@north-light/api 0.3.589 → 0.3.590

package/dist/api/client.d.ts

@@ -340,7 +340,10 @@ export declare class CrtrClient {
     /** Package (builtin and plugin) documents. */
     readonly documents: {
         browserAccess: () => Promise<DocumentAccessDTO>;
-        reconcilePackages: () => Promise<ReconcilePackagesDTO>;
+        /** `plugins` names the installs a cloud role resolves (a taken name then answers `409 name_taken`); omitted, it resolves all of the app's. */
+        reconcilePackages: (opts?: {
+            plugins?: string[];
+        }) => Promise<ReconcilePackagesDTO>;
     };
     /** A plugin's `crtr_app_` credential and the headers crtrd adds to its local HTTP calls. */
     readonly plugins: {

package/dist/api/client.js

@@ -620,7 +620,8 @@ export class CrtrClient {
     /** Package (builtin and plugin) documents. */
     documents = {
         browserAccess: () => this.request('GET', routes.documentsBrowserAccess()),
-        reconcilePackages: () => this.request('POST', routes.documentsReconcilePackages()),
+        /** `plugins` names the installs a cloud role resolves (a taken name then answers `409 name_taken`); omitted, it resolves all of the app's. */
+        reconcilePackages: (opts) => this.request('POST', routes.documentsReconcilePackages(), opts),
     };
     /** A plugin's `crtr_app_` credential and the headers crtrd adds to its local HTTP calls. */
     plugins = {

package/dist/api/contract.d.ts

@@ -1,5 +1,5 @@
 /** The contract level this build serves and requires. Written by `scripts/contract.mjs release`; never edit by hand. */
-export declare const CONTRACT_LEVEL = "1.43";
+export declare const CONTRACT_LEVEL = "1.44";
 /** Request header naming the one contract level the caller needs, e.g. `1.3`. Optional: absent means no check. */
 export declare const REQUIRED_CONTRACT_HEADER = "Crouter-Required-Contract";
 /** Response header listing the contract levels the server serves, comma-separated, one per major, e.g. `1.3`. */

package/dist/api/contract.js

@@ -12,7 +12,7 @@
 //
 // PURITY (spec §3.1): Node built-ins + `src/api/*` only.
 /** The contract level this build serves and requires. Written by `scripts/contract.mjs release`; never edit by hand. */
-export const CONTRACT_LEVEL = '1.43';
+export const CONTRACT_LEVEL = '1.44';
 /** Request header naming the one contract level the caller needs, e.g. `1.3`. Optional: absent means no check. */
 export const REQUIRED_CONTRACT_HEADER = 'Crouter-Required-Contract';
 /** Response header listing the contract levels the server serves, comma-separated, one per major, e.g. `1.3`. */

package/dist/api/dto/docs.d.ts

@@ -173,6 +173,11 @@ export interface ReconcilePackagesDTO {
             error: string;
         }>;
     };
+    /** cloud role: installed plugins whose documents are not on the canvas — `not_public` (the directory reads public marketplaces only), `not_found` (the directory does not list it) or `directory_unreachable` (the next sync publishes them) */
+    unavailable?: Array<{
+        plugin: string;
+        reason: 'not_public' | 'not_found' | 'directory_unreachable';
+    }>;
     /** the `crtr_app_` tokens after this pass: who holds one (with its scopes) and whose was removed */
     tokens?: {
         granted: Array<{

package/dist/api/dto/settings.d.ts

@@ -23,12 +23,33 @@ export interface PersonSettingsSnapshotDTO {
     /** Owner key (`user`, `profile:<id>`) → raw settings, with the `plugins` and `marketplaces` blocks rebuilt from their rows. */
     settings: Record<string, Record<string, unknown>>;
     state: Record<string, SettingsScopeStateDTO>;
+    /** App id (`app:<id>`) → that app's plugin and marketplace installs; `revision` covers only that block. */
+    apps: Record<string, SettingsAppInstallsDTO>;
+}
+export interface SettingsAppInstallsDTO {
+    plugins: Record<string, {
+        enabled?: boolean;
+        source_marketplace?: string;
+        version?: string;
+    }>;
+    marketplaces: Record<string, {
+        url?: string;
+        ref?: string;
+        installed_at?: string;
+    }>;
+    revision: string;
 }
 export type SettingsOpDTO = {
     op: 'settings.replace';
     owner: string;
     raw: Record<string, unknown>;
     ifRevision: string;
+} | {
+    op: 'app-plugins.replace';
+    app: string;
+    plugins: SettingsAppInstallsDTO['plugins'];
+    marketplaces: SettingsAppInstallsDTO['marketplaces'];
+    ifRevision: string;
 } | {
     op: 'state.write';
     owner: string;

