Merge pull request #23 from dknauss/codex/fix-pmid-rest-proxy

[codex] Fix PMID imports via REST proxy

Author: dknauss

.planning/ROADMAP.md

@@ -123,6 +123,29 @@ Deferred / demand-gated:
 
 These exports complement the existing metadata-output toggles by giving users tangible bibliography data files they can download and reuse directly.
 
+## Identifier input and metadata-resolution backlog
+
+Future identifier support should be implemented as a resolver layer, not as
+format-specific parser hacks. Each resolver must validate the identifier before
+making outbound requests, use fixed upstream hosts or vetted provider adapters,
+avoid SSRF-prone arbitrary URL fetches, normalize results to CSL-JSON, and keep
+CSL-JSON as the source of truth for save output, exports, JSON-LD, COinS, and
+CSL-JSON script blocks.
+
+| Identifier | Status | Evaluation |
+| --- | --- | --- |
+| **ISBN-10 / ISBN-13** | Planned support | High-value next book/monograph importer. Accept `ISBN:` prefixes plus bare, hyphenated, or spaced ISBNs; validate ISBN-10/ISBN-13 checksums before lookup; evaluate metadata providers and terms before choosing a resolver. |
+| **PMCID** | Planned support | Strong biomedical follow-up to PMID. Resolve through the same authenticated WordPress REST proxy pattern; prefer NCBI-derived CSL/PMID/DOI metadata when available. |
+| **arXiv ID** | Planned support | High-value scholarly preprint importer. Accept modern and legacy arXiv identifiers; resolve through arXiv metadata APIs; map to CSL article/report-ish records while preserving DOI/journal data when present. |
+| **ISSN** | Evaluate | Identifies a serial, not a specific cited work. Useful for journal/periodical enrichment and validation, but should not create a standalone bibliography entry unless paired with article-level metadata. |
+| **URL** | Evaluate | Useful but risky and unreliable. Consider after fixed-host identifiers; require strict timeout, content-type, size, redirect, and allowlist/denylist controls; prefer standards-based metadata (`citation_*`, Open Graph, JSON-LD, COinS) over arbitrary scraping. |
+| **OCLC / WorldCat** | Evaluate | Useful for library/book workflows and edition disambiguation. Needs API/access/licensing review and careful mapping from edition/work records to CSL `book`. |
+| **ORCID** | Evaluate as enrichment only | Identifies people, not publications. Useful for author enrichment and disambiguation in manual/resolved records, but not a standalone citation import path. |
+| **ISRC** | Evaluate niche media support | Identifies sound recordings. Could map to CSL `song`/audio records if a reliable resolver is available; lower priority than scholarly text identifiers. |
+| **ISWC** | Evaluate niche media support | Identifies musical works/compositions. Potentially useful for music scholarship; resolver availability and CSL mapping need investigation. |
+| **ISAN** | Evaluate niche media support | Identifies audiovisual works. Could support film/media bibliographies; requires resolver and CSL `motion_picture`/broadcast mapping review. |
+| **EIDR** | Evaluate niche media support | Identifies movies/TV and related audiovisual assets. Similar to ISAN; useful for media studies if resolver access and metadata quality are acceptable. |
+
 ## Performance hardening track
 
 Grounded in the 2026-04-04 Xdebug/profile review:

CHANGELOG.md

@@ -14,7 +14,7 @@ No changes yet.
 ### Added
 
 - BibLaTeX export is available from the editor exports panel for LaTeX/Biber workflows with full Unicode support.
-- PMID input resolution imports PubMed records through the NCBI Literature Citation Export API.
+- PMID input resolution imports PubMed records through the authenticated WordPress REST proxy to the NCBI/PMC Literature Citation Exporter API.
 - Numeric citation styles now support manual reordering, including visible move controls and keyboard Alt+Arrow movement.
 - New bibliography blocks get style-aware default headings.
 
@@ -23,15 +23,18 @@ No changes yet.
 - Citation mutations now reformat the full bibliography so cached display text, sort order, and metadata stay aligned after edits, deletes, style changes, and structured updates.
 - Sorting now uses explicit style-family dispatch, author-date solo-first ordering, contributor-chain tie-breaks, and numeric no-op ordering where appropriate.
 - OSCOLA users now see an editor notice explaining the current single-list limitation for grouped bibliographies.
+- Readmes and release notes now highlight the 1.2.0 interoperability features, recent 1.1.x accessibility fixes, and ABNT (Associação Brasileira de Normas Técnicas) support targeting NBR 6023:2018.
 
