Move the addon-gated domains onto the decorators

collab, journal, atlas, vacay and collections: 32 more methods, so the registry
owns 93 of 113. rpc-host.ts is at 565 lines, down from 1332, and the deps factory
at 384, down from 944.

These five are the risky group, because their addon gates lived inside the deps
factory's closure rather than in the router. A handler that calls its service
directly still works, just without the check, and neither the compiler nor the
router tests would notice. So addon-gates.rpc.test.ts walks all 37 gated methods as
one table and asserts two things for each: with the addon off it is refused with
that addon's message, and the service is never reached. The table length is pinned,
so a later method added without a row is a failure rather than a silent gap.

One ordering detail worth knowing: on the atlas writes the router evaluated its
params before the addon gate inside the closure, so a malformed country code still
reports BAD_PARAMS rather than the addon. The handlers keep that order.

The collections service reports refusals as status-tagged errors rather than typed
ones, so mapCollectionError came across with the handlers: 403 and 404 become
RESOURCE_FORBIDDEN, 400 and 409 become BAD_PARAMS, and anything untagged stays a
HOST_ERROR instead of being dressed up as a permission problem.

server/src/nest/atlas/atlas.module.ts

@@ -1,6 +1,8 @@
 import { Module } from '@nestjs/common';
 import { AtlasController } from './atlas.controller';
 import { AtlasService } from './atlas.service';
+import { AtlasRpc } from './atlas.rpc';
+import { PluginGuardsModule } from '../plugins/host/plugin-guards.module';
 import { AtlasMcp } from './atlas.mcp';
 
 /**
@@ -10,8 +12,9 @@ import { AtlasMcp } from './atlas.mcp';
  * it after app.init().
  */
 @Module({
+  imports: [PluginGuardsModule],
   controllers: [AtlasController],
-  providers: [AtlasService, AtlasMcp],
+  providers: [AtlasService, AtlasMcp, AtlasRpc],
   exports: [AtlasService],
 })
 export class AtlasModule {}

server/src/nest/atlas/atlas.rpc.ts

@@ -0,0 +1,128 @@
+import { PluginController, PluginMethod } from '../plugins/host/rpc-kit/decorators';
+import { PluginGuards } from '../plugins/host/plugin-guards.service';
+import { BadParams, ForbiddenResource } from '../plugins/host/rpc-errors';
+import { asPayload, num } from '../plugins/host/rpc-params';
+import type { PluginRpcContext } from '../plugins/host/rpc-kit/types';
+import { ADDON_IDS } from '../../addons';
+import { AtlasService } from './atlas.service';
+
+/**
+ * The atlas surface a plugin may reach (#plugins): visited countries and regions plus
+ * the bucket list.
+ *
+ * Every row is the acting user's own, so there is no trip scoping and no cross-tenant
+ * surface at all; what each method does need is a host-bound acting user and the
+ * Atlas addon. The addon gate used to sit in the deps factory closure, so it is
+ * repeated on every method here rather than assumed.
+ */
+@PluginController()
+export class AtlasRpc {
+  constructor(
+    private readonly atlas: AtlasService,
+    private readonly guards: PluginGuards,
+  ) {}
+
+  @PluginMethod('atlas.visited', { permission: 'db:read:atlas' })
+  visited(_params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireAtlasUser(ctx, 'reads');
+    this.requireAtlasAddon();
+    return {
+      countries: this.atlas.listVisitedCountries(userId),
+      regions: this.atlas.listManuallyVisitedRegions(userId),
+    };
+  }
+
+  @PluginMethod('atlas.bucketList', { permission: 'db:read:atlas' })
+  bucketList(_params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireAtlasUser(ctx, 'reads');
+    this.requireAtlasAddon();
+    return this.atlas.bucketList(userId) as unknown[];
+  }
+
+  @PluginMethod('atlas.markCountry', { permission: 'db:write:atlas' })
+  markCountry(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireAtlasUser(ctx, 'writes');
+    const code = this.code(params.code, 'code');
+    this.requireAtlasAddon();
+    this.atlas.markCountry(userId, code);
+    return { visited: true };
+  }
+
+  @PluginMethod('atlas.unmarkCountry', { permission: 'db:write:atlas' })
+  unmarkCountry(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireAtlasUser(ctx, 'writes');
+    const code = this.code(params.code, 'code');
+    this.requireAtlasAddon();
+    this.atlas.unmarkCountry(userId, code);
+    return { visited: false };
+  }
+
+  @PluginMethod('atlas.markRegion', { permission: 'db:write:atlas' })
+  markRegion(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireAtlasUser(ctx, 'writes');
+    // A missing name falls back to the code, so the row is never nameless.
+    const regionName = typeof params.regionName === 'string' && params.regionName
+      ? params.regionName.slice(0, 128)
+      : String(params.regionCode ?? '');
+    const regionCode = this.code(params.regionCode, 'regionCode');
+    const countryCode = this.code(params.countryCode, 'countryCode');
+    this.requireAtlasAddon();
+    this.atlas.markRegion(userId, regionCode, regionName, countryCode);
+    return { visited: true };
+  }
+
+  @PluginMethod('atlas.unmarkRegion', { permission: 'db:write:atlas' })
+  unmarkRegion(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireAtlasUser(ctx, 'writes');
+    const regionCode = this.code(params.regionCode, 'regionCode');
+    this.requireAtlasAddon();
+    this.atlas.unmarkRegion(userId, regionCode);
+    return { visited: false };
+  }
+
+  @PluginMethod('atlas.createBucketItem', { permission: 'db:write:atlas' })
+  createBucketItem(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireAtlasUser(ctx, 'writes');
+    const input = asPayload(params.input);
+    if (typeof input.name !== 'string' || input.name.trim() === '') throw new BadParams('bucket item name is required');
+    this.requireAtlasAddon();
+    return this.atlas.createBucketItem(userId, input as never);
+  }
+
+  @PluginMethod('atlas.deleteBucketItem', { permission: 'db:write:atlas' })
+  deleteBucketItem(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireAtlasUser(ctx, 'writes');
+    const itemId = num(params.itemId, 'itemId');
+    this.requireAtlasAddon();
+    if (!this.atlas.deleteBucketItem(userId, itemId)) {
+      throw new ForbiddenResource(`no bucket item ${itemId} for this user`);
+    }
+    return { deleted: true };
+  }
+
+  /**
+   * A bound acting user. Reads and writes word the refusal differently.
+   *
+   * Deliberately does NOT check the addon: on the write paths the router evaluated
+   * its params (and so the code validation) before the addon gate inside the deps
+   * closure, so a malformed code still reports BAD_PARAMS rather than the addon.
+   */
+  private requireAtlasUser(ctx: PluginRpcContext, kind: 'reads' | 'writes'): number {
+    if (ctx.actingUserId === undefined) {
+      throw new ForbiddenResource(`atlas ${kind} require an authenticated user context`);
+    }
+    return ctx.actingUserId;
+  }
+
+  private requireAtlasAddon(): void {
+    this.guards.requireAddon(ADDON_IDS.ATLAS, 'atlas');
+  }
+
+  /** Country and region codes are short and stored upper-cased. */
+  private code(value: unknown, name: string): string {
+    if (typeof value !== 'string' || value.trim() === '' || value.length > 8) {
+      throw new BadParams(`${name} must be a short code`);
+    }
+    return value.trim().toUpperCase();
+  }
+}

server/src/nest/collab/collab.module.ts

@@ -1,14 +1,17 @@
 import { Module } from '@nestjs/common';
 import { CollabController } from './collab.controller';
 import { CollabService } from './collab.service';
+import { CollabRpc } from './collab.rpc';
+import { PluginGuardsModule } from '../plugins/host/plugin-guards.module';
+import { RealtimeModule } from '../realtime/realtime.module';
 import { CollabMcp } from './collab.mcp';
 import { PermissionsModule } from '../permissions/permissions.module';
 import { AuthModule } from '../auth/auth.module';
 
