@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/plugins/plugin-rename.service.d.ts

@@ -0,0 +1,71 @@
+import type { AuthUser } from '@bevel-software/platform-shared';
+import type { ITreeWalker } from '../../shared/fs.contract.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { PluginSource } from './discovery/plugin-source.js';
+export declare class PluginRenameError extends Error {
+    readonly status: number;
+    readonly payload: Record<string, unknown>;
+    constructor(message: string, status: number, payload?: Record<string, unknown>);
+}
+/** The one commit the rename lands as — a scoped batch, pushed. */
+export interface RenameCommitDriver {
+    commitChanges(workspaceId: string, user: AuthUser, summary: string, onlyPaths: string[]): Promise<unknown>;
+}
+export interface RenameResult {
+    name: string;
+    displayName: string;
+    /** Repo-relative files whose grants were rewritten, for the response and the log. */
+    rewritten: string[];
+}
+/**
+ * Renaming a plugin — its identifier, its display name, or both.
+ *
+ * The identifier (the manifest's `name`) IS the plugin: the marketplace
+ * publishes it, the URLs key on it, and every grant of `plugin/<name>/<verb>`
+ * spells it. Changing it is therefore a rename of a PRINCIPAL, and a
+ * principal that is renamed in one file and not another is two principals,
+ * one of which nobody is a member of. So the rename is one commit: the
+ * manifest, plus every access entry in the knowledge base that names the old
+ * identifier, rewritten to the new one. Membership does not change — the
+ * same people hold the same verbs through the new spelling — but the caller
+ * still needs write on each file the commit touches: the protected-branch
+ * gate checks every path, and a rename that lands in some files and is
+ * refused in others is the split it exists to prevent. The refusal names the
+ * files, so the manager can ask their editors or an admin.
+ *
+ * The display name is free text with no consequences: the manifest changes,
+ * nothing else does.
+ */
+export declare class PluginRenameService {
+    private readonly workspaceService;
+    private readonly commits;
+    private readonly accessControl;
+    private readonly source;
+    private readonly disk;
+    private readonly kbDirName;
+    private readonly events?;
+    private readonly onChanged?;
+    constructor(workspaceService: WorkspaceService, commits: RenameCommitDriver, accessControl: IAccessControl, source: PluginSource, disk: ITreeWalker, kbDirName: string, events?: {
+        emit(event: {
+            kind: "fs-tree-changed";
+            workspaceId: string;
+            branch: string;
+        }): void;
+    } | undefined, onChanged?: (() => void) | undefined);
+    private noteChanged;
+    /** The READ phase must have seen everything it needed; a hole refuses the rename before any write. */
+    private assertComplete;
+    rename(user: AuthUser, current: string, patch: {
+        name?: unknown;
+        displayName?: unknown;
+    }): Promise<RenameResult>;
+}
+/**
+ * Every access entry line naming `plugin/<old>/<verb>` — in ANY spelling the
+ * parser accepts — rewritten to `plugin/<next>/<verb>`, the rest of the
+ * line (indent, `- `, a `deny` prefix, the line ending) kept. Lines that are
+ * not such an entry are untouched, so the file's own formatting survives.
+ */
+export declare function renamePluginPrincipalInText(text: string, oldName: string, nextName: string): string;
+//# sourceMappingURL=plugin-rename.service.d.ts.map

package/dist/modules/plugins/plugin-rename.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-rename.service.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-rename.service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAO5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAGjE,qBAAa,iBAAkB,SAAQ,KAAK;IAGxC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFzC,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAKjD;AAED,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5G;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAGxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBATV,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,EAAE,kBAAkB,EAC3B,aAAa,EAAE,cAAc,EAC7B,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;QACxB,IAAI,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,iBAAiB,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KACrF,YAAA,EACgB,SAAS,CAAC,GAAE,MAAM,IAAI,aAAA;IAGzC,OAAO,CAAC,WAAW;IAInB,sGAAsG;IACtG,OAAO,CAAC,cAAc;IAShB,MAAM,CACV,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/C,OAAO,CAAC,YAAY,CAAC;CA0KzB;AAkBD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAanG"}

package/dist/modules/plugins/plugin-rename.service.js

@@ -0,0 +1,254 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { PERSONAL_PLUGIN_PREFIX, PLUGIN_MANIFEST_FILE, isPluginIdentifier, pluginDisplayNameOf, pluginManifestName, } from '@bevel-software/platform-shared';
+import { PushNeedsAgentResolutionError } from '../../shared/domain-errors.js';
+import { PLUGIN_TOKEN_PREFIX, canonicalPluginToken, hasAccessFrontmatterExtension, parsePluginPrincipalKey, } from '../access-model/access-grammar.js';
+import { linksWorkspaceId } from './plugin-links.js';
+export class PluginRenameError extends Error {
+    status;
+    payload;
+    constructor(message, status, payload = {}) {
+        super(message);
+        this.status = status;
+        this.payload = payload;
+        this.name = 'PluginRenameError';
+    }
+}
+/**
+ * Renaming a plugin — its identifier, its display name, or both.
