@cogenta/plugins 0.1.0

package/dist/manifest.d.ts

@@ -0,0 +1,93 @@
+/**
+ * `definePlugin` is the only door into the plugin model, mirroring
+ * `defineCollection` (`@cogenta/schema`) — checked eagerly, at import time,
+ * because every later L7 task (worker isolation, SDK capability
+ * translation, the permission screen, signing) trusts this manifest
+ * completely. A mistake caught here costs a restart; the same mistake
+ * caught after a plugin is already granted capabilities costs a
+ * compromised site — 90% of WordPress compromises go through a plugin
+ * (docs/lots/L7-extensibilite.md § Objectif).
+ *
+ * Every issue is collected and reported at once (same reasoning as
+ * `schemaError` in `@cogenta/schema`): fixing a manifest one refusal at a
+ * time is a game of whack-a-mole an author shouldn't have to play.
+ */
+/** One thing wrong with a manifest, located by a dotted path. */
+export interface PluginManifestIssue {
+    readonly path: string;
+    readonly message: string;
+}
+/**
+ * A block a plugin provides outside the frozen contract B vocabulary. The
+ * fallback is part of the SHAPE, not a separate later check: "un bloc sans
+ * fallback est refusé" (docs/lots/L7-extensibilite.md § Manifeste) is a
+ * property of what a block provision IS, not something bolted on after the
+ * fact — carrying it here now avoids a breaking manifest-shape change once
+ * block registration is actually built (a later task).
+ */
+export interface PluginBlockProvision {
+    readonly name: string;
+    /** The vocabulary block (e.g. `prose`) a renderer falls back to when this plugin is absent or its block is unrecognised. */
+    readonly fallback: string;
+}
+/**
+ * What a plugin brings, per "## Ce qu'un plugin peut apporter"
+ * (docs/lots/L7-extensibilite.md, lines 38-46). The manifest example in the
+ * lot doc only shows `tools`/`blocks`/`fields`/`channels`, but the
+ * surrounding prose names drivers, skills and event subscriptions as
+ * equally real things a plugin can provide — those slots are added here
+ * now so a later task doesn't have to widen this shape under a frozen
+ * contract. All optional: a plugin providing nothing new (e.g. a
+ * pure-consumer integration) is a legitimate, empty `provides`.
+ */
+export interface PluginProvides {
+    readonly tools?: readonly string[];
+    readonly blocks?: readonly PluginBlockProvision[];
+    readonly fields?: readonly string[];
+    readonly channels?: readonly string[];
+    readonly drivers?: readonly string[];
+    readonly skills?: readonly string[];
+    readonly eventSubscriptions?: readonly string[];
+}
+export declare const PLUGIN_RUNTIMES: readonly ['server'];
+export type PluginRuntime = (typeof PLUGIN_RUNTIMES)[number];
+export interface PluginManifest {
+    /** npm-scoped or plain package name, e.g. `@auteur/mon-plugin`. */
+    readonly name: string;
+    /** Exact semver, e.g. `1.0.0`. */
+    readonly version: string;
+    /** A semver range this plugin declares compatibility with, e.g. `^1.0.0`. */
+    readonly engine: string;
+    /** Capability strings this plugin requests — see `PLUGIN_CAPABILITY_NAMES`. */
+    readonly capabilities: readonly string[];
+    readonly provides: PluginProvides;
+    readonly runtime: PluginRuntime;
+    /** Whether this plugin runs in an isolated worker (task 3) — which registry it may join is a later task's concern, not this schema's. */
+    readonly isolated: boolean;
+}
+/**
+ * The known plugin capability vocabulary. Grounded in contract C's frozen
+ * tool-permission taxonomy (`docs/04-contrats.md` § "Taxonomie des
+ * permissions": `content.*`, `media.*`, `schema.read`, `site.config_*`,
+ * `deps.*`, `build.trigger`, `deploy.trigger`, `http.fetch`,
+ * `channel.send`, `agent.delegate`, `memory.*`) rather than a parallel
+ * invention — a plugin providing an agent tool declares the same
+ * permission names an agent's own tool manifest already uses. `storage.read`
+ * / `storage.write` are added beyond contract C: plugins get their own
+ * prefix-confined storage (a concept agents' tool taxonomy doesn't need),
+ * and the lot doc's own manifest example (`storage.write:plugins/mon-plugin`)
+ * requires it to exist.
+ */
+export declare const PLUGIN_CAPABILITY_NAMES: readonly ['content.read', 'content.write_draft', 'content.publish', 'content.delete', 'media.read', 'media.write', 'schema.read', 'site.config_read', 'site.config_write', 'deps.scan', 'deps.patch', 'build.trigger', 'deploy.trigger', 'http.fetch', 'storage.read', 'storage.write', 'channel.send', 'agent.delegate', 'memory.read', 'memory.write'];
+export type PluginCapabilityName = (typeof PLUGIN_CAPABILITY_NAMES)[number];
+/**
+ * Validates and freezes a plugin manifest. Every hard-refusal rule the lot
+ * specifies (`docs/lots/L7-extensibilite.md` § Manifeste) is enforced here:
+ * `http.fetch` without an explicit domain, a storage capability outside the
+ * plugin's own prefix, an unknown capability, and a block without a
+ * fallback are all refused with a single, complete error listing every
+ * issue at once — never a partial refusal an author has to rediscover one
+ * `definePlugin` call at a time.
+ */
+export declare function definePlugin(input: PluginManifest): PluginManifest;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4HAA4H;IAC5H,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChD;AAED,eAAO,MAAM,eAAe,YAAI,QAAQ,CAAU,CAAA;AAClD,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5D,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,yIAAyI;IACzI,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,YAClC,cAAc,EACd,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,CACN,CAAA;AACV,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAA;AAiK3E;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAYlE"}

