@unbrained/pm-cli 2026.10.14 → 2026.10.17

package/dist/sdk/mcp/authorization.d.ts

@@ -2,133 +2,133 @@ import type { PmMcpHttpHeaders } from "./transport.js";
 /** Authorization failure with an HTTP status and disclosure-safe context. */
 export declare class PmMcpAuthorizationError extends Error {
 /** HTTP status required at the remote MCP boundary. */
-readonly httpStatus: 401 | 403;
+readonly httpStatus:401 | 403;
 /** Optional RFC 6750 challenge safe to send to an unauthenticated client. */
-readonly challenge?: string;
+readonly challenge?:string;
 /** Create one remote authorization refusal. */
-constructor(message: string, httpStatus: 401 | 403, challenge?: string);
+constructor(message:string,httpStatus:401 | 403,challenge?:string);
 }
 /** RFC 9728 metadata served by a protected pm MCP resource. */
 export interface PmMcpProtectedResourceMetadata {
 /** Canonical MCP resource URI used for token audience binding. */
-resource: string;
+resource:string;
 /** Independent authorization-server issuers accepted by this resource. */
-authorization_servers: string[];
+authorization_servers:string[];
 /** Minimal scopes used for initial least-privilege authorization. */
-scopes_supported?: string[];
+scopes_supported?:string[];
 }
 /** Validated authorization-server discovery fields needed by MCP clients. */
 export interface PmMcpAuthorizationServerMetadata {
 /** Exact issuer identifier. */
-issuer: string;
+issuer:string;
 /** Authorization endpoint for code flows. */
-authorization_endpoint?: string;
+authorization_endpoint?:string;
 /** Token endpoint used to redeem authorization codes. */
-token_endpoint?: string;
+token_endpoint?:string;
 /** PKCE methods advertised by the authorization server. */
-code_challenge_methods_supported: string[];
+code_challenge_methods_supported:string[];
 /** Whether URL-form Client ID Metadata Documents are supported. */
-client_id_metadata_document_supported?: boolean;
+client_id_metadata_document_supported?:boolean;
 /** Deprecated dynamic-registration fallback endpoint. */
-registration_endpoint?: string;
+registration_endpoint?:string;
 }
 /** Discovery metadata after endpoint and PKCE validation succeeds. */
 export interface PmMcpValidatedAuthorizationServerMetadata extends PmMcpAuthorizationServerMetadata {
 /** Validated HTTPS authorization endpoint for code flows. */
-authorization_endpoint: string;
+authorization_endpoint:string;
 /** Validated HTTPS token endpoint used to redeem authorization codes. */
-token_endpoint: string;
+token_endpoint:string;
 }
 /** Client registration strategy ordered by current MCP preference. */
 export type PmMcpClientRegistrationMode = "pre_registered" | "client_id_metadata_document" | "dynamic" | "user_supplied";
 /** Bound access-token facts returned by a host-provided verifier. */
 export interface PmMcpAccessTokenClaims {
 /** Stable authenticated principal without raw token material. */
-principal: string;
+principal:string;
 /** Issuer that minted the token. */
-issuer: string;
+issuer:string;
 /** Intended resource audiences. */
-audience: string | string[];
+audience:string | string[];
 /** Granted OAuth scopes. */
-scopes: string[];
+scopes:string[];
 }
 /** Policy a Streamable HTTP adapter enforces before dispatching MCP. */
 export interface PmMcpHttpAuthorizationPolicy {
 /** Exact accepted issuer. */
-issuer: string;
+issuer:string;
 /** Exact canonical MCP resource audience. */
-resource: string;
+resource:string;
 /** Scopes required for this endpoint or operation. */
-requiredScopes?: string[];
+requiredScopes?:string[];
 /** Protected-resource metadata location for RFC 6750 challenges. */
