@consciousclouds/operator-shell 0.1.0

package/dist/palette/CommandPalette.js

@@ -0,0 +1,108 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * CommandPalette — the shell-owned ⌘K palette over the registry `command`
+ * component (@consciousclouds/ui, cmdk). The shell owns the BEHAVIOR
+ * (keybinding, open/close, filtering, execution); the Flavor owns the
+ * VOCABULARY (nav-derived route commands + inert declared references, see
+ * palette/commands.ts); the product owns the MEANING of non-route commands
+ * through the injected `runCommand` executor — the same injection pattern as
+ * icons and the permission resolver.
+ *
+ * The palette is ALSO the Search surface (the doctrine skeleton's Search
+ * experience): product-injected `searchSources` (see search-sources.ts) run
+ * against the typed text and their results render alongside the command
+ * groups, gated by the SAME fail-closed permission snapshot. An erroring,
+ * in-flight, or absent source contributes nothing. A result's action either
+ * navigates (the palette's own door) or opens the shell-owned inspector by
+ * entity kind — which keeps its own fail-closed gate (an undeclared or
+ * view-less kind refuses to open and the palette simply stays).
+ *
+ * Controlled open state: the frame holds it so the header's search button
+ * and the ⌘K keybinding open the same instance.
+ */
+import * as React from "react";
+import { useRouter } from "next/navigation";
+import { CommandDialog, CommandEmpty, CommandGroup, CommandInput, CommandItem, CommandList, } from "@consciousclouds/ui";
+import { collectPermissionRefs } from "../guard/permissions.js";
+import { usePermissionDecisions } from "../guard/PermissionProvider.js";
+import { resolveIcon } from "../icons/registry.js";
+import { useInspector } from "../inspector/InspectorProvider.js";
+import { derivePaletteGroups } from "./commands.js";
+import { useSearchResults } from "./use-search-results.js";
+export function CommandPalette({ flavor, resolvePermission, icons, iconFamily, runCommand, searchSources, open, onOpenChange, placeholder = "Type a command or search…", }) {
+    const router = useRouter();
+    const inspector = useInspector();
+    // The palette text — controlled so the search sources can see it. Reset on
+    // close: the next open starts commands-only, no stale query.
+    const [query, setQuery] = React.useState("");
+    React.useEffect(() => {
+        if (!open)
+            setQuery("");
+    }, [open]);
+    // The registry ⌘K binding: meta/ctrl+K toggles, anywhere on the document.
+    React.useEffect(() => {
+        const down = (event) => {
+            if (event.key === "k" && (event.metaKey || event.ctrlKey)) {
+                event.preventDefault();
+                onOpenChange(!open);
+            }
+        };
+        document.addEventListener("keydown", down);
+        return () => document.removeEventListener("keydown", down);
+    }, [open, onOpenChange]);
+    // Resolve every gated reference (nav + declared commands + search sources)
+    // through the live seam, then snapshot the decisions into the SYNC lookup
+    // the pure derivations take: allowed passes, loading/denied/absent ⇒
+    // unknown ⇒ denied (fail-closed while an async resolver is still deciding).
+    const permissionRefs = collectPermissionRefs([
+        ...flavor.nav.flatMap((group) => group.items),
+        ...(flavor.commands ?? []).flatMap((group) => group.items),
+        ...(searchSources ?? []),
+    ]);
+    const decisions = usePermissionDecisions(permissionRefs, resolvePermission);
+    const snapshotResolver = (permission) => decisions[permission] === "allowed" ? "allowed" : "unknown";
+    const groups = derivePaletteGroups(flavor, snapshotResolver, Boolean(runCommand));
+    // The Search experience: the injected sources run against the typed text
+    // under the SAME decisions snapshot; in-flight/erroring/absent sources
+    // contribute nothing (use-search-results.ts holds the fail-closed rules).
+    const searchGroups = useSearchResults(searchSources, open ? query : "", decisions);
+    const select = (action) => {
+        // Close first so navigation lands on an unobstructed surface.
+        onOpenChange(false);
+        if (action.kind === "navigate")
+            router.push(action.href);
+        else
+            runCommand?.(action.command);
+    };
+    const selectResult = (action) => {
+        if (action.kind === "navigate") {
+            onOpenChange(false);
+            router.push(action.href);
+            return;
+        }
+        // Inspector door: open FIRST, close only on acceptance — a fail-closed
+        // refusal (undeclared/view-less kind) leaves the palette exactly as it
+        // was (no panel, no crash, no dead-end close).
+        const opened = inspector.open({
+            kind: action.entityKind,
+            entity: action.entity,
+            title: action.title,
+            description: action.description,
+        });
+        if (opened)
+            onOpenChange(false);
+    };
+    return (_jsxs(CommandDialog, { open: open, onOpenChange: onOpenChange, title: "Command palette", description: "Search the console's destinations and commands", children: [_jsx(CommandInput, { placeholder: placeholder, value: query, onValueChange: setQuery }), _jsxs(CommandList, { children: [_jsx(CommandEmpty, { children: "No results found." }), groups.map((group) => (_jsx(CommandGroup, { heading: group.label, children: group.commands.map((command) => {
+                            const Icon = command.icon ? resolveIcon(command.icon, icons, iconFamily) : null;
+                            return (_jsxs(CommandItem, { value: command.label, keywords: command.keywords, onSelect: () => select(command.action), children: [Icon && _jsx(Icon, {}), _jsx("span", { children: command.label })] }, command.id));
+                        }) }, group.id))), searchGroups.map((group) => (_jsx(CommandGroup, { heading: group.label, children: group.results.map((result) => {
+                            const Icon = result.icon ? resolveIcon(result.icon, icons, iconFamily) : null;
+                            return (_jsxs(CommandItem, { value: `${group.id}:${result.id}`, 
+                                // The source already matched these results against the
+                                // typed text (it may match fields cmdk can't see), so pin
+                                // them past cmdk's own filter by including the query.
+                                keywords: [query, result.label, ...(result.keywords ?? [])], onSelect: () => selectResult(result.action), children: [Icon && _jsx(Icon, {}), _jsx("span", { children: result.label })] }, `${group.id}:${result.id}`));
+                        }) }, group.id)))] })] }));
+}
+//# sourceMappingURL=CommandPalette.js.map

