@3sln/trove 0.0.16 → 0.0.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@3sln/trove",
-  "version": "0.0.16",
+  "version": "0.0.17",
   "type": "module",
   "description": "Trove — a self-hostable, plugin-extensible Google Drive. Semantic search, pluggable storage (S3 / filesystem / NAS), and a VS Code-style contribution system with sandboxed plugins.",
   "repository": {

package/packages/core/src/index.js

@@ -36,7 +36,7 @@ export { EmbeddingProvider, LocalHashEmbedding, HttpEmbedding } from './search/e
 export { SqliteVectorStore, SqliteKeywordStore, SEARCH_DB_KEY } from './search/sqliteStores.js';
 
 export { IndexerRegistry, textIndexer, chunkText } from './indexers/registry.js';
-export { PluginService, PackageStore, StoragePackageStore, PluginInstallStore, SqlitePluginInstallStore, MemoryPluginInstallStore, parsePluginPackage, capabilityList, ALL_CAPABILITIES, IndexerRuntime, InProcessIndexerRuntime, PluginIndexers, matchFromSelector } from './plugins/index.js';
+export { PluginService, PackageStore, StoragePackageStore, PluginInstallStore, SqlitePluginInstallStore, MemoryPluginInstallStore, parsePluginPackage, capabilityList, ALL_CAPABILITIES, IndexerRuntime, InProcessIndexerRuntime, WorkerLoaderIndexerRuntime, PluginIndexers, matchFromSelector } from './plugins/index.js';
 export { UploadManager, KvSessionStore, DEFAULT_PART_SIZE } from './uploads.js';
 // Encryption at rest: the bucket holds ciphertext, the drive holds the key. Protects
 // against the STORAGE host (a leaked bucket credential, a storage vendor who is not the

package/packages/core/src/indexers/registry.js

@@ -64,9 +64,20 @@ export class IndexerRegistry {
   unregister(id) {
     this.indexers.delete(id);
   }
+  /**
+   * The redacted view — what `/api/indexers` answers with. Deliberately not the indexer
+   * itself: an indexer holds a `match` and an `index` that runs plugin code, and neither
+   * belongs in a response.
+   */
   list() {
     return [...this.indexers.values()].map((i) => ({ id: i.id, displayName: i.displayName || i.id }));
   }
+
+  /**
+   * The LIVE indexer, for a caller that means to run it — `backfillIndexer` after an
+   * install, which needs the real `match` and `index` that `list()` strips.
+   */
+  get(id) { return this.indexers.get(id) || null; }
   matching(node) {
     return [...this.indexers.values()].filter((i) => {
       try {

package/packages/core/src/plugins/index.js

@@ -15,6 +15,7 @@ export { parsePluginPackage, capabilityList, ALL_CAPABILITIES, serverIndexers, d
 export * from './identity.js';
 export { CONTRIBUTION_TYPES, contributionsOfType } from './contributions.js';
 export { IndexerRuntime, InProcessIndexerRuntime } from './runtime.js';
+export { WorkerLoaderIndexerRuntime } from './workerLoaderRuntime.js';
 export { clampContribution, DEFAULT_CAPS } from '../indexers/contribution.js';
 export { PluginIndexers, matchFromSelector } from './indexers.js';
 
@@ -79,6 +80,16 @@ export class PluginService {
     if (pkg.indexers.length && !this.indexers) {
       throw TroveError.unsupported('Server indexers are disabled on this deployment');
     }
+    // ...or when it HAS one that cannot run here — the in-process runner on workerd,
+    // which cannot import a `data:` URL. That case DEGRADES rather than refusing: a
+    // plugin is more than its indexer, and refusing the install would take the viewers,
+    // commands and everything else away over one part the deployment cannot host.
+    //
+    // What it must not do is what it used to: run anyway and fail once per file forever,
+    // with nothing said. So the reason is recorded ON the record — `indexersSkipped` —
+    // and travels to the client, which is what turns "my search is empty" into a sentence
+    // someone can act on. Asked once per install, not per node.
+    const probe = pkg.indexers.length ? (await this.indexers?.probe?.() ?? { ok: true }) : { ok: true };
 
