@knpkv/control-center 0.1.0

package/dist/server/server/plugins/fake/FakePluginProbe.d.ts

@@ -0,0 +1,40 @@
+import * as Effect from "effect/Effect";
+/** Redacted deterministic call captured by the fake adapter. */
+export interface FakePluginCall {
+    readonly operation: string;
+    readonly key: string | null;
+}
+/** Snapshot used by contract tests without exposing mutable fake state. */
+export interface FakePluginProbeSnapshot {
+    readonly calls: ReadonlyArray<FakePluginCall>;
+    readonly providerMutations: number;
+    readonly runtimeAcquisitions: number;
+    readonly runtimeReleases: number;
+}
+/** Test observer for calls, exact-once mutations, and scoped runtime lifecycle. */
+export interface FakePluginProbe {
+    readonly snapshot: Effect.Effect<FakePluginProbeSnapshot>;
+}
+export interface FakePluginProbeControl {
+    readonly probe: FakePluginProbe;
+    readonly recordCall: (operation: string, key?: string | undefined) => Effect.Effect<void>;
+    readonly recordMutation: Effect.Effect<void>;
+    readonly recordAcquisition: Effect.Effect<void>;
+    readonly recordRelease: Effect.Effect<void>;
+}
+/** Construct isolated probe state for one fake connection definition. */
+export declare const makeFakePluginProbe: () => Effect.Effect<{
+    probe: {
+        snapshot: Effect.Effect<{
+            calls: readonly FakePluginCall[];
+            providerMutations: number;
+            runtimeAcquisitions: number;
+            runtimeReleases: number;
+        }, never, never>;
+    };
+    recordCall: (operation: string, key?: string | undefined) => Effect.Effect<void, never, never>;
+    recordMutation: Effect.Effect<void, never, never>;
+    recordAcquisition: Effect.Effect<void, never, never>;
+    recordRelease: Effect.Effect<void, never, never>;
+}, never, never>;
+//# sourceMappingURL=FakePluginProbe.d.ts.map

package/dist/server/server/plugins/fake/FakePluginProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FakePluginProbe.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/fake/FakePluginProbe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,gEAAgE;AAChE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACzF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CAC5C;AAED,yEAAyE;AACzE,eAAO,MAAM,mBAAmB;;;;;;;;;4BAeJ,MAAM,QAAQ,MAAM,GAAG,SAAS;;;;gBAM1D,CAAA"}

package/dist/server/server/plugins/fake/FakePluginScenario.d.ts

@@ -0,0 +1,46 @@
+import type * as Deferred from "effect/Deferred";
+/** One untrusted fake-provider response decoded by the same Schema boundary as a real adapter. */
+export type FakePluginResponse = {
+    readonly _tag: "success";
+    readonly value: unknown;
+} | {
+    readonly _tag: "authentication";
+} | {
+    readonly _tag: "authorization";
+} | {
+    readonly _tag: "rate-limit";
+    readonly retryAt: unknown;
+} | {
+    readonly _tag: "timeout";
+} | {
+    readonly _tag: "malformed";
+    readonly diagnosticCode: string;
+} | {
+    readonly _tag: "outage";
+} | {
+    readonly _tag: "cancellation";
+};
+/** Deterministic latch used to prove in-flight provider effects are interruptible. */
+export interface FakePluginExecutionGate {
+    readonly entered: Deferred.Deferred<void>;
+    readonly release: Deferred.Deferred<void>;
+}
+/** Fully deterministic script for one fake connection runtime. */
+export interface FakePluginScenario {
+    readonly descriptor: unknown;
+    readonly discover: FakePluginResponse;
+    readonly health: FakePluginResponse;
+    readonly sync: Readonly<Record<string, ReadonlyArray<FakePluginResponse>>>;
+    readonly readEntity: FakePluginResponse;
+    readonly proposeAction: FakePluginResponse;
+    readonly preflight: FakePluginResponse;
+    readonly executeAuthorizedAction: FakePluginResponse;
+    readonly executeAuthorizedActionGate?: FakePluginExecutionGate;
+    readonly requestCancellation: FakePluginResponse;
+    readonly reconcile: Readonly<Record<string, ReadonlyArray<FakePluginResponse>>>;
+}
+/** Stable lookup key for replayable sync scripts. */
+export declare const fakeSyncScriptKey: (streamKey: string, checkpoint: string | null) => string;
+/** Stable lookup key for ambiguous-outcome reconciliation scripts. */
+export declare const fakeReconciliationScriptKey: (reconciliationKey: string | null, idempotencyKey: string) => string;
+//# sourceMappingURL=FakePluginScenario.d.ts.map

package/dist/server/server/plugins/fake/FakePluginScenario.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FakePluginScenario.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/fake/FakePluginScenario.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAEhD,kGAAkG;AAClG,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAA;AAErC,sFAAsF;AACtF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;CAC1C;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAA;IAC1E,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;IACvC,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAA;IAC1C,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;IACtC,QAAQ,CAAC,uBAAuB,EAAE,kBAAkB,CAAA;IACpD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,uBAAuB,CAAA;IAC9D,QAAQ,CAAC,mBAAmB,EAAE,kBAAkB,CAAA;IAChD,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAA;CAChF;AAED,qDAAqD;AACrD,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,EAAE,YAAY,MAAM,GAAG,IAAI,KAAG,MACtC,CAAA;AAE3C,sEAAsE;AACtE,eAAO,MAAM,2BAA2B,GACtC,mBAAmB,MAAM,GAAG,IAAI,EAChC,gBAAgB,MAAM,KACrB,MAAmE,CAAA"}

