByUri(uri:string):PmMcpAppContract | undefined;
 /** Attach negotiated MCP App metadata to matching tool definitions. */
 export declare function decoratePmMcpToolsWithApps<Tool extends {
-name: string;
-_meta?: Record<string, unknown>;
-}>(tools: readonly Tool[]): Tool[];
+name:string;
+_meta?:Record<string,unknown>;
+}>(tools:readonly Tool[]):Tool[];
 /**
  * Render a self-contained, sandbox-compatible MCP App document.
  *
@@ -66,5 +66,5 @@ _meta?: Record<string, unknown>;
  * the authoritative tool input/result from the host, bounds large rendering,
  * and presents the text fallback when structured content is unavailable.
  */
-export declare function renderPmMcpAppHtml(contract: PmMcpAppContract): string;
+export declare function renderPmMcpAppHtml(contract:PmMcpAppContract):string;
 export {};

package/dist/sdk/mcp/authorization.d.ts

@@ -2,133 +2,133 @@ import type { PmMcpHttpHeaders } from "./transport.js";
 /** Authorization failure with an HTTP status and disclosure-safe context. */
 export declare class PmMcpAuthorizationError extends Error {
 /** HTTP status required at the remote MCP boundary. */
-readonly httpStatus: 401 | 403;
+readonly httpStatus:401 | 403;
 /** Optional RFC 6750 challenge safe to send to an unauthenticated client. */
-readonly challenge?: string;
+readonly challenge?:string;
 /** Create one remote authorization refusal. */
-constructor(message: string, httpStatus: 401 | 403, challenge?: string);
+constructor(message:string,httpStatus:401 | 403,challenge?:string);
 }
 /** RFC 9728 metadata served by a protected pm MCP resource. */
 export interface PmMcpProtectedResourceMetadata {
 /** Canonical MCP resource URI used for token audience binding. */
-resource: string;
+resource:string;
 /** Independent authorization-server issuers accepted by this resource. */
-authorization_servers: string[];
+authorization_servers:string[];
 /** Minimal scopes used for initial least-privilege authorization. */
-scopes_supported?: string[];
+scopes_supported?:string[];
 }
 /** Validated authorization-server discovery fields needed by MCP clients. */
 export interface PmMcpAuthorizationServerMetadata {
 /** Exact issuer identifier. */
-issuer: string;
+issuer:string;
 /** Authorization endpoint for code flows. */
-authorization_endpoint?: string;
+authorization_endpoint?:string;
 /** Token endpoint used to redeem authorization codes. */
-token_endpoint?: string;
+token_endpoint?:string;
 /** PKCE methods advertised by the authorization server. */
-code_challenge_methods_supported: string[];
+code_challenge_methods_supported:string[];
 /** Whether URL-form Client ID Metadata Documents are supported. */
-client_id_metadata_document_supported?: boolean;
+client_id_metadata_document_supported?:boolean;
 /** Deprecated dynamic-registration fallback endpoint. */
-registration_endpoint?: string;
+registration_endpoint?:string;
 }
 /** Discovery metadata after endpoint and PKCE validation succeeds. */
 export interface PmMcpValidatedAuthorizationServerMetadata extends PmMcpAuthorizationServerMetadata {
 /** Validated HTTPS authorization endpoint for code flows. */
-authorization_endpoint: string;
+authorization_endpoint:string;
 /** Validated HTTPS token endpoint used to redeem authorization codes. */
-token_endpoint: string;
+token_endpoint:string;
 }
 /** Client registration strategy ordered by current MCP preference. */
 export type PmMcpClientRegistrationMode = "pre_registered" | "client_id_metadata_document" | "dynamic" | "user_supplied";
 /** Bound access-token facts returned by a host-provided verifier. */
 export interface PmMcpAccessTokenClaims {
 /** Stable authenticated principal without raw token material. */
-principal: string;
+principal:string;
 /** Issuer that minted the token. */
-issuer: string;
+issuer:string;
 /** Intended resource audiences. */
-audience: string | string[];
+audience:string | string[];
 /** Granted OAuth scopes. */
-scopes: string[];
+scopes:string[];
 }
 /** Policy a Streamable HTTP adapter enforces before dispatching MCP. */
 export interface PmMcpHttpAuthorizationPolicy {
 /** Exact accepted issuer. */
-issuer: string;
+issuer:string;
 /** Exact canonical MCP resource audience. */
-resource: string;
+resource:string;
 /** Scopes required for this endpoint or operation. */
-requiredScopes?: string[];
+requiredScopes?:string[];
 /** Protected-resource metadata location for RFC 6750 challenges. */
-resourceMetadataUrl: string;
+resourceMetadataUrl:string;
 /** Validate an opaque or structured access token without passing it onward. */
-verifyAccessToken: (token: string) => PmMcpAccessTokenClaims | Promise<PmMcpAccessTokenClaims>;
+verifyAccessToken:(token:string) => PmMcpAccessTokenClaims | Promise<PmMcpAccessTokenClaims>;
 }
 /** W3C trace context accepted from request `_meta`. */
 export interface PmMcpTraceContext {
 /** W3C trace-parent value. */
-traceparent?: string;
+traceparent?:string;
 /** W3C trace-state value. */
-tracestate?: string;
+tracestate?:string;
 /** Allowlisted W3C baggage members only. */
-baggage?: string;
+baggage?:string;
 }
 /** Build and validate protected-resource metadata for a remote pm endpoint. */
-export declare function buildMcpProtectedResourceMetadata(input: {