package/dist/manifest.js

@@ -0,0 +1,197 @@
+import { CogentaError } from '@cogenta/core';
+export const PLUGIN_RUNTIMES = ['server'];
+/**
+ * The known plugin capability vocabulary. Grounded in contract C's frozen
+ * tool-permission taxonomy (`docs/04-contrats.md` § "Taxonomie des
+ * permissions": `content.*`, `media.*`, `schema.read`, `site.config_*`,
+ * `deps.*`, `build.trigger`, `deploy.trigger`, `http.fetch`,
+ * `channel.send`, `agent.delegate`, `memory.*`) rather than a parallel
+ * invention — a plugin providing an agent tool declares the same
+ * permission names an agent's own tool manifest already uses. `storage.read`
+ * / `storage.write` are added beyond contract C: plugins get their own
+ * prefix-confined storage (a concept agents' tool taxonomy doesn't need),
+ * and the lot doc's own manifest example (`storage.write:plugins/mon-plugin`)
+ * requires it to exist.
+ */
+export const PLUGIN_CAPABILITY_NAMES = [
+    'content.read',
+    'content.write_draft',
+    'content.publish',
+    'content.delete',
+    'media.read',
+    'media.write',
+    'schema.read',
+    'site.config_read',
+    'site.config_write',
+    'deps.scan',
+    'deps.patch',
+    'build.trigger',
+    'deploy.trigger',
+    'http.fetch',
+    'storage.read',
+    'storage.write',
+    'channel.send',
+    'agent.delegate',
+    'memory.read',
+    'memory.write',
+];
+/**
+ * Capabilities whose string carries a colon-suffixed parameter, per the
+ * lot doc's own example (`http.fetch:api.exemple.com`,
+ * `storage.write:plugins/mon-plugin`) — never a bare name, and never `*`.
+ */
+const PARAMETERIZED_CAPABILITIES = new Set([
+    'http.fetch',
+    'storage.read',
+    'storage.write',
+    'channel.send',
+]);
+const CAPABILITY_NAME_SET = new Set(PLUGIN_CAPABILITY_NAMES);
+/** Table-safe and consistent with how `defineCollection` guards collection names elsewhere in this workspace. */
+const PACKAGE_NAME_PATTERN = /^(@[a-z0-9-]+\/)?[a-z0-9-]+$/;
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+/** Deliberately loose: `^1.0.0`, `~1.2.3`, `>=1.0.0 <2.0.0`, or a bare `1.0.0`. */
+const SEMVER_RANGE_PATTERN = /^[\^~]?\d+\.\d+\.\d+.*$/;
+/** A real hostname shape — no wildcard, no scheme, no path. */
+const HOSTNAME_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i;
+/** The storage prefix a plugin's own capability grants — `plugins/<derived-name>`, scope stripped. */
+function expectedStoragePrefix(pluginName) {
+    const derived = pluginName.includes('/')
+        ? (pluginName.split('/').at(-1) ?? pluginName)
+        : pluginName;
+    return `plugins/${derived}`;
+}
+function isWithinOwnPrefix(path, prefix) {
+    return path === prefix || path.startsWith(`${prefix}/`);
+}
+function checkCapability(raw, index, pluginName, issues) {
+    const path = `capabilities[${index}]`;
+    const separatorIndex = raw.indexOf(':');
+    const name = separatorIndex === -1 ? raw : raw.slice(0, separatorIndex);
+    const parameter = separatorIndex === -1 ? undefined : raw.slice(separatorIndex + 1);
+    if (!CAPABILITY_NAME_SET.has(name)) {
+        issues.push({ path, message: `unknown capability "${name}"` });
+        return;
+    }
+    const requiresParameter = PARAMETERIZED_CAPABILITIES.has(name);
+    if (!requiresParameter) {
+        if (parameter !== undefined) {
+            issues.push({ path, message: `"${name}" does not take a parameter, found "${raw}"` });
+        }
+        return;
+    }
+    if (parameter === undefined || parameter.trim() === '') {
+        issues.push({
+            path,
+            message: `"${name}" requires an explicit parameter, e.g. "${name}:example"`,
+        });
+        return;
+    }
+    if (name === 'http.fetch') {
+        if (parameter === '*') {
+            issues.push({ path, message: '"http.fetch" must name an explicit domain, never "*"' });
+        }
+        else if (!HOSTNAME_PATTERN.test(parameter)) {
+            issues.push({
+                path,
+                message: `"http.fetch" parameter "${parameter}" is not a valid hostname`,
+            });
+        }
+        return;
+    }
+    if (name === 'storage.read' || name === 'storage.write') {
+        const prefix = expectedStoragePrefix(pluginName);
+        if (!isWithinOwnPrefix(parameter, prefix)) {
+            issues.push({
+                path,
+                message: `"${name}" must stay within this plugin's own prefix ("${prefix}"), found "${parameter}"`,
+            });
+        }
+        return;
+    }
+    // `channel.send:<channel>` — channel names are a runtime registry
+    // (`@cogenta/channels`'s `createChannelRegistry`), not a fixed set this
+    // schema can enumerate; a non-empty parameter is already checked above.
+}
+function checkProvidesBlocks(blocks, issues) {
+    if (blocks === undefined)
+        return;
+    blocks.forEach((block, index) => {
+        const path = `provides.blocks[${index}]`;
+        if (typeof block.name !== 'string' || block.name.trim() === '') {
+            issues.push({ path: `${path}.name`, message: 'is required' });
+        }
+        if (typeof block.fallback !== 'string' || block.fallback.trim() === '') {
+            issues.push({
+                path: `${path}.fallback`,
+                message: 'is required — a block without a fallback is refused',
+            });
+        }
+    });
+}
+function collectIssues(input) {
+    const issues = [];
+    if (typeof input.name !== 'string' || !PACKAGE_NAME_PATTERN.test(input.name)) {
+        issues.push({
+            path: 'name',
+            message: 'must be a valid package name such as "@auteur/mon-plugin"',
+        });
+    }
+    if (typeof input.version !== 'string' || !SEMVER_PATTERN.test(input.version)) {