package/dist/server/server/plugins/firstPartySynchronization.d.ts

@@ -0,0 +1,7 @@
+import type { NegotiatedPluginDescriptorV1 } from "../../domain/plugins/descriptor.js";
+import type { ProviderId } from "../../domain/sourceRevision.js";
+/** Resolve the production synchronization stream owned by a first-party provider. */
+export declare const firstPartySyncStreamKey: (providerId: ProviderId) => string;
+/** Apply first-party runtime migration policy to persisted synchronization descriptors. */
+export declare const supportsFirstPartySynchronization: (providerId: ProviderId, negotiated: typeof NegotiatedPluginDescriptorV1.Type) => boolean;
+//# sourceMappingURL=firstPartySynchronization.d.ts.map

package/dist/server/server/plugins/firstPartySynchronization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firstPartySynchronization.d.ts","sourceRoot":"","sources":["../../../../src/server/plugins/firstPartySynchronization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAahE,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,GAAI,YAAY,UAAU,KAAG,MAA8C,CAAA;AAmB/G,2FAA2F;AAC3F,eAAO,MAAM,iCAAiC,GAC5C,YAAY,UAAU,EACtB,YAAY,OAAO,4BAA4B,CAAC,IAAI,KACnD,OAE0E,CAAA"}

package/dist/server/server/plugins/index.d.ts

@@ -0,0 +1,21 @@
+/** Safe scoped plugin connection contract. */
+export * from "./PluginConnection.js";
+/** Workspace-isolated public projection of scoped plugin runtimes. */
+export * from "./PluginConnectionMap.js";
+/** Opaque plugin definition identity; factories remain internal. */
+export type { PluginDefinitionV1 } from "./PluginDefinitionV1.js";
+/** Typed plugin failure taxonomy without raw provider causes. */
+export * from "./failures.js";
+/** Descriptor and capability negotiation performed before construction. */
+export * from "./negotiation.js";
+/** Bounded retry policy for explicitly safe or idempotent provider operations. */
+export * from "./retryPolicy.js";
+/** Production CodeCommit read adapter. */
+export * from "./codecommit/index.js";
+/** Production AWS CodePipeline read adapter. */
+export * from "./codepipeline/index.js";
+/** Production, read-only Jira issue adapter. */
+export * from "./jira/index.js";
+/** Production, read-only Clockify time-entry adapter. */
+export * from "./clockify/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/server/plugins/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/plugins/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,cAAc,uBAAuB,CAAA;AACrC,sEAAsE;AACtE,cAAc,0BAA0B,CAAA;AACxC,oEAAoE;AACpE,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,iEAAiE;AACjE,cAAc,eAAe,CAAA;AAC7B,2EAA2E;AAC3E,cAAc,kBAAkB,CAAA;AAChC,kFAAkF;AAClF,cAAc,kBAAkB,CAAA;AAChC,0CAA0C;AAC1C,cAAc,uBAAuB,CAAA;AACrC,gDAAgD;AAChD,cAAc,yBAAyB,CAAA;AACvC,gDAAgD;AAChD,cAAc,iBAAiB,CAAA;AAC/B,yDAAyD;AACzD,cAAc,qBAAqB,CAAA"}

package/dist/server/server/plugins/internal/AuthorizedPluginExecutor.d.ts

@@ -0,0 +1,8 @@
+import * as Context from "effect/Context";
+import type { AuthorizedPluginExecutorV1 } from "../PluginExecutor.js";
+declare const AuthorizedPluginExecutor_base: Context.ServiceClass<AuthorizedPluginExecutor, "@knpkv/control-center/internal/AuthorizedPluginExecutor", AuthorizedPluginExecutorV1>;
+/** Live executor tag kept declaration-visible inside the unexported internal module. */
+export declare class AuthorizedPluginExecutor extends AuthorizedPluginExecutor_base {
+}
+export {};
+//# sourceMappingURL=AuthorizedPluginExecutor.d.ts.map

package/dist/server/server/plugins/internal/AuthorizedPluginExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizedPluginExecutor.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/internal/AuthorizedPluginExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AAEzC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;;AAEtE,wFAAwF;AACxF,qBAAa,wBAAyB,SAAQ,6BAGgB;CAAG"}

