@nimbalyst/extension-sdk 0.1.5 → 0.2.1

package/dist/types/panel.d.ts

@@ -282,6 +282,46 @@ export interface PanelHost {
      * @returns Promise resolving to exec result with stdout, stderr, and exit code
      */
     exec(command: string, options?: ExecOptions): Promise<ExecResult>;
+    /**
+     * Read-only access to Nimbalyst's local PGLite database.
+     *
+     * Requires the extension to declare `"nimbalyst-database-read"` in
+     * `permissions.catalog` in manifest.json. Queries run inside a
+     * `READ ONLY` transaction with a bounded statement_timeout; any DML/DDL
+     * is rejected by the planner.
+     *
+     * Tables and columns are not part of any stable contract -- this surface
+     * is intended for built-in extensions today and will be redesigned when
+     * Nimbalyst's storage layer ports to native SQLite. Pin to the host
+     * version you tested against.
+     */
+    readonly data: ExtensionDataAccess;
+}
+/**
+ * Read-only data access surface exposed to extension panels.
+ *
+ * @example
+ * ```typescript
+ * const rows = await host.data.query<{ id: string; title: string }>(
+ *   'SELECT id, title FROM ai_sessions ORDER BY created_at DESC LIMIT $1',
+ *   [50]
+ * );
+ * ```
+ */
+export interface ExtensionDataAccess {
+    /**
+     * Run a read-only SQL query against the local PGLite database.
+     *
+     * The query is wrapped in `BEGIN; SET TRANSACTION READ ONLY; SET LOCAL
+     * statement_timeout = '5s'; <sql>; COMMIT;` -- DML/DDL is rejected by PG.
+     * Multi-statement scripts are not supported; use a single SELECT or CTE.
+     *
+     * @param sql Parameterized SQL (use `$1`, `$2`, ... placeholders)
+     * @param params Bound parameter values (optional)
+     * @returns Resolves with the result rows. Rejects with the raw PG error on
+     *          read-only violations, timeouts, syntax errors, or missing tables.
+     */
+    query<T = unknown>(sql: string, params?: unknown[]): Promise<T[]>;
 }
 /**
  * Options for PanelHost.exec() subprocess execution.
@@ -571,5 +611,15 @@ export interface SettingsPanelProps {
      * Current application theme.
      */
     theme: string;
+    /**
+     * Call one of this extension's backend-module MCP tools and return its parsed
+     * JSON result. Pass the advertised, namespaced tool name (`<extShort>.<tool>`,
+     * e.g. `memory.status`). Mirrors {@link ExtensionAIService.callBackendTool};
+     * present only for extensions whose backend module registers MCP tools. Lets a
+     * settings panel show live state (index status, stored facts) and trigger
+     * maintenance actions (rebuild). Throws if the tool errors or the module is
+     * not running.
+     */
+    callBackendTool?: (toolName: string, args?: Record<string, unknown>) => Promise<unknown>;
 }
 //# sourceMappingURL=panel.d.ts.map

