@unbrained/pm-cli 2026.9.7 → 2026.9.9

package/dist/core/validate/missing-link-owners.js

@@ -1,96 +1,2 @@
-/**
- * Owner attribution for stale linked paths reported by `pm validate --check-files`.
- *
- * The files check collects, per item, the linked paths (from the item's `files`
- * and `docs` link lists) that no longer resolve on disk. By default those are
- * surfaced as bare path strings + `path:classification` rows, which forces a
- * reverse lookup to discover which item owns each stale link. This module turns
- * the already-collected stale-link rows into owner-attributed, path-grouped rows
- * so an agent can perform evidence-based cleanup (relink/prune) without that
- * reverse lookup.
- *
- * Pure module (GH-210): no filesystem access and no heavy imports — callers pass
- * the already-collected stale-link rows plus a metadata `lookup` closure.
- */
-/** `malformed` wins over other classifications to prevent unsafe automatic repair. Otherwise `moved` wins over `deleted` when a single path's rows disagree on classification: `moved` means a relink candidate exists, which is the safer, more-actionable signal (relink instead of risk pruning a still-reachable link). In practice all rows for one path share a classification; this is a deterministic tie-break for the degenerate case. */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1a4f19cf-56ba-571a-908c-97278a8284f7")}catch(e){}}();
-function preferClassification(current, next) {
-    if (current === "malformed" || next === "malformed")
-        return "malformed";
-    return current === "moved" || next === "moved" ? "moved" : "deleted";
-}
-function ownerKey(input) {
-    return `${input.item_id} ${input.link_kind}`;
-}
-/**
- * Group stale-link owner inputs by linked path and attach owning-item metadata.
- *
- * - Paths sorted ascending (`localeCompare`); items within a path sorted by `id`
- *   then `field`.
- * - De-duplicates identical `(id, field)` owners for the same path.
- * - `classification` per path follows {@link preferClassification} (moved wins).
- * - Missing metadata falls back: type `"Unknown"`, title `""`, status `""`.
- */
-export function buildMissingLinkedPathRows(rows, lookup) {
-    const buckets = new Map();
-    for (const row of rows) {
-        const bucket = buckets.get(row.path);
-        if (bucket) {
-            bucket.classification = preferClassification(bucket.classification, row.classification);
-            bucket.owners.set(ownerKey(row), row);
-        }
-        else {
-            buckets.set(row.path, {
-                classification: row.classification,
-                owners: new Map([[ownerKey(row), row]]),
-            });
-        }
-    }
-    return [...buckets.entries()]
-        .sort(([left], [right]) => left.localeCompare(right))
-        .map(([path, bucket]) => ({
-        path,
-        classification: bucket.classification,
-        items: [...bucket.owners.values()]
-            .map((owner) => {
-            const metadata = lookup(owner.item_id);
-            return {
-                id: owner.item_id,
-                type: metadata?.type ?? "Unknown",
-                title: metadata?.title ?? "",
-                status: metadata?.status ?? "",
-                field: owner.link_kind,
-            };
-        })
-            .sort((leftOwner, rightOwner) => {
-            const byId = leftOwner.id.localeCompare(rightOwner.id);
-            return byId !== 0
-                ? byId
-                : leftOwner.field.localeCompare(rightOwner.field);
-        }),
-    }));
-}
-function escapeTitle(title) {
-    return title.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-}
-/**
- * Token-efficient one-line-per-owner serialization for the files-check details
- * (compact text counterpart to the full {@link MissingLinkedPathRow} objects).
- * Format per owner row:
- *   `<path>:<classification> owner=<id> status=<status> field=<field> title="<title>"`
- * Title is double-quoted with backslash/quote escaping; empty status/title still
- * render (`status=` and `title=""`). Order follows
- * {@link buildMissingLinkedPathRows} output order.
- */
-export function summarizeMissingLinkedPathRows(rows) {
-    const lines = [];
-    for (const row of rows) {
-        for (const owner of row.items) {
-            lines.push(`${row.path}:${row.classification} owner=${owner.id} status=${owner.status} field=${owner.field} title="${escapeTitle(owner.title)}"`);
-        }
-    }
-    return lines;
-}
+!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e2cd8850-491a-505c-8709-3dcdb758de75")}catch(e2){}})();function preferClassification(current,next){if(current==="malformed"||next==="malformed")return"malformed";return current==="moved"||next==="moved"?"moved":"deleted"}function ownerKey(input){return`${input.item_id} ${input.link_kind}`}function buildMissingLinkedPathRows(rows,lookup){const buckets=new Map;for(const row of rows){const bucket=buckets.get(row.path);if(bucket){bucket.classification=preferClassification(bucket.classification,row.classification);bucket.owners.set(ownerKey(row),row)}else{buckets.set(row.path,{classification:row.classification,owners:new Map([[ownerKey(row),row]])})}}return[...buckets.entries()].sort(([left],[right])=>left.localeCompare(right)).map(([path,bucket])=>({path,classification:bucket.classification,items:[...bucket.owners.values()].map(owner=>{const metadata=lookup(owner.item_id);return{id:owner.item_id,type:metadata?.type??"Unknown",title:metadata?.title??"",status:metadata?.status??"",field:owner.link_kind}}).sort((leftOwner,rightOwner)=>{const byId=leftOwner.id.localeCompare(rightOwner.id);return byId!==0?byId:leftOwner.field.localeCompare(rightOwner.field)})}))}function escapeTitle(title){return title.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}function summarizeMissingLinkedPathRows(rows){const lines=[];for(const row of rows){for(const owner of row.items){lines.push(`${row.path}:${row.classification} owner=${owner.id} status=${owner.status} field=${owner.field} title="${escapeTitle(owner.title)}"`)}}return lines}export{buildMissingLinkedPathRows,summarizeMissingLinkedPathRows};
 //# sourceMappingURL=missing-link-owners.js.map
-//# debugId=1a4f19cf-56ba-571a-908c-97278a8284f7

package/dist/core/validate/stale-file-classification.js

@@ -1,83 +1,2 @@
-/**
- * Classification of stale linked paths reported by `pm validate --check-files`.