package/dist/server/server/plugins/internal/AuthorizedPluginExecutorMap.d.ts

@@ -0,0 +1,27 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type * as Scope from "effect/Scope";
+import type { PluginFailure } from "../failures.js";
+import type { PluginRuntimeScope } from "../PluginConnectionMap.js";
+import { AuthorizedPluginExecutor } from "./AuthorizedPluginExecutor.js";
+import { type PluginRuntimeAuthorityToken, PluginRuntimeAuthorityUnavailable } from "./PluginRuntimeAuthority.js";
+import { PluginRuntimeMap } from "./PluginRuntimeMap.js";
+export { PluginRuntimeAuthorityUnavailable } from "./PluginRuntimeAuthority.js";
+/** Executor and exact runtime generation held under one shared scoped lease. */
+export interface AuthorizedPluginExecutorLease {
+    readonly context: Context.Context<AuthorizedPluginExecutor>;
+    readonly runtimeAuthorityToken: PluginRuntimeAuthorityToken;
+}
+/** Internal projection of a cached runtime's vendor-write capability. */
+export interface AuthorizedPluginExecutorMapV1 {
+    readonly contextEffect: (scope: PluginRuntimeScope) => Effect.Effect<AuthorizedPluginExecutorLease, PluginFailure, Scope.Scope>;
+    readonly contextEffectForAuthority: (scope: PluginRuntimeScope, runtimeAuthorityToken: PluginRuntimeAuthorityToken) => Effect.Effect<AuthorizedPluginExecutorLease, PluginFailure | PluginRuntimeAuthorityUnavailable, Scope.Scope>;
+    readonly invalidate: (scope: PluginRuntimeScope) => Effect.Effect<void>;
+}
+declare const AuthorizedPluginExecutorMap_base: Context.ServiceClass<AuthorizedPluginExecutorMap, "@knpkv/control-center/internal/AuthorizedPluginExecutorMap", AuthorizedPluginExecutorMapV1>;
+/** Internal-only executor lookup used later by the governed action engine. */
+export declare class AuthorizedPluginExecutorMap extends AuthorizedPluginExecutorMap_base {
+    static readonly layer: Layer.Layer<AuthorizedPluginExecutorMap, never, PluginRuntimeMap>;
+}
+//# sourceMappingURL=AuthorizedPluginExecutorMap.d.ts.map

package/dist/server/server/plugins/internal/AuthorizedPluginExecutorMap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizedPluginExecutorMap.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/internal/AuthorizedPluginExecutorMap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAA;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAEL,KAAK,2BAA2B,EAChC,iCAAiC,EAClC,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAoB,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAE1E,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAA;AAE/E,gFAAgF;AAChF,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAC3D,QAAQ,CAAC,qBAAqB,EAAE,2BAA2B,CAAA;CAC5D;AAED,yEAAyE;AACzE,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,aAAa,EAAE,CACtB,KAAK,EAAE,kBAAkB,KACtB,MAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7E,QAAQ,CAAC,yBAAyB,EAAE,CAClC,KAAK,EAAE,kBAAkB,EACzB,qBAAqB,EAAE,2BAA2B,KAC/C,MAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE,aAAa,GAAG,iCAAiC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IACjH,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CACxE;;AAED,8EAA8E;AAC9E,qBAAa,2BAA4B,SAAQ,gCAGgB;IAC/D,MAAM,CAAC,QAAQ,CAAC,KAAK,oEAkBpB;CACF"}

package/dist/server/server/plugins/internal/FirstPartyPluginRuntimeRegistry.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=FirstPartyPluginRuntimeRegistry.d.ts.map

package/dist/server/server/plugins/internal/FirstPartyPluginRuntimeRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FirstPartyPluginRuntimeRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/internal/FirstPartyPluginRuntimeRegistry.ts"],"names":[],"mappings":""}

package/dist/server/server/plugins/internal/PluginRuntime.d.ts

@@ -0,0 +1,13 @@
+import * as Layer from "effect/Layer";
+import type { PluginConnectionV1 } from "../PluginConnection.js";
+import { PluginConnection } from "../PluginConnection.js";
+import type { AuthorizedPluginExecutorV1 } from "../PluginExecutor.js";
+import { AuthorizedPluginExecutor } from "./AuthorizedPluginExecutor.js";
+/** Both halves of one scoped adapter runtime before authority projection. */
+export interface PluginRuntimeV1 {
+    readonly connection: PluginConnectionV1;
+    readonly executor: AuthorizedPluginExecutorV1;
+}
+/** Build the internal runtime layer while keeping execution out of the public connection shape. */
+export declare const pluginRuntimeLayer: (runtime: PluginRuntimeV1) => Layer.Layer<PluginConnection | AuthorizedPluginExecutor>;
+//# sourceMappingURL=PluginRuntime.d.ts.map

package/dist/server/server/plugins/internal/PluginRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginRuntime.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/internal/PluginRuntime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAExE,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAA;CAC9C;AAED,mGAAmG;AACnG,eAAO,MAAM,kBAAkB,GAC7B,SAAS,eAAe,KACvB,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,wBAAwB,CAGvD,CAAA"}