package/dist/types/panel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"panel.d.ts","sourceRoot":"","sources":["../../src/types/panel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAM3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;OAeG;IACH,SAAS,EAAE,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC;IAE5D;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEzC;;;;OAIG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAErD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACnD;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,UAAU,EAAE,MAAM,IAAI,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IAGxB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAI7B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAI9D;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC;;OAEG;IACH,KAAK,IAAI,IAAI,CAAC;IAId;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAEjC;;OAEG;IACH,YAAY,IAAI,IAAI,CAAC;IAErB;;OAEG;IACH,aAAa,IAAI,IAAI,CAAC;IAItB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC;IAI7B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAI/E;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAInC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IAIrC;;;;;;;;;OASG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACnE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/B;;OAEG;IACH,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAErC;;;;OAIG;IACH,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhD;;;OAGG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEhD;;;OAGG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/C;;;OAGG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5C;;;;OAIG;IACH,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/C;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;OAOG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAEnD;;OAEG;IACH,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEtC;;OAEG;IACH,YAAY,IAAI,IAAI,CAAC;IAErB;;;;;;;;OAQG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAElD;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACpF;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,gBAAgB;IAG/B;;;;;;OAMG;IACH,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAEnC;;;;;OAKG;IACH,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAInC;;;;;;OAMG;IACH,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAEzC;;;;;OAKG;IACH,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;;OAIG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAIzC;;;;;;OAMG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAEpD;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD;;;;OAIG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAMD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAEhC;;OAEG;IACH,OAAO,EAAE,WAAW,CAAC;IAErB;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,YAAY,EAAE,yBAAyB,CAAC;IAExC;;OAEG;IACH,SAAS,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,gBAAgB,CAAC;IAE1B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf"}
+{"version":3,"file":"panel.d.ts","sourceRoot":"","sources":["../../src/types/panel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAM3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;OAeG;IACH,SAAS,EAAE,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC;IAE5D;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEzC;;;;OAIG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAErD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACnD;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,UAAU,EAAE,MAAM,IAAI,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IAGxB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAI7B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAI9D;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC;;OAEG;IACH,KAAK,IAAI,IAAI,CAAC;IAId;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAEjC;;OAEG;IACH,YAAY,IAAI,IAAI,CAAC;IAErB;;OAEG;IACH,aAAa,IAAI,IAAI,CAAC;IAItB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC;IAI7B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAI/E;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAInC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IAIrC;;;;;;;;;OASG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAIlE;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CACnE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/B;;OAEG;IACH,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAErC;;;;OAIG;IACH,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhD;;;OAGG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEhD;;;OAGG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/C;;;OAGG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5C;;;;OAIG;IACH,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/C;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;OAOG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAEnD;;OAEG;IACH,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEtC;;OAEG;IACH,YAAY,IAAI,IAAI,CAAC;IAErB;;;;;;;;OAQG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAElD;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACpF;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,gBAAgB;IAG/B;;;;;;OAMG;IACH,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAEnC;;;;;OAKG;IACH,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAInC;;;;;;OAMG;IACH,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAEzC;;;;;OAKG;IACH,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;;OAIG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAIzC;;;;;;OAMG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAEpD;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD;;;;OAIG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAMD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAEhC;;OAEG;IACH,OAAO,EAAE,WAAW,CAAC;IAErB;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,YAAY,EAAE,yBAAyB,CAAC;IAExC;;OAEG;IACH,SAAS,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,gBAAgB,CAAC;IAE1B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,CAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB"}

