@unbrained/pm-cli 2026.8.16 → 2026.8.18

package/dist/sdk/generated/generated-error-code-catalog-part-1.js

@@ -1,6 +1,6 @@
 /** Generated partition 1 of the exhaustive error-code catalog. */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="515e0f67-1d1d-5ee7-9000-bbe9aa201507")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="29cde680-7551-51d1-9c5e-dd9d062d2397")}catch(e){}}();
 export const PM_ERROR_CODE_CATALOG_PART_1 = [
     {
         code: "acceptance_criteria_mutation_conflict",
@@ -38,6 +38,18 @@ export const PM_ERROR_CODE_CATALOG_PART_1 = [
         canonical_code: "acceptance_criteria_semicolon_forbidden",
         aliases: [],
     },
+    {
+        code: "alias_target_missing",
+        meaning: "Alias target missing condition.",
+        stability: "provisional",
+        exit_code: 1,
+        class: "generic_failure",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: ["sdk/cli-contracts/grammar-contracts.ts"],
+        emitting_commands: ["*"],
+        canonical_code: "alias_target_missing",
+        aliases: [],
+    },
     {
         code: "already_claimed_by",
         meaning: "Already claimed by condition.",
@@ -50,18 +62,6 @@ export const PM_ERROR_CODE_CATALOG_PART_1 = [
         canonical_code: "already_claimed_by",
         aliases: [],
     },
-    {
-        code: "ambiguous_list_all",
-        meaning: "Ambiguous list all condition.",
-        stability: "stable",
-        exit_code: 2,
-        class: "usage",
-        recovery: "Inspect the structured error guidance and retry the suggested command.",
-        sources: ["cli/register-list-query.ts"],
-        emitting_commands: ["*"],
-        canonical_code: "ambiguous_list_all",
-        aliases: [],
-    },
     {
         code: "ambiguous_option_combination",
         meaning: "Ambiguous option combination condition.",
@@ -470,6 +470,18 @@ export const PM_ERROR_CODE_CATALOG_PART_1 = [
         canonical_code: "dependency_target_not_found",
         aliases: [],
     },
+    {
+        code: "dependency_temporal_order_invalid",
+        meaning: "Dependency temporal order invalid condition.",
+        stability: "provisional",
+        exit_code: 2,
+        class: "usage",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: ["sdk/dependency-flag-validation.ts"],
+        emitting_commands: ["*"],
+        canonical_code: "dependency_temporal_order_invalid",
+        aliases: [],
+    },
     {
         code: "duplicate_command",
         meaning: "Duplicate command condition.",
@@ -482,6 +494,18 @@ export const PM_ERROR_CODE_CATALOG_PART_1 = [
         canonical_code: "duplicate_command",
         aliases: [],
     },
+    {
+        code: "duplicate_destination",
+        meaning: "Duplicate destination condition.",
+        stability: "provisional",
+        exit_code: 1,
+        class: "generic_failure",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: ["sdk/cli-contracts/grammar-contracts.ts"],
+        emitting_commands: ["*"],
+        canonical_code: "duplicate_destination",
+        aliases: [],
+    },
     {
         code: "duplicate_edge",
         meaning: "Duplicate edge condition.",
@@ -1256,6 +1280,22 @@ export const PM_ERROR_CODE_CATALOG_PART_1 = [
         canonical_code: "invalid_event_cursor",
         aliases: [],
     },
+    {
+        code: "invalid_event_cursor_mode",
+        meaning: "Invalid event cursor mode condition.",
+        stability: "provisional",
+        exit_code: 2,
+        class: "usage",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: [
+            "cli/register-list-query.ts",
+            "sdk/mutation-events.ts",
+            "sdk/runtime-extended-actions.ts",
+        ],
+        emitting_commands: ["*"],
+        canonical_code: "invalid_event_cursor_mode",
+        aliases: [],
+    },
     {
         code: "invalid_event_follow_interval",
         meaning: "Invalid event follow interval condition.",
@@ -1628,6 +1668,18 @@ export const PM_ERROR_CODE_CATALOG_PART_1 = [
         canonical_code: "manifest_capabilities_absent",
         aliases: [],
     },
+    {
+        code: "manifest_unknown_key",
+        meaning: "Manifest unknown key condition.",
+        stability: "provisional",
+        exit_code: 2,
+        class: "usage",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: ["sdk/compose.ts"],
+        emitting_commands: ["*"],
+        canonical_code: "manifest_unknown_key",
+        aliases: [],
+    },
     {
         code: "merge_conflict_markers_detected",
         meaning: "Merge conflict markers detected condition.",
@@ -1640,6 +1692,18 @@ export const PM_ERROR_CODE_CATALOG_PART_1 = [
         canonical_code: "merge_conflict_markers_detected",
         aliases: ["history_merge_conflict_markers_detected"],
     },
+    {
+        code: "merge_decisions_unreviewed",
+        meaning: "Merge decisions unreviewed condition.",
+        stability: "provisional",
+        exit_code: 1,
+        class: "generic_failure",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: ["core/diagnostics/remediation.ts"],
+        emitting_commands: ["*"],
+        canonical_code: "merge_decisions_unreviewed",
+        aliases: [],
+    },
 ];
 //# sourceMappingURL=generated-error-code-catalog-part-1.js.map
-//# debugId=515e0f67-1d1d-5ee7-9000-bbe9aa201507
+//# debugId=29cde680-7551-51d1-9c5e-dd9d062d2397

