@nklisch/pi-enhanced 0.1.0

package/node_modules/@nklisch/pi-plugins/dist/application/ports/runtime-projection.js

@@ -0,0 +1,275 @@
+import { z } from "zod";
+import { canonicalJson, compareUtf8 } from "../../domain/canonical-json.js";
+import { canonicalProvenance, canonicalizeJsonValue, compareProvenanceUtf8, } from "../../domain/canonical-order.js";
+import { ContentDigestSchema, hashContent, } from "../../domain/content-manifest.js";
+import { HookComponentSchema, McpServerComponentSchema, RetainedMetadataSchema, SkillComponentSchema, flattenComponents, } from "../../domain/components.js";
+import { CompatibilityReportSchema, } from "../../domain/compatibility.js";
+import { PluginIdentitySchema, PluginKeySchema } from "../../domain/identity.js";
+import { NormalizedPluginSchema, } from "../../domain/plugin.js";
+import { InstalledRevisionRecordSchema, } from "../../domain/state/installed-state.js";
+import { PluginConfigurationRefSchema, PluginContentRefSchema, PluginDataRefSchema, deriveProjectionRootRef, ProjectionRootRefSchema, } from "../../domain/state/references.js";
+import { ScopeReferenceSchema, } from "../../domain/state/scope.js";
+export const RuntimePluginComponentsSchema = z.object({
+    skills: z.array(SkillComponentSchema).readonly(),
+    hooks: z.array(HookComponentSchema).readonly(),
+    mcpServers: z.array(McpServerComponentSchema).readonly(),
+}).strict().readonly();
+export const PluginRuntimeProjectionSchemaV1 = z.object({
+    schemaVersion: z.literal(1),
+    scope: ScopeReferenceSchema,
+    plugin: PluginKeySchema,
+    pluginIdentity: PluginIdentitySchema,
+    compatibilityDigest: ContentDigestSchema,
+    revision: ContentDigestSchema,
+    contentRef: PluginContentRefSchema,
+    dataRef: PluginDataRefSchema,
+    configurationRef: PluginConfigurationRefSchema.optional(),
+    components: RuntimePluginComponentsSchema,
+    digest: ContentDigestSchema,
+}).strict().readonly().superRefine((projection, context) => {
+    if (projection.plugin !== projection.pluginIdentity.key) {
+        context.addIssue({
+            code: "custom",
+            path: ["pluginIdentity", "key"],
+            message: "projection plugin identity must match its source plugin key",
+        });
+    }
+});
+const ActiveProjectionExpectationSchema = z.object({
+    kind: z.literal("active"),
+    projection: PluginRuntimeProjectionSchemaV1,
+    projectionRef: ProjectionRootRefSchema,
+}).strict().readonly();
+const InactiveProjectionExpectationSchema = z.object({
+    kind: z.literal("inactive"),
+    scope: ScopeReferenceSchema,
+    plugin: PluginKeySchema,
+    digest: ContentDigestSchema,
+}).strict().readonly();
+export const ProjectionExpectationSchema = z.discriminatedUnion("kind", [
+    ActiveProjectionExpectationSchema,
+    InactiveProjectionExpectationSchema,
+]);
+const encoder = new TextEncoder();
+function digestProjection(value, sha256) {
+    return hashContent(encoder.encode(`plugin-runtime-projection-v1\0${canonicalJson(value)}`), sha256);
+}
+function digestInactive(scope, plugin, sha256) {
+    return hashContent(encoder.encode(`plugin-runtime-inactive-v1\0${canonicalJson({ scope, plugin })}`), sha256);
+}
+function canonicalProvenanceOrEmpty(values) {
+    return values.length === 0 ? [] : canonicalProvenance(values);
+}
+function canonicalMetadata(metadata) {
+    const valid = RetainedMetadataSchema.parse(metadata);
+    return RetainedMetadataSchema.parse({
+        key: valid.key,
+        claimed: {
+            value: canonicalizeJsonValue(valid.claimed.value),
+            provenance: canonicalProvenance(valid.claimed.provenance),
+        },
+    });
+}
+function compareMetadata(left, right) {
+    const firstProvenance = compareProvenanceUtf8(left.claimed.provenance[0], right.claimed.provenance[0]);
+    return compareUtf8(left.key, right.key) ||
+        compareUtf8(canonicalJson(left.claimed.value), canonicalJson(right.claimed.value)) ||
+        firstProvenance ||
+        compareUtf8(canonicalJson(left.claimed.provenance), canonicalJson(right.claimed.provenance));
+}
+function canonicalSkill(component) {
+    const valid = SkillComponentSchema.parse(component);
+    return SkillComponentSchema.parse({
+        kind: valid.kind,
+        id: valid.id,
+        name: { value: valid.name.value, provenance: canonicalProvenance(valid.name.provenance) },
+        root: { value: valid.root.value, provenance: canonicalProvenance(valid.root.provenance) },
+        metadata: valid.metadata.map(canonicalMetadata).sort(compareMetadata),
+    });
+}
+function canonicalHook(component) {
