@bevel-software/platform-core-backend 0.13.6 → 0.15.1

package/dist/modules/plugins/discovery/kb-plugin-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-plugin-source.d.ts","sourceRoot":"","sources":["../../../../src/modules/plugins/discovery/kb-plugin-source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAoB,SAAS,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtG,OAAO,EAAU,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD,QAAQ,CAAC,OAAO,QAAQ;IAElB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAI5C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAOhG"}

package/dist/modules/plugins/discovery/kb-plugin-source.js

@@ -0,0 +1,107 @@
+import path from 'node:path';
+import { PLUGINS_DIR, PLUGIN_MANIFEST_FILE, pluginManifestName } from '@bevel-software/platform-shared';
+import { walkKb } from '../../../shared/kb-walk.js';
+import { readNativePlugin } from './native.source.js';
+import { BUNDLE_FILE, loadRegistry, readBundlePlugin } from './bundle-dialect/bundle.source.js';
+/**
+ * THE plugin source: a LISTENER on the one walk of the checkout
+ * (`walkKb`), reading every folder under the plugins root in whichever of
+ * the two file shapes it carries.
+ *
+ *   plugin.json          → a native plugin (this platform's layout)
+ *   plugin.bundle.json   → a bundle (the customer dialect, read-only)
+ *
+ * Nothing else is a plugin. A folder's POSITION means nothing: the legacy
+ * rule "everything directly under the root is a plugin" is retired by the
+ * `plugin-manifests` boot step, which writes the manifest into every such
+ * folder once, so discovery never has to guess.
+ *
+ * A folder that IS a plugin claims everything beneath it (its `skills/` are
+ * its own) — the walk still visits what lies beneath, for the other
+ * listeners; this one ignores it. When a folder carries both files the
+ * manifest wins, so a bundle migrated in place stops being read as a bundle
+ * the moment a `plugin.json` lands beside it. Two plugins with one name keep
+ * the first by path (the walk's order) and warn about the second — a name is
+ * an identity to people and URLs, and two folders answering to it would be
+ * two plugins with one key.
+ *
+ * Holes — a folder under the root that could not be listed, an identity
+ * file that could not be read — are counted in `unreadable`: nothing behind
+ * them is listed, and a writer refuses while they exist.
+ *
+ * No setting picks a dialect. Nothing to configure means nothing to document
+ * and nothing to remove but the `else if` that reads bundles.
+ */
+export class KbPluginSource {
+    dialect = 'kb';
+    async discover(kbRoot) {
+        return (await this.walkWith(kbRoot, [])).discovery;
+    }
+    async walkWith(kbRoot, listeners) {
+        const warnings = [];
+        const registry = await loadRegistry(kbRoot, warnings);
+        const listener = pluginListener(kbRoot, registry, warnings);
+        const { holes } = await walkKb(kbRoot, [listener.listener, ...listeners]);
+        return { discovery: listener.result(), holes };
+    }
+}
+/** The discovery listener over one walk, and the `Discovery` it has built once the walk is done. */
+function pluginListener(kbRoot, registry, warnings) {
+    const unreadable = [];
+    const plugins = [];
+    const seen = new Map();
+    /** Folders claimed as plugins (or as holes standing where a plugin may be): nothing beneath is looked at. */
+    const claimed = [];
+    const underRoot = (rel) => rel === PLUGINS_DIR || rel.startsWith(`${PLUGINS_DIR}/`);
+    const beneathClaimed = (rel) => claimed.some((c) => rel === c || rel.startsWith(`${c}/`));
+    // Uniqueness is judged on the MANIFEST SLUG, not the raw name: `Sales Team`
+    // and `sales-team` fold to one slug, and the slug is what the compiled
+    // marketplace keys a plugin on — two folders sharing it would be two
+    // plugins with one key and one of them silently overwritten.
+    const claim = (plugin) => {
+        const key = pluginManifestName(plugin.name);
+        const twin = seen.get(key);
+        if (twin) {
+            warnings.push(`${plugin.folder}: plugin name "${plugin.name}" is already used by ${twin} — plugin skipped`);
+            return;
+        }
+        seen.set(key, plugin.folder);
+        plugins.push(plugin);
+    };
+    return {
+        listener: {
+            async onDir(rel, entries) {
+                if (!underRoot(rel) || rel === PLUGINS_DIR || beneathClaimed(rel))
+                    return;
+                const has = (name) => entries.some((e) => e.isFile() && e.name === name);
+                const dir = path.join(kbRoot, rel);
+                const relFolder = rel.slice(PLUGINS_DIR.length + 1);
+                if (has(PLUGIN_MANIFEST_FILE)) {
+                    claimed.push(rel);
+                    // A manifest that could not be read: a hole, and still claimed.
+                    const native = await readNativePlugin(dir, rel, relFolder, warnings, unreadable);
+                    if (native)
+                        claim(native);
+                }
+                else if (has(BUNDLE_FILE)) {
+                    claimed.push(rel);
+                    const bundle = await readBundlePlugin(dir, rel, relFolder, registry, warnings, unreadable);
+                    if (bundle)
+                        claim(bundle);
+                }
+            },
+            onHole(rel, err) {
+                // A folder under the root that could not be listed hides every plugin
+                // beneath it; said out loud rather than letting the catalog shrink in
+                // silence, and COUNTED so a writer can tell an incomplete listing from
+                // a complete one. (Holes elsewhere in the tree are the walk's to report.)
+                if (!underRoot(rel) || beneathClaimed(rel))
+                    return;
+                warnings.push(`${rel}: could not be read — ${err instanceof Error ? err.message : String(err)}`);
+                unreadable.push(rel);
+            },
+        },
+        result: () => ({ plugins, warnings, unreadable }),
+    };
+}
+//# sourceMappingURL=kb-plugin-source.js.map