package/dist/build-root.d.ts

@@ -23,6 +23,8 @@ export declare function personOnlyInvocation(argv: readonly string[]): string |
 /** Select a smaller canonical tree; `runCli` still parses, renders help, and reports errors. */
 export declare function isDaemonControlInvocation(argv: readonly string[]): boolean;
 /** `sys signin` and `sys signout` run when the stored sign-in is gone or a move is unfinished, the states in which the settings load would refuse. */
+/** `pkg plugin …` and `pkg market …` read and write the calling node's app install block, so a sandboxed node loads the settings snapshot for them. */
+export declare function isPkgInstallInvocation(argv: readonly string[]): boolean;
 export declare function isSignInInvocation(argv: readonly string[]): boolean;
 export declare function isJoinInvocation(argv: readonly string[]): boolean;
 export declare function isLayoutMigrationInvocation(argv: readonly string[]): boolean;

package/dist/build-root.js

@@ -268,7 +268,7 @@ const PERSON_ONLY_PATHS = [
     ['canvas', 'chord'], ['canvas', 'config'], ['canvas', 'use'], ['canvas', 'browse'], ['canvas', 'issue'],
 ];
 /** Leaves inside a person-only subtree that an app's node may still run: the command a node runs when the harness itself misbehaves. */
-const NODE_CALLABLE_PATHS = [['sys', 'feedback']];
+const NODE_CALLABLE_PATHS = [['sys', 'feedback'], ['pkg', 'plugin'], ['pkg', 'market']];
 function startsWithPath(tokens, path) {
     return path.every((name, index) => tokens[index] === name);
 }
@@ -283,6 +283,11 @@ export function personOnlyInvocation(argv) {
 /** Select a smaller canonical tree; `runCli` still parses, renders help, and reports errors. */
 export function isDaemonControlInvocation(argv) { return isSysInvocation(argv, 'daemon'); }
 /** `sys signin` and `sys signout` run when the stored sign-in is gone or a move is unfinished, the states in which the settings load would refuse. */
+/** `pkg plugin …` and `pkg market …` read and write the calling node's app install block, so a sandboxed node loads the settings snapshot for them. */
+export function isPkgInstallInvocation(argv) {
+    const tokens = argv.slice(2).filter((token) => !GLOBAL_TOKENS.has(token));
+    return tokens[0] === 'pkg' && (tokens[1] === 'plugin' || tokens[1] === 'market');
+}
 export function isSignInInvocation(argv) { return isSysInvocation(argv, 'signin') || isSysInvocation(argv, 'signout'); }
 export function isJoinInvocation(argv) { return isSysInvocation(argv, 'join'); }
 export function isLayoutMigrationInvocation(argv) { return isSysInvocation(argv, 'migrate'); }

package/dist/commands/pkg/app-installs.d.ts

@@ -0,0 +1,53 @@
+export declare const appId: () => string;
+export declare function installAppPlugin(ref: string): Promise<{
+    name: string;
+    app: string;
+    warnings?: string[];
+}>;
+export declare function removeAppPlugin(name: string): Promise<{
+    app: string;
+}>;
+export declare function setAppPluginEnabled(name: string, enabled: boolean): Promise<{
+    name: string;
+    app: string;
+    enabled: boolean;
+    warnings?: string[];
+}>;
+/** Refresh the documents of one install, or all of the app's: the directory re-reads its marketplaces hourly and the control plane converges on its next sync. */
+export declare function updateAppPlugins(name: string | undefined): Promise<{
+    updated: Array<{
+        name: string;
+        warnings?: string[];
+    }>;
+}>;
+/** The app's installs. Each says why it has no documents when the directory cannot serve it (a name another source holds, a private marketplace, a directory that is down). */
+export declare function listAppPlugins(includeDisabled: boolean): Promise<{
+    items: Array<{
+        name: string;
+        scope: string;
+        enabled: boolean;
+        source_marketplace?: string;
+        version?: string;
+        documents?: string;
+    }>;
+    next_cursor: null;
+    total: number;
+}>;
+export declare function addAppMarketplace(url: string, ref: string | undefined): Promise<{
+    name: string;
+    app: string;
+}>;
+/** The marketplaces the app has registered, in the shape `pkg market list` prints (no clone path: a sandbox holds none). */
+export declare function listAppMarketplaces(): {
+    items: Array<{
+        name: string;
+        scope: string;
+        url: string | undefined;
+        ref: string | undefined;
+    }>;
+    next_cursor: null;
+    total: number;
+};
+export declare function removeAppMarketplace(name: string): Promise<{
+    app: string;
+}>;