     const version = pkg.manifest.version || '0';
     // CONTENT-addressed. The ref used to be `<account>/<pluginId>/<version>.zip`, written
@@ -112,21 +123,48 @@ export class PluginService {
     if (prev?.packageRef && prev.packageRef !== ref && !(await this.#refIsShared(prev.packageRef, account))) {
       await this.packages.delete(prev.packageRef).catch(() => {});
     }
-    // Register + backfill any server indexers this package ships.
-    if (this.indexers && pkg.indexers.length) {
-      try { await this.indexers.activate(record); }
+    // Register + backfill any server indexers this package ships — unless the probe
+    // just said this deployment cannot run them, in which case registering would only
+    // queue up a failure per file.
+    if (this.indexers && pkg.indexers.length && probe.ok) {
+      // REGISTER ONLY. The backfill used to run here, inline and awaited inside the
+      // install request, which is the same mistake `completeUpload` made at a larger
+      // scale: re-reading every matching file in a drive is not work a request can
+      // finish, and on Workers the isolate goes before it gets far. The caller schedules
+      // it instead — `beginBackfill`, which lands in the same Durable Object that owns
+      // scans and reindexes, and reports through the same task record.
+      try { await this.indexers.activate(record, { backfill: false }); }
       catch (err) { console.error(`activating indexers for ${record.pluginId} failed:`, err.message); }
+    } else if (!probe.ok) {
+      console.warn(`server indexers for ${record.pluginId} are not running: ${probe.reason}`);
     }
-    return this.#publicRecord(record);
+    return this.#annotate(this.#publicRecord(record));
+  }
+
+  /**
+   * Why this record's indexers are not running, or null when they are.
+   *
+   * DERIVED, not stored. The reason is a property of the DEPLOYMENT, not of the install:
+   * a drive that gains a Worker Loader binding should stop reporting "skipped" the moment
+   * it restarts, without anyone rewriting rows — and a drive that loses one should start.
+   * Storing it at install would freeze an answer that is only true until the next deploy.
+   *
+   * The probe caches its own result, so this costs nothing after the first call.
+   */
+  async #annotate(record) {
+    if (!record?.indexers?.length) return record;
+    const probe = await this.indexers?.probe?.() ?? { ok: true };
+    return probe.ok ? record : { ...record, indexersSkipped: probe.reason };
   }
 
   /** An account's installed plugins (secrets stripped). */
   async list(principal) {
-    return (await this.installs.list(accountOf(principal))).map((r) => this.#publicRecord(r));
+    const rows = (await this.installs.list(accountOf(principal))).map((r) => this.#publicRecord(r));
+    return Promise.all(rows.map((r) => this.#annotate(r)));
   }
   async get(principal, pluginId) {
     const r = await this.installs.get(accountOf(principal), pluginId);
-    return r ? this.#publicRecord(r) : null;
+    return r ? this.#annotate(this.#publicRecord(r)) : null;
   }
 
   /** Download the package blob (for a device to sync + enable). */

package/packages/core/src/plugins/indexers.js

@@ -34,6 +34,14 @@ export class PluginIndexers {
    */
   async activate(record, { backfill = true } = {}) {
     const specs = record.indexers || [];
+    // The probe first, so a deployment that cannot run this plugin's indexers says so
+    // once, here, instead of failing per file — and so the saying of it is undone the
+    // moment the deployment can. A record with no indexers has nothing to diagnose.
+    if (specs.length) {
+      const probe = await this.probe();
+      await this.#diagnose(record, probe);
+      if (!probe.ok) return 0;
+    }
     // Retire anything this plugin used to declare and no longer does. Both this and
     // deactivate() iterated only the record in hand, so an indexer dropped by an
     // upgrade stayed registered — running code the user upgraded away from on every
@@ -66,6 +74,50 @@ export class PluginIndexers {
     return specs.length;
   }
 
