Plugin infrastructure

.cargo/config.toml

@@ -1,11 +1,15 @@
 # Cargo configuration for drasi-server
 #
+# cargo xtask alias — run `cargo xtask vendor push/pull/list`
+[alias]
+xtask = "run --package xtask --"
+
 # To use local path-based dependencies for development:
-# 1. Uncomment the [patch.crates-io] section in Cargo.toml
+# 1. Uncomment the [patch.crates-io] section
 # 2. Run: cargo build
 #
 # To use published crates from crates.io:
-# 1. Keep the [patch.crates-io] section commented out in Cargo.toml
+# 1. Keep the [patch.crates-io] section commented
 # 2. Run: cargo build
 
 # Cross-compilation target flags (used by `cross` tool)
@@ -17,3 +21,40 @@ rustflags = ["-C", "target-feature=-crt-static"]
 
 [target.x86_64-pc-windows-gnu]
 rustflags = ["-C", "target-feature=+crt-static"]
+
+# Vendored native library overrides for Windows MSVC
+# These override the jq-sys and openssl-sys build scripts to use pre-built
+# static libraries from vendor/x86_64-pc-windows-msvc/lib/.
+# On non-MSVC targets, these overrides are ignored and the -sys crates
+# use their normal discovery (pkg-config, vendored build, etc.).
+[target.x86_64-pc-windows-msvc.jq]
+rustc-link-lib = ["static:-bundle=jq"]
+rustc-link-search = ["native=vendor/x86_64-pc-windows-msvc/lib"]
+
+[target.x86_64-pc-windows-msvc.openssl]
+rustc-link-lib = ["static:-bundle=libssl", "static:-bundle=libcrypto", "dylib=crypt32", "dylib=ws2_32", "dylib=advapi32", "dylib=user32"]
+rustc-link-search = ["native=vendor/x86_64-pc-windows-msvc/lib"]
+rustc-cfg = ["openssl", "ossl101", "ossl102", "ossl102f", "ossl102h", "ossl110", "ossl110f", "ossl110g", "ossl110h", "ossl111", "ossl111b", "ossl111c", "ossl111d", "ossl300", "ossl320", "ossl330", "ossl340", "ossl350"]
+version_number = "30600000"
+include = "vendor/x86_64-pc-windows-msvc/include"
+
+# [patch.crates-io]
+# drasi-plugin-sdk = { path = "../drasi-core/components/plugin-sdk" }
+# drasi-ffi-primitives = { path = "../drasi-core/components/ffi-primitives" }
+# drasi-core = { path = "../drasi-core/core" }
+# drasi-lib = { path = "../drasi-core/lib" }
+# drasi-query-ast = { path = "../drasi-core/query-ast" }
+# drasi-query-cypher = { path = "../drasi-core/query-cypher" }
+# drasi-query-gql = { path = "../drasi-core/query-gql" }
+# drasi-functions-cypher = { path = "../drasi-core/functions-cypher" }
+# drasi-functions-gql = { path = "../drasi-core/functions-gql" }
+# drasi-middleware = { path = "../drasi-core/middleware" }
+# drasi-source-application = { path = "../drasi-core/components/sources/application" }
+# drasi-bootstrap-application = { path = "../drasi-core/components/bootstrappers/application" }
+# drasi-bootstrap-noop = { path = "../drasi-core/components/bootstrappers/noop" }
+# drasi-reaction-application = { path = "../drasi-core/components/reactions/application" }
+# drasi-index-rocksdb = { path = "../drasi-core/components/indexes/rocksdb" }
+# drasi-index-garnet = { path = "../drasi-core/components/indexes/garnet" }
+# drasi-state-store-redb = { path = "../drasi-core/components/state_stores/redb" }
+# drasi-mssql-common = { path = "../drasi-core/components/mssql-common" }
+# drasi-host-sdk = { path = "../drasi-core/components/host-sdk" }

.github/workflows/release.yaml

@@ -303,6 +303,53 @@ jobs:
           path: drasi-server-x86_64-windows.exe
           if-no-files-found: error
 
