@unbrained/pm-cli 2026.6.24 → 2026.7.1

package/dist/sdk/compose.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="376f0804-a437-515f-a653-485531d98f13")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ef101a7b-f751-5242-8a7b-099f2a969a46")}catch(e){}}();
 import { normalizeKnownExtensionCapability, resolveLegacyExtensionCapabilityAlias, } from "../core/extensions/extension-capability-aliases.js";
 import { normalizeCommandName } from "../core/extensions/extension-runtime-helpers.js";
 import { evaluatePmMaxVersionBound, evaluatePmMinVersionBound, } from "../core/extensions/version-compat.js";
@@ -35,14 +35,104 @@ export function defineExtension(module) {
 export function defineExtensionBlueprint(blueprint) {
     return blueprint;
 }
+/**
+ * Register a blueprint's command-layer surfaces — fresh command definitions,
+ * command overrides, flag tables, and parser/renderer/service overrides — in the
+ * deterministic order {@link composeExtension} documents.
+ */
+function registerBlueprintCommandSurfaces(api, blueprint) {
+    for (const command of blueprint.commands ?? []) {
+        api.registerCommand(command);
+    }
+    for (const [command, override] of Object.entries(blueprint.commandOverrides ?? {})) {
+        api.registerCommand(command, override);
+    }
+    for (const [targetCommand, flags] of Object.entries(blueprint.flags ?? {})) {
+        api.registerFlags(targetCommand, flags);
+    }
+    for (const [command, override] of Object.entries(blueprint.parsers ?? {})) {
+        api.registerParser(command, override);
+    }
+    for (const [format, renderer] of Object.entries(blueprint.renderers ?? {})) {
+        api.registerRenderer(format, renderer);
+    }
+    for (const [service, override] of Object.entries(blueprint.services ?? {})) {
+        api.registerService(service, override);
+    }
+}
+/**
+ * Register a blueprint's schema-layer surfaces — preflight overrides, item types,
+ * item fields, schema migrations, and project profiles — preserving the
+ * batch-registration semantics of `registerItemTypes`/`registerItemFields`
+ * (only invoked when at least one entry is present).
+ */
+function registerBlueprintSchemaSurfaces(api, blueprint) {
+    for (const override of blueprint.preflights ?? []) {
+        api.registerPreflight(override);
+    }
+    const itemTypes = blueprint.itemTypes ?? [];
+    if (itemTypes.length > 0) {
+        api.registerItemTypes(itemTypes);
+    }
+    const itemFields = blueprint.itemFields ?? [];
+    if (itemFields.length > 0) {
+        api.registerItemFields(itemFields);
+    }
+    for (const migration of blueprint.migrations ?? []) {
+        api.registerMigration(migration);
+    }
+    for (const profile of blueprint.profiles ?? []) {
+        api.registerProfile(profile);
+    }
+}
+/**
+ * Register a blueprint's retrieval and interchange surfaces — search providers,
+ * vector store adapters, importers, and exporters — passing each importer's and
+ * exporter's optional registration options through verbatim.
+ */
+function registerBlueprintRetrievalSurfaces(api, blueprint) {
+    for (const provider of blueprint.searchProviders ?? []) {
+        api.registerSearchProvider(provider);
+    }
+    for (const adapter of blueprint.vectorStoreAdapters ?? []) {
+        api.registerVectorStoreAdapter(adapter);
+    }
+    for (const entry of blueprint.importers ?? []) {
+        api.registerImporter(entry.name, entry.importer, entry.options);
+    }
+    for (const entry of blueprint.exporters ?? []) {
+        api.registerExporter(entry.name, entry.exporter, entry.options);
+    }
+}
+/**
+ * Register a blueprint's lifecycle hooks in canonical order
+ * (beforeCommand → afterCommand → onWrite → onRead → onIndex).
+ */
+function registerBlueprintHooks(api, hooks) {
+    for (const hook of hooks.beforeCommand ?? []) {
+        api.hooks.beforeCommand(hook);
+    }
+    for (const hook of hooks.afterCommand ?? []) {
+        api.hooks.afterCommand(hook);
+    }
+    for (const hook of hooks.onWrite ?? []) {
+        api.hooks.onWrite(hook);
+    }
+    for (const hook of hooks.onRead ?? []) {
+        api.hooks.onRead(hook);
+    }
+    for (const hook of hooks.onIndex ?? []) {
+        api.hooks.onIndex(hook);
+    }
+}
 /**
  * Assemble an {@link ExtensionModule} from a declarative {@link ExtensionBlueprint}.
