@cogenta/plugins 0.1.0

package/dist/permissions/resolve.d.ts

@@ -0,0 +1,47 @@
+import type { PluginManifest } from '../manifest.js';
+import type { PluginGrant } from './grants.js';
+/**
+ * "Traduction capacités → objet SDK, avec absence des méthodes non
+ * accordées" (docs/lots/L7-extensibilite.md, task 5) — the real reconciliation
+ * between what a manifest DECLARES (task 1) and what has actually been
+ * APPROVED (`./grants.js`). The result is the INTERSECTION of the two, by
+ * exact capability string:
+ *
+ *   - A grant for a capability the current manifest no longer declares is
+ *     excluded (a stale grant left over from an old manifest version never
+ *     leaks through).
+ *   - A declared-but-never-granted capability is excluded (nothing is
+ *     granted just because a plugin asked for it).
+ *   - `http.fetch:api.exemple.com` being granted does NOT cover
+ *     `http.fetch:evil.com` even though both share the bare name
+ *     `http.fetch` — grants are exact-string, never prefix- or
+ *     name-matched.
+ *
+ * This is the ONLY list that may ever reach `buildSdk`
+ * (`../guest/sandbox-entry.mjs` via `runIsolated`'s `grantedCapabilities`
+ * option) — never the manifest's raw `capabilities` array, and never a
+ * caller-supplied list task 4 originally accepted as a placeholder.
+ */
+export declare function resolveGrantedCapabilities(manifest: PluginManifest, grants: readonly PluginGrant[]): readonly string[];
+/**
+ * "## Les mises à jour de plugins" (docs/lots/L7-extensibilite.md, lines
+ * 192-193, quoted in full): "Une nouvelle version demandant plus de
+ * permissions ne doit **jamais** s'installer automatiquement. Nouvelle
+ * approbation exigée."
+ *
+ * Chosen operational semantics: the new manifest version MAY be resolved and
+ * run immediately (it is not blocked from activating) — but
+ * `resolveGrantedCapabilities` above already, structurally, excludes any
+ * capability the grant store has no exact-string row for. A capability the
+ * new manifest declares for the first time therefore has no matching grant
+ * yet and is silently absent from the SDK (task 4's "absent, not refused"
+ * property) until someone calls `PluginGrantStore.grant` for it — there is
+ * no separate "block activation" state machine to build, because the
+ * reconciliation function itself already never auto-grants. This function
+ * exists to make that property VISIBLE and TESTABLE as its own concern (a
+ * permission screen, task 7, needs exactly this list to prompt the user for
+ * fresh approval), not to add a second enforcement mechanism alongside
+ * `resolveGrantedCapabilities`.
+ */
+export declare function detectCapabilitiesNeedingApproval(newManifest: PluginManifest, previouslyGrantedCapabilities: readonly string[]): readonly string[];
+//# sourceMappingURL=resolve.d.ts.map

package/dist/permissions/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/permissions/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,SAAS,WAAW,EAAE,GAC7B,SAAS,MAAM,EAAE,CAKnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,cAAc,EAC3B,6BAA6B,EAAE,SAAS,MAAM,EAAE,GAC/C,SAAS,MAAM,EAAE,CAGnB"}