package/dist/palette/CommandPalette.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandPalette.js","sourceRoot":"","sources":["../../src/palette/CommandPalette.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EACL,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAqC3D,MAAM,UAAU,cAAc,CAAC,EAC7B,MAAM,EACN,iBAAiB,EACjB,KAAK,EACL,UAAU,EACV,UAAU,EACV,aAAa,EACb,IAAI,EACJ,YAAY,EACZ,WAAW,GAAG,2BAA2B,GACrB;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IAEjC,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC,IAAI;YAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,0EAA0E;IAC1E,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,MAAM,IAAI,GAAG,CAAC,KAAoB,EAAE,EAAE;YACpC,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvB,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC;QACF,QAAQ,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAEzB,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,4EAA4E;IAC5E,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1D,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,sBAAsB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAC5E,MAAM,gBAAgB,GAA2B,CAAC,UAAU,EAAE,EAAE,CAC9D,SAAS,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAElF,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,YAAY,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAEnF,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE;QACvC,8DAA8D;QAC9D,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;;YACpD,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,MAA0B,EAAE,EAAE;QAClD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC;YAC5B,IAAI,EAAE,MAAM,CAAC,UAAU;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,IAAI,MAAM;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO,CACL,MAAC,aAAa,IACZ,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAC,iBAAiB,EACvB,WAAW,EAAC,gDAAgD,aAE5D,KAAC,YAAY,IAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,GAAI,EACjF,MAAC,WAAW,eACV,KAAC,YAAY,oCAAiC,EAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACrB,KAAC,YAAY,IAAgB,OAAO,EAAE,KAAK,CAAC,KAAK,YAC9C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;4BAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;4BAChF,OAAO,CACL,MAAC,WAAW,IAEV,KAAK,EAAE,OAAO,CAAC,KAAK,EACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAC1B,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAErC,IAAI,IAAI,KAAC,IAAI,KAAG,EACjB,yBAAO,OAAO,CAAC,KAAK,GAAQ,KANvB,OAAO,CAAC,EAAE,CAOH,CACf,CAAC;wBACJ,CAAC,CAAC,IAde,KAAK,CAAC,EAAE,CAeZ,CAChB,CAAC,EACD,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC3B,KAAC,YAAY,IAAgB,OAAO,EAAE,KAAK,CAAC,KAAK,YAC9C,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;4BAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;4BAC9E,OAAO,CACL,MAAC,WAAW,IAEV,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,EAAE;gCACjC,uDAAuD;gCACvD,0DAA0D;gCAC1D,sDAAsD;gCACtD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,EAC3D,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,aAE1C,IAAI,IAAI,KAAC,IAAI,KAAG,EACjB,yBAAO,MAAM,CAAC,KAAK,GAAQ,KATtB,GAAG,KAAK,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,EAAE,CAUnB,CACf,CAAC;wBACJ,CAAC,CAAC,IAjBe,KAAK,CAAC,EAAE,CAkBZ,CAChB,CAAC,IACU,IACA,CACjB,CAAC;AACJ,CAAC"}

