@bevel-software/platform-core-backend 0.7.4 → 0.8.0

package/dist/modules/plugins/plugins.routes.js

@@ -0,0 +1,379 @@
+import express from 'express';
+import '../auth/auth.middleware.js'; // Express Request.userId / userEmail augmentation
+import { DEFAULT_BRANCH, joinBranchFor, } from '@bevel-software/platform-shared';
+import { spliceGrant } from '../access/access-splice.js';
+import { WorkflowDomainError } from '../workflow/workflow.errors.js';
+import { pluginsWorkspaceId } from './plugins.service.js';
+import { PluginProvisionError } from './plugin-provision.service.js';
+/**
+ * Browser-facing (JWT) plugin routes, mounted behind `authMiddleware`:
+ *
+ *   GET    /api/plugins                            → { plugins: PluginSummary[] }
+ *   DELETE /api/plugins/:name                      → { ok }          (owners)
+ *   POST   /api/plugins/:name/join-request         → { ok, number }  (opens a CR)
+ *   GET    /api/plugins/:name/join-requests        → { requests }    (managers)
+ *   POST   /api/plugins/:name/join-requests/:n/reconcile → { closed }
+ *
+ * Enumeration is three verdicts per (caller, plugin), all of them ordinary
+ * access resolution — no special cases, no side tables:
+ *
+ *   member       canRead on the plugin FOLDER
+ *   manager      canWrite on the folder's access.md (admin-rescued)
+ *   discoverable canRead on the access.md FILE — in the body-governed format
+ *                its own `read: everyone` frontmatter grants this
+ *
+ * All three false ⇒ the plugin is absent from the response entirely.
+ *
+ * A join request is a plain change request whose branch edits the plugin's
+ * `access.md`. Managers do NOT merge it: they read its individual proposals
+ * (see `join-proposals.ts`), grant the ones they accept through the ordinary
+ * access path, and the request retires itself once its rules are a subset of
+ * the default branch's — reconciled here, lazily on listing and eagerly right
+ * after a grant. Nothing about the lifecycle is stored; it is derived from
+ * two copies of one file.
+ *
+ * Auth gating is explicit and uniform: `authMiddleware` at the mount, PLUS a
+ * `req.userEmail` check in every handler (the skills-routes pattern) so a
+ * middleware change can never silently un-gate one. Nothing here is reachable
+ * with an agent connection key or a manual-auth bearer.
+ */
+export function createPluginsRoutes(pluginIndex, accessControl, workflow, workspaceService, joinRequests, provision, kbDirName, resolveUser) {
+    const router = express.Router();
+    /** The folder-chain probe for MEMBERSHIP — the folder itself. */
+    const memberProbe = (folder) => folder;
+    /** The FILE probe for discovery/management — the folder's access.md. */
+    const accessMdOf = (folder) => `${folder}/access.md`;
+    const probesFor = (plugins) => [
+        ...new Set(plugins.flatMap((g) => g.folders.flatMap((f) => [memberProbe(f), accessMdOf(f)]))),
+    ];
+    /** The caller's open join CR for `plugin`, or null. */
+    const openJoinCr = (mine, email, plugin) => mine.find((cr) => cr.state === 'open' && cr.branch === joinBranchFor(email, plugin)) ?? null;
+    router.get('/plugins', async (req, res) => {
+        const email = req.userEmail;
+        if (!email) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return;
+        }
+        try {
+            const catalog = await pluginIndex.catalog();
+            if (catalog.length === 0) {
+                res.json({ plugins: [] });
+                return;
+            }
+            const wsId = pluginsWorkspaceId();
+            const probes = probesFor(catalog);
+            const [readable, writable, owned] = await Promise.all([
+                accessControl.canReadBatch(wsId, email, probes),
+                accessControl.canWriteBatch(wsId, email, probes),
+                accessControl.canOwnerBatch(wsId, email, probes),
+            ]);
+            // Fail closed on every verdict: a path missing from the map is denied.
+            const any = (map, g, probe) => g.folders.some((f) => map.get(probe(f)) === true);
+            // The caller's own open join CRs — drives `hasRequested`. A CR-listing
+            // hiccup must not take plugin enumeration down: degrade to "nothing
+            // requested" and let the next load repair it.
