@unbrained/pm-cli 2026.8.25 → 2026.8.27

package/dist/core/extensions/manifest-schema.d.ts

@@ -14,7 +14,27 @@ export interface ExtensionManifestSchemaInspection {
     /** Whether neither canonical pm compatibility bound is present. */
     missingVersionBounds: boolean;
 }
+/** Stable machine-readable schema finding emitted by author-time lint. */
+export interface ExtensionManifestSchemaFinding {
+    /** Schema condition an author must review. */
+    code: "manifest_unknown_key" | "no_version_bounds_declared";
+    /** JSON-style manifest location responsible for the finding. */
+    path: string;
+    /** Canonical key to use when the mistaken or missing field has one. */
+    suggested_key?: "pm_min_version" | "pm_max_version";
+    /** Actionable explanation of the ignored or missing declaration. */
+    message: string;
+}
+/** Pure schema-lint result for one raw extension manifest. */
+export interface ExtensionManifestSchemaLintResult {
+    /** False when at least one author-facing schema finding is present. */
+    ok: boolean;
+    /** Deterministically ordered schema findings. */
+    findings: ExtensionManifestSchemaFinding[];
+}
 /** Inspect raw manifest keys without parsing, loading, or mutating an extension. */
 export declare function inspectExtensionManifestSchema(manifest: Readonly<Record<string, unknown>>): ExtensionManifestSchemaInspection;
+/** Lint raw extension-manifest keys without loading code or evaluating versions. */
+export declare function lintExtensionManifestSchema(manifest: Readonly<Record<string, unknown>>): ExtensionManifestSchemaLintResult;
 /** Format runtime discovery warnings for unknown keys and absent canonical compatibility bounds. */
 export declare function formatExtensionManifestSchemaWarnings(layer: ExtensionLayer, manifest: ExtensionManifest, rawManifest: Readonly<Record<string, unknown>>): string[];

package/dist/core/extensions/manifest-schema.js

@@ -6,7 +6,7 @@
  */
 /** Canonical top-level keys accepted by an extension `manifest.json`. */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7d9d8924-3186-5aab-ac36-164fb08624a8")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="49cea84c-1d1b-523b-8c98-7ac16c69ae82")}catch(e){}}();
 export const KNOWN_EXTENSION_MANIFEST_KEYS = new Set([
     "name",
     "version",
@@ -37,16 +37,34 @@ export function inspectExtensionManifestSchema(manifest) {
             manifest.pm_max_version === undefined,
     };
 }
-/** Format runtime discovery warnings for unknown keys and absent canonical compatibility bounds. */
-export function formatExtensionManifestSchemaWarnings(layer, manifest, rawManifest) {
-    const inspection = inspectExtensionManifestSchema(rawManifest);
-    const warnings = inspection.unknownKeys.map((key) => key === "compatibility"
-        ? `extension_manifest_unknown_key:${layer}:${manifest.name}:key=compatibility:suggested=pm_min_version`
-        : `extension_manifest_unknown_key:${layer}:${manifest.name}:key=${key}`);
+/** Lint raw extension-manifest keys without loading code or evaluating versions. */
+export function lintExtensionManifestSchema(manifest) {
+    const inspection = inspectExtensionManifestSchema(manifest);
+    const findings = inspection.unknownKeys.map((key) => ({
+        code: "manifest_unknown_key",
+        path: key,
+        ...(key === "compatibility"
+            ? { suggested_key: "pm_min_version" }
+            : {}),
+        message: key === "compatibility"
+            ? 'Manifest key "compatibility" is ignored; declare the canonical pm_min_version and optional pm_max_version fields instead.'
+            : `Manifest key "${key}" is not part of the extension manifest contract and will be ignored.`,
+    }));
     if (inspection.missingVersionBounds) {
-        warnings.push(`extension_manifest_no_version_bounds:${layer}:${manifest.name}:suggested=pm_min_version`);
+        findings.push({
+            code: "no_version_bounds_declared",
+            path: "$",
+            suggested_key: "pm_min_version",
+            message: "No canonical pm version bounds are declared; add pm_min_version so compatibility intent is explicit.",
+        });
     }
-    return warnings;
+    return { ok: findings.length === 0, findings };
+}
+/** Format runtime discovery warnings for unknown keys and absent canonical compatibility bounds. */
+export function formatExtensionManifestSchemaWarnings(layer, manifest, rawManifest) {
+    return lintExtensionManifestSchema(rawManifest).findings.map((finding) => finding.code === "manifest_unknown_key"
+        ? `extension_manifest_unknown_key:${layer}:${manifest.name}:key=${finding.path}${finding.suggested_key ? `:suggested=${finding.suggested_key}` : ""}`
+        : `extension_manifest_no_version_bounds:${layer}:${manifest.name}:suggested=pm_min_version`);
 }
 //# sourceMappingURL=manifest-schema.js.map
-//# debugId=7d9d8924-3186-5aab-ac36-164fb08624a8
+//# debugId=49cea84c-1d1b-523b-8c98-7ac16c69ae82