+    const valid = HookComponentSchema.parse(component);
+    return HookComponentSchema.parse({
+        kind: valid.kind,
+        id: valid.id,
+        event: { value: valid.event.value, provenance: canonicalProvenance(valid.event.provenance) },
+        ...(valid.matcher === undefined ? {} : {
+            matcher: { value: valid.matcher.value, provenance: canonicalProvenance(valid.matcher.provenance) },
+        }),
+        handler: {
+            value: canonicalizeJsonValue(valid.handler.value),
+            provenance: canonicalProvenance(valid.handler.provenance),
+        },
+        metadata: valid.metadata.map(canonicalMetadata).sort(compareMetadata),
+    });
+}
+function canonicalMcpServer(component) {
+    const valid = McpServerComponentSchema.parse(component);
+    return McpServerComponentSchema.parse({
+        kind: valid.kind,
+        id: valid.id,
+        nativeKey: {
+            value: valid.nativeKey.value,
+            provenance: canonicalProvenance(valid.nativeKey.provenance),
+        },
+        declaration: {
+            value: canonicalizeJsonValue(valid.declaration.value),
+            provenance: canonicalProvenance(valid.declaration.provenance),
+        },
+        metadata: valid.metadata.map(canonicalMetadata).sort(compareMetadata),
+    });
+}
+function canonicalRuntimeComponents(components) {
+    const valid = RuntimePluginComponentsSchema.parse(components);
+    return RuntimePluginComponentsSchema.parse({
+        skills: valid.skills.map(canonicalSkill).sort((left, right) => compareUtf8(left.id, right.id)),
+        hooks: valid.hooks.map(canonicalHook).sort((left, right) => compareUtf8(left.id, right.id)),
+        mcpServers: valid.mcpServers.map(canonicalMcpServer).sort((left, right) => compareUtf8(left.id, right.id)),
+    });
+}
+function sortedCanonicalDiagnostics(values) {
+    return [...values].sort((left, right) => compareUtf8(canonicalJson(left), canonicalJson(right)));
+}
+function canonicalCompatibilityEvidence(report) {
+    const valid = CompatibilityReportSchema.parse(report);
+    return {
+        plugin: valid.plugin,
+        activatable: valid.activatable,
+        components: valid.components.map((component) => ({
+            ...component,
+            requirementIds: [...component.requirementIds].sort(compareUtf8),
+            diagnostics: sortedCanonicalDiagnostics(component.diagnostics),
+        })).sort((left, right) => compareUtf8(left.componentId, right.componentId)),
+        requirements: valid.requirements.map((assessment) => ({
+            ...assessment,
+            requirement: {
+                ...assessment.requirement,
+                provenance: canonicalProvenanceOrEmpty(assessment.requirement.provenance),
+            },
+        })).sort((left, right) => compareUtf8(left.requirement.id, right.requirement.id) ||
+            compareUtf8(canonicalJson(left), canonicalJson(right))),
+        diagnostics: sortedCanonicalDiagnostics(valid.diagnostics),
+    };
+}
+/** Digest the complete report after canonical ordering of its set-like evidence. */
+export function digestCompatibilityReport(report, sha256) {
+    return hashContent(encoder.encode(`compatibility-report-evidence-v1\0${canonicalJson(canonicalCompatibilityEvidence(report))}`), sha256);
+}
+function exactComponentInventory(plugin, report) {
+    const expected = flattenComponents(plugin.components).map((component) => component.id).sort(compareUtf8);
+    const actual = report.components.map((component) => component.componentId).sort(compareUtf8);
+    if (expected.length !== actual.length || expected.some((id, index) => id !== actual[index])) {
+        throw new Error("runtime projection component inventory differs from compatibility evidence");
+    }
+}
+function runtimeComponents(plugin, report) {
+    exactComponentInventory(plugin, report);
+    const verdicts = new Map(report.components.map((assessment) => [assessment.componentId, assessment.verdict.kind]));
+    const skills = [];
+    const hooks = [];
+    const mcpServers = [];
+    for (const component of [
+        ...plugin.components.skills,
+        ...plugin.components.hooks,
+        ...plugin.components.mcpServers,
+    ]) {
+        const verdict = verdicts.get(component.id);
+        if (verdict === undefined || verdict === "incompatible") {
+            throw new Error("runtime projection component inventory is not activatable");
+        }
+        if (verdict === "metadata-only")
+            continue;
+        if (component.kind === "skill")
+            skills.push(component);
+        else if (component.kind === "hook")
+            hooks.push(component);
