@unbrained/pm-cli 2026.6.23 → 2026.6.30

package/dist/sdk/compose.d.ts

@@ -27,6 +27,9 @@
  */
 import type { AfterCommandHook, BeforeCommandHook, CommandDefinition, CommandOverride, ExtensionApi, ExtensionCapability, ExtensionManifest, ExtensionServiceName, Exporter, FlagDefinition, ImportExportRegistrationOptions, Importer, OnIndexHook, OnReadHook, OnWriteHook, OutputRendererFormat, ParserOverride, PreflightOverride, RendererOverride, SchemaFieldDefinition, SchemaItemTypeDefinition, SchemaMigrationDefinition, SearchProviderDefinition, ServiceOverride, VectorStoreAdapterDefinition } from "../core/extensions/loader.js";
 import type { ExtensionActivationSummary } from "../core/extensions/activation-summary.js";
+import type { ProjectProfileRegistrationInput } from "../core/profile/profile-presets.js";
+import type { PmMaxVersionExceededMode } from "../core/extensions/extension-types.js";
+import { type PmVersionBoundKind } from "../core/extensions/version-compat.js";
 /**
  * Documents the extension module payload exchanged by command, SDK, and package integrations.
  *
@@ -41,8 +44,8 @@ export interface ExtensionModule {
      *
      * The authoritative manifest remains on-disk `manifest.json`; this field is
      * useful when authors want colocated metadata for tooling/tests. Type it with
-     * {@link defineExtensionManifest} for full contract checking in plain
-     * JavaScript packages.
+     * {@link defineExtensionManifest} for full contract checking at the definition
+     * site.
      */
     manifest?: ExtensionManifest;
     activate(api: ExtensionApi): void | Promise<void>;
@@ -140,6 +143,8 @@ export interface ExtensionBlueprint {
     itemFields?: SchemaFieldDefinition[];
     /** Schema migrations registered one at a time via `api.registerMigration(definition)`. */
     migrations?: SchemaMigrationDefinition[];
+    /** Project profiles registered one at a time via `api.registerProfile(profile)`. */
+    profiles?: ProjectProfileRegistrationInput[];
     /** Search providers registered via `api.registerSearchProvider(provider)`. */
     searchProviders?: SearchProviderDefinition[];
     /** Vector store adapters registered via `api.registerVectorStoreAdapter(adapter)`. */
@@ -158,14 +163,32 @@ export interface ExtensionBlueprint {
     /** Optional teardown hook copied onto the produced module verbatim. */
     deactivate?: () => void | Promise<void>;
 }
+/**
+ * Typed identity helper for a (partial) {@link ExtensionBlueprint} authored as its
+ * own module — the typed entry point of the modular declarative-authoring loop.
+ *
+ * It is the natural companion to {@link mergeExtensionBlueprints}: when an
+ * extension's surface is split across files — a commands module, a search module,
+ * a hooks module — wrap each fragment so it is contract-checked *at its definition
+ * site* (with editor completion), exactly as {@link defineExtension} types a whole
+ * module and {@link defineExtensionManifest} types a manifest. It returns its
+ * argument unchanged, preserving the literal type
+ * so the fragment composes into {@link mergeExtensionBlueprints},
+ * {@link composeExtension}, or {@link composeExtensionPackage} with no loss of
+ * inference.
+ *
+ * Use as:
+ * `export const commandsModule = defineExtensionBlueprint({ commands: [...] })`
+ */
+export declare function defineExtensionBlueprint<TBlueprint extends ExtensionBlueprint>(blueprint: TBlueprint): TBlueprint;
 /**
  * Assemble an {@link ExtensionModule} from a declarative {@link ExtensionBlueprint}.