 @Module({
-  imports: [PermissionsModule, AuthModule],
+  imports: [PermissionsModule, AuthModule, RealtimeModule, PluginGuardsModule],
   controllers: [CollabController],
-  providers: [CollabService, CollabMcp],
+  providers: [CollabService, CollabMcp, CollabRpc],
   // For in-container consumers (PluginHostDepsFactory).
   exports: [CollabService],
 })

server/src/nest/collab/collab.rpc.ts

@@ -0,0 +1,116 @@
+import { PluginController, PluginMethod } from '../plugins/host/rpc-kit/decorators';
+import { PluginGuards } from '../plugins/host/plugin-guards.service';
+import { BadParams } from '../plugins/host/rpc-errors';
+import { asPayload, num } from '../plugins/host/rpc-params';
+import type { PluginRpcContext } from '../plugins/host/rpc-kit/types';
+import { RealtimeService } from '../realtime/realtime.service';
+import { ADDON_IDS } from '../../addons';
+import { CollabService } from './collab.service';
+
+const COLLAB_EDIT_ACTION = 'collab_edit';
+
+/**
+ * The collab surface a plugin may reach (#plugins): notes, polls and messages.
+ *
+ * Every method is addon-gated. That gate used to live in the deps factory's closure
+ * rather than in the router, which is exactly how it could have been lost in this
+ * move: a handler calling CollabService directly would still work, just without the
+ * addon check, and nothing in the type system or the router tests would notice.
+ * Hence requireCollabAddon on every single method, and an addon-off case per method
+ * in the suite.
+ *
+ * Reads need membership only. The write side carries collab_edit on top.
+ */
+@PluginController()
+export class CollabRpc {
+  constructor(
+    private readonly collab: CollabService,
+    private readonly realtime: RealtimeService,
+    private readonly guards: PluginGuards,
+  ) {}
+
+  @PluginMethod('collab.listNotes', { permission: 'db:read:collab' })
+  listNotes(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    return this.guards.tripRead(params, ctx, () => {
+      this.requireCollabAddon();
+      return this.collab.listNotes(num(params.tripId, 'tripId')) as unknown[];
+    });
+  }
+
+  @PluginMethod('collab.listPolls', { permission: 'db:read:collab' })
+  listPolls(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    return this.guards.tripRead(params, ctx, () => {
+      this.requireCollabAddon();
+      return this.collab.listPolls(num(params.tripId, 'tripId')) as unknown[];
+    });
+  }
+
+  @PluginMethod('collab.listMessages', { permission: 'db:read:collab' })
+  listMessages(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    return this.guards.tripRead(params, ctx, () => {
+      this.requireCollabAddon();
+      const before = params.before != null ? num(params.before, 'before') : undefined;
+      return this.collab.listMessages(num(params.tripId, 'tripId'), before) as unknown[];
+    });
+  }
+
+  @PluginMethod('collab.createNote', { permission: 'db:write:collab' })
+  createNote(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const tripId = num(params.tripId, 'tripId');
+    const actor = this.guards.requireActor(ctx, 'collab note');
+    const input = asPayload(params.input);
+    if (typeof input.title !== 'string' || input.title.trim() === '') throw new BadParams('note title is required');
+    this.guards.requireTripEdit(tripId, actor, COLLAB_EDIT_ACTION);
+    this.requireCollabAddon();
+    const note = this.collab.createNote(String(tripId), actor, input as never);
+    this.realtime.broadcast(tripId, 'collab:note:created', { note }, undefined);
+    return note;
+  }
+
+  @PluginMethod('collab.createPoll', { permission: 'db:write:collab' })
+  createPoll(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const tripId = num(params.tripId, 'tripId');
+    const actor = this.guards.requireActor(ctx, 'collab poll');
+    const input = asPayload(params.input);
+    if (typeof input.question !== 'string' || input.question.trim() === '') throw new BadParams('poll question is required');
+    if (!Array.isArray(input.options) || input.options.length < 2) throw new BadParams('a poll needs at least two options');
+    this.guards.requireTripEdit(tripId, actor, COLLAB_EDIT_ACTION);
+    this.requireCollabAddon();
+    const poll = this.collab.createPoll(String(tripId), actor, input as never);
+    this.realtime.broadcast(tripId, 'collab:poll:created', { poll }, undefined);
+    return poll;
+  }
+
+  @PluginMethod('collab.votePoll', { permission: 'db:write:collab' })
+  votePoll(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const tripId = num(params.tripId, 'tripId');
+    const actor = this.guards.requireActor(ctx, 'collab poll');
+    this.guards.requireTripEdit(tripId, actor, COLLAB_EDIT_ACTION);
+    this.requireCollabAddon();
+    const result = this.collab.votePoll(String(tripId), String(num(params.pollId, 'pollId')), actor, num(params.optionIndex, 'optionIndex'));
+    // The service reports its own validation failures rather than throwing.
+    if (result.error) throw new BadParams(result.error);
+    this.realtime.broadcast(tripId, 'collab:poll:voted', { poll: result.poll }, undefined);
+    return result.poll;
+  }
+
+  @PluginMethod('collab.createMessage', { permission: 'db:write:collab' })
+  createMessage(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const tripId = num(params.tripId, 'tripId');
+    const actor = this.guards.requireActor(ctx, 'collab message');
+    if (typeof params.text !== 'string' || params.text.trim() === '' || params.text.length > 4000) {
+      throw new BadParams('message text is required (max 4000 chars)');
+    }
+    this.guards.requireTripEdit(tripId, actor, COLLAB_EDIT_ACTION);
+    this.requireCollabAddon();
+    const replyTo = typeof params.replyTo === 'number' ? params.replyTo : null;
+    const result = this.collab.createMessage(String(tripId), actor, params.text, replyTo);
+    if (result.error) throw new BadParams(result.error);
+    this.realtime.broadcast(tripId, 'collab:message:created', { message: result.message }, undefined);
+    return result.message;
+  }
+
+  private requireCollabAddon(): void {
+    this.guards.requireAddon(ADDON_IDS.COLLAB, 'collab');
+  }
+}

