@databricks/appkit-ui 0.15.0 → 0.17.0

package/dist/cli/commands/plugin/add-resource/add-resource.js

@@ -1,5 +1,6 @@
 import { humanizeResourceType } from "../create/resource-defaults.js";
 import { promptOneResource } from "../create/prompt-resource.js";
+import { resolveManifestInDir } from "../manifest-resolve.js";
 import { validateManifest } from "../validate/validate-manifest.js";
 import fs from "node:fs";
 import path from "node:path";
@@ -12,11 +13,16 @@ async function runPluginAddResource(options) {
 	intro("Add resource to plugin manifest");
 	const cwd = process.cwd();
 	const pluginDir = path.resolve(cwd, options.path ?? ".");
-	const manifestPath = path.join(pluginDir, "manifest.json");
-	if (!fs.existsSync(manifestPath)) {
-		console.error(`manifest.json not found at ${manifestPath}`);
+	const resolved = resolveManifestInDir(pluginDir, { allowJsManifest: true });
+	if (!resolved) {
+		console.error(`No manifest found in ${pluginDir}. This command requires manifest.json (manifest.js cannot be edited in place).`);
 		process.exit(1);
 	}
+	if (resolved.type !== "json") {
+		console.error(`Editable manifest not found. add-resource only supports plugin directories that contain manifest.json (found ${path.basename(resolved.path)}).`);
+		process.exit(1);
+	}
+	const manifestPath = resolved.path;
 	let manifest;
 	try {
 		const raw = fs.readFileSync(manifestPath, "utf-8");
@@ -51,7 +57,7 @@ async function runPluginAddResource(options) {
 	outro("Resource added.");
 	console.log(`\nAdded ${alias} as ${spec.required ? "required" : "optional"} to ${path.relative(cwd, manifestPath)}`);
 }
-const pluginAddResourceCommand = new Command("add-resource").description("Add a resource requirement to an existing plugin manifest (interactive). Overwrites manifest.json in place.").option("-p, --path <dir>", "Plugin directory containing manifest.json (default: .)").action((opts) => runPluginAddResource(opts).catch((err) => {
+const pluginAddResourceCommand = new Command("add-resource").description("Add a resource requirement to an existing plugin manifest (interactive). Overwrites manifest.json in place.").option("-p, --path <dir>", "Plugin directory containing manifest.json, which will be edited in place (default: .)").action((opts) => runPluginAddResource(opts).catch((err) => {
 	console.error(err);
 	process.exit(1);
 }));

package/dist/cli/commands/plugin/add-resource/add-resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"add-resource.js","names":[],"sources":["../../../../../src/cli/commands/plugin/add-resource/add-resource.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport process from \"node:process\";\nimport { cancel, intro, outro } from \"@clack/prompts\";\nimport { Command } from \"commander\";\nimport { promptOneResource } from \"../create/prompt-resource\";\nimport { humanizeResourceType } from \"../create/resource-defaults\";\nimport type { PluginManifest } from \"../manifest-types\";\nimport { validateManifest } from \"../validate/validate-manifest\";\n\n/** Extended manifest type that preserves extra JSON fields (e.g. $schema, author, version) for round-trip writes. */\ninterface ManifestWithExtras extends PluginManifest {\n  [key: string]: unknown;\n}\n\nasync function runPluginAddResource(options: { path?: string }): Promise<void> {\n  intro(\"Add resource to plugin manifest\");\n\n  const cwd = process.cwd();\n  const pluginDir = path.resolve(cwd, options.path ?? \".\");\n  const manifestPath = path.join(pluginDir, \"manifest.json\");\n\n  if (!fs.existsSync(manifestPath)) {\n    console.error(`manifest.json not found at ${manifestPath}`);\n    process.exit(1);\n  }\n\n  let manifest: ManifestWithExtras;\n  try {\n    const raw = fs.readFileSync(manifestPath, \"utf-8\");\n    const parsed = JSON.parse(raw) as unknown;\n    const result = validateManifest(parsed);\n    if (!result.valid || !result.manifest) {\n      console.error(\n        \"Invalid manifest. Run `appkit plugin validate` for details.\",\n      );\n      process.exit(1);\n    }\n    manifest = parsed as ManifestWithExtras;\n  } catch (err) {\n    console.error(\n      \"Failed to read or parse manifest.json:\",\n      err instanceof Error ? err.message : err,\n    );\n    process.exit(1);\n  }\n\n  const spec = await promptOneResource();\n  if (!spec) {\n    cancel(\"Cancelled.\");\n    process.exit(0);\n  }\n\n  const alias = humanizeResourceType(spec.type);\n  const entry = {\n    type: spec.type,\n    alias,\n    resourceKey: spec.resourceKey,\n    description: spec.description || `Required for ${alias} functionality.`,\n    permission: spec.permission,\n    fields: spec.fields,\n  };\n\n  if (spec.required) {\n    manifest.resources.required.push(entry);\n  } else {\n    manifest.resources.optional.push(entry);\n  }\n\n  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\\n`);\n\n  outro(\"Resource added.\");\n  console.log(\n    `\\nAdded ${alias} as ${spec.required ? \"required\" : \"optional\"} to ${path.relative(cwd, manifestPath)}`,\n  );\n}\n\nexport const pluginAddResourceCommand = new Command(\"add-resource\")\n  .description(\n    \"Add a resource requirement to an existing plugin manifest (interactive). Overwrites manifest.json in place.\",\n  )\n  .option(\n    \"-p, --path <dir>\",\n    \"Plugin directory containing manifest.json (default: .)\",\n  )\n  .action((opts) =>\n    runPluginAddResource(opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;AAeA,eAAe,qBAAqB,SAA2C;AAC7E,OAAM,kCAAkC;CAExC,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,YAAY,KAAK,QAAQ,KAAK,QAAQ,QAAQ,IAAI;CACxD,MAAM,eAAe,KAAK,KAAK,WAAW,gBAAgB;AAE1D,KAAI,CAAC,GAAG,WAAW,aAAa,EAAE;AAChC,UAAQ,MAAM,8BAA8B,eAAe;AAC3D,UAAQ,KAAK,EAAE;;CAGjB,IAAI;AACJ,KAAI;EACF,MAAM,MAAM,GAAG,aAAa,cAAc,QAAQ;EAClD,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,MAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,CAAC,OAAO,SAAS,CAAC,OAAO,UAAU;AACrC,WAAQ,MACN,8DACD;AACD,WAAQ,KAAK,EAAE;;AAEjB,aAAW;UACJ,KAAK;AACZ,UAAQ,MACN,0CACA,eAAe,QAAQ,IAAI,UAAU,IACtC;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,OAAO,MAAM,mBAAmB;AACtC,KAAI,CAAC,MAAM;AACT,SAAO,aAAa;AACpB,UAAQ,KAAK,EAAE;;CAGjB,MAAM,QAAQ,qBAAqB,KAAK,KAAK;CAC7C,MAAM,QAAQ;EACZ,MAAM,KAAK;EACX;EACA,aAAa,KAAK;EAClB,aAAa,KAAK,eAAe,gBAAgB,MAAM;EACvD,YAAY,KAAK;EACjB,QAAQ,KAAK;EACd;AAED,KAAI,KAAK,SACP,UAAS,UAAU,SAAS,KAAK,MAAM;KAEvC,UAAS,UAAU,SAAS,KAAK,MAAM;AAGzC,IAAG,cAAc,cAAc,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,IAAI;AAExE,OAAM,kBAAkB;AACxB,SAAQ,IACN,WAAW,MAAM,MAAM,KAAK,WAAW,aAAa,WAAW,MAAM,KAAK,SAAS,KAAK,aAAa,GACtG;;AAGH,MAAa,2BAA2B,IAAI,QAAQ,eAAe,CAChE,YACC,8GACD,CACA,OACC,oBACA,yDACD,CACA,QAAQ,SACP,qBAAqB,KAAK,CAAC,OAAO,QAAQ;AACxC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}
+{"version":3,"file":"add-resource.js","names":[],"sources":["../../../../../src/cli/commands/plugin/add-resource/add-resource.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport process from \"node:process\";\nimport { cancel, intro, outro } from \"@clack/prompts\";\nimport { Command } from \"commander\";\nimport { promptOneResource } from \"../create/prompt-resource\";\nimport { humanizeResourceType } from \"../create/resource-defaults\";\nimport { resolveManifestInDir } from \"../manifest-resolve\";\nimport type { PluginManifest } from \"../manifest-types\";\nimport { validateManifest } from \"../validate/validate-manifest\";\n\n/** Extended manifest type that preserves extra JSON fields (e.g. $schema, author, version) for round-trip writes. */\ninterface ManifestWithExtras extends PluginManifest {\n  [key: string]: unknown;\n}\n\nasync function runPluginAddResource(options: { path?: string }): Promise<void> {\n  intro(\"Add resource to plugin manifest\");\n\n  const cwd = process.cwd();\n  const pluginDir = path.resolve(cwd, options.path ?? \".\");\n  const resolved = resolveManifestInDir(pluginDir, { allowJsManifest: true });\n\n  if (!resolved) {\n    console.error(\n      `No manifest found in ${pluginDir}. This command requires manifest.json (manifest.js cannot be edited in place).`,\n    );\n    process.exit(1);\n  }\n\n  if (resolved.type !== \"json\") {\n    console.error(\n      `Editable manifest not found. add-resource only supports plugin directories that contain manifest.json (found ${path.basename(resolved.path)}).`,\n    );\n    process.exit(1);\n  }\n\n  const manifestPath = resolved.path;\n\n  let manifest: ManifestWithExtras;\n  try {\n    const raw = fs.readFileSync(manifestPath, \"utf-8\");\n    const parsed = JSON.parse(raw) as unknown;\n    const result = validateManifest(parsed);\n    if (!result.valid || !result.manifest) {\n      console.error(\n        \"Invalid manifest. Run `appkit plugin validate` for details.\",\n      );\n      process.exit(1);\n    }\n    manifest = parsed as ManifestWithExtras;\n  } catch (err) {\n    console.error(\n      \"Failed to read or parse manifest.json:\",\n      err instanceof Error ? err.message : err,\n    );\n    process.exit(1);\n  }\n\n  const spec = await promptOneResource();\n  if (!spec) {\n    cancel(\"Cancelled.\");\n    process.exit(0);\n  }\n\n  const alias = humanizeResourceType(spec.type);\n  const entry = {\n    type: spec.type,\n    alias,\n    resourceKey: spec.resourceKey,\n    description: spec.description || `Required for ${alias} functionality.`,\n    permission: spec.permission,\n    fields: spec.fields,\n  };\n\n  if (spec.required) {\n    manifest.resources.required.push(entry);\n  } else {\n    manifest.resources.optional.push(entry);\n  }\n\n  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\\n`);\n\n  outro(\"Resource added.\");\n  console.log(\n    `\\nAdded ${alias} as ${spec.required ? \"required\" : \"optional\"} to ${path.relative(cwd, manifestPath)}`,\n  );\n}\n\nexport const pluginAddResourceCommand = new Command(\"add-resource\")\n  .description(\n    \"Add a resource requirement to an existing plugin manifest (interactive). Overwrites manifest.json in place.\",\n  )\n  .option(\n    \"-p, --path <dir>\",\n    \"Plugin directory containing manifest.json, which will be edited in place (default: .)\",\n  )\n  .action((opts) =>\n    runPluginAddResource(opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;;AAgBA,eAAe,qBAAqB,SAA2C;AAC7E,OAAM,kCAAkC;CAExC,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,YAAY,KAAK,QAAQ,KAAK,QAAQ,QAAQ,IAAI;CACxD,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,MAAM,CAAC;AAE3E,KAAI,CAAC,UAAU;AACb,UAAQ,MACN,wBAAwB,UAAU,gFACnC;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,SAAS,SAAS,QAAQ;AAC5B,UAAQ,MACN,gHAAgH,KAAK,SAAS,SAAS,KAAK,CAAC,IAC9I;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,eAAe,SAAS;CAE9B,IAAI;AACJ,KAAI;EACF,MAAM,MAAM,GAAG,aAAa,cAAc,QAAQ;EAClD,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,MAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,CAAC,OAAO,SAAS,CAAC,OAAO,UAAU;AACrC,WAAQ,MACN,8DACD;AACD,WAAQ,KAAK,EAAE;;AAEjB,aAAW;UACJ,KAAK;AACZ,UAAQ,MACN,0CACA,eAAe,QAAQ,IAAI,UAAU,IACtC;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,OAAO,MAAM,mBAAmB;AACtC,KAAI,CAAC,MAAM;AACT,SAAO,aAAa;AACpB,UAAQ,KAAK,EAAE;;CAGjB,MAAM,QAAQ,qBAAqB,KAAK,KAAK;CAC7C,MAAM,QAAQ;EACZ,MAAM,KAAK;EACX;EACA,aAAa,KAAK;EAClB,aAAa,KAAK,eAAe,gBAAgB,MAAM;EACvD,YAAY,KAAK;EACjB,QAAQ,KAAK;EACd;AAED,KAAI,KAAK,SACP,UAAS,UAAU,SAAS,KAAK,MAAM;KAEvC,UAAS,UAAU,SAAS,KAAK,MAAM;AAGzC,IAAG,cAAc,cAAc,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,IAAI;AAExE,OAAM,kBAAkB;AACxB,SAAQ,IACN,WAAW,MAAM,MAAM,KAAK,WAAW,aAAa,WAAW,MAAM,KAAK,SAAS,KAAK,aAAa,GACtG;;AAGH,MAAa,2BAA2B,IAAI,QAAQ,eAAe,CAChE,YACC,8GACD,CACA,OACC,oBACA,wFACD,CACA,QAAQ,SACP,qBAAqB,KAAK,CAAC,OAAO,QAAQ;AACxC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}

