@unbrained/pm-cli 2026.6.30 → 2026.7.1

package/dist/cli-bundle/chunks/{chunk-CY5IJMUM.js → chunk-7R4QEMZZ.js}

@@ -1,6 +1,6 @@
 // dist/core/fs/fs-utils.js
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b452df4b-661b-5f08-9d20-dff37c4bfb2f")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="03ed13d8-75ea-5f3b-b089-a7347a59acca")}catch(e){}}();
 import * as fs from "node:fs/promises";
 import path from "node:path";
 import crypto from "node:crypto";
@@ -2499,34 +2499,15 @@ function collectExtensionPolicyOverrides(rawOverrides) {
   }
   return overridesByName;
 }
-function normalizeExtensionPolicy(settings) {
-  const policy = settings.extensions.policy;
-  const mode = normalizePolicyMode(policy?.mode);
-  const trustMode = normalizePolicyTrustMode(policy?.trust_mode);
-  const pmMaxVersionExceededMode2 = normalizePmMaxVersionExceededMode(policy?.pm_max_version_exceeded_mode);
-  const requireProvenance = policy?.require_provenance === true;
-  const trustedExtensions = normalizePolicyStringSet(policy?.trusted_extensions);
-  const defaultSandboxProfile = normalizePolicySandboxProfile(policy?.default_sandbox_profile);
-  const allowedExtensions = normalizePolicyStringSet(policy?.allowed_extensions);
-  const blockedExtensions = normalizePolicyStringSet(policy?.blocked_extensions);
-  const allowedCapabilities = normalizePolicyStringSet(policy?.allowed_capabilities);
-  const blockedCapabilities = normalizePolicyStringSet(policy?.blocked_capabilities);
-  const allowedSurfaces = normalizePolicySurfaceSet(policy?.allowed_surfaces);
-  const blockedSurfaces = normalizePolicySurfaceSet(policy?.blocked_surfaces);
-  const allowedCommands = normalizePolicyStringSet(policy?.allowed_commands);
-  const blockedCommands = normalizePolicyStringSet(policy?.blocked_commands);
-  const allowedActions = normalizePolicyStringSet(policy?.allowed_actions);
-  const blockedActions = normalizePolicyStringSet(policy?.blocked_actions);
-  const allowedServices = normalizePolicyStringSet(policy?.allowed_services);
-  const blockedServices = normalizePolicyStringSet(policy?.blocked_services);
-  const overridesByName = collectExtensionPolicyOverrides(policy?.extension_overrides);
+function collectExtensionPolicyWarnings(normalized) {
   const warnings = [];
-  for (const capability of toSortedList([...allowedCapabilities, ...blockedCapabilities])) {
+  const sortedOverrides = [...normalized.overridesByName.values()].sort((left, right) => left.name.localeCompare(right.name));
+  for (const capability of toSortedList([...normalized.allowedCapabilities, ...normalized.blockedCapabilities])) {
     if (!isKnownExtensionCapability(capability)) {
       warnings.push(`extension_policy_unknown_capability:${capability}`);
     }
   }
-  for (const override of [...overridesByName.values()].sort((left, right) => left.name.localeCompare(right.name))) {
+  for (const override of sortedOverrides) {
     for (const capability of toSortedList([...override.allowedCapabilities, ...override.blockedCapabilities])) {
       if (!isKnownExtensionCapability(capability)) {
         warnings.push(`extension_policy_unknown_capability:${override.name}:${capability}`);
@@ -2534,39 +2515,54 @@ function normalizeExtensionPolicy(settings) {
     }
   }
   const knownSurfaces = new Set(KNOWN_EXTENSION_POLICY_SURFACES);
-  for (const surface of toSortedList([...allowedSurfaces, ...blockedSurfaces])) {
+  for (const surface of toSortedList([...normalized.allowedSurfaces, ...normalized.blockedSurfaces])) {
     if (!knownSurfaces.has(surface)) {
       warnings.push(`extension_policy_unknown_surface:${surface}`);
     }
   }
-  for (const override of [...overridesByName.values()].sort((left, right) => left.name.localeCompare(right.name))) {
+  for (const override of sortedOverrides) {
     for (const surface of toSortedList([...override.allowedSurfaces, ...override.blockedSurfaces])) {
       if (!knownSurfaces.has(surface)) {
         warnings.push(`extension_policy_unknown_surface:${override.name}:${surface}`);
       }
     }
   }
+  return [...new Set(warnings)].sort((left, right) => left.localeCompare(right));
+}
+function normalizeExtensionPolicy(settings) {
+  const policy = settings.extensions?.policy ?? {};
+  const allowedCapabilities = normalizePolicyStringSet(policy.allowed_capabilities);
+  const blockedCapabilities = normalizePolicyStringSet(policy.blocked_capabilities);
+  const allowedSurfaces = normalizePolicySurfaceSet(policy.allowed_surfaces);
+  const blockedSurfaces = normalizePolicySurfaceSet(policy.blocked_surfaces);
+  const overridesByName = collectExtensionPolicyOverrides(policy.extension_overrides);
   return {
-    mode,
-    trustMode,
-    pmMaxVersionExceededMode: pmMaxVersionExceededMode2,
-    requireProvenance,
-    trustedExtensions,
-    defaultSandboxProfile,
-    allowedExtensions,
-    blockedExtensions,
+    mode: normalizePolicyMode(policy.mode),
+    trustMode: normalizePolicyTrustMode(policy.trust_mode),
+    pmMaxVersionExceededMode: normalizePmMaxVersionExceededMode(policy.pm_max_version_exceeded_mode),
+    requireProvenance: policy.require_provenance === true,
+    trustedExtensions: normalizePolicyStringSet(policy.trusted_extensions),
+    defaultSandboxProfile: normalizePolicySandboxProfile(policy.default_sandbox_profile),
