feat: add the snippets plugin (B2)

plugins/snippets/src/backend/execution.ts

@@ -0,0 +1,82 @@
+export interface SnippetExecutionResult {
+  success: boolean;
+  output: string;
+  error?: string;
+}
+
+export interface SnippetHostVars {
+  ip?: string;
+  username?: string;
+  port?: number | string;
+  name?: string;
+}
+
+const INPUT_PATTERN =
+  /\$\{INPUT_(\d+)(?::([^}$]+))?\}|\$INPUT_(\d+)(?![a-zA-Z0-9_])/g;
+
+function replaceVar(content: string, name: string, value?: string): string {
+  if (value === undefined) return content;
+  const pattern = new RegExp(`\\$\\{?${name}\\}?`, "g");
+  return content.replace(pattern, value);
+}
+
+/**
+ * Mirrors src/ui/lib/snippet-variables.ts resolveSnippetContent. Frontend and
+ * backend are separate builds, so this is kept as a small standalone copy
+ * rather than a shared package for one pure function.
+ */
+export function resolveSnippetCommand(
+  content: string,
+  host: SnippetHostVars | null,
+  inputValues: Record<string, string> = {},
+): string {
+  let resolved = content;
+
+  resolved = replaceVar(resolved, "HOST", host?.ip);
+  resolved = replaceVar(resolved, "USER", host?.username);
+  resolved = replaceVar(
+    resolved,
+    "PORT",
+    host?.port !== undefined ? String(host.port) : undefined,
+  );
+  resolved = replaceVar(resolved, "NAME", host?.name);
+
+  resolved = resolved.replace(
+    INPUT_PATTERN,
+    (
+      fullMatch,
+      braceDigits: string | undefined,
+      _label,
+      plainDigits: string | undefined,
+    ) => {
+      const key = `INPUT_${braceDigits ?? plainDigits}`;
+      return key in inputValues ? inputValues[key] : fullMatch;
+    },
+  );
+
+  return resolved;
+}
+
+export function getSnippetExecutionTimeoutMs(
+  value = process.env.SNIPPET_EXECUTION_TIMEOUT_SECONDS,
+): number | undefined {
+  if (value === undefined || value.trim() === "") return undefined;
+
+  const seconds = Number(value);
+  if (!Number.isFinite(seconds) || seconds <= 0) return undefined;
+
+  return seconds * 1000;
+}
+
+export function createSnippetExecutionResult(
+  exitCode: number | null,
+  output: string,
+  errorOutput: string,
+): SnippetExecutionResult {
+  const success = exitCode === 0 || (exitCode === null && !errorOutput);
+  return {
+    success,
+    output,
+    ...(errorOutput ? { error: errorOutput } : {}),
+  };
+}

plugins/snippets/src/backend/index.ts

@@ -0,0 +1,156 @@
+import type { Router } from "express";
+import type { PluginContext } from "@termix/plugin-sdk/backend";
+import { snippetAccess, snippetFolders, snippets } from "./tables.js";
+import { createSnippetRepository } from "./repository.js";
+import { registerSnippetRoutes } from "./routes.js";
+import { resolveSnippetCommand } from "./execution.js";
+
+/** What other plugins get from ctx.services.get("snippets.access", {userId}). */
+export interface SnippetsService {
+  /** The calling user's own snippets (not shared ones), full content included. */
+  list: () => Promise<
+    Array<{
+      id: number;
+      name: string;
+      content: string;
+      description: string | null;
+      isNote: boolean;
+      folder: string | null;
+    }>
+  >;
+  /** A snippet the calling user owns or was shared with them. */
+  get: (id: number) => Promise<{
+    id: number;
+    name: string;
+    content: string;
+    isNote: boolean;
+  } | null>;
+  resolveCommand: (
+    id: number,
+    vars: { ip?: string; username?: string; port?: number; name?: string },
+    inputValues?: Record<string, string>,
+  ) => Promise<string | null>;
+  /** Creates a snippet owned by the calling user. */
+  create: (input: {
+    name: string;
+    content: string;
+    description?: string | null;
+    folder?: string | null;
+  }) => Promise<{ id: number; name: string }>;
+  /** Updates a snippet the calling user owns. Throws if not found. */
+  update: (
+    id: number,
+    changes: {
+      name?: string;
+      content?: string;
+      description?: string | null;
+      folder?: string | null;
+    },
+  ) => Promise<void>;
+  /** Deletes a snippet the calling user owns. Returns whether one was deleted. */
+  remove: (id: number) => Promise<boolean>;
+}
+
+export async function activate(ctx: PluginContext) {
+  const snippetsTable = await ctx.db.define(snippets);
+  const foldersTable = await ctx.db.define(snippetFolders);
+  const accessTable = await ctx.db.define(snippetAccess);
+
+  const repo = createSnippetRepository(
+    ctx.db,
+    snippetsTable,
+    foldersTable,
+    accessTable,
+  );
+
+  registerSnippetRoutes(ctx.http.router<Router>(), repo, ctx);
+
+  ctx.sync.registerEntity({
+    type: "snippetFolders",
+    table: foldersTable,
+    order: 40,
+  });
+  ctx.sync.registerEntity({
+    type: "snippets",
+    table: snippetsTable,
+    order: 60,
+  });
+
+  // The user row survives a password-reset data wipe, so it never triggers
+  // our refUser() cascade; this topic is core's way of telling us to drop
+  // our copy of that user's data too.