+            let mine = [];
+            try {
+                mine = await workflow.listChangeRequestsAuthoredBy(email);
+            }
+            catch (err) {
+                console.warn(`[plugins] join-request lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            const plugins = [];
+            for (const g of catalog) {
+                const member = any(readable, g, memberProbe);
+                const manager = any(writable, g, accessMdOf);
+                // The FOLDER verdict, owner-lists-only — the delete gate, mirrored
+                // here so the UI shows the verb to exactly the people the DELETE
+                // route will let through.
+                const owner = any(owned, g, memberProbe);
+                const discoverable = member || any(readable, g, accessMdOf);
+                if (!member && !manager && !discoverable)
+                    continue; // absent — fail closed
+                const joinCr = member ? null : openJoinCr(mine, email, g.name);
+                plugins.push({
+                    name: g.name,
+                    folders: g.folders,
+                    canRead: member,
+                    canWrite: manager,
+                    isOwner: owner,
+                    skillCount: g.skillCount,
+                    toolCount: g.toolCount,
+                    owners: g.owners,
+                    writers: g.writers,
+                    readers: g.readers,
+                    hasRequested: joinCr !== null,
+                    requestNumber: joinCr?.number ?? null,
+                });
+            }
+            res.json({ plugins });
+        }
+        catch (err) {
+            console.error('[plugins] failed to list plugins:', err);
+            res.status(500).json({ error: 'Failed to list plugins' });
+        }
+    });
+    /**
+     * Open (or return the existing) join change request for the caller.
+     *
+     * Idempotent via the deterministic branch name: a second click finds the
+     * open CR and returns it. Every step is an existing primitive — branch,
+     * splice, commit-and-push, open CR — so the security story is exactly the
+     * workflow's: draft branches are ungated, and the merge gate requires an
+     * approver who can write the touched access.md.
+     */
+    /**
+     * Create a plugin — the ONE door through which `Plugins/<name>/` folders come
+     * to exist. Any authenticated user may create one; that is the product
+     * model (making a plugin makes you the one who runs it), and the seeded
+     * access.md immediately fences the new folder off from everyone else. See
+     * `PluginProvisionService` for why this is an endpoint and not a write path.
+     */
+    router.post('/plugins', async (req, res) => {
+        const user = await resolveUser(req);
+        if (!user) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return;
+        }
+        // `req.body` is undefined when no JSON body was sent at all — that is a
+        // 400, not a destructuring crash.
+        const { name } = (req.body ?? {});
+        if (typeof name !== 'string') {
+            res.status(400).json({ error: 'name is required in body' });
+            return;
+        }
+        try {
+            const result = await provision.createPlugin(user, name);
+            res.status(201).json(result);
+        }
+        catch (err) {
+            if (err instanceof PluginProvisionError) {
+                res.status(err.status).json({ error: err.message });
+                return;
+            }
+            console.error('[plugins] create failed:', err);
+            res.status(500).json({ error: 'Failed to create the plugin' });
+        }
+    });
+    /**
+     * Ensure the caller's personal folder (`Plugins/personal-<id>/`) exists —
+     * idempotent; the UI calls it lazily right before the first personal-skill
+     * write. Private by construction: its access.md names only the caller.
+     */
+    router.post('/plugins/personal', async (req, res) => {
+        const user = await resolveUser(req);
+        if (!user) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return;
+        }
+        try {
+            res.json(await provision.ensurePersonalPlugin(user));
+        }
+        catch (err) {
+            console.error('[plugins] personal-folder ensure failed:', err);
+            res.status(500).json({ error: 'Failed to prepare your personal folder' });
+        }
+    });
+    /**
+     * Delete a plugin — the OWNER's verb, and only theirs. Creating a plugin
+     * makes you the one who runs it; deleting it is the other end of that same
+     * promise, so the gate is the `owner` verdict on the folder (owner-lists
+     * only, no admin rescue) — a manager who merely writes the access.md, and
+     * an admin rescued into managing it, do not get it.