package/dist/palette/commands.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The palette's pure command derivation. Commands are DECLARATIVE:
+ *
+ *   - Route commands are AUTO-DERIVED from `flavor.nav` — the same tree the
+ *     sidebar renders, so the palette can never disagree with navigation
+ *     (no second route list anywhere, per nav/routes.ts).
+ *   - `flavor.commands` adds inert reference entries (Declarative-Flavor
+ *     law): `href` entries navigate; `command` entries name a reference the
+ *     product's injected runner interprets — and are HIDDEN when no runner
+ *     is injected (fail-closed: a reference nobody interprets cannot
+ *     execute).
+ *   - Every entry passes the SAME permission gate as the sidebar
+ *     (isPermitted — unknown ⇒ denied, contracts §5). The palette is a
+ *     second door to the console; it opens exactly as wide as the first.
+ *
+ * Pure data-in/data-out so the gating behavior is provable without a DOM.
+ */
+import type { OperatorFlavor } from "../flavor/types.js";
+import type { SyncPermissionResolver } from "../guard/permissions.js";
+/** What a selected command does. The palette executes; products never inject functions here. */
+export type PaletteAction = {
+    kind: "navigate";
+    href: string;
+} | {
+    kind: "run";
+    command: string;
+};
+/** One resolved, permitted palette entry. */
+export interface PaletteCommand {
+    id: string;
+    label: string;
+    /** Icon NAME for the shell's icon registry (nav items always carry one). */
+    icon?: string;
+    /** Extra match terms beyond the label. */
+    keywords?: string[];
+    action: PaletteAction;
+}
+/** A rendered palette section. */
+export interface PaletteGroup {
+    id: string;
+    label: string;
+    commands: PaletteCommand[];
+}
+/**
+ * Derive the visible palette groups for a Flavor under a permission
+ * resolver. `hasRunner` reports whether the product injected a `runCommand`
+ * executor — without one, `command`-reference entries are dropped
+ * (fail-closed), while `href` entries remain (the shell itself can navigate).
+ *
+ * The resolver here is SYNC by design (the derivation stays pure/provable):
+ * for an async product resolver, the palette component snapshots the live
+ * decisions from usePermissionDecisions into a sync lookup — an in-flight
+ * (`loading`) decision snapshots to `unknown` ⇒ denied, so the palette is
+ * fail-closed WHILE resolving and the entry appears once allowed (a palette
+ * has no useful loading row; the sidebar carries the visible loading state).
+ */
+export declare function derivePaletteGroups(flavor: OperatorFlavor, resolvePermission: SyncPermissionResolver, hasRunner: boolean): PaletteGroup[];
+//# sourceMappingURL=commands.d.ts.map

package/dist/palette/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/palette/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGtE,gGAAgG;AAChG,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,cAAc,EACtB,iBAAiB,EAAE,sBAAsB,EACzC,SAAS,EAAE,OAAO,GACjB,YAAY,EAAE,CAmChB"}