- *
- * A linked file path that no longer exists is either:
- * - `moved`: a file with the same basename still exists elsewhere in the
- *   scanned candidate set — the candidates are reported so an agent can relink
- *   the item to the new location instead of dropping the link, or
- * - `deleted`: no candidate with that basename exists anywhere in the scan,
- *   making it eligible for an explicitly requested prune, or
- * - `malformed`: an ambiguous missing CSV or path:note literal which must be
- *   reviewed before any relocation or removal is inferred.
- *
- * Pure module (pm-0v2m / GH-184): no filesystem access — callers pass the
- * already-collected candidate file list from the files check scan.
- */
-/** Fallback stale path candidate limit used when callers do not provide an override. */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="eb4fe9bd-31b5-5ed3-b401-3e3776ec12e9")}catch(e){}}();
-export const DEFAULT_STALE_PATH_CANDIDATE_LIMIT = 3;
-/** Extract a basename from either portable separator convention. */
-function basenameOf(relativePath) {
-    const lastSlash = Math.max(relativePath.lastIndexOf("/"), relativePath.lastIndexOf("\\"));
-    return lastSlash === -1 ? relativePath : relativePath.slice(lastSlash + 1);
-}
-/** Classify each stale (missing) linked path as `moved`, `deleted`, or `malformed` by matching its basename against the candidate file list. Output preserves the input order of `stalePaths` (callers pass an already-sorted unique list). A candidate equal to the stale path itself never matches (the path is known missing; an identical candidate would be self-referential noise). */
-export function classifyStaleLinkedPaths(stalePaths, candidateFiles, candidateLimit = DEFAULT_STALE_PATH_CANDIDATE_LIMIT) {
-    const limit = Number.isFinite(candidateLimit) && candidateLimit >= 1
-        ? Math.floor(candidateLimit)
-        : DEFAULT_STALE_PATH_CANDIDATE_LIMIT;
-    const candidatesByBasename = new Map();
-    for (const candidate of candidateFiles) {
-        const basename = basenameOf(candidate);
-        if (basename.length === 0) {
-            continue;
-        }
-        const bucket = candidatesByBasename.get(basename);
-        if (bucket) {
-            bucket.push(candidate);
-        }
-        else {
-            candidatesByBasename.set(basename, [candidate]);
-        }
-    }
-    return stalePaths.map((stalePath) => {
-        // Historical CSV and path:note input must not become a confident basename
-        // relocation. Existing files are checked before classification; this only
-        // rejects ambiguous missing references, never an existing literal filename.
-        if (stalePath.includes(",") ||
-            stalePath.replace(/^[a-z]:[\\/]/i, "").includes(":")) {
-            return {
-                path: stalePath,
-                classification: "malformed",
-                candidates: [],
-                candidates_truncated: false,
-            };
-        }
-        const matches = (candidatesByBasename.get(basenameOf(stalePath)) ?? [])
-            .filter((candidate) => candidate !== stalePath)
-            .sort((left, right) => left.localeCompare(right));
-        if (matches.length === 0) {
-            return {
-                path: stalePath,
-                classification: "deleted",
-                candidates: [],
-                candidates_truncated: false,
-            };
-        }
-        return {
-            path: stalePath,
-            classification: "moved",
-            candidates: matches.slice(0, limit),
-            candidates_truncated: matches.length > limit,
-        };
-    });
-}
-/** Render compact `<path>:moved:<top-candidate>` / `<path>:deleted` rows for the files check details (token-efficient counterpart to the full classification objects). */
-export function summarizeStaleLinkedPathClassifications(classified) {
-    return classified.map((entry) => entry.classification === "moved"
-        ? `${entry.path}:moved:${entry.candidates[0]}`
-        : `${entry.path}:${entry.classification}`);
-}
+!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ede22770-cb10-5054-85a7-89bb2758c25f")}catch(e2){}})();const DEFAULT_STALE_PATH_CANDIDATE_LIMIT=3;function basenameOf(relativePath){const lastSlash=Math.max(relativePath.lastIndexOf("/"),relativePath.lastIndexOf("\\"));return lastSlash===-1?relativePath:relativePath.slice(lastSlash+1)}function classifyStaleLinkedPaths(stalePaths,candidateFiles,candidateLimit=DEFAULT_STALE_PATH_CANDIDATE_LIMIT){const limit=Number.isFinite(candidateLimit)&&candidateLimit>=1?Math.floor(candidateLimit):DEFAULT_STALE_PATH_CANDIDATE_LIMIT;const candidatesByBasename=new Map;for(const candidate of candidateFiles){const basename=basenameOf(candidate);if(basename.length===0){continue}const bucket=candidatesByBasename.get(basename);if(bucket){bucket.push(candidate)}else{candidatesByBasename.set(basename,[candidate])}}return stalePaths.map(stalePath=>{if(stalePath.includes(",")||stalePath.replace(/^[a-z]:[\\/]/i,"").includes(":")){return{path:stalePath,classification:"malformed",candidates:[],candidates_truncated:false}}const matches=(candidatesByBasename.get(basenameOf(stalePath))??[]).filter(candidate=>candidate!==stalePath).sort((left,right)=>left.localeCompare(right));if(matches.length===0){return{path:stalePath,classification:"deleted",candidates:[],candidates_truncated:false}}return{path:stalePath,classification:"moved",candidates:matches.slice(0,limit),candidates_truncated:matches.length>limit}})}function summarizeStaleLinkedPathClassifications(classified){return classified.map(entry=>entry.classification==="moved"?`${entry.path}:moved:${entry.candidates[0]}`:`${entry.path}:${entry.classification}`)}export{DEFAULT_STALE_PATH_CANDIDATE_LIMIT,classifyStaleLinkedPaths,summarizeStaleLinkedPathClassifications};
 //# sourceMappingURL=stale-file-classification.js.map
-//# debugId=eb4fe9bd-31b5-5ed3-b401-3e3776ec12e9

package/dist/mcp/http-server.js

@@ -1,451 +1,8 @@
 #!/usr/bin/env node
-/**
- * @module mcp/http-server
- *
- * Serves the pm MCP dispatcher through the sessionless 2026-07-28 Streamable
- * HTTP POST binding with request-scoped JSON/SSE responses.