package/dist/commands/pkg/app-installs.js

@@ -0,0 +1,125 @@
+// `crtr pkg plugin …` and `crtr pkg market …` in a sandboxed node: the node's plugins are its app's install block on the control plane
+// (`app-plugins.replace`), not a directory on disk. The sandbox clones the plugin code itself at its next start; the documents come from the
+// directory through `reconcile-packages`.
+import { ApiError } from '../../api/errors.js';
+import { envGrantee } from '../../shared/env.js';
+import { deriveNameFromUrl } from '../../core/git.js';
+import { notFound, usage, CrtrError } from '../../core/errors.js';
+import { nowIso } from '../../core/fs-utils.js';
+import { appRevisionOf, currentSnapshot, writeSettings } from '../../core/scoped-state/person-store.js';
+import { ExitCode } from '../../types.js';
+import { cliClient, rethrowAsCliError } from '../api-client.js';
+const OFFICIAL = { name: 'crouter-official-marketplace', url: 'https://github.com/crouton-labs/crouter-official-marketplace.git' };
+export const appId = () => envGrantee() ?? 'app:terminal';
+const block = () => currentSnapshot().apps[appId()] ?? { plugins: {}, marketplaces: {}, revision: 'absent' };
+async function change(mutate) {
+    const app = appId();
+    await writeSettings((snapshot) => {
+        const current = snapshot.apps[app];
+        const next = structuredClone({ plugins: current?.plugins ?? {}, marketplaces: current?.marketplaces ?? {} });
+        mutate(next);
+        return [{ op: 'app-plugins.replace', app, plugins: next.plugins, marketplaces: next.marketplaces, ifRevision: appRevisionOf(current) }];
+    });
+}
+/** Ask the control plane to resolve the named installs against the directory. A taken name or an unlisted plugin refuses the install: the caller removes its row. */
+async function resolve(plugins) {
+    return await resolveRaw(plugins).catch((err) => rethrowAsCliError(err));
+}
+async function resolveRaw(plugins) {
+    return await cliClient().documents.reconcilePackages({ plugins });
+}
+/** Resolve all of the app's installs: a taken or unlisted name is reported, never refused. */
+async function resolveAll() {
+    return await cliClient().documents.reconcilePackages().catch((err) => rethrowAsCliError(err));
+}
+function unavailableWarnings(report, name) {
+    const why = { not_public: 'installed without documents: the directory reads public marketplaces only', not_found: 'installed without documents: the directory does not list it', directory_unreachable: 'installed; its documents arrive on the next sync because the directory is unreachable' };
+    const unavailable = (report.unavailable ?? []).filter((u) => name === undefined || u.plugin === name).map((u) => `${u.plugin}: ${why[u.reason]}`);
+    // A published package can be partial: files that did not parse (paths start with the plugin's name) and kinds another owner holds.
+    const invalid = report.invalid.filter((i) => name === undefined || i.path.startsWith(`${name}/`)).map((i) => `${i.path.split('/')[0]}: ${i.path} was not published: ${i.error}`);
+    const refused = (report.kinds?.refused ?? []).filter((k) => name === undefined || k.plugin === name).map((k) => `${k.plugin}: kind ${k.kind} not registered: ${k.message}`);
+    return [...unavailable, ...invalid, ...refused];
+}
+export async function installAppPlugin(ref) {
+    const parts = ref.split('/');
+    if (parts.length !== 2 || parts[0] === '' || parts[1] === '')
+        throw usage(`invalid plugin install ref: ${ref}\nA sandboxed node installs marketplace/plugin from a marketplace added with \`crtr pkg market add\`.`);
+    const [market, name] = parts;
+    const before = block();
+    if (before.plugins[name] !== undefined)
+        throw new CrtrError('conflict', `plugin "${name}" is already installed in ${appId()}`, ExitCode.GENERAL);
+    const known = before.marketplaces[market] ?? (market === OFFICIAL.name ? { url: OFFICIAL.url, ref: 'main', installed_at: nowIso() } : undefined);
+    if (known === undefined)
+        throw notFound(`marketplace not found: ${market}`);
+    await change((b) => { b.marketplaces[market] = known; b.plugins[name] = { enabled: true, source_marketplace: market }; });
+    try {
+        const report = await resolveRaw([name]);
+        const warnings = unavailableWarnings(report, name);
+        return { name, app: appId(), ...(warnings.length > 0 ? { warnings } : {}) };
+    }
+    catch (error) {