package/dist/palette/commands.js

@@ -0,0 +1,81 @@
+/**
+ * The palette's pure command derivation. Commands are DECLARATIVE:
+ *
+ *   - Route commands are AUTO-DERIVED from `flavor.nav` — the same tree the
+ *     sidebar renders, so the palette can never disagree with navigation
+ *     (no second route list anywhere, per nav/routes.ts).
+ *   - `flavor.commands` adds inert reference entries (Declarative-Flavor
+ *     law): `href` entries navigate; `command` entries name a reference the
+ *     product's injected runner interprets — and are HIDDEN when no runner
+ *     is injected (fail-closed: a reference nobody interprets cannot
+ *     execute).
+ *   - Every entry passes the SAME permission gate as the sidebar
+ *     (isPermitted — unknown ⇒ denied, contracts §5). The palette is a
+ *     second door to the console; it opens exactly as wide as the first.
+ *
+ * Pure data-in/data-out so the gating behavior is provable without a DOM.
+ */
+import { isPermitted } from "../guard/permissions.js";
+/**
+ * Derive the visible palette groups for a Flavor under a permission
+ * resolver. `hasRunner` reports whether the product injected a `runCommand`
+ * executor — without one, `command`-reference entries are dropped
+ * (fail-closed), while `href` entries remain (the shell itself can navigate).
+ *
+ * The resolver here is SYNC by design (the derivation stays pure/provable):
+ * for an async product resolver, the palette component snapshots the live
+ * decisions from usePermissionDecisions into a sync lookup — an in-flight
+ * (`loading`) decision snapshots to `unknown` ⇒ denied, so the palette is
+ * fail-closed WHILE resolving and the entry appears once allowed (a palette
+ * has no useful loading row; the sidebar carries the visible loading state).
+ */
+export function derivePaletteGroups(flavor, resolvePermission, hasRunner) {
+    const groups = [];
+    // Route commands, straight from the nav tree the sidebar renders.
+    for (const group of flavor.nav) {
+        const commands = group.items
+            .filter((item) => isPermitted(item.requiredPermission, resolvePermission))
+            .map((item) => ({
+            id: `nav:${item.id}`,
+            label: item.label,
+            icon: item.icon,
+            action: { kind: "navigate", href: item.href },
+        }));
+        if (commands.length > 0)
+            groups.push({ id: `nav:${group.id}`, label: group.label, commands });
+    }
+    // Declared commands — additive, same gate, runner-aware.
+    for (const group of flavor.commands ?? []) {
+        const commands = [];
+        for (const item of group.items) {
+            if (!isPermitted(item.requiredPermission, resolvePermission))
+                continue;
+            const action = toAction(item.href, item.command, hasRunner);
+            if (!action)
+                continue;
+            commands.push({
+                id: `cmd:${item.id}`,
+                label: item.label,
+                icon: item.icon,
+                keywords: item.keywords,
+                action,
+            });
+        }
+        if (commands.length > 0)
+            groups.push({ id: `cmd:${group.id}`, label: group.label, commands });
+    }
+    return groups;
+}
+/**
+ * An entry resolves to exactly one action or none: `href` wins if both are
+ * (mis)declared, a `command` reference needs an injected runner, and an
+ * entry with neither is inert misdeclaration — dropped, never guessed at.
+ */
+function toAction(href, command, hasRunner) {
+    if (href)
+        return { kind: "navigate", href };
+    if (command && hasRunner)
+        return { kind: "run", command };
+    return null;
+}
+//# sourceMappingURL=commands.js.map