+  /**
+   * Can indexers actually run on this deployment? Passed straight through to the
+   * runtime — PluginIndexers is the coordinator, not the thing that knows.
+   */
+  async probe() { return this.runtime?.probe?.() ?? { ok: true }; }
+
+  /**
+   * Say — or stop saying — that this plugin's indexers are not running.
+   *
+   * A standing DIAGNOSTIC rather than a field nobody draws, because the symptom is an
+   * absence: a drive whose plugin indexers never ran looks exactly like a drive with
+   * nothing to index. The issues list is where the drive already admits to things it
+   * cannot do, and it carries a retry, so the answer to "why is my search empty" arrives
+   * in the same place as every other one.
+   *
+   * Raised and cleared at ACTIVATION, which happens on install and again at every boot —
+   * so a deployment that gains a Worker Loader binding drops the diagnostic on its next
+   * start, and one that loses it picks the diagnostic back up, with nobody rewriting a
+   * stored answer.
+   */
+  async #diagnose(record, probe) {
+    const issues = this.vfs?.issues;
+    if (!issues) return;
+    try {
+      if (probe.ok) {
+        await issues.clear('plugin-indexers', record.pluginId);
+        return;
+      }
+      await issues.raise({
+        kind: 'plugin-indexers',
+        subject: record.pluginId,
+        severity: 'warning',
+        title: `“${record.pluginId}” cannot index on this deployment — what it would add to search is missing`,
+        detail: probe.reason,
+        remedy: 'Bind a Worker Loader (`[[worker_loaders]]` in wrangler.toml) so plugin indexers can run in their own isolate.',
+        // Retrying re-activates, which re-probes: the honest way to ask again after the
+        // binding has been added, rather than a button that only clears the message.
+        retry: { op: 'reactivate-indexers', pluginId: record.pluginId },
+      });
+    } catch (err) {
+      console.error('could not record the plugin-indexer diagnostic:', err.message);
+    }
+  }
+
   /** Unregister + purge every indexer a record declared. */
   async deactivate(record) {
     for (const spec of record.indexers || []) {

package/packages/core/src/plugins/runtime.js

@@ -33,6 +33,27 @@ export class IndexerRuntime {
    */
   async run(spec, node, ctx) { throw TroveError.unsupported('IndexerRuntime.run'); }
   async close() {}
+
+  /**
+   * Can this runtime actually execute an indexer HERE, on this deployment?
+   *
+   * Asked once, at install, because the alternative is what shipped: a runtime that
+   * installs happily and then fails on every single file, silently, for the life of the
+   * deployment. The in-process runner loads code by importing a `data:` URL — which
+   * Node and Bun allow and **workerd does not** — so on Cloudflare every plugin indexer
+   * failed with `No such module "data:text/javascript;base64,…"`, once per node, with
+   * nothing to see at install time and nothing in the UI to explain the empty index.
+   *
+   * The design doc's provider matrix already called for this (§7, the `CF plain / none`
+   * row: *"install-scope check refuses server-indexer plugins on this deployment, with a
+   * clear message"*). It could not fire, because it keyed on the runtime being ABSENT
+   * and the broken runtime is present — it just cannot run.
+   *
+   * Default true: a runtime that does not implement a probe is one that works.
+   *
+   * @returns {Promise<{ok: true} | {ok: false, reason: string}>}
+   */
+  async probe() { return { ok: true }; }
 }
 
 /**
@@ -72,6 +93,26 @@ export class InProcessIndexerRuntime extends IndexerRuntime {
     return p;
   }
 
+  /**
+   * Try the loader itself, once, on a module that does nothing.
+   *
+   * The probe imports a real `data:` URL rather than sniffing for a runtime name.
+   * Feature-detection over branding: workerd is the case that prompted this, but the
+   * question is "does dynamic import of a data: URL work here", and only doing it
+   * answers that. Cached — including the failure, which is a property of the runtime
+   * and will not change while the process lives.
+   */
+  async probe() {
+    this._probe ||= import(/* @vite-ignore */ 'data:text/javascript;base64,' + btoa('export default 1'))
+      .then(() => ({ ok: true }))
+      .catch((err) => ({
+        ok: false,
+        reason: `this deployment's JavaScript runtime cannot load plugin code dynamically (${err?.message || err}). `
+          + 'Server indexers need an isolate runtime — on Cloudflare, a Worker Loader binding.',
+      }));
+    return this._probe;
+  }
+
   async run(spec, node, ctx) {
     const fn = await this.#load(spec);
     const result = await withTimeout(