+        else
+            mcpServers.push(component);
+    }
+    return canonicalRuntimeComponents({ skills, hooks, mcpServers });
+}
+function samePluginIdentity(plugin, report) {
+    return plugin.identity.key === report.plugin.key &&
+        plugin.identity.marketplaceName === report.plugin.marketplaceName &&
+        plugin.identity.marketplaceEntryName === report.plugin.marketplaceEntryName &&
+        plugin.identity.manifestName === report.plugin.manifestName;
+}
+/**
+ * Build the one logical runtime descriptor from normalized, compatibility-checked
+ * evidence. The digest is derived from this exact schema projection, not from
+ * adapter paths or expanded configuration values.
+ */
+export function createPluginRuntimeProjection(input) {
+    const scope = ScopeReferenceSchema.parse(input.scope);
+    const plugin = NormalizedPluginSchema.parse(input.plugin);
+    const compatibility = CompatibilityReportSchema.parse(input.compatibility);
+    const revision = InstalledRevisionRecordSchema.parse(input.revision);
+    if (!samePluginIdentity(plugin, compatibility))
+        throw new Error("projection plugin and compatibility identity differ");
+    if (!compatibility.activatable)
+        throw new Error("incompatible plugin cannot receive an active projection");
+    if (revision.evidence.plugin.key !== plugin.identity.key)
+        throw new Error("projection revision belongs to another plugin");
+    const components = runtimeComponents(plugin, compatibility);
+    const withoutDigest = {
+        schemaVersion: 1,
+        scope,
+        plugin: plugin.identity.key,
+        pluginIdentity: plugin.identity,
+        compatibilityDigest: digestCompatibilityReport(compatibility, input.sha256),
+        revision: revision.revision,
+        contentRef: revision.contentRef,
+        dataRef: revision.dataRef,
+        ...(revision.configurationRef === undefined ? {} : { configurationRef: revision.configurationRef }),
+        components,
+    };
+    const digest = digestProjection(withoutDigest, input.sha256);
+    if (input.digest !== undefined && ContentDigestSchema.parse(input.digest) !== digest) {
+        throw new Error("runtime projection digest does not match its contents");
+    }
+    return PluginRuntimeProjectionSchemaV1.parse({ ...withoutDigest, digest });
+}
+export function createActiveProjectionExpectation(projection, sha256) {
+    const value = PluginRuntimeProjectionSchemaV1.parse(projection);
+    const canonicalComponents = canonicalRuntimeComponents(value.components);
+    if (canonicalJson(value.components) !== canonicalJson(canonicalComponents)) {
+        throw new Error("runtime projection components are not canonical");
+    }
+    const { digest: claimedDigest, ...withoutDigest } = value;
+    const digest = digestProjection(withoutDigest, sha256);
+    if (digest !== claimedDigest)
+        throw new Error("runtime projection digest does not match its contents");
+    const projectionRef = deriveProjectionRootRef({
+        scope: value.scope,
+        plugin: value.plugin,
+        projectionDigest: value.digest,
+    }, sha256);
+    return ActiveProjectionExpectationSchema.parse({ kind: "active", projection: value, projectionRef });
+}
+/** A canonical, scope-qualified tombstone used for all deactivation operations. */
+export function createInactiveProjectionExpectation(input) {
+    const scope = ScopeReferenceSchema.parse(input.scope);
+    const plugin = PluginKeySchema.parse(input.plugin);
+    const digest = digestInactive(scope, plugin, input.sha256);
+    if (input.digest !== undefined && ContentDigestSchema.parse(input.digest) !== digest) {
+        throw new Error("inactive projection digest does not match its scope and plugin");
+    }
+    return InactiveProjectionExpectationSchema.parse({ kind: "inactive", scope, plugin, digest });
+}
+/** Validate adapter evidence and recompute its canonical digest/reference. */
+export function verifyProjectionExpectation(input, sha256) {
+    const value = ProjectionExpectationSchema.parse(input);
+    const expected = value.kind === "active"
+        ? createActiveProjectionExpectation(value.projection, sha256)
+        : createInactiveProjectionExpectation({
+            scope: value.scope,
+            plugin: value.plugin,
+            digest: value.digest,
+            sha256,
+        });
+    if (canonicalJson(value) !== canonicalJson(expected)) {
+        throw new Error("projection expectation evidence does not match its canonical digest or reference");
+    }
+    return expected;
+}
+//# sourceMappingURL=runtime-projection.js.map

