@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/dist/modules/plugins/plugins.service.js

@@ -1,8 +1,12 @@
+import fs from 'node:fs/promises';
+import { logger } from '../../shared/logging.js';
+const log = logger('plugins');
 import path from 'node:path';
 import { DEFAULT_BRANCH, } from '@bevel-software/platform-shared';
+import { isPrivateAccessMd } from '../access-model/access-grammar.js';
+import { isAbsence } from '../../shared/fs.contract.js';
 import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import { TtlCache } from '../../shared/ttl-cache.js';
-import { KbPluginSource } from './discovery/kb-plugin-source.js';
 const CACHE_TTL_MS = 60_000;
 /**
  * The plugin index: every plugin folder in the default-branch KB, with its
@@ -35,25 +39,25 @@ export class PluginIndexService {
     skillService;
     toolManualService;
     kbDirName;
-    links;
     source;
+    links;
     cache;
-    constructor(workspaceService, accessControl, skillService, toolManualService, kbDirName, now = Date.now, 
+    constructor(workspaceService, accessControl, skillService, toolManualService, kbDirName, 
+    /** Where plugins come from — the one discovery every catalog shares. */
+    source, now = Date.now, 
     /**
      * The link index, when the deployment has one: a plugin's skill count is
      * then inline PLUS linked. Optional so hosts composing their own service
      * set (and older tests) keep the inline-only count.
      */
-    links, 
-    /** Where plugins come from — native manifests unless a dialect is configured. */
-    source = new KbPluginSource()) {
+    links) {
         this.workspaceService = workspaceService;
         this.accessControl = accessControl;
         this.skillService = skillService;
         this.toolManualService = toolManualService;
         this.kbDirName = kbDirName;
-        this.links = links;
         this.source = source;
+        this.links = links;
         this.cache = new TtlCache(CACHE_TTL_MS, now);
     }
     invalidate() {
@@ -101,21 +105,23 @@ export class PluginIndexService {
             const folders = new Map([...scanned].map(([name, p]) => [name, p.folders]));
             const [{ skillCounts, brokenLinkCounts }, toolCounts] = await Promise.all([
                 this.countThroughLinks(folders),
-                this.countTools(folders),
+                this.countTools(scanned),
             ]);
             const entries = [];
             for (const [name, pluginFolders] of folders) {
                 // One folder, one access boundary — the folder IS the plugin.
                 const [primary] = pluginFolders;
-                const [owners, writers, readers] = await Promise.all([
+                const [owners, writers, readers, isPrivate] = await Promise.all([
                     this.accessControl.eligibleOwners(wsId, primary),
                     this.accessControl.eligibleWriters(wsId, primary),
                     this.accessControl.eligibleReaders(wsId, primary),
+                    this.readsAsPrivate(path.join(kbRoot, primary, 'access.md')),
                 ]);
                 entries.push({
                     name,
                     displayName: scanned.get(name)?.displayName ?? name,
                     folders: pluginFolders,
+                    linkedRoots: scanned.get(name)?.linkedRoots ?? [],
                     linksAreManaged: scanned.get(name)?.linksAreManaged ?? false,
                     skillCount: skillCounts.get(name) ?? 0,
                     toolCount: toolCounts.get(name) ?? 0,
@@ -123,12 +129,14 @@ export class PluginIndexService {
                     owners,
                     writers,
                     readers,
+                    isPrivate,
+                    warnings: scanned.get(name)?.warnings ?? [],
                 });
             }
             return entries.sort((a, b) => a.name.localeCompare(b.name));
         }
         catch (err) {
-            console.warn(`[plugins] plugin index unavailable: ${err instanceof Error ? err.message : String(err)}`);
+            log.warn(`plugin index unavailable: ${err instanceof Error ? err.message : String(err)}`);
             return null;
         }
     }
@@ -144,14 +152,22 @@ export class PluginIndexService {
         const byName = new Map();
         const discovered = await this.source.discover(kbRoot);
         for (const w of discovered.warnings)
-            console.warn(`[plugins] ${w}`);
+            log.warn(w);
         for (const plugin of discovered.plugins) {
             if (plugin.personal || !plugin.exists)
                 continue;
             byName.set(plugin.name, {
                 folders: [plugin.folder],
+                linkedRoots: plugin.linkedRoots,
                 linksAreManaged: plugin.linksAreManaged,
                 displayName: plugin.displayName,
+                // Discovery prefixes what it says about one plugin with that
+                // plugin's folder; the page names the plugin already, so the
+                // prefix goes. Whatever names no folder (an unreadable registry)
+                // stays in the log alone.
+                warnings: discovered.warnings
+                    .filter((w) => w.startsWith(`${plugin.folder}: `) || w.startsWith(`${plugin.folder}/`))
+                    .map((w) => w.slice(plugin.folder.length).replace(/^[:/]\s*/, '')),
             });
         }
         return byName;
@@ -197,18 +213,59 @@ export class PluginIndexService {
      * prefix against the discovered folders, not by `pluginOfPath`'s
      * second-segment rule, so a dialect plugin nested three folders deep still
      * counts the servers its bundle expands.
+     *
+     * And to every plugin one of whose LINKED ROOTS holds them. A root is a
+     * skill folder or a folder of skills, and a `.tool` manual sitting beside
+     * those skills reaches the plugin the same way they do — the plugin's page
+     * lists it, so the plugin's total has to count it. Once per plugin: a root
+     * inside the plugin's own folder says nothing the folder did not say first.
+     *
+     * Without a link index, inline only — the same degradation `countThroughLinks`
+     * makes for skills. A host that composes no link index has asked for totals
+     * that count what each plugin's folder holds, and a catalog that counted a
+     * plugin's linked tools while leaving its linked skills out would describe a
+     * plugin that exists nowhere.
      */
-    async countTools(folders) {
+    async countTools(scanned) {
         const counts = new Map();
-        const byFolder = [...folders.entries()].map(([name, [folder]]) => ({ name, prefix: `${folder}/` }));
+        const plugins = [...scanned].map(([name, p]) => ({
+            name,
+            folders: p.folders,
+            roots: this.links ? p.linkedRoots : [],
+        }));
+        const bump = (name) => counts.set(name, (counts.get(name) ?? 0) + 1);
         for (const tool of await this.toolManualService.listAllSummaries()) {
-            const owner = byFolder.find((f) => tool.path.startsWith(f.prefix));
-            if (!owner)
-                continue;
-            counts.set(owner.name, (counts.get(owner.name) ?? 0) + 1);
+            const inline = plugins.find((p) => p.folders.some((f) => tool.path.startsWith(`${f}/`)));
+            if (inline)
+                bump(inline.name);
+            for (const p of plugins) {
+                if (p === inline)
+                    continue;
+                if (p.roots.some((root) => tool.path.startsWith(`${root}/`)))
+                    bump(p.name);
+            }
         }
         return counts;
     }
+    /**
+     * What the plugin's own access.md says of itself — see
+     * `PluginCatalogEntry.isPrivate`. Read from disk rather than through the
+     * resolver: the mark reflects the file's frontmatter as written. An
+     * ABSENT file makes no statement (false: a plugin discovered by its
+     * manifest may have no rules yet); any other failure to read it is a real
+     * one and propagates, so the catalog never claims a privacy verdict it
+     * could not inspect — `build` degrades the whole read, as for any fault.
+     */
+    async readsAsPrivate(accessMdPath) {
+        try {
+            return isPrivateAccessMd(await fs.readFile(accessMdPath, 'utf8'));
+        }
+        catch (err) {
+            if (isAbsence(err))
+                return false;
+            throw err;
+        }
+    }
 }
 /**
  * Count items per plugin by FOLDER PREFIX against the discovered folders —
@@ -230,4 +287,16 @@ function bucketByFolder(items, folders) {
 export function pluginsWorkspaceId() {
     return workspaceIdForBranch(DEFAULT_BRANCH);
 }
+/**
+ * A plugin folder's path BELOW the plugins root: `GTM`, or `teams/deep`.
+ *
+ * The key a join request is cut by — its branch, and the row that records it
+ * — so it lives here rather than in any one of the three places that need to
+ * compute it. The whole path, not the basename, so two plugins whose folders
+ * share a basename can never share a branch; and it survives a rename of the
+ * plugin's identity, which moves no folder.
+ */
+export function pluginFolderBelowRoot(folder) {
+    return folder.slice(folder.indexOf('/') + 1);
+}
 //# sourceMappingURL=plugins.service.js.map