package/dist/permissions/resolve.js

@@ -0,0 +1,51 @@
+/**
+ * "Traduction capacités → objet SDK, avec absence des méthodes non
+ * accordées" (docs/lots/L7-extensibilite.md, task 5) — the real reconciliation
+ * between what a manifest DECLARES (task 1) and what has actually been
+ * APPROVED (`./grants.js`). The result is the INTERSECTION of the two, by
+ * exact capability string:
+ *
+ *   - A grant for a capability the current manifest no longer declares is
+ *     excluded (a stale grant left over from an old manifest version never
+ *     leaks through).
+ *   - A declared-but-never-granted capability is excluded (nothing is
+ *     granted just because a plugin asked for it).
+ *   - `http.fetch:api.exemple.com` being granted does NOT cover
+ *     `http.fetch:evil.com` even though both share the bare name
+ *     `http.fetch` — grants are exact-string, never prefix- or
+ *     name-matched.
+ *
+ * This is the ONLY list that may ever reach `buildSdk`
+ * (`../guest/sandbox-entry.mjs` via `runIsolated`'s `grantedCapabilities`
+ * option) — never the manifest's raw `capabilities` array, and never a
+ * caller-supplied list task 4 originally accepted as a placeholder.
+ */
+export function resolveGrantedCapabilities(manifest, grants) {
+    const grantedSet = new Set(grants.filter((grant) => grant.pluginName === manifest.name).map((grant) => grant.capability));
+    return manifest.capabilities.filter((capability) => grantedSet.has(capability));
+}
+/**
+ * "## Les mises à jour de plugins" (docs/lots/L7-extensibilite.md, lines
+ * 192-193, quoted in full): "Une nouvelle version demandant plus de
+ * permissions ne doit **jamais** s'installer automatiquement. Nouvelle
+ * approbation exigée."
+ *
+ * Chosen operational semantics: the new manifest version MAY be resolved and
+ * run immediately (it is not blocked from activating) — but
+ * `resolveGrantedCapabilities` above already, structurally, excludes any
+ * capability the grant store has no exact-string row for. A capability the
+ * new manifest declares for the first time therefore has no matching grant
+ * yet and is silently absent from the SDK (task 4's "absent, not refused"
+ * property) until someone calls `PluginGrantStore.grant` for it — there is
+ * no separate "block activation" state machine to build, because the
+ * reconciliation function itself already never auto-grants. This function
+ * exists to make that property VISIBLE and TESTABLE as its own concern (a
+ * permission screen, task 7, needs exactly this list to prompt the user for
+ * fresh approval), not to add a second enforcement mechanism alongside
+ * `resolveGrantedCapabilities`.
+ */
+export function detectCapabilitiesNeedingApproval(newManifest, previouslyGrantedCapabilities) {
+    const previouslyGranted = new Set(previouslyGrantedCapabilities);
+    return newManifest.capabilities.filter((capability) => !previouslyGranted.has(capability));
+}
+//# sourceMappingURL=resolve.js.map

package/dist/permissions/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/permissions/resolve.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAwB,EACxB,MAA8B;IAE9B,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAC9F,CAAA;IACD,OAAO,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,WAA2B,EAC3B,6BAAgD;IAEhD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,6BAA6B,CAAC,CAAA;IAChE,OAAO,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;AAC5F,CAAC"}

package/dist/permissions/review.d.ts

@@ -0,0 +1,50 @@
+import type { PluginManifest } from '../manifest.js';
+import { type PluginCapabilityDescription } from './describe.js';
+import type { PluginGrantStore } from './grants.js';
+/**
+ * "Les permissions sont révisables après installation, et révocables"
+ * (docs/lots/L7-extensibilite.md, task 7's own text — this is task 8's job).
+ * One currently-active grant, already translated via `describeCapability`
+ * (task 7) — never a raw capability string reaching a caller that renders
+ * a review screen.
+ */
+export interface GrantedCapabilityReview {
+    readonly capability: string;
+    readonly description: PluginCapabilityDescription;
+    readonly grantedAt: string;
+}
+/**
+ * The real listing this task builds: every currently-active grant for
+ * `pluginName`, translated. Reuses `PluginGrantStore.listGrants` (task 5)
+ * and `describeCapability` (task 7) as-is — no new persistence, no new
+ * translation table.
+ */
+export declare function listGrantedCapabilities(pluginName: string, grantStore: PluginGrantStore): Promise<readonly GrantedCapabilityReview[]>;
+/**
+ * Revokes `capability` for `pluginName` and reports whether it is now
+ * genuinely absent from the plugin's SDK — not merely "marked revoked in a
+ * table somewhere". Callers that only need the write can call
+ * `PluginGrantStore.revoke` directly; this wrapper exists for the one place
+ * that needs the end-to-end confirmation (a UI action that wants to know
+ * the revocation actually took effect before saying so to the user).
+ */
+export declare function revokeCapability(manifest: PluginManifest, capability: string, grantStore: PluginGrantStore): Promise<{
+    readonly stillGranted: boolean;
+}>;
+/** One capability a manifest update newly declares, not yet approved — translated, with the exact string a caller needs to actually grant it. */
+export interface PendingCapabilityReview {
+    readonly capability: string;
+    readonly description: PluginCapabilityDescription;
+}
+/**
+ * "## Les mises à jour de plugins": `detectCapabilitiesNeedingApproval`
+ * (task 5) already computes WHICH capabilities a new manifest declares
+ * beyond what was previously granted — this is that same list, translated,
+ * for a real "new permissions requested" section next to the plugin's
+ * existing granted-permissions review (never re-approving is the SDK's job,
+ * already handled structurally by `resolveGrantedCapabilities`; this is
+ * only about making the pending set visible to a human, and giving them the
+ * exact capability strings a real approval action needs).
+ */
+export declare function describePendingApproval(newManifest: PluginManifest, grantStore: PluginGrantStore): Promise<readonly PendingCapabilityReview[]>;
+//# sourceMappingURL=review.d.ts.map

