@unbrained/pm-cli 2026.8.26 → 2026.8.27

package/dist/sdk/mcp/skills.d.ts

@@ -0,0 +1,127 @@
+import { PM_MCP_PROTOCOL_VERSION, type PmMcpRequestContext } from "./protocol.js";
+/** Draft extension identifier proposed by SEP-2640. */
+export declare const PM_MCP_SKILLS_EXTENSION: "io.modelcontextprotocol/skills";
+/** Exact draft proposal revision implemented by pm. */
+export declare const PM_MCP_SKILLS_DRAFT_REVISION: "SEP-2640@a3e147ca2710f68214247aecc729731ee1ae8d03";
+/** Server-side draft capability advertised through discovery. */
+export declare const PM_MCP_SKILLS_SERVER_CAPABILITY: Readonly<{
+    revision: "SEP-2640@a3e147ca2710f68214247aecc729731ee1ae8d03";
+    status: "draft";
+    directoryRead: true;
+}>;
+/** Require exact draft negotiation for a skills method. */
+export declare function assertPmMcpSkillsCapability(context: PmMcpRequestContext, directoryRead?: boolean): void;
+/** Security and context limits applied independently to every skill origin. */
+export declare const PM_MCP_SKILL_LIMITS: Readonly<{
+    maxFilesPerSkill: 512;
+    maxFileBytes: number;
+    maxSkillBytes: number;
+    defaultPageSize: 20;
+    maxPageSize: 100;
+}>;
+/** Origin from which a skill was loaded. */
+export type PmMcpSkillOrigin = "package" | "workspace";
+/** One immutable file advertised by a skill. */
+export interface PmMcpSkillResource {
+    /** Addressable skill resource URI. */
+    uri: string;
+    /** SEP-2640 SHA-256 digest of the exact bytes returned by reads. */
+    digest: string;
+    /** Exact byte length. */
+    size: number;
+}
+/** Discoverable skill descriptor from the current SEP draft. */
+export interface PmMcpSkillDescriptor {
+    /** URI of the skill's mandatory SKILL.md. */
+    uri: string;
+    /** Parsed, verbatim frontmatter object. */
+    frontmatter: Record<string, unknown>;
+    /** Every bounded file in the skill directory. */
+    resources: PmMcpSkillResource[];
+    /** pm-specific compatibility and trust provenance. */
+    _meta: {
+        contractVersion: 1;
+        extensionRevision: typeof PM_MCP_SKILLS_DRAFT_REVISION;
+        origin: PmMcpSkillOrigin;
+        packageVersion: string;
+        protocolVersion: typeof PM_MCP_PROTOCOL_VERSION;
+        trust: "untrusted";
+        estimatedTokens: number;
+    };
+}
+/** Inputs for loading the canonical package skills plus repository overrides. */
+export interface LoadPmMcpSkillsOptions {
+    /** pm package root containing `.agents/skills`. */
+    packageRoot: string;
+    /** Workspace root whose `.agents/skills` override package skills by name. */
+    workspaceRoot?: string;
+    /** Exact package version included in compatibility metadata. */
+    packageVersion: string;
+}
+/** List request inputs with opaque cursor pagination. */
+export interface ListPmMcpSkillsOptions {
+    /** Opaque cursor returned by a previous page. */
+    cursor?: string;
+    /** Requested page size, bounded to 100. */
+    limit?: number;
+}
+/** One deterministic list page. */
+export interface ListPmMcpSkillsResult {
+    /** Skills in lexical URI order. */
+    skills: PmMcpSkillDescriptor[];
+    /** Opaque continuation cursor when more skills exist. */
+    nextCursor?: string;
+    /** Explicit completeness signal. */
+    hasMore: boolean;
+}
+/** Exact read result for one skill resource. */
+export interface ReadPmMcpSkillResourceResult {
+    /** Resource content returned as UTF-8 text or lossless Base64 bytes. */
+    contents: Array<{
+        uri: string;
+        mimeType: "text/markdown" | "text/plain";
+        text: string;
+        _meta: {
+            digest: string;
+            origin: PmMcpSkillOrigin;
+            trust: "untrusted";
+        };
+    } | {
