dineway 0.1.48 → 0.2.0

package/dist/astro/routes/api/widget-areas/index.mjs

@@ -1,34 +1,37 @@
 import "../../../../dialect-helpers-fk43GbDb.mjs";
-import "../../../../content-QaryevFO.mjs";
-import "../../../../base64-C1Q9yr0B.mjs";
-import "../../../../types-DfuD0Afl.mjs";
-import "../../../../media-DUAjMfvR.mjs";
-import "../../../../options-BvJoSSJR.mjs";
-import "../../../../site-activity-D7Xyropw.mjs";
-import "../../../../review-requests-gGMyYYhy.mjs";
-import "../../../../entity-aliases-Egjmqc7I.mjs";
-import "../../../../request-cache-CYMbwZc6.mjs";
-import "../../../../briefing-gKWiGLt1.mjs";
-import "../../../../context-types-DQh_XKkn.mjs";
-import "../../../../fts-manager-CIZlScg5.mjs";
-import "../../../../registry-CTkbIDB9.mjs";
-import "../../../../loader-tg63WSY2.mjs";
-import "../../../../settings-yLjz_I4T.mjs";
-import "../../../../query-DKEwzobh.mjs";
-import "../../../../zod-generator-BS9-umbk.mjs";
-import "../../../../schema-B6zyB-Xn.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DCSuUAZW.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-CneSgl7-.mjs";
-import { p as createWidgetAreaBody } from "../../../../redirects-ocRJmQHP.mjs";
-import "../../../../byline-fields-B-ZkoVft.mjs";
+import "../../../../base64-F8-DUraK.mjs";
+import "../../../../types-Dq1qT19x.mjs";
+import "../../../../loader-CjWqjweO.mjs";
+import "../../../../object-cache-D51qOseS.mjs";
+import "../../../../content-Bh4BDjv8.mjs";
+import "../../../../media-DMj0grzC.mjs";
+import "../../../../options-DQPTH5n0.mjs";
+import "../../../../site-activity-Dy3FROs0.mjs";
+import "../../../../review-requests-DUyEmtmG.mjs";
+import "../../../../hitl-Hw1RmWOq.mjs";
+import "../../../../request-cache-D9GQBxMP.mjs";
+import "../../../../briefing-CawZ59CY.mjs";
+import "../../../../context-types-DqTo6C79.mjs";
+import "../../../../content-refresh-CgutSUfO.mjs";
+import "../../../../fts-manager-Crzypjqu.mjs";
+import "../../../../registry-CtyVedcN.mjs";
+import "../../../../settings-BbqgHWpU.mjs";
+import "../../../../query-jaAmw8E1.mjs";
+import "../../../../zod-generator-B7TMjyFJ.mjs";
+import "../../../../schema-DXdYj4R3.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-CytFlgcd.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-CbymENaR.mjs";
+import { p as createWidgetAreaBody } from "../../../../redirects-CA-xylPG.mjs";
+import "../../../../byline-fields-DOJO16Gm.mjs";
+import "../../../../status-DANd8ERo.mjs";
 import "../../../../api/schemas/index.mjs";
-import "../../../../utils-wv-zvC-Y.mjs";
-import { i as rowToWidget } from "../../../../widgets-DR8EHuRO.mjs";
-import "../../../../search-axGQ1KY3.mjs";
-import { n as requirePerm } from "../../../../authorize-BLO0m7fW.mjs";
-import { _ as RiskPolicyEvaluator, s as WidgetHitlPayloadBuilder } from "../../../../site-context-DaN9Z91j.mjs";
-import { h as logWidgetActivity, w as widgetApiRouteSource } from "../../../../activity-events-C9u37D5z.mjs";
-import { i as resolveHitlRouteActor, n as hitlRequiredRouteError, t as ensureWorkflowHitlRouteRequest } from "../../../../hitl-route-helpers-GSDLNPpN.mjs";
+import { T as widgetApiRouteSource, g as logWidgetActivity } from "../../../../activity-events-y6eT8UW6.mjs";
+import "../../../../utils-CMDhr5Xd.mjs";
+import { i as rowToWidget } from "../../../../widgets-f0ibZUIq.mjs";
+import "../../../../search-DSaLgEFI.mjs";
+import { n as requirePerm } from "../../../../authorize-CcBxcHtz.mjs";
+import { g as RiskPolicyEvaluator, o as WidgetHitlPayloadBuilder } from "../../../../site-context-DQiL8Fl5.mjs";
+import { i as resolveHitlRouteActor, n as hitlRequiredRouteError, t as ensureWorkflowHitlRouteRequest } from "../../../../hitl-route-helpers-hEVzvP8l.mjs";
 import { ulid } from "ulidx";
 import { z } from "zod";
 

