@evermore.work/server 2026.509.0-canary.0

package/dist/services/plugin-capability-validator.js

@@ -0,0 +1,313 @@
+import { forbidden } from "../errors.js";
+import { logger } from "../middleware/logger.js";
+// ---------------------------------------------------------------------------
+// Capability requirement mappings
+// ---------------------------------------------------------------------------
+/**
+ * Maps high-level operations to the capabilities they require.
+ *
+ * When the bridge receives a call from a plugin worker, the host looks up
+ * the operation in this map and checks the plugin's declared capabilities.
+ * If any required capability is missing, the call is rejected.
+ *
+ * @see PLUGIN_SPEC.md §15 — Capability Model
+ */
+const OPERATION_CAPABILITIES = {
+    // Data read operations
+    "companies.list": ["companies.read"],
+    "companies.get": ["companies.read"],
+    "projects.list": ["projects.read"],
+    "projects.get": ["projects.read"],
+    "projects.managed.get": ["projects.managed"],
+    "projects.managed.reconcile": ["projects.managed"],
+    "projects.managed.reset": ["projects.managed"],
+    "routines.managed.get": ["routines.managed"],
+    "routines.managed.reconcile": ["routines.managed"],
+    "routines.managed.reset": ["routines.managed"],
+    "project.workspaces.list": ["project.workspaces.read"],
+    "project.workspaces.get": ["project.workspaces.read"],
+    "issues.list": ["issues.read"],
+    "issues.get": ["issues.read"],
+    "issues.relations.get": ["issue.relations.read"],
+    "issue.comments.list": ["issue.comments.read"],
+    "issue.comments.get": ["issue.comments.read"],
+    "agents.list": ["agents.read"],
+    "agents.get": ["agents.read"],
+    "agents.managed.get": ["agents.managed"],
+    "agents.managed.reconcile": ["agents.managed"],
+    "agents.managed.reset": ["agents.managed"],
+    "goals.list": ["goals.read"],
+    "goals.get": ["goals.read"],
+    "activity.list": ["activity.read"],
+    "activity.get": ["activity.read"],
+    "costs.list": ["costs.read"],
+    "costs.get": ["costs.read"],
+    "issues.summaries.getOrchestration": ["issues.orchestration.read"],
+    "db.namespace": ["database.namespace.read"],
+    "db.query": ["database.namespace.read"],
+    "localFolders.declarations": [],
+    "localFolders.configure": ["local.folders"],
+    "localFolders.status": ["local.folders"],
+    "localFolders.list": ["local.folders"],
+    "localFolders.readText": ["local.folders"],
+    "localFolders.writeTextAtomic": ["local.folders"],
+    // Data write operations
+    "issues.create": ["issues.create"],
+    "issues.update": ["issues.update"],
+    "issues.relations.setBlockedBy": ["issue.relations.write"],
+    "issues.relations.addBlockers": ["issue.relations.write"],
+    "issues.relations.removeBlockers": ["issue.relations.write"],
+    "issues.assertCheckoutOwner": ["issues.checkout"],
+    "issues.getSubtree": ["issue.subtree.read"],
+    "issues.requestWakeup": ["issues.wakeup"],
+    "issues.requestWakeups": ["issues.wakeup"],
+    "issue.comments.create": ["issue.comments.create"],
+    "issue.interactions.create": ["issue.interactions.create"],
+    "activity.log": ["activity.log.write"],
+    "metrics.write": ["metrics.write"],
+    "telemetry.track": ["telemetry.track"],
+    "db.migrate": ["database.namespace.migrate"],
+    "db.execute": ["database.namespace.write"],
+    // Plugin state operations
+    "plugin.state.get": ["plugin.state.read"],
+    "plugin.state.list": ["plugin.state.read"],
+    "plugin.state.set": ["plugin.state.write"],
+    "plugin.state.delete": ["plugin.state.write"],
+    // Runtime / Integration operations
+    "events.subscribe": ["events.subscribe"],
+    "events.emit": ["events.emit"],
+    "jobs.schedule": ["jobs.schedule"],
+    "jobs.cancel": ["jobs.schedule"],
+    "webhooks.receive": ["webhooks.receive"],
+    "http.request": ["http.outbound"],
+    "secrets.resolve": ["secrets.read-ref"],
+    // Agent tools
+    "agent.tools.register": ["agent.tools.register"],
+    "agent.tools.execute": ["agent.tools.register"],
+    // Environment runtime drivers
+    "environment.validateConfig": ["environment.drivers.register"],
+    "environment.probe": ["environment.drivers.register"],
+    "environment.acquireLease": ["environment.drivers.register"],
+    "environment.resumeLease": ["environment.drivers.register"],
+    "environment.releaseLease": ["environment.drivers.register"],
+    "environment.destroyLease": ["environment.drivers.register"],
+    "environment.realizeWorkspace": ["environment.drivers.register"],
+    "environment.execute": ["environment.drivers.register"],
+};
+/**
+ * Maps UI slot types to the capability required to register them.