server/src/nest/collections/collections.module.ts

@@ -1,6 +1,8 @@
 import { Module } from '@nestjs/common';
 import { CollectionsController } from './collections.controller';
 import { CollectionsService } from './collections.service';
+import { CollectionsRpc } from './collections.rpc';
+import { PluginGuardsModule } from '../plugins/host/plugin-guards.module';
 import { AppConfigModule } from '../app-config/app-config.module';
 import { CollectionsMcp } from './collections.mcp';
 import { AddonsModule } from '../addons/addons.module';
@@ -11,9 +13,9 @@ import { AuthModule } from '../auth/auth.module';
  *  Exports CollectionsService for in-container consumers (PluginsModule's
  *  RPC host deps factory). */
 @Module({
-  imports: [AddonsModule, PermissionsModule, AuthModule, AppConfigModule],
+  imports: [AddonsModule, PermissionsModule, AuthModule, AppConfigModule, PluginGuardsModule],
   controllers: [CollectionsController],
-  providers: [CollectionsService, CollectionsMcp],
+  providers: [CollectionsService, CollectionsMcp, CollectionsRpc],
   exports: [CollectionsService],
 })
 export class CollectionsModule {}

server/src/nest/collections/collections.rpc.ts

@@ -0,0 +1,117 @@
+import {
+  collectionCopyToTripRequestSchema,
+  collectionCreateRequestSchema,
+  collectionSavePlaceRequestSchema,
+  collectionUpdateRequestSchema,
+} from '@trek/shared';
+import { PluginController, PluginMethod } from '../plugins/host/rpc-kit/decorators';
+import { PluginGuards } from '../plugins/host/plugin-guards.service';
+import { BadParams, ForbiddenResource } from '../plugins/host/rpc-errors';
+import { num } from '../plugins/host/rpc-params';
+import type { PluginRpcContext } from '../plugins/host/rpc-kit/types';
+import { ADDON_IDS } from '../../addons';
+import { CollectionsService } from './collections.service';
+
+/**
+ * The collections surface a plugin may reach (#plugins).
+ *
+ * CollectionsService decides per-collection access itself (owner, admin or editor via
+ * its assertAccess / assertCanEdit), and reports a refusal as a status-tagged error
+ * rather than a typed one. mapCollectionError turns those statuses into the RPC error
+ * classes, so a 403 or 404 reaches the plugin as RESOURCE_FORBIDDEN and a 400 or 409
+ * as BAD_PARAMS, instead of leaking out as HOST_ERROR.
+ */
+@PluginController()
+export class CollectionsRpc {
+  constructor(
+    private readonly collections: CollectionsService,
+    private readonly guards: PluginGuards,
+  ) {}
+
+  @PluginMethod('collections.listMine', { permission: 'db:read:collections' })
+  listMine(_params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireCollectionsUser(ctx, 'reads');
+    this.requireCollectionsAddon();
+    return this.collections.listCollections(userId);
+  }
+
+  @PluginMethod('collections.get', { permission: 'db:read:collections' })
+  get(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    // getCollection is user-scoped by the service, so a plugin only ever fetches one
+    // the acting user may see.
+    const userId = this.requireCollectionsUser(ctx, 'reads');
+    const id = num(params.id, 'id');
+    this.requireCollectionsAddon();
+    return this.collections.getCollection(userId, id);
+  }
+
+  @PluginMethod('collections.create', { permission: 'db:write:collections' })
+  create(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const parsed = collectionCreateRequestSchema.safeParse(params.input);
+    if (!parsed.success) throw new BadParams(`invalid collection: ${parsed.error.issues[0]?.message ?? 'bad input'}`);
+    const userId = this.requireCollectionsUser(ctx, 'writes');
+    this.requireCollectionsAddon();
+    return this.mapCollectionError(() => this.collections.createCollection(userId, parsed.data as never));
+  }
+
+  @PluginMethod('collections.update', { permission: 'db:write:collections' })
+  update(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const parsed = collectionUpdateRequestSchema.safeParse(params.input);
+    if (!parsed.success) throw new BadParams(`invalid collection: ${parsed.error.issues[0]?.message ?? 'bad input'}`);
+    const userId = this.requireCollectionsUser(ctx, 'writes');
+    const id = num(params.id, 'id');
+    this.requireCollectionsAddon();
+    return this.mapCollectionError(() => this.collections.updateCollection(userId, id, parsed.data as never, undefined));
+  }
+
+  @PluginMethod('collections.savePlace', { permission: 'db:write:collections' })
+  savePlace(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const parsed = collectionSavePlaceRequestSchema.safeParse(params.input);
+    if (!parsed.success) throw new BadParams(`invalid place: ${parsed.error.issues[0]?.message ?? 'bad input'}`);
+    const userId = this.requireCollectionsUser(ctx, 'writes');
+    this.requireCollectionsAddon();
+    return this.mapCollectionError(() => this.collections.savePlace(userId, parsed.data as never, undefined));
+  }
+
+  @PluginMethod('collections.copyToTrip', { permission: 'db:write:collections' })
+  copyToTrip(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const parsed = collectionCopyToTripRequestSchema.safeParse(params.input);
+    if (!parsed.success) throw new BadParams(`invalid copy request: ${parsed.error.issues[0]?.message ?? 'bad input'}`);
+    const userId = this.requireCollectionsUser(ctx, 'writes');
+    this.requireCollectionsAddon();
+    return this.mapCollectionError(() => this.collections.copyToTrip(userId, parsed.data as never));
+  }
+
+  @PluginMethod('collections.deletePlace', { permission: 'db:write:collections' })
+  deletePlace(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireCollectionsUser(ctx, 'writes');
+    const placeId = num(params.placeId, 'placeId');
+    this.requireCollectionsAddon();
+    this.mapCollectionError(() => this.collections.deletePlace(userId, placeId, undefined));
+    return { deleted: true };
+  }
+
+  private requireCollectionsUser(ctx: PluginRpcContext, kind: 'reads' | 'writes'): number {
+    if (ctx.actingUserId === undefined) {
+      throw new ForbiddenResource(`collection ${kind} require an authenticated user context`);
+    }
+    return ctx.actingUserId;
+  }
+
+  private requireCollectionsAddon(): void {
+    this.guards.requireAddon(ADDON_IDS.COLLECTIONS, 'collections');
+  }
+
+  /** The service's status-tagged errors, mapped onto the RPC error taxonomy. */
+  private mapCollectionError<T>(fn: () => T): T {
+    try {
+      return fn();
+    } catch (e) {
+      const status = (e as { status?: number })?.status;
+      const msg = e instanceof Error ? e.message : 'collection error';
+      if (status === 403 || status === 404) throw new ForbiddenResource(msg);
+      if (status === 400 || status === 409) throw new BadParams(msg);
+      throw e;
+    }
+  }
+}

