@unbrained/pm-cli 2026.8.12 → 2026.8.13

package/dist/core/telemetry/runtime.js

@@ -4,15 +4,17 @@
  * Captures consent-aware telemetry and observability events for Runtime.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fea9d81b-3deb-51f4-9ec3-76396ae1307d")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="26ea62d9-874d-5826-9822-83c5523b673b")}catch(e){}}();
 import crypto from "node:crypto";
 import { spawn } from "node:child_process";
 import { mkdirSync, rmSync, statSync } from "node:fs";
 import { mkdir, readdir, rm, stat } from "node:fs/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
 import os from "node:os";
 import path from "node:path";
 import { resolvePmPackageRootFromModule } from "../packages/root.js";
-import { appendLineAtomic, readFileIfExists, writeFileAtomic, } from "../fs/fs-utils.js";
+import { isFileMissingError, appendLineAtomic, readFileIfExists, writeFileAtomic, } from "../fs/fs-utils.js";
 import { resolveTelemetryErrorCategory, } from "../shared/constants.js";
 import { nowIso } from "../shared/time.js";
 import { detectAgentIdentity, readAuthorEnvironment, } from "../shared/author.js";
@@ -22,11 +24,10 @@ import { deriveTelemetryCommandResolution, deriveTelemetryCommandTaxonomy, infer
 const TELEMETRY_QUEUE_RELATIVE_PATH = path.join("runtime", "telemetry", "events.jsonl");
 const TELEMETRY_STATE_RELATIVE_PATH = path.join("runtime", "telemetry", "state.json");
 const TELEMETRY_OTEL_SPANS_RELATIVE_PATH = path.join("runtime", "telemetry", "otel-spans.jsonl");
-// Kept small so a worst-case batch against a blackholed collector
-// (TELEMETRY_OTEL_SPANS_FLUSH_BATCH_SIZE * TELEMETRY_HTTP_TIMEOUT_MS plus the
-// preceding event flush) stays well under TELEMETRY_FLUSH_LOCK_STALE_MS (60s).
-// Otherwise a later command could treat the still-held flush lock as stale and
-// start a second concurrent worker.
+// OTLP requests run concurrently, while event and OTLP phases run sequentially.
+// The maximum configurable HTTP timeout therefore keeps two worst-case network
+// phases below TELEMETRY_FLUSH_LOCK_STALE_MS (60s), preventing a later command
+// from treating a live worker's lock as stale and starting a second worker.
 const TELEMETRY_OTEL_SPANS_FLUSH_BATCH_SIZE = 8;
 const TELEMETRY_OTEL_SPANS_MAX_PENDING = 500;
 /** Public contract for telemetry schema version, shared by SDK and presentation-layer consumers. */
@@ -35,7 +36,9 @@ const TELEMETRY_CLIENT_SCHEMA_VERSION = 1;
 const TELEMETRY_FLUSH_BATCH_SIZE = 100;
 const TELEMETRY_MAX_RETRY_DELAY_MS = 3_600_000;
 const TELEMETRY_RETRY_BASE_DELAY_MS = 30_000;
-const TELEMETRY_HTTP_TIMEOUT_MS = 5_000;
+const TELEMETRY_HTTP_TIMEOUT_DEFAULT_MS = 20_000;
+const TELEMETRY_HTTP_TIMEOUT_MIN_MS = 1_000;
+const TELEMETRY_HTTP_TIMEOUT_MAX_MS = 25_000;
 const MILLISECONDS_PER_DAY = 86_400_000;
 const TELEMETRY_MAX_EVENT_BYTES = 65_536;
 const TELEMETRY_SANITIZE_MAX_DEPTH = 6;
@@ -58,6 +61,8 @@ const PM_TELEMETRY_OTEL_DISABLED_VALUES = new Set(["1", "true", "yes", "on"]);
 const PM_TELEMETRY_INLINE_FLUSH_ENV = "PM_TELEMETRY_INLINE_FLUSH";
 const PM_TELEMETRY_FLUSH_CHILD_ENV = "PM_TELEMETRY_FLUSH_CHILD";
 const PM_TELEMETRY_SOURCE_CONTEXT_ENV = "PM_TELEMETRY_SOURCE_CONTEXT";
+const PM_TELEMETRY_HTTP_TIMEOUT_MS_ENV = "PM_TELEMETRY_HTTP_TIMEOUT_MS";
+const NATIVE_FETCH = globalThis.fetch;
 /** Supported values accepted by the pm telemetry source context contract. */