package/dist/permissions/review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/permissions/review.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAsB,KAAK,2BAA2B,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,KAAK,EAAe,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAGhE;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAO7C;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAAC;IAAE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;CAAE,CAAC,CAK7C;AAED,iJAAiJ;AACjJ,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAA;CAClD;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,cAAc,EAC3B,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAO7C"}

package/dist/permissions/review.js

@@ -0,0 +1,46 @@
+import { describeCapability } from './describe.js';
+import { detectCapabilitiesNeedingApproval } from './resolve.js';
+/**
+ * The real listing this task builds: every currently-active grant for
+ * `pluginName`, translated. Reuses `PluginGrantStore.listGrants` (task 5)
+ * and `describeCapability` (task 7) as-is — no new persistence, no new
+ * translation table.
+ */
+export async function listGrantedCapabilities(pluginName, grantStore) {
+    const grants = await grantStore.listGrants(pluginName);
+    return grants.map((grant) => ({
+        capability: grant.capability,
+        description: describeCapability(grant.capability),
+        grantedAt: grant.grantedAt,
+    }));
+}
+/**
+ * Revokes `capability` for `pluginName` and reports whether it is now
+ * genuinely absent from the plugin's SDK — not merely "marked revoked in a
+ * table somewhere". Callers that only need the write can call
+ * `PluginGrantStore.revoke` directly; this wrapper exists for the one place
+ * that needs the end-to-end confirmation (a UI action that wants to know
+ * the revocation actually took effect before saying so to the user).
+ */
+export async function revokeCapability(manifest, capability, grantStore) {
+    await grantStore.revoke(manifest.name, capability);
+    const remaining = await grantStore.listGrants(manifest.name);
+    const stillGranted = remaining.some((grant) => grant.capability === capability);
+    return { stillGranted };
+}
+/**
+ * "## Les mises à jour de plugins": `detectCapabilitiesNeedingApproval`
+ * (task 5) already computes WHICH capabilities a new manifest declares
+ * beyond what was previously granted — this is that same list, translated,
+ * for a real "new permissions requested" section next to the plugin's
+ * existing granted-permissions review (never re-approving is the SDK's job,
+ * already handled structurally by `resolveGrantedCapabilities`; this is
+ * only about making the pending set visible to a human, and giving them the
+ * exact capability strings a real approval action needs).
+ */
+export async function describePendingApproval(newManifest, grantStore) {
+    const currentGrants = await grantStore.listGrants(newManifest.name);
+    const pending = detectCapabilitiesNeedingApproval(newManifest, currentGrants.map((grant) => grant.capability));
+    return pending.map((capability) => ({ capability, description: describeCapability(capability) }));
+}
+//# sourceMappingURL=review.js.map

package/dist/permissions/review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.js","sourceRoot":"","sources":["../../src/permissions/review.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAoC,MAAM,eAAe,CAAA;AAEpF,OAAO,EAAE,iCAAiC,EAAE,MAAM,cAAc,CAAA;AAehE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAkB,EAClB,UAA4B;IAE5B,MAAM,MAAM,GAA2B,MAAM,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IAC9E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC;QACjD,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAwB,EACxB,UAAkB,EAClB,UAA4B;IAE5B,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5D,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAA;IAC/E,OAAO,EAAE,YAAY,EAAE,CAAA;AACzB,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAA2B,EAC3B,UAA4B;IAE5B,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,iCAAiC,CAC/C,WAAW,EACX,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAC/C,CAAA;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;AACnG,CAAC"}