package/dist/cli/commands/plugin/create/scaffold.js

@@ -72,7 +72,7 @@ function rollback(written, targetDir) {
 }
 /**
 * Scaffold plugin files into targetDir. Pure: no interactive I/O.
-* Writes manifest.json, manifest.ts, {name}.ts, index.ts; for isolated also package.json, tsconfig.json, README.md.
+* Writes manifest.json, {name}.ts, index.ts; for isolated also package.json, tsconfig.json, README.md.
 * On failure, rolls back any files already written.
 */
 function scaffoldPlugin(targetDir, answers, options) {
@@ -83,24 +83,18 @@ function scaffoldPlugin(targetDir, answers, options) {
 		const className = toPascalCase(answers.name);
 		const exportName = toCamelCase(answers.name);
 		writeTracked(path.join(targetDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, written);
-		writeTracked(path.join(targetDir, "manifest.ts"), `import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import type { PluginManifest } from "@databricks/appkit";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-export const manifest = JSON.parse(
-  readFileSync(join(__dirname, "manifest.json"), "utf-8"),
-) as PluginManifest;
-`, written);
-		const pluginTs = `import { Plugin, toPlugin, type IAppRouter } from "@databricks/appkit";
-import { manifest } from "./manifest.js";
+		const pluginTs = `import {
+  Plugin,
+  toPlugin,
+  type IAppRouter,
+  type PluginManifest,
+} from "@databricks/appkit";
+import manifest from "./manifest.json";
 
 export class ${className} extends Plugin {
   name = "${answers.name}";
 
-  static manifest = manifest;
+  static manifest = manifest as PluginManifest;
 
   injectRoutes(router: IAppRouter): void {
     // Add your routes here, e.g.:
@@ -122,7 +116,7 @@ export const ${exportName} = toPlugin<
 >(${className}, "${answers.name}");
 `;
 		writeTracked(path.join(targetDir, `${answers.name}.ts`), pluginTs, written);
-		const indexTs = `export { ${className}, ${exportName} } from "./${answers.name}.js";
+		const indexTs = `export { ${className}, ${exportName} } from "./${answers.name}";
 `;
 		writeTracked(path.join(targetDir, "index.ts"), indexTs, written);
 		if (options.isolated) {