+        uri: string;
+        mimeType: "application/octet-stream";
+        blob: string;
+        _meta: {
+            digest: string;
+            origin: PmMcpSkillOrigin;
+            trust: "untrusted";
+        };
+    }>;
+}
+/** Direct-child directory listing defined by the current SEP draft. */
+export interface ReadPmMcpSkillDirectoryResult {
+    /** Direct child file and directory resources in lexical URI order. */
+    resources: Array<{
+        uri: string;
+        name: string;
+        mimeType: "application/octet-stream" | "inode/directory" | "text/markdown" | "text/plain";
+    }>;
+    /** Opaque continuation cursor when more direct children exist. */
+    nextCursor?: string;
+    /** Explicit completeness signal for this directory page. */
+    hasMore: boolean;
+}
+/** Immutable in-memory registry for one request's package/workspace origins. */
+export declare class PmMcpSkillRegistry {
+    #private;
+    private constructor();
+    /** Load package skills and apply validated workspace overrides by name. */
+    static load(options: LoadPmMcpSkillsOptions): Promise<PmMcpSkillRegistry>;
+    /** List skills in deterministic pages without loading file bodies. */
+    list(options?: ListPmMcpSkillsOptions): ListPmMcpSkillsResult;
+    /** Get one skill descriptor by its SKILL.md URI. */
+    get(uri: string): PmMcpSkillDescriptor;
+    /** Read one digest-bound skill resource without following filesystem links. */
+    read(uri: string): ReadPmMcpSkillResourceResult;
+    /** List one directory's direct children with opaque cursor pagination. */
+    readDirectory(uri: string, options?: ListPmMcpSkillsOptions): ReadPmMcpSkillDirectoryResult;
+}

package/dist/sdk/mcp/skills.js

@@ -0,0 +1,390 @@
+/**
+ * @module sdk/mcp/skills
+ *
+ * Implements pm's draft Skills over MCP registry with bounded filesystem
+ * discovery, per-file digests, origin provenance, pagination, and fail-closed
+ * revision negotiation.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5f60bc89-c81b-57ee-a8f2-0d0b18d0af1b")}catch(e){}}();
+import { createHash } from "node:crypto";
+import { lstat, readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { parseDocument } from "yaml";
+import { isFileAbsentError } from "../../core/fs/fs-utils.js";
+import { PM_MCP_ERROR_CODES, PM_MCP_PROTOCOL_VERSION, PmMcpProtocolError, isMcpRecord, } from "./protocol.js";
+/** Draft extension identifier proposed by SEP-2640. */
+export const PM_MCP_SKILLS_EXTENSION = "io.modelcontextprotocol/skills";
+/** Exact draft proposal revision implemented by pm. */
+export const PM_MCP_SKILLS_DRAFT_REVISION = "SEP-2640@a3e147ca2710f68214247aecc729731ee1ae8d03";
+/** Server-side draft capability advertised through discovery. */
+export const PM_MCP_SKILLS_SERVER_CAPABILITY = Object.freeze({
+    revision: PM_MCP_SKILLS_DRAFT_REVISION,
+    status: "draft",
+    directoryRead: true,
+});
+/** Require exact draft negotiation for a skills method. */
+export function assertPmMcpSkillsCapability(context, directoryRead = false) {
+    const extensions = context.clientCapabilities.extensions;
+    const declaration = isMcpRecord(extensions)
+        ? extensions[PM_MCP_SKILLS_EXTENSION]
+        : undefined;
+    if (!isMcpRecord(declaration) ||
+        declaration.revision !== PM_MCP_SKILLS_DRAFT_REVISION ||
+        (directoryRead && declaration.directoryRead !== true)) {
+        throw new PmMcpProtocolError("Missing or incompatible Skills over MCP draft capability", PM_MCP_ERROR_CODES.missingRequiredClientCapability, {
+            requiredCapabilities: {
+                extensions: {
+                    [PM_MCP_SKILLS_EXTENSION]: PM_MCP_SKILLS_SERVER_CAPABILITY,
+                },
+            },
