@sensigo/realm 0.12.1 → 0.14.0

package/dist/index.d.ts

@@ -23,18 +23,26 @@ export { TERMINAL_PHASES, RESUMABLE_PHASES, WAITING_PHASES, isTerminalPhase, TER
 export { evaluatePrecondition, checkPreconditions, evaluateAllPreconditions, } from './engine/precondition.js';
 export type { PreconditionResult } from './engine/precondition.js';
 export type { StepDiagnostics } from './types/run-record.js';
-export declare const VERSION = "0.12.1";
+export declare const VERSION = "0.14.0";
 export type { ToolCallRecord, McpServerConfig } from './types/mcp-types.js';
 export type { ServiceAdapter, ServiceResponse } from './extensions/service-adapter.js';
 export type { StepHandler, StepHandlerInputs, StepContext, StepHandlerResult, } from './extensions/step-handler.js';
 export type { Processor, ProcessorInput, ProcessorOutput } from './extensions/processor.js';
 export { ExtensionRegistry } from './extensions/registry.js';
 export { createDefaultRegistry } from './extensions/default-registry.js';
+export type { ExtensionManifest, ExtensionModuleRef } from './extensions/manifest.js';
+export { validateDeploymentManifest, collectManifestSecretRefs, DEPLOYMENT_MANIFEST_JSON_SCHEMA, } from './manifest/deployment-manifest.js';
+export type { DeploymentManifest, ManifestEntry, ManifestSecretsConfig, SlackGateNotifierConfig, ExtensionFactory, ExtensionFactoryContext, } from './manifest/deployment-manifest.js';
+export { scanSecretString, stringHasSecretRefs, interpolateSecretString, interpolateConfigTree, findSecretRefSites, } from './manifest/secret-refs.js';
+export type { SecretRefSite, SecretScanResult } from './manifest/secret-refs.js';
+export type { ExtensionIdentityEntry, ExtensionIdentityModule, ExtensionIdentityTree, ExtensionIdentitySignals, } from './types/extension-identity.js';
+export { extensionIdentityDiffers } from './types/extension-identity.js';
 export { captureEvidence } from './evidence/snapshot.js';
 export type { CaptureEvidenceParams } from './evidence/snapshot.js';
 export { GenericHttpAdapter } from './adapters/http-adapter.js';
 export type { HttpAdapterConfig } from './adapters/http-adapter.js';
 export { FileSystemAdapter } from './adapters/file-adapter.js';
+export { MockAdapter } from './adapters/mock-adapter.js';
 export { GitHubAdapter } from './adapters/github-adapter.js';
 export type { GitHubAdapterConfig } from './adapters/github-adapter.js';
 export { SlackAdapter } from './adapters/slack-adapter.js';
@@ -52,7 +60,6 @@ export type { NotionAdapterConfig } from './adapters/notion-adapter.js';
 export { TRACE_POLICY_VERSION, TRACE_POLICY, TRACE_POLICY_HASH } from './engine/trace-policy.js';
 export type { TracePolicyDescriptor, TracePolicyVersion } from './engine/trace-policy.js';
 export { validateInputSchema } from './validation/input-schema.js';
-export { loadSecrets, resolveSecret } from './config/secrets.js';
 export { loadWorkflowFromFile, loadWorkflowFromString, CURRENT_WORKFLOW_SCHEMA_VERSION, } from './workflow/yaml-loader.js';
 export { JsonWorkflowStore } from './workflow/registrar.js';
 export type { WorkflowRegistrar } from './workflow/registrar.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,YAAY,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,cAAc,GACf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,eAAO,MAAM,OAAO,WAAW,CAAC;AAChC,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5E,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvF,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAGzE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,YAAY,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACjG,YAAY,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAG1E,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,YAAY,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,cAAc,GACf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,eAAO,MAAM,OAAO,WAAW,CAAC;AAChC,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5E,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvF,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACtF,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACjF,YAAY,EACV,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAGzE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,YAAY,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACjG,YAAY,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAG1E,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC"}