 export const PM_TELEMETRY_SOURCE_CONTEXT_VALUES = [
     "user",
@@ -390,6 +395,80 @@ function normalizeCaptureLevel(value) {
 function parseBooleanTrueLike(value) {
     return BOOLEAN_TRUE_VALUES.has((value ?? "").trim().toLowerCase());
 }
+/** Resolve the background event and OTLP request timeout within the flush-lock safety envelope. */
+function resolveTelemetryHttpTimeoutMs() {
+    const rawConfigured = process.env[PM_TELEMETRY_HTTP_TIMEOUT_MS_ENV]?.trim();
+    if (!rawConfigured) {
+        return TELEMETRY_HTTP_TIMEOUT_DEFAULT_MS;
+    }
+    const configured = Number(rawConfigured);
+    if (!Number.isFinite(configured)) {
+        return TELEMETRY_HTTP_TIMEOUT_DEFAULT_MS;
+    }
+    return Math.min(TELEMETRY_HTTP_TIMEOUT_MAX_MS, Math.max(TELEMETRY_HTTP_TIMEOUT_MIN_MS, Math.trunc(configured)));
+}
+/** POST a JSON payload with one total timeout that covers DNS, connection, TLS, and response completion. */
+async function postTelemetryJson(endpoint, headers, body) {
+    const url = new URL(endpoint);
+    // A replaced global fetch is an intentional runtime adapter used by the
+    // repository's deterministic tests and by embedders that instrument network
+    // traffic. Production retains the native HTTP transport below so Node's
+    // independent built-in-fetch connect timeout cannot preempt our bound.
+    if (globalThis.fetch !== NATIVE_FETCH) {
+        const controller = new AbortController();
+        let timeout;
+        const deadline = new Promise((_resolve, reject) => {
+            timeout = setTimeout(() => {
+                controller.abort();
+                reject(new Error("telemetry_http_timeout"));
+            }, resolveTelemetryHttpTimeoutMs());
+        });
+        try {
+            const response = await Promise.race([
+                globalThis.fetch(endpoint, {
+                    method: "POST",
+                    headers,
+                    body,
+                    signal: controller.signal,
+                }),
+                deadline,
+            ]);
+            return response.status;
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    const request = url.protocol === "https:"
+        ? httpsRequest
+        : url.protocol === "http:"
+            ? httpRequest
+            : undefined;
+    if (!request) {
+        throw new Error(`telemetry_http_protocol_unsupported_${url.protocol}`);
+    }
+    return new Promise((resolve, reject) => {
+        const timeoutMs = resolveTelemetryHttpTimeoutMs();
+        const requestOptions = {
+            method: "POST",
+            headers: {
+                ...headers,
+                "content-length": Buffer.byteLength(body),
+            },
+            signal: AbortSignal.timeout(timeoutMs),
+            autoSelectFamilyAttemptTimeout: Math.min(5_000, timeoutMs),
+        };
+        const clientRequest = request(url, requestOptions, (response) => {
+            response.once("error", reject);
+            // Client responses always carry an HTTP status code; Node's shared
+            // IncomingMessage type is also used for server requests where it is absent.
+            response.once("end", () => resolve(response.statusCode));
+            response.resume();
+        });
+        clientRequest.once("error", reject);
+        clientRequest.end(body);
+    });