package/dist/cli/commands/plugin/create/scaffold.js.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.js","names":[],"sources":["../../../../../src/cli/commands/plugin/create/scaffold.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { humanizeResourceType, MANIFEST_SCHEMA_ID } from \"./resource-defaults\";\nimport type { CreateAnswers } from \"./types\";\n\n/** Convert kebab-name to PascalCase (e.g. my-plugin -> MyPlugin). */\nfunction toPascalCase(name: string): string {\n  return name\n    .split(\"-\")\n    .map((s) => s.charAt(0).toUpperCase() + s.slice(1).toLowerCase())\n    .join(\"\");\n}\n\n/** Convert kebab-name to camelCase (e.g. my-plugin -> myPlugin). */\nfunction toCamelCase(name: string): string {\n  const pascal = toPascalCase(name);\n  return pascal.charAt(0).toLowerCase() + pascal.slice(1);\n}\n\n/** Build manifest.json resources from selected resources. */\nfunction buildManifestResources(answers: CreateAnswers) {\n  const required: unknown[] = [];\n  const optional: unknown[] = [];\n\n  for (const r of answers.resources) {\n    const alias = humanizeResourceType(r.type);\n    const entry = {\n      type: r.type,\n      alias,\n      resourceKey: r.resourceKey,\n      description: r.description || `Required for ${alias} functionality.`,\n      permission: r.permission,\n      fields: r.fields,\n    };\n    if (r.required) {\n      required.push(entry);\n    } else {\n      optional.push(entry);\n    }\n  }\n\n  return { required, optional };\n}\n\n/** Build full manifest object for manifest.json. */\nfunction buildManifest(answers: CreateAnswers): Record<string, unknown> {\n  const { required, optional } = buildManifestResources(answers);\n  const manifest: Record<string, unknown> = {\n    $schema: MANIFEST_SCHEMA_ID,\n    name: answers.name,\n    displayName: answers.displayName,\n    description: answers.description,\n    resources: { required, optional },\n  };\n  if (answers.author) manifest.author = answers.author;\n  manifest.version = answers.version || \"0.1.0\";\n  if (answers.license) manifest.license = answers.license;\n  return manifest;\n}\n\n/** Resolve absolute target directory from cwd and answers. */\nexport function resolveTargetDir(cwd: string, answers: CreateAnswers): string {\n  return path.resolve(cwd, answers.targetPath);\n}\n\n/** Track files written during scaffolding for rollback on failure. */\nfunction writeTracked(\n  filePath: string,\n  content: string,\n  written: string[],\n): void {\n  fs.writeFileSync(filePath, content);\n  written.push(filePath);\n}\n\n/** Remove files written during a failed scaffold attempt. */\nfunction rollback(written: string[], targetDir: string): void {\n  for (const filePath of written.reverse()) {\n    try {\n      fs.unlinkSync(filePath);\n    } catch {\n      // best-effort cleanup\n    }\n  }\n  try {\n    const remaining = fs.readdirSync(targetDir);\n    if (remaining.length === 0) fs.rmdirSync(targetDir);\n  } catch {\n    // directory may not be empty or may have been removed already\n  }\n}\n\n/**\n * Scaffold plugin files into targetDir. Pure: no interactive I/O.\n * Writes manifest.json, manifest.ts, {name}.ts, index.ts; for isolated also package.json, tsconfig.json, README.md.\n * On failure, rolls back any files already written.\n */\nexport function scaffoldPlugin(\n  targetDir: string,\n  answers: CreateAnswers,\n  options: { isolated: boolean },\n): void {\n  fs.mkdirSync(targetDir, { recursive: true });\n\n  const written: string[] = [];\n\n  try {\n    const manifest = buildManifest(answers);\n    const className = toPascalCase(answers.name);\n    const exportName = toCamelCase(answers.name);\n\n    writeTracked(\n      path.join(targetDir, \"manifest.json\"),\n      `${JSON.stringify(manifest, null, 2)}\\n`,\n      written,\n    );\n\n    const manifestTs = `import { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { PluginManifest } from \"@databricks/appkit\";\n\nconst __dirname = dirname(fileURLToPath(import.meta.url));\n\nexport const manifest = JSON.parse(\n  readFileSync(join(__dirname, \"manifest.json\"), \"utf-8\"),\n) as PluginManifest;\n`;\n\n    writeTracked(path.join(targetDir, \"manifest.ts\"), manifestTs, written);\n\n    const pluginTs = `import { Plugin, toPlugin, type IAppRouter } from \"@databricks/appkit\";\nimport { manifest } from \"./manifest.js\";\n\nexport class ${className} extends Plugin {\n  name = \"${answers.name}\";\n\n  static manifest = manifest;\n\n  injectRoutes(router: IAppRouter): void {\n    // Add your routes here, e.g.:\n    // this.route(router, {\n    //   name: \"example\",\n    //   method: \"get\",\n    //   path: \"/\",\n    //   handler: async (_req, res) => {\n    //     res.json({ message: \"Hello from ${answers.name}\" });\n    //   },\n    // });\n  }\n}\n\nexport const ${exportName} = toPlugin<\n  typeof ${className},\n  Record<string, never>,\n  \"${answers.name}\"\n>(${className}, \"${answers.name}\");\n`;\n\n    writeTracked(path.join(targetDir, `${answers.name}.ts`), pluginTs, written);\n\n    const indexTs = `export { ${className}, ${exportName} } from \"./${answers.name}.js\";\n`;\n\n    writeTracked(path.join(targetDir, \"index.ts\"), indexTs, written);\n\n    if (options.isolated) {\n      const packageName =\n        answers.name.includes(\"/\") || answers.name.startsWith(\"@\")\n          ? answers.name\n          : `appkit-plugin-${answers.name}`;\n\n      const packageJson = {\n        name: packageName,\n        version: answers.version || \"0.1.0\",\n        type: \"module\",\n        main: \"./dist/index.js\",\n        types: \"./dist/index.d.ts\",\n        files: [\"dist\"],\n        scripts: {\n          build: \"tsc\",\n          typecheck: \"tsc --noEmit\",\n        },\n        peerDependencies: {\n          \"@databricks/appkit\": \">=0.5.0\",\n        },\n        devDependencies: {\n          typescript: \"^5.0.0\",\n        },\n      };\n\n      writeTracked(\n        path.join(targetDir, \"package.json\"),\n        `${JSON.stringify(packageJson, null, 2)}\\n`,\n        written,\n      );\n\n      const tsconfigJson = {\n        compilerOptions: {\n          target: \"ES2022\",\n          module: \"NodeNext\",\n          moduleResolution: \"NodeNext\",\n          outDir: \"dist\",\n          rootDir: \".\",\n          declaration: true,\n          strict: true,\n          skipLibCheck: true,\n        },\n        include: [\"*.ts\"],\n        exclude: [\"node_modules\", \"dist\"],\n      };\n\n      writeTracked(\n        path.join(targetDir, \"tsconfig.json\"),\n        `${JSON.stringify(tsconfigJson, null, 2)}\\n`,\n        written,\n      );\n\n      const readme = `# ${answers.displayName}\n\n${answers.description}\n\n## Installation\n\n\\`\\`\\`bash\npnpm add ${packageName} @databricks/appkit\n\\`\\`\\`\n\n## Usage\n\nRegister the plugin in your AppKit app:\n\n\\`\\`\\`ts\nimport { createApp } from \"@databricks/appkit\";\nimport { ${exportName} } from \"${packageName}\";\n\ncreateApp({\n  plugins: [\n    ${exportName}(),\n    // ... other plugins\n  ],\n}).then((app) => { /* ... */ });\n\\`\\`\\`\n`;\n\n      writeTracked(path.join(targetDir, \"README.md\"), readme, written);\n    }\n  } catch (err) {\n    rollback(written, targetDir);\n    throw err;\n  }\n}\n"],"mappings":";;;;;;AAMA,SAAS,aAAa,MAAsB;AAC1C,QAAO,KACJ,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,OAAO,EAAE,CAAC,aAAa,GAAG,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,CAChE,KAAK,GAAG;;;AAIb,SAAS,YAAY,MAAsB;CACzC,MAAM,SAAS,aAAa,KAAK;AACjC,QAAO,OAAO,OAAO,EAAE,CAAC,aAAa,GAAG,OAAO,MAAM,EAAE;;;AAIzD,SAAS,uBAAuB,SAAwB;CACtD,MAAM,WAAsB,EAAE;CAC9B,MAAM,WAAsB,EAAE;AAE9B,MAAK,MAAM,KAAK,QAAQ,WAAW;EACjC,MAAM,QAAQ,qBAAqB,EAAE,KAAK;EAC1C,MAAM,QAAQ;GACZ,MAAM,EAAE;GACR;GACA,aAAa,EAAE;GACf,aAAa,EAAE,eAAe,gBAAgB,MAAM;GACpD,YAAY,EAAE;GACd,QAAQ,EAAE;GACX;AACD,MAAI,EAAE,SACJ,UAAS,KAAK,MAAM;MAEpB,UAAS,KAAK,MAAM;;AAIxB,QAAO;EAAE;EAAU;EAAU;;;AAI/B,SAAS,cAAc,SAAiD;CACtE,MAAM,EAAE,UAAU,aAAa,uBAAuB,QAAQ;CAC9D,MAAM,WAAoC;EACxC,SAAS;EACT,MAAM,QAAQ;EACd,aAAa,QAAQ;EACrB,aAAa,QAAQ;EACrB,WAAW;GAAE;GAAU;GAAU;EAClC;AACD,KAAI,QAAQ,OAAQ,UAAS,SAAS,QAAQ;AAC9C,UAAS,UAAU,QAAQ,WAAW;AACtC,KAAI,QAAQ,QAAS,UAAS,UAAU,QAAQ;AAChD,QAAO;;;AAIT,SAAgB,iBAAiB,KAAa,SAAgC;AAC5E,QAAO,KAAK,QAAQ,KAAK,QAAQ,WAAW;;;AAI9C,SAAS,aACP,UACA,SACA,SACM;AACN,IAAG,cAAc,UAAU,QAAQ;AACnC,SAAQ,KAAK,SAAS;;;AAIxB,SAAS,SAAS,SAAmB,WAAyB;AAC5D,MAAK,MAAM,YAAY,QAAQ,SAAS,CACtC,KAAI;AACF,KAAG,WAAW,SAAS;SACjB;AAIV,KAAI;AAEF,MADkB,GAAG,YAAY,UAAU,CAC7B,WAAW,EAAG,IAAG,UAAU,UAAU;SAC7C;;;;;;;AAUV,SAAgB,eACd,WACA,SACA,SACM;AACN,IAAG,UAAU,WAAW,EAAE,WAAW,MAAM,CAAC;CAE5C,MAAM,UAAoB,EAAE;AAE5B,KAAI;EACF,MAAM,WAAW,cAAc,QAAQ;EACvC,MAAM,YAAY,aAAa,QAAQ,KAAK;EAC5C,MAAM,aAAa,YAAY,QAAQ,KAAK;AAE5C,eACE,KAAK,KAAK,WAAW,gBAAgB,EACrC,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,KACrC,QACD;AAcD,eAAa,KAAK,KAAK,WAAW,cAAc,EAZ7B;;;;;;;;;;GAY2C,QAAQ;EAEtE,MAAM,WAAW;;;eAGN,UAAU;YACb,QAAQ,KAAK;;;;;;;;;;;6CAWoB,QAAQ,KAAK;;;;;;eAM3C,WAAW;WACf,UAAU;;KAEhB,QAAQ,KAAK;IACd,UAAU,KAAK,QAAQ,KAAK;;AAG5B,eAAa,KAAK,KAAK,WAAW,GAAG,QAAQ,KAAK,KAAK,EAAE,UAAU,QAAQ;EAE3E,MAAM,UAAU,YAAY,UAAU,IAAI,WAAW,aAAa,QAAQ,KAAK;;AAG/E,eAAa,KAAK,KAAK,WAAW,WAAW,EAAE,SAAS,QAAQ;AAEhE,MAAI,QAAQ,UAAU;GACpB,MAAM,cACJ,QAAQ,KAAK,SAAS,IAAI,IAAI,QAAQ,KAAK,WAAW,IAAI,GACtD,QAAQ,OACR,iBAAiB,QAAQ;GAE/B,MAAM,cAAc;IAClB,MAAM;IACN,SAAS,QAAQ,WAAW;IAC5B,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO,CAAC,OAAO;IACf,SAAS;KACP,OAAO;KACP,WAAW;KACZ;IACD,kBAAkB,EAChB,sBAAsB,WACvB;IACD,iBAAiB,EACf,YAAY,UACb;IACF;AAED,gBACE,KAAK,KAAK,WAAW,eAAe,EACpC,GAAG,KAAK,UAAU,aAAa,MAAM,EAAE,CAAC,KACxC,QACD;AAiBD,gBACE,KAAK,KAAK,WAAW,gBAAgB,EACrC,GAAG,KAAK,UAjBW;IACnB,iBAAiB;KACf,QAAQ;KACR,QAAQ;KACR,kBAAkB;KAClB,QAAQ;KACR,SAAS;KACT,aAAa;KACb,QAAQ;KACR,cAAc;KACf;IACD,SAAS,CAAC,OAAO;IACjB,SAAS,CAAC,gBAAgB,OAAO;IAClC,EAIiC,MAAM,EAAE,CAAC,KACzC,QACD;GAED,MAAM,SAAS,KAAK,QAAQ,YAAY;;EAE5C,QAAQ,YAAY;;;;;WAKX,YAAY;;;;;;;;;WASZ,WAAW,WAAW,YAAY;;;;MAIvC,WAAW;;;;;;AAOX,gBAAa,KAAK,KAAK,WAAW,YAAY,EAAE,QAAQ,QAAQ;;UAE3D,KAAK;AACZ,WAAS,SAAS,UAAU;AAC5B,QAAM"}
