@synoikia/core 0.2.1-rc.0 → 0.4.0

package/dist/plugins/discovery.d.ts

@@ -1,35 +1,26 @@
 import type { Manifest } from '@synoikia/plugin-sdk';
 import type { Db } from '../db/index.js';
-/** Plugin discovery (design §4.1): core plugins from the image, installed ones from `DATA_DIR/plugins`. */
-export type PluginSource = 'core' | 'repo';
+/** Plugin discovery (design §4.1): the plugins installed in `DATA_DIR/plugins`. */
 export type DiscoveredPlugin = {
     status: 'ok';
-    source: PluginSource;
     dir: string;
     manifest: Manifest;
 } | {
     status: 'invalid' | 'incompatible';
-    source: PluginSource;
     dir: string;
     manifest?: Manifest;
     pluginId: string;
     error: string;
 };
-export declare function inspectPluginDir(dir: string, source: PluginSource): DiscoveredPlugin;
-/** Scans each root's immediate subdirectories that contain a manifest.json. */
-export declare function discoverPlugins(roots: {
-    dir: string;
-    source: PluginSource;
-}[]): DiscoveredPlugin[];
-export declare const pluginIdOf: (p: DiscoveredPlugin) => string;
+export declare function inspectPluginDir(dir: string): DiscoveredPlugin;
+/** Scans the plugins directory's immediate subdirectories that contain a manifest.json. */
+export declare function discoverPlugins(root: string): DiscoveredPlugin[];
 /**
- * Upserts discovery results into `plugins`. New core plugins start disabled unless `autoEnableCore`.
- * A repository plugin may not shadow a core plugin id; a core plugin that arrives later with a repo
- * plugin's id doesn't take its row over either (that row is marked invalid until an admin resolves it). Plugins no longer on disk are marked invalid,
- * never deleted, so their instances and history remain.
+ * Upserts discovery results into `plugins`. New plugins start disabled: enabling one is the admin's
+ * review of what it may do (design §4.2). Two directories declaring the same id keep only the first.
+ * Plugins no longer on disk are marked invalid, never deleted, so their instances and history remain.
  */
-export declare function syncPluginRegistry(db: Db, discovered: DiscoveredPlugin[], opts: {
-    autoEnableCore: boolean;
+export declare function syncPluginRegistry(db: Db, discovered: DiscoveredPlugin[], opts?: {
     now?: Date;
 }): {
     added: string[];

package/dist/plugins/discovery.js

@@ -11,20 +11,19 @@ function explain(err) {
         return err.issues.map((i) => `${i.path.join('.') || '(root)'}: ${i.message}`).join('; ');
     return err instanceof Error ? err.message : String(err);
 }
-export function inspectPluginDir(dir, source) {
+export function inspectPluginDir(dir) {
     const fallbackId = path.basename(dir);
     let manifest;
     try {
         manifest = parseManifest(JSON.parse(readFileSync(path.join(dir, 'manifest.json'), 'utf8')));
     }
     catch (err) {
-        return { status: 'invalid', source, dir, pluginId: fallbackId, error: `manifest.json: ${explain(err)}` };
+        return { status: 'invalid', dir, pluginId: fallbackId, error: `manifest.json: ${explain(err)}` };
     }
     const entry = path.join(dir, manifest.entry);
     if (!existsSync(entry)) {
         return {
             status: 'invalid',
-            source,
             dir,
             manifest,
             pluginId: manifest.id,
@@ -36,7 +35,6 @@ export function inspectPluginDir(dir, source) {
     if (!realpathSync(entry).startsWith(realDir + path.sep)) {
         return {
             status: 'invalid',
-            source,
             dir,
             manifest,
             pluginId: manifest.id,
@@ -46,41 +44,33 @@ export function inspectPluginDir(dir, source) {
     if (!isSdkCompatible(manifest)) {
         return {
             status: 'incompatible',
-            source,
             dir,