+}
 function normalizePmVersion(value) {
     const trimmed = typeof value === "string" ? value.trim() : "";
     return trimmed.length > 0 ? trimmed : "0.0.0";
@@ -1214,14 +1293,9 @@ async function flushPendingOtelSpans(globalPmRoot, retentionDays) {
     // and safe under Node's single-threaded event loop.
     await Promise.all(due.map(async (span) => {
         try {
-            const response = await fetch(span.endpoint, {
-                method: "POST",
-                headers: { "content-type": "application/json" },
-                body: JSON.stringify(span.payload),
-                signal: AbortSignal.timeout(TELEMETRY_HTTP_TIMEOUT_MS),
-            });
-            if (!response.ok) {
-                throw new Error(`local_otel_export_http_${response.status}`);
+            const status = await postTelemetryJson(span.endpoint, { "content-type": "application/json" }, JSON.stringify(span.payload));
+            if (status < 200 || status >= 300) {
+                throw new Error(`local_otel_export_http_${status}`);
             }
             succeededIds.add(span.id);
             succeededCount += 1;
@@ -1398,17 +1472,12 @@ async function flushQueue(globalPmRoot, endpoint, retentionDays) {
         requestHeaders["x-pm-telemetry-key"] = ingestKey;
     }
     try {
-        const response = await fetch(normalizedEndpoint, {
-            method: "POST",
-            headers: requestHeaders,
-            body: JSON.stringify({
-                schema_version: TELEMETRY_SCHEMA_VERSION,
-                events: dueEntries.map((entry) => entry.event),
-            }),
-            signal: AbortSignal.timeout(TELEMETRY_HTTP_TIMEOUT_MS),
-        });
-        if (!response.ok) {
-            throw new Error(`telemetry_flush_http_${response.status}`);
+        const status = await postTelemetryJson(normalizedEndpoint, requestHeaders, JSON.stringify({
+            schema_version: TELEMETRY_SCHEMA_VERSION,
+            events: dueEntries.map((entry) => entry.event),
+        }));
+        if (status < 200 || status >= 300) {
+            throw new Error(`telemetry_flush_http_${status}`);
         }
     }
     catch (error) {
@@ -1519,7 +1588,7 @@ function createDirectoryLock(lockPath) {
         if (code === "EEXIST") {
             return false;
         }
-        if (code !== "ENOENT") {
+        if (!isFileMissingError(error)) {
             return false;
         }
     }
@@ -1547,7 +1616,7 @@ function acquireTelemetryFlushSpawnGate(globalPmRoot) {
         removeDirectoryLockBestEffort(lockPath);
     }
     catch (error) {
-        if (errorCode(error) !== "ENOENT") {
+        if (!isFileMissingError(error)) {
             return false;
         }
     }
@@ -1586,11 +1655,13 @@ export const _testOnly = {
     looksLikeEmailToken,
     otelSpansQueuePath,
     parseBooleanTrueLike,
+    postTelemetryJson,
     parsePendingOtelSpanLines,
     prunePendingOtelSpans,
     reconcilePendingOtelSpansAfterFlush,
     retentionCutoffMs,
     resolveOtelTracesEndpoint,
+    resolveTelemetryHttpTimeoutMs,
     rewritePendingOtelSpans,
     normalizeForHash,
     normalizeCaptureLevel,
@@ -1915,4 +1986,4 @@ export async function emitTelemetryErrorEvent(context) {
     }
 }
 //# sourceMappingURL=runtime.js.map
-//# debugId=fea9d81b-3deb-51f4-9ec3-76396ae1307d
+//# debugId=26ea62d9-874d-5826-9822-83c5523b673b

