feat: plugins v1

e2e/fixtures/plugins/api-test-plugin/README.md

@@ -0,0 +1,3 @@
+# E2E Plugin API Fixture
+
+This plugin is intentionally tiny. Tests use its manifest to exercise plugin discovery, server support metadata, server data, and plugin event relay APIs without executing plugin code.

e2e/fixtures/plugins/api-test-plugin/dist/main.js

@@ -0,0 +1,6 @@
+export default {
+  id: 'e2e.plugin-api',
+  activate(api) {
+    api?.logger?.info?.('E2E Plugin API Fixture activated');
+  }
+};

e2e/fixtures/plugins/api-test-plugin/toju-plugin.json

@@ -0,0 +1,49 @@
+{
+  "apiVersion": "1.0.0",
+  "capabilities": [
+    "storage.serverData.read",
+    "storage.serverData.write",
+    "events.server.publish",
+    "events.server.subscribe",
+    "events.p2p.publish",
+    "events.p2p.subscribe"
+  ],
+  "compatibility": {
+    "minimumTojuVersion": "1.0.0",
+    "verifiedTojuVersion": "1.0.0"
+  },
+  "data": [
+    {
+      "key": "settings",
+      "scope": "server",
+      "storage": "serverData"
+    },
+    {
+      "key": "presence",
+      "scope": "user",
+      "storage": "serverData"
+    }
+  ],
+  "description": "Fixture plugin used by automated tests for plugin support APIs.",
+  "entrypoint": "./dist/main.js",
+  "events": [
+    {
+      "direction": "serverRelay",
+      "eventName": "e2e:relay",
+      "maxPayloadBytes": 2048,
+      "scope": "server"
+    },
+    {
+      "direction": "p2pHint",
+      "eventName": "e2e:p2p",
+      "maxPayloadBytes": 512,
+      "scope": "user"
+    }
+  ],
+  "id": "e2e.plugin-api",
+  "kind": "client",
+  "readme": "./README.md",
+  "schemaVersion": 1,
+  "title": "E2E Plugin API Fixture",
+  "version": "1.0.0"
+}

e2e/helpers/plugin-api-test-fixture.ts

@@ -0,0 +1,42 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+export const TEST_PLUGIN_FIXTURE_DIR = join(__dirname, '..', 'fixtures', 'plugins', 'api-test-plugin');
+export const TEST_PLUGIN_ID = 'e2e.plugin-api';
+export const TEST_PLUGIN_RELAY_EVENT = 'e2e:relay';
+export const TEST_PLUGIN_P2P_EVENT = 'e2e:p2p';
+
+export interface PluginApiTestManifestEvent {
+  direction: 'clientToServer' | 'serverRelay' | 'p2pHint';
+  eventName: string;
+  maxPayloadBytes?: number;
+  scope: 'server' | 'channel' | 'user' | 'plugin';
+}
+
+export interface PluginApiTestManifest {
+  description: string;
+  events: PluginApiTestManifestEvent[];
+  id: string;
+  title: string;
+  version: string;
+}
+
+export async function readPluginApiTestManifest(): Promise<PluginApiTestManifest> {
+  const manifestPath = join(TEST_PLUGIN_FIXTURE_DIR, 'toju-plugin.json');
+  const manifestText = await readFile(manifestPath, 'utf8');
+
+  return JSON.parse(manifestText) as PluginApiTestManifest;
+}
+
+export function getPluginApiTestEvent(
+  manifest: PluginApiTestManifest,
+  eventName: string
+): PluginApiTestManifestEvent {
+  const eventDefinition = manifest.events.find((event) => event.eventName === eventName);
+
+  if (!eventDefinition) {
+    throw new Error(`Expected fixture plugin to define ${eventName}`);
+  }
+
+  return eventDefinition;
+}

e2e/tests/plugins/plugin-api-two-users.spec.ts

@@ -0,0 +1,179 @@
+import { type Page } from '@playwright/test';
+import {
+  expect,
+  test,
+  type Client
+} from '../../fixtures/multi-client';
+import { ChatMessagesPage } from '../../pages/chat-messages.page';
+import { ChatRoomPage } from '../../pages/chat-room.page';
+import { RegisterPage } from '../../pages/register.page';
+import { ServerSearchPage } from '../../pages/server-search.page';
+
+const PLUGIN_SOURCE_URL = 'http://localhost:4200/plugins/e2e-plugin-source.json';
+const PLUGIN_TITLE = 'E2E All API Plugin';
+const EDITED_MESSAGE = 'Plugin API edited message';
+const ORIGINAL_MESSAGE = 'Plugin API original message';
+const DELETED_MESSAGE = 'Plugin API deleted message';
+const DELETED_MESSAGE_CONTENT = '[Message deleted]';
