@skaile/workspaces 0.39.0 → 0.40.1

package/dist/{chunk-ZDKJHQY2.js → chunk-JXT46QFC.js}

@@ -83,5 +83,5 @@ var ProviderUnavailableError = class extends SecretsError {
 var VERSION = "0.0.0";
 
 export { AssetKindConflictError, AssetKindPathAmbiguityError, AssetKindPatternConflictError, AssetKindRegistryFrozenError, ProviderUnavailableError, SecretAccessDeniedError, SecretExpiredError, SecretNotFoundError, SecretsError, VERSION };
-//# sourceMappingURL=chunk-ZDKJHQY2.js.map
-//# sourceMappingURL=chunk-ZDKJHQY2.js.map
+//# sourceMappingURL=chunk-JXT46QFC.js.map
+//# sourceMappingURL=chunk-JXT46QFC.js.map

package/dist/{chunk-ZDKJHQY2.js.map → chunk-JXT46QFC.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../plugins/src/asset-kind-registry.ts","../plugins/src/secrets-provider.ts","../plugins/src/index.ts"],"names":[],"mappings":";AA8BO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EAET,YAAY,IAAA,EAAc;AACxB,IAAA,KAAA,CAAM,CAAA,YAAA,EAAe,IAAI,CAAA,kEAAA,CAAoE,CAAA;AAC7F,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAMO,IAAM,6BAAA,GAAN,cAA4C,KAAA,CAAM;AAAA,EAC9C,OAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,YAAA,EAAsB,kBAAA,EAA4B;AAC7E,IAAA,KAAA;AAAA,MACE,CAAA,mBAAA,EAAsB,kBAAkB,CAAA,aAAA,EAAgB,OAAO,0BAA0B,YAAY,CAAA,8CAAA;AAAA,KACvG;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,+BAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAAA,EAC5B;AACF;AAOO,IAAM,2BAAA,GAAN,cAA0C,KAAA,CAAM;AAAA,EAC5C,IAAA;AAAA,EACA,aAAA;AAAA,EAET,WAAA,CAAY,MAAc,aAAA,EAAyB;AACjD,IAAA,KAAA;AAAA,MACE,SAAS,IAAI,CAAA,+BAAA,EAAkC,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA,sCAAA;AAAA,KACzE;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,6BAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AACF;AAKO,IAAM,4BAAA,GAAN,cAA2C,KAAA,CAAM;AAAA,EACtD,WAAA,GAAc;AACZ,IAAA,KAAA;AAAA,MACE;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,8BAAA;AAAA,EACd;AACF;;;ACRO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,IAAA;AAAA,EAEA,WAAA,CAAY,SAAiB,IAAA,EAAc;AACzC,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAQO,IAAM,mBAAA,GAAN,cAAkC,YAAA,CAAa;AAAA,EACpD,YAAY,GAAA,EAAa;AACvB,IAAA,KAAA,CAAM,CAAA,kBAAA,EAAqB,GAAG,CAAA,CAAA,EAAI,kBAAkB,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOO,IAAM,uBAAA,GAAN,cAAsC,YAAA,CAAa;AAAA,EACxD,WAAA,CAAY,UAAU,eAAA,EAAiB;AACrC,IAAA,KAAA,CAAM,SAAS,sBAAsB,CAAA;AACrC,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AAAA,EACd;AACF;AAQO,IAAM,kBAAA,GAAN,cAAiC,YAAA,CAAa;AAAA,EACnD,YAAY,GAAA,EAAa;AACvB,IAAA,KAAA,CAAM,CAAA,gBAAA,EAAmB,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA;AAChD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,EACd;AACF;AASO,IAAM,wBAAA,GAAN,cAAuC,YAAA,CAAa;AAAA,EACzD,WAAA,CAAY,YAAoB,KAAA,EAAgB;AAC9C,IAAA,KAAA;AAAA,MACE,yBAAyB,UAAU,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,KAAK,MAAM,EAAE,CAAA,CAAA;AAAA,MAChE;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AAAA,EACd;AACF;;;AChJO,IAAM,OAAA,GAAU","file":"chunk-ZDKJHQY2.js","sourcesContent":["/**\n * IAssetKindRegistry — contract for the frozen-state asset kind registry.\n *\n * Library-bound, not process-global. Follows a frozen-state machine:\n * - register() is valid only in the \"open\" state\n * - First read operation auto-freezes the registry\n * - freeze() is idempotent\n *\n * Conflicts on registration are hard errors (A4):\n * - Same kind registered twice → AssetKindConflictError\n * - Overlapping glob patterns → AssetKindPatternConflictError\n * - Multiple providers match a path → AssetKindPathAmbiguityError\n *\n * Design decisions A3, A4: locked in Phase 1.7 planning.\n */\n\nimport type { ManifestValidationResult } from \"@skaile/workspaces/types/manifests\";\nimport type {\n  AssetKindFileFilter,\n  AssetKindRequiresEdge,\n  IAssetKindProvider,\n} from \"./asset-kind-provider.js\";\n\n// ---------------------------------------------------------------------------\n// Error classes (A4)\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a kind is registered that already exists in the registry.\n */\nexport class AssetKindConflictError extends Error {\n  readonly kind: string;\n\n  constructor(kind: string) {\n    super(`Asset kind \"${kind}\" is already registered. Each kind must have exactly one provider.`);\n    this.name = \"AssetKindConflictError\";\n    this.kind = kind;\n  }\n}\n\n/**\n * Thrown when a provider's discovery patterns overlap with an\n * already-registered provider's patterns.