+        issues.push({ path: 'version', message: 'must be an exact semver version such as "1.0.0"' });
+    }
+    if (typeof input.engine !== 'string' || !SEMVER_RANGE_PATTERN.test(input.engine)) {
+        issues.push({ path: 'engine', message: 'must be a semver range such as "^1.0.0"' });
+    }
+    if (!PLUGIN_RUNTIMES.includes(input.runtime)) {
+        issues.push({ path: 'runtime', message: `must be one of: ${PLUGIN_RUNTIMES.join(', ')}` });
+    }
+    if (typeof input.isolated !== 'boolean') {
+        issues.push({ path: 'isolated', message: 'is required' });
+    }
+    if (!Array.isArray(input.capabilities)) {
+        issues.push({ path: 'capabilities', message: 'must be an array' });
+    }
+    else {
+        input.capabilities.forEach((capability, index) => {
+            if (typeof capability !== 'string' || capability.trim() === '') {
+                issues.push({ path: `capabilities[${index}]`, message: 'must be a non-empty string' });
+                return;
+            }
+            checkCapability(capability, index, input.name, issues);
+        });
+    }
+    if (input.provides === undefined || typeof input.provides !== 'object') {
+        issues.push({
+            path: 'provides',
+            message: 'is required (an empty object is a valid "provides nothing")',
+        });
+    }
+    else {
+        checkProvidesBlocks(input.provides.blocks, issues);
+    }
+    return issues;
+}
+/**
+ * Validates and freezes a plugin manifest. Every hard-refusal rule the lot
+ * specifies (`docs/lots/L7-extensibilite.md` § Manifeste) is enforced here:
+ * `http.fetch` without an explicit domain, a storage capability outside the
+ * plugin's own prefix, an unknown capability, and a block without a
+ * fallback are all refused with a single, complete error listing every
+ * issue at once — never a partial refusal an author has to rediscover one
+ * `definePlugin` call at a time.
+ */
+export function definePlugin(input) {
+    const issues = collectIssues(input);
+    if (issues.length > 0) {
+        const lines = issues.map((issue) => `  ${issue.path}: ${issue.message}`).join('\n');
+        throw new CogentaError({
+            code: 'PLUGIN_MANIFEST_INVALID',
+            message: `Plugin manifest "${input.name ?? '(unnamed)'}" is not valid:\n${lines}`,
+            hint: 'Fix the fields listed above and try again.',
+            details: { name: input.name, issues },
+        });
+    }
+    return Object.freeze(input);
+}
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAyD5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAQ,CAAU,CAAA;AAkBlD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,cAAc;IACd,qBAAqB;IACrB,iBAAiB;IACjB,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,mBAAmB;IACnB,WAAW;IACX,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,cAAc;IACd,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,cAAc;CACN,CAAA;AAGV;;;;GAIG;AACH,MAAM,0BAA0B,GAAsC,IAAI,GAAG,CAAC;IAC5E,YAAY;IACZ,cAAc;IACd,eAAe;IACf,cAAc;CACf,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAA;AAEjF,iHAAiH;AACjH,MAAM,oBAAoB,GAAG,8BAA8B,CAAA;AAC3D,MAAM,cAAc,GAAG,0DAA0D,CAAA;AACjF,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AACtD,+DAA+D;AAC/D,MAAM,gBAAgB,GAAG,oEAAoE,CAAA;AAE7F,sGAAsG;AACtG,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;QAC9C,CAAC,CAAC,UAAU,CAAA;IACd,OAAO,WAAW,OAAO,EAAE,CAAA;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAc;IACrD,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,eAAe,CACtB,GAAW,EACX,KAAa,EACb,UAAkB,EAClB,MAA6B;IAE7B,MAAM,IAAI,GAAG,gBAAgB,KAAK,GAAG,CAAA;IACrC,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,IAAI,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAA;IACvE,MAAM,SAAS,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;IAEnF,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,IAAI,GAAG,EAAE,CAAC,CAAA;QAC9D,OAAM;IACR,CAAC;IAED,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,GAAG,CAAC,IAA4B,CAAC,CAAA;IAEtF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,uCAAuC,GAAG,GAAG,EAAE,CAAC,CAAA;QACvF,CAAC;QACD,OAAM;IACR,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI;YACJ,OAAO,EAAE,IAAI,IAAI,2CAA2C,IAAI,WAAW;SAC5E,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAA;QACxF,CAAC;aAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,OAAO,EAAE,2BAA2B,SAAS,2BAA2B;aACzE,CAAC,CAAA;QACJ,CAAC;QACD,OAAM;IACR,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAA;QAChD,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,OAAO,EAAE,IAAI,IAAI,iDAAiD,MAAM,cAAc,SAAS,GAAG;aACnG,CAAC,CAAA;QACJ,CAAC;QACD,OAAM;IACR,CAAC;IACD,kEAAkE;IAClE,wEAAwE;IACxE,wEAAwE;AAC1E,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAmD,EACnD,MAA6B;IAE7B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAM;IAChC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,mBAAmB,KAAK,GAAG,CAAA;QACxC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,IAAI,WAAW;gBACxB,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB;IAC1C,MAAM,MAAM,GAA0B,EAAE,CAAA;IAExC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;IAC3D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACpE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;YAC/C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,KAAK,GAAG,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAA;gBACtF,OAAM;YACR,CAAC;YACD,eAAe,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpD,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAqB;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnF,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,oBAAoB,KAAK,CAAC,IAAI,IAAI,WAAW,oBAAoB,KAAK,EAAE;YACjF,IAAI,EAAE,4CAA4C;YAClD,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE;SACtC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC"}