+  ctx.events.on("user.data_wiped", (payload) => {
+    const userId = (payload as { userId?: string } | null)?.userId;
+    if (userId) void repo.deleteByUserId(userId);
+  });
+
+  async function findAccessible(userId: string, id: number) {
+    const owned = await repo.findOwnedById(userId, id);
+    if (owned) return owned;
+    const roleIds = await repo.listUserRoleIds(userId);
+    return repo.findAccessibleSharedSnippet(id, userId, roleIds);
+  }
+
+  const service: SnippetsService = {
+    list: async () => {
+      const userId = ctx.currentActor();
+      if (!userId) return [];
+      const owned = await repo.listOwnedSnippets(userId);
+      return owned.map((s) => ({
+        id: s.id,
+        name: s.name,
+        content: s.content,
+        description: s.description,
+        isNote: s.isNote,
+        folder: s.folder,
+      }));
+    },
+    get: async (id) => {
+      const userId = ctx.currentActor();
+      if (!userId) return null;
+      const snippet = await findAccessible(userId, id);
+      if (!snippet) return null;
+      return {
+        id: snippet.id,
+        name: snippet.name,
+        content: snippet.content,
+        isNote: snippet.isNote,
+      };
+    },
+    resolveCommand: async (id, vars, inputValues = {}) => {
+      const userId = ctx.currentActor();
+      if (!userId) return null;
+      const snippet = await findAccessible(userId, id);
+      if (!snippet) return null;
+      return resolveSnippetCommand(snippet.content, vars, inputValues);
+    },
+    create: async (input) => {
+      const userId = ctx.currentActor();
+      if (!userId) throw new Error("snippets.access.create needs an actor");
+      const created = await repo.createSnippet(userId, input);
+      return { id: created.id, name: created.name };
+    },
+    update: async (id, changes) => {
+      const userId = ctx.currentActor();
+      if (!userId) throw new Error("snippets.access.update needs an actor");
+      const result = await repo.updateSnippet(userId, id, changes);
+      if (!result) throw new Error("Snippet not found");
+    },
+    remove: async (id) => {
+      const userId = ctx.currentActor();
+      if (!userId) throw new Error("snippets.access.remove needs an actor");
+      const existing = await repo.deleteSnippet(userId, id);
+      if (existing?.syncId) {
+        await ctx.sync.recordTombstone(userId, "snippets", existing.syncId);
+      }
+      return !!existing;
+    },
+  };
+  ctx.services.provide("snippets.access", service);
+
+  ctx.log.info("Snippets routes mounted at /plugin-api/snippets");
+}
+
+export async function deactivate() {
+  // Everything above was registered through ctx and is disposed by core.
+}

plugins/snippets/src/backend/reorder.ts

@@ -0,0 +1,29 @@
+import type { SnippetReorderUpdate } from "./repository.js";
+
+type SnippetReorderRequestBody = {
+  snippets?: unknown;
+  updates?: unknown;
+};
+
+export function extractSnippetReorderUpdates(
+  body: unknown,
+): SnippetReorderUpdate[] | null {
+  if (!body || typeof body !== "object") {
+    return null;
+  }
+
+  const payload = body as SnippetReorderRequestBody;
+  // Keep accepting the legacy `updates` key so older clients do not break
+  // while the web and desktop helpers converge on `snippets`.
