@databricks/appkit-ui 0.15.0 → 0.17.0

package/dist/cli/commands/plugin/sync/sync.js

@@ -1,4 +1,6 @@
+import { loadManifestFromFile, resolveManifestInDir } from "../manifest-resolve.js";
 import { formatValidationErrors, validateManifest } from "../validate/validate-manifest.js";
+import { shouldAllowJsManifestForPackage } from "../trusted-js-manifest.js";
 import fs from "node:fs";
 import path from "node:path";
 import { Command } from "commander";
@@ -28,6 +30,25 @@ function validateManifestWithSchema(obj, sourcePath) {
 	if (result.errors?.length) console.warn(`Warning: Manifest at ${sourcePath} failed schema validation:\n${formatValidationErrors(result.errors, obj)}`);
 	return null;
 }
+/** Safety limit for recursive directory scanning to prevent runaway traversal. */
+const MAX_SCAN_DEPTH = 5;
+/**
+* Load and validate a resolved manifest, returning a TemplatePlugin entry or null.
+* Centralises the resolve → load → validate → build-entry pipeline used by
+* multiple discovery functions.
+*/
+async function loadPluginEntry(resolved, pkg, allowJsManifest) {
+	const manifest = validateManifestWithSchema(await loadManifestFromFile(resolved.path, resolved.type, { allowJsManifest }), resolved.path);
+	if (!manifest || manifest.hidden) return null;
+	return [manifest.name, {
+		name: manifest.name,
+		displayName: manifest.displayName,
+		description: manifest.description,
+		package: pkg,
+		resources: manifest.resources,
+		...manifest.onSetupMessage && { onSetupMessage: manifest.onSetupMessage }
+	}];
+}
 /**
 * Known packages that may contain AppKit plugins.
 * Always scanned for manifests, even if not imported in the server file.
@@ -39,6 +60,12 @@ const KNOWN_PLUGIN_PACKAGES = ["@databricks/appkit"];
 */
 const SERVER_FILE_CANDIDATES = ["server/server.ts", "server/index.ts"];
 /**
+* Conventional directories to scan for local plugin manifests when
+* --local-plugins-dir is not set. Checked in order; each that exists is scanned.
+* Plugins found here are added to the manifest even if not imported in the server.
+*/
+const CONVENTIONAL_LOCAL_PLUGIN_DIRS = ["plugins", "server"];
+/**
 * Find the server entry file by checking candidate paths in order.
 *
 * @param cwd - Current working directory
@@ -123,100 +150,85 @@ const RESOLVE_EXTENSIONS = [
 	".jsx"
 ];
 /**
-* Resolve a relative import source to the plugin directory containing a manifest.json.
-* Follows the convention that plugins live in their own directory with a manifest.json.
+* Resolve a relative import source to the plugin directory containing a manifest
+* (manifest.json or manifest.js). Follows the convention that plugins live in
+* their own directory with a manifest file.
 *
 * Resolution strategy:
-* 1. If the import path is a directory, look for manifest.json directly in it
-* 2. If the import path + extension is a file, look for manifest.json in its parent directory
-* 3. If the import path is a directory with an index file, look for manifest.json in that directory
+* 1. If the import path is a directory, look for manifest.json/js in it
+* 2. If the import path + extension is a file, look for manifest in its parent directory
+* 3. If the import path is a directory with an index file, look for manifest in that directory
 *
 * @param importSource - The relative import specifier (e.g. "./plugins/my-plugin")
 * @param serverFileDir - Absolute path to the directory containing the server file
-* @returns Absolute path to manifest.json, or null if not found
+* @returns Resolved manifest file path and type, or null if not found
 */
-function resolveLocalManifest(importSource, serverFileDir, projectRoot) {
+function resolveLocalManifest(importSource, serverFileDir, allowJsManifest, projectRoot) {
 	const resolved = path.resolve(serverFileDir, importSource);
-	if (!isWithinDirectory(resolved, projectRoot || serverFileDir)) {
+	const boundary = projectRoot || serverFileDir;
+	if (!isWithinDirectory(resolved, boundary)) {
 		console.warn(`Warning: Skipping import "${importSource}" — resolves outside the project directory`);
 		return null;
 	}
-	if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {
-		const manifestPath = path.join(resolved, "manifest.json");
-		if (fs.existsSync(manifestPath)) return manifestPath;
-	}
+	if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) return resolveManifestInDir(resolved, { allowJsManifest });
 	for (const ext of RESOLVE_EXTENSIONS) {
 		const filePath = `${resolved}${ext}`;
 		if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {
 			const dir = path.dirname(filePath);
-			const manifestPath = path.join(dir, "manifest.json");
-			if (fs.existsSync(manifestPath)) return manifestPath;
-			break;
+			if (!isWithinDirectory(dir, boundary)) return null;
+			return resolveManifestInDir(dir, { allowJsManifest });
 		}
 	}
 	for (const ext of RESOLVE_EXTENSIONS) {
 		const indexPath = path.join(resolved, `index${ext}`);
-		if (fs.existsSync(indexPath)) {
-			const manifestPath = path.join(resolved, "manifest.json");
-			if (fs.existsSync(manifestPath)) return manifestPath;
-			break;
-		}
+		if (fs.existsSync(indexPath)) return resolveManifestInDir(resolved, { allowJsManifest });
 	}
 	return null;
 }
 /**
 * Discover plugin manifests from local (relative) imports in the server file.
-* Resolves each relative import to a directory and looks for manifest.json.
+* Resolves each relative import to a directory and loads manifest.json or manifest.js.
 *
 * @param relativeImports - Parsed imports with relative sources (starting with . or /)
 * @param serverFileDir - Absolute path to the directory containing the server file
 * @param cwd - Current working directory (for computing relative paths in output)
 * @returns Map of plugin name to template plugin entry for local plugins
 */
-function discoverLocalPlugins(relativeImports, serverFileDir, cwd) {
+async function discoverLocalPlugins(relativeImports, serverFileDir, cwd, allowJsManifest) {
 	const plugins = {};
 	for (const imp of relativeImports) {
-		const manifestPath = resolveLocalManifest(imp.source, serverFileDir, cwd);
-		if (!manifestPath) continue;
+		const resolved = resolveLocalManifest(imp.source, serverFileDir, allowJsManifest, cwd);
+		if (!resolved) continue;
 		try {
-			const content = fs.readFileSync(manifestPath, "utf-8");
-			const manifest = validateManifestWithSchema(JSON.parse(content), manifestPath);
-			if (!manifest || manifest.hidden) continue;
-			const relativePath = path.relative(cwd, path.dirname(manifestPath));
-			plugins[manifest.name] = {
-				name: manifest.name,
-				displayName: manifest.displayName,
-				description: manifest.description,
-				package: `./${relativePath}`,
-				resources: manifest.resources,
-				...manifest.onSetupMessage && { onSetupMessage: manifest.onSetupMessage }
-			};
+			const entry = await loadPluginEntry(resolved, `./${path.relative(cwd, path.dirname(resolved.path))}`, allowJsManifest);
+			if (entry) plugins[entry[0]] = entry[1];
 		} catch (error) {
-			console.warn(`Warning: Failed to parse manifest at ${manifestPath}:`, error instanceof Error ? error.message : error);
+			console.warn(`Warning: Failed to load manifest at ${resolved.path}:`, error instanceof Error ? error.message : error);
 		}
 	}
 	return plugins;
 }
 /**
 * Discover plugin manifests from a package's dist folder.