package/dist/sdk/agent/command-recovery.d.ts

@@ -1,3 +1,5 @@
+/** Resolve a recovery command without interpreting global option values as command tokens. */
+export declare function resolveRecoveryCommandName(invocationArgv: string[] | undefined): string | undefined;
 /** Resolve the truthful placeholder for a missing flag from its contract. */
 export declare function resolveMissingOptionPlaceholder(commandName: string, missingLabel: string): string | null | undefined;
 /** Preserve an attempted argv vector and insert each missing option before `--`. */

package/dist/sdk/agent/command-recovery.js

@@ -6,13 +6,21 @@
  * supplied arguments are preserved byte-for-token.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ab87f46c-c9b4-51d1-a712-fbce7c79fca9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4973a995-60f0-5990-9927-371dc6716063")}catch(e){}}();
 import { renderPmCommand } from "../command-line.js";
 import { resolveSubcommandFlagContractsForCommand } from "../cli-contracts.js";
+import { parseBootstrapCommandName } from "../cli-bootstrap.js";
 function normalizeMissingFlag(label) {
     const match = label.trim().match(/--[a-z0-9][a-z0-9_-]*/i);
     return match?.[0]?.replaceAll("_", "-").toLowerCase();
 }
+/** Resolve a recovery command without interpreting global option values as command tokens. */
+export function resolveRecoveryCommandName(invocationArgv) {
+    if (!Array.isArray(invocationArgv) || invocationArgv.length === 0) {
+        return undefined;
+    }
+    return parseBootstrapCommandName(invocationArgv);
+}
 /** Resolve the truthful placeholder for a missing flag from its contract. */
 export function resolveMissingOptionPlaceholder(commandName, missingLabel) {
     const flag = normalizeMissingFlag(missingLabel);
@@ -49,4 +57,4 @@ export function renderMissingOptionRetry(invocationArgv, commandName, missingLab
         : renderPmCommand(retry);
 }
 //# sourceMappingURL=command-recovery.js.map
-//# debugId=ab87f46c-c9b4-51d1-a712-fbce7c79fca9
+//# debugId=4973a995-60f0-5990-9927-371dc6716063

package/dist/sdk/annotations.js

@@ -4,9 +4,9 @@
  * Implements the pm annotation command command surface and its agent-facing runtime behavior.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="13cf8bd9-0aee-5838-a6eb-de9f87ddfac7")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0af9967c-ca72-563a-9518-2e68da0c0fe0")}catch(e){}}();
 import { readFile } from "node:fs/promises";
-import { pathExists } from "../core/fs/fs-utils.js";
+import { isFileAbsentError, pathExists } from "../core/fs/fs-utils.js";
 import { getActiveExtensionRegistrations } from "../core/extensions/index.js";
 import { resolveItemTypeRegistry } from "../core/item/type-registry.js";
 import { createStdinTokenResolver, parseCsvKv } from "../core/item/parse.js";
@@ -114,7 +114,7 @@ async function resolveAnnotationTextSource(options, noun) {
         return { value: await readFile(filePath, "utf8"), emptyFlag: "--file" };
     }
     catch (error) {
-        if (isErrnoError(error) && error.code === "ENOENT") {
+        if (isErrnoError(error) && isFileAbsentError(error)) {
             throw new PmCliError(`--file path not found: ${filePath}`, EXIT_CODE.USAGE);
         }
         const detail = error instanceof Error ? error.message : String(error);
@@ -399,4 +399,4 @@ function renderAnnotationResult(id, collectionKey, allEntries, limit, includeMet
     };
 }
 //# sourceMappingURL=annotations.js.map
-//# debugId=13cf8bd9-0aee-5838-a6eb-de9f87ddfac7
+//# debugId=0af9967c-ca72-563a-9518-2e68da0c0fe0

package/dist/sdk/cli-contracts/completeness.js

@@ -7,7 +7,7 @@
  * a hand-picked test list.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="13847453-3016-5855-a816-2cadc2ca4870")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cf238c71-1626-5e48-9207-7acf22c0d680")}catch(e){}}();
 import { PM_TOOL_ACTIONS } from "./enum-contracts.js";
 import { resolveSubcommandFlagContractsForCommand, } from "./flag-contracts.js";
 import { pmToolActionParameterKeys } from "./tool-schema.js";
@@ -80,6 +80,7 @@ const ACTION_POSITIONAL_PARAMETERS = {
     assurance: {
         id: "<id>",
         kind: "<kind>",
+        preset: "[kind]|[id]",
         subcommand: "<action>",
     },
     event: { title: "<title>" },
@@ -95,7 +96,12 @@ const ACTION_POSITIONAL_PARAMETERS = {
     },
 };
 const ACTION_FLAG_PARAMETER_OVERRIDES = {
-    assurance: { "--tree": "treeId" },
+    assurance: {
+        "--tree": "treeId",
+        "--owner": "owner",
+        "--apply": "apply",
+        "--enforcement": "enforcement",
+    },
     init: {
         "--id-prefix": "idPrefix",
         "--no-merge-fence": "mergeFence",
@@ -377,4 +383,4 @@ export function analyzeSdkCliParameterCompleteness(source = {}) {
     });
 }
 //# sourceMappingURL=completeness.js.map
-//# debugId=13847453-3016-5855-a816-2cadc2ca4870
+//# debugId=cf238c71-1626-5e48-9207-7acf22c0d680