+  const snippetsUpdates = Array.isArray(payload.snippets)
+    ? payload.snippets
+    : Array.isArray(payload.updates)
+      ? payload.updates
+      : null;
+
+  if (!snippetsUpdates) {
+    return null;
+  }
+
+  return snippetsUpdates as SnippetReorderUpdate[];
+}

plugins/snippets/src/backend/repository.ts

@@ -0,0 +1,896 @@
+import { randomUUID } from "node:crypto";
+import {
+  and,
+  asc,
+  desc,
+  eq,
+  gte,
+  inArray,
+  isNull,
+  like,
+  or,
+  sql,
+} from "drizzle-orm";
+import type { PluginDatabase } from "@termix/plugin-sdk/backend";
+
+export interface SnippetRecord {
+  id: number;
+  userId: string;
+  name: string;
+  content: string;
+  description: string | null;
+  folder: string | null;
+  order: number;
+  syncId: string | null;
+  createdAt: string;
+  updatedAt: string;
+  hostFilter: string | null;
+  isNote: boolean;
+}
+
+export interface SnippetFolderRecord {
+  id: number;
+  userId: string;
+  name: string;
+  color: string | null;
+  icon: string | null;
+  syncId: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface RenameSnippetFolderResult {
+  status: "renamed" | "missing" | "conflict";
+}
+
+export interface SnippetReorderUpdate {
+  id: number;
+  order: number;
+  folder?: string;
+}
+
+export interface NewSnippetInput {
+  name: string;
+  content: string;
+  description?: string | null;
+  folder?: string | null;
+  order?: number | null;
+  hostFilter?: unknown;
+  isNote?: boolean;
+}
+
+export interface SnippetUpdateInput {
+  name?: string;
+  content?: string;
+  description?: string | null;
+  folder?: string | null;
+  order?: number;
+  hostFilter?: unknown;
+  isNote?: boolean;
+}
+
+export interface UpdateSnippetResult {
+  existing: SnippetRecord;
+  updated: SnippetRecord;
+}
+
+export interface SnippetBulkImportResult {
+  snippetsImported: number;
+  snippetsSkipped: number;
+  snippetsUpdated: number;
+  foldersImported: number;
+  foldersSkipped: number;
+  failed: number;
+  errors: string[];
+}
+
+interface BulkImportSnippetInput {
+  name?: unknown;
+  content?: unknown;
+  description?: string | null;
+  folder?: string | null;
+  order?: unknown;
+  hostFilter?: string | null;
+}
+
+interface BulkImportFolderInput {
+  name?: unknown;
+  color?: string | null;
+  icon?: string | null;
+}
+
+export interface RbacAccessListItem {
+  id: number;
+  targetType: "user" | "role";
+  userId: string | null;
+  roleId: number | null;
+  username: string | null;
+  roleName: string | null;
+  roleDisplayName: string | null;
+  grantedBy: string;
+  grantedByUsername: string | null;
+  permissionLevel: string;
+  expiresAt: string | null;
+  createdAt: string;
+}
+
+export type SnippetAccessTarget =
+  | { targetType: "user"; targetUserId: string }
+  | { targetType: "role"; targetRoleId: number };
+
+export type UpsertSnippetAccessInput = SnippetAccessTarget & {
+  snippetId: number;
+  grantedBy: string;
+  expiresAt: string | null;
+};
+
+export interface RbacSharedSnippet {
+  id: number;
+  name: string;
+  content: string;
+  description: string | null;
+  folder: string | null;
+  ownerUsername: string;
+  permissionLevel: string;
+  expiresAt: string | null;
+}
+
+export interface RbacVisibleSharedSnippet extends RbacSharedSnippet {
+  userId: string;
+  order: number;
+  createdAt: string;
+  updatedAt: string;
+  isNote: boolean;
+}
+
+export interface RbacAccessibleSnippet extends RbacVisibleSharedSnippet {
+  hostFilter: string | null;
+}
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+// The tables come from ctx.db.define/ctx.db.refs, which the SDK hands back
+// untyped, and the drizzle handle is the server's own. Typed at this module's
+// edge instead.
+type Table = any;
+type Drizzle = any;
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+function toAccessListItem(
+  row: Omit<RbacAccessListItem, "targetType">,
+): RbacAccessListItem {
+  return { ...row, targetType: row.userId ? "user" : "role" };
+}
+
+export type SnippetRepository = ReturnType<typeof createSnippetRepository>;
+
+/**
+ * Snippet, folder and sharing storage. Written without RETURNING so it runs
+ * the same on all three engines: an insert or update is read back by id/sync
+ * id rather than relying on `.returning()`.