  *
  * The returned module's `activate` registers every populated surface through the
  * matching `api.register*` method in a deterministic order (commands → overrides
  * → flags → parsers → renderers → services → preflights → item types → item
- * fields → migrations → search providers → vector store adapters → importers →
- * exporters → hooks), then awaits the blueprint's optional imperative `activate`
+ * fields → migrations → profiles → search providers → vector store adapters →
+ * importers → exporters → hooks), then awaits the blueprint's optional imperative `activate`
  * so it can layer on anything the declarative form cannot express. `manifest`
  * and `deactivate` are copied onto the module verbatim.
  *
@@ -53,70 +143,14 @@ export function defineExtensionBlueprint(blueprint) {
  */
 export function composeExtension(blueprint) {
     const activate = async (api) => {
-        for (const command of blueprint.commands ?? []) {
-            api.registerCommand(command);
-        }
-        for (const [command, override] of Object.entries(blueprint.commandOverrides ?? {})) {
-            api.registerCommand(command, override);
-        }
-        for (const [targetCommand, flags] of Object.entries(blueprint.flags ?? {})) {
-            api.registerFlags(targetCommand, flags);
-        }
-        for (const [command, override] of Object.entries(blueprint.parsers ?? {})) {
-            api.registerParser(command, override);
-        }
-        for (const [format, renderer] of Object.entries(blueprint.renderers ?? {})) {
-            api.registerRenderer(format, renderer);
-        }
-        for (const [service, override] of Object.entries(blueprint.services ?? {})) {
-            api.registerService(service, override);
-        }
-        for (const override of blueprint.preflights ?? []) {
-            api.registerPreflight(override);
-        }
-        const itemTypes = blueprint.itemTypes ?? [];
-        if (itemTypes.length > 0) {
-            api.registerItemTypes(itemTypes);
-        }
-        const itemFields = blueprint.itemFields ?? [];
-        if (itemFields.length > 0) {
-            api.registerItemFields(itemFields);
-        }
-        for (const migration of blueprint.migrations ?? []) {
-            api.registerMigration(migration);
-        }
-        for (const provider of blueprint.searchProviders ?? []) {
-            api.registerSearchProvider(provider);
-        }
-        for (const adapter of blueprint.vectorStoreAdapters ?? []) {
-            api.registerVectorStoreAdapter(adapter);
-        }
-        for (const entry of blueprint.importers ?? []) {
-            api.registerImporter(entry.name, entry.importer, entry.options);
-        }
-        for (const entry of blueprint.exporters ?? []) {
-            api.registerExporter(entry.name, entry.exporter, entry.options);
-        }
+        registerBlueprintCommandSurfaces(api, blueprint);
+        registerBlueprintSchemaSurfaces(api, blueprint);
+        registerBlueprintRetrievalSurfaces(api, blueprint);
         // `?? {}` (rather than a `!== undefined` guard) so an explicit `hooks: null`
         // crossing an untyped boundary (e.g. a blueprint hydrated from JSON) is
         // treated the same as omitting it, instead of throwing on the first
         // `hooks.beforeCommand` access.
-        const hooks = blueprint.hooks ?? {};
-        for (const hook of hooks.beforeCommand ?? []) {
-            api.hooks.beforeCommand(hook);
-        }
-        for (const hook of hooks.afterCommand ?? []) {
-            api.hooks.afterCommand(hook);
-        }
-        for (const hook of hooks.onWrite ?? []) {
-            api.hooks.onWrite(hook);
-        }
-        for (const hook of hooks.onRead ?? []) {
-            api.hooks.onRead(hook);
-        }
-        for (const hook of hooks.onIndex ?? []) {
-            api.hooks.onIndex(hook);
-        }
+        registerBlueprintHooks(api, blueprint.hooks ?? {});
         await blueprint.activate?.(api);
     };
     // Truthy checks (rather than `!== undefined`) so an explicit `null` mirror or
@@ -210,8 +244,8 @@ function mergeHookSurfaces(surfaces) {
  * combines the way its underlying `api.register*` call composes:
  *
  * - **Array surfaces** — `commands`, `preflights`, `itemTypes`, `itemFields`,
- *   `migrations`, `searchProviders`, `vectorStoreAdapters`, `importers`,
- *   `exporters` — concatenate in argument order.