package/dist/sdk/cli-contracts/enum-contracts.d.ts

@@ -19,7 +19,7 @@ export declare const PM_EXTENSION_SANDBOX_PROFILE_CONTRACTS: readonly ["none", "
 /** Restricts pm extension sandbox profile contract values accepted by command, SDK, and storage contracts. */
 export type PmExtensionSandboxProfileContract = (typeof PM_EXTENSION_SANDBOX_PROFILE_CONTRACTS)[number];
 /** Public contract for pm extension policy surface contracts, shared by SDK and presentation-layer consumers. */
-export declare const PM_EXTENSION_POLICY_SURFACE_CONTRACTS: readonly ["commands.override", "commands.handler", "hooks.beforecommand", "hooks.beforemutation", "hooks.aftercommand", "hooks.onwrite", "hooks.onread", "hooks.onindex", "schema.flags", "schema.itemfields", "schema.itemtypes", "schema.relationshipkinds", "schema.migrations", "schema.profiles", "parser.override", "preflight.override", "services.override", "renderers.override", "importers.importer", "importers.exporter", "search.provider", "search.vectorstore"];
+export declare const PM_EXTENSION_POLICY_SURFACE_CONTRACTS: readonly ["commands.override", "commands.handler", "hooks.beforecommand", "hooks.beforemutation", "hooks.aftercommand", "hooks.onwrite", "hooks.onread", "hooks.onindex", "schema.flags", "schema.itemfields", "schema.itemtypes", "schema.relationshipkinds", "schema.migrations", "schema.profiles", "parser.override", "preflight.override", "services.override", "renderers.override", "importers.importer", "importers.exporter", "search.provider", "search.vectorstore", "services.assuranceprovider"];
 /** Restricts pm extension policy surface contract values accepted by command, SDK, and storage contracts. */
 export type PmExtensionPolicySurfaceContract = (typeof PM_EXTENSION_POLICY_SURFACE_CONTRACTS)[number];
 /** Public contract for pm core command names, shared by SDK and presentation-layer consumers. */

package/dist/sdk/cli-contracts/flag-contracts.js

@@ -7,7 +7,7 @@
  * flag surface stays single-sourced across the CLI, SDK, and MCP boundaries.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="40309a44-7d45-5333-9003-6fc740e827c8")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a5a2c81f-8870-5111-b13c-74c362098d54")}catch(e){}}();
 import { normalizeUniqueStringList } from "./string-lists.js";
 import { RESERVED_EXTENSION_HOST_FLAGS } from "../../core/extensions/reserved-host-flags.js";
 function normalizeFlagAliasKey(flag) {
@@ -392,7 +392,7 @@ export const SCHEMA_FLAG_CONTRACTS = [
     // add-type --infer flags (title-prefix type inference).
     { flag: "--infer" },
     { flag: "--min-count" },
-    { flag: "--apply" },
+    { flag: "--apply", value_type: "boolean" },
     // Lossless schema evolution flags.
     { flag: "--to" },
     { flag: "--migration-id", aliases: ["--migration_id"] },
@@ -1018,6 +1018,9 @@ export const ASSURANCE_FLAG_CONTRACTS = [
     { flag: "--dry-run" },
     { flag: "--author", value_name: "value" },
     { flag: "--message", value_name: "value" },
+    { flag: "--owner", value_name: "item-id" },
+    { flag: "--apply", value_type: "boolean" },
+    { flag: "--enforcement", value_name: "level" },
 ];
 const ITEM_OWNERSHIP_AND_ISSUE_FLAG_CONTRACTS = [
     { flag: "--assignee" },
@@ -1814,4 +1817,4 @@ export function toCompletionFlagString(flagContracts, includeGlobal = true) {
     return normalizeUniqueStringList(all).join(" ");
 }
 //# sourceMappingURL=flag-contracts.js.map
-//# debugId=40309a44-7d45-5333-9003-6fc740e827c8
+//# debugId=a5a2c81f-8870-5111-b13c-74c362098d54