package/dist/permissions/describe.d.ts

@@ -0,0 +1,22 @@
+import { type PluginCapabilityName } from '../manifest.js';
+/** How much trust a capability asks for — drives the extra-confirmation gate. */
+export type PluginCapabilityRisk = 'low' | 'medium' | 'high';
+export interface PluginCapabilityDescription {
+    /** Plain-language French, never a raw identifier fragment. */
+    readonly sentence: string;
+    readonly riskLevel: PluginCapabilityRisk;
+    readonly category: string;
+}
+/**
+ * Translates one exact capability string (e.g. `http.fetch:api.exemple.com`)
+ * into a plain-language description — never the raw `content.write_draft`
+ * shape, only what it means. Throws on a capability outside the known
+ * vocabulary rather than guessing a description for it: an untranslatable
+ * capability is a manifest-validation bug (`../manifest.js` already refuses
+ * it at `definePlugin` time), never something this function should paper
+ * over with a generic sentence.
+ */
+export declare function describeCapability(capability: string): PluginCapabilityDescription;
+/** Every capability name this module can describe — used by `describeCapability`'s own exhaustiveness test. */
+export declare const DESCRIBABLE_CAPABILITY_NAMES: readonly PluginCapabilityName[];
+//# sourceMappingURL=describe.d.ts.map