package/dist/core/governance/issue-codes.d.ts

@@ -21,6 +21,15 @@ export interface IssueCodeItem {
     parent?: string | null;
     /** The id of the canonical item this one was closed as a duplicate of, when set. A closed-as-duplicate item has already been adjudicated, so it is excluded from collision detection entirely (GH-278) — re-flagging a resolved duplicate is permanent noise that erodes trust in `validate`. */
     duplicate_of?: string | null;
+    /** Optional body evidence used to disambiguate mixed-case prose compounds. */
+    body?: string | null;
+}
+/** Explicit classifier inputs for repository-specific issue-code formats. */
+export interface IssueCodeDetectionOptions {
+    /** Prefixes configured by the repository, compared case-insensitively. */
+    configuredPrefixes?: readonly string[];
+    /** Item body used only for explicit code markers or backtick references. */
+    evidenceText?: string | null;
 }
 /** A logical issue code shared by two or more items. */
 export interface DuplicateIssueCode {
@@ -42,7 +51,7 @@ export interface DuplicateIssueCode {
  * Accepts unknown-ish input defensively (exported helper SDK consumers may call
  * from untyped JS): a non-string or empty title resolves to `null`.
  */
-export declare function extractIssueCode(title: string | null | undefined): string | null;
+export declare function extractIssueCode(title: string | null | undefined, options?: IssueCodeDetectionOptions): string | null;
 /**
  * Find logical issue codes used by 2+ items. Any item whose title begins with a
  * conventional issue code contributes; codes used by a single item are not
@@ -67,4 +76,4 @@ export declare function extractIssueCode(title: string | null | undefined): stri
  * given (id) is used; duplicate ids (should not occur for a valid corpus) are
  * de-duplicated so an item never inflates its own code's count.
  */
-export declare function findDuplicateIssueCodes(items: readonly IssueCodeItem[]): DuplicateIssueCode[];
+export declare function findDuplicateIssueCodes(items: readonly IssueCodeItem[], options?: Omit<IssueCodeDetectionOptions, "evidenceText">): DuplicateIssueCode[];

package/dist/core/governance/issue-codes.js

@@ -22,8 +22,8 @@
  * (digit immediately followed by a letter — no boundary) does not match.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="087bac58-e32d-5cb8-8fda-0e09075c3f35")}catch(e){}}();
-const ISSUE_CODE_PATTERN = /^([A-Z][A-Z0-9]*-\d+)\b/;
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8a7fbaf1-917f-5067-b9b6-a9f27c80e291")}catch(e){}}();
+const ISSUE_CODE_PATTERN = /^([A-Z][A-Z0-9]*-\d+)\b/iu;
 /**
  * Extract the leading logical issue code from a title, or `null` when the title
  * does not begin with one. The title is trimmed and upper-cased before matching
@@ -33,16 +33,32 @@ const ISSUE_CODE_PATTERN = /^([A-Z][A-Z0-9]*-\d+)\b/;
  * Accepts unknown-ish input defensively (exported helper SDK consumers may call
  * from untyped JS): a non-string or empty title resolves to `null`.
  */
-export function extractIssueCode(title) {
+export function extractIssueCode(title, options = {}) {
     if (typeof title !== "string") {
         return null;
     }
-    const normalized = title.trim().toUpperCase();
-    if (normalized.length === 0) {
+    const trimmed = title.trim();
+    if (trimmed.length === 0) {
         return null;
     }
-    const match = ISSUE_CODE_PATTERN.exec(normalized);
-    return match ? match[1] : null;
+    const match = ISSUE_CODE_PATTERN.exec(trimmed);
+    if (!match)
+        return null;
+    const rawCode = match[1];
+    const normalized = rawCode.toUpperCase();
+    const rawPrefix = rawCode.slice(0, rawCode.lastIndexOf("-"));
+    const configured = new Set((options.configuredPrefixes ?? []).map((prefix) => prefix.trim().replace(/-+$/u, "").toUpperCase()));
+    const remainder = trimmed.slice(rawCode.length);
+    const evidence = options.evidenceText?.toUpperCase() ?? "";
+    const hasExplicitBodyEvidence = evidence.includes(`ISSUE CODE: ${normalized}`) ||
+        evidence.includes(`ISSUE CODE \`${normalized}\``) ||
+        evidence.includes(`\`${normalized}\``) ||
+        evidence.includes(`[${normalized}]`);
+    const structurallyQualified = rawPrefix === rawPrefix.toUpperCase() ||
+        /^\s*(?::|—|–|\])/u.test(remainder) ||
+        configured.has(rawPrefix.toUpperCase()) ||
+        hasExplicitBodyEvidence;
+    return structurallyQualified ? normalized : null;
 }
 /** Test whether a value is a usable (non-empty after trim) item-id reference. */
 function isNonEmptyIdReference(value) {
@@ -72,7 +88,7 @@ function isNonEmptyIdReference(value) {
  * given (id) is used; duplicate ids (should not occur for a valid corpus) are
  * de-duplicated so an item never inflates its own code's count.
  */
-export function findDuplicateIssueCodes(items) {
+export function findDuplicateIssueCodes(items, options = {}) {
     const byCode = new Map();
     for (const item of items) {
         // A non-string title can never carry a code, so skip it before extraction;
@@ -84,7 +100,10 @@ export function findDuplicateIssueCodes(items) {
         if (isNonEmptyIdReference(item.duplicate_of)) {
             continue;
         }
-        const code = extractIssueCode(item.title);
+        const code = extractIssueCode(item.title, {
+            ...options,
+            evidenceText: item.body,
+        });
         if (code === null) {
             continue;
         }
@@ -130,4 +149,4 @@ export function findDuplicateIssueCodes(items) {
     return duplicates.sort((left, right) => left.code.localeCompare(right.code));
 }
 //# sourceMappingURL=issue-codes.js.map
-//# debugId=087bac58-e32d-5cb8-8fda-0e09075c3f35
+//# debugId=8a7fbaf1-917f-5067-b9b6-a9f27c80e291