package/dist/sdk/cli-contracts/schemas/assurance-definition.d.ts

@@ -303,6 +303,7 @@ export declare const ASSURANCE_DEFINITION_SCHEMA: {
             negative_control?: undefined;
             assertion_ids?: undefined;
             triggers?: undefined;
+            provider_policy?: undefined;
         };
         oneOf?: undefined;
         allOf?: undefined;
@@ -463,6 +464,7 @@ export declare const ASSURANCE_DEFINITION_SCHEMA: {
             source?: undefined;
             assertion_ids?: undefined;
             triggers?: undefined;
+            provider_policy?: undefined;
         };
     } | {
         type: string;
@@ -491,6 +493,36 @@ export declare const ASSURANCE_DEFINITION_SCHEMA: {
                     enum: string[];
                 };
             };
+            provider_policy: {
+                type: string;
+                additionalProperties: boolean;
+                required: string[];
+                properties: {
+                    allowed_providers: {
+                        type: string;
+                        items: {
+                            type: string;
+                            minLength: number;
+                        };
+                    };
+                    triggers: {
+                        type: string;
+                        additionalProperties: {
+                            type: string;
+                            additionalProperties: boolean;
+                            required: string[];
+                            properties: {
+                                max_cost_class: {
+                                    enum: string[];
+                                };
+                                allow_network: {
+                                    type: string;
+                                };
+                            };
+                        };
+                    };
+                };
+            };
             max_cost?: undefined;
             source?: undefined;
             measurement_id?: undefined;

package/dist/sdk/cli-contracts/schemas/assurance-definition.js

@@ -4,7 +4,7 @@
  * Defines the strict JSON Schema accepted by assurance definition mutations.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2d81fb20-890a-553b-b761-d60caf56b502")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="19a97f60-3b6e-5653-a652-02aebaf5afdd")}catch(e){}}();
 const ASSURANCE_VALUE_SCHEMA = {
     oneOf: [{ type: "number" }, { type: "array", items: { type: "string" } }],
 };
@@ -244,9 +244,32 @@ export const ASSURANCE_DEFINITION_SCHEMA = {
                         ],
                     },
                 },
+                provider_policy: {
+                    type: "object",
+                    additionalProperties: false,
+                    required: ["allowed_providers", "triggers"],
+                    properties: {
+                        allowed_providers: {
+                            type: "array",
+                            items: { type: "string", minLength: 1 },
+                        },
+                        triggers: {
+                            type: "object",
+                            additionalProperties: {
+                                type: "object",
+                                additionalProperties: false,
+                                required: ["max_cost_class", "allow_network"],
+                                properties: {
+                                    max_cost_class: { enum: ["low", "medium", "high"] },
+                                    allow_network: { type: "boolean" },
+                                },
+                            },
+                        },
+                    },
+                },
             },
         },
     ],
 };
 //# sourceMappingURL=assurance-definition.js.map
-//# debugId=2d81fb20-890a-553b-b761-d60caf56b502
+//# debugId=19a97f60-3b6e-5653-a652-02aebaf5afdd