-resource: string;
-authorizationServers: readonly string[];
-scopes?: readonly string[];
-}): PmMcpProtectedResourceMetadata;
+export declare function buildMcpProtectedResourceMetadata(input:{
+resource:string;
+authorizationServers:readonly string[];
+scopes?:readonly string[];
+}):PmMcpProtectedResourceMetadata;
 /** Construct OAuth and OIDC discovery URLs in the MCP-required order. */
-export declare function buildMcpAuthorizationDiscoveryUrls(issuer: string): string[];
+export declare function buildMcpAuthorizationDiscoveryUrls(issuer:string):string[];
 /** Validate authorization-server metadata, exact issuer binding, and S256 PKCE. */
-export declare function validateMcpAuthorizationServerMetadata(value: unknown, expectedIssuer: string): PmMcpValidatedAuthorizationServerMetadata;
+export declare function validateMcpAuthorizationServerMetadata(value:unknown,expectedIssuer:string):PmMcpValidatedAuthorizationServerMetadata;
 /** Apply the current pre-registration, metadata-document, dynamic, prompt order. */
-export declare function selectMcpClientRegistrationMode(input: {
-hasPreRegisteredClient: boolean;
-metadata: Pick<PmMcpAuthorizationServerMetadata, "client_id_metadata_document_supported" | "registration_endpoint">;
-}): PmMcpClientRegistrationMode;
+export declare function selectMcpClientRegistrationMode(input:{
+hasPreRegisteredClient:boolean;
+metadata:Pick<PmMcpAuthorizationServerMetadata,"client_id_metadata_document_supported" | "registration_endpoint">;
+}):PmMcpClientRegistrationMode;
 /** Validate a present authorization-response issuer before code redemption. */
-export declare function validateMcpAuthorizationResponseIssuer(input: {
-expectedIssuer: string;
-responseIssuer?: string;
-issuerParameterSupported?: boolean;
-}): void;
+export declare function validateMcpAuthorizationResponseIssuer(input:{
+expectedIssuer:string;
+responseIssuer?:string;
+issuerParameterSupported?:boolean;
+}):void;
 /** Validate a self-hosted Client ID Metadata Document and exact redirect set. */
-export declare function validateMcpClientMetadataDocument(value: unknown, documentUrl: string): Record<string, unknown>;
+export declare function validateMcpClientMetadataDocument(value:unknown,documentUrl:string):Record<string,unknown>;
 /** Build bounded dynamic-registration metadata for explicit legacy fallback. */
-export declare function buildMcpDynamicRegistrationMetadata(input: {
-redirectUris: readonly string[];
-applicationType: "native" | "web";
-clientName: string;
-}): Record<string, unknown>;
+export declare function buildMcpDynamicRegistrationMetadata(input:{
+redirectUris:readonly string[];
+applicationType:"native" | "web";
+clientName:string;
+}):Record<string,unknown>;
 /** In-memory issuer-keyed credential primitive that never reuses cross-issuer state. */
-export declare class PmMcpIssuerCredentialStore<Credential extends Record<string, unknown>> {
+export declare class PmMcpIssuerCredentialStore<Credential extends Record<string,unknown>> {
 #private;
 /** Persist a cloned credential under the exact validated issuer. */
-set(issuer: string, credential: Credential): void;
+set(issuer:string,credential:Credential):void;
 /** Read a cloned credential only for the exact issuer. */
-get(issuer: string): Credential | undefined;
+get(issuer:string):Credential | undefined;
 /** Remove credentials for one issuer during revocation or re-registration. */
-delete(issuer: string): boolean;
+delete(issuer:string):boolean;
 }
 /** Extract W3C trace context with strict syntax, size, and baggage allowlists. */
-export declare function extractMcpTraceContext(params: unknown, options?: {
-baggageAllowlist?: readonly string[];
-}): PmMcpTraceContext;
+export declare function extractMcpTraceContext(params:unknown,options?:{
+baggageAllowlist?:readonly string[];
+}):PmMcpTraceContext;
 /** Run one request with trace context isolated from every concurrent request. */
-export declare function runWithMcpTraceContext<Result>(context: PmMcpTraceContext, callback: () => Result): Result;
+export declare function runWithMcpTraceContext<Result>(context:PmMcpTraceContext,callback:() => Result):Result;
 /** Read a defensive copy of the current request's trace context. */
-export declare function getActiveMcpTraceContext(): PmMcpTraceContext | undefined;
+export declare function getActiveMcpTraceContext():PmMcpTraceContext | undefined;
 /** Enforce bearer location, issuer, audience, and least-privilege scopes. */
-export declare function authorizeMcpHttpRequest(input: {
-headers: PmMcpHttpHeaders;
-requestUrl: string;
-policy: PmMcpHttpAuthorizationPolicy;
-}): Promise<PmMcpAccessTokenClaims>;
+export declare function authorizeMcpHttpRequest(input:{
+headers:PmMcpHttpHeaders;
+requestUrl:string;
+policy:PmMcpHttpAuthorizationPolicy;
+}):Promise<PmMcpAccessTokenClaims>;
 /** Create an exact opaque-token verifier without exposing token values in results. */
-export declare function createMcpStaticBearerVerifier(input: {
-token: string;
-claims: PmMcpAccessTokenClaims;
-}): (token: string) => PmMcpAccessTokenClaims;
+export declare function createMcpStaticBearerVerifier(input:{
+token:string;
+claims:PmMcpAccessTokenClaims;
+}):(token:string) => PmMcpAccessTokenClaims;