\n */\nexport class AssetKindPatternConflictError extends Error {\n  readonly newKind: string;\n  readonly existingKind: string;\n  readonly conflictingPattern: string;\n\n  constructor(newKind: string, existingKind: string, conflictingPattern: string) {\n    super(\n      `Discovery pattern \"${conflictingPattern}\" from kind \"${newKind}\" conflicts with kind \"${existingKind}\". Patterns must not overlap across providers.`,\n    );\n    this.name = \"AssetKindPatternConflictError\";\n    this.newKind = newKind;\n    this.existingKind = existingKind;\n    this.conflictingPattern = conflictingPattern;\n  }\n}\n\n/**\n * Thrown at discovery time when multiple providers claim the same path.\n * This indicates a bug in matchesPath implementations — should be caught\n * earlier by pattern conflict detection, but serves as a runtime safety net.\n */\nexport class AssetKindPathAmbiguityError extends Error {\n  readonly path: string;\n  readonly matchingKinds: string[];\n\n  constructor(path: string, matchingKinds: string[]) {\n    super(\n      `Path \"${path}\" matches multiple providers: [${matchingKinds.join(\", \")}]. Only one provider may claim a path.`,\n    );\n    this.name = \"AssetKindPathAmbiguityError\";\n    this.path = path;\n    this.matchingKinds = matchingKinds;\n  }\n}\n\n/**\n * Thrown when register() is called on a frozen registry.\n */\nexport class AssetKindRegistryFrozenError extends Error {\n  constructor() {\n    super(\n      \"Cannot register providers after the registry is frozen. All providers must be registered before the first read operation.\",\n    );\n    this.name = \"AssetKindRegistryFrozenError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Interface\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen-state asset kind registry.\n *\n * Lifecycle:\n * 1. Created in \"open\" state\n * 2. Providers registered via register()\n * 3. First read operation (getProvider, getAllProviders, resolveKind,\n *    validateManifest, defaultFileFilter, extractRequires) auto-freezes\n * 4. No further registrations allowed\n *\n * Implementations: AssetKindRegistry in @skaile/discovery.\n */\nexport interface IAssetKindRegistry {\n  /** Whether the registry is frozen (no further registrations allowed). */\n  readonly frozen: boolean;\n\n  /**\n   * Register a provider. Must be called before the registry is frozen.\n   * @throws AssetKindConflictError if kind already registered\n   * @throws AssetKindPatternConflictError if patterns overlap\n   * @throws AssetKindRegistryFrozenError if registry is frozen\n   */\n  register(provider: IAssetKindProvider): void;\n\n  /**\n   * Explicitly freeze the registry. Idempotent — calling on an already-frozen\n   * registry is a no-op.\n   */\n  freeze(): void;\n\n  // -- Read operations (auto-freeze on first call) --\n\n  /** Get a provider by kind name. Returns undefined for unregistered kinds. */\n  getProvider(kind: string): IAssetKindProvider | undefined;\n\n  /** Get all registered providers (snapshot, not live). */\n  getAllProviders(): IAssetKindProvider[];\n\n  /** Get all registered kind names. */\n  getAllKinds(): string[];\n\n  /**\n   * Resolve a relative path to an asset kind.\n   * @throws AssetKindPathAmbiguityError if multiple providers match\n   * @returns The kind string, or undefined if no provider matches\n   */\n  resolveKind(relativePath: string): string | undefined;\n\n  // -- Convenience delegates (auto-freeze on first call) --\n\n  /**\n   * Validate a manifest for a given kind.\n   * @returns Validation result, or a failure if the kind is unregistered\n   */\n  validateManifest(kind: string, data: unknown): ManifestValidationResult<unknown>;\n\n  /**\n   * Compute the default file filter for an asset.\n   * @returns The file filter, or undefined if the kind is unregistered\n   */\n  defaultFileFilter(kind: string, manifestPath: string): AssetKindFileFilter | undefined;\n\n  /**\n   * Extract requires edges from a manifest.\n   * @returns The edges, or an empty array if the kind has no extractRequires\n   */\n  extractRequires(\n    kind: string,\n    assetRef: string,\n    manifest: Record<string, unknown>,\n  ): AssetKindRequiresEdge[];\n}\n","/**\n * ISecretsProvider — pluggable secret storage/retrieval interface.\n *\n * Lives in workspaces/plugins (all pluggable interface contracts centralized here).\n * Built-in implementations live in workspaces/secrets.