+    allowedExtensions: normalizePolicyStringSet(policy.allowed_extensions),
+    blockedExtensions: normalizePolicyStringSet(policy.blocked_extensions),
     allowedCapabilities,
     blockedCapabilities,
     allowedSurfaces,
     blockedSurfaces,
-    allowedCommands,
-    blockedCommands,
-    allowedActions,
-    blockedActions,
-    allowedServices,
-    blockedServices,
+    allowedCommands: normalizePolicyStringSet(policy.allowed_commands),
+    blockedCommands: normalizePolicyStringSet(policy.blocked_commands),
+    allowedActions: normalizePolicyStringSet(policy.allowed_actions),
+    blockedActions: normalizePolicyStringSet(policy.blocked_actions),
+    allowedServices: normalizePolicyStringSet(policy.allowed_services),
+    blockedServices: normalizePolicyStringSet(policy.blocked_services),
     overridesByName,
-    warnings: [...new Set(warnings)].sort((left, right) => left.localeCompare(right))
+    warnings: collectExtensionPolicyWarnings({
+      allowedCapabilities,
+      blockedCapabilities,
+      allowedSurfaces,
+      blockedSurfaces,
+      overridesByName
+    })
   };
 }
 function serializeExtensionPolicy(policy) {
@@ -2777,55 +2773,28 @@ function evaluateExtensionPolicyForExtension(policy, extension) {
   if (policy.mode === "off" && policy.trustMode === "off") {
     return { allowed: true, warning: null };
   }
+  const violations = [];
   const reason = resolvePolicyExtensionReason(policy, extension);
-  const trustReason = resolvePolicyTrustReason(policy, extension);
-  const sandboxReason = resolvePolicySandboxReason(policy, extension);
-  const extensionEnforced = reason && policy.mode === "enforce";
-  const trustEnforced = trustReason && policy.trustMode === "enforce";
-  const sandboxEnforced = sandboxReason && policy.mode === "enforce";
-  if (!reason && !trustReason && !sandboxReason) {
-    return { allowed: true, warning: null };
+  if (reason) {
+    violations.push({ reason, scope: "extension", mode: policy.mode });
   }
-  if (extensionEnforced) {
-    return {
-      allowed: false,
-      warning: buildPolicyWarning("blocked", "extension", extension, reason)
-    };
+  const trustReason = resolvePolicyTrustReason(policy, extension);
+  if (trustReason) {
+    violations.push({ reason: trustReason, scope: "trust", mode: policy.trustMode });
   }
-  if (trustEnforced) {
-    return {
-      allowed: false,
-      warning: buildPolicyWarning("blocked", "trust", extension, trustReason)
-    };
+  const sandboxReason = resolvePolicySandboxReason(policy, extension);
+  if (sandboxReason) {
+    violations.push({ reason: sandboxReason, scope: "extension", mode: policy.mode });
   }
-  if (sandboxEnforced) {
-    return {
-      allowed: false,
-      warning: buildPolicyWarning("blocked", "extension", extension, sandboxReason)
-    };
+  const enforced = violations.find((violation) => violation.mode === "enforce");
+  if (enforced) {
+    return { allowed: false, warning: buildPolicyWarning("blocked", enforced.scope, extension, enforced.reason) };
   }
-  if (reason && policy.mode === "warn") {
-    return {
-      allowed: true,
-      warning: buildPolicyWarning("violation", "extension", extension, reason)
-    };
+  const warned = violations.find((violation) => violation.mode === "warn");
+  if (warned) {
+    return { allowed: true, warning: buildPolicyWarning("violation", warned.scope, extension, warned.reason) };
   }
-  if (trustReason && policy.trustMode === "warn") {
-    return {
-      allowed: true,
-      warning: buildPolicyWarning("violation", "trust", extension, trustReason)
-    };
-  }
-  if (sandboxReason && policy.mode === "warn") {
-    return {
-      allowed: true,
-      warning: buildPolicyWarning("violation", "extension", extension, sandboxReason)
-    };
-  }
-  return {
-    allowed: true,
-    warning: null
-  };
+  return { allowed: true, warning: null };
 }
 function evaluateExtensionPolicyForCapability(policy, extension, capability) {
   if (policy.mode === "off") {
@@ -2840,19 +2809,15 @@ function evaluateExtensionPolicyForCapability(policy, extension, capability) {
     warning: buildPolicyWarning(policy.mode === "warn" ? "violation" : "blocked", "capability", extension, reason, { capability: capability.trim().toLowerCase() })
   };
 }
-function evaluateExtensionPolicyForRegistration(policy, extension, surface, method, capability, details) {
-  if (policy.mode === "off") {
-    return { allowed: true, warning: null };
-  }
+function resolveRegistrationPolicyReason(policy, extension, surface, capability, detail) {
   const capabilityReason = typeof capability === "string" ? resolvePolicyCapabilityReason(policy, extension, capability) : null;
   const surfaceReason = resolvePolicySurfaceReason(policy, extension, surface);
-  const commandReason = details?.command ? resolvePolicyCommandReason(policy, extension, details.command) : null;
-  const actionReason = details?.action ? resolvePolicyActionReason(policy, extension, details.action) : null;
-  const serviceReason = details?.service ? resolvePolicyServiceReason(policy, extension, details.service) : null;
-  const reason = capabilityReason ?? surfaceReason ?? commandReason ?? actionReason ?? serviceReason;
-  if (!reason) {
-    return { allowed: true, warning: null };
-  }