package/dist/modules/plugins/discovery/kb-plugin-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-plugin-source.js","sourceRoot":"","sources":["../../../../src/modules/plugins/discovery/kb-plugin-source.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAExG,OAAO,EAAE,MAAM,EAAuB,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAGhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAO,cAAc;IAChB,OAAO,GAAG,IAAI,CAAC;IAExB,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,SAAoC;QACjE,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;QAC1E,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;CACF;AAED,oGAAoG;AACpG,SAAS,cAAc,CACrB,MAAc,EACd,QAA4B,EAC5B,QAAkB;IAElB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,6GAA6G;IAC7G,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAElG,4EAA4E;IAC5E,uEAAuE;IACvE,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,CAAC,MAAwB,EAAQ,EAAE;QAC/C,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,kBAAkB,MAAM,CAAC,IAAI,wBAAwB,IAAI,mBAAmB,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE;YACR,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO;gBACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,WAAW,IAAI,cAAc,CAAC,GAAG,CAAC;oBAAE,OAAO;gBAC1E,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACjF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACpD,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,gEAAgE;oBAChE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;oBACjF,IAAI,MAAM;wBAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC5B,CAAC;qBAAM,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;oBAC3F,IAAI,MAAM;wBAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,GAAG;gBACb,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,0EAA0E;gBAC1E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC;oBAAE,OAAO;gBACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;SACF;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/modules/plugins/discovery/native.source.d.ts

@@ -0,0 +1,15 @@
+import type { DiscoveredPlugin } from './plugin-source.js';
+/**
+ * A plugin in the layout this platform writes (see `kb-layout.ts`): a folder
+ * carrying `plugin.json`, optionally `mcp.json`, and the `access.md` that
+ * makes it exist to the index. Called by the walker for every folder it
+ * decides is a native plugin; reads the files, decides nothing else.
+ *
+ * Null when the manifest exists but could not be READ: the manifest is the
+ * identity, and a plugin whose identity nobody could see is not listed under
+ * a guessed one — it is a hole (`unreadable`), like a folder that could not
+ * be listed. The optional `mcp.json` carries no identity, so its read
+ * failure is a warning and nothing more.
+ */
+export declare function readNativePlugin(dir: string, folder: string, relFolder: string, warnings: string[], unreadable: string[]): Promise<DiscoveredPlugin | null>;
+//# sourceMappingURL=native.source.d.ts.map

package/dist/modules/plugins/discovery/native.source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.source.d.ts","sourceRoot":"","sources":["../../../../src/modules/plugins/discovery/native.source.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAAE,EAClB,UAAU,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA0DlC"}