\n *\n * Signature locked per Phase 1 plan decision E5.\n */\n\n// ---------------------------------------------------------------------------\n// Helper types\n// ---------------------------------------------------------------------------\n\n/**\n * Metadata record returned by {@link ISecretsProvider.getMetadata}.\n *\n * Carries audit timestamps and optional ownership information without\n * exposing the secret value itself.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface SecretMetadata {\n  ref: string;\n  createdAt: Date;\n  updatedAt: Date;\n  lastAccessedAt?: Date;\n  owner?: string;\n  scopeSummary?: string;\n}\n\n/**\n * Feature flags advertised by a secrets provider via\n * {@link ISecretsProvider.getCapabilities}.\n *\n * Consumers use this to determine whether rotation, TTL, or batch operations\n * are available before calling the corresponding methods.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface ProviderCapabilities {\n  supportsRotation: boolean;\n  supportsExpiry: boolean;\n  supportsBatch: boolean;\n  scopeModel: \"flat\" | \"hierarchical\";\n}\n\n/**\n * Options accepted by {@link ISecretsProvider.setSecret}.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface SetSecretOptions {\n  ttlSeconds?: number;\n  metadata?: Record<string, string>;\n}\n\n/**\n * Filter parameters accepted by {@link ISecretsProvider.listSecrets}.\n *\n * All fields are optional — an empty filter returns all accessible secrets.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface ListFilter {\n  prefix?: string;\n  owner?: string;\n  limit?: number;\n}\n\n// ---------------------------------------------------------------------------\n// Error hierarchy\n// ---------------------------------------------------------------------------\n\n/**\n * Base error class for all secrets-layer failures.\n *\n * Carries a machine-readable `code` string alongside the human-readable\n * message so callers can switch on error type without instanceof chains.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretsError extends Error {\n  code: string;\n\n  constructor(message: string, code: string) {\n    super(message);\n    this.name = \"SecretsError\";\n    this.code = code;\n  }\n}\n\n/**\n * Thrown by {@link ISecretsProvider.getSecret} when the requested `ref` does\n * not exist in the provider's backing store.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretNotFoundError extends SecretsError {\n  constructor(ref: string) {\n    super(`Secret not found: ${ref}`, \"SECRET_NOT_FOUND\");\n    this.name = \"SecretNotFoundError\";\n  }\n}\n\n/**\n * Thrown when the caller does not have permission to access a secret.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretAccessDeniedError extends SecretsError {\n  constructor(message = \"Access denied\") {\n    super(message, \"SECRET_ACCESS_DENIED\");\n    this.name = \"SecretAccessDeniedError\";\n  }\n}\n\n/**\n * Thrown by {@link ISecretsProvider.getSecret} when the secret exists but its\n * TTL has elapsed.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretExpiredError extends SecretsError {\n  constructor(ref: string) {\n    super(`Secret expired: ${ref}`, \"SECRET_EXPIRED\");\n    this.name = \"SecretExpiredError\";\n  }\n}\n\n/**\n * Thrown when the backing secrets provider cannot be reached.\n *\n * Carries an optional `cause` string with provider-specific diagnostics.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class ProviderUnavailableError extends SecretsError {\n  constructor(providerId: string, cause?: string) {\n    super(\n      `Provider unavailable: ${providerId}${cause ? ` (${cause})` : \"\"}`,\n      \"PROVIDER_UNAVAILABLE\",\n    );\n    this.name = \"ProviderUnavailableError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Interface\n// ---------------------------------------------------------------------------\n\n/**\n * Pluggable interface for secret storage and retrieval.\n *\n * Built-in implementations (Phase 1): `LocalSecretsProvider`, `EnvSecretsProvider`\n * (in `workspaces/secrets`).  Future implementations include Vault, AWS SM,\n * GCP SM, Azure Key Vault, Infisical, Doppler, and Bitwarden Secrets.\n *\n * Registration is explicit and programmatic: `pluginRegistry.register(impl)`.\n * Third-party providers are loaded via dynamic import driven by config.