package/dist/astro/routes/api/widget-components.mjs

@@ -1,5 +1,5 @@
-import { n as apiSuccess, r as handleError } from "../../../error-DCSuUAZW.mjs";
-import { t as getWidgetComponents } from "../../../components--pg6zBvu.mjs";
+import { n as apiSuccess, r as handleError } from "../../../error-CytFlgcd.mjs";
+import { t as getWidgetComponents } from "../../../components-Bclf98Be.mjs";
 
 //#region src/astro/routes/api/widget-components.ts
 const prerender = false;

package/dist/astro/routes/robots.txt.mjs

@@ -1,12 +1,13 @@
 import "../../dialect-helpers-fk43GbDb.mjs";
-import "../../base64-C1Q9yr0B.mjs";
-import "../../types-DfuD0Afl.mjs";
-import "../../media-DUAjMfvR.mjs";
-import "../../options-BvJoSSJR.mjs";
-import "../../request-cache-CYMbwZc6.mjs";
-import "../../loader-tg63WSY2.mjs";
-import { a as getSiteSettingsWithDb } from "../../settings-yLjz_I4T.mjs";
-import { n as getPublicOrigin } from "../../public-url-DLUM5OOv.mjs";
+import "../../base64-F8-DUraK.mjs";
+import "../../types-Dq1qT19x.mjs";
+import "../../loader-CjWqjweO.mjs";
+import "../../object-cache-D51qOseS.mjs";
+import "../../media-DMj0grzC.mjs";
+import "../../options-DQPTH5n0.mjs";
+import "../../request-cache-D9GQBxMP.mjs";
+import { a as getSiteSettingsWithDb } from "../../settings-BbqgHWpU.mjs";
+import { n as getPublicOrigin } from "../../public-url-BEz_sM9n.mjs";
 
 //#region src/astro/routes/robots.txt.ts
 const prerender = false;

package/dist/astro/routes/sitemap-_collection_.xml.mjs

@@ -1,15 +1,17 @@
 import "../../dialect-helpers-fk43GbDb.mjs";
 import { n as getI18nConfig, r as isI18nEnabled } from "../../config-CVssduLe.mjs";
-import "../../base64-C1Q9yr0B.mjs";
-import "../../types-DfuD0Afl.mjs";
-import "../../media-DUAjMfvR.mjs";
-import "../../options-BvJoSSJR.mjs";
-import "../../request-cache-CYMbwZc6.mjs";
-import "../../loader-tg63WSY2.mjs";
-import { a as getSiteSettingsWithDb } from "../../settings-yLjz_I4T.mjs";
-import { t as handleSitemapData } from "../../seo-5lJOtB5J.mjs";
-import { n as localizePath, t as interpolateUrlPattern } from "../../resolve-DTuDyYKs.mjs";
-import { n as getPublicOrigin } from "../../public-url-DLUM5OOv.mjs";
+import "../../base64-F8-DUraK.mjs";
+import "../../types-Dq1qT19x.mjs";
+import "../../loader-CjWqjweO.mjs";
+import "../../object-cache-D51qOseS.mjs";
+import "../../media-DMj0grzC.mjs";
+import "../../options-DQPTH5n0.mjs";
+import "../../request-cache-D9GQBxMP.mjs";
+import { a as getSiteSettingsWithDb } from "../../settings-BbqgHWpU.mjs";
+import { t as handleSitemapData } from "../../seo-qa7Dn0jK.mjs";
+import { n as localizePath, t as interpolateUrlPattern } from "../../resolve-Cb6Dbz-C.mjs";
+import { t as buildSeoImageUrl } from "../../media-url-lEKSrpr9.mjs";
+import { n as getPublicOrigin } from "../../public-url-BEz_sM9n.mjs";
 