+ *   `migrations`, `profiles`, `searchProviders`, `vectorStoreAdapters`,
+ *   `importers`, `exporters` — concatenate in argument order.
  * - **`flags`** concatenates the flag arrays of any shared target command,
  *   mirroring additive `api.registerFlags`: every module's flags reach the command.
  * - **Single-handler records** — `commandOverrides`, `parsers`, `renderers`,
@@ -252,6 +286,7 @@ export function mergeExtensionBlueprints(...blueprints) {
     assign("itemTypes", mergeArraySurface(blueprints.map((blueprint) => blueprint.itemTypes)));
     assign("itemFields", mergeArraySurface(blueprints.map((blueprint) => blueprint.itemFields)));
     assign("migrations", mergeArraySurface(blueprints.map((blueprint) => blueprint.migrations)));
+    assign("profiles", mergeArraySurface(blueprints.map((blueprint) => blueprint.profiles)));
     assign("searchProviders", mergeArraySurface(blueprints.map((blueprint) => blueprint.searchProviders)));
     assign("vectorStoreAdapters", mergeArraySurface(blueprints.map((blueprint) => blueprint.vectorStoreAdapters)));
     assign("importers", mergeArraySurface(blueprints.map((blueprint) => blueprint.importers)));
@@ -322,6 +357,7 @@ const BLUEPRINT_FIELD_CAPABILITIES = [
     ["itemTypes", "schema"],
     ["itemFields", "schema"],
     ["migrations", "schema"],
+    ["profiles", "schema"],
     ["parsers", "parser"],
     ["renderers", "renderers"],
     ["services", "services"],
@@ -366,9 +402,29 @@ export function deriveExtensionCapabilities(blueprint) {
     // what activation enforces when a command declares flags inline and the
     // blueprint has no separate `flags` field. `!== undefined` (not a truthiness or
     // length check) matches the loader's exact guard, including an empty inline array.
-    if ((blueprint.commands ?? []).some((command) => command.flags !== undefined)) {
+    if ((blueprint.commands ?? []).filter(isPresent).some((command) => command.flags !== undefined)) {
         capabilities.add("schema");
     }
+    // `registerImporter`/`registerExporter` with `options.flags` register flag
+    // metadata through the same surface as `registerFlags`, asserting the `schema`
+    // capability on top of `importers` (loader `applyImportExportCommandMetadata`).
+    // Mirror that guard so a flag-bearing importer/exporter derives `schema` too —
+    // otherwise a least-privilege manifest synthesized from the blueprint would
+    // under-grant `schema` and fail activation. `!== undefined` matches the loader's
+    // exact `options.flags` guard, including an empty flag array. `entry?.` keeps a
+    // malformed null array entry (from an untyped `.js`/JSON boundary) from crashing
+    // derivation, consistent with the null-field robustness above.
+    const importExportEntries = [...(blueprint.importers ?? []), ...(blueprint.exporters ?? [])].filter(isPresent);
+    if (importExportEntries.some((entry) => entry?.options?.flags !== undefined)) {
+        capabilities.add("schema");
+    }
+    // Importers/exporters always synthesize command handlers (`<name> import` /
+    // `<name> export`), so runtime capability summaries attribute them to the
+    // commands surface as well as the importers surface. Keep the author-time
+    // capability preview aligned with describeExtensionActivation.
+    if (importExportEntries.some((entry) => typeof entry === "object")) {
+        capabilities.add("commands");
+    }
     // `?? {}` keeps an explicit `hooks: null` from throwing, mirroring composeExtension.
     const hooks = blueprint.hooks ?? {};
     if ([hooks.beforeCommand, hooks.afterCommand, hooks.onWrite, hooks.onRead, hooks.onIndex].some(hasEntries)) {
@@ -394,6 +450,9 @@ const BLUEPRINT_HOOK_FIELD_TO_KIND = [
 function sortUnique(values) {
     return [...new Set(values)].sort((left, right) => left.localeCompare(right));
 }
+function isPresent(value) {
+    return value !== null && value !== undefined;
+}
 /**
  * Compute, without activating, the exact {@link ExtensionActivationSummary} that
  * {@link composeExtension}'s generated `activate` would produce for a blueprint.
