@unbrained/pm-cli 2026.5.11 → 2026.5.14

package/dist/cli/commands/extension.js

@@ -2,11 +2,12 @@ import { execFile } from "node:child_process";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import { activateExtensions, loadExtensions, nextExtensionReloadToken } from "../../core/extensions/index.js";
 import { EXTENSION_CAPABILITY_CONTRACT, KNOWN_EXTENSION_CAPABILITIES, parseLegacyExtensionCapabilityAliasWarning, parseUnknownExtensionCapabilityWarning, resolveExtensionRoots, } from "../../core/extensions/loader.js";
 import { pathExists } from "../../core/fs/fs-utils.js";
+import { PM_PACKAGE_RESOURCE_KINDS, collectPackageExtensionDirectories, readPmPackageManifest, } from "../../core/packages/manifest.js";
 import { EXIT_CODE } from "../../core/shared/constants.js";
 import { PmCliError } from "../../core/shared/errors.js";
 import { nowIso } from "../../core/shared/time.js";
@@ -17,10 +18,17 @@ const DEFAULT_EXTENSION_PRIORITY = 100;
 const MANAGED_EXTENSION_STATE_FILENAME = ".managed-extensions.json";
 const MANAGED_EXTENSION_STATE_VERSION = 1;
 const PM_PACKAGE_ROOT_ENV = "PM_CLI_PACKAGE_ROOT";
-const BUNDLED_EXTENSION_ALIASES = {
-    beads: "beads",
-    todos: "todos",
+const LEGACY_BUNDLED_PACKAGE_ALIASES = {
+    beads: {
+        package_directory: "pm-beads",
+        legacy_extension_directory: "beads",
+    },
+    todos: {
+        package_directory: "pm-todos",
+        legacy_extension_directory: "todos",
+    },
 };
+const BUNDLED_PACKAGE_INSTALL_ALL_TARGETS = new Set(["*", "all"]);
 function resolvePackageRootCandidates() {
     const candidates = [];
     const envRoot = process.env[PM_PACKAGE_ROOT_ENV];
@@ -33,18 +41,87 @@ function resolvePackageRootCandidates() {
 }
 async function resolveBundledExtensionAliasSource(input) {
     const normalized = input.trim().toLowerCase();
-    const alias = BUNDLED_EXTENSION_ALIASES[normalized];
+    const packageRoot = await resolveBundledPackageRoot(normalized);
+    if (packageRoot) {
+        return packageRoot;
+    }
+    const alias = LEGACY_BUNDLED_PACKAGE_ALIASES[normalized];
     if (!alias) {
         return null;
     }
     for (const packageRoot of resolvePackageRootCandidates()) {
-        const bundledPath = path.join(packageRoot, ".agents", "pm", "extensions", alias);
-        if (await pathExists(path.join(bundledPath, "manifest.json"))) {
-            return bundledPath;
+        const legacyExtensionPath = path.join(packageRoot, ".agents", "pm", "extensions", alias.legacy_extension_directory);
+        if (await pathExists(path.join(legacyExtensionPath, "manifest.json"))) {
+            return legacyExtensionPath;
         }
     }
     return null;
 }
+function isBundledPackageInstallAllTarget(input) {
+    return BUNDLED_PACKAGE_INSTALL_ALL_TARGETS.has(input.trim().toLowerCase());
+}
+function derivePackageAlias(packageDirectory) {
+    return packageDirectory.replace(/^pm-/i, "").trim().toLowerCase();
+}
+async function collectBundledPackageEntries() {
+    const entriesByAlias = new Map();
+    for (const packageRoot of resolvePackageRootCandidates()) {
+        const packagesRoot = path.join(packageRoot, "packages");
+        if (!(await pathExists(packagesRoot))) {
+            continue;
+        }
+        const entries = await fs.readdir(packagesRoot, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory() || !entry.name.startsWith("pm-")) {
+                continue;
+            }
+            const candidateRoot = path.join(packagesRoot, entry.name);
+            if (!(await pathExists(path.join(candidateRoot, "package.json")))) {
+                continue;
+            }
+            const manifest = await readPmPackageManifest(candidateRoot);
+            const aliases = manifest.aliases && manifest.aliases.length > 0
+                ? manifest.aliases
+                : [derivePackageAlias(entry.name)];
+            for (const alias of aliases) {
+                const normalizedAlias = alias.trim().toLowerCase();
+                if (normalizedAlias.length === 0 || entriesByAlias.has(normalizedAlias)) {
+                    continue;
+                }
+                entriesByAlias.set(normalizedAlias, {
+                    alias: normalizedAlias,
+                    package_directory: entry.name,
+                    package_root: candidateRoot,
+                });
+            }
+        }
+    }
+    for (const [alias, legacy] of Object.entries(LEGACY_BUNDLED_PACKAGE_ALIASES)) {
+        if (entriesByAlias.has(alias)) {
+            continue;
+        }
+        for (const packageRoot of resolvePackageRootCandidates()) {
+            const packagePath = path.join(packageRoot, "packages", legacy.package_directory);
+            if (await pathExists(path.join(packagePath, "package.json"))) {
+                entriesByAlias.set(alias, {
+                    alias,
+                    package_directory: legacy.package_directory,
+                    package_root: packagePath,
+                });
+                break;
+            }
+        }
+    }
+    return [...entriesByAlias.values()].sort((left, right) => left.alias.localeCompare(right.alias));
+}
+async function listBundledPackageAliases() {