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface ISecretsProvider {\n  /** Unique provider identifier used for registration and diagnostics. */\n  readonly id: string;\n  /** Retrieve a secret by ref, returning the raw bytes. */\n  getSecret(ref: string): Promise<Uint8Array>;\n  /** Store or update a secret. Optional TTL and metadata can be attached. */\n  setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void>;\n  /** Permanently remove a secret. */\n  deleteSecret(ref: string): Promise<void>;\n  /** List secret refs accessible to the caller, with optional filtering. */\n  listSecrets(filter?: ListFilter): Promise<string[]>;\n  /** Verify the provider is reachable and measure round-trip latency. */\n  testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }>;\n  /** Return audit metadata for a secret without revealing its value. */\n  getMetadata(ref: string): Promise<SecretMetadata>;\n  /** Advertise which optional capabilities this provider supports. */\n  getCapabilities(): ProviderCapabilities;\n}\n","export const VERSION = \"0.0.0\";\n\n// Pluggable interface contracts — Asset Kind Provider\nexport type {\n  AssetKindFileFilter,\n  AssetKindRequiresEdge,\n  IAssetKindProvider,\n} from \"./asset-kind-provider.js\";\nexport type { IAssetKindRegistry } from \"./asset-kind-registry.js\";\n// Pluggable interface contracts — Asset Kind Registry\nexport {\n  AssetKindConflictError,\n  AssetKindPathAmbiguityError,\n  AssetKindPatternConflictError,\n  AssetKindRegistryFrozenError,\n} from \"./asset-kind-registry.js\";\n// Pluggable interface contracts — Catalog Source\nexport type {\n  CatalogAsset,\n  CatalogAssetFilter,\n  CatalogSourceInfo,\n  ICatalogSource,\n} from \"./catalog-source.js\";\n\nexport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"./secrets-provider.js\";\n// Pluggable interface contracts — Secrets\nexport {\n  ProviderUnavailableError,\n  SecretAccessDeniedError,\n  SecretExpiredError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"./secrets-provider.js\";\n"]}
+{"version":3,"sources":["../plugins/src/asset-kind-registry.ts","../plugins/src/secrets-provider.ts","../plugins/src/index.ts"],"names":[],"mappings":";AA8BO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EAET,YAAY,IAAA,EAAc;AACxB,IAAA,KAAA,CAAM,CAAA,YAAA,EAAe,IAAI,CAAA,kEAAA,CAAoE,CAAA;AAC7F,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAMO,IAAM,6BAAA,GAAN,cAA4C,KAAA,CAAM;AAAA,EAC9C,OAAA;AAAA,EACA,YAAA;AAAA,EACA,kBAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,YAAA,EAAsB,kBAAA,EAA4B;AAC7E,IAAA,KAAA;AAAA,MACE,CAAA,mBAAA,EAAsB,kBAAkB,CAAA,aAAA,EAAgB,OAAO,0BAA0B,YAAY,CAAA,8CAAA;AAAA,KACvG;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,+BAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAAA,EAC5B;AACF;AAOO,IAAM,2BAAA,GAAN,cAA0C,KAAA,CAAM;AAAA,EAC5C,IAAA;AAAA,EACA,aAAA;AAAA,EAET,WAAA,CAAY,MAAc,aAAA,EAAyB;AACjD,IAAA,KAAA;AAAA,MACE,SAAS,IAAI,CAAA,+BAAA,EAAkC,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA,sCAAA;AAAA,KACzE;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,6BAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AACF;AAKO,IAAM,4BAAA,GAAN,cAA2C,KAAA,CAAM;AAAA,EACtD,WAAA,GAAc;AACZ,IAAA,KAAA;AAAA,MACE;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,8BAAA;AAAA,EACd;AACF;;;ACRO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,IAAA;AAAA,EAEA,WAAA,CAAY,SAAiB,IAAA,EAAc;AACzC,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAQO,IAAM,mBAAA,GAAN,cAAkC,YAAA,CAAa;AAAA,EACpD,YAAY,GAAA,EAAa;AACvB,IAAA,KAAA,CAAM,CAAA,kBAAA,EAAqB,GAAG,CAAA,CAAA,EAAI,kBAAkB,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOO,IAAM,uBAAA,GAAN,cAAsC,YAAA,CAAa;AAAA,EACxD,WAAA,CAAY,UAAU,eAAA,EAAiB;AACrC,IAAA,KAAA,CAAM,SAAS,sBAAsB,CAAA;AACrC,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AAAA,EACd;AACF;AAQO,IAAM,kBAAA,GAAN,cAAiC,YAAA,CAAa;AAAA,EACnD,YAAY,GAAA,EAAa;AACvB,IAAA,KAAA,CAAM,CAAA,gBAAA,EAAmB,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA;AAChD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,EACd;AACF;AASO,IAAM,wBAAA,GAAN,cAAuC,YAAA,CAAa;AAAA,EACzD,WAAA,CAAY,YAAoB,KAAA,EAAgB;AAC9C,IAAA,KAAA;AAAA,MACE,yBAAyB,UAAU,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,KAAK,MAAM,EAAE,CAAA,CAAA;AAAA,MAChE;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AAAA,EACd;AACF;;;AChJO,IAAM,OAAA,GAAU","file":"chunk-JXT46QFC.js","sourcesContent":["/**\n * IAssetKindRegistry — contract for the frozen-state asset kind registry.