package/dist/modules/plugins/discovery/native.source.js

@@ -0,0 +1,102 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { PLUGIN_MANIFEST_FILE, PLUGIN_MCP_FILE, isPersonalPluginDir, isPluginIdentifier, linkedSkillRoots, pluginDisplayNameOf, pluginIdentityOf, } from '@bevel-software/platform-shared';
+import { isAbsence } from '../../../shared/fs-errors.js';
+/**
+ * A plugin in the layout this platform writes (see `kb-layout.ts`): a folder
+ * carrying `plugin.json`, optionally `mcp.json`, and the `access.md` that
+ * makes it exist to the index. Called by the walker for every folder it
+ * decides is a native plugin; reads the files, decides nothing else.
+ *
+ * Null when the manifest exists but could not be READ: the manifest is the
+ * identity, and a plugin whose identity nobody could see is not listed under
+ * a guessed one — it is a hole (`unreadable`), like a folder that could not
+ * be listed. The optional `mcp.json` carries no identity, so its read
+ * failure is a warning and nothing more.
+ */
+export async function readNativePlugin(dir, folder, relFolder, warnings, unreadable) {
+    const folderName = path.posix.basename(relFolder);
+    const manifestRead = await readText(path.join(dir, PLUGIN_MANIFEST_FILE), folder, warnings);
+    if (manifestRead.failed) {
+        unreadable.push(`${folder}/${PLUGIN_MANIFEST_FILE}`);
+        return null;
+    }
+    // The walker probed the manifest a moment ago; gone now means it vanished
+    // between probe and read — then this is no plugin, not one under a guessed name.
+    if (manifestRead.text === null)
+        return null;
+    const manifestText = manifestRead.text;
+    const mcpJsonText = (await readText(path.join(dir, PLUGIN_MCP_FILE), folder, warnings)).text;
+    const manifest = parseObject(manifestText);
+    if (manifest === null) {
+        warnings.push(`${folder}/${PLUGIN_MANIFEST_FILE} is not a JSON object — treated as absent`);
+    }
+    // The manifest's `name` IS the identity — the grants, the URLs, the
+    // marketplace all spell it — when it is an identifier. One that is not
+    // (spaces, capitals) is never silently reinterpreted: the folder stands
+    // in, and the mismatch is said out loud so a grant written against the
+    // manifest's spelling is not a mystery.
+    const name = pluginIdentityOf(manifest, folderName);
+    const displayName = pluginDisplayNameOf(manifest, folderName);
+    // Any PRESENT name that is not an identifier is worth a word — a number or
+    // an object as much as a capitalised string. Only an absent name is silent.
+    if (manifest && manifest.name !== undefined && !isPluginIdentifier(manifest.name)) {
+        // A diagnostic must never be the thing that fails: a non-string name is
+        // described by its type, not serialised (a value nested deep enough
+        // would blow the stack on the way to a warning).
+        const spelled = typeof manifest.name === 'string'
+            ? `"${manifest.name}"`
+            : `a value of type ${Array.isArray(manifest.name) ? 'array' : typeof manifest.name}`;
+        warnings.push(`${folder}/${PLUGIN_MANIFEST_FILE} names ${spelled}, which is not a plugin identifier (lowercase kebab-case) — the folder stands in as "${name}"`);
+    }
+    const mcp = parseObject(mcpJsonText);
+    const mcpServers = mcp && typeof mcp.mcpServers === 'object' && mcp.mcpServers !== null && !Array.isArray(mcp.mcpServers)
+        ? mcp.mcpServers
+        : null;
+    const exists = await fs.stat(path.join(dir, 'access.md')).then((s) => s.isFile(), () => false);
+    return {
+        name,
+        displayName,
+        folder,
+        relFolder,
+        // The one structural rule: a direct child of the root with the prefix.
+        personal: isPersonalPluginDir(folder),
+        exists,
+        manifest,
+        manifestText,
+        linkedRoots: linkedSkillRoots(manifest),
+        mcpServers,
+        mcpJsonText,
+        linksAreManaged: true,
+    };
+}
+/**
+ * A file's text — null when there is no such file — and whether a file that
+ * IS there could not be read. Absence and failure are different answers;
+ * the caller decides what a failure means for the file in question.
+ */
+async function readText(abs, folder, warnings) {
+    try {
+        return { text: await fs.readFile(abs, 'utf-8'), failed: false };
+    }
+    catch (err) {
+        if (isAbsence(err))
+            return { text: null, failed: false };
+        warnings.push(`${folder}/${path.basename(abs)} could not be read — ${err instanceof Error ? err.message : String(err)}`);
+        return { text: null, failed: true };
+    }
+}
+function parseObject(text) {
+    if (text === null)
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=native.source.js.map