package/dist/permissions/tables.d.ts

@@ -0,0 +1,18 @@
+import { type DatabaseHandle } from '@cogenta/core';
+export declare const PERMISSION_TABLES: {
+    readonly grants: 'cogenta_plugin_grants';
+    readonly disabled: 'cogenta_plugin_disabled';
+};
+/**
+ * Owned by `@cogenta/plugins`, following `@cogenta/channels`'s
+ * `ensureChannelTables` pattern exactly (itself following `@cogenta/auth`'s
+ * `ensureAuthTables`): `create table if not exists`, run once at startup, no
+ * separate migration file.
+ *
+ * A grant is keyed to the EXACT capability string (`http.fetch:api.exemple.com`,
+ * not just the bare name `http.fetch`) — task 1's grammar already makes the
+ * parameter part of the capability's identity, so a grant never implicitly
+ * covers a different parameter of the same bare name.
+ */
+export declare function ensurePluginTables(db: DatabaseHandle): Promise<void>;
+//# sourceMappingURL=tables.d.ts.map

package/dist/permissions/tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../../src/permissions/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EAKpB,MAAM,eAAe,CAAA;AAEtB,eAAO,MAAM,iBAAiB;aAC5B,MAAM,EAAE,uBAAuB;aAC/B,QAAQ,EAAE,yBAAyB;CAC3B,CAAA;AAMV;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B1E"}

package/dist/permissions/tables.js

@@ -0,0 +1,48 @@
+import { identifier, sql, unsafeRaw, } from '@cogenta/core';
+export const PERMISSION_TABLES = {
+    grants: 'cogenta_plugin_grants',
+    disabled: 'cogenta_plugin_disabled',
+};
+function textColumn(dialect, length) {
+    return unsafeRaw(dialect === 'sqlite' ? 'text' : `varchar(${length})`);
+}
+/**
+ * Owned by `@cogenta/plugins`, following `@cogenta/channels`'s
+ * `ensureChannelTables` pattern exactly (itself following `@cogenta/auth`'s
+ * `ensureAuthTables`): `create table if not exists`, run once at startup, no
+ * separate migration file.
+ *
+ * A grant is keyed to the EXACT capability string (`http.fetch:api.exemple.com`,
+ * not just the bare name `http.fetch`) — task 1's grammar already makes the
+ * parameter part of the capability's identity, so a grant never implicitly
+ * covers a different parameter of the same bare name.
+ */
+export async function ensurePluginTables(db) {
+    const d = db.dialect;
+    const grants = identifier(PERMISSION_TABLES.grants, d);
+    const t255 = textColumn(d, 255);
+    const t512 = textColumn(d, 512);
+    await db.query(sql `
+    create table if not exists ${grants} (
+      id ${t255} not null primary key,
+      plugin_name ${t255} not null,
+      capability ${t512} not null,
+      granted_at ${t255} not null,
+      revoked_at ${t255}
+    )`);
+    await createIndexIfMissing(db, 'cogenta_plugin_grants_lookup', grants, sql `(plugin_name, capability)`);
+    const disabled = identifier(PERMISSION_TABLES.disabled, d);
+    await db.query(sql `
+    create table if not exists ${disabled} (
+      plugin_name ${t255} not null primary key,
+      reason ${t255} not null,
+      details ${t512},
+      disabled_at ${t255} not null
+    )`);
+}
+async function createIndexIfMissing(db, name, table, columns) {
+    await db
+        .query(sql `create index ${identifier(name, db.dialect)} on ${table} ${columns}`)
+        .catch(() => undefined); // already there — no portable "if not exists" for indexes
+}
+//# sourceMappingURL=tables.js.map

package/dist/permissions/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../src/permissions/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EAEV,GAAG,EACH,SAAS,GACV,MAAM,eAAe,CAAA;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,uBAAuB;IAC/B,QAAQ,EAAE,yBAAyB;CAC3B,CAAA;AAEV,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAc;IAC1D,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAA;AACxE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAkB;IACzD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAA;IACpB,MAAM,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAE/B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,MAAM;WAC5B,IAAI;oBACK,IAAI;mBACL,IAAI;mBACJ,IAAI;mBACJ,IAAI;MACjB,CAAC,CAAA;IAEL,MAAM,oBAAoB,CACxB,EAAE,EACF,8BAA8B,EAC9B,MAAM,EACN,GAAG,CAAA,2BAA2B,CAC/B,CAAA;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC1D,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,QAAQ;oBACrB,IAAI;eACT,IAAI;gBACH,IAAI;oBACA,IAAI;MAClB,CAAC,CAAA;AACP,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,EAAkB,EAClB,IAAY,EACZ,KAAkB,EAClB,OAAoB;IAEpB,MAAM,EAAE;SACL,KAAK,CAAC,GAAG,CAAA,gBAAgB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAC;SAC/E,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA,CAAC,0DAA0D;AACtF,CAAC"}

