@unbrained/pm-web 2026.7.27 → 2026.7.28

package/CHANGELOG.md

@@ -1,11 +1,29 @@
 # Changelog
 
+## 2026.7.28 - 2026-07-28
+
+### Added
+
+- Per-project package catalog so every pm package is installable from the web UI ([pm-web-28aw](https://github.com/unbraind/pm-web/blob/main/.agents/pm/features/pm-web-28aw.toon))
+
+### Fixed
+
+- Require edit permission for package catalog mutations in pm-web ([pm-web-rknk](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-rknk.toon))
+
+### Other
+
+- Adopt pm-cli 2026.7.28 in the hosted web UI package ([pm-web-g7ed](https://github.com/unbraind/pm-web/blob/main/.agents/pm/chores/pm-web-g7ed.toon))
+
 ## 2026.7.27 - 2026-07-27
 
 ### Added
 
 - Replace per-request pm processes with typed PmClient dispatch and cursor pagination ([pm-web-wyum](https://github.com/unbraind/pm-web/blob/main/.agents/pm/features/pm-web-wyum.toon))
 
+### Fixed
+
+- web status/stop/doctor shadow the host-owned --json global and fail to register on pm-cli 2026.7.27 ([pm-web-snn2](https://github.com/unbraind/pm-web/blob/main/.agents/pm/issues/pm-web-snn2.toon))
+
 ### Other
 
 - Move pm-web onto pm-cli 2026.7.26 and pm-changelog 2026.7.25 ([pm-web-orfk](https://github.com/unbraind/pm-web/blob/main/.agents/pm/chores/pm-web-orfk.toon))
@@ -14,12 +32,18 @@
 
 ### Added
 
+- Full pm ecosystem production pass for pm-web ([pm-web-i98h](https://github.com/unbraind/pm-web/blob/main/.agents/pm/features/pm-web-i98h.toon))
 - Realtime mutation-event subscription replaces filesystem polling as the primary out-of-band change detector ([pm-web-vwaq](https://github.com/unbraind/pm-web/blob/main/.agents/pm/features/pm-web-vwaq.toon))
 
+### Other
+
+- Enable governance duplicate-detection advisory mode and restore parent_reference=warn ([pm-web-0nc9](https://github.com/unbraind/pm-web/blob/main/.agents/pm/chores/pm-web-0nc9.toon))
+
 ## 2026.7.25 - 2026-07-25
 
 ### Other
 
+- Adopt --respect-item-release in changelog scripts and bump pm-changelog to 2026.7.24 ([pm-web-hgx4](https://github.com/unbraind/pm-web/blob/main/.agents/pm/chores/pm-web-hgx4.toon))
 - project-watcher: bounded round-robin scan for projects beyond MAX_FILES_PER_PROJECT (8000) ([pm-web-acwm](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-acwm.toon))
 
 ## 2026.7.24 - 2026-07-24
@@ -48,6 +72,14 @@
 
 - Harden release bun-verify so registry-mirror lag cannot block the GitHub release ([pm-web-rwsr](https://github.com/unbraind/pm-web/blob/main/.agents/pm/chores/pm-web-rwsr.toon))
 
+## 2026.7.17-1 - 2026-07-17
+
+### Added
+
+- Chinese (zh) locale for package-owned UI strings ([pm-web-t6v6](https://github.com/unbraind/pm-web/blob/main/.agents/pm/features/pm-web-t6v6.toon))
+- Spanish (es) locale for package-owned UI strings ([pm-web-2ut6](https://github.com/unbraind/pm-web/blob/main/.agents/pm/features/pm-web-2ut6.toon))
+- i18n plumbing + German locale for package-owned UI strings ([pm-web-y80b](https://github.com/unbraind/pm-web/blob/main/.agents/pm/features/pm-web-y80b.toon))
+
 ## 2026.7.17 - 2026-07-16
 
 ### Added
@@ -84,6 +116,7 @@
 
 ### Other
 
+- Ecosystem release readiness pass 2026-07-06 ([pm-web-f9r8](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-f9r8.toon))
 - Align Node engine with pm CLI runtime ([pm-web-ndeb](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-ndeb.toon))
 - Generate pm-web package declarations and refresh bundled graph toolchain ([pm-web-1xkj](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-1xkj.toon))
 - Regenerate CHANGELOG after pm close item ([pm-web-0ww0](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-0ww0.toon))
@@ -112,6 +145,8 @@
 
