@hachej/boring-core 0.1.78 → 0.1.80

package/dist/{PostgresModelBudgetStore-D5GHv0fE.d.ts → PostgresModelBudgetStore-BbqIF5TR.d.ts}

@@ -1,8 +1,12 @@
+import postgres from 'postgres';
 import { C as CoreConfig } from './types-DDnayJjI.js';
 import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
 
+type CoreMigrationSql = postgres.Sql;
 interface RunMigrationsOptions {
     migrationsFolder?: string;
+    /** Explicit app-owned migrations run under the same deployment lock. */
+    additionalMigrations?: Array<(sql: CoreMigrationSql) => Promise<void>>;
 }
 declare function runMigrations(config: CoreConfig, options?: RunMigrationsOptions): Promise<void>;
 

package/dist/app/server/index.d.ts

@@ -1,5 +1,5 @@
 import { RuntimeProvisioningContribution, RegisterAgentRoutesOptions } from '@hachej/boring-agent/server';
-import { DirPluginEntry, CreateWorkspaceAgentServerOptions } from '@hachej/boring-workspace/app/server';
+import { DirPluginEntry, CreateWorkspaceAgentServerOptions, WorkspaceAgentServerPluginContext } from '@hachej/boring-workspace/app/server';
 import { WorkspaceServerPlugin, WorkspaceBridgeOperationDefinition, WorkspaceBridgeHandler, WorkspaceBridgeRuntimeEnvOptions, WorkspaceBridgeCallRequest, WorkspaceBridgeCallResponse } from '@hachej/boring-workspace/server';
 import { FastifyInstance } from 'fastify';
 import { C as CoreConfig } from '../../types-DDnayJjI.js';
@@ -70,6 +70,8 @@ interface CreateCoreWorkspaceAgentServerOptions extends Omit<RegisterAgentRoutes
     serveFrontend?: boolean;
     /** Optional best-effort telemetry sink. Defaults to core's DB-backed env helper. */
     telemetry?: TelemetrySink;
+    /** Verified actor resolver exposed only to boot-time internal plugins. */
+    trustedPluginActorResolver?: NonNullable<WorkspaceAgentServerPluginContext['trusted']>['actorResolver'];
 }
 type AgentPiOptions = RegisterAgentRoutesOptions['pi'];
 declare function createCoreWorkspaceAgentServer(options?: CreateCoreWorkspaceAgentServerOptions): Promise<CoreWorkspaceAgentServer>;

package/dist/app/server/index.js

@@ -9,13 +9,13 @@ import {
   registerRoutes,
   registerSettingsRoutes,
   registerWorkspaceRoutes
-} from "../../chunk-DSENO5O4.js";
+} from "../../chunk-VB2N2DG5.js";
 import {
   PostgresUserStore,
   PostgresWorkspaceStore,
   createDatabase,
   telemetryEvents
-} from "../../chunk-JBEKMYST.js";
+} from "../../chunk-H5BQOHWR.js";
 import {
   noopTelemetry,
   safeCapture
@@ -768,15 +768,42 @@ async function createCoreWorkspaceAgentServer(options = {}) {
     ...defaultPluginDirEntries,
     ...options.plugins ?? []
   ];
-  const pluginResolveContext = {
+  let workspaceAgentDispatcherResolver;
+  const trustedDispatcherProxy = {
+    async resolve(actor, resolveOptions) {
+      if (!workspaceAgentDispatcherResolver) throw new Error("workspace agent dispatcher is not ready");
+      return await workspaceAgentDispatcherResolver.resolve(actor, resolveOptions);
+    },
+    async resolveWithWorkspace(actor, resolveOptions) {
+      if (!workspaceAgentDispatcherResolver?.resolveWithWorkspace) {
+        throw new Error("workspace agent dispatcher binding is not ready");
+      }
+      return await workspaceAgentDispatcherResolver.resolveWithWorkspace(actor, resolveOptions);
+    }
+  };
+  const basePluginResolveContext = {
     workspaceRoot: pluginWorkspaceRoot,
     bridge: createUnavailableCorePluginBridge()
   };
+  const trustedPluginActorResolver = options.trustedPluginActorResolver ?? (async (request) => {
+    const workspaceId = await resolveAuthorizedWorkspaceId(request, workspaceStore);
+    const userId = request.user?.id;
+    if (!userId) throw httpError("authentication required", 401);
+    return { workspaceId, userId };
+  });
+  const trustedPluginResolveContext = {
+    ...basePluginResolveContext,
+    trusted: {
+      workspaceAgentDispatcherResolver: trustedDispatcherProxy,
+      actorResolver: trustedPluginActorResolver,
+      sql
+    }
+  };
   const resolvedPlugins = await Promise.all(
     pluginEntries.map(async (entry) => {
       const plugin = await resolveOnePluginEntry(
         entry,
-        pluginResolveContext
+        "dir" in entry && entry.trust === "internal" ? trustedPluginResolveContext : basePluginResolveContext
       );
       assertWorkspaceBridgeHandlersTrusted(plugin, entry);
       return plugin;
@@ -902,7 +929,10 @@ async function createCoreWorkspaceAgentServer(options = {}) {
     getWorkspaceId: resolveWorkspaceId,
     getWorkspaceRoot: resolveRoot,
     getTrustedWorkspaceRoot: options.getTrustedWorkspaceRoot ?? (options.getWorkspaceRoot ? void 0 : async ({ workspaceId }) => await resolveWorkspaceRoot(workspaceRoot, workspaceId)),
-    onWorkspaceAgentDispatcher: options.onWorkspaceAgentDispatcher,
+    onWorkspaceAgentDispatcher: (resolver) => {
+      workspaceAgentDispatcherResolver = resolver;
+      options.onWorkspaceAgentDispatcher?.(resolver);
+    },
     provisionRuntime: async ({ provisioningAdapter, runtimeLayout, workspaceId, request, runtimeMode }) => {
       if (!provisioningAdapter) return void 0;
       const runtimePlugins = [