package/dist/modules/plugins/plugins.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.service.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.service.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,cAAc,GACf,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIpE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAIrD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,kBAAkB;IAIV;IACA;IACA;IACA;IACA;IAOA;IAEA;IAhBF,KAAK,CAAiC;IAEvD,YACmB,gBAAkC,EAClC,aAA6B,EAC7B,YAA2B,EAC3B,iBAAqC,EACrC,SAAiB,EAClC,MAAoB,IAAI,CAAC,GAAG;IAC5B;;;;OAIG;IACc,KAAuB;IACxC,iFAAiF;IAChE,SAAuB,IAAI,cAAc,EAAE;QAb3C,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,iBAAY,GAAZ,YAAY,CAAe;QAC3B,sBAAiB,GAAjB,iBAAiB,CAAoB;QACrC,cAAS,GAAT,SAAS,CAAQ;QAOjB,UAAK,GAAL,KAAK,CAAkB;QAEvB,WAAM,GAAN,MAAM,CAAqC;QAE5D,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,mEAAmE;QACnE,2EAA2E;QAC3E,yEAAyE;QACzE,+BAA+B;QAC/B,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAE7E;;;;;;;;;;MAUE;IACK,KAAK,CAAC,KAAK;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAE7F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAE5E,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;gBAC/B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;aACzB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAyB,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC5C,8DAA8D;gBAC9D,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC;gBAChC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACnD,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;oBAChD,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;oBACjD,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;iBAClD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,IAAI;oBACnD,OAAO,EAAE,aAAa;oBACtB,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,eAAe,IAAI,KAAK;oBAC5D,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtC,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBACpC,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC5C,MAAM;oBACN,OAAO;oBACP,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CACvB,MAAc;QAEd,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgF,CAAC;QACvG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACpE,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,SAAS;YAChD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;gBACtB,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;gBACxB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,iBAAiB,CAC7B,OAA8B;QAE9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,uEAAuE;YACvE,gDAAgD;YAChD,OAAO;gBACL,WAAW,EAAE,cAAc,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;gBACnF,gBAAgB;aACjB,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO;oBAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CAAC,OAA8B;QACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;QACpG,KAAK,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAyB,EAAE,OAA8B;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACpG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,OAAO,oBAAoB,CAAC,cAAc,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"plugins.service.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,cAAc,GACf,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIpE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAKrD,MAAM,YAAY,GAAG,MAAM,CAAC;AAY5B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,kBAAkB;IAIV;IACA;IACA;IACA;IACA;IAEA;IAOA;IAhBF,KAAK,CAAiC;IAEvD,YACmB,gBAAkC,EAClC,aAA6B,EAC7B,YAA2B,EAC3B,iBAAqC,EACrC,SAAiB;IAClC,wEAAwE;IACvD,MAAoB,EACrC,MAAoB,IAAI,CAAC,GAAG;IAC5B;;;;OAIG;IACc,KAAuB;QAbvB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,iBAAY,GAAZ,YAAY,CAAe;QAC3B,sBAAiB,GAAjB,iBAAiB,CAAoB;QACrC,cAAS,GAAT,SAAS,CAAQ;QAEjB,WAAM,GAAN,MAAM,CAAc;QAOpB,UAAK,GAAL,KAAK,CAAkB;QAExC,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,mEAAmE;QACnE,2EAA2E;QAC3E,yEAAyE;QACzE,+BAA+B;QAC/B,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAE7E;;;;;;;;;;MAUE;IACK,KAAK,CAAC,KAAK;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAE7F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAE5E,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;gBAC/B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;aACzB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAyB,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC5C,8DAA8D;gBAC9D,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC;gBAChC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC9D,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;oBAChD,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;oBACjD,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;oBACjD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;iBAC7D,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,IAAI;oBACnD,OAAO,EAAE,aAAa;oBACtB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE;oBACjD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,eAAe,IAAI,KAAK;oBAC5D,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtC,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBACpC,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC5C,MAAM;oBACN,OAAO;oBACP,OAAO;oBACP,SAAS;oBACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,IAAI,EAAE;iBAC5C,CAAC,CAAC;YACL,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CAAC,MAAc;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,SAAS;YAChD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;gBACtB,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;gBACxB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,6DAA6D;gBAC7D,6DAA6D;gBAC7D,iEAAiE;gBACjE,0BAA0B;gBAC1B,QAAQ,EAAE,UAAU,CAAC,QAAQ;qBAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;qBACtF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,iBAAiB,CAC7B,OAA8B;QAE9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,uEAAuE;YACvE,gDAAgD;YAChD,OAAO;gBACL,WAAW,EAAE,cAAc,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;gBACnF,gBAAgB;aACjB,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO;oBAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,UAAU,CAAC,OAAmC;QAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI;YACJ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;SACvC,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzF,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,MAAM;oBAAE,SAAS;gBAC3B,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;oBAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,cAAc,CAAC,YAAoB;QAC/C,IAAI,CAAC;YACH,OAAO,iBAAiB,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAyB,EAAE,OAA8B;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACpG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,OAAO,oBAAoB,CAAC,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/modules/plugins/plugins.tools.d.ts