  *
  * The returned module's `activate` registers every populated surface through the
  * matching `api.register*` method in a deterministic order (commands → overrides
  * → flags → parsers → renderers → services → preflights → item types → item
- * fields → migrations → search providers → vector store adapters → importers →
- * exporters → hooks), then awaits the blueprint's optional imperative `activate`
+ * fields → migrations → profiles → search providers → vector store adapters →
+ * importers → exporters → hooks), then awaits the blueprint's optional imperative `activate`
  * so it can layer on anything the declarative form cannot express. `manifest`
  * and `deactivate` are copied onto the module verbatim.
  *
@@ -175,6 +198,44 @@ export interface ExtensionBlueprint {
  * the same activation diagnostic either way.
  */
 export declare function composeExtension(blueprint: ExtensionBlueprint): ExtensionModule;
+/**
+ * Merge several partial {@link ExtensionBlueprint}s into one, so an extension's
+ * surface can be authored *modularly* — a commands module, a search module, a
+ * hooks module — and combined into a single blueprint to feed
+ * {@link composeExtension}, {@link composeExtensionPackage},
+ * {@link synthesizeExtensionManifest}, {@link describeExtensionBlueprint}, or
+ * {@link preflightExtension}.
+ *
+ * The merge is pure and deterministic and never mutates an input. Each surface
+ * combines the way its underlying `api.register*` call composes:
+ *
+ * - **Array surfaces** — `commands`, `preflights`, `itemTypes`, `itemFields`,
+ *   `migrations`, `profiles`, `searchProviders`, `vectorStoreAdapters`,
+ *   `importers`, `exporters` — concatenate in argument order.
+ * - **`flags`** concatenates the flag arrays of any shared target command,
+ *   mirroring additive `api.registerFlags`: every module's flags reach the command.
+ * - **Single-handler records** — `commandOverrides`, `parsers`, `renderers`,
+ *   `services` — follow last-defined-wins precedence on a key collision, exactly
+ *   like spreading the records in argument order; a later module deliberately
+ *   overrides an earlier one's handler for that key.
+ * - **`hooks`** concatenates each lifecycle kind's array in canonical order.
+ * - The imperative **`activate`** escape hatches chain in argument order (each
+ *   awaited), so every module's escape-hatch wiring still runs.
+ * - The **`deactivate`** teardown hooks chain in *reverse* argument order (LIFO),
+ *   releasing resources in the inverse of acquisition. Teardown is best-effort:
+ *   a throwing hook does not strand later modules' cleanup — every hook runs and
+ *   teardown failures are re-thrown afterwards (as the original error for one
+ *   failure, or an `AggregateError` for several).
+ * - The **`manifest`** mirror is last-defined-wins.
+ *
+ * Because `composeExtension` and the derive/lint/describe helpers are pure readers
+ * of this data, a merged blueprint behaves exactly as a hand-written one: a command
+ * two modules both define survives as a duplicate in the merged `commands` array
+ * and {@link lintExtensionBlueprint} flags it, just as it would in one file. An
+ * empty field is omitted rather than emitted empty, so merging zero blueprints
+ * returns an empty blueprint (`{}`).
+ */
+export declare function mergeExtensionBlueprints(...blueprints: ExtensionBlueprint[]): ExtensionBlueprint;
 /**
  * Compute the minimal least-privilege capability set a {@link ExtensionBlueprint}
  * exercises, sorted and de-duplicated.
@@ -295,3 +356,284 @@ export interface ExtensionBlueprintLintResult {
  * the imperative `activate` escape hatch is invisible to this static check.
  */
 export declare function lintExtensionBlueprint(blueprint: ExtensionBlueprint, options?: LintExtensionBlueprintOptions): ExtensionBlueprintLintResult;
+/**
+ * The author-supplied identity fields {@link synthesizeExtensionManifest} cannot
+ * derive from a blueprint: every {@link ExtensionManifest} field except the
+ * generated `capabilities`.