package/dist/modules/plugins/discovery/native.source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.source.js","sourceRoot":"","sources":["../../../../src/modules/plugins/discovery/native.source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAGzD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,MAAc,EACd,SAAiB,EACjB,QAAkB,EAClB,UAAoB;IAEpB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5F,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,oBAAoB,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,iFAAiF;IACjF,IAAI,YAAY,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC;IACvC,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,oBAAoB,2CAA2C,CAAC,CAAC;IAC9F,CAAC;IACD,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,wCAAwC;IACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClF,wEAAwE;QACxE,oEAAoE;QACpE,iDAAiD;QACjD,MAAM,OAAO,GACX,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAC/B,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG;YACtB,CAAC,CAAC,mBAAmB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzF,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,IAAI,oBAAoB,UAAU,OAAO,wFAAwF,IAAI,GAAG,CAClJ,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,UAAU,GACd,GAAG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACpG,CAAC,CAAE,GAAG,CAAC,UAAsC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC/F,OAAO;QACL,IAAI;QACJ,WAAW;QACX,MAAM;QACN,SAAS;QACT,uEAAuE;QACvE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC;QACrC,MAAM;QACN,QAAQ;QACR,YAAY;QACZ,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACvC,UAAU;QACV,WAAW;QACX,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,MAAc,EACd,QAAkB;IAElB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAmB;IACtC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/modules/plugins/discovery/plugin-source.d.ts

@@ -0,0 +1,96 @@
+import type { KbWalkListener } from '../../../shared/kb-walk.js';
+/**
+ * Plugin DISCOVERY as an interface — the one seam between "what a plugin is
+ * on disk" and everything that consumes plugins (the plugin index, the link
+ * index, the tool-manual scanner, the compiler).
+ *
+ * Two providers implement it:
+ *
+ *   - `native.source.ts`  — the Agent Plugins layout this platform writes:
+ *                           `Plugins/<Name>/plugin.json` (+ `mcp.json`,
+ *                           `access.md`, the hexis extension block).
+ *   - `bundle-dialect/`   — a customer's source layout: `plugin.bundle.json`
+ *                           files at any depth, pointing at skill roots and at
+ *                           an MCP profile in a registry. Read-only, and
+ *                           deletable as a unit once that customer migrates.
+ *
+ * Consumers see only {@link DiscoveredPlugin}: parsed objects, never files.
+ * A provider that reads a different file shape changes nothing downstream.
+ */
+export interface DiscoveredPlugin {
+    /**
+     * The plugin's IDENTITY everywhere a URL, a grant or a marketplace names
+     * it: the manifest's `name` — an Agent Plugins identifier — or the folder
+     * name folded into one when the manifest declares none it can be. A bundle
+     * plugin's is the bundle's `name`. Unique per source.
+     */
+    name: string;
+    /** What a person sees it called: the manifest's `displayName`, else the folder name. */
+    displayName: string;
+    /** Repo-relative folder holding the plugin, e.g. `Plugins/GTM`. */
+    folder: string;
+    /** The same folder relative to the plugins root, e.g. `GTM` or `functional/x/y`. */
+    relFolder: string;
+    /** A personal folder (`Plugins/personal-<id>`): a place, not a plugin. */
+    personal: boolean;
+    /**
+     * Whether the plugin EXISTS by the index's rule. Native: its folder carries
+     * an `access.md` (a bare directory is a ghost git left behind). Dialect:
+     * always — the bundle file is the existence.
+     */
+    exists: boolean;
+    /** The Agent Plugins manifest, parsed (a dialect synthesises one). Null when absent or unparsable. */
+    manifest: Record<string, unknown> | null;
+    /** The manifest's raw text, for readers that want the extension block verbatim (native only). */
+    manifestText: string | null;
+    /** Repo-relative roots the plugin LINKS skills from — a skill folder or a folder of skills. */
+    linkedRoots: string[];
+    /** The `mcpServers` map of the plugin's `mcp.json`, parsed; null when it has none. */
+    mcpServers: Record<string, unknown> | null;
+    /** The raw `mcp.json` text, when it exists on disk (native only). */
+    mcpJsonText: string | null;
+    /**
+     * Whether hexis manages this plugin's links — writes them, grants the
+     * plugin's principal on the skill, reports a missing grant as needing
+     * repair. False for a dialect, whose links are plain references and whose
+     * skills' own scopes decide readability.
+     */
+    linksAreManaged: boolean;
+}
+export interface Discovery {
+    plugins: DiscoveredPlugin[];
+    /** What was skipped and why — unparsable files, unknown profiles. */
+    warnings: string[];
+    /**
+     * HOLES: identity-bearing things that exist but could NOT be read
+     * (permissions, I/O), repo-relative — a folder that could not be listed,
+     * a manifest or bundle that could not be opened. Nothing behind a hole is
+     * in `plugins`: not absent, unseen, and never listed under a guessed name.
+     * A file that carries no identity (an `mcp.json`) is never a hole; its
+     * failure is a warning. A reader that only shows what it can carries on
+     * (the catalog does); a WRITER that keys a change on the set of plugins
+     * (a rename claiming a name) must refuse while this is not empty, or it
+     * may take an identity it could not see.
+     */
+    unreadable: string[];
+}
+/** What one walk yields when discovery shares it: the plugins, and every hole the walk met anywhere. */
+export interface PluginSourceWalk {
+    discovery: Discovery;
+    /** Every folder the walk could not list, repo-relative — under the plugins root or anywhere else. */
+    holes: string[];
+}
+export interface PluginSource {
+    /** A short name for logs and the settings screen. */
+    readonly dialect: string;
+    /** Enumerate the plugins in a KB checkout. Never throws: a broken tree yields warnings. */
+    discover(kbRoot: string): Promise<Discovery>;
+    /**
+     * Discover while driving other listeners from the SAME walk — a writer
+     * that needs plugins and grant files alike reads the tree once, and sees
+     * one set of holes. Optional: a source that cannot share its walk is
+     * discovered on its own and the caller walks separately.
+     */
+    walkWith?(kbRoot: string, listeners: readonly KbWalkListener[]): Promise<PluginSourceWalk>;
+}
+//# sourceMappingURL=plugin-source.d.ts.map

