@checkstack/backend-api 0.14.1 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,114 @@
 # @checkstack/backend-api
 
+## 0.15.0
+
+### Minor Changes
+
+- 50e5f5f: Runtime plugin system: install + uninstall plugins from npm, GitHub releases
+  (including private GitHub Enterprise instances), or tarball uploads at
+  runtime, with multi-package bundles, dependency-derived compatibility checks,
+  multi-instance coordination via a Postgres artifact store, and
+  single-coordinator destructive cleanup.
+
+  Highlights:
+
+  - New `PluginSource` discriminated union and `PluginInstaller` /
+    `PluginInstallerRegistry` interfaces in `@checkstack/backend-api`. The
+    GitHub variant accepts an optional `apiBaseUrl` so deployments backed by
+    GitHub Enterprise can install from `https://ghe.example.com/api/v3`
+    instead of `api.github.com`.
+  - New `installPackageMetadataSchema` (Zod) in `@checkstack/common` validates
+    every plugin's `package.json` at install time. Required fields: `name`,
+    `version`, `description`, `author`, `license`, `checkstack.type`,
+    `checkstack.pluginId`. Optional: `checkstack.bundle`,
+    `checkstack.usageInstructions`, `checkstack.allowInstallScripts`.
+  - New `pluginManagerContract` in `@checkstack/pluginmanager-common` with
+    `list`, `previewInstall`, `install`, `previewUninstall`, `uninstall`, and
+    `events` procedures.
+  - New `@checkstack/pluginmanager-frontend` admin UI: installed-plugins list
+    with per-row uninstall (typed-confirmation modal, schema/configs/cascade
+    toggles), install page with NPM / Tarball Upload / GitHub Release tabs
+    (Catalog tab disabled — coming soon), and an events page surfacing the
+    install/uninstall audit log.
+  - New `bunx @checkstack/scripts plugin-pack` CLI for plugin authors —
+    per-package mode produces an npm-shaped tarball; `--bundle` mode produces
+    an outer tarball containing every sibling declared in
+    `package.json#checkstack.bundle`. Published to npm so external authors
+    can `bunx` it directly without a workspace checkout.
+  - Compatibility derived from `package.json#dependencies` ranges
+    (`semver.satisfies` against the platform's loaded `@checkstack/*`
+    versions) — no separate `compatibility` field.
+  - Multi-instance: originator persists artifacts + `plugins` rows + broadcasts
+    install/uninstall; receiving instances do in-process register/unregister
+    only. Destructive ops (drop schema, delete plugin_configs, delete
+    artifacts, delete `plugins` rows) run exactly once on the originator.
+  - Fresh-instance bootstrap: `loadPlugins()` hydrates any
+    `is_uninstallable=true` plugin missing from `node_modules` from the
+    artifact store before normal Phase 1 register.
+  - New schema: `plugin_artifacts` (tarball storage), `plugin_install_events`
+    (audit/error log). `plugins` extended with `version`, `metadata`,
+    `source`, `bundle_id`, `is_primary`. Local plugin sync now writes
+    `version` from each plugin's `package.json` so the admin UI shows real
+    versions instead of `—`.
+  - Tarball-upload endpoint (`POST /api/pluginmanager/upload-tarball`) for
+    the install UI; access-gated by `pluginmanager.plugin.manage`.
+  - Plugin Manager menu link added to the user menu (main grid, alongside
+    Profile / Notification Settings / etc.).
+
+  Cross-cutting changes:
+
+  - Backend request/response logging now flows through `rootLogger` (winston)
+    instead of `hono/logger`. 5xx responses include the response body inline