\n *\n * Library-bound, not process-global. Follows a frozen-state machine:\n * - register() is valid only in the \"open\" state\n * - First read operation auto-freezes the registry\n * - freeze() is idempotent\n *\n * Conflicts on registration are hard errors (A4):\n * - Same kind registered twice → AssetKindConflictError\n * - Overlapping glob patterns → AssetKindPatternConflictError\n * - Multiple providers match a path → AssetKindPathAmbiguityError\n *\n * Design decisions A3, A4: locked in Phase 1.7 planning.\n */\n\nimport type { ManifestValidationResult } from \"@skaile/workspaces/types/manifests\";\nimport type {\n  AssetKindFileFilter,\n  AssetKindRequiresEdge,\n  IAssetKindProvider,\n} from \"./asset-kind-provider.js\";\n\n// ---------------------------------------------------------------------------\n// Error classes (A4)\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a kind is registered that already exists in the registry.\n */\nexport class AssetKindConflictError extends Error {\n  readonly kind: string;\n\n  constructor(kind: string) {\n    super(`Asset kind \"${kind}\" is already registered. Each kind must have exactly one provider.`);\n    this.name = \"AssetKindConflictError\";\n    this.kind = kind;\n  }\n}\n\n/**\n * Thrown when a provider's discovery patterns overlap with an\n * already-registered provider's patterns.\n */\nexport class AssetKindPatternConflictError extends Error {\n  readonly newKind: string;\n  readonly existingKind: string;\n  readonly conflictingPattern: string;\n\n  constructor(newKind: string, existingKind: string, conflictingPattern: string) {\n    super(\n      `Discovery pattern \"${conflictingPattern}\" from kind \"${newKind}\" conflicts with kind \"${existingKind}\". Patterns must not overlap across providers.`,\n    );\n    this.name = \"AssetKindPatternConflictError\";\n    this.newKind = newKind;\n    this.existingKind = existingKind;\n    this.conflictingPattern = conflictingPattern;\n  }\n}\n\n/**\n * Thrown at discovery time when multiple providers claim the same path.\n * This indicates a bug in matchesPath implementations — should be caught\n * earlier by pattern conflict detection, but serves as a runtime safety net.\n */\nexport class AssetKindPathAmbiguityError extends Error {\n  readonly path: string;\n  readonly matchingKinds: string[];\n\n  constructor(path: string, matchingKinds: string[]) {\n    super(\n      `Path \"${path}\" matches multiple providers: [${matchingKinds.join(\", \")}]. Only one provider may claim a path.`,\n    );\n    this.name = \"AssetKindPathAmbiguityError\";\n    this.path = path;\n    this.matchingKinds = matchingKinds;\n  }\n}\n\n/**\n * Thrown when register() is called on a frozen registry.\n */\nexport class AssetKindRegistryFrozenError extends Error {\n  constructor() {\n    super(\n      \"Cannot register providers after the registry is frozen. All providers must be registered before the first read operation.\",\n    );\n    this.name = \"AssetKindRegistryFrozenError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Interface\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen-state asset kind registry.\n *\n * Lifecycle:\n * 1. Created in \"open\" state\n * 2. Providers registered via register()\n * 3. First read operation (getProvider, getAllProviders, resolveKind,\n *    validateManifest, defaultFileFilter, extractRequires) auto-freezes\n * 4. No further registrations allowed\n *\n * Implementations: AssetKindRegistry in @skaile/discovery.\n */\nexport interface IAssetKindRegistry {\n  /** Whether the registry is frozen (no further registrations allowed). */\n  readonly frozen: boolean;\n\n  /**\n   * Register a provider. Must be called before the registry is frozen.\n   * @throws AssetKindConflictError if kind already registered\n   * @throws AssetKindPatternConflictError if patterns overlap\n   * @throws AssetKindRegistryFrozenError if registry is frozen\n   */\n  register(provider: IAssetKindProvider): void;\n\n  /**\n   * Explicitly freeze the registry. Idempotent — calling on an already-frozen\n   * registry is a no-op.\n   */\n  freeze(): void;\n\n  // -- Read operations (auto-freeze on first call) --\n\n  /** Get a provider by kind name. Returns undefined for unregistered kinds. */\n  getProvider(kind: string): IAssetKindProvider | undefined;\n\n  /** Get all registered providers (snapshot, not live). */\n  getAllProviders(): IAssetKindProvider[];\n\n  /** Get all registered kind names. */\n  getAllKinds(): string[];\n\n  /**\n   * Resolve a relative path to an asset kind.