package/dist/index.js

@@ -16,14 +16,18 @@ export { submitHumanResponse, executeChain, buildNextActions, buildPreExecutionE
 export { findEligibleSteps, isWorkflowComplete, deriveRunPhase, buildEvidenceByStep, propagateSkips, } from './engine/eligibility.js';
 export { TERMINAL_PHASES, RESUMABLE_PHASES, WAITING_PHASES, isTerminalPhase, TERMINAL_STATES, RESUMABLE_STATES, WAITING_STATES, isTerminalState, } from './engine/lifecycle.js';
 export { evaluatePrecondition, checkPreconditions, evaluateAllPreconditions, } from './engine/precondition.js';
-export const VERSION = '0.12.1';
+export const VERSION = '0.14.0';
 export { ExtensionRegistry } from './extensions/registry.js';
 export { createDefaultRegistry } from './extensions/default-registry.js';
+export { validateDeploymentManifest, collectManifestSecretRefs, DEPLOYMENT_MANIFEST_JSON_SCHEMA, } from './manifest/deployment-manifest.js';
+export { scanSecretString, stringHasSecretRefs, interpolateSecretString, interpolateConfigTree, findSecretRefSites, } from './manifest/secret-refs.js';
+export { extensionIdentityDiffers } from './types/extension-identity.js';
 // Evidence
 export { captureEvidence } from './evidence/snapshot.js';
 // Adapters
 export { GenericHttpAdapter } from './adapters/http-adapter.js';
 export { FileSystemAdapter } from './adapters/file-adapter.js';
+export { MockAdapter } from './adapters/mock-adapter.js';
 export { GitHubAdapter } from './adapters/github-adapter.js';
 export { SlackAdapter } from './adapters/slack-adapter.js';
 export { GorgiasAdapter } from './adapters/gorgias-adapter.js';
@@ -35,8 +39,6 @@ export { NotionAdapter } from './adapters/notion-adapter.js';
 export { TRACE_POLICY_VERSION, TRACE_POLICY, TRACE_POLICY_HASH } from './engine/trace-policy.js';
 // Validation
 export { validateInputSchema } from './validation/input-schema.js';
-// Config
-export { loadSecrets, resolveSecret } from './config/secrets.js';
 // Workflow
 export { loadWorkflowFromFile, loadWorkflowFromString, CURRENT_WORKFLOW_SCHEMA_VERSION, } from './workflow/yaml-loader.js';
 export { JsonWorkflowStore } from './workflow/registrar.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,EACL,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,cAAc,GACf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAGlC,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAYhC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,WAAW;AACX,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,WAAW;AACX,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAMvE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAG7D,eAAe;AACf,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGjG,aAAa;AACb,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE,SAAS;AACT,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEjE,WAAW;AACX,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG5D,qBAAqB;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAI1E,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,EACL,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,cAAc,GACf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAGlC,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAYhC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAS3C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAQnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,WAAW;AACX,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,WAAW;AACX,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAMvE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAG7D,eAAe;AACf,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGjG,aAAa;AACb,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE,WAAW;AACX,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG5D,qBAAqB;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAI1E,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC"}