+        // Only the directory's `name_taken` and `not_found` refuse the install (the row was written ahead of its answer); anything else leaves it standing.
+        if (!(error instanceof ApiError) || (error.code !== 'name_taken' && error.code !== 'not_found'))
+            return rethrowAsCliError(error);
+        await change((b) => { delete b.plugins[name]; if (before.marketplaces[market] === undefined && !Object.values(b.plugins).some((p) => p.source_marketplace === market))
+            delete b.marketplaces[market]; });
+        if (error.code === 'not_found')
+            throw notFound(error.message);
+        throw new CrtrError('conflict', `${error.message}; uninstall that marketplace's plugin or pick another`, ExitCode.GENERAL, { plugin: name });
+    }
+}
+export async function removeAppPlugin(name) {
+    if (block().plugins[name] === undefined)
+        throw notFound(`plugin not found: ${name}`);
+    await change((b) => { delete b.plugins[name]; });
+    return { app: appId() };
+}
+export async function setAppPluginEnabled(name, enabled) {
+    if (block().plugins[name] === undefined)
+        throw notFound(`plugin not found: ${name}`);
+    await change((b) => { b.plugins[name] = { ...b.plugins[name], enabled }; });
+    const warnings = enabled ? unavailableWarnings(await resolve([name]), name) : [];
+    return { name, app: appId(), enabled, ...(warnings.length > 0 ? { warnings } : {}) };
+}
+/** Refresh the documents of one install, or all of the app's: the directory re-reads its marketplaces hourly and the control plane converges on its next sync. */
+export async function updateAppPlugins(name) {
+    const installed = Object.keys(block().plugins);
+    if (name !== undefined && !installed.includes(name))
+        throw notFound(`plugin not found: ${name}`);
+    const names = name === undefined ? installed : [name];
+    const report = names.length === 0 ? undefined : name === undefined ? await resolveAll() : await resolve(names);
+    const conflicted = (n) => (report?.conflicts ?? []).filter((c) => c.plugin === n).map((c) => `${n}: no documents: ${c.message}`);
+    return { updated: names.map((n) => { const warnings = report === undefined ? [] : [...conflicted(n), ...unavailableWarnings(report, n)]; return { name: n, ...(warnings.length > 0 ? { warnings } : {}) }; }) };
+}
+/** The app's installs. Each says why it has no documents when the directory cannot serve it (a name another source holds, a private marketplace, a directory that is down). */
+export async function listAppPlugins(includeDisabled) {
+    const entries = Object.entries(block().plugins).filter(([, p]) => includeDisabled || p.enabled !== false).sort(([a], [b]) => a.localeCompare(b));
+    const enabled = entries.filter(([, p]) => p.enabled !== false).map(([n]) => n);
+    const report = enabled.length === 0 ? undefined : await resolveAll();
+    const why = (name) => {
+        const conflict = report?.conflicts.find((c) => c.plugin === name);
+        if (conflict !== undefined)
+            return `no documents: ${conflict.message}`;
+        return report === undefined ? undefined : unavailableWarnings(report, name)[0];
+    };
+    const items = entries.map(([name, p]) => ({ name, scope: appId(), enabled: p.enabled !== false, ...(p.source_marketplace === undefined ? {} : { source_marketplace: p.source_marketplace }), ...(p.version === undefined ? {} : { version: p.version }), ...(why(name) === undefined ? {} : { documents: why(name) }) }));
+    return { items, next_cursor: null, total: items.length };
+}
+export async function addAppMarketplace(url, ref) {
+    const name = deriveNameFromUrl(url);
+    await change((b) => { b.marketplaces[name] = { url, ref: ref ?? 'main', installed_at: nowIso() }; });
+    return { name, app: appId() };
+}
+/** The marketplaces the app has registered, in the shape `pkg market list` prints (no clone path: a sandbox holds none). */
+export function listAppMarketplaces() {
+    const items = Object.entries(block().marketplaces).sort(([a], [b]) => a.localeCompare(b)).map(([name, m]) => ({ name, scope: appId(), url: m.url, ref: m.ref }));
+    return { items, next_cursor: null, total: items.length };
+}
+export async function removeAppMarketplace(name) {
+    if (block().marketplaces[name] === undefined)
+        throw notFound(`marketplace not found: ${name}`);
+    await change((b) => { delete b.marketplaces[name]; for (const [p, e] of Object.entries(b.plugins))
+        if (e.source_marketplace === name)
+            delete b.plugins[p]; });
+    return { app: appId() };
+}