+{"version":3,"file":"scaffold.js","names":[],"sources":["../../../../../src/cli/commands/plugin/create/scaffold.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { humanizeResourceType, MANIFEST_SCHEMA_ID } from \"./resource-defaults\";\nimport type { CreateAnswers } from \"./types\";\n\n/** Convert kebab-name to PascalCase (e.g. my-plugin -> MyPlugin). */\nfunction toPascalCase(name: string): string {\n  return name\n    .split(\"-\")\n    .map((s) => s.charAt(0).toUpperCase() + s.slice(1).toLowerCase())\n    .join(\"\");\n}\n\n/** Convert kebab-name to camelCase (e.g. my-plugin -> myPlugin). */\nfunction toCamelCase(name: string): string {\n  const pascal = toPascalCase(name);\n  return pascal.charAt(0).toLowerCase() + pascal.slice(1);\n}\n\n/** Build manifest.json resources from selected resources. */\nfunction buildManifestResources(answers: CreateAnswers) {\n  const required: unknown[] = [];\n  const optional: unknown[] = [];\n\n  for (const r of answers.resources) {\n    const alias = humanizeResourceType(r.type);\n    const entry = {\n      type: r.type,\n      alias,\n      resourceKey: r.resourceKey,\n      description: r.description || `Required for ${alias} functionality.`,\n      permission: r.permission,\n      fields: r.fields,\n    };\n    if (r.required) {\n      required.push(entry);\n    } else {\n      optional.push(entry);\n    }\n  }\n\n  return { required, optional };\n}\n\n/** Build full manifest object for manifest.json. */\nfunction buildManifest(answers: CreateAnswers): Record<string, unknown> {\n  const { required, optional } = buildManifestResources(answers);\n  const manifest: Record<string, unknown> = {\n    $schema: MANIFEST_SCHEMA_ID,\n    name: answers.name,\n    displayName: answers.displayName,\n    description: answers.description,\n    resources: { required, optional },\n  };\n  if (answers.author) manifest.author = answers.author;\n  manifest.version = answers.version || \"0.1.0\";\n  if (answers.license) manifest.license = answers.license;\n  return manifest;\n}\n\n/** Resolve absolute target directory from cwd and answers. */\nexport function resolveTargetDir(cwd: string, answers: CreateAnswers): string {\n  return path.resolve(cwd, answers.targetPath);\n}\n\n/** Track files written during scaffolding for rollback on failure. */\nfunction writeTracked(\n  filePath: string,\n  content: string,\n  written: string[],\n): void {\n  fs.writeFileSync(filePath, content);\n  written.push(filePath);\n}\n\n/** Remove files written during a failed scaffold attempt. */\nfunction rollback(written: string[], targetDir: string): void {\n  for (const filePath of written.reverse()) {\n    try {\n      fs.unlinkSync(filePath);\n    } catch {\n      // best-effort cleanup\n    }\n  }\n  try {\n    const remaining = fs.readdirSync(targetDir);\n    if (remaining.length === 0) fs.rmdirSync(targetDir);\n  } catch {\n    // directory may not be empty or may have been removed already\n  }\n}\n\n/**\n * Scaffold plugin files into targetDir. Pure: no interactive I/O.\n * Writes manifest.json, {name}.ts, index.ts; for isolated also package.json, tsconfig.json, README.md.\n * On failure, rolls back any files already written.\n */\nexport function scaffoldPlugin(\n  targetDir: string,\n  answers: CreateAnswers,\n  options: { isolated: boolean },\n): void {\n  fs.mkdirSync(targetDir, { recursive: true });\n\n  const written: string[] = [];\n\n  try {\n    const manifest = buildManifest(answers);\n    const className = toPascalCase(answers.name);\n    const exportName = toCamelCase(answers.name);\n\n    writeTracked(\n      path.join(targetDir, \"manifest.json\"),\n      `${JSON.stringify(manifest, null, 2)}\\n`,\n      written,\n    );\n\n    const pluginTs = `import {\n  Plugin,\n  toPlugin,\n  type IAppRouter,\n  type PluginManifest,\n} from \"@databricks/appkit\";\nimport manifest from \"./manifest.json\";\n\nexport class ${className} extends Plugin {\n  name = \"${answers.name}\";\n\n  static manifest = manifest as PluginManifest;\n\n  injectRoutes(router: IAppRouter): void {\n    // Add your routes here, e.g.:\n    // this.route(router, {\n    //   name: \"example\",\n    //   method: \"get\",\n    //   path: \"/\",\n    //   handler: async (_req, res) => {\n    //     res.json({ message: \"Hello from ${answers.name}\" });\n    //   },\n    // });\n  }\n}\n\nexport const ${exportName} = toPlugin<\n  typeof ${className},\n  Record<string, never>,\n  \"${answers.name}\"\n>(${className}, \"${answers.name}\");\n`;\n\n    writeTracked(path.join(targetDir, `${answers.name}.ts`), pluginTs, written);\n\n    const indexTs = `export { ${className}, ${exportName} } from \"./${answers.name}\";\n`;\n\n    writeTracked(path.join(targetDir, \"index.ts\"), indexTs, written);\n\n    if (options.isolated) {\n      const packageName =\n        answers.name.includes(\"/\") || answers.name.startsWith(\"@\")\n          ? answers.name\n          : `appkit-plugin-${answers.name}`;\n\n      const packageJson = {\n        name: packageName,\n        version: answers.version || \"0.1.0\",\n        type: \"module\",\n        main: \"./dist/index.js\",\n        types: \"./dist/index.d.ts\",\n        files: [\"dist\"],\n        scripts: {\n          build: \"tsc\",\n          typecheck: \"tsc --noEmit\",\n        },\n        peerDependencies: {\n          \"@databricks/appkit\": \">=0.5.0\",\n        },\n        devDependencies: {\n          typescript: \"^5.0.0\",\n        },\n      };\n\n      writeTracked(\n        path.join(targetDir, \"package.json\"),\n        `${JSON.stringify(packageJson, null, 2)}\\n`,\n        written,\n      );\n\n      const tsconfigJson = {\n        compilerOptions: {\n          target: \"ES2022\",\n          module: \"NodeNext\",\n          moduleResolution: \"NodeNext\",\n          outDir: \"dist\",\n          rootDir: \".\",\n          declaration: true,\n          strict: true,\n          skipLibCheck: true,\n        },\n        include: [\"*.ts\"],\n        exclude: [\"node_modules\", \"dist\"],\n      };\n\n      writeTracked(\n        path.join(targetDir, \"tsconfig.json\"),\n        `${JSON.stringify(tsconfigJson, null, 2)}\\n`,\n        written,\n      );\n\n      const readme = `# ${answers.displayName}\n\n${answers.description}\n\n## Installation\n\n\\`\\`\\`bash\npnpm add ${packageName} @databricks/appkit\n\\`\\`\\`\n\n## Usage\n\nRegister the plugin in your AppKit app:\n\n\\`\\`\\`ts\nimport { createApp } from \"@databricks/appkit\";\nimport { ${exportName} } from \"${packageName}\";\n\ncreateApp({\n  plugins: [\n    ${exportName}(),\n    // ... other plugins\n  ],\n}).then((app) => { /* ... */ });\n\\`\\`\\`\n`;\n\n      writeTracked(path.join(targetDir, \"README.md\"), readme, written);\n    }\n  } catch (err) {\n    rollback(written, targetDir);\n    throw err;\n  }\n}\n"],"mappings":";;;;;;AAMA,SAAS,aAAa,MAAsB;AAC1C,QAAO,KACJ,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,OAAO,EAAE,CAAC,aAAa,GAAG,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,CAChE,KAAK,GAAG;;;AAIb,SAAS,YAAY,MAAsB;CACzC,MAAM,SAAS,aAAa,KAAK;AACjC,QAAO,OAAO,OAAO,EAAE,CAAC,aAAa,GAAG,OAAO,MAAM,EAAE;;;AAIzD,SAAS,uBAAuB,SAAwB;CACtD,MAAM,WAAsB,EAAE;CAC9B,MAAM,WAAsB,EAAE;AAE9B,MAAK,MAAM,KAAK,QAAQ,WAAW;EACjC,MAAM,QAAQ,qBAAqB,EAAE,KAAK;EAC1C,MAAM,QAAQ;GACZ,MAAM,EAAE;GACR;GACA,aAAa,EAAE;GACf,aAAa,EAAE,eAAe,gBAAgB,MAAM;GACpD,YAAY,EAAE;GACd,QAAQ,EAAE;GACX;AACD,MAAI,EAAE,SACJ,UAAS,KAAK,MAAM;MAEpB,UAAS,KAAK,MAAM;;AAIxB,QAAO;EAAE;EAAU;EAAU;;;AAI/B,SAAS,cAAc,SAAiD;CACtE,MAAM,EAAE,UAAU,aAAa,uBAAuB,QAAQ;CAC9D,MAAM,WAAoC;EACxC,SAAS;EACT,MAAM,QAAQ;EACd,aAAa,QAAQ;EACrB,aAAa,QAAQ;EACrB,WAAW;GAAE;GAAU;GAAU;EAClC;AACD,KAAI,QAAQ,OAAQ,UAAS,SAAS,QAAQ;AAC9C,UAAS,UAAU,QAAQ,WAAW;AACtC,KAAI,QAAQ,QAAS,UAAS,UAAU,QAAQ;AAChD,QAAO;;;AAIT,SAAgB,iBAAiB,KAAa,SAAgC;AAC5E,QAAO,KAAK,QAAQ,KAAK,QAAQ,WAAW;;;AAI9C,SAAS,aACP,UACA,SACA,SACM;AACN,IAAG,cAAc,UAAU,QAAQ;AACnC,SAAQ,KAAK,SAAS;;;AAIxB,SAAS,SAAS,SAAmB,WAAyB;AAC5D,MAAK,MAAM,YAAY,QAAQ,SAAS,CACtC,KAAI;AACF,KAAG,WAAW,SAAS;SACjB;AAIV,KAAI;AAEF,MADkB,GAAG,YAAY,UAAU,CAC7B,WAAW,EAAG,IAAG,UAAU,UAAU;SAC7C;;;;;;;AAUV,SAAgB,eACd,WACA,SACA,SACM;AACN,IAAG,UAAU,WAAW,EAAE,WAAW,MAAM,CAAC;CAE5C,MAAM,UAAoB,EAAE;AAE5B,KAAI;EACF,MAAM,WAAW,cAAc,QAAQ;EACvC,MAAM,YAAY,aAAa,QAAQ,KAAK;EAC5C,MAAM,aAAa,YAAY,QAAQ,KAAK;AAE5C,eACE,KAAK,KAAK,WAAW,gBAAgB,EACrC,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,KACrC,QACD;EAED,MAAM,WAAW;;;;;;;;eAQN,UAAU;YACb,QAAQ,KAAK;;;;;;;;;;;6CAWoB,QAAQ,KAAK;;;;;;eAM3C,WAAW;WACf,UAAU;;KAEhB,QAAQ,KAAK;IACd,UAAU,KAAK,QAAQ,KAAK;;AAG5B,eAAa,KAAK,KAAK,WAAW,GAAG,QAAQ,KAAK,KAAK,EAAE,UAAU,QAAQ;EAE3E,MAAM,UAAU,YAAY,UAAU,IAAI,WAAW,aAAa,QAAQ,KAAK;;AAG/E,eAAa,KAAK,KAAK,WAAW,WAAW,EAAE,SAAS,QAAQ;AAEhE,MAAI,QAAQ,UAAU;GACpB,MAAM,cACJ,QAAQ,KAAK,SAAS,IAAI,IAAI,QAAQ,KAAK,WAAW,IAAI,GACtD,QAAQ,OACR,iBAAiB,QAAQ;GAE/B,MAAM,cAAc;IAClB,MAAM;IACN,SAAS,QAAQ,WAAW;IAC5B,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO,CAAC,OAAO;IACf,SAAS;KACP,OAAO;KACP,WAAW;KACZ;IACD,kBAAkB,EAChB,sBAAsB,WACvB;IACD,iBAAiB,EACf,YAAY,UACb;IACF;AAED,gBACE,KAAK,KAAK,WAAW,eAAe,EACpC,GAAG,KAAK,UAAU,aAAa,MAAM,EAAE,CAAC,KACxC,QACD;AAiBD,gBACE,KAAK,KAAK,WAAW,gBAAgB,EACrC,GAAG,KAAK,UAjBW;IACnB,iBAAiB;KACf,QAAQ;KACR,QAAQ;KACR,kBAAkB;KAClB,QAAQ;KACR,SAAS;KACT,aAAa;KACb,QAAQ;KACR,cAAc;KACf;IACD,SAAS,CAAC,OAAO;IACjB,SAAS,CAAC,gBAAgB,OAAO;IAClC,EAIiC,MAAM,EAAE,CAAC,KACzC,QACD;GAED,MAAM,SAAS,KAAK,QAAQ,YAAY;;EAE5C,QAAQ,YAAY;;;;;WAKX,YAAY;;;;;;;;;WASZ,WAAW,WAAW,YAAY;;;;MAIvC,WAAW;;;;;;AAOX,gBAAa,KAAK,KAAK,WAAW,YAAY,EAAE,QAAQ,QAAQ;;UAE3D,KAAK;AACZ,WAAS,SAAS,UAAU;AAC5B,QAAM"}