+ *
+ * The identifier (the manifest's `name`) IS the plugin: the marketplace
+ * publishes it, the URLs key on it, and every grant of `plugin/<name>/<verb>`
+ * spells it. Changing it is therefore a rename of a PRINCIPAL, and a
+ * principal that is renamed in one file and not another is two principals,
+ * one of which nobody is a member of. So the rename is one commit: the
+ * manifest, plus every access entry in the knowledge base that names the old
+ * identifier, rewritten to the new one. Membership does not change — the
+ * same people hold the same verbs through the new spelling — but the caller
+ * still needs write on each file the commit touches: the protected-branch
+ * gate checks every path, and a rename that lands in some files and is
+ * refused in others is the split it exists to prevent. The refusal names the
+ * files, so the manager can ask their editors or an admin.
+ *
+ * The display name is free text with no consequences: the manifest changes,
+ * nothing else does.
+ */
+export class PluginRenameService {
+    workspaceService;
+    commits;
+    accessControl;
+    source;
+    disk;
+    kbDirName;
+    events;
+    onChanged;
+    constructor(workspaceService, commits, accessControl, source, disk, kbDirName, events, onChanged) {
+        this.workspaceService = workspaceService;
+        this.commits = commits;
+        this.accessControl = accessControl;
+        this.source = source;
+        this.disk = disk;
+        this.kbDirName = kbDirName;
+        this.events = events;
+        this.onChanged = onChanged;
+    }
+    noteChanged(wsId) {
+        noteChangedFor(this.accessControl, this.events, this.onChanged, wsId);
+    }
+    /** The READ phase must have seen everything it needed; a hole refuses the rename before any write. */
+    assertComplete(unreadable) {
+        if (unreadable.length === 0)
+            return;
+        throw new PluginRenameError(`Some of the knowledge base could not be read (${unreadable.join(', ')}), so the rename cannot be checked against every plugin and grant. Try again, or ask an admin.`, 503, { kind: 'incomplete-discovery', unreadable });
+    }
+    async rename(user, current, patch) {
+        const wsId = linksWorkspaceId();
+        const kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
+        // ONE walk of the checkout for everything the rename needs to know:
+        // the plugins (discovery's listener) and every file that can carry a
+        // grant (this one's), seeing one set of holes. Listing is all that
+        // happens here — no file is read, nothing is decided — so it can run
+        // before authorization without telling anyone anything.
+        const grantFiles = [];
+        const grantListener = {
+            onFile(dir, name) {
+                if (hasAccessFrontmatterExtension(name))
+                    grantFiles.push(dir ? `${dir}/${name}` : name);
+            },
+        };
+        const { discovery, holes } = this.source.walkWith
+            ? await this.source.walkWith(kbRoot, [grantListener])
+            : { discovery: await this.source.discover(kbRoot), holes: (await this.disk.walkKb(kbRoot, [grantListener])).holes };
+        const { plugins } = discovery;
+        const unreadable = [...new Set([...discovery.unreadable, ...holes])];
+        // Three phases: READ everything, DECIDE, then WRITE. Nothing about the
+        // tree — not even that part of it could not be read — reaches a caller
+        // before they are known to manage the plugin they name.
+        const plugin = plugins.find((p) => p.name === current.trim() && !p.personal && p.exists);
+        // Fail closed, like every plugin surface: unknown and not-yours answer alike.