@@ -419,16 +478,36 @@ function sortUnique(values) {
  * blueprint that registers everything through that hatch summarizes as empty.
  */
 export function describeExtensionBlueprint(blueprint) {
-    const commandPaths = (blueprint.commands ?? []).map((command) => normalizeCommandName(command.name));
-    const importerPaths = (blueprint.importers ?? []).map((entry) => normalizeCommandName(`${entry.name} import`));
-    const exporterPaths = (blueprint.exporters ?? []).map((entry) => normalizeCommandName(`${entry.name} export`));
+    const commands = (blueprint.commands ?? []).filter(isPresent);
+    const importers = (blueprint.importers ?? []).filter(isPresent);
+    const exporters = (blueprint.exporters ?? []).filter(isPresent);
+    const importerPaths = importers.map((entry) => normalizeCommandName(`${entry.name} import`));
+    const exporterPaths = exporters.map((entry) => normalizeCommandName(`${entry.name} export`));
+    const importerCommandDefinitionPaths = importers
+        .filter((entry) => entry.options !== undefined)
+        .map((entry) => normalizeCommandName(`${entry.name} import`));
+    const exporterCommandDefinitionPaths = exporters
+        .filter((entry) => entry.options !== undefined)
+        .map((entry) => normalizeCommandName(`${entry.name} export`));
+    const commandPaths = [
+        ...commands.map((command) => normalizeCommandName(command.name)),
+        ...importerCommandDefinitionPaths,
+        ...exporterCommandDefinitionPaths,
+    ];
     // A command definition with inline `flags` registers a flag target under its own
-    // path in addition to any top-level `flags` record, so union both sources.
+    // path in addition to any top-level `flags` record. Import/export options with
+    // `flags` register through the same runtime metadata path, so union all sources.
     const flagCommands = [
         ...Object.keys(blueprint.flags ?? {}).map((command) => normalizeCommandName(command)),
-        ...(blueprint.commands ?? [])
+        ...commands
             .filter((command) => command.flags !== undefined)
             .map((command) => normalizeCommandName(command.name)),
+        ...importers
+            .filter((entry) => entry.options?.flags !== undefined)
+            .map((entry) => normalizeCommandName(`${entry.name} import`)),
+        ...exporters
+            .filter((entry) => entry.options?.flags !== undefined)
+            .map((entry) => normalizeCommandName(`${entry.name} export`)),
     ];
     const hooks = blueprint.hooks ?? {};
     return {
@@ -445,8 +524,9 @@ export function describeExtensionBlueprint(blueprint) {
         // id-less migrations register but carry no identifier, so they are omitted —
         // exactly as describeExtensionActivation drops them from its `migrations` list.
         migrations: sortUnique((blueprint.migrations ?? []).flatMap((migration) => (typeof migration.id === "string" ? [migration.id] : []))),
-        importers: sortUnique((blueprint.importers ?? []).map((entry) => normalizeCommandName(entry.name))),
-        exporters: sortUnique((blueprint.exporters ?? []).map((entry) => normalizeCommandName(entry.name))),
+        profiles: sortUnique((blueprint.profiles ?? []).map((profile) => profile.name)),
+        importers: sortUnique(importers.map((entry) => normalizeCommandName(entry.name))),
+        exporters: sortUnique(exporters.map((entry) => normalizeCommandName(entry.name))),
         search_providers: sortUnique((blueprint.searchProviders ?? []).map((provider) => provider.name)),
         vector_store_adapters: sortUnique((blueprint.vectorStoreAdapters ?? []).map((adapter) => adapter.name)),
         parser_overrides: sortUnique(Object.keys(blueprint.parsers ?? {}).map((command) => normalizeCommandName(command))),
@@ -472,6 +552,7 @@ const BLUEPRINT_LINTABLE_SURFACE_FIELDS = [
     "itemTypes",
     "itemFields",
     "migrations",
+    "profiles",
     "searchProviders",
     "vectorStoreAdapters",
     "importers",
@@ -495,34 +576,14 @@ function normalizeDeclaredCapabilities(capabilities) {
     return [...known].sort((left, right) => left.localeCompare(right));
 }
 /**
- * Preflight a declarative {@link ExtensionBlueprint} at author time, returning the
- * structured issues that would otherwise only surface at activation.