package/dist/palette/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/palette/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAyBtD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAsB,EACtB,iBAAyC,EACzC,SAAkB;IAElB,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,kEAAkE;IAClE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAqB,KAAK,CAAC,KAAK;aAC3C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;aACzE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE;YACpB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;SAC9C,CAAC,CAAC,CAAC;QACN,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,yDAAyD;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;gBAAE,SAAS;YACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE;gBACpB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CACf,IAAwB,EACxB,OAA2B,EAC3B,SAAkB;IAElB,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/palette/search-sources.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Search sources — the doctrine skeleton's Search experience as a typed
+ * injection seam (frontend-platform-doctrine.md, Operator Platform contract
+ * skeleton: "Search — the platform owns the search surface, invocation, and
+ * result rendering contract; the product fills WHICH sources and scopes are
+ * searchable").
+ *
+ * The split, same as every other slot:
+ *   - The SHELL owns the surface — the ⌘K palette renders source results
+ *     alongside its command groups and executes the selected action.
+ *   - The PRODUCT injects `SearchSource` values through the shell's
+ *     `searchSources` prop (the same injection pattern as icons / the
+ *     permission resolver / `inspectorViews` / `runCommand`) — product code,
+ *     never Flavor logic (a Flavor is inert data; `query` is a function).
+ *   - A source's `query` runs on the PRODUCT'S side of the membrane (its own
+ *     BFF / already-held reads). No transport, URL, or credential ever
+ *     enters this package.
+ *
+ * FAIL-CLOSED, three ways (the palette dual of the inspector's refusal):
+ *   - a source gated by `requiredPermission` that is not explicitly allowed
+ *     under the SAME snapshot the palette's commands gate on is NEVER
+ *     QUERIED (denied/unknown/in-flight resolution ⇒ zero results),
+ *   - an erroring source (rejection or synchronous throw) contributes
+ *     nothing — siblings are unaffected, the palette never crashes,
+ *   - an in-flight source contributes nothing until it resolves (the hook
+ *     in use-search-results.ts enforces this; absent sources trivially
+ *     contribute nothing).
+ *
+ * A result's action is PaletteAction-shaped: `navigate` reuses the palette's
+ * href navigation; `inspect` opens the shell-owned inspector by entity KIND
+ * with an ALREADY-RESOLVED entity (the source fetched it — the inspector
+ * contract's "the opener hands it the entity" rule, and the inspector's own
+ * fail-closed gate still applies: an undeclared or view-less kind refuses).
+ *
+ * This module is PURE (no React): the contract + the query machinery,
+ * provable without a DOM. The React half lives in use-search-results.ts.
+ */
+import type { SyncPermissionResolver } from "../guard/permissions.js";
+/**
+ * What selecting a search result does — PaletteAction-shaped, extended with
+ * the inspector door (the palette executes; sources return data, never
+ * callbacks).
+ */
+export type SearchResultAction = {
+    kind: "navigate";
+    href: string;
+} | {
+    kind: "inspect";
+    /**
+     * Entity-kind REFERENCE — must be Flavor-declared AND have an injected
+     * inspector view, or the open fails closed (no panel, palette stays).
+     */
+    entityKind: string;
+    /** The already-resolved entity the inspector view will present. */
+    entity: unknown;
+    /** Inspector panel title (defaults to the kind reference). */
+    title?: string;
+    /** Optional one-line description under the title. */
+    description?: string;
+};
+/** One result a source returns for a query. Data only — no components, no callbacks. */
+export interface SearchResult {
+    /** Stable id, unique within the source. */
+    id: string;
+    label: string;
+    /** Icon NAME for the shell's icon registry (unknown names fail closed to UNKNOWN_ICON). */
+    icon?: string;
+    /** Extra match terms beyond the label. */
+    keywords?: string[];
+    action: SearchResultAction;
+}
+/**
+ * A product-injected searchable source. `query` is product code (it runs the
+ * product's own reads) — which is exactly why sources arrive through a shell
+ * PROP and never through the Flavor (Declarative-Flavor law: a Flavor holds
+ * no functions).
+ */
+export interface SearchSource {
+    /** Stable source id (unique across the injected set). */
+    id: string;
+    /** The palette group heading its results render under. */
+    label: string;
+    /**
+     * Permission REFERENCE gating the whole source — resolved through the SAME
+     * fail-closed snapshot as the palette's commands: anything but an explicit
+     * `allowed` means the source is never queried.
+     */
+    requiredPermission?: string;
+    /**
+     * The product's search. Receives the trimmed palette text; returns results
+     * already filtered/ranked by the source. A rejection (or throw) makes the
+     * source contribute nothing for that query — never a crash.
+     */
+    query: (text: string) => Promise<SearchResult[]>;
+}
+/** A rendered search section — the source's results under its group label. */
+export interface SearchResultGroup {
+    /** `search:${source.id}` — disjoint from the command groups' `nav:`/`cmd:` namespaces. */
+    id: string;
+    label: string;
+    results: SearchResult[];
+}
+/**
+ * The permission gate, shared with the command derivation: a gated source
+ * passes only on an explicit `allowed` (unknown/denied/in-flight ⇒ dropped —
+ * and a dropped source is never queried, so denial can't even leak timing).
+ */
+export declare function permittedSearchSources(sources: readonly SearchSource[] | undefined, resolvePermission: SyncPermissionResolver): SearchSource[];
+/**
+ * A result is rendered only if it is SHAPED like one — a malformed entry
+ * from a product source is dropped, never guessed at (fail-closed at the
+ * data boundary, same posture as the icon registry's unknown names).
+ */
+export declare function isSearchResult(value: unknown): value is SearchResult;
+/**
+ * Run one query pass across the injected sources — the pure core the palette
+ * hook awaits:
+ *
+ *   - blank text queries NOTHING (the palette starts as commands-only),
+ *   - only permitted sources are queried (fail-closed gate above),
+ *   - each source is independent: an error/throw or an empty/malformed
+ *     answer contributes nothing while siblings still land,
+ *   - group order follows injection order (deterministic rendering).
+ */
+export declare function querySearchSources(sources: readonly SearchSource[] | undefined, text: string, resolvePermission: SyncPermissionResolver): Promise<SearchResultGroup[]>;
+//# sourceMappingURL=search-sources.d.ts.map