+    return (await collectBundledPackageEntries()).map((entry) => entry.alias);
+}
+async function resolveBundledPackageRoot(alias) {
+    const normalized = alias.trim().toLowerCase();
+    const entry = (await collectBundledPackageEntries()).find((candidate) => candidate.alias === normalized);
+    return entry?.package_root ?? null;
+}
 function normalizeStringList(values) {
     return [...new Set(values.map((value) => value.trim()).filter((value) => value.length > 0))].sort((left, right) => left.localeCompare(right));
 }
@@ -273,7 +350,7 @@ function normalizeManagedState(raw) {
             continue;
         }
         const source = entry.source;
-        if ((source.kind !== "local" && source.kind !== "github") ||
+        if ((source.kind !== "local" && source.kind !== "github" && source.kind !== "npm") ||
             typeof source.input !== "string" ||
             typeof source.location !== "string") {
             continue;
@@ -291,6 +368,8 @@ function normalizeManagedState(raw) {
                 kind: source.kind,
                 input: source.input,
                 location: source.location,
+                package: typeof source.package === "string" ? source.package : undefined,
+                version: typeof source.version === "string" ? source.version : undefined,
                 repository: typeof source.repository === "string" ? source.repository : undefined,
                 owner: typeof source.owner === "string" ? source.owner : undefined,
                 repo: typeof source.repo === "string" ? source.repo : undefined,
@@ -366,7 +445,11 @@ async function resolveBundledAliasManifestName(input) {
         return null;
     }
     try {
-        const validated = await validateExtensionDirectory(bundledAliasSource);
+        const extensionDirectories = await collectPackageExtensionDirectories(bundledAliasSource);
+        if (extensionDirectories.length !== 1) {
+            return null;
+        }
+        const validated = await validateExtensionDirectory(extensionDirectories[0]);
         return validated.manifest.name;
     }
     catch {
@@ -453,6 +536,7 @@ function resolveAction(target, options) {
             options.manage ? "manage" : null,
             options.reload ? "reload" : null,
             options.doctor ? "doctor" : null,
+            options.catalog ? "catalog" : null,
             options.init ? "init" : null,
             options.scaffold ? "init" : null,
             options.adopt ? "adopt" : null,
@@ -467,10 +551,13 @@ function resolveAction(target, options) {
         if (typeof target === "string" && target.trim().toLowerCase() === "reload") {
             return "reload";
         }
+        if (typeof target === "string" && target.trim().toLowerCase() === "catalog") {
+            return "catalog";
+        }
         if (typeof target === "string" && (target.trim().toLowerCase() === "init" || target.trim().toLowerCase() === "scaffold")) {
             return "init";
         }
-        throw new PmCliError("One action flag is required. Use one of: --install, --uninstall, --explore, --manage, --reload, --doctor, --init/--scaffold, --adopt, --adopt-all, --activate, --deactivate.", EXIT_CODE.USAGE);
+        throw new PmCliError("One action flag is required. Use one of: --install, --uninstall, --explore, --manage, --reload, --doctor, --catalog, --init/--scaffold, --adopt, --adopt-all, --activate, --deactivate.", EXIT_CODE.USAGE);
     }
     if (selected.length > 1) {
         throw new PmCliError("Extension action flags are mutually exclusive.", EXIT_CODE.USAGE);
@@ -485,6 +572,77 @@ function resolveScope(options) {
     }
     return global ? "global" : "project";
 }
+async function buildBundledPackageCatalog(scope, global) {
+    const roots = resolveExtensionRoots(resolvePmRoot(process.cwd(), global.path), process.cwd());
+    const selectedRoot = scope === "global" ? roots.global : roots.project;
+    const managedStateRead = await readManagedExtensionState(selectedRoot);
+    const installedLocations = new Set(managedStateRead.state.entries
+        .filter((entry) => entry.scope === scope)
+        .map((entry) => path.resolve(entry.source.location)));
+    const packages = [];
+    for (const alias of await listBundledPackageAliases()) {
+        const packageRoot = await resolveBundledPackageRoot(alias);
+        const installScopeFlag = scope === "global" ? "--global" : "--project";
+        if (!packageRoot) {
+            packages.push({
+                alias,
+                bundled: true,
+                available: false,
+                installed: false,
+                install_target: alias,
+                install_command: `pm install ${alias} ${installScopeFlag}`,
+            });
+            continue;
+        }
+        const manifest = await readPmPackageManifest(packageRoot);
+        const repository = manifest.catalog?.links?.repository ?? manifest.package_repository_url;
+        const report = manifest.catalog?.links?.report ?? manifest.package_bugs_url;
+        const docs = manifest.catalog?.links?.docs ?? manifest.package_homepage;
+        const npm = manifest.catalog?.links?.npm ??
