[michielbdejong]

Consolidates the parts of the plugin-host stack (#1702–#1934) that atomic-plugins' drive apps need now and that don't depend on the open #1970 questions on #1726. Rebased onto current develop, nothing merged from the old stack base. Decided by Michiel (Decision Inbox Q-101), on @joepio's request on #1726 for one PR instead of the stack.

The inventory, the CLOSE list and the four #1970 questions are on #1726: #1726 (comment)

What's in it

Area	Change	Replaces	Why atomic-plugins needs it
Importer destinations	A manifest destination can declare keyed tables beside (or instead of) its single table. Set up creates each table with its own row class and default view, and stores tables: { <key>: { table, rowClass } } in the config. A drive app shown on one of them gets the same map from store.getData(). provisionDestination moves into @tomic/lib (plugin-destination.ts). The server now validates destination with the browser's rules, and both are held to new shared fixtures in testdata/plugin-manifest/.	#1768 (own commit e739bf750)	Money's bank-statement importer declares destination.tables.statements (integrations/money/plugin.ts), which feeds the Money app's Imports tab and closing balances.
App frames	store.getMany(subjects): up to 100 reads in one round trip, each exactly like get, with an unreadable subject reported in its place.	#1748	Called by the issue-tracker, money and notion drive apps.
App frames	store.getTheme() / store.onThemeChange(handler) ({ colorScheme }), --t-color-success, and the host passing an explicit colorScheme to app frames and packaged views.	#1750	Called by six drive apps: calendar, google-tasks, issue-tracker, money, notion, timesheets.

Commit by commit: one commit per PR, cherry-picked with -x. The hand edits made while resolving against develop are named in each commit message. Then one commit that settles the .po catalogs.

Notes on the port

• Let a destination declare several tables, each found by its key #1768. In the stack this change sat next to the atomic-proxy: operation URLs (atomic-proxy: URLs for plugins, resolved to the delegated connection on the configured proxy (#1700, answer 4) #1725). Those are left out: manifest.rs and plugin-manifest.ts keep develop's operation URL check.
• App frames: store.getMany(subjects), a batched read #1748 and App frames theme: --t-color-success and an explicit colorScheme #1750. Added on top of One plugin contract: a Store-shaped API and host UI for every plugin view #1970's Store-shaped view-client.js: getMany, getTheme and onThemeChange sit beside getResource, query, search and ui.*. The openExternal, openResource and proxy.disconnect code these commits carried as context is left out.
• App frames theme: --t-color-success and an explicit colorScheme #1750's conflict in pluginRPC.tsx. It was only two adjacent imports (One plugin contract: a Store-shaped API and host UI for every plugin view #1970's useHostUI and the ColorScheme type), so it resolved without a design choice. Packaged views get the colour scheme through the same setStyle(css, colorScheme) as app frames.
• Parity. The new calls are drive-app only, like getApp, getData and proxy. store.test.ts's parity list for the shared contract is unchanged.

What waits on #1726

The rest of the NEED set touches #1970's design, so it waits for Joep's answers to the questions on #1726:

• App frames: openExternal(url) and openResource(subject) #1744: openExternal / openResource
• App frames: store.proxy.disconnect({platform}) removes this app's delegation #1745: proxy.disconnect
• Let a drive app run and apply its own importer #1774: a drive app running its own importer
• Let an app shown as a table's view edit its rows through a grant (#1740) #1788: the row grant
• Row extras: awaiting current scoped-write grant support #1900: row extras under the grant

This PR doesn't replace those PRs.

Flags

None needed. Everything here is additive:

• A manifest without destination.tables gets the same config, the same table localId and the same release id as before. The single-table fixture's id is pinned, and so are the stored bytes of an app package carrying it.
• The new frame calls do nothing until an app calls them.
• colorScheme is an extra field on the style message, which older frames ignore.

Review guide (Joep, Polle, Michiel)

• Signatures and crypto: none in this PR.
• Grants and rights:
  • getMany reads each subject through the signed-in person's store, so it has the same rights as get.
  • It is capped at 100 subjects, and the subjects are validated before anything is read (hostStore.ts).
• Manifest validation (server): validate_destination in server/src/plugins/manifest.rs now rejects destinations the browser already rejected. Before, the server only required a map.
  • Table keys must be identifiers.
  • Object.prototype names are refused as keys.
  • Each table needs its own row class.
  • Worth a look: whether any manifest published before this would now fail on the server. The browser rejected all of these already, so none should have been installable.
• Theme: useFrameColorScheme in useCreateThemeVars.ts, and FrameBridge.setStyle.

Replaces

• App frames: store.getMany(subjects), a batched read #1748
• App frames theme: --t-color-success and an explicit colorScheme #1750
• Let a destination declare several tables, each found by its key #1768

The rest of the CLOSE list is in the #1726 comment linked above. The branches stay.

Local checks

• pnpm run -r build
• pnpm run lint (the pre-commit hook on each commit)
• data-browser tsc --noEmit and the per-package typecheck
• vitest: @tomic/plugin, AppPage, PluginRuns, and the lib manifest, destination and app-package tests
• cargo fmt --check
• cargo clippy (CI's feature set)
• cargo test -p atomic-server --lib
• cargo test -p atomic_lib --features db-redb --lib: 698 of 699 passed. db::compaction::startup_compaction_shrinks_a_bloated_store_and_keeps_every_resource failed once on a size bound while the machine was busy, then passed when run alone. This PR doesn't touch lib/.

No UI change beyond FileImport's Set up line, which now names several tables when a manifest declares them. No screenshots taken.

CI

Green on 6126887: run 37828791674, with full e2e on Mancave.

The earlier runs on the same commit failed on tests this PR doesn't touch:

• data-browser vitest recovery-assisted.test.ts timed out. It also failed on another branch's run that morning.
• The flutter bridge test a_canvas_syncs_to_a_second_device_through_the_bridge failed. It passes locally 3/3.
• One run was cancelled mid-e2e.
• e2e search.spec.ts › scoped search failed. The same test failed in another branch's run at the same time.

🤖 Generated with Claude Code

[joepio]

Landed on develop through #2169 (batch with the message catalogs re-extracted), merged as b214af0 on a green run of the exact head. This head (6126887) is fully contained, so closing.

---

Generated by Claude Code