+     *
+     * Fail-closed like every other plugin surface: an unknown plugin and a plugin
+     * the caller does not own answer IDENTICALLY, so probing the endpoint can
+     * confirm nothing about what exists. The mechanism (park, one commit,
+     * rollback on refusal) lives in `PluginProvisionService.deletePlugin`.
+     */
+    router.delete('/plugins/:name', async (req, res) => {
+        const email = req.userEmail;
+        if (!email) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return;
+        }
+        try {
+            const user = await resolveUser(req);
+            if (!user) {
+                res.status(401).json({ error: 'Unauthenticated' });
+                return;
+            }
+            // Case-sensitive, like `pluginOfPath` — the plugin name IS the folder name.
+            const plugin = (await pluginIndex.catalog()).find((g) => g.name === req.params.name);
+            const wsId = pluginsWorkspaceId();
+            const ownerVerdicts = plugin
+                ? await Promise.all(plugin.folders.map((f) => accessControl.canOwner(wsId, email, memberProbe(f))))
+                : [];
+            if (!plugin || !ownerVerdicts.some((v) => v === true)) {
+                res.status(404).json({ error: 'Unknown plugin', kind: 'unknown-plugin' });
+                return;
+            }
+            await provision.deletePlugin(user, plugin.name);
+            pluginIndex.invalidate();
+            res.json({ ok: true });
+        }
+        catch (err) {
+            if (err instanceof PluginProvisionError) {
+                res.status(err.status).json({ error: err.message });
+                return;
+            }
+            console.error('[plugins] delete failed:', err);
+            res.status(500).json({ error: 'Failed to delete the plugin' });
+        }
+    });
+    router.post('/plugins/:name/join-request', async (req, res) => {
+        const email = req.userEmail;
+        if (!email) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return;
+        }
+        try {
+            const user = await resolveUser(req);
+            if (!user) {
+                res.status(401).json({ error: 'Unauthenticated' });
+                return;
+            }
+            const catalog = await pluginIndex.catalog();
+            // Case-sensitive, like `pluginOfPath` — the plugin name IS the folder name.
+            const plugin = catalog.find((g) => g.name === req.params.name);
+            const wsId = pluginsWorkspaceId();
+            // Same ANY-folder shape `GET /plugins` resolves with, so a plugin can
+            // never be listed as discoverable there and rejected as unknown here.
+            const verdicts = plugin
+                ? await accessControl.canReadBatch(wsId, email, plugin.folders.flatMap((f) => [memberProbe(f), accessMdOf(f)]))
+                : new Map();
+            const any = (probe) => plugin?.folders.some((f) => verdicts.get(probe(f)) === true) ?? false;
+            // Discovery gate, fail-closed: an unknown plugin and a plugin the caller
+            // cannot discover answer IDENTICALLY, so probing can't confirm existence.
+            if (!plugin || !any(accessMdOf)) {
+                res.status(404).json({ error: 'Unknown plugin', kind: 'unknown-plugin' });
+                return;
+            }
+            if (any(memberProbe)) {
+                // Access landed between page load and click — reload, don't ask.
+                res.status(409).json({ error: 'You can already read this plugin', kind: 'already-readable' });
+                return;
+            }
+            // The grant is written to the plugin's primary folder — the one the
+            // summary's `folders[0]` names and the banner's touched-path check
+            // expects.
+            const folder = plugin.folders[0];
+            const branch = joinBranchFor(email, plugin.name);
+            const existing = openJoinCr(await workflow.listChangeRequestsAuthoredBy(email), email, plugin.name);
+            if (existing) {
+                res.json({ ok: true, number: existing.number });
+                return;
+            }
+            // A leftover branch from a rejected/withdrawn request is reused — the
+            // grant commit is already on it and the splice below no-ops.
