@khirby/plugin-pokelo 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Khirby Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@khirby/plugin-pokelo",
+  "version": "1.0.0",
+  "description": "Khirby — Pokelo RAG knowledge base context for AI Compose",
+  "main": "src/index.ts",
+  "keywords": [
+    "khirby-plugin"
+  ],
+  "peerDependencies": {
+    "@khirby/plugin-host": "^1.0.0",
+    "@khirby/plugin-sdk": "^1.0.0",
+    "@nestjs/common": "*",
+    "@nestjs/swagger": "*",
+    "drizzle-orm": "*"
+  },
+  "types": "src/index.ts",
+  "files": [
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  }
+}

package/src/index.ts

@@ -0,0 +1,7 @@
+export { PokeloPlugin } from './pokelo.plugin';
+import { PokeloPlugin } from './pokelo.plugin';
+import type { CrmPlugin } from '@khirby/plugin-sdk';
+
+export function createPlugin(): CrmPlugin {
+  return new PokeloPlugin();
+}

package/src/migrations.ts

@@ -0,0 +1,23 @@
+/**
+ * Idempotent SQL for pokelo_settings.
+ * Statements are split on `;` — do not use DO $$ blocks.
+ */
+export const POKELO_MIGRATIONS_SQL = `
+CREATE TABLE IF NOT EXISTS pokelo_settings (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  base_url TEXT NOT NULL DEFAULT 'https://rag.bearly.pro/v1',
+  encrypted_token TEXT,
+  project_id TEXT,
+  project_ids TEXT[] NOT NULL DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+ALTER TABLE pokelo_settings ADD COLUMN IF NOT EXISTS project_ids TEXT[] NOT NULL DEFAULT '{}';
+
+UPDATE pokelo_settings
+SET project_ids = ARRAY[project_id]
+WHERE project_id IS NOT NULL
+  AND project_id <> ''
+  AND (project_ids IS NULL OR cardinality(project_ids) = 0)
+`;