package/dist/cli/commands/plugin/list/list.js

@@ -1,10 +1,14 @@
+import { loadManifestFromFile, resolveManifestInDir } from "../manifest-resolve.js";
 import { validateManifest } from "../validate/validate-manifest.js";
+import { shouldAllowJsManifestForDir } from "../trusted-js-manifest.js";
 import fs from "node:fs";
 import path from "node:path";
 import { Command } from "commander";
 import process from "node:process";
 
 //#region src/cli/commands/plugin/list/list.ts
+/** Safety limit for recursive directory scanning to prevent runaway traversal. */
+const MAX_SCAN_DEPTH = 5;
 function listFromManifestFile(manifestPath) {
 	let raw;
 	try {
@@ -29,31 +33,40 @@ function listFromManifestFile(manifestPath) {
 		optional: Array.isArray(p.resources?.optional) ? p.resources.optional.length : 0
 	}));
 }
-function listFromDirectory(dirPath, cwd) {
-	const resolved = path.resolve(cwd, dirPath);
-	if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) return [];
-	const entries = fs.readdirSync(resolved, { withFileTypes: true });
-	const rows = [];
+async function collectPluginsRecursive(dir, cwd, rows, allowJsManifest, depth = 0) {
+	if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory() || depth >= MAX_SCAN_DEPTH) return;
+	const entries = fs.readdirSync(dir, { withFileTypes: true });
 	for (const entry of entries) {
 		if (!entry.isDirectory()) continue;
-		const manifestPath = path.join(resolved, entry.name, "manifest.json");
-		if (!fs.existsSync(manifestPath)) continue;
-		try {
-			const raw = fs.readFileSync(manifestPath, "utf-8");
-			const result = validateManifest(JSON.parse(raw));
-			const manifest = result.valid ? result.manifest : null;
-			if (!manifest) continue;
-			const relPath = path.relative(cwd, path.dirname(manifestPath));
-			const packagePath = relPath.startsWith(".") ? relPath : `./${relPath}`;
-			rows.push({
-				name: manifest.name,
-				displayName: manifest.displayName ?? manifest.name,
-				package: packagePath,
-				required: Array.isArray(manifest.resources?.required) ? manifest.resources.required.length : 0,
-				optional: Array.isArray(manifest.resources?.optional) ? manifest.resources.optional.length : 0
-			});
-		} catch {}
+		const childPath = path.join(dir, entry.name);
+		const allowJsForChild = allowJsManifest || shouldAllowJsManifestForDir(childPath);
+		const resolvedManifest = resolveManifestInDir(childPath, { allowJsManifest: allowJsForChild });
+		if (resolvedManifest) {
+			try {
+				const result = validateManifest(await loadManifestFromFile(resolvedManifest.path, resolvedManifest.type, { allowJsManifest: allowJsForChild }));
+				const manifest = result.valid ? result.manifest : null;
+				if (manifest) {
+					const relPath = path.relative(cwd, path.dirname(resolvedManifest.path));
+					const packagePath = relPath.startsWith(".") ? relPath : `./${relPath}`;
+					rows.push({
+						name: manifest.name,
+						displayName: manifest.displayName ?? manifest.name,
+						package: packagePath,
+						required: Array.isArray(manifest.resources?.required) ? manifest.resources.required.length : 0,
+						optional: Array.isArray(manifest.resources?.optional) ? manifest.resources.optional.length : 0
+					});
+				}
+			} catch {}
+			continue;
+		}
+		await collectPluginsRecursive(childPath, cwd, rows, allowJsManifest, depth + 1);
 	}
+}
+async function listFromDirectory(dirPath, cwd, allowJsManifest = false) {
+	const resolved = path.resolve(cwd, dirPath);
+	if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) return [];
+	const rows = [];
+	await collectPluginsRecursive(resolved, cwd, rows, allowJsManifest);
 	return rows;
 }
 function printTable(rows) {
@@ -81,13 +94,15 @@ function printTable(rows) {
 		String(r.optional).padStart(3)
 	].join("  "));
 }
-function runPluginList(options) {
+async function runPluginList(options) {
 	const cwd = process.cwd();
+	const allowJsManifest = Boolean(options.allowJsManifest);
+	if (allowJsManifest) console.warn("Warning: --allow-js-manifest executes manifest.js/manifest.cjs files. Only use with trusted code.");
 	let rows;
 	if (options.dir !== void 0) {
-		rows = listFromDirectory(options.dir, cwd);
+		rows = await listFromDirectory(options.dir, cwd, allowJsManifest);
 		if (rows.length === 0 && options.dir) {
-			console.error(`No plugin directories with manifest.json found in ${options.dir}`);
+			console.error(`No plugin directories with ${allowJsManifest ? "manifest.json or manifest.js" : "manifest.json"} found in ${options.dir}`);
 			process.exit(1);
 		}
 	} else {
@@ -106,7 +121,10 @@ function runPluginList(options) {
 	if (options.json) console.log(JSON.stringify(rows, null, 2));
 	else printTable(rows);
 }
-const pluginListCommand = new Command("list").description("List plugins from appkit.plugins.json or a directory").option("-m, --manifest <path>", "Path to appkit.plugins.json", "appkit.plugins.json").option("-d, --dir <path>", "Scan directory for plugin folders (each with manifest.json)").option("--json", "Output as JSON").action(runPluginList);
+const pluginListCommand = new Command("list").description("List plugins from appkit.plugins.json or a directory").option("-m, --manifest <path>", "Path to appkit.plugins.json", "appkit.plugins.json").option("-d, --dir <path>", "Scan directory recursively for plugin folders (manifest.json by default)").option("--allow-js-manifest", "Allow reading manifest.js/manifest.cjs (executes code; use only with trusted plugins)").option("--json", "Output as JSON").action((opts) => runPluginList(opts).catch((err) => {
+	console.error(err);
+	process.exit(1);
+}));
 
 //#endregion
 export { pluginListCommand };