package/dist/permissions/describe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../src/permissions/describe.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAEnF,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;AAE5D,MAAM,WAAW,2BAA2B;IAC1C,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AA0ID;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,2BAA2B,CAiBlF;AAED,+GAA+G;AAC/G,eAAO,MAAM,4BAA4B,EAAE,SAAS,oBAAoB,EAA4B,CAAA"}

package/dist/permissions/describe.js

@@ -0,0 +1,158 @@
+import { CogentaError } from '@cogenta/core';
+import { PLUGIN_CAPABILITY_NAMES } from '../manifest.js';
+/**
+ * "Écran de permissions en langage clair" (docs/lots/L7-extensibilite.md,
+ * task 7). One real sentence and risk judgment per name in the frozen
+ * vocabulary (`../manifest.js`'s `PLUGIN_CAPABILITY_NAMES`) — no generic
+ * fallback, because a fallback ("ce plugin demande une permission
+ * technique") is exactly the kind of raw-identifier-adjacent non-answer the
+ * acceptance criterion ("aucun identifiant technique brut") exists to rule
+ * out. Risk is a real per-capability judgment, not a formula: destructive or
+ * bypass-review actions (publish, delete, site-wide config write, deploy,
+ * agent delegation, memory write) are `high`; actions confined to the
+ * plugin's own narrow surface or requiring a further human step (draft
+ * writes, dependency patches, storage within one's own prefix) are `medium`
+ * or `low` depending on blast radius.
+ */
+const DESCRIPTIONS = {
+    'content.read': {
+        sentence: 'Ce plugin pourra lire le contenu du site.',
+        riskLevel: 'low',
+        category: 'Contenu',
+    },
+    'content.write_draft': {
+        sentence: 'Ce plugin pourra créer et modifier des brouillons, mais pas publier.',
+        riskLevel: 'low',
+        category: 'Contenu',
+    },
+    'content.publish': {
+        sentence: 'Ce plugin pourra publier du contenu directement, sans validation humaine préalable.',
+        riskLevel: 'high',
+        category: 'Contenu',
+    },
+    'content.delete': {
+        sentence: 'Ce plugin pourra supprimer du contenu du site.',
+        riskLevel: 'high',
+        category: 'Contenu',
+    },
+    'media.read': {
+        sentence: 'Ce plugin pourra consulter les images et fichiers du site.',
+        riskLevel: 'low',
+        category: 'Médias',
+    },
+    'media.write': {
+        sentence: 'Ce plugin pourra ajouter ou modifier des images et fichiers.',
+        riskLevel: 'medium',
+        category: 'Médias',
+    },
+    'schema.read': {
+        sentence: 'Ce plugin pourra consulter la structure du contenu (les types de contenu et leurs champs).',
+        riskLevel: 'low',
+        category: 'Structure',
+    },
+    'site.config_read': {
+        sentence: 'Ce plugin pourra consulter les réglages du site.',
+        riskLevel: 'low',
+        category: 'Réglages',
+    },
+    'site.config_write': {
+        sentence: 'Ce plugin pourra modifier les réglages du site.',
+        riskLevel: 'high',
+        category: 'Réglages',
+    },
+    'deps.scan': {
+        sentence: 'Ce plugin pourra analyser les dépendances du site à la recherche de failles connues.',
+        riskLevel: 'low',
+        category: 'Maintenance',
+    },
+    'deps.patch': {
+        sentence: 'Ce plugin pourra proposer des corrections de dépendances, sous forme de suggestion à valider.',
+        riskLevel: 'medium',
+        category: 'Maintenance',
+    },
+    'build.trigger': {
+        sentence: 'Ce plugin pourra déclencher une reconstruction du site.',
+        riskLevel: 'medium',
+        category: 'Maintenance',
+    },
+    'deploy.trigger': {
+        sentence: 'Ce plugin pourra déclencher une mise en ligne du site.',
+        riskLevel: 'high',
+        category: 'Maintenance',
+    },
+    'http.fetch': {
+        sentence: 'Ce plugin pourra envoyer des données à {param}.',
+        riskLevel: 'medium',
+        category: 'Réseau',
+    },
+    'storage.read': {
+        sentence: 'Ce plugin pourra lire les fichiers qu’il a lui-même stockés.',
+        riskLevel: 'low',
+        category: 'Stockage',
+    },
+    'storage.write': {
+        sentence: 'Ce plugin pourra créer ou modifier les fichiers qu’il stocke pour son propre usage.',
+        riskLevel: 'medium',
+        category: 'Stockage',
+    },
+    'channel.send': {
+        sentence: 'Ce plugin pourra envoyer des messages sur le canal {param} (par exemple Telegram ou Slack).',
+        riskLevel: 'medium',
+        category: 'Canaux',
+    },
+    'agent.delegate': {
+        sentence: 'Ce plugin pourra déléguer des tâches à un agent du site.',
+        riskLevel: 'high',
+        category: 'Agents',
+    },
+    'memory.read': {
+        sentence: 'Ce plugin pourra consulter la mémoire des agents (leurs notes et apprentissages).',
+        riskLevel: 'medium',
+        category: 'Agents',
+    },
+    'memory.write': {
+        sentence: 'Ce plugin pourra modifier la mémoire des agents (leurs notes et apprentissages).',
+        riskLevel: 'high',
+        category: 'Agents',
+    },
+};
+/**
+ * Splits `name` and an optional colon-suffixed parameter the same way
+ * `../manifest.js`'s `checkCapability` does, without re-importing its
+ * private helpers.
+ */
+function splitCapability(capability) {
+    const separatorIndex = capability.indexOf(':');
+    return separatorIndex === -1
+        ? { name: capability, parameter: undefined }
+        : { name: capability.slice(0, separatorIndex), parameter: capability.slice(separatorIndex + 1) };
+}
+/**
+ * Translates one exact capability string (e.g. `http.fetch:api.exemple.com`)
+ * into a plain-language description — never the raw `content.write_draft`
+ * shape, only what it means. Throws on a capability outside the known
+ * vocabulary rather than guessing a description for it: an untranslatable
+ * capability is a manifest-validation bug (`../manifest.js` already refuses
+ * it at `definePlugin` time), never something this function should paper
+ * over with a generic sentence.
+ */
+export function describeCapability(capability) {
+    const { name, parameter } = splitCapability(capability);
+    const entry = DESCRIPTIONS[name];
+    if (entry === undefined) {
+        throw new CogentaError({
+            code: 'PLUGIN_CAPABILITY_REFUSED',
+            message: `No plain-language description exists for capability "${capability}".`,
+            hint: 'This capability is outside the known vocabulary (PLUGIN_CAPABILITY_NAMES) — it should have been refused at definePlugin time.',
+            details: { capability },
+        });
+    }
+    return {
+        sentence: parameter === undefined ? entry.sentence : entry.sentence.replace('{param}', parameter),
+        riskLevel: entry.riskLevel,
+        category: entry.category,
+    };
+}
+/** Every capability name this module can describe — used by `describeCapability`'s own exhaustiveness test. */
+export const DESCRIBABLE_CAPABILITY_NAMES = PLUGIN_CAPABILITY_NAMES;
+//# sourceMappingURL=describe.js.map