+            (manifest.package_name ? `https://www.npmjs.com/package/${encodeURIComponent(manifest.package_name)}` : undefined);
+        const metadataOnlyResources = Object.fromEntries(PM_PACKAGE_RESOURCE_KINDS
+            .filter((resourceKind) => resourceKind !== "extensions")
+            .map((resourceKind) => [resourceKind, manifest.resources[resourceKind] ?? []])
+            .filter(([, entries]) => Array.isArray(entries) && entries.length > 0));
+        packages.push({
+            alias,
+            bundled: true,
+            available: true,
+            installed: installedLocations.has(path.resolve(packageRoot)),
+            install_target: alias,
+            install_command: `pm install ${alias} ${installScopeFlag}`,
+            package_root: packageRoot,
+            package_name: manifest.package_name,
+            package_version: manifest.package_version,
+            description: manifest.catalog?.summary ?? manifest.package_description,
+            keywords: manifest.package_keywords ?? [],
+            resources: manifest.resources,
+            installable_resources: {
+                extensions: manifest.resources.extensions ?? [],
+            },
+            metadata_only_resources: metadataOnlyResources,
+            catalog: {
+                display_name: manifest.catalog?.display_name,
+                category: manifest.catalog?.category,
+                tags: manifest.catalog?.tags ?? manifest.package_keywords ?? [],
+                links: {
+                    docs,
+                    npm,
+                    repository,
+                    report,
+                },
+                media: manifest.catalog?.media,
+            },
+        });
+    }
+    return {
+        total: packages.length,
+        scope,
+        installable_resource_kinds: ["extensions"],
+        metadata_only_resource_kinds: PM_PACKAGE_RESOURCE_KINDS.filter((resourceKind) => resourceKind !== "extensions"),
+        packages,
+    };
+}
 function parseGithubPathSpec(pathSpec, input, refOverride) {
     const segments = pathSpec
         .split("/")
@@ -527,6 +685,23 @@ export function parseExtensionInstallSource(input, options = {}) {
         throw new PmCliError("Extension source is required for --install.", EXIT_CODE.USAGE);
     }
     const refOverride = typeof options.ref === "string" && options.ref.trim().length > 0 ? options.ref.trim() : undefined;
+    if (normalizedInput.startsWith("npm:")) {
+        const spec = normalizedInput.slice("npm:".length).trim();
+        if (spec.length === 0) {
+            throw new PmCliError('npm package source must include a package spec after "npm:".', EXIT_CODE.USAGE);
+        }
+        if (options.forceGithub) {
+            throw new PmCliError('Options "--gh/--github" cannot be combined with npm: package sources.', EXIT_CODE.USAGE);
+        }
+        if (refOverride) {
+            throw new PmCliError('Option "--ref" cannot be combined with npm: package sources.', EXIT_CODE.USAGE);
+        }
+        return {
+            kind: "npm",
+            input: normalizedInput,
+            spec,
+        };
+    }
     const maybeGithubByUrl = (() => {
         try {
             const parsed = new URL(normalizedInput);
@@ -578,22 +753,123 @@ async function runGitCommand(args) {
         throw new PmCliError(`Git command failed: git ${args.join(" ")}\n${message}`, EXIT_CODE.GENERIC_FAILURE);
     }
 }
-async function listManifestDirectories(parentDirectory) {
-    if (!(await pathExists(parentDirectory))) {
-        return [];
+async function runNpmCommand(args, cwd) {
+    try {
+        const result = await execFileAsync("npm", args, { cwd, encoding: "utf8" });
+        return (result.stdout ?? "").trim();
     }
-    const entries = await fs.readdir(parentDirectory, { withFileTypes: true });
-    const candidates = [];
-    for (const entry of entries) {
-        if (!entry.isDirectory()) {
-            continue;
+    catch (error) {
+        const stderr = typeof error === "object" && error !== null && "stderr" in error ? String(error.stderr) : "";
+        const message = stderr.trim().length > 0 ? stderr.trim() : error instanceof Error ? error.message : String(error);
+        throw new PmCliError(`npm command failed: npm ${args.join(" ")}\n${message}`, EXIT_CODE.GENERIC_FAILURE);
+    }
+}
+async function resolveLocalNpmPackagePath(spec) {
+    if (path.isAbsolute(spec) || spec.startsWith(".") || spec.startsWith("..")) {
+        const absolutePath = path.resolve(process.cwd(), spec);
+        return (await pathExists(absolutePath)) ? absolutePath : null;
+    }
+    try {
+        const parsed = new URL(spec);
+        if (parsed.protocol === "file:") {
+            const absolutePath = fileURLToPath(parsed);
+            return (await pathExists(absolutePath)) ? absolutePath : null;
         }
-        const directory = path.join(parentDirectory, entry.name);
-        if (await pathExists(path.join(directory, "manifest.json"))) {
-            candidates.push(directory);
+    }
+    catch {
+        // Registry package specs are not URLs.
+    }
+    return null;
+}
+async function resolveNpmPackSpec(spec) {
+    const localPath = await resolveLocalNpmPackagePath(spec);
+    if (localPath) {
+        return pathToFileURL(localPath).href;
+    }
+    if (/^[a-z][a-z0-9+.-]*:/i.test(spec)) {
+        return spec;
+    }
+    return spec;
+}
+function parsePackedNpmPackage(stdout, packDirectory) {
+    try {
+        const parsed = JSON.parse(stdout);
+        const first = Array.isArray(parsed) ? parsed[0] : undefined;
+        if (first && typeof first.filename === "string" && first.filename.trim().length > 0) {
+            return {
+                tarball: path.resolve(packDirectory, first.filename),
+                package: typeof first.name === "string" ? first.name : undefined,
+                version: typeof first.version === "string" ? first.version : undefined,
+            };
         }
     }
-    return candidates.sort((left, right) => left.localeCompare(right));
+    catch {
+        // Fall back to the last stdout line for older npm output.