package/dist/cli/commands/plugin/list/list.js.map

@@ -1 +1 @@
-{"version":3,"file":"list.js","names":[],"sources":["../../../../../src/cli/commands/plugin/list/list.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport process from \"node:process\";\nimport { Command } from \"commander\";\nimport { validateManifest } from \"../validate/validate-manifest\";\n\nexport interface PluginRow {\n  name: string;\n  displayName: string;\n  package: string;\n  required: number;\n  optional: number;\n}\n\nexport function listFromManifestFile(manifestPath: string): PluginRow[] {\n  let raw: string;\n  try {\n    raw = fs.readFileSync(manifestPath, \"utf-8\");\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`Failed to read manifest file ${manifestPath}: ${msg}`);\n  }\n\n  let data: {\n    plugins?: Record<\n      string,\n      {\n        name: string;\n        displayName: string;\n        package: string;\n        resources: { required: unknown[]; optional: unknown[] };\n      }\n    >;\n  };\n  try {\n    data = JSON.parse(raw) as typeof data;\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`Failed to parse manifest file ${manifestPath}: ${msg}`);\n  }\n\n  const plugins = data.plugins ?? {};\n  return Object.values(plugins).map((p) => ({\n    name: p.name,\n    displayName: p.displayName ?? p.name,\n    package: p.package ?? \"\",\n    required: Array.isArray(p.resources?.required)\n      ? p.resources.required.length\n      : 0,\n    optional: Array.isArray(p.resources?.optional)\n      ? p.resources.optional.length\n      : 0,\n  }));\n}\n\nexport function listFromDirectory(dirPath: string, cwd: string): PluginRow[] {\n  const resolved = path.resolve(cwd, dirPath);\n  if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) {\n    return [];\n  }\n  const entries = fs.readdirSync(resolved, { withFileTypes: true });\n  const rows: PluginRow[] = [];\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n    const manifestPath = path.join(resolved, entry.name, \"manifest.json\");\n    if (!fs.existsSync(manifestPath)) continue;\n    try {\n      const raw = fs.readFileSync(manifestPath, \"utf-8\");\n      const obj = JSON.parse(raw);\n      const result = validateManifest(obj);\n      const manifest = result.valid ? result.manifest : null;\n      if (!manifest) continue;\n      const relPath = path.relative(cwd, path.dirname(manifestPath));\n      const packagePath = relPath.startsWith(\".\") ? relPath : `./${relPath}`;\n      rows.push({\n        name: manifest.name,\n        displayName: manifest.displayName ?? manifest.name,\n        package: packagePath,\n        required: Array.isArray(manifest.resources?.required)\n          ? manifest.resources.required.length\n          : 0,\n        optional: Array.isArray(manifest.resources?.optional)\n          ? manifest.resources.optional.length\n          : 0,\n      });\n    } catch {\n      // skip invalid manifests\n    }\n  }\n  return rows;\n}\n\nfunction printTable(rows: PluginRow[]): void {\n  if (rows.length === 0) {\n    console.log(\"No plugins found.\");\n    return;\n  }\n  const maxName = Math.max(4, ...rows.map((r) => r.name.length));\n  const maxDisplay = Math.max(10, ...rows.map((r) => r.displayName.length));\n  const maxPkg = Math.max(7, ...rows.map((r) => r.package.length));\n  const header = [\n    \"NAME\".padEnd(maxName),\n    \"DISPLAY NAME\".padEnd(maxDisplay),\n    \"PACKAGE / PATH\".padEnd(maxPkg),\n    \"REQ\",\n    \"OPT\",\n  ].join(\"  \");\n  console.log(header);\n  console.log(\"-\".repeat(header.length));\n  for (const r of rows) {\n    console.log(\n      [\n        r.name.padEnd(maxName),\n        r.displayName.padEnd(maxDisplay),\n        r.package.padEnd(maxPkg),\n        String(r.required).padStart(3),\n        String(r.optional).padStart(3),\n      ].join(\"  \"),\n    );\n  }\n}\n\nfunction runPluginList(options: {\n  manifest?: string;\n  dir?: string;\n  json?: boolean;\n}): void {\n  const cwd = process.cwd();\n  let rows: PluginRow[];\n\n  if (options.dir !== undefined) {\n    rows = listFromDirectory(options.dir, cwd);\n    if (rows.length === 0 && options.dir) {\n      console.error(\n        `No plugin directories with manifest.json found in ${options.dir}`,\n      );\n      process.exit(1);\n    }\n  } else {\n    const manifestPath = path.resolve(\n      cwd,\n      options.manifest ?? \"appkit.plugins.json\",\n    );\n    if (!fs.existsSync(manifestPath)) {\n      console.error(`Manifest not found: ${manifestPath}`);\n      process.exit(1);\n    }\n    try {\n      rows = listFromManifestFile(manifestPath);\n    } catch (err) {\n      console.error(err instanceof Error ? err.message : String(err));\n      process.exit(1);\n    }\n  }\n\n  if (options.json) {\n    console.log(JSON.stringify(rows, null, 2));\n  } else {\n    printTable(rows);\n  }\n}\n\nexport const pluginListCommand = new Command(\"list\")\n  .description(\"List plugins from appkit.plugins.json or a directory\")\n  .option(\n    \"-m, --manifest <path>\",\n    \"Path to appkit.plugins.json\",\n    \"appkit.plugins.json\",\n  )\n  .option(\n    \"-d, --dir <path>\",\n    \"Scan directory for plugin folders (each with manifest.json)\",\n  )\n  .option(\"--json\", \"Output as JSON\")\n  .action(runPluginList);\n"],"mappings":";;;;;;;AAcA,SAAgB,qBAAqB,cAAmC;CACtE,IAAI;AACJ,KAAI;AACF,QAAM,GAAG,aAAa,cAAc,QAAQ;UACrC,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,gCAAgC,aAAa,IAAI,MAAM;;CAGzE,IAAI;AAWJ,KAAI;AACF,SAAO,KAAK,MAAM,IAAI;UACf,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,iCAAiC,aAAa,IAAI,MAAM;;CAG1E,MAAM,UAAU,KAAK,WAAW,EAAE;AAClC,QAAO,OAAO,OAAO,QAAQ,CAAC,KAAK,OAAO;EACxC,MAAM,EAAE;EACR,aAAa,EAAE,eAAe,EAAE;EAChC,SAAS,EAAE,WAAW;EACtB,UAAU,MAAM,QAAQ,EAAE,WAAW,SAAS,GAC1C,EAAE,UAAU,SAAS,SACrB;EACJ,UAAU,MAAM,QAAQ,EAAE,WAAW,SAAS,GAC1C,EAAE,UAAU,SAAS,SACrB;EACL,EAAE;;AAGL,SAAgB,kBAAkB,SAAiB,KAA0B;CAC3E,MAAM,WAAW,KAAK,QAAQ,KAAK,QAAQ;AAC3C,KAAI,CAAC,GAAG,WAAW,SAAS,IAAI,CAAC,GAAG,SAAS,SAAS,CAAC,aAAa,CAClE,QAAO,EAAE;CAEX,MAAM,UAAU,GAAG,YAAY,UAAU,EAAE,eAAe,MAAM,CAAC;CACjE,MAAM,OAAoB,EAAE;AAC5B,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAC1B,MAAM,eAAe,KAAK,KAAK,UAAU,MAAM,MAAM,gBAAgB;AACrE,MAAI,CAAC,GAAG,WAAW,aAAa,CAAE;AAClC,MAAI;GACF,MAAM,MAAM,GAAG,aAAa,cAAc,QAAQ;GAElD,MAAM,SAAS,iBADH,KAAK,MAAM,IAAI,CACS;GACpC,MAAM,WAAW,OAAO,QAAQ,OAAO,WAAW;AAClD,OAAI,CAAC,SAAU;GACf,MAAM,UAAU,KAAK,SAAS,KAAK,KAAK,QAAQ,aAAa,CAAC;GAC9D,MAAM,cAAc,QAAQ,WAAW,IAAI,GAAG,UAAU,KAAK;AAC7D,QAAK,KAAK;IACR,MAAM,SAAS;IACf,aAAa,SAAS,eAAe,SAAS;IAC9C,SAAS;IACT,UAAU,MAAM,QAAQ,SAAS,WAAW,SAAS,GACjD,SAAS,UAAU,SAAS,SAC5B;IACJ,UAAU,MAAM,QAAQ,SAAS,WAAW,SAAS,GACjD,SAAS,UAAU,SAAS,SAC5B;IACL,CAAC;UACI;;AAIV,QAAO;;AAGT,SAAS,WAAW,MAAyB;AAC3C,KAAI,KAAK,WAAW,GAAG;AACrB,UAAQ,IAAI,oBAAoB;AAChC;;CAEF,MAAM,UAAU,KAAK,IAAI,GAAG,GAAG,KAAK,KAAK,MAAM,EAAE,KAAK,OAAO,CAAC;CAC9D,MAAM,aAAa,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,MAAM,EAAE,YAAY,OAAO,CAAC;CACzE,MAAM,SAAS,KAAK,IAAI,GAAG,GAAG,KAAK,KAAK,MAAM,EAAE,QAAQ,OAAO,CAAC;CAChE,MAAM,SAAS;EACb,OAAO,OAAO,QAAQ;EACtB,eAAe,OAAO,WAAW;EACjC,iBAAiB,OAAO,OAAO;EAC/B;EACA;EACD,CAAC,KAAK,KAAK;AACZ,SAAQ,IAAI,OAAO;AACnB,SAAQ,IAAI,IAAI,OAAO,OAAO,OAAO,CAAC;AACtC,MAAK,MAAM,KAAK,KACd,SAAQ,IACN;EACE,EAAE,KAAK,OAAO,QAAQ;EACtB,EAAE,YAAY,OAAO,WAAW;EAChC,EAAE,QAAQ,OAAO,OAAO;EACxB,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE;EAC9B,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE;EAC/B,CAAC,KAAK,KAAK,CACb;;AAIL,SAAS,cAAc,SAId;CACP,MAAM,MAAM,QAAQ,KAAK;CACzB,IAAI;AAEJ,KAAI,QAAQ,QAAQ,QAAW;AAC7B,SAAO,kBAAkB,QAAQ,KAAK,IAAI;AAC1C,MAAI,KAAK,WAAW,KAAK,QAAQ,KAAK;AACpC,WAAQ,MACN,qDAAqD,QAAQ,MAC9D;AACD,WAAQ,KAAK,EAAE;;QAEZ;EACL,MAAM,eAAe,KAAK,QACxB,KACA,QAAQ,YAAY,sBACrB;AACD,MAAI,CAAC,GAAG,WAAW,aAAa,EAAE;AAChC,WAAQ,MAAM,uBAAuB,eAAe;AACpD,WAAQ,KAAK,EAAE;;AAEjB,MAAI;AACF,UAAO,qBAAqB,aAAa;WAClC,KAAK;AACZ,WAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AAC/D,WAAQ,KAAK,EAAE;;;AAInB,KAAI,QAAQ,KACV,SAAQ,IAAI,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;KAE1C,YAAW,KAAK;;AAIpB,MAAa,oBAAoB,IAAI,QAAQ,OAAO,CACjD,YAAY,uDAAuD,CACnE,OACC,yBACA,+BACA,sBACD,CACA,OACC,oBACA,8DACD,CACA,OAAO,UAAU,iBAAiB,CAClC,OAAO,cAAc"}