 ### Other
 
+- Full-cycle hardening wave: pm-web ([pm-web-3x0r](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-3x0r.toon))
+- Align pm-web with pm CLI 2026.6.12 release readiness ([pm-web-gtdz](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-gtdz.toon))
 - Restore self-hosted daily release automation ([pm-web-hgjp](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-hgjp.toon))
 
 ## 2026.6.9 - 2026-06-09
@@ -150,6 +185,12 @@
 - Implement 'pm web stop' command + pidfile-on-detach ([pm-web-odwq](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-odwq.toon))
 - Implement 'pm web status' command ([pm-web-8eqs](https://github.com/unbraind/pm-web/blob/main/.agents/pm/tasks/pm-web-8eqs.toon))
 
+## 2026.6.2 - 2026-06-02
+
+### Added
+
+- Add kanban board + full-text search data endpoints (contracts-driven) ([pm-web-9sno](https://github.com/unbraind/pm-web/blob/main/.agents/pm/features/pm-web-9sno.toon))
+
 ## 2026.5.30 - 2026-05-30
 
 ### Fixed

package/README.md

@@ -123,7 +123,6 @@ pm web doctor --json
 | `NEO4J_URI` | No | Neo4j Bolt URI for graph sync |
 | `NEO4J_USER` / `NEO4J_USERNAME` | No | Neo4j username |
 | `NEO4J_PASSWORD` | No | Neo4j password |
-| `PM_GRAPH_EXTENSION_PATH` | No | Bundled pm-graph extension path, default `extensions/pm-graph` |
 | `PM_WEB_LEGAL_DIR` | Production | Absolute path to a complete, private, operator-reviewed legal-page overlay; see `docs/LEGAL_DEPLOYMENT_BOUNDARY.md` |
 | `OIDC_ISSUER` | No | Provider issuer URL; setting any OIDC variable enables strict configuration validation |
 | `OIDC_CLIENT_ID` / `OIDC_CLIENT_SECRET` | With OIDC | OIDC confidential client credentials |
@@ -132,7 +131,7 @@ pm web doctor --json
 | `OIDC_SCOPES` | No | Requested scopes (default: `openid profile email`) |
 | `OIDC_REQUIRE_VERIFIED_EMAIL` | No | Reject identities without a provider-verified email when `true` |
 
-New pm-web projects configure local Ollama search automatically and install the bundled `pm-graph` extension into the project workspace. Neo4j graph rows are scoped per pm-web project so syncing one project does not overwrite another.
+New pm-web projects configure local Ollama search automatically and install the `pm-graph` package into the project workspace (from npm, via the per-project package catalog). Neo4j graph rows are scoped per pm-web project so syncing one project does not overwrite another.
 
 Saved GitHub personal access tokens are encrypted at rest before they are written to PostgreSQL. Existing plaintext tokens from older installs still work when read, and are replaced with encrypted values the next time the user saves a token.
 

package/dist/app.js

@@ -7,6 +7,7 @@ import { authRouter } from "./routes/auth.js";
 import { oidcRouter } from "./routes/oidc.js";
 import { projectsRouter } from "./routes/projects.js";
 import { pmRouter } from "./routes/pm.js";
+import { extensionsRouter } from "./routes/extensions.js";
 import { groupsRouter } from "./routes/groups.js";
 import { sharesRouter, sharedWithMeRouter } from "./routes/sharing.js";
 import { githubRouter } from "./routes/github.js";
@@ -134,6 +135,7 @@ export function createApp() {
     app.use("/api/auth", authRouter);
     app.use("/api/projects", projectsRouter);
     app.use("/api/projects/:projectId/pm", pmRouter);
+    app.use("/api/projects/:projectId/extensions", extensionsRouter);
     app.use("/api/groups", groupsRouter);
     app.use("/api/projects/:id/shares", sharesRouter);
     app.use("/api/shared", sharedWithMeRouter);

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,iBAAiB;CACT,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,YAAY,EAAE,eAAe;IAC7B,cAAc,EAAE,iBAAiB;IACjC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,kBAAkB;CAC/B,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,UAAU,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,oCAAoC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,QAAQ,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,kDAAkD,CAAC,CAAC;QACnG,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;QACxF,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACzD,CAAC,CACH,CAAC;IAEF,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1B,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACpE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC5C,CAAC;YAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAEpF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;IAEhD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACrD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvF,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,aAAa;IACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACrC,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEnC,0EAA0E;IAC1E,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,iBAAiB;CACT,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,YAAY,EAAE,eAAe;IAC7B,cAAc,EAAE,iBAAiB;IACjC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,kBAAkB;CAC/B,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,UAAU,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,oCAAoC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,QAAQ,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,kDAAkD,CAAC,CAAC;QACnG,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;QACxF,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACzD,CAAC,CACH,CAAC;IAEF,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1B,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACpE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC5C,CAAC;YAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAEpF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;IAEhD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACrD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvF,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,aAAa;IACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,qCAAqC,EAAE,gBAAgB,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACrC,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEnC,0EAA0E;IAC1E,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.js