+            try {
+                await workflow.createBranch(pluginsWorkspaceId(), branch, DEFAULT_BRANCH);
+            }
+            catch {
+                // exists (or raced) — proceed against it
+            }
+            const ws = await workspaceService.getOrCreateForBranch(branch);
+            const accessPath = `${kbDirName}/${accessMdOf(folder)}`;
+            const current = await workspaceService.readFile(ws.id, accessPath).catch(() => '');
+            const spliced = spliceGrant(current, 'read', { kind: 'user', email: user.email, displayName: user.name }, { target: 'folder' });
+            if (spliced.changed) {
+                await workspaceService.writeFile(ws.id, accessPath, spliced.text);
+                await workflow.commitChanges(ws.id, user, `Request access to ${plugin.name}`);
+            }
+            const detail = await workflow.openChangeRequest(ws.id, user, {
+                sourceBranch: branch,
+                targetBranch: DEFAULT_BRANCH,
+                title: `Join request: ${plugin.name}`,
+                description: `${user.name} asked to join ${plugin.name}. A manager of the plugin accepts by ` +
+                    `granting the access this branch proposes; the request closes itself once ` +
+                    `every proposal has landed.`,
+            });
+            res.json({ ok: true, number: detail.number });
+        }
+        catch (err) {
+            if (err instanceof WorkflowDomainError) {
+                res.status(err.status).json({ error: err.message, ...(err.payload ?? {}) });
+                return;
+            }
+            console.error('[plugins] failed to open a join request:', err);
+            res.status(500).json({ error: 'Failed to request access' });
+        }
+    });
+    /**
+     * Resolve the caller as a MANAGER of `name` — the only role that may see or
+     * settle its join requests. Returns the plugin's primary folder, or null
+     * after answering the request.
+     *
+     * A non-manager gets an empty list rather than a 403 (the frontend asks
+     * unconditionally, exactly as it does for every other plugin surface), and
+     * an unknown plugin is indistinguishable from an unmanaged one.
+     */
+    async function requireManager(req, res, onDenied) {
+        const email = req.userEmail;
+        if (!email) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return null;
+        }
+        const plugin = (await pluginIndex.catalog()).find((g) => g.name === req.params.name);
+        if (!plugin) {
+            onDenied();
+            return null;
+        }
+        const writable = await accessControl.canWriteBatch(pluginsWorkspaceId(), email, plugin.folders.map(accessMdOf));
+        if (!plugin.folders.some((f) => writable.get(accessMdOf(f)) === true)) {
+            onDenied();
+            return null;
+        }
+        const user = await resolveUser(req);
+        if (!user) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return null;
+        }
+        return { plugin, folder: plugin.folders[0], user };
+    }
+    router.get('/plugins/:name/join-requests', async (req, res) => {
+        try {
+            const ctx = await requireManager(req, res, () => res.json({ requests: [] }));
+            if (!ctx)
+                return;
+            const crs = await workflow.listChangeRequests();
+            res.json({
+                requests: await joinRequests.list(ctx.plugin.name, ctx.folder, crs, ctx.user),
+            });
+        }
+        catch (err) {
+            console.error('[plugins] failed to list join requests:', err);
+            res.status(500).json({ error: 'Failed to list join requests' });
+        }
+    });
+    /**
+     * Settle one request if its proposals have all landed on the default
+     * branch. Called right after a grant so the banner updates in the same
+     * round-trip; the listing does the same thing lazily, so skipping this (a
+     * dropped response, a closed tab) only delays it.