package/dist/{chunk-JBEKMYST.js → chunk-H5BQOHWR.js}

@@ -56,6 +56,9 @@ async function runMigrations(config, options) {
       await db.execute(sql.raw("CREATE EXTENSION IF NOT EXISTS pgcrypto"));
       const migrationsFolder = options?.migrationsFolder ?? defaultMigrationsFolder();
       await migrate(db, { migrationsFolder });
+      for (const migration of options?.additionalMigrations ?? []) {
+        await migration(migrationClient);
+      }
     } finally {
       await db.execute(sql.raw(`SELECT pg_advisory_unlock(${ADVISORY_LOCK_ID})`));
     }

package/dist/{chunk-DSENO5O4.js → chunk-VB2N2DG5.js}

@@ -13,7 +13,7 @@ import {
   workspaceRuntimes,
   workspaceSettings,
   workspaces
-} from "./chunk-JBEKMYST.js";
+} from "./chunk-H5BQOHWR.js";
 import {
   noopTelemetry,
   safeCapture

package/dist/server/db/index.d.ts

@@ -1,6 +1,6 @@
 import { U as UserStore, W as WorkspaceStore } from '../../types-Dm11Zm56.js';
 export { D as Database, c as createDatabase } from '../../types-Dm11Zm56.js';
-export { B as BudgetReservationAdmission, a as BudgetReservationAdmissionInput, b as BudgetReservationScope, F as FinishBudgetReservationInput, c as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, d as ModelBudgetExceededError, P as PostgresBudgetReservationStore, e as PostgresMeteringStore, f as PostgresModelBudgetStore, R as RecordUsageInput, g as RecordUsageResult, h as ReservationFinalStatus, i as ReserveBudgetInput, j as ReserveBudgetResult, k as ReserveInput, l as ReserveResult, m as RunMigrationsOptions, U as UserBudgetExceededError, r as runMigrations } from '../../PostgresModelBudgetStore-D5GHv0fE.js';
+export { B as BudgetReservationAdmission, a as BudgetReservationAdmissionInput, b as BudgetReservationScope, F as FinishBudgetReservationInput, c as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, d as ModelBudgetExceededError, P as PostgresBudgetReservationStore, e as PostgresMeteringStore, f as PostgresModelBudgetStore, R as RecordUsageInput, g as RecordUsageResult, h as ReservationFinalStatus, i as ReserveBudgetInput, j as ReserveBudgetResult, k as ReserveInput, l as ReserveResult, m as RunMigrationsOptions, U as UserBudgetExceededError, r as runMigrations } from '../../PostgresModelBudgetStore-BbqIF5TR.js';
 import { U as User, b as Workspace, E as ERROR_CODES, M as MemberRole, W as WorkspaceMember, c as WorkspaceInvite, d as WorkspaceRuntime, e as WorkspaceRuntimeResourceSelector, f as WorkspaceRuntimeResource, g as WorkspaceRuntimeResourceInput } from '../../types-DDnayJjI.js';
 import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
 import 'postgres';