package/dist/sdk/cli-contracts/tool-parameter-tables.js

@@ -4,7 +4,7 @@
  * Defines SDK command-contract metadata for Tool Parameter Tables.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6cdf1fd1-7328-5bae-9238-d317f6efba8a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9a679120-6f16-5588-b4d4-91c90a2fe385")}catch(e){}}();
 import { PLAN_HARNESS_VALUES, PLAN_MODE_VALUES, PLAN_STEP_LINK_KIND_VALUES, PLAN_STEP_STATUS_VALUES, } from "../../types/index.js";
 import { PM_READ_OUTPUT_SESSION_MAX_SEEN_ITEM_IDS } from "../read-output-session.js";
 import { ASSURANCE_DEFINITION_SCHEMA } from "./schemas/assurance-definition.js";
@@ -219,6 +219,8 @@ export const PM_TOOL_PARAMETER_PROPERTIES = {
     acceptanceCriteria: { type: "string" },
     author: { type: "string" },
     message: { type: "string" },
+    owner: { type: "string" },
+    enforcement: { type: "string" },
     assignee: { type: "string" },
     assigneeFilter: { type: "string", enum: ["assigned", "unassigned"] },
     parent: { type: "string" },
@@ -646,8 +648,24 @@ export const PM_TOOL_ACTION_SCOPED_PARAMETER_PROPERTIES = {
         },
         subcommand: {
             type: "string",
-            enum: ["list", "show", "put", "remove", "run", "verdicts"],
+            enum: [
+                "list",
+                "show",
+                "put",
+                "remove",
+                "run",
+                "verdicts",
+                "presets",
+                "apply",
+                "derive",
+                "promote",
+            ],
+        },
+        preset: {
+            type: "string",
+            enum: ["software-delivery", "research", "agent-evaluation", "operations"],
         },
+        enforcement: { type: "string", enum: ["warn", "block"] },
         limit: { type: "integer", minimum: 1, maximum: 1000 },
     },
     activity: {
@@ -970,6 +988,14 @@ export const PM_TOOL_PARAMETER_METADATA = {
         description: "Stable assurance gate id used to filter durable verdict history.",
         examples: ["release-readiness"],
     },
+    owner: {
+        description: "pm item that owns preset or observation-derived assurance assertions.",
+        examples: ["pm-a1b2"],
+    },
+    enforcement: {
+        description: "Explicit next assurance enforcement level.",
+        examples: ["warn", "block"],
+    },
     runId: {
         description: "Background test run identifier.",
         examples: ["tr-kq9x3f-93acde"],
@@ -1850,8 +1876,8 @@ export const PM_TOOL_PARAMETER_METADATA = {
 export const PM_TOOL_ACTION_SCOPED_PARAMETER_METADATA = {
     assurance: {
         subcommand: {
-            description: "Assurance operation: list, show, put, remove, run, or verdicts.",
-            examples: ["list", "run", "verdicts"],
+            description: "Assurance operation: list, show, put, remove, run, verdicts, presets, apply, derive, or promote.",
+            examples: ["list", "run", "derive", "promote"],
         },
         kind: {
             description: "Assurance declaration kind for registry operations: measurement, assertion, or gate.",
@@ -1865,6 +1891,10 @@ export const PM_TOOL_ACTION_SCOPED_PARAMETER_METADATA = {
             description: "Maximum number of newest assurance verdicts returned.",
             examples: [10, 25],
         },
+        preset: {
+            description: "Built-in assurance project shape to preview or apply.",
+            examples: ["software-delivery", "agent-evaluation"],
+        },
     },
     update: {
         acceptanceCriteria: {
@@ -2019,4 +2049,4 @@ export const PM_TOOL_ACTION_SCOPED_PARAMETER_METADATA = {
     },
 };
 //# sourceMappingURL=tool-parameter-tables.js.map
-//# debugId=6cdf1fd1-7328-5bae-9238-d317f6efba8a
+//# debugId=9a679120-6f16-5588-b4d4-91c90a2fe385