+     */
+    router.post('/plugins/:name/join-requests/:number/reconcile', async (req, res) => {
+        try {
+            const ctx = await requireManager(req, res, () => res.status(404).json({ error: 'Not found' }));
+            if (!ctx)
+                return;
+            const crNumber = Number(req.params.number);
+            if (!Number.isSafeInteger(crNumber) || crNumber <= 0) {
+                res.status(400).json({ error: 'Invalid change request number' });
+                return;
+            }
+            const cr = await workflow.getChangeRequest(crNumber);
+            if (!cr) {
+                res.status(404).json({ error: 'Not found' });
+                return;
+            }
+            res.json({ closed: await joinRequests.reconcile(ctx.plugin.name, ctx.folder, cr, ctx.user) });
+        }
+        catch (err) {
+            console.error('[plugins] failed to reconcile a join request:', err);
+            res.status(500).json({ error: 'Failed to update the request' });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=plugins.routes.js.map

package/dist/modules/plugins/plugins.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.routes.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,4BAA4B,CAAC,CAAC,kDAAkD;AACvF,OAAO,EACL,cAAc,EACd,aAAa,GAId,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAA+B,MAAM,+BAA+B,CAAC;AAQlG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAgC,EAChC,aAA6B,EAC7B,QAA0B,EAC1B,gBAAkC,EAClC,YAAiC,EACjC,SAAiC,EACjC,SAAiB,EACjB,WAA+D;IAE/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,iEAAiE;IACjE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC;IAC/C,wEAAwE;IACxE,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,YAAY,CAAC;IAE7D,MAAM,SAAS,GAAG,CAAC,OAA6B,EAAY,EAAE,CAAC;QAC7D,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC9F,CAAC;IAEF,uDAAuD;IACvD,MAAM,UAAU,GAAG,CAAC,IAAqB,EAAE,KAAa,EAAE,MAAc,EAAwB,EAAE,CAChG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,EAAE,CAAC,MAAM,KAAK,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;IAE/F,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACpD,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC;gBAC/C,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC;gBAChD,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC;aACjD,CAAC,CAAC;YACH,uEAAuE;YACvE,MAAM,GAAG,GAAG,CAAC,GAAyB,EAAE,CAAqB,EAAE,KAA4B,EAAE,EAAE,CAC7F,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAEpD,uEAAuE;YACvE,oEAAoE;YACpE,8CAA8C;YAC9C,IAAI,IAAI,GAAoB,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAoB,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;gBAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;gBAC7C,mEAAmE;gBACnE,iEAAiE;gBACjE,0BAA0B;gBAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;gBACzC,MAAM,YAAY,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;gBAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY;oBAAE,SAAS,CAAC,uBAAuB;gBAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM;oBACf,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,KAAK;oBACd,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,YAAY,EAAE,MAAM,KAAK,IAAI;oBAC7B,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAsB,CAAC;QACvD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,MAAM,MAAM,GAAG,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,MAAM;gBAC1B,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/E;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAChD,WAAW,CAAC,UAAU,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;YAC5C,4EAA4E;YAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAClC,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,QAAQ,GAAG,MAAM;gBACrB,CAAC,CAAC,MAAM,aAAa,CAAC,YAAY,CAC9B,IAAI,EACJ,KAAK,EACL,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/D;gBACH,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;YAC/B,MAAM,GAAG,GAAG,CAAC,KAA4B,EAAE,EAAE,CAC3C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC;YACxE,yEAAyE;YACzE,0EAA0E;YAC1E,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrB,iEAAiE;gBACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YACD,oEAAoE;YACpE,mEAAmE;YACnE,WAAW;YACX,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,QAAQ,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACpG,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YAED,sEAAsE;YACtE,6DAA6D;YAC7D,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,yCAAyC;YAC3C,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnF,MAAM,OAAO,GAAG,WAAW,CACzB,OAAO,EACP,MAAM,EACN,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,EAC3D,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;YACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;gBAClE,MAAM,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,qBAAqB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE;gBAC3D,YAAY,EAAE,MAAM;gBACpB,YAAY,EAAE,cAAc;gBAC5B,KAAK,EAAE,iBAAiB,MAAM,CAAC,IAAI,EAAE;gBACrC,WAAW,EACT,GAAG,IAAI,CAAC,IAAI,kBAAkB,MAAM,CAAC,IAAI,uCAAuC;oBAChF,2EAA2E;oBAC3E,4BAA4B;aAC/B,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC5E,OAAO;YACT,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH,KAAK,UAAU,cAAc,CAC3B,GAAoB,EACpB,GAAqB,EACrB,QAAoB;QAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,aAAa,CAChD,kBAAkB,EAAE,EACpB,KAAK,EACL,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAC/B,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACtE,QAAQ,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC;aAC9E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAC7C,CAAC;YACF,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/plugins/plugins.service.d.ts

@@ -0,0 +1,60 @@
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import type { ISkillService } from '../skills/skills.contract.js';
+import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';
+import type { PluginCatalogEntry, IPluginIndexService } from './plugins.contract.js';
+/**
+ * The plugin index: every plugin folder in the default-branch KB, with its
+ * caller-independent totals and access principals.