package/dist/server/server/plugins/internal/PluginRuntimeAuthority.d.ts

@@ -0,0 +1,154 @@
+import * as Context from "effect/Context";
+import * as Schema from "effect/Schema";
+/** Opaque digest of the exact configured runtime generation backing an executor lease. */
+export declare const PluginRuntimeAuthorityToken: Schema.brand<Schema.String, "PluginRuntimeAuthorityToken">;
+/** Decoded runtime-generation authority token. */
+export type PluginRuntimeAuthorityToken = typeof PluginRuntimeAuthorityToken.Type;
+/** Secret-free digest of the credential/account generation used to construct a runtime. */
+export declare const PluginRuntimeAccountDigest: Schema.brand<Schema.String, "PluginRuntimeAccountDigest">;
+export type PluginRuntimeAccountDigest = typeof PluginRuntimeAccountDigest.Type;
+/** Raw digest of one exact persisted configuration or negotiated descriptor. */
+export declare const PluginRuntimeSourceDigest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+export type PluginRuntimeSourceDigest = typeof PluginRuntimeSourceDigest.Type;
+/** Exact optional configuration revision bound into runtime authority. */
+export declare const PluginRuntimeAuthorityConfiguration: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"absent", {}>, Schema.TaggedStruct<"present", {
+    readonly revision: Schema.Int;
+    readonly digest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+}>]>;
+export type PluginRuntimeAuthorityConfiguration = typeof PluginRuntimeAuthorityConfiguration.Type;
+/** Persisted source snapshot expected by the runtime constructor. */
+export declare const PluginRuntimeAuthorityExpectedSource: Schema.Struct<{
+    readonly providerId: Schema.Literals<readonly ["codecommit", "codepipeline", "jira", "confluence", "clockify"]>;
+    readonly connectionRevision: Schema.Int;
+    readonly descriptorGeneration: Schema.Int;
+    readonly configuration: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"absent", {}>, Schema.TaggedStruct<"present", {
+        readonly revision: Schema.Int;
+        readonly digest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+    }>]>;
+    readonly descriptorDigest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+}>;
+export type PluginRuntimeAuthorityExpectedSource = typeof PluginRuntimeAuthorityExpectedSource.Type;
+/** Internal publication request; generation and authority digest are always server-derived. */
+export declare const PublishPluginRuntimeAuthority: Schema.Struct<{
+    readonly scope: Schema.Struct<{
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+    }>;
+    readonly expected: Schema.Struct<{
+        readonly providerId: Schema.Literals<readonly ["codecommit", "codepipeline", "jira", "confluence", "clockify"]>;
+        readonly connectionRevision: Schema.Int;
+        readonly descriptorGeneration: Schema.Int;
+        readonly configuration: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"absent", {}>, Schema.TaggedStruct<"present", {
+            readonly revision: Schema.Int;
+            readonly digest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+        }>]>;
+        readonly descriptorDigest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+    }>;
+    readonly accountDigest: Schema.brand<Schema.String, "PluginRuntimeAccountDigest">;
+    readonly activatedAt: Schema.DateTimeUtcFromString;
+}>;
+export type PublishPluginRuntimeAuthority = typeof PublishPluginRuntimeAuthority.Type;
+/** Exact current runtime generation safe to bind to an executor lease. */
+export declare const CurrentPluginRuntimeAuthority: Schema.Struct<{
+    readonly negotiated: Schema.Struct<{
+        readonly descriptor: Schema.Struct<{
+            readonly contractId: Schema.Literal<"dev.knpkv.control-center.plugin">;
+            readonly contractVersion: Schema.Struct<{
+                readonly major: Schema.Int;
+                readonly minor: Schema.Int;
+                readonly patch: Schema.Int;
+            }>;
+            readonly pluginId: Schema.brand<Schema.String, string>;
+            readonly adapterVersion: Schema.Struct<{
+                readonly major: Schema.Int;
+                readonly minor: Schema.Int;
+                readonly patch: Schema.Int;
+            }>;
+            readonly displayName: Schema.String;
+            readonly configurationFields: Schema.$Array<Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"text", {
+                key: Schema.brand<Schema.String, string>;
+                label: Schema.String;
+                description: Schema.String;
+                required: Schema.Boolean;
+            }>, Schema.TaggedStruct<"url", {
+                key: Schema.brand<Schema.String, string>;
+                label: Schema.String;
+                description: Schema.String;
+                required: Schema.Boolean;
+            }>, Schema.TaggedStruct<"boolean", {
+                key: Schema.brand<Schema.String, string>;
+                label: Schema.String;
+                description: Schema.String;
+                required: Schema.Boolean;
+            }>, Schema.Struct<{
+                readonly _tag: Schema.tag<"integer">;
+                readonly minimum: Schema.NullOr<Schema.Int>;
+                readonly maximum: Schema.NullOr<Schema.Int>;
+                readonly key: Schema.brand<Schema.String, string>;
+                readonly label: Schema.String;
+                readonly description: Schema.String;
+                readonly required: Schema.Boolean;
+            }>, Schema.TaggedStruct<"select", {
+                readonly options: Schema.$Array<Schema.Struct<{
+                    readonly label: Schema.String;
+                    readonly value: Schema.brand<Schema.String, string>;
+                }>>;
+                readonly key: Schema.brand<Schema.String, string>;
+                readonly label: Schema.String;
+                readonly description: Schema.String;
+                readonly required: Schema.Boolean;
+            }>, Schema.TaggedStruct<"secret-reference", {
+                readonly secretKind: Schema.Literals<readonly ["token", "password", "private-key", "certificate", "opaque"]>;
+                readonly key: Schema.brand<Schema.String, string>;
+                readonly label: Schema.String;
+                readonly description: Schema.String;
+                readonly required: Schema.Boolean;
+            }>]>>;
+            readonly capabilities: Schema.$Array<Schema.Struct<{
+                readonly capabilityId: Schema.Literals<readonly ["entity.read", "sync.incremental", "action.propose", "action.execute", "action.cancel", "action.reconcile", "diff.inventory", "diff.content"]>;
+                readonly supportedVersions: Schema.$Array<Schema.Int>;
+                readonly requirement: Schema.Literals<readonly ["required", "optional"]>;
+            }>>;
+        }>;
+        readonly capabilities: Schema.$Array<Schema.Struct<{
+            readonly capabilityId: Schema.Literals<readonly ["entity.read", "sync.incremental", "action.propose", "action.execute", "action.cancel", "action.reconcile", "diff.inventory", "diff.content"]>;
+            readonly version: Schema.Int;
+        }>>;
+    }>;
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly generation: Schema.Int;
+    readonly runtimeAuthorityToken: Schema.brand<Schema.String, "PluginRuntimeAuthorityToken">;
+    readonly scope: Schema.Struct<{
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+    }>;
+    readonly expected: Schema.Struct<{
+        readonly providerId: Schema.Literals<readonly ["codecommit", "codepipeline", "jira", "confluence", "clockify"]>;
+        readonly connectionRevision: Schema.Int;
+        readonly descriptorGeneration: Schema.Int;
+        readonly configuration: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"absent", {}>, Schema.TaggedStruct<"present", {
+            readonly revision: Schema.Int;
+            readonly digest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+        }>]>;
+        readonly descriptorDigest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+    }>;
+    readonly accountDigest: Schema.brand<Schema.String, "PluginRuntimeAccountDigest">;
+    readonly activatedAt: Schema.DateTimeUtcFromString;
+}>;
+export type CurrentPluginRuntimeAuthority = typeof CurrentPluginRuntimeAuthority.Type;
+declare const PluginRuntimeAuthorityUnavailable_base: Schema.Class<PluginRuntimeAuthorityUnavailable, Schema.TaggedStruct<"PluginRuntimeAuthorityUnavailable", {}>, import("effect/Cause").YieldableError>;
+/** The requested runtime generation is absent or no longer matches its persisted sources. */
+export declare class PluginRuntimeAuthorityUnavailable extends PluginRuntimeAuthorityUnavailable_base {
+}
+declare const PluginRuntimeAuthorityPublicationConflict_base: Schema.Class<PluginRuntimeAuthorityPublicationConflict, Schema.TaggedStruct<"PluginRuntimeAuthorityPublicationConflict", {
+    readonly reason: Schema.Literals<readonly ["source-missing", "source-disabled", "source-changed", "concurrent-publication"]>;
+}>, import("effect/Cause").YieldableError>;
+/** A publication lost a source or generation compare-and-swap race. */
+export declare class PluginRuntimeAuthorityPublicationConflict extends PluginRuntimeAuthorityPublicationConflict_base {
+}
+declare const PluginRuntimeAuthority_base: Context.ServiceClass<PluginRuntimeAuthority, "@knpkv/control-center/internal/PluginRuntimeAuthority", string & import("effect/Brand").Brand<"PluginRuntimeAuthorityToken">>;
+/** Internal runtime metadata acquired in the same scope as its executor. */
+export declare class PluginRuntimeAuthority extends PluginRuntimeAuthority_base {
+}
+export {};
+//# sourceMappingURL=PluginRuntimeAuthority.d.ts.map