package/dist/core/item/item-format.js

@@ -4,7 +4,7 @@
  * Defines item parsing, formatting, and lifecycle helpers for Item Format.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="65a90a42-eecb-57d3-9f78-3a5f1bc3abd3")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="051655a4-8ba7-5118-9758-d9ca377fa7e4")}catch(e){}}();
 import { encode as encodeToon } from "@toon-format/toon";
 import { isDeepStrictEqual } from "node:util";
 import { CONFIDENCE_TEXT_VALUES, ISSUE_SEVERITY_VALUES, PLAN_STEP_STATUS_VALUES, RECURRENCE_FREQUENCY_VALUES, RECURRENCE_WEEKDAY_VALUES, STATUS_VALUES, weekdayOrderIndex, } from "../../types/index.js";
@@ -422,7 +422,7 @@ function sortDependencies(values) {
         return undefined;
     return [...values]
         .map((value) => ({
-        id: value.id.trim().toLowerCase(),
+        id: value.id.trim(),
         kind: value.kind,
         created_at: value.created_at,
         author: value.author?.trim() || undefined,
@@ -1472,4 +1472,4 @@ export const _testOnlyItemFormat = {
     sortTests,
 };
 //# sourceMappingURL=item-format.js.map
-//# debugId=65a90a42-eecb-57d3-9f78-3a5f1bc3abd3
+//# debugId=051655a4-8ba7-5118-9758-d9ca377fa7e4

package/dist/core/store/item-store.js

@@ -4,7 +4,7 @@
  * Reads and writes tracker storage with format-aware helpers for Item Store.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f49b5141-f348-5954-a87e-8fd957593113")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bffd3114-3e85-58ae-90c7-eea5069cdb89")}catch(e){}}();
 import fs from "node:fs/promises";
 import path from "node:path";
 import { getActiveExtensionRegistrations, projectAfterCommandItemSnapshot, recordAfterCommandAffectedItem, runActiveOnReadHooks, runActiveBeforeMutationHooks, runActiveOnWriteHooks, runActiveServiceOverride, } from "../extensions/index.js";
@@ -63,11 +63,18 @@ function resolveItemFormatSearchOrder(preferredFormat) {
 }
 /** Implements locate item for the public runtime surface of this module. */
 export async function locateItem(pmRoot, rawId, idPrefix = "pm-", preferredFormat, typeToFolder = TYPE_TO_FOLDER) {
+    const trimmedRawId = rawId.trim();
+    const exactRawId = trimmedRawId.startsWith("#")
+        ? trimmedRawId.slice(1)
+        : trimmedRawId;
+    if (exactRawId.length === 0) {
+        return null;
+    }
     const normalizedId = normalizeItemId(rawId, idPrefix);
     const rawNormalizedId = normalizeRawItemId(rawId);
-    const candidateIds = normalizedId === rawNormalizedId
-        ? [normalizedId]
-        : [normalizedId, rawNormalizedId];
+    const candidateIds = [
+        ...new Set([exactRawId, normalizedId, rawNormalizedId]),
+    ].filter((candidateId) => candidateId.length > 0);
     const entries = Object.entries(typeToFolder);
     const searchOrder = resolveItemFormatSearchOrder(preferredFormat);
     for (const candidateId of candidateIds) {
@@ -642,4 +649,4 @@ export async function deleteItem(params) {
     }
 }
 //# sourceMappingURL=item-store.js.map
-//# debugId=f49b5141-f348-5954-a87e-8fd957593113
+//# debugId=bffd3114-3e85-58ae-90c7-eea5069cdb89