package/dist/palette/search-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-sources.d.ts","sourceRoot":"","sources":["../../src/palette/search-sources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGtE;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IACE,IAAI,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;CAClD;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,0FAA0F;IAC1F,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,EAC5C,iBAAiB,EAAE,sBAAsB,GACxC,YAAY,EAAE,CAKhB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CASpE;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,EAC5C,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,sBAAsB,GACxC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAsB9B"}

package/dist/palette/search-sources.js

@@ -0,0 +1,101 @@
+/**
+ * Search sources — the doctrine skeleton's Search experience as a typed
+ * injection seam (frontend-platform-doctrine.md, Operator Platform contract
+ * skeleton: "Search — the platform owns the search surface, invocation, and
+ * result rendering contract; the product fills WHICH sources and scopes are
+ * searchable").
+ *
+ * The split, same as every other slot:
+ *   - The SHELL owns the surface — the ⌘K palette renders source results
+ *     alongside its command groups and executes the selected action.
+ *   - The PRODUCT injects `SearchSource` values through the shell's
+ *     `searchSources` prop (the same injection pattern as icons / the
+ *     permission resolver / `inspectorViews` / `runCommand`) — product code,
+ *     never Flavor logic (a Flavor is inert data; `query` is a function).
+ *   - A source's `query` runs on the PRODUCT'S side of the membrane (its own
+ *     BFF / already-held reads). No transport, URL, or credential ever
+ *     enters this package.
+ *
+ * FAIL-CLOSED, three ways (the palette dual of the inspector's refusal):
+ *   - a source gated by `requiredPermission` that is not explicitly allowed
+ *     under the SAME snapshot the palette's commands gate on is NEVER
+ *     QUERIED (denied/unknown/in-flight resolution ⇒ zero results),
+ *   - an erroring source (rejection or synchronous throw) contributes
+ *     nothing — siblings are unaffected, the palette never crashes,
+ *   - an in-flight source contributes nothing until it resolves (the hook
+ *     in use-search-results.ts enforces this; absent sources trivially
+ *     contribute nothing).
+ *
+ * A result's action is PaletteAction-shaped: `navigate` reuses the palette's
+ * href navigation; `inspect` opens the shell-owned inspector by entity KIND
+ * with an ALREADY-RESOLVED entity (the source fetched it — the inspector
+ * contract's "the opener hands it the entity" rule, and the inspector's own
+ * fail-closed gate still applies: an undeclared or view-less kind refuses).
+ *
+ * This module is PURE (no React): the contract + the query machinery,
+ * provable without a DOM. The React half lives in use-search-results.ts.
+ */
+import { isPermitted } from "../guard/permissions.js";
+/**
+ * The permission gate, shared with the command derivation: a gated source
+ * passes only on an explicit `allowed` (unknown/denied/in-flight ⇒ dropped —
+ * and a dropped source is never queried, so denial can't even leak timing).
+ */
+export function permittedSearchSources(sources, resolvePermission) {
+    if (!sources || sources.length === 0)
+        return [];
+    return sources.filter((source) => isPermitted(source.requiredPermission, resolvePermission));
+}
+/**
+ * A result is rendered only if it is SHAPED like one — a malformed entry
+ * from a product source is dropped, never guessed at (fail-closed at the
+ * data boundary, same posture as the icon registry's unknown names).
+ */
+export function isSearchResult(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const result = value;
+    if (typeof result.id !== "string" || typeof result.label !== "string")
+        return false;
+    const action = result.action;
+    if (typeof action !== "object" || action === null)
+        return false;
+    if (action.kind === "navigate")
+        return typeof action.href === "string";
+    if (action.kind === "inspect")
+        return typeof action.entityKind === "string";
+    return false;
+}
+/**
+ * Run one query pass across the injected sources — the pure core the palette
+ * hook awaits:
+ *
+ *   - blank text queries NOTHING (the palette starts as commands-only),
+ *   - only permitted sources are queried (fail-closed gate above),
+ *   - each source is independent: an error/throw or an empty/malformed
+ *     answer contributes nothing while siblings still land,
+ *   - group order follows injection order (deterministic rendering).
+ */
+export async function querySearchSources(sources, text, resolvePermission) {
+    const trimmed = text.trim();
+    if (trimmed.length === 0)
+        return [];
+    const permitted = permittedSearchSources(sources, resolvePermission);
+    if (permitted.length === 0)
+        return [];
+    const settled = await Promise.all(permitted.map(async (source) => {
+        let results;
+        try {
+            const answer = await source.query(trimmed);
+            results = Array.isArray(answer) ? answer.filter(isSearchResult) : [];
+        }
+        catch {
+            return null; // an erroring source contributes nothing — never a crash
+        }
+        if (results.length === 0)
+            return null;
+        return { id: `search:${source.id}`, label: source.label, results };
+    }));
+    return settled.filter((group) => group !== null);
+}
+//# sourceMappingURL=search-sources.js.map