@@ -176,7 +176,7 @@ function processAlive(pid) {
 }
 export default defineExtension({
     name: "pm-web",
-    version: "2026.7.27",
+    version: "2026.7.28",
     activate(api) {
         // -----------------------------------------------------------------------
         // Command: pm web [--port <port>] [--detach]

package/dist/routes/extensions.d.ts

@@ -0,0 +1,16 @@
+import { type PackageCatalogEntry } from "../services/package-catalog.js";
+declare const router: import("express-serve-static-core").Router;
+/** The realtime event type broadcast on every successful extension mutation. */
+export declare const EXTENSIONS_CHANGED_EVENT = "extensions-changed";
+/** The catalog entry joined with its live per-project state, for the GET list. */
+export interface PackageCatalogRow extends PackageCatalogEntry {
+    installed: boolean;
+    version: string | null;
+    active: boolean;
+    enabled: boolean;
+    runtimeActive: boolean;
+    activationStatus: string | null;
+    managed: boolean;
+    sourceKind: string | null;
+}
+export { router as extensionsRouter };

package/dist/routes/extensions.js

@@ -0,0 +1,214 @@
+// ═══════════════════════════════════════════════════════════════
+// EXTENSIONS ROUTES — per-project pm package catalog management
+// ═══════════════════════════════════════════════════════════════
+//
+// pm-web used to support exactly one pm package — a vendored copy of pm-graph —
+// and offered no way to install any other. These routes expose the full pm
+// package catalog (src/services/package-catalog.ts) joined with the live
+// per-project state from `pm extension --json`, and let a user install,
+// activate, deactivate, and uninstall packages for a project.
+//
+// SECURITY-CRITICAL: every `:name` route parameter is validated against the
+// catalog BEFORE it is passed to any pm command. A catalog lookup miss must
+// 400 before any process spawn — a user-supplied string can never be
+// interpolated into an install target. The install target is the matched
+// entry's own `npmSpec` constant, so the spawn argument always comes from the
+// catalog, never from the raw request string.
+//
+// The router is mounted under the same project-scoped path as the pm router
+// (`/api/projects/:projectId/extensions`), so `:projectId` is available via
+// Express mergeParams. Authorization mirrors src/routes/pm.ts: a user must own
+// or be shared on the project; one user can never touch another user's
+// project. Every successful mutation publishes on the existing realtime bus
+// (src/services/sse.ts) so all collaborators on the project see the change
+// live — consistent with how item mutations already broadcast.
+import { Router } from "express";
+import { requireAuth } from "../middleware/auth.js";
+import { verifyProjectAccess } from "./projects.js";
+import { routeParam } from "./route-params.js";
+import { INSTALL_COMMAND_TIMEOUT_MS, readProjectExtensionStates, runPm, getProjectDir, } from "../services/pm-runner.js";
+import { PACKAGE_CATALOG, findCatalogEntry, } from "../services/package-catalog.js";
+import { broadcastProjectEvent } from "../services/sse.js";
+const router = Router({ mergeParams: true });
+router.use(requireAuth);
+/**
+ * Resolve and validate `:name` against the catalog exactly once per request.
+ *
+ * SECURITY GATE. Express runs a `router.param` callback before any matching
+ * route handler, so a mutation route physically cannot run without the
+ * validated entry — the previous per-handler lookup relied on every future
+ * route remembering to repeat it, and a route that forgot would pass an
+ * unvalidated string toward a process spawn.
+ *
+ * The resolved entry is stashed on the response so handlers read a catalog
+ * constant rather than the request string.
+ */
+router.param("name", (req, res, next, value) => {
+    const entry = findCatalogEntry(value);
+    if (!entry) {
+        res.status(400).json({ error: `Unknown package: ${value}` });
+        return;
+    }
+    res.locals.catalogEntry = entry;
+    next();
+});
+/** The catalog entry resolved by the `:name` param gate above. */
+function catalogEntry(res) {
+    return res.locals.catalogEntry;
+}
+/** The realtime event type broadcast on every successful extension mutation. */
+export const EXTENSIONS_CHANGED_EVENT = "extensions-changed";
+/** Verify project access (owner or shared) and return the pm-runner ref. */
+async function verifyProject(userId, projectId) {
+    const access = await verifyProjectAccess(userId, projectId);
+    if (!access)
+        return null;
+    return {
+        slug: access.slug,
+        prefix: access.prefix,
+        ownerUserId: access.ownerUserId,
+        permission: access.permission,
+    };
+}
+/**
+ * Resolve the project for a mutating request, enforcing edit permission.
+ *
+ * Installing, activating, or removing a package changes the workspace for
+ * *every* collaborator, so it is an edit-level action. Sharing grants either
+ * `"view"` or `"edit"`; without this check a view-only collaborator could
+ * install or uninstall packages on someone else's project. Mirrors the
+ * guard `routes/pm.ts` applies to item mutations.
+ *
+ * Responds and returns `null` when access is denied, so callers `return`
+ * immediately on a null result.
+ */
+async function requireEditableProject(req, res) {
+    const project = await verifyProject(req.user.userId, routeParam(req, "projectId"));