server/src/nest/journey/journal.rpc.ts

@@ -0,0 +1,111 @@
+import { PluginController, PluginMethod } from '../plugins/host/rpc-kit/decorators';
+import { PluginGuards } from '../plugins/host/plugin-guards.service';
+import { BadParams, ForbiddenResource } from '../plugins/host/rpc-errors';
+import { asPayload, num } from '../plugins/host/rpc-params';
+import type { PluginRpcContext } from '../plugins/host/rpc-kit/types';
+import { ADDON_IDS } from '../../addons';
+import { JourneyDomainService } from './journey-domain.service';
+
+/**
+ * The journal surface a plugin may reach (#plugins).
+ *
+ * Journeys are user-scoped, not trip-scoped, so there is no tripId to check. The
+ * access decision belongs to JourneyDomainService, which self-gates every call
+ * against the acting user (owner or contributor) and answers with null rather than
+ * throwing; each handler turns that null into RESOURCE_FORBIDDEN.
+ */
+@PluginController()
+export class JournalRpc {
+  constructor(
+    private readonly journey: JourneyDomainService,
+    private readonly guards: PluginGuards,
+  ) {}
+
+  @PluginMethod('journal.listMine', { permission: 'db:read:journal' })
+  listMine(_params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireJournalUser(ctx, 'reads');
+    this.requireJourneyAddon();
+    return this.journey.listJourneys(userId);
+  }
+
+  @PluginMethod('journal.getEntries', { permission: 'db:read:journal' })
+  getEntries(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireJournalUser(ctx, 'reads');
+    const journeyId = num(params.journeyId, 'journeyId');
+    this.requireJourneyAddon();
+    // listEntries self-gates via canAccessJourney and returns null when the user
+    // cannot see it.
+    const entries = this.journey.listEntries(journeyId, userId);
+    if (entries === null) throw new ForbiddenResource(`no access to journey ${journeyId}`);
+    return entries;
+  }
+
+  @PluginMethod('journal.createEntry', { permission: 'db:write:journal' })
+  createEntry(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireJournalUser(ctx, 'writes');
+    const input = asPayload(params.input);
+    if (typeof input.entry_date !== 'string' || input.entry_date === '') throw new BadParams('entry_date is required');
+    const journeyId = num(params.journeyId, 'journeyId');
+    this.requireJourneyAddon();
+    const entry = this.journey.createEntry(journeyId, userId, input as never);
+    if (!entry) throw new ForbiddenResource(`no editable journey ${journeyId} for this user`);
+    return entry;
+  }
+
+  @PluginMethod('journal.updateEntry', { permission: 'db:write:journal' })
+  updateEntry(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireJournalUser(ctx, 'writes');
+    const entryId = num(params.entryId, 'entryId');
+    this.requireJourneyAddon();
+    const entry = this.journey.updateEntry(entryId, userId, asPayload(params.input) as never);
+    if (!entry) throw new ForbiddenResource(`no editable journal entry ${entryId} for this user`);
+    return entry;
+  }
+
+  @PluginMethod('journal.deleteEntry', { permission: 'db:write:journal' })
+  deleteEntry(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireJournalUser(ctx, 'writes');
+    const entryId = num(params.entryId, 'entryId');
+    this.requireJourneyAddon();
+    if (!this.journey.deleteEntry(entryId, userId)) {
+      throw new ForbiddenResource(`no editable journal entry ${entryId} for this user`);
+    }
+    return { deleted: true };
+  }
+
+  @PluginMethod('journal.createJourney', { permission: 'db:write:journal' })
+  createJourney(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireJournalUser(ctx, 'writes');
+    const input = asPayload(params.input);
+    this.requireJourneyAddon();
+    const title = typeof input.title === 'string' ? input.title.trim() : '';
+    if (!title) throw new BadParams('journal title is required');
+    return this.journey.createJourney(userId, {
+      title,
+      subtitle: input.subtitle as string | undefined,
+      trip_ids: input.trip_ids as number[] | undefined,
+    });
+  }
+
+  @PluginMethod('journal.deleteJourney', { permission: 'db:write:journal' })
+  deleteJourney(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireJournalUser(ctx, 'writes');
+    const journeyId = num(params.journeyId, 'journeyId');
+    this.requireJourneyAddon();
+    if (!this.journey.deleteJourney(journeyId, userId)) {
+      throw new ForbiddenResource(`no deletable journal ${journeyId} for this user`);
+    }
+    return { deleted: true };
+  }
+
+  private requireJournalUser(ctx: PluginRpcContext, kind: 'reads' | 'writes'): number {
+    if (ctx.actingUserId === undefined) {
+      throw new ForbiddenResource(`journal ${kind} require an authenticated user context`);
+    }
+    return ctx.actingUserId;
+  }
+
+  private requireJourneyAddon(): void {
+    this.guards.requireAddon(ADDON_IDS.JOURNEY, 'journey');
+  }
+}

server/src/nest/journey/journey-domain.module.ts

@@ -2,6 +2,8 @@ import { Module } from '@nestjs/common';
 import { RealtimeModule } from '../realtime/realtime.module';
 import { TrekPhotosModule } from '../photos/trek-photos.module';
 import { JourneyDomainService } from './journey-domain.service';
+import { JournalRpc } from './journal.rpc';
+import { PluginGuardsModule } from '../plugins/host/plugin-guards.module';
 import { JourneyShareService } from './journey-share.service';
 
 /**
@@ -16,8 +18,8 @@ import { JourneyShareService } from './journey-share.service';
  * single-domain e2e TestingModule can still resolve the broadcast.
  */
 @Module({
-  imports: [RealtimeModule, TrekPhotosModule],
-  providers: [JourneyDomainService, JourneyShareService],
+  imports: [RealtimeModule, TrekPhotosModule, PluginGuardsModule],
+  providers: [JourneyDomainService, JourneyShareService, JournalRpc],
   exports: [JourneyDomainService, JourneyShareService],
 })
 export class JourneyDomainModule {}