+        if (!plugin || !(await this.accessControl.canWrite(wsId, user.email, `${plugin.folder}/access.md`))) {
+            throw new PluginRenameError('Unknown plugin', 404, { kind: 'unknown-plugin' });
+        }
+        if (!plugin.linksAreManaged) {
+            throw new PluginRenameError(`${plugin.name} is read from an external plugin format; rename it in that repository.`, 409, { kind: 'read-only' });
+        }
+        const nextName = patch.name === undefined ? plugin.name : String(patch.name).trim();
+        // The rules govern a NEW identifier only. The current one is whatever the
+        // manifest says — a hand-written name that predates a rule (a reserved
+        // prefix, say) must not block a display-name change, and cannot be
+        // "fixed" by a rename that keeps it.
+        const identifierChanges = nextName !== plugin.name;
+        // A NEW identifier is claimed against EVERY plugin there is and rewritten
+        // into every grant there is. A listing with a hole in it — a folder or
+        // manifest that exists but could not be read — is neither set: the name
+        // could belong to what was not seen, the grant could live there. Fail
+        // closed; nothing is written. A display-name change claims nothing and
+        // touches one manifest, so it needs no more than its own plugin read.
+        if (identifierChanges)
+            this.assertComplete(unreadable);
+        // An identifier must be its own slug: the marketplace and the collision
+        // checks key on `pluginManifestName(name)`, so a name that does not
+        // round-trip (longer than the slug's 64 characters, say) would be one
+        // thing here and another everywhere it is published.
+        if (identifierChanges && (!isPluginIdentifier(nextName) || pluginManifestName(nextName) !== nextName)) {
+            throw new PluginRenameError('A plugin identifier is lowercase kebab-case: letters, digits and single hyphens, like "sales-team".', 422, { kind: 'bad-name' });
+        }
+        if (identifierChanges && nextName.startsWith(PERSONAL_PLUGIN_PREFIX)) {
+            throw new PluginRenameError(`The "${PERSONAL_PLUGIN_PREFIX}" namespace is reserved for personal folders. Pick another identifier.`, 422, { kind: 'bad-name' });
+        }
+        // Taken by SLUG, not by spelling: a bundle may declare a name that is not
+        // an identifier, and the marketplace folds every name to its slug — a
+        // collision there drops one of the two from the catalog.
+        if (identifierChanges && plugins.some((p) => p !== plugin && pluginManifestName(p.name) === nextName)) {
+            throw new PluginRenameError(`A plugin named "${nextName}" already exists.`, 409, { kind: 'name-taken' });
+        }
+        // What the MANIFEST says today, not what discovery resolved: a manifest
+        // carrying no `displayName` shows its identifier, and carrying THAT over
+        // an identifier change would persist the name the plugin just stopped
+        // being called. The stored field is the only thing an untouched display
+        // name can mean.
+        const storedDisplay = typeof plugin.manifest?.displayName === 'string' ? plugin.manifest.displayName.trim() : '';
+        const nextDisplay = patch.displayName === undefined ? storedDisplay : String(patch.displayName).trim();
+        // The manifest, with everything else in it kept. `displayName` is ALWAYS
+        // written — equal to the identifier, equal to the folder, whatever the
+        // person typed — because the manifest is the only source every reader
+        // has. The field is never deleted: an edit that blanks it falls back to
+        // the identifier, which is what the plugin is then called.
+        const manifest = { ...(plugin.manifest ?? {}), name: nextName };
+        manifest.displayName = nextDisplay || nextName;
+        const manifestRel = `${this.kbDirName}/${plugin.folder}/${PLUGIN_MANIFEST_FILE}`;
+        const writes = [
+            { rel: manifestRel, text: `${JSON.stringify(manifest, null, 2)}\n`, before: plugin.manifestText },
+        ];
+        if (identifierChanges) {
+            // Every access entry in the knowledge base that names the old
+            // principal — in a folder's access.md or in the own frontmatter of any
+            // file kind the resolver reads grants from (`.md`, `.tool`, whatever
+            // an overlay registered). The files came from the walk above, whose
+            // holes have already refused: a folder that could not be listed would
+            // leave the old spelling live in it, and a principal renamed in some
+            // files and not others is two principals. A file the walk listed but
+            // that cannot be opened is the same hole: every such file is
+            // collected, then refused together.