+ *
+ * @see PLUGIN_SPEC.md §19 — UI Extension Model
+ */
+const UI_SLOT_CAPABILITIES = {
+    sidebar: "ui.sidebar.register",
+    sidebarPanel: "ui.sidebar.register",
+    projectSidebarItem: "ui.sidebar.register",
+    page: "ui.page.register",
+    detailTab: "ui.detailTab.register",
+    taskDetailView: "ui.detailTab.register",
+    dashboardWidget: "ui.dashboardWidget.register",
+    globalToolbarButton: "ui.action.register",
+    toolbarButton: "ui.action.register",
+    contextMenuItem: "ui.action.register",
+    commentAnnotation: "ui.commentAnnotation.register",
+    commentContextMenuItem: "ui.action.register",
+    settingsPage: "instance.settings.register",
+    routeSidebar: "ui.sidebar.register",
+};
+/**
+ * Launcher placement zones align with host UI surfaces and therefore inherit
+ * the same capability requirements as the equivalent slot type.
+ */
+const LAUNCHER_PLACEMENT_CAPABILITIES = {
+    page: "ui.page.register",
+    detailTab: "ui.detailTab.register",
+    taskDetailView: "ui.detailTab.register",
+    dashboardWidget: "ui.dashboardWidget.register",
+    sidebar: "ui.sidebar.register",
+    sidebarPanel: "ui.sidebar.register",
+    projectSidebarItem: "ui.sidebar.register",
+    globalToolbarButton: "ui.action.register",
+    toolbarButton: "ui.action.register",
+    contextMenuItem: "ui.action.register",
+    commentAnnotation: "ui.commentAnnotation.register",
+    commentContextMenuItem: "ui.action.register",
+    settingsPage: "instance.settings.register",
+};
+/**
+ * Maps feature declarations in the manifest to their required capabilities.
+ */
+const FEATURE_CAPABILITIES = {
+    tools: "agent.tools.register",
+    jobs: "jobs.schedule",
+    webhooks: "webhooks.receive",
+    database: "database.namespace.migrate",
+    environmentDrivers: "environment.drivers.register",
+    agents: "agents.managed",
+    projects: "projects.managed",
+    routines: "routines.managed",
+};
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a PluginCapabilityValidator.
+ *
+ * This service enforces capability gates for plugin operations.  The host
+ * uses it to verify that a plugin's declared capabilities permit the
+ * operation it is attempting, both at install time (manifest validation)
+ * and at runtime (bridge call gating).