+    so swallowed early-return errors are visible in the log.
+  - The `/api/:pluginId/*` dispatcher now logs which core service is missing
+    or which `pluginId` had no metadata when it 500s.
+  - New `registerCorePluginMetadata` on `PluginManager` for core routers
+    (like the plugin manager itself) that need their metadata visible to the
+    RPC dispatcher without going through the full plugin lifecycle.
+  - ESLint: `unicorn/no-null` is now disabled globally. Drizzle distinguishes
+    between `null` (writes a real SQL NULL) and `undefined` (skip the column
+    on insert), so treating them as interchangeable produced latent bugs at
+    the persistence boundary. The bulk of the patch-bumped packages above
+    reflect lint-fix touches that landed when this rule was relaxed.
+  - Workspace-wide license normalization to `Elastic-2.0` (matches
+    `LICENSE.md`). Every `package.json` in the workspace now declares the
+    same SPDX identifier; the patch bumps capture this.
+
+  Plugin packages (every `plugins/*`): added a `pack` npm script
+  (`bunx @checkstack/scripts plugin-pack`), mirrored each plugin's
+  `pluginId` from `plugin-metadata.ts` into `package.json#checkstack.pluginId`
+  so install-time validation passes, stubbed any missing required metadata
+  fields (`description`, `author`, `license`), and added
+  `checkstack.bundle` to multi-package plugin primaries (telegram, rcon, ssh,
+  jira, queue-bullmq, queue-memory, cache-memory).
+
+  Breaking changes:
+
+  - The legacy single-method `PluginInstaller` interface (`install(packageName)`)
+    is removed. Callers must use `coreServices.pluginInstallerRegistry`.
+  - The old `pluginAdminContract` and `createPluginAdminRouter` are removed.
+    Replaced by `pluginManagerContract` in `@checkstack/pluginmanager-common`
+    and `createPluginManagerRouter` in `core/backend`.
+  - `@checkstack/test-utils-backend` no longer exports
+    `createMockPluginInstaller` / `MockPluginInstaller` (the legacy interface
+    it shimmed is gone).
+
+  Note: bumps are limited to `minor` (for packages with new public API
+  surface) and `patch` (for downstream consumers, license normalization,
+  and lint fixes). No `major` bumps despite the `PluginInstaller` removal —
+  the legacy interface had no third-party consumers in the wild before this
+  runtime plugin system landed, and the contract surface is the same shape
+  modulo the rename.
+
+### Patch Changes
+
+- Updated dependencies [50e5f5f]
+  - @checkstack/common@0.8.0
+  - @checkstack/queue-api@0.2.18
+  - @checkstack/cache-api@0.2.4
+  - @checkstack/healthcheck-common@1.0.1
+  - @checkstack/signal-common@0.2.1
+
 ## 0.14.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@checkstack/backend-api",
-  "version": "0.14.1",
+  "version": "0.15.0",
+  "license": "Elastic-2.0",
   "type": "module",
   "main": "./src/index.ts",
   "scripts": {
@@ -11,8 +12,8 @@
   "dependencies": {
     "@checkstack/common": "0.7.0",
     "@checkstack/healthcheck-common": "1.0.0",
-    "@checkstack/cache-api": "0.2.2",
-    "@checkstack/queue-api": "0.2.16",
+    "@checkstack/cache-api": "0.2.3",
+    "@checkstack/queue-api": "0.2.17",
     "@checkstack/signal-common": "0.2.0",
     "@orpc/client": "^1.13.14",
     "@orpc/contract": "^1.13.14",
@@ -26,7 +27,7 @@
   },
   "devDependencies": {
     "@types/bun": "latest",
-    "@checkstack/tsconfig": "0.0.5",
+    "@checkstack/tsconfig": "0.0.6",
     "@checkstack/scripts": "0.1.2"
   },
   "peerDependencies": {