+    }
+    const lastLine = stdout
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0)
+        .at(-1);
+    if (!lastLine) {
+        throw new PmCliError("npm pack did not report a tarball filename.", EXIT_CODE.GENERIC_FAILURE);
+    }
+    return {
+        tarball: path.resolve(packDirectory, lastLine),
+    };
+}
+async function resolveNpmSourceDirectory(source) {
+    const localPackageRoot = await resolveLocalNpmPackagePath(source.spec);
+    if (localPackageRoot) {
+        const packageJsonPath = path.join(localPackageRoot, "package.json");
+        const packageJson = (await pathExists(packageJsonPath))
+            ? JSON.parse(await fs.readFile(packageJsonPath, "utf8"))
+            : {};
+        return {
+            directory: await resolvePackageExtensionDirectory(localPackageRoot, source.input),
+            package: typeof packageJson.name === "string" ? packageJson.name : undefined,
+            version: typeof packageJson.version === "string" ? packageJson.version : undefined,
+            cleanup: async () => { },
+        };
+    }
+    const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "pm-npm-package-source-"));
+    const packDirectory = path.join(tempRoot, "pack");
+    const extractDirectory = path.join(tempRoot, "extract");
+    await fs.mkdir(packDirectory, { recursive: true });
+    await fs.mkdir(extractDirectory, { recursive: true });
+    try {
+        const packSpec = await resolveNpmPackSpec(source.spec);
+        const packStdout = await runNpmCommand(["pack", packSpec, "--json", "--pack-destination", packDirectory]);
+        const packed = parsePackedNpmPackage(packStdout, packDirectory);
+        await execFileAsync("tar", ["-xzf", packed.tarball, "-C", extractDirectory], { encoding: "utf8" });
+        const packageRoot = path.join(extractDirectory, "package");
+        const directory = await resolvePackageExtensionDirectory(packageRoot, source.input);
+        return {
+            directory,
+            package: packed.package,
+            version: packed.version,
+            cleanup: async () => {
+                await fs.rm(tempRoot, { recursive: true, force: true });
+            },
+        };
+    }
+    catch (error) {
+        await fs.rm(tempRoot, { recursive: true, force: true });
+        throw error;
+    }
+}
+async function resolvePackageExtensionDirectory(packageRoot, sourceLabel) {
+    const discovered = await collectPackageExtensionDirectories(packageRoot);
+    if (discovered.length === 1) {
+        return discovered[0];
+    }
+    if (discovered.length > 1) {
+        const choices = discovered
+            .map((entry) => path.relative(packageRoot, entry).replaceAll(path.sep, "/"))
+            .sort((left, right) => left.localeCompare(right));
+        throw new PmCliError(`Package source "${sourceLabel}" contains multiple extension manifests. Provide an explicit extension path. Candidates: ${choices.join(", ")}`, EXIT_CODE.USAGE);
+    }
+    throw new PmCliError(`Unable to locate a pm extension manifest in package source "${sourceLabel}". Package installs currently activate only extension resources, so add package.json pm.extensions or an extensions/ directory. Metadata-only resources like pm.docs/pm.examples are catalog metadata and do not activate commands.`, EXIT_CODE.USAGE);
 }
 async function resolveGithubSourceDirectory(cloneDirectory, source) {
     const candidatePaths = [];
@@ -612,25 +888,11 @@ async function resolveGithubSourceDirectory(cloneDirectory, source) {
     if (await pathExists(path.join(cloneDirectory, "manifest.json"))) {
         return { directory: cloneDirectory, resolved_subpath: "." };
     }
-    const defaultRoots = [
-        path.join(cloneDirectory, ".agents", "pm", "extensions"),
-        path.join(cloneDirectory, ".custom", "pm-extensions"),
-        path.join(cloneDirectory, ".custom", "pm-extension"),
-    ];
-    const discovered = (await Promise.all(defaultRoots.map((defaultRoot) => listManifestDirectories(defaultRoot)))).flat();
-    if (discovered.length === 1) {
-        return {
-            directory: discovered[0],
-            resolved_subpath: path.relative(cloneDirectory, discovered[0]).replaceAll(path.sep, "/"),
-        };
-    }
-    if (discovered.length > 1) {
-        const choices = discovered
-            .map((entry) => path.relative(cloneDirectory, entry).replaceAll(path.sep, "/"))
-            .sort((left, right) => left.localeCompare(right));
-        throw new PmCliError(`GitHub source "${source.input}" contains multiple extension manifests. Provide an explicit path. Candidates: ${choices.join(", ")}`, EXIT_CODE.USAGE);
-    }
-    throw new PmCliError(`Unable to locate extension manifest in GitHub source "${source.input}". Provide an explicit extension path.`, EXIT_CODE.USAGE);
+    const discoveredDirectory = await resolvePackageExtensionDirectory(cloneDirectory, source.input);
+    return {
+        directory: discoveredDirectory,
+        resolved_subpath: path.relative(cloneDirectory, discoveredDirectory).replaceAll(path.sep, "/"),
+    };
 }
 async function resolveInstallSource(source) {
     if (source.kind === "local") {
@@ -641,9 +903,21 @@ async function resolveInstallSource(source) {
         if (!stats.isDirectory()) {
             throw new PmCliError(`Local extension source must be a directory: "${source.absolute_path}".`, EXIT_CODE.USAGE);
         }
+        const directory = await resolvePackageExtensionDirectory(source.absolute_path, source.input);
         return {
             source,
-            directory: source.absolute_path,
+            directory,
+        };
+    }
+    if (source.kind === "npm") {
+        const resolved = await resolveNpmSourceDirectory(source);
+        return {
+            source,
+            directory: resolved.directory,
+            cleanup: resolved.cleanup,
+            resolved_subpath: path.relative(path.dirname(resolved.directory), resolved.directory).replaceAll(path.sep, "/"),
+            npm_package: resolved.package,
+            npm_version: resolved.version,
         };
     }
     const cloneDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "pm-extension-source-"));
@@ -826,20 +1100,66 @@ function applyDoctorRuntimeActivationState(extensions, loadResult, activationRes