 ### Fixed
 
+- PMID resolution now uses an authenticated WordPress REST proxy so PubMed imports work in browsers despite NCBI's missing CORS headers.
 - Saved citation URL links and block toolbar controls now expose clearer accessible names.
 - Playwright accessibility and Playground smoke tests are more deterministic on GitHub Actions by selecting the block explicitly and serializing tests that share one Playground server.
 
 ### Internal
 
 - Added JS/PHP sort-coordination fixtures, citeproc cross-runner conformance checks, targeted Codecov warning coverage, and locale/lock parity audit tests.
+- Added compact matrix tests for all nine style save semantics, all nine formatter outputs, export ordering for author-date versus numeric styles, and PMID REST proxy regression coverage before tagging 1.2.0.
 
 ## [1.1.1] - 2026-05-07
 
@@ -81,7 +84,7 @@ No changes yet.
 - DOI and BibTeX input parsing via citation-js.
 - Supported formatted citation input for books, articles, chapters, webpages, reviews, and theses.
 - Manual entry with structured fields and per-type validation.
-- Nine citation styles: Chicago Notes-Bibliography (default), Chicago Author-Date, APA 7, MLA 9, Harvard, Vancouver, IEEE, OSCOLA, and ABNT.
+- Nine citation styles: Chicago Notes-Bibliography (default), Chicago Author-Date, APA 7, MLA 9, Harvard, Vancouver, IEEE, OSCOLA, and ABNT (Associação Brasileira de Normas Técnicas) targeting NBR 6023:2018.
 - Automatic alphabetical sorting per style rules.
 - Duplicate detection across paste and manual entry.
 - Static save with semantic HTML (`role="doc-bibliography"`, `<cite>` wrappers, `lang` attributes, and no deprecated bibliography-entry ARIA role in newly saved output).
@@ -137,4 +140,4 @@ No changes yet.
 - The PHPUnit `wp_strip_all_tags()` stub now matches WordPress behavior and no longer collapses whitespace, exposing plain-text rendering bugs more accurately.
 - `jsonld.js` now maps chapter citations with a container title to `isPartOf: { @type: "Book" }`, and maps `review-book` to `Review`.
 - `coins.js` now emits dissertation-specific COinS metadata for thesis citations instead of falling back to the journal format.
-- ABNT formatter normalization now collapses duplicate page markers such as `p. p.` and `p. pp.`.
+- ABNT/NBR 6023:2018 formatter normalization now collapses duplicate page markers such as `p. p.` and `p. pp.`.

README.md

@@ -12,11 +12,11 @@
 
 Named for Jorge Luis Borges (1899–1986), the Argentine writer, essayist, poet, and librarian whose work imagined infinite libraries, invented books, and labyrinths of reference, Borges Bibliography Builder brings that bibliographic spirit to WordPress.
 
-The plugin transforms pasted scholarly references — DOI numbers/URLs, BibTeX entries, and supported formatted citations — into a semantically rich, auto-sorted bibliography with static saved output. Export your work as CSL-JSON, BibTeX, and RIS for Zotero, Mendeley, EndNote, JabRef, BibDesk, and similar tools.
+The plugin transforms pasted scholarly references — DOI numbers/URLs, PubMed/PMID identifiers, BibTeX entries, and supported formatted citations — into a semantically rich, auto-sorted bibliography with static saved output. Export your work as CSL-JSON, BibTeX, BibLaTeX, and RIS for Zotero, Mendeley, EndNote, JabRef, BibDesk, and similar tools.
 
 No shortcodes. No database storage. Static HTML output survives plugin deactivation.
 
-Just write out your citations or paste DOIs and BibTeX code, up to 50 at a time. Easily build a formatted, auto-sorted bibliography in any style.
+Just write out your citations or paste DOIs, PubMed/PMID identifiers, and BibTeX code, up to 50 at a time. Easily build a formatted, auto-sorted bibliography in any supported style.
 