+            const unopened = [];
+            for (const rel of grantFiles) {
+                const abs = path.join(kbRoot, rel);
+                let before;
+                try {
+                    before = await fs.readFile(abs, 'utf-8');
+                }
+                catch {
+                    unopened.push(rel);
+                    continue;
+                }
+                const after = renamePluginPrincipalInText(before, plugin.name, nextName);
+                if (after !== before)
+                    writes.push({ rel: `${this.kbDirName}/${rel}`, text: after, before });
+            }
+            this.assertComplete(unopened);
+            const denied = [];
+            for (const w of writes.slice(1)) {
+                const repoRel = w.rel.slice(this.kbDirName.length + 1);
+                if (!(await this.accessControl.canWrite(wsId, user.email, repoRel)))
+                    denied.push(repoRel);
+            }
+            if (denied.length > 0) {
+                throw new PluginRenameError(`Renaming ${plugin.name} would rewrite grants in files you can't edit: ${denied.join(', ')}. Ask their editors, or an admin.`, 409, { kind: 'needs-write', files: denied });
+            }
+        }
+        // Writes and commit share ONE failure envelope: whichever of them fails,
+        // the working tree goes back to what origin has — a half-written batch
+        // is as much a split principal as a refused commit.
+        try {
+            for (const w of writes)
+                await this.workspaceService.writeFile(wsId, w.rel, w.text);
+            const summary = identifierChanges
+                ? `Rename plugin ${plugin.name} to ${nextName}`
+                : `Rename plugin ${plugin.name}: display name`;
+            await this.commits.commitChanges(wsId, user, summary, writes.map((w) => w.rel));
+        }
+        catch (err) {
+            // One failure is NOT a failed commit: the commit landed locally and only
+            // the push did not (the typed hand-off the workflow throws). Restoring
+            // the old bytes then would stack an uncommitted inverse of a real
+            // commit; the recovery flow owns that state, so it is left alone — and
+            // since the tree DID change, every cache keyed on the old identity is
+            // dropped before the error goes up, exactly as on success.
+            if (err instanceof PushNeedsAgentResolutionError) {
+                this.noteChanged(wsId);
+            }
+            else {
+                for (const w of writes) {
+                    if (w.before !== null)
+                        await this.workspaceService.writeFile(wsId, w.rel, w.before).catch(() => undefined);
+                }
+            }
+            throw err;
+        }
+        this.noteChanged(wsId);
+        // Exactly what was persisted, read back through the shared rule — the
+        // response and the file can never say two different things.
+        return {
+            name: nextName,
+            displayName: pluginDisplayNameOf(manifest),
+            rewritten: writes.slice(1).map((w) => w.rel.slice(this.kbDirName.length + 1)),
+        };
+    }
+}
+/**
+ * The tree changed: drop the resolver's model and the plugin caches, and
+ * tell every session. The ONE place this happens, for the landed commit and
+ * for the committed-but-unpushed one alike.
+ */
+function noteChangedFor(accessControl, events, onChanged, wsId) {
+    accessControl.invalidate(wsId);
+    events?.emit({ kind: 'fs-tree-changed', workspaceId: wsId, branch: linksWorkspaceIdBranch() });
+    onChanged?.();
+}
+/**
+ * Every access entry line naming `plugin/<old>/<verb>` — in ANY spelling the
+ * parser accepts — rewritten to `plugin/<next>/<verb>`, the rest of the
+ * line (indent, `- `, a `deny` prefix, the line ending) kept. Lines that are
+ * not such an entry are untouched, so the file's own formatting survives.
+ */
+export function renamePluginPrincipalInText(text, oldName, nextName) {
+    const oldSlug = pluginManifestName(oldName);
+    return text
+        .split('\n')
+        .map((line) => {
+        const m = /^(\s*-\s+(?:deny\s+)?)(\S.*?)(\s*)$/i.exec(line);
+        if (!m)
+            return line;
+        const key = canonicalPluginToken(m[2]);
+        const parsed = key === null ? null : parsePluginPrincipalKey(key);
+        if (!parsed || parsed.slug !== oldSlug)
+            return line;
+        return `${m[1]}${PLUGIN_TOKEN_PREFIX}${nextName}/${parsed.verb}${m[3]}`;
+    })
+        .join('\n');
+}
+function linksWorkspaceIdBranch() {
+    // The default branch's workspace id IS its encoded branch name.