     const loadedNames = new Set(loadResult.loaded.map((entry) => normalizeExtensionNameForMatch(entry.name)));
     const loadFailedNames = new Set(loadResult.failed.map((entry) => normalizeExtensionNameForMatch(entry.name)));
     const activationFailedNames = new Set(activationResult.failed.map((entry) => normalizeExtensionNameForMatch(entry.name)));
+    const commandPathsByExtension = new Map();
+    const actionPathsByExtension = new Map();
+    const addCommandPath = (extensionName, commandPath) => {
+        const normalizedName = normalizeExtensionNameForMatch(extensionName);
+        const normalizedCommandPath = commandPath.trim();
+        if (normalizedName.length === 0 || normalizedCommandPath.length === 0) {
+            return;
+        }
+        const existing = commandPathsByExtension.get(normalizedName) ?? new Set();
+        existing.add(normalizedCommandPath);
+        commandPathsByExtension.set(normalizedName, existing);
+    };
+    const addActionPath = (extensionName, actionPath) => {
+        const normalizedName = normalizeExtensionNameForMatch(extensionName);
+        const normalizedActionPath = actionPath.trim();
+        if (normalizedName.length === 0 || normalizedActionPath.length === 0) {
+            return;
+        }
+        const existing = actionPathsByExtension.get(normalizedName) ?? new Set();
+        existing.add(normalizedActionPath);
+        actionPathsByExtension.set(normalizedName, existing);
+    };
+    for (const registration of activationResult.registrations.commands) {
+        addCommandPath(registration.name, registration.command);
+        addActionPath(registration.name, registration.action);
+    }
+    for (const handler of activationResult.commands.handlers) {
+        addCommandPath(handler.name, handler.command);
+    }
+    for (const override of activationResult.commands.overrides) {
+        addCommandPath(override.name, override.command);
+    }
+    const sortedPaths = (values) => {
+        if (!values || values.size === 0) {
+            return undefined;
+        }
+        return [...values].sort((left, right) => left.localeCompare(right));
+    };
     return extensions.map((entry) => {
+        const normalizedName = normalizeExtensionNameForMatch(entry.name);
+        const commandPaths = sortedPaths(commandPathsByExtension.get(normalizedName));
+        const actionPaths = sortedPaths(actionPathsByExtension.get(normalizedName));
+        const runtimeMetadata = {
+            ...(commandPaths ? { command_paths: commandPaths } : {}),
+            ...(actionPaths ? { action_paths: actionPaths } : {}),
+        };
         if (!entry.enabled) {
             return {
                 ...entry,
                 runtime_active: false,
                 activation_status: "not_loaded",
+                ...runtimeMetadata,
             };
         }
-        const normalizedName = normalizeExtensionNameForMatch(entry.name);
         if (loadFailedNames.has(normalizedName) || activationFailedNames.has(normalizedName)) {
             return {
                 ...entry,
                 runtime_active: false,
                 activation_status: "failed",
+                ...runtimeMetadata,
             };
         }
         if (loadedNames.has(normalizedName)) {
@@ -847,12 +1167,14 @@ function applyDoctorRuntimeActivationState(extensions, loadResult, activationRes
                 ...entry,
                 runtime_active: true,
                 activation_status: "ok",
+                ...runtimeMetadata,
             };
         }
         return {
             ...entry,
             runtime_active: false,
             activation_status: "not_loaded",
+            ...runtimeMetadata,
         };
     });
 }
@@ -987,13 +1309,16 @@ function requireTarget(target, action) {
     const normalized = target?.trim();
     if (!normalized) {
         if (action === "init") {
-            throw new PmCliError('Action "init" requires a scaffold target path (for example: pm extension --init ./my-extension or pm extension init ./my-extension).', EXIT_CODE.USAGE);
+            throw new PmCliError('Action "init" requires a scaffold target path (for example: pm package init ./my-package or pm extension init ./my-extension).', EXIT_CODE.USAGE);
         }
         throw new PmCliError(`Action "${action}" requires an extension name or source target argument.`, EXIT_CODE.USAGE);
     }
     return normalized;
 }
-function buildStarterExtensionScaffoldFiles(extensionName, commandName) {
+function lifecycleFlagCommand(options, action) {
+    return options.vocabulary === "package" ? `pm package ${action}` : `pm extension --${action}`;
+}
+function buildStarterExtensionScaffoldFiles(extensionName, commandName, vocabulary) {
     const manifest = `${JSON.stringify({
         name: extensionName,
         version: "0.1.0",
@@ -1001,26 +1326,28 @@ function buildStarterExtensionScaffoldFiles(extensionName, commandName) {
         capabilities: ["commands"],
     }, null, 2)}\n`;
     const entrypoint = [
-        "module.exports = {",
-        "  activate(api) {",
-        "    api.registerCommand({",
-        `      name: ${JSON.stringify(commandName)},`,
-        '      description: "Starter scaffold command. Replace with your own behavior.",',
-        "      run: async (context) => ({",
-        "        ok: true,",
-        `        source: ${JSON.stringify(extensionName)},`,
-        "        command: context.command,",
-        '        message: "Starter extension scaffold is active.",',
-        "      }),",
-        "    });",
-        "  },",
+        "export function activate(api) {",
+        "  api.registerCommand({",
+        `    name: ${JSON.stringify(commandName)},`,
+        '    description: "Starter scaffold command. Replace with your own behavior.",',
+        "    run: async (context) => ({",
+        "      ok: true,",
+        `      source: ${JSON.stringify(extensionName)},`,
+        "      command: context.command,",
+        '      message: "Starter extension scaffold is active.",',
+        "    }),",
+        "  });",
+        "}",
+        "",
+        "export default {",
+        "  activate,",
         "};",
         "",
     ].join("\n");
     const readme = [