package/dist/palette/search-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-sources.js","sourceRoot":"","sources":["../../src/palette/search-sources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAqEtD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA4C,EAC5C,iBAAyC;IAEzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAC/B,WAAW,CAAC,MAAM,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,MAAM,GAAG,KAA8B,CAAC;IAC9C,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAiD,CAAC;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;IACvE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA4C,EAC5C,IAAY,EACZ,iBAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACrE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAqC,EAAE;QAChE,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,yDAAyD;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,UAAU,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AAC/E,CAAC"}

package/dist/palette/use-search-results.d.ts

@@ -0,0 +1,4 @@
+import type { PermissionGateStatus } from "../guard/permissions.js";
+import type { SearchResultGroup, SearchSource } from "./search-sources.js";
+export declare function useSearchResults(sources: readonly SearchSource[] | undefined, text: string, decisions: Readonly<Record<string, PermissionGateStatus>>): SearchResultGroup[];
+//# sourceMappingURL=use-search-results.d.ts.map

package/dist/palette/use-search-results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-search-results.d.ts","sourceRoot":"","sources":["../../src/palette/use-search-results.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,oBAAoB,EAA0B,MAAM,yBAAyB,CAAC;AAC5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAG3E,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,EAC5C,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GACxD,iBAAiB,EAAE,CAoCrB"}

package/dist/palette/use-search-results.js

@@ -0,0 +1,51 @@
+"use client";
+/**
+ * The React half of the search-source seam: run the injected sources against
+ * the palette text and hold the CURRENT results — with the fail-closed
+ * in-flight rule enforced here:
+ *
+ *   - while a query pass is in flight, the sources contribute NOTHING (the
+ *     previous pass's results are cleared the moment the text changes — the
+ *     palette never shows results for a query the user is no longer typing),
+ *   - a stale pass (the text moved on before it settled) is DISCARDED, never
+ *     rendered,
+ *   - blank text / no sources ⇒ no query, no results, synchronously.
+ *
+ * Permission gating rides the SAME live decisions map the palette's command
+ * derivation snapshots (usePermissionDecisions state): anything but an
+ * explicit `allowed` on a gated source means it is never queried. The
+ * decisions map is React state with stable identity between settlements, so
+ * it is the correct effect dependency (a per-render closure would not be).
+ */
+import * as React from "react";
+import { permittedSearchSources, querySearchSources } from "./search-sources.js";
+export function useSearchResults(sources, text, decisions) {
+    const [groups, setGroups] = React.useState([]);
+    React.useEffect(() => {
+        // Snapshot the live decisions into the sync gate the pure core takes:
+        // allowed passes; loading/denied/absent ⇒ unknown ⇒ the source is
+        // dropped before it is ever queried (fail-closed while resolving).
+        const snapshot = (permission) => decisions[permission] === "allowed" ? "allowed" : "unknown";
+        // Nothing searchable (blank text / no sources / none permitted) ⇒
+        // nothing rendered, no query fired, no async pass left dangling.
+        if (text.trim().length === 0 ||
+            permittedSearchSources(sources, snapshot).length === 0) {
+            setGroups([]);
+            return;
+        }
+        // In-flight contributes nothing: clear immediately, render on settle.
+        setGroups([]);
+        let stale = false;
+        querySearchSources(sources, text, snapshot).then((next) => {
+            if (!stale)
+                setGroups(next);
+        });
+        // querySearchSources never rejects (per-source errors are absorbed), so
+        // no catch is needed — but staleness still guards the resolution.
+        return () => {
+            stale = true;
+        };
+    }, [sources, text, decisions]);
+    return groups;
+}
+//# sourceMappingURL=use-search-results.js.map