package/node_modules/@nklisch/pi-plugins/dist/application/ports/runtime-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-projection.js","sourceRoot":"","sources":["../../../src/application/ports/runtime-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,WAAW,GAEZ,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,GAKlB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,yBAAyB,GAE1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAkB,MAAM,0BAA0B,CAAC;AACjG,OAAO,EACL,sBAAsB,GAEvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,6BAA6B,GAE9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,oBAAoB,GAErB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAGvB,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,eAAe;IACvB,cAAc,EAAE,oBAAoB;IACpC,mBAAmB,EAAE,mBAAmB;IACxC,QAAQ,EAAE,mBAAmB;IAC7B,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE,mBAAmB;IAC5B,gBAAgB,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IACzD,UAAU,EAAE,6BAA6B;IACzC,MAAM,EAAE,mBAAmB;CAC5B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACxD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,EAAE,KAAK,CAAC;YAC/B,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,UAAU,EAAE,+BAA+B;IAC3C,aAAa,EAAE,uBAAuB;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AACvB,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3B,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,mBAAmB;CAC5B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AACvB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACtE,iCAAiC;IACjC,mCAAmC;CACpC,CAAC,CAAC;AAQH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,gBAAgB,CAAC,KAA8C,EAAE,MAAc;IACtF,OAAO,WAAW,CAChB,OAAO,CAAC,MAAM,CAAC,iCAAiC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EACvE,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAqB,EAAE,MAAiB,EAAE,MAAc;IAC9E,OAAO,WAAW,CAChB,OAAO,CAAC,MAAM,CAAC,+BAA+B,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EACjF,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,MAA6B;IAC/D,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA0B;IACnD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO,EAAE;YACP,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACjD,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;SAC1D;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,IAAsB,EAAE,KAAuB;IACtE,MAAM,eAAe,GAAG,qBAAqB,CAC3C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAE,EAC3B,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAE,CAC7B,CAAC;IACF,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;QACrC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClF,eAAe;QACf,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,cAAc,CAAC,SAAyB;IAC/C,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,oBAAoB,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACzF,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;KACtE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,SAAwB;IAC7C,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,mBAAmB,CAAC,KAAK,CAAC;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE;QAC5F,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;SACnG,CAAC;QACF,OAAO,EAAE;YACP,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAkB,CAAC;YAC9D,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;SAC1D;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;KACtE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,SAA6B;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,wBAAwB,CAAC,KAAK,CAAC;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE;YACT,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK;YAC5B,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;SAC5D;QACD,WAAW,EAAE;YACX,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC;YACrD,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC;SAC9D;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;KACtE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,UAAmC;IACrE,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,OAAO,6BAA6B,CAAC,KAAK,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;KAC3G,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAI,MAAoB;IACzD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,8BAA8B,CAAC,MAA2B;IACjE,MAAM,KAAK,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC/C,GAAG,SAAS;YACZ,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/D,WAAW,EAAE,0BAA0B,CAAC,SAAS,CAAC,WAAW,CAAC;SAC/D,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3E,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACpD,GAAG,UAAU;YACb,WAAW,EAAE;gBACX,GAAG,UAAU,CAAC,WAAW;gBACzB,UAAU,EAAE,0BAA0B,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC;aAC1E;SACF,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACvB,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACtD,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,WAAW,EAAE,0BAA0B,CAAC,KAAK,CAAC,WAAW,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,yBAAyB,CACvC,MAA2B,EAC3B,MAAc;IAEd,OAAO,WAAW,CAChB,OAAO,CAAC,MAAM,CAAC,qCAAqC,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAC5G,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAwB,EAAE,MAA2B;IACpF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzG,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7F,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAwB,EAAE,MAA2B;IAC9E,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnH,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,KAAK,MAAM,SAAS,IAAI;QACtB,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM;QAC3B,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK;QAC1B,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU;KAChC,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,KAAK,eAAe;YAAE,SAAS;QAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;aAClD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;;YACrD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,0BAA0B,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAwB,EAAE,MAA2B;IAC/E,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG;QAC9C,MAAM,CAAC,QAAQ,CAAC,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,eAAe;QACjE,MAAM,CAAC,QAAQ,CAAC,oBAAoB,KAAK,MAAM,CAAC,MAAM,CAAC,oBAAoB;QAC3E,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAOE;IAEF,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACvH,IAAI,CAAC,aAAa,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC3G,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC3H,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG;QACpB,aAAa,EAAE,CAAU;QACzB,KAAK;QACL,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QAC3B,cAAc,EAAE,MAAM,CAAC,QAAQ;QAC/B,mBAAmB,EAAE,yBAAyB,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC;QAC3E,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QACnG,UAAU;KACX,CAAC;IACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,+BAA+B,CAAC,KAAK,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,UAAmC,EACnC,MAAc;IAEd,MAAM,KAAK,GAAG,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,aAAa,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvG,MAAM,aAAa,GAAG,uBAAuB,CAAC;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,KAAK,CAAC,MAAM;KAC/B,EAAE,MAAM,CAAC,CAAC;IACX,OAAO,iCAAiC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mCAAmC,CACjD,KAAqG;IAErG,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,mCAAmC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,2BAA2B,CAAC,KAAc,EAAE,MAAc;IACxE,MAAM,KAAK,GAAG,2BAA2B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtC,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QAC7D,CAAC,CAAC,mCAAmC,CAAC;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM;SACP,CAAC,CAAC;IACL,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/application/ports/scope-lock.d.ts