         `# ${extensionName}`,
         "",
-        "Generated by `pm extension --init`.",
+        `Generated by \`${vocabulary === "package" ? "pm package init" : "pm extension init"}\`.`,
         "",
         "## Included Files",
         "- `manifest.json`: extension metadata and capabilities.",
@@ -1028,13 +1355,13 @@ function buildStarterExtensionScaffoldFiles(extensionName, commandName) {
         "",
         "## Quick Start",
         "```bash",
-        "pm extension --install --project <scaffold-path>",
+        `${vocabulary === "package" ? "pm install" : "pm extension --install"} --project <scaffold-path>`,
         `pm ${commandName}`,
-        "pm extension --doctor --project --detail summary",
+        `${vocabulary === "package" ? "pm package doctor" : "pm extension --doctor"} --project --detail summary`,
         "```",
         "",
         "## Notes",
-        "- This scaffold uses CommonJS (`module.exports`) for zero-config runtime compatibility.",
+        "- This scaffold uses ESM exports so it works in package scopes with `type: module`.",
         "- Update `manifest.json` capabilities and `index.js` command behavior as your extension evolves.",
         "",
     ].join("\n");
@@ -1044,12 +1371,12 @@ function buildStarterExtensionScaffoldFiles(extensionName, commandName) {
         "README.md": readme,
     };
 }
-async function scaffoldExtensionProject(target) {
+async function scaffoldExtensionProject(target, vocabulary = "extension") {
     const normalizedTarget = target.trim();
     const targetPath = path.resolve(process.cwd(), normalizedTarget);
     const extensionName = normalizeManagedDirectoryName(path.basename(targetPath));
     const commandName = `${extensionName} ping`;
-    const scaffoldFiles = buildStarterExtensionScaffoldFiles(extensionName, commandName);
+    const scaffoldFiles = buildStarterExtensionScaffoldFiles(extensionName, commandName, vocabulary);
     let createdDirectory = false;
     if (await pathExists(targetPath)) {
         const existingTargetStats = await fs.stat(targetPath);
@@ -1106,7 +1433,7 @@ function classifyDoctorLoadFailureWarnings(loadFailures) {
     }
     return [...new Set(warnings)].sort((left, right) => left.localeCompare(right));
 }
-function buildExtensionTriageSummary(scope, warnings, extensions) {
+function buildExtensionTriageSummary(scope, warnings, extensions, options = {}) {
     const normalizedWarnings = [...new Set(warnings)].sort((left, right) => left.localeCompare(right));
     const managedTotal = extensions.filter((entry) => entry.managed).length;
     const enabledTotal = extensions.filter((entry) => entry.enabled).length;
@@ -1146,7 +1473,7 @@ function buildExtensionTriageSummary(scope, warnings, extensions) {
     const remediation = [];
     if (normalizedWarnings.length > 0) {
         if (normalizedWarnings.some((warning) => warning.startsWith("extension_manifest_"))) {
-            remediation.push(`Run pm extension --explore ${scopeFlag} to inspect discovered manifests and directories.`);
+            remediation.push(`Run ${lifecycleFlagCommand(options, "explore")} ${scopeFlag} to inspect discovered manifests and directories.`);
         }
         if (normalizedWarnings.some((warning) => warning.startsWith("extension_capability_unknown:"))) {
             remediation.push(`Unknown extension capabilities detected. Allowed capabilities: ${KNOWN_EXTENSION_CAPABILITIES.join(", ")}. ` +
@@ -1162,14 +1489,14 @@ function buildExtensionTriageSummary(scope, warnings, extensions) {
         }
         if (normalizedWarnings.some((warning) => warning.startsWith("extension_load_failed_sdk_dependency_missing:"))) {
             remediation.push(`Detected extension load failures caused by missing SDK dependency resolution. ` +
-                `Ensure extension package dependencies include "@unbrained/pm-cli" and reinstall dependencies before running pm extension --doctor ${scopeFlag}.`);
+                `Ensure extension package dependencies include "@unbrained/pm-cli" and reinstall dependencies before running ${lifecycleFlagCommand(options, "doctor")} ${scopeFlag}.`);
         }
         if (normalizedWarnings.some((warning) => warning.startsWith("extension_load_failed_module_mode_mismatch:"))) {
             remediation.push(`Detected extension module-mode mismatches. For ESM-based extension entries/imports, set package.json "type": "module" ` +
-                `or use an explicit .mjs entry and rerun pm extension --doctor ${scopeFlag}.`);
+                `or use an explicit .mjs entry and rerun ${lifecycleFlagCommand(options, "doctor")} ${scopeFlag}.`);
         }
         if (updateCheckFailedTotal > 0) {
-            remediation.push(`Run pm extension --manage ${scopeFlag} after validating network and repository access.`);
+            remediation.push(`Run ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} after validating network and repository access.`);
         }
         if (normalizedWarnings.some((warning) => warning.startsWith("extension_manager_state_"))) {
             remediation.push(`Review and repair ${scope} managed extension state file if schema/read warnings persist.`);
@@ -1179,19 +1506,19 @@ function buildExtensionTriageSummary(scope, warnings, extensions) {
         }
     }
     if (updateHealthPartial) {
-        remediation.push(`Update-check coverage is partial because unmanaged extensions need adoption. Adopt existing installs via pm extension --manage ${scopeFlag} --fix-managed-state (or pm extension --adopt-all ${scopeFlag}, pm extension --adopt <name> ${scopeFlag}, or reinstall via pm extension --install ${scopeFlag} <source>).`);
+        remediation.push(`Update-check coverage is partial because unmanaged extensions need adoption. Adopt existing installs via ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} --fix-managed-state (or ${lifecycleFlagCommand(options, "adopt-all")} ${scopeFlag}, ${lifecycleFlagCommand(options, "adopt")} <name> ${scopeFlag}, or reinstall via ${lifecycleFlagCommand(options, "install")} ${scopeFlag} <source>).`);
     }
     else if (skippedUnmanagedTotal > 0) {
-        remediation.push(`Loaded unmanaged extensions are currently treated as informational. Use pm extension --manage ${scopeFlag} --fix-managed-state to adopt them for update checks.`);