+const PLUGIN_BOT_MESSAGE = 'Plugin bot message from all-api fixture';
+const CUSTOM_EMBED_TEXT = 'E2E custom embed: Plugin API custom embed';
+const SOUND_BOARD_TEXT = 'E2E soundboard ready';
+const SOUND_BOARD_LABEL = 'E2E Soundboard';
+const SOUND_BOARD_PLAYED_MESSAGE = 'E2E soundboard played Airhorn to voice channel';
+const VOICE_CHANNEL = 'Plugin Voice';
+
+test.describe('Plugin API multi-user runtime', () => {
+  test.describe.configure({ timeout: 180_000 });
+
+  test('runs chat, embed, soundboard, and profile APIs between two users', async ({ createClient }) => {
+    const scenario = await createPluginApiScenario(createClient);
+
+    await test.step('Install and activate the plugin for Bob as the embed/soundboard receiver', async () => {
+      await installGrantAndActivatePlugin(scenario.bob.page);
+      await closeSettingsModal(scenario.bob.page);
+      await expect(soundboardComposerButton(scenario.bob.page)).toBeVisible({ timeout: 20_000 });
+      await expect(scenario.bob.page.getByText(SOUND_BOARD_TEXT, { exact: true })).toBeVisible({ timeout: 20_000 });
+      await expect(scenario.bob.page.getByTestId('e2e-plugin-owned-dom')).toHaveAttribute('data-plugin-owner', 'e2e.all-api-plugin');
+    });
+
+    await test.step('Install and activate the plugin for Alice as the API driver', async () => {
+      await installGrantAndActivatePlugin(scenario.alice.page);
+      await closeSettingsModal(scenario.alice.page);
+      await expect(soundboardComposerButton(scenario.alice.page)).toBeVisible({ timeout: 20_000 });
+      await expect(scenario.alice.page.getByText(SOUND_BOARD_TEXT, { exact: true })).toBeVisible({ timeout: 20_000 });
+      await expect(scenario.alice.page.getByTestId('e2e-plugin-owned-dom')).toHaveAttribute('data-plugin-owner', 'e2e.all-api-plugin');
+    });
+
+    await test.step('Alice opens the plugin soundboard modal and plays a sound to voice', async () => {
+      await soundboardComposerButton(scenario.alice.page).click();
+      await expect(scenario.alice.page.getByRole('dialog', { name: SOUND_BOARD_LABEL })).toBeVisible({ timeout: 20_000 });
+      await expect(scenario.alice.page.getByTestId('e2e-soundboard-modal')).toHaveAttribute('data-plugin-owner', 'e2e.all-api-plugin');
+      await scenario.alice.page.getByRole('button', { name: 'Play airhorn to voice' }).click();
+      await expect(scenario.alice.page.getByTestId('e2e-soundboard-status')).toHaveText(SOUND_BOARD_PLAYED_MESSAGE, { timeout: 20_000 });
+    });
+
+    await test.step('Bob receives messages sent and edited by Alice through the plugin API', async () => {
+      await expect(scenario.bobMessages.getMessageItemByText(EDITED_MESSAGE)).toBeVisible({ timeout: 30_000 });
+      await expect(scenario.bobMessages.getMessageItemByText(ORIGINAL_MESSAGE)).toHaveCount(0);
+      await expect(scenario.bob.page.getByText('(edited)')).toBeVisible({ timeout: 20_000 });
+    });
+
+    await test.step('Bob sees plugin API deletion state and plugin-user messages', async () => {
+      await expect(scenario.bobMessages.getMessageItemByText(DELETED_MESSAGE_CONTENT)).toBeVisible({ timeout: 30_000 });
+      await expect(scenario.bobMessages.getMessageItemByText(DELETED_MESSAGE)).toHaveCount(0);
+      await expect(scenario.bobMessages.getMessageItemByText(PLUGIN_BOT_MESSAGE)).toBeVisible({ timeout: 30_000 });
+      await expect(scenario.bobMessages.getMessageItemByText(SOUND_BOARD_PLAYED_MESSAGE)).toBeVisible({ timeout: 30_000 });
+    });
+
+    await test.step('Bob renders Alice custom embed through the plugin embed API', async () => {
+      await expect(scenario.bob.page.getByTestId('plugin-message-embeds')).toContainText(CUSTOM_EMBED_TEXT, { timeout: 30_000 });
+    });
+
+    await test.step('Bob sees Alice profile name changed by the plugin API', async () => {