 //#region src/astro/routes/sitemap-[collection].xml.ts
 const prerender = false;
@@ -61,23 +63,30 @@ const GET = async ({ params, locals, url }) => {
 			return absolute;
 		};
 		const lines = ["<?xml version=\"1.0\" encoding=\"UTF-8\"?>"];
-		lines.push(i18nEnabled ? "<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\" xmlns:xhtml=\"http://www.w3.org/1999/xhtml\">" : "<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">");
+		lines.push(i18nEnabled ? "<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\" xmlns:xhtml=\"http://www.w3.org/1999/xhtml\" xmlns:image=\"http://www.google.com/schemas/sitemap-image/1.1\">" : "<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\" xmlns:image=\"http://www.google.com/schemas/sitemap-image/1.1\">");
 		const writeUrl = async (entry, siblings) => {
 			const loc = await resolveEntryUrl(entry);
 			if (loc === null) return;
 			lines.push("  <url>");
 			lines.push(`    <loc>${escapeXml(loc)}</loc>`);
 			lines.push(`    <lastmod>${escapeXml(entry.updatedAt)}</lastmod>`);
-			if (i18nEnabled && siblings && siblings.length > 1) {
-				for (const sibling of siblings) {
+			if (entry.image) {
+				const imageLoc = buildSeoImageUrl(entry.image, siteUrl);
+				lines.push("    <image:image>");
+				lines.push(`      <image:loc>${escapeXml(imageLoc)}</image:loc>`);
+				lines.push("    </image:image>");
+			}
+			const alternateEntries = siblings ?? (i18nEnabled ? [entry] : null);
+			if (i18nEnabled && alternateEntries) {
+				for (const sibling of alternateEntries) {
 					const siblingLoc = await resolveEntryUrl(sibling);
 					if (siblingLoc === null) continue;
 					lines.push(`    <xhtml:link rel="alternate" hreflang="${escapeXml(sibling.locale)}" href="${escapeXml(siblingLoc)}" />`);
 				}
-				const defaultSibling = i18nConfig && siblings.find((sibling) => sibling.locale === i18nConfig.defaultLocale);
+				const defaultSibling = i18nConfig && alternateEntries.find((sibling) => sibling.locale === i18nConfig.defaultLocale);
 				let xDefaultLoc = null;
 				if (defaultSibling) xDefaultLoc = await resolveEntryUrl(defaultSibling);
-				if (xDefaultLoc === null) for (const sibling of siblings) {
+				if (xDefaultLoc === null) for (const sibling of alternateEntries) {
 					const siblingLoc = await resolveEntryUrl(sibling);
 					if (siblingLoc !== null) {
 						xDefaultLoc = siblingLoc;