+  const commandReason = detail.command ? resolvePolicyCommandReason(policy, extension, detail.command) : null;
+  const actionReason = detail.action ? resolvePolicyActionReason(policy, extension, detail.action) : null;
+  const serviceReason = detail.service ? resolvePolicyServiceReason(policy, extension, detail.service) : null;
+  return capabilityReason ?? surfaceReason ?? commandReason ?? actionReason ?? serviceReason;
+}
+function buildRegistrationPolicyWarningDetails(method, surface, capability, detail) {
   const warningDetails = {
     method: normalizePolicyName(method).replace(/\s+/g, "_"),
     surface
@@ -2860,16 +2825,27 @@ function evaluateExtensionPolicyForRegistration(policy, extension, surface, meth
   if (capability) {
     warningDetails.capability = capability;
   }
-  if (details?.command) {
-    warningDetails.command = normalizeCommandName(details.command);
+  if (detail.command) {
+    warningDetails.command = normalizeCommandName(detail.command);
+  }
+  if (detail.action) {
+    warningDetails.action = normalizePolicyName(detail.action).replace(/\s+/g, "-");
+  }
+  if (detail.service) {
+    warningDetails.service = normalizePolicyName(detail.service);
   }
-  if (details?.action) {
-    warningDetails.action = normalizePolicyName(details.action).replace(/\s+/g, "-");
+  return warningDetails;
+}
+function evaluateExtensionPolicyForRegistration(policy, extension, surface, method, capability, details) {
+  if (policy.mode === "off") {
+    return { allowed: true, warning: null };
   }
-  if (details?.service) {
-    warningDetails.service = normalizePolicyName(details.service);
+  const detail = details ?? {};
+  const reason = resolveRegistrationPolicyReason(policy, extension, surface, capability, detail);
+  if (!reason) {
+    return { allowed: true, warning: null };
   }
-  const warning = buildPolicyWarning(policy.mode === "warn" ? "violation" : "blocked", "registration", extension, reason, warningDetails);
+  const warning = buildPolicyWarning(policy.mode === "warn" ? "violation" : "blocked", "registration", extension, reason, buildRegistrationPolicyWarningDetails(method, surface, capability, detail));
   return {
     allowed: policy.mode === "warn",
     warning
@@ -2916,33 +2892,134 @@ function parseManifestEngines(value) {
   }
   return Object.keys(engines).length > 0 ? engines : void 0;
 }
-function parseManifest(raw) {
-  if (typeof raw !== "object" || raw === null) {
+function parseRequiredManifestString(candidate, field) {
+  const value = candidate[field];
+  if (typeof value !== "string" || value.trim().length === 0) {
     return null;
   }
-  const candidate = raw;
-  if (typeof candidate.name !== "string" || candidate.name.trim().length === 0) {
+  return value.trim();
+}
+function parseOptionalIntegerValue(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value !== "number" || !Number.isInteger(value)) {
     return null;
   }
-  if (typeof candidate.version !== "string" || candidate.version.trim().length === 0) {
+  return value;
+}
+function parseOptionalBooleanValue(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value !== "boolean") {
     return null;
   }
-  if (typeof candidate.entry !== "string" || candidate.entry.trim().length === 0) {
+  return value;
+}
+function parseManifestPriority(candidate) {
+  const value = parseOptionalIntegerValue(candidate.priority);
+  return value === void 0 ? DEFAULT_EXTENSION_PRIORITY : value;
+}
+function parseManifestSandboxProfile(candidate) {
+  const value = candidate.sandbox_profile;
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value !== "string") {
     return null;
   }
-  let priority = DEFAULT_EXTENSION_PRIORITY;
-  if ("priority" in candidate && candidate.priority !== void 0 && candidate.priority !== null) {
-    if (typeof candidate.priority !== "number" || !Number.isInteger(candidate.priority)) {
-      return null;
-    }
-    priority = candidate.priority;
+  const normalizedProfile = normalizePolicySandboxProfile(value);
+  if (normalizedProfile !== value.trim().toLowerCase()) {
+    return null;
   }
-  let manifestVersion;
-  if ("manifest_version" in candidate && candidate.manifest_version !== void 0 && candidate.manifest_version !== null) {
-    if (typeof candidate.manifest_version !== "number" || !Number.isInteger(candidate.manifest_version)) {
-      return null;
-    }
-    manifestVersion = candidate.manifest_version;
+  return normalizedProfile;
+}
+function optionalTrimmedString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function parseManifestProvenance(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  const provenanceRecord = asRecordLoose(value);
+  if (!provenanceRecord) {
+    return null;
+  }
+  const source = optionalTrimmedString(provenanceRecord.source);
+  const signature = optionalTrimmedString(provenanceRecord.signature);
+  const attestation = optionalTrimmedString(provenanceRecord.attestation);
+  const verified = provenanceRecord.verified === void 0 || provenanceRecord.verified === null ? void 0 : typeof provenanceRecord.verified === "boolean" ? provenanceRecord.verified : null;
+  if (verified === null) {
+    return null;
+  }
+  return {
+    ...source ? { source } : {},
+    ...signature ? { signature } : {},
+    ...attestation ? { attestation } : {},