+    if (!project) {
+        res.status(404).json({ error: "Project not found" });
+        return null;
+    }
+    if (project.permission !== "edit") {
+        res.status(403).json({ error: "This project is shared as view-only." });
+        return null;
+    }
+    return project;
+}
+function toRow(entry, state) {
+    return {
+        ...entry,
+        installed: Boolean(state),
+        version: state?.version ?? null,
+        active: Boolean(state?.active),
+        enabled: Boolean(state?.enabled),
+        runtimeActive: Boolean(state?.runtime_active),
+        activationStatus: state?.activation_status ?? null,
+        managed: Boolean(state?.managed),
+        sourceKind: state?.source?.kind ?? null,
+    };
+}
+/** Broadcast an extensions-changed event to all project collaborators. */
+function broadcastExtensionsChanged(projectId, userId, name, operation) {
+    broadcastProjectEvent(projectId, {
+        type: EXTENSIONS_CHANGED_EVENT,
+        data: { userId, name, operation },
+    });
+}
+// GET /api/projects/:projectId/extensions
+// Catalog joined with live `pm extension --json` state.
+router.get("/", async (req, res) => {
+    // Read-only: a view-only collaborator may see which packages a project uses,
+    // they just cannot change them.
+    const project = await verifyProject(req.user.userId, routeParam(req, "projectId"));
+    if (!project) {
+        res.status(404).json({ error: "Project not found" });
+        return;
+    }
+    const { ok, states, error } = await readProjectExtensionStates(getProjectDir(project.ownerUserId, project.slug));
+    const rows = PACKAGE_CATALOG.map((entry) => toRow(entry, states.get(entry.name)));
+    // Surface a failed read rather than rendering every package as "not
+    // installed", which is indistinguishable from a healthy empty project.
+    res.json(ok ? { packages: rows } : { packages: rows, stateError: error });
+});
+// POST /api/projects/:projectId/extensions/:name/install
+router.post("/:name/install", async (req, res) => {
+    const project = await requireEditableProject(req, res);
+    if (!project)
+        return;
+    const entry = catalogEntry(res);
+    const result = await runPm({
+        // entry.npmSpec is a catalog constant, never the request string.
+        args: ["install", entry.npmSpec, "--project"],
+        userId: project.ownerUserId,
+        slug: project.slug,
+        jsonOutput: true,
+        // Installs resolve and download from the npm registry; the 30s default is
+        // sized for local commands and leaves too thin a margin for a cold cache.
+        timeoutMs: INSTALL_COMMAND_TIMEOUT_MS,
+    });
+    if (!result.ok) {
+        res.status(400).json({ error: result.stderr || `Failed to install ${entry.name}` });
+        return;
+    }
+    broadcastExtensionsChanged(routeParam(req, "projectId"), req.user.userId, entry.name, "install");
+    res.status(201).json(result.parsed || { ok: true, name: entry.name });
+});
+// POST /api/projects/:projectId/extensions/:name/activate
+router.post("/:name/activate", async (req, res) => {
+    const project = await requireEditableProject(req, res);
+    if (!project)
+        return;
+    const entry = catalogEntry(res);
+    const result = await runPm({
+        args: ["extension", "activate", entry.name, "--project"],
+        userId: project.ownerUserId,
+        slug: project.slug,
+        jsonOutput: true,
+    });
+    if (!result.ok) {
+        res.status(400).json({ error: result.stderr || `Failed to activate ${entry.name}` });
+        return;
+    }
+    broadcastExtensionsChanged(routeParam(req, "projectId"), req.user.userId, entry.name, "activate");
+    res.json(result.parsed || { ok: true, name: entry.name });
+});
+// POST /api/projects/:projectId/extensions/:name/deactivate
+router.post("/:name/deactivate", async (req, res) => {
+    const project = await requireEditableProject(req, res);
+    if (!project)
+        return;
+    const entry = catalogEntry(res);
+    const result = await runPm({
+        args: ["extension", "deactivate", entry.name, "--project"],
+        userId: project.ownerUserId,
+        slug: project.slug,
+        jsonOutput: true,
+    });
+    if (!result.ok) {
+        res.status(400).json({ error: result.stderr || `Failed to deactivate ${entry.name}` });
+        return;
+    }
+    broadcastExtensionsChanged(routeParam(req, "projectId"), req.user.userId, entry.name, "deactivate");
+    res.json(result.parsed || { ok: true, name: entry.name });
+});
+// DELETE /api/projects/:projectId/extensions/:name
+router.delete("/:name", async (req, res) => {
+    const project = await requireEditableProject(req, res);
+    if (!project)
+        return;
+    const entry = catalogEntry(res);
+    const result = await runPm({
+        args: ["extension", "uninstall", entry.name, "--project"],
+        userId: project.ownerUserId,
+        slug: project.slug,
+        jsonOutput: true,
+    });
+    if (!result.ok) {
+        res.status(400).json({ error: result.stderr || `Failed to uninstall ${entry.name}` });
+        return;
+    }
+    broadcastExtensionsChanged(routeParam(req, "projectId"), req.user.userId, entry.name, "uninstall");
+    res.json(result.parsed || { ok: true, name: entry.name });
+});
+export { router as extensionsRouter };
+//# sourceMappingURL=extensions.js.map