@@ -0,0 +1,15 @@
+import type { ScopeReference } from "../../domain/state/scope.js";
+/**
+ * The capability held while a scope mutation is in its short authoritative
+ * window. Implementations must not make ownership expire while the process is
+ * merely paused; process death is the safe abandonment boundary.
+ */
+export interface ScopeLockLease {
+    readonly scope: ScopeReference;
+    assertOwned(signal: AbortSignal): Promise<void>;
+    release(): Promise<void>;
+}
+/** Cross-process coordination for one complete user or project scope. */
+export interface ScopeLockManager {
+    acquire(scope: ScopeReference, signal: AbortSignal): Promise<ScopeLockLease>;
+}

package/node_modules/@nklisch/pi-plugins/dist/application/ports/scope-lock.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scope-lock.js.map

package/node_modules/@nklisch/pi-plugins/dist/application/ports/scope-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-lock.js","sourceRoot":"","sources":["../../../src/application/ports/scope-lock.ts"],"names":[],"mappings":""}

package/node_modules/@nklisch/pi-plugins/dist/application/ports/secret-store.d.ts

@@ -0,0 +1,100 @@
+import { z } from "zod";
+import { type SecretLocator } from "../../domain/configured-values.js";
+import { SensitiveValue } from "../sensitive-value.js";
+/**
+ * Creation evidence is intentionally opaque to application code. A concrete
+ * adapter must issue an identity-bearing token and accept it only for a
+ * successful create from that adapter; a locator string by itself is never
+ * sufficient proof that this operation owns the credential.
+ */
+declare const secretCreationEvidenceBrand: unique symbol;
+export type SecretCreationEvidence = Readonly<{
+    readonly [secretCreationEvidenceBrand]: true;
+}>;
+/** The result registry is the single source for create-result variants and types. */
+export declare const SecretStoreCreateResultSchemaRegistry: {
+    readonly created: z.ZodReadonly<z.ZodObject<{
+        kind: z.ZodLiteral<"created">;
+        locator: z.core.$ZodBranded<z.ZodString, "SecretLocator", "out">;
+        evidence: z.ZodCustom<Readonly<{
+            readonly [secretCreationEvidenceBrand]: true;
+        }>, Readonly<{
+            readonly [secretCreationEvidenceBrand]: true;
+        }>>;
+    }, z.core.$strict>>;
+    readonly collision: z.ZodReadonly<z.ZodObject<{
+        kind: z.ZodLiteral<"collision">;
+    }, z.core.$strict>>;
+};
+export declare const SecretStoreCreateResultSchema: z.ZodDiscriminatedUnion<[z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"created">;
+    locator: z.core.$ZodBranded<z.ZodString, "SecretLocator", "out">;
+    evidence: z.ZodCustom<Readonly<{
+        readonly [secretCreationEvidenceBrand]: true;
+    }>, Readonly<{
+        readonly [secretCreationEvidenceBrand]: true;
+    }>>;
+}, z.core.$strict>> | z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"collision">;
+}, z.core.$strict>>, ...(z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"created">;
+    locator: z.core.$ZodBranded<z.ZodString, "SecretLocator", "out">;