+        });
+    }
+}
+/** Security and context limits applied independently to every skill origin. */
+export const PM_MCP_SKILL_LIMITS = Object.freeze({
+    maxFilesPerSkill: 512,
+    maxFileBytes: 16 * 1024 * 1024,
+    maxSkillBytes: 16 * 1024 * 1024,
+    defaultPageSize: 20,
+    maxPageSize: 100,
+});
+const MAX_MCP_SKILLS_PER_ORIGIN = 100;
+const MAX_MCP_SKILL_ORIGIN_BYTES = 32 * 1024 * 1024;
+const SKILL_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+const SKILL_PAGE_SIZES = new Set(Array.from({ length: PM_MCP_SKILL_LIMITS.maxPageSize }, (_, index) => index + 1));
+function skillError(message, data) {
+    throw new PmMcpProtocolError(message, -32602, data);
+}
+function skillFileMimeType(name, bytes) {
+    try {
+        new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        return name.endsWith(".md") ? "text/markdown" : "text/plain";
+    }
+    catch {
+        return "application/octet-stream";
+    }
+}
+function parseSkillFrontmatter(content, source) {
+    const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/u.exec(content);
+    if (!match)
+        skillError(`Skill ${source} is missing YAML frontmatter.`);
+    const document = parseDocument(match[1], {
+        prettyErrors: false,
+        strict: true,
+        uniqueKeys: true,
+    });
+    if (document.errors.length > 0) {
+        skillError(`Skill ${source} has invalid YAML frontmatter.`, {
+            errors: document.errors.map((error) => error.message),
+        });
+    }
+    let value;
+    try {
+        value = document.toJS({ maxAliasCount: 0 });
+    }
+    catch (error) {
+        skillError(`Skill ${source} has unsupported YAML aliases.`, {
+            error: String(error),
+        });
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        skillError(`Skill ${source} frontmatter must be an object.`);
+    }
+    return value;
+}
+async function readBoundedSkillFile(filePath, relative, size, budget) {
+    if (size > PM_MCP_SKILL_LIMITS.maxFileBytes) {
+        skillError(`Skill resource exceeds the per-file limit: ${relative}.`);
+    }
+    budget.files += 1;
+    if (budget.files > PM_MCP_SKILL_LIMITS.maxFilesPerSkill) {
+        skillError(`Skill exceeds ${PM_MCP_SKILL_LIMITS.maxFilesPerSkill} files.`);
+    }
+    budget.skillBytes += size;
+    if (budget.skillBytes > PM_MCP_SKILL_LIMITS.maxSkillBytes) {
+        skillError(`Skill exceeds the aggregate byte limit: ${relative}.`);
+    }
+    budget.originBytes.value += size;
+    if (budget.originBytes.value > MAX_MCP_SKILL_ORIGIN_BYTES) {
+        skillError(`Skill origin exceeds the aggregate byte limit: ${relative}.`);
+    }
+    return readFile(filePath);
+}
+async function collectSkillFiles(root, relative, budget) {
+    const directory = path.join(root, relative);
+    const entries = await readdir(directory, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+        const childRelative = path.posix.join(relative.split(path.sep).join("/"), entry.name);
+        const childPath = path.join(root, ...childRelative.split("/"));
+        const stats = await lstat(childPath);
+        if (stats.isSymbolicLink()) {
+            skillError(`Skill resource must not be a symbolic link: ${childRelative}.`);
+        }
+        if (stats.isDirectory()) {
+            files.push(...(await collectSkillFiles(root, childRelative, budget)));
+        }
+        else if (stats.isFile()) {
+            files.push({
+                relative: childRelative,
+                bytes: await readBoundedSkillFile(childPath, childRelative, stats.size, budget),
+            });
+        }
+        else {
+            skillError(`Skill resource must be a regular file or directory: ${childRelative}.`);