+      await expect(scenario.bobMessages.getMessageItemByText(EDITED_MESSAGE)).toContainText('Alice Plugin Renamed', { timeout: 30_000 });
+    });
+  });
+});
+
+interface PluginApiScenario {
+  alice: Client;
+  aliceRoom: ChatRoomPage;
+  bob: Client;
+  bobRoom: ChatRoomPage;
+  aliceMessages: ChatMessagesPage;
+  bobMessages: ChatMessagesPage;
+}
+
+async function createPluginApiScenario(createClient: () => Promise<Client>): Promise<PluginApiScenario> {
+  const suffix = uniqueName('plugin-api');
+  const serverName = `Plugin API Server ${suffix}`;
+  const alice = await createClient();
+  const bob = await createClient();
+
+  await registerUser(alice.page, `alice_${suffix}`, 'Alice');
+  await registerUser(bob.page, `bob_${suffix}`, 'Bob');
+
+  const aliceSearch = new ServerSearchPage(alice.page);
+
+  await aliceSearch.createServer(serverName, { description: 'Two-user plugin API E2E coverage' });
+  await expect(alice.page).toHaveURL(/\/room\//, { timeout: 30_000 });
+
+  const aliceRoom = new ChatRoomPage(alice.page);
+
+  await aliceRoom.ensureVoiceChannelExists(VOICE_CHANNEL);
+
+  const bobSearch = new ServerSearchPage(bob.page);
+
+  await bobSearch.joinServerFromSearch(serverName);
+  await expect(bob.page).toHaveURL(/\/room\//, { timeout: 30_000 });
+
+  const bobRoom = new ChatRoomPage(bob.page);
+
+  await aliceRoom.joinVoiceChannel(VOICE_CHANNEL);
+  await bobRoom.joinVoiceChannel(VOICE_CHANNEL);
+  await expect(aliceRoom.voiceControls).toBeVisible({ timeout: 30_000 });
+  await expect(bobRoom.voiceControls).toBeVisible({ timeout: 30_000 });
+
+  const aliceMessages = new ChatMessagesPage(alice.page);
+  const bobMessages = new ChatMessagesPage(bob.page);
+
+  await aliceMessages.waitForReady();
+  await bobMessages.waitForReady();
+  await expect(alice.page.locator('[data-testid^="room-user-card-"]', { hasText: 'Bob' })).toBeVisible({ timeout: 30_000 });
+  await expect(bob.page.locator('[data-testid^="room-user-card-"]', { hasText: 'Alice' })).toBeVisible({ timeout: 30_000 });
+
+  return {
+    alice,
+    aliceRoom,
+    bob,
+    bobRoom,
+    aliceMessages,
+    bobMessages
+  };
+}
+
+async function registerUser(page: Page, username: string, displayName: string): Promise<void> {
+  const registerPage = new RegisterPage(page);
+
+  await registerPage.goto();
+  await registerPage.register(username, displayName, 'TestPass123!');
+  await expect(page).toHaveURL(/\/search/, { timeout: 30_000 });
+}
+
+async function installGrantAndActivatePlugin(page: Page): Promise<void> {
+  await page.getByRole('button', { name: 'Plugins' }).click();
+  await expect(page).toHaveURL(/\/plugin-store/, { timeout: 20_000 });
+  await expect(page.getByTestId('plugin-store-page')).toBeVisible({ timeout: 20_000 });
+  await page.getByPlaceholder('https://example.com/plugins.json').fill(PLUGIN_SOURCE_URL);
+  await page.getByRole('button', { name: 'Add Source' }).click();
+  await expect(page.getByRole('heading', { name: PLUGIN_TITLE })).toBeVisible({ timeout: 20_000 });
+  await page.getByRole('button', { exact: true, name: 'Install' }).click();
+  await expect(page.locator('article', { hasText: PLUGIN_TITLE }).getByText('Installed')).toBeVisible({ timeout: 20_000 });
+  await page.getByRole('button', { name: 'Manage Plugins' }).click();
+  await expect(page.getByTestId('plugin-manager')).toBeVisible({ timeout: 20_000 });
+  await expect(page.locator('article', { hasText: PLUGIN_TITLE })).toBeVisible({ timeout: 20_000 });
+  await page.locator('article', { hasText: PLUGIN_TITLE })
+    .getByRole('button', { name: 'Select' })
+    .click();
+
+  await page.getByRole('button', { name: 'Grant all requested' }).click();
+  await page.getByRole('button', { name: 'Activate ready plugins' }).click();
+  await expect(page.locator('article', { hasText: PLUGIN_TITLE }).getByText('ready', { exact: true })).toBeVisible({ timeout: 30_000 });
+  await page.getByRole('button', { name: 'Logs' }).click();