package/dist/server/db/index.js

@@ -11,7 +11,7 @@ import {
   UserBudgetExceededError,
   createDatabase,
   runMigrations
-} from "../../chunk-JBEKMYST.js";
+} from "../../chunk-H5BQOHWR.js";
 import "../../chunk-QZGYKLXB.js";
 import "../../chunk-MLKGABMK.js";
 export {

package/dist/server/index.d.ts

@@ -9,8 +9,8 @@ import { IncomingMessage } from 'node:http';
 import { W as WorkspaceStore, C as CreateCoreAppOptions, D as Database, U as UserStore, a as WorkspaceProvisioner } from '../types-Dm11Zm56.js';
 export { A as AuthProvider, b as CapabilitiesContributor, P as ProvisionContext, d as ProvisionResult, c as createDatabase } from '../types-Dm11Zm56.js';
 import postgres from 'postgres';
-import { e as PostgresMeteringStore, C as CreditLedgerEntry } from '../PostgresModelBudgetStore-D5GHv0fE.js';
-export { B as BudgetReservationAdmission, a as BudgetReservationAdmissionInput, b as BudgetReservationScope, F as FinishBudgetReservationInput, c as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, d as ModelBudgetExceededError, P as PostgresBudgetReservationStore, f as PostgresModelBudgetStore, R as RecordUsageInput, g as RecordUsageResult, h as ReservationFinalStatus, i as ReserveBudgetInput, j as ReserveBudgetResult, k as ReserveInput, l as ReserveResult, U as UserBudgetExceededError, r as runMigrations } from '../PostgresModelBudgetStore-D5GHv0fE.js';
+import { m as RunMigrationsOptions, e as PostgresMeteringStore, C as CreditLedgerEntry } from '../PostgresModelBudgetStore-BbqIF5TR.js';
+export { B as BudgetReservationAdmission, a as BudgetReservationAdmissionInput, b as BudgetReservationScope, F as FinishBudgetReservationInput, c as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, d as ModelBudgetExceededError, P as PostgresBudgetReservationStore, f as PostgresModelBudgetStore, R as RecordUsageInput, g as RecordUsageResult, h as ReservationFinalStatus, i as ReserveBudgetInput, j as ReserveBudgetResult, k as ReserveInput, l as ReserveResult, U as UserBudgetExceededError, r as runMigrations } from '../PostgresModelBudgetStore-BbqIF5TR.js';
 import { T as TelemetrySink } from '../telemetry-DR18MeI0.js';
 import { AgentMeteringSink } from '@hachej/boring-agent/server';
 import 'better-auth';
@@ -361,7 +361,7 @@ interface WelcomeData {
 }
 declare function renderWelcome(data: WelcomeData): Promise<RenderedEmail>;
 
-interface RunCoreMigrationsFromEnvOptions {
+interface RunCoreMigrationsFromEnvOptions extends RunMigrationsOptions {
     loadConfigOptions?: LoadConfigOptions;
     log?: Pick<Console, 'log'>;
 }

package/dist/server/index.js

@@ -25,7 +25,7 @@ import {
   validateConfig,
   validatePasswordStrength,
   withUserSettingsWriteLock
-} from "../chunk-DSENO5O4.js";
+} from "../chunk-VB2N2DG5.js";
 import {
   InsufficientCreditError,
   ModelBudgetExceededError,
@@ -35,7 +35,7 @@ import {
   UserBudgetExceededError,
   createDatabase,
   runMigrations
-} from "../chunk-JBEKMYST.js";
+} from "../chunk-H5BQOHWR.js";
 import {
   noopTelemetry,
   safeCapture
@@ -78,7 +78,7 @@ function safeRedirect(url, config) {
 // src/server/migrations.ts
 async function runCoreMigrationsFromEnv(options = {}) {
   const config = await loadConfig(options.loadConfigOptions);
-  await runMigrations(config);
+  await runMigrations(config, options);
   options.log?.log("migrations complete");
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-core",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "type": "module",
   "license": "MIT",
   "description": "Foundation package for boring-ui-v2 apps: DB, auth, config, HTTP app factory, and frontend app shell.",
@@ -79,9 +79,9 @@
     "react-router-dom": "^7.18.0",
     "smol-toml": "^1.7.0",
     "zod": "^3.25.76",
-    "@hachej/boring-agent": "0.1.78",
-    "@hachej/boring-workspace": "0.1.78",
-    "@hachej/boring-ui-kit": "0.1.78"
+    "@hachej/boring-agent": "0.1.80",
+    "@hachej/boring-workspace": "0.1.80",
+    "@hachej/boring-ui-kit": "0.1.80"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",