+        }
+    }
+    return files;
+}
+async function loadSkillOrigin(skillsRoot, origin, packageVersion) {
+    const skills = new Map();
+    let entries;
+    try {
+        entries = await readdir(skillsRoot, { withFileTypes: true });
+    }
+    catch (error) {
+        if (isFileAbsentError(error)) {
+            return skills;
+        }
+        throw error;
+    }
+    const skillEntries = entries
+        .filter((entry) => entry.isDirectory() && SKILL_NAME_PATTERN.test(entry.name))
+        .sort((left, right) => left.name.localeCompare(right.name));
+    if (skillEntries.length > MAX_MCP_SKILLS_PER_ORIGIN) {
+        skillError(`Skill origin exceeds ${MAX_MCP_SKILLS_PER_ORIGIN} directories.`);
+    }
+    const originBytes = { value: 0 };
+    for (const entry of skillEntries) {
+        const files = await collectSkillFiles(path.join(skillsRoot, entry.name), "", {
+            files: 0,
+            skillBytes: 0,
+            originBytes,
+        });
+        const totalBytes = files.reduce((sum, file) => sum + file.bytes.byteLength, 0);
+        const main = files.find((file) => file.relative === "SKILL.md");
+        if (!main)
+            continue;
+        const frontmatter = parseSkillFrontmatter(main.bytes.toString("utf8"), entry.name);
+        if (frontmatter.name !== entry.name) {
+            skillError(`Skill directory ${entry.name} must match frontmatter name.`, {
+                actual: frontmatter.name ?? null,
+                expected: entry.name,
+            });
+        }
+        if (typeof frontmatter.description !== "string" ||
+            frontmatter.description.trim().length === 0) {
+            skillError(`Skill ${entry.name} requires a non-empty frontmatter description.`, {
+                required: ["description"],
+            });
+        }
+        const resources = files.map((file) => ({
+            uri: `skill://${entry.name}/${file.relative}`,
+            digest: `sha256:${createHash("sha256").update(file.bytes).digest("hex")}`,
+            size: file.bytes.byteLength,
+        }));
+        const fingerprint = createHash("sha256")
+            .update(resources
+            .map((resource) => `${resource.uri}:${resource.digest}`)
+            .join("\n"))
+            .digest("hex");
+        skills.set(entry.name, {
+            uri: `skill://${entry.name}/SKILL.md`,
+            frontmatter,
+            resources,
+            _meta: {
+                contractVersion: 1,
+                extensionRevision: PM_MCP_SKILLS_DRAFT_REVISION,
+                origin,
+                packageVersion,
+                protocolVersion: PM_MCP_PROTOCOL_VERSION,
+                trust: "untrusted",
+                estimatedTokens: Math.ceil(totalBytes / 4),
+            },
+            files: new Map(files.map((file) => [file.relative, file.bytes])),
+            fingerprint,
+        });
+    }
+    return skills;
+}
+function projectSkill(skill) {
+    const { files: _files, fingerprint: _fingerprint, ...descriptor } = skill;
+    return descriptor;
+}
+/** Immutable in-memory registry for one request's package/workspace origins. */
+export class PmMcpSkillRegistry {
+    #skills;
+    #fingerprint;
+    constructor(skills) {
+        this.#skills = skills;
+        this.#fingerprint = createHash("sha256")
+            .update([...skills.entries()]
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([name, skill]) => `${name}:${skill.fingerprint}`)
+            .join("\n"))
+            .digest("hex")
+            .slice(0, 16);
+    }
+    /** Decode one registry-bound cursor for a list or directory scope. */
+    #decodeCursor(cursor, scope) {
+        if (!cursor)
+            return 0;
+        try {