package/dist/astro/routes/sitemap.xml.mjs

@@ -1,13 +1,14 @@
 import "../../dialect-helpers-fk43GbDb.mjs";
-import "../../base64-C1Q9yr0B.mjs";
-import "../../types-DfuD0Afl.mjs";
-import "../../media-DUAjMfvR.mjs";
-import "../../options-BvJoSSJR.mjs";
-import "../../request-cache-CYMbwZc6.mjs";
-import "../../loader-tg63WSY2.mjs";
-import { a as getSiteSettingsWithDb } from "../../settings-yLjz_I4T.mjs";
-import { t as handleSitemapData } from "../../seo-5lJOtB5J.mjs";
-import { n as getPublicOrigin } from "../../public-url-DLUM5OOv.mjs";
+import "../../base64-F8-DUraK.mjs";
+import "../../types-Dq1qT19x.mjs";
+import "../../loader-CjWqjweO.mjs";
+import "../../object-cache-D51qOseS.mjs";
+import "../../media-DMj0grzC.mjs";
+import "../../options-DQPTH5n0.mjs";
+import "../../request-cache-D9GQBxMP.mjs";
+import { a as getSiteSettingsWithDb } from "../../settings-BbqgHWpU.mjs";
+import { t as handleSitemapData } from "../../seo-qa7Dn0jK.mjs";
+import { n as getPublicOrigin } from "../../public-url-BEz_sM9n.mjs";
 
 //#region src/astro/routes/sitemap.xml.ts
 const prerender = false;

package/dist/astro/session-driver.d.mts

@@ -1,4 +1,4 @@
-import { t as Database } from "../types-eu5UDgHN.mjs";
+import { t as Database } from "../types-DU0bU2Wu.mjs";
 import { Kysely } from "kysely";
 
 //#region src/astro/session-driver.d.ts

package/dist/astro/session-driver.mjs

@@ -1,7 +1,7 @@
 import { a as currentTimestampValue } from "../dialect-helpers-fk43GbDb.mjs";
-import "../base64-C1Q9yr0B.mjs";
-import "../types-DfuD0Afl.mjs";
-import { r as getDb } from "../loader-tg63WSY2.mjs";
+import "../base64-F8-DUraK.mjs";
+import "../types-Dq1qT19x.mjs";
+import { r as getDb } from "../loader-CjWqjweO.mjs";
 
 //#region src/astro/session-driver.ts
 function createDinewaySessionDriver(dbFactory = getDb) {

package/dist/astro/types.d.mts

@@ -1,15 +1,15 @@
-import { i as ContentItem } from "../types-DRIKLmJI.mjs";
-import { Ar as MediaListResponse, Gt as EmailPipeline, Kt as HookPipeline, Ri as ContentListResponse, gr as SandboxRunner, jr as MediaResponse, t as DinewayConfig, wi as MediaItem, zi as ContentResponse } from "../runtime-DEWQpZ-4.mjs";
-import { t as Database } from "../types-eu5UDgHN.mjs";
-import { A as PageMetadataContribution, D as PageFragmentContribution, X as ResolvedPlugin, ct as Element, q as PublicPageContext } from "../types-DSPGWjxO.mjs";
-import "../types-Dryvv7LH.mjs";
-import { f as MediaProvider, p as MediaProviderCapabilities } from "../placeholder-CXfoCtCd.mjs";
-import "../runner-D4FL9usy.mjs";
-import "../index-CwRuZ-u8.mjs";
-import { d as Storage } from "../types-DZpT-PnG.mjs";
-import "../byline-fields-BX7rWKNU.mjs";
-import "../types-GaCtZ1k9.mjs";
-import "../validate-BMs11tan.mjs";
+import { i as ContentItem } from "../types-C_ly5eTp.mjs";
+import { $r as SandboxedPluginEntry, Br as MediaListResponse, Vr as MediaResponse, Yi as MediaItem, _a as ContentResponse, ci as PluginMcpRegistry, ga as ContentListResponse, ii as SandboxRunner, pi as EmailPipeline, t as DinewayConfig, ui as HookPipeline } from "../runtime-BOeiQsCv.mjs";
+import { t as Database } from "../types-DU0bU2Wu.mjs";
+import { A as PageMetadataContribution, D as PageFragmentContribution, F as PluginActor, Pt as Element, b as HttpAccess, ct as PluginRouteAuthorization, vt as PublicPageContext, xt as ResolvedPlugin } from "../types-C8XW6L19.mjs";
+import { d as Storage } from "../types-POH8PQZh.mjs";
+import "../types-Rc3gQqqw.mjs";
+import { f as MediaProvider, p as MediaProviderCapabilities } from "../placeholder-uvNRZBX9.mjs";
+import "../runner-1tC2tIRV.mjs";
+import "../index-D4y6NGiy.mjs";
+import "../byline-fields-CUvbslGc.mjs";
+import "../types-CDpH6MA4.mjs";
+import "../validate-CZvb-BKB.mjs";
 import "../index.mjs";
 import { Kysely } from "kysely";
 