+ *
+ * Usage:
+ * ```ts
+ * const validator = pluginCapabilityValidator();
+ *
+ * // Runtime: gate a bridge call
+ * validator.assertOperation(plugin.manifestJson, "issues.create");
+ *
+ * // Install time: validate manifest consistency
+ * const result = validator.validateManifestCapabilities(manifest);
+ * if (!result.allowed) {
+ *   throw badRequest("Missing capabilities", result.missing);
+ * }
+ * ```
+ */
+export function pluginCapabilityValidator() {
+    const log = logger.child({ service: "plugin-capability-validator" });
+    // -----------------------------------------------------------------------
+    // Internal helpers
+    // -----------------------------------------------------------------------
+    function capabilitySet(manifest) {
+        return new Set(manifest.capabilities);
+    }
+    function buildForbiddenMessage(manifest, operation, missing) {
+        return (`Plugin '${manifest.id}' is not allowed to perform '${operation}'. ` +
+            `Missing required capabilities: ${missing.join(", ")}`);
+    }
+    // -----------------------------------------------------------------------
+    // Public API
+    // -----------------------------------------------------------------------
+    return {
+        hasCapability(manifest, capability) {
+            return manifest.capabilities.includes(capability);
+        },
+        hasAllCapabilities(manifest, capabilities) {
+            const declared = capabilitySet(manifest);
+            const missing = capabilities.filter((cap) => !declared.has(cap));
+            return {
+                allowed: missing.length === 0,
+                missing,
+                pluginId: manifest.id,
+            };
+        },
+        hasAnyCapability(manifest, capabilities) {
+            const declared = capabilitySet(manifest);
+            return capabilities.some((cap) => declared.has(cap));
+        },
+        checkOperation(manifest, operation) {
+            const required = OPERATION_CAPABILITIES[operation];
+            if (!required) {
+                log.warn({ pluginId: manifest.id, operation }, "capability check for unknown operation – rejecting by default");
+                return {
+                    allowed: false,
+                    missing: [],
+                    operation,
+                    pluginId: manifest.id,
+                };
+            }
+            const declared = capabilitySet(manifest);
+            const missing = required.filter((cap) => !declared.has(cap));
+            if (missing.length > 0) {
+                log.debug({ pluginId: manifest.id, operation, missing }, "capability check failed");
+            }
+            return {
+                allowed: missing.length === 0,
+                missing,
+                operation,
+                pluginId: manifest.id,
+            };
+        },
+        assertOperation(manifest, operation) {
+            const result = this.checkOperation(manifest, operation);
+            if (!result.allowed) {
+                const msg = result.missing.length > 0
+                    ? buildForbiddenMessage(manifest, operation, result.missing)
+                    : `Plugin '${manifest.id}' attempted unknown operation '${operation}'`;
+                throw forbidden(msg);
+            }
+        },
+        assertCapability(manifest, capability) {
+            if (!this.hasCapability(manifest, capability)) {
+                throw forbidden(`Plugin '${manifest.id}' lacks required capability '${capability}'`);