package/dist/sdk/cli-contracts/tool-schema.js

@@ -7,7 +7,7 @@
  * consumers from a single source of truth.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5a184f36-a305-59f1-8c68-ef53cea1df1e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d4550d60-3907-528e-b984-c8ca90b7a4e8")}catch(e){}}();
 import { normalizeUniqueStringList } from "./string-lists.js";
 import { PM_TOOL_ACTIONS } from "./enum-contracts.js";
 import { TOOL_CREATE_OPTION_CONTRACTS, TOOL_SHARED_CREATE_UPDATE_OPTION_CONTRACTS, TOOL_UPDATE_OPTION_CONTRACTS, TOOL_UPDATE_MANY_FILTER_OPTION_CONTRACTS, TOOL_CONTEXT_OPTION_CONTRACTS, TOOL_ACTIVITY_OPTION_CONTRACTS, TOOL_LIST_FILTER_OPTION_CONTRACTS, TOOL_AGGREGATE_OPTION_CONTRACTS, TOOL_SEARCH_FILTER_OPTION_CONTRACTS, TOOL_CLOSE_MANY_FILTER_OPTION_CONTRACTS, } from "./tool-option-contracts.js";
@@ -1119,6 +1119,10 @@ const PM_TOOL_ACTION_SCHEMA_CONTRACTS = {
             "dryRun",
             "author",
             "message",
+            "preset",
+            "owner",
+            "apply",
+            "enforcement",
         ],
         conditionalRequired: [
             { property: "subcommand", value: "list", required: ["kind"] },
@@ -1130,6 +1134,17 @@ const PM_TOOL_ACTION_SCHEMA_CONTRACTS = {
             },
             { property: "subcommand", value: "remove", required: ["kind", "id"] },
             { property: "subcommand", value: "run", required: ["id", "trigger"] },
+            {
+                property: "subcommand",
+                value: "apply",
+                required: ["preset", "owner"],
+            },
+            { property: "subcommand", value: "derive", required: ["owner"] },
+            {
+                property: "subcommand",
+                value: "promote",
+                required: ["id", "enforcement"],
+            },
         ],
     },
     gc: { optional: ["dryRun", "gcScope"] },
@@ -1558,4 +1573,4 @@ export const _testOnlyCliContracts = {
     withFlagAliasMetadata,
 };
 //# sourceMappingURL=tool-schema.js.map
-//# debugId=5a184f36-a305-59f1-8c68-ef53cea1df1e
+//# debugId=d4550d60-3907-528e-b984-c8ca90b7a4e8

package/dist/sdk/comments.js

@@ -4,7 +4,8 @@
  * Implements the pm comments command surface and its agent-facing runtime behavior.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="667218ac-866c-59b1-8309-18ad92434fca")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a7687052-a04e-536e-ace5-a665ebd477e3")}catch(e){}}();
+import { isFileAbsentError } from "../core/fs/fs-utils.js";
 import { readFile } from "node:fs/promises";
 import { EXIT_CODE, PmCliError, createStdinTokenResolver, } from "./runtime-primitives.js";
 import { isErrnoError, parseAnnotationTextInput, runAnnotationCommand, } from "./annotations.js";
@@ -36,7 +37,7 @@ async function resolveCommentTextSource(options, stdinResolver) {
         return { value: fileInput, emptyFlag: "--file" };
     }
     catch (error) {
-        if (isErrnoError(error) && error.code === "ENOENT") {
+        if (isErrnoError(error) && isFileAbsentError(error)) {
             throw new PmCliError(`--file path not found: ${filePath}`, EXIT_CODE.USAGE);
         }
         const detail = error instanceof Error ? error.message : String(error);
@@ -122,4 +123,4 @@ export async function runComments(id, options, global) {
     });
 }
 //# sourceMappingURL=comments.js.map
-//# debugId=667218ac-866c-59b1-8309-18ad92434fca
+//# debugId=a7687052-a04e-536e-ace5-a665ebd477e3

package/dist/sdk/compile-cache.js

@@ -5,7 +5,8 @@
  * compile-cache generations.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6748a283-bc93-5783-98c1-d1a7f2fdce4e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="611e9aba-d08e-5c1a-89c9-c7fda0cc9bc9")}catch(e){}}();
+import { isFileMissingError } from "../core/fs/fs-utils.js";
 import fs from "node:fs";
 import path from "node:path";
 const COMPILE_CACHE_CONCURRENT_GRACE_MS = 5 * 60 * 1000;
@@ -44,7 +45,7 @@ export function pruneCompileCacheGenerations(cacheRoot, currentGeneration) {
         catch (error) {
             if (error instanceof Error &&
                 "code" in error &&
-                error.code === "ENOENT") {
+                isFileMissingError(error)) {
                 return [];
             }
             throw error;
@@ -70,4 +71,4 @@ export function pruneCompileCacheGenerations(cacheRoot, currentGeneration) {
     return { retained: normalizedGeneration, removed };
 }
 //# sourceMappingURL=compile-cache.js.map
-//# debugId=6748a283-bc93-5783-98c1-d1a7f2fdce4e
+//# debugId=611e9aba-d08e-5c1a-89c9-c7fda0cc9bc9