package/dist/types/permissions.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Extension permission types.
+ *
+ * The catalog of valid permission ids is owned by the host (Nimbalyst core).
+ * Extensions reference permission ids; they cannot register new ids.
+ *
+ * Scope of what this catalog actually enforces
+ * --------------------------------------------
+ * The catalog only contains permissions for capabilities Nimbalyst exposes
+ * through main-process brokers (database, workspace files, MCP registration,
+ * secrets). Brokers can refuse a call when the grant is missing, so these
+ * checks are real.
+ *
+ * The catalog deliberately does NOT contain ids for ambient Node capabilities
+ * like spawn-process, raw fs access, or arbitrary network. Once a backend
+ * module is granted (see BackendModuleContribution below), it can call
+ * `require('child_process')`, `require('fs')`, `require('net')` directly --
+ * there is no in-process sandbox that can prevent that. Listing those as
+ * granular permissions would advertise enforcement we cannot deliver.
+ *
+ * Instead, granting a backend module is itself the consent that "this
+ * extension may run native code on this machine with the same trust as your
+ * user account." The first-use prompt says this verbatim. Anything finer
+ * than that requires OS sandboxing or a different runtime model and is not
+ * in scope here.
+ *
+ * Risk tiers shape how the consent prompt groups brokered permissions:
+ *   low      - routine, low-impact (e.g., reading workspace files)
+ *   elevated - non-trivial but bounded (e.g., registering MCP tools)
+ *   high     - powerful, broad impact (e.g., writing the host DB, reading
+ *              secrets)
+ */
+export type PermissionRiskTier = 'low' | 'elevated' | 'high';
+/**
+ * The full set of permission ids understood by the host. Every entry here is
+ * a host-brokered capability: the renderer or backend module calls a main-
+ * process surface that consults the grant before running.
+ *
+ * Adding a new id here is a coordinated host change: the runtime catalog
+ * in the privileged host's `permissionRegistry` must gain a matching entry.
+ *
+ * Database access splits into read and write so extensions can declare
+ * least-privilege intent without composing two grants into one.
+ */
+export type ExtensionPermissionId = 'workspace-files' | 'nimbalyst-database-read' | 'nimbalyst-database-write' | 'secrets-read' | 'mcp-server-register';
+/**
+ * Backend module runtime. The privileged host loads the module in one of two
+ * isolated runtimes. Choose based on workload:
+ *
+ *   utility-process - separate OS process via Electron `utilityProcess.fork`.
+ *                     Use for process-spawning, networked, or crash-prone
+ *                     backends (kernels, language servers, daemons).
+ *   worker-thread   - `node:worker_threads`. Use for lighter compute / indexing
+ *                     helpers that share the main-process Node lifecycle but
+ *                     run off the event loop.
+ */
+export type BackendModuleRuntime = 'utility-process' | 'worker-thread';
+/**
+ * How a privileged capability is enabled.
+ *
+ * `default: 'disabled'` is the only supported value today. Capabilities are
+ * always opt-in by the user.
+ *
+ * `promptOn: 'firstUse'` defers the consent prompt until the user takes an
+ * action that needs the capability. This avoids first-launch consent walls.
+ *
+ * `purpose` is a one-sentence, human-readable description shown verbatim in
+ * the consent prompt. It is the actual security copy the user reads, so
+ * write it from the user's perspective ("Run Jupyter kernels and execute
+ * notebook cells locally."), not the implementation's.
+ */
+export interface BackendModuleEnablement {
+    default: 'disabled';
+    promptOn: 'firstUse';
+    purpose: string;
+}
+/**
+ * A backend module contributed by an extension.
+ *
+ * Backend modules live outside the renderer in the privileged host. They are
+ * inert until the user grants the module at first use.
+ *
+ * Granting a backend module is itself the consent to run native code on the
+ * user's machine. The catalog ids in `permissions` only cover ADDITIONAL
+ * host-brokered capabilities (Nimbalyst DB, secrets, MCP registration). They
+ * do NOT enumerate raw Node capabilities the module already has via standard
+ * `require()`. See the catalog docs at the top of this file.
+ *
+ * Only extensions on the host's backend-module allowlist may load a module.
+ * Built-in extensions are allowed by default; marketplace extensions need an
+ * explicit allowlist entry; dev-mode installs require an opt-in env flag.
+ *
+ * `entry` is a path relative to the extension root pointing at a compiled JS
+ * file. The file is loaded inside the chosen runtime, never in Electron main.
+ */
+export interface BackendModuleContribution {
+    /** Unique within the extension (e.g., "jupyter-runtime") */
+    id: string;
+    /** Path to compiled JS entry, relative to extension root */
+    entry: string;
+    /** Which isolated runtime hosts the module */
+    runtime: BackendModuleRuntime;
+    /**
+     * Additional host-brokered permissions this module requires beyond the
+     * implicit "run native code" grant. Optional -- a module that only needs
+     * ambient Node capabilities (fs, net, child_process) declares an empty
+     * array. The consent prompt always shows the "run native code" line; the
+     * brokered ids here appear as additional checkboxes grouped by risk tier.
+     *
+     * The runtime gate refuses any host-brokered RPC call whose permission is
+     * not in this list and not in the user's grant set.
+     */
+    permissions: ExtensionPermissionId[];
+    /** How/when the user is asked to enable this module */
+    enablement: BackendModuleEnablement;
+}
+//# sourceMappingURL=permissions.d.ts.map

package/dist/types/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/types/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAC7B,iBAAiB,GACjB,yBAAyB,GACzB,0BAA0B,GAC1B,cAAc,GACd,qBAAqB,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,eAAe,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,yBAAyB;IACxC,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;IAEX,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IAEd,8CAA8C;IAC9C,OAAO,EAAE,oBAAoB,CAAC;IAE9B;;;;;;;;;OASG;IACH,WAAW,EAAE,qBAAqB,EAAE,CAAC;IAErC,uDAAuD;IACvD,UAAU,EAAE,uBAAuB,CAAC;CACrC"}