package/dist/permissions/describe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.js","sourceRoot":"","sources":["../../src/permissions/describe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,uBAAuB,EAA6B,MAAM,gBAAgB,CAAA;AAYnF;;;;;;;;;;;;;GAaG;AACH,MAAM,YAAY,GAGd;IACF,cAAc,EAAE;QACd,QAAQ,EAAE,2CAA2C;QACrD,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,SAAS;KACpB;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,sEAAsE;QAChF,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,SAAS;KACpB;IACD,iBAAiB,EAAE;QACjB,QAAQ,EAAE,qFAAqF;QAC/F,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,SAAS;KACpB;IACD,gBAAgB,EAAE;QAChB,QAAQ,EAAE,gDAAgD;QAC1D,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,SAAS;KACpB;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,4DAA4D;QACtE,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,QAAQ;KACnB;IACD,aAAa,EAAE;QACb,QAAQ,EAAE,8DAA8D;QACxE,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD,aAAa,EAAE;QACb,QAAQ,EACN,4FAA4F;QAC9F,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,WAAW;KACtB;IACD,kBAAkB,EAAE;QAClB,QAAQ,EAAE,kDAAkD;QAC5D,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,UAAU;KACrB;IACD,mBAAmB,EAAE;QACnB,QAAQ,EAAE,iDAAiD;QAC3D,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,UAAU;KACrB;IACD,WAAW,EAAE;QACX,QAAQ,EACN,sFAAsF;QACxF,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,aAAa;KACxB;IACD,YAAY,EAAE;QACZ,QAAQ,EACN,+FAA+F;QACjG,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,aAAa;KACxB;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,yDAAyD;QACnE,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,aAAa;KACxB;IACD,gBAAgB,EAAE;QAChB,QAAQ,EAAE,wDAAwD;QAClE,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,aAAa;KACxB;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,iDAAiD;QAC3D,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD,cAAc,EAAE;QACd,QAAQ,EAAE,8DAA8D;QACxE,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,UAAU;KACrB;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,qFAAqF;QAC/F,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,UAAU;KACrB;IACD,cAAc,EAAE;QACd,QAAQ,EACN,6FAA6F;QAC/F,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD,gBAAgB,EAAE;QAChB,QAAQ,EAAE,0DAA0D;QACpE,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,QAAQ;KACnB;IACD,aAAa,EAAE;QACb,QAAQ,EAAE,mFAAmF;QAC7F,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD,cAAc,EAAE;QACd,QAAQ,EAAE,kFAAkF;QAC5F,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAA;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9C,OAAO,cAAc,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE;QAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,EAAE,CAAA;AACpG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IACvD,MAAM,KAAK,GAAG,YAAY,CAAC,IAA4B,CAAC,CAAA;IACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,wDAAwD,UAAU,IAAI;YAC/E,IAAI,EAAE,+HAA+H;YACrI,OAAO,EAAE,EAAE,UAAU,EAAE;SACxB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EACN,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;QACzF,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAA;AACH,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,MAAM,4BAA4B,GAAoC,uBAAuB,CAAA"}

