Adopt pm-cli 2026.7.26 typed authoring contracts and drop the any-cast defineExtension shim

[unbraind]

What

Adopts the pm-cli 2026.7.26 typed authoring contracts and removes the forced-any defineExtension shim.

pm item: pm-github-zjxx

Why

This package carried:

import type { defineExtension as defineExtensionType } from "@unbrained/pm-cli/sdk";
const defineExtension: typeof defineExtensionType = ((extension: any) => extension) as any;

Two anys that existed only to bridge a type surface the SDK did not expose. 2026.7.26 adds @unbrained/pm-cli/sdk/authoring with the real contracts.

Approach: local declaration, not a value import

defineExtension is a pure identity function — <T extends ExtensionModule>(module: T) => T. So the shim is replaced with an equivalent locally declared, fully typed helper:

const defineExtension = <TModule extends ExtensionModule>(module: TModule): TModule => module;

Declared locally on purpose. This package's dependency on @unbrained/pm-cli is type-only, so every import erases at build time and the published extension carries no runtime module edge to the CLI. Importing defineExtension as a value would have introduced one. Contract checking is identical, since the constraint is the SDK's own ExtensionModule.

activate is now typed with the real ExtensionApi rather than any, so every api.register* call is checked against the host contract.

Verification

• npm run typecheck — clean
• npm test — 168 passing
• dependency ranges moved to pm-cli 2026.7.26 (first release exposing sdk/authoring) and pm-changelog 2026.7.25

---

Summary by cubic

Adopts @unbrained/pm-cli 2026.7.26 typed authoring contracts and removes the any-cast defineExtension shim for better type safety with no runtime edge. Consumers need @unbrained/pm-cli >= 2026.7.26.

• Refactors

  • Type-only import ExtensionApi and ExtensionModule from @unbrained/pm-cli/sdk/authoring.
  • Replace the shim with a local typed identity defineExtension<T extends ExtensionModule>(module).
  • Type activate(api: ExtensionApi) and remove remaining any casts.
  • Close the implementation record and regenerate CHANGELOG.md against v2026.07.26.

• Dependencies

  • Bump @unbrained/pm-cli to ^2026.7.26 (peer: >=2026.7.26).
  • Bump pm-changelog to ^2026.7.25.

^{Written for commit b890133. Summary will update on new commits.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[sourcery-ai]

Sorry @unbraind, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Warning

Review limit reached

@unbraind, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 39 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 582e675d-fc4f-4126-b268-35ce6f186410

📥 Commits

Reviewing files that changed from the base of the PR and between 2a2ccbc and b890133.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• .agents/pm/history/pm-github-zjxx.jsonl
• .agents/pm/tasks/pm-github-zjxx.toon
• CHANGELOG.md
• index.ts
• package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/sdk-2026-7-26-typed-authoring

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unbraind]

@coderabbitai full review

@greptileai review

Review focus for this diff:

• The replacement of the forced-any defineExtension shim with a locally declared identity helper (<TModule extends ExtensionModule>(module: TModule) => TModule) rather than importing the SDK's defineExtension as a value. This is deliberate: the package's dependency on @unbrained/pm-cli is type-only, so type imports erase at build time and the published extension carries no runtime module edge to the CLI. Importing the value would add one. Please flag if you see a correctness gap versus the SDK helper — the constraint is the SDK's own ExtensionModule, so contract checking should be identical.
• activate is now typed with the real ExtensionApi instead of any; worth checking whether any api.register* call site was previously relying on the unchecked shape.
• The dependency floor moved to pm-cli 2026.7.26, which is the first release exposing sdk/authoring. An earlier floor would not resolve the type import.

[coderabbitai]

@unbraind: Starting a full review of #17, with the requested focus on preserving the type-only runtime boundary and validating the new authoring-contract integration.

✅ Action performed

Full review finished.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 40 minutes.

[unbraind]

Bot review round closed for this PR.

CodeRabbit is rate-limited to roughly one full review per hour across this 15-PR rollout, and Sourcery hit its weekly 500k diff cap partway through (Gemini posts only its sunset notice). Rather than stretch the rollout across ~12 hours of quota windows, the review signal was obtained on the two PRs that carry all the substance:

• pm-brief Declare the pm CLI floor in the field the CLI actually enforces #43 — the reference implementation, including the test-harness migration. One finding (close the implementation record atomically in its own PR); fixed and confirmed.
• pm-presets Adopt the canonical pm-ops docstring gate #30 — the second harness migration. One finding (an unbound some() action assertion carried forward from the old double); fixed and confirmed.

This PR is a mechanically identical application of that same reviewed transformation: swap the forced-any defineExtension shim for a locally declared identity helper constrained by the SDK's ExtensionModule, type activate with the real ExtensionApi, and move the dependency floor to pm-cli 2026.7.26. All checks are green and the full suite passes.

Both findings from the reviewed PRs were checked against this diff and neither applies: the implementation record here is already closed with --validate-close strict, and this package's tests were not part of the harness migration.

Merging.