+    ...typeof verified === "boolean" ? { verified } : {}
+  };
+}
+function parseManifestPermissions(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  const permissionsRecord = asRecordLoose(value);
+  if (!permissionsRecord) {
+    return null;
+  }
+  const fsRead = parseOptionalBooleanValue(permissionsRecord.fs_read);
+  const fsWrite = parseOptionalBooleanValue(permissionsRecord.fs_write);
+  const network = parseOptionalBooleanValue(permissionsRecord.network);
+  const envRead = parseOptionalBooleanValue(permissionsRecord.env_read);
+  const envWrite = parseOptionalBooleanValue(permissionsRecord.env_write);
+  const processSpawn = parseOptionalBooleanValue(permissionsRecord.process_spawn);
+  if ([fsRead, fsWrite, network, envRead, envWrite, processSpawn].includes(null)) {
+    return null;
+  }
+  return {
+    ...typeof fsRead === "boolean" ? { fs_read: fsRead } : {},
+    ...typeof fsWrite === "boolean" ? { fs_write: fsWrite } : {},
+    ...typeof network === "boolean" ? { network } : {},
+    ...typeof envRead === "boolean" ? { env_read: envRead } : {},
+    ...typeof envWrite === "boolean" ? { env_write: envWrite } : {},
+    ...typeof processSpawn === "boolean" ? { process_spawn: processSpawn } : {}
+  };
+}
+function parseManifestCapabilities(value) {
+  if (value === void 0 || value === null) {
+    return { capabilities: [], legacy_aliases: [] };
+  }
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    return null;
+  }
+  const normalizedCapabilities = normalizeManifestCapabilities(value);
+  return { capabilities: normalizedCapabilities.capabilities, legacy_aliases: normalizedCapabilities.legacy_aliases };
+}
+function parseManifestActivation(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  const activationRecord = asRecordLoose(value);
+  if (!activationRecord) {
+    return null;
+  }
+  const rawCommands = activationRecord.commands;
+  if (rawCommands === void 0 || rawCommands === null) {
+    return void 0;
+  }
+  if (!Array.isArray(rawCommands) || rawCommands.some((entry) => typeof entry !== "string")) {
+    return null;
+  }
+  const commands = [
+    ...new Set(rawCommands.map((entry) => normalizeCommandName(entry)).filter((entry) => entry.length > 0))
+  ].sort((left, right) => left.localeCompare(right));
+  return commands.length > 0 ? { commands } : void 0;
+}
+function parseManifestMetadata(candidate) {
+  const manifestVersion = parseOptionalIntegerValue(candidate.manifest_version);
+  if (manifestVersion === null) {
+    return null;
   }
   const pmMinVersion = parseOptionalManifestString(candidate, "pm_min_version");
   if (pmMinVersion === null) {
@@ -2956,124 +3033,85 @@ function parseManifest(raw) {
   if (engines === null) {
     return null;
   }
-  let trusted;
-  if ("trusted" in candidate && candidate.trusted !== void 0 && candidate.trusted !== null) {
-    if (typeof candidate.trusted !== "boolean") {
-      return null;
-    }
-    trusted = candidate.trusted;
+  const trusted = parseOptionalBooleanValue(candidate.trusted);
+  if (trusted === null) {
+    return null;
   }
-  let sandboxProfile;
-  if ("sandbox_profile" in candidate && candidate.sandbox_profile !== void 0 && candidate.sandbox_profile !== null) {
-    if (typeof candidate.sandbox_profile !== "string") {
-      return null;
-    }
-    const normalizedProfile = normalizePolicySandboxProfile(candidate.sandbox_profile);
-    if (normalizedProfile !== candidate.sandbox_profile.trim().toLowerCase()) {
-      return null;
-    }
-    sandboxProfile = normalizedProfile;
+  const sandboxProfile = parseManifestSandboxProfile(candidate);
+  if (sandboxProfile === null) {
+    return null;
   }
-  let provenance;
-  if ("provenance" in candidate && candidate.provenance !== void 0 && candidate.provenance !== null) {
-    const provenanceRecord = asRecordLoose(candidate.provenance);
-    if (!provenanceRecord) {
-      return null;
-    }
-    const source = typeof provenanceRecord.source === "string" && provenanceRecord.source.trim().length > 0 ? provenanceRecord.source.trim() : void 0;
-    const signature = typeof provenanceRecord.signature === "string" && provenanceRecord.signature.trim().length > 0 ? provenanceRecord.signature.trim() : void 0;
-    const attestation = typeof provenanceRecord.attestation === "string" && provenanceRecord.attestation.trim().length > 0 ? provenanceRecord.attestation.trim() : void 0;
-    const verified = provenanceRecord.verified === void 0 || provenanceRecord.verified === null ? void 0 : typeof provenanceRecord.verified === "boolean" ? provenanceRecord.verified : null;
-    if (verified === null) {
-      return null;
-    }
-    provenance = {
-      ...source ? { source } : {},
-      ...signature ? { signature } : {},
-      ...attestation ? { attestation } : {},
-      ...typeof verified === "boolean" ? { verified } : {}
-    };
+  const provenance = parseManifestProvenance(candidate.provenance);
+  if (provenance === null) {
+    return null;
   }
-  let permissions;
-  if ("permissions" in candidate && candidate.permissions !== void 0 && candidate.permissions !== null) {
-    const permissionsRecord = asRecordLoose(candidate.permissions);
-    if (!permissionsRecord) {
-      return null;
-    }
-    const parseOptionalBoolean = (value) => {
-      if (value === void 0 || value === null) {