+ */
+export function createSnippetRepository(
+  db: PluginDatabase,
+  snippets: Table,
+  folders: Table,
+  access: Table,
+) {
+  const client = () => db.client<Drizzle>();
+  const refs = () =>
+    db.refs<{ users: Table; roles: Table; userRoles: Table }>();
+
+  async function findOwnedById(
+    userId: string,
+    snippetId: number,
+  ): Promise<SnippetRecord | null> {
+    const drizzle = await client();
+    const rows = await drizzle
+      .select()
+      .from(snippets)
+      .where(and(eq(snippets.id, snippetId), eq(snippets.userId, userId)))
+      .limit(1);
+    return rows[0] ?? null;
+  }
+
+  async function findFolderByName(
+    userId: string,
+    name: string,
+  ): Promise<SnippetFolderRecord | null> {
+    const drizzle = await client();
+    const rows = await drizzle
+      .select()
+      .from(folders)
+      .where(and(eq(folders.userId, userId), eq(folders.name, name)))
+      .limit(1);
+    return rows[0] ?? null;
+  }
+
+  async function maxOrderForFolder(
+    userId: string,
+    folder: string | null,
+  ): Promise<number> {
+    const drizzle = await client();
+    const result = await drizzle
+      .select({ maxOrder: sql<number>`MAX(${snippets.order})` })
+      .from(snippets)
+      .where(
+        and(
+          eq(snippets.userId, userId),
+          folder
+            ? eq(snippets.folder, folder)
+            : sql`(${snippets.folder} IS NULL OR ${snippets.folder} = '')`,
+        ),
+      );
+    return result[0]?.maxOrder ?? -1;
+  }
+
+  async function nextOrderForFolder(
+    userId: string,
+    folder: string,
+  ): Promise<number> {
+    return (await maxOrderForFolder(userId, folder || null)) + 1;
+  }
+
+  async function findByNameAndFolder(
+    userId: string,
+    name: string,
+    folder: string | null,
+  ): Promise<SnippetRecord | null> {
+    const drizzle = await client();
+    const rows = await drizzle
+      .select()
+      .from(snippets)
+      .where(
+        and(
+          eq(snippets.userId, userId),
+          eq(snippets.name, name),
+          folder
+            ? eq(snippets.folder, folder)
+            : sql`(${snippets.folder} IS NULL OR ${snippets.folder} = '')`,
+        ),
+      )
+      .limit(1);
+    return rows[0] ?? null;
+  }
+
+  function userOrRoleAccessFilter(userId: string, roleIds: number[]) {
+    if (roleIds.length === 0) return eq(access.userId, userId);
+    return or(eq(access.userId, userId), inArray(access.roleId, roleIds));
+  }
+
+  async function findSnippetAccess(
+    snippetId: number,
+    target: SnippetAccessTarget,
+  ) {
+    const drizzle = await client();
+    const rows = await drizzle
+      .select()
+      .from(access)
+      .where(
+        and(
+          eq(access.snippetId, snippetId),
+          target.targetType === "user"
+            ? eq(access.userId, target.targetUserId)
+            : eq(access.roleId, target.targetRoleId),
+        ),
+      )
+      .limit(1);
+    return rows[0] ?? null;
+  }
+
+  return {
+    findOwnedById,
+
+    async listFolders(userId: string): Promise<SnippetFolderRecord[]> {
+      const drizzle = await client();
+      return drizzle
+        .select()
+        .from(folders)
+        .where(eq(folders.userId, userId))
+        .orderBy(asc(folders.name));
+    },
+
+    async listSnippetsForExport(userId: string): Promise<SnippetRecord[]> {
+      const drizzle = await client();
+      return drizzle
+        .select()
+        .from(snippets)
+        .where(eq(snippets.userId, userId))
+        .orderBy(sql`coalesce(${snippets.folder}, '')`, asc(snippets.order));
+    },
+
+    async listFoldersForExport(userId: string): Promise<SnippetFolderRecord[]> {
+      const drizzle = await client();
+      return drizzle
+        .select()
+        .from(folders)
+        .where(eq(folders.userId, userId))
+        .orderBy(asc(folders.name));
+    },
+
+    async listOwnedSnippetsInFolder(
+      userId: string,
+      folder: string,
+    ): Promise<SnippetRecord[]> {
+      const drizzle = await client();
+      return drizzle
+        .select()
+        .from(snippets)
+        .where(
+          and(
+            eq(snippets.userId, userId),
+            or(
+              eq(snippets.folder, folder),
+              like(snippets.folder, `${folder} / %`),
+            ),
+          ),
+        );
+    },
+
+    async listOwnedSnippets(userId: string): Promise<SnippetRecord[]> {
+      const drizzle = await client();
+      return drizzle
+        .select()
+        .from(snippets)
+        .where(eq(snippets.userId, userId))
+        .orderBy(
+          sql`CASE WHEN ${snippets.folder} IS NULL OR ${snippets.folder} = '' THEN 0 ELSE 1 END`,
+          asc(snippets.folder),
+          asc(snippets.order),
+          sql`${snippets.updatedAt} DESC`,
+        );
+    },
+
+    async reorderSnippets(
+      userId: string,
+      updates: SnippetReorderUpdate[],
+    ): Promise<void> {
+      const drizzle = await client();