- */
+!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ad8ab3b3-7b07-565a-be09-2d1c2ba6133d")}catch(e2){}})();import{createServer}from"node:http";import{PM_MCP_ERROR_CODES,PmMcpProtocolError}from"../sdk/mcp/protocol.js";import{PmMcpAuthorizationError,authorizeMcpHttpRequest,buildMcpProtectedResourceMetadata,createMcpStaticBearerVerifier}from"../sdk/mcp/authorization.js";import{validateMcpHttpRequestHeaders}from"../sdk/mcp/transport.js";import{buildMcpToolCallErrorResult,closeMcpSubscription,handleRequest,isInvokedAsMcpMainModule,openMcpSubscription,resolveMcpToolSchemaForRequest}from"./server.js";const DEFAULT_MAXIMUM_BODY_BYTES=1024*1024;const DEFAULT_KEEP_ALIVE_MS=15e3;const PM_MCP_HTTP_RUNTIMES=new WeakMap;function writePmMcpSseEvent(response,payload){return new Promise((resolve,reject)=>{let settled=false;const cleanup=()=>{response.off("drain",onDrain);response.off("close",onClose)};const onDrain=()=>{settled=true;cleanup();resolve()};const onClose=()=>{settled=true;cleanup();reject(new Error("MCP response stream closed during backpressure"))};response.once("drain",onDrain);response.once("close",onClose);try{if(response.write(`data: ${JSON.stringify(payload)}
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7c5d2b34-e2ab-52a9-80a9-c5a28ce09dc7")}catch(e){}}();
-import { createServer, } from "node:http";
-import { PM_MCP_ERROR_CODES, PmMcpProtocolError } from "../sdk/mcp/protocol.js";
-import { PmMcpAuthorizationError, authorizeMcpHttpRequest, buildMcpProtectedResourceMetadata, createMcpStaticBearerVerifier, } from "../sdk/mcp/authorization.js";
-import { validateMcpHttpRequestHeaders } from "../sdk/mcp/transport.js";
-import { buildMcpToolCallErrorResult, closeMcpSubscription, handleRequest, isInvokedAsMcpMainModule, openMcpSubscription, resolveMcpToolSchemaForRequest, } from "./server.js";
-const DEFAULT_MAXIMUM_BODY_BYTES = 1024 * 1024;
-const DEFAULT_KEEP_ALIVE_MS = 15_000;
-const PM_MCP_HTTP_RUNTIMES = new WeakMap();
-/** Write one SSE event and wait for transport backpressure to clear. */
-export function writePmMcpSseEvent(response, payload) {
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        const cleanup = () => {
-            response.off("drain", onDrain);
-            response.off("close", onClose);
-        };
-        const onDrain = () => {
-            settled = true;
-            cleanup();
-            resolve();
-        };
-        const onClose = () => {
-            settled = true;
-            cleanup();
-            reject(new Error("MCP response stream closed during backpressure"));
-        };
-        response.once("drain", onDrain);
-        response.once("close", onClose);
-        try {
-            if (response.write(`data: ${JSON.stringify(payload)}\n\n`) && !settled) {
-                settled = true;
-                cleanup();
-                resolve();
-            }
-        }
-        catch (error) {
-            cleanup();
-            reject(error);
-        }
-    });
-}
-function writeJson(response, status, payload, headers = {}) {
-    response.writeHead(status, {
-        "Cache-Control": "no-store",
-        "Content-Type": "application/json",
-        ...headers,
-    });
-    response.end(`${JSON.stringify(payload)}\n`);
-}
-function writeJsonRpcError(response, id, error) {
-    const authorizationError = error instanceof PmMcpAuthorizationError ? error : undefined;
-    const protocolError = error instanceof PmMcpProtocolError ? error : undefined;
-    const code = protocolError?.code ?? -32603;
-    const clientErrorCodes = new Set([
-        -32700,
-        -32600,
-        PM_MCP_ERROR_CODES.headerMismatch,
-        PM_MCP_ERROR_CODES.unsupportedProtocolVersion,
-        PM_MCP_ERROR_CODES.invalidParams,
-    ]);
-    const status = authorizationError?.httpStatus ??