package/dist/commands/pkg/market-inspect.js

@@ -3,6 +3,8 @@ import { notFound } from '../../core/errors.js';
 import { paginate } from '../../core/pagination.js';
 import { listInstalledPlugins, listInstalledMarketplaces, listAllMarketplaces, findMarketplaceByName, } from '../../core/resolver.js';
 import { resolveScopeArg, projectScopeRoot } from '../../core/scope.js';
+import { isSandboxedNode } from '../../shared/env.js';
+import { listAppMarketplaces } from './app-installs.js';
 export const marketList = defineLeaf({
     name: 'list',
     description: 'list registered marketplaces',
@@ -24,6 +26,8 @@ export const marketList = defineLeaf({
         effects: ['None. Read-only.'],
     },
     run: async (input) => {
+        if (isSandboxedNode())
+            return listAppMarketplaces();
         const scopeInput = input['scope'];
         const limitRaw = input['limit'];
         const limit = limitRaw !== undefined ? Math.min(Math.max(1, limitRaw), 200) : 50;

package/dist/commands/pkg/market-manage.js

@@ -4,6 +4,8 @@ import { defineLeaf } from '../../core/command.js';
 import { general, notFound } from '../../core/errors.js';
 import { listAllMarketplaces, listAllPlugins, findMarketplaceByName } from '../../core/resolver.js';
 import { resolveScopeArg, requireScopeRoot, marketplacesDir, pluginsDir } from '../../core/scope.js';
+import { isSandboxedNode } from '../../shared/env.js';
+import { addAppMarketplace, removeAppMarketplace } from './app-installs.js';
 import { updateConfig, updateState, ensureScopeInitialized, readConfig } from '../../core/config.js';
 import { pathExists, ensureDir, removePath, isSymlink, nowIso, readSymlinkTarget } from '../../core/fs-utils.js';
 import { clone, deriveNameFromUrl, currentSha, gitSync, isGitRepo } from '../../core/git.js';
@@ -72,6 +74,8 @@ export const marketAdd = defineLeaf({
         const url = input['url'];
         const ref = input['ref'];
         const scopeInput = input['scope'];
+        if (isSandboxedNode())
+            return await addAppMarketplace(url, ref);
         return addMarketplace({ url, ref, scope: resolveInstallScope(scopeInput) });
     },
 });
@@ -92,6 +96,8 @@ export const marketRemove = defineLeaf({
     },
     run: async (input) => {
         const name = input['name'];
+        if (isSandboxedNode())
+            return await removeAppMarketplace(name);
         const scopeInput = input['scope'];
         let targetScope;
         let mktRoot;

package/dist/commands/pkg/plugin-inspect.js

@@ -1,5 +1,7 @@
 import { defineLeaf } from '../../core/command.js';
 import { notFound } from '../../core/errors.js';
+import { isSandboxedNode } from '../../shared/env.js';
+import { listAppPlugins } from './app-installs.js';
 import { paginate } from '../../core/pagination.js';
 import { listInstalledPlugins, findPluginByName, } from '../../core/resolver.js';
 import { packageFiles } from '../../core/graph/package-files.js';
@@ -34,16 +36,18 @@ export const pluginList = defineLeaf({
             { kind: 'flag', name: 'cursor', type: 'string', required: false, constraint: 'Opaque token from next_cursor. Omit on first call.' },
         ],
         output: [
-            { name: 'items', type: 'object[]', required: true, constraint: 'Each: {name, scope, version?, enabled, transport, source_marketplace?, path}. transport is exec or http for command plugins, null for docs-only plugins. Sorted by scope then name ascending.' },
+            { name: 'items', type: 'object[]', required: true, constraint: 'Each: {name, scope, version?, enabled, transport, source_marketplace?, path, documents?}. documents, on a sandboxed node, says why an install has no documents. transport is exec or http for command plugins, null for docs-only plugins. Sorted by scope then name ascending.' },
             { name: 'next_cursor', type: 'string | null', required: true, constraint: 'null means no more items.' },
             { name: 'total', type: 'integer | null', required: true, constraint: 'Exact when cheap; null otherwise.' },
         ],
         outputKind: 'object',
-        effects: ['None. Read-only.'],
+        effects: ['None on a Mac. On a sandboxed node it asks the directory about each enabled install, which publishes what the directory serves.'],
     },
     run: async (input) => {
         const scopeInput = input['scope'];
         const includeDisabled = input['includeDisabled'] ?? false;
+        if (isSandboxedNode())
+            return await listAppPlugins(includeDisabled);
         const limitRaw = input['limit'];
         const limit = limitRaw !== undefined ? Math.min(Math.max(1, limitRaw), 200) : 50;
         const cursor = input['cursor'];