             manifest,
             pluginId: manifest.id,
             error: `requires plugin SDK ${manifest.sdk}; core implements ${SDK_VERSION}`,
         };
     }
-    return { status: 'ok', source, dir, manifest };
+    return { status: 'ok', dir, manifest };
 }
-/** Scans each root's immediate subdirectories that contain a manifest.json. */
-export function discoverPlugins(roots) {
-    const found = [];
-    for (const root of roots) {
-        if (!existsSync(root.dir))
-            continue;
-        for (const name of readdirSync(root.dir).sort()) {
-            const dir = path.join(root.dir, name);
-            if (statSync(dir).isDirectory() && existsSync(path.join(dir, 'manifest.json'))) {
-                found.push(inspectPluginDir(dir, root.source));
-            }
-        }
-    }
-    return found;
+/** Scans the plugins directory's immediate subdirectories that contain a manifest.json. */
+export function discoverPlugins(root) {
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root)
+        .sort()
+        .map((name) => path.join(root, name))
+        .filter((dir) => statSync(dir).isDirectory() && existsSync(path.join(dir, 'manifest.json')))
+        .map((dir) => inspectPluginDir(dir));
 }
-export const pluginIdOf = (p) => (p.status === 'ok' ? p.manifest.id : p.pluginId);
+const pluginIdOf = (p) => (p.status === 'ok' ? p.manifest.id : p.pluginId);
 /**
- * Upserts discovery results into `plugins`. New core plugins start disabled unless `autoEnableCore`.
- * A repository plugin may not shadow a core plugin id; a core plugin that arrives later with a repo
- * plugin's id doesn't take its row over either (that row is marked invalid until an admin resolves it). Plugins no longer on disk are marked invalid,
- * never deleted, so their instances and history remain.
+ * Upserts discovery results into `plugins`. New plugins start disabled: enabling one is the admin's
+ * review of what it may do (design §4.2). Two directories declaring the same id keep only the first.
+ * Plugins no longer on disk are marked invalid, never deleted, so their instances and history remain.
  */
-export function syncPluginRegistry(db, discovered, opts) {
+export function syncPluginRegistry(db, discovered, opts = {}) {
     const now = opts.now ?? new Date();
     const out = { added: [], updated: [], missing: [], rejected: [] };
-    const coreIds = new Set(discovered.filter((p) => p.source === 'core').map(pluginIdOf));
     db.transaction((tx) => {
         const existing = new Map(tx
             .select()
@@ -90,10 +80,6 @@ export function syncPluginRegistry(db, discovered, opts) {
         const seen = new Set();
         for (const p of discovered) {
             const pluginId = pluginIdOf(p);
-            if (p.source === 'repo' && coreIds.has(pluginId)) {
-                out.rejected.push(pluginId);
-                continue;
-            }
             if (seen.has(pluginId)) {
                 out.rejected.push(pluginId);
                 continue;
@@ -101,40 +87,22 @@ export function syncPluginRegistry(db, discovered, opts) {
             seen.add(pluginId);
             const fields = {
                 version: p.manifest?.version ?? '0.0.0',
-                source: p.source,
                 path: p.dir,
                 manifest: p.manifest ?? {},
                 status: p.status,
                 statusError: p.status === 'ok' ? null : p.error,
             };
             const prev = existing.get(pluginId);
-            if (prev?.source === 'repo' && p.source === 'core') {
-                // A core release now ships this id. Its instances must not silently switch to different code
-                // with the same secrets: the repo row stays as it was, unusable, until an admin resolves it.