+    evidence: z.ZodCustom<Readonly<{
+        readonly [secretCreationEvidenceBrand]: true;
+    }>, Readonly<{
+        readonly [secretCreationEvidenceBrand]: true;
+    }>>;
+}, z.core.$strict>> | z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"collision">;
+}, z.core.$strict>>)[]], "kind">;
+export type SecretStoreCreateResult = z.infer<typeof SecretStoreCreateResultSchema>;
+export declare const SecretStorePutResultSchema: z.ZodDiscriminatedUnion<[z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"created">;
+    locator: z.core.$ZodBranded<z.ZodString, "SecretLocator", "out">;
+    evidence: z.ZodCustom<Readonly<{
+        readonly [secretCreationEvidenceBrand]: true;
+    }>, Readonly<{
+        readonly [secretCreationEvidenceBrand]: true;
+    }>>;
+}, z.core.$strict>> | z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"collision">;
+}, z.core.$strict>>, ...(z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"created">;
+    locator: z.core.$ZodBranded<z.ZodString, "SecretLocator", "out">;
+    evidence: z.ZodCustom<Readonly<{
+        readonly [secretCreationEvidenceBrand]: true;
+    }>, Readonly<{
+        readonly [secretCreationEvidenceBrand]: true;
+    }>>;
+}, z.core.$strict>> | z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"collision">;
+}, z.core.$strict>>)[]], "kind">;
+export type SecretStorePutResult = SecretStoreCreateResult;
+export declare const SecretStoreGetResultSchema: z.ZodDiscriminatedUnion<[z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"found">;
+    value: z.ZodCustom<SensitiveValue, SensitiveValue>;
+}, z.core.$strict>> | z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"missing">;
+}, z.core.$strict>>, ...(z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"found">;
+    value: z.ZodCustom<SensitiveValue, SensitiveValue>;
+}, z.core.$strict>> | z.ZodReadonly<z.ZodObject<{
+    kind: z.ZodLiteral<"missing">;
+}, z.core.$strict>>)[]], "kind">;
+export type SecretStoreGetResult = z.infer<typeof SecretStoreGetResultSchema>;
+export declare const SecretStoreRemoveResultSchema: z.ZodUnion<[z.ZodLiteral<"missing"> | z.ZodLiteral<"removed">, ...(z.ZodLiteral<"missing"> | z.ZodLiteral<"removed">)[]]>;
+export type SecretStoreRemoveResult = z.infer<typeof SecretStoreRemoveResultSchema>;
+/**
+ * Adapter-neutral OS credential boundary. `put` is an atomic no-replace
+ * create: it returns `collision` when the locator already exists and must not
+ * alter the existing value. `removeOwned` requires evidence returned by a
+ * successful `put`; `remove` is reserved for an explicitly authoritative
+ * document retirement and therefore still takes its proven locator.
+ */
+export interface SecretStore {
+    put(locator: SecretLocator, value: SensitiveValue, signal: AbortSignal): Promise<SecretStorePutResult>;
+    get(locator: SecretLocator, signal: AbortSignal): Promise<SecretStoreGetResult>;
+    remove(locator: SecretLocator, signal: AbortSignal): Promise<SecretStoreRemoveResult>;
+    removeOwned(evidence: SecretCreationEvidence, signal: AbortSignal): Promise<SecretStoreRemoveResult>;
+}
+export {};