-resourceMetadataUrl: string;
+resourceMetadataUrl:string;
 /** Validate an opaque or structured access token without passing it onward. */
-verifyAccessToken: (token: string) => PmMcpAccessTokenClaims | Promise<PmMcpAccessTokenClaims>;
+verifyAccessToken:(token:string) => PmMcpAccessTokenClaims | Promise<PmMcpAccessTokenClaims>;
 }
 /** W3C trace context accepted from request `_meta`. */
 export interface PmMcpTraceContext {
 /** W3C trace-parent value. */
-traceparent?: string;
+traceparent?:string;
 /** W3C trace-state value. */
-tracestate?: string;
+tracestate?:string;
 /** Allowlisted W3C baggage members only. */
-baggage?: string;
+baggage?:string;
 }
 /** Build and validate protected-resource metadata for a remote pm endpoint. */
-export declare function buildMcpProtectedResourceMetadata(input: {
-resource: string;
-authorizationServers: readonly string[];
-scopes?: readonly string[];
-}): PmMcpProtectedResourceMetadata;
+export declare function buildMcpProtectedResourceMetadata(input:{
+resource:string;
+authorizationServers:readonly string[];
+scopes?:readonly string[];
+}):PmMcpProtectedResourceMetadata;
 /** Construct OAuth and OIDC discovery URLs in the MCP-required order. */
-export declare function buildMcpAuthorizationDiscoveryUrls(issuer: string): string[];
+export declare function buildMcpAuthorizationDiscoveryUrls(issuer:string):string[];
 /** Validate authorization-server metadata, exact issuer binding, and S256 PKCE. */
-export declare function validateMcpAuthorizationServerMetadata(value: unknown, expectedIssuer: string): PmMcpValidatedAuthorizationServerMetadata;
+export declare function validateMcpAuthorizationServerMetadata(value:unknown,expectedIssuer:string):PmMcpValidatedAuthorizationServerMetadata;
 /** Apply the current pre-registration, metadata-document, dynamic, prompt order. */
-export declare function selectMcpClientRegistrationMode(input: {
-hasPreRegisteredClient: boolean;
-metadata: Pick<PmMcpAuthorizationServerMetadata, "client_id_metadata_document_supported" | "registration_endpoint">;
-}): PmMcpClientRegistrationMode;
+export declare function selectMcpClientRegistrationMode(input:{
+hasPreRegisteredClient:boolean;
+metadata:Pick<PmMcpAuthorizationServerMetadata,"client_id_metadata_document_supported" | "registration_endpoint">;
+}):PmMcpClientRegistrationMode;
 /** Validate a present authorization-response issuer before code redemption. */
-export declare function validateMcpAuthorizationResponseIssuer(input: {
-expectedIssuer: string;
-responseIssuer?: string;
-issuerParameterSupported?: boolean;
-}): void;
+export declare function validateMcpAuthorizationResponseIssuer(input:{
+expectedIssuer:string;
+responseIssuer?:string;
+issuerParameterSupported?:boolean;
+}):void;
 /** Validate a self-hosted Client ID Metadata Document and exact redirect set. */
-export declare function validateMcpClientMetadataDocument(value: unknown, documentUrl: string): Record<string, unknown>;
+export declare function validateMcpClientMetadataDocument(value:unknown,documentUrl:string):Record<string,unknown>;
 /** Build bounded dynamic-registration metadata for explicit legacy fallback. */
-export declare function buildMcpDynamicRegistrationMetadata(input: {
-redirectUris: readonly string[];
-applicationType: "native" | "web";
-clientName: string;
-}): Record<string, unknown>;
+export declare function buildMcpDynamicRegistrationMetadata(input:{
+redirectUris:readonly string[];
+applicationType:"native" | "web";
+clientName:string;
+}):Record<string,unknown>;
 /** In-memory issuer-keyed credential primitive that never reuses cross-issuer state. */