-                const statusError = `A core plugin now uses the id "${pluginId}". Uninstall this repository plugin (after moving its endpoints) to use the core one.`;
-                if (prev.status !== 'invalid' || prev.statusError !== statusError) {
-                    tx.update(plugins).set({ status: 'invalid', statusError }).where(eq(plugins.id, prev.id)).run();
-                    writeAudit(tx, {
-                        kind: 'plugin',
-                        decision: 'plugin_id_conflict',
-                        actorKind: 'system',
-                        detail: { pluginId, repoVersion: prev.version, coreVersion: fields.version },
-                    }, now);
-                }
-                out.rejected.push(pluginId);
-                continue;
-            }
             if (!prev) {
-                const enabled = p.status === 'ok' && p.source === 'core' && opts.autoEnableCore;
                 tx.insert(plugins)
-                    .values({ id: randomUUID(), pluginId, ...fields, enabled, installedAt: now })
+                    .values({ id: randomUUID(), pluginId, ...fields, enabled: false, installedAt: now })
                     .run();
                 out.added.push(pluginId);
                 writeAudit(tx, {
                     kind: 'plugin',
                     decision: 'plugin_discovered',
                     actorKind: 'system',
-                    detail: { pluginId, ...fields, manifest: undefined, enabled },
+                    detail: { pluginId, ...fields, manifest: undefined, enabled: false },
                 }, now);
             }
             else {

package/dist/plugins/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/plugins/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnF,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAiB1C,SAAS,OAAO,CAAC,GAAY;IAC3B,IAAI,GAAG,YAAY,QAAQ;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtH,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAoB;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC3G,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM;YACN,GAAG;YACH,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,KAAK,EAAE,SAAS,QAAQ,CAAC,KAAK,yBAAyB;SACxD,CAAC;IACJ,CAAC;IACD,yGAAyG;IACzG,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM;YACN,GAAG;YACH,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,KAAK,EAAE,6CAA6C;SACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,MAAM;YACN,GAAG;YACH,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,KAAK,EAAE,uBAAuB,QAAQ,CAAC,GAAG,qBAAqB,WAAW,EAAE;SAC7E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,KAA8C;IAC5E,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;gBAC/E,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAEpG;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAM,EACN,UAA8B,EAC9B,IAA6C;IAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,EAAc,EAAE,OAAO,EAAE,EAAc,EAAE,OAAO,EAAE,EAAc,EAAE,QAAQ,EAAE,EAAc,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAC/B,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG;gBACb,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO;gBACvC,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,CAAC,CAAC,GAAG;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;gBAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;aAChD,CAAC;YACF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACnD,6FAA6F;gBAC7F,6FAA6F;gBAC7F,MAAM,WAAW,GAAG,kCAAkC,QAAQ,uFAAuF,CAAC;gBACtJ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;oBAClE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;oBAChG,UAAU,CACR,EAAE,EACF;wBACE,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,oBAAoB;wBAC9B,SAAS,EAAE,QAAQ;wBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE;qBAC7E,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC;gBAChF,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;qBACf,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;qBAC5E,GAAG,EAAE,CAAC;gBACT,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,UAAU,CACR,EAAE,EACF;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,mBAAmB;oBAC7B,SAAS,EAAE,QAAQ;oBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE;iBAC9D,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1D,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;qBACf,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;qBACrE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;qBAC9B,GAAG,EAAE,CAAC;gBACT,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/plugins/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnF,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAc1C,SAAS,OAAO,CAAC,GAAY;IAC3B,IAAI,GAAG,YAAY,QAAQ;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtH,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACnG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,GAAG;YACH,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,KAAK,EAAE,SAAS,QAAQ,CAAC,KAAK,yBAAyB;SACxD,CAAC;IACJ,CAAC;IACD,yGAAyG;IACzG,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,GAAG;YACH,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,KAAK,EAAE,6CAA6C;SACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,GAAG;YACH,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,KAAK,EAAE,uBAAuB,QAAQ,CAAC,GAAG,qBAAqB,WAAW,EAAE;SAC7E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;SACpC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;SAC3F,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAE7F;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAM,EACN,UAA8B,EAC9B,OAAuB,EAAE;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,EAAc,EAAE,OAAO,EAAE,EAAc,EAAE,OAAO,EAAE,EAAc,EAAE,QAAQ,EAAE,EAAc,EAAE,CAAC;IAElH,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAC/B,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG;gBACb,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO;gBACvC,IAAI,EAAE,CAAC,CAAC,GAAG;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;gBAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;aAChD,CAAC;YACF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;qBACf,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;qBACnF,GAAG,EAAE,CAAC;gBACT,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,UAAU,CACR,EAAE,EACF;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,mBAAmB;oBAC7B,SAAS,EAAE,QAAQ;oBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;iBACrE,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1D,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;qBACf,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;qBACrE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;qBAC9B,GAAG,EAAE,CAAC;gBACT,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/plugins/process.js

@@ -1,5 +1,6 @@
 import { fork } from 'node:child_process';
 import { EventEmitter } from 'node:events';
+import { realpathSync } from 'node:fs';
 import path from 'node:path';
 import { GuideSchema, OptionSchema, PrepareWriteResultSchema, RegistryEntrySchema, ResolvedTargetSchema, ResolveOperationResultSchema, SummarizeResultSchema, SyncCatalogResultSchema, TestConnectionResultSchema, } from '@synoikia/plugin-sdk';
 import { z } from 'zod';
@@ -73,7 +74,9 @@ export class PluginProcess extends EventEmitter {
     start() {
         if (this.child)
             throw new Error('Plugin process already started');
-        const dir = path.resolve(this.opts.dir);
+        // The permission model checks real paths, but the grant is taken literally: through a symlinked dir (macOS's
+        // /var -> /private/var tmpdir, a symlinked DATA_DIR) the child could not even load its own entry.