+  # Windows MSVC native build (uses vendored static libs for jq and OpenSSL)
+  build-windows-msvc:
+    name: Build Windows MSVC (x86_64)
+    runs-on: windows-latest
+    needs: determine-version
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+
+      - name: Pull vendored native libraries
+        shell: bash
+        run: cargo xtask vendor pull x86_64-pc-windows-msvc --tag v1
+
+      - name: Build binary
+        shell: bash
+        run: |
+          cargo build --release --target x86_64-pc-windows-msvc --bin drasi-server
+
+          SRC_BINARY="target/x86_64-pc-windows-msvc/release/drasi-server.exe"
+          ARTIFACT_NAME="drasi-server-x86_64-windows-msvc.exe"
+
+          echo "=== Build output ==="
+          ls -lh "$SRC_BINARY" || true
+          file "$SRC_BINARY" || true
+
+          if [[ -f "$SRC_BINARY" ]]; then
+            cp "$SRC_BINARY" "$ARTIFACT_NAME"
+            echo "✓ Built $ARTIFACT_NAME ($(du -h "$ARTIFACT_NAME" | cut -f1))"
+          else
+            echo "Error: Built binary not found at $SRC_BINARY"
+            echo "=== release directory listing ==="
+            ls -la "target/x86_64-pc-windows-msvc/release/" || true
+            exit 1
+          fi
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: drasi-server-x86_64-windows-msvc
+          path: drasi-server-x86_64-windows-msvc.exe
+          if-no-files-found: error
+
   # ─── SSE CLI builds (pure Rust, no C dependencies) ───
 
   # Build all Linux SSE CLI binaries using cross
@@ -565,7 +612,8 @@ jobs:
           echo "Binary artifacts are available as workflow artifacts for the following targets:" >> $GITHUB_STEP_SUMMARY
           echo "- \`drasi-server-aarch64-apple-darwin\` (macOS ARM64 / Apple Silicon)" >> $GITHUB_STEP_SUMMARY
           echo "- \`drasi-server-x86_64-apple-darwin\` (macOS x86_64 / Intel)" >> $GITHUB_STEP_SUMMARY
-          echo "- \`drasi-server-x86_64-windows.exe\` (Windows x86_64)" >> $GITHUB_STEP_SUMMARY
+          echo "- \`drasi-server-x86_64-windows.exe\` (Windows x86_64 MinGW)" >> $GITHUB_STEP_SUMMARY
+          echo "- \`drasi-server-x86_64-windows-msvc.exe\` (Windows x86_64 MSVC)" >> $GITHUB_STEP_SUMMARY
           echo "- \`drasi-server-aarch64-linux-gnu\` (Linux ARM64 glibc)" >> $GITHUB_STEP_SUMMARY
           echo "- \`drasi-server-x86_64-linux-gnu\` (Linux x86_64 glibc)" >> $GITHUB_STEP_SUMMARY
           echo "- \`drasi-server-aarch64-linux-musl\` (Linux ARM64 musl)" >> $GITHUB_STEP_SUMMARY
@@ -584,7 +632,7 @@ jobs:
   # Smoke-test each binary with the hello-world (mock source) config
   test-binaries:
     name: Test ${{ matrix.artifact_suffix }}
-    needs: [build-linux, build-macos, build-windows]
+    needs: [build-linux, build-macos, build-windows, build-windows-msvc]
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
@@ -606,10 +654,14 @@ jobs:
           - artifact_suffix: aarch64-linux-gnu
             runner: ubuntu-24.04-arm
             binary_name: "drasi-server-aarch64-linux-gnu"
-          # Windows x86_64
+          # Windows x86_64 (MinGW)
           - artifact_suffix: x86_64-windows
             runner: windows-latest
             binary_name: "drasi-server-x86_64-windows.exe"
+          # Windows x86_64 (MSVC)
+          - artifact_suffix: x86_64-windows-msvc
+            runner: windows-latest
+            binary_name: "drasi-server-x86_64-windows-msvc.exe"
           # Linux x86_64 (musl) — tested inside Alpine container
           - artifact_suffix: x86_64-linux-musl
             runner: ubuntu-latest
@@ -746,7 +798,8 @@ jobs:
           - x86_64 (Intel) - `drasi-server-x86_64-apple-darwin`
 
           ### Windows
-          - x86_64 - `drasi-server-x86_64-windows.exe`
+          - x86_64 (MinGW) - `drasi-server-x86_64-windows.exe`
+          - x86_64 (MSVC) - `drasi-server-x86_64-windows-msvc.exe`
 
           ### Linux (glibc)
           - ARM64 - `drasi-server-aarch64-linux-gnu`

.gitignore

@@ -34,3 +34,6 @@ logs/
 # Cargo install metadata
 .crates.toml
 .crates2.json
+
+# Vendored native libraries (downloaded from OCI registry)
+vendor/