-* Looks for manifest.json files in dist/plugins/{plugin-name}/ directories.
+* Looks for manifest.json or manifest.js in dist/plugins/{plugin-name}/ directories.
 *
 * @param packagePath - Path to the package in node_modules
 * @returns Array of plugin manifests found in the package
 */
-function discoverPluginManifests(packagePath) {
+async function discoverPluginManifests(packagePath, allowJsManifest) {
 	const pluginsDir = path.join(packagePath, "dist", "plugins");
 	const manifests = [];
 	if (!fs.existsSync(pluginsDir)) return manifests;
 	const entries = fs.readdirSync(pluginsDir, { withFileTypes: true });
-	for (const entry of entries) if (entry.isDirectory()) {
-		const manifestPath = path.join(pluginsDir, entry.name, "manifest.json");
-		if (fs.existsSync(manifestPath)) try {
-			const content = fs.readFileSync(manifestPath, "utf-8");
-			const manifest = validateManifestWithSchema(JSON.parse(content), manifestPath);
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		const resolved = resolveManifestInDir(path.join(pluginsDir, entry.name), { allowJsManifest });
+		if (!resolved) continue;
+		try {
+			const manifest = validateManifestWithSchema(await loadManifestFromFile(resolved.path, resolved.type, { allowJsManifest }), resolved.path);
 			if (manifest) manifests.push(manifest);
 		} catch (error) {
-			console.warn(`Warning: Failed to parse manifest at ${manifestPath}:`, error instanceof Error ? error.message : error);
+			console.warn(`Warning: Failed to load manifest at ${resolved.path}:`, error instanceof Error ? error.message : error);
 		}
 	}
 	return manifests;
@@ -228,12 +240,12 @@ function discoverPluginManifests(packagePath) {
 * @param packages - Set of npm package names to scan for plugin manifests
 * @returns Map of plugin name to template plugin entry
 */
-function scanForPlugins(cwd, packages) {
+async function scanForPlugins(cwd, packages, allowJsManifest) {
 	const plugins = {};
 	for (const packageName of packages) {
 		const packagePath = path.join(cwd, "node_modules", packageName);
 		if (!fs.existsSync(packagePath)) continue;
-		const manifests = discoverPluginManifests(packagePath);
+		const manifests = await discoverPluginManifests(packagePath, allowJsManifest || shouldAllowJsManifestForPackage(packageName));
 		for (const manifest of manifests) {
 			if (manifest.hidden) continue;
 			plugins[manifest.name] = {
@@ -249,35 +261,58 @@ function scanForPlugins(cwd, packages) {
 	return plugins;
 }
 /**
-* Scan a directory for plugin manifests in direct subdirectories.
-* Each subdirectory is expected to contain a manifest.json file.
+* Recursively scan a directory for plugin manifests. Any directory that
+* contains manifest.json or manifest.js is treated as a plugin root; we do
+* not descend into that directory's children. Used for local plugins discovery
+* so nested paths like server/plugins/category/my-plugin are found.
+*/
+async function scanPluginsDirRecursive(dir, cwd, allowJsManifest, depth = 0) {
+	const plugins = {};
+	if (!fs.existsSync(dir) || depth >= MAX_SCAN_DEPTH) return plugins;
+	const entries = fs.readdirSync(dir, { withFileTypes: true });
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		const pluginDir = path.join(dir, entry.name);
+		const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });
+		if (resolved) {
+			const pkg = `./${path.relative(cwd, pluginDir)}`;
+			try {
+				const pluginEntry = await loadPluginEntry(resolved, pkg, allowJsManifest);
+				if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];
+			} catch (error) {
+				console.warn(`Warning: Failed to load manifest at ${resolved.path}:`, error instanceof Error ? error.message : error);
+			}
+			continue;
+		}
+		Object.assign(plugins, await scanPluginsDirRecursive(pluginDir, cwd, allowJsManifest, depth + 1));
+	}
+	return plugins;
+}
+/**
+* Scan a directory for plugin manifests in direct subdirectories only.
+* Each subdirectory may contain manifest.json or manifest.js.
 * Used with --plugins-dir to discover plugins from source instead of node_modules.
 *
 * @param dir - Absolute path to the directory containing plugin subdirectories
-* @param packageName - Package name to assign to discovered plugins
+* @param packageName - Package name to assign to discovered plugins (used when cwd is not set)
+* @param cwd - When set, each plugin's package is set to ./<path from cwd to plugin subdir>, e.g. ./server/my-plugin
 * @returns Map of plugin name to template plugin entry
 */
-function scanPluginsDir(dir, packageName) {
+async function scanPluginsDir(dir, packageName, allowJsManifest, cwd) {
 	const plugins = {};
 	if (!fs.existsSync(dir)) return plugins;
 	const entries = fs.readdirSync(dir, { withFileTypes: true });
 	for (const entry of entries) {
 		if (!entry.isDirectory()) continue;
-		const manifestPath = path.join(dir, entry.name, "manifest.json");
-		if (!fs.existsSync(manifestPath)) continue;
+		const pluginDir = path.join(dir, entry.name);
+		const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });
+		if (!resolved) continue;
+		const pkg = cwd !== void 0 ? `./${path.relative(cwd, pluginDir)}` : packageName;
 		try {
-			const content = fs.readFileSync(manifestPath, "utf-8");
-			const manifest = validateManifestWithSchema(JSON.parse(content), manifestPath);
-			if (manifest && !manifest.hidden) plugins[manifest.name] = {
-				name: manifest.name,
-				displayName: manifest.displayName,
-				description: manifest.description,
-				package: packageName,
-				resources: manifest.resources,
-				...manifest.onSetupMessage && { onSetupMessage: manifest.onSetupMessage }
-			};
+			const pluginEntry = await loadPluginEntry(resolved, pkg, allowJsManifest);
+			if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];
 		} catch (error) {
-			console.warn(`Warning: Failed to parse manifest at ${manifestPath}:`, error instanceof Error ? error.message : error);
+			console.warn(`Warning: Failed to load manifest at ${resolved.path}:`, error instanceof Error ? error.message : error);
 		}
 	}
 	return plugins;
@@ -309,14 +344,18 @@ function writeManifest(outputPath, { plugins }, options) {
 * manifests, then marks plugins that are actually used in the `plugins: [...]`
 * array as requiredByTemplate.