@@ -0,0 +1,25 @@
+import type { IToolRegistry, UtcpTool } from '../tool-registry/tool.contract.js';
+/**
+ * The two plugin tools an agent has, both surfaces — DESCRIPTIONS of the
+ * app's own creation endpoints, not a second implementation of them:
+ *
+ *  - `my_plugin`     → `POST /api/plugins/personal`
+ *  - `create_plugin` → `POST /api/plugins`
+ *
+ * The endpoints are the same ones the New plugin button and the first-visit
+ * personal-folder ensure call; they sit behind a gate that admits an agent's
+ * connection key as well as a session (`keyOrSessionAuth`), so one route
+ * serves both. Without these an agent asked to "put my skills in Hexis" had
+ * nowhere to write: the personal folder is created lazily by the web app
+ * under a name derived from the user's id, and a non-admin's plain write
+ * under the plugins root is refused by the root rules.
+ *
+ * Every rule the app enforces — names, reserved prefixes, twins, where a
+ * plugin may go, the one commit — is the endpoint's, so it holds for an
+ * agent exactly as for a person; a refusal comes back as the endpoint's own
+ * 4xx with its message.
+ */
+export declare function registerPluginsTools(registry: IToolRegistry): void;
+export declare const MY_PLUGIN: UtcpTool;
+export declare const CREATE_PLUGIN: UtcpTool;
+//# sourceMappingURL=plugins.tools.d.ts.map