server/src/nest/plugins/host/plugin-host-deps.factory.ts

@@ -196,37 +196,7 @@ export class PluginHostDepsFactory {
       // must live on the same trip (findForeignLinkTarget). Same events as the app. ---
       // --- Collab reads (collab addon; membership checked by the host). Same hydrated
       // shapes as the REST GETs, so a collab plugin can finally read what it writes. ---
-      listCollabNotes: (tripId) => { requireAddon(ADDON_IDS.COLLAB, 'collab'); return this.collab.listNotes(tripId) as unknown[]; },
-      listCollabPolls: (tripId) => { requireAddon(ADDON_IDS.COLLAB, 'collab'); return this.collab.listPolls(tripId) as unknown[]; },
-      listCollabMessages: (tripId, before) => { requireAddon(ADDON_IDS.COLLAB, 'collab'); return this.collab.listMessages(tripId, before) as unknown[]; },
       // --- Collab content (collab addon). The services validate + self-report errors. ---
-      canEditCollab: (tripId, userId) => this.canEditTripAs('collab_edit', tripId, userId),
-      createCollabNote: (tripId, input, actingUserId) => {
-        requireAddon(ADDON_IDS.COLLAB, 'collab');
-        const note = this.collab.createNote(String(tripId), actingUserId, input as never);
-        this.realtime.broadcast(tripId, 'collab:note:created', { note }, undefined);
-        return note;
-      },
-      createCollabPoll: (tripId, input, actingUserId) => {
-        requireAddon(ADDON_IDS.COLLAB, 'collab');
-        const poll = this.collab.createPoll(String(tripId), actingUserId, input as never);
-        this.realtime.broadcast(tripId, 'collab:poll:created', { poll }, undefined);
-        return poll;
-      },
-      voteCollabPoll: (tripId, pollId, optionIndex, actingUserId) => {
-        requireAddon(ADDON_IDS.COLLAB, 'collab');
-        const result = this.collab.votePoll(String(tripId), String(pollId), actingUserId, optionIndex);
-        if (result.error) throw new BadParams(result.error);
-        this.realtime.broadcast(tripId, 'collab:poll:voted', { poll: result.poll }, undefined);
-        return result.poll;
-      },
-      createCollabMessage: (tripId, text, replyTo, actingUserId) => {
-        requireAddon(ADDON_IDS.COLLAB, 'collab');
-        const result = this.collab.createMessage(String(tripId), actingUserId, text, replyTo ?? null);
-        if (result.error) throw new BadParams(result.error);
-        this.realtime.broadcast(tripId, 'collab:message:created', { message: result.message }, undefined);
-        return result.message;
-      },
       // --- Member add (member_manage). Grants trip access — the target must exist;
       // the acting user is recorded as the inviter. Owner/duplicate adds are no-ops. ---
       // --- Host-mediated notifications. Recipient resolution + channel fan-out +
@@ -347,97 +317,12 @@ export class PluginHostDepsFactory {
       // --- User-scoped addon reads (the acting user's own data across all trips). Each
       // reuses the same service the addon's REST/MCP path uses; the addon-enabled gate
       // mirrors the app (a disabled addon has nothing to read). ---
-      listJournalsForUser: (userId) => { requireAddon(ADDON_IDS.JOURNEY, 'journey'); return this.journey.listJourneys(userId); },
-      journalEntriesForUser: (userId, journeyId) => {
-        requireAddon(ADDON_IDS.JOURNEY, 'journey');
-        // listEntries self-gates via canAccessJourney(journeyId, userId) → null if the
-        // user can't see it (owner/contributor only).
-        const entries = this.journey.listEntries(journeyId, userId);
-        if (entries === null) throw new ForbiddenResource(`no access to journey ${journeyId}`);
-        return entries;
-      },
-      atlasVisitedForUser: (userId) => {
-        requireAddon(ADDON_IDS.ATLAS, 'atlas');
-        return { countries: this.atlas.listVisitedCountries(userId), regions: this.atlas.listManuallyVisitedRegions(userId) };
-      },
-      atlasBucketForUser: (userId) => { requireAddon(ADDON_IDS.ATLAS, 'atlas'); return this.atlas.bucketList(userId) as unknown[]; },
-      vacayForUser: (userId) => { requireAddon(ADDON_IDS.VACAY, 'vacay'); return this.vacay.getPlanData(userId); },
-      listCollectionsForUser: (userId) => { requireAddon(ADDON_IDS.COLLECTIONS, 'collections'); return this.collections.listCollections(userId); },
-      getCollectionForUser: (userId, id) => { requireAddon(ADDON_IDS.COLLECTIONS, 'collections'); return this.collections.getCollection(userId, id); },
       // --- Collections write. The service self-gates per-collection role (assertAccess/
       // assertCanEdit throw status-tagged errors) — map those to the RPC error codes. ---
-      createCollectionForUser: (userId, input) => {
-        requireAddon(ADDON_IDS.COLLECTIONS, 'collections');
-        return mapCollectionError(() => this.collections.createCollection(userId, input as never));
-      },
-      updateCollectionForUser: (userId, id, input) => {
-        requireAddon(ADDON_IDS.COLLECTIONS, 'collections');
-        return mapCollectionError(() => this.collections.updateCollection(userId, id, input as never, undefined));
-      },
-      saveCollectionPlace: (userId, input) => {
-        requireAddon(ADDON_IDS.COLLECTIONS, 'collections');
-        return mapCollectionError(() => this.collections.savePlace(userId, input as never, undefined));
-      },
-      copyCollectionToTrip: (userId, input) => {
-        requireAddon(ADDON_IDS.COLLECTIONS, 'collections');
-        return mapCollectionError(() => this.collections.copyToTrip(userId, input as never));
-      },
-      deleteCollectionPlace: (userId, placeId) => {
-        requireAddon(ADDON_IDS.COLLECTIONS, 'collections');
-        mapCollectionError(() => this.collections.deletePlace(userId, placeId, undefined));
-        return { deleted: true };
-      },
       // --- Atlas write: plain uid-scoped rows, no broadcasts in the service. ---
-      markCountryVisited: (userId, code) => { requireAddon(ADDON_IDS.ATLAS, 'atlas'); this.atlas.markCountry(userId, code); return { visited: true }; },
-      unmarkCountryVisited: (userId, code) => { requireAddon(ADDON_IDS.ATLAS, 'atlas'); this.atlas.unmarkCountry(userId, code); return { visited: false }; },
-      markRegionVisited: (userId, regionCode, regionName, countryCode) => {
-        requireAddon(ADDON_IDS.ATLAS, 'atlas');
-        this.atlas.markRegion(userId, regionCode, regionName, countryCode);
-        return { visited: true };
-      },
-      unmarkRegionVisited: (userId, regionCode) => { requireAddon(ADDON_IDS.ATLAS, 'atlas'); this.atlas.unmarkRegion(userId, regionCode); return { visited: false }; },
-      createBucketItem: (userId, input) => { requireAddon(ADDON_IDS.ATLAS, 'atlas'); return this.atlas.createBucketItem(userId, input as never); },
-      deleteBucketItem: (userId, itemId) => {
-        requireAddon(ADDON_IDS.ATLAS, 'atlas');
-        if (!this.atlas.deleteBucketItem(userId, itemId)) throw new ForbiddenResource(`no bucket item ${itemId} for this user`);
-        return { deleted: true };
-      },
       // --- Vacay write: the plan is the ACTING USER's active plan (resolved host-side);
       // the service broadcasts to plan users itself. ---
-      vacayToggleEntry: (userId, date) => { requireAddon(ADDON_IDS.VACAY, 'vacay'); return this.vacay.toggleEntry(userId, this.vacay.getActivePlanId(userId), date, 1, 'vacation', undefined); },
-      vacayToggleCompanyHoliday: (userId, date, note) => {
-        requireAddon(ADDON_IDS.VACAY, 'vacay');
-        return this.vacay.toggleCompanyHoliday(this.vacay.getActivePlanId(userId), date, note, undefined);
-      },
       // --- Journal write: journeyService.canEdit self-gates each call (owner/contributor). ---
-      createJournalEntry: (userId, journeyId, input) => {
-        requireAddon(ADDON_IDS.JOURNEY, 'journey');
-        const entry = this.journey.createEntry(journeyId, userId, input as never);
-        if (!entry) throw new ForbiddenResource(`no editable journey ${journeyId} for this user`);
-        return entry;
-      },
-      updateJournalEntry: (userId, entryId, input) => {
-        requireAddon(ADDON_IDS.JOURNEY, 'journey');
-        const entry = this.journey.updateEntry(entryId, userId, input as never);
-        if (!entry) throw new ForbiddenResource(`no editable journal entry ${entryId} for this user`);
-        return entry;
-      },
-      deleteJournalEntry: (userId, entryId) => {
-        requireAddon(ADDON_IDS.JOURNEY, 'journey');
-        if (!this.journey.deleteEntry(entryId, userId)) throw new ForbiddenResource(`no editable journal entry ${entryId} for this user`);
-        return { deleted: true };
-      },
-      createJournal: (userId, input) => {
-        requireAddon(ADDON_IDS.JOURNEY, 'journey');
-        const title = typeof (input as { title?: unknown }).title === 'string' ? String((input as { title: string }).title).trim() : '';
-        if (!title) throw new BadParams('journal title is required');
-        return this.journey.createJourney(userId, { title, subtitle: (input as { subtitle?: string }).subtitle, trip_ids: (input as { trip_ids?: number[] }).trip_ids });
-      },
-      deleteJournal: (userId, journeyId) => {
-        requireAddon(ADDON_IDS.JOURNEY, 'journey');
-        if (!this.journey.deleteJourney(journeyId, userId)) throw new ForbiddenResource(`no deletable journal ${journeyId} for this user`);
-        return { deleted: true };
-      },
       // Day notes are core (no addon) and trip-scoped; membership is enforced by the host.
       // --- Day notes write (day_edit). The day must belong to the trip; broadcasts the
       // same dayNote:* events the REST controller emits so open sessions update live. ---