package/dist/types/permissions.js

@@ -0,0 +1,33 @@
+/**
+ * Extension permission types.
+ *
+ * The catalog of valid permission ids is owned by the host (Nimbalyst core).
+ * Extensions reference permission ids; they cannot register new ids.
+ *
+ * Scope of what this catalog actually enforces
+ * --------------------------------------------
+ * The catalog only contains permissions for capabilities Nimbalyst exposes
+ * through main-process brokers (database, workspace files, MCP registration,
+ * secrets). Brokers can refuse a call when the grant is missing, so these
+ * checks are real.
+ *
+ * The catalog deliberately does NOT contain ids for ambient Node capabilities
+ * like spawn-process, raw fs access, or arbitrary network. Once a backend
+ * module is granted (see BackendModuleContribution below), it can call
+ * `require('child_process')`, `require('fs')`, `require('net')` directly --
+ * there is no in-process sandbox that can prevent that. Listing those as
+ * granular permissions would advertise enforcement we cannot deliver.
+ *
+ * Instead, granting a backend module is itself the consent that "this
+ * extension may run native code on this machine with the same trust as your
+ * user account." The first-use prompt says this verbatim. Anything finer
+ * than that requires OS sandboxing or a different runtime model and is not
+ * in scope here.
+ *
+ * Risk tiers shape how the consent prompt groups brokered permissions:
+ *   low      - routine, low-impact (e.g., reading workspace files)
+ *   elevated - non-trivial but bounded (e.g., registering MCP tools)
+ *   high     - powerful, broad impact (e.g., writing the host DB, reading
+ *              secrets)
+ */
+export {};

package/dist/types/theme.d.ts

@@ -14,9 +14,66 @@ export type ThemeColorKey = 'bg' | 'bg-secondary' | 'bg-tertiary' | 'bg-hover' |
  * All colors are optional - missing colors will fall back to base theme.
  */
 export type ThemeColors = Partial<Record<ThemeColorKey, string>>;
+/**
+ * Built-in Monaco theme ids accepted as the `base` field on a
+ * `MonacoThemeContribution`. Single source of truth -- the manifest
+ * validator, the renderer registry helper, and consumer-facing docs
+ * all derive from this list.
+ */
+export declare const MONACO_BASE_THEMES: readonly ["vs", "vs-dark", "hc-black", "hc-light"];
+export type MonacoBaseTheme = typeof MONACO_BASE_THEMES[number];
+/**
+ * Monaco editor token rule -- mirrors monaco-editor's
+ * `editor.ITokenThemeRule`. Keeping the shape redeclared (rather than
+ * importing from monaco-editor) so extension manifests can be validated
+ * and processed in contexts that don't bundle Monaco.
+ */
+export interface MonacoTokenRule {
+    /** Token id (e.g. 'comment', 'keyword.js', 'string.escape') */
+    token: string;
+    /** Hex color WITHOUT leading '#' (Monaco convention) */
+    foreground?: string;
+    /** Hex color WITHOUT leading '#' */
+    background?: string;
+    /** Space-separated styles: 'italic', 'bold', 'underline' */
+    fontStyle?: string;
+}
+/**
+ * Monaco editor theme contribution embedded in a ThemeContribution.
+ * When present, the runtime registers a matching Monaco theme via
+ * `monaco.editor.defineTheme()` and routes Monaco-backed editors
+ * (code files, JSON, etc.) to use it.
+ *
+ * `base` selects the Monaco built-in theme to inherit from. `rules`
+ * carries token-level color rules; `colors` carries Monaco's
+ * editor.* color keys (e.g. 'editor.background').
+ */
+export interface MonacoThemeContribution {
+    /** Built-in Monaco theme used as the base for inheritance */
+    base: MonacoBaseTheme;
+    /**
+     * Whether to inherit unspecified rules/colors from `base`.
+     * Defaults to true (matches Monaco's `defineTheme` default).
+     */
+    inherit?: boolean;
+    /** Token rules applied to syntax-highlighted text */
+    rules: MonacoTokenRule[];
+    /**
+     * Editor color overrides keyed by Monaco color id
+     * (e.g. 'editor.background', 'editor.foreground').
+     */
+    colors: Record<string, string>;
+}
+/**
+ * Where a theme entry returned by `theme:list` originated from.
+ */
+export type ThemeManifestOrigin = 'builtin' | 'user' | 'extension';
 /**
  * Theme manifest schema (theme.json).
  * This is the schema for standalone theme packages.
+ *
+ * The same shape is also returned by the runtime `theme:list` IPC for
+ * extension-contributed themes, with `origin` and `contributedBy` populated.
  */
 export interface ThemeManifest {
     /** Unique theme identifier (e.g., 'solarized-dark') */
@@ -45,6 +102,16 @@ export interface ThemeManifest {
     license?: string;
     /** Homepage or repository URL */
     homepage?: string;
+    /**
+     * Where this theme came from. Populated by the runtime when listing themes.
+     * Not part of the on-disk theme.json schema.
+     */
+    origin?: ThemeManifestOrigin;
+    /**
+     * Extension ID that contributed this theme (only set when `origin === 'extension'`).
+     * Not part of the on-disk theme.json schema.
+     */
+    contributedBy?: string;
 }
 /**
  * Full theme object with metadata and resolved colors.