-export declare class PmMcpIssuerCredentialStore<Credential extends Record<string, unknown>> {
+export declare class PmMcpIssuerCredentialStore<Credential extends Record<string,unknown>> {
 #private;
 /** Persist a cloned credential under the exact validated issuer. */
-set(issuer: string, credential: Credential): void;
+set(issuer:string,credential:Credential):void;
 /** Read a cloned credential only for the exact issuer. */
-get(issuer: string): Credential | undefined;
+get(issuer:string):Credential | undefined;
 /** Remove credentials for one issuer during revocation or re-registration. */
-delete(issuer: string): boolean;
+delete(issuer:string):boolean;
 }
 /** Extract W3C trace context with strict syntax, size, and baggage allowlists. */
-export declare function extractMcpTraceContext(params: unknown, options?: {
-baggageAllowlist?: readonly string[];
-}): PmMcpTraceContext;
+export declare function extractMcpTraceContext(params:unknown,options?:{
+baggageAllowlist?:readonly string[];
+}):PmMcpTraceContext;
 /** Run one request with trace context isolated from every concurrent request. */
-export declare function runWithMcpTraceContext<Result>(context: PmMcpTraceContext, callback: () => Result): Result;
+export declare function runWithMcpTraceContext<Result>(context:PmMcpTraceContext,callback:() => Result):Result;
 /** Read a defensive copy of the current request's trace context. */
-export declare function getActiveMcpTraceContext(): PmMcpTraceContext | undefined;
+export declare function getActiveMcpTraceContext():PmMcpTraceContext | undefined;
 /** Enforce bearer location, issuer, audience, and least-privilege scopes. */
-export declare function authorizeMcpHttpRequest(input: {
-headers: PmMcpHttpHeaders;
-requestUrl: string;
-policy: PmMcpHttpAuthorizationPolicy;
-}): Promise<PmMcpAccessTokenClaims>;
+export declare function authorizeMcpHttpRequest(input:{
+headers:PmMcpHttpHeaders;
+requestUrl:string;
+policy:PmMcpHttpAuthorizationPolicy;
+}):Promise<PmMcpAccessTokenClaims>;
 /** Create an exact opaque-token verifier without exposing token values in results. */
-export declare function createMcpStaticBearerVerifier(input: {
-token: string;
-claims: PmMcpAccessTokenClaims;
-}): (token: string) => PmMcpAccessTokenClaims;
+export declare function createMcpStaticBearerVerifier(input:{
+token:string;
+claims:PmMcpAccessTokenClaims;
+}):(token:string) => PmMcpAccessTokenClaims;

package/dist/sdk/mcp/discovery.d.ts

@@ -1,147 +1,147 @@
-import { type PmCommandCapabilityFamily, type PmCommandVisibilityTier, type PmMcpToolProfile } from "../agent-capability-contracts.js";
+import { type PmCommandCapabilityFamily,type PmCommandVisibilityTier,type PmMcpToolProfile } from "../agent-capability-contracts.js";
 /** Namespaced MCP extension that opts a client into progressive tool discovery. */
 export declare const PM_MCP_PROGRESSIVE_DISCOVERY_EXTENSION = "dev.unbrained.pm/progressive-tool-discovery";
 /** Versioned server capability advertised for progressive tool discovery. */
-export declare const PM_MCP_PROGRESSIVE_DISCOVERY_SERVER_CAPABILITY: Readonly<{
-version: 1;
-discoveryTool: "pm_discover";
-canonicalResult: "structuredContent.result";
-compatibilityText: "pointer";
+export declare const PM_MCP_PROGRESSIVE_DISCOVERY_SERVER_CAPABILITY:Readonly<{
+version:1;
+discoveryTool:"pm_discover";
+canonicalResult:"structuredContent.result";
+compatibilityText:"pointer";
 }>;
 /** Small stable tool catalog returned to clients that negotiate the extension. */
-export declare const PM_MCP_ENTRY_TOOL_NAMES: readonly string[];
+export declare const PM_MCP_ENTRY_TOOL_NAMES:readonly string[];
 /** Ranking signals composed by the public discovery contract. */