-        (code === -32601 ? 404 : clientErrorCodes.has(code) ? 400 : 500);
-    writeJson(response, status, {
-        jsonrpc: "2.0",
-        id: id ?? null,
-        error: {
-            code,
-            message: error instanceof Error ? error.message : "Internal MCP error",
-            ...(protocolError ? { data: protocolError.data } : {}),
-        },
-    }, authorizationError?.challenge
-        ? { "WWW-Authenticate": authorizationError.challenge }
-        : {});
-}
-function finishCommittedMcpResponse(response) {
-    if (!response.headersSent && !response.writableEnded && !response.destroyed) {
-        return false;
-    }
-    if (!response.writableEnded && !response.destroyed)
-        response.end();
-    return true;
-}
-function writeMcpHttpDispatchError(response, rpcRequest, error) {
-    if (finishCommittedMcpResponse(response))
-        return;
-    const toolError = rpcRequest
-        ? buildMcpToolCallErrorResult(rpcRequest, error)
-        : undefined;
-    if (toolError && rpcRequest) {
-        writeJson(response, 200, {
-            jsonrpc: "2.0",
-            id: rpcRequest.id ?? null,
-            result: toolError,
-        });
-        return;
-    }
-    writeJsonRpcError(response, rpcRequest?.id, error);
-}
-function destroyFailedMcpHttpResponse(response, error) {
-    response.destroy(new Error("Unhandled MCP HTTP request failure", { cause: error }));
-}
-async function readRequestBody(request, maximumBytes) {
-    const chunks = [];
-    let observed = 0;
-    for await (const chunk of request) {
-        const buffer = Buffer.from(chunk);
-        observed += buffer.length;
-        if (observed > maximumBytes) {
-            throw new PmMcpProtocolError("MCP HTTP request body exceeds the configured limit", PM_MCP_ERROR_CODES.invalidParams, { maximumBytes });
-        }
-        chunks.push(buffer);
-    }
-    return Buffer.concat(chunks).toString("utf8");
-}
-function parseJsonRpcRequest(source) {
-    let value;
-    try {
-        value = JSON.parse(source);
-    }
-    catch {
-        throw new PmMcpProtocolError("Invalid JSON-RPC request body", -32700);
-    }
-    if (typeof value !== "object" ||
-        value === null ||
-        Array.isArray(value) ||
-        ("jsonrpc" in value && value.jsonrpc !== "2.0") ||
-        ("method" in value && typeof value.method !== "string")) {
-        throw new PmMcpProtocolError("Invalid JSON-RPC request", -32600);
-    }
-    return value;
-}
-function protectedResourcePaths(endpointPath) {
-    return new Set([
-        "/.well-known/oauth-protected-resource",
-        `/.well-known/oauth-protected-resource${endpointPath}`,
-    ]);
-}
-function routeMcpHttpBoundary(request, response, requestUrl, runtime) {
-    if (runtime.options.protectedResourceMetadata &&
-        request.method === "GET" &&
-        protectedResourcePaths(runtime.endpointPath).has(requestUrl.pathname)) {
-        writeJson(response, 200, { ...runtime.options.protectedResourceMetadata });
-        return true;
-    }
-    if (requestUrl.pathname !== runtime.endpointPath) {
-        writeJson(response, 404, { error: "Not found" });
-        return true;
-    }
-    if (request.method !== "POST") {
-        response.setHeader("Allow", "POST");
-        writeJson(response, 405, { error: "Method not allowed" });
-        return true;
-    }
-    const origin = request.headers.origin;
-    if (origin !== undefined && !runtime.allowedOrigins.has(origin)) {
-        writeJson(response, 403, { error: "Origin is not allowed" });
-        return true;
-    }
-    const accept = request.headers.accept;
-    const contentType = request.headers["content-type"];
-    if (typeof accept !== "string" ||
-        !accept.includes("application/json") ||
-        !accept.includes("text/event-stream") ||
-        typeof contentType !== "string" ||
-        !contentType.startsWith("application/json")) {
-        writeJson(response, 406, {
-            error: "MCP requires JSON and SSE content negotiation",
-        });
-        return true;
-    }
-    return false;
-}
-async function openHttpSubscription(input) {
-    if (typeof input.request.id !== "string" &&
-        typeof input.request.id !== "number") {
-        throw new PmMcpProtocolError("subscriptions/listen requires a JSON-RPC id", PM_MCP_ERROR_CODES.invalidParams);
-    }
-    const subscriptionId = input.request.id;
-    const subscriptionKey = Symbol("pm-mcp-http-subscription");
-    const active = {
-        id: subscriptionId,
-        key: subscriptionKey,
-        response: input.response,
-    };
-    let disconnected = input.response.destroyed || input.response.writableEnded;
-    let subscriptionOpened = false;
-    const closeActiveSubscription = () => {
-        disconnected = true;
-        if (active.timer)
-            clearInterval(active.timer);
-        input.runtime.activeSubscriptions.delete(subscriptionKey);
-        if (subscriptionOpened) {
-            closeMcpSubscription(subscriptionId, subscriptionKey);
-        }
-    };
-    input.response.once("close", closeActiveSubscription);
-    let responseStarted = false;
-    try {
-        await openMcpSubscription({
-            request: input.request,
-            key: subscriptionKey,
-            sink: (notification) => {