+ *
+ * Two decisions worth keeping straight:
+ *
+ *  - **Existence is an `access.md`, counting is not.** A plugin EXISTS because
+ *    its folder carries an `access.md` — the file the provisioning endpoint
+ *    seeds and the one every per-caller verdict (member / manager /
+ *    discoverable) resolves against. A bare directory under `Plugins/` is NOT
+ *    a plugin: git cannot record an empty folder, so deleting a plugin's files
+ *    leaves its directory behind on live checkouts, and enumerating by
+ *    directory would resurrect every such ghost. Counts come from the
+ *    already-cached global catalogs — `skillService.listSkills(undefined)` and
+ *    `toolManualService.listAllSummaries()` — bucketed by `pluginOfPath`. A
+ *    second `walkFiles` pass would re-read the same tree and could disagree
+ *    with the catalogs about what counts as a skill.
+ *  - **Loose files are not plugins.** `Plugins/slack.tool` sits directly under
+ *    the root, so it is a file, not a directory — the same ≥3-segment rule
+ *    `pluginOfPath` applies, arrived at from the other side.
+ *
+ * Cached for {@link CACHE_TTL_MS} and dropped by `invalidate()` from the
+ * file-change subscriber, so a grant committed on the default branch is
+ * reflected within one round-trip rather than one TTL.
+ */
+export declare class PluginIndexService implements IPluginIndexService {
+    private readonly workspaceService;
+    private readonly accessControl;
+    private readonly skillService;
+    private readonly toolManualService;
+    private readonly kbDirName;
+    private readonly cache;
+    constructor(workspaceService: WorkspaceService, accessControl: IAccessControl, skillService: ISkillService, toolManualService: IToolManualService, kbDirName: string, now?: () => number);
+    invalidate(): void;
+    catalog(): Promise<PluginCatalogEntry[]>;
+    /**
+    * Degrades on ANY failure rather than throwing. The Library must never break
+    * because a plugin folder can't be read — same philosophy as the skill and
+    * tool-manual scanners, and the reason the route's 500 is reserved for the
+    * per-caller half.
+    *
+    * `null` is that degraded case and is deliberately NOT the same value as an
+    * empty array: a KB with no plugin folders returns `[]`, which is true and
+    * cacheable, while a failure returns `null`, which `catalog()` serves as `[]`
+    * without storing it.
+    */
+    private build;
+    /** name → repo-relative plugin folder (always a single-element list). */
+    private scanFolders;
+    private countSkills;
+    private countTools;
+}
+/** The default-branch workspace id every plugin resolution runs against. */
+export declare function pluginsWorkspaceId(): string;
+//# sourceMappingURL=plugins.service.d.ts.map

package/dist/modules/plugins/plugins.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.service.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIrF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAI1D,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;gBAGpC,gBAAgB,EAAE,gBAAgB,EAClC,aAAa,EAAE,cAAc,EAC7B,YAAY,EAAE,aAAa,EAC3B,iBAAiB,EAAE,kBAAkB,EACrC,SAAS,EAAE,MAAM,EAClC,GAAG,GAAE,MAAM,MAAiB;IAK9B,UAAU,IAAI,IAAI;IAIZ,OAAO,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAkB7C;;;;;;;;;;MAUE;YACW,KAAK;IAyCnB,yEAAyE;YAC3D,WAAW;YAkCX,WAAW;YAMX,UAAU;CAGzB;AAaD,4EAA4E;AAC5E,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}

package/dist/modules/plugins/plugins.service.js

@@ -0,0 +1,172 @@
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import { DEFAULT_BRANCH, PLUGINS_DIR, pluginOfPath, isPersonalPluginFolder, } from '@bevel-software/platform-shared';
+import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { TtlCache } from '../../shared/ttl-cache.js';
+const CACHE_TTL_MS = 60_000;
+/**
+ * The plugin index: every plugin folder in the default-branch KB, with its
+ * caller-independent totals and access principals.