package/packages/core/src/plugins/workerLoaderRuntime.js

@@ -0,0 +1,160 @@
+// WorkerLoaderIndexerRuntime — the Cloudflare arm of the provider matrix.
+//
+// This is step 4 of docs/design/server-plugins-and-indexers.md §11, and the reason the
+// in-process runner is not the answer on Workers: it loads indexer code by importing a
+// `data:` URL, which workerd refuses outright. Every plugin indexer on a Worker
+// deployment failed with `No such module "data:text/javascript;base64,…"`, once per
+// file, silently. See `InProcessIndexerRuntime.probe()`.
+//
+// A Worker Loader is the fix the doc already chose over Workers-for-Platforms dispatch
+// namespaces: no per-install upload step, so the install flow stays identical across
+// runtimes — every deployment stores the same package blob, and only execution differs.
+// The parent Worker never evaluates plugin code at all; the loader builds a genuinely
+// separate isolate for it.
+//
+// THE BYTES PROBLEM, and why it is solved with a URL rather than RPC. An indexer reads
+// its file adaptively — the audiobook one walks MP4 boxes, so which range it wants next
+// depends on what the last range said. That is a conversation, and a conversation across
+// an isolate boundary is either RPC plumbing on every deployment or one thing the
+// sandbox can already do: fetch. So the host mints a time-limited presigned read URL
+// (§8, `ctx.presignRead()`) and the shim implements `readRange` as a ranged GET against
+// it. The sandbox reaches exactly one object, for a few minutes, and the host holds no
+// open channel it has to police.
+//
+// What the sandbox is allowed to do is therefore precisely: fetch that URL. `env` carries
+// no bindings — no storage, no database, no secrets beyond the plugin's own config — and
+// the entrypoint is called once with one node.
+
+import { TroveError } from '../errors.js';
+import { withTimeout } from '../retry.js';
+import { clampContribution, DEFAULT_CAPS } from '../indexers/contribution.js';
+import { IndexerRuntime } from './runtime.js';
+
+/**
+ * The module that runs INSIDE the sandbox, wrapping the plugin's own entry.
+ *
+ * It exists because the plugin's `index(node, ctx)` contract is a function call and a
+ * dynamic Worker's contract is `fetch(request)`. This is the adapter between them, and
+ * it is the only host-authored code in there.
+ *
+ * `readRange` is deliberately the same shape the in-process context offers, so an
+ * indexer cannot tell which runtime it is on — that is what makes the audiobook indexer
+ * work unchanged on both.
+ */
+export const SHIM = `
+import * as entry from './entry.js';
+
+const fn = entry.default || entry.index;
+
+export default {
+  async fetch(request) {
+    const { node, url, maxBytes, config, secrets } = await request.json();
+    if (typeof fn !== 'function') {
+      return Response.json({ error: 'no default/index export' }, { status: 500 });
+    }
+    // One ranged GET per call, against the presigned URL and nothing else. \`end\` is
+    // exclusive here (as it is host-side) and inclusive in an HTTP Range header — the
+    // off-by-one that would silently drop the last byte of every read.
+    const readRange = async (start = 0, end = node.size) => {
+      const from = Math.max(0, Math.min(start, node.size));
+      const to = Math.min(end, from + maxBytes, node.size);
+      if (to <= from) return new Uint8Array(0);
+      // Concatenation rather than a template literal, deliberately: this whole module is
+      // itself a template literal, and a nested one has to be escaped through two levels.
+      // The first version got that wrong and every sandbox died with "Failed to start
+      // Worker" — a syntax error in generated code, which is invisible at the call site.
+      const res = await fetch(url, { headers: { Range: 'bytes=' + from + '-' + (to - 1) } });