package/dist/server/server/plugins/internal/PluginRuntimeAuthority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginRuntimeAuthority.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/internal/PluginRuntimeAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAOvC,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,4DAEW,CAAA;AAEnD,kDAAkD;AAClD,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA;AAEjF,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,2DAEW,CAAA;AAClD,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,0DAEW,CAAA;AACjD,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAE7E,0EAA0E;AAC1E,eAAO,MAAM,mCAAmC;;;IAMX,CAAA;AACrC,MAAM,MAAM,mCAAmC,GAAG,OAAO,mCAAmC,CAAC,IAAI,CAAA;AAEjG,qEAAqE;AACrE,eAAO,MAAM,oCAAoC;;;;;;;;;EAM/C,CAAA;AACF,MAAM,MAAM,oCAAoC,GAAG,OAAO,oCAAoC,CAAC,IAAI,CAAA;AAEnG,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;EAQxC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,6BAA6B,CAAC,IAAI,CAAA;AAErF,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMxC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,6BAA6B,CAAC,IAAI,CAAA;;AAErF,6FAA6F;AAC7F,qBAAa,iCAAkC,SAAQ,sCAGtD;CAAG;;;;AAEJ,uEAAuE;AACvE,qBAAa,yCACX,SAAQ,8CAUP;CACD;;AAEF,4EAA4E;AAC5E,qBAAa,sBAAuB,SAAQ,2BAGgB;CAAG"}

package/dist/server/server/plugins/internal/PluginRuntimeAuthorityRepository.d.ts