package/dist/modules/plugins/discovery/plugin-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-source.d.ts","sourceRoot":"","sources":["../../../../src/modules/plugins/discovery/plugin-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,iGAAiG;IACjG,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+FAA+F;IAC/F,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,qEAAqE;IACrE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;;OAUG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,SAAS,CAAC;IACrB,qGAAqG;IACrG,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC5F"}

package/dist/modules/plugins/discovery/plugin-source.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=plugin-source.js.map

package/dist/modules/plugins/discovery/plugin-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-source.js","sourceRoot":"","sources":["../../../../src/modules/plugins/discovery/plugin-source.ts"],"names":[],"mappings":""}

package/dist/modules/plugins/index.d.ts

@@ -1,7 +1,16 @@
 export { PluginIndexService, pluginsWorkspaceId } from './plugins.service.js';
 export { PluginProvisionService, PluginProvisionError, pluginAccessMd, personalAccessMd, } from './plugin-provision.service.js';
 export { JoinRequestsService, type JoinRequest } from './join-requests.service.js';
+export { PluginLinkIndex, type LinkMembership, type PluginLinks } from './plugin-links.js';
+export { PluginLinksService, PluginLinkError } from './plugin-links.service.js';
+export { PluginRenameService, PluginRenameError, renamePluginPrincipalInText } from './plugin-rename.service.js';
+export { compileMarketplace, type VirtualTree, type CompileInput, type MarketplaceOptions } from './compile/compile-marketplace.js';
+export { MarketplaceCompilerService, type CompileAudience } from './compile/marketplace-compiler.service.js';
+export type { PluginSource, PluginSourceWalk, DiscoveredPlugin, Discovery } from './discovery/plugin-source.js';
+export { walkKb, type KbWalkListener, type KbWalkResult } from '../../shared/kb-walk.js';
+export { KbPluginSource } from './discovery/kb-plugin-source.js';
+export { DEFAULT_REGISTRY_PATH } from './discovery/bundle-dialect/bundle.source.js';
 export { pendingProposals, type JoinProposal } from './join-proposals.js';
 export { createPluginsRoutes } from './plugins.routes.js';
-export type { IPluginIndexService, PluginCatalogEntry, PluginSummary, ResolvedPrincipals, ResolvedReaders, } from './plugins.contract.js';
+export type { IPluginIndexService, PluginCatalogEntry, PluginMembership, PluginSummary, ResolvedPrincipals, ResolvedReaders, } from './plugins.contract.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/modules/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,eAAe,GAChB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACpI,OAAO,EAAE,0BAA0B,EAAE,KAAK,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAC7G,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAChH,OAAO,EAAE,MAAM,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,eAAe,GAChB,MAAM,uBAAuB,CAAC"}