-                if (input.response.destroyed || input.response.writableEnded) {
-                    throw new Error("MCP response stream closed before acknowledgment");
-                }
-                if (!responseStarted) {
-                    responseStarted = true;
-                    input.response.setHeader("Cache-Control", "no-cache, no-store");
-                    input.response.setHeader("Connection", "keep-alive");
-                    input.response.setHeader("Content-Type", "text/event-stream");
-                    input.response.setHeader("X-Accel-Buffering", "no");
-                }
-                return writePmMcpSseEvent(input.response, notification);
-            },
-        });
-        subscriptionOpened = true;
-    }
-    catch (error) {
-        input.response.off("close", closeActiveSubscription);
-        throw error;
-    }
-    if (disconnected ||
-        input.response.destroyed ||
-        input.response.writableEnded) {
-        closeActiveSubscription();
-        return;
-    }
-    if (input.runtime.keepAliveMs > 0) {
-        active.timer = setInterval(() => input.response.write(":\r\n\r\n"), input.runtime.keepAliveMs);
-        active.timer.unref();
-    }
-    input.runtime.activeSubscriptions.set(subscriptionKey, active);
-}
-async function dispatchMcpHttpRpc(input) {
-    let rpcRequest;
-    try {
-        if (input.runtime.options.authorization) {
-            await authorizeMcpHttpRequest({
-                headers: input.request.headers,
-                requestUrl: input.requestUrl.href,
-                policy: input.runtime.options.authorization,
-            });
-        }
-        rpcRequest = parseJsonRpcRequest(await readRequestBody(input.request, input.runtime.maximumBodyBytes));
-        validateMcpHttpRequestHeaders({
-            headers: input.request.headers,
-            request: rpcRequest,
-            toolSchema: await resolveMcpToolSchemaForRequest(rpcRequest),
-        });
-        if (rpcRequest.method === "subscriptions/listen") {
-            await openHttpSubscription({
-                request: rpcRequest,
-                response: input.response,
-                runtime: input.runtime,
-            });
-            return;
-        }
-        const result = await (input.runtime.options.requestHandler ?? handleRequest)(rpcRequest);
-        if (!Object.prototype.hasOwnProperty.call(rpcRequest, "id")) {
-            input.response.writeHead(202);
-            input.response.end();
-            return;
-        }
-        writeJson(input.response, 200, {
-            jsonrpc: "2.0",
-            id: rpcRequest.id ?? null,
-            result: result ?? {},
-        });
-    }
-    catch (error) {
-        writeMcpHttpDispatchError(input.response, rpcRequest, error);
-    }
-}
-async function handleMcpHttpRequest(request, response, runtime) {
-    const requestUrl = new URL(request.url, "http://localhost");
-    if (routeMcpHttpBoundary(request, response, requestUrl, runtime))
-        return;
-    await dispatchMcpHttpRpc({ request, response, requestUrl, runtime });
-}
-/** Create a configured HTTP server without binding it. */
-export function createPmMcpHttpServer(options = {}) {
-    const runtime = {
-        activeSubscriptions: new Map(),
-        allowedOrigins: new Set(options.allowedOrigins ?? []),
-        endpointPath: options.endpointPath ?? "/mcp",
-        keepAliveMs: options.keepAliveMs ?? DEFAULT_KEEP_ALIVE_MS,
-        maximumBodyBytes: options.maximumBodyBytes ?? DEFAULT_MAXIMUM_BODY_BYTES,
-        options,
-    };
-    const server = createServer((request, response) => {
-        void handleMcpHttpRequest(request, response, runtime).catch(destroyFailedMcpHttpResponse.bind(undefined, response));
-    });
-    PM_MCP_HTTP_RUNTIMES.set(server, runtime);
-    server.on("close", () => {
-        closeActiveHttpSubscriptions(runtime);
-        PM_MCP_HTTP_RUNTIMES.delete(server);
-    });
-    return server;
-}
-function closeActiveHttpSubscriptions(runtime) {
-    for (const [key, active] of runtime.activeSubscriptions) {
-        if (active.timer)
-            clearInterval(active.timer);
-        const result = closeMcpSubscription(active.id, key);
-        if (result) {
-            active.response.write(`data: ${JSON.stringify({ jsonrpc: "2.0", id: active.id, result })}\n\n`);
-        }
-        active.response.end();
-    }
-    runtime.activeSubscriptions.clear();
-}
-/** Gracefully close subscriptions before stopping a Streamable HTTP server. */
-export async function closePmMcpHttpServer(server) {
-    const runtime = PM_MCP_HTTP_RUNTIMES.get(server);
-    if (runtime)
-        closeActiveHttpSubscriptions(runtime);
-    await new Promise((resolve, reject) => {
-        server.close((error) => (error ? reject(error) : resolve()));
-    });
-    server.closeAllConnections();
-}
-/** Bind the configured Streamable HTTP server and return its actual address. */
-export async function startPmMcpHttpServer(options = {}) {
-    const server = createPmMcpHttpServer(options);
-    const address = resolvePmMcpHttpListenAddress(options);
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(address.port, address.host, () => {
-            server.off("error", reject);
-            resolve();
-        });
-    });
-    return server;
-}
-/** Resolve loopback-safe bind defaults without opening a socket. */