package/src/pokelo-context.service.ts

@@ -0,0 +1,237 @@
+import { Injectable, Logger } from '@nestjs/common';
+import type { PokeloContextServiceLike, PokeloFetchOpts } from '../../../packages/plugin-host/src';
+import { PokeloSettingsService } from './pokelo-settings.service';
+
+const SNIPPET_LIMIT_TOTAL = 8;
+const SNIPPET_LIMIT_PER_PROJECT = 3;
+const SNIPPET_MAX_CHARS = 800;
+
+type McpToolResult = {
+  result?: {
+    content?: Array<{ type?: string; text?: string }>;
+  };
+  error?: { message?: string };
+};
+
+@Injectable()
+export class PokeloContextService implements PokeloContextServiceLike {
+  private readonly logger = new Logger(PokeloContextService.name);
+
+  constructor(private readonly settings: PokeloSettingsService) {}
+
+  async fetchContext(query: string, opts?: PokeloFetchOpts): Promise<string> {
+    try {
+      if (!(await this.settings.isPluginEnabled())) {
+        return '';
+      }
+
+      const creds = await this.settings.getCredentials();
+      if (!creds?.token || creds.projectIds.length === 0) {
+        return '';
+      }
+
+      const trimmed = query.trim();
+      if (!trimmed) {
+        return '';
+      }
+
+      const requested = opts?.projectIds?.filter(Boolean) ?? [];
+      const targetIds =
+        requested.length > 0
+          ? requested.filter((id) => creds.projectIds.includes(id))
+          : creds.projectIds;
+
+      if (targetIds.length === 0) {
+        return '';
+      }
+
+      const nameById = await this.resolveNames(creds.baseUrl, creds.token, targetIds);
+
+      const perProjectLimit =
+        targetIds.length === 1 ? SNIPPET_LIMIT_TOTAL : SNIPPET_LIMIT_PER_PROJECT;
+
+      const settled = await Promise.all(
+        targetIds.map(async (projectId) => {
+          try {
+            const text = await this.callMcpTool(creds.baseUrl, creds.token, 'search_documents', {
+              projectId,
+              query: trimmed.slice(0, 4000),
+              limit: perProjectLimit,
+            });
+            const matches = parseSearchMatches(text)
+              .slice(0, perProjectLimit)
+              .map((m) => m.slice(0, SNIPPET_MAX_CHARS).trim())
+              .filter(Boolean);
+            return { projectId, name: nameById.get(projectId) ?? projectId, matches };
+          } catch (err) {
+            this.logger.warn(`Pokelo search failed for ${projectId}: ${(err as Error).message}`);
+            return {
+              projectId,
+              name: nameById.get(projectId) ?? projectId,
+              matches: [] as string[],
+            };
+          }
+        }),
+      );
+
+      const labeled: string[] = [];
+      for (const block of settled) {
+        for (const m of block.matches) {
+          labeled.push(`[${block.name}] ${m}`);
+          if (labeled.length >= SNIPPET_LIMIT_TOTAL) break;
+        }
+        if (labeled.length >= SNIPPET_LIMIT_TOTAL) break;
+      }
+
+      if (labeled.length === 0) {
+        return '';
+      }
+
+      return [
+        '--- Kontekst z Pokelo ---',
+        ...labeled.map((s, i) => `[${i + 1}] ${s}`),
+        '--- Koniec kontekstu Pokelo ---',
+      ].join('\n\n');
+    } catch (err) {
+      this.logger.warn(`Pokelo fetchContext failed: ${(err as Error).message}`);
+      return '';
+    }
+  }
+
+  async listProjects(): Promise<Array<{ id: string; name: string }>> {
+    const creds = await this.settings.getCredentials();
+    if (!creds?.token) {
+      return [];
+    }
+
+    const text = await this.callMcpTool(creds.baseUrl, creds.token, 'list_projects', {
+      limit: 100,
+    });
+
+    return parseProjectList(text);
+  }
+
+  async listBoundProjects(): Promise<Array<{ id: string; name: string }>> {
+    const creds = await this.settings.getCredentials();
+    if (!creds?.token || creds.projectIds.length === 0) {
+      return [];
+    }
+    const all = await this.listProjects().catch(() => [] as Array<{ id: string; name: string }>);
+    const byId = new Map(all.map((p) => [p.id, p.name]));
+    return creds.projectIds.map((id) => ({ id, name: byId.get(id) ?? id }));
+  }
+
+  private async resolveNames(
+    baseUrl: string,
+    token: string,
+    projectIds: string[],
+  ): Promise<Map<string, string>> {
+    const map = new Map<string, string>();
+    try {
+      const text = await this.callMcpTool(baseUrl, token, 'list_projects', { limit: 100 });
+      for (const p of parseProjectList(text)) {
+        map.set(p.id, p.name);
+      }
+    } catch {
+      // names are cosmetic for snippet labels
+    }
+    for (const id of projectIds) {
+      if (!map.has(id)) map.set(id, id);
+    }
+    return map;
+  }
+
+  private async callMcpTool(
+    baseUrl: string,
+    token: string,
+    name: string,
+    args: Record<string, unknown>,
+  ): Promise<string> {
+    const url = `${baseUrl.replace(/\/$/, '')}/mcp`;
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+        Authorization: `Bearer ${token}`,
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/call',
+        params: { name, arguments: args },
+      }),
+    });
+
+    if (!response.ok) {
+      const errText = await response.text().catch(() => 'unknown error');
+      throw new Error(`Pokelo MCP ${response.status}: ${errText.slice(0, 200)}`);
+    }
+
+    const contentType = response.headers.get('content-type') ?? '';
+    const raw = await response.text();
+    const envelope = contentType.includes('text/event-stream')
+      ? parseSseJsonRpc(raw)
+      : (JSON.parse(raw) as McpToolResult);
+
+    if (envelope.error) {
+      throw new Error(envelope.error.message ?? 'Pokelo MCP tool error');
+    }
+
+    return envelope.result?.content?.[0]?.text ?? '';
+  }
+}
+
+/** Parse last JSON-RPC payload from an SSE body (`data: {...}` lines). */
+export function parseSseJsonRpc(raw: string): McpToolResult {
+  const dataLines: string[] = [];
+  for (const line of raw.split(/\r?\n/)) {
+    if (line.startsWith('data:')) {
+      dataLines.push(line.slice(5).trim());
+    }
+  }
+  if (dataLines.length === 0) {
+    return JSON.parse(raw) as McpToolResult;
+  }
+  for (let i = dataLines.length - 1; i >= 0; i--) {
+    if (dataLines[i] && dataLines[i] !== '[DONE]') {
+      return JSON.parse(dataLines[i]) as McpToolResult;
+    }
+  }
+  throw new Error('Empty SSE response from Pokelo MCP');
+}
+
+export function parseSearchMatches(text: string): string[] {
+  if (!text.trim()) return [];
+  try {
+    const parsed = JSON.parse(text) as {
+      matches?: Array<{ content?: string }>;
+      matchCount?: number;
+    };
+    if (Array.isArray(parsed.matches)) {
+      return parsed.matches
+        .map((m) => (typeof m.content === 'string' ? m.content : ''))
+        .filter(Boolean);
+    }
+  } catch {
+    // fall through
+  }
+  return [text];
+}
+
+export function parseProjectList(text: string): Array<{ id: string; name: string }> {
+  if (!text.trim()) return [];
+  try {
+    const parsed = JSON.parse(text) as {
+      items?: Array<{ id?: string; name?: string }>;
+    };
+    if (Array.isArray(parsed.items)) {
+      return parsed.items
+        .filter((p): p is { id: string; name: string } => !!p.id && !!p.name)
+        .map((p) => ({ id: p.id, name: p.name }));
+    }
+  } catch {
+    // ignore
+  }
+  return [];
+}