+        const dir = realpathSync(path.resolve(this.opts.dir));
         this.child = fork(path.resolve(dir, this.opts.entry), [], {
             cwd: dir,
             execArgv: ['--permission', `--allow-fs-read=${dir}`, `--max-old-space-size=${this.opts.memoryMb ?? 256}`],

package/dist/plugins/process.js.map

@@ -1 +1 @@
-{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/plugins/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,YAAY,EACZ,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AAEH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B;IAEA;IAHX,YACW,IAAe,EACxB,OAAe,EACN,IAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAW;QAEf,SAAI,GAAJ,IAAI,CAAU;QAGvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,0GAA0G;AAC1G,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,GAAG,iCAAiC;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,MAAc,EAAE,EAAU;QACpC,KAAK,CAAC,yBAAyB,MAAM,WAAW,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,MAAc,EAAE,MAAc;QACxC,KAAK,CAAC,WAAW,MAAM,wBAAwB,MAAM,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAClD,MAAM,cAAc,GAAoC;IACtD,IAAI,EAAE,OAAO;IACb,cAAc,EAAE,0BAA0B;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,WAAW,EAAE,uBAAuB;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC1C,gBAAgB,EAAE,4BAA4B;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC7C,SAAS,EAAE,qBAAqB;IAChC,YAAY,EAAE,wBAAwB;IACtC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IACjC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,OAAO;CAClB,CAAC;AA2BF,MAAM,OAAO,aAAc,SAAQ,YAAiC;IAMrC;IALrB,KAAK,CAAgB;IACrB,MAAM,GAAG,CAAC,CAAC;IACF,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC9C,MAAM,GAAG,KAAK,CAAC;IAEvB,YAA6B,IAAkB;QAC7C,KAAK,EAAE,CAAC;QADmB,SAAI,GAAJ,IAAI,CAAc;IAE/C,CAAC;IAED,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IACtC,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;IACzB,CAAC;IAED,sGAAsG;IACtG,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE;YACxD,GAAG,EAAE,GAAG;YACR,QAAQ,EAAE,CAAC,cAAc,EAAE,mBAAmB,GAAG,EAAE,EAAE,wBAAwB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;YACzG,uFAAuF;YACvF,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;YACjG,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;YACxC,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,MAAM,IAAI,IAAI,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/F,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAsB,MAAS,EAAE,MAAkB,EAAE,SAAkB;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAClF,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC,EAAE,EAAE,CAAC,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzD,IAAI,CAAC,GAAG;oBAAE,OAAO;gBACjB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAC3B,MAAM,EACN,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3F,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAiB,CAAC;IAClC,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QAClC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC;QACb,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI;QACF,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAEO,SAAS,CAAC,GAAY;QAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAA6B,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO;QACxG,IAAI,IAAI,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,GAAkB,CAAC;YAC/B,IAAI,OAAO,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;;gBACrG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAsB,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;aAC/E,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9F,CAAC;CACF"}
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/plugins/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,YAAY,EACZ,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AAEH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B;IAEA;IAHX,YACW,IAAe,EACxB,OAAe,EACN,IAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAW;QAEf,SAAI,GAAJ,IAAI,CAAU;QAGvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,0GAA0G;AAC1G,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,GAAG,iCAAiC;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,MAAc,EAAE,EAAU;QACpC,KAAK,CAAC,yBAAyB,MAAM,WAAW,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,MAAc,EAAE,MAAc;QACxC,KAAK,CAAC,WAAW,MAAM,wBAAwB,MAAM,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAClD,MAAM,cAAc,GAAoC;IACtD,IAAI,EAAE,OAAO;IACb,cAAc,EAAE,0BAA0B;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,WAAW,EAAE,uBAAuB;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC1C,gBAAgB,EAAE,4BAA4B;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC7C,SAAS,EAAE,qBAAqB;IAChC,YAAY,EAAE,wBAAwB;IACtC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IACjC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,OAAO;CAClB,CAAC;AA2BF,MAAM,OAAO,aAAc,SAAQ,YAAiC;IAMrC;IALrB,KAAK,CAAgB;IACrB,MAAM,GAAG,CAAC,CAAC;IACF,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC9C,MAAM,GAAG,KAAK,CAAC;IAEvB,YAA6B,IAAkB;QAC7C,KAAK,EAAE,CAAC;QADmB,SAAI,GAAJ,IAAI,CAAc;IAE/C,CAAC;IAED,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IACtC,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;IACzB,CAAC;IAED,sGAAsG;IACtG,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAClE,6GAA6G;QAC7G,kGAAkG;QAClG,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE;YACxD,GAAG,EAAE,GAAG;YACR,QAAQ,EAAE,CAAC,cAAc,EAAE,mBAAmB,GAAG,EAAE,EAAE,wBAAwB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;YACzG,uFAAuF;YACvF,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;YACjG,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;YACxC,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,MAAM,IAAI,IAAI,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/F,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAsB,MAAS,EAAE,MAAkB,EAAE,SAAkB;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAClF,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC,EAAE,EAAE,CAAC,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzD,IAAI,CAAC,GAAG;oBAAE,OAAO;gBACjB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAC3B,MAAM,EACN,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3F,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAiB,CAAC;IAClC,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QAClC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC;QACb,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI;QACF,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAEO,SAAS,CAAC,GAAY;QAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAA6B,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO;QACxG,IAAI,IAAI,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,GAAkB,CAAC;YAC/B,IAAI,OAAO,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;;gBACrG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAsB,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;aAC/E,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9F,CAAC;CACF"}

package/dist/plugins/repos.d.ts

@@ -20,14 +20,6 @@ export declare const IndexSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type RepoIndex = z.infer<typeof IndexSchema>;
-export declare const AddRepoSchema: z.ZodObject<{
-    url: z.ZodURL;
-    signingMode: z.ZodEnum<{
-        signed: "signed";
-        unsigned: "unsigned";
-    }>;
-    confirmPublicKey: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
 export declare const InstallSchema: z.ZodObject<{
     repoId: z.ZodString;
     pluginId: z.ZodString;
@@ -55,8 +47,6 @@ export interface RepoServiceOptions {
     /** Start (and resync) every servable instance of a plugin row. */
     startPlugin: (pluginRowId: string) => Promise<void>;
 }
-/** The parts of a manifest that change what a plugin may do; an update touching them needs review. */
-export declare function permissionChanges(before: unknown, after: unknown): string[];
 /**
  * Replaces `target` with `next`, keeping the previous copy at `backup` until the swap succeeded. If
  * moving `next` in fails, the previous copy is moved back, so a failed update never leaves no plugin.
@@ -92,8 +82,8 @@ export declare class PluginRepoService {
         lastFetchError: string | null;
     }[];
     /**
-     * Adds a repository. Signed repos take two calls: the first answers 409 `confirm_key` with the key
-     * id, the second repeats the request with `confirmKeyId` once the admin has checked it out of band.
+     * Adds a repository. Signed repos take two calls: the first answers 409 `confirm_key` with the
+     * public key, the second repeats the request with `confirmPublicKey` once the admin has checked it out of band.
      */
     add(raw: unknown, actor?: Actor): Promise<{
         id: string;
@@ -112,6 +102,31 @@ export declare class PluginRepoService {
         lastFetchedAt: Date | null;
         lastFetchError: string | null;
     }>;
+    /**
+     * Adds a signed repository whose key ships with core, without fetching its index (the next refresh
+     * does). Runs once per `marker`: a repo the admin removed stays removed.