@@ -298,10 +298,15 @@ interface DinewayHandlers {
     };
   }>>;
   handleRevisionRestore: (revisionId: string, callerUserId: string) => Promise<HandlerResponse>;
-  handlePluginApiRoute: (pluginId: string, method: string, path: string, request: Request) => Promise<HandlerResponse>;
+  handlePluginApiRoute: (pluginId: string, method: string, path: string, request: Request, invocation?: {
+    actor?: PluginActor | null;
+  }) => Promise<HandlerResponse>;
   handlePublicPluginApiRoute: (pluginId: string, method: string, path: string, request: Request) => Promise<HandlerResponse>;
   getPluginRouteMeta: (pluginId: string, path: string) => {
     public: boolean;
+    body: "json" | "raw";
+    maxBodyBytes?: number;
+    authorization?: PluginRouteAuthorization;
   } | null;
   getMediaProvider: (providerId: string) => MediaProvider | undefined;
   getMediaProviderList: () => Array<{
@@ -316,6 +321,9 @@ interface DinewayHandlers {
   hooks: HookPipeline;
   email: EmailPipeline | null;
   configuredPlugins: ResolvedPlugin[];
+  sandboxedPluginEntries: SandboxedPluginEntry[];
+  getPluginMcpRegistry: () => PluginMcpRegistry;
+  getPluginHttpAccess: (pluginId: string) => HttpAccess | undefined;
   config: DinewayConfig;
   getManifest: () => Promise<DinewayManifest>;
   invalidateManifest: () => void;

package/dist/{audit-D1cbG7xH.mjs → audit-ByVKIwWF.mjs}

@@ -1,4 +1,4 @@
-import { i as encodeCursor, r as decodeCursor } from "./types-DfuD0Afl.mjs";
+import { i as encodeCursor, r as decodeCursor } from "./types-Dq1qT19x.mjs";
 import { ulid } from "ulidx";
 
 //#region src/database/repositories/audit.ts

package/dist/auth/providers/github.d.mts

@@ -1,4 +1,4 @@
-import { r as AuthProviderDescriptor } from "../../types-Dryvv7LH.mjs";
+import { r as AuthProviderDescriptor } from "../../types-Rc3gQqqw.mjs";
 
 //#region src/auth/providers/github.d.ts
 /**

package/dist/auth/providers/google.d.mts

@@ -1,4 +1,4 @@
-import { r as AuthProviderDescriptor } from "../../types-Dryvv7LH.mjs";
+import { r as AuthProviderDescriptor } from "../../types-Rc3gQqqw.mjs";
 
 //#region src/auth/providers/google.d.ts
 /**

package/dist/{auth-control-guard-Dr14I98m.mjs → auth-control-guard-CqeUmQsv.mjs}

@@ -1,4 +1,4 @@
-import { t as apiError } from "./error-DCSuUAZW.mjs";
+import { t as apiError } from "./error-CytFlgcd.mjs";
 
 //#region src/api/auth-control-guard.ts
 function rejectApiTokenAuthControlWrite(locals, resource) {

package/dist/{authorize-BLO0m7fW.mjs → authorize-CcBxcHtz.mjs}

@@ -1,4 +1,4 @@
-import { t as apiError } from "./error-DCSuUAZW.mjs";
+import { t as apiError } from "./error-CytFlgcd.mjs";
 import { canActOnOwn, hasPermission } from "@dineway-ai/auth";
 