+    return decodeURIComponent(linksWorkspaceId());
+}
+//# sourceMappingURL=plugin-rename.service.js.map

package/dist/modules/plugins/plugin-rename.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-rename.service.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-rename.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAG9E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG/B;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,UAAmC,EAAE;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAA8B;QAG9C,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IACA;IACA;IACA;IACA;IACA;IAGA;IAVnB,YACmB,gBAAkC,EAClC,OAA2B,EAC3B,aAA6B,EAC7B,MAAoB,EACpB,IAAiB,EACjB,SAAiB,EACjB,MAEhB,EACgB,SAAsB;QATtB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,YAAO,GAAP,OAAO,CAAoB;QAC3B,kBAAa,GAAb,aAAa,CAAgB;QAC7B,WAAM,GAAN,MAAM,CAAc;QACpB,SAAI,GAAJ,IAAI,CAAa;QACjB,cAAS,GAAT,SAAS,CAAQ;QACjB,WAAM,GAAN,MAAM,CAEtB;QACgB,cAAS,GAAT,SAAS,CAAa;IACtC,CAAC;IAEI,WAAW,CAAC,IAAY;QAC9B,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,sGAAsG;IAC9F,cAAc,CAAC,UAAoB;QACzC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,MAAM,IAAI,iBAAiB,CACzB,iDAAiD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,gGAAgG,EACtK,GAAG,EACH,EAAE,IAAI,EAAE,sBAAsB,EAAE,UAAU,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAc,EACd,OAAe,EACf,KAAgD;QAEhD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7F,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,aAAa,GAAiB;YAClC,MAAM,CAAC,GAAG,EAAE,IAAI;gBACd,IAAI,6BAA6B,CAAC,IAAI,CAAC;oBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1F,CAAC;SACF,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/C,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,CAAC;YACrD,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACtH,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;QAC9B,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;QACzF,8EAA8E;QAC9E,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,YAAY,CAAC,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,GAAG,MAAM,CAAC,IAAI,wEAAwE,EACtF,GAAG,EACH,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACpF,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,qCAAqC;QACrC,MAAM,iBAAiB,GAAG,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC;QACnD,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,iBAAiB;YAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACvD,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,qDAAqD;QACrD,IAAI,iBAAiB,IAAI,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,iBAAiB,CACzB,qGAAqG,EACrG,GAAG,EACH,EAAE,IAAI,EAAE,UAAU,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,iBAAiB,IAAI,QAAQ,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,iBAAiB,CACzB,QAAQ,sBAAsB,wEAAwE,EACtG,GAAG,EACH,EAAE,IAAI,EAAE,UAAU,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,sEAAsE;QACtE,yDAAyD;QACzD,IAAI,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,QAAQ,mBAAmB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,iBAAiB;QACjB,MAAM,aAAa,GACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QAErF,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,QAAQ,GAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACzF,QAAQ,CAAC,WAAW,GAAG,WAAW,IAAI,QAAQ,CAAC;QAC/C,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;QACjF,MAAM,MAAM,GAA2D;YACrE,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE;SAClG,CAAC;QAEF,IAAI,iBAAiB,EAAE,CAAC;YACtB,8DAA8D;YAC9D,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,6DAA6D;YAC7D,oCAAoC;YACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACnC,IAAI,MAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnB,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACzE,IAAI,KAAK,KAAK,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CACzB,YAAY,MAAM,CAAC,IAAI,kDAAkD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,EAC7H,GAAG,EACH,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,oDAAoD;QACpD,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACnF,MAAM,OAAO,GAAG,iBAAiB;gBAC/B,CAAC,CAAC,iBAAiB,MAAM,CAAC,IAAI,OAAO,QAAQ,EAAE;gBAC/C,CAAC,CAAC,iBAAiB,MAAM,CAAC,IAAI,gBAAgB,CAAC;YACjD,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAC9B,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CACzB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,sEAAsE;YACtE,2DAA2D;YAC3D,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;gBACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;oBACvB,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;wBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7G,CAAC;YACH,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvB,sEAAsE;QACtE,4DAA4D;QAC5D,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC;YAC1C,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;SAC9E,CAAC;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,aAA6B,EAC7B,MAAqC,EACrC,SAAmC,EACnC,IAAY;IAEZ,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;IAC/F,SAAS,EAAE,EAAE,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,OAAe,EAAE,QAAgB;IACzF,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,CAAC,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB;IAC7B,gEAAgE;IAChE,OAAO,kBAAkB,CAAC,gBAAgB,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/modules/plugins/plugins.contract.d.ts

@@ -32,6 +32,7 @@
  * via Manage access, which makes the CR moot). To agents these are plain
  * change requests; only the UI dresses them up.