server/src/nest/plugins/host/rpc-host.ts

@@ -97,54 +97,21 @@ export interface HostDeps {
   /** Update a file's description/links (same-trip targets enforced); broadcasts file:updated. */
   /** Move a trip file to the trash; broadcasts file:deleted. */
   // --- Collab reads (membership + collab addon; no separate right, like the REST GETs) ---
-  listCollabNotes(tripId: number): unknown[];
-  listCollabPolls(tripId: number): unknown[];
-  listCollabMessages(tripId: number, before: number | undefined): unknown[];
   // --- Collab content (the app's collab_edit permission; collab addon gated) ---
-  canEditCollab(tripId: number, userId: number): boolean;
-  createCollabNote(tripId: number, input: Record<string, unknown>, actingUserId: number): unknown;
-  createCollabPoll(tripId: number, input: Record<string, unknown>, actingUserId: number): unknown;
-  voteCollabPoll(tripId: number, pollId: number, optionIndex: number, actingUserId: number): unknown;
-  createCollabMessage(tripId: number, text: string, replyTo: number | undefined, actingUserId: number): unknown;
   // --- Member add (the DISTINCT member_manage permission — never bundled) ---
   /** The acting user's own journals (journey addon must be enabled). */
-  listJournalsForUser(userId: number): unknown;
   /** The entries of one of the acting user's journeys (journey addon; access-checked). */
-  journalEntriesForUser(userId: number, journeyId: number): unknown;
   /** The acting user's visited countries + regions (atlas addon must be enabled). */
-  atlasVisitedForUser(userId: number): unknown;
   /** The acting user's bucket-list items (atlas addon must be enabled). */
-  atlasBucketForUser(userId: number): unknown[];
   /** The acting user's vacation plan data (vacay addon must be enabled). */
-  vacayForUser(userId: number): unknown;
   /** The acting user's saved-place collections (collections addon must be enabled). */
-  listCollectionsForUser(userId: number): unknown;
   /** One of the acting user's collections by id (collections addon must be enabled). */
-  getCollectionForUser(userId: number, id: number): unknown;
   // --- Collections write (the service enforces per-collection role itself) ---
-  createCollectionForUser(userId: number, input: Record<string, unknown>): unknown;
-  updateCollectionForUser(userId: number, id: number, input: Record<string, unknown>): unknown;
-  saveCollectionPlace(userId: number, input: Record<string, unknown>): unknown;
-  copyCollectionToTrip(userId: number, input: Record<string, unknown>): unknown;
-  deleteCollectionPlace(userId: number, placeId: number): unknown;
   // --- Atlas write (all rows are the acting user's own; atlas addon gated) ---
-  markCountryVisited(userId: number, code: string): unknown;
-  unmarkCountryVisited(userId: number, code: string): unknown;
-  markRegionVisited(userId: number, regionCode: string, regionName: string, countryCode: string): unknown;
-  unmarkRegionVisited(userId: number, regionCode: string): unknown;
-  createBucketItem(userId: number, input: Record<string, unknown>): unknown;
-  deleteBucketItem(userId: number, itemId: number): unknown;
   // --- Vacay write (plan resolved from the acting user; vacay addon gated) ---
-  vacayToggleEntry(userId: number, date: string): unknown;
-  vacayToggleCompanyHoliday(userId: number, date: string, note: string | undefined): unknown;
   // --- Journal write (journeyService.canEdit self-gates; journey addon gated) ---
-  createJournalEntry(userId: number, journeyId: number, input: Record<string, unknown>): unknown;
-  updateJournalEntry(userId: number, entryId: number, input: Record<string, unknown>): unknown;
-  deleteJournalEntry(userId: number, entryId: number): unknown;
   /** Create/delete a JOURNAL itself (owned by the acting user) — lets an importer
    * bootstrap the journal it then fills, and clean it up. */
-  createJournal(userId: number, input: Record<string, unknown>): unknown;
-  deleteJournal(userId: number, journeyId: number): unknown;
   /** A trip day's notes (trip-scoped), for `daynotes.list`. */
   /** Create a day note (the day must be on the trip); broadcasts dayNote:created. */
   /** Update a day note (scoped to the day+trip); broadcasts dayNote:updated. */
@@ -235,185 +202,12 @@ export class PluginRpcHost {
     // trips.*, reservations.listMine and the member roster now live in
     // src/nest/trips/trips.rpc.ts.
     // files.* now lives in src/nest/files/files.rpc.ts.
-    if (has('db:write:collab')) {
-      // Collab content (notes/polls/messages) under the app's collab_edit right.
-      this.methods.set('collab.createNote', (p, uid) => {
-        const tripId = num(p.tripId, 'tripId');
-        const actor = this.requireActor(uid, 'collab note');
-        const input = asPayload(p.input);
-        if (typeof input.title !== 'string' || input.title.trim() === '') throw new BadParams('note title is required');
-        this.requireTripEdit(tripId, actor, deps.canEditCollab);
-        return deps.createCollabNote(tripId, input, actor);
-      });
-      this.methods.set('collab.createPoll', (p, uid) => {
-        const tripId = num(p.tripId, 'tripId');
-        const actor = this.requireActor(uid, 'collab poll');
-        const input = asPayload(p.input);
-        if (typeof input.question !== 'string' || input.question.trim() === '') throw new BadParams('poll question is required');
-        if (!Array.isArray(input.options) || input.options.length < 2) throw new BadParams('a poll needs at least two options');
-        this.requireTripEdit(tripId, actor, deps.canEditCollab);
-        return deps.createCollabPoll(tripId, input, actor);
-      });
-      this.methods.set('collab.votePoll', (p, uid) => {
-        const tripId = num(p.tripId, 'tripId');
-        const actor = this.requireActor(uid, 'collab poll');
-        this.requireTripEdit(tripId, actor, deps.canEditCollab);
-        return deps.voteCollabPoll(tripId, num(p.pollId, 'pollId'), num(p.optionIndex, 'optionIndex'), actor);
-      });
-      this.methods.set('collab.createMessage', (p, uid) => {
-        const tripId = num(p.tripId, 'tripId');
-        const actor = this.requireActor(uid, 'collab message');
-        if (typeof p.text !== 'string' || p.text.trim() === '' || p.text.length > 4000) throw new BadParams('message text is required (max 4000 chars)');
-        this.requireTripEdit(tripId, actor, deps.canEditCollab);
-        return deps.createCollabMessage(tripId, p.text, typeof p.replyTo === 'number' ? p.replyTo : undefined, actor);
-      });
-    }
 