+            const parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+            if (typeof parsed !== "object" ||
+                parsed === null ||
+                !("fingerprint" in parsed) ||
+                parsed.fingerprint !== this.#fingerprint ||
+                !("scope" in parsed) ||
+                parsed.scope !== scope ||
+                !("offset" in parsed) ||
+                !Number.isInteger(parsed.offset) ||
+                Number(parsed.offset) < 0) {
+                skillError("Skill cursor is invalid or stale.");
+            }
+            return Number(parsed.offset);
+        }
+        catch (error) {
+            if (error instanceof PmMcpProtocolError)
+                throw error;
+            return skillError("Skill cursor is invalid or stale.");
+        }
+    }
+    /** Encode one registry-bound continuation cursor. */
+    #encodeCursor(offset, scope) {
+        return Buffer.from(JSON.stringify({ fingerprint: this.#fingerprint, offset, scope })).toString("base64url");
+    }
+    /** Load package skills and apply validated workspace overrides by name. */
+    static async load(options) {
+        const packaged = await loadSkillOrigin(path.join(options.packageRoot, ".agents", "skills"), "package", options.packageVersion);
+        if (options.workspaceRoot) {
+            const packageSkillsRoot = path.resolve(options.packageRoot, ".agents", "skills");
+            const workspaceSkillsRoot = path.resolve(options.workspaceRoot, ".agents", "skills");
+            if (workspaceSkillsRoot !== packageSkillsRoot) {
+                const overrides = await loadSkillOrigin(workspaceSkillsRoot, "workspace", options.packageVersion);
+                for (const [name, skill] of overrides)
+                    packaged.set(name, skill);
+            }
+        }
+        return new PmMcpSkillRegistry(packaged);
+    }
+    /** List skills in deterministic pages without loading file bodies. */
+    list(options = {}) {
+        const limit = options.limit ?? PM_MCP_SKILL_LIMITS.defaultPageSize;
+        if (!SKILL_PAGE_SIZES.has(limit)) {
+            skillError(`Skill list limit must be an integer from 1 to ${PM_MCP_SKILL_LIMITS.maxPageSize}.`);
+        }
+        const offset = this.#decodeCursor(options.cursor, "skills/list");
+        const ordered = [...this.#skills.values()].sort((left, right) => left.uri.localeCompare(right.uri));
+        const page = ordered.slice(offset, offset + limit);
+        const nextOffset = offset + page.length;
+        const hasMore = nextOffset < ordered.length;
+        return {
+            skills: page.map(projectSkill),
+            hasMore,
+            ...(hasMore
+                ? {
+                    nextCursor: this.#encodeCursor(nextOffset, "skills/list"),
+                }
+                : {}),
+        };
+    }
+    /** Get one skill descriptor by its SKILL.md URI. */
+    get(uri) {
+        const match = /^skill:\/\/([a-z0-9]+(?:-[a-z0-9]+)*)\/SKILL\.md$/u.exec(uri);
+        const skill = match ? this.#skills.get(match[1]) : undefined;
+        if (!skill)
+            skillError(`Unknown pm MCP skill: ${uri}.`, { field: "uri" });
+        return projectSkill(skill);
+    }
+    /** Read one digest-bound skill resource without following filesystem links. */
+    read(uri) {
+        const match = /^skill:\/\/([a-z0-9]+(?:-[a-z0-9]+)*)\/(.+)$/u.exec(uri);
+        const skill = match ? this.#skills.get(match[1]) : undefined;
+        const relative = match?.[2] ?? "";
+        const bytes = skill && relative ? skill.files.get(relative) : undefined;
+        const resource = skill?.resources.find((candidate) => candidate.uri === uri);
+        if (!skill || !bytes || !resource) {