package/dist/manifest/deployment-manifest.d.ts

@@ -0,0 +1,197 @@
+/** One adapter/handler/processor entry, keyed by REGISTRATION name in the manifest maps. */
+export interface ManifestEntry {
+    /**
+     * What constructs the instance: a built-in catalog name (e.g. `github`), or a module
+     * reference `./path.js#ExportName` resolved against the MANIFEST file's directory
+     * (`#ExportName` optional — default export otherwise). Contains `/` or a file
+     * extension → module ref; else catalog name. Handlers/processors have no catalog —
+     * module refs only. Omitted `use:` is invalid for adapters and handlers/processors
+     * alike (there is nothing to construct).
+     */
+    use?: string;
+    /** Construction config; `${secret:NAME}` references are legal only inside its strings. */
+    config?: Record<string, unknown>;
+}
+/** Slack gate-notifier config — the reborn checkSlackBidirectionalConfig semantics. */
+export interface SlackGateNotifierConfig {
+    type: 'slack';
+    config: {
+        webhook_url?: string;
+        bot_token?: string;
+        channel_id?: string;
+        app_token?: string;
+        signing_secret?: string;
+        events_port?: number;
+        reminder_interval_ms?: number;
+        escalation_threshold_ms?: number;
+    };
+}
+export interface ManifestSecretsConfig {
+    /** Secret sources in PRECEDENCE order. Default: ['dotenv']. `env` is opt-in. */
+    sources?: Array<'dotenv' | 'env'>;
+    /** dotenv file path, relative to the manifest file. Default: `<root>/.env`. */
+    dotenv?: string;
+}
+export interface DeploymentManifest {
+    version: 1;
+    secrets?: ManifestSecretsConfig;
+    adapters?: Record<string, ManifestEntry>;
+    handlers?: Record<string, ManifestEntry>;
+    processors?: Record<string, ManifestEntry>;
+    notifiers?: {
+        slack_gate?: SlackGateNotifierConfig;
+    };
+}
+/**
+ * The ONE construction shape for `use:` module refs AND catalog wrappers: a factory
+ * receiving the registration id and the secret-RESOLVED config, returning the instance.
+ */
+export interface ExtensionFactoryContext {
+    id: string;
+    config: Record<string, unknown>;
+}
+export type ExtensionFactory<T = unknown> = (ctx: ExtensionFactoryContext) => T;
+/** Ajv-strict JSON schema for the deployment manifest document. */
+export declare const DEPLOYMENT_MANIFEST_JSON_SCHEMA: {
+    type: string;
+    additionalProperties: boolean;
+    required: string[];
+    properties: {
+        version: {
+            const: number;
+        };
+        secrets: {
+            type: string;
+            additionalProperties: boolean;
+            properties: {
+                sources: {
+                    type: string;
+                    minItems: number;
+                    items: {
+                        enum: string[];
+                    };
+                };
+                dotenv: {
+                    type: string;
+                    minLength: number;
+                };
+            };
+        };
+        adapters: {
+            readonly type: "object";
+            readonly additionalProperties: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly properties: {
+                    readonly use: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly config: {
+                        readonly type: "object";
+                    };
+                };
+            };
+        };
+        handlers: {
+            readonly type: "object";
+            readonly additionalProperties: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly properties: {
+                    readonly use: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly config: {
+                        readonly type: "object";
+                    };
+                };
+            };
+        };
+        processors: {
+            readonly type: "object";
+            readonly additionalProperties: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly properties: {
+                    readonly use: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly config: {
+                        readonly type: "object";
+                    };
+                };
+            };
+        };
+        notifiers: {
+            type: string;
+            additionalProperties: boolean;
+            properties: {
+                slack_gate: {
+                    type: string;
+                    additionalProperties: boolean;
+                    required: string[];
+                    properties: {
+                        type: {
+                            const: string;
+                        };
+                        config: {
+                            type: string;
+                            additionalProperties: boolean;
+                            properties: {
+                                webhook_url: {
+                                    type: string;
+                                    minLength: number;
+                                };
+                                bot_token: {
+                                    type: string;
+                                    minLength: number;
+                                };
+                                channel_id: {
+                                    type: string;
+                                    minLength: number;
+                                };
+                                app_token: {
+                                    type: string;
+                                    minLength: number;
+                                };
+                                signing_secret: {
+                                    type: string;
+                                    minLength: number;
+                                };
+                                events_port: {
+                                    type: string;
+                                    minimum: number;
+                                    maximum: number;
+                                };
+                                reminder_interval_ms: {
+                                    type: string;
+                                    minimum: number;
+                                };
+                                escalation_threshold_ms: {
+                                    type: string;
+                                    minimum: number;
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * Pure structural + semantic validation of a parsed manifest document.
+ * Returns actionable error strings (empty = valid). Empty maps and absent sections are
+ * valid. Duplicate-name detection across manifest entries and code-module exports is
+ * loader-side (post-resolution) — one namespace, one collision map.
+ */
+export declare function validateDeploymentManifest(raw: unknown): string[];
+/** Collects every well-formed secret reference site across all config trees. */
+export declare function collectManifestSecretRefs(manifest: DeploymentManifest): Array<{
+    name: string;
+    path: string;
+}>;
+//# sourceMappingURL=deployment-manifest.d.ts.map

package/dist/manifest/deployment-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-manifest.d.ts","sourceRoot":"","sources":["../../src/manifest/deployment-manifest.ts"],"names":[],"mappings":"AAWA,4FAA4F;AAC5F,MAAM,WAAW,aAAa;IAC5B;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uFAAuF;AACvF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE;QACN,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;IAClC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3C,SAAS,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,uBAAuB,CAAA;KAAE,CAAC;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AACD,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,uBAAuB,KAAK,CAAC,CAAC;AAgBhF,mEAAmE;AACnE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD3C,CAAC;AAWF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAuCjE;AA0DD,gFAAgF;AAChF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,kBAAkB,GAC3B,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBvC"}