package/dist/permissions/disabled.d.ts

@@ -0,0 +1,25 @@
+import { type DatabaseHandle } from '@cogenta/core';
+/** Why a plugin was killed and disabled — the two real policy violations this task enforces, plus a catch-all for any other worker crash. */
+export type PluginViolationReason = 'timeout' | 'memory' | 'crash';
+export interface PluginDisabledRecord {
+    readonly pluginName: string;
+    readonly reason: PluginViolationReason;
+    readonly details: string | null;
+    readonly disabledAt: string;
+}
+export interface PluginDisableStore {
+    /**
+     * "Tué et désactivé" — a plugin that exceeds its time or memory limit does
+     * not just have that one run terminated, it stops being runnable at all
+     * until a human re-enables it. Idempotent: disabling an already-disabled
+     * plugin overwrites the record with the newest violation, it does not
+     * error or accumulate history.
+     */
+    disable(pluginName: string, reason: PluginViolationReason, details?: string): Promise<void>;
+    /** A human decided the plugin is safe to run again. */
+    enable(pluginName: string): Promise<void>;
+    /** The real gate `runPlugin` checks before ever spawning a worker. */
+    isDisabled(pluginName: string): Promise<PluginDisabledRecord | null>;
+}
+export declare function createPluginDisableStore(db: DatabaseHandle, now?: () => number): PluginDisableStore;
+//# sourceMappingURL=disabled.d.ts.map

package/dist/permissions/disabled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disabled.d.ts","sourceRoot":"","sources":["../../src/permissions/disabled.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAmB,MAAM,eAAe,CAAA;AAGpE,6IAA6I;AAC7I,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAA;AAElE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3F,uDAAuD;IACvD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC,sEAAsE;IACtE,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAA;CACrE;AASD,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,cAAc,EAClB,GAAG,GAAE,MAAM,MAAiB,GAC3B,kBAAkB,CA6BpB"}

package/dist/permissions/disabled.js

@@ -0,0 +1,29 @@
+import { identifier, sql } from '@cogenta/core';
+import { PERMISSION_TABLES } from './tables.js';
+export function createPluginDisableStore(db, now = Date.now) {
+    const disabled = identifier(PERMISSION_TABLES.disabled, db.dialect);
+    return {
+        async disable(pluginName, reason, details) {
+            await db.query(sql `delete from ${disabled} where plugin_name = ${pluginName}`);
+            await db.query(sql `
+        insert into ${disabled} (plugin_name, reason, details, disabled_at)
+        values (${pluginName}, ${reason}, ${details ?? null}, ${new Date(now()).toISOString()})`);
+        },
+        async enable(pluginName) {
+            await db.query(sql `delete from ${disabled} where plugin_name = ${pluginName}`);
+        },
+        async isDisabled(pluginName) {
+            const result = await db.query(sql `select * from ${disabled} where plugin_name = ${pluginName}`);
+            const row = result.rows[0];
+            if (row === undefined)
+                return null;
+            return {
+                pluginName: row.plugin_name,
+                reason: row.reason,
+                details: row.details,
+                disabledAt: row.disabled_at,
+            };
+        },
+    };
+}
+//# sourceMappingURL=disabled.js.map

package/dist/permissions/disabled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disabled.js","sourceRoot":"","sources":["../../src/permissions/disabled.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,UAAU,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAoC/C,MAAM,UAAU,wBAAwB,CACtC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAEnE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO;YACvC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,QAAQ,wBAAwB,UAAU,EAAE,CAAC,CAAA;YAC9E,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,QAAQ;kBACZ,UAAU,KAAK,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QAC7F,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,QAAQ,wBAAwB,UAAU,EAAE,CAAC,CAAA;QAChF,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,UAAU;YACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,QAAQ,wBAAwB,UAAU,EAAE,CACjE,CAAA;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAClC,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,MAAM,EAAE,GAAG,CAAC,MAA+B;gBAC3C,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,GAAG,CAAC,WAAW;aAC5B,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/permissions/grants.d.ts