     // User-scoped addon reads: the acting user's OWN journals/atlas/vacay across all
     // their trips (not one trip), so — like costs.listMine — they are gated on a bound
     // acting user, not a tripId; the wiring additionally refuses a disabled addon.
-    if (has('db:read:collab')) {
-      // Collab reads mirror the REST GETs: membership only (the addon gate lives in
-      // the wiring), no separate right — the write side already has collab_edit.
-      this.methods.set('collab.listNotes', (p, uid) => this.tripRead(p, uid, () => deps.listCollabNotes(num(p.tripId, 'tripId'))));
-      this.methods.set('collab.listPolls', (p, uid) => this.tripRead(p, uid, () => deps.listCollabPolls(num(p.tripId, 'tripId'))));
-      this.methods.set('collab.listMessages', (p, uid) =>
-        this.tripRead(p, uid, () => deps.listCollabMessages(num(p.tripId, 'tripId'), p.before != null ? num(p.before, 'before') : undefined)),
-      );
-    }
-    if (has('db:read:journal')) {
-      this.methods.set('journal.listMine', (_p, uid) => {
-        if (uid === undefined) throw new ForbiddenResource('journal reads require an authenticated user context');
-        return deps.listJournalsForUser(uid);
-      });
-      // A journey's entries (photos/story/checkins). Journeys are user-scoped, not
-      // trip-scoped, so the access check is journey membership inside the wiring.
-      this.methods.set('journal.getEntries', (p, uid) => {
-        if (uid === undefined) throw new ForbiddenResource('journal reads require an authenticated user context');
-        return deps.journalEntriesForUser(uid, num(p.journeyId, 'journeyId'));
-      });
-    }
-    if (has('db:read:atlas')) {
-      this.methods.set('atlas.visited', (_p, uid) => {
-        if (uid === undefined) throw new ForbiddenResource('atlas reads require an authenticated user context');
-        return deps.atlasVisitedForUser(uid);
-      });
-      this.methods.set('atlas.bucketList', (_p, uid) => {
-        if (uid === undefined) throw new ForbiddenResource('atlas reads require an authenticated user context');
-        return deps.atlasBucketForUser(uid);
-      });
-    }
-    if (has('db:read:vacay')) {
-      this.methods.set('vacay.mine', (_p, uid) => {
-        if (uid === undefined) throw new ForbiddenResource('vacay reads require an authenticated user context');
-        return deps.vacayForUser(uid);
-      });
-    }
-    if (has('db:read:collections')) {
-      this.methods.set('collections.listMine', (_p, uid) => {
-        if (uid === undefined) throw new ForbiddenResource('collection reads require an authenticated user context');
-        return deps.listCollectionsForUser(uid);
-      });
-      // getCollection is user-scoped by the service (it takes the acting user), so a
-      // plugin can only fetch a collection the acting user owns.
-      this.methods.set('collections.get', (p, uid) => {
-        if (uid === undefined) throw new ForbiddenResource('collection reads require an authenticated user context');
-        return deps.getCollectionForUser(uid, num(p.id, 'id'));
-      });
-    }
-    if (has('db:write:collections')) {
-      // Collections write. The service enforces per-collection role itself
-      // (owner/admin/editor via assertCanEdit) against the HOST-bound acting user —
-      // the wiring maps its 403/404 to RESOURCE_FORBIDDEN. Inputs are schema-validated.
-      const requireUid = (uid: number | undefined): number => {
-        if (uid === undefined) throw new ForbiddenResource('collection writes require an authenticated user context');
-        return uid;
-      };
-      this.methods.set('collections.create', (p, uid) => {
-        const parsed = collectionCreateRequestSchema.safeParse(p.input);
-        if (!parsed.success) throw new BadParams(`invalid collection: ${parsed.error.issues[0]?.message ?? 'bad input'}`);
-        return deps.createCollectionForUser(requireUid(uid), parsed.data as Record<string, unknown>);
-      });
-      this.methods.set('collections.update', (p, uid) => {
-        const parsed = collectionUpdateRequestSchema.safeParse(p.input);
-        if (!parsed.success) throw new BadParams(`invalid collection: ${parsed.error.issues[0]?.message ?? 'bad input'}`);
-        return deps.updateCollectionForUser(requireUid(uid), num(p.id, 'id'), parsed.data as Record<string, unknown>);
-      });
-      this.methods.set('collections.savePlace', (p, uid) => {
-        const parsed = collectionSavePlaceRequestSchema.safeParse(p.input);
-        if (!parsed.success) throw new BadParams(`invalid place: ${parsed.error.issues[0]?.message ?? 'bad input'}`);
-        return deps.saveCollectionPlace(requireUid(uid), parsed.data as Record<string, unknown>);
-      });
-      this.methods.set('collections.copyToTrip', (p, uid) => {
-        const parsed = collectionCopyToTripRequestSchema.safeParse(p.input);
-        if (!parsed.success) throw new BadParams(`invalid copy request: ${parsed.error.issues[0]?.message ?? 'bad input'}`);
-        return deps.copyCollectionToTrip(requireUid(uid), parsed.data as Record<string, unknown>);
-      });
-      this.methods.set('collections.deletePlace', (p, uid) => deps.deleteCollectionPlace(requireUid(uid), num(p.placeId, 'placeId')));
-    }
-    if (has('db:write:atlas')) {
-      // Atlas write: every row is the acting user's own (visited_countries /
-      // visited_regions / bucket) — no trip scoping, no cross-tenant surface.
-      const requireUid = (uid: number | undefined): number => {
-        if (uid === undefined) throw new ForbiddenResource('atlas writes require an authenticated user context');
-        return uid;
-      };
-      const code = (v: unknown, name: string): string => {
-        if (typeof v !== 'string' || v.trim() === '' || v.length > 8) throw new BadParams(`${name} must be a short code`);
-        return v.trim().toUpperCase();
-      };
-      this.methods.set('atlas.markCountry', (p, uid) => deps.markCountryVisited(requireUid(uid), code(p.code, 'code')));
-      this.methods.set('atlas.unmarkCountry', (p, uid) => deps.unmarkCountryVisited(requireUid(uid), code(p.code, 'code')));
-      this.methods.set('atlas.markRegion', (p, uid) => {
-        const u = requireUid(uid);
-        const regionName = typeof p.regionName === 'string' && p.regionName ? p.regionName.slice(0, 128) : String(p.regionCode ?? '');
-        return deps.markRegionVisited(u, code(p.regionCode, 'regionCode'), regionName, code(p.countryCode, 'countryCode'));
-      });
-      this.methods.set('atlas.unmarkRegion', (p, uid) => deps.unmarkRegionVisited(requireUid(uid), code(p.regionCode, 'regionCode')));
-      this.methods.set('atlas.createBucketItem', (p, uid) => {
-        const u = requireUid(uid);
-        const input = asPayload(p.input);
-        if (typeof input.name !== 'string' || input.name.trim() === '') throw new BadParams('bucket item name is required');
-        return deps.createBucketItem(u, input);
-      });
-      this.methods.set('atlas.deleteBucketItem', (p, uid) => deps.deleteBucketItem(requireUid(uid), num(p.itemId, 'itemId')));
-    }
-    if (has('db:write:vacay')) {
-      // Vacay write: the plan is resolved host-side from the acting user's active
-      // plan — a plugin can never name another plan. toggleEntry only ever toggles
-      // the ACTING USER's own PTO day.
-      const requireUid = (uid: number | undefined): number => {
-        if (uid === undefined) throw new ForbiddenResource('vacay writes require an authenticated user context');
-        return uid;
-      };
-      const dateStr = (v: unknown): string => {
-        if (typeof v !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(v)) throw new BadParams('date must be YYYY-MM-DD');
-        return v;
-      };
-      this.methods.set('vacay.toggleEntry', (p, uid) => deps.vacayToggleEntry(requireUid(uid), dateStr(p.date)));
-      this.methods.set('vacay.toggleCompanyHoliday', (p, uid) =>
-        deps.vacayToggleCompanyHoliday(requireUid(uid), dateStr(p.date), typeof p.note === 'string' ? p.note.slice(0, 256) : undefined));
-    }
-    if (has('db:write:journal')) {
-      // Journal write: journeyService.canEdit self-gates every call against the
-      // acting user (owner/contributor) — the wiring maps a refusal to
-      // RESOURCE_FORBIDDEN. Journeys are user-scoped, not trip-scoped.
-      const requireUid = (uid: number | undefined): number => {
-        if (uid === undefined) throw new ForbiddenResource('journal writes require an authenticated user context');
-        return uid;
-      };
-      this.methods.set('journal.createEntry', (p, uid) => {
-        const u = requireUid(uid);
-        const input = asPayload(p.input);
-        if (typeof input.entry_date !== 'string' || input.entry_date === '') throw new BadParams('entry_date is required');
-        return deps.createJournalEntry(u, num(p.journeyId, 'journeyId'), input);
-      });
-      this.methods.set('journal.updateEntry', (p, uid) =>
-        deps.updateJournalEntry(requireUid(uid), num(p.entryId, 'entryId'), asPayload(p.input)));
-      this.methods.set('journal.deleteEntry', (p, uid) => deps.deleteJournalEntry(requireUid(uid), num(p.entryId, 'entryId')));
-      this.methods.set('journal.createJourney', (p, uid) => deps.createJournal(requireUid(uid), asPayload(p.input)));
-      this.methods.set('journal.deleteJourney', (p, uid) => deps.deleteJournal(requireUid(uid), num(p.journeyId, 'journeyId')));
-    }
+    // collab, journal, atlas, vacay and collections now live in their own
+    // domains' *.rpc.ts, each carrying its addon gate with it.
 