package/dist/modules/plugins/plugins.tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.tools.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAGjF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAKlE;AAeD,eAAO,MAAM,SAAS,EAAE,QActB,CAAC;AAEH,eAAO,MAAM,aAAa,EAAE,QA4B1B,CAAC"}

package/dist/modules/plugins/plugins.tools.js

@@ -0,0 +1,82 @@
+import { toolDef } from '../tool-helpers/tool-def.js';
+/**
+ * The two plugin tools an agent has, both surfaces — DESCRIPTIONS of the
+ * app's own creation endpoints, not a second implementation of them:
+ *
+ *  - `my_plugin`     → `POST /api/plugins/personal`
+ *  - `create_plugin` → `POST /api/plugins`
+ *
+ * The endpoints are the same ones the New plugin button and the first-visit
+ * personal-folder ensure call; they sit behind a gate that admits an agent's
+ * connection key as well as a session (`keyOrSessionAuth`), so one route
+ * serves both. Without these an agent asked to "put my skills in Hexis" had
+ * nowhere to write: the personal folder is created lazily by the web app
+ * under a name derived from the user's id, and a non-admin's plain write
+ * under the plugins root is refused by the root rules.
+ *
+ * Every rule the app enforces — names, reserved prefixes, twins, where a
+ * plugin may go, the one commit — is the endpoint's, so it holds for an
+ * agent exactly as for a person; a refusal comes back as the endpoint's own
+ * 4xx with its message.
+ */
+export function registerPluginsTools(registry) {
+    registry.registerExternalTool(MY_PLUGIN);
+    registry.registerInternalTool(MY_PLUGIN);
+    registry.registerExternalTool(CREATE_PLUGIN);
+    registry.registerInternalTool(CREATE_PLUGIN);
+}
+/** The endpoint's answer, `ProvisionedPlugin` — see `PluginProvisionService`. */
+const PROVISIONED_OUTPUT = {
+    type: 'object',
+    properties: {
+        path: { type: 'string', description: 'The plugin folder, repo-relative (e.g. `Plugins/personal-abc`, `Plugins/Teams/GTM`) — the path the file tools address.' },
+        skillsDir: { type: 'string', description: 'Where its skills go: `<path>/skills`. Each skill is a subfolder holding a `SKILL.md`.' },
+        folder: { type: 'string', description: 'The same folder as its path below the plugins root.' },
+        name: { type: 'string', description: 'The plugin identity (its manifest name), as grants and the marketplace spell it.' },
+        displayName: { type: 'string', description: 'What people see it called — the manifest `displayName`, exactly as persisted: for `create_plugin`, the name that was asked for, trimmed; for `my_plugin`, the personal folder\'s own label.' },
+        created: { type: 'boolean', description: 'False when the folder already existed.' },
+    },
+};
+export const MY_PLUGIN = toolDef({
+    name: 'my_plugin',
+    description: "The caller's own private plugin — their personal space in the knowledge base, created on first use. " +
+        'Returns its folder and where skills go inside it (`skillsDir`); write a skill there as ' +
+        '`<skillsDir>/<skill-name>/SKILL.md` with the file tools, opening with the Agent Skills frontmatter ' +
+        '(`name`, `description`, and `metadata.version` such as `"1.0.0"`). Readable only by its owner — not even admins — and ' +
+        'never listed as a shared plugin. Idempotent: calling it again returns the same folder.',
+    path: '/api/plugins/personal',
+    inputs: { type: 'object', properties: {}, additionalProperties: false },
+    outputs: PROVISIONED_OUTPUT,
+    // `write`: both make folders and commit — a read-scoped caller's manual
+    // must not advertise them (see `isWriteTool` in the manual routes).
+    tags: ['plugins', 'skills', 'write'],
+});
+export const CREATE_PLUGIN = toolDef({
+    name: 'create_plugin',
+    description: "Create a shared plugin under the plugins root, exactly as the app's New plugin button does: the caller " +
+        'runs it (read, write and owner), and it is discoverable by everyone so people can ask to join. Pass ' +
+        '`parent` to make it inside an existing grouping folder under the plugins root (e.g. `Teams`); a plugin ' +
+        'cannot be made inside another plugin. Returns the folder and where its skills go. A refusal carries ' +
+        '`error` in words. 4xx means the input will not do: 409 when a plugin of that name (or its identifier) ' +
+        'exists, 422 for a name the knowledge base cannot carry or a parent that may not hold a plugin, 404 when ' +
+        'the parent folder is not there. 503 means the plugin list could not be read completely just now — ' +
+        'nothing is wrong with the input; try again shortly.',
+    path: '/api/plugins',
+    inputs: {
+        type: 'object',
+        properties: {
+            name: { type: 'string', minLength: 1, description: 'The plugin name, e.g. `Design`. Becomes the folder name and the display name people see; its identifier is the kebab-case slug.' },
+            parent: {
+                type: 'string',
+                description: 'Optional grouping folder below the plugins root to create it in, e.g. `Teams` or `Teams/EU`. Omit for the root.',
+            },
+        },
+        required: ['name'],
+        additionalProperties: false,
+    },
+    outputs: PROVISIONED_OUTPUT,
+    // `write`: both make folders and commit — a read-scoped caller's manual
+    // must not advertise them (see `isWriteTool` in the manual routes).
+    tags: ['plugins', 'skills', 'write'],
+});
+//# sourceMappingURL=plugins.tools.js.map