package/dist/modules/plugins/index.js

@@ -1,6 +1,14 @@
 export { PluginIndexService, pluginsWorkspaceId } from './plugins.service.js';
 export { PluginProvisionService, PluginProvisionError, pluginAccessMd, personalAccessMd, } from './plugin-provision.service.js';
 export { JoinRequestsService } from './join-requests.service.js';
+export { PluginLinkIndex } from './plugin-links.js';
+export { PluginLinksService, PluginLinkError } from './plugin-links.service.js';
+export { PluginRenameService, PluginRenameError, renamePluginPrincipalInText } from './plugin-rename.service.js';
+export { compileMarketplace } from './compile/compile-marketplace.js';
+export { MarketplaceCompilerService } from './compile/marketplace-compiler.service.js';
+export { walkKb } from '../../shared/kb-walk.js';
+export { KbPluginSource } from './discovery/kb-plugin-source.js';
+export { DEFAULT_REGISTRY_PATH } from './discovery/bundle-dialect/bundle.source.js';
 export { pendingProposals } from './join-proposals.js';
 export { createPluginsRoutes } from './plugins.routes.js';
 //# sourceMappingURL=index.js.map

package/dist/modules/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAoB,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAqB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAoB,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,eAAe,EAAyC,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAgE,MAAM,kCAAkC,CAAC;AACpI,OAAO,EAAE,0BAA0B,EAAwB,MAAM,2CAA2C,CAAC;AAE7G,OAAO,EAAE,MAAM,EAA0C,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAqB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/modules/plugins/plugin-links.d.ts

@@ -0,0 +1,66 @@
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import type { ISkillService } from '../skills/skills.contract.js';
+import type { PluginMembership } from './plugins.contract.js';
+import type { PluginSource } from './discovery/plugin-source.js';
+/** One plugin's links, resolved against the released catalog. */
+export interface PluginLinks {
+    /** The plugin's name — its identity to people and URLs. */
+    name: string;
+    /** Repo-relative plugin folder. */
+    folder: string;
+    /** The roots the manifest declares, normalised. */
+    roots: string[];
+    /** Skill folders the roots resolve to (released catalog only). */
+    linkedSkills: string[];
+    /** Roots that resolve to no released skill — a typo, or a skill not yet merged. */
+    unresolvedRoots: string[];
+    /** Whether hexis writes these links and checks their grants — see `DiscoveredPlugin`. */
+    linksAreManaged: boolean;
+}
+export interface LinkMembership {
+    /** skill path → every plugin that holds it, inline or by link. */
+    bySkill: Map<string, PluginMembership[]>;
+    /** plugin folder → its links. Every plugin folder appears, linked or not. */
+    byPlugin: Map<string, PluginLinks>;
+}
+/**
+ * The link index: which shared skills each plugin links, and — the other way
+ * round — which plugins each skill belongs to, whether by sitting inside the
+ * plugin folder or by being linked from its manifest.
+ *
+ * Plugins come from the configured {@link PluginSource} (native manifests, or
+ * a customer dialect); resolution runs against the RELEASED catalog
+ * (`skillService.listSkills()`, unfiltered), never the file system: the
+ * catalog already applies the leaf-folder rule, the `.bevelignore` layers
+ * and the global-name dedup, and a second walk here would be a second
+ * opinion about what a skill is.
+ *
+ * `granted` is the consistency check the amber dot renders: a linked skill
+ * whose own access rules DO grant the plugin's `plugin/<Name>/read`
+ * principal (directly or from a scope above it). The link service writes
+ * that grant with the link; only a hand edit takes it away.
+ *
+ * Cached briefly, dropped by `invalidate()` from the same file-change
+ * subscriber that drops the plugin index, so a link committed on the default
+ * branch shows within one round-trip.
+ */
+export declare class PluginLinkIndex {
+    private readonly workspaceService;
+    private readonly skillService;
+    private readonly accessControl;
+    private readonly kbDirName;
+    private readonly source;
+    private readonly cache;
+    constructor(workspaceService: WorkspaceService, skillService: ISkillService, accessControl: IAccessControl, kbDirName: string, now?: () => number, source?: PluginSource);
+    invalidate(): void;
+    membership(): Promise<LinkMembership>;
+    /** Convenience: the memberships of one skill (empty when it is in no plugin). */
+    pluginsOf(skillPath: string): Promise<PluginMembership[]>;
+    private build;
+    /** Whether the skill folder's effective readers include the plugin's read principal. */
+    private isGranted;
+}
+/** The default-branch workspace id every link resolution runs against. */
+export declare function linksWorkspaceId(): string;
+//# sourceMappingURL=plugin-links.d.ts.map