     // costs.* now lives in src/nest/budget/costs.rpc.ts.
 

server/src/nest/vacay/vacay.module.ts

@@ -1,6 +1,8 @@
 import { Module } from '@nestjs/common';
 import { VacayController } from './vacay.controller';
 import { VacayService } from './vacay.service';
+import { VacayRpc } from './vacay.rpc';
+import { PluginGuardsModule } from '../plugins/host/plugin-guards.module';
 import { VacayMcp } from './vacay.mcp';
 import { AuthModule } from '../auth/auth.module';
 
@@ -10,9 +12,9 @@ import { AuthModule } from '../auth/auth.module';
  * VacayMcp carries the DI-discovered MCP tools/resources.
  */
 @Module({
-  imports: [AuthModule],
+  imports: [AuthModule, PluginGuardsModule],
   controllers: [VacayController],
-  providers: [VacayService, VacayMcp],
+  providers: [VacayService, VacayMcp, VacayRpc],
   exports: [VacayService],
 })
 export class VacayModule {}

server/src/nest/vacay/vacay.rpc.ts

@@ -0,0 +1,61 @@
+import { PluginController, PluginMethod } from '../plugins/host/rpc-kit/decorators';
+import { PluginGuards } from '../plugins/host/plugin-guards.service';
+import { BadParams, ForbiddenResource } from '../plugins/host/rpc-errors';
+import type { PluginRpcContext } from '../plugins/host/rpc-kit/types';
+import { ADDON_IDS } from '../../addons';
+import { VacayService } from './vacay.service';
+
+/**
+ * The vacay surface a plugin may reach (#plugins).
+ *
+ * The plan is always resolved host-side from the acting user's ACTIVE plan, so a
+ * plugin can never name someone else's plan, and toggleEntry only ever moves the
+ * acting user's own PTO day. The service broadcasts to the plan's users itself.
+ */
+@PluginController()
+export class VacayRpc {
+  constructor(
+    private readonly vacay: VacayService,
+    private readonly guards: PluginGuards,
+  ) {}
+
+  @PluginMethod('vacay.mine', { permission: 'db:read:vacay' })
+  mine(_params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireVacayUser(ctx, 'reads');
+    this.requireVacayAddon();
+    return this.vacay.getPlanData(userId);
+  }
+
+  @PluginMethod('vacay.toggleEntry', { permission: 'db:write:vacay' })
+  toggleEntry(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireVacayUser(ctx, 'writes');
+    const date = this.dateStr(params.date);
+    this.requireVacayAddon();
+    return this.vacay.toggleEntry(userId, this.vacay.getActivePlanId(userId), date, 1, 'vacation', undefined);
+  }
+
+  @PluginMethod('vacay.toggleCompanyHoliday', { permission: 'db:write:vacay' })
+  toggleCompanyHoliday(params: Record<string, unknown>, ctx: PluginRpcContext): unknown {
+    const userId = this.requireVacayUser(ctx, 'writes');
+    const date = this.dateStr(params.date);
+    const note = typeof params.note === 'string' ? params.note.slice(0, 256) : undefined;
+    this.requireVacayAddon();
+    return this.vacay.toggleCompanyHoliday(this.vacay.getActivePlanId(userId), date, note, undefined);
+  }
+
+  private requireVacayUser(ctx: PluginRpcContext, kind: 'reads' | 'writes'): number {
+    if (ctx.actingUserId === undefined) {
+      throw new ForbiddenResource(`vacay ${kind} require an authenticated user context`);
+    }
+    return ctx.actingUserId;
+  }
+
+  private requireVacayAddon(): void {
+    this.guards.requireAddon(ADDON_IDS.VACAY, 'vacay');
+  }
+
+  private dateStr(value: unknown): string {
+    if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(value)) throw new BadParams('date must be YYYY-MM-DD');
+    return value;
+  }
+}