+            }
+        },
+        checkUiSlot(manifest, slotType) {
+            const required = UI_SLOT_CAPABILITIES[slotType];
+            if (!required) {
+                return {
+                    allowed: false,
+                    missing: [],
+                    operation: `ui.${slotType}.register`,
+                    pluginId: manifest.id,
+                };
+            }
+            const has = manifest.capabilities.includes(required);
+            return {
+                allowed: has,
+                missing: has ? [] : [required],
+                operation: `ui.${slotType}.register`,
+                pluginId: manifest.id,
+            };
+        },
+        validateManifestCapabilities(manifest) {
+            const declared = capabilitySet(manifest);
+            const allMissing = [];
+            // Check feature declarations → required capabilities
+            for (const [feature, requiredCap] of Object.entries(FEATURE_CAPABILITIES)) {
+                const featureValue = manifest[feature];
+                if (Array.isArray(featureValue) && featureValue.length > 0) {
+                    if (!declared.has(requiredCap)) {
+                        allMissing.push(requiredCap);
+                    }
+                }
+            }
+            // Check UI slots → required capabilities
+            const uiSlots = manifest.ui?.slots ?? [];
+            if (uiSlots.length > 0) {
+                for (const slot of uiSlots) {
+                    const requiredCap = UI_SLOT_CAPABILITIES[slot.type];
+                    if (requiredCap && !declared.has(requiredCap)) {
+                        if (!allMissing.includes(requiredCap)) {
+                            allMissing.push(requiredCap);
+                        }
+                    }
+                }
+            }
+            // Check launcher declarations → required capabilities
+            const launchers = [
+                ...(manifest.launchers ?? []),
+                ...(manifest.ui?.launchers ?? []),
+            ];
+            if (launchers.length > 0) {
+                for (const launcher of launchers) {
+                    const requiredCap = LAUNCHER_PLACEMENT_CAPABILITIES[launcher.placementZone];
+                    if (requiredCap && !declared.has(requiredCap) && !allMissing.includes(requiredCap)) {
+                        allMissing.push(requiredCap);
+                    }
+                }
+            }
+            return {
+                allowed: allMissing.length === 0,
+                missing: allMissing,
+                pluginId: manifest.id,
+            };
+        },
+        getRequiredCapabilities(operation) {
+            return OPERATION_CAPABILITIES[operation] ?? [];
+        },
+        getUiSlotCapability(slotType) {
+            return UI_SLOT_CAPABILITIES[slotType];
+        },
+    };
+}
+//# sourceMappingURL=plugin-capability-validator.js.map

package/dist/services/plugin-capability-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-capability-validator.js","sourceRoot":"","sources":["../../src/services/plugin-capability-validator.