+      for (const update of updates) {
+        const { id, order, folder } = update;
+        if (!id || order === undefined) continue;
+
+        const updateFields: Partial<{ order: number; folder: string | null }> =
+          {
+            order,
+          };
+        if (folder !== undefined) updateFields.folder = folder?.trim() || null;
+
+        await drizzle
+          .update(snippets)
+          .set(updateFields)
+          .where(and(eq(snippets.id, id), eq(snippets.userId, userId)));
+      }
+      await db.persist();
+    },
+
+    async createSnippet(
+      userId: string,
+      input: NewSnippetInput,
+    ): Promise<SnippetRecord> {
+      const folderValue = input.folder?.trim() || "";
+      const order =
+        input.order === undefined || input.order === null
+          ? await nextOrderForFolder(userId, folderValue)
+          : input.order;
+
+      const syncId = randomUUID();
+      const drizzle = await client();
+      await drizzle.insert(snippets).values({
+        syncId,
+        userId,
+        name: input.name.trim(),
+        content: input.content.trim(),
+        description: input.description?.trim() || null,
+        folder: input.folder?.trim() || null,
+        order,
+        hostFilter: input.hostFilter ? JSON.stringify(input.hostFilter) : null,
+        isNote: input.isNote ?? false,
+      });
+      await db.persist();
+
+      const rows = await drizzle
+        .select()
+        .from(snippets)
+        .where(eq(snippets.syncId, syncId))
+        .limit(1);
+      return rows[0];
+    },
+
+    async updateSnippet(
+      userId: string,
+      snippetId: number,
+      input: SnippetUpdateInput,
+    ): Promise<UpdateSnippetResult | null> {
+      const existing = await findOwnedById(userId, snippetId);
+      if (!existing) return null;
+
+      const updateFields: Record<string, unknown> = {
+        updatedAt: sql`CURRENT_TIMESTAMP`,
+      };
+      if (input.name !== undefined) updateFields.name = input.name.trim();
+      if (input.content !== undefined)
+        updateFields.content = input.content.trim();
+      if (input.description !== undefined)
+        updateFields.description = input.description?.trim() || null;
+      if (input.folder !== undefined)
+        updateFields.folder = input.folder?.trim() || null;
+      if (input.order !== undefined) updateFields.order = input.order;
+      if (input.hostFilter !== undefined)
+        updateFields.hostFilter = input.hostFilter
+          ? JSON.stringify(input.hostFilter)
+          : null;
+      if (input.isNote !== undefined) updateFields.isNote = input.isNote;
+
+      const drizzle = await client();
+      await drizzle
+        .update(snippets)
+        .set(updateFields)
+        .where(and(eq(snippets.id, snippetId), eq(snippets.userId, userId)));
+      await db.persist();
+
+      const updated = await findOwnedById(userId, snippetId);
+      return { existing, updated: updated as SnippetRecord };
+    },
+
+    async deleteSnippet(
+      userId: string,
+      snippetId: number,
+    ): Promise<SnippetRecord | null> {
+      const existing = await findOwnedById(userId, snippetId);
+      if (!existing) return null;
+
+      const drizzle = await client();
+      await drizzle
+        .delete(snippets)
+        .where(and(eq(snippets.id, snippetId), eq(snippets.userId, userId)));
+      await db.persist();
+      return existing;
+    },
+
+    async bulkImport(
+      userId: string,
+      snippetsToImport: unknown[] | undefined,
+      foldersToImport: unknown[] | undefined,
+      overwrite: boolean,
+    ): Promise<SnippetBulkImportResult> {
+      const results: SnippetBulkImportResult = {
+        snippetsImported: 0,
+        snippetsSkipped: 0,
+        snippetsUpdated: 0,
+        foldersImported: 0,
+        foldersSkipped: 0,
+        failed: 0,
+        errors: [],
+      };
+
+      const drizzle = await client();
+      let changed = false;
+
+      if (Array.isArray(foldersToImport)) {
+        for (const rawFolder of foldersToImport) {
+          const folder = rawFolder as BulkImportFolderInput;
+          if (!isNonEmptyString(folder.name)) {
+            results.failed++;
+            results.errors.push(`Folder missing name`);
+            continue;
+          }
+
+          const existing = await findFolderByName(userId, folder.name);
+          if (existing) {
+            results.foldersSkipped++;
+            continue;
+          }
+
+          await drizzle.insert(folders).values({
+            syncId: randomUUID(),
+            userId,
+            name: folder.name.trim(),
+            color: folder.color?.trim() || null,
+            icon: folder.icon?.trim() || null,
+          });
+          changed = true;
+          results.foldersImported++;
+        }
+      }
+
+      if (Array.isArray(snippetsToImport)) {
+        for (let i = 0; i < snippetsToImport.length; i++) {