@@ -0,0 +1,131 @@
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import type { Success } from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import { Database } from "../../persistence/Database.js";
+import { PersistedRecordError, PersistenceOperationError } from "../../persistence/errors.js";
+import { type CurrentPluginRuntimeAuthority as CurrentPluginRuntimeAuthorityType, PluginRuntimeAccountDigest, PluginRuntimeAuthorityPublicationConflict, PluginRuntimeAuthorityToken, PluginRuntimeAuthorityUnavailable, type PublishPluginRuntimeAuthority } from "./PluginRuntimeAuthority.js";
+import { PluginRuntimeAuthoritySource } from "./PluginRuntimeAuthoritySource.js";
+/** Stable authority digest over a domain-separated ordered tuple. */
+export declare const digestPluginRuntimeAuthority: (input: {
+    readonly scope: PublishPluginRuntimeAuthority["scope"];
+    readonly expected: PublishPluginRuntimeAuthority["expected"];
+    readonly accountDigest: PluginRuntimeAccountDigest;
+    readonly generation: number;
+}) => Effect.Effect<string & import("effect/Brand").Brand<"PluginRuntimeAuthorityToken">, PersistenceOperationError, Crypto.Crypto>;
+declare const makePluginRuntimeAuthorityRepository: Effect.Effect<{
+    publish: (input: Schema.Struct.ReadonlySide<{
+        readonly scope: Schema.Struct<{
+            readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+            readonly pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+        }>;
+        readonly expected: Schema.Struct<{
+            readonly providerId: Schema.Literals<readonly ["codecommit", "codepipeline", "jira", "confluence", "clockify"]>;
+            readonly connectionRevision: Schema.Int;
+            readonly descriptorGeneration: Schema.Int;
+            readonly configuration: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"absent", {}>, Schema.TaggedStruct<"present", {
+                readonly revision: Schema.Int;
+                readonly digest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+            }>]>;
+            readonly descriptorDigest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+        }>;
+        readonly accountDigest: Schema.brand<Schema.String, "PluginRuntimeAccountDigest">;
+        readonly activatedAt: Schema.DateTimeUtcFromString;
+    }, "Type">) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly negotiated: Schema.Struct<{
+            readonly descriptor: Schema.Struct<{
+                readonly contractId: Schema.Literal<"dev.knpkv.control-center.plugin">;
+                readonly contractVersion: Schema.Struct<{
+                    readonly major: Schema.Int;
+                    readonly minor: Schema.Int;
+                    readonly patch: Schema.Int;
+                }>;
+                readonly pluginId: Schema.brand<Schema.String, string>;
+                readonly adapterVersion: Schema.Struct<{
+                    readonly major: Schema.Int;
+                    readonly minor: Schema.Int;
+                    readonly patch: Schema.Int;
+                }>;
+                readonly displayName: Schema.String;
+                readonly configurationFields: Schema.$Array<Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"text", {
+                    key: Schema.brand<Schema.String, string>;
+                    label: Schema.String;
+                    description: Schema.String;
+                    required: Schema.Boolean;
+                }>, Schema.TaggedStruct<"url", {
+                    key: Schema.brand<Schema.String, string>;
+                    label: Schema.String;
+                    description: Schema.String;
+                    required: Schema.Boolean;
+                }>, Schema.TaggedStruct<"boolean", {
+                    key: Schema.brand<Schema.String, string>;
+                    label: Schema.String;
+                    description: Schema.String;
+                    required: Schema.Boolean;
+                }>, Schema.Struct<{
+                    readonly _tag: Schema.tag<"integer">;
+                    readonly minimum: Schema.NullOr<Schema.Int>;
+                    readonly maximum: Schema.NullOr<Schema.Int>;
+                    readonly key: Schema.brand<Schema.String, string>;
+                    readonly label: Schema.String;
+                    readonly description: Schema.String;
+                    readonly required: Schema.Boolean;
+                }>, Schema.TaggedStruct<"select", {
+                    readonly options: Schema.$Array<Schema.Struct<{
+                        readonly label: Schema.String;
+                        readonly value: Schema.brand<Schema.String, string>;
+                    }>>;
+                    readonly key: Schema.brand<Schema.String, string>;
+                    readonly label: Schema.String;
+                    readonly description: Schema.String;
+                    readonly required: Schema.Boolean;
+                }>, Schema.TaggedStruct<"secret-reference", {
+                    readonly secretKind: Schema.Literals<readonly ["token", "password", "private-key", "certificate", "opaque"]>;
+                    readonly key: Schema.brand<Schema.String, string>;
+                    readonly label: Schema.String;
+                    readonly description: Schema.String;
+                    readonly required: Schema.Boolean;
+                }>]>>;
+                readonly capabilities: Schema.$Array<Schema.Struct<{
+                    readonly capabilityId: Schema.Literals<readonly ["entity.read", "sync.incremental", "action.propose", "action.execute", "action.cancel", "action.reconcile", "diff.inventory", "diff.content"]>;
+                    readonly supportedVersions: Schema.$Array<Schema.Int>;
+                    readonly requirement: Schema.Literals<readonly ["required", "optional"]>;
+                }>>;
+            }>;
+            readonly capabilities: Schema.$Array<Schema.Struct<{
+                readonly capabilityId: Schema.Literals<readonly ["entity.read", "sync.incremental", "action.propose", "action.execute", "action.cancel", "action.reconcile", "diff.inventory", "diff.content"]>;
+                readonly version: Schema.Int;
+            }>>;
+        }>;
+        readonly schemaVersion: Schema.Literal<1>;
+        readonly generation: Schema.Int;
+        readonly runtimeAuthorityToken: Schema.brand<Schema.String, "PluginRuntimeAuthorityToken">;
+        readonly scope: Schema.Struct<{
+            readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+            readonly pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+        }>;
+        readonly expected: Schema.Struct<{
+            readonly providerId: Schema.Literals<readonly ["codecommit", "codepipeline", "jira", "confluence", "clockify"]>;
+            readonly connectionRevision: Schema.Int;
+            readonly descriptorGeneration: Schema.Int;
+            readonly configuration: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"absent", {}>, Schema.TaggedStruct<"present", {
+                readonly revision: Schema.Int;
+                readonly digest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+            }>]>;
+            readonly descriptorDigest: Schema.brand<Schema.String, "PluginRuntimeSourceDigest">;
+        }>;
+        readonly accountDigest: Schema.brand<Schema.String, "PluginRuntimeAccountDigest">;
+        readonly activatedAt: Schema.DateTimeUtcFromString;
+    }, "Type">, PersistenceOperationError | PersistedRecordError | PluginRuntimeAuthorityPublicationConflict, never>;
+    transactCurrent: <Success, Failure, Requirements>(input: {
+        readonly scope: PublishPluginRuntimeAuthority["scope"];
+        readonly runtimeAuthorityToken: PluginRuntimeAuthorityToken;
+    }, use: (current: CurrentPluginRuntimeAuthorityType) => Effect.Effect<Success, Failure, Requirements>) => Effect.Effect<Success, PersistenceOperationError | PersistedRecordError | PluginRuntimeAuthorityUnavailable | Exclude<Failure, Schema.SchemaError | import("effect/unstable/sql/SqlError").SqlError>, Requirements>;
+}, never, Crypto.Crypto | Database>;
+/** Internal live layer for persisted plugin-runtime authority. */
+export declare const pluginRuntimeAuthoritySourceLayer: Layer.Layer<PluginRuntimeAuthoritySource, never, Crypto.Crypto | Database>;
+/** Concrete service shape, exported only for internal composition tests. */
+export type PluginRuntimeAuthorityRepositoryService = Success<typeof makePluginRuntimeAuthorityRepository>;
+export {};
+//# sourceMappingURL=PluginRuntimeAuthorityRepository.d.ts.map