package/dist/modules/plugins/plugin-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-links.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-links.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAKjE,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mFAAmF;IACnF,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,yFAAyF;IACzF,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzC,6EAA6E;IAC7E,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IARzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2B;gBAG9B,gBAAgB,EAAE,gBAAgB,EAClC,YAAY,EAAE,aAAa,EAC3B,aAAa,EAAE,cAAc,EAC7B,SAAS,EAAE,MAAM,EAClC,GAAG,GAAE,MAAM,MAAiB,EACX,MAAM,GAAE,YAAmC;IAK9D,UAAU,IAAI,IAAI;IAIZ,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC;IAgB3C,iFAAiF;IAC3E,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAMjD,KAAK;IAoEnB,wFAAwF;YAC1E,SAAS;CAUxB;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC"}

package/dist/modules/plugins/plugin-links.js

@@ -0,0 +1,160 @@
+import path from 'node:path';
+import { DEFAULT_BRANCH, pluginManifestName, skillUnderRoot } from '@bevel-software/platform-shared';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import { TtlCache } from '../../shared/ttl-cache.js';
+import { canonicalRoleName, pluginPrincipalKey } from '../access-model/access-grammar.js';
+import { KbPluginSource } from './discovery/kb-plugin-source.js';
+const CACHE_TTL_MS = 60_000;
+/**
+ * The link index: which shared skills each plugin links, and — the other way
+ * round — which plugins each skill belongs to, whether by sitting inside the
+ * plugin folder or by being linked from its manifest.
+ *
+ * Plugins come from the configured {@link PluginSource} (native manifests, or
+ * a customer dialect); resolution runs against the RELEASED catalog
+ * (`skillService.listSkills()`, unfiltered), never the file system: the
+ * catalog already applies the leaf-folder rule, the `.bevelignore` layers
+ * and the global-name dedup, and a second walk here would be a second
+ * opinion about what a skill is.
+ *
+ * `granted` is the consistency check the amber dot renders: a linked skill
+ * whose own access rules DO grant the plugin's `plugin/<Name>/read`
+ * principal (directly or from a scope above it). The link service writes
+ * that grant with the link; only a hand edit takes it away.
+ *
+ * Cached briefly, dropped by `invalidate()` from the same file-change
+ * subscriber that drops the plugin index, so a link committed on the default
+ * branch shows within one round-trip.
+ */
+export class PluginLinkIndex {
+    workspaceService;
+    skillService;
+    accessControl;
+    kbDirName;
+    source;
+    cache;
+    constructor(workspaceService, skillService, accessControl, kbDirName, now = Date.now, source = new KbPluginSource()) {
+        this.workspaceService = workspaceService;
+        this.skillService = skillService;
+        this.accessControl = accessControl;
+        this.kbDirName = kbDirName;
+        this.source = source;
+        this.cache = new TtlCache(CACHE_TTL_MS, now);
+    }
+    invalidate() {
+        this.cache.invalidate();
+    }
+    async membership() {
+        const cached = this.cache.get();
+        if (cached)
+            return cached;
+        // Token first, like the other catalogs: an `invalidate()` landing while
+        // the build reads the pre-change tree must not be undone by storing that
+        // read afterwards.
+        const token = this.cache.begin();
+        const built = await this.build();
+        // A degraded read (no workspace yet) is served but not stored — the same
+        // reasoning as the plugin index: caching a failure hides every link for
+        // a full TTL after its cause is gone.
+        if (built === null)
+            return { bySkill: new Map(), byPlugin: new Map() };
+        this.cache.set(built, token);
+        return built;
+    }
+    /** Convenience: the memberships of one skill (empty when it is in no plugin). */
+    async pluginsOf(skillPath) {
+        return (await this.membership()).bySkill.get(skillPath) ?? [];
+    }
+    // --- internal --------------------------------------------------------------
+    async build() {
+        let wsId;
+        let kbRoot;
+        try {
+            wsId = (await this.workspaceService.getOrCreateForBranch(DEFAULT_BRANCH)).id;