+          const snippet = snippetsToImport[i] as BulkImportSnippetInput;
+
+          if (
+            !isNonEmptyString(snippet.name) ||
+            !isNonEmptyString(snippet.content)
+          ) {
+            results.failed++;
+            results.errors.push(
+              `Snippet ${i + 1}: name and content are required`,
+            );
+            continue;
+          }
+
+          const folderVal = snippet.folder?.trim() || null;
+          const existing = await findByNameAndFolder(
+            userId,
+            snippet.name.trim(),
+            folderVal,
+          );
+
+          if (existing) {
+            if (!overwrite) {
+              results.snippetsSkipped++;
+              continue;
+            }
+
+            await drizzle
+              .update(snippets)
+              .set({
+                content: snippet.content.trim(),
+                description: snippet.description?.trim() || null,
+                folder: folderVal,
+                order:
+                  typeof snippet.order === "number"
+                    ? snippet.order
+                    : existing.order,
+                hostFilter: snippet.hostFilter || null,
+                updatedAt: sql`CURRENT_TIMESTAMP`,
+              })
+              .where(
+                and(eq(snippets.id, existing.id), eq(snippets.userId, userId)),
+              );
+            changed = true;
+            results.snippetsUpdated++;
+            continue;
+          }
+
+          const maxOrder = await maxOrderForFolder(userId, folderVal);
+          await drizzle.insert(snippets).values({
+            syncId: randomUUID(),
+            userId,
+            name: snippet.name.trim(),
+            content: snippet.content.trim(),
+            description: snippet.description?.trim() || null,
+            folder: folderVal,
+            order:
+              typeof snippet.order === "number" ? snippet.order : maxOrder + 1,
+            hostFilter: snippet.hostFilter || null,
+          });
+          changed = true;
+          results.snippetsImported++;
+        }
+      }
+
+      if (changed) await db.persist();
+      return results;
+    },
+
+    async createFolder(
+      userId: string,
+      name: string,
+      color: string | null | undefined,
+      icon: string | null | undefined,
+    ): Promise<SnippetFolderRecord | null> {
+      const existing = await findFolderByName(userId, name);
+      if (existing) return null;
+
+      const syncId = randomUUID();
+      const drizzle = await client();
+      await drizzle.insert(folders).values({
+        syncId,
+        userId,
+        name: name.trim(),
+        color: color?.trim() || null,
+        icon: icon?.trim() || null,
+      });
+      await db.persist();
+
+      const rows = await drizzle
+        .select()
+        .from(folders)
+        .where(eq(folders.syncId, syncId))
+        .limit(1);
+      return rows[0] ?? null;
+    },
+
+    async updateFolderMetadata(
+      userId: string,
+      name: string,
+      color: string | null | undefined,
+      icon: string | null | undefined,
+    ): Promise<SnippetFolderRecord | null> {
+      const existing = await findFolderByName(userId, name);
+      if (!existing) return null;
+
+      const updateFields: Record<string, unknown> = {
+        updatedAt: sql`CURRENT_TIMESTAMP`,
+      };
+      if (color !== undefined) updateFields.color = color?.trim() || null;
+      if (icon !== undefined) updateFields.icon = icon?.trim() || null;
+
+      const drizzle = await client();
+      await drizzle
+        .update(folders)
+        .set(updateFields)
+        .where(and(eq(folders.userId, userId), eq(folders.name, name)));
+      await db.persist();
+
+      return findFolderByName(userId, name);
+    },
+
+    async renameFolder(
+      userId: string,
+      oldName: string,
+      newName: string,
+    ): Promise<RenameSnippetFolderResult> {
+      const existing = await findFolderByName(userId, oldName);
+      if (!existing) return { status: "missing" };
+
+      const nameExists = await findFolderByName(userId, newName);
+      if (nameExists) return { status: "conflict" };
+
+      const drizzle = await client();
+      await drizzle
+        .update(folders)
+        .set({ name: newName, updatedAt: sql`CURRENT_TIMESTAMP` })
+        .where(and(eq(folders.userId, userId), eq(folders.name, oldName)));
+
+      await drizzle
+        .update(snippets)
+        .set({ folder: newName })
+        .where(and(eq(snippets.userId, userId), eq(snippets.folder, oldName)));
+
+      await db.persist();
+      return { status: "renamed" };
+    },
+
+    async deleteFolder(
+      userId: string,
+      name: string,
+    ): Promise<{ syncId: string | null } | null> {
+      const drizzle = await client();
+      await drizzle
+        .update(snippets)
+        .set({ folder: null })
+        .where(and(eq(snippets.userId, userId), eq(snippets.folder, name)));
+
+      const existing = await findFolderByName(userId, name);