+        remediation.push(`Loaded unmanaged extensions are currently treated as informational. Use ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} --fix-managed-state to adopt them for update checks.`);
     }
     if (skippedNonGithubTotal > 0) {
         remediation.push(`Non-GitHub managed extensions are skipped by update checks. Use doctor output for non-update diagnostics.`);
     }
     if (updateAvailableTotal > 0) {
-        remediation.push(`Update available managed extensions via pm extension --install ${scopeFlag} <source>.`);
+        remediation.push(`Update available managed extensions via ${lifecycleFlagCommand(options, "install")} ${scopeFlag} <source>.`);
     }
     if (remediation.length === 0) {
-        remediation.push(`No immediate action required. Re-run pm extension --manage ${scopeFlag} after extension changes.`);
+        remediation.push(`No immediate action required. Re-run ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} after extension changes.`);
     }
     return {
         status: effectiveWarnings.length === 0 ? "ok" : "warn",
@@ -1343,6 +1670,9 @@ export async function runExtension(target, options, global) {
         if (action === "reload" && normalizedInput === "reload") {
             return undefined;
         }
+        if (action === "catalog" && normalizedInput === "catalog") {
+            return undefined;
+        }
         const inferredInitAlias = action === "init" &&
             options.init !== true &&
             options.scaffold !== true &&
@@ -1374,7 +1704,7 @@ export async function runExtension(target, options, global) {
             throw new PmCliError('Action "init" does not accept --gh/--github/--ref options.', EXIT_CODE.USAGE);
         }
         const scaffoldTarget = requireTarget(normalizedTarget, action);
-        const scaffold = await scaffoldExtensionProject(scaffoldTarget);
+        const scaffold = await scaffoldExtensionProject(scaffoldTarget, options.vocabulary ?? "extension");
         const quotedTargetPath = JSON.stringify(scaffold.target_path);
         return withResult({
             scaffolded: scaffold.created_directory || scaffold.files.some((entry) => entry.status === "created"),
@@ -1386,9 +1716,9 @@ export async function runExtension(target, options, global) {
             created_directory: scaffold.created_directory,
             files: scaffold.files,
             next_steps: [
-                `Install the scaffold: pm extension --install --project ${quotedTargetPath}`,
+                `Install the scaffold: ${options.vocabulary === "package" ? "pm install --project" : "pm extension --install --project"} ${quotedTargetPath}`,
                 `Smoke-test command path: pm ${scaffold.command_name}`,
-                "Run extension diagnostics: pm extension --doctor --project --detail summary",
+                `Run diagnostics: ${options.vocabulary === "package" ? "pm package doctor" : "pm extension --doctor"} --project --detail summary`,
             ],
         });
     }
@@ -1440,9 +1770,45 @@ export async function runExtension(target, options, global) {
         }
         return withResult(details);
     }
+    if (action === "catalog") {
+        if (typeof normalizedTarget === "string" && normalizedTarget.length > 0 && normalizedTarget !== "catalog") {
+            throw new PmCliError('Action "catalog" does not accept a package target.', EXIT_CODE.USAGE);
+        }
+        return withResult(await buildBundledPackageCatalog(scope, global));
+    }
     if (action === "install") {
         const githubOption = resolveGithubOption(options);
         const explicitSourceInput = githubOption ?? requireTarget(normalizedTarget, action);
+        if (typeof githubOption !== "string" && isBundledPackageInstallAllTarget(explicitSourceInput)) {
+            if (typeof options.ref === "string" && options.ref.trim().length > 0) {
+                throw new PmCliError('Action "install all" does not accept --ref.', EXIT_CODE.USAGE);
+            }
+            const aliases = await listBundledPackageAliases();
+            const packages = [];
+            for (const alias of aliases) {
+                packages.push({
+                    alias,
+                    result: await runExtension(alias, { ...options, install: true }, global),
+                });
+            }
+            for (const entry of packages) {
+                warnings.push(...entry.result.warnings);
+            }
+            return withResult({
+                installed_all: true,
+                installed_count: packages.length,
+                packages: packages.map((entry) => ({
+                    alias: entry.alias,
+                    ok: entry.result.ok,
+                    extension: entry.result.details.extension,
+                    source: entry.result.details.source,
+                    destination_path: entry.result.details.destination_path,
+                    activated: entry.result.details.activated,
+                    settings_changed: entry.result.details.settings_changed,
+                    warnings: entry.result.warnings,
+                })),
+            });
+        }
         const bundledAliasSource = typeof githubOption === "string" ? null : await resolveBundledExtensionAliasSource(explicitSourceInput);
         const sourceInput = bundledAliasSource ?? explicitSourceInput;
         const installSource = parseExtensionInstallSource(sourceInput, {
@@ -1472,17 +1838,25 @@ export async function runExtension(target, options, global) {
                     input: installSource.input,
                     location: installSource.absolute_path,
                 }
-                : {
-                    kind: "github",
-                    input: installSource.input,
-                    location: resolvedSource.resolved_subpath ?? installSource.subpath ?? ".",
-                    repository: installSource.repository,
-                    owner: installSource.owner,
-                    repo: installSource.repo,
-                    ref: installSource.ref,
-                    subpath: resolvedSource.resolved_subpath ?? installSource.subpath,
-                    commit: resolvedSource.commit,
-                };