package/dist/modules/plugins/plugins.tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.tools.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAuB;IAC1D,QAAQ,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC7C,QAAQ,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,iFAAiF;AACjF,MAAM,kBAAkB,GAAG;IACzB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wHAAwH,EAAE;QAC/J,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uFAAuF,EAAE;QACnI,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC9F,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kFAAkF,EAAE;QACzH,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6LAA6L,EAAE;QAC3O,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,wCAAwC,EAAE;KACpF;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAa,OAAO,CAAC;IACzC,IAAI,EAAE,WAAW;IACjB,WAAW,EACT,sGAAsG;QACtG,yFAAyF;QACzF,qGAAqG;QACrG,wHAAwH;QACxH,wFAAwF;IAC1F,IAAI,EAAE,uBAAuB;IAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;IACvE,OAAO,EAAE,kBAAkB;IAC3B,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAa,OAAO,CAAC;IAC7C,IAAI,EAAE,eAAe;IACrB,WAAW,EACT,yGAAyG;QACzG,sGAAsG;QACtG,yGAAyG;QACzG,sGAAsG;QACtG,wGAAwG;QACxG,0GAA0G;QAC1G,oGAAoG;QACpG,qDAAqD;IACvD,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,iIAAiI,EAAE;YACtL,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,iHAAiH;aAC/H;SACF;QACD,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,oBAAoB,EAAE,KAAK;KAC5B;IACD,OAAO,EAAE,kBAAkB;IAC3B,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;CACrC,CAAC,CAAC"}