 export type PmToolDiscoverySignalName = "lexical" | "semantic" | "graph" | "permission" | "freshness" | "usage";
 /** Optional host-owned signals supplied for one tool. */
 export interface PmToolDiscoverySignalInput {
 /** Semantic relevance normalized to the inclusive range zero through one. */
-semantic?: number;
+semantic?:number;
 /** Graph proximity normalized to the inclusive range zero through one. */
-graph?: number;
+graph?:number;
 /** Definition freshness normalized to the inclusive range zero through one. */
-freshness?: number;
+freshness?:number;
 /** Historical selection usefulness normalized to the inclusive range zero through one. */
-usage?: number;
+usage?:number;
 }
 /** One tool definition accepted by the SDK discovery engine. */
 export interface PmToolDiscoveryCandidate {
 /** Stable callable tool name. */
-name: string;
+name:string;
 /** Agent-facing tool description. */
-description: string;
+description:string;
 /** JSON Schema supplied when callers request schema expansion. */
-inputSchema: Record<string, unknown>;
+inputSchema:Record<string,unknown>;
 /** Whether the current caller is authorized to invoke the tool. */
-authorized?: boolean;
+authorized?:boolean;
 /** Optional host-owned ranking signals. */
-signals?: PmToolDiscoverySignalInput;
+signals?:PmToolDiscoverySignalInput;
 }
 /** Options controlling one progressive discovery page. */
 export interface PmToolDiscoveryOptions {
 /** Free-text capability intent. Empty text lists by deterministic policy order. */
-query?: string;
+query?:string;
 /** Restrict results to one stable capability family. */
-family?: PmCommandCapabilityFamily;
+family?:PmCommandCapabilityFamily;
 /** Restrict results to tools visible at or below this tier. */
-tier?: Exclude<PmCommandVisibilityTier, "internal">;
+tier?:Exclude<PmCommandVisibilityTier,"internal">;
 /** Maximum result rows, from one through one hundred. */
-limit?: number;
+limit?:number;
 /** Opaque continuation cursor from an equivalent discovery request. */
-cursor?: string;
+cursor?:string;
 /** Include complete input schemas instead of the default compact projection. */
-includeSchema?: boolean;
+includeSchema?:boolean;
 /** Estimated-token ceiling, or unbounded for the complete selected page. */
-outputBudget?: number | "unbounded";
+outputBudget?:number | "unbounded";
 /** MCP profile that produced the authorized candidate catalog. */
-profile?: PmMcpToolProfile;
+profile?:PmMcpToolProfile;
 /** Host-owned HMAC key of at least 32 bytes for restart-stable cursors. */
-cursorIntegrityKey?: Uint8Array;
+cursorIntegrityKey?:Uint8Array;
 }
 /** Applied score for one signal with explicit provenance. */
 export interface PmToolDiscoveryAppliedSignal {
 /** Normalized signal value. */
-value: number;
+value:number;
 /** Public policy weight. */
-weight: number;
+weight:number;
 /** Whether the signal was computed or supplied rather than defaulted. */
-available: boolean;
+available:boolean;
 /** Transparent source of the normalized value. */
-source: "computed" | "host" | "authorization" | "unavailable";
+source:"computed" | "host" | "authorization" | "unavailable";
 }
 /** One ranked discovery result. */
 export interface PmToolDiscoveryResultRow {
 /** Stable callable tool name. */
-name: string;
+name:string;
 /** Agent-facing description. */
-description: string;
+description:string;
 /** Canonical CLI command backing the tool. */
-command: string;
+command:string;
 /** Minimum visibility tier inherited from the command contract. */
-tier: PmCommandVisibilityTier;
+tier:PmCommandVisibilityTier;
 /** Stable capability family inherited from the command contract. */