-export function resolvePmMcpHttpListenAddress(options = {}) {
-    return {
-        host: options.host ?? "127.0.0.1",
-        port: options.port ?? 3000,
-    };
-}
-function readMcpHttpEnvironment(environment) {
-    const configuredPort = environment.PM_MCP_HTTP_PORT?.trim();
-    const port = Number(configuredPort || "3000");
-    if (!Number.isInteger(port) || port < 0 || port > 65_535) {
-        throw new Error("PM_MCP_HTTP_PORT must be an integer from 0 through 65535");
-    }
-    return {
-        host: environment.PM_MCP_HTTP_HOST?.trim() || "127.0.0.1",
-        port,
-        allowedOrigins: (environment.PM_MCP_HTTP_ALLOWED_ORIGINS ?? "")
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter(Boolean),
-        token: environment.PM_MCP_HTTP_BEARER_TOKEN?.trim() || undefined,
-        issuer: environment.PM_MCP_HTTP_AUTH_ISSUER?.trim() || undefined,
-        resource: environment.PM_MCP_HTTP_RESOURCE?.trim() || undefined,
-        scopes: (environment.PM_MCP_HTTP_SCOPES ?? "pm:read pm:write")
-            .split(/\s+/u)
-            .filter(Boolean),
-    };
-}
-function buildMcpHttpAuthorizationOptions(environment) {
-    const metadata = buildMcpProtectedResourceMetadata({
-        resource: environment.resource,
-        authorizationServers: [environment.issuer],
-        scopes: environment.scopes,
-    });
-    const acceptedIssuer = environment.issuer;
-    return {
-        protectedResourceMetadata: metadata,
-        authorization: {
-            issuer: acceptedIssuer,
-            resource: metadata.resource,
-            requiredScopes: environment.scopes,
-            resourceMetadataUrl: new URL("/.well-known/oauth-protected-resource", metadata.resource).href,
-            verifyAccessToken: createMcpStaticBearerVerifier({
-                token: environment.token,
-                claims: {
-                    principal: "configured-remote-client",
-                    issuer: acceptedIssuer,
-                    audience: metadata.resource,
-                    scopes: environment.scopes,
-                },
-            }),
-        },
-    };
-}
-function hasCompleteMcpHttpAuthorization(environment) {
-    return Boolean(environment.token && environment.issuer && environment.resource);
-}
-/** Resolve and harden executable HTTP options from an environment map. */
-export function resolvePmMcpHttpServerOptionsFromEnvironment(processEnvironment = process.env) {
-    const environment = readMcpHttpEnvironment(processEnvironment);
-    const hasAuthorization = hasCompleteMcpHttpAuthorization(environment);
-    if (environment.host !== "127.0.0.1" &&
-        environment.host !== "localhost" &&
-        !hasAuthorization) {
-        throw new Error("Non-loopback MCP HTTP requires PM_MCP_HTTP_BEARER_TOKEN, PM_MCP_HTTP_AUTH_ISSUER, and PM_MCP_HTTP_RESOURCE");
-    }
-    const base = {
-        host: environment.host,
-        port: environment.port,
-        allowedOrigins: environment.allowedOrigins,
-    };
-    return hasAuthorization
-        ? {
-            ...base,
-            ...buildMcpHttpAuthorizationOptions({
-                issuer: environment.issuer,
-                resource: environment.resource,
-                token: environment.token,
-                scopes: environment.scopes,
-            }),
-        }
-        : base;
-}
-/** Internal HTTP transport seams used only by direct integration tests. */
-export const _testOnly = {
-    /** Return the first active request-scoped transport key for one server. */
-    activeSubscriptionKey: (server) => PM_MCP_HTTP_RUNTIMES.get(server).activeSubscriptions.keys().next().value,
-    /** Open a stream against one server runtime without a network socket. */
-    openHttpSubscription: (server, request, response) => openHttpSubscription({
-        request,
-        response,
-        runtime: PM_MCP_HTTP_RUNTIMES.get(server),
-    }),
-    /** Exercise committed-response handling without a network race. */
-    writeMcpHttpDispatchError,
-    /** Exercise the terminal request rejection handler without a live socket. */
-    destroyFailedMcpHttpResponse,
-};
-/* c8 ignore start -- executable guard and process lifecycle are integration-tested */
-if (isInvokedAsMcpMainModule(process.argv[1], import.meta.url)) {
-    startPmMcpHttpServer(resolvePmMcpHttpServerOptionsFromEnvironment()).catch((error) => {
-        console.error(error instanceof Error ? error.message : String(error));
-        process.exit(1);
-    });
-}
-/* c8 ignore stop */
+`)&&!settled){settled=true;cleanup();resolve()}}catch(error){cleanup();reject(error)}})}function writeJson(response,status,payload,headers={}){response.writeHead(status,{"Cache-Control":"no-store","Content-Type":"application/json",...headers});response.end(`${JSON.stringify(payload)}