package/dist/types/theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../src/types/theme.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,MAAM,aAAa,GAErB,IAAI,GAAG,cAAc,GAAG,aAAa,GAAG,UAAU,GAAG,aAAa,GAAG,WAAW,GAEhF,MAAM,GAAG,YAAY,GAAG,YAAY,GAAG,eAAe,GAEtD,QAAQ,GAAG,cAAc,GAEzB,SAAS,GAAG,eAAe,GAE3B,MAAM,GAAG,YAAY,GAErB,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAC;IAEX,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IAEb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAEhB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAC;IAEpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAC;IAEX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAEhB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,oBAAoB;IACpB,MAAM,EAAE,OAAO,CAAC;IAEhB,qDAAqD;IACrD,MAAM,EAAE,WAAW,CAAC;IAEpB,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,0BAA0B;IAC1B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IAEX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,aAAa;IACb,MAAM,EAAE,MAAM,CAAC;IAEf,cAAc;IACd,OAAO,EAAE,MAAM,CAAC;IAEhB,kBAAkB;IAClB,WAAW,EAAE,MAAM,CAAC;IAEpB,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAElB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IAEf,WAAW;IACX,IAAI,EAAE,MAAM,EAAE,CAAC;IAEf,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAEhB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IAEpB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IAEpB,cAAc;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IAEf,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IAEf,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAEhB,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}
+{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../src/types/theme.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,MAAM,aAAa,GAErB,IAAI,GAAG,cAAc,GAAG,aAAa,GAAG,UAAU,GAAG,aAAa,GAAG,WAAW,GAEhF,MAAM,GAAG,YAAY,GAAG,YAAY,GAAG,eAAe,GAEtD,QAAQ,GAAG,cAAc,GAEzB,SAAS,GAAG,eAAe,GAE3B,MAAM,GAAG,YAAY,GAErB,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,oDAAqD,CAAC;AACrF,MAAM,MAAM,eAAe,GAAG,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,IAAI,EAAE,eAAe,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qDAAqD;IACrD,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAC;IAEX,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IAEb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAEhB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAC;IAEpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAE7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAC;IAEX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAEhB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,oBAAoB;IACpB,MAAM,EAAE,OAAO,CAAC;IAEhB,qDAAqD;IACrD,MAAM,EAAE,WAAW,CAAC;IAEpB,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,0BAA0B;IAC1B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IAEX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,aAAa;IACb,MAAM,EAAE,MAAM,CAAC;IAEf,cAAc;IACd,OAAO,EAAE,MAAM,CAAC;IAEhB,kBAAkB;IAClB,WAAW,EAAE,MAAM,CAAC;IAEpB,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAElB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IAEf,WAAW;IACX,IAAI,EAAE,MAAM,EAAE,CAAC;IAEf,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAEhB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IAEpB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IAEpB,cAAc;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IAEf,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IAEf,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAEhB,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}

package/dist/types/theme.js

@@ -4,4 +4,10 @@
  * Themes are separate from extensions - they provide styling only, no code.
  * This module defines the schema for theme.json manifests and theme metadata.
  */
-export {};
+/**
+ * Built-in Monaco theme ids accepted as the `base` field on a
+ * `MonacoThemeContribution`. Single source of truth -- the manifest
+ * validator, the renderer registry helper, and consumer-facing docs
+ * all derive from this list.
+ */
+export const MONACO_BASE_THEMES = ['vs', 'vs-dark', 'hc-black', 'hc-light'];