-        return void 0;
-      }
-      if (typeof value !== "boolean") {
-        return null;
-      }
-      return value;
-    };
-    const fsRead = parseOptionalBoolean(permissionsRecord.fs_read);
-    const fsWrite = parseOptionalBoolean(permissionsRecord.fs_write);
-    const network = parseOptionalBoolean(permissionsRecord.network);
-    const envRead = parseOptionalBoolean(permissionsRecord.env_read);
-    const envWrite = parseOptionalBoolean(permissionsRecord.env_write);
-    const processSpawn = parseOptionalBoolean(permissionsRecord.process_spawn);
-    if ([fsRead, fsWrite, network, envRead, envWrite, processSpawn].includes(null)) {
-      return null;
-    }
-    permissions = {
-      ...typeof fsRead === "boolean" ? { fs_read: fsRead } : {},
-      ...typeof fsWrite === "boolean" ? { fs_write: fsWrite } : {},
-      ...typeof network === "boolean" ? { network } : {},
-      ...typeof envRead === "boolean" ? { env_read: envRead } : {},
-      ...typeof envWrite === "boolean" ? { env_write: envWrite } : {},
-      ...typeof processSpawn === "boolean" ? { process_spawn: processSpawn } : {}
-    };
+  const permissions = parseManifestPermissions(candidate.permissions);
+  if (permissions === null) {
+    return null;
   }
-  let capabilities = [];
-  let legacyCapabilityAliases = [];
-  if ("capabilities" in candidate && candidate.capabilities !== void 0 && candidate.capabilities !== null) {
-    if (!Array.isArray(candidate.capabilities) || candidate.capabilities.some((value) => typeof value !== "string")) {
-      return null;
-    }
-    const normalizedCapabilities = normalizeManifestCapabilities(candidate.capabilities);
-    capabilities = normalizedCapabilities.capabilities;
-    legacyCapabilityAliases = normalizedCapabilities.legacy_aliases;
+  const capabilities = parseManifestCapabilities(candidate.capabilities);
+  if (capabilities === null) {
+    return null;
   }
-  let activation;
-  if ("activation" in candidate && candidate.activation !== void 0 && candidate.activation !== null) {
-    const activationRecord = asRecordLoose(candidate.activation);
-    if (!activationRecord) {
-      return null;
-    }
-    const rawCommands = activationRecord.commands;
-    if (rawCommands !== void 0 && rawCommands !== null) {
-      if (!Array.isArray(rawCommands) || rawCommands.some((value) => typeof value !== "string")) {
-        return null;
-      }
-      const commands = [
-        ...new Set(rawCommands.map((value) => normalizeCommandName(value)).filter((value) => value.length > 0))
-      ].sort((left, right) => left.localeCompare(right));
-      if (commands.length > 0) {
-        activation = {
-          commands
-        };
-      }
-    }
+  const activation = parseManifestActivation(candidate.activation);
+  if (activation === null) {
+    return null;
   }
   return {
-    name: candidate.name.trim(),
-    version: candidate.version.trim(),
-    entry: candidate.entry.trim(),
-    priority,
     manifest_version: manifestVersion,
     pm_min_version: pmMinVersion,
     pm_max_version: pmMaxVersion,
     engines,
     trusted,
-    provenance,
     sandbox_profile: sandboxProfile,
+    provenance,
     permissions,
-    activation,
-    capabilities,
-    legacy_capability_aliases: legacyCapabilityAliases.length > 0 ? legacyCapabilityAliases : void 0
+    capabilities: capabilities.capabilities,
+    legacy_capability_aliases: capabilities.legacy_aliases,
+    activation
+  };
+}
+function parseManifest(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return null;
+  }
+  const candidate = raw;
+  const name = parseRequiredManifestString(candidate, "name");
+  if (name === null) {
+    return null;
+  }
+  const version = parseRequiredManifestString(candidate, "version");
+  if (version === null) {
+    return null;
+  }
+  const entry = parseRequiredManifestString(candidate, "entry");
+  if (entry === null) {
+    return null;
+  }
+  const priority = parseManifestPriority(candidate);
+  if (priority === null) {
+    return null;
+  }
+  const metadata = parseManifestMetadata(candidate);
+  if (metadata === null) {
+    return null;
+  }
+  return {
+    name,
+    version,
+    entry,
+    priority,
+    manifest_version: metadata.manifest_version,
+    pm_min_version: metadata.pm_min_version,
+    pm_max_version: metadata.pm_max_version,
+    engines: metadata.engines,
+    trusted: metadata.trusted,
+    provenance: metadata.provenance,
+    sandbox_profile: metadata.sandbox_profile,
+    permissions: metadata.permissions,
+    activation: metadata.activation,
+    capabilities: metadata.capabilities,
+    legacy_capability_aliases: metadata.legacy_capability_aliases.length > 0 ? metadata.legacy_capability_aliases : void 0
   };
 }
 function shouldEnable(name, enabled, disabled) {
@@ -3202,26 +3240,50 @@ async function scanExtensionLayer(layer, extensionsRoot, enabled, disabled, pmMa
   }
   return { diagnostics, warnings, candidates };
 }
+function buildUnavailableExtensionScan(layer, directory, manifestPath, warning) {
+  return {
+    diagnostic: {
+      layer,
+      directory,
+      manifest_path: manifestPath,
+      name: null,
+      version: null,
+      entry: null,
+      priority: null,
+      entry_path: null,
+      enabled: null,
+      status: "warn"
+    },