+ *
+ * The blueprint determines `capabilities` (the surfaces it registers) and nothing
+ * else, so `name`/`version`/`entry`/`priority` and any optional metadata
+ * (engines, permissions, provenance, version floors/ceilings, sandbox profile,
+ * manifest version, activation, legacy aliases) are the author's to supply here.
+ */
+export interface SynthesizeExtensionManifestIdentity extends Omit<ExtensionManifest, "capabilities"> {
+    /**
+     * Extra capabilities to grant beyond the blueprint's derived set, for surfaces
+     * registered through the blueprint's imperative `activate` escape hatch that
+     * static derivation cannot see (e.g. a renderer wired in `activate`). Each is
+     * legacy-alias resolved and normalized like a declared manifest capability;
+     * unknown names are dropped (the synthesized manifest is validated at load).
+     */
+    additionalCapabilities?: readonly string[];
+}
+/**
+ * Generate a complete, least-privilege {@link ExtensionManifest} from a
+ * declarative {@link ExtensionBlueprint} and the author's identity fields.
+ *
+ * This is the *generate* verb that completes the declarative authoring loop
+ * (`compose → derive → describe/lint → synthesize`). Where
+ * {@link defineExtensionManifest} only *types* a hand-written manifest and
+ * {@link deriveExtensionCapabilities} computes only the capability set, this
+ * function assembles the whole manifest: it copies every author-supplied identity
+ * field verbatim and fills `capabilities` with `deriveExtensionCapabilities`
+ * unioned with any {@link SynthesizeExtensionManifestIdentity.additionalCapabilities | additionalCapabilities},
+ * sorted and de-duplicated. The author writes the blueprint once and never
+ * hand-syncs `manifest.capabilities` — declaring nothing the extension does not
+ * use and nothing it does.
+ *
+ * It is a pure assembler: it neither validates the blueprint definitions (that
+ * stays in `api.register*` at activation) nor the identity fields (the loader
+ * validates the on-disk manifest). Pair it with
+ * {@link ../sdk/testing.js#assertExtensionManifestMatchesBlueprint} to guard a
+ * hand-maintained `manifest.json` against drift in CI.
+ */
+export declare function synthesizeExtensionManifest(blueprint: ExtensionBlueprint, identity: SynthesizeExtensionManifestIdentity): ExtensionManifest;
+/**
+ * The two generated halves of a shippable extension package, returned by
+ * {@link composeExtensionPackage}.
+ */
+export interface ExtensionPackage {
+    /**
+     * The runtime {@link ExtensionModule} to export as the package entry's default
+     * export. Its `manifest` mirror is set to the same {@link ExtensionPackage.manifest}
+     * object, so the in-module metadata and the on-disk manifest never diverge.
+     */
+    module: ExtensionModule;
+    /**
+     * The complete least-privilege {@link ExtensionManifest} to write as the
+     * package's `manifest.json`, with `capabilities` derived from the blueprint.
+     */
+    manifest: ExtensionManifest;
+}
+/**
+ * Assemble both halves of a shippable extension package from one declarative
+ * {@link ExtensionBlueprint} and the author's identity fields — the author-once
+ * capstone of the declarative loop.
+ *
+ * Where {@link composeExtension} produces only the runtime module and
+ * {@link synthesizeExtensionManifest} produces only the manifest, this unifies
+ * them: it synthesizes the complete least-privilege manifest from the blueprint
+ * and identity, then composes the module with that synthesized manifest set as its
+ * authoritative in-module `manifest` mirror. Both halves are therefore generated
+ * from a single source and cannot drift — the module's `manifest` is the very
+ * object returned as `manifest`. Export `module` as the package entry's default
+ * export and write `manifest` as `manifest.json`.
+ *
+ * It is a pure assembler with no validation, loading, or filesystem access,
+ * exactly like the two functions it composes; pair it with
+ * {@link preflightExtension} (or {@link ../sdk/testing.js#assertExtensionPreflight})
+ * for the author-time verify step. Use {@link mergeExtensionBlueprints} first to
+ * assemble the blueprint modularly, then this to ship it.