CLAUDE.md

@@ -11,16 +11,23 @@ This is the Drasi Server repository - a standalone server wrapper around DrasiLi
 ### Build and Run
 - Build: `cargo build`
 - Build release: `cargo build --release`
+- Cross-compile: `make build-cross TARGET=x86_64-pc-windows-gnu`
 - Run server: `cargo run` or `cargo run -- --config config/server.yaml`
 - Run with custom port: `cargo run -- --port 8080`
+- Run with plugin verification: `cargo run -- --verify-plugins --config config/server.yaml`
 - Check compilation: `cargo check`
 
+### Plugin Loading
+Plugins (sources, reactions, bootstrap providers) are loaded at runtime as cdylib shared libraries (`.so`/`.dylib`/`.dll`) from a `plugins/` directory next to the binary. Each plugin is self-contained with its own tokio runtime, communicating via a stable C ABI. Plugin building is managed by drasi-core, not this repository.
+
 ### Testing
 - Run all tests: `cargo test`
 - Run unit tests only: `cargo test --lib`
 - Run specific test: `cargo test test_name`
 - Run integration tests: `./tests/run_working_tests.sh`
+- Run plugin smoke tests: `make test-smoke`
 - Run with logging: `RUST_LOG=debug cargo test -- --nocapture`
+- Run host-sdk integration tests: `cd ../drasi-core && cargo test -p drasi-host-sdk --test integration_test`
 
 ### Code Quality
 - Format code: `cargo fmt`
@@ -42,6 +49,7 @@ This repository contains only the server wrapper functionality:
    - `mappings/` - DTO to domain model conversions
 3. **Builder** (`src/builder.rs`) - Builder pattern for server construction
 4. **Main** (`src/main.rs`) - CLI entry point for standalone server
+5. **Dynamic Loading** (`src/dynamic_loading.rs`) - Runtime plugin loading from shared libraries
 
 ### Core Components (External Dependency)
 
@@ -94,6 +102,12 @@ port: 8080
 logLevel: "info"
 persistConfig: true  # Enable persistence (default)
 persistIndex: false  # Use RocksDB for persistent indexing (default: false, uses in-memory)
+verifyPlugins: true  # Enable cosign signature verification for downloaded plugins (default: false)
+
+# Optional trusted identities for plugin signature verification
+# trustedIdentities:
+#   - issuer: "https://accounts.google.com"
+#     subjectPattern: "builder@my-org.iam.gserviceaccount.com"
 
 # Optional state store for plugin state persistence
 # stateStore:
@@ -252,6 +266,11 @@ server.run().await?;
 - API tests: `tests/api/`
 - Protocol tests: `tests/grpc/`, `tests/http/`, `tests/postgres/`
 - End-to-end tests: Files ending with `_e2e_test.rs`
+- Host-SDK integration tests: `../drasi-core/components/host-sdk/tests/integration_test.rs`
+  - Tests load real cdylib plugins (mock source, log reaction) and exercise the full
+    dynamic loading pipeline including metadata validation, callbacks, factory invocation,
+    and lifecycle management through FFI vtables.
+  - Prerequisites: build plugins in drasi-core with `make build-cdylib-plugins`
 
 ### Running Tests
 - Always run `cargo test` before committing
@@ -404,7 +423,10 @@ server.run().await?;
 
 ### Important Notes
 - The core functionality is provided by the external `drasi-lib` library
-- Sources and reactions are plugins that must be provided as instances (no YAML configuration)
-- Queries can be created via the builder pattern
+- Plugins (sources, reactions, bootstrappers) use `cdylib` crate-type and export `drasi_plugin_init()` / `drasi_plugin_metadata()` entry points
+- Plugins are loaded as self-contained cdylib `.so`/`.dylib`/`.dll` files at runtime via `drasi-host-sdk`
+- Each cdylib plugin has its own tokio runtime and communicates with the host via `#[repr(C)]` vtable structs (stable C ABI)
+- Plugin metadata validation checks SDK version (major.minor match) and target triple at load time
 - All data processing logic resides in drasi-lib
 - This repository focuses on API and server lifecycle management
+- Plugin signature verification is available via `--verify-plugins` CLI flag or `verifyPlugins: true` in config. Uses Sigstore/cosign keyless verification against the Rekor transparency log.