+      if (!existing) {
+        await db.persist();
+        return null;
+      }
+
+      await drizzle
+        .delete(folders)
+        .where(and(eq(folders.userId, userId), eq(folders.name, name)));
+      await db.persist();
+      return { syncId: existing.syncId };
+    },
+
+    /** Wipes a user's snippets and folders, for the password-reset data-wipe flow. */
+    async deleteByUserId(userId: string): Promise<void> {
+      const drizzle = await client();
+      await drizzle.delete(snippets).where(eq(snippets.userId, userId));
+      await drizzle.delete(folders).where(eq(folders.userId, userId));
+      await db.persist();
+    },
+
+    // Sharing (moved from core's RbacAccessRepository)
+
+    async listSnippetAccess(snippetId: number): Promise<RbacAccessListItem[]> {
+      const drizzle = await client();
+      const { users, roles } = await refs();
+      const rows = await drizzle
+        .select({
+          id: access.id,
+          userId: access.userId,
+          roleId: access.roleId,
+          username: users.username,
+          roleName: roles.name,
+          roleDisplayName: roles.displayName,
+          grantedBy: access.grantedBy,
+          grantedByUsername: sql<
+            string | null
+          >`(SELECT username FROM users WHERE id = ${access.grantedBy})`,
+          permissionLevel: access.permissionLevel,
+          expiresAt: access.expiresAt,
+          createdAt: access.createdAt,
+        })
+        .from(access)
+        .leftJoin(users, eq(access.userId, users.id))
+        .leftJoin(roles, eq(access.roleId, roles.id))
+        .where(eq(access.snippetId, snippetId))
+        .orderBy(desc(access.createdAt));
+
+      return rows.map(toAccessListItem);
+    },
+
+    async upsertSnippetAccess(
+      input: UpsertSnippetAccessInput,
+    ): Promise<{ id: number; created: boolean }> {
+      const existing = await findSnippetAccess(input.snippetId, input);
+      const drizzle = await client();
+
+      if (existing) {
+        await drizzle
+          .update(access)
+          .set({ expiresAt: input.expiresAt })
+          .where(eq(access.id, existing.id));
+        await db.persist();
+        return { id: existing.id, created: false };
+      }
+
+      const now = new Date().toISOString();
+      await drizzle.insert(access).values({
+        snippetId: input.snippetId,
+        userId: input.targetType === "user" ? input.targetUserId : null,
+        roleId: input.targetType === "role" ? input.targetRoleId : null,
+        grantedBy: input.grantedBy,
+        permissionLevel: "view",
+        expiresAt: input.expiresAt,
+        createdAt: now,
+      });
+      await db.persist();
+
+      const created = await findSnippetAccess(input.snippetId, input);
+      return { id: created!.id, created: true };
+    },
+
+    async revokeSnippetAccess(
+      accessId: number,
+      snippetId: number,
+    ): Promise<void> {
+      const drizzle = await client();
+      await drizzle
+        .delete(access)
+        .where(and(eq(access.id, accessId), eq(access.snippetId, snippetId)));
+      await db.persist();
+    },
+
+    async listSharedSnippets(
+      userId: string,
+      roleIds: number[],
+      now = new Date().toISOString(),
+    ): Promise<RbacSharedSnippet[]> {
+      const drizzle = await client();
+      const { users } = await refs();
+
+      const directShared = await drizzle
+        .select({
+          id: snippets.id,
+          name: snippets.name,
+          content: snippets.content,
+          description: snippets.description,
+          folder: snippets.folder,
+          ownerUsername: users.username,
+          permissionLevel: access.permissionLevel,
+          expiresAt: access.expiresAt,
+        })
+        .from(access)
+        .innerJoin(snippets, eq(access.snippetId, snippets.id))
+        .innerJoin(users, eq(snippets.userId, users.id))
+        .where(
+          and(
+            eq(access.userId, userId),
+            or(isNull(access.expiresAt), gte(access.expiresAt, now)),
+          ),
+        );
+
+      if (roleIds.length === 0) return directShared;
+
+      const directIds = new Set(directShared.map((s: { id: number }) => s.id));
+      const roleShared = await drizzle
+        .select({
+          id: snippets.id,
+          name: snippets.name,
+          content: snippets.content,
+          description: snippets.description,
+          folder: snippets.folder,
+          ownerUsername: users.username,
+          permissionLevel: access.permissionLevel,
+          expiresAt: access.expiresAt,
+        })
+        .from(access)
+        .innerJoin(snippets, eq(access.snippetId, snippets.id))
+        .innerJoin(users, eq(snippets.userId, users.id))
+        .where(
+          and(
+            or(isNull(access.expiresAt), gte(access.expiresAt, now)),
+            inArray(access.roleId, roleIds),
+          ),
+        );
+
+      return [
+        ...directShared,
+        ...roleShared.filter((s: { id: number }) => !directIds.has(s.id)),
+      ];
+    },
+
+    async listVisibleSharedSnippets(
+      userId: string,
+      roleIds: number[],
+      now = new Date().toISOString(),
+    ): Promise<RbacVisibleSharedSnippet[]> {
+      const drizzle = await client();
+      const { users } = await refs();
+      return drizzle
+        .select({
+          id: snippets.id,
+          userId: snippets.userId,
+          name: snippets.name,
+          content: snippets.content,
+          description: snippets.description,
+          folder: snippets.folder,
+          order: snippets.order,
+          createdAt: snippets.createdAt,
+          updatedAt: snippets.updatedAt,
+          isNote: snippets.isNote,
+          ownerUsername: users.username,
+          permissionLevel: access.permissionLevel,
+          expiresAt: access.expiresAt,
+        })
+        .from(access)
+        .innerJoin(snippets, eq(access.snippetId, snippets.id))
+        .innerJoin(users, eq(snippets.userId, users.id))
+        .where(
+          and(
+            userOrRoleAccessFilter(userId, roleIds),
+            or(isNull(access.expiresAt), gte(access.expiresAt, now)),
+          ),
+        );
+    },
+
+    async findAccessibleSharedSnippet(
+      snippetId: number,
+      userId: string,
+      roleIds: number[],
+      now = new Date().toISOString(),
+    ): Promise<RbacAccessibleSnippet | null> {
+      const drizzle = await client();
+      const { users } = await refs();
+      const rows = await drizzle
+        .select({
+          id: snippets.id,
+          userId: snippets.userId,
+          name: snippets.name,
+          content: snippets.content,
+          description: snippets.description,
+          folder: snippets.folder,
+          order: snippets.order,
+          createdAt: snippets.createdAt,
+          updatedAt: snippets.updatedAt,
+          hostFilter: snippets.hostFilter,
+          isNote: snippets.isNote,
+          ownerUsername: users.username,
+          permissionLevel: access.permissionLevel,
+          expiresAt: access.expiresAt,
+        })
+        .from(access)
+        .innerJoin(snippets, eq(access.snippetId, snippets.id))
+        .innerJoin(users, eq(snippets.userId, users.id))
+        .where(
+          and(
+            eq(access.snippetId, snippetId),
+            userOrRoleAccessFilter(userId, roleIds),
+            or(isNull(access.expiresAt), gte(access.expiresAt, now)),
+          ),
+        )
+        .limit(1);
+
+      return rows[0] ?? null;
+    },
+
+    /** A user's role ids, for the sharing filters above. */
+    async listUserRoleIds(userId: string): Promise<number[]> {
+      const drizzle = await client();
+      const { userRoles } = await refs();
+      const rows = await drizzle
+        .select({ roleId: userRoles.roleId })
+        .from(userRoles)
+        .where(eq(userRoles.userId, userId));
+      return rows.map((r: { roleId: number }) => r.roleId);
+    },
+  };
+}

plugins/snippets/src/backend/tables.ts

@@ -0,0 +1,73 @@
+import {
+  adoptLegacyTable,
+  boolean,
+  defineTable,
+  id,
+  integer,
+  refUser,
+  text,
+  timestamp,
+  varchar,
+} from "@termix/plugin-sdk/db";
+
+export const snippets = adoptLegacyTable(
+  "snippets",
+  defineTable(
+    "snippets",
+    {
+      id: id(),
+      userId: refUser(),
+      name: text().notNull(),
+      content: text().notNull(),
+      description: text(),
+      folder: text(),
+      order: integer().notNull().default(0),
+      syncId: varchar().unique(),
+      createdAt: timestamp().notNull().defaultNow(),
+      updatedAt: timestamp().notNull().defaultNow(),
+      hostFilter: text(),
+      isNote: boolean().notNull().default(false),
+    },
+    { indexes: [{ name: "idx_snippets_user_id", columns: ["userId"] }] },
+  ),
+);
+
+export const snippetFolders = adoptLegacyTable(
+  "snippet_folders",
+  defineTable("snippet_folders", {
+    id: id(),
+    userId: refUser(),
+    name: text().notNull(),
+    color: text(),
+    icon: text(),
+    syncId: varchar().unique(),
+    createdAt: timestamp().notNull().defaultNow(),
+    updatedAt: timestamp().notNull().defaultNow(),
+  }),
+);
+
+export const snippetAccess = adoptLegacyTable(
+  "snippet_access",
+  defineTable(
+    "snippet_access",
+    {
+      id: id(),
+      snippetId: integer().notNull(),
+      userId: varchar(),
+      roleId: integer(),
+      grantedBy: refUser(),
+      permissionLevel: text().notNull().default("view"),
+      expiresAt: timestamp(),
+      createdAt: timestamp().notNull().defaultNow(),
+    },
+    {
+      indexes: [
+        { name: "idx_snippet_access_user_id", columns: ["userId"] },
+        { name: "idx_snippet_access_snippet_id", columns: ["snippetId"] },
+        { name: "idx_snippet_access_role_id", columns: ["roleId"] },
+      ],
+    },
+  ),
+);
+
+export const tables = [snippets, snippetFolders, snippetAccess];