+ */
+export declare function composeExtensionPackage(blueprint: ExtensionBlueprint, identity: SynthesizeExtensionManifestIdentity): ExtensionPackage;
+/**
+ * The target a {@link checkExtensionManifestCompatibility} call evaluates a
+ * manifest's version bounds against.
+ */
+export interface ExtensionManifestCompatibilityTarget {
+    /**
+     * The pm CLI version to check the manifest against, e.g. the running CLI's
+     * `version` or a version floor a package commits to supporting. Plain
+     * dotted-numeric (`2026.6.23`) or `v`-prefixed values are compared; anything
+     * uninterpretable yields an `unchecked` finding rather than a false verdict.
+     */
+    pmVersion: string;
+    /**
+     * How a `pm_max_version` overrun is treated, mirroring the runtime
+     * `extensions.policy.pm_max_version_exceeded_mode`. `"block"` (the default)
+     * reports an exceeded upper bound as a blocking incompatibility; `"warn"`
+     * reports it as a non-blocking advisory, matching an operator who relaxed the
+     * gate during a CLI upgrade window.
+     */
+    pmMaxVersionExceededMode?: PmMaxVersionExceededMode;
+}
+/**
+ * The manifest fields {@link checkExtensionManifestCompatibility} evaluates.
+ *
+ * Values are intentionally `unknown` rather than `string` so an author can
+ * preflight the same malformed blank/non-string bounds (e.g. read from a JSON
+ * manifest) the loader's manifest parser rejects as `extension_manifest_invalid`.
+ */
+export interface ExtensionManifestCompatibilityManifest {
+    /** Inclusive lower pm CLI version bound from `manifest.json`. */
+    pm_min_version?: unknown;
+    /** Inclusive upper pm CLI version bound from `manifest.json`. */
+    pm_max_version?: unknown;
+}
+/**
+ * The machine-readable kind of an {@link ExtensionManifestCompatibilityFinding},
+ * one per `<bound>_<outcome>` the loader can reach. Each mirrors a loader
+ * `extension_pm_*_version_*` warning: `*_invalid`/`*_unmet`/`*_exceeded` block the
+ * load, while `*_unchecked`/`*_exceeded_warn` are advisory (the extension still
+ * loads).
+ */
+export type ExtensionManifestCompatibilityCode = "pm_min_version_invalid" | "pm_min_version_unchecked" | "pm_min_version_unmet" | "pm_max_version_invalid" | "pm_max_version_unchecked" | "pm_max_version_exceeded" | "pm_max_version_exceeded_warn";
+/**
+ * A single version-bound issue {@link checkExtensionManifestCompatibility} found
+ * when evaluating a manifest against a target pm version.
+ */
+export interface ExtensionManifestCompatibilityFinding {
+    /** The machine-readable {@link ExtensionManifestCompatibilityCode} for programmatic handling. */
+    code: ExtensionManifestCompatibilityCode;
+    /** `error` when the bound blocks the load against the target version, `warning` when it is advisory. */
+    severity: "error" | "warning";
+    /** Which manifest bound produced the finding. */
+    constraint: PmVersionBoundKind;
+    /** The declared bound value, verbatim. */
+    required: string;
+    /** The target pm version the bound was evaluated against. */
+    current: string;
+    /** Human-readable explanation of the outcome and its effect on loading. */
+    message: string;
+}
+/**
+ * The structured result of {@link checkExtensionManifestCompatibility}.
+ */
+export interface ExtensionManifestCompatibilityResult {
+    /** `true` when no `error`-severity finding blocks the load against the target version. */
+    compatible: boolean;
+    /** Every bound finding, lower bound before upper bound; empty when both bounds are absent or satisfied. */
+    findings: ExtensionManifestCompatibilityFinding[];
+    /** The target pm version the manifest was checked against, echoed back for messaging. */
+    pmVersion: string;
+}
+/**
+ * Check, without loading anything, whether an extension manifest's declared
+ * version bounds permit it to load on a given pm CLI version.