package/dist/palette/use-search-results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-search-results.js","sourceRoot":"","sources":["../../src/palette/use-search-results.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAI/B,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,MAAM,UAAU,gBAAgB,CAC9B,OAA4C,EAC5C,IAAY,EACZ,SAAyD;IAEzD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAsB,EAAE,CAAC,CAAC;IAEpE,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,sEAAsE;QACtE,kEAAkE;QAClE,mEAAmE;QACnE,MAAM,QAAQ,GAA2B,CAAC,UAAU,EAAE,EAAE,CACtD,SAAS,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9D,kEAAkE;QAClE,iEAAiE;QACjE,IACE,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YACxB,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EACtD,CAAC;YACD,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QAED,sEAAsE;QACtE,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACxD,IAAI,CAAC,KAAK;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,wEAAwE;QACxE,kEAAkE;QAElE,OAAO,GAAG,EAAE;YACV,KAAK,GAAG,IAAI,CAAC;QACf,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAE/B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/sidebar/OperatorSidebar.d.ts

@@ -0,0 +1,44 @@
+/**
+ * OperatorSidebar — the shell's nav engine over the open-registry sidebar
+ * primitives (icon-collapsible, per the sidebar-07/sidebar-16 block
+ * patterns). It reads the Flavor: the product-context block from
+ * `flavor.product`, groups/items from `flavor.nav` (string icon names
+ * resolved through the icon registry), and gates items through the injected
+ * permission resolver — fail-closed, with EXPLICIT states (contracts §5):
+ *
+ *   - `allowed` → the item renders,
+ *   - `loading` → a registry SidebarMenuSkeleton holds the slot while an
+ *     async resolver decides (no flash of a link the decision may remove),
+ *   - `denied`/unknown → the item does not exist here (hidden, not disabled —
+ *     a denied destination is not advertised),
+ *   - a group whose gated items all vanish vanishes with them (no orphan
+ *     group labels).
+ *
+ * The shell owns navigation behavior; the product declares the tree.
+ */
+import type * as React from "react";
+import type { OperatorFlavor } from "../flavor/types.js";
+import type { PermissionResolver } from "../guard/permissions.js";
+import type { IconRegistry } from "../icons/registry.js";
+export interface OperatorSidebarProps {
+    flavor: OperatorFlavor;
+    /** The product's permission resolution (§5), sync or async. Fail-closed on unknown. */
+    resolvePermission: PermissionResolver;
+    /** Product icon-vocabulary extensions for the registry. */
+    icons?: IconRegistry;
+    /**
+     * The resolved icon family (the frame reads the Brand's inert
+     * `iconFamily` declaration and resolves it via `resolveIconFamily`).
+     * Absent ⇒ the shipped family — same deterministic default.
+     */
+    iconFamily?: string;
+    /**
+     * Workspace-switcher SLOT (typed seam, INERT until backend PRE-1 — see
+     * OperatorShellProps.workspaceSwitcher and the Flavor's `workspaces`
+     * field). Nothing injected (today: every product) ⇒ nothing renders; the
+     * static product block below stays the whole context chrome.
+     */
+    workspaceSwitcher?: React.ReactNode;
+}
+export declare function OperatorSidebar({ flavor, resolvePermission, icons, iconFamily, workspaceSwitcher, }: OperatorSidebarProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=OperatorSidebar.d.ts.map

package/dist/sidebar/OperatorSidebar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OperatorSidebar.d.ts","sourceRoot":"","sources":["../../src/sidebar/OperatorSidebar.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,KAAK,KAAK,MAAM,OAAO,CAAC;AAkBpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIzD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,cAAc,CAAC;IACvB,uFAAuF;IACvF,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,2DAA2D;IAC3D,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CACrC;AAED,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,iBAAiB,EACjB,KAAK,EACL,UAAU,EACV,iBAAiB,GAClB,EAAE,oBAAoB,2CA8EtB"}