+      if (!res.ok && res.status !== 206) throw new Error('range read failed: ' + res.status);
+      return new Uint8Array(await res.arrayBuffer());
+    };
+    const ctx = {
+      readRange,
+      readBytes: () => readRange(0, node.size),
+      readText: async () => new TextDecoder().decode(await readRange(0, node.size)),
+      maxBytes, config, secrets,
+    };
+    try {
+      return Response.json({ contribution: (await fn(node, ctx)) ?? null });
+    } catch (err) {
+      return Response.json({ error: err?.message || String(err) }, { status: 500 });
+    }
+  },
+};
+`;
+
+export class WorkerLoaderIndexerRuntime extends IndexerRuntime {
+  /**
+   * @param {object} opts
+   * @param {{get: Function}} opts.loader the `worker_loaders` binding (env.LOADER)
+   * @param {string} [opts.compatibilityDate] what the sandbox is compiled against
+   * @param {number} [opts.timeoutMs]
+   * @param {object} [opts.caps]
+   */
+  constructor({ loader, compatibilityDate = '2025-01-01', timeoutMs = 10_000, caps = DEFAULT_CAPS } = {}) {
+    super();
+    if (!loader?.get) throw TroveError.invalid('WorkerLoaderIndexerRuntime needs a worker_loaders binding');
+    this.loader = loader;
+    this.compatibilityDate = compatibilityDate;
+    this.timeoutMs = timeoutMs;
+    this.caps = { ...DEFAULT_CAPS, ...caps };
+  }
+
+  /**
+   * The binding either exists or it does not, and if it does it works — unlike the
+   * in-process runner, there is no capability here that a runtime might withhold.
+   * Constructing this class already refused a missing binding.
+   */
+  async probe() { return { ok: true }; }
+
+  async run(spec, node, ctx) {
+    // A presigned URL is the whole mechanism, so its absence is a hard error rather
+    // than a degraded path. It fails LOUDLY and per-install-shaped: a backend that
+    // cannot presign cannot host server indexers on Workers, and saying that is more
+    // use than an empty contribution.
+    if (typeof ctx.presignRead !== 'function') {
+      throw TroveError.unsupported(
+        `Indexer "${spec.id}" needs a presigned read URL to run in a sandbox, and this storage backend cannot mint one`,
+      );
+    }
+    const url = await ctx.presignRead();
+
+    const code = spec.files?.[spec.entry];
+    if (!code) throw TroveError.invalid(`Indexer "${spec.id}" is missing its entry "${spec.entry}"`);
+
+    // Keyed by cacheKey, which embeds the package DIGEST — so a reinstall at the same
+    // version gets a different isolate rather than the old code kept warm. The loader
+    // may reuse an isolate for a repeated id; that is exactly what we want within a
+    // digest and exactly what we must not have across one.
+    const stub = this.loader.get(spec.cacheKey || spec.id, async () => ({
+      compatibilityDate: this.compatibilityDate,
+      mainModule: 'shim.js',
+      modules: {
+        'shim.js': SHIM,
+        'entry.js': new TextDecoder().decode(code),
+      },
+      // No bindings. The sandbox gets its instructions in the request body and its bytes
+      // from one URL; there is nothing else for it to reach.
+      env: {},
+    }));
+
+    const res = await withTimeout(
+      stub.getEntrypoint().fetch('https://indexer.invalid/run', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          node: { id: node.id, name: node.name, contentType: node.contentType, size: node.size },
+          url,
+          maxBytes: ctx.maxBytes ?? 2 * 1024 * 1024,
+          config: ctx.config || {},
+          secrets: ctx.secrets || {},
+        }),
+      }),
+      this.timeoutMs,
+      `Indexer "${spec.id}" timed out after ${this.timeoutMs}ms`,
+    );
+
+    const body = await res.json().catch(() => ({ error: 'indexer returned a non-JSON response' }));
+    if (!res.ok || body.error) throw TroveError.invalid(`Indexer "${spec.id}" failed: ${body.error || res.status}`);
+    return clampContribution(body.contribution, this.caps);
+  }
+}