package/dist/types/trackerImporter.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Tracker importer contract.
+ *
+ * An importer lets Nimbalyst pull items from an external system (GitHub Issues,
+ * Linear, ...) into the native tracker as ordinary items that carry a back-link
+ * to their upstream source (see the `origin` field on tracker items).
+ *
+ * This is a strict READ-side, one-shot subset of the broader `TrackerProvider`
+ * design: `listBindings` + `list` + `fetch` are enough to power snapshot import.
+ * Write/sync/comment methods can be added later as optional methods without
+ * breaking importers written against this contract.
+ *
+ * ## Runtime model
+ *
+ * Importers do privileged work (network calls, spawning `gh`, reading tokens),
+ * so the implementation runs inside the extension's **backend module**
+ * (utility-process) — not the renderer. The methods below are the RPC surface
+ * the backend module exports under the `importer.*` namespace; the host's
+ * `TrackerImporterRegistry` invokes them and owns turning a {@link TrackerSnapshot}
+ * into a real tracker item through the normal create path (so sync, body Y.Doc,
+ * activity, and issue-key allocation all fire identically to a hand-created item).
+ *
+ * The contribution therefore points at a `backendModuleId` (declared in
+ * `contributions.backendModules`) rather than a renderer component.
+ */
+/** Method names the importer backend module must export, namespaced `importer.*`. */
+export declare const TRACKER_IMPORTER_RPC_METHODS: {
+    readonly isAuthenticated: "importer.isAuthenticated";
+    readonly listBindings: "importer.listBindings";
+    readonly list: "importer.list";
+    readonly fetch: "importer.fetch";
+    readonly openExternal: "importer.openExternal";
+};
+/**
+ * Manifest declaration for an importer. Lives in
+ * `contributions.trackerImporters[]`.
+ */
+export interface TrackerImporterContribution {
+    /** Stable id, kebab-case. Used as the `providerId` on imported items' origin. */
+    id: string;
+    /** Human-readable name, e.g. 'GitHub Issues'. */
+    displayName: string;
+    /** Material icon name, e.g. 'bug_report'. */
+    icon: string;
+    /** URN scheme this importer owns, e.g. 'github' | 'linear'. Routes by URN. */
+    urnScheme: string;
+    /**
+     * Id of the backend module (from `contributions.backendModules`) that
+     * implements the `importer.*` RPC methods.
+     */
+    backendModuleId: string;
+    /** Tracker types this importer may create. Empty/undefined = any creatable type. */
+    importsAs?: string[];
+    /** Settings panel id (from `contributions.settingsPanel`) handling auth + bindings. */
+    settingsPanelId?: string;
+}
+/** A configured import target within a provider (a GitHub repo, a Linear team, ...). */
+export interface ImporterBinding {
+    /** Per-binding id, e.g. 'nimbalyst/nimbalyst' for a GitHub repo. */
+    id: string;
+    /** Human-readable label for the binding chooser. */
+    label: string;
+}
+/** Advisory filters for {@link ImporterMethods.list}. The importer applies what it supports. */
+export interface ImporterListFilter {
+    search?: string;
+    state?: 'open' | 'closed' | 'all';
+    labels?: string[];
+    cursor?: string;
+    limit?: number;
+}
+/** Lightweight list entry; the full body is fetched lazily via {@link ImporterMethods.fetch}. */
+export interface ImporterListEntry {
+    externalId: string;
+    urn: string;
+    url: string;
+    title: string;
+    state: string;
+    updatedAt: string;
+}
+export interface ImporterListPage {
+    items: ImporterListEntry[];
+    nextCursor?: string;
+}
+/** Identity of an upstream author, matching the host's tracker identity shape. */
+export interface ImporterIdentity {
+    email: string | null;
+    displayName: string;
+    gitName?: string | null;
+    gitEmail?: string | null;
+}
+/**
+ * Pointer to the upstream record, minus the host-stamped timestamps
+ * (`importedAt` / `lastSyncedAt`), which the host fills in on import.
+ */
+export interface ImporterExternalRef {
+    providerId: string;
+    externalId: string;
+    urn: string;
+    url: string;
+    titleSnapshot: string;
+    stateSnapshot?: string;
+}
+/**
+ * One-shot snapshot returned by {@link ImporterMethods.fetch}. The host converts
+ * this into a tracker item (markdown body -> Lexical state, status mapped to a
+ * workspace status, etc.).
+ */
+export interface TrackerSnapshot {
+    external: ImporterExternalRef;
+    /** Tracker type to create as; importer picks from its `importsAs`. */
+    primaryType: string;
+    title: string;
+    /** Markdown body; host converts to Lexical content on insert. */
+    body?: string;
+    status?: string;
+    priority?: string;
+    labels?: string[];
+    authorIdentity?: ImporterIdentity | null;
+    upstreamCreatedAt?: string;
+    upstreamUpdatedAt?: string;
+}
+/**
+ * The RPC surface an importer backend module implements. Each method maps to a
+ * `TRACKER_IMPORTER_RPC_METHODS` entry. All are async (they cross the
+ * backend-module RPC boundary).
+ */
+export interface ImporterMethods {
+    /** Has the user authenticated this importer? UI hides import flows otherwise. */
+    isAuthenticated(): Promise<boolean>;
+    /** Per-workspace targets the user configured (repos, teams). */
+    listBindings(): Promise<ImporterBinding[]>;
+    /** Page through importable items for one binding. */
+    list(args: {
+        binding: ImporterBinding;
+        filters: ImporterListFilter;
+    }): Promise<ImporterListPage>;
+    /** Pull one external item as a snapshot. One-shot read; the host decides create vs merge. */
+    fetch(args: {
+        externalId: string;
+    }): Promise<TrackerSnapshot>;
+    /** Optional: open the external item in the default browser. */
+    openExternal?(args: {
+        externalId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=trackerImporter.d.ts.map