package/dist/modules/plugins/teams.routes.d.ts

@@ -0,0 +1,42 @@
+import express from 'express';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import type { ISkillService } from '../skills/skills.contract.js';
+import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';
+import type { IPluginIndexService } from './plugins.contract.js';
+/**
+ * What one team can use, by id — the Library's "Your teams" lens.
+ *
+ * A team is a group from the active group source (`groups.yaml`, or the
+ * IdP-synced file), and what it can use is what being IN it lets a person
+ * read: the plugins whose rules admit the group, the skills those plugins
+ * link or hold, a shared skill whose own folder names the group, the tools
+ * declared in an admitted plugin. The verdict is the resolver's own
+ * (`canReadAsGroupBatch`), so a grant reached through a role that lists the
+ * group, or through `plugin/<name>/read` on a skill the group's plugin links,
+ * counts exactly as it does for a member.
+ *
+ * Every id is ALSO gated on the caller: a skill or tool the caller cannot
+ * read is not named here, however the team stands, and a plugin appears only
+ * when the caller could see it on the index (a member, or able to discover
+ * it). The lens never widens what the catalog already shows the caller — it
+ * slices it.
+ *
+ * The list opens with `Everyone`: not a group, the built-in org-wide
+ * principal — what a signed-in person in no group at all can use, which is
+ * what `read: everyone` (or a public plugin) reaches. Same slice, same
+ * caller gate, asked of the resolver as `canReadAsEveryoneBatch`. The name
+ * cannot collide with a group's: `everyone` is reserved by the grammar.
+ */
+export interface TeamAccess {
+    name: string;
+    /** Plugin identities (manifest names) the team's members can read. */
+    plugins: string[];
+    /** Skill names. */
+    skills: string[];
+    /** Tool slugs. */
+    tools: string[];
+}
+/** The org-wide entry's name — the built-in `everyone` principal, as the sidebar spells it. */
+export declare const EVERYONE_TEAM = "Everyone";
+export declare function createTeamsRoutes(accessControl: IAccessControl, pluginIndex: IPluginIndexService, skillService: Pick<ISkillService, 'listSkills'>, toolManuals: Pick<IToolManualService, 'listAllSummaries'>): express.Router;
+//# sourceMappingURL=teams.routes.d.ts.map

package/dist/modules/plugins/teams.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/teams.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAK9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,uBAAuB,CAAC;AAGrF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mBAAmB;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kBAAkB;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,+FAA+F;AAC/F,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,cAAc,EAC7B,WAAW,EAAE,mBAAmB,EAChC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAC/C,WAAW,EAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GACxD,OAAO,CAAC,MAAM,CAmEhB"}

package/dist/modules/plugins/teams.routes.js

@@ -0,0 +1,79 @@
+import express from 'express';
+import { logger } from '../../shared/logging.js';
+const log = logger('teams');
+import { isPersonalPluginDir, isPersonalPluginFolder, pluginOfPath } from '@bevel-software/platform-shared';
+import { pluginsWorkspaceId } from './plugins.service.js';
+/** The org-wide entry's name — the built-in `everyone` principal, as the sidebar spells it. */
+export const EVERYONE_TEAM = 'Everyone';
+export function createTeamsRoutes(accessControl, pluginIndex, skillService, toolManuals) {
+    const router = express.Router();
+    router.get('/teams', async (req, res) => {
+        const email = req.userEmail;
+        if (!email) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return;
+        }
+        try {
+            const wsId = pluginsWorkspaceId();
+            const [{ groups }, catalog, allSkills, allTools] = await Promise.all([
+                accessControl.kbPrincipals(wsId),
+                pluginIndex.catalog(),
+                skillService.listSkills(),
+                toolManuals.listAllSummaries(),
+            ]);
+            // A personal plugin is one person's space, not a team's: it has no
+            // roster and admits nobody, so neither it nor anything inside it can
+            // be a team's to read — whatever a hand-written grant in there says.
+            // One rule for the plugin and for its contents, so the two cannot
+            // disagree.
+            const plugins = catalog.filter((g) => !g.folders.every(isPersonalPluginDir));
+            const skills = allSkills.filter((s) => !inPersonalPlugin(s.path));
+            const tools = allTools.filter((t) => !inPersonalPlugin(t.path));
+            const folderProbes = plugins.flatMap((g) => g.folders);
+            const discoverProbes = folderProbes.map(accessMdOf);
+            const skillProbes = skills.map((s) => skillMdOf(s.path));
+            const toolProbes = tools.map((t) => t.path);
+            const probes = [...new Set([...folderProbes, ...discoverProbes, ...skillProbes, ...toolProbes])];
+            const caller = await accessControl.canReadBatch(wsId, email, probes);
+            const callerReads = (p) => caller.get(p) === true;
+            const callerSeesPlugin = (g) => g.folders.some((f) => callerReads(f) || callerReads(accessMdOf(f)));
+            /** One entry: what `verdicts` reads, cut to what the caller sees. */
+            const slice = (name, verdicts) => {
+                const reads = (p) => verdicts.get(p) === true;
+                return {
+                    name,
+                    plugins: plugins
+                        .filter((g) => g.folders.some(reads) && callerSeesPlugin(g))
+                        .map((g) => g.name),
+                    skills: skills
+                        .filter((s) => reads(skillMdOf(s.path)) && callerReads(skillMdOf(s.path)))
+                        .map((s) => s.name),
+                    tools: tools.filter((t) => reads(t.path) && callerReads(t.path)).map((t) => t.slug),
+                };
+            };
+            const teams = [
+                slice(EVERYONE_TEAM, await accessControl.canReadAsEveryoneBatch(wsId, probes)),
+            ];
+            for (const name of groups) {
+                const team = await accessControl.canReadAsGroupBatch(wsId, name, probes);
+                if (team === null)
+                    continue; // gone between the two reads — nothing to say
+                teams.push(slice(name, team));
+            }
+            res.json({ teams });
+        }
+        catch (err) {
+            log.error('failed to list teams:', { err });
+            res.status(500).json({ error: 'Failed to list teams' });
+        }
+    });
+    return router;
+}
+const accessMdOf = (folder) => `${folder}/access.md`;
+const skillMdOf = (skillPath) => `${skillPath}/SKILL.md`;
+/** Under `Plugins/personal-<id>/…` — one person's space, whatever it grants. */
+const inPersonalPlugin = (repoPath) => {
+    const folder = pluginOfPath(repoPath);
+    return folder !== null && isPersonalPluginFolder(folder);
+};
+//# sourceMappingURL=teams.routes.js.map