+            skillError(`Unknown pm MCP skill resource: ${uri}.`, { field: "uri" });
+        }
+        const metadata = {
+            digest: resource.digest,
+            origin: skill._meta.origin,
+            trust: "untrusted",
+        };
+        const mimeType = skillFileMimeType(relative, bytes);
+        if (mimeType !== "application/octet-stream") {
+            return {
+                contents: [
+                    {
+                        uri,
+                        mimeType,
+                        text: bytes.toString("utf8"),
+                        _meta: metadata,
+                    },
+                ],
+            };
+        }
+        return {
+            contents: [
+                {
+                    uri,
+                    mimeType,
+                    blob: bytes.toString("base64"),
+                    _meta: metadata,
+                },
+            ],
+        };
+    }
+    /** List one directory's direct children with opaque cursor pagination. */
+    readDirectory(uri, options = {}) {
+        const match = /^skill:\/\/([a-z0-9]+(?:-[a-z0-9]+)*)(?:\/(.+))?$/u.exec(uri);
+        const skill = match ? this.#skills.get(match[1]) : undefined;
+        if (!skill)
+            skillError(`Unknown pm MCP skill directory: ${uri}.`, { field: "uri" });
+        const directory = (match?.[2] ?? "").replace(/\/$/u, "");
+        const prefix = directory.length > 0 ? `${directory}/` : "";
+        const base = `skill://${match[1]}`;
+        const children = new Map();
+        for (const resource of skill.resources) {
+            const relative = resource.uri.slice(`${base}/`.length);
+            if (!relative.startsWith(prefix))
+                continue;
+            const remainder = relative.slice(prefix.length);
+            const [name, ...descendants] = remainder.split("/");
+            const childUri = `${base}/${prefix}${name}`;
+            const childBytes = skill.files.get(`${prefix}${name}`);
+            children.set(name, {
+                uri: childUri,
+                name,
+                mimeType: descendants.length > 0
+                    ? "inode/directory"
+                    : skillFileMimeType(name, childBytes),
+            });
+        }
+        if (directory.length > 0 && children.size === 0) {
+            skillError(`Unknown pm MCP skill directory: ${uri}.`, { field: "uri" });
+        }
+        const limit = options.limit ?? PM_MCP_SKILL_LIMITS.maxPageSize;
+        if (!SKILL_PAGE_SIZES.has(limit)) {
+            skillError(`Skill directory limit must be an integer from 1 to ${PM_MCP_SKILL_LIMITS.maxPageSize}.`);
+        }
+        const offset = this.#decodeCursor(options.cursor, uri);
+        const ordered = [...children.values()].sort((left, right) => left.uri.localeCompare(right.uri));
+        const resources = ordered.slice(offset, offset + limit);
+        const nextOffset = offset + resources.length;
+        const hasMore = nextOffset < ordered.length;
+        return {
+            resources,
+            hasMore,
+            ...(hasMore
+                ? {
+                    nextCursor: this.#encodeCursor(nextOffset, uri),
+                }
+                : {}),
+        };
+    }
+}
+//# sourceMappingURL=skills.js.map
+//# debugId=5f60bc89-c81b-57ee-a8f2-0d0b18d0af1b

package/dist/sdk/read-output-contracts.js

@@ -5,7 +5,7 @@
  * surface without coupling package authors to command-specific option names.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d084da05-c967-58f1-afe4-069f09838e6f")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2103a4dc-3037-5768-b2c7-5964de4ac86b")}catch(e){}}();
 import { EXIT_CODE } from "../core/shared/constants.js";