@@ -0,0 +1,22 @@
+import { type DatabaseHandle } from '@cogenta/core';
+/** One user-approved capability for one plugin, keyed to the exact capability string. */
+export interface PluginGrant {
+    readonly pluginName: string;
+    readonly capability: string;
+    readonly grantedAt: string;
+}
+export interface PluginGrantStore {
+    /**
+     * Records that `capability` (the exact string, e.g. `http.fetch:api.exemple.com`)
+     * has been approved for `pluginName`. Not this task's job to decide WHO
+     * gets to call this or through what UI (task 7's permission screen) — this
+     * is the real, minimal data-layer primitive that screen will call.
+     */
+    grant(pluginName: string, capability: string): Promise<void>;
+    /** Revoking an already-unrevoked-or-nonexistent grant is not an error — it's already in the state being asked for. */
+    revoke(pluginName: string, capability: string): Promise<void>;
+    /** Every currently-active (non-revoked) grant for a plugin. */
+    listGrants(pluginName: string): Promise<readonly PluginGrant[]>;
+}
+export declare function createPluginGrantStore(db: DatabaseHandle, now?: () => number): PluginGrantStore;
+//# sourceMappingURL=grants.d.ts.map

package/dist/permissions/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/permissions/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAG3E,yFAAyF;AACzF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE5D,sHAAsH;IACtH,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE7D,+DAA+D;IAC/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAA;CAChE;AAUD,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,cAAc,EAClB,GAAG,GAAE,MAAM,MAAiB,GAC3B,gBAAgB,CAgClB"}

package/dist/permissions/grants.js

@@ -0,0 +1,31 @@
+import { identifier, newId, sql } from '@cogenta/core';
+import { PERMISSION_TABLES } from './tables.js';
+export function createPluginGrantStore(db, now = Date.now) {
+    const grants = identifier(PERMISSION_TABLES.grants, db.dialect);
+    return {
+        async grant(pluginName, capability) {
+            // Re-granting an already-active capability is idempotent, not a
+            // duplicate row — replace rather than accumulate revoked history for
+            // the same exact (plugin, capability) pair still active.
+            await db.query(sql `delete from ${grants} where plugin_name = ${pluginName} and capability = ${capability} and revoked_at is null`);
+            await db.query(sql `
+        insert into ${grants} (id, plugin_name, capability, granted_at, revoked_at)
+        values (${newId(now)}, ${pluginName}, ${capability}, ${new Date(now()).toISOString()}, ${null})`);
+        },
+        async revoke(pluginName, capability) {
+            await db.query(sql `
+        update ${grants} set revoked_at = ${new Date(now()).toISOString()}
+        where plugin_name = ${pluginName} and capability = ${capability} and revoked_at is null`);
+        },
+        async listGrants(pluginName) {
+            const result = await db.query(sql `
+        select * from ${grants} where plugin_name = ${pluginName} and revoked_at is null order by granted_at asc`);
+            return result.rows.map((row) => ({
+                pluginName: row.plugin_name,
+                capability: row.capability,
+                grantedAt: row.granted_at,
+            }));
+        },
+    };
+}
+//# sourceMappingURL=grants.js.map

package/dist/permissions/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/permissions/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAiC/C,MAAM,UAAU,sBAAsB,CACpC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE/D,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU;YAChC,gEAAgE;YAChE,qEAAqE;YACrE,yDAAyD;YACzD,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,eAAe,MAAM,wBAAwB,UAAU,qBAAqB,UAAU,yBAAyB,CACnH,CAAA;YACD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,MAAM;kBACV,KAAK,CAAC,GAAG,CAAC,KAAK,UAAU,KAAK,UAAU,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,GAAG,CAAC,CAAA;QACrG,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,MAAM,qBAAqB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;8BAC3C,UAAU,qBAAqB,UAAU,yBAAyB,CAAC,CAAA;QAC7F,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,UAAU;YACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAW,GAAG,CAAA;wBACzB,MAAM,wBAAwB,UAAU,iDAAiD,CAAC,CAAA;YAC5G,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B,CAAC,CAAC,CAAA;QACL,CAAC;KACF,CAAA;AACH,CAAC"}