package/dist/types/trackerImporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trackerImporter.d.ts","sourceRoot":"","sources":["../../src/types/trackerImporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,qFAAqF;AACrF,eAAO,MAAM,4BAA4B;;;;;;CAM/B,CAAC;AAEX;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,iFAAiF;IACjF,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,uFAAuF;IACvF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gGAAgG;AAChG,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iGAAiG;AACjG,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACzC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,gEAAgE;IAChE,YAAY,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3C,qDAAqD;IACrD,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,eAAe,CAAC;QAAC,OAAO,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjG,6FAA6F;IAC7F,KAAK,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9D,+DAA+D;IAC/D,YAAY,CAAC,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D"}

package/dist/types/trackerImporter.js

@@ -0,0 +1,33 @@
+/**
+ * Tracker importer contract.
+ *
+ * An importer lets Nimbalyst pull items from an external system (GitHub Issues,
+ * Linear, ...) into the native tracker as ordinary items that carry a back-link
+ * to their upstream source (see the `origin` field on tracker items).
+ *
+ * This is a strict READ-side, one-shot subset of the broader `TrackerProvider`
+ * design: `listBindings` + `list` + `fetch` are enough to power snapshot import.
+ * Write/sync/comment methods can be added later as optional methods without
+ * breaking importers written against this contract.
+ *
+ * ## Runtime model
+ *
+ * Importers do privileged work (network calls, spawning `gh`, reading tokens),
+ * so the implementation runs inside the extension's **backend module**
+ * (utility-process) — not the renderer. The methods below are the RPC surface
+ * the backend module exports under the `importer.*` namespace; the host's
+ * `TrackerImporterRegistry` invokes them and owns turning a {@link TrackerSnapshot}
+ * into a real tracker item through the normal create path (so sync, body Y.Doc,
+ * activity, and issue-key allocation all fire identically to a hand-created item).
+ *
+ * The contribution therefore points at a `backendModuleId` (declared in
+ * `contributions.backendModules`) rather than a renderer component.
+ */
+/** Method names the importer backend module must export, namespaced `importer.*`. */
+export const TRACKER_IMPORTER_RPC_METHODS = {
+    isAuthenticated: 'importer.isAuthenticated',
+    listBindings: 'importer.listBindings',
+    list: 'importer.list',
+    fetch: 'importer.fetch',
+    openExternal: 'importer.openExternal',
+};