package/dist/registries/plugins.d.ts

@@ -0,0 +1,74 @@
+import { type DatabaseHandle } from '@cogenta/core';
+export type PluginSubmissionStatus = 'pending' | 'accepted' | 'rejected';
+export interface PluginSubmissionInput {
+    readonly submitterId: string;
+    readonly displayName: string;
+    readonly description?: string;
+    /** Raw manifest input, unvalidated until `submit()` runs it through `definePlugin`. */
+    readonly manifest: unknown;
+    /** Base64 Ed25519 signature over the manifest's canonical content, or `null` for none. */
+    readonly signatureBase64: string | null;
+}
+export interface PluginSubmissionEntry {
+    readonly id: string;
+    readonly submitterId: string;
+    readonly displayName: string;
+    readonly description: string | null;
+    readonly status: PluginSubmissionStatus;
+    /** From the validated manifest — `null` when an automatic gate rejected the submission. */
+    readonly pluginName: string | null;
+    readonly pluginVersion: string | null;
+    /** Set only for an automatic-gate rejection (signature or manifest) — never for a human decision. */
+    readonly rejectionCode: string | null;
+    readonly rejectionReason: string | null;
+    readonly reviewedBy: string | null;
+    readonly reviewedAt: string | null;
+    readonly submittedAt: string;
+}
+export type PluginReviewDecision = 'accept' | 'reject';
+export type PluginReviewResult = {
+    readonly ok: true;
+    readonly entry: PluginSubmissionEntry;
+} | {
+    readonly ok: false;
+    readonly reason: 'not_found';
+} | {
+    readonly ok: false;
+    readonly reason: 'already_decided';
+    readonly entry: PluginSubmissionEntry;
+};
+export interface PluginRegistryOptions {
+    readonly trustedPublicKeys?: readonly string[];
+}
+export interface PluginRegistry {
+    /**
+     * Runs the submission through the lot's own three named gates
+     * ("Signature, manifeste, revue" — docs/lots/L7-extensibilite.md § Registres),
+     * in order:
+     *
+     * (1) **Signature** — checked first, against the raw, not-yet-validated
+     * manifest content. Signature is the more fundamental trust question: a
+     * submission with no valid signature from a trusted registry key is
+     * refused before any structural inspection runs, so an unsigned/untrusted
+     * submission can never use manifest-validation error messages as an
+     * oracle to probe this registry's rules.
+     * (2) **Manifeste** — task 1's real `definePlugin`, unchanged and
+     * unre-implemented: the exact same four hard refusals (unscoped
+     * `http.fetch`, storage outside the plugin's own prefix, unknown
+     * capability, block without `fallback`) plus every structural rule apply
+     * here, identically to a manifest loaded straight off disk.
+     * (3) **Revue** — a submission that clears both automatic gates reaches
+     * `pending`, exactly mirroring the Skills registry's (task 11) two-step
+     * state machine: automatic pre-check necessary but not sufficient, a real
+     * human decision required before acceptance. Plugins execute code — the
+     * one property distinguishing this registry from every other one in the
+     * lot's table — so no registry here is ever automatic-only.
+     */
+    submit(input: PluginSubmissionInput): Promise<PluginSubmissionEntry>;
+    /** A human reviewer's accept/reject decision on a `pending` submission. */
+    review(id: string, decision: PluginReviewDecision, reviewerUserId: string, notes?: string): Promise<PluginReviewResult>;
+    listAccepted(): Promise<readonly PluginSubmissionEntry[]>;
+    get(id: string): Promise<PluginSubmissionEntry | null>;
+}
+export declare function createPluginRegistry(db: DatabaseHandle, options?: PluginRegistryOptions, now?: () => number): PluginRegistry;
+//# sourceMappingURL=plugins.d.ts.map