+ *
+ * Two decisions worth keeping straight:
+ *
+ *  - **Existence is an `access.md`, counting is not.** A plugin EXISTS because
+ *    its folder carries an `access.md` — the file the provisioning endpoint
+ *    seeds and the one every per-caller verdict (member / manager /
+ *    discoverable) resolves against. A bare directory under `Plugins/` is NOT
+ *    a plugin: git cannot record an empty folder, so deleting a plugin's files
+ *    leaves its directory behind on live checkouts, and enumerating by
+ *    directory would resurrect every such ghost. Counts come from the
+ *    already-cached global catalogs — `skillService.listSkills(undefined)` and
+ *    `toolManualService.listAllSummaries()` — bucketed by `pluginOfPath`. A
+ *    second `walkFiles` pass would re-read the same tree and could disagree
+ *    with the catalogs about what counts as a skill.
+ *  - **Loose files are not plugins.** `Plugins/slack.tool` sits directly under
+ *    the root, so it is a file, not a directory — the same ≥3-segment rule
+ *    `pluginOfPath` applies, arrived at from the other side.
+ *
+ * Cached for {@link CACHE_TTL_MS} and dropped by `invalidate()` from the
+ * file-change subscriber, so a grant committed on the default branch is
+ * reflected within one round-trip rather than one TTL.
+ */
+export class PluginIndexService {
+    workspaceService;
+    accessControl;
+    skillService;
+    toolManualService;
+    kbDirName;
+    cache;
+    constructor(workspaceService, accessControl, skillService, toolManualService, kbDirName, now = Date.now) {
+        this.workspaceService = workspaceService;
+        this.accessControl = accessControl;
+        this.skillService = skillService;
+        this.toolManualService = toolManualService;
+        this.kbDirName = kbDirName;
+        this.cache = new TtlCache(CACHE_TTL_MS, now);
+    }
+    invalidate() {
+        this.cache.invalidate();
+    }
+    async catalog() {
+        const cached = this.cache.get();
+        if (cached)
+            return cached;
+        const entries = await this.build();
+        // A failed scan and a KB with genuinely no plugin folders both serve `[]`,
+        // but only the second is a fact worth holding for the TTL. Caching the
+        // failure would hide every plugin from every user for the full 60s AFTER
+        // the cause is gone — a clone mid-creation, a readdir that raced a
+        // checkout — and `invalidate()` only fires on a file-change event that may
+        // never arrive in that window. So a degraded read is served, not stored,
+        // and the next caller retries.
+        if (entries === null)
+            return [];
+        this.cache.set(entries);
+        return entries;
+    }
+    // --- internal --------------------------------------------------------------
+    /**
+    * Degrades on ANY failure rather than throwing. The Library must never break
+    * because a plugin folder can't be read — same philosophy as the skill and
+    * tool-manual scanners, and the reason the route's 500 is reserved for the
+    * per-caller half.
+    *
+    * `null` is that degraded case and is deliberately NOT the same value as an
+    * empty array: a KB with no plugin folders returns `[]`, which is true and
+    * cacheable, while a failure returns `null`, which `catalog()` serves as `[]`
+    * without storing it.
+    */
+    async build() {
+        try {
+            const wsId = (await this.workspaceService.getOrCreateForBranch(DEFAULT_BRANCH)).id;
+            const kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
+            const folders = await this.scanFolders(kbRoot);
+            if (folders.size === 0)
+                return [];
+            const [skillCounts, toolCounts] = await Promise.all([
+                this.countSkills(),
+                this.countTools(),
+            ]);
+            const entries = [];
+            for (const [name, pluginFolders] of folders) {
+                // One folder, one access boundary — the folder IS the plugin.
+                const [primary] = pluginFolders;
+                const [owners, writers, readers] = await Promise.all([
+                    this.accessControl.eligibleOwners(wsId, primary),
+                    this.accessControl.eligibleWriters(wsId, primary),
+                    this.accessControl.eligibleReaders(wsId, primary),
+                ]);
+                entries.push({
+                    name,
+                    folders: pluginFolders,
+                    skillCount: skillCounts.get(name) ?? 0,
+                    toolCount: toolCounts.get(name) ?? 0,
+                    owners,
+                    writers,
+                    readers,
+                });
+            }
+            return entries.sort((a, b) => a.name.localeCompare(b.name));
+        }
+        catch (err) {
+            console.warn(`[plugins] plugin index unavailable: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+    }
+    /** name → repo-relative plugin folder (always a single-element list). */
+    async scanFolders(kbRoot) {
+        const byName = new Map();
+        let children;
+        try {
+            children = await fs.readdir(path.join(kbRoot, PLUGINS_DIR), { withFileTypes: true });
+        }
+        catch {
+            return byName; // a KB without a `Plugins/` root simply has no plugins
+        }
+        const candidates = children.filter((child) => child.isDirectory() &&
+            !child.name.startsWith('.') &&
+            // Personal folders live under Plugins/ but are not plugins: one exists
+            // per person, private by construction, and listing them would put a
+            // locked row per employee in everyone's index.