package/node_modules/@nklisch/pi-plugins/dist/application/ports/secret-store.js

@@ -0,0 +1,36 @@
+import { z } from "zod";
+import { SecretLocatorSchema } from "../../domain/configured-values.js";
+import { SensitiveValue } from "../sensitive-value.js";
+const SecretCreationEvidenceSchema = z.custom((value) => value !== null && typeof value === "object");
+/** The result registry is the single source for create-result variants and types. */
+export const SecretStoreCreateResultSchemaRegistry = {
+    created: z.object({
+        kind: z.literal("created"),
+        locator: SecretLocatorSchema,
+        evidence: SecretCreationEvidenceSchema,
+    }).strict().readonly(),
+    collision: z.object({
+        kind: z.literal("collision"),
+    }).strict().readonly(),
+};
+const secretStoreCreateResultSchemas = Object.values(SecretStoreCreateResultSchemaRegistry);
+export const SecretStoreCreateResultSchema = z.discriminatedUnion("kind", secretStoreCreateResultSchemas);
+// `put` is the existing port verb; retain a directly named alias so adapter
+// implementations and conformance suites cannot fall back to an untyped void.
+export const SecretStorePutResultSchema = SecretStoreCreateResultSchema;
+const SecretStoreGetResultSchemaRegistry = {
+    found: z.object({
+        kind: z.literal("found"),
+        value: z.custom((value) => value instanceof SensitiveValue),
+    }).strict().readonly(),
+    missing: z.object({ kind: z.literal("missing") }).strict().readonly(),
+};
+const secretStoreGetResultSchemas = Object.values(SecretStoreGetResultSchemaRegistry);
+export const SecretStoreGetResultSchema = z.discriminatedUnion("kind", secretStoreGetResultSchemas);
+const SecretStoreRemoveResultSchemaRegistry = {
+    removed: z.literal("removed"),
+    missing: z.literal("missing"),
+};
+const secretStoreRemoveResultSchemas = Object.values(SecretStoreRemoveResultSchemaRegistry);
+export const SecretStoreRemoveResultSchema = z.union(secretStoreRemoveResultSchemas);
+//# sourceMappingURL=secret-store.js.map

package/node_modules/@nklisch/pi-plugins/dist/application/ports/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../../src/application/ports/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAsB,MAAM,mCAAmC,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAavD,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CACvD,CAAC;AAEF,qFAAqF;AACrF,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,4BAA4B;KACvC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;KAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACd,CAAC;AAEX,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC,qCAAqC,CAGzF,CAAC;AACF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;AAE1G,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AAGxE,MAAM,kCAAkC,GAAG;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,cAAc,CAAC;KAC5E,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7D,CAAC;AACX,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAGnF,CAAC;AACF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;AAGpG,MAAM,qCAAqC,GAAG;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;CACrB,CAAC;AACX,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC,qCAAqC,CAGzF,CAAC;AACF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/application/ports/skill-resource-path.d.ts

@@ -0,0 +1,20 @@
+import type { ManifestFileRef } from "./content-read.js";
+export type SkillResourcePathFailureCode = "ROOT_MISSING" | "ROOT_ESCAPE" | "ROOT_MUTATED" | "ROOT_UNREADABLE" | "ADAPTER_FAILED";
+export type VerifiedSkillResourcePath = Readonly<{
+    /** Ephemeral absolute path returned only to the Pi adapter. */
+    path: string;
+    /** Process-local canonical key for exact-file deduplication. */
+    canonicalPath: string;
+}>;
+export type SkillResourcePathVerificationResult = Readonly<{
+    kind: "ready";
+    value: VerifiedSkillResourcePath;
+}> | Readonly<{
+    kind: "failed";
+    code: SkillResourcePathFailureCode;
+}> | Readonly<{
+    kind: "cancelled";
+}>;
+export interface SkillResourcePathPort {
+    verify(file: ManifestFileRef, signal: AbortSignal): Promise<SkillResourcePathVerificationResult>;
+}

package/node_modules/@nklisch/pi-plugins/dist/application/ports/skill-resource-path.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skill-resource-path.js.map

package/node_modules/@nklisch/pi-plugins/dist/application/ports/skill-resource-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-resource-path.js","sourceRoot":"","sources":["../../../src/application/ports/skill-resource-path.ts"],"names":[],"mappings":""}

package/node_modules/@nklisch/pi-plugins/dist/application/ports/source-acquisition.d.ts