package/src/pokelo-crypto.ts

@@ -0,0 +1,60 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
+
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+
+function getKey(): Buffer {
+  const raw = process.env.POKELO_SECRETS_KEY?.trim();
+  if (!raw) {
+    throw new Error('POKELO_SECRETS_KEY is not set');
+  }
+  let buf: Buffer;
+  if (/^[0-9a-fA-F]{64}$/.test(raw)) {
+    buf = Buffer.from(raw, 'hex');
+  } else {
+    buf = Buffer.from(raw, 'base64');
+  }
+  if (buf.length !== 32) {
+    throw new Error(
+      "POKELO_SECRETS_KEY must be 32 bytes as hex (64 chars) or base64 — generate with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"",
+    );
+  }
+  return buf;
+}
+
+export function isPokeloSecretsKeyConfigured(): boolean {
+  try {
+    getKey();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Encrypts plaintext using AES-256-GCM.
+ * Returns a base64 string: iv(12) + ciphertext + tag(16)
+ */
+export function encrypt(plaintext: string): string {
+  const key = getKey();
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, encrypted, tag]).toString('base64');
+}
+
+/**
+ * Decrypts a base64 blob produced by `encrypt`.
+ */
+export function decrypt(ciphertext: string): string {
+  const key = getKey();
+  const buf = Buffer.from(ciphertext, 'base64');
+  const iv = buf.subarray(0, IV_BYTES);
+  const tag = buf.subarray(buf.length - TAG_BYTES);
+  const encrypted = buf.subarray(IV_BYTES, buf.length - TAG_BYTES);
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(tag);
+  return decipher.update(encrypted) + decipher.final('utf8');
+}

package/src/pokelo-settings.controller.ts

@@ -0,0 +1,74 @@
+import { Controller, Get, Patch, Body, UseGuards, Logger } from '@nestjs/common';
+import { ApiTags, ApiOperation } from '@nestjs/swagger';
+import {
+  SessionGuard,
+  PermissionGuard,
+  RequirePermission,
+  RequirePluginEnabled,
+  PluginEnabledGuard,
+  AppException,
+} from '../../../packages/plugin-host/src';
+import { PokeloSettingsService, POKELO_PLUGIN_NAME } from './pokelo-settings.service';
+import { PokeloContextService } from './pokelo-context.service';
+
+@ApiTags('plugins-pokelo')
+@Controller('plugins/pokelo')
+@UseGuards(SessionGuard, PermissionGuard, PluginEnabledGuard)
+@RequirePermission('integrations', 'manage')
+@RequirePluginEnabled(POKELO_PLUGIN_NAME)
+export class PokeloSettingsController {
+  private readonly logger = new Logger(PokeloSettingsController.name);
+
+  constructor(
+    private readonly settings: PokeloSettingsService,
+    private readonly context: PokeloContextService,
+  ) {}
+
+  @Get('settings')
+  @ApiOperation({ summary: 'Get Pokelo settings (token never returned)' })
+  getSettings() {
+    return this.settings.getSettings();
+  }
+
+  @Patch('settings')
+  @ApiOperation({
+    summary: 'Update Pokelo settings; auto-select the only project when none are bound',
+  })
+  async updateSettings(
+    @Body()
+    dto: {
+      token?: string;
+      baseUrl?: string;
+      projectIds?: string[];
+    },
+  ) {
+    let result = await this.settings.updateSettings(dto);
+
+    const shouldAutoPick =
+      !!dto.token?.trim() && dto.projectIds === undefined && result.projectIds.length === 0;
+
+    if (shouldAutoPick && result.tokenConfigured) {
+      try {
+        const projects = await this.context.listProjects();
+        if (projects.length === 1) {
+          result = await this.settings.updateSettings({ projectIds: [projects[0].id] });
+          this.logger.log(`Auto-selected Pokelo project ${projects[0].id}`);
+        }
+      } catch (err) {
+        this.logger.warn(`Could not auto-select Pokelo project: ${(err as Error).message}`);
+      }
+    }
+
+    return result;
+  }
+
+  @Get('projects')
+  @ApiOperation({ summary: 'List Pokelo projects visible to the configured token' })
+  async listProjects() {
+    const settings = await this.settings.getSettings();
+    if (!settings.tokenConfigured) {
+      throw AppException.badRequest('Pokelo token is not configured. Save your settings first.');
+    }
+    return this.context.listProjects();
+  }
+}