package/dist/manifest/deployment-manifest.js

@@ -0,0 +1,174 @@
+// Deployment manifest (`<deployment root>/realm.yaml`, v0.14) — types, Ajv-STRICT schema,
+// and the pure validate function (precedent: trigger-schema.ts). The manifest is the single
+// home of ALL deployment configuration: adapter construction (built-in catalog + custom
+// factories), handler/processor construction config, secret bindings (`${secret:NAME}`),
+// and gate-notifier config. Core owns SHAPE validation only — the CLI owns fs/parse/
+// resolve/construct. Workflows keep declaring CODE via `extensions:`; the manifest owns
+// CONFIG. Trust model: manifest-write = credential-redirection = code-write-equivalent.
+import { Ajv } from 'ajv';
+import { findSecretRefSites } from './secret-refs.js';
+const ENTRY_SCHEMA = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        use: { type: 'string', minLength: 1 },
+        config: { type: 'object' },
+    },
+};
+const ENTRY_MAP_SCHEMA = {
+    type: 'object',
+    additionalProperties: ENTRY_SCHEMA,
+};
+/** Ajv-strict JSON schema for the deployment manifest document. */
+export const DEPLOYMENT_MANIFEST_JSON_SCHEMA = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['version'],
+    properties: {
+        version: { const: 1 },
+        secrets: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                sources: {
+                    type: 'array',
+                    minItems: 1,
+                    items: { enum: ['dotenv', 'env'] },
+                },
+                dotenv: { type: 'string', minLength: 1 },
+            },
+        },
+        adapters: ENTRY_MAP_SCHEMA,
+        handlers: ENTRY_MAP_SCHEMA,
+        processors: ENTRY_MAP_SCHEMA,
+        notifiers: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                slack_gate: {
+                    type: 'object',
+                    additionalProperties: false,
+                    required: ['type', 'config'],
+                    properties: {
+                        type: { const: 'slack' },
+                        config: {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                webhook_url: { type: 'string', minLength: 1 },
+                                bot_token: { type: 'string', minLength: 1 },
+                                channel_id: { type: 'string', minLength: 1 },
+                                app_token: { type: 'string', minLength: 1 },
+                                signing_secret: { type: 'string', minLength: 1 },
+                                events_port: { type: 'integer', minimum: 1, maximum: 65535 },
+                                reminder_interval_ms: { type: 'integer', minimum: 1 },
+                                escalation_threshold_ms: { type: 'integer', minimum: 1 },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    },
+};
+function formatAjvError(err) {
+    const where = err.instancePath === '' ? 'manifest' : `manifest${err.instancePath}`;
+    const detail = err.keyword === 'additionalProperties'
+        ? `unknown key '${String(err.params.additionalProperty)}'`
+        : (err.message ?? 'invalid');
+    return `${where}: ${detail}`;
+}
+/**
+ * Pure structural + semantic validation of a parsed manifest document.
+ * Returns actionable error strings (empty = valid). Empty maps and absent sections are
+ * valid. Duplicate-name detection across manifest entries and code-module exports is
+ * loader-side (post-resolution) — one namespace, one collision map.
+ */
+export function validateDeploymentManifest(raw) {
+    const errors = [];
+    const ajv = new Ajv({ strict: true, allErrors: true });
+    if (!ajv.validate(DEPLOYMENT_MANIFEST_JSON_SCHEMA, raw)) {
+        for (const err of ajv.errors ?? [])
+            errors.push(formatAjvError(err));
+        return errors;
+    }
+    const manifest = raw;
+    // Notifier combo validation (the reborn checkSlackBidirectionalConfig, as hard schema):
+    const slack = manifest.notifiers?.slack_gate?.config;
+    if (slack !== undefined) {
+        if (slack.app_token !== undefined && slack.bot_token === undefined) {
+            errors.push(`notifiers.slack_gate: 'app_token' (Socket Mode) requires 'bot_token' — Socket Mode replies are posted via the bot token.`);
+        }
+        if (slack.signing_secret !== undefined && slack.events_port === undefined) {
+            errors.push(`notifiers.slack_gate: 'signing_secret' (Events API) requires 'events_port' — the events listener needs a port to bind.`);
+        }
+        if (slack.events_port !== undefined && slack.signing_secret === undefined) {
+            errors.push(`notifiers.slack_gate: 'events_port' requires 'signing_secret' — an events listener without request verification is not allowed.`);
+        }
+        if (slack.app_token !== undefined && slack.signing_secret !== undefined) {
+            errors.push(`notifiers.slack_gate: 'app_token' and 'signing_secret' are mutually exclusive — Socket Mode and the Events API are alternative reply channels; configure one.`);
+        }
+    }
+    // `${secret:NAME}` placement: legal ONLY inside string values under `config` trees.
+    // Also reject malformed reference-like fragments anywhere (typos never pass silently).
+    errors.push(...checkSecretRefPlacement(manifest));
+    return errors;
+}
+/** Sections whose `config` subtree is the ONLY legal home for secret references. */
+function checkSecretRefPlacement(manifest) {
+    const errors = [];
+    const checkEntryMap = (section, map) => {
+        for (const [name, entry] of Object.entries(map ?? {})) {
+            // use: must not carry secret refs (it names code, not config).
+            if (entry.use !== undefined) {
+                const scan = findSecretRefSites(entry.use, `${section}.${name}.use`);
+                for (const site of scan.sites) {
+                    errors.push(`${site.path}: '\${secret:${site.name}}' is not allowed here — secret references are legal only inside string values under 'config'.`);
+                }
+                for (const bad of scan.malformed) {
+                    errors.push(`${bad.path}: malformed secret reference '${bad.fragment}'.`);
+                }
+            }
+            const scan = findSecretRefSites(entry.config, `${section}.${name}.config`);
+            for (const bad of scan.malformed) {
+                errors.push(`${bad.path}: malformed secret reference '${bad.fragment}' — the form is \${secret:NAME} with NAME = [A-Z0-9_]+.`);
+            }
+        }
+    };
+    checkEntryMap('adapters', manifest.adapters);
+    checkEntryMap('handlers', manifest.handlers);
+    checkEntryMap('processors', manifest.processors);
+    const slackConfig = manifest.notifiers?.slack_gate?.config;
+    if (slackConfig !== undefined) {
+        const scan = findSecretRefSites(slackConfig, 'notifiers.slack_gate.config');
+        for (const bad of scan.malformed) {
+            errors.push(`${bad.path}: malformed secret reference '${bad.fragment}' — the form is \${secret:NAME} with NAME = [A-Z0-9_]+.`);
+        }
+    }
+    // secrets.dotenv must not carry refs (it locates the source, it cannot use one).
+    if (manifest.secrets?.dotenv !== undefined) {
+        const scan = findSecretRefSites(manifest.secrets.dotenv, 'secrets.dotenv');
+        for (const site of scan.sites) {
+            errors.push(`${site.path}: '\${secret:${site.name}}' is not allowed here — secret references are legal only inside string values under 'config'.`);
+        }
+    }
+    return errors;
+}
+/** Collects every well-formed secret reference site across all config trees. */
+export function collectManifestSecretRefs(manifest) {
+    const sites = [];
+    const fromMap = (section, map) => {
+        for (const [name, entry] of Object.entries(map ?? {})) {
+            sites.push(...findSecretRefSites(entry.config, `${section}.${name}.config`).sites);
+        }
+    };
+    fromMap('adapters', manifest.adapters);
+    fromMap('handlers', manifest.handlers);
+    fromMap('processors', manifest.processors);
+    const slack = manifest.notifiers?.slack_gate?.config;
+    if (slack !== undefined) {
+        sites.push(...findSecretRefSites(slack, 'notifiers.slack_gate.config').sites);
+    }
+    return sites;
+}
+//# sourceMappingURL=deployment-manifest.js.map