+{"version":3,"file":"list.js","names":[],"sources":["../../../../../src/cli/commands/plugin/list/list.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport process from \"node:process\";\nimport { Command } from \"commander\";\nimport {\n  loadManifestFromFile,\n  resolveManifestInDir,\n} from \"../manifest-resolve\";\nimport { shouldAllowJsManifestForDir } from \"../trusted-js-manifest\";\nimport { validateManifest } from \"../validate/validate-manifest\";\n\n/** Safety limit for recursive directory scanning to prevent runaway traversal. */\nconst MAX_SCAN_DEPTH = 5;\n\nexport interface PluginRow {\n  name: string;\n  displayName: string;\n  package: string;\n  required: number;\n  optional: number;\n}\n\nexport function listFromManifestFile(manifestPath: string): PluginRow[] {\n  let raw: string;\n  try {\n    raw = fs.readFileSync(manifestPath, \"utf-8\");\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`Failed to read manifest file ${manifestPath}: ${msg}`);\n  }\n\n  let data: {\n    plugins?: Record<\n      string,\n      {\n        name: string;\n        displayName: string;\n        package: string;\n        resources: { required: unknown[]; optional: unknown[] };\n      }\n    >;\n  };\n  try {\n    data = JSON.parse(raw) as typeof data;\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`Failed to parse manifest file ${manifestPath}: ${msg}`);\n  }\n\n  const plugins = data.plugins ?? {};\n  return Object.values(plugins).map((p) => ({\n    name: p.name,\n    displayName: p.displayName ?? p.name,\n    package: p.package ?? \"\",\n    required: Array.isArray(p.resources?.required)\n      ? p.resources.required.length\n      : 0,\n    optional: Array.isArray(p.resources?.optional)\n      ? p.resources.optional.length\n      : 0,\n  }));\n}\n\nasync function collectPluginsRecursive(\n  dir: string,\n  cwd: string,\n  rows: PluginRow[],\n  allowJsManifest: boolean,\n  depth = 0,\n): Promise<void> {\n  if (\n    !fs.existsSync(dir) ||\n    !fs.statSync(dir).isDirectory() ||\n    depth >= MAX_SCAN_DEPTH\n  )\n    return;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const childPath = path.join(dir, entry.name);\n    const allowJsForChild =\n      allowJsManifest || shouldAllowJsManifestForDir(childPath);\n    const resolvedManifest = resolveManifestInDir(childPath, {\n      allowJsManifest: allowJsForChild,\n    });\n\n    if (resolvedManifest) {\n      try {\n        const obj = await loadManifestFromFile(\n          resolvedManifest.path,\n          resolvedManifest.type,\n          { allowJsManifest: allowJsForChild },\n        );\n        const result = validateManifest(obj);\n        const manifest = result.valid ? result.manifest : null;\n        if (manifest) {\n          const relPath = path.relative(\n            cwd,\n            path.dirname(resolvedManifest.path),\n          );\n          const packagePath = relPath.startsWith(\".\")\n            ? relPath\n            : `./${relPath}`;\n          rows.push({\n            name: manifest.name,\n            displayName: manifest.displayName ?? manifest.name,\n            package: packagePath,\n            required: Array.isArray(manifest.resources?.required)\n              ? manifest.resources.required.length\n              : 0,\n            optional: Array.isArray(manifest.resources?.optional)\n              ? manifest.resources.optional.length\n              : 0,\n          });\n        }\n      } catch {\n        // skip invalid manifests\n      }\n      continue;\n    }\n\n    await collectPluginsRecursive(\n      childPath,\n      cwd,\n      rows,\n      allowJsManifest,\n      depth + 1,\n    );\n  }\n}\n\nexport async function listFromDirectory(\n  dirPath: string,\n  cwd: string,\n  allowJsManifest = false,\n): Promise<PluginRow[]> {\n  const resolved = path.resolve(cwd, dirPath);\n  if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) {\n    return [];\n  }\n  const rows: PluginRow[] = [];\n  await collectPluginsRecursive(resolved, cwd, rows, allowJsManifest);\n  return rows;\n}\n\nfunction printTable(rows: PluginRow[]): void {\n  if (rows.length === 0) {\n    console.log(\"No plugins found.\");\n    return;\n  }\n  const maxName = Math.max(4, ...rows.map((r) => r.name.length));\n  const maxDisplay = Math.max(10, ...rows.map((r) => r.displayName.length));\n  const maxPkg = Math.max(7, ...rows.map((r) => r.package.length));\n  const header = [\n    \"NAME\".padEnd(maxName),\n    \"DISPLAY NAME\".padEnd(maxDisplay),\n    \"PACKAGE / PATH\".padEnd(maxPkg),\n    \"REQ\",\n    \"OPT\",\n  ].join(\"  \");\n  console.log(header);\n  console.log(\"-\".repeat(header.length));\n  for (const r of rows) {\n    console.log(\n      [\n        r.name.padEnd(maxName),\n        r.displayName.padEnd(maxDisplay),\n        r.package.padEnd(maxPkg),\n        String(r.required).padStart(3),\n        String(r.optional).padStart(3),\n      ].join(\"  \"),\n    );\n  }\n}\n\nasync function runPluginList(options: {\n  manifest?: string;\n  dir?: string;\n  json?: boolean;\n  allowJsManifest?: boolean;\n}): Promise<void> {\n  const cwd = process.cwd();\n  const allowJsManifest = Boolean(options.allowJsManifest);\n  if (allowJsManifest) {\n    console.warn(\n      \"Warning: --allow-js-manifest executes manifest.js/manifest.cjs files. Only use with trusted code.\",\n    );\n  }\n  let rows: PluginRow[];\n\n  if (options.dir !== undefined) {\n    rows = await listFromDirectory(options.dir, cwd, allowJsManifest);\n    if (rows.length === 0 && options.dir) {\n      console.error(\n        `No plugin directories with ${allowJsManifest ? \"manifest.json or manifest.js\" : \"manifest.json\"} found in ${options.dir}`,\n      );\n      process.exit(1);\n    }\n  } else {\n    const manifestPath = path.resolve(\n      cwd,\n      options.manifest ?? \"appkit.plugins.json\",\n    );\n    if (!fs.existsSync(manifestPath)) {\n      console.error(`Manifest not found: ${manifestPath}`);\n      process.exit(1);\n    }\n    try {\n      rows = listFromManifestFile(manifestPath);\n    } catch (err) {\n      console.error(err instanceof Error ? err.message : String(err));\n      process.exit(1);\n    }\n  }\n\n  if (options.json) {\n    console.log(JSON.stringify(rows, null, 2));\n  } else {\n    printTable(rows);\n  }\n}\n\nexport const pluginListCommand = new Command(\"list\")\n  .description(\"List plugins from appkit.plugins.json or a directory\")\n  .option(\n    \"-m, --manifest <path>\",\n    \"Path to appkit.plugins.json\",\n    \"appkit.plugins.json\",\n  )\n  .option(\n    \"-d, --dir <path>\",\n    \"Scan directory recursively for plugin folders (manifest.json by default)\",\n  )\n  .option(\n    \"--allow-js-manifest\",\n    \"Allow reading manifest.js/manifest.cjs (executes code; use only with trusted plugins)\",\n  )\n  .option(\"--json\", \"Output as JSON\")\n  .action((opts) =>\n    runPluginList(opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;AAYA,MAAM,iBAAiB;AAUvB,SAAgB,qBAAqB,cAAmC;CACtE,IAAI;AACJ,KAAI;AACF,QAAM,GAAG,aAAa,cAAc,QAAQ;UACrC,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,gCAAgC,aAAa,IAAI,MAAM;;CAGzE,IAAI;AAWJ,KAAI;AACF,SAAO,KAAK,MAAM,IAAI;UACf,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,iCAAiC,aAAa,IAAI,MAAM;;CAG1E,MAAM,UAAU,KAAK,WAAW,EAAE;AAClC,QAAO,OAAO,OAAO,QAAQ,CAAC,KAAK,OAAO;EACxC,MAAM,EAAE;EACR,aAAa,EAAE,eAAe,EAAE;EAChC,SAAS,EAAE,WAAW;EACtB,UAAU,MAAM,QAAQ,EAAE,WAAW,SAAS,GAC1C,EAAE,UAAU,SAAS,SACrB;EACJ,UAAU,MAAM,QAAQ,EAAE,WAAW,SAAS,GAC1C,EAAE,UAAU,SAAS,SACrB;EACL,EAAE;;AAGL,eAAe,wBACb,KACA,KACA,MACA,iBACA,QAAQ,GACO;AACf,KACE,CAAC,GAAG,WAAW,IAAI,IACnB,CAAC,GAAG,SAAS,IAAI,CAAC,aAAa,IAC/B,SAAS,eAET;CAEF,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,kBACJ,mBAAmB,4BAA4B,UAAU;EAC3D,MAAM,mBAAmB,qBAAqB,WAAW,EACvD,iBAAiB,iBAClB,CAAC;AAEF,MAAI,kBAAkB;AACpB,OAAI;IAMF,MAAM,SAAS,iBALH,MAAM,qBAChB,iBAAiB,MACjB,iBAAiB,MACjB,EAAE,iBAAiB,iBAAiB,CACrC,CACmC;IACpC,MAAM,WAAW,OAAO,QAAQ,OAAO,WAAW;AAClD,QAAI,UAAU;KACZ,MAAM,UAAU,KAAK,SACnB,KACA,KAAK,QAAQ,iBAAiB,KAAK,CACpC;KACD,MAAM,cAAc,QAAQ,WAAW,IAAI,GACvC,UACA,KAAK;AACT,UAAK,KAAK;MACR,MAAM,SAAS;MACf,aAAa,SAAS,eAAe,SAAS;MAC9C,SAAS;MACT,UAAU,MAAM,QAAQ,SAAS,WAAW,SAAS,GACjD,SAAS,UAAU,SAAS,SAC5B;MACJ,UAAU,MAAM,QAAQ,SAAS,WAAW,SAAS,GACjD,SAAS,UAAU,SAAS,SAC5B;MACL,CAAC;;WAEE;AAGR;;AAGF,QAAM,wBACJ,WACA,KACA,MACA,iBACA,QAAQ,EACT;;;AAIL,eAAsB,kBACpB,SACA,KACA,kBAAkB,OACI;CACtB,MAAM,WAAW,KAAK,QAAQ,KAAK,QAAQ;AAC3C,KAAI,CAAC,GAAG,WAAW,SAAS,IAAI,CAAC,GAAG,SAAS,SAAS,CAAC,aAAa,CAClE,QAAO,EAAE;CAEX,MAAM,OAAoB,EAAE;AAC5B,OAAM,wBAAwB,UAAU,KAAK,MAAM,gBAAgB;AACnE,QAAO;;AAGT,SAAS,WAAW,MAAyB;AAC3C,KAAI,KAAK,WAAW,GAAG;AACrB,UAAQ,IAAI,oBAAoB;AAChC;;CAEF,MAAM,UAAU,KAAK,IAAI,GAAG,GAAG,KAAK,KAAK,MAAM,EAAE,KAAK,OAAO,CAAC;CAC9D,MAAM,aAAa,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,MAAM,EAAE,YAAY,OAAO,CAAC;CACzE,MAAM,SAAS,KAAK,IAAI,GAAG,GAAG,KAAK,KAAK,MAAM,EAAE,QAAQ,OAAO,CAAC;CAChE,MAAM,SAAS;EACb,OAAO,OAAO,QAAQ;EACtB,eAAe,OAAO,WAAW;EACjC,iBAAiB,OAAO,OAAO;EAC/B;EACA;EACD,CAAC,KAAK,KAAK;AACZ,SAAQ,IAAI,OAAO;AACnB,SAAQ,IAAI,IAAI,OAAO,OAAO,OAAO,CAAC;AACtC,MAAK,MAAM,KAAK,KACd,SAAQ,IACN;EACE,EAAE,KAAK,OAAO,QAAQ;EACtB,EAAE,YAAY,OAAO,WAAW;EAChC,EAAE,QAAQ,OAAO,OAAO;EACxB,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE;EAC9B,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE;EAC/B,CAAC,KAAK,KAAK,CACb;;AAIL,eAAe,cAAc,SAKX;CAChB,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,kBAAkB,QAAQ,QAAQ,gBAAgB;AACxD,KAAI,gBACF,SAAQ,KACN,oGACD;CAEH,IAAI;AAEJ,KAAI,QAAQ,QAAQ,QAAW;AAC7B,SAAO,MAAM,kBAAkB,QAAQ,KAAK,KAAK,gBAAgB;AACjE,MAAI,KAAK,WAAW,KAAK,QAAQ,KAAK;AACpC,WAAQ,MACN,8BAA8B,kBAAkB,iCAAiC,gBAAgB,YAAY,QAAQ,MACtH;AACD,WAAQ,KAAK,EAAE;;QAEZ;EACL,MAAM,eAAe,KAAK,QACxB,KACA,QAAQ,YAAY,sBACrB;AACD,MAAI,CAAC,GAAG,WAAW,aAAa,EAAE;AAChC,WAAQ,MAAM,uBAAuB,eAAe;AACpD,WAAQ,KAAK,EAAE;;AAEjB,MAAI;AACF,UAAO,qBAAqB,aAAa;WAClC,KAAK;AACZ,WAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AAC/D,WAAQ,KAAK,EAAE;;;AAInB,KAAI,QAAQ,KACV,SAAQ,IAAI,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;KAE1C,YAAW,KAAK;;AAIpB,MAAa,oBAAoB,IAAI,QAAQ,OAAO,CACjD,YAAY,uDAAuD,CACnE,OACC,yBACA,+BACA,sBACD,CACA,OACC,oBACA,2EACD,CACA,OACC,uBACA,wFACD,CACA,OAAO,UAAU,iBAAiB,CAClC,QAAQ,SACP,cAAc,KAAK,CAAC,OAAO,QAAQ;AACjC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}