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAgD;IAC1E,uBAAuB;IACvB,gBAAgB,EAAE,CAAC,gBAAgB,CAAC;IACpC,eAAe,EAAE,CAAC,gBAAgB,CAAC;IACnC,eAAe,EAAE,CAAC,eAAe,CAAC;IAClC,cAAc,EAAE,CAAC,eAAe,CAAC;IACjC,sBAAsB,EAAE,CAAC,kBAAkB,CAAC;IAC5C,4BAA4B,EAAE,CAAC,kBAAkB,CAAC;IAClD,wBAAwB,EAAE,CAAC,kBAAkB,CAAC;IAC9C,sBAAsB,EAAE,CAAC,kBAAkB,CAAC;IAC5C,4BAA4B,EAAE,CAAC,kBAAkB,CAAC;IAClD,wBAAwB,EAAE,CAAC,kBAAkB,CAAC;IAC9C,yBAAyB,EAAE,CAAC,yBAAyB,CAAC;IACtD,wBAAwB,EAAE,CAAC,yBAAyB,CAAC;IACrD,aAAa,EAAE,CAAC,aAAa,CAAC;IAC9B,YAAY,EAAE,CAAC,aAAa,CAAC;IAC7B,sBAAsB,EAAE,CAAC,sBAAsB,CAAC;IAChD,qBAAqB,EAAE,CAAC,qBAAqB,CAAC;IAC9C,oBAAoB,EAAE,CAAC,qBAAqB,CAAC;IAC7C,aAAa,EAAE,CAAC,aAAa,CAAC;IAC9B,YAAY,EAAE,CAAC,aAAa,CAAC;IAC7B,oBAAoB,EAAE,CAAC,gBAAgB,CAAC;IACxC,0BAA0B,EAAE,CAAC,gBAAgB,CAAC;IAC9C,sBAAsB,EAAE,CAAC,gBAAgB,CAAC;IAC1C,YAAY,EAAE,CAAC,YAAY,CAAC;IAC5B,WAAW,EAAE,CAAC,YAAY,CAAC;IAC3B,eAAe,EAAE,CAAC,eAAe,CAAC;IAClC,cAAc,EAAE,CAAC,eAAe,CAAC;IACjC,YAAY,EAAE,CAAC,YAAY,CAAC;IAC5B,WAAW,EAAE,CAAC,YAAY,CAAC;IAC3B,mCAAmC,EAAE,CAAC,2BAA2B,CAAC;IAClE,cAAc,EAAE,CAAC,yBAAyB,CAAC;IAC3C,UAAU,EAAE,CAAC,yBAAyB,CAAC;IACvC,2BAA2B,EAAE,EAAE;IAC/B,wBAAwB,EAAE,CAAC,eAAe,CAAC;IAC3C,qBAAqB,EAAE,CAAC,eAAe,CAAC;IACxC,mBAAmB,EAAE,CAAC,eAAe,CAAC;IACtC,uBAAuB,EAAE,CAAC,eAAe,CAAC;IAC1C,8BAA8B,EAAE,CAAC,eAAe,CAAC;IAEjD,wBAAwB;IACxB,eAAe,EAAE,CAAC,eAAe,CAAC;IAClC,eAAe,EAAE,CAAC,eAAe,CAAC;IAClC,+BAA+B,EAAE,CAAC,uBAAuB,CAAC;IAC1D,8BAA8B,EAAE,CAAC,uBAAuB,CAAC;IACzD,iCAAiC,EAAE,CAAC,uBAAuB,CAAC;IAC5D,4BAA4B,EAAE,CAAC,iBAAiB,CAAC;IACjD,mBAAmB,EAAE,CAAC,oBAAoB,CAAC;IAC3C,sBAAsB,EAAE,CAAC,eAAe,CAAC;IACzC,uBAAuB,EAAE,CAAC,eAAe,CAAC;IAC1C,uBAAuB,EAAE,CAAC,uBAAuB,CAAC;IAClD,2BAA2B,EAAE,CAAC,2BAA2B,CAAC;IAC1D,cAAc,EAAE,CAAC,oBAAoB,CAAC;IACtC,eAAe,EAAE,CAAC,eAAe,CAAC;IAClC,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;IACtC,YAAY,EAAE,CAAC,4BAA4B,CAAC;IAC5C,YAAY,EAAE,CAAC,0BAA0B,CAAC;IAE1C,0BAA0B;IAC1B,kBAAkB,EAAE,CAAC,mBAAmB,CAAC;IACzC,mBAAmB,EAAE,CAAC,mBAAmB,CAAC;IAC1C,kBAAkB,EAAE,CAAC,oBAAoB,CAAC;IAC1C,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;IAE7C,mCAAmC;IACnC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;IACxC,aAAa,EAAE,CAAC,aAAa,CAAC;IAC9B,eAAe,EAAE,CAAC,eAAe,CAAC;IAClC,aAAa,EAAE,CAAC,eAAe,CAAC;IAChC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;IACxC,cAAc,EAAE,CAAC,eAAe,CAAC;IACjC,iBAAiB,EAAE,CAAC,kBAAkB,CAAC;IAEvC,cAAc;IACd,sBAAsB,EAAE,CAAC,sBAAsB,CAAC;IAChD,qBAAqB,EAAE,CAAC,sBAAsB,CAAC;IAE/C,8BAA8B;IAC9B,4BAA4B,EAAE,CAAC,8BAA8B,CAAC;IAC9D,mBAAmB,EAAE,CAAC,8BAA8B,CAAC;IACrD,0BAA0B,EAAE,CAAC,8BAA8B,CAAC;IAC5D,yBAAyB,EAAE,CAAC,8BAA8B,CAAC;IAC3D,0BAA0B,EAAE,CAAC,8BAA8B,CAAC;IAC5D,0BAA0B,EAAE,CAAC,8BAA8B,CAAC;IAC5D,8BAA8B,EAAE,CAAC,8BAA8B,CAAC;IAChE,qBAAqB,EAAE,CAAC,8BAA8B,CAAC;CACxD,CAAC;AAEF;;;;GAIG;AACH,MAAM,oBAAoB,GAA+C;IACvE,OAAO,EAAE,qBAAqB;IAC9B,YAAY,EAAE,qBAAqB;IACnC,kBAAkB,EAAE,qBAAqB;IACzC,IAAI,EAAE,kBAAkB;IACxB,SAAS,EAAE,uBAAuB;IAClC,cAAc,EAAE,uBAAuB;IACvC,eAAe,EAAE,6BAA6B;IAC9C,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,oBAAoB;IACnC,eAAe,EAAE,oBAAoB;IACrC,iBAAiB,EAAE,+BAA+B;IAClD,sBAAsB,EAAE,oBAAoB;IAC5C,YAAY,EAAE,4BAA4B;IAC1C,YAAY,EAAE,qBAAqB;CACpC,CAAC;AAEF;;;GAGG;AACH,MAAM,+BAA+B,GAGjC;IACF,IAAI,EAAE,kBAAkB;IACxB,SAAS,EAAE,uBAAuB;IAClC,cAAc,EAAE,uBAAuB;IACvC,eAAe,EAAE,6BAA6B;IAC9C,OAAO,EAAE,qBAAqB;IAC9B,YAAY,EAAE,qBAAqB;IACnC,kBAAkB,EAAE,qBAAqB;IACzC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,oBAAoB;IACnC,eAAe,EAAE,oBAAoB;IACrC,iBAAiB,EAAE,+BAA+B;IAClD,sBAAsB,EAAE,oBAAoB;IAC5C,YAAY,EAAE,4BAA4B;CAC3C,CAAC;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAAqC;IAC7D,KAAK,EAAE,sBAAsB;IAC7B,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,kBAAkB;IAC5B,QAAQ,EAAE,4BAA4B;IACtC,kBAAkB,EAAE,8BAA8B;IAClD,MAAM,EAAE,gBAAgB;IACxB,QAAQ,EAAE,kBAAkB;IAC5B,QAAQ,EAAE,kBAAkB;CAC7B,CAAC;AA0GF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAErE,0EAA0E;IAC1E,mBAAmB;IACnB,0EAA0E;IAE1E,SAAS,aAAa,CAAC,QAAkC;QACvD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED,SAAS,qBAAqB,CAC5B,QAAkC,EAClC,SAAiB,EACjB,OAA2B;QAE3B,OAAO,CACL,WAAW,QAAQ,CAAC,EAAE,gCAAgC,SAAS,KAAK;YACpE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvD,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,aAAa;IACb,0EAA0E;IAE1E,OAAO;QACL,aAAa,CAAC,QAAQ,EAAE,UAAU;YAChC,OAAO,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;QAED,kBAAkB,CAAC,QAAQ,EAAE,YAAY;YACvC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC7B,OAAO;gBACP,QAAQ,EAAE,QAAQ,CAAC,EAAE;aACtB,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,QAAQ,EAAE,YAAY;YACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,cAAc,CAAC,QAAQ,EAAE,SAAS;YAChC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;YAEnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,IAAI,CACN,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,EACpC,+DAA+D,CAChE,CAAC;gBACF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,EAAE;oBACX,SAAS;oBACT,QAAQ,EAAE,QAAQ,CAAC,EAAE;iBACtB,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAE7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,KAAK,CACP,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAC7C,yBAAyB,CAC1B,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC7B,OAAO;gBACP,SAAS;gBACT,QAAQ,EAAE,QAAQ,CAAC,EAAE;aACtB,CAAC;QACJ,CAAC;QAED,eAAe,CAAC,QAAQ,EAAE,SAAS;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;oBACnC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;oBAC5D,CAAC,CAAC,WAAW,QAAQ,CAAC,EAAE,kCAAkC,SAAS,GAAG,CAAC;gBACzE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,gBAAgB,CAAC,QAAQ,EAAE,UAAU;YACnC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC9C,MAAM,SAAS,CACb,WAAW,QAAQ,CAAC,EAAE,gCAAgC,UAAU,GAAG,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,WAAW,CAAC,QAAQ,EAAE,QAAQ;YAC5B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,EAAE;oBACX,SAAS,EAAE,MAAM,QAAQ,WAAW;oBACpC,QAAQ,EAAE,QAAQ,CAAC,EAAE;iBACtB,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,OAAO;gBACL,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC9B,SAAS,EAAE,MAAM,QAAQ,WAAW;gBACpC,QAAQ,EAAE,QAAQ,CAAC,EAAE;aACtB,CAAC;QACJ,CAAC;QAED,4BAA4B,CAAC,QAAQ;YACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,UAAU,GAAuB,EAAE,CAAC;YAE1C,qDAAqD;YACrD,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAyC,CAAC,CAAC;gBACzE,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC/B,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,yCAAyC;YACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;oBAC3B,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpD,IAAI,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;4BACtC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;wBAC/B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,sDAAsD;YACtD,MAAM,SAAS,GAAG;gBAChB,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;gBAC7B,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,IAAI,EAAE,CAAC;aAClC,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;oBACjC,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;oBAC5E,IAAI,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;wBACnF,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;gBAChC,OAAO,EAAE,UAAU;gBACnB,QAAQ,EAAE,QAAQ,CAAC,EAAE;aACtB,CAAC;QACJ,CAAC;QAED,uBAAuB,CAAC,SAAS;YAC/B,OAAO,sBAAsB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC;QAED,mBAAmB,CAAC,QAAQ;YAC1B,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/services/plugin-config-validator.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @fileoverview Validates plugin instance configuration against its JSON Schema.