package/dist/sdk/generated/generated-error-code-catalog-part-2.js

@@ -1,19 +1,7 @@
 /** Generated partition 2 of the exhaustive error-code catalog. */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e17917c7-8433-5de1-a895-ca5a03ce03da")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1b16c4f8-d399-52fa-b2b6-bc677bdf676f")}catch(e){}}();
 export const PM_ERROR_CODE_CATALOG_PART_2 = [
-    {
-        code: "merge_decisions_unreviewed",
-        meaning: "Merge decisions unreviewed condition.",
-        stability: "provisional",
-        exit_code: 1,
-        class: "generic_failure",
-        recovery: "Inspect the structured error guidance and retry the suggested command.",
-        sources: ["core/diagnostics/remediation.ts"],
-        emitting_commands: ["*"],
-        canonical_code: "merge_decisions_unreviewed",
-        aliases: [],
-    },
     {
         code: "merge_git_config_unwritable",
         meaning: "Merge git config unwritable condition.",
@@ -50,6 +38,18 @@ export const PM_ERROR_CODE_CATALOG_PART_2 = [
         canonical_code: "merge_root_not_found",
         aliases: [],
     },
+    {
+        code: "missing_destination",
+        meaning: "Missing destination condition.",
+        stability: "provisional",
+        exit_code: 1,
+        class: "generic_failure",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: ["sdk/cli-contracts/grammar-contracts.ts"],
+        emitting_commands: ["*"],
+        canonical_code: "missing_destination",
+        aliases: [],
+    },
     {
         code: "missing_directory",
         meaning: "Missing directory condition.",
@@ -219,6 +219,18 @@ export const PM_ERROR_CODE_CATALOG_PART_2 = [
         canonical_code: "no_update_fields",
         aliases: [],
     },
+    {
+        code: "no_version_bounds_declared",
+        meaning: "No version bounds declared condition.",
+        stability: "provisional",
+        exit_code: 1,
+        class: "generic_failure",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: ["sdk/compose.ts"],
+        emitting_commands: ["*"],
+        canonical_code: "no_version_bounds_declared",
+        aliases: [],
+    },
     {
         code: "npm_package_not_found",
         meaning: "Npm package not found condition.",
@@ -495,6 +507,18 @@ export const PM_ERROR_CODE_CATALOG_PART_2 = [
         canonical_code: "settings_read_merge_failed",
         aliases: [],
     },
+    {
+        code: "stale_destination",
+        meaning: "Stale destination condition.",
+        stability: "provisional",
+        exit_code: 1,
+        class: "generic_failure",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: ["sdk/cli-contracts/grammar-contracts.ts"],
+        emitting_commands: ["*"],
+        canonical_code: "stale_destination",
+        aliases: [],
+    },
     {
         code: "status_duplicate",
         meaning: "Status duplicate condition.",
@@ -910,6 +934,18 @@ export const PM_ERROR_CODE_CATALOG_PART_2 = [
         canonical_code: "unknown_subcommand",
         aliases: [],
     },
+    {
+        code: "unknown_noun",
+        meaning: "Unknown noun condition.",
+        stability: "provisional",
+        exit_code: 2,
+        class: "usage",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: ["sdk/cli-contracts/grammar-contracts.ts"],
+        emitting_commands: ["*"],
+        canonical_code: "unknown_noun",
+        aliases: [],
+    },
     {
         code: "unknown_option",
         meaning: "Unknown option condition.",
@@ -1471,6 +1507,18 @@ export const PM_ERROR_CODE_CATALOG_PART_2 = [
         canonical_code: "vectorization_stale_items_remaining",
         aliases: [],
     },
+    {
+        code: "visible_surface_ceiling_exceeded",
+        meaning: "Visible surface ceiling exceeded condition.",
+        stability: "provisional",
+        exit_code: 1,
+        class: "generic_failure",
+        recovery: "Inspect the structured error guidance and retry the suggested command.",
+        sources: ["sdk/cli-contracts/grammar-contracts.ts"],
+        emitting_commands: ["*"],
+        canonical_code: "visible_surface_ceiling_exceeded",
+        aliases: [],
+    },
     {
         code: "workflow_duplicate_type",
         meaning: "Workflow duplicate type condition.",
@@ -1665,4 +1713,4 @@ export const PM_ERROR_CODE_CATALOG_PART_2 = [
     },
 ];
 //# sourceMappingURL=generated-error-code-catalog-part-2.js.map
-//# debugId=e17917c7-8433-5de1-a895-ca5a03ce03da
+//# debugId=1b16c4f8-d399-52fa-b2b6-bc677bdf676f

