SDK defineCommand accepts misspelled keys and widens the command name, contrary to the Authoring Builders guide #1539

Version: 2026.10.21, @unbrained/pm-cli/sdk, TypeScript 5.9 --strict.

docs/SDK.md § Authoring Builders makes two promises:

• wrapping a definition in a builder "checks the object against the contract and preserves the narrow literal types";
• the defineCommand example's comment says "the literal name/action are preserved".

defineCommand does neither. Misspelled metadata keys compile cleanly, and command.name widens to string.

Repro

mkdir probe && cd probe && npm init -y >/dev/null && npm pkg set type=module
npm i --save-exact @unbrained/pm-cli@2026.10.21 typescript@5.9.3 @types/node@22
cat > probe.ts <<'TS'
import { defineCommand } from '@unbrained/pm-cli/sdk';
const command = defineCommand({
  name: 'probe ping',
  descripton: 'typo',            // misspelled description
  read_ouput: { row_keys: [] },  // misspelled read_output
  run: () => ({ ok: true }),
});
const literal: 'probe ping' = command.name;
void literal;
TS
npx tsc --noEmit --strict --skipLibCheck --module NodeNext --moduleResolution NodeNext --target ES2022 probe.ts

Observed

• Without the last two lines, tsc exits 0 with no diagnostics. Both typo keys are accepted. The activation harness also registers the command, and the registration has no description.
• With them, tsc reports TS2322: Type 'string' is not assignable to type '"probe ping"'.

Expected

A fresh object literal passed to defineCommand should:

• reject unknown keys, as defineFlag and the other object builders do according to the same section;
• keep name and action as literal types, for example through a const type parameter plus an exact-keys constraint.

If permissive command metadata is intentional, document an explicit escape hatch and correct the guide. Both behaviours could be tested through the public package entrypoint.

Why it matters for agents

Agents write extensions from the guide. A silently ignored descripton produces commands with no help text, and the misspelling is only noticed at runtime.