  */
+export type { PluginMembership } from '../skills/skills.contract.js';
 /** Access-rule principals as the resolver hands them back. */
 export interface ResolvedPrincipals {
     roles: string[];
@@ -45,10 +46,26 @@ export interface ResolvedReaders extends ResolvedPrincipals {
 }
 /** One plugin as `GET /api/plugins` reports it, resolved for ONE caller. */
 export interface PluginSummary {
-    /** Plugin folder name, e.g. `GTM`. */
+    /** The plugin's identity — its manifest name, e.g. `gtm`. */
     name: string;
+    /** What a person sees it called, e.g. `GTM`. */
+    displayName: string;
     /** Repo-relative constituent folders, e.g. `['Plugins/GTM']`. */
     folders: string[];
+    /**
+     * Repo-relative roots the plugin LINKS — its manifest's linked-skill roots
+     * (`extensions["software.bevel.hexis"].skills`), or a bundle's
+     * `sourceSkillRoots`.
+     *
+     * Served because a plugin's page has to say which of its cards live
+     * somewhere else. A SKILL carries its own membership record (linked or
+     * inline); a TOOL carries none — a `.tool` sitting beside the skills under
+     * a linked root reaches the plugin exactly the way those skills do, and
+     * these roots are the only thing that says so.
+     */
+    linkedRoots: string[];
+    /** Whether this platform writes the plugin's links — see `PluginCatalogEntry`. */
+    linksAreManaged: boolean;
     /**
      * Per-caller: the caller can read the FOLDER (membership). Every returned
      * plugin has at least one of `canRead` / `canWrite` / discoverability; a
@@ -71,17 +88,43 @@ export interface PluginSummary {
     /** Caller-INDEPENDENT total (the plugin's whole content, not the caller's slice). */
     skillCount: number;
     toolCount: number;
+    /**
+     * Caller-INDEPENDENT: how many of the plugin's LINKED skills its members
+     * cannot read — the link is in the manifest, but the skill folder no
+     * longer grants the plugin's readers. Counted here, from the unfiltered
+     * link index, because the people who most need the warning are the
+     * plugin's managers, and they are exactly the people a missing grant
+     * locks out: a count derived from what the caller can read would be zero
+     * for them. Zero for a plugin whose links are not managed here.
+     */
+    brokenLinks: number;
     /** For display: "Run by …" (fallback chain: owners → writers → 'the workspace admins'). */
     owners: ResolvedPrincipals;
     writers: ResolvedPrincipals;
     readers: ResolvedReaders;
+    /** The plugin's access.md says of itself that it is private — see `PluginCatalogEntry.isPrivate`. */
+    isPrivate: boolean;
+    /** What discovery left out of this plugin and why — see `PluginCatalogEntry.warnings`. */
+    warnings: string[];
     /**
-     * The caller has an OPEN join change request for this plugin (their
-     * deterministic join branch has an open CR). Always false for a member.
+     * The caller has asked to join this plugin and the ask still stands: a
+     * recorded request that is pending, one whose change request is still
+     * open, or an open join change request on their deterministic join branch.
+     * The RECORD is what makes this true the moment the subscribe call is
+     * answered — the change request may still be seconds away. False again
+     * once that change request is declined or settled: the ask is over, and
+     * the person may make it again. Always false for a member.
      */
     hasRequested: boolean;
-    /** The open join CR's number when `hasRequested` (deep-links the UI). */
+    /** The join CR's number once it exists (deep-links the UI); null before that. */
     requestNumber: number | null;
+    /**
+     * Why the last recorded request could not be sent, in the words the git
+     * work used — set only when `hasRequested` is false because the record
+     * failed, which is when the page owes the person the button back and a
+     * reason. Null in every other case, including on a server without records.
+     */
+    requestFailure?: string | null;
 }
 /**
  * The caller-INDEPENDENT slice of a plugin — what `catalog()` computes once and
@@ -89,13 +132,44 @@ export interface PluginSummary {
  * appears at all) are resolved per request in the route.