package/dist/modules/plugins/teams.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.routes.js","sourceRoot":"","sources":["../../../src/modules/plugins/teams.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAK5G,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAoC1D,+FAA+F;AAC/F,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC,MAAM,UAAU,iBAAiB,CAC/B,aAA6B,EAC7B,WAAgC,EAChC,YAA+C,EAC/C,WAAyD;IAEzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAClC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACnE,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC;gBAChC,WAAW,CAAC,OAAO,EAAE;gBACrB,YAAY,CAAC,UAAU,EAAE;gBACzB,WAAW,CAAC,gBAAgB,EAAE;aAC/B,CAAC,CAAC;YACH,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,kEAAkE;YAClE,YAAY;YACZ,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAEjG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAC1D,MAAM,gBAAgB,GAAG,CAAC,CAAqB,EAAE,EAAE,CACjD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtE,qEAAqE;YACrE,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,QAA8B,EAAc,EAAE;gBACzE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;gBACtD,OAAO;oBACL,IAAI;oBACJ,OAAO,EAAE,OAAO;yBACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC;yBAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;oBACrB,MAAM,EAAE,MAAM;yBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;yBACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBACpF,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,KAAK,GAAiB;gBAC1B,KAAK,CAAC,aAAa,EAAE,MAAM,aAAa,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;aAC/E,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACzE,IAAI,IAAI,KAAK,IAAI;oBAAE,SAAS,CAAC,8CAA8C;gBAC3E,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAChC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,YAAY,CAAC;AAC7D,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,GAAG,SAAS,WAAW,CAAC;AACjE,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,EAAE;IAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,MAAM,KAAK,IAAI,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC,CAAC"}

package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts

@@ -1,5 +1,5 @@
 import type { Database } from '../database/connection.js';
-import { type ISecretsVaultService, type SecretSummary, type SecretConfigStatus, type PutStaticSecretInput, type PutSharedStaticSecretInput, type CreateOAuthSecretInput, type OAuthProviderConfig, type VariableScopeResolver } from './secrets-vault.contract.js';
+import { type ISecretsVaultService, type SecretSummary, type SecretConfigStatus, type PutStaticSecretInput, type PutSharedStaticSecretInput, type CreateOAuthSecretInput, type OAuthProviderConfig, type VariableScopeResolver, type NamespaceSecretCount, type ForcedRefreshOutcome } from './secrets-vault.contract.js';
 /**
  * Postgres-backed `ISecretsVaultService`. Secret material is encrypted at rest
  * with `TokenCrypto` (AES-256-GCM); a DB leak alone yields only ciphertext. Per-
@@ -48,6 +48,20 @@ export declare class DbSecretsVaultService implements ISecretsVaultService {
     putSharedStatic(input: PutSharedStaticSecretInput): Promise<SecretSummary>;
     removeShared(key: string): Promise<void>;
     removeUserByKey(userId: string, key: string): Promise<void>;
+    countNamespace(prefix: string): Promise<NamespaceSecretCount>;
+    removeNamespace(prefix: string): Promise<NamespaceSecretCount>;
+    /**
+     * Tell the tiers a namespace deletion actually touched. The `null` sentinel
+     * means "everyone's pooled connection" — earned only by a SHARED row going,
+     * never by one user's secret.
+     */
+    private notifyNamespaceGone;
+    /**
+     * The rows under a namespace, across every user. `LIKE` narrows in the
+     * database (its `_` and `%` escaped — `_` is in nearly every prefix); the
+     * exact membership rule, which `LIKE` cannot say, is applied here.
+     */
+    private namespaceRows;
     statusFor(userId: string, keys: string[]): Promise<SecretConfigStatus[]>;
     /**
      * Decrypt+parse an oauth row's token set once, or undefined if the blob can't be
@@ -73,6 +87,31 @@ export declare class DbSecretsVaultService implements ISecretsVaultService {
         url: string;
     }>;
     resolve(userId: string, key: string): Promise<string | null>;
+    forceRefresh(userId: string, key: string): Promise<ForcedRefreshOutcome>;
+    /**
+     * Trade `tokens.refresh_token` for a fresh token set and persist it — the ONE
+     * refresh path, shared by the expiry-driven `resolve` and the rejection-driven
+     * `forceRefresh`. Three outcomes, each already persisted:
+     *
+     *   - `refreshed` — fresh tokens stored (or a concurrent refresh already
+     *     stored some); `accessToken` is the one to use.
+     *   - `rejected` — the grant is dead: the provider refused it (400/401) or
+     *     there is no refresh token to try. The token set is wiped, the client
+     *     secret kept, so `statusFor` reports not-authorized and /connect routes
+     *     the user to re-authorize.
+     *   - `transient` — timeout, network, 5xx: nothing is changed, so a later
+     *     call tries again.
+     */
+    private refreshRow;
+    /**
+     * The access token currently stored on `id`, or undefined if there is none to
+     * read — including when the row is no longer an OAuth row at all: a concurrent
+     * edit can turn a sign-in into a static value, and a static value that happens
+     * to parse as a token blob must not be handed out as a refreshed grant.
+     */
+    private currentAccessToken;
+    /** Drop a dead grant's token set, keeping the client secret. See {@link refreshRow}. */
+    private wipeTokens;
     putSharedOAuthProvider(input: {
         key: string;
         label?: string | null;