+     */
+    addPreconfigured(repo: {
+        url: string;
+        name: string;
+        publicKey: string;
+    }, marker?: string): {
+        id: string;
+        url: string;
+        name: string | null;
+        signingMode: "signed" | "unsigned";
+        publicKey: string | null;
+        keyId: string | null;
+        keyStatus: "ok" | "key_changed";
+        /** When the key changed: the new key awaiting confirmation. */
+        offeredKey: {
+            publicKey: string;
+            keyId: string;
+        } | null;
+        pluginCount: number;
+        lastFetchedAt: Date | null;
+        lastFetchError: string | null;
+    } | null;
     /** Re-reads the index. A changed signing key blocks installs until re-confirmed. */
     refresh(id: string): Promise<{
         id: string;
@@ -130,7 +145,10 @@ export declare class PluginRepoService {
         lastFetchedAt: Date | null;
         lastFetchError: string | null;
     }>;
-    /** Daily refresh (design §10). Failures are recorded on the row, never thrown. */
+    /**
+     * Daily refresh (design §10). A repo whose last fetch failed is retried on every call (hourly), so a
+     * start-up network hiccup doesn't leave it empty for a day. Failures are recorded on the row, never thrown.
+     */
     refreshStale(maxAgeMs?: number): Promise<void>;
     /** Pins the key a refreshed index now offers, after the admin checked it against the publisher's. */
     confirmKey(id: string, publicKey: string, actor?: Actor): {
@@ -167,7 +185,7 @@ export declare class PluginRepoService {
         installed: {
             version: string;
             fromThisRepo: boolean;
-            source: "core" | "repo";
+            managed: boolean;
         } | null;
         updateAvailable: boolean;
         blocked: string | null;
@@ -180,7 +198,6 @@ export declare class PluginRepoService {
         id: string;
         pluginId: string;
         version: string;
-        source: "core" | "repo";
         repoId: string | null;
         path: string;
         sha256: string | null;
@@ -192,7 +209,7 @@ export declare class PluginRepoService {
         installedAt: Date;
     }>;
     private installLocked;
-    /** Removes an installed (repo) plugin. Blocked while any instance uses it. */
+    /** Removes an installed plugin. Blocked while any instance uses it. */
     uninstall(pluginRowOrId: string, actor?: Actor): void;
 }
 export {};

package/dist/plugins/repos.js

@@ -9,7 +9,7 @@ import semver from 'semver';
 import * as tar from 'tar';
 import { z } from 'zod';
 import { writeAudit } from '../audit.js';
-import { pluginInstances, pluginRepos, plugins } from '../db/schema.js';
+import { pluginInstances, pluginRepos, plugins, settings } from '../db/schema.js';
 import { ConflictError, NotFoundError, ServiceError, ValidationError } from '../errors.js';
 import { CORE_VERSION } from '../version.js';
 import { inspectPluginDir } from './discovery.js';
@@ -47,7 +47,7 @@ export const IndexSchema = z.object({
     }))
         .max(500),
 });
-export const AddRepoSchema = z.object({
+const AddRepoSchema = z.object({
     url: z.url(),
     signingMode: z.enum(['signed', 'unsigned']),
     /**
@@ -64,8 +64,10 @@ export const InstallSchema = z.object({
     confirm: z.string().optional(),
 });
 const MAX_REDIRECTS = 5;
+/** `settings` row recording that the pre-configured repository was added once. */
+const DEFAULT_REPO_MARKER = 'plugin_repos.preconfigured';
 /** The parts of a manifest that change what a plugin may do; an update touching them needs review. */
-export function permissionChanges(before, after) {
+function permissionChanges(before, after) {
     const b = (before ?? {});
     const a = (after ?? {});
     const pick = {
@@ -220,8 +222,8 @@ export class PluginRepoService {
             .map((r) => this.publicRepo(r));
     }
     /**
-     * Adds a repository. Signed repos take two calls: the first answers 409 `confirm_key` with the key
-     * id, the second repeats the request with `confirmKeyId` once the admin has checked it out of band.
