Sources rail mode — centralise URL / schema-file management

[thomas-stegemann]

Why

URL / schema-file management is scattered across the workbench:

• Topbar URL bar (quick add / switch the primary URL)
• Statusbar connection pill (click toggles into the sources sidebar-view)
• Sources sidebar-view (list of URLs, with main pane rendering basic config)
• Discover rail-mode (the discovered services are consequences of URLs but the URL config itself isn't here)
• Future catalogue providers (URL / service catalogue providers (local / http / consul / kubernetes / agent) #136) need a place to plug in

A new operator has to learn five different ways to get to the same data. Per the maintainer's clarification: option B from the conversation — a dedicated Sources rail mode that's a peer of Workspaces / Recordings / etc. — bundles every URL / schema touchpoint into one consistent surface.

Proposal

Rail entry

• New mode sources in the rail catalogue, with a connector / link icon.
• Sits in the hardening group (peer of Security + Workspaces) OR the work group (peer of Discover) — Discovery is downstream of Sources, so work is the natural group.
• sidebar.kind = 'sources' so the existing Sidebar declaration per rail mode + stable toggle location #137 dispatcher picks it up.

Sidebar (renderSourcesSidebar)

• Header: title 'Sources' + + button to add a new URL.
• Body: one row per URL, with:
  • Status dot (connected / disconnected / discovering)
  • URL value (truncated to fit; full URL in title tooltip)
  • Service count from the live discovery
  • ▶ Activate button (the URL becomes the primary one for new requests)
• Header ⋮ overflow for bulk actions: 'Import schema file…', 'Disconnect all', 'Re-run discovery on all'.
• Per-row delete + multi-select using the Uniform delete affordances on every list sidebar (single / multi-select / all) #143 selection model — already wired for envs/recordings/collections, reuse the same pattern.

Main pane (renderSourcesDetailMain)

When a URL is selected in the sidebar, the right pane shows:

• Header: status dot + URL (editable inline) + connection state badge + 'Refresh discovery' button
• Discovery section: protocol mix, service count, last refresh time
• Headers section: per-URL headers (Authorization, X-API-Key, …) editable as key / value pairs
• Schema section: drop zone for OpenAPI / AsyncAPI / proto files; lists imported schemas with their paths + 'Replace' / 'Remove' actions
• Catalogue origin section (composes with URL / service catalogue providers (local / http / consul / kubernetes / agent) #136): if this URL came from a catalogue provider, show its source + 'Refresh from catalogue'
• Danger zone: 'Remove URL' (moves to trash via the Uniform delete affordances on every list sidebar (single / multi-select / all) #143 pattern)

When nothing is selected (empty state): mid-pane empty card "Pick a URL on the left or add one to get started."

Composability

• Cross-workspace sharing (composes with Workspace-side environment inclusion list (shared envs + per-workspace selection) #146 env pattern, defer to v2): URLs become shared resources + each workspace declares includedSourceUrls. Not in scope here; v1 is per-workspace.
• Catalogue providers (URL / service catalogue providers (local / http / consul / kubernetes / agent) #136): each URL row shows its origin chip; sidebar gains 'From catalogue' header for catalogue-sourced URLs.
• Discovery rail mode: still owns the service tree. Sources owns the URLs that produce that tree.

Removed surfaces (post this issue)

• Settings → no longer hosts URL config (it never really did but the Sources sidebar-view route via the connection pill stays as an additional entry point).
• The sidebarView === 'sources' shim is folded into the rail mode; the connection-pill click now switches railMode = 'sources'.
• Topbar URL bar stays — it's the quick-switch path, valuable for daily use. Click "Manage…" on the URL dropdown jumps to the Sources rail mode.

Acceptance

• Rail catalogue entry sources with the right icon + group.
• Sidebar lists every URL with status dot + service count + activate button.
• Sidebar + opens bowirePrompt for new URL.
• Per-row delete + multi-select + delete-all via Uniform delete affordances on every list sidebar (single / multi-select / all) #143 pattern.
• Main pane shows discovery / headers / schema / catalogue / danger sections for the selected URL.
• Connection-pill click switches to railMode = 'sources' instead of sidebarView = 'sources'.
• Old sidebarView === 'sources' path retired.
• Topbar URL bar gains a 'Manage…' affordance.
• Empty state when no URL is selected.

Composes with

• Activity rail (left) — switch workbench focus by use case (dev / security / perf / mocks / …) #133 — Activity rail; this issue adds one more mode.
• Sidebar declaration per rail mode + stable toggle location #137 — declarative sidebar spec; sources joins the catalogue.
• Uniform delete affordances on every list sidebar (single / multi-select / all) #143 — selection model + trash bin for per-URL delete.
• URL / service catalogue providers (local / http / consul / kubernetes / agent) #136 — catalogue providers as URL sources (origin chip).
• Workspace-side environment inclusion list (shared envs + per-workspace selection) #146 — pattern for cross-workspace sharing (future v2 of this issue).

Out of scope

• Per-method URL override (a method that always hits a different host than its service's URL). Method-level override is a Header Library: named, scoped, toggleable header sets #95-style header library concern.
• Auto-discovered URLs from network scanning. Operator opts in via paste / catalogue.
• mTLS / client-cert configuration per URL. Composes with the auth-provider SPI (Auth-provider SPI — plugin-load privilege #31); separate issue.