package/packages/core/src/vfs.js

@@ -345,8 +345,9 @@ export class Vfs {
       collectionId, name, storageKey, size: plaintextSize ?? info.size, contentType: ct,
       etag: info.etag, encryption,
     });
-    // Small server-side writes index synchronously (search is ready on return);
-    // large client uploads (completeUpload) index in the background instead.
+    // Indexing is awaited on BOTH write paths — here and in `completeUpload` — so search
+    // is ready when the call returns. See the note there for why the background variant
+    // could not work on a request-scoped runtime.
     await this.indexing.indexNode(node).catch((e) => console.error('index error', e));
     return node;
   }
@@ -763,7 +764,17 @@ export class Vfs {
         size: obj.size, contentType: obj.contentType, etag: obj.etag,
         overwrite: obj.overwrite, encryption: obj.encryption || null,
       });
-      this.indexing.indexNode(node).catch((e) => console.error('index error', e));
+      // AWAITED, like the small-write path above. It used to be fire-and-forget, and the
+      // reasoning ("large client uploads index in the background") only holds on a
+      // runtime with a process that outlives the request. On Workers there is none: the
+      // response returns, the isolate goes, and the indexing is cut off mid-read — so an
+      // uploaded file got no contributions, no search entry and NO ISSUE either, because
+      // nothing failed. It simply never ran.
+      //
+      // Awaiting is bounded rather than open-ended: an indexer reads through `readRange`,
+      // capped at `maxIndexBytes` (2 MiB by default), so this costs a couple of megabytes
+      // of reads regardless of whether the file is 400 KB or 400 MB.
+      await this.indexing.indexNode(node).catch((e) => console.error('index error', e));
       return node;
     } catch (err) {
       await (await this.storageFor(obj.collectionId)).delete(obj.storageKey).catch(() => {});

package/packages/server/src/adapters/worker-tasks.js

@@ -85,6 +85,15 @@ export function createTaskHost(getServer) {
       return { task, alreadyRunning };
     }
 
+    async #beginBackfill(indexerIds, reason) {
+      const server = await this.#boot();
+      const { task, alreadyRunning, done } = await server.beginBackfill({ indexerIds, reason });
+      // Same shape as a reindex: nothing to resume from, so it either finishes in this
+      // object's lifetime or the files stay unindexed until something asks again.
+      if (!alreadyRunning) this.state.waitUntil?.(done.catch(() => null));
+      return { task, alreadyRunning };
+    }
+
     async #beginReindex(reason) {
       const server = await this.#boot();
       const { task, alreadyRunning, done } = await server.beginReindex({ reason });
@@ -102,6 +111,7 @@ export function createTaskHost(getServer) {
       const server = await this.#boot();
       switch (url.pathname) {
         case '/begin':
+          if (body.kind === 'backfill') return json(await this.#beginBackfill(body.indexerIds, body.reason));
           return json(body.kind === 'index'
             ? await this.#beginReindex(body.reason)
             : await this.#beginScan(body.collectionId || 'default', body.reason));
@@ -204,6 +214,7 @@ export function remoteBackground(namespace) {
     background: {
       beginScan: (collectionId, { reason } = {}) => begin({ kind: 'scan', collectionId, reason }),
       beginReindex: ({ reason } = {}) => begin({ kind: 'index', reason }),
+      beginBackfill: ({ indexerIds, reason } = {}) => begin({ kind: 'backfill', indexerIds, reason }),
     },
     maintain: (budgetMs) => stub()
       .fetch('https://trove.tasks/maintain', {

package/packages/server/src/engine/providers/core.js

@@ -39,7 +39,7 @@ import {
   ApiKeyService, CapabilityProvider, ApiKeyCapabilityProvider,
   CollectionService,
   PluginService, PackageStore, StoragePackageStore, SqlitePluginInstallStore,
-  IndexerRuntime, InProcessIndexerRuntime, PluginIndexers,
+  IndexerRuntime, InProcessIndexerRuntime, WorkerLoaderIndexerRuntime, PluginIndexers,
   TaskRegistry, IssueRegistry,
   Vfs, TroveError,
   resolveAuthDiscovery,
@@ -225,6 +225,7 @@ export function coreProviders(config, lifecycleState) {
     backgroundWork: Provider.fromSingleton({
       beginScan: (collectionId, opts) => lifecycleState.background.beginScan(collectionId, opts),
       beginReindex: (opts) => lifecycleState.background.beginReindex(opts),
+      beginBackfill: (opts) => lifecycleState.background.beginBackfill(opts),
     }),
 