package/src/pokelo-settings.service.ts

@@ -0,0 +1,167 @@
+import { Injectable, Inject, Logger } from '@nestjs/common';
+import { eq } from 'drizzle-orm';
+import {
+  Db,
+  DB_TOKEN,
+  PLUGIN_REGISTRY,
+  type PluginRegistryLike,
+  AppException,
+} from '../../../packages/plugin-host/src';
+import { pokeloSettings } from './schema';
+import { encrypt, decrypt, isPokeloSecretsKeyConfigured } from './pokelo-crypto';
+
+export const POKELO_PLUGIN_NAME = 'crm_pokelo';
+export const DEFAULT_POKELO_BASE_URL = 'https://rag.bearly.pro/v1';
+
+export type PokeloSettingsPublic = {
+  baseUrl: string;
+  /** Bound Pokelo project IDs (multi-select). */
+  projectIds: string[];
+  tokenConfigured: boolean;
+};
+
+function normalizeProjectIds(ids: unknown): string[] {
+  if (!Array.isArray(ids)) return [];
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const raw of ids) {
+    if (typeof raw !== 'string') continue;
+    const id = raw.trim();
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+  }
+  return out;
+}
+
+/** Resolve bound IDs from row (project_ids preferred; legacy project_id fallback). */
+export function resolveBoundProjectIds(
+  row: {
+    projectIds?: string[] | null;
+    projectId?: string | null;
+  } | null,
+): string[] {
+  if (!row) return [];
+  const fromArray = normalizeProjectIds(row.projectIds);
+  if (fromArray.length > 0) return fromArray;
+  if (row.projectId?.trim()) return [row.projectId.trim()];
+  return [];
+}
+
+@Injectable()
+export class PokeloSettingsService {
+  private readonly logger = new Logger(PokeloSettingsService.name);
+
+  constructor(
+    @Inject(DB_TOKEN) private readonly db: Db,
+    @Inject(PLUGIN_REGISTRY) private readonly registry: PluginRegistryLike,
+  ) {}
+
+  async assertPluginEnabled(): Promise<void> {
+    const plugin = await this.registry.findByName(POKELO_PLUGIN_NAME);
+    if (!plugin?.enabled) {
+      throw AppException.pluginDisabled('pokelo');
+    }
+  }
+
+  async isPluginEnabled(): Promise<boolean> {
+    if (this.registry.isEnabled?.(POKELO_PLUGIN_NAME) === false) {
+      return false;
+    }
+    const plugin = await this.registry.findByName(POKELO_PLUGIN_NAME);
+    return !!plugin?.enabled;
+  }
+
+  private async getRow() {
+    const [row] = await this.db.select().from(pokeloSettings).limit(1);
+    return row ?? null;
+  }
+
+  async getSettings(): Promise<PokeloSettingsPublic> {
+    await this.assertPluginEnabled();
+    const row = await this.getRow();
+    return {
+      baseUrl: row?.baseUrl ?? DEFAULT_POKELO_BASE_URL,
+      projectIds: resolveBoundProjectIds(row),
+      tokenConfigured: !!row?.encryptedToken,
+    };
+  }
+
+  async updateSettings(dto: {
+    token?: string;
+    baseUrl?: string;
+    projectIds?: string[];
+  }): Promise<PokeloSettingsPublic> {
+    await this.assertPluginEnabled();
+
+    const existing = await this.getRow();
+
+    let encryptedToken: string | undefined = undefined;
+    if (dto.token !== undefined && dto.token.trim()) {
+      if (!isPokeloSecretsKeyConfigured()) {
+        throw AppException.badRequest('POKELO_SECRETS_KEY is not configured');
+      }
+      encryptedToken = encrypt(dto.token.trim());
+    }
+
+    const baseUrl = dto.baseUrl ?? existing?.baseUrl ?? DEFAULT_POKELO_BASE_URL;
+    if (
+      !baseUrl.startsWith('https://') &&
+      baseUrl !== 'http://localhost' &&
+      !baseUrl.startsWith('http://localhost:')
+    ) {
+      throw AppException.badRequest(
+        'baseUrl must use https:// (or http://localhost for local Pokelo)',
+      );
+    }
+
+    const projectIds =
+      dto.projectIds !== undefined
+        ? normalizeProjectIds(dto.projectIds)
+        : resolveBoundProjectIds(existing);
+
+    const patch: Record<string, unknown> = {
+      baseUrl,
+      projectIds,
+      // Keep legacy column in sync (first id or null) for older rows / tooling
+      projectId: projectIds[0] ?? null,
+      updatedAt: new Date(),
+    };
+
+    if (encryptedToken !== undefined) {
+      patch.encryptedToken = encryptedToken;
+    }
+
+    if (!existing) {
+      await this.db.insert(pokeloSettings).values(patch as any);
+    } else {
+      await this.db
+        .update(pokeloSettings)
+        .set(patch as any)
+        .where(eq(pokeloSettings.id, existing.id));
+    }
+
+    this.logger.log('Pokelo settings updated');
+    return this.getSettings();
+  }
+
+  /** Internal: credentials for MCP calls. Returns null if token missing. */
+  async getCredentials(): Promise<{
+    token: string;
+    baseUrl: string;
+    projectIds: string[];
+  } | null> {
+    const row = await this.getRow();
+    if (!row?.encryptedToken) return null;
+    try {
+      return {
+        token: decrypt(row.encryptedToken),
+        baseUrl: row.baseUrl || DEFAULT_POKELO_BASE_URL,
+        projectIds: resolveBoundProjectIds(row),
+      };
+    } catch (err) {
+      this.logger.warn(`Failed to decrypt Pokelo token: ${(err as Error).message}`);
+      return null;
+    }
+  }
+}