package/dist/commands/pkg/plugin-manage.js

@@ -5,6 +5,8 @@ import { dirname, join, resolve, isAbsolute, relative } from 'node:path';
 import { renameSync } from 'node:fs';
 import { defineLeaf } from '../../core/command.js';
 import { cliClient, rethrowAsCliError } from '../api-client.js';
+import { isSandboxedNode } from '../../shared/env.js';
+import { installAppPlugin, removeAppPlugin, setAppPluginEnabled, updateAppPlugins } from './app-installs.js';
 import { notFound, usage, general, network, CrtrError } from '../../core/errors.js';
 import { findMarketplaceByName, findPluginByName, listAllPlugins } from '../../core/resolver.js';
 import { pluginsDir, ensureProjectScopeRoot, userScopeRoot, resolveScopeArg, projectScopeRoot, requireScopeRoot, } from '../../core/scope.js';
@@ -810,6 +812,11 @@ export const pluginInstall = defineLeaf({
         const authEnv = input['authEnv'];
         const scopeInput = input['scope'];
         const gitRef = input['ref'];
+        if (isSandboxedNode()) {
+            if (rawRef === undefined || endpoint !== undefined || name !== undefined || authEnv !== undefined || gitRef !== undefined || scopeInput !== undefined)
+                throw usage('a sandboxed node installs only INSTALL-REF as marketplace/plugin');
+            return await installAppPlugin(rawRef);
+        }
         const scope = resolveInstallScope(scopeInput);
         if ((rawRef === undefined) === (endpoint === undefined)) {
             throw usage('provide exactly one of INSTALL-REF or --endpoint');
@@ -867,6 +874,8 @@ export const pluginRemove = defineLeaf({
         if (name === 'crtr') {
             throw usage('cannot remove builtin plugin "crtr" — it ships with the binary');
         }
+        if (isSandboxedNode())
+            return await removeAppPlugin(name);
         let scopes;
         if (scopeInput !== undefined) {
             const resolved = resolveScopeArg(scopeInput);
@@ -930,6 +939,8 @@ export const pluginEnable = defineLeaf({
     },
     run: async (input) => {
         const name = input['name'];
+        if (isSandboxedNode())
+            return await setAppPluginEnabled(name, true);
         const target = resolvePluginConfigTarget(name, input['scope']);
         if (target === null)
             throw notFound(`plugin not found: ${name}`);
@@ -961,6 +972,8 @@ export const pluginDisable = defineLeaf({
         effects: ['Sets plugin enabled=false in config.json.'],
     },
     run: async (input) => {
+        if (isSandboxedNode())
+            return await setAppPluginEnabled(input['name'], false);
         const result = await setPluginEnabled(input, false);
         await reconcilePluginDocuments();
         return { scope: result['scope'] };
@@ -989,6 +1002,8 @@ export const pluginUpdate = defineLeaf({
     },
     run: async (input) => {
         const name = input['name'];
+        if (isSandboxedNode())
+            return await updateAppPlugins(name);
         const scopeInput = input['scope'];
         const scope = scopeInput === undefined ? undefined : resolveScopeArg(scopeInput);
         const marketplaceCache = new Map();

package/dist/core/canvas/schema-version.d.ts

@@ -1,7 +1,7 @@
 /** The canvas schema version this build supports: the number of the highest delta in `schema-pg/` (the baseline
  *  `schema-pg.sql` is version 1). `scripts/install-runtime.mjs` reads this module from a candidate generation to refuse
  *  one below the live database's `schema_min_reader`. */
-export declare const CANVAS_SCHEMA_VERSION = 10;
+export declare const CANVAS_SCHEMA_VERSION = 11;
 /** The Postgres schema holding the canvas tables: `CRTR_DATABASE_SCHEMA` (`crtr` in the cloud deploy). Unset or empty
  *  means the role's own search_path (`public` on a Mac and on a VM). A name that is not a plain identifier is an error:
  *  it is put in a `search_path` connection option. */