     /**
@@ -611,10 +612,16 @@ export function coreProviders(config, lifecycleState) {
 
     // Server indexer sub-packages run through a pluggable runtime. The default is
     // the in-process (trusted) runner; a deployment swaps in an isolate runtime.
-    indexerRuntime: Provider.fromLazySingleton(() =>
-      (config.serverIndexers === false
-        ? null
-        : resolve(config.indexerRuntime, IndexerRuntime, () => new InProcessIndexerRuntime()))),
+    indexerRuntime: Provider.fromLazySingleton(() => {
+      if (config.serverIndexers === false) return null;
+      // `{ loader }` — a Worker Loader binding, which configFromEnv sets when the
+      // deployment declares one. Built here rather than there so core stays the only
+      // place that knows what a runtime is.
+      if (config.indexerRuntime?.loader && !(config.indexerRuntime instanceof IndexerRuntime)) {
+        return new WorkerLoaderIndexerRuntime(config.indexerRuntime);
+      }
+      return resolve(config.indexerRuntime, IndexerRuntime, () => new InProcessIndexerRuntime());
+    }),
 
     plugins: Provider.fromLazySingleton(
       async (deps) => {

package/packages/server/src/index.js

@@ -140,6 +140,47 @@ export async function createServer(config = {}) {
     }
   };
   const startReindex = async (opts) => (await beginReindex(opts)).done;
+
+  /**
+   * Re-run named indexers over the files they match — what a freshly installed plugin
+   * needs, and the reason it is a TASK rather than part of the install.
+   *
+   * Scoped to `indexerIds` rather than rebuilding the drive: installing one plugin should
+   * not re-embed every file for every other indexer. That is also why it does not take
+   * the drive-wide `reindex` claim a full rebuild takes — two different plugins
+   * backfilling at once are doing disjoint work.
+   */
+  const beginBackfill = async ({ indexerIds = [], reason, title } = {}) => {
+    const wanted = indexerIds.filter(Boolean);
+    if (!wanted.length) {
+      return { task: null, alreadyRunning: false, done: Promise.resolve({ indexed: 0 }) };
+    }
+    const begun = tasks.begin(
+      {
+        kind: 'index',
+        title: title || (wanted.length === 1 ? 'Indexing existing files' : `Indexing existing files for ${wanted.length} indexers`),
+        detail: reason || null,
+        unit: 'items',
+        cancellable: true,
+      },
+      async (task) => {
+        let indexed = 0;
+        for (const id of wanted) {
+          const indexer = vfs.indexers.get(id);
+          // A named indexer that is not registered is not an error worth failing the
+          // task over: the usual cause is a deployment that cannot run it, which has
+          // already said so through the plugin-indexers issue.
+          if (!indexer?.match) continue;
+          const r = await vfs.backfillIndexer(indexer, { shouldStop: () => task.cancelled || closing() });
+          indexed += r?.indexed ?? 0;
+          task.progress?.({ done: indexed });
+          if (task.cancelled || closing()) break;
+        }
+        return { indexed };
+      },
+    );
+    return { task: begun.task, alreadyRunning: false, done: begun.done };
+  };
   // Retrying an issue runs the same work as everything else, and reports it the same
   // way. The issue is not cleared here — it is cleared by the indexing that succeeds,
   // so a retry can't report success over a problem that is still there.
@@ -165,10 +206,25 @@ export async function createServer(config = {}) {
   lifecycleState.background = {
     beginScan: config.background?.beginScan || beginScan,
     beginReindex: config.background?.beginReindex || beginReindex,
+    beginBackfill: config.background?.beginBackfill || beginBackfill,
   };
   const routeBeginScan = lifecycleState.background.beginScan;
   const routeBeginReindex = lifecycleState.background.beginReindex;
+  const routeBeginBackfill = lifecycleState.background.beginBackfill;
   issues.handle('scan-collection', (issue) => startScan(issue.retry.collectionId, { reason: 'Retrying after a failed scan' }));
+  // "I have added the binding — try again." Re-activating re-probes, which is the only
+  // honest way to answer: a button that merely dismissed the diagnostic would leave the
+  // drive exactly as unable to index as it was, with nothing saying so.
+  issues.handle('reactivate-indexers', async (issue) => {
+    const record = (await plugins?.installs?.all?.() ?? []).find((r) => r.pluginId === issue.retry.pluginId);
+    if (!record) return { ok: false };
+    await plugins.indexers?.activate(record, { backfill: false });
+    // Registered again? Then catch the existing files up, which is what the install
+    // would have scheduled had the deployment been able to run them at the time.
+    const ids = (record.indexers || []).map((i) => i.id).filter((id) => vfs.indexers.get(id));
+    if (ids.length) await routeBeginBackfill({ indexerIds: ids, reason: 'Retrying after the indexer runtime became available' });
+    return { ok: true };
+  });
   issues.handle('storage-check', (issue) => storageCheck.run({ origin: issue.retry?.origin || config.publicUrl || null }));
   // The one retry that matters most: the user has been told a comment saved and it exists
   // only in memory. The op was raised for years with no handler registered for it — and in
@@ -529,6 +585,7 @@ export async function createServer(config = {}) {
     // inside a Durable Object want. `begin*` goes wherever `config.background` says,
     // which for a front-line Worker isolate is the object rather than itself.
     startScan, startReindex, beginScan: routeBeginScan, beginReindex: routeBeginReindex,
+    beginBackfill: routeBeginBackfill,
     runMaintenance, checkStorage: (opts) => storageCheck.run(opts), rotation, mcp, auth, close };
 }
 