package/dist/routes/extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../src/routes/extensions.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,gEAAgE;AAChE,kEAAkE;AAClE,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,yEAAyE;AACzE,wEAAwE;AACxE,8DAA8D;AAC9D,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,qEAAqE;AACrE,yEAAyE;AACzE,8EAA8E;AAC9E,8CAA8C;AAC9C,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,uEAAuE;AACvE,4EAA4E;AAC5E,2EAA2E;AAC3E,+DAA+D;AAE/D,OAAO,EAAE,MAAM,EAAiB,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,EACL,aAAa,GAEd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,eAAe,EACf,gBAAgB,GAEjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7C,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAExB;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAa,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC;IAChC,IAAI,EAAE,CAAC;AACT,CAAC,CAAC,CAAC;AAEH,kEAAkE;AAClE,SAAS,YAAY,CAAC,GAAa;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,YAAmC,CAAC;AACxD,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAU7D,4EAA4E;AAC5E,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,sBAAsB,CACnC,GAAgB,EAChB,GAAa;IAEb,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAK,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAcD,SAAS,KAAK,CACZ,KAA0B,EAC1B,KAAiC;IAEjC,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI;QAC/B,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAChC,aAAa,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;QAC7C,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,IAAI,IAAI;QAClD,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAChC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI;KACxC,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,0BAA0B,CAAC,SAAiB,EAAE,MAAc,EAAE,IAAY,EAAE,SAAiB;IACpG,qBAAqB,CAAC,SAAS,EAAE;QAC/B,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;KAClC,CAAC,CAAC;AACL,CAAC;AAED,0CAA0C;AAC1C,wDAAwD;AACxD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAgB,EAAE,GAAG,EAAE,EAAE;IAC9C,6EAA6E;IAC7E,gCAAgC;IAChC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAK,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC/E,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,0BAA0B,CAC5D,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CACjD,CAAC;IACF,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClF,oEAAoE;IACpE,uEAAuE;IACvE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAgB,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,iEAAiE;QACjE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;QAC7C,MAAM,EAAE,OAAO,CAAC,WAAW;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,0EAA0E;QAC1E,0EAA0E;QAC1E,SAAS,EAAE,0BAA0B;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,qBAAqB,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,0BAA0B,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,IAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAClG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAgB,EAAE,GAAG,EAAE,EAAE;IAC7D,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;QACxD,MAAM,EAAE,OAAO,CAAC,WAAW;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,sBAAsB,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,0BAA0B,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,IAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACnG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,4DAA4D;AAC5D,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAgB,EAAE,GAAG,EAAE,EAAE;IAC/D,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,WAAW;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,wBAAwB,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IACD,0BAA0B,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,IAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACrG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,mDAAmD;AACnD,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAgB,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;QACzD,MAAM,EAAE,OAAO,CAAC,WAAW;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,uBAAuB,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IACD,0BAA0B,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,IAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC"}