package/dist/server/server/plugins/internal/PluginRuntimeAuthorityRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginRuntimeAuthorityRepository.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/internal/PluginRuntimeAuthorityRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAE5C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAIvC,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAG7F,OAAO,EAEL,KAAK,6BAA6B,IAAI,iCAAiC,EACvE,0BAA0B,EAE1B,yCAAyC,EACzC,2BAA2B,EAC3B,iCAAiC,EAEjC,KAAK,6BAA6B,EACnC,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AA0IhF,qEAAqE;AACrE,eAAO,MAAM,4BAA4B;oBAErB,6BAA6B,CAAC,OAAO,CAAC;uBACnC,6BAA6B,CAAC,UAAU,CAAC;4BACpC,0BAA0B;yBAC7B,MAAM;mIAgC7B,CAAA;AAEF,QAAA,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA8Tf,OAAO,EAAE,OAAO,EAAE,YAAY,SAC9C;QACL,QAAQ,CAAC,KAAK,EAAE,6BAA6B,CAAC,OAAO,CAAC,CAAA;QACtD,QAAQ,CAAC,qBAAqB,EAAE,2BAA2B,CAAA;KAC5D,OACI,CACH,OAAO,EAAE,iCAAiC,KACvC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC;mCAYpD,CAAA;AAEF,kEAAkE;AAClE,eAAO,MAAM,iCAAiC,4EAG7C,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,uCAAuC,GAAG,OAAO,CAC3D,OAAO,oCAAoC,CAC5C,CAAA"}

package/dist/server/server/plugins/internal/PluginRuntimeAuthoritySource.d.ts

@@ -0,0 +1,23 @@
+import * as Context from "effect/Context";
+import type * as Effect from "effect/Effect";
+import type { PersistedRecordError, PersistenceOperationError } from "../../persistence/errors.js";
+import type { PluginRuntimeScope } from "../PluginConnectionMap.js";
+import type { CurrentPluginRuntimeAuthority, PluginRuntimeAuthorityPublicationConflict, PluginRuntimeAuthorityToken, PluginRuntimeAuthorityUnavailable, PublishPluginRuntimeAuthority } from "./PluginRuntimeAuthority.js";
+/** Internal transaction-owned authority source for runtime publication and governed dispatch. */
+export interface PluginRuntimeAuthoritySourceV1 {
+    readonly publish: (input: PublishPluginRuntimeAuthority) => Effect.Effect<CurrentPluginRuntimeAuthority, PluginRuntimeAuthorityPublicationConflict | PersistedRecordError | PersistenceOperationError>;
+    /**
+     * Verify an exact current generation and run database-only work in the same transaction.
+     * The callback must not perform provider, filesystem, or network effects.
+     */
+    readonly transactCurrent: <Success, Failure, Requirements>(input: {
+        readonly scope: PluginRuntimeScope;
+        readonly runtimeAuthorityToken: PluginRuntimeAuthorityToken;
+    }, use: (current: CurrentPluginRuntimeAuthority) => Effect.Effect<Success, Failure, Requirements>) => Effect.Effect<Success, Failure | PluginRuntimeAuthorityUnavailable | PersistedRecordError | PersistenceOperationError, Requirements>;
+}
+declare const PluginRuntimeAuthoritySource_base: Context.ServiceClass<PluginRuntimeAuthoritySource, "@knpkv/control-center/internal/PluginRuntimeAuthoritySource", PluginRuntimeAuthoritySourceV1>;
+/** Server-only seam that keeps current-source verification adjacent to database mutations. */
+export declare class PluginRuntimeAuthoritySource extends PluginRuntimeAuthoritySource_base {
+}
+export {};
+//# sourceMappingURL=PluginRuntimeAuthoritySource.d.ts.map

package/dist/server/server/plugins/internal/PluginRuntimeAuthoritySource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginRuntimeAuthoritySource.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/internal/PluginRuntimeAuthoritySource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAE5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,KAAK,EACV,6BAA6B,EAC7B,yCAAyC,EACzC,2BAA2B,EAC3B,iCAAiC,EACjC,6BAA6B,EAC9B,MAAM,6BAA6B,CAAA;AAEpC,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,6BAA6B,KACjC,MAAM,CAAC,MAAM,CAChB,6BAA6B,EAC7B,yCAAyC,GAAG,oBAAoB,GAAG,yBAAyB,CAC7F,CAAA;IACD;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EACvD,KAAK,EAAE;QACL,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;QAClC,QAAQ,CAAC,qBAAqB,EAAE,2BAA2B,CAAA;KAC5D,EACD,GAAG,EAAE,CACH,OAAO,EAAE,6BAA6B,KACnC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,KAC/C,MAAM,CAAC,MAAM,CAChB,OAAO,EACP,OAAO,GAAG,iCAAiC,GAAG,oBAAoB,GAAG,yBAAyB,EAC9F,YAAY,CACb,CAAA;CACF;;AAED,8FAA8F;AAC9F,qBAAa,4BAA6B,SAAQ,iCAGgB;CAAG"}