@@ -0,0 +1,88 @@
+import type { MarketplaceSource, PluginSource, ResolvedMarketplaceSource, ResolvedPluginSource, Sha256 } from "../../domain/source.js";
+import type { ContentManifest, ContentDigest } from "../../domain/content-manifest.js";
+export declare const DEFAULT_MATERIALIZATION_LIMITS: Readonly<{
+    maxEntries: 20000;
+    maxPathBytes: 1024;
+    maxSegmentBytes: 255;
+    maxTotalPathBytes: number;
+    maxFileBytes: number;
+    maxExpandedBytes: number;
+    maxArchiveBytes: number;
+    maxExpansionRatio: 100;
+    maxPackumentBytes: number;
+    maxRedirects: 5;
+}>;
+export type MaterializationLimits = Readonly<{
+    [K in keyof typeof DEFAULT_MATERIALIZATION_LIMITS]: number;
+}>;
+/** A caller-owned, pre-created empty directory. No adapter may select it. */
+export type StagingSlot = Readonly<{
+    root: string;
+}>;
+export type ContentEntry = Readonly<{
+    kind: "directory";
+    path: string;
+    mode: number;
+}> | Readonly<{
+    kind: "file";
+    path: string;
+    mode: number;
+    body: AsyncIterable<Uint8Array>;
+}> | Readonly<{
+    kind: "symlink";
+    path: string;
+    mode: number;
+    target: string;
+}> | Readonly<{
+    kind: "hardlink";
+    path: string;
+    mode: number;
+    target: string;
+}>;
+export interface SecureContentSession {
+    add(entry: ContentEntry, signal: AbortSignal): Promise<void>;
+    finalize(signal: AbortSignal): Promise<Readonly<{
+        root: string;
+        content: ContentManifest;
+    }>>;
+    abort(cause?: unknown): Promise<void>;
+    /** The only scratch root adapters may use. */
+    readonly workRoot: string;
+    /** The writer's canonical content root, used to reject forged handoffs. */
+    readonly contentRoot: string;
+}
+export interface SecureContentWriterFactory {
+    /** Canonicalize and validate the caller-owned slot before opening it. */
+    canonicalize(slot: StagingSlot): Promise<StagingSlot>;
+    open(slot: StagingSlot, limits?: Partial<MaterializationLimits>): Promise<SecureContentSession>;
+}
+/** The only port allowed to copy a marketplace-relative source tree. */
+export interface MarketplacePathAcquirer {
+    materialize(source: Extract<PluginSource, {
+        kind: "marketplace-path";
+    }>, context: Readonly<{
+        root: string;
+        source: ResolvedMarketplaceSource;
+        contentRootDigest: ContentDigest;
+        content: ContentManifest;
+        binding: ContentDigest;
+    }>, sink: SecureContentSession, signal: AbortSignal): Promise<void>;
+}
+export interface GitSourceAcquirer {
+    materializeMarketplace(source: MarketplaceSource, sink: SecureContentSession, signal: AbortSignal): Promise<ResolvedMarketplaceSource>;
+    materializePlugin(source: Extract<PluginSource, {
+        kind: "git" | "git-subdir";
+    }>, sink: SecureContentSession, signal: AbortSignal): Promise<ResolvedPluginSource>;
+}
+export interface NpmSourceAcquirer {
+    materialize(source: Extract<PluginSource, {
+        kind: "npm";
+    }>, sink: SecureContentSession, signal: AbortSignal): Promise<ResolvedPluginSource>;
+}
+export type SourceMaterializationPortDependencies = Readonly<{
+    git: GitSourceAcquirer;
+    npm: NpmSourceAcquirer;
+    content: SecureContentWriterFactory;
+    sha256: Sha256;
+    marketplace?: MarketplacePathAcquirer;
+}>;

package/node_modules/@nklisch/pi-plugins/dist/application/ports/source-acquisition.js

@@ -0,0 +1,13 @@
+export const DEFAULT_MATERIALIZATION_LIMITS = Object.freeze({
+    maxEntries: 20_000,
+    maxPathBytes: 1_024,
+    maxSegmentBytes: 255,
+    maxTotalPathBytes: 16 * 1024 * 1024,
+    maxFileBytes: 64 * 1024 * 1024,
+    maxExpandedBytes: 512 * 1024 * 1024,
+    maxArchiveBytes: 128 * 1024 * 1024,
+    maxExpansionRatio: 100,
+    maxPackumentBytes: 10 * 1024 * 1024,
+    maxRedirects: 5,
+});
+//# sourceMappingURL=source-acquisition.js.map

package/node_modules/@nklisch/pi-plugins/dist/application/ports/source-acquisition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-acquisition.js","sourceRoot":"","sources":["../../../src/application/ports/source-acquisition.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,UAAU,EAAE,MAAM;IAClB,YAAY,EAAE,KAAK;IACnB,eAAe,EAAE,GAAG;IACpB,iBAAiB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IACnC,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC9B,gBAAgB,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IACnC,eAAe,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IAClC,iBAAiB,EAAE,GAAG;IACtB,iBAAiB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IACnC,YAAY,EAAE,CAAC;CAChB,CAAC,CAAC"}