\n   * @throws AssetKindPathAmbiguityError if multiple providers match\n   * @returns The kind string, or undefined if no provider matches\n   */\n  resolveKind(relativePath: string): string | undefined;\n\n  // -- Convenience delegates (auto-freeze on first call) --\n\n  /**\n   * Validate a manifest for a given kind.\n   * @returns Validation result, or a failure if the kind is unregistered\n   */\n  validateManifest(kind: string, data: unknown): ManifestValidationResult<unknown>;\n\n  /**\n   * Compute the default file filter for an asset.\n   * @returns The file filter, or undefined if the kind is unregistered\n   */\n  defaultFileFilter(kind: string, manifestPath: string): AssetKindFileFilter | undefined;\n\n  /**\n   * Extract requires edges from a manifest.\n   * @returns The edges, or an empty array if the kind has no extractRequires\n   */\n  extractRequires(\n    kind: string,\n    assetRef: string,\n    manifest: Record<string, unknown>,\n  ): AssetKindRequiresEdge[];\n}\n","/**\n * ISecretsProvider — pluggable secret storage/retrieval interface.\n *\n * Lives in workspaces/plugins (all pluggable interface contracts centralized here).\n * Built-in implementations live in workspaces/secrets.\n *\n * Signature locked per Phase 1 plan decision E5.\n */\n\n// ---------------------------------------------------------------------------\n// Helper types\n// ---------------------------------------------------------------------------\n\n/**\n * Metadata record returned by {@link ISecretsProvider.getMetadata}.\n *\n * Carries audit timestamps and optional ownership information without\n * exposing the secret value itself.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface SecretMetadata {\n  ref: string;\n  createdAt: Date;\n  updatedAt: Date;\n  lastAccessedAt?: Date;\n  owner?: string;\n  scopeSummary?: string;\n}\n\n/**\n * Feature flags advertised by a secrets provider via\n * {@link ISecretsProvider.getCapabilities}.\n *\n * Consumers use this to determine whether rotation, TTL, or batch operations\n * are available before calling the corresponding methods.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface ProviderCapabilities {\n  supportsRotation: boolean;\n  supportsExpiry: boolean;\n  supportsBatch: boolean;\n  scopeModel: \"flat\" | \"hierarchical\";\n}\n\n/**\n * Options accepted by {@link ISecretsProvider.setSecret}.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface SetSecretOptions {\n  ttlSeconds?: number;\n  metadata?: Record<string, string>;\n}\n\n/**\n * Filter parameters accepted by {@link ISecretsProvider.listSecrets}.\n *\n * All fields are optional — an empty filter returns all accessible secrets.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface ListFilter {\n  prefix?: string;\n  owner?: string;\n  limit?: number;\n}\n\n// ---------------------------------------------------------------------------\n// Error hierarchy\n// ---------------------------------------------------------------------------\n\n/**\n * Base error class for all secrets-layer failures.\n *\n * Carries a machine-readable `code` string alongside the human-readable\n * message so callers can switch on error type without instanceof chains.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretsError extends Error {\n  code: string;\n\n  constructor(message: string, code: string) {\n    super(message);\n    this.name = \"SecretsError\";\n    this.code = code;\n  }\n}\n\n/**\n * Thrown by {@link ISecretsProvider.getSecret} when the requested `ref` does\n * not exist in the provider's backing store.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretNotFoundError extends SecretsError {\n  constructor(ref: string) {\n    super(`Secret not found: ${ref}`, \"SECRET_NOT_FOUND\");\n    this.name = \"SecretNotFoundError\";\n  }\n}\n\n/**\n * Thrown when the caller does not have permission to access a secret.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretAccessDeniedError extends SecretsError {\n  constructor(message = \"Access denied\") {\n    super(message, \"SECRET_ACCESS_DENIED\");\n    this.name = \"SecretAccessDeniedError\";\n  }\n}\n\n/**\n * Thrown by {@link ISecretsProvider.getSecret} when the secret exists but its\n * TTL has elapsed.