  */
 export interface PluginCatalogEntry {
+    /** The plugin's identity — its manifest name. */
     name: string;
+    /** What a person sees it called — the manifest's `displayName`, else its `name`. */
+    displayName: string;
     folders: string[];
+    /** The roots it links skills from — see `PluginSummary.linkedRoots`. */
+    linkedRoots: string[];
+    /**
+     * Whether this platform writes the plugin's links (a native `plugin.json`)
+     * — false for a plugin read from an external format, whose links are
+     * edited in that repository and which the link endpoints refuse.
+     */
+    linksAreManaged: boolean;
     skillCount: number;
     toolCount: number;
+    /** Linked skills the members cannot read — see `PluginSummary.brokenLinks`. */
+    brokenLinks: number;
     owners: ResolvedPrincipals;
     writers: ResolvedPrincipals;
     readers: ResolvedReaders;
+    /**
+     * The folder's access.md FRONTMATTER denies `everyone` read and names
+     * nobody but people (`isPrivateAccessMd`) — the shape a personal space is
+     * seeded with, and what a person writes to keep a plugin to a few named
+     * colleagues. The Library marks such a plugin "Private". A statement the
+     * file makes about itself, not a verdict: `readers` says who can use it.
+     */
+    isPrivate: boolean;
+    /**
+     * What discovery left out of THIS plugin and why, in plain words: an MCP
+     * server its profile selects that the registry could not keep, a skill
+     * root that is not a folder, a profile that does not exist. Attributed by
+     * folder from the discovery warnings, with the folder prefix removed, so
+     * the plugin's page can list them for the people who can fix the files —
+     * the server log is not where a plugin's owner looks. Empty when nothing
+     * was left out.
+     */
+    warnings: string[];
 }
 export interface IPluginIndexService {
     /** Caller-independent catalog part (folders, counts, principals) — cached 60s. */

package/dist/modules/plugins/plugins.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAC;IACzB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,yEAAyE;IACzE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,OAAO,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,wFAAwF;IACxF,UAAU,IAAI,IAAI,CAAC;CACpB"}
+{"version":3,"file":"plugins.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kFAAkF;IAClF,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAC;IACzB,qGAAqG;IACrG,SAAS,EAAE,OAAO,CAAC;IACnB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,iFAAiF;IACjF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAC;IACzB;;;;;;OAMG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;OAQG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,OAAO,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzC,wFAAwF;IACxF,UAAU,IAAI,IAAI,CAAC;CACpB"}

package/dist/modules/plugins/plugins.routes.d.ts

@@ -2,16 +2,18 @@ import express from 'express';
 import '../auth/auth.middleware.js';
 import { type AuthUser, type IWorkflowService } from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../access/access-control.interface.js';
-import type { WorkspaceService } from '../workspace/workspace.service.js';
 import { type PluginProvisionService } from './plugin-provision.service.js';
+import { type PluginLinksService } from './plugin-links.service.js';
+import { type PluginRenameService } from './plugin-rename.service.js';
 import type { JoinRequestsService } from './join-requests.service.js';
+import type { PluginJoinRequestJobs } from './join-request-jobs.service.js';
 import type { IPluginIndexService } from './plugins.contract.js';
 /**
  * Browser-facing (JWT) plugin routes, mounted behind `authMiddleware`:
  *
  *   GET    /api/plugins                            → { plugins: PluginSummary[] }
  *   DELETE /api/plugins/:name                      → { ok }          (owners)
- *   POST   /api/plugins/:name/join-request         → { ok, number }  (opens a CR)
+ *   POST   /api/plugins/:name/join-request         → { ok, state, number }  (records it)
  *   GET    /api/plugins/:name/join-requests        → { requests }    (managers)
  *   POST   /api/plugins/:name/join-requests/:n/reconcile → { closed }
  *
@@ -25,8 +27,12 @@ import type { IPluginIndexService } from './plugins.contract.js';
  *
  * All three false ⇒ the plugin is absent from the response entirely.
  *
- * A join request is a plain change request whose branch edits the plugin's
- * `access.md`. Managers do NOT merge it: they read its individual proposals
+ * A join request is a recorded row plus the change request the row's
+ * background job opens — a branch that edits the plugin's `access.md`. The
+ * row exists so the click can be answered before any git runs; what managers
+ * see is the change request, unchanged.