+  await expect(page.getByText('all-api plugin completed')).toBeVisible({ timeout: 30_000 });
+}
+
+async function closeSettingsModal(page: Page): Promise<void> {
+  await page.keyboard.press('Escape');
+  await expect(page.getByTestId('plugin-manager')).toHaveCount(0);
+}
+
+function uniqueName(prefix: string): string {
+  return `${prefix}-${Date.now()}-${Math.random().toString(36)
+    .slice(2, 8)}`;
+}
+
+function soundboardComposerButton(page: Page) {
+  return page.locator('app-chat-message-composer')
+    .getByRole('button', { exact: true, name: SOUND_BOARD_LABEL });
+}

e2e/tests/plugins/plugin-manager-ui.spec.ts

@@ -0,0 +1,88 @@
+import { expect, test } from '../../fixtures/multi-client';
+import { RegisterPage } from '../../pages/register.page';
+import { ServerSearchPage } from '../../pages/server-search.page';
+
+test.describe('Plugin manager UI', () => {
+  test.describe.configure({ timeout: 180_000 });
+
+  test('installs, grants, activates, and logs an all-API test plugin', async ({ createClient }) => {
+    const client = await createClient();
+    const { page } = client;
+    const suffix = Date.now();
+    const register = new RegisterPage(page);
+    const search = new ServerSearchPage(page);
+
+    await test.step('Register user and create server context', async () => {
+      await register.goto();
+      await register.register(`plugin_${suffix}`, 'Plugin Tester', 'TestPass123!');
+      await expect(page.getByPlaceholder('Search servers and users...')).toBeVisible({ timeout: 30_000 });
+      await search.createServer(`Plugin API Server ${suffix}`, {
+        description: 'Plugin manager UI E2E coverage'
+      });
+
+      await expect(page).toHaveURL(/\/room\//, { timeout: 30_000 });
+    });
+
+    await test.step('Open visible Plugins button', async () => {
+      await page.getByRole('button', { name: 'Plugins' }).click();
+      await expect(page).toHaveURL(/\/plugin-store/, { timeout: 10_000 });
+      await expect(page.getByTestId('plugin-store-page')).toBeVisible({ timeout: 10_000 });
+    });
+
+    await test.step('Install fixture plugin from source manifest', async () => {
+      await page.getByPlaceholder('https://example.com/plugins.json').fill('http://localhost:4200/plugins/e2e-plugin-source.json');
+      await page.getByRole('button', { name: 'Add Source' }).click();
+      await expect(page.getByRole('heading', { name: 'E2E All API Plugin' })).toBeVisible({ timeout: 15_000 });
+      await page.getByRole('button', { name: 'Readme' }).click();
+      await expect(page.getByText('Fixture plugin for Playwright coverage.')).toBeVisible({ timeout: 10_000 });
+      await page.getByRole('button', { exact: true, name: 'Install' }).click();
+      await expect(page.locator('article', { hasText: 'E2E All API Plugin' }).getByText('Installed')).toBeVisible({ timeout: 10_000 });
+    });
+
+    await test.step('Open plugin manager from the store page', async () => {
+      await page.getByRole('button', { name: 'Manage Plugins' }).click();
+      await expect(page.getByTestId('plugin-manager')).toBeVisible({ timeout: 10_000 });
+      await expect(page.getByTestId('plugin-manager').getByRole('heading', { name: 'Plugins' })).toBeVisible();
+      await expect(page.getByText('Development Plugin')).toBeVisible();
+    });
+
+    await test.step('Grant capabilities and activate runtime', async () => {
+      const manager = page.getByTestId('plugin-manager');
+      const pluginCard = manager.locator('article', { hasText: 'E2E All API Plugin' });
+
+      await manager.getByRole('button', { name: 'Installed' }).click();
+      await expect(pluginCard).toBeVisible({ timeout: 10_000 });
+      await pluginCard.getByRole('button', { name: 'Select' }).click();
+
+      await page.getByRole('button', { name: 'Grant all requested' }).click();
+      await page.getByRole('button', { name: 'Activate ready plugins' }).click();