package/dist/registries/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/registries/plugins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAKzF,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;AAExE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,qGAAqG;IACrG,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEtD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;CACtC,CAAA;AAEL,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC/C;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACpE,2EAA2E;IAC3E,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,oBAAoB,EAC9B,cAAc,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC9B,YAAY,IAAI,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAA;CACvD;AAoCD,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,cAAc,EAClB,OAAO,GAAE,qBAA0B,EACnC,GAAG,GAAE,MAAM,MAAiB,GAC3B,cAAc,CAsHhB"}

package/dist/registries/plugins.js

@@ -0,0 +1,127 @@
+import { CogentaError, identifier, newId, sql } from '@cogenta/core';
+import { definePlugin } from '../manifest.js';
+import { TRUSTED_REGISTRY_PUBLIC_KEYS, verifyContentAgainstTrustedKeys } from '../signing/verify.js';
+import { REGISTRY_TABLES } from './tables.js';
+function toEntry(row) {
+    const status = row.status === 'accepted' ? 'accepted' : row.status === 'pending' ? 'pending' : 'rejected';
+    return {
+        id: row.id,
+        submitterId: row.submitter_id,
+        displayName: row.display_name,
+        description: row.description,
+        status,
+        pluginName: row.plugin_name,
+        pluginVersion: row.plugin_version,
+        rejectionCode: row.rejection_code,
+        rejectionReason: row.rejection_reason,
+        reviewedBy: row.reviewed_by,
+        reviewedAt: row.reviewed_at,
+        submittedAt: row.submitted_at,
+    };
+}
+export function createPluginRegistry(db, options = {}, now = Date.now) {
+    const plugins = identifier(REGISTRY_TABLES.plugins, db.dialect);
+    const trustedPublicKeys = options.trustedPublicKeys ?? TRUSTED_REGISTRY_PUBLIC_KEYS;
+    return {
+        async submit(input) {
+            const id = newId(now);
+            const submittedAt = new Date(now()).toISOString();
+            let status = 'pending';
+            let pluginName = null;
+            let pluginVersion = null;
+            let rejectionCode = null;
+            let rejectionReason = null;
+            const signed = verifyContentAgainstTrustedKeys(input.manifest, input.signatureBase64, trustedPublicKeys);
+            if (!signed) {
+                status = 'rejected';
+                rejectionCode =
+                    input.signatureBase64 === null ? 'PLUGIN_SIGNATURE_MISSING' : 'PLUGIN_SIGNATURE_INVALID';
+                rejectionReason =
+                    input.signatureBase64 === null
+                        ? `The plugin "${input.displayName}" was submitted with no signature.`
+                        : `The plugin "${input.displayName}" has no valid signature from a trusted registry key.`;
+            }
+            else {
+                try {
+                    const manifest = definePlugin(input.manifest);
+                    pluginName = manifest.name;
+                    pluginVersion = manifest.version;
+                }
+                catch (error) {
+                    status = 'rejected';
+                    rejectionCode = error instanceof CogentaError ? error.code : 'PLUGIN_MANIFEST_INVALID';
+                    rejectionReason = error instanceof Error ? error.message : String(error);
+                }
+            }
+            const description = input.description ?? null;
+            await db.query(sql `
+        insert into ${plugins}
+          (id, submitter_id, display_name, description, plugin_name, plugin_version,
+           status, rejection_code, rejection_reason, reviewed_by, reviewed_at, submitted_at)
+        values
+          (${id}, ${input.submitterId}, ${input.displayName}, ${description},
+           ${pluginName}, ${pluginVersion}, ${status}, ${rejectionCode}, ${rejectionReason},
+           ${null}, ${null}, ${submittedAt})`);
+            return {
+                id,
+                submitterId: input.submitterId,
+                displayName: input.displayName,
+                description,
+                status,
+                pluginName,
+                pluginVersion,
+                rejectionCode,
+                rejectionReason,
+                reviewedBy: null,
+                reviewedAt: null,
+                submittedAt,
+            };
+        },
+        async review(id, decision, reviewerUserId, notes) {
+            const result = await db.query(sql `
+        select id, submitter_id, display_name, description, plugin_name, plugin_version, status,
+               rejection_code, rejection_reason, reviewed_by, reviewed_at, submitted_at
+        from ${plugins} where id = ${id}`);
+            const row = result.rows[0];
+            if (row === undefined)
+                return { ok: false, reason: 'not_found' };
+            const current = toEntry(row);
+            if (current.status !== 'pending')
+                return { ok: false, reason: 'already_decided', entry: current };
+            const reviewedAt = new Date(now()).toISOString();
+            const nextStatus = decision === 'accept' ? 'accepted' : 'rejected';
+            const rejectionReason = decision === 'reject' ? (notes ?? null) : null;
+            await db.query(sql `
+        update ${plugins}
+        set status = ${nextStatus}, rejection_reason = ${rejectionReason},
+            reviewed_by = ${reviewerUserId}, reviewed_at = ${reviewedAt}
+        where id = ${id}`);
+            return {
+                ok: true,
+                entry: {
+                    ...current,
+                    status: nextStatus,
+                    rejectionReason,
+                    reviewedBy: reviewerUserId,
+                    reviewedAt,
+                },
+            };
+        },
+        async listAccepted() {
+            const result = await db.query(sql `
+        select id, submitter_id, display_name, description, plugin_name, plugin_version, status,
+               rejection_code, rejection_reason, reviewed_by, reviewed_at, submitted_at
+        from ${plugins} where status = 'accepted' order by submitted_at asc`);
+            return result.rows.map(toEntry);
+        },
+        async get(id) {
+            const result = await db.query(sql `
+        select id, submitter_id, display_name, description, plugin_name, plugin_version, status,
+               rejection_code, rejection_reason, reviewed_by, reviewed_at, submitted_at
+        from ${plugins} where id = ${id}`);
+            const row = result.rows[0];
+            return row === undefined ? null : toEntry(row);
+        },
+    };
+}
+//# sourceMappingURL=plugins.js.map