@@ -902,6 +959,17 @@ export function configFromEnv(env = (typeof process !== 'undefined' ? process.en
   // TROVE_SERVER_INDEXERS=0/false refuses server-indexer plugins on this deployment.
   if (env.TROVE_SERVER_INDEXERS === '0' || env.TROVE_SERVER_INDEXERS === 'false') config.serverIndexers = false;
 
+  // A `worker_loaders` binding means this is a Worker that CAN run plugin code, in a
+  // real isolate — so it does, rather than falling back to the in-process runner, which
+  // cannot import a `data:` URL on workerd and fails on every file. Discovered from the
+  // binding rather than configured: a deployment that declared the binding wants it, and
+  // one that did not gets the honest install-time refusal from the probe.
+  //
+  // Any binding name is accepted so the wrangler config can call it what it likes;
+  // TROVE_WORKER_LOADER names it explicitly when there is more than one.
+  const loader = env[env.TROVE_WORKER_LOADER || 'LOADER'] ?? findWorkerLoader(env);
+  if (loader && config.serverIndexers !== false) config.indexerRuntime = { loader };
+
   // Plugin package blob store: defaults to the primary storage backend (prefixed).
   // Point it at a separate bucket/root with TROVE_PACKAGE_STORE (+ its own settings).
   if (env.TROVE_PACKAGE_STORE) {
@@ -955,3 +1023,25 @@ export function configFromEnv(env = (typeof process !== 'undefined' ? process.en
 }
 
 export { createRouter };
+
+/**
+ * A `worker_loaders` binding, found by shape.
+ *
+ * Bindings arrive as an untyped bag and a loader is only identifiable by having `get`
+ * and nothing else — deliberately narrow, because a false positive here would hand
+ * plugin code to whatever object happened to match. Skips the names of bindings that
+ * also expose `get` and are emphatically not loaders (KV, R2, D1, Durable Objects are
+ * declared under their own config keys and reached by name, so a drive that wants this
+ * can always be explicit with TROVE_WORKER_LOADER).
+ */
+function findWorkerLoader(env) {
+  for (const [name, value] of Object.entries(env || {})) {
+    if (!value || typeof value !== 'object') continue;
+    if (typeof value.get !== 'function') continue;
+    // A loader has exactly one method. KV has `put`/`list`, R2 has `head`/`delete`,
+    // a DO namespace has `idFromName`, D1 has `prepare` — all disqualifying.
+    if (value.put || value.list || value.head || value.delete || value.idFromName || value.prepare) continue;
+    if (/loader/i.test(name)) return value;
+  }
+  return null;
+}