+    warnings: [warning],
+    candidate: null
+  };
+}
+function collectScannedExtensionWarnings(layer, manifest, entryWithinDirectory, entryExists, pmVersionCompatibility, pmMaxVersionCompatibility) {
+  const extensionWarnings = [];
+  if (Array.isArray(manifest.legacy_capability_aliases) && manifest.legacy_capability_aliases.length > 0) {
+    extensionWarnings.push(formatLegacyExtensionCapabilityAliasWarning(layer, manifest.name, manifest.legacy_capability_aliases));
+  }
+  for (const capability of collectUnknownExtensionCapabilities(manifest.capabilities)) {
+    extensionWarnings.push(formatUnknownExtensionCapabilityWarning(layer, manifest.name, capability));
+  }
+  if (!entryWithinDirectory) {
+    extensionWarnings.push(`extension_entry_outside_extension:${layer}:${manifest.name}`);
+  } else if (!entryExists) {
+    extensionWarnings.push(`extension_entry_missing:${layer}:${manifest.name}`);
+  }
+  if (pmVersionCompatibility.warning) {
+    extensionWarnings.push(pmVersionCompatibility.warning);
+  }
+  if (pmMaxVersionCompatibility.warning) {
+    extensionWarnings.push(pmMaxVersionCompatibility.warning);
+  }
+  return extensionWarnings;
+}
 async function scanExtensionDirectory(layer, extensionsRoot, directory, enabled, disabled, managedSourcePackages, pmMaxVersionExceededMode2) {
   const extensionDir = path5.join(extensionsRoot, directory);
   const manifestPath = path5.join(extensionDir, "manifest.json");
   if (!await pathExists(manifestPath)) {
-    return {
-      diagnostic: {
-        layer,
-        directory,
-        manifest_path: manifestPath,
-        name: null,
-        version: null,
-        entry: null,
-        priority: null,
-        entry_path: null,
-        enabled: null,
-        status: "warn"
-      },
-      warnings: [`extension_manifest_missing:${layer}:${directory}`],
-      candidate: null
-    };
+    return buildUnavailableExtensionScan(layer, directory, manifestPath, `extension_manifest_missing:${layer}:${directory}`);
   }
   let manifest = null;
   try {
@@ -3231,48 +3293,16 @@ async function scanExtensionDirectory(layer, extensionsRoot, directory, enabled,
     manifest = null;
   }
   if (!manifest) {
-    return {
-      diagnostic: {
-        layer,
-        directory,
-        manifest_path: manifestPath,
-        name: null,
-        version: null,
-        entry: null,
-        priority: null,
-        entry_path: null,
-        enabled: null,
-        status: "warn"
-      },
-      warnings: [`extension_manifest_invalid:${layer}:${directory}`],
-      candidate: null
-    };
+    return buildUnavailableExtensionScan(layer, directory, manifestPath, `extension_manifest_invalid:${layer}:${directory}`);
   }
   const entryPath = path5.resolve(extensionDir, manifest.entry);
   const entryWithinDirectoryByPath = isPathWithinDirectory(extensionDir, entryPath);
   const entryExists = entryWithinDirectoryByPath ? await pathExists(entryPath) : false;
   const entryWithinDirectory = entryWithinDirectoryByPath && entryExists ? await isCanonicalPathWithinDirectory(extensionDir, entryPath) : entryWithinDirectoryByPath;
   const enabledForLoad = shouldEnable(manifest.name, enabled, disabled);
-  const extensionWarnings = [];
-  if (Array.isArray(manifest.legacy_capability_aliases) && manifest.legacy_capability_aliases.length > 0) {
-    extensionWarnings.push(formatLegacyExtensionCapabilityAliasWarning(layer, manifest.name, manifest.legacy_capability_aliases));
-  }
-  for (const capability of collectUnknownExtensionCapabilities(manifest.capabilities)) {
-    extensionWarnings.push(formatUnknownExtensionCapabilityWarning(layer, manifest.name, capability));
-  }
-  if (!entryWithinDirectory) {
-    extensionWarnings.push(`extension_entry_outside_extension:${layer}:${manifest.name}`);
-  } else if (!entryExists) {
-    extensionWarnings.push(`extension_entry_missing:${layer}:${manifest.name}`);
-  }
   const pmVersionCompatibility = await evaluatePmMinVersionCompatibility(layer, manifest);
-  if (pmVersionCompatibility.warning) {
-    extensionWarnings.push(pmVersionCompatibility.warning);
-  }
   const pmMaxVersionCompatibility = await evaluatePmMaxVersionCompatibility(layer, manifest, pmMaxVersionExceededMode2);
-  if (pmMaxVersionCompatibility.warning) {
-    extensionWarnings.push(pmMaxVersionCompatibility.warning);
-  }
+  const extensionWarnings = collectScannedExtensionWarnings(layer, manifest, entryWithinDirectory, entryExists, pmVersionCompatibility, pmMaxVersionCompatibility);
   const extensionReady = entryWithinDirectory && entryExists && pmVersionCompatibility.allowed && pmMaxVersionCompatibility.allowed;
   const sourcePackage = managedSourcePackages.get(`directory:${directory}`) ?? managedSourcePackages.get(`name:${manifest.name}`);
   return {
@@ -4022,69 +4052,70 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
     received: sanitizeRegistrationValue(received),
     hint
   });
-  const registerCommand = (commandOrDefinition, override) => {
-    assertExtensionCapability(extension, "commands", "registerCommand");
-    if (typeof commandOrDefinition === "string") {
-      const normalizedCommand2 = normalizeCommandName(commandOrDefinition);
-      if (normalizedCommand2.length === 0) {