package/dist/core/canvas/schema-version.js

@@ -6,7 +6,7 @@
 /** The canvas schema version this build supports: the number of the highest delta in `schema-pg/` (the baseline
  *  `schema-pg.sql` is version 1). `scripts/install-runtime.mjs` reads this module from a candidate generation to refuse
  *  one below the live database's `schema_min_reader`. */
-export const CANVAS_SCHEMA_VERSION = 10;
+export const CANVAS_SCHEMA_VERSION = 11;
 /** The Postgres schema holding the canvas tables: `CRTR_DATABASE_SCHEMA` (`crtr` in the cloud deploy). Unset or empty
  *  means the role's own search_path (`public` on a Mac and on a VM). A name that is not a plain identifier is an error:
  *  it is put in a `search_path` connection option. */

package/dist/core/config.d.ts

@@ -85,6 +85,7 @@ export declare function normalizeRequires(raw: unknown): Record<string, string>;
 /** STRICT install-time validation for a plugin's advisory `requires` block.
  *  A missing executable is advisory; only malformed declarations fail install. */
 export declare function invalidPluginRequiresReasons(raw: unknown): string[];
+export declare function setAppPluginKinds(kinds: Record<string, unknown> | undefined): void;
 /** The ACTIVE page-component catalog every authoring, validation, daemon,
  *  inbox, and TUI consumer resolves: the user scope's own `page_components`
  *  entries plus the contributions of every ENABLED plugin installed under that

package/dist/core/config.js

@@ -630,6 +630,10 @@ function mergeKinds(raw, base = defaultKindsConfig()) {
     }
     return out;
 }
+/** The launch kinds of the plugins a cloud role's node has enabled in its app, by plugin name (`appLaunchKinds`). A cloud role holds no plugin
+ *  directories, so when this is set the user scope layers these instead of listing a directory. The launch-config subprocess sets it from its request. */
+let appPluginKinds;
+export function setAppPluginKinds(kinds) { appPluginKinds = kinds; }
 /** Layer the `kinds` contributions of every ENABLED plugin installed under
  *  `scopeRootPath` over `base`, plugin name-sorted for determinism (directory
  *  listing order is filesystem-dependent). Each plugin's block goes through
@@ -638,6 +642,12 @@ function mergeKinds(raw, base = defaultKindsConfig()) {
  *  `readMergedLaunchConfig` BELOW the host scope's own raw `kinds`, so the
  *  scope's config.json always overrides its plugins. */
 function layerPluginKinds(scope, scopeRootPath, base) {
+    if (scope === 'user' && appPluginKinds !== undefined) {
+        let out = base;
+        for (const name of Object.keys(appPluginKinds).sort((a, b) => a.localeCompare(b)))
+            out = mergeKinds(appPluginKinds[name], out);
+        return out;
+    }
     if (scopeRootPath === null)
         return base;
     const plugins = listInstalledPluginsInRoot(scope, scopeRootPath)