- *
- * It is the author-time inverse of the runtime extension guardrails — pure data
- * analysis with no loading, activation, or side effects:
- *
- * - capability drift in both directions: a capability a surface exercises but the
- *   declared set omits is an `error` (the loader throws `extension_capability_missing`
- *   at activation); a declared capability no surface exercises is a `warning` (the
- *   author-time form of the `pm package doctor` `extension_capability_unused` note,
- *   making this the static inverse of `reconcileExtensionCapabilityUsage`).
- * - structural footguns: a command path declared twice (`duplicate_command`), a
- *   path declared as both a command and an override (`command_override_conflict`),
- *   and a registration field present but empty (`empty_surface`).
- *
- * The declared set is taken from `options.declaredCapabilities` or, failing that,
- * `blueprint.manifest.capabilities`; with neither, capability reconciliation is
- * skipped and a single `manifest_capabilities_absent` warning suggests adopting
- * {@link deriveExtensionCapabilities}. Like {@link describeExtensionBlueprint},
- * the imperative `activate` escape hatch is invisible to this static check.
+ * Reconcile a blueprint's exercised capabilities against its declared set: a
+ * used-but-undeclared capability is an `error` (activation throws
+ * `extension_capability_missing`), a declared-but-unused one a `warning`, and a
+ * wholly absent declared set (`declared === null`) yields the single
+ * `manifest_capabilities_absent` adoption hint.
  */
-export function lintExtensionBlueprint(blueprint, options = {}) {
+function collectBlueprintCapabilityFindings(used, declared) {
     const findings = [];
-    const used = deriveExtensionCapabilities(blueprint);
-    // A non-array declared source (an untyped `.js` author's malformed manifest, or
-    // a missing field) is treated as "no declared set" rather than "declares nothing".
-    const declaredSource = options.declaredCapabilities ?? blueprint.manifest?.capabilities;
-    const declared = Array.isArray(declaredSource) ? normalizeDeclaredCapabilities(declaredSource) : null;
     if (declared === null) {
         if (used.length > 0) {
             findings.push({
@@ -531,32 +592,40 @@ export function lintExtensionBlueprint(blueprint, options = {}) {
                 message: `Blueprint exercises ${used.length === 1 ? "capability" : "capabilities"} [${used.join(", ")}] but declares none; set capabilities to deriveExtensionCapabilities(blueprint) so the manifest grant matches.`,
             });
         }
+        return findings;
     }
-    else {
-        const declaredSet = new Set(declared);
-        const usedSet = new Set(used);
-        for (const capability of used) {
-            if (!declaredSet.has(capability)) {
-                findings.push({
-                    code: "capability_undeclared",
-                    severity: "error",
-                    message: `Blueprint exercises capability "${capability}" but it is absent from the declared capabilities; activation throws extension_capability_missing — add "${capability}" to the manifest capabilities.`,
-                    capability,
-                });
-            }
+    const declaredSet = new Set(declared);
+    const usedSet = new Set(used);
+    for (const capability of used) {
+        if (!declaredSet.has(capability)) {
+            findings.push({
+                code: "capability_undeclared",
+                severity: "error",
+                message: `Blueprint exercises capability "${capability}" but it is absent from the declared capabilities; activation throws extension_capability_missing — add "${capability}" to the manifest capabilities.`,
+                capability,
+            });
         }
-        for (const capability of declared) {
-            if (!usedSet.has(capability)) {
-                findings.push({
-                    code: "capability_unused",
-                    severity: "warning",
-                    message: `Capability "${capability}" is declared but no blueprint surface exercises it; drop it to keep the manifest least-privilege (pm package doctor reports this as extension_capability_unused).`,
-                    capability,
-                });
-            }
+    }
+    for (const capability of declared) {
+        if (!usedSet.has(capability)) {
+            findings.push({
+                code: "capability_unused",
+                severity: "warning",
+                message: `Capability "${capability}" is declared but no blueprint surface exercises it; drop it to keep the manifest least-privilege (pm package doctor reports this as extension_capability_unused).`,
+                capability,
+            });
         }
     }
-    // Duplicate command paths within the declared command definitions.
+    return findings;
+}
+/**
+ * Detect structural command footguns in a blueprint: a command path declared
+ * more than once (`duplicate_command`, the later registration shadowing the
+ * earlier at dispatch) and a path declared both as a fresh command definition
+ * and as an override (`command_override_conflict`).