package/src/pokelo.module.ts

@@ -0,0 +1,21 @@
+import { Global, Module } from '@nestjs/common';
+import { POKELO_CONTEXT_SERVICE } from '../../../packages/plugin-host/src';
+import { PokeloSettingsService } from './pokelo-settings.service';
+import { PokeloContextService } from './pokelo-context.service';
+import { PokeloSettingsController } from './pokelo-settings.controller';
+
+/**
+ * @Global so AI Compose (sibling plugin module) can @Optional()-inject
+ * POKELO_CONTEXT_SERVICE (ADR-0022).
+ */
+@Global()
+@Module({
+  controllers: [PokeloSettingsController],
+  providers: [
+    PokeloSettingsService,
+    PokeloContextService,
+    { provide: POKELO_CONTEXT_SERVICE, useExisting: PokeloContextService },
+  ],
+  exports: [POKELO_CONTEXT_SERVICE],
+})
+export class PokeloModule {}

package/src/pokelo.plugin.ts

@@ -0,0 +1,32 @@
+import type { CrmPlugin, PluginContext, PluginSqlClient } from '@khirby/plugin-sdk';
+import { PokeloModule } from './pokelo.module';
+import { POKELO_MIGRATIONS_SQL } from './migrations';
+
+export class PokeloPlugin implements CrmPlugin {
+  name = 'crm_pokelo';
+  displayName = 'Pokelo Knowledge Base';
+  displayNameKey = 'plugins.pokelo.displayName';
+  description = 'Enriches AI Compose with firm knowledge from Pokelo RAG (mail + campaigns).';
+  descriptionKey = 'plugins.pokelo.description';
+  version = '1.0.0';
+
+  getNestModule() {
+    return PokeloModule;
+  }
+
+  async onMigrate(sql: PluginSqlClient): Promise<void> {
+    const statements = POKELO_MIGRATIONS_SQL.split(';')
+      .map((s) => s.trim())
+      .filter((s) => s.length > 0);
+
+    for (const statement of statements) {
+      await sql.unsafe(statement);
+    }
+  }
+
+  // Settings UI lives in Settings → Plugins (expand panel), not a sidebar route (ADR-0023).
+
+  onInit(ctx: PluginContext): void {
+    ctx.log('PokeloPlugin: initialized');
+  }
+}