package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-secrets-vault.service.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/db-secrets-vault.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAI1D,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAI3B,MAAM,6BAA6B,CAAC;AA+CrC;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,YAAW,oBAAoB;IAI9D,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAb3B,OAAO,CAAC,cAAc,CAA4B;gBAG/B,EAAE,EAAE,QAAQ;IAC7B,yFAAyF;IACxE,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,MAAiB;IAC7C;;;;;OAKG;IACc,OAAO,CAAC,EAAE,qBAAqB,YAAA;IAGlD,kGAAkG;IAClG,OAAO,CAAC,MAAM;IAiBd,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA8C;IAEhF,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAI3D,OAAO,CAAC,cAAc;IAUhB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAS9C,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKlE,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC;IAyB9D,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwBlE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC;IA0B1E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASxC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS3D,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA4B9E;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAQhB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwE3F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmC3F,0BAA0B,CAAC,KAAK,EAAE;QACtC,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBX,mBAAmB,CAAC,KAAK,EAAE;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IA0GlC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA+G5D,sBAAsB,CAAC,KAAK,EAAE;QAClC,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBX,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAgBhE,YAAY;YA2CZ,GAAG;YASH,UAAU;IAMxB,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,QAAQ;IAwBhB,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,SAAS;CAelB"}
+{"version":3,"file":"db-secrets-vault.service.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/db-secrets-vault.service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAI1D,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAEvB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAEzB,KAAK,oBAAoB,EAI1B,MAAM,6BAA6B,CAAC;AAyDrC;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,YAAW,oBAAoB;IAI9D,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAb3B,OAAO,CAAC,cAAc,CAA4B;gBAG/B,EAAE,EAAE,QAAQ;IAC7B,yFAAyF;IACxE,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,MAAiB;IAC7C;;;;;OAKG;IACc,OAAO,CAAC,EAAE,qBAAqB,YAAA;IAGlD,kGAAkG;IAClG,OAAO,CAAC,MAAM;IAiBd,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA8C;IAEhF,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAI3D,OAAO,CAAC,cAAc;IAUhB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAS9C,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKlE,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC;IAyB9D,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwBlE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC;IA0B1E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASxC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS3D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI7D,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BpE;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAQ3B;;;;OAIG;YACW,aAAa;IAYrB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAiC9E;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAQhB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwE3F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmC3F,0BAA0B,CAAC,KAAK,EAAE;QACtC,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBX,mBAAmB,CAAC,KAAK,EAAE;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IA0GlC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA2C5D,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqB9E;;;;;;;;;;;;;OAaG;YACW,UAAU;IA4ExB;;;;;OAKG;YACW,kBAAkB;IAchC,wFAAwF;YAC1E,UAAU;IAyBlB,sBAAsB,CAAC,KAAK,EAAE;QAClC,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBX,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAgBhE,YAAY;YA2CZ,GAAG;YASH,UAAU;IAMxB,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,QAAQ;IAwBhB,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,SAAS;CAelB"}