 import { PmCliError } from "../core/shared/errors.js";
 import { compactReadOutputToBudget, estimateReadOutputTokens, resolveReadOutputRecoveryBudget, updateReadOutputReceiptEstimate, } from "./read-output-budget.js";
@@ -388,7 +388,20 @@ export function applyReadOutputIncludeModes(command, includeValue, commandOption
         modes.push(token);
         canonicalModes.add(token);
     }
-    if (modes.length > 0) {
+    const forwardedGetFieldSelectors = resolveReadOutputSurface(command) === "get"
+        ? selectors.filter((selector) => selector !== "item")
+        : [];
+    const forwardedGetFields = forwardedGetFieldSelectors.length > 0;
+    if (forwardedGetFields) {
+        commandOptions.fields = [
+            ...new Set([
+                ...(stringList(commandOptions.fields) ?? []),
+                ...forwardedGetFieldSelectors,
+            ]),
+        ].join(",");
+        canonicalModes.add("fields");
+    }
+    if (modes.length > 0 || forwardedGetFields) {
         optionsWithProvenance[READ_OUTPUT_INVOCATION_PROVENANCE] = {
             canonical_include_modes: [...canonicalModes],
             explicit_legacy_aliases: [...explicitLegacyAliases],
@@ -1210,4 +1223,4 @@ export function resolveReadOutputEncoding(command, options) {
         : undefined;
 }
 //# sourceMappingURL=read-output-contracts.js.map
-//# debugId=d084da05-c967-58f1-afe4-069f09838e6f
+//# debugId=2103a4dc-3037-5768-b2c7-5964de4ac86b

package/dist/sdk/runtime-action-aliases.js

@@ -4,8 +4,8 @@
  * Declares canonical native-action routes for public SDK aliases.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6f62939a-7b99-5687-93ae-834e0032f1d5")}catch(e){}}();
-import { PM_EXTENSION_PACKAGE_ACTION_SUBCOMMANDS } from "./cli-contracts/enum-contracts.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1ff4005f-be23-5dcf-9834-dbd7d083b76d")}catch(e){}}();
+import { PM_EXTENSION_PACKAGE_ACTION_SUBCOMMANDS, PM_PACKAGE_ONLY_ACTION_SUBCOMMANDS, } from "./cli-contracts/enum-contracts.js";
 const LIST_ACTION_ALIASES = {
     "list-all": { action: "list", options: { excludeTerminal: false } },
     "list-draft": {
@@ -51,6 +51,10 @@ export const SDK_ACTION_ALIASES = {
     ...LIST_ACTION_ALIASES,
     ...buildExtensionPackageActionAliases("extension"),
     ...buildExtensionPackageActionAliases("package"),
+    ...Object.fromEntries(PM_PACKAGE_ONLY_ACTION_SUBCOMMANDS.map((subcommand) => [
+        `package-${subcommand}`,
+        { action: subcommand },
+    ])),
 };
 //# sourceMappingURL=runtime-action-aliases.js.map
-//# debugId=6f62939a-7b99-5687-93ae-834e0032f1d5
+//# debugId=1ff4005f-be23-5dcf-9834-dbd7d083b76d

package/dist/sdk/runtime-input.js

@@ -5,7 +5,7 @@
  * primitives are shared by native action dispatchers and MCP-specific adapters.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2a1e986f-304d-50f6-a405-6afc221bdad5")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7949205a-ab1b-5457-961c-593498aff88b")}catch(e){}}();
 import { EXIT_CODE } from "../core/shared/constants.js";
 import { PmCliError } from "../core/shared/errors.js";
 import { asRecordClone } from "../core/shared/primitives.js";
@@ -202,6 +202,15 @@ const HOISTED_ACTION_OPTION_KEYS = {
     update: ["parent", "allowMissingParent", "completedAt"],
     copy: ["allowDuplicate"],
     close: ["duplicateOf", "completedAt"],
+    upgrade: [
+        "scope",
+        "dryRun",
+        "cliOnly",
+        "packagesOnly",
+        "repair",
+        "tag",
+        "packageName",
+    ],
     // pm-7u9j: the narrow pm_append tool declares `body` top-level; runAppend
     // reads it from options, while schema/config consume their top-level values
     // directly in runAction and therefore need no hoisting.