+      await expect(page.locator('article', { hasText: 'E2E All API Plugin' }).getByText('ready', { exact: true })).toBeVisible({ timeout: 20_000 });
+    });
+
+    await test.step('Verify plugin exercised APIs through logs and extension points', async () => {
+      const manager = page.getByTestId('plugin-manager');
+
+      await manager.getByRole('button', { name: 'Logs' }).click();
+      await expect(page.getByText('all-api plugin completed')).toBeVisible({ timeout: 20_000 });
+      await expect(page.getByText('all-api plugin ready')).toBeVisible({ timeout: 10_000 });
+      await manager.getByRole('button', { name: 'Extension points' }).click();
+      await expect(page.getByTestId('plugin-extension-counts')).toContainText('Settings pages');
+      await expect(page.getByTestId('plugin-extension-counts')).toContainText('Embed renderers');
+      await expect(page.getByTestId('plugin-extension-counts')).toContainText('1');
+      await expect(page.getByTestId('plugin-conflict-diagnostics')).toContainText(
+        'No duplicate route, action, embed, channel, panel, or settings contribution ids detected.'
+      );
+
+      await manager.getByRole('button', { exact: true, name: 'Requirements' }).click();
+      await expect(page.getByTestId('plugin-server-requirements')).toContainText('E2E All API Plugin');
+      await expect(page.getByTestId('plugin-server-requirements')).toContainText('enabled');
+
+      await manager.getByRole('button', { exact: true, name: 'Settings' }).click();
+      await expect(page.getByTestId('plugin-generated-settings')).toContainText('E2E settings contribution');
+      await expect(page.getByTestId('plugin-generated-settings')).toContainText('"enabled"');
+
+      await manager.getByRole('button', { exact: true, name: 'Docs' }).click();
+      await expect(page.getByTestId('plugin-installed-docs')).toContainText('Calls every public Toju plugin API surface');
+    });
+  });
+});

e2e/tests/plugins/plugin-support-api.spec.ts

@@ -0,0 +1,405 @@
+import type { APIRequestContext, APIResponse } from '@playwright/test';
+import WebSocket from 'ws';
+import { expect, test } from '../../fixtures/multi-client';
+import {
+  getPluginApiTestEvent,
+  readPluginApiTestManifest,
+  TEST_PLUGIN_ID,
+  TEST_PLUGIN_P2P_EVENT,
+  TEST_PLUGIN_RELAY_EVENT
+} from '../../helpers/plugin-api-test-fixture';
+
+const OWNER_USER_ID = 'plugin-api-owner';
+
+interface CreatedServerResponse {
+  id: string;
+}
+
+interface PluginRequirementResponse {
+  requirement: {
+    pluginId: string;
+    reason?: string;
+    status: string;
+    versionRange?: string;
+  };
+}
+
+interface PluginEventDefinitionResponse {
+  eventDefinition: {
+    direction: string;
+    eventName: string;
+    maxPayloadBytes: number;
+    pluginId: string;
+    scope: string;
+  };
+}
+
+interface PluginDataResponse {
+  record: {
+    key: string;
+    ownerId?: string;
+    pluginId: string;
+    schemaVersion: number;
+    scope: string;
+    value: unknown;
+  };
+}
+
+interface PluginDataListResponse {
+  records: PluginDataResponse['record'][];
+}
+
+interface PluginSnapshotResponse {
+  eventDefinitions: PluginEventDefinitionResponse['eventDefinition'][];
+  requirements: PluginRequirementResponse['requirement'][];
+  serverId: string;
+}
+
+interface SocketMessage {
+  [key: string]: unknown;
+  type?: string;
+}
+
+interface TestSocket {
+  close: () => Promise<void>;
+  messages: SocketMessage[];
+  send: (message: SocketMessage) => void;
+}
+
+test.describe('Plugin support API', () => {
+  test('covers plugin requirement, event, data, and websocket APIs with the fixture plugin', async ({ request, testServer }) => {
+    const manifest = await readPluginApiTestManifest();
+    const server = await createServer(request, testServer.url, `Plugin API ${Date.now()}`);