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class SecretExpiredError extends SecretsError {\n  constructor(ref: string) {\n    super(`Secret expired: ${ref}`, \"SECRET_EXPIRED\");\n    this.name = \"SecretExpiredError\";\n  }\n}\n\n/**\n * Thrown when the backing secrets provider cannot be reached.\n *\n * Carries an optional `cause` string with provider-specific diagnostics.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport class ProviderUnavailableError extends SecretsError {\n  constructor(providerId: string, cause?: string) {\n    super(\n      `Provider unavailable: ${providerId}${cause ? ` (${cause})` : \"\"}`,\n      \"PROVIDER_UNAVAILABLE\",\n    );\n    this.name = \"ProviderUnavailableError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Interface\n// ---------------------------------------------------------------------------\n\n/**\n * Pluggable interface for secret storage and retrieval.\n *\n * Built-in implementations (Phase 1): `LocalSecretsProvider`, `EnvSecretsProvider`\n * (in `workspaces/secrets`).  Future implementations include Vault, AWS SM,\n * GCP SM, Azure Key Vault, Infisical, Doppler, and Bitwarden Secrets.\n *\n * Registration is explicit and programmatic: `pluginRegistry.register(impl)`.\n * Third-party providers are loaded via dynamic import driven by config.\n *\n * @docLink packages/workspace-plugin/index#plugin-interfaces\n */\nexport interface ISecretsProvider {\n  /** Unique provider identifier used for registration and diagnostics. */\n  readonly id: string;\n  /** Retrieve a secret by ref, returning the raw bytes. */\n  getSecret(ref: string): Promise<Uint8Array>;\n  /** Store or update a secret. Optional TTL and metadata can be attached. */\n  setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void>;\n  /** Permanently remove a secret. */\n  deleteSecret(ref: string): Promise<void>;\n  /** List secret refs accessible to the caller, with optional filtering. */\n  listSecrets(filter?: ListFilter): Promise<string[]>;\n  /** Verify the provider is reachable and measure round-trip latency. */\n  testConnection(): Promise<{ ok: boolean; latencyMs?: number; error?: string }>;\n  /** Return audit metadata for a secret without revealing its value. */\n  getMetadata(ref: string): Promise<SecretMetadata>;\n  /** Advertise which optional capabilities this provider supports. */\n  getCapabilities(): ProviderCapabilities;\n}\n","export const VERSION = \"0.0.0\";\n\n// Pluggable interface contracts — Asset Kind Provider\nexport type {\n  AssetKindFileFilter,\n  AssetKindRequiresEdge,\n  IAssetKindProvider,\n} from \"./asset-kind-provider.js\";\nexport type { IAssetKindRegistry } from \"./asset-kind-registry.js\";\n// Pluggable interface contracts — Asset Kind Registry\nexport {\n  AssetKindConflictError,\n  AssetKindPathAmbiguityError,\n  AssetKindPatternConflictError,\n  AssetKindRegistryFrozenError,\n} from \"./asset-kind-registry.js\";\n// Pluggable interface contracts — Catalog Source\nexport type {\n  CatalogAsset,\n  CatalogAssetFilter,\n  CatalogDomain,\n  CatalogDomainFilter,\n  CatalogSourceInfo,\n  DomainRelation,\n  ICatalogSource,\n} from \"./catalog-source.js\";\n\nexport type {\n  ISecretsProvider,\n  ListFilter,\n  ProviderCapabilities,\n  SecretMetadata,\n  SetSecretOptions,\n} from \"./secrets-provider.js\";\n// Pluggable interface contracts — Secrets\nexport {\n  ProviderUnavailableError,\n  SecretAccessDeniedError,\n  SecretExpiredError,\n  SecretNotFoundError,\n  SecretsError,\n} from \"./secrets-provider.js\";\n"]}

package/dist/{chunk-UAYAK7N4.js → chunk-O66LT7UI.js}

@@ -1,4 +1,4 @@
-import { readManifestSourceConfig, discoverAssetsInTree } from './chunk-O4PANZI2.js';
+import { readManifestSourceConfig, discoverAssetsInTree } from './chunk-XNMABEHH.js';
 import { installFromManifest } from './chunk-KYC6JH75.js';
 import { parseAssetRef } from './chunk-BM7XANVN.js';
 import { PresetManifestSchema } from './chunk-HRKB2ATT.js';
@@ -2857,6 +2857,32 @@ var RemoteCatalogSource = class {
   async listSources() {
     return [{ id: this.id, type: "remote-catalog", url: this.baseUrl }];
   }
+  /**
+   * List navigational domains via `GET /trpc/catalog.listDomains`. Display-only,
+   * so this **never throws**: a missing endpoint (older store → 404), a transport
+   * error, or a malformed payload all degrade to `[]` rather than jeopardize the
+   * asset feed this call accompanies. Air-gapped mode returns `[]` (domains are
+   * not part of the offline cache in v1).