 //#region src/api/authorize.ts

package/dist/{briefing-CObXGOGz.mjs → briefing-BJaJI8dm.mjs}

@@ -1,4 +1,4 @@
-import { t as SiteBriefingAssembler } from "./briefing-gKWiGLt1.mjs";
+import { t as SiteBriefingAssembler } from "./briefing-CawZ59CY.mjs";
 
 //#region src/api/handlers/briefing.ts
 async function handleSiteBriefingGet(options, input) {
@@ -9,6 +9,7 @@ async function handleSiteBriefingGet(options, input) {
 				db: options.db,
 				storage: options.storage ?? null,
 				configuredPlugins: options.configuredPlugins ?? [],
+				sandboxedPluginEntries: options.sandboxedPluginEntries ?? [],
 				marketplaceUrl: options.marketplaceUrl,
 				permissions: options.permissions
 			}).assemble(input) }

package/dist/{briefing-gKWiGLt1.mjs → briefing-CawZ59CY.mjs}

@@ -1,10 +1,10 @@
-import { i as encodeCursor, r as decodeCursor } from "./types-DfuD0Afl.mjs";
-import { t as SiteActivityRepository } from "./site-activity-D7Xyropw.mjs";
-import { t as ReviewRequestRepository } from "./review-requests-gGMyYYhy.mjs";
-import { t as withTransaction } from "./transaction-CShMWIej.mjs";
-import { n as isSiteContextType, t as SITE_CONTEXT_TYPES } from "./context-types-DQh_XKkn.mjs";
-import { n as SchemaRegistry } from "./registry-CTkbIDB9.mjs";
-import { a as getSiteSettingsWithDb } from "./settings-yLjz_I4T.mjs";
+import { i as encodeCursor, r as decodeCursor } from "./types-Dq1qT19x.mjs";
+import { t as SiteActivityRepository } from "./site-activity-Dy3FROs0.mjs";
+import { t as ReviewRequestRepository } from "./review-requests-DUyEmtmG.mjs";
+import { t as withTransaction } from "./transaction-C2EOMTJA.mjs";
+import { n as isSiteContextType, t as SITE_CONTEXT_TYPES } from "./context-types-DqTo6C79.mjs";
+import { n as SchemaRegistry } from "./registry-CtyVedcN.mjs";
+import { a as getSiteSettingsWithDb } from "./settings-BbqgHWpU.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 
@@ -162,10 +162,33 @@ function buildPluginInfo(plugin, state, marketplaceUrl) {
 		iconUrl: isMarketplace && marketplaceUrl ? marketplaceIconUrl(marketplaceUrl, plugin.id) : void 0
 	};
 }
+function buildSandboxedPluginInfo(entry, state) {
+	const status = state?.status ?? "active";
+	const enabled = status === "active";
+	return {
+		id: entry.id,
+		name: state?.displayName || entry.id,
+		version: entry.version,
+		package: void 0,
+		enabled,
+		status,
+		source: "config",
+		sandboxed: true,
+		marketplaceVersion: void 0,
+		capabilities: entry.capabilities,
+		hasAdminPages: (entry.adminPages?.length ?? 0) > 0,
+		hasDashboardWidgets: (entry.adminWidgets?.length ?? 0) > 0,
+		hasHooks: false,
+		installedAt: state?.installedAt?.toISOString(),
+		activatedAt: state?.activatedAt?.toISOString() ?? void 0,
+		deactivatedAt: state?.deactivatedAt?.toISOString() ?? void 0,
+		description: state?.description ?? void 0
+	};
+}
 /**
 * List all configured plugins with their state
 */
-async function handlePluginList(db, configuredPlugins, marketplaceUrl) {
+async function handlePluginList(db, configuredPlugins, sandboxedPluginEntries, marketplaceUrl) {
 	try {
 		const allStates = await new PluginStateRepository(db).getAll();
 		const stateMap = new Map(allStates.map((s) => [s.pluginId, s]));
@@ -173,6 +196,11 @@ async function handlePluginList(db, configuredPlugins, marketplaceUrl) {