@@ -232,8 +241,7 @@ export function normalizeMcpOptionsArrays(options, action = "") {
             result[key] = value;
             continue;
         }
-        if (typeof value === "string" &&
-            scalarToArrayFields.has(key)) {
+        if (typeof value === "string" && scalarToArrayFields.has(key)) {
             result[key] = [value];
             continue;
         }
@@ -578,4 +586,4 @@ export function updateManyOptionsFromFlat(options) {
     };
 }
 //# sourceMappingURL=runtime-input.js.map
-//# debugId=2a1e986f-304d-50f6-a405-6afc221bdad5
+//# debugId=7949205a-ab1b-5457-961c-593498aff88b

package/dist/sdk/runtime-primitives.d.ts

@@ -75,7 +75,7 @@ export { migrateItemFilesToFormat } from "../core/store/item-format-migration.js
 export { type CachedDocumentCandidate, listAllDocumentCandidatesCached, } from "../core/store/item-metadata-cache.js";
 export { buildItemNotFoundError, createMutationGuardSdk, deleteItem, listAllItemMetadata, listAllItemMetadataLight, locateItem, mutateItem, mutateItemWithHistoryContext, readLocatedItem, } from "../core/store/item-store.js";
 export { isTerminalPlanMode, shouldCompletePlanOnClose, } from "../core/item/plan-lifecycle.js";
-export { getHistoryPath, getItemPath, getSettingsPath, resolveImplicitPmRoot, resolvePmRoot, } from "../core/store/paths.js";
+export { getHistoryPath, getItemPath, getSettingsPath, resolveImplicitPmRoot, resolvePmRoot, resolveWorkspaceRoot, } from "../core/store/paths.js";
 export { persistSelectedItemFormat, readSettings, readSettingsWithMetadata, writeSettings, } from "../core/store/settings.js";
 export { maybeRunFirstUseTelemetryPrompt } from "../core/telemetry/consent.js";
 export { type TelemetryCommandResolution, type TelemetryResolutionStage, deriveTelemetryCommandResolution, } from "../core/telemetry/observability.js";

package/dist/sdk/runtime-primitives.js

@@ -7,7 +7,7 @@
  * prefer the typed operations exported by the main SDK barrel.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4be36c51-a9fc-507d-8f13-d764b5668ab9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d45775e5-6826-521b-80b3-429ed22947d9")}catch(e){}}();
 export { createCheckpointId, loadMutationCheckpoint, restoreCheckpointItems, writeMutationCheckpoint, } from "../core/checkpoint/mutation-checkpoint.js";
 export { flattenFlagListValue, resolveFlagValueKind, } from "../core/extensions/flag-value-types.js";
 export { createUnknownSubcommandError, } from "./agent/subcommand-recovery.js";
@@ -76,10 +76,10 @@ export { migrateItemFilesToFormat } from "../core/store/item-format-migration.js
 export { listAllDocumentCandidatesCached, } from "../core/store/item-metadata-cache.js";
 export { buildItemNotFoundError, createMutationGuardSdk, deleteItem, listAllItemMetadata, listAllItemMetadataLight, locateItem, mutateItem, mutateItemWithHistoryContext, readLocatedItem, } from "../core/store/item-store.js";
 export { isTerminalPlanMode, shouldCompletePlanOnClose, } from "../core/item/plan-lifecycle.js";
-export { getHistoryPath, getItemPath, getSettingsPath, resolveImplicitPmRoot, resolvePmRoot, } from "../core/store/paths.js";
+export { getHistoryPath, getItemPath, getSettingsPath, resolveImplicitPmRoot, resolvePmRoot, resolveWorkspaceRoot, } from "../core/store/paths.js";
 export { persistSelectedItemFormat, readSettings, readSettingsWithMetadata, writeSettings, } from "../core/store/settings.js";
 export { maybeRunFirstUseTelemetryPrompt } from "../core/telemetry/consent.js";
 export { deriveTelemetryCommandResolution, } from "../core/telemetry/observability.js";
 export { emitTelemetryErrorEvent, finishTelemetryCommand, startTelemetryCommand, } from "../core/telemetry/runtime.js";
 //# sourceMappingURL=runtime-primitives.js.map
-//# debugId=4be36c51-a9fc-507d-8f13-d764b5668ab9
+//# debugId=d45775e5-6826-521b-80b3-429ed22947d9