+     * Adds a repository. Signed repos take two calls: the first answers 409 `confirm_key` with the
+     * public key, the second repeats the request with `confirmPublicKey` once the admin has checked it out of band.
      */
     async add(raw, actor = {}) {
         const input = AddRepoSchema.parse(raw);
@@ -266,6 +268,43 @@ export class PluginRepoService {
         });
         return this.publicRepo(this.repoRow(id));
     }
+    /**
+     * Adds a signed repository whose key ships with core, without fetching its index (the next refresh
+     * does). Runs once per `marker`: a repo the admin removed stays removed.
+     */
+    addPreconfigured(repo, marker = DEFAULT_REPO_MARKER) {
+        if (this.db.select().from(settings).where(eq(settings.key, marker)).get())
+            return null;
+        const url = this.checkUrl(repo.url);
+        const key = parsePublicKey(repo.publicKey);
+        const exists = this.db.select().from(pluginRepos).where(eq(pluginRepos.url, url)).get();
+        const id = randomUUID();
+        this.db.transaction((tx) => {
+            tx.insert(settings)
+                .values({ key: marker, value: { url, addedAt: this.now().toISOString() } })
+                .run();
+            if (exists)
+                return;
+            tx.insert(pluginRepos)
+                .values({
+                id,
+                url,
+                name: repo.name,
+                signingMode: 'signed',
+                publicKey: key.base64,
+                keyFingerprint: key.keyId,
+                keyStatus: 'ok',
+            })
+                .run();
+            writeAudit(tx, {
+                kind: 'config',
+                decision: 'plugin_repo_added',
+                actorKind: 'system',
+                detail: { id, url, name: repo.name, signingMode: 'signed', keyId: key.keyId, preconfigured: true },
+            });
+        });
+        return exists ? null : this.publicRepo(this.repoRow(id));
+    }
     /** Re-reads the index. A changed signing key blocks installs until re-confirmed. */
     async refresh(id) {
         const row = this.repoRow(id);
@@ -306,10 +345,14 @@ export class PluginRepoService {
         }
         return this.publicRepo(this.repoRow(id));
     }
-    /** Daily refresh (design §10). Failures are recorded on the row, never thrown. */
+    /**
+     * Daily refresh (design §10). A repo whose last fetch failed is retried on every call (hourly), so a
+     * start-up network hiccup doesn't leave it empty for a day. Failures are recorded on the row, never thrown.
+     */
     async refreshStale(maxAgeMs = 24 * 60 * 60_000) {
         for (const row of this.db.select().from(pluginRepos).all()) {
-            if (row.lastFetchedAt && this.now().getTime() - row.lastFetchedAt.getTime() < maxAgeMs)
+            const fresh = row.lastFetchedAt && this.now().getTime() - row.lastFetchedAt.getTime() < maxAgeMs;
+            if (fresh && !row.lastFetchError)
                 continue;
             await this.refresh(row.id).catch(() => undefined);
         }
@@ -377,7 +420,7 @@ export class PluginRepoService {
                     .map((v) => v.version);
                 const latest = semver.rsort([...compatible])[0] ?? null;
                 const current = installed.get(p.id);
-                const fromHere = current?.source === 'repo' && current.repoId === repo.id;
+                const fromHere = !!current && current.repoId === repo.id;
                 out.push({
                     repoId: repo.id,
                     repoName: repo.name,
@@ -387,15 +430,13 @@ export class PluginRepoService {
                     description: p.description ?? null,
                     versions: p.versions.map((v) => ({ version: v.version, compatible: compatible.includes(v.version) })),
                     latest,
-                    installed: current ? { version: current.version, fromThisRepo: fromHere, source: current.source } : null,
+                    installed: current ? { version: current.version, fromThisRepo: fromHere, managed: !!current.repoId } : null,
                     updateAvailable: !!(fromHere && latest && semver.gt(latest, current.version)),
-                    blocked: current?.source === 'core'
-                        ? 'core_plugin_id'
-                        : current && !fromHere
-                            ? 'installed_from_elsewhere'
-                            : repo.keyStatus === 'key_changed'
-                                ? 'key_changed'