 		const items = configuredPlugins.map((plugin) => {
 			return buildPluginInfo(plugin, stateMap.get(plugin.id) ?? null, marketplaceUrl);
 		});
+		for (const entry of sandboxedPluginEntries) {
+			if (configuredIds.has(entry.id)) continue;
+			configuredIds.add(entry.id);
+			items.push(buildSandboxedPluginInfo(entry, stateMap.get(entry.id) ?? null));
+		}
 		for (const state of allStates) {
 			if (state.source !== "marketplace") continue;
 			if (configuredIds.has(state.pluginId)) continue;
@@ -212,20 +240,26 @@ async function handlePluginList(db, configuredPlugins, marketplaceUrl) {
 /**
 * Get a single plugin's info
 */
-async function handlePluginGet(db, configuredPlugins, pluginId, marketplaceUrl) {
+async function handlePluginGet(db, configuredPlugins, sandboxedPluginEntries, pluginId, marketplaceUrl) {
 	try {
+		const stateRepo = new PluginStateRepository(db);
 		const plugin = configuredPlugins.find((p) => p.id === pluginId);
-		if (!plugin) return {
+		if (plugin) return {
+			success: true,
+			data: { item: buildPluginInfo(plugin, await stateRepo.get(pluginId), marketplaceUrl) }
+		};
+		const sandboxed = sandboxedPluginEntries.find((entry) => entry.id === pluginId);
+		if (sandboxed) return {
+			success: true,
+			data: { item: buildSandboxedPluginInfo(sandboxed, await stateRepo.get(pluginId)) }
+		};
+		return {
 			success: false,
 			error: {
 				code: "NOT_FOUND",
 				message: `Plugin not found: ${pluginId}`
 			}
 		};
-		return {
-			success: true,
-			data: { item: buildPluginInfo(plugin, await new PluginStateRepository(db).get(pluginId), marketplaceUrl) }
-		};
 	} catch {
 		return {
 			success: false,
@@ -239,20 +273,26 @@ async function handlePluginGet(db, configuredPlugins, pluginId, marketplaceUrl)
 /**
 * Enable a plugin
 */
-async function handlePluginEnable(db, configuredPlugins, pluginId) {
+async function handlePluginEnable(db, configuredPlugins, sandboxedPluginEntries, pluginId) {
 	try {
+		const stateRepo = new PluginStateRepository(db);
 		const plugin = configuredPlugins.find((p) => p.id === pluginId);
-		if (!plugin) return {
+		if (plugin) return {
+			success: true,
+			data: { item: buildPluginInfo(plugin, await stateRepo.enable(pluginId, plugin.version)) }
+		};
+		const sandboxed = sandboxedPluginEntries.find((entry) => entry.id === pluginId);
+		if (sandboxed) return {
+			success: true,
+			data: { item: buildSandboxedPluginInfo(sandboxed, await stateRepo.enable(pluginId, sandboxed.version)) }
+		};
+		return {
 			success: false,
 			error: {
 				code: "NOT_FOUND",
 				message: `Plugin not found: ${pluginId}`
 			}
 		};
-		return {
-			success: true,
-			data: { item: buildPluginInfo(plugin, await new PluginStateRepository(db).enable(pluginId, plugin.version)) }
-		};
 	} catch {
 		return {
 			success: false,
@@ -266,20 +306,26 @@ async function handlePluginEnable(db, configuredPlugins, pluginId) {
 /**
 * Disable a plugin
 */
-async function handlePluginDisable(db, configuredPlugins, pluginId) {
+async function handlePluginDisable(db, configuredPlugins, sandboxedPluginEntries, pluginId) {
 	try {
+		const stateRepo = new PluginStateRepository(db);
 		const plugin = configuredPlugins.find((p) => p.id === pluginId);
-		if (!plugin) return {