+ *
+ * This is the author-time inverse of the loader's runtime version gate: where the
+ * loader resolves the *installed* CLI version (asynchronously, from `package.json`)
+ * and emits `extension_pm_*_version_*` warnings, this pure synchronous function
+ * takes the {@link ExtensionManifestCompatibilityTarget.pmVersion | target version}
+ * the author supplies and returns structured findings. Both share the
+ * {@link ../core/extensions/version-compat.js | version-compat core}, so the
+ * author-time verdict and the runtime decision agree by construction — a package
+ * author can pin a CI test to the pm version they support and catch a too-tight
+ * `pm_min_version`, a malformed `pm_max_version`, or an upper bound a newer CLI
+ * would exceed, long before publishing.
+ *
+ * `compatible` is `true` only when no bound blocks the load (`*_invalid`,
+ * `*_unmet`, and a `block`-mode `*_exceeded`); `*_unchecked` (an uninterpretable
+ * bound or target) and a `warn`-mode `*_exceeded_warn` are advisory `warning`
+ * findings that still load. Pair it with
+ * {@link ../sdk/testing.js#assertExtensionManifestCompatible} to fail CI on a
+ * blocking incompatibility.
+ */
+export declare function checkExtensionManifestCompatibility(manifest: ExtensionManifestCompatibilityManifest, target: ExtensionManifestCompatibilityTarget): ExtensionManifestCompatibilityResult;
+/**
+ * Options for {@link preflightExtension} and
+ * {@link ../sdk/testing.js#assertExtensionPreflight}. Every field is optional:
+ * each one a check enables, so an author opts into exactly the stages whose
+ * inputs they can supply.
+ */
+export interface PreflightExtensionOptions {
+    /**
+     * The author-supplied identity fields the blueprint cannot determine
+     * (`name`/`version`/`entry`/`priority`, version bounds, etc.). Provide them to
+     * have preflight {@link synthesizeExtensionManifest | synthesize} the complete
+     * least-privilege manifest and include it in the report; the synthesized
+     * version bounds then feed the {@link PreflightExtensionOptions.target | target}
+     * compatibility check. Omit to skip manifest synthesis.
+     */
+    identity?: SynthesizeExtensionManifestIdentity;
+    /**
+     * The pm CLI version (and optional max-version overrun mode) to evaluate the
+     * manifest's `pm_min_version`/`pm_max_version` bounds against. Provide it to run
+     * {@link checkExtensionManifestCompatibility} against the synthesized manifest
+     * (or, absent an `identity`, the blueprint's in-module `manifest` mirror). Omit
+     * to skip the version-compatibility check.
+     */
+    target?: ExtensionManifestCompatibilityTarget;
+    /**
+     * The capabilities the package's `manifest.json` declares, reconciled against
+     * the surfaces the blueprint exercises. Passed straight to
+     * {@link lintExtensionBlueprint}; when omitted it falls back to
+     * `blueprint.manifest.capabilities`, so the blueprint's in-module mirror is
+     * linted by default.
+     */
+    declaredCapabilities?: readonly string[];
+}
+/** Which preflight stage produced an {@link ExtensionPreflightFinding}. */
+export type ExtensionPreflightFindingSource = "blueprint" | "compatibility";
+/**
+ * A single finding in an {@link ExtensionPreflightReport}, flattened from one of
+ * the underlying stages and tagged with its {@link ExtensionPreflightFindingSource}
+ * so a consolidated report stays traceable to the check that raised it.