package/dist/manifest/deployment-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-manifest.js","sourceRoot":"","sources":["../../src/manifest/deployment-manifest.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,4FAA4F;AAC5F,wFAAwF;AACxF,yFAAyF;AACzF,qFAAqF;AACrF,wFAAwF;AACxF,wFAAwF;AACxF,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAE1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AA0DtD,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;QACrC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC3B;CACO,CAAC;AAEX,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,YAAY;CAC1B,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,SAAS,CAAC;IACrB,UAAU,EAAE;QACV,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,CAAC;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE;iBACnC;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;aACzC;SACF;QACD,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,gBAAgB;QAC5B,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,oBAAoB,EAAE,KAAK;oBAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAC5B,UAAU,EAAE;wBACV,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;wBACxB,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,oBAAoB,EAAE,KAAK;4BAC3B,UAAU,EAAE;gCACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gCAC7C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gCAC3C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gCAC5C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gCAC3C,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gCAChD,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;gCAC5D,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;gCACrD,uBAAuB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;6BACzD;yBACF;qBACF;iBACF;aACF;SACF;KACF;CACF,CAAC;AAEF,SAAS,cAAc,CAAC,GAAgB;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,YAAY,EAAE,CAAC;IACnF,MAAM,MAAM,GACV,GAAG,CAAC,OAAO,KAAK,sBAAsB;QACpC,CAAC,CAAC,gBAAgB,MAAM,CAAE,GAAG,CAAC,MAA0C,CAAC,kBAAkB,CAAC,GAAG;QAC/F,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;IACjC,OAAO,GAAG,KAAK,KAAK,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAY;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,+BAA+B,EAAE,GAAG,CAAC,EAAE,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAyB,CAAC;IAE3C,wFAAwF;IACxF,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CACT,0HAA0H,CAC3H,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CACT,wHAAwH,CACzH,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CACT,iIAAiI,CAClI,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CACT,+JAA+J,CAChK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,uFAAuF;IACvF,MAAM,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAElD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,uBAAuB,CAAC,QAA4B;IAC3D,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,aAAa,GAAG,CACpB,OAA+C,EAC/C,GAA8C,EACxC,EAAE;QACR,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACtD,+DAA+D;YAC/D,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,IAAI,MAAM,CAAC,CAAC;gBACrE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,IAAI,gGAAgG,CACtI,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,iCAAiC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,OAAO,IAAI,IAAI,SAAS,CAAC,CAAC;YAC3E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,CAAC,IAAI,iCAAiC,GAAG,CAAC,QAAQ,yDAAyD,CAClH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEjD,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC;IAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,kBAAkB,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;QAC5E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,CAAC,IAAI,iCAAiC,GAAG,CAAC,QAAQ,yDAAyD,CAClH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,IAAI,gGAAgG,CACtI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CACvC,QAA4B;IAE5B,MAAM,KAAK,GAA0C,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,CACd,OAA+C,EAC/C,GAA8C,EACxC,EAAE;QACR,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,OAAO,IAAI,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC;QACrF,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/manifest/secret-refs.d.ts