package/dist/registries/plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../../src/registries/plugins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAuB,MAAM,gBAAgB,CAAA;AAClE,OAAO,EAAE,4BAA4B,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAA;AACpG,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAiG7C,SAAS,OAAO,CAAC,GAAc;IAC7B,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;IAC5F,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM;QACN,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,eAAe,EAAE,GAAG,CAAC,gBAAgB;QACrC,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,WAAW,EAAE,GAAG,CAAC,YAAY;KAC9B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,EAAkB,EAClB,OAAO,GAA0B,EAAE,EACnC,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,4BAA4B,CAAA;IAEnF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAEjD,IAAI,MAAM,GAA2B,SAAS,CAAA;YAC9C,IAAI,UAAU,GAAkB,IAAI,CAAA;YACpC,IAAI,aAAa,GAAkB,IAAI,CAAA;YACvC,IAAI,aAAa,GAAkB,IAAI,CAAA;YACvC,IAAI,eAAe,GAAkB,IAAI,CAAA;YAEzC,MAAM,MAAM,GAAG,+BAA+B,CAC5C,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,eAAe,EACrB,iBAAiB,CAClB,CAAA;YAED,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,UAAU,CAAA;gBACnB,aAAa;oBACX,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,CAAA;gBAC1F,eAAe;oBACb,KAAK,CAAC,eAAe,KAAK,IAAI;wBAC5B,CAAC,CAAC,eAAe,KAAK,CAAC,WAAW,oCAAoC;wBACtE,CAAC,CAAC,eAAe,KAAK,CAAC,WAAW,uDAAuD,CAAA;YAC/F,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAA0B,CAAC,CAAA;oBAC/D,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAA;oBAC1B,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAA;gBAClC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,GAAG,UAAU,CAAA;oBACnB,aAAa,GAAG,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAA;oBACtF,eAAe,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBAC1E,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAA;YAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,OAAO;;;;aAIhB,EAAE,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,KAAK,WAAW;aAC9D,UAAU,KAAK,aAAa,KAAK,MAAM,KAAK,aAAa,KAAK,eAAe;aAC7E,IAAI,KAAK,IAAI,KAAK,WAAW,GAAG,CAAC,CAAA;YAExC,OAAO;gBACL,EAAE;gBACF,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW;gBACX,MAAM;gBACN,UAAU;gBACV,aAAa;gBACb,aAAa;gBACb,eAAe;gBACf,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,WAAW;aACZ,CAAA;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK;YAC9C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAY,GAAG,CAAA;;;eAGnC,OAAO,eAAe,EAAE,EAAE,CAAC,CAAA;YACpC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAEhE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;YAEjE,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAChD,MAAM,UAAU,GAA2B,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;YAC1F,MAAM,eAAe,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAEtE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,OAAO;uBACD,UAAU,wBAAwB,eAAe;4BAC5C,cAAc,mBAAmB,UAAU;qBAClD,EAAE,EAAE,CAAC,CAAA;YAEpB,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACL,GAAG,OAAO;oBACV,MAAM,EAAE,UAAU;oBAClB,eAAe;oBACf,UAAU,EAAE,cAAc;oBAC1B,UAAU;iBACX;aACF,CAAA;QACH,CAAC;QAED,KAAK,CAAC,YAAY;YAChB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAY,GAAG,CAAA;;;eAGnC,OAAO,sDAAsD,CAAC,CAAA;YACvE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAY,GAAG,CAAA;;;eAGnC,OAAO,eAAe,EAAE,EAAE,CAAC,CAAA;YACpC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/registries/skills.d.ts