+`)}function writeJsonRpcError(response,id,error){const authorizationError=error instanceof PmMcpAuthorizationError?error:void 0;const protocolError=error instanceof PmMcpProtocolError?error:void 0;const code=protocolError?.code??-32603;const clientErrorCodes=new Set([-32700,-32600,PM_MCP_ERROR_CODES.headerMismatch,PM_MCP_ERROR_CODES.unsupportedProtocolVersion,PM_MCP_ERROR_CODES.invalidParams]);const status=authorizationError?.httpStatus??(code===-32601?404:clientErrorCodes.has(code)?400:500);writeJson(response,status,{jsonrpc:"2.0",id:id??null,error:{code,message:error instanceof Error?error.message:"Internal MCP error",...protocolError?{data:protocolError.data}:{}}},authorizationError?.challenge?{"WWW-Authenticate":authorizationError.challenge}:{})}function finishCommittedMcpResponse(response){if(!response.headersSent&&!response.writableEnded&&!response.destroyed){return false}if(!response.writableEnded&&!response.destroyed)response.end();return true}function writeMcpHttpDispatchError(response,rpcRequest,error){if(finishCommittedMcpResponse(response))return;const toolError=rpcRequest?buildMcpToolCallErrorResult(rpcRequest,error):void 0;if(toolError&&rpcRequest){writeJson(response,200,{jsonrpc:"2.0",id:rpcRequest.id??null,result:toolError});return}writeJsonRpcError(response,rpcRequest?.id,error)}function destroyFailedMcpHttpResponse(response,error){response.destroy(new Error("Unhandled MCP HTTP request failure",{cause:error}))}async function readRequestBody(request,maximumBytes){const chunks=[];let observed=0;for await(const chunk of request){const buffer=Buffer.from(chunk);observed+=buffer.length;if(observed>maximumBytes){throw new PmMcpProtocolError("MCP HTTP request body exceeds the configured limit",PM_MCP_ERROR_CODES.invalidParams,{maximumBytes})}chunks.push(buffer)}return Buffer.concat(chunks).toString("utf8")}function parseJsonRpcRequest(source){let value;try{value=JSON.parse(source)}catch{throw new PmMcpProtocolError("Invalid JSON-RPC request body",-32700)}if(typeof value!=="object"||value===null||Array.isArray(value)||"jsonrpc"in value&&value.jsonrpc!=="2.0"||"method"in value&&typeof value.method!=="string"){throw new PmMcpProtocolError("Invalid JSON-RPC request",-32600)}return value}function protectedResourcePaths(endpointPath){return new Set(["/.well-known/oauth-protected-resource",`/.well-known/oauth-protected-resource${endpointPath}`])}function routeMcpHttpBoundary(request,response,requestUrl,runtime){if(runtime.options.protectedResourceMetadata&&request.method==="GET"&&protectedResourcePaths(runtime.endpointPath).has(requestUrl.pathname)){writeJson(response,200,{...runtime.options.protectedResourceMetadata});return true}if(requestUrl.pathname!==runtime.endpointPath){writeJson(response,404,{error:"Not found"});return true}if(request.method!=="POST"){response.setHeader("Allow","POST");writeJson(response,405,{error:"Method not allowed"});return true}const origin=request.headers.origin;if(origin!==void 0&&!runtime.allowedOrigins.has(origin)){writeJson(response,403,{error:"Origin is not allowed"});return true}const accept=request.headers.accept;const contentType=request.headers["content-type"];if(typeof accept!=="string"||!accept.includes("application/json")||!accept.includes("text/event-stream")||typeof contentType!=="string"||!contentType.startsWith("application/json")){writeJson(response,406,{error:"MCP requires JSON and SSE content negotiation"});return true}return false}async function openHttpSubscription(input){if(typeof input.request.id!=="string"&&typeof input.request.id!=="number"){throw new PmMcpProtocolError("subscriptions/listen requires a JSON-RPC id",PM_MCP_ERROR_CODES.invalidParams)}const subscriptionId=input.request.id;const subscriptionKey=Symbol("pm-mcp-http-subscription");const active={id:subscriptionId,key:subscriptionKey,response:input.response};let disconnected=input.response.destroyed||input.response.writableEnded;let subscriptionOpened=false;const closeActiveSubscription=()=>{disconnected=true;if(active.timer)clearInterval(active.timer);input.runtime.activeSubscriptions.delete(subscriptionKey);if(subscriptionOpened){closeMcpSubscription(subscriptionId,subscriptionKey)}};input.response.once("close",closeActiveSubscription);let responseStarted=false;try{await openMcpSubscription({request:input.request,key:subscriptionKey,sink:notification=>{if(input.response.destroyed||input.response.writableEnded){throw new Error("MCP response stream closed before acknowledgment")}if(!responseStarted){responseStarted=true;input.response.setHeader("Cache-Control","no-cache, no-store");input.response.setHeader("Connection","keep-alive");input.response.setHeader("Content-Type","text/event-stream");input.response.setHeader("X-Accel-Buffering","no")}return writePmMcpSseEvent(input.response,notification)}});subscriptionOpened=true}catch(error){input.response.off("close",closeActiveSubscription);throw error}if(disconnected||input.response.destroyed||input.response.writableEnded){closeActiveSubscription();return}if(input.runtime.keepAliveMs>0){active.timer=setInterval(()=>input.response.write(":\r\n\r\n"),input.runtime.keepAliveMs);active.timer.unref()}input.runtime.activeSubscriptions.set(subscriptionKey,active)}async function dispatchMcpHttpRpc(input){let rpcRequest;try{if(input.runtime.options.authorization){await authorizeMcpHttpRequest({headers:input.request.headers,requestUrl:input.requestUrl.href,policy:input.runtime.options.authorization})}rpcRequest=parseJsonRpcRequest(await readRequestBody(input.request,input.runtime.maximumBodyBytes));validateMcpHttpRequestHeaders({headers:input.request.headers,request:rpcRequest,toolSchema:await resolveMcpToolSchemaForRequest(rpcRequest)});if(rpcRequest.method==="subscriptions/listen"){await openHttpSubscription({request:rpcRequest,response:input.response,runtime:input.runtime});return}const result=await(input.runtime.options.requestHandler??handleRequest)(rpcRequest);if(!Object.prototype.hasOwnProperty.call(rpcRequest,"id")){input.response.writeHead(202);input.response.end();return}writeJson(input.response,200,{jsonrpc:"2.0",id:rpcRequest.id??null,result:result??