@@ -0,0 +1,44 @@
+/** Result of scanning one string value for secret references. */
+export interface SecretScanResult {
+    /** Referenced secret NAMEs, in order of appearance (duplicates preserved). */
+    refs: string[];
+    /** Malformed `${secret:...}`-like fragments (bad charset, unterminated). */
+    malformed: string[];
+}
+/**
+ * Scans a string left-to-right honoring the `$$` escape. Well-formed references are
+ * collected; anything starting like a reference but not matching the grammar is malformed.
+ */
+export declare function scanSecretString(value: string): SecretScanResult;
+/** True when the string contains at least one well-formed secret reference. */
+export declare function stringHasSecretRefs(value: string): boolean;
+/**
+ * Interpolates a string: well-formed references are replaced via `resolve(name)`,
+ * `$$` becomes a literal `$`. The caller guarantees every referenced name resolves
+ * (the CLI aggregates unresolved references into one loud error BEFORE interpolating).
+ */
+export declare function interpolateSecretString(value: string, resolve: (name: string) => string): string;
+/** One secret reference found in a config tree, with its binding site for error messages. */
+export interface SecretRefSite {
+    /** Referenced secret NAME. */
+    name: string;
+    /** Dot-path binding site, e.g. `adapters.github.config.auth.token`. */
+    path: string;
+}
+/**
+ * Walks a config tree (objects/arrays/strings) collecting every well-formed secret
+ * reference with its binding site. Malformed fragments are collected separately.
+ */
+export declare function findSecretRefSites(node: unknown, basePath: string): {
+    sites: SecretRefSite[];
+    malformed: Array<{
+        path: string;
+        fragment: string;
+    }>;
+};
+/**
+ * Interpolates every string inside a config tree, returning a deep copy.
+ * Non-string leaves pass through untouched.
+ */
+export declare function interpolateConfigTree<T>(node: T, resolve: (name: string) => string): T;
+//# sourceMappingURL=secret-refs.d.ts.map

package/dist/manifest/secret-refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-refs.d.ts","sourceRoot":"","sources":["../../src/manifest/secret-refs.ts"],"names":[],"mappings":"AAeA,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4EAA4E;IAC5E,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA4BhE;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,CAqBhG;AAED,6FAA6F;AAC7F,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAoBlF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,CAAC,CAetF"}