+ *
+ * Uses Ajv to validate `configJson` values against the `instanceConfigSchema`
+ * declared in a plugin's manifest. This ensures that invalid configuration is
+ * rejected at the API boundary, not discovered later at worker startup.
+ *
+ * @module server/services/plugin-config-validator
+ */
+import type { JsonSchema } from "@evermore.work/shared";
+export interface ConfigValidationResult {
+    valid: boolean;
+    errors?: {
+        field: string;
+        message: string;
+    }[];
+}
+/**
+ * Validate a config object against a JSON Schema.
+ *
+ * @param configJson - The configuration values to validate.
+ * @param schema - The JSON Schema from the plugin manifest's `instanceConfigSchema`.
+ * @returns Validation result with structured field errors on failure.
+ */
+export declare function validateInstanceConfig(configJson: Record<string, unknown>, schema: JsonSchema): ConfigValidationResult;
+//# sourceMappingURL=plugin-config-validator.d.ts.map

package/dist/services/plugin-config-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-config-validator.d.ts","sourceRoot":"","sources":["../../src/services/plugin-config-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,MAAM,EAAE,UAAU,GACjB,sBAAsB,CAwBxB"}

package/dist/services/plugin-config-validator.js

@@ -0,0 +1,41 @@
+/**
+ * @fileoverview Validates plugin instance configuration against its JSON Schema.
+ *
+ * Uses Ajv to validate `configJson` values against the `instanceConfigSchema`
+ * declared in a plugin's manifest. This ensures that invalid configuration is
+ * rejected at the API boundary, not discovered later at worker startup.
+ *
+ * @module server/services/plugin-config-validator
+ */
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
+/**
+ * Validate a config object against a JSON Schema.
+ *
+ * @param configJson - The configuration values to validate.
+ * @param schema - The JSON Schema from the plugin manifest's `instanceConfigSchema`.
+ * @returns Validation result with structured field errors on failure.
+ */
+export function validateInstanceConfig(configJson, schema) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const AjvCtor = Ajv.default ?? Ajv;
+    const ajv = new AjvCtor({ allErrors: true });
+    // ajv-formats v3 default export is a FormatsPlugin object; call it as a plugin.
+    const applyFormats = addFormats.default ?? addFormats;
+    applyFormats(ajv);
+    // Register the secret-ref format used by plugin manifests to mark fields that
+    // hold a Evermore secret UUID rather than a raw value. The format is a UI
+    // hint only — UUID validation happens in the secrets handler at resolve time.