{}})}catch(error){writeMcpHttpDispatchError(input.response,rpcRequest,error)}}async function handleMcpHttpRequest(request,response,runtime){const requestUrl=new URL(request.url,"http://localhost");if(routeMcpHttpBoundary(request,response,requestUrl,runtime))return;await dispatchMcpHttpRpc({request,response,requestUrl,runtime})}function createPmMcpHttpServer(options={}){const runtime={activeSubscriptions:new Map,allowedOrigins:new Set(options.allowedOrigins??[]),endpointPath:options.endpointPath??"/mcp",keepAliveMs:options.keepAliveMs??DEFAULT_KEEP_ALIVE_MS,maximumBodyBytes:options.maximumBodyBytes??DEFAULT_MAXIMUM_BODY_BYTES,options};const server=createServer((request,response)=>{void handleMcpHttpRequest(request,response,runtime).catch(destroyFailedMcpHttpResponse.bind(void 0,response))});PM_MCP_HTTP_RUNTIMES.set(server,runtime);server.on("close",()=>{closeActiveHttpSubscriptions(runtime);PM_MCP_HTTP_RUNTIMES.delete(server)});return server}function closeActiveHttpSubscriptions(runtime){for(const[key,active]of runtime.activeSubscriptions){if(active.timer)clearInterval(active.timer);const result=closeMcpSubscription(active.id,key);if(result){active.response.write(`data: ${JSON.stringify({jsonrpc:"2.0",id:active.id,result})}
+
+`)}active.response.end()}runtime.activeSubscriptions.clear()}async function closePmMcpHttpServer(server){const runtime=PM_MCP_HTTP_RUNTIMES.get(server);if(runtime)closeActiveHttpSubscriptions(runtime);await new Promise((resolve,reject)=>{server.close(error=>error?reject(error):resolve())});server.closeAllConnections()}async function startPmMcpHttpServer(options={}){const server=createPmMcpHttpServer(options);const address=resolvePmMcpHttpListenAddress(options);await new Promise((resolve,reject)=>{server.once("error",reject);server.listen(address.port,address.host,()=>{server.off("error",reject);resolve()})});return server}function resolvePmMcpHttpListenAddress(options={}){return{host:options.host??"127.0.0.1",port:options.port??3e3}}function readMcpHttpEnvironment(environment){const configuredPort=environment.PM_MCP_HTTP_PORT?.trim();const port=Number(configuredPort||"3000");if(!Number.isInteger(port)||port<0||port>65535){throw new Error("PM_MCP_HTTP_PORT must be an integer from 0 through 65535")}return{host:environment.PM_MCP_HTTP_HOST?.trim()||"127.0.0.1",port,allowedOrigins:(environment.PM_MCP_HTTP_ALLOWED_ORIGINS??"").split(",").map(entry=>entry.trim()).filter(Boolean),token:environment.PM_MCP_HTTP_BEARER_TOKEN?.trim()||void 0,issuer:environment.PM_MCP_HTTP_AUTH_ISSUER?.trim()||void 0,resource:environment.PM_MCP_HTTP_RESOURCE?.trim()||void 0,scopes:(environment.PM_MCP_HTTP_SCOPES??"pm:read pm:write").split(/\s+/u).filter(Boolean)}}function buildMcpHttpAuthorizationOptions(environment){const metadata=buildMcpProtectedResourceMetadata({resource:environment.resource,authorizationServers:[environment.issuer],scopes:environment.scopes});const acceptedIssuer=environment.issuer;return{protectedResourceMetadata:metadata,authorization:{issuer:acceptedIssuer,resource:metadata.resource,requiredScopes:environment.scopes,resourceMetadataUrl:new URL("/.well-known/oauth-protected-resource",metadata.resource).href,verifyAccessToken:createMcpStaticBearerVerifier({token:environment.token,claims:{principal:"configured-remote-client",issuer:acceptedIssuer,audience:metadata.resource,scopes:environment.scopes}})}}}function hasCompleteMcpHttpAuthorization(environment){return Boolean(environment.token&&environment.issuer&&environment.resource)}function resolvePmMcpHttpServerOptionsFromEnvironment(processEnvironment=process.env){const environment=readMcpHttpEnvironment(processEnvironment);const hasAuthorization=hasCompleteMcpHttpAuthorization(environment);if(environment.host!=="127.0.0.1"&&environment.host!=="localhost"&&!hasAuthorization){throw new Error("Non-loopback MCP HTTP requires PM_MCP_HTTP_BEARER_TOKEN, PM_MCP_HTTP_AUTH_ISSUER, and PM_MCP_HTTP_RESOURCE")}const base={host:environment.host,port:environment.port,allowedOrigins:environment.allowedOrigins};return hasAuthorization?{...base,...buildMcpHttpAuthorizationOptions({issuer:environment.issuer,resource:environment.resource,token:environment.token,scopes:environment.scopes})}:base}const _testOnly={activeSubscriptionKey:server=>PM_MCP_HTTP_RUNTIMES.get(server).activeSubscriptions.keys().next().value,openHttpSubscription:(server,request,response)=>openHttpSubscription({request,response,runtime:PM_MCP_HTTP_RUNTIMES.get(server)}),writeMcpHttpDispatchError,destroyFailedMcpHttpResponse};if(isInvokedAsMcpMainModule(process.argv[1],import.meta.url)){startPmMcpHttpServer(resolvePmMcpHttpServerOptionsFromEnvironment()).catch(error=>{console.error(error instanceof Error?error.message:String(error));process.exit(1)})}export{_testOnly,closePmMcpHttpServer,createPmMcpHttpServer,resolvePmMcpHttpListenAddress,resolvePmMcpHttpServerOptionsFromEnvironment,startPmMcpHttpServer,writePmMcpSseEvent};
 //# sourceMappingURL=http-server.js.map
-//# debugId=7c5d2b34-e2ab-52a9-80a9-c5a28ce09dc7