package/src/assertions.ts

@@ -1,4 +1,4 @@
-/* eslint-disable unicorn/no-null */
+ 
 import { z } from "zod";
 
 // ============================================================================

package/src/core-services.ts

@@ -10,13 +10,9 @@ import type {
 import type { ConfigService } from "./config-service";
 import type { SignalService } from "@checkstack/signal-common";
 import { SafeDatabase } from "./plugin-system";
-import {
-  Logger,
-  Fetch,
-  AuthService,
-  PluginInstaller,
-  RpcClient,
-} from "./types";
+import { Logger, Fetch, AuthService, RpcClient } from "./types";
+import type { PluginInstallerRegistry } from "./plugin-source";
+import type { PluginArtifactStore } from "./plugin-artifact-store";
 import type { EventBus } from "./event-bus-types";
 import type { WebSocketRouteRegistry } from "./ws-registry";
 import type { ReadinessRegistry } from "./readiness-registry";
@@ -39,7 +35,20 @@ export const coreServices = {
   collectorRegistry: createServiceRef<CollectorRegistry>(
     "core.collectorRegistry",
   ),
-  pluginInstaller: createServiceRef<PluginInstaller>("core.pluginInstaller"),
+  /**
+   * Per-source installer registry used by the runtime plugin system.
+   * Indexed by `PluginSource["type"]` (npm, tarball, github, catalog).
+   */
+  pluginInstallerRegistry: createServiceRef<PluginInstallerRegistry>(
+    "core.pluginInstallerRegistry",
+  ),
+  /**
+   * Persistent tarball store backing fresh-instance bootstrap and
+   * cross-instance artifact sharing.
+   */
+  pluginArtifactStore: createServiceRef<PluginArtifactStore>(
+    "core.pluginArtifactStore",
+  ),
   rpc: createServiceRef<RpcService>("core.rpc"),
   rpcClient: createServiceRef<RpcClient>("core.rpcClient"),
   queuePluginRegistry: createServiceRef<QueuePluginRegistry>(

package/src/index.ts

@@ -15,7 +15,8 @@ export * from "./rpc";
 export * from "./test-utils";
 export * from "./hooks";
 export * from "./event-bus-types";
-export * from "./plugin-admin-contract";
+export * from "./plugin-source";
+export * from "./plugin-artifact-store";
 export * from "./notification-strategy";
 export * from "./oauth-handler";
 export * from "./markdown";

package/src/plugin-artifact-store.ts

@@ -0,0 +1,56 @@
+/**
+ * Persistent storage for plugin tarballs.
+ *
+ * Implementations must be **shared across all instances** so that a freshly
+ * spun-up replica can recover any plugin that was installed at runtime
+ * without re-fetching from the original source. The default implementation
+ * uses a Postgres `plugin_artifacts` table (bytea); an S3 implementation
+ * can drop in via env config later.
+ *
+ * Lifecycle:
+ *   1. Originator's install handler calls `store(...)` after fetching the
+ *      tarball from the source. This commits in the same DB transaction
+ *      as the `plugins` row insert.
+ *   2. Every instance handling the install broadcast (incl. originator)
+ *      calls `fetch(...)` to get the tarball bytes, then runs `bun install`.
+ *   3. On uninstall, originator calls `delete(...)` to drop the row.
+ */
+export interface PluginArtifactStore {
+  store(input: {
+    pluginName: string;
+    version: string;
+    /** `null` for single-package installs; `string` for bundle siblings. */
+    bundleId?: string | null;
+    tarball: Uint8Array;
+  }): Promise<{ artifactId: string; contentHash: string }>;
+
+  /**
+   * Fetch by `(pluginName, version)`. Returns `undefined` if not present
+   * (e.g. the artifact has been pruned but the `plugins` row still exists —
+   * the caller is expected to fall back to refetching from the original
+   * `PluginSource`).
+   */
+  fetch(input: {
+    pluginName: string;
+    version: string;
+  }): Promise<{ tarball: Uint8Array; contentHash: string } | undefined>;
+
+  fetchById(artifactId: string): Promise<
+    | {
+        tarball: Uint8Array;
+        contentHash: string;
+        pluginName: string;
+        version: string;
+      }
+    | undefined
+  >;
+
+  /** Delete artifacts for a plugin (all versions). Used on uninstall. */
+  delete(input: { pluginName: string }): Promise<void>;
+
+  /** Delete artifacts for a whole bundle. */
+  deleteByBundle(input: { bundleId: string }): Promise<void>;
+
+  /** Hard cap (in bytes) the store will accept. Used for UI feedback. */
+  readonly maxArtifactSize: number;
+}