+    const relayEvent = getPluginApiTestEvent(manifest, TEST_PLUGIN_RELAY_EVENT);
+    const p2pEvent = getPluginApiTestEvent(manifest, TEST_PLUGIN_P2P_EVENT);
+    const pluginsApi = `${testServer.url}/api/servers/${encodeURIComponent(server.id)}/plugins`;
+
+    await test.step('Initial snapshot is empty', async () => {
+      const snapshot = await expectJson<PluginSnapshotResponse>(await request.get(pluginsApi));
+
+      expect(snapshot).toEqual(expect.objectContaining({
+        eventDefinitions: [],
+        requirements: [],
+        serverId: server.id
+      }));
+    });
+
+    await test.step('Requirement API enforces server management permission', async () => {
+      const response = await request.put(`${pluginsApi}/${TEST_PLUGIN_ID}/requirement`, {
+        data: {
+          actorUserId: 'not-the-owner',
+          status: 'required'
+        }
+      });
+      const body = await expectJson<{ errorCode: string }>(response, 403);
+
+      expect(body.errorCode).toBe('NOT_AUTHORIZED');
+    });
+
+    await test.step('Requirement and event definition APIs persist the test plugin contract', async () => {
+      const requirement = await expectJson<PluginRequirementResponse>(await request.put(`${pluginsApi}/${TEST_PLUGIN_ID}/requirement`, {
+        data: {
+          actorUserId: OWNER_USER_ID,
+          reason: manifest.description,
+          status: 'required',
+          versionRange: `^${manifest.version}`
+        }
+      }));
+
+      expect(requirement.requirement).toEqual(expect.objectContaining({
+        pluginId: TEST_PLUGIN_ID,
+        reason: manifest.description,
+        status: 'required',
+        versionRange: `^${manifest.version}`
+      }));
+
+      const relayDefinition = await upsertEventDefinition(request, pluginsApi, relayEvent);
+      const p2pDefinition = await upsertEventDefinition(request, pluginsApi, p2pEvent);
+
+      expect(relayDefinition.eventDefinition).toEqual(expect.objectContaining({
+        direction: 'serverRelay',
+        eventName: TEST_PLUGIN_RELAY_EVENT,
+        pluginId: TEST_PLUGIN_ID,
+        scope: 'server'
+      }));
+
+      expect(p2pDefinition.eventDefinition).toEqual(expect.objectContaining({
+        direction: 'p2pHint',
+        eventName: TEST_PLUGIN_P2P_EVENT,
+        pluginId: TEST_PLUGIN_ID,
+        scope: 'user'
+      }));
+
+      const snapshot = await expectJson<PluginSnapshotResponse>(await request.get(pluginsApi));
+
+      expect(snapshot.requirements.map((entry) => entry.pluginId)).toEqual([TEST_PLUGIN_ID]);
+      expect(snapshot.eventDefinitions.map((entry) => entry.eventName).sort()).toEqual([TEST_PLUGIN_P2P_EVENT, TEST_PLUGIN_RELAY_EVENT]);
+    });
+
+    await test.step('Plugin data API stores, lists, and deletes server scoped data', async () => {
+      const stored = await expectJson<PluginDataResponse>(await request.put(`${pluginsApi}/${TEST_PLUGIN_ID}/data/settings`, {
+        data: {
+          actorUserId: OWNER_USER_ID,
+          schemaVersion: 1,
+          scope: 'server',
+          value: {
+            enabled: true,
+            pluginVersion: manifest.version
+          }
+        }
+      }));
+
+      expect(stored.record).toEqual(expect.objectContaining({
+        key: 'settings',
+        pluginId: TEST_PLUGIN_ID,
+        schemaVersion: 1,
+        scope: 'server',
+        value: {
+          enabled: true,
+          pluginVersion: manifest.version
+        }
+      }));
+
+      const listed = await expectJson<PluginDataListResponse>(await request.get(`${pluginsApi}/${TEST_PLUGIN_ID}/data`, {
+        params: {
+          key: 'settings',
+          scope: 'server',
+          userId: OWNER_USER_ID
+        }
+      }));
+
+      expect(listed.records).toHaveLength(1);
+      expect(listed.records[0]?.value).toEqual({
+        enabled: true,
+        pluginVersion: manifest.version
+      });
+