package/src/pokelo.spec.ts

@@ -0,0 +1,322 @@
+import { encrypt, decrypt, isPokeloSecretsKeyConfigured } from './pokelo-crypto';
+import { parseSseJsonRpc, parseSearchMatches, parseProjectList } from './pokelo-context.service';
+import { PokeloSettingsService } from './pokelo-settings.service';
+import { PokeloContextService } from './pokelo-context.service';
+
+describe('pokelo-crypto', () => {
+  const HEX_KEY = 'c'.repeat(64);
+
+  beforeEach(() => {
+    process.env.POKELO_SECRETS_KEY = HEX_KEY;
+  });
+
+  afterEach(() => {
+    delete process.env.POKELO_SECRETS_KEY;
+  });
+
+  it('encrypts and decrypts back to the same plaintext', () => {
+    const plaintext = 'mcp_test_token';
+    const cipher = encrypt(plaintext);
+    expect(cipher).not.toEqual(plaintext);
+    expect(decrypt(cipher)).toEqual(plaintext);
+  });
+
+  it('isPokeloSecretsKeyConfigured returns false when key is unset', () => {
+    delete process.env.POKELO_SECRETS_KEY;
+    expect(isPokeloSecretsKeyConfigured()).toBe(false);
+  });
+
+  it('throws on missing key at encrypt time', () => {
+    delete process.env.POKELO_SECRETS_KEY;
+    expect(() => encrypt('anything')).toThrow('POKELO_SECRETS_KEY is not set');
+  });
+});
+
+describe('parseSseJsonRpc / parseSearchMatches / parseProjectList', () => {
+  it('parses SSE data lines', () => {
+    const raw = [
+      'event: message',
+      'data: {"jsonrpc":"2.0","id":1,"result":{"content":[{"type":"text","text":"{\\"matches\\":[]}"}]}}',
+      '',
+    ].join('\n');
+    const envelope = parseSseJsonRpc(raw);
+    expect(envelope.result?.content?.[0]?.text).toContain('matches');
+  });
+
+  it('parses search matches JSON', () => {
+    const matches = parseSearchMatches(
+      JSON.stringify({ matches: [{ content: 'Snippet A' }, { content: 'Snippet B' }] }),
+    );
+    expect(matches).toEqual(['Snippet A', 'Snippet B']);
+  });
+
+  it('parses project list JSON', () => {
+    const projects = parseProjectList(
+      JSON.stringify({ items: [{ id: 'p1', name: 'Bearly CRM' }, { id: 'x' }] }),
+    );
+    expect(projects).toEqual([{ id: 'p1', name: 'Bearly CRM' }]);
+  });
+});
+
+function makeSelectChain(returnValue: unknown[]) {
+  const chain: Record<string, unknown> = {};
+  const resolved = Promise.resolve(returnValue);
+  (chain as any).then = resolved.then.bind(resolved);
+  (chain as any).catch = resolved.catch.bind(resolved);
+  chain.select = () => chain;
+  chain.from = () => chain;
+  chain.where = () => chain;
+  chain.limit = () => chain;
+  return chain;
+}
+
+function makeMockDb(row?: unknown) {
+  const rows = row !== undefined ? [row] : [];
+  return {
+    select: () => makeSelectChain(rows),
+    insert: () => {
+      const chain: Record<string, unknown> = {};
+      const resolved = Promise.resolve([]);
+      (chain as any).then = resolved.then.bind(resolved);
+      chain.values = () => chain;
+      return chain;
+    },
+    update: () => {
+      const chain: Record<string, unknown> = {};
+      const resolved = Promise.resolve([]);
+      (chain as any).then = resolved.then.bind(resolved);
+      chain.set = () => chain;
+      chain.where = () => chain;
+      return chain;
+    },
+  };
+}
+
+function makeMockRegistry(enabled = true) {
+  return {
+    findByName: jest.fn().mockResolvedValue({ name: 'crm_pokelo', enabled, config: null }),
+    isEnabled: jest.fn().mockReturnValue(enabled),
+  };
+}
+
+describe('PokeloSettingsService', () => {
+  const HEX_KEY = 'd'.repeat(64);
+
+  beforeEach(() => {
+    process.env.POKELO_SECRETS_KEY = HEX_KEY;
+  });
+
+  afterEach(() => {
+    delete process.env.POKELO_SECRETS_KEY;
+  });