package/dist/sdk/governance/assurance-action.d.ts

@@ -1,14 +1,10 @@
-/**
- * @module sdk/assurance-action
- *
- * Normalizes the assurance action vocabulary once for CLI, SDK, and MCP hosts.
- */
 import type { GlobalOptions } from "../../core/shared/command-types.js";
 import { type AssuranceBundleMutationReceipt, type AssuranceDeclaration, type AssuranceGateVerdict, type AssuranceMutationReceipt } from "./assurance.js";
 import { type AssuranceDerivedProposal, type AssurancePreset, type AssurancePresetId } from "./assurance-presets.js";
 import { type CreateAssuranceWorkspaceContextOptions } from "./assurance-runtime.js";
+import { type DefectChangeRiskReport } from "./defect-recurrence.js";
 /** Assurance registry and evaluation verbs shared by every transport. */
-export declare const ASSURANCE_ACTIONS: readonly ["list", "show", "put", "remove", "run", "verdicts", "presets", "apply", "derive", "promote"];
+export declare const ASSURANCE_ACTIONS: readonly ["list", "show", "put", "remove", "run", "verdicts", "presets", "apply", "derive", "promote", "risk"];
 /** Assurance declaration kinds shared by every transport. */
 export declare const ASSURANCE_DECLARATION_KINDS: readonly ["measurement", "assertion", "gate"];
 /** Assurance action verb. */
@@ -56,7 +52,7 @@ export interface AssuranceActionRuntimeOptions {
     workspace?: Omit<CreateAssuranceWorkspaceContextOptions, "tree_id" | "trigger">;
 }
 /** Result union returned by transport-neutral assurance execution. */
-export type AssuranceActionResult = AssuranceDeclaration | AssuranceMutationReceipt | AssuranceGateVerdict | AssuranceBundleMutationReceipt | AssurancePreset | {
+export type AssuranceActionResult = AssuranceDeclaration | AssuranceMutationReceipt | AssuranceGateVerdict | AssuranceBundleMutationReceipt | AssurancePreset | DefectChangeRiskReport | {
     items: AssuranceDerivedProposal[];
     count: number;
     applied?: AssuranceBundleMutationReceipt;