 */
-function runPluginsSync(options) {
+async function runPluginsSync(options) {
 	const cwd = process.cwd();
+	const allowJsManifest = Boolean(options.allowJsManifest);
 	const outputPath = path.resolve(cwd, options.output || "appkit.plugins.json");
 	if (!isWithinDirectory(outputPath, cwd)) {
 		console.error(`Error: Output path "${options.output}" resolves outside the project directory.`);
 		process.exit(1);
 	}
-	if (!options.silent) console.log("Scanning for AppKit plugins...\n");
+	if (!options.silent) {
+		console.log("Scanning for AppKit plugins...\n");
+		if (allowJsManifest) console.warn("Warning: --allow-js-manifest executes manifest.js/manifest.cjs files. Only use with trusted code.");
+	}
 	const serverFile = findServerFile(cwd);
 	let serverImports = [];
 	let pluginUsages = /* @__PURE__ */ new Set();
@@ -337,15 +376,23 @@ function runPluginsSync(options) {
 		const resolvedDir = path.resolve(cwd, options.pluginsDir);
 		const pkgName = options.packageName ?? "@databricks/appkit";
 		if (!options.silent) console.log(`Scanning plugins directory: ${options.pluginsDir}`);
-		Object.assign(plugins, scanPluginsDir(resolvedDir, pkgName));
+		Object.assign(plugins, await scanPluginsDir(resolvedDir, pkgName, allowJsManifest));
 	} else {
 		const npmPackages = new Set([...KNOWN_PLUGIN_PACKAGES, ...npmImports.map((i) => i.source)]);
-		Object.assign(plugins, scanForPlugins(cwd, npmPackages));
+		Object.assign(plugins, await scanForPlugins(cwd, npmPackages, allowJsManifest));
 	}
 	if (serverFile && localImports.length > 0) {
-		const localPlugins = discoverLocalPlugins(localImports, path.dirname(serverFile), cwd);
+		const localPlugins = await discoverLocalPlugins(localImports, path.dirname(serverFile), cwd, allowJsManifest);
 		Object.assign(plugins, localPlugins);
 	}
+	const localDirsToScan = options.localPluginsDir ? [options.localPluginsDir] : CONVENTIONAL_LOCAL_PLUGIN_DIRS.filter((d) => fs.existsSync(path.join(cwd, d)));
+	for (const dir of localDirsToScan) {
+		const resolvedDir = path.resolve(cwd, dir);
+		if (!fs.existsSync(resolvedDir)) continue;
+		if (!options.silent) console.log(`Scanning local plugins directory: ${dir}`);
+		const discovered = await scanPluginsDirRecursive(resolvedDir, cwd, allowJsManifest);
+		for (const [name, entry] of Object.entries(discovered)) if (!plugins[name]) plugins[name] = entry;
+	}
 	const pluginCount = Object.keys(plugins).length;
 	if (pluginCount === 0) {
 		if (options.silent) {
@@ -353,7 +400,7 @@ function runPluginsSync(options) {
 			return;
 		}
 		console.log("No plugins found.");
-		if (options.pluginsDir) console.log(`\nNo manifest.json files found in: ${options.pluginsDir}`);
+		if (options.pluginsDir) console.log(`\nNo manifest (${allowJsManifest ? "manifest.json or manifest.js" : "manifest.json"}) found in: ${options.pluginsDir}`);
 		else console.log("\nMake sure you have plugin packages installed.");
 		process.exit(1);
 	}
@@ -387,7 +434,10 @@ function runPluginsSync(options) {
 	}
 	writeManifest(outputPath, { plugins }, options);
 }
-const pluginsSyncCommand = new Command("sync").description("Sync plugin manifests from installed packages into appkit.plugins.json").option("-w, --write", "Write the manifest file").option("-o, --output <path>", "Output file path (default: ./appkit.plugins.json)").option("-s, --silent", "Suppress output and never exit with error (for use in predev/prebuild hooks)").option("--require-plugins <names>", "Comma-separated plugin names to mark as requiredByTemplate (e.g. server,analytics)").option("--plugins-dir <path>", "Scan this directory for plugin subdirectories with manifest.json (instead of node_modules)").option("--package-name <name>", "Package name to assign to plugins found via --plugins-dir (default: @databricks/appkit)").action(runPluginsSync);
+const pluginsSyncCommand = new Command("sync").description("Sync plugin manifests from installed packages into appkit.plugins.json").option("-w, --write", "Write the manifest file").option("-o, --output <path>", "Output file path (default: ./appkit.plugins.json)").option("-s, --silent", "Suppress output and never exit with error (for use in predev/prebuild hooks)").option("--require-plugins <names>", "Comma-separated plugin names to mark as requiredByTemplate (e.g. server,analytics)").option("--plugins-dir <path>", "Scan this directory for plugin subdirectories with manifest.json (instead of node_modules)").option("--package-name <name>", "Package name to assign to plugins found via --plugins-dir (default: @databricks/appkit)").option("--local-plugins-dir <path>", "Also scan this directory for local plugin manifests (default: plugins, server)").option("--allow-js-manifest", "Allow reading manifest.js/manifest.cjs (executes code; use only with trusted plugins)").action((opts) => runPluginsSync(opts).catch((err) => {
+	console.error(err);
+	process.exit(1);
+}));
 
 //#endregion
 export { pluginsSyncCommand };