+   *
+   * Not cached — domains are read once per `skaile manage` open and are cheap.
+   */
+  async listDomains(filter) {
+    if (this.cache.airGapped) return [];
+    try {
+      const input = filter && (filter.publisher || filter.source) ? filter : {};
+      const url = trpcGetUrl(this.baseUrl, "catalog.listDomains", input);
+      const res = await this.httpClient(url, {
+        method: "GET",
+        headers: { Accept: "application/json" }
+      });
+      if (!res.ok) return [];
+      const data = await parseTrpcGet(res);
+      if (!Array.isArray(data)) return [];
+      return data.map(normalizeCatalogDomain).filter((d) => d !== null);
+    } catch {
+      return [];
+    }
+  }
   // ── extension API ───────────────────────────────────────────────────────
   /**
    * Force a metadata-cache refresh. Wipes all resolve/list entries and
@@ -3116,6 +3142,26 @@ function pickString(r, key) {
   const v = r[key];
   return typeof v === "string" ? v : void 0;
 }
+function normalizeCatalogDomain(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const r = raw;
+  const slug = pickString(r, "slug");
+  const title = pickString(r, "title");
+  if (!slug || !title) return null;
+  const domain = { slug, title };
+  const description = pickString(r, "description");
+  if (description) domain.description = description;
+  const relation = pickString(r, "relation");
+  if (relation === "additions" || relation === "alternatives" || relation === "sequence") {
+    domain.relation = relation;
+  }
+  if (typeof r.order === "number") domain.order = r.order;
+  const recommendedRef = pickString(r, "recommendedRef");
+  if (recommendedRef) domain.recommendedRef = recommendedRef;
+  const sidecarSource = pickString(r, "sidecarSource");
+  if (sidecarSource) domain.sidecarSource = sidecarSource;
+  return domain;
+}
 var CATALOG_REQUEST_TIMEOUT_MS = 1e4;
 var defaultFetch = async (url, init) => {
   if (typeof fetch === "undefined") {
@@ -3623,5 +3669,5 @@ function detectWorkspaceVersion(dir, filename = "skaile.yaml") {
 }
 
 export { AssignmentNotFoundError, CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateAssignmentError, DuplicateLibraryNameError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KNOWN_ASSET_KINDS, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LIBRARY_STRUCTURES, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibraryManager, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalIndex, LocalSyncDriver, LockAssignmentSchema, LockFileSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, SidecarGit, SkaileConfigSchema, SourceNotFoundError, TarballHashMismatchError, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, classifyRef, createEmptyLockFile, deriveSlug, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, getStoreManifestsDir, getStoreRoot, hasInterpolationTokens, interpolate, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, migrateSidecarsToStoreIfNeeded, migrateWorkspaceConfig, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, queryInstancePickerChoices, resolveAllItems, resolveConfig, resolveIndexPath, resolveItem, resolveLibraryDir, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, sha256Hex, skaileHomeDir, storeSecrets, trpcGetUrl, userConfigPath, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeManifestIfMissing };
-//# sourceMappingURL=chunk-UAYAK7N4.js.map
-//# sourceMappingURL=chunk-UAYAK7N4.js.map
+//# sourceMappingURL=chunk-O66LT7UI.js.map
+//# sourceMappingURL=chunk-O66LT7UI.js.map