+      await expectJson<{ ok: boolean }>(await request.delete(`${pluginsApi}/${TEST_PLUGIN_ID}/data/settings`, {
+        data: {
+          actorUserId: OWNER_USER_ID,
+          scope: 'server'
+        }
+      }));
+
+      const afterDelete = await expectJson<PluginDataListResponse>(await request.get(`${pluginsApi}/${TEST_PLUGIN_ID}/data`, {
+        params: {
+          key: 'settings',
+          scope: 'server',
+          userId: OWNER_USER_ID
+        }
+      }));
+
+      expect(afterDelete.records).toEqual([]);
+    });
+
+    await test.step('WebSocket plugin API sends snapshots, relays server events, and rejects p2p relays', async () => {
+      const alice = await openTestSocket(testServer.url);
+      const bob = await openTestSocket(testServer.url);
+
+      try {
+        alice.send({ type: 'identify', oderId: OWNER_USER_ID, displayName: 'Plugin Owner' });
+        bob.send({ type: 'identify', oderId: 'plugin-api-peer', displayName: 'Plugin Peer' });
+        alice.send({ type: 'join_server', serverId: server.id });
+        bob.send({ type: 'join_server', serverId: server.id });
+
+        const aliceSnapshot = await waitForSocketMessage(alice, (message) => message.type === 'plugin_requirements');
+        const bobSnapshot = await waitForSocketMessage(bob, (message) => message.type === 'plugin_requirements');
+        const bobEventNames = (bobSnapshot['snapshot'] as PluginSnapshotResponse).eventDefinitions
+          .map((entry) => entry.eventName)
+          .sort();
+
+        expect((aliceSnapshot['snapshot'] as PluginSnapshotResponse).requirements[0]?.pluginId).toBe(TEST_PLUGIN_ID);
+        expect(bobEventNames).toEqual([TEST_PLUGIN_P2P_EVENT, TEST_PLUGIN_RELAY_EVENT]);
+
+        alice.send({
+          type: 'plugin_event',
+          eventId: 'relay-event-1',
+          eventName: TEST_PLUGIN_RELAY_EVENT,
+          payload: { message: 'hello from fixture plugin' },
+          pluginId: TEST_PLUGIN_ID,
+          serverId: server.id,
+          sourcePluginUserId: 'fixture-plugin-user'
+        });
+
+        const relayedEvent = await waitForSocketMessage(bob, (message) => message.type === 'plugin_event');
+
+        expect(relayedEvent).toEqual(expect.objectContaining({
+          eventId: 'relay-event-1',
+          eventName: TEST_PLUGIN_RELAY_EVENT,
+          pluginId: TEST_PLUGIN_ID,
+          serverId: server.id,
+          sourcePluginUserId: 'fixture-plugin-user',
+          sourceUserId: OWNER_USER_ID
+        }));
+
+        expect(relayedEvent['payload']).toEqual({ message: 'hello from fixture plugin' });
+        expect(typeof relayedEvent['emittedAt']).toBe('number');
+
+        alice.send({
+          type: 'plugin_event',
+          eventId: 'p2p-event-1',
+          eventName: TEST_PLUGIN_P2P_EVENT,
+          payload: { hint: true },
+          pluginId: TEST_PLUGIN_ID,
+          serverId: server.id
+        });
+
+        const p2pError = await waitForSocketMessage(
+          alice,
+          (message) => message.type === 'plugin_error' && message['eventId'] === 'p2p-event-1'
+        );
+
+        expect(p2pError['code']).toBe('PLUGIN_EVENT_NOT_RELAYABLE');
+
+        alice.send({
+          type: 'plugin_event',
+          eventId: 'missing-event-1',
+          eventName: 'e2e:missing',
+          payload: {},
+          pluginId: TEST_PLUGIN_ID,
+          serverId: server.id
+        });
+
+        const missingError = await waitForSocketMessage(
+          alice,
+          (message) => message.type === 'plugin_error' && message['eventId'] === 'missing-event-1'
+        );
+
+        expect(missingError['code']).toBe('PLUGIN_EVENT_NOT_REGISTERED');
+      } finally {
+        await Promise.all([alice.close(), bob.close()]);
+      }
+    });
+
+    await test.step('Delete APIs remove event definitions and requirements', async () => {