@@ -0,0 +1,54 @@
+import { type DatabaseHandle } from '@cogenta/core';
+export type SkillSubmissionStatus = 'pending' | 'accepted' | 'rejected';
+export interface SkillSubmissionInput {
+    readonly submitterId: string;
+    readonly displayName: string;
+    readonly description?: string;
+    /** The skill file's raw frontmatter+instructions text, in `parseSkillFile`'s real format. */
+    readonly rawContent: string;
+}
+export interface SkillSubmissionEntry {
+    readonly id: string;
+    readonly submitterId: string;
+    readonly displayName: string;
+    readonly description: string | null;
+    readonly status: SkillSubmissionStatus;
+    /** From the parsed skill's own frontmatter — `null` when the automatic parse pre-check failed. */
+    readonly skillName: string | null;
+    readonly skillVersion: string | null;
+    /** Set only for an automatic parse-failure rejection — never for a human decision. */
+    readonly rejectionCode: string | null;
+    readonly rejectionReason: string | null;
+    readonly reviewedBy: string | null;
+    readonly reviewedAt: string | null;
+    readonly submittedAt: string;
+}
+export type SkillReviewDecision = 'accept' | 'reject';
+export type SkillReviewResult = {
+    readonly ok: true;
+    readonly entry: SkillSubmissionEntry;
+} | {
+    readonly ok: false;
+    readonly reason: 'not_found';
+} | {
+    readonly ok: false;
+    readonly reason: 'already_decided';
+    readonly entry: SkillSubmissionEntry;
+};
+export interface SkillRegistry {
+    /**
+     * Runs the submission through `@cogenta/agents`'s real `parseSkillFile` as
+     * a necessary-but-not-sufficient automatic pre-check: content that doesn't
+     * even parse as a skill file is rejected immediately, with the real parse
+     * error — but content that DOES parse only reaches `pending`, since the
+     * lot's own table requires "Revue de contenu" (human review) for skills,
+     * unlike the Skins gallery's fully automatic gate.
+     */
+    submit(input: SkillSubmissionInput): Promise<SkillSubmissionEntry>;
+    /** A human reviewer's accept/reject decision on a `pending` submission. */
+    review(id: string, decision: SkillReviewDecision, reviewerUserId: string, notes?: string): Promise<SkillReviewResult>;
+    listAccepted(): Promise<readonly SkillSubmissionEntry[]>;
+    get(id: string): Promise<SkillSubmissionEntry | null>;
+}
+export declare function createSkillRegistry(db: DatabaseHandle, now?: () => number): SkillRegistry;
+//# sourceMappingURL=skills.d.ts.map

package/dist/registries/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/registries/skills.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAGzF,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;AAEvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,sFAAsF;IACtF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAErD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAA;AAEpG,MAAM,WAAW,aAAa;IAC5B;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAClE,2EAA2E;IAC3E,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,mBAAmB,EAC7B,cAAc,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7B,YAAY,IAAI,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAA;CACtD;AAoCD,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,cAAc,EAClB,GAAG,GAAE,MAAM,MAAiB,GAC3B,aAAa,CAoGf"}