-                                : null,
+                    blocked: current?.repoId && !fromHere
+                        ? 'installed_from_elsewhere'
+                        : repo.keyStatus === 'key_changed'
+                            ? 'key_changed'
+                            : null,
                 });
             }
         }
@@ -480,11 +521,12 @@ export class PluginRepoService {
             throw new ConflictError('incompatible', `${input.pluginId}@${input.version} needs core ${version.minCoreVersion} or newer`);
         }
         const current = this.db.select().from(plugins).where(eq(plugins.pluginId, input.pluginId)).get();
-        if (current?.source === 'core')
-            throw new ConflictError('core_plugin_id', `"${input.pluginId}" is a core plugin`);
-        if (current && current.repoId !== repo.id) {
-            throw new ConflictError('installed_from_elsewhere', `"${input.pluginId}" is installed from another source; uninstall it first`);
+        if (current?.repoId && current.repoId !== repo.id) {
+            throw new ConflictError('installed_from_elsewhere', `"${input.pluginId}" is installed from another repository; uninstall it first`);
         }
+        // A plugin no repository manages (a built-in plugin from before 0.3.0, or one copied in by hand) is
+        // adopted: this install replaces its files and keeps its row, so its endpoints carry over.
+        const adopting = !!current && !current.repoId;
         if (repo.signingMode === 'unsigned' && input.confirm !== input.pluginId) {
             throw new ConflictError('confirm_required', `This repository is unsigned. Type "${input.pluginId}" to install anyway`);
         }
@@ -511,7 +553,7 @@ export class PluginRepoService {
         const work = path.join(this.stagingDir, randomUUID());
         try {
             const root = await this.extract(tarball, work);
-            const inspected = inspectPluginDir(root, 'repo');
+            const inspected = inspectPluginDir(root);
             if (inspected.status !== 'ok')
                 throw new ValidationError('invalid_plugin', inspected.error);
             if (inspected.manifest.id !== input.pluginId || inspected.manifest.version !== input.version) {
@@ -536,7 +578,8 @@ export class PluginRepoService {
             // New installs start disabled, and an update that changes what the plugin may do is disabled
             // again: enabling it is the admin's review of its binding, capabilities and hosts (design §4.2).
             const review = current ? permissionChanges(current.manifest, inspected.manifest) : [];
-            const enabled = current ? current.enabled && review.length === 0 : false;
+            // Adopted code comes from a new source, so it waits for the admin's review like a new install.
+            const enabled = current && !adopting ? current.enabled && review.length === 0 : false;
             this.db.transaction((tx) => {
                 tx.update(plugins)
                     .set({ repoId: repo.id, sha256, signatureVerified, enabled })
@@ -544,7 +587,7 @@ export class PluginRepoService {
                     .run();
                 writeAudit(tx, {
                     kind: 'config',
-                    decision: current ? 'plugin_updated' : 'plugin_installed',
+                    decision: adopting ? 'plugin_adopted' : current ? 'plugin_updated' : 'plugin_installed',
                     actorKind: 'user',
                     actorId: actor.userId,
                     detail: {
@@ -567,14 +610,12 @@ export class PluginRepoService {
             rmSync(work, { recursive: true, force: true });
         }
     }
-    /** Removes an installed (repo) plugin. Blocked while any instance uses it. */
+    /** Removes an installed plugin. Blocked while any instance uses it. */
     uninstall(pluginRowOrId, actor = {}) {
         const row = this.db.select().from(plugins).where(eq(plugins.id, pluginRowOrId)).get() ??
             this.db.select().from(plugins).where(eq(plugins.pluginId, pluginRowOrId)).get();
         if (!row)
             throw new NotFoundError('plugin_not_found', 'No such plugin');
-        if (row.source === 'core')
-            throw new ConflictError('core_plugin', 'Core plugins cannot be uninstalled; disable them instead');
         const instances = this.db.select().from(pluginInstances).where(eq(pluginInstances.pluginId, row.id)).all();
         if (instances.length) {
             throw new ConflictError('plugin_has_instances', 'Delete this plugin’s endpoints first', {