+            kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
+        }
+        catch {
+            return null;
+        }
+        const skills = await this.skillService.listSkills(undefined);
+        const bySkill = new Map();
+        const byPlugin = new Map();
+        const add = (skillPath, m) => {
+            const list = bySkill.get(skillPath) ?? [];
+            if (!list.some((x) => x.name === m.name))
+                list.push(m);
+            bySkill.set(skillPath, list);
+        };
+        const discovered = await this.source.discover(kbRoot);
+        for (const w of discovered.warnings)
+            console.warn(`[plugins] ${w}`);
+        // Inline skills: the ones sitting INSIDE a plugin's folder, matched by
+        // folder prefix (a plugin may sit at any depth, so the second path
+        // segment says nothing). Personal folders are places, not plugins —
+        // their skills belong to nobody's plugin.
+        const ownerOf = (skillPath) => discovered.plugins.find((p) => !p.personal && p.exists && skillPath.startsWith(`${p.folder}/`));
+        for (const s of skills) {
+            const owner = ownerOf(s.path);
+            if (owner)
+                add(s.path, { name: owner.name, linked: false, granted: true });
+        }
+        for (const plugin of discovered.plugins) {
+            // Personal folders are places, not plugins; a manifest without the
+            // access.md that makes a plugin EXIST is a ghost the index and the
+            // compiler omit, so it must not be linkable or hold grants either.
+            if (plugin.personal || !plugin.exists)
+                continue;
+            const roots = plugin.linkedRoots;
+            const linkedSkills = [];
+            const unresolvedRoots = [];
+            for (const root of roots) {
+                const hits = skills.filter((s) => skillUnderRoot(s.path, root)).map((s) => s.path);
+                if (hits.length === 0)
+                    unresolvedRoots.push(root);
+                for (const hit of hits)
+                    if (!linkedSkills.includes(hit))
+                        linkedSkills.push(hit);
+            }
+            byPlugin.set(plugin.name, {
+                name: plugin.name,
+                folder: plugin.folder,
+                roots,
+                linkedSkills,
+                unresolvedRoots,
+                linksAreManaged: plugin.linksAreManaged,
+            });
+            if (linkedSkills.length === 0)
+                continue;
+            const token = pluginPrincipalKey(pluginManifestName(plugin.name), 'read');
+            for (const skillPath of linkedSkills) {
+                // A skill that also sits INSIDE this plugin folder is inline, and its
+                // inline membership already stands.
+                if (skillPath.startsWith(`${plugin.folder}/`))
+                    continue;
+                // An unmanaged (dialect) link is a plain reference: nothing to grant,
+                // nothing to repair — the skill's own scope decides who reads it.
+                const granted = plugin.linksAreManaged ? await this.isGranted(wsId, skillPath, token) : true;
+                add(skillPath, { name: plugin.name, linked: true, granted });
+            }
+        }
+        return { bySkill, byPlugin };
+    }
+    /** Whether the skill folder's effective readers include the plugin's read principal. */
+    async isGranted(wsId, skillPath, token) {
+        try {
+            const readers = await this.accessControl.eligibleReaders(wsId, skillPath);
+            if (!readers.restricted)
+                return true; // readable by everyone — the plugin's members included
+            // The resolver reports display names; compare through the one canonicaliser.
+            return (readers.principals ?? []).some((p) => p.kind === 'plugin' && canonicalRoleName(p.name) === token);
+        }
+        catch {
+            return false; // fail closed: an unreadable tree reports the link as needing repair
+        }
+    }
+}
+/** The default-branch workspace id every link resolution runs against. */
+export function linksWorkspaceId() {
+    return workspaceIdForBranch(DEFAULT_BRANCH);
+}
+//# sourceMappingURL=plugin-links.js.map