 ## Try it in WordPress Playground
 
@@ -34,14 +34,14 @@ Install the public release from [WordPress.org](https://wordpress.org/plugins/bo
 | Block inserter | Empty-state form | Manual entry |
 |---|---|---|
 | ![](.wordpress-org/screenshot-3.png) | ![](.wordpress-org/screenshot-4.png) | ![](.wordpress-org/screenshot-5.png) |
-| Discover the Bibliography block in the block inserter by searching for "Bibliography." | Paste DOIs, BibTeX entries, or supported citation text into the import form. The sidebar controls citation style, visible heading, and metadata output (JSON-LD, COinS, CSL-JSON). | Switch to Manual Entry to build a citation field by field: Publication Type, Author, Title, Container, Publisher, Year, Pages, DOI, and URL. These fields will be automatically populated from DOIs and pasted input that can be parsed. |
+| Discover the Bibliography block in the block inserter by searching for "Bibliography." | Paste DOIs, PubMed/PMID identifiers, BibTeX entries, or supported citation text into the import form. The sidebar controls citation style, visible heading, and metadata output (JSON-LD, COinS, CSL-JSON). | Switch to Manual Entry to build a citation field by field: Publication Type, Author, Title, Container, Publisher, Year, Pages, DOI, and URL. These fields will be automatically populated from DOIs, PubMed/PMID records, and pasted input that can be parsed. |
 
 ## Installation
 
 1. Upload the plugin files to `/wp-content/plugins/borges-bibliography-builder/`, or install directly through the WordPress plugin screen.
 2. Activate the plugin through the **Plugins** screen in WordPress.
 3. Add the **Bibliography** block to any post or page.
-4. Paste DOI(s), BibTeX entries, or supported citations.
+4. Paste DOI(s), PubMed/PMID identifiers, BibTeX entries, or supported citations.
 
 ## Compatibility
 
@@ -51,30 +51,36 @@ Install the public release from [WordPress.org](https://wordpress.org/plugins/bo
 
 Developer-facing CI/runtime coverage details are listed in the development section below.
 
+## Recent Release Highlights
+
+- **1.2.0** — Adds PubMed/PMID import through an authenticated REST proxy, BibLaTeX export, manual reordering for numeric styles, full-bibliography reformat parity, and compact matrix coverage across all nine styles.
+- **ABNT / NBR 6023:2018** — Brazilian bibliography output is available as **ABNT (Associação Brasileira de Normas Técnicas)** with `pt-BR` defaults and the `Referências` heading.
+- **1.1.x accessibility** — Adds optional Block Accessibility Checks integration and restores visible keyboard focus on editor row actions.
+
 ## Features
 
-- **Multiple input paths** — Add bare DOIs, DOI URLs, BibTeX entries, and supported formatted citations.
-- **Nine citation styles** — Chicago Notes-Bibliography by default, with Chicago Author-Date, APA 7, Harvard, Vancouver, IEEE, MLA 9, OSCOLA, and ABNT selectable.
+- **Multiple input paths** — Add bare DOIs, DOI URLs, PubMed/PMID records, BibTeX entries, and supported formatted citations.
+- **Nine citation styles** — Chicago Notes-Bibliography by default, with Chicago Author-Date, APA 7, Harvard, Vancouver, IEEE, MLA 9, OSCOLA, and **ABNT (Associação Brasileira de Normas Técnicas / NBR 6023:2018)** selectable.
 - **Structured editing** — Plain-text editing plus per-field editing for heuristic or warning-marked citations.
 - **Semantic output** — `role="doc-bibliography"`, `<cite>` wrappers, `lang` attributes, and hanging-indent styling without deprecated bibliography-entry ARIA roles.
 - **JSON-LD** — Schema.org structured data for search engines, AI systems, and semantic consumers (on by default).
 - **COinS** — Optional OpenURL spans for browser-based citation manager detection, especially Zotero and legacy OpenURL workflows.
 - **CSL-JSON output** — Optional machine-readable metadata for citation-manager, citeproc, and scholarly-service interoperability.
-- **Export** — Download the current bibliography as CSL-JSON, UTF-8 BibTeX, or RIS; copy individual citations or the full bibliography as plain text.
+- **Export** — Download the current bibliography as CSL-JSON, UTF-8 BibTeX, BibLaTeX, or RIS; copy individual citations or the full bibliography as plain text.
 - **Static save** — Bibliography HTML and metadata are baked into post content at save time.
 - **Accessible editor UX** — Focus management, block-local Gutenberg notices, keyboard escape/cancel flows, and row action controls.
 - **Translation-ready interface** — strings use the `borges-bibliography-builder` text domain; WordPress.org publishes language packs as community translations are approved. (See **Language Support** below.)
 