+ *
+ * Managers do NOT merge it: they read its individual proposals
  * (see `join-proposals.ts`), grant the ones they accept through the ordinary
  * access path, and the request retires itself once its rules are a subset of
  * the default branch's — reconciled here, lazily on listing and eagerly right
@@ -38,5 +44,38 @@ import type { IPluginIndexService } from './plugins.contract.js';
  * middleware change can never silently un-gate one. Nothing here is reachable
  * with an agent connection key or a manual-auth bearer.
  */
-export declare function createPluginsRoutes(pluginIndex: IPluginIndexService, accessControl: IAccessControl, workflow: IWorkflowService, workspaceService: WorkspaceService, joinRequests: JoinRequestsService, provision: PluginProvisionService, kbDirName: string, resolveUser: (req: express.Request) => Promise<AuthUser | null>): express.Router;
+/**
+ * The two doors through which plugin folders come to exist — ONE
+ * implementation each, for the app and for agents alike:
+ *
+ *  - `POST /plugins` `{ name, parent? }` — a shared plugin. Any authenticated
+ *    user may create one; that is the product model (making a plugin makes
+ *    you the one who runs it), and the seeded access.md immediately fences
+ *    the new folder off from everyone else. `parent` is a grouping folder
+ *    below the plugins root to make it in. See `PluginProvisionService` for
+ *    why this is an endpoint and not a write path.
+ *  - `POST /plugins/personal` — the caller's own space, ensured (idempotent).
+ *    The UI calls it lazily before the first personal-skill write; an agent
+ *    calls it to learn where to put a person's skills.
+ *
+ * Mounted apart from the other plugin routes, behind a gate that admits an
+ * agent's connection key as well as a session (see `keyOrSessionAuth`):
+ * the `create_plugin` and `my_plugin` tools are UTCP descriptions of these
+ * very endpoints, not a second set. `resolveUser` reads the identity either
+ * gate established.
+ */
+export declare function createPluginCreationRoutes(provision: Pick<PluginProvisionService, 'createPlugin' | 'ensurePersonalPlugin'>, resolveUser: (req: express.Request) => Promise<AuthUser | null>): express.Router;
+export declare function createPluginsRoutes(pluginIndex: IPluginIndexService, accessControl: IAccessControl, workflow: IWorkflowService, joinRequests: JoinRequestsService, 
+/**
+ * Where a join request is RECORDED, and what finishes it afterwards. The
+ * subscribe endpoint writes the row and answers; the git work runs against
+ * it after the answer (see `PluginJoinRequestJobs`) — which is why this
+ * router no longer takes a workspace service or the KB directory name at
+ * all, having no file of its own left to write.
+ */
+joinRequestJobs: PluginJoinRequestJobs, provision: PluginProvisionService, resolveUser: (req: express.Request) => Promise<AuthUser | null>, 
+/** Optional: a host without the link machinery simply has no link routes. */
+links?: PluginLinksService, 
+/** Optional: a host without it has no rename route. */
+rename?: PluginRenameService): express.Router;
 //# sourceMappingURL=plugins.routes.d.ts.map

package/dist/modules/plugins/plugins.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,4BAA4B,CAAC;AACpC,OAAO,EAGL,KAAK,QAAQ,EAEb,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAG5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,EAAwB,KAAK,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAClG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAGV,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,mBAAmB,EAChC,aAAa,EAAE,cAAc,EAC7B,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,gBAAgB,EAClC,YAAY,EAAE,mBAAmB,EACjC,SAAS,EAAE,sBAAsB,EACjC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAC9D,OAAO,CAAC,MAAM,CAiXhB"}
+{"version":3,"file":"plugins.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,QAAQ,EAGb,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAI5E,OAAO,EAAwB,KAAK,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAClG,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE5E,OAAO,KAAK,EAGV,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,GAAG,sBAAsB,CAAC,EAChF,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAC9D,OAAO,CAAC,MAAM,CAyDhB;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,mBAAmB,EAChC,aAAa,EAAE,cAAc,EAC7B,QAAQ,EAAE,gBAAgB,EAC1B,YAAY,EAAE,mBAAmB;AACjC;;;;;;GAMG;AACH,eAAe,EAAE,qBAAqB,EACtC,SAAS,EAAE,sBAAsB,EACjC,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC/D,6EAA6E;AAC7E,KAAK,CAAC,EAAE,kBAAkB;AAC1B,uDAAuD;AACvD,MAAM,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAgdhB"}