package/dist/mcp/http-server.d.ts

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+/**
+ * @module mcp/http-server
+ *
+ * Serves the pm MCP dispatcher through the sessionless 2026-07-28 Streamable
+ * HTTP POST binding with request-scoped JSON/SSE responses.
+ */
+import { type IncomingMessage, type Server, type ServerResponse } from "node:http";
+import { type PmMcpHttpAuthorizationPolicy, type PmMcpProtectedResourceMetadata } from "../sdk/mcp/authorization.js";
+import { type JsonRpcRequest } from "./server.js";
+/** Runtime options for one real Streamable HTTP server. */
+export interface PmMcpHttpServerOptions {
+    /** Local bind host. Defaults to the DNS-rebinding-safe loopback address. */
+    host?: string;
+    /** TCP port. Zero requests an ephemeral port. */
+    port?: number;
+    /** Single modern MCP POST endpoint. */
+    endpointPath?: string;
+    /** Exact browser origins permitted when an Origin header is present. */
+    allowedOrigins?: readonly string[];
+    /** Optional RFC 9728/OAuth resource-server policy. */
+    authorization?: PmMcpHttpAuthorizationPolicy;
+    /** Metadata served at RFC 9728 well-known paths. */
+    protectedResourceMetadata?: PmMcpProtectedResourceMetadata;
+    /** Maximum accepted JSON request bytes. */
+    maximumBodyBytes?: number;
+    /** SSE comment interval; zero disables keep-alives. */
+    keepAliveMs?: number;
+    /** Optional embedding dispatcher; defaults to the canonical pm MCP handler. */
+    requestHandler?: (request: JsonRpcRequest) => unknown | Promise<unknown>;
+}
+/** Write one SSE event and wait for transport backpressure to clear. */
+export declare function writePmMcpSseEvent(response: ServerResponse, payload: unknown): Promise<void>;
+declare function writeMcpHttpDispatchError(response: ServerResponse, rpcRequest: JsonRpcRequest | undefined, error: unknown): void;
+declare function destroyFailedMcpHttpResponse(response: ServerResponse, error: unknown): void;
+/** Create a configured HTTP server without binding it. */
+export declare function createPmMcpHttpServer(options?: PmMcpHttpServerOptions): Server<typeof IncomingMessage, typeof ServerResponse>;
+/** Gracefully close subscriptions before stopping a Streamable HTTP server. */
+export declare function closePmMcpHttpServer(server: Server): Promise<void>;
+/** Bind the configured Streamable HTTP server and return its actual address. */
+export declare function startPmMcpHttpServer(options?: PmMcpHttpServerOptions): Promise<ReturnType<typeof createPmMcpHttpServer>>;
+/** Resolve loopback-safe bind defaults without opening a socket. */
+export declare function resolvePmMcpHttpListenAddress(options?: Pick<PmMcpHttpServerOptions, "host" | "port">): {
+    host: string;
+    port: number;
+};
+/** Resolve and harden executable HTTP options from an environment map. */
+export declare function resolvePmMcpHttpServerOptionsFromEnvironment(processEnvironment?: NodeJS.ProcessEnv): PmMcpHttpServerOptions;
+/** Internal HTTP transport seams used only by direct integration tests. */
+export declare const _testOnly: {
+    /** Return the first active request-scoped transport key for one server. */
+    activeSubscriptionKey: (server: Server) => symbol | undefined;
+    /** Open a stream against one server runtime without a network socket. */
+    openHttpSubscription: (server: Server, request: JsonRpcRequest, response: ServerResponse) => Promise<void>;
+    /** Exercise committed-response handling without a network race. */
+    writeMcpHttpDispatchError: typeof writeMcpHttpDispatchError;
+    /** Exercise the terminal request rejection handler without a live socket. */
+    destroyFailedMcpHttpResponse: typeof destroyFailedMcpHttpResponse;
+};
+export {};