 ## Reference Manager Compatibility
 
-Borges is reference-manager-friendly by design. It outputs portable CSL-JSON, BibTeX, RIS, DOI links, Schema.org JSON-LD, and optional COinS metadata so your bibliographies can be imported directly into the most widely used bibliography management and academic publishing software.
+Borges is reference-manager-friendly by design. It outputs portable CSL-JSON, BibTeX, BibLaTeX, RIS, DOI links, Schema.org JSON-LD, and optional COinS metadata so your bibliographies can be imported directly into the most widely used bibliography management and academic publishing software.
 
 | Tool or workflow | How Borges supports it |
 |---|---|
 | **Zotero** | Strong compatibility through DOI links, BibTeX, RIS, CSL-JSON, and optional COinS metadata. Tested with the [@zotero](https://github.com/zotero) SaaS, macOS app, and Chrome browser extension from [@digitalscholar](https://github.com/digitalscholar). |
 | **Mendeley** | Compatible with Elsevier's [@Mendeley](https://github.com/Mendeley) SaaS, macOS app, and Chrome browser extension through BibTeX/RIS exports; DOI-backed entries are also browser-importer friendly. Use export/copy actions for non-DOI entries rather than relying on extension autodetection. |
 | **EndNote** | Compatible through RIS and BibTeX imports. EndNote XML is deferred as a Borges export format unless user feedback and/or future testing show a practical gap that RIS and BibTeX do not cover. |
-| **JabRef, BibDesk, LaTeX** | Compatible through UTF-8 BibTeX exports; BibLaTeX support is on the roadmap. |
+| **JabRef, BibDesk, LaTeX** | Compatible through UTF-8 BibTeX and BibLaTeX exports for BibTeX/Biber and LaTeX-family workflows. |
 | **CSL / citeproc tools** | Compatible through CSL-JSON, which is the plugin's canonical structured data model. |
 
 ## Language Support
@@ -89,6 +95,7 @@ This repository/package currently includes seed PO/MO files for translator revie
 
 - **Bare DOI** — `10.1000/xyz123`
 - **DOI URL** — `https://doi.org/10.1000/xyz123`
+- **PubMed/PMID** — `PMID:26673779` or `pmid:26673779`, resolved through the authenticated WordPress REST proxy
 - **BibTeX** — `@article{key, title={...}, ...}`
 
 ### Supported Formatted Citation Coverage
@@ -155,15 +162,29 @@ GET /wp-json/bibliography/v1/posts/<post_id>/bibliographies/<index>
 
 The separate editor-only formatter endpoint accepts `POST /wp-json/bibliography/v1/format`, requires `edit_posts`, and returns formatted citation text for submitted CSL-JSON. It does not save changes.
 
+The editor-only PubMed resolver accepts `GET /wp-json/bibliography/v1/pmid/<pmid>`, requires `edit_posts`, validates the PMID as numeric input, and returns normalized CSL-JSON from the fixed NCBI/PMC citation exporter endpoint. It is used for pasted `PMID:` input and does not persist citations by itself.
+
 ## External Services
 
-This plugin connects to the [CrossRef REST API](https://api.crossref.org/) when you paste a DOI to resolve citation metadata. No account or API key is required. Requests are made only when you explicitly add a DOI in the block editor — no data is sent automatically or in the background.
+This plugin connects to fixed scholarly metadata services only when you explicitly add an identifier in the block editor — no citation data is sent automatically or in the background. No account or API key is required for the supported DOI or PMID lookups.
+
+### DOI metadata
+
+DOI input connects to the [CrossRef REST API](https://api.crossref.org/) to resolve citation metadata.
 
 - [CrossRef](https://www.crossref.org/)
 - [CrossRef REST API documentation](https://api.crossref.org/swagger-ui/index.html)
 - [CrossRef privacy policy](https://www.crossref.org/privacy/)
 - [CrossRef terms of service](https://www.crossref.org/terms/)
 
+### PubMed/PMID metadata
+
+PubMed/PMID input connects through the plugin's authenticated WordPress REST proxy to the [NCBI/PMC Literature Citation Exporter](https://pmc.ncbi.nlm.nih.gov/api/ctxp/) CSL endpoint. The proxy uses a fixed upstream host and validates the PMID before making the outbound request.
+
+- [NCBI APIs](https://www.ncbi.nlm.nih.gov/home/develop/api/)
+- [NCBI/PMC Literature Citation Exporter](https://pmc.ncbi.nlm.nih.gov/api/ctxp/)
+- [NLM Web Policies](https://www.nlm.nih.gov/web_policies.html)
+
 ## Development
 
 Requires Node.js 18+, npm 9+, and Composer.