+ */
+function collectBlueprintCommandFindings(blueprint) {
+    const findings = [];
     const commandPathCounts = new Map();
     for (const command of blueprint.commands ?? []) {
         const path = normalizeCommandName(command.name);
@@ -572,7 +641,6 @@ export function lintExtensionBlueprint(blueprint, options = {}) {
             });
         }
     }
-    // A command path declared as both a fresh definition and an override.
     const overridePaths = new Set(Object.keys(blueprint.commandOverrides ?? {}).map((command) => normalizeCommandName(command)));
     for (const path of commandPathCounts.keys()) {
         if (overridePaths.has(path)) {
@@ -584,7 +652,15 @@ export function lintExtensionBlueprint(blueprint, options = {}) {
             });
         }
     }
-    // Registration fields present on the blueprint but contributing nothing.
+    return findings;
+}
+/**
+ * Flag blueprint registration fields that are present but contribute nothing —
+ * an empty array/record surface, or a `hooks` object registering no lifecycle
+ * hook — each reported as an `empty_surface` warning (fields first, then hooks).
+ */
+function collectBlueprintEmptySurfaceFindings(blueprint) {
+    const findings = [];
     for (const field of BLUEPRINT_LINTABLE_SURFACE_FIELDS) {
         if (field in blueprint && !hasEntries(blueprint[field])) {
             findings.push({
@@ -607,6 +683,46 @@ export function lintExtensionBlueprint(blueprint, options = {}) {
             });
         }
     }
+    return findings;
+}
+/**
+ * Preflight a declarative {@link ExtensionBlueprint} at author time, returning the
+ * structured issues that would otherwise only surface at activation.
+ *
+ * It is the author-time inverse of the runtime extension guardrails — pure data
+ * analysis with no loading, activation, or side effects:
+ *
+ * - capability drift in both directions: a capability a surface exercises but the
+ *   declared set omits is an `error` (the loader throws `extension_capability_missing`
+ *   at activation); a declared capability no surface exercises is a `warning` (the
+ *   author-time form of the `pm package doctor` `extension_capability_unused` note,
+ *   making this the static inverse of `reconcileExtensionCapabilityUsage`).
+ * - structural footguns: a command path declared twice (`duplicate_command`), a
+ *   path declared as both a command and an override (`command_override_conflict`),
+ *   and a registration field present but empty (`empty_surface`).
+ *
+ * The declared set is taken from `options.declaredCapabilities` or, failing that,
+ * `blueprint.manifest.capabilities`; with neither, capability reconciliation is
+ * skipped and a single `manifest_capabilities_absent` warning suggests adopting
+ * {@link deriveExtensionCapabilities}. Like {@link describeExtensionBlueprint},
+ * the imperative `activate` escape hatch is invisible to this static check. The
+ * findings are assembled from the per-dimension collectors
+ * ({@link collectBlueprintCapabilityFindings}, {@link collectBlueprintCommandFindings},
+ * {@link collectBlueprintEmptySurfaceFindings}) in that detection order.
+ */
+export function lintExtensionBlueprint(blueprint, options = {}) {
+    const used = deriveExtensionCapabilities(blueprint);
+    // A non-array declared source (an untyped `.js` author's malformed manifest, or
+    // a missing field) is treated as "no declared set" rather than "declares nothing".
+    const declaredSource = options.declaredCapabilities ?? blueprint.manifest?.capabilities;
+    const declared = Array.isArray(declaredSource) ? normalizeDeclaredCapabilities(declaredSource) : null;
+    // Findings accumulate in detection order: capability drift, then command
+    // duplicates/conflicts, then empty surfaces.
+    const findings = [
+        ...collectBlueprintCapabilityFindings(used, declared),
+        ...collectBlueprintCommandFindings(blueprint),
+        ...collectBlueprintEmptySurfaceFindings(blueprint),
+    ];
     return {
         ok: findings.every((finding) => finding.severity !== "error"),
         findings,
@@ -838,4 +954,4 @@ export function preflightExtension(blueprint, options = {}) {
     };
 }
 //# sourceMappingURL=compose.js.map
-//# debugId=376f0804-a437-515f-a653-485531d98f13
+//# debugId=ef101a7b-f751-5242-8a7b-099f2a969a46