package/dist/sdk/governance/assurance-action.js

@@ -1,7 +1,14 @@
+/**
+ * @module sdk/assurance-action
+ *
+ * Normalizes the assurance action vocabulary once for CLI, SDK, and MCP hosts.
+ */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="06d21369-1339-54b2-8d78-442f02e24cef")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="57c12241-812d-5db6-9a07-ca256152b130")}catch(e){}}();
+import { createHash } from "node:crypto";
 import { EXIT_CODE } from "../../core/shared/constants.js";
 import { PmCliError } from "../../core/shared/errors.js";
+import { stableStringify } from "../../core/shared/serialization.js";
 import { ASSURANCE_GATE_TRIGGERS, evaluateAssuranceGate, getAssuranceDeclaration, listAssuranceDeclarations, listAssuranceVerdicts, putAssuranceDeclaration, recordAssuranceVerdict, removeAssuranceDeclaration, } from "./assurance.js";
 import { ASSURANCE_PRESET_IDS, acceptAssuranceProposals, applyAssurancePreset, createAssurancePreset, deriveAssuranceProposals, promoteAssuranceAssertion, } from "./assurance-presets.js";
 import { MAX_ASSURANCE_VERDICT_LIMIT } from "./assurance-limits.js";
@@ -9,6 +16,9 @@ import { normalizeAssuranceEvaluation, normalizeAssuranceMutation, } from "./ass
 import { createAssuranceWorkspaceContext, } from "./assurance-runtime.js";
 import { resolvePmRoot } from "../runtime-primitives.js";
 import { parseRuntimeInteger, readRuntimeString } from "../runtime-input.js";
+import { analyzeDefectChangeRisk, buildDefectRecurrenceIndex, parseDefectChangeRiskRequest, } from "./defect-recurrence.js";
+import { defectRecurrenceItemSignals } from "./defect-recurrence-signals.js";
+let riskIndexCache;
 /** Assurance registry and evaluation verbs shared by every transport. */
 export const ASSURANCE_ACTIONS = [
     "list",
@@ -21,6 +31,7 @@ export const ASSURANCE_ACTIONS = [
     "apply",
     "derive",
     "promote",
+    "risk",
 ];
 /** Assurance declaration kinds shared by every transport. */
 export const ASSURANCE_DECLARATION_KINDS = [
@@ -205,6 +216,87 @@ async function runGateAction(input, pmRoot, runtime) {
     }
     return verdict;
 }
+/** Normalize a request-validation failure into the shared usage-error contract. */
+function throwRiskUsageError(error) {
+    if (error instanceof PmCliError)
+        throw error;
+    throw new PmCliError(error instanceof Error
+        ? error.message
+        : "assurance risk request is invalid", EXIT_CODE.USAGE);
+}
+/** Parse JSON or object risk definitions without wrapping workspace failures. */
+function parseRiskActionRequest(input) {
+    if (input.limit !== undefined) {
+        throw new PmCliError("assurance risk does not accept --limit; set limit inside the risk definition", EXIT_CODE.USAGE);
+    }
+    let definition = input.definition;
+    if (typeof definition === "string") {
+        try {
+            definition = JSON.parse(definition);
+        }
+        catch (error) {
+            throw new PmCliError("assurance risk definition must be valid JSON", EXIT_CODE.USAGE, { reason: error instanceof Error ? error.message : "invalid_json" });
+        }
+    }
+    try {
+        return parseDefectChangeRiskRequest(definition);
+    }
+    catch (error) {
+        return throwRiskUsageError(error);
+    }
+}
+/** Derive the exact sparse replacement and deletion set for a cached index. */
+function changedRiskItemIds(cached, current) {
+    const changed = new Set();
+    for (const [itemId, itemFingerprint] of current) {
+        if (cached.item_fingerprints.get(itemId) !== itemFingerprint)
+            changed.add(itemId);
+    }
+    for (const itemId of cached.item_fingerprints.keys()) {
+        if (!current.has(itemId))
+            changed.add(itemId);
+    }
+    return changed;
+}
+/** Build and retain a safely invalidated bounded process-local recurrence index. */
+function buildCachedRiskIndex(pmRoot, request, items) {
+    const policySerialized = stableStringify(request.policy);
+    const cached = riskIndexCache?.pm_root === pmRoot ? riskIndexCache : undefined;
+    const itemFingerprints = new Map(items.map((item) => [
+        item.id,
+        createHash("sha256")
+            .update(stableStringify(defectRecurrenceItemSignals(item)))
+            .digest("hex"),
+    ]));
+    const reusable = cached?.policy_serialized === policySerialized ? cached : undefined;
+    const changed = reusable
+        ? changedRiskItemIds(reusable, itemFingerprints)
+        : new Set();
+    const index = buildDefectRecurrenceIndex(request.policy, reusable ? items.filter((item) => changed.has(item.id)) : items, reusable
+        ? { previous_index: reusable.index, changed_item_ids: [...changed] }
+        : {});
+    riskIndexCache = {
+        pm_root: pmRoot,
+        policy_serialized: policySerialized,
+        item_fingerprints: itemFingerprints,
+        index,
+    };
+    return index;
+}
+/** Evaluate one serialized change-risk request against authoritative PM metadata. */
+async function runRiskAction(input, pmRoot) {
+    const request = parseRiskActionRequest(input);
+    const context = await createAssuranceWorkspaceContext(pmRoot, {
+        include_history: false,
+        resolve_tree: false,
+    });
+    try {
+        return analyzeDefectChangeRisk(buildCachedRiskIndex(pmRoot, request, context.items), request.change, { cursor: request.cursor, limit: request.limit });
+    }
+    catch (error) {
+        return throwRiskUsageError(error);
+    }
+}
 /** Execute one assurance request through the public assurance SDK primitives. */
 export async function runAssuranceAction(input, global = {}, runtime = {}) {
     const action = parseAction(input.action);
@@ -221,6 +313,9 @@ export async function runAssuranceAction(input, global = {}, runtime = {}) {
     if (action === "run") {
         return runGateAction(input, pmRoot, runtime);
     }
+    if (action === "risk") {
+        return runRiskAction(input, pmRoot);
+    }
     const kind = parseKind(input.kind);
     if (action === "list")
         return listAssuranceDeclarations(pmRoot, kind);
@@ -282,4 +377,4 @@ export function runAssuranceDispatch(args, options, global) {
     }, global);
 }
 //# sourceMappingURL=assurance-action.js.map
-//# debugId=06d21369-1339-54b2-8d78-442f02e24cef
+//# debugId=57c12241-812d-5db6-9a07-ca256152b130