package/dist/core/graph/names.js

@@ -1,6 +1,6 @@
 import { isSafeNodeId } from '../canvas/paths.js';
 import { OBJECT_TYPE } from '../permissions/builtin.js';
-import { ceilingFrag, resolveCeiling } from '../permissions/ceiling.js';
+import { ceilingFrag, readablePackageApps, resolveCeiling } from '../permissions/ceiling.js';
 import { compilePermission } from '../permissions/compile.js';
 import { permits, readerUser, resolveReader } from '../permissions/evaluator.js';
 import { loadDefinitions } from '../permissions/schemas.js';
@@ -14,11 +14,12 @@ export async function viewOf(db, reader) {
     const user = await readerUser(db, reader);
     const person = user === null ? undefined : await db.prepare(`SELECT o.* FROM objects o JOIN identities i ON i.object = o.id AND i.scheme = 'user'
     WHERE o.type = 'person' AND o.home_machine IS NULL AND regexp_replace(i.external_id, '^user:', '') = ?`).get(user);
-    // The apps that ship documents (installed plugins), `crtr` last: ranking only; what a reader may read is decided in each query.
-    const tools = await db.prepare(`SELECT a.* FROM objects a WHERE a.type = 'app' AND a.deleted_at IS NULL AND EXISTS (
+    // The apps whose shipped documents the reader may read (the read rule), `crtr` last. A person reads every published package.
+    const eligible = await readablePackageApps(db, reader, user);
+    const tools = await db.prepare(`SELECT a.* FROM objects a WHERE a.type = 'app' AND a.deleted_at IS NULL AND ${eligible === null ? `EXISTS (
       SELECT 1 FROM objects o JOIN documents d ON d.object = o.id
-      WHERE o.owner = a.id AND o.type = 'document' AND o.deleted_at IS NULL AND d.source_path IS NOT NULL)
-    ORDER BY a.name = 'crtr', a.name`).all();
+      WHERE o.owner = a.id AND o.type = 'document' AND o.deleted_at IS NULL AND d.source_path IS NOT NULL)` : 'a.id = ANY(?::text[])'}
+    ORDER BY a.name = 'crtr', a.name`).all(...(eligible === null ? [] : [eligible]));
     const head = reader.class === 'node' ? [reader.node, ...reader.repos, ...reader.projectRepos, reader.profile, reader.app]
         : reader.class === 'app' ? [reader.app]
             : reader.class === 'object' ? [reader.owner, ...reader.repos, reader.app]
@@ -32,7 +33,7 @@ export async function viewOf(db, reader) {
  *  schema-typed object has had its facts removed, so only the `permits` branch answers it: its own namespace's app. */
 export async function readableOrDeleted(db, ev, alias) {
     const live = await permits(db, ev, 'read', alias);
-    const ceiling = await resolveCeiling(db, ev.reader, 'read');
+    const ceiling = await resolveCeiling(db, ev.reader, ev.userId, 'read');
     const grants = compilePermission(await loadDefinitions(db), ev.subjects, OBJECT_TYPE, 'read', raw('gr.id'));
     const chain = { sql: `EXISTS (WITH RECURSIVE up(id, depth) AS (
       SELECT ${alias}.id, 0

package/dist/core/graph/package-docs.d.ts

@@ -1,14 +1,8 @@
-import { type QuarantinedPlugin } from '../plugin-quarantine.js';
 import { type PackageFile } from './package-files.js';
 import type { ReposFn } from './reader.js';
 import type { ObjectRow } from './types.js';
+import type { QuarantinedPlugin } from '../plugin-quarantine.js';
 import type { CanvasDb } from '../canvas/db.js';
-export interface PackageSource {
-    plugin: string;
-    dir: string;
-}
-/** The builtin corpus (app `crtr`), then every enabled user-scope plugin's `memory/` folder. */
-export declare function packageSources(): PackageSource[];
 export interface PackageReconcileReport {
     created: number;
     updated: number;
@@ -25,17 +19,14 @@ export interface PackageReconcileReport {
     /** plugin directories with an unreadable manifest or command file, moved aside before reconciling */
     quarantined: QuarantinedPlugin[];
 }
-/** Converge every package's documents onto its files. Run inside the caller's transaction.
- *  Idempotent: a second run over unchanged files changes no document, revision or rule (it re-derives
- *  each document's link edges, which land the same). A changed body replaces the
- *  document's single revision and publishes `edited`; a vanished file (or plugin) marks its
- *  document deleted and publishes `deleted`. */
-export declare function reconcilePackageDocuments(db: CanvasDb, explicitSources?: readonly PackageSource[]): Promise<PackageReconcileReport>;
 /** Record a package document's `links-to` edges the way a runtime document gets them, so delivery
- *  attaches the link previews. Each `[[name]]` resolves in its own app's view and links only when it
- *  names another shipped document (builtin or plugin): a package never links to a user's or a
+ *  attaches the link previews. Each `[[name]]` links only when it names a shipped document of any
+ *  published package (builtin, provider or plugin): a package never links to a user's or a
  *  runtime document that happens to share a bare name. A name that resolves to nothing stays text.
  *  Edges are rewritten only when they differ, so an unchanged pass writes nothing. */
 export declare function deriveLinks(db: CanvasDb, owner: ObjectRow, doc: ObjectRow, body: string): Promise<void>;
+/** Re-derive the links of every live shipped document of every app. A package published before the one its documents name has no edge to it yet;
+ *  publishing the missing one calls this, so the edges do not depend on which package arrived first. */
+export declare function relinkAllShipped(db: CanvasDb): Promise<void>;
 export declare function convergeFile(db: CanvasDb, owner: ObjectRow, file: PackageFile, report: PackageReconcileReport, reposFn: ReposFn): Promise<string>;
 export declare function deleteMissing(db: CanvasDb, owner: ObjectRow, keep: ReadonlySet<string>, report: PackageReconcileReport, reposFn: ReposFn): Promise<void>;