package/dist/cli/commands/plugin/manifest-resolve.js

@@ -0,0 +1,57 @@
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+//#region src/cli/commands/plugin/manifest-resolve.ts
+const MANIFEST_JSON = "manifest.json";
+/** Resolution order for manifest files in a plugin directory. */
+const MANIFEST_CANDIDATES = [
+	MANIFEST_JSON,
+	"manifest.js",
+	"manifest.cjs"
+];
+/**
+* Resolve the manifest file in a plugin directory.
+* By default tries only manifest.json. If allowJsManifest=true, then also
+* tries manifest.js and manifest.cjs.
+*
+* @param pluginDir - Absolute path to the plugin directory
+* @returns The resolved file path and type, or null if none found
+*/
+function resolveManifestInDir(pluginDir, options = {}) {
+	const candidates = options.allowJsManifest ? MANIFEST_CANDIDATES : [MANIFEST_JSON];
+	for (const name of candidates) {
+		const manifestPath = path.join(pluginDir, name);
+		if (fs.existsSync(manifestPath) && fs.statSync(manifestPath).isFile()) return {
+			path: path.resolve(manifestPath),
+			type: name === MANIFEST_JSON ? "json" : "js"
+		};
+	}
+	return null;
+}
+/**
+* Load a manifest from a file (JSON or JS).
+* JSON: read and parse. JS: dynamic import (ESM) or require (CJS); the module must default-export the manifest object.
+*
+* @param manifestPath - Absolute path to manifest.json or manifest.js/.cjs
+* @param type - "json" or "js"
+* @returns The parsed manifest object (caller should validate with schema)
+*/
+async function loadManifestFromFile(manifestPath, type, options = {}) {
+	if (type === "json") {
+		const raw = fs.readFileSync(manifestPath, "utf-8");
+		return JSON.parse(raw);
+	}
+	if (!options.allowJsManifest) throw new Error(`Refusing to execute JS manifest at ${manifestPath}. Pass --allow-js-manifest to opt in.`);
+	if (path.extname(manifestPath).toLowerCase() === ".cjs") {
+		const mod = createRequire(import.meta.url)(manifestPath);
+		return mod?.default ?? mod;
+	}
+	const mod = await import(pathToFileURL(manifestPath).href);
+	return mod?.default ?? mod;
+}
+
+//#endregion
+export { loadManifestFromFile, resolveManifestInDir };
+//# sourceMappingURL=manifest-resolve.js.map

package/dist/cli/commands/plugin/manifest-resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-resolve.js","names":[],"sources":["../../../../src/cli/commands/plugin/manifest-resolve.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\n\nconst MANIFEST_JSON = \"manifest.json\";\nconst MANIFEST_JS = \"manifest.js\";\nconst MANIFEST_CJS = \"manifest.cjs\";\n\n/** Resolution order for manifest files in a plugin directory. */\nconst MANIFEST_CANDIDATES = [MANIFEST_JSON, MANIFEST_JS, MANIFEST_CJS] as const;\n\nexport type ManifestFileType = \"json\" | \"js\";\n\nexport interface ResolvedManifest {\n  /** Absolute path to the manifest file */\n  path: string;\n  /** How to load it: JSON (read + parse) or JS (dynamic import / require) */\n  type: ManifestFileType;\n}\n\nexport interface ManifestLoadOptions {\n  /**\n   * Allow loading JS manifests via import/require.\n   * Disabled by default to avoid executing untrusted code.\n   */\n  allowJsManifest?: boolean;\n}\n\n/**\n * Resolve the manifest file in a plugin directory.\n * By default tries only manifest.json. If allowJsManifest=true, then also\n * tries manifest.js and manifest.cjs.\n *\n * @param pluginDir - Absolute path to the plugin directory\n * @returns The resolved file path and type, or null if none found\n */\nexport function resolveManifestInDir(\n  pluginDir: string,\n  options: ManifestLoadOptions = {},\n): ResolvedManifest | null {\n  const candidates = options.allowJsManifest\n    ? MANIFEST_CANDIDATES\n    : [MANIFEST_JSON];\n  for (const name of candidates) {\n    const manifestPath = path.join(pluginDir, name);\n    if (fs.existsSync(manifestPath) && fs.statSync(manifestPath).isFile()) {\n      return {\n        path: path.resolve(manifestPath),\n        type: name === MANIFEST_JSON ? \"json\" : \"js\",\n      };\n    }\n  }\n  return null;\n}\n\n/**\n * Load a manifest from a file (JSON or JS).\n * JSON: read and parse. JS: dynamic import (ESM) or require (CJS); the module must default-export the manifest object.\n *\n * @param manifestPath - Absolute path to manifest.json or manifest.js/.cjs\n * @param type - \"json\" or \"js\"\n * @returns The parsed manifest object (caller should validate with schema)\n */\nexport async function loadManifestFromFile(\n  manifestPath: string,\n  type: ManifestFileType,\n  options: ManifestLoadOptions = {},\n): Promise<unknown> {\n  if (type === \"json\") {\n    const raw = fs.readFileSync(manifestPath, \"utf-8\");\n    return JSON.parse(raw) as unknown;\n  }\n\n  if (!options.allowJsManifest) {\n    throw new Error(\n      `Refusing to execute JS manifest at ${manifestPath}. Pass --allow-js-manifest to opt in.`,\n    );\n  }\n\n  const ext = path.extname(manifestPath).toLowerCase();\n  if (ext === \".cjs\") {\n    const require = createRequire(import.meta.url);\n    const mod = require(manifestPath);\n    return mod?.default ?? mod;\n  }\n\n  const url = pathToFileURL(manifestPath).href;\n  const mod = await import(url);\n  return mod?.default ?? mod;\n}\n"],"mappings":";;;;;;AAKA,MAAM,gBAAgB;;AAKtB,MAAM,sBAAsB;CAAC;CAJT;CACC;CAGiD;;;;;;;;;AA2BtE,SAAgB,qBACd,WACA,UAA+B,EAAE,EACR;CACzB,MAAM,aAAa,QAAQ,kBACvB,sBACA,CAAC,cAAc;AACnB,MAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,eAAe,KAAK,KAAK,WAAW,KAAK;AAC/C,MAAI,GAAG,WAAW,aAAa,IAAI,GAAG,SAAS,aAAa,CAAC,QAAQ,CACnE,QAAO;GACL,MAAM,KAAK,QAAQ,aAAa;GAChC,MAAM,SAAS,gBAAgB,SAAS;GACzC;;AAGL,QAAO;;;;;;;;;;AAWT,eAAsB,qBACpB,cACA,MACA,UAA+B,EAAE,EACf;AAClB,KAAI,SAAS,QAAQ;EACnB,MAAM,MAAM,GAAG,aAAa,cAAc,QAAQ;AAClD,SAAO,KAAK,MAAM,IAAI;;AAGxB,KAAI,CAAC,QAAQ,gBACX,OAAM,IAAI,MACR,sCAAsC,aAAa,uCACpD;AAIH,KADY,KAAK,QAAQ,aAAa,CAAC,aAAa,KACxC,QAAQ;EAElB,MAAM,MADU,cAAc,OAAO,KAAK,IAAI,CAC1B,aAAa;AACjC,SAAO,KAAK,WAAW;;CAIzB,MAAM,MAAM,MAAM,OADN,cAAc,aAAa,CAAC;AAExC,QAAO,KAAK,WAAW"}