-        throw createRegistrationValidationError("registerCommand requires a non-empty command name", registerCommandTrace("override", commandOrDefinition, 'registerCommand("<command>", (context) => unknown)', commandOrDefinition, "Provide a non-empty command path as the first argument."));
-      }
-      if (typeof override !== "function") {
-        const trace = registerCommandTrace("override", normalizedCommand2, 'registerCommand("<command>", (context) => unknown)', { command: commandOrDefinition, override }, "Provide a function as the second registerCommand argument.");
-        throw createRegistrationValidationError(`registerCommand requires an override function when command name is provided (command="${normalizedCommand2}", registration_index=${trace.registration_index})`, trace);
-      }
-      if (!allowRegistration("commands.override", "registerCommand", "commands", { command: normalizedCommand2 })) {
-        return;
-      }
-      commands.overrides.push({
-        layer: extension.layer,
-        name: extension.name,
-        command: normalizedCommand2,
-        run: override
-      });
-      return;
-    }
-    if (typeof commandOrDefinition !== "object" || commandOrDefinition === null) {
-      throw createRegistrationValidationError("registerCommand requires a command definition object", registerCommandTrace("definition", void 0, "{ name: string; run: (context) => unknown; }", commandOrDefinition, 'Use registerCommand({ name: "command path", run: (context) => ... }).'));
+  const registerCommandOverride = (command, override) => {
+    const normalizedCommand = normalizeCommandName(command);
+    if (normalizedCommand.length === 0) {
+      throw createRegistrationValidationError("registerCommand requires a non-empty command name", registerCommandTrace("override", command, 'registerCommand("<command>", (context) => unknown)', command, "Provide a non-empty command path as the first argument."));
     }
-    if (typeof commandOrDefinition.name !== "string") {
-      throw createRegistrationValidationError("registerCommand requires a command definition name", registerCommandTrace("definition", void 0, "{ name: string; run: (context) => unknown; }", commandOrDefinition, "Set command definition.name to a non-empty string command path."));
+    if (typeof override !== "function") {
+      const trace = registerCommandTrace("override", normalizedCommand, 'registerCommand("<command>", (context) => unknown)', { command, override }, "Provide a function as the second registerCommand argument.");
+      throw createRegistrationValidationError(`registerCommand requires an override function when command name is provided (command="${normalizedCommand}", registration_index=${trace.registration_index})`, trace);
     }
-    const normalizedCommand = normalizeCommandName(commandOrDefinition.name);
-    if (normalizedCommand.length === 0) {
-      throw createRegistrationValidationError("registerCommand requires a non-empty command definition name", registerCommandTrace("definition", commandOrDefinition.name, "{ name: string; run: (context) => unknown; }", commandOrDefinition, "Ensure command definition.name contains a non-empty command path."));
+    if (!allowRegistration("commands.override", "registerCommand", "commands", { command: normalizedCommand })) {
+      return;
     }
-    const runHandler = typeof commandOrDefinition.run === "function" ? commandOrDefinition.run : void 0;
-    const legacyHandler = typeof commandOrDefinition.handler === "function" ? commandOrDefinition.handler : void 0;
+    commands.overrides.push({
+      layer: extension.layer,
+      name: extension.name,
+      command: normalizedCommand,
+      run: override
+    });
+  };
+  const resolveCommandDefinitionRunHandler = (definition, normalizedCommand) => {
+    const runHandler = typeof definition.run === "function" ? definition.run : void 0;
+    const legacyHandler = typeof definition.handler === "function" ? definition.handler : void 0;
     if (!runHandler && legacyHandler) {
       activationWarnings.push(`extension_command_definition_legacy_handler_alias:${extension.layer}:${extension.name}:${normalizedCommand}`);
     }
-    const resolvedHandler = runHandler ?? legacyHandler;
+    return runHandler ?? legacyHandler;
+  };
+  const registerCommandDefinition = (definition) => {
+    if (typeof definition !== "object" || definition === null) {
+      throw createRegistrationValidationError("registerCommand requires a command definition object", registerCommandTrace("definition", void 0, "{ name: string; run: (context) => unknown; }", definition, 'Use registerCommand({ name: "command path", run: (context) => ... }).'));
+    }
+    if (typeof definition.name !== "string") {
+      throw createRegistrationValidationError("registerCommand requires a command definition name", registerCommandTrace("definition", void 0, "{ name: string; run: (context) => unknown; }", definition, "Set command definition.name to a non-empty string command path."));
+    }
+    const normalizedCommand = normalizeCommandName(definition.name);
+    if (normalizedCommand.length === 0) {
+      throw createRegistrationValidationError("registerCommand requires a non-empty command definition name", registerCommandTrace("definition", definition.name, "{ name: string; run: (context) => unknown; }", definition, "Ensure command definition.name contains a non-empty command path."));