-family: PmCommandCapabilityFamily;
+family:PmCommandCapabilityFamily;
 /** Weighted aggregate score used for ordering. */
-score: number;
+score:number;
 /** Complete per-signal score explanation. */
-signals: Readonly<Record<PmToolDiscoverySignalName, PmToolDiscoveryAppliedSignal>>;
+signals:Readonly<Record<PmToolDiscoverySignalName,PmToolDiscoveryAppliedSignal>>;
 /** Complete JSON Schema when explicitly requested. */
-input_schema?: Record<string, unknown>;
+input_schema?:Record<string,unknown>;
 }
 /** Explicit receipt for information omitted from a discovery page. */
 export interface PmToolDiscoveryOmissionReceipt {
 /** Whether any result rows or schemas were omitted. */
-has_omissions: boolean;
+has_omissions:boolean;
 /** Stable omitted field groups. */
-omitted: Array<{
-name: "input_schema" | "tools";
-reason: "compact_projection" | "limit" | "token_budget";
-restore_with: string;
+omitted:Array<{
+name:"input_schema" | "tools";
+reason:"compact_projection" | "limit" | "token_budget";
+restore_with:string;
 }>;
 }
 /** Deterministic progressive tool discovery response. */
 export interface PmToolDiscoveryResult {
 /** Stable result discriminator for model and host routing. */
-result_type: "pm_tool_discovery";
+result_type:"pm_tool_discovery";
 /** Public contract revision. */
-contract_version: 1;
+contract_version:1;
 /** Normalized query used by ranking and cursor binding. */
-query: string;
+query:string;
 /** MCP profile that produced the candidate catalog. */
-profile: PmMcpToolProfile;
+profile:PmMcpToolProfile;
 /** Ranked page of authorized tools. */
-tools: PmToolDiscoveryResultRow[];
+tools:PmToolDiscoveryResultRow[];
 /** Total authorized rows after filters and before pagination. */
-total: number;
+total:number;
 /** Rows returned on this page. */
-returned: number;
+returned:number;
 /** Whether a later ranked row remains. */
-has_more: boolean;
+has_more:boolean;
 /** Opaque continuation cursor bound to query, filters, and catalog. */
-next_cursor?: string;
+next_cursor?:string;
 /** Exact estimated serialized result cost. */
-token_cost: {
-estimated_tokens: number;
-budget: number | "unbounded";
-within_budget: boolean;
+token_cost:{
+estimated_tokens:number;
+budget:number | "unbounded";
+within_budget:boolean;
 };
 /** Public ranking formula and weights. */
-ranking_policy: {
-version: 1;
-formula: "weighted_sum_then_name";
-weights: Readonly<Record<PmToolDiscoverySignalName, number>>;
+ranking_policy:{
+version:1;
+formula:"weighted_sum_then_name";
+weights:Readonly<Record<PmToolDiscoverySignalName,number>>;
 };
 /** Cache identity and invalidation contract for deterministic pages. */
-cache: {
-key: string;
-ttl_ms: number;
-scope: "private";
-invalidates_on: readonly string[];
+cache:{
+key:string;
+ttl_ms:number;
+scope:"private";
+invalidates_on:readonly string[];
 };
 /** Explicit recovery for compacted fields and rows. */
-omission_receipt: PmToolDiscoveryOmissionReceipt;
+omission_receipt:PmToolDiscoveryOmissionReceipt;
 }
 /** Parse untrusted adapter input without discarding malformed discovery values. */
-export declare function parsePmToolDiscoveryOptions(input: Record<string, unknown>): PmToolDiscoveryOptions;
+export declare function parsePmToolDiscoveryOptions(input:Record<string,unknown>):PmToolDiscoveryOptions;
 /**
  * Rank and page an authorized MCP tool catalog under an explicit token budget.
  *
@@ -149,4 +149,4 @@ export declare function parsePmToolDiscoveryOptions(input: Record<string, unknow
  * catalog, or ranking inputs change. Host signals override documented local
  * fallbacks without changing the public formula or hiding signal provenance.