+            !isPersonalPluginFolder(child.name));
+        // A plugin exists exactly when its folder carries an `access.md` (see the
+        // class doc) — stat that file, don't trust the directory.
+        const verdicts = await Promise.all(candidates.map(async (child) => {
+            try {
+                return (await fs.stat(path.join(kbRoot, PLUGINS_DIR, child.name, 'access.md'))).isFile();
+            }
+            catch {
+                return false;
+            }
+        }));
+        candidates.forEach((child, i) => {
+            if (verdicts[i])
+                byName.set(child.name, [`${PLUGINS_DIR}/${child.name}`]);
+        });
+        return byName;
+    }
+    async countSkills() {
+        // `undefined` is the documented GLOBAL, unfiltered mode — counts are a
+        // property of the plugin, not of who is asking.
+        return bucketByPlugin(await this.skillService.listSkills(undefined));
+    }
+    async countTools() {
+        return bucketByPlugin(await this.toolManualService.listAllSummaries());
+    }
+}
+/** Count items per plugin folder name; ungrouped items (`null`) count nowhere. */
+function bucketByPlugin(items) {
+    const counts = new Map();
+    for (const item of items) {
+        const plugin = pluginOfPath(item.path);
+        if (plugin === null)
+            continue;
+        counts.set(plugin, (counts.get(plugin) ?? 0) + 1);
+    }
+    return counts;
+}
+/** The default-branch workspace id every plugin resolution runs against. */
+export function pluginsWorkspaceId() {
+    return workspaceIdForBranch(DEFAULT_BRANCH);
+}
+//# sourceMappingURL=plugins.service.js.map

package/dist/modules/plugins/plugins.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.service.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugins.service.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,EACL,cAAc,EACd,WAAW,EACX,YAAY,EACZ,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAIzE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAGrD,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,kBAAkB;IAIV;IACA;IACA;IACA;IACA;IAPF,KAAK,CAAiC;IAEvD,YACmB,gBAAkC,EAClC,aAA6B,EAC7B,YAA2B,EAC3B,iBAAqC,EACrC,SAAiB,EAClC,MAAoB,IAAI,CAAC,GAAG;QALX,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,iBAAY,GAAZ,YAAY,CAAe;QAC3B,sBAAiB,GAAjB,iBAAiB,CAAoB;QACrC,cAAS,GAAT,SAAS,CAAQ;QAGlC,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,mEAAmE;QACnE,2EAA2E;QAC3E,yEAAyE;QACzE,+BAA+B;QAC/B,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAE7E;;;;;;;;;;MAUE;IACK,KAAK,CAAC,KAAK;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAE7F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAElC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAClD,IAAI,CAAC,WAAW,EAAE;gBAClB,IAAI,CAAC,UAAU,EAAE;aAClB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAyB,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC5C,8DAA8D;gBAC9D,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC;gBAChC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACnD,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;oBAChD,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;oBACjD,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;iBAClD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,OAAO,EAAE,aAAa;oBACtB,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtC,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBACpC,MAAM;oBACN,OAAO;oBACP,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,WAAW,CAAC,MAAc;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,CAAC,uDAAuD;QACxE,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,EAAE;YACnB,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAC3B,uEAAuE;YACvE,oEAAoE;YACpE,+CAA+C;YAC/C,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CACtC,CAAC;QACF,0EAA0E;QAC1E,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YAC9B,IAAI,QAAQ,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,uEAAuE;QACvE,gDAAgD;QAChD,OAAO,cAAc,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,OAAO,cAAc,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACzE,CAAC;CACF;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,OAAO,oBAAoB,CAAC,cAAc,CAAC,CAAC;AAC9C,CAAC"}