+    }
+    const resolvedHandler = resolveCommandDefinitionRunHandler(definition, normalizedCommand);
     if (typeof resolvedHandler !== "function") {
-      const trace = registerCommandTrace("definition", normalizedCommand, "{ name: string; run: (context) => unknown; }", commandOrDefinition, "Define command definition.run as a function.");
+      const trace = registerCommandTrace("definition", normalizedCommand, "{ name: string; run: (context) => unknown; }", definition, "Define command definition.run as a function.");
       throw createRegistrationValidationError(`registerCommand requires a command definition run handler (command="${normalizedCommand}", registration_index=${trace.registration_index})`, trace);
     }
     try {
-      assertOptionalStringField("registerCommand definition.action", commandOrDefinition.action);
-      assertOptionalStringField("registerCommand definition.description", commandOrDefinition.description);
-      assertOptionalStringField("registerCommand definition.intent", commandOrDefinition.intent);
-      const action = resolveCommandDefinitionAction(normalizedCommand, commandOrDefinition.action);
+      assertOptionalStringField("registerCommand definition.action", definition.action);
+      assertOptionalStringField("registerCommand definition.description", definition.description);
+      assertOptionalStringField("registerCommand definition.intent", definition.intent);
+      const action = resolveCommandDefinitionAction(normalizedCommand, definition.action);
       if (!allowRegistration("commands.handler", "registerCommand", "commands", { command: normalizedCommand, action })) {
         return;
       }
-      const description = commandOrDefinition.description?.trim();
-      const intent = commandOrDefinition.intent?.trim();
-      const examples = normalizeOptionalStringArrayField("registerCommand definition.examples", commandOrDefinition.examples);
-      const failureHints = normalizeOptionalStringArrayField("registerCommand definition.failure_hints", commandOrDefinition.failure_hints);
-      const argumentsDefinition = normalizeCommandDefinitionArguments(commandOrDefinition.arguments);
-      if (commandOrDefinition.flags !== void 0) {
+      const description = definition.description?.trim();
+      const intent = definition.intent?.trim();
+      const examples = normalizeOptionalStringArrayField("registerCommand definition.examples", definition.examples);
+      const failureHints = normalizeOptionalStringArrayField("registerCommand definition.failure_hints", definition.failure_hints);
+      const argumentsDefinition = normalizeCommandDefinitionArguments(definition.arguments);
+      if (definition.flags !== void 0) {
         assertExtensionCapability(extension, "schema", "registerCommand flags");
-        validateFlagDefinitions(commandOrDefinition.flags);
+        validateFlagDefinitions(definition.flags);
         registrations.flags.push({
           layer: extension.layer,
           name: extension.name,
           target_command: normalizedCommand,
-          flags: normalizeRegistrationRecordList("registerCommand definition.flags", commandOrDefinition.flags)
+          flags: normalizeRegistrationRecordList("registerCommand definition.flags", definition.flags)
         });
       }
       const registration = {
@@ -4106,7 +4137,7 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
       registrations.commands.push(registration);
     } catch (error) {
       const reason = formatUnknownError(error);
-      const trace = registerCommandTrace("definition", normalizedCommand, "{ name: string; run: (context) => unknown; action?: string; arguments?: object[]; flags?: object[]; }", commandOrDefinition, "Use schema-style metadata (action/arguments/flags/examples/intent) with valid values.");
+      const trace = registerCommandTrace("definition", normalizedCommand, "{ name: string; run: (context) => unknown; action?: string; arguments?: object[]; flags?: object[]; }", definition, "Use schema-style metadata (action/arguments/flags/examples/intent) with valid values.");
       throw createRegistrationValidationError(`registerCommand definition metadata invalid (command="${normalizedCommand}", registration_index=${trace.registration_index}): ${reason}`, trace);
     }
     commands.handlers.push({
@@ -4116,6 +4147,14 @@ function createExtensionApi(extension, hooks, commands, parsers, preflight, serv
       run: resolvedHandler
     });
   };
+  const registerCommand = (commandOrDefinition, override) => {
+    assertExtensionCapability(extension, "commands", "registerCommand");
+    if (typeof commandOrDefinition === "string") {
+      registerCommandOverride(commandOrDefinition, override);
+      return;
+    }
+    registerCommandDefinition(commandOrDefinition);
+  };
   const registerParser = (command, override) => {
     assertExtensionCapability(extension, "parser", "registerParser");
     if (!allowRegistration("parser.override", "registerParser", "parser")) {
@@ -7260,6 +7299,6 @@ export {
   readSettings,
   writeSettings
 };
-//# sourceMappingURL=chunk-CY5IJMUM.js.map
+//# sourceMappingURL=chunk-7R4QEMZZ.js.map
 
-//# debugId=b452df4b-661b-5f08-9d20-dff37c4bfb2f
+//# debugId=03ed13d8-75ea-5f3b-b089-a7347a59acca