  */
-export declare function discoverPmTools(candidates: readonly PmToolDiscoveryCandidate[], options?: PmToolDiscoveryOptions): PmToolDiscoveryResult;
+export declare function discoverPmTools(candidates:readonly PmToolDiscoveryCandidate[],options?:PmToolDiscoveryOptions):PmToolDiscoveryResult;

package/dist/sdk/mcp/interactions.d.ts

@@ -1,32 +1,32 @@
-import { type PmMcpImplementation, type PmMcpRequestContext } from "./protocol.js";
+import { type PmMcpImplementation,type PmMcpRequestContext } from "./protocol.js";
 /** Methods permitted inside a 2026-07-28 MRTR input request map. */
-export declare const PM_MCP_INPUT_REQUEST_METHODS: readonly ["elicitation/create", "roots/list", "sampling/createMessage"];
+export declare const PM_MCP_INPUT_REQUEST_METHODS:readonly ["elicitation/create","roots/list","sampling/createMessage"];
 /** One typed request that a host must fulfill before retrying an operation. */
 export interface PmMcpInputRequest {
 /** Current MCP server-to-client request method. */
-method: (typeof PM_MCP_INPUT_REQUEST_METHODS)[number];
+method:(typeof PM_MCP_INPUT_REQUEST_METHODS)[number];
 /** Method-specific parameters retained as an open protocol object. */
-params: Record<string, unknown>;
+params:Record<string,unknown>;
 }
 /** Server-assigned MRTR input identifiers mapped to bounded requests. */
-export type PmMcpInputRequests = Record<string, PmMcpInputRequest>;
+export type PmMcpInputRequests = Record<string,PmMcpInputRequest>;
 /** Host responses keyed by the identifiers in an earlier input request map. */
-export type PmMcpInputResponses = Record<string, Record<string, unknown>>;
+export type PmMcpInputResponses = Record<string,Record<string,unknown>>;
 /** Modern interim result returned when an operation needs more host input. */
 export interface PmMcpInputRequiredResult {
 /** MRTR discriminator required by the current protocol. */
-resultType: "input_required";
+resultType:"input_required";
 /** Optional bounded requests the host must fulfill. */
-inputRequests?: PmMcpInputRequests;
+inputRequests?:PmMcpInputRequests;
 /** Optional integrity-protected state echoed unchanged on retry. */
-requestState?: string;
+requestState?:string;
 /** Result-local MCP metadata. */
-_meta: {
+_meta:{
 /** Server identity repeated on every modern result. */
-"io.modelcontextprotocol/serverInfo": PmMcpImplementation;
+"io.modelcontextprotocol/serverInfo":PmMcpImplementation;
 };
 /** Additional forward-compatible result fields. */
-[key: string]: unknown;
+[key:string]:unknown;
 }
 /**
  * Transport-neutral control signal used by SDK handlers to request an MRTR
@@ -34,68 +34,68 @@ _meta: {
  */
 export declare class PmMcpInputRequiredError extends Error {
 /** Server-authored input requests validated by the adapter. */
-readonly inputRequests?: unknown;
+readonly inputRequests?:unknown;
 /** Optional opaque continuation state echoed on retry. */
-readonly requestState?: string;
+readonly requestState?:string;
 /** Create an input-required control signal. */
-constructor(input: {
-inputRequests?: unknown;
-requestState?: string;
+constructor(input:{
+inputRequests?:unknown;
+requestState?:string;
 });
 }
 /** Cache fields required on current list and read results. */
 export interface PmMcpCachePolicy {
 /** Milliseconds for which a client may consider the response fresh. */
-ttlMs: number;
+ttlMs:number;
 /** Whether shared intermediaries may reuse the response. */
-cacheScope: "private" | "public";
+cacheScope:"private" | "public";
 /** Additional forward-compatible cache fields. */
-[key: string]: unknown;
+[key:string]:unknown;
 }
 /** Work bounds applied while validating an advertised JSON Schema. */
 export interface PmMcpJsonSchemaBounds {
 /** Maximum serialized schema bytes. */
-maxBytes?: number;
+maxBytes?:number;
 /** Maximum nested object or array depth. */
-maxDepth?: number;
+maxDepth?:number;
 /** Maximum visited object, array, and scalar nodes. */
-maxNodes?: number;
+maxNodes?:number;
 }
 /** State sealed into an opaque MRTR requestState value. */
 export interface PmMcpRequestStatePayload {
 /** Absolute expiration timestamp in milliseconds. */