+
+  it('getSettings returns tokenConfigured false when empty', async () => {
+    const service = new PokeloSettingsService(makeMockDb() as any, makeMockRegistry() as any);
+    const settings = await service.getSettings();
+    expect(settings.tokenConfigured).toBe(false);
+    expect(settings.baseUrl).toBe('https://rag.bearly.pro/v1');
+  });
+
+  it('getCredentials decrypts stored token', async () => {
+    const enc = encrypt('mcp_secret');
+    const service = new PokeloSettingsService(
+      makeMockDb({
+        id: '1',
+        baseUrl: 'https://rag.bearly.pro/v1',
+        encryptedToken: enc,
+        projectId: 'proj-1',
+        projectIds: ['proj-1', 'proj-2'],
+      }) as any,
+      makeMockRegistry() as any,
+    );
+    const creds = await service.getCredentials();
+    expect(creds?.token).toBe('mcp_secret');
+    expect(creds?.projectIds).toEqual(['proj-1', 'proj-2']);
+  });
+
+  it('falls back to legacy projectId when projectIds empty', async () => {
+    const enc = encrypt('mcp_secret');
+    const service = new PokeloSettingsService(
+      makeMockDb({
+        id: '1',
+        baseUrl: 'https://rag.bearly.pro/v1',
+        encryptedToken: enc,
+        projectId: 'legacy-only',
+        projectIds: [],
+      }) as any,
+      makeMockRegistry() as any,
+    );
+    const settings = await service.getSettings();
+    expect(settings.projectIds).toEqual(['legacy-only']);
+  });
+});
+
+describe('PokeloContextService.fetchContext', () => {
+  const HEX_KEY = 'e'.repeat(64);
+
+  beforeEach(() => {
+    process.env.POKELO_SECRETS_KEY = HEX_KEY;
+    global.fetch = jest.fn();
+  });
+
+  afterEach(() => {
+    delete process.env.POKELO_SECRETS_KEY;
+    jest.restoreAllMocks();
+  });
+
+  it('returns empty string when plugin disabled', async () => {
+    const settings = new PokeloSettingsService(
+      makeMockDb({
+        encryptedToken: encrypt('t'),
+        projectIds: ['p'],
+        projectId: 'p',
+        baseUrl: 'https://rag.bearly.pro/v1',
+      }) as any,
+      makeMockRegistry(false) as any,
+    );
+    const ctx = new PokeloContextService(settings);
+    expect(await ctx.fetchContext('hello')).toBe('');
+    expect(global.fetch).not.toHaveBeenCalled();
+  });
+
+  it('returns formatted snippets on MCP success', async () => {
+    const settings = new PokeloSettingsService(
+      makeMockDb({
+        encryptedToken: encrypt('mcp_tok'),
+        projectIds: ['proj-uuid'],
+        projectId: 'proj-uuid',
+        baseUrl: 'https://rag.bearly.pro/v1',
+      }) as any,
+      makeMockRegistry(true) as any,
+    );
+
+    const listPayload = {
+      jsonrpc: '2.0',
+      id: 1,
+      result: {
+        content: [
+          {
+            type: 'text',
+            text: JSON.stringify({ items: [{ id: 'proj-uuid', name: 'Bearly CRM' }] }),
+          },
+        ],
+      },
+    };
+
+    const searchPayload = {
+      jsonrpc: '2.0',
+      id: 1,
+      result: {
+        content: [
+          {
+            type: 'text',
+            text: JSON.stringify({
+              matches: [{ content: 'Firm pricing is X' }, { content: 'SLA is Y' }],
+            }),
+          },
+        ],
+      },
+    };
+
+    (global.fetch as jest.Mock)
+      .mockResolvedValueOnce({
+        ok: true,
+        headers: { get: () => 'text/event-stream' },
+        text: async () => `data: ${JSON.stringify(listPayload)}\n\n`,
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        headers: { get: () => 'text/event-stream' },
+        text: async () => `data: ${JSON.stringify(searchPayload)}\n\n`,
+      });
+
+    const ctx = new PokeloContextService(settings);