package/src/plugin-source.ts

@@ -0,0 +1,84 @@
+import {
+  
+  
+  
+  type InstallPackageMetadata,
+  type PluginBundleManifest,
+  type PluginSource,
+} from "@checkstack/common";
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Runtime-only types for the plugin installer pipeline.
+//
+// `PluginSource` (the discriminated union itself) lives in `@checkstack/common`
+// because it must be referenceable from contracts. The interfaces below are
+// implemented by services running on the backend, so they live here.
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface FetchedTarball {
+  tarball: Uint8Array;
+  packageJson: InstallPackageMetadata;
+  /**
+   * Set when the fetched tarball is a bundle (outer `.tgz` containing
+   * sibling tarballs and a `bundle.json`). The siblings array contains
+   * already-extracted per-package tarballs.
+   */
+  bundle?: {
+    manifest: PluginBundleManifest;
+    siblings: Array<{
+      tarball: Uint8Array;
+      packageJson: InstallPackageMetadata;
+    }>;
+  };
+}
+
+export interface InstalledArtifact {
+  /** The npm package name (matches `packageJson.name`) */
+  name: string;
+  /** Absolute path to the installed plugin under the runtime dir */
+  path: string;
+  /** The installed version */
+  version: string;
+}
+
+/**
+ * Per-source installer.
+ *
+ * Two-phase by design:
+ *   1. fetchTarball(source)         — pulls bytes; does NOT install anything.
+ *                                     Originator runs this once, persists the
+ *                                     bytes to plugin_artifacts, then broadcasts.
+ *   2. installFromArtifact({ ... }) — extracts the tarball into the plugin
+ *                                     runtime dir via `bun install ... --no-save
+ *                                     --ignore-scripts` (unless allowInstallScripts).
+ *                                     Every instance runs this when handling
+ *                                     the broadcast.
+ */
+export interface PluginInstaller {
+  fetchTarball(source: PluginSource): Promise<FetchedTarball>;
+  installFromArtifact(input: {
+    tarball: Uint8Array;
+    pluginName: string;
+    allowInstallScripts?: boolean;
+  }): Promise<InstalledArtifact>;
+}
+
+/**
+ * Registry of per-source installers. Indexed by `PluginSource["type"]`.
+ */
+export interface PluginInstallerRegistry {
+  forSource(type: PluginSource["type"]): PluginInstaller;
+  fetchTarball(source: PluginSource): Promise<FetchedTarball>;
+}
+
+// Re-export the source-related schemas/types from `@checkstack/common` so
+// backend code only needs one import path.
+
+export type {
+  NpmPluginSource,
+  TarballPluginSource,
+  GithubPluginSource,
+  CatalogPluginSource, PluginSource, InstallPackageMetadata, PluginBundleManifest,
+} from "@checkstack/common";
+
+export {installPackageMetadataSchema, pluginBundleManifestSchema, pluginSourceSchema} from "@checkstack/common";

package/src/types.ts

@@ -105,9 +105,8 @@ export interface AuthenticationStrategy {
   validate(request: Request): Promise<RealUser | ApplicationUser | undefined>;
 }
 
-export interface PluginInstaller {
-  install(packageName: string): Promise<{ name: string; path: string }>;
-}
+// Runtime-plugin installer types live in ./plugin-source.ts and are
+// re-exported via the package index.
 
 /**
  * Options for declarative route definitions (Deprecated, will be replaced by oRPC procedures).

package/src/plugin-admin-contract.ts

@@ -1,59 +0,0 @@
-import { z } from "zod";
-import { access, proc } from "@checkstack/common";
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Access Rules
-// ─────────────────────────────────────────────────────────────────────────────
-
-export const pluginAdminAccess = {
-  install: access("plugin", "manage", "Install new plugins from npm"),
-  deregister: access("plugin", "manage", "Deregister (uninstall) plugins"),
-};
-
-export const pluginAdminAccessRules = [
-  pluginAdminAccess.install,
-  pluginAdminAccess.deregister,
-];
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Contract
-// ─────────────────────────────────────────────────────────────────────────────
-
-export const pluginAdminContract = {
-  /**
-   * Install a plugin from npm and load it across all instances.
-   */
-  install: proc({
-    operationType: "mutation",
-    userType: "user",
-    access: [pluginAdminAccess.install],
-  })
-    .input(
-      z.object({
-        packageName: z.string().min(1, "Package name is required"),
-      })
-    )
-    .output(
-      z.object({
-        success: z.boolean(),
-        pluginId: z.string(),
-        path: z.string(),
-      })
-    ),
-
-  /**
-   * Deregister a plugin across all instances.
-   */
-  deregister: proc({
-    operationType: "mutation",
-    userType: "user",
-    access: [pluginAdminAccess.deregister],
-  })
-    .input(
-      z.object({
-        pluginId: z.string().min(1, "Plugin ID is required"),
-        deleteSchema: z.boolean().default(false),
-      })
-    )
-    .output(z.object({ success: z.boolean() })),
-};