+ */
+export interface ExtensionPreflightFinding {
+    /** The stage that produced the finding: blueprint lint or version compatibility. */
+    source: ExtensionPreflightFindingSource;
+    /** Whether the finding blocks publish/activation (`error`) or is advisory (`warning`). */
+    severity: ExtensionBlueprintLintSeverity;
+    /** The underlying stage's machine-readable code, for programmatic handling. */
+    code: ExtensionBlueprintLintCode | ExtensionManifestCompatibilityCode;
+    /** The underlying stage's human-readable explanation, verbatim. */
+    message: string;
+}
+/**
+ * The consolidated result of {@link preflightExtension}: every author-time stage's
+ * structured output plus a flattened, source-tagged finding list.
+ */
+export interface ExtensionPreflightReport {
+    /** `true` when no `error`-severity finding appears across any stage (warnings still pass). */
+    ok: boolean;
+    /** The least-privilege capability set the blueprint exercises (from {@link deriveExtensionCapabilities}). */
+    capabilities: ExtensionCapability[];
+    /** The full {@link lintExtensionBlueprint} result (structural + capability-drift findings). */
+    blueprint: ExtensionBlueprintLintResult;
+    /** The manifest synthesized from `options.identity`, or `null` when no identity was supplied. */
+    manifest: ExtensionManifest | null;
+    /** The {@link checkExtensionManifestCompatibility} result, or `null` when no `options.target` was supplied. */
+    compatibility: ExtensionManifestCompatibilityResult | null;
+    /**
+     * Every finding from all stages, blueprint-lint findings before compatibility
+     * findings, each tagged by `source`. This is the consolidated, curated view: when
+     * `options.identity` synthesizes the manifest without an explicit
+     * `declaredCapabilities` set, capability-drift findings the lint raised against the
+     * blueprint's now-superseded in-module `manifest` mirror are omitted here (the raw
+     * `blueprint` result still carries them).
+     */
+    findings: ExtensionPreflightFinding[];
+}
+/**
+ * Preflight a declarative {@link ExtensionBlueprint} through every author-time
+ * check in one call, returning a single consolidated {@link ExtensionPreflightReport}.
+ *
+ * This is the author-time capstone — the static analog of
+ * {@link ../sdk/testing.js#createExtensionTestHarness}, which unified the
+ * runtime-test helpers. Instead of chaining {@link lintExtensionBlueprint},
+ * {@link synthesizeExtensionManifest}, and {@link checkExtensionManifestCompatibility}
+ * (and reconciling their separate results) before publishing a package, an author
+ * runs `preflightExtension(blueprint, { identity, target })` and reads one report:
+ *
+ * - the blueprint is always linted (structural footguns + capability drift);
+ * - when `options.identity` is given, the complete least-privilege manifest is
+ *   synthesized and returned, so the author never hand-syncs `capabilities`;
+ * - when `options.target` is given, the synthesized manifest's version bounds
+ *   (or, absent an identity, the blueprint's in-module `manifest` mirror) are
+ *   checked against that pm version.
+ *
+ * It is pure and side-effect-free — no loading, activation, or filesystem access,
+ * exactly like the stages it composes — so it is safe in any author-time or CI
+ * context. The per-stage structured results are exposed unmodified
+ * (`report.blueprint`/`manifest`/`compatibility`) alongside the flattened,
+ * source-tagged `report.findings`; `report.ok` is `false` if any stage produced an
+ * `error`-severity finding. The flattened `findings` are curated for the author-once
+ * flow: once an `identity` synthesizes the manifest (and no explicit
+ * `declaredCapabilities` was pinned), the synthesized manifest — not the blueprint's
+ * in-module `manifest` mirror — is what ships, so capability-drift findings the lint
+ * raised against that mirror are false positives and are omitted from
+ * `report.findings` (the raw `report.blueprint` result still reports them). Pair it
+ * with {@link ../sdk/testing.js#assertExtensionPreflight} to fail CI in one line.
+ */
+export declare function preflightExtension(blueprint: ExtensionBlueprint, options?: PreflightExtensionOptions): ExtensionPreflightReport;