+      await expectJson<{ ok: boolean }>(await request.delete(`${pluginsApi}/${TEST_PLUGIN_ID}/events/${TEST_PLUGIN_RELAY_EVENT}`, {
+        data: { actorUserId: OWNER_USER_ID }
+      }));
+
+      await expectJson<{ ok: boolean }>(await request.delete(`${pluginsApi}/${TEST_PLUGIN_ID}/events/${TEST_PLUGIN_P2P_EVENT}`, {
+        data: { actorUserId: OWNER_USER_ID }
+      }));
+
+      await expectJson<{ ok: boolean }>(await request.delete(`${pluginsApi}/${TEST_PLUGIN_ID}/requirement`, {
+        data: { actorUserId: OWNER_USER_ID }
+      }));
+
+      const snapshot = await expectJson<PluginSnapshotResponse>(await request.get(pluginsApi));
+
+      expect(snapshot.eventDefinitions).toEqual([]);
+      expect(snapshot.requirements).toEqual([]);
+    });
+  });
+});
+
+async function createServer(
+  request: APIRequestContext,
+  baseUrl: string,
+  serverName: string
+): Promise<CreatedServerResponse> {
+  const response = await request.post(`${baseUrl}/api/servers`, {
+    data: {
+      channels: [
+        {
+          id: 'general-text',
+          name: 'general',
+          position: 0,
+          type: 'text'
+        }
+      ],
+      description: 'Server for plugin API E2E coverage',
+      id: `plugin-api-${Date.now()}`,
+      isPrivate: false,
+      name: serverName,
+      ownerId: OWNER_USER_ID,
+      ownerPublicKey: 'plugin-api-owner-public-key',
+      tags: ['plugins']
+    }
+  });
+
+  return await expectJson<CreatedServerResponse>(response, 201);
+}
+
+async function upsertEventDefinition(
+  request: APIRequestContext,
+  pluginsApi: string,
+  eventDefinition: ReturnType<typeof getPluginApiTestEvent>
+): Promise<PluginEventDefinitionResponse> {
+  return await expectJson<PluginEventDefinitionResponse>(await request.put(
+    `${pluginsApi}/${TEST_PLUGIN_ID}/events/${encodeURIComponent(eventDefinition.eventName)}`,
+    {
+      data: {
+        actorUserId: OWNER_USER_ID,
+        direction: eventDefinition.direction,
+        maxPayloadBytes: eventDefinition.maxPayloadBytes,
+        schemaJson: '{"type":"object"}',
+        scope: eventDefinition.scope
+      }
+    }
+  ));
+}
+
+async function expectJson<T>(response: APIResponse, status = 200): Promise<T> {
+  expect(response.status()).toBe(status);
+
+  return await response.json() as T;
+}
+
+async function openTestSocket(baseUrl: string): Promise<TestSocket> {
+  const socketUrl = baseUrl.replace(/^http/, 'ws');
+  const socket = new WebSocket(socketUrl);
+  const messages: SocketMessage[] = [];
+
+  socket.on('message', (data) => {
+    messages.push(JSON.parse(data.toString()) as SocketMessage);
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    socket.once('open', () => resolve());
+    socket.once('error', reject);
+  });
+
+  await waitForSocketMessage({ messages, send: () => {}, close: async () => {} }, (message) => message.type === 'connected');
+
+  return {
+    close: async () => {
+      if (socket.readyState === WebSocket.CLOSED) {
+        return;
+      }
+
+      await new Promise<void>((resolve) => {
+        socket.once('close', () => resolve());
+        socket.close();
+      });
+    },
+    messages,
+    send: (message: SocketMessage) => {
+      socket.send(JSON.stringify(message));
+    }
+  };
+}
+
+async function waitForSocketMessage(
+  socket: Pick<TestSocket, 'messages'>,
+  predicate: (message: SocketMessage) => boolean,
+  timeoutMs = 10_000
+): Promise<SocketMessage> {
+  const startedAt = Date.now();
+
+  return await new Promise((resolve, reject) => {
+    const interval = setInterval(() => {
+      const message = socket.messages.find(predicate);
+
+      if (message) {
+        clearInterval(interval);
+        resolve(message);
+        return;
+      }
+
+      if (Date.now() - startedAt > timeoutMs) {
+        clearInterval(interval);
+        reject(new Error('Timed out waiting for websocket message'));
+      }
+    }, 25);
+  });
+}