+    ajv.addFormat("secret-ref", { validate: () => true });
+    const validate = ajv.compile(schema);
+    const valid = validate(configJson);
+    if (valid) {
+        return { valid: true };
+    }
+    const errors = (validate.errors ?? []).map((err) => ({
+        field: err.instancePath || "/",
+        message: err.message ?? "validation failed",
+    }));
+    return { valid: false, errors };
+}
+//# sourceMappingURL=plugin-config-validator.js.map

package/dist/services/plugin-config-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-config-validator.js","sourceRoot":"","sources":["../../src/services/plugin-config-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,GAAyB,MAAM,KAAK,CAAC;AAC5C,OAAO,UAAU,MAAM,aAAa,CAAC;AAQrC;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAmC,EACnC,MAAkB;IAElB,8DAA8D;IAC9D,MAAM,OAAO,GAAI,GAAW,CAAC,OAAO,IAAI,GAAG,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,gFAAgF;IAChF,MAAM,YAAY,GAAI,UAAkB,CAAC,OAAO,IAAI,UAAU,CAAC;IAC/D,YAAY,CAAC,GAAG,CAAC,CAAC;IAClB,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEnC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,CAAC;QAChE,KAAK,EAAE,GAAG,CAAC,YAAY,IAAI,GAAG;QAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,mBAAmB;KAC5C,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/services/plugin-database.d.ts

@@ -0,0 +1,49 @@
+import type { Db } from "@evermore.work/db";
+import type { EvermorePluginManifestV1, PluginDatabaseCoreReadTable } from "@evermore.work/shared";
+export type PluginDatabaseRuntimeResult<T = Record<string, unknown>> = {
+    rows?: T[];
+    rowCount?: number;
+};
+export declare function derivePluginDatabaseNamespace(pluginKey: string, namespaceSlug?: string): string;
+export declare function validatePluginMigrationStatement(statement: string, namespace: string, coreReadTables?: readonly PluginDatabaseCoreReadTable[]): void;
+export declare function validatePluginRuntimeQuery(query: string, namespace: string, coreReadTables?: readonly PluginDatabaseCoreReadTable[]): void;
+export declare function validatePluginRuntimeExecute(query: string, namespace: string): void;
+type PluginDatabaseClient = Pick<Db, "select" | "insert" | "update" | "execute">;
+type PluginDatabaseRootClient = PluginDatabaseClient & Partial<Pick<Db, "transaction">>;
+export interface ApplyPluginMigrationsOptions {
+    /**
+     * Persist failed migration ledger rows. Fresh install uses false because the
+     * caller owns a larger transaction and must roll back the plugin row and
+     * namespace together.
+     */
+    persistFailure?: boolean;
+}
+export declare function pluginDatabaseService(db: PluginDatabaseRootClient): {
+    ensureNamespace: (pluginId: string, manifest: EvermorePluginManifestV1) => Promise<{
+        id: string;
+        status: "active" | "migration_failed";
+        createdAt: Date;
+        updatedAt: Date;
+        pluginKey: string;
+        pluginId: string;
+        namespaceName: string;
+        namespaceMode: "schema";
+    } | null>;
+    applyMigrations(pluginId: string, manifest: EvermorePluginManifestV1, packageRoot: string, options?: ApplyPluginMigrationsOptions): Promise<{
+        id: string;
+        status: "active" | "migration_failed";
+        createdAt: Date;
+        updatedAt: Date;
+        pluginKey: string;
+        pluginId: string;
+        namespaceName: string;
+        namespaceMode: "schema";
+    } | null>;
+    getRuntimeNamespace: (pluginId: string) => Promise<string>;
+    query<T = Record<string, unknown>>(pluginId: string, statement: string, params?: unknown[]): Promise<T[]>;
+    execute(pluginId: string, statement: string, params?: unknown[]): Promise<{
+        rowCount: number;
+    }>;
+};
+export {};
+//# sourceMappingURL=plugin-database.d.ts.map

package/dist/services/plugin-database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-database.d.ts","sourceRoot":"","sources":["../../src/services/plugin-database.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAM5C,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAE5B,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,2BAA2B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI;IACrE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAUR;AAmID,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,cAAc,GAAE,SAAS,2BAA2B,EAAO,GAC1D,IAAI,CA4BN;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,cAAc,GAAE,SAAS,2BAA2B,EAAO,GAC1D,IAAI,CAwBN;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAyBnF;AA6CD,KAAK,oBAAoB,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;AACjF,KAAK,wBAAwB,GAAG,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;AAExF,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,wBAAwB;gCA0CvB,MAAM,YAAY,wBAAwB;;;;;;;;;;8BAgErE,MAAM,YACN,wBAAwB,eACrB,MAAM,YACV,4BAA4B;;;;;;;;;;oCAtDI,MAAM;UAgJrC,CAAC,sCAAsC,MAAM,aAAa,MAAM,WAAW,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;sBAQvF,MAAM,aAAa,MAAM,WAAW,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;EAOxG"}