package/dist/services/package-catalog.d.ts

@@ -0,0 +1,84 @@
+/**
+ * The set of capabilities a pm package can declare, mirrored verbatim from
+ * each package's `manifest.json` `capabilities` array. The union is kept
+ * open-ended as a string array (not a closed enum) because the pm extension
+ * contract may add new capability kinds upstream; pinning a closed list here
+ * would reject a future package that uses a capability we have not enumerated.
+ */
+export type PackageCapability = string;
+/**
+ * Honest gating metadata so the UI can tell a user what they must configure
+ * before a package is useful. Both fields are OPTIONAL — most packages work
+ * with no external setup.
+ *
+ * - `requiresService`: a backing service the package talks to (e.g. Neo4j for
+ *   pm-graph's sync). When set, the UI explains that the package's
+ *   service-dependent features will not work until the service is reachable.
+ *   `optional: true` means the package is still useful without the service
+ *   (e.g. pm-graph's offline export/analyze work without Neo4j).
+ *
+ * - `requiresCredentials`: human-supplied secrets the package needs for its
+ *   network-mutating commands (e.g. JIRA_API_TOKEN, LINEAR_API_KEY,
+ *   PM_SLACK_WEBHOOK, GITHUB_TOKEN). Each entry names the env var(s) and a
+ *   short human description. The UI must not pretend these are one-click; it
+ *   surfaces the variables the user must set.
+ */
+export interface ServiceRequirement {
+    /** Display name of the backing service, e.g. "Neo4j". */
+    name: string;
+    /** True when the package is useful without the service (best-effort). */
+    optional?: boolean;
+}
+export interface CredentialRequirement {
+    /** Display label for what the credentials unlock, e.g. "Jira sync". */
+    label: string;
+    /** Environment variable(s) the package reads for the credentials. */
+    envVars: string[];
+    /**
+     * True when the package is partially usable without the credentials (e.g.
+     * `--dry-run` paths, unauthenticated reads). When false, the package is
+     * inert until the credentials are configured.
+     */
+    optional?: boolean;
+}
+export interface PackageCatalogEntry {
+    /** Canonical npm package name, e.g. `pm-graph`. */
+    readonly name: string;
+    /** The install spec passed to `pm install`, always `npm:<name>`. */
+    readonly npmSpec: string;
+    /** Human-friendly title, e.g. `Graph`. */
+    readonly title: string;
+    /** One-line description, mirrored from the package's manifest/package.json. */
+    readonly description: string;
+    /** Capabilities declared in the package manifest. */
+    readonly capabilities: readonly PackageCapability[];
+    /** Backing service the package needs (optional). */
+    readonly requiresService?: ServiceRequirement;
+    /** Credentials the user must configure (optional). */
+    readonly requiresCredentials?: readonly CredentialRequirement[];
+}
+/**
+ * The catalog. Order is the display order in the UI. The list is exhaustive
+ * over user-facing pm packages: every package in the fleet that is not an
+ * authoring template (`pm-starter`/`pm-ts-starter`) and not pm-web itself is
+ * here. `pm-starter`/`pm-ts-starter` are authoring templates, not user-facing
+ * packages; `pm-web` is this package.
+ */
+export declare const PACKAGE_CATALOG: readonly PackageCatalogEntry[];
+/**
+ * Look up a catalog entry by package name. Returns the entry or `undefined`
+ * when the name is not in the catalog. This is the security-critical gate:
+ * route handlers MUST call this and reject with 400 on a miss BEFORE passing
+ * the name to any pm command, so a user-supplied string can never be
+ * interpolated into an install target.
+ */
+export declare function findCatalogEntry(name: string): PackageCatalogEntry | undefined;
+/**
+ * Resolve a package name to its verified npm install spec
+ * (`npm:<name>`), or `null` when the name is not in the catalog. Route
+ * handlers use this to obtain the spawn argument without ever building an
+ * install target from a raw user string.
+ */
+export declare function resolveNpmSpec(name: string): string | null;
+/** The immutable list of catalog package names, in display order. */
+export declare function catalogNames(): readonly string[];