+    const result = await ctx.fetchContext('pricing');
+    expect(result).toContain('--- Kontekst z Pokelo ---');
+    expect(result).toContain('[Bearly CRM]');
+    expect(result).toContain('Firm pricing is X');
+    expect(result).toContain('SLA is Y');
+    expect(result).toContain('--- Koniec kontekstu Pokelo ---');
+
+    const searchCall = (global.fetch as jest.Mock).mock.calls.find(
+      (c) => JSON.parse(c[1].body).params?.name === 'search_documents',
+    );
+    expect(searchCall[0]).toBe('https://rag.bearly.pro/v1/mcp');
+    expect(searchCall[1].headers.Accept).toContain('text/event-stream');
+    expect(searchCall[1].headers.Authorization).toBe('Bearer mcp_tok');
+  });
+
+  it('searches only requested projectIds subset', async () => {
+    const settings = new PokeloSettingsService(
+      makeMockDb({
+        encryptedToken: encrypt('mcp_tok'),
+        projectIds: ['a', 'b'],
+        baseUrl: 'https://rag.bearly.pro/v1',
+      }) as any,
+      makeMockRegistry(true) as any,
+    );
+
+    const listPayload = {
+      jsonrpc: '2.0',
+      result: {
+        content: [
+          {
+            type: 'text',
+            text: JSON.stringify({
+              items: [
+                { id: 'a', name: 'CRM' },
+                { id: 'b', name: 'Finsly' },
+              ],
+            }),
+          },
+        ],
+      },
+    };
+    const searchPayload = {
+      jsonrpc: '2.0',
+      result: {
+        content: [{ type: 'text', text: JSON.stringify({ matches: [{ content: 'Only A' }] }) }],
+      },
+    };
+
+    (global.fetch as jest.Mock).mockImplementation(async (_url: string, init: { body: string }) => {
+      const body = JSON.parse(init.body);
+      const payload = body.params?.name === 'list_projects' ? listPayload : searchPayload;
+      return {
+        ok: true,
+        headers: { get: () => 'application/json' },
+        text: async () => JSON.stringify(payload),
+      };
+    });
+
+    const ctx = new PokeloContextService(settings);
+    await ctx.fetchContext('q', { projectIds: ['a'] });
+
+    const searchBodies = (global.fetch as jest.Mock).mock.calls
+      .map((c) => JSON.parse(c[1].body))
+      .filter((b) => b.params?.name === 'search_documents');
+    expect(searchBodies).toHaveLength(1);
+    expect(searchBodies[0].params.arguments.projectId).toBe('a');
+  });
+
+  it('returns empty string on MCP error', async () => {
+    const settings = new PokeloSettingsService(
+      makeMockDb({
+        encryptedToken: encrypt('mcp_tok'),
+        projectIds: ['proj-uuid'],
+        projectId: 'proj-uuid',
+        baseUrl: 'https://rag.bearly.pro/v1',
+      }) as any,
+      makeMockRegistry(true) as any,
+    );
+
+    (global.fetch as jest.Mock).mockResolvedValue({
+      ok: false,
+      status: 401,
+      text: async () => 'Unauthorized',
+    });
+
+    const ctx = new PokeloContextService(settings);
+    expect(await ctx.fetchContext('pricing')).toBe('');
+  });
+});

package/src/schema.ts

@@ -0,0 +1,14 @@
+import { pgTable, uuid, text, timestamp } from 'drizzle-orm/pg-core';
+
+export const pokeloSettings = pgTable('pokelo_settings', {
+  id: uuid('id').defaultRandom().primaryKey(),
+  baseUrl: text('base_url').notNull().default('https://rag.bearly.pro/v1'),
+  encryptedToken: text('encrypted_token'),
+  /** @deprecated prefer projectIds — kept for migration from single-project installs */
+  projectId: text('project_id'),
+  projectIds: text('project_ids').array().notNull().default([]),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+});
+
+export type PokeloSettings = typeof pokeloSettings.$inferSelect;