package/dist/cli/commands/plugin/sync/sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync.js","names":[],"sources":["../../../../../src/cli/commands/plugin/sync/sync.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { Lang, parse, type SgNode } from \"@ast-grep/napi\";\nimport { Command } from \"commander\";\nimport type {\n  PluginManifest,\n  TemplatePlugin,\n  TemplatePluginsManifest,\n} from \"../manifest-types\";\nimport {\n  formatValidationErrors,\n  validateManifest,\n} from \"../validate/validate-manifest\";\n\n/**\n * Checks whether a resolved file path is within a given directory boundary.\n * Uses path.resolve + startsWith to prevent directory traversal.\n *\n * @param filePath - The path to check (will be resolved to absolute)\n * @param boundary - The directory that must contain filePath\n * @returns true if filePath is inside boundary (or equal to it)\n */\nfunction isWithinDirectory(filePath: string, boundary: string): boolean {\n  const resolvedPath = path.resolve(filePath);\n  const resolvedBoundary = path.resolve(boundary);\n  // Append separator to avoid prefix false-positives (e.g. /foo-bar matching /foo)\n  return (\n    resolvedPath === resolvedBoundary ||\n    resolvedPath.startsWith(`${resolvedBoundary}${path.sep}`)\n  );\n}\n\n/**\n * Validates a parsed JSON object against the plugin-manifest JSON schema.\n * Returns the manifest if valid, or null and logs schema errors.\n */\nfunction validateManifestWithSchema(\n  obj: unknown,\n  sourcePath: string,\n): PluginManifest | null {\n  const result = validateManifest(obj);\n  if (result.valid && result.manifest) return result.manifest;\n  if (result.errors?.length) {\n    console.warn(\n      `Warning: Manifest at ${sourcePath} failed schema validation:\\n${formatValidationErrors(result.errors, obj)}`,\n    );\n  }\n  return null;\n}\n\n/**\n * Known packages that may contain AppKit plugins.\n * Always scanned for manifests, even if not imported in the server file.\n */\nconst KNOWN_PLUGIN_PACKAGES = [\"@databricks/appkit\"];\n\n/**\n * Candidate paths for the server entry file, relative to cwd.\n * Checked in order; the first that exists is used.\n */\nconst SERVER_FILE_CANDIDATES = [\"server/server.ts\", \"server/index.ts\"];\n\n/**\n * Find the server entry file by checking candidate paths in order.\n *\n * @param cwd - Current working directory\n * @returns Absolute path to the server file, or null if none found\n */\nfunction findServerFile(cwd: string): string | null {\n  for (const candidate of SERVER_FILE_CANDIDATES) {\n    const fullPath = path.join(cwd, candidate);\n    if (fs.existsSync(fullPath)) {\n      return fullPath;\n    }\n  }\n  return null;\n}\n\n/**\n * Represents a single named import extracted from the server file.\n */\ninterface ParsedImport {\n  /** The imported name (or local alias if renamed) */\n  name: string;\n  /** The original exported name (differs from name when using `import { foo as bar }`) */\n  originalName: string;\n  /** The module specifier (package name or relative path) */\n  source: string;\n}\n\n/**\n * Extract all named imports from the AST root using structural node traversal.\n * Handles single/double quotes, multiline imports, and aliased imports.\n *\n * @param root - AST root node\n * @returns Array of parsed imports with name, original name, and source\n */\nfunction parseImports(root: SgNode): ParsedImport[] {\n  const imports: ParsedImport[] = [];\n\n  // Find all import_statement nodes in the AST\n  const importStatements = root.findAll({\n    rule: { kind: \"import_statement\" },\n  });\n\n  for (const stmt of importStatements) {\n    // Extract the module specifier (the string node, e.g. '@databricks/appkit')\n    const sourceNode = stmt.find({ rule: { kind: \"string\" } });\n    if (!sourceNode) continue;\n\n    // Strip surrounding quotes from the string node text\n    const source = sourceNode.text().replace(/^['\"]|['\"]$/g, \"\");\n\n    // Find named_imports block: { createApp, analytics, server }\n    const namedImports = stmt.find({ rule: { kind: \"named_imports\" } });\n    if (!namedImports) continue;\n\n    // Extract each import_specifier\n    const specifiers = namedImports.findAll({\n      rule: { kind: \"import_specifier\" },\n    });\n\n    for (const specifier of specifiers) {\n      const children = specifier.children();\n      if (children.length >= 3) {\n        // Aliased import: `foo as bar` — children are [name, \"as\", alias]\n        const originalName = children[0].text();\n        const localName = children[children.length - 1].text();\n        imports.push({ name: localName, originalName, source });\n      } else {\n        // Simple import: `foo`\n        const name = specifier.text();\n        imports.push({ name, originalName: name, source });\n      }\n    }\n  }\n\n  return imports;\n}\n\n/**\n * Extract local names of plugins actually used in the `plugins: [...]` array\n * passed to `createApp()`. Uses structural AST traversal to find `pair` nodes\n * with key \"plugins\" and array values containing call expressions.\n *\n * @param root - AST root node\n * @returns Set of local variable names used as plugin calls in the plugins array\n */\nfunction parsePluginUsages(root: SgNode): Set<string> {\n  const usedNames = new Set<string>();\n\n  // Find all property pairs in the AST\n  const pairs = root.findAll({ rule: { kind: \"pair\" } });\n\n  for (const pair of pairs) {\n    // Check if the property key is \"plugins\"\n    const key = pair.find({ rule: { kind: \"property_identifier\" } });\n    if (!key || key.text() !== \"plugins\") continue;\n\n    // Find the array value\n    const arrayNode = pair.find({ rule: { kind: \"array\" } });\n    if (!arrayNode) continue;\n\n    // Iterate direct children of the array to find call expressions\n    for (const child of arrayNode.children()) {\n      if (child.kind() === \"call_expression\") {\n        // The callee is the first child (the identifier being called)\n        const callee = child.children()[0];\n        if (callee?.kind() === \"identifier\") {\n          usedNames.add(callee.text());\n        }\n      }\n    }\n  }\n\n  return usedNames;\n}\n\n/**\n * File extensions to try when resolving a relative import to a file path.