+		if (plugin) return {
+			success: true,
+			data: { item: buildPluginInfo(plugin, await stateRepo.disable(pluginId, plugin.version)) }
+		};
+		const sandboxed = sandboxedPluginEntries.find((entry) => entry.id === pluginId);
+		if (sandboxed) return {
+			success: true,
+			data: { item: buildSandboxedPluginInfo(sandboxed, await stateRepo.disable(pluginId, sandboxed.version)) }
+		};
+		return {
 			success: false,
 			error: {
 				code: "NOT_FOUND",
 				message: `Plugin not found: ${pluginId}`
 			}
 		};
-		return {
-			success: true,
-			data: { item: buildPluginInfo(plugin, await new PluginStateRepository(db).disable(pluginId, plugin.version)) }
-		};
 	} catch {
 		return {
 			success: false,
@@ -614,6 +660,7 @@ const MAX_ACTIVITY_LIMIT = 100;
 const DEFAULT_TOKEN_BUDGET = 8e3;
 const TOKEN_CHARS = 4;
 const RELATIVE_SINCE_PATTERN = /^(\d+)(m|h|d|w)$/i;
+const PLUGIN_SCOPE_PREFIX_PATTERN = /^[a-z][a-z0-9_-]*$/;
 var SiteBriefingError = class extends Error {
 	constructor(message, code) {
 		super(message);
@@ -625,6 +672,7 @@ var SiteBriefingAssembler = class {
 	db;
 	storage;
 	configuredPlugins;
+	sandboxedPluginEntries;
 	marketplaceUrl;
 	permissions;
 	now;
@@ -632,6 +680,7 @@ var SiteBriefingAssembler = class {
 		this.db = options.db;
 		this.storage = options.storage ?? null;
 		this.configuredPlugins = options.configuredPlugins ?? [];
+		this.sandboxedPluginEntries = options.sandboxedPluginEntries ?? [];
 		this.marketplaceUrl = options.marketplaceUrl;
 		this.permissions = {
 			canReadContent: false,
@@ -734,7 +783,7 @@ var SiteBriefingAssembler = class {
 	}
 	async loadPluginSection() {
 		if (!this.permissions.canReadPlugins) return omittedSection({ active: [] }, "missing plugins:read permission");
-		const result = await handlePluginList(this.db, this.configuredPlugins, this.marketplaceUrl);
+		const result = await handlePluginList(this.db, this.configuredPlugins, this.sandboxedPluginEntries, this.marketplaceUrl);
 		if (!result.success || !result.data) return omittedSection({ active: [] }, "plugin list could not be loaded");
 		return includedSection({ active: result.data.items.filter((plugin) => plugin.enabled).map((plugin) => summarizePlugin(plugin)) });
 	}
@@ -825,6 +874,19 @@ function parseSiteBriefingScope(scope) {
 			pluginId: parts[1]
 		};
 	}
+	if (parts.length >= 3 && PLUGIN_SCOPE_PREFIX_PATTERN.test(parts[0] ?? "") && parts.slice(1).every((part) => part.length > 0)) {
+		const pluginId = parts[0];
+		return {
+			type: "plugin_extension",
+			scope,
+			ancestors: [
+				"site",
+				`plugin:${pluginId}`,
+				scope
+			],
+			pluginId
+		};
+	}
 	if (parts[0] === "taxonomy" && parts.length === 2 && parts[1].length > 0) {
 		const resolved = `taxonomy:${parts[1]}`;
 		return {
@@ -843,7 +905,7 @@ function parseSiteBriefingScope(scope) {
 			menuId: parts[1]
 		};
 	}
-	throw new SiteBriefingError(`Invalid scope "${scope}". Expected site, collection:{slug}, content:{collection}:{id}, plugin:{id}, taxonomy:{id}, or menu:{id}.`, "INVALID_SCOPE");
+	throw new SiteBriefingError(`Invalid scope "${scope}". Expected a core scope or a namespaced plugin scope such as restaurant:location:{id}.`, "INVALID_SCOPE");
 }
 function formatSiteBriefingText(briefing) {
 	const lines = [];