-expiresAt: number;
+expiresAt:number;
 /** Original JSON-RPC method this state may resume. */
-method: string;
+method:string;
 /** Digest of the original request's salient parameters. */
-parameterDigest: string;
+parameterDigest:string;
 /** Principal binding chosen by the host or authorization layer. */
-principal: string;
+principal:string;
 /** Application-owned continuation data. */
-state: unknown;
+state:unknown;
 }
 /** Validate and clone a server-authored MRTR request map. */
-export declare function parseMcpInputRequests(value: unknown, requestContext: PmMcpRequestContext): PmMcpInputRequests;
+export declare function parseMcpInputRequests(value:unknown,requestContext:PmMcpRequestContext):PmMcpInputRequests;
 /** Validate and clone client-supplied input responses from an MRTR retry. */
-export declare function parseMcpInputResponses(value: unknown): PmMcpInputResponses;
+export declare function parseMcpInputResponses(value:unknown):PmMcpInputResponses;
 /** Build a modern input-required result after validating capability and size bounds. */
-export declare function buildMcpInputRequiredResult(input: {
-requestContext: PmMcpRequestContext;
-serverInfo: PmMcpImplementation;
-inputRequests?: unknown;
-requestState?: string;
-}): PmMcpInputRequiredResult;
+export declare function buildMcpInputRequiredResult(input:{
+requestContext:PmMcpRequestContext;
+serverInfo:PmMcpImplementation;
+inputRequests?:unknown;
+requestState?:string;
+}):PmMcpInputRequiredResult;
 /** Seal integrity-protected continuation state for an MRTR retry. */
-export declare function sealMcpRequestState(payload: PmMcpRequestStatePayload, secret: string | Uint8Array): string;
+export declare function sealMcpRequestState(payload:PmMcpRequestStatePayload,secret:string | Uint8Array):string;
 /** Verify an MRTR requestState value against method, principal, digest, and expiry. */
-export declare function openMcpRequestState(value: string, secret: string | Uint8Array, expected: {
-method: string;
-parameterDigest: string;
-principal: string;
-nowMs?: number;
-}): PmMcpRequestStatePayload;
+export declare function openMcpRequestState(value:string,secret:string | Uint8Array,expected:{
+method:string;
+parameterDigest:string;
+principal:string;
+nowMs?:number;
+}):PmMcpRequestStatePayload;
 /** Compute a stable-sized digest for application-selected salient request data. */
-export declare function digestMcpRequestParameters(value: unknown): string;
+export declare function digestMcpRequestParameters(value:unknown):string;
 /**
  * Bound single-use MRTR state consumption within one server process. Callers
  * requiring cross-process one-time semantics should persist the resulting hash.
@@ -103,16 +103,16 @@ export declare function digestMcpRequestParameters(value: unknown): string;
 export declare class PmMcpRequestStateReplayGuard {
 #private;
 /** Create a bounded in-process replay guard. */
-constructor(maximumEntries?: number);
+constructor(maximumEntries?:number);
 /** Consume one opaque requestState value exactly once in this process. */
-consume(value: string): void;
+consume(value:string):void;
 }
 /** Validate and clone a required MCP cache policy. */
-export declare function parseMcpCachePolicy(value: PmMcpCachePolicy): PmMcpCachePolicy;
+export declare function parseMcpCachePolicy(value:PmMcpCachePolicy):PmMcpCachePolicy;
 /** Attach required cache fields without mutating a method-specific payload. */
-export declare function withMcpCachePolicy<Payload extends Record<string, unknown>>(payload: Payload, policy: PmMcpCachePolicy): Payload & PmMcpCachePolicy;
+export declare function withMcpCachePolicy<Payload extends Record<string,unknown>>(payload:Payload,policy:PmMcpCachePolicy):Payload & PmMcpCachePolicy;
 /**
  * Validate JSON Schema 2020-12 structure under explicit byte, depth, node, and
  * local-reference work bounds while allowing the complete keyword vocabulary.
  */
-export declare function validateMcpJsonSchema(schema: unknown, bounds?: PmMcpJsonSchemaBounds): unknown;
+export declare function validateMcpJsonSchema(schema:unknown,bounds?:PmMcpJsonSchemaBounds):unknown;