+                : installSource.kind === "npm"
+                    ? {
+                        kind: "npm",
+                        input: installSource.input,
+                        location: resolvedSource.resolved_subpath ?? ".",
+                        package: resolvedSource.npm_package,
+                        version: resolvedSource.npm_version,
+                    }
+                    : {
+                        kind: "github",
+                        input: installSource.input,
+                        location: resolvedSource.resolved_subpath ?? installSource.subpath ?? ".",
+                        repository: installSource.repository,
+                        owner: installSource.owner,
+                        repo: installSource.repo,
+                        ref: installSource.ref,
+                        subpath: resolvedSource.resolved_subpath ?? installSource.subpath,
+                        commit: resolvedSource.commit,
+                    };
             const now = nowIso();
             const existingManagedEntry = managedStateRead.state.entries.find((entry) => normalizeExtensionNameForMatch(entry.name) === normalizeExtensionNameForMatch(validated.manifest.name));
             const managedState = upsertManagedEntry(managedStateRead.state, {
@@ -1539,7 +1913,7 @@ export async function runExtension(target, options, global) {
         const adoption = await adoptUnmanagedExtensions(resolvedRoots.selected_root, scope, installed.extensions, managedStateRead.state);
         const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, adoption.state);
         warnings.push(...refreshedInstalled.warnings);
-        const triage = buildExtensionTriageSummary(scope, warnings, refreshedInstalled.extensions);
+        const triage = buildExtensionTriageSummary(scope, warnings, refreshedInstalled.extensions, options);
         warnings.push(...triage.warnings);
         const adoptedDetails = adoption.adopted_entries.map((entry) => {
             const refreshedEntry = refreshedInstalled.extensions.find((candidate) => normalizeExtensionNameForMatch(candidate.name) === normalizeExtensionNameForMatch(entry.name) &&
@@ -1746,7 +2120,7 @@ export async function runExtension(target, options, global) {
             .filter((entry) => entry.update_check_status === "failed")
             .map((entry) => `extension_update_check_failed:${entry.name}`);
         warnings.push(...updateCheckWarnings);
-        const triage = buildExtensionTriageSummary(scope, warnings, runtimeInstalledExtensions);
+        const triage = buildExtensionTriageSummary(scope, warnings, runtimeInstalledExtensions, options);
         warnings.push(...triage.warnings);
         const normalizedWarnings = [...triage.warnings];
         const policySummary = {
@@ -1776,10 +2150,18 @@ export async function runExtension(target, options, global) {
             ...new Set([
                 ...triage.remediation,
                 ...(loadResult.failed.length > 0
-                    ? ["Run pm extension --explore --project and pm extension --explore --global to inspect load failures."]
+                    ? [
+                        options.vocabulary === "package"
+                            ? "Run pm package explore --project and pm package explore --global to inspect load failures."
+                            : "Run pm extension --explore --project and pm extension --explore --global to inspect load failures.",
+                    ]
                     : []),
                 ...(activationResult.failed.length > 0
-                    ? ["Review activation failures in pm extension --doctor --detail deep output."]
+                    ? [
+                        options.vocabulary === "package"
+                            ? "Review activation failures in pm package doctor --detail deep output."
+                            : "Review activation failures in pm extension --doctor --detail deep output.",
+                    ]
                     : []),
                 ...(managedStateFix && managedStateFix.adopted_entries.length > 0
                     ? [`Managed-state fix adopted ${managedStateFix.adopted_entries.length} extension(s).`]
@@ -1956,7 +2338,7 @@ export async function runExtension(target, options, global) {
         }
         let runtimeProbeSummary;
         let runtimeInstalledExtensions = refreshedInstalled.extensions;
-        if (action === "manage" && options.runtimeProbe === true) {
+        if (action === "explore" || options.runtimeProbe === true) {
             const loadResult = await loadExtensions({
                 pmRoot: resolvedRoots.pm_root,
                 settings,
@@ -1973,6 +2355,7 @@ export async function runExtension(target, options, global) {
             runtimeProbeSummary = {
                 requested: true,
                 executed: true,
+                reason: action === "explore" ? "explore_defaults_to_runtime_probe" : "runtime_probe_requested",
                 load_failure_count: loadResult.failed.length,
                 activation_failure_count: activationResult.failed.length,
                 warning_count: [...new Set([...loadResult.warnings, ...activationResult.warnings])].length,
@@ -1981,11 +2364,11 @@ export async function runExtension(target, options, global) {
         }
         else if (action === "manage") {
             runtimeProbeSummary = {
-                requested: options.runtimeProbe === true,
+                requested: false,
                 executed: false,
             };
         }
-        const triage = buildExtensionTriageSummary(scope, warnings, runtimeInstalledExtensions);
+        const triage = buildExtensionTriageSummary(scope, warnings, runtimeInstalledExtensions, options);
         warnings.push(...triage.warnings);
         const details = {
             total: runtimeInstalledExtensions.length,
@@ -1996,6 +2379,9 @@ export async function runExtension(target, options, global) {
             triage,
             policy: configuredPolicy,
         };
+        if (action === "explore") {
+            details.runtime_probe = runtimeProbeSummary;
+        }
         if (action === "manage") {
             details.runtime_probe = runtimeProbeSummary;
             details.managed_state_fix =