package/dist/sdk/governance/boundary-fixtures.d.ts

@@ -0,0 +1,86 @@
+/** Evidence source accepted for a captured boundary sample. */
+export declare const BOUNDARY_FIXTURE_CAPTURE_SOURCES: readonly ["captured_redacted", "captured_verbatim"];
+/** Captured boundary evidence source. */
+export type BoundaryFixtureCaptureSource = (typeof BOUNDARY_FIXTURE_CAPTURE_SOURCES)[number];
+/** Inventory record backed by a committed captured sample. */
+export interface CapturedBoundaryRecord {
+    /** Stable external-boundary identifier. */
+    id: string;
+    /** Production component that emits or obtains the value. */
+    producer: string;
+    /** Production component that parses or consumes the value. */
+    consumer: string;
+    /** Concise serialized-format description. */
+    format: string;
+    /** Relative path to a committed JSON fixture. */
+    fixture_path: string;
+}
+/** Inventory record explicitly waived until a bounded expiry. */
+export interface WaivedBoundaryRecord {
+    /** Stable external-boundary identifier. */
+    id: string;
+    /** Production component that emits or obtains the value. */
+    producer: string;
+    /** Production component that parses or consumes the value. */
+    consumer: string;
+    /** Concise serialized-format description. */
+    format: string;
+    /** Concrete reason a safe captured fixture is not available. */
+    waiver_reason: string;
+    /** Accountable PM item or team. */
+    waiver_owner: string;
+    /** ISO timestamp after which the waiver fails closed. */
+    waiver_expires_at: string;
+}
+/** One externally generated or consumed boundary inventory entry. */
+export type BoundaryInventoryRecord = CapturedBoundaryRecord | WaivedBoundaryRecord;
+/** Versioned project boundary inventory. */
+export interface BoundaryFixtureRegistry {
+    /** Serialized registry format. */
+    version: 1;
+    /** Human-readable statement of what source surfaces were inventoried. */
+    inventory_scope: string;
+    /** Captured or explicitly waived boundary records. */
+    boundaries: BoundaryInventoryRecord[];
+}
+/** Required shape of a committed captured boundary sample. */
+export interface BoundaryFixtureSample {
+    /** Serialized fixture format. */
+    version: 1;
+    /** Inventory boundary id proved by this sample. */
+    boundary_id: string;
+    /** Captured evidence classification; self-generated is intentionally absent. */
+    capture_source: BoundaryFixtureCaptureSource;
+    /** Where and how the original value was observed. */
+    capture_provenance: string;
+    /** Redactions applied before committing the sample. */
+    redactions: string[];
+    /** Redacted external input. */
+    input: unknown;
+    /** Redacted observed boundary value. */
+    observed: unknown;
+}
+/** Stable boundary-fixture governance finding. */
+export interface BoundaryFixtureFinding {
+    /** Boundary id, or registry for registry-wide defects. */
+    boundary_id: string;
+    /** Machine-readable failure kind. */
+    kind: "invalid_registry" | "duplicate_boundary" | "invalid_boundary" | "missing_fixture" | "invalid_fixture" | "fixture_boundary_mismatch" | "unsafe_fixture" | "invalid_waiver" | "expired_waiver";
+    /** Actionable explanation. */
+    detail: string;
+}
+/** Complete captured-boundary governance report. */
+export interface BoundaryFixtureReport {
+    /** Whether every inventoried boundary has safe current evidence. */
+    ok: boolean;
+    /** Total inventoried boundaries. */
+    boundary_count: number;
+    /** Boundaries backed by committed captured samples. */
+    captured_count: number;
+    /** Boundaries carrying live explicit waivers. */
+    waived_count: number;
+    /** Stable sorted failures. */
+    findings: BoundaryFixtureFinding[];
+}
+/** Validate an untrusted boundary registry and its already-loaded JSON samples. */
+export declare function evaluateBoundaryFixtures(registry: BoundaryFixtureRegistry, fixtures: Readonly<Record<string, unknown>>, now?: Date): BoundaryFixtureReport;