package/dist/server/server/plugins/internal/PluginRuntimeMap.d.ts

@@ -0,0 +1,23 @@
+import * as Data from "effect/Data";
+import * as Layer from "effect/Layer";
+import * as LayerMap from "effect/LayerMap";
+import type { PluginFailure } from "../failures.js";
+import { PluginConnection } from "../PluginConnection.js";
+import type { PluginRuntimeScope } from "../PluginConnectionMap.js";
+import { PluginConnectionMap } from "../PluginConnectionMap.js";
+import type { AuthorizedPluginExecutor } from "./AuthorizedPluginExecutor.js";
+import type { PluginRuntimeAuthority } from "./PluginRuntimeAuthority.js";
+import { PluginRuntimeRegistry } from "./PluginRuntimeRegistry.js";
+/** Value-equality cache key preventing connection-ID aliasing across workspaces. */
+export declare class PluginRuntimeKey extends Data.Class<PluginRuntimeScope> {
+}
+/** Canonical value-equality key for public and internal registry projections. */
+export declare const pluginRuntimeKey: (scope: PluginRuntimeScope) => PluginRuntimeKey;
+declare const PluginRuntimeMap_base: LayerMap.TagClass<PluginRuntimeMap, "@knpkv/control-center/internal/PluginRuntimeMap", PluginRuntimeKey, PluginConnection | AuthorizedPluginExecutor | PluginRuntimeAuthority, PluginFailure, PluginRuntimeRegistry, never, never>;
+/** Shared scoped runtime cache used by the separately projected public and internal facades. */
+export declare class PluginRuntimeMap extends PluginRuntimeMap_base {
+}
+/** Public read-only projection over the internal shared runtime cache. */
+export declare const PluginConnectionMapLive: Layer.Layer<PluginConnectionMap, never, PluginRuntimeMap>;
+export {};
+//# sourceMappingURL=PluginRuntimeMap.d.ts.map

package/dist/server/server/plugins/internal/PluginRuntimeMap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginRuntimeMap.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/internal/PluginRuntimeMap.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AAEnC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,oFAAoF;AACpF,qBAAa,gBAAiB,SAAQ,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;CAAG;AAEvE,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,GAAI,OAAO,kBAAkB,KAAG,gBAA+C,CAAA;;AAU5G,gGAAgG;AAChG,qBAAa,gBAAiB,SAAQ,qBAMrC;CAAG;AAEJ,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,2DAUnC,CAAA"}

package/dist/server/server/plugins/internal/PluginRuntimeRegistry.d.ts

@@ -0,0 +1,21 @@
+import * as Context from "effect/Context";
+import type * as Layer from "effect/Layer";
+import type { PluginFailure } from "../failures.js";
+import type { PluginConnection } from "../PluginConnection.js";
+import type { AuthorizedPluginExecutor } from "./AuthorizedPluginExecutor.js";
+import type { PluginRuntimeAuthority } from "./PluginRuntimeAuthority.js";
+import type { PluginRuntimeKey } from "./PluginRuntimeMap.js";
+/**
+ * Internal factory registry for the fixed first-party plugin catalog.
+ * Every layer must bind `PluginRuntimeAuthority` to a canonical token that changes with
+ * connection revision, configuration, credential generation, negotiated adapter, or account.
+ */
+export interface PluginRuntimeRegistryV1 {
+    readonly layer: (scope: PluginRuntimeKey) => Layer.Layer<PluginConnection | AuthorizedPluginExecutor | PluginRuntimeAuthority, PluginFailure>;
+}
+declare const PluginRuntimeRegistry_base: Context.ServiceClass<PluginRuntimeRegistry, "@knpkv/control-center/internal/PluginRuntimeRegistry", PluginRuntimeRegistryV1>;
+/** Internal runtime registry; it is deliberately absent from every package barrel. */
+export declare class PluginRuntimeRegistry extends PluginRuntimeRegistry_base {
+}
+export {};
+//# sourceMappingURL=PluginRuntimeRegistry.d.ts.map

package/dist/server/server/plugins/internal/PluginRuntimeRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginRuntimeRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/internal/PluginRuntimeRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAA;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAE7D;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,gBAAgB,KACpB,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,wBAAwB,GAAG,sBAAsB,EAAE,aAAa,CAAC,CAAA;CACtG;;AAED,sFAAsF;AACtF,qBAAa,qBAAsB,SAAQ,0BAE1C;CAAG"}

package/dist/server/server/plugins/jira/JiraIssueNormalization.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=JiraIssueNormalization.d.ts.map

package/dist/server/server/plugins/jira/JiraIssueNormalization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JiraIssueNormalization.d.ts","sourceRoot":"","sources":["../../../../../src/server/plugins/jira/JiraIssueNormalization.ts"],"names":[],"mappings":""}