\n */\nconst RESOLVE_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".jsx\"];\n\n/**\n * Resolve a relative import source to the plugin directory containing a manifest.json.\n * Follows the convention that plugins live in their own directory with a manifest.json.\n *\n * Resolution strategy:\n * 1. If the import path is a directory, look for manifest.json directly in it\n * 2. If the import path + extension is a file, look for manifest.json in its parent directory\n * 3. If the import path is a directory with an index file, look for manifest.json in that directory\n *\n * @param importSource - The relative import specifier (e.g. \"./plugins/my-plugin\")\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @returns Absolute path to manifest.json, or null if not found\n */\nfunction resolveLocalManifest(\n  importSource: string,\n  serverFileDir: string,\n  projectRoot?: string,\n): string | null {\n  const resolved = path.resolve(serverFileDir, importSource);\n\n  // Security: Reject paths that escape the project root\n  const boundary = projectRoot || serverFileDir;\n  if (!isWithinDirectory(resolved, boundary)) {\n    console.warn(\n      `Warning: Skipping import \"${importSource}\" — resolves outside the project directory`,\n    );\n    return null;\n  }\n\n  // Case 1: Import path is a directory with manifest.json\n  // e.g. ./plugins/my-plugin → ./plugins/my-plugin/manifest.json\n  if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n    const manifestPath = path.join(resolved, \"manifest.json\");\n    if (fs.existsSync(manifestPath)) return manifestPath;\n  }\n\n  // Case 2: Import path + extension resolves to a file\n  // e.g. ./plugins/my-plugin → ./plugins/my-plugin.ts\n  // Look for manifest.json in the same directory\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const filePath = `${resolved}${ext}`;\n    if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {\n      const dir = path.dirname(filePath);\n      const manifestPath = path.join(dir, \"manifest.json\");\n      if (fs.existsSync(manifestPath)) return manifestPath;\n      break;\n    }\n  }\n\n  // Case 3: Import path is a directory with an index file\n  // e.g. ./plugins/my-plugin → ./plugins/my-plugin/index.ts\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const indexPath = path.join(resolved, `index${ext}`);\n    if (fs.existsSync(indexPath)) {\n      const manifestPath = path.join(resolved, \"manifest.json\");\n      if (fs.existsSync(manifestPath)) return manifestPath;\n      break;\n    }\n  }\n\n  return null;\n}\n\n/**\n * Discover plugin manifests from local (relative) imports in the server file.\n * Resolves each relative import to a directory and looks for manifest.json.\n *\n * @param relativeImports - Parsed imports with relative sources (starting with . or /)\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @param cwd - Current working directory (for computing relative paths in output)\n * @returns Map of plugin name to template plugin entry for local plugins\n */\nfunction discoverLocalPlugins(\n  relativeImports: ParsedImport[],\n  serverFileDir: string,\n  cwd: string,\n): TemplatePluginsManifest[\"plugins\"] {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const imp of relativeImports) {\n    const manifestPath = resolveLocalManifest(imp.source, serverFileDir, cwd);\n    if (!manifestPath) continue;\n\n    try {\n      const content = fs.readFileSync(manifestPath, \"utf-8\");\n      const parsed = JSON.parse(content);\n      const manifest = validateManifestWithSchema(parsed, manifestPath);\n      if (!manifest || manifest.hidden) continue;\n\n      const relativePath = path.relative(cwd, path.dirname(manifestPath));\n\n      plugins[manifest.name] = {\n        name: manifest.name,\n        displayName: manifest.displayName,\n        description: manifest.description,\n        package: `./${relativePath}`,\n        resources: manifest.resources,\n        ...(manifest.onSetupMessage && {\n          onSetupMessage: manifest.onSetupMessage,\n        }),\n      };\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to parse manifest at ${manifestPath}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Discover plugin manifests from a package's dist folder.\n * Looks for manifest.json files in dist/plugins/{plugin-name}/ directories.\n *\n * @param packagePath - Path to the package in node_modules\n * @returns Array of plugin manifests found in the package\n */\nfunction discoverPluginManifests(packagePath: string): PluginManifest[] {\n  const pluginsDir = path.join(packagePath, \"dist\", \"plugins\");\n  const manifests: PluginManifest[] = [];\n\n  if (!fs.existsSync(pluginsDir)) {\n    return manifests;\n  }\n\n  const entries = fs.readdirSync(pluginsDir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (entry.isDirectory()) {\n      const manifestPath = path.join(pluginsDir, entry.name, \"manifest.json\");\n      if (fs.existsSync(manifestPath)) {\n        try {\n          const content = fs.readFileSync(manifestPath, \"utf-8\");\n          const parsed = JSON.parse(content);\n          const manifest = validateManifestWithSchema(parsed, manifestPath);\n          if (manifest) {\n            manifests.push(manifest);\n          }\n        } catch (error) {\n          console.warn(\n            `Warning: Failed to parse manifest at ${manifestPath}:`,\n            error instanceof Error ? error.message : error,\n          );\n        }\n      }\n    }\n  }\n\n  return manifests;\n}\n\n/**\n * Scan node_modules for packages with plugin manifests.\n *\n * @param cwd - Current working directory to search from\n * @param packages - Set of npm package names to scan for plugin manifests\n * @returns Map of plugin name to template plugin entry\n */\nfunction scanForPlugins(\n  cwd: string,\n  packages: Iterable<string>,\n): TemplatePluginsManifest[\"plugins\"] {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const packageName of packages) {\n    const packagePath = path.join(cwd, \"node_modules\", packageName);\n    if (!fs.existsSync(packagePath)) {\n      continue;\n    }\n\n    const manifests = discoverPluginManifests(packagePath);\n    for (const manifest of manifests) {\n      if (manifest.hidden) continue;\n      plugins[manifest.name] = {\n        name: manifest.name,\n        displayName: manifest.displayName,\n        description: manifest.description,\n        package: packageName,\n        resources: manifest.resources,\n        ...(manifest.onSetupMessage && {\n          onSetupMessage: manifest.onSetupMessage,\n        }),\n      };\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Scan a directory for plugin manifests in direct subdirectories.\n * Each subdirectory is expected to contain a manifest.json file.\n * Used with --plugins-dir to discover plugins from source instead of node_modules.\n *\n * @param dir - Absolute path to the directory containing plugin subdirectories\n * @param packageName - Package name to assign to discovered plugins\n * @returns Map of plugin name to template plugin entry\n */\nfunction scanPluginsDir(\n  dir: string,\n  packageName: string,\n): TemplatePluginsManifest[\"plugins\"] {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (!fs.existsSync(dir)) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const manifestPath = path.join(dir, entry.name, \"manifest.json\");\n    if (!fs.existsSync(manifestPath)) continue;\n\n    try {\n      const content = fs.readFileSync(manifestPath, \"utf-8\");\n      const parsed = JSON.parse(content);\n      const manifest = validateManifestWithSchema(parsed, manifestPath);\n      if (manifest && !manifest.hidden) {\n        plugins[manifest.name] = {\n          name: manifest.name,\n          displayName: manifest.displayName,\n          description: manifest.description,\n          package: packageName,\n          resources: manifest.resources,\n          ...(manifest.onSetupMessage && {\n            onSetupMessage: manifest.onSetupMessage,\n          }),\n        };\n      }\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to parse manifest at ${manifestPath}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Write (or preview) the template plugins manifest to disk.\n */\nfunction writeManifest(\n  outputPath: string,\n  { plugins }: { plugins: TemplatePluginsManifest[\"plugins\"] },\n  options: { write?: boolean; silent?: boolean },\n) {\n  const templateManifest: TemplatePluginsManifest = {\n    $schema:\n      \"https://databricks.github.io/appkit/schemas/template-plugins.schema.json\",\n    version: \"1.0\",\n    plugins,\n  };\n\n  if (options.write) {\n    fs.writeFileSync(\n      outputPath,\n      `${JSON.stringify(templateManifest, null, 2)}\\n`,\n    );\n    if (!options.silent) {\n      console.log(`\\n✓ Wrote ${outputPath}`);\n    }\n  } else if (!options.silent) {\n    console.log(\"\\nTo write the manifest, run:\");\n    console.log(\"  npx appkit plugin sync --write\\n\");\n    console.log(\"Preview:\");\n    console.log(\"─\".repeat(60));\n    console.log(JSON.stringify(templateManifest, null, 2));\n    console.log(\"─\".repeat(60));\n  }\n}\n\n/**\n * Run the plugin sync command.\n * Parses the server entry file to discover which packages to scan for plugin\n * manifests, then marks plugins that are actually used in the `plugins: [...]`\n * array as requiredByTemplate.\n */\nfunction runPluginsSync(options: {\n  write?: boolean;\n  output?: string;\n  silent?: boolean;\n  requirePlugins?: string;\n  pluginsDir?: string;\n  packageName?: string;\n}) {\n  const cwd = process.cwd();\n  const outputPath = path.resolve(cwd, options.output || \"appkit.plugins.json\");\n\n  // Security: Reject output paths that escape the project root\n  if (!isWithinDirectory(outputPath, cwd)) {\n    console.error(\n      `Error: Output path \"${options.output}\" resolves outside the project directory.`,\n    );\n    process.exit(1);\n  }\n\n  if (!options.silent) {\n    console.log(\"Scanning for AppKit plugins...\\n\");\n  }\n\n  // Step 1: Parse server file to discover imports and plugin usages\n  const serverFile = findServerFile(cwd);\n  let serverImports: ParsedImport[] = [];\n  let pluginUsages = new Set<string>();\n\n  if (serverFile) {\n    if (!options.silent) {\n      const relativePath = path.relative(cwd, serverFile);\n      console.log(`Server entry file: ${relativePath}`);\n    }\n\n    const content = fs.readFileSync(serverFile, \"utf-8\");\n    const lang = serverFile.endsWith(\".tsx\") ? Lang.Tsx : Lang.TypeScript;\n    const ast = parse(lang, content);\n    const root = ast.root();\n\n    serverImports = parseImports(root);\n    pluginUsages = parsePluginUsages(root);\n  } else if (!options.silent) {\n    console.log(\n      \"No server entry file found. Checked:\",\n      SERVER_FILE_CANDIDATES.join(\", \"),\n    );\n  }\n\n  // Step 2: Split imports into npm packages and local (relative) imports\n  const npmImports = serverImports.filter(\n    (i) => !i.source.startsWith(\".\") && !i.source.startsWith(\"/\"),\n  );\n  const localImports = serverImports.filter(\n    (i) => i.source.startsWith(\".\") || i.source.startsWith(\"/\"),\n  );\n\n  // Step 3: Scan for plugin manifests (--plugins-dir or node_modules)\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (options.pluginsDir) {\n    const resolvedDir = path.resolve(cwd, options.pluginsDir);\n    const pkgName = options.packageName ?? \"@databricks/appkit\";\n    if (!options.silent) {\n      console.log(`Scanning plugins directory: ${options.pluginsDir}`);\n    }\n    Object.assign(plugins, scanPluginsDir(resolvedDir, pkgName));\n  } else {\n    const npmPackages = new Set([\n      ...KNOWN_PLUGIN_PACKAGES,\n      ...npmImports.map((i) => i.source),\n    ]);\n    Object.assign(plugins, scanForPlugins(cwd, npmPackages));\n  }\n\n  // Step 4: Discover local plugin manifests from relative imports\n  if (serverFile && localImports.length > 0) {\n    const serverFileDir = path.dirname(serverFile);\n    const localPlugins = discoverLocalPlugins(localImports, serverFileDir, cwd);\n    Object.assign(plugins, localPlugins);\n  }\n\n  const pluginCount = Object.keys(plugins).length;\n\n  if (pluginCount === 0) {\n    if (options.silent) {\n      writeManifest(outputPath, { plugins: {} }, options);\n      return;\n    }\n    console.log(\"No plugins found.\");\n    if (options.pluginsDir) {\n      console.log(`\\nNo manifest.json files found in: ${options.pluginsDir}`);\n    } else {\n      console.log(\"\\nMake sure you have plugin packages installed.\");\n    }\n    process.exit(1);\n  }\n\n  // Step 5: Mark plugins that are imported AND used in the plugins array as mandatory.\n  // For npm imports, match by package name + plugin name.\n  // For local imports, resolve both paths to absolute and compare.\n  const serverFileDir = serverFile ? path.dirname(serverFile) : cwd;\n\n  for (const imp of serverImports) {\n    if (!pluginUsages.has(imp.name)) continue;\n\n    const isLocal = imp.source.startsWith(\".\") || imp.source.startsWith(\"/\");\n    let plugin: TemplatePlugin | undefined;\n\n    if (isLocal) {\n      // Resolve the import source to an absolute path from the server file directory\n      const resolvedImportDir = path.resolve(serverFileDir, imp.source);\n      plugin = Object.values(plugins).find((p) => {\n        if (!p.package.startsWith(\".\")) return false;\n        const resolvedPluginDir = path.resolve(cwd, p.package);\n        return (\n          resolvedPluginDir === resolvedImportDir && p.name === imp.originalName\n        );\n      });\n    } else {\n      // npm import: direct string comparison\n      plugin = Object.values(plugins).find(\n        (p) => p.package === imp.source && p.name === imp.originalName,\n      );\n    }\n\n    if (plugin) {\n      plugin.requiredByTemplate = true;\n    }\n  }\n\n  // Step 6: Apply explicit --require-plugins overrides\n  if (options.requirePlugins) {\n    const explicitNames = options.requirePlugins\n      .split(\",\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n    for (const name of explicitNames) {\n      if (plugins[name]) {\n        plugins[name].requiredByTemplate = true;\n      } else if (!options.silent) {\n        console.warn(\n          `Warning: --require-plugins referenced \"${name}\" but no such plugin was discovered`,\n        );\n      }\n    }\n  }\n\n  if (!options.silent) {\n    console.log(`\\nFound ${pluginCount} plugin(s):`);\n    for (const [name, manifest] of Object.entries(plugins)) {\n      const resourceCount =\n        manifest.resources.required.length + manifest.resources.optional.length;\n      const resourceInfo =\n        resourceCount > 0 ? ` [${resourceCount} resource(s)]` : \"\";\n      const mandatoryTag = manifest.requiredByTemplate ? \" (mandatory)\" : \"\";\n      console.log(\n        `  ${manifest.requiredByTemplate ? \"●\" : \"○\"} ${manifest.displayName} (${name}) from ${manifest.package}${resourceInfo}${mandatoryTag}`,\n      );\n    }\n  }\n\n  writeManifest(outputPath, { plugins }, options);\n}\n\n/** Exported for testing: path boundary check, AST parsing. */\nexport { isWithinDirectory, parseImports, parsePluginUsages };\n\nexport const pluginsSyncCommand = new Command(\"sync\")\n  .description(\n    \"Sync plugin manifests from installed packages into appkit.plugins.json\",\n  )\n  .option(\"-w, --write\", \"Write the manifest file\")\n  .option(\n    \"-o, --output <path>\",\n    \"Output file path (default: ./appkit.plugins.json)\",\n  )\n  .option(\n    \"-s, --silent\",\n    \"Suppress output and never exit with error (for use in predev/prebuild hooks)\",\n  )\n  .option(\n    \"--require-plugins <names>\",\n    \"Comma-separated plugin names to mark as requiredByTemplate (e.g. server,analytics)\",\n  )\n  .option(\n    \"--plugins-dir <path>\",\n    \"Scan this directory for plugin subdirectories with manifest.json (instead of node_modules)\",\n  )\n  .option(\n    \"--package-name <name>\",\n    \"Package name to assign to plugins found via --plugins-dir (default: @databricks/appkit)\",\n  )\n  .action(runPluginsSync);\n"],"mappings":";;;;;;;;;;;;;;;AAsBA,SAAS,kBAAkB,UAAkB,UAA2B;CACtE,MAAM,eAAe,KAAK,QAAQ,SAAS;CAC3C,MAAM,mBAAmB,KAAK,QAAQ,SAAS;AAE/C,QACE,iBAAiB,oBACjB,aAAa,WAAW,GAAG,mBAAmB,KAAK,MAAM;;;;;;AAQ7D,SAAS,2BACP,KACA,YACuB;CACvB,MAAM,SAAS,iBAAiB,IAAI;AACpC,KAAI,OAAO,SAAS,OAAO,SAAU,QAAO,OAAO;AACnD,KAAI,OAAO,QAAQ,OACjB,SAAQ,KACN,wBAAwB,WAAW,8BAA8B,uBAAuB,OAAO,QAAQ,IAAI,GAC5G;AAEH,QAAO;;;;;;AAOT,MAAM,wBAAwB,CAAC,qBAAqB;;;;;AAMpD,MAAM,yBAAyB,CAAC,oBAAoB,kBAAkB;;;;;;;AAQtE,SAAS,eAAe,KAA4B;AAClD,MAAK,MAAM,aAAa,wBAAwB;EAC9C,MAAM,WAAW,KAAK,KAAK,KAAK,UAAU;AAC1C,MAAI,GAAG,WAAW,SAAS,CACzB,QAAO;;AAGX,QAAO;;;;;;;;;AAsBT,SAAS,aAAa,MAA8B;CAClD,MAAM,UAA0B,EAAE;CAGlC,MAAM,mBAAmB,KAAK,QAAQ,EACpC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,MAAK,MAAM,QAAQ,kBAAkB;EAEnC,MAAM,aAAa,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,EAAE,CAAC;AAC1D,MAAI,CAAC,WAAY;EAGjB,MAAM,SAAS,WAAW,MAAM,CAAC,QAAQ,gBAAgB,GAAG;EAG5D,MAAM,eAAe,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,EAAE,CAAC;AACnE,MAAI,CAAC,aAAc;EAGnB,MAAM,aAAa,aAAa,QAAQ,EACtC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,OAAK,MAAM,aAAa,YAAY;GAClC,MAAM,WAAW,UAAU,UAAU;AACrC,OAAI,SAAS,UAAU,GAAG;IAExB,MAAM,eAAe,SAAS,GAAG,MAAM;IACvC,MAAM,YAAY,SAAS,SAAS,SAAS,GAAG,MAAM;AACtD,YAAQ,KAAK;KAAE,MAAM;KAAW;KAAc;KAAQ,CAAC;UAClD;IAEL,MAAM,OAAO,UAAU,MAAM;AAC7B,YAAQ,KAAK;KAAE;KAAM,cAAc;KAAM;KAAQ,CAAC;;;;AAKxD,QAAO;;;;;;;;;;AAWT,SAAS,kBAAkB,MAA2B;CACpD,MAAM,4BAAY,IAAI,KAAa;CAGnC,MAAM,QAAQ,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,EAAE,CAAC;AAEtD,MAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,MAAM,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,EAAE,CAAC;AAChE,MAAI,CAAC,OAAO,IAAI,MAAM,KAAK,UAAW;EAGtC,MAAM,YAAY,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,CAAC;AACxD,MAAI,CAAC,UAAW;AAGhB,OAAK,MAAM,SAAS,UAAU,UAAU,CACtC,KAAI,MAAM,MAAM,KAAK,mBAAmB;GAEtC,MAAM,SAAS,MAAM,UAAU,CAAC;AAChC,OAAI,QAAQ,MAAM,KAAK,aACrB,WAAU,IAAI,OAAO,MAAM,CAAC;;;AAMpC,QAAO;;;;;AAMT,MAAM,qBAAqB;CAAC;CAAO;CAAQ;CAAO;CAAO;;;;;;;;;;;;;;AAezD,SAAS,qBACP,cACA,eACA,aACe;CACf,MAAM,WAAW,KAAK,QAAQ,eAAe,aAAa;AAI1D,KAAI,CAAC,kBAAkB,UADN,eAAe,cACU,EAAE;AAC1C,UAAQ,KACN,6BAA6B,aAAa,4CAC3C;AACD,SAAO;;AAKT,KAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,aAAa,EAAE;EAClE,MAAM,eAAe,KAAK,KAAK,UAAU,gBAAgB;AACzD,MAAI,GAAG,WAAW,aAAa,CAAE,QAAO;;AAM1C,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,WAAW,GAAG,WAAW;AAC/B,MAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,QAAQ,EAAE;GAC7D,MAAM,MAAM,KAAK,QAAQ,SAAS;GAClC,MAAM,eAAe,KAAK,KAAK,KAAK,gBAAgB;AACpD,OAAI,GAAG,WAAW,aAAa,CAAE,QAAO;AACxC;;;AAMJ,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,YAAY,KAAK,KAAK,UAAU,QAAQ,MAAM;AACpD,MAAI,GAAG,WAAW,UAAU,EAAE;GAC5B,MAAM,eAAe,KAAK,KAAK,UAAU,gBAAgB;AACzD,OAAI,GAAG,WAAW,aAAa,CAAE,QAAO;AACxC;;;AAIJ,QAAO;;;;;;;;;;;AAYT,SAAS,qBACP,iBACA,eACA,KACoC;CACpC,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,eAAe,qBAAqB,IAAI,QAAQ,eAAe,IAAI;AACzE,MAAI,CAAC,aAAc;AAEnB,MAAI;GACF,MAAM,UAAU,GAAG,aAAa,cAAc,QAAQ;GAEtD,MAAM,WAAW,2BADF,KAAK,MAAM,QAAQ,EACkB,aAAa;AACjE,OAAI,CAAC,YAAY,SAAS,OAAQ;GAElC,MAAM,eAAe,KAAK,SAAS,KAAK,KAAK,QAAQ,aAAa,CAAC;AAEnE,WAAQ,SAAS,QAAQ;IACvB,MAAM,SAAS;IACf,aAAa,SAAS;IACtB,aAAa,SAAS;IACtB,SAAS,KAAK;IACd,WAAW,SAAS;IACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;IACF;WACM,OAAO;AACd,WAAQ,KACN,wCAAwC,aAAa,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,SAAS,wBAAwB,aAAuC;CACtE,MAAM,aAAa,KAAK,KAAK,aAAa,QAAQ,UAAU;CAC5D,MAAM,YAA8B,EAAE;AAEtC,KAAI,CAAC,GAAG,WAAW,WAAW,CAC5B,QAAO;CAGT,MAAM,UAAU,GAAG,YAAY,YAAY,EAAE,eAAe,MAAM,CAAC;AACnE,MAAK,MAAM,SAAS,QAClB,KAAI,MAAM,aAAa,EAAE;EACvB,MAAM,eAAe,KAAK,KAAK,YAAY,MAAM,MAAM,gBAAgB;AACvE,MAAI,GAAG,WAAW,aAAa,CAC7B,KAAI;GACF,MAAM,UAAU,GAAG,aAAa,cAAc,QAAQ;GAEtD,MAAM,WAAW,2BADF,KAAK,MAAM,QAAQ,EACkB,aAAa;AACjE,OAAI,SACF,WAAU,KAAK,SAAS;WAEnB,OAAO;AACd,WAAQ,KACN,wCAAwC,aAAa,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAMT,QAAO;;;;;;;;;AAUT,SAAS,eACP,KACA,UACoC;CACpC,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,eAAe,UAAU;EAClC,MAAM,cAAc,KAAK,KAAK,KAAK,gBAAgB,YAAY;AAC/D,MAAI,CAAC,GAAG,WAAW,YAAY,CAC7B;EAGF,MAAM,YAAY,wBAAwB,YAAY;AACtD,OAAK,MAAM,YAAY,WAAW;AAChC,OAAI,SAAS,OAAQ;AACrB,WAAQ,SAAS,QAAQ;IACvB,MAAM,SAAS;IACf,aAAa,SAAS;IACtB,aAAa,SAAS;IACtB,SAAS;IACT,WAAW,SAAS;IACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;IACF;;;AAIL,QAAO;;;;;;;;;;;AAYT,SAAS,eACP,KACA,aACoC;CACpC,MAAM,UAA8C,EAAE;AAEtD,KAAI,CAAC,GAAG,WAAW,IAAI,CAAE,QAAO;CAEhC,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,eAAe,KAAK,KAAK,KAAK,MAAM,MAAM,gBAAgB;AAChE,MAAI,CAAC,GAAG,WAAW,aAAa,CAAE;AAElC,MAAI;GACF,MAAM,UAAU,GAAG,aAAa,cAAc,QAAQ;GAEtD,MAAM,WAAW,2BADF,KAAK,MAAM,QAAQ,EACkB,aAAa;AACjE,OAAI,YAAY,CAAC,SAAS,OACxB,SAAQ,SAAS,QAAQ;IACvB,MAAM,SAAS;IACf,aAAa,SAAS;IACtB,aAAa,SAAS;IACtB,SAAS;IACT,WAAW,SAAS;IACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;IACF;WAEI,OAAO;AACd,WAAQ,KACN,wCAAwC,aAAa,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;AAMT,SAAS,cACP,YACA,EAAE,WACF,SACA;CACA,MAAM,mBAA4C;EAChD,SACE;EACF,SAAS;EACT;EACD;AAED,KAAI,QAAQ,OAAO;AACjB,KAAG,cACD,YACA,GAAG,KAAK,UAAU,kBAAkB,MAAM,EAAE,CAAC,IAC9C;AACD,MAAI,CAAC,QAAQ,OACX,SAAQ,IAAI,aAAa,aAAa;YAE/B,CAAC,QAAQ,QAAQ;AAC1B,UAAQ,IAAI,gCAAgC;AAC5C,UAAQ,IAAI,qCAAqC;AACjD,UAAQ,IAAI,WAAW;AACvB,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;AAC3B,UAAQ,IAAI,KAAK,UAAU,kBAAkB,MAAM,EAAE,CAAC;AACtD,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;;;;;;;;;AAU/B,SAAS,eAAe,SAOrB;CACD,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,aAAa,KAAK,QAAQ,KAAK,QAAQ,UAAU,sBAAsB;AAG7E,KAAI,CAAC,kBAAkB,YAAY,IAAI,EAAE;AACvC,UAAQ,MACN,uBAAuB,QAAQ,OAAO,2CACvC;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,CAAC,QAAQ,OACX,SAAQ,IAAI,mCAAmC;CAIjD,MAAM,aAAa,eAAe,IAAI;CACtC,IAAI,gBAAgC,EAAE;CACtC,IAAI,+BAAe,IAAI,KAAa;AAEpC,KAAI,YAAY;AACd,MAAI,CAAC,QAAQ,QAAQ;GACnB,MAAM,eAAe,KAAK,SAAS,KAAK,WAAW;AACnD,WAAQ,IAAI,sBAAsB,eAAe;;EAGnD,MAAM,UAAU,GAAG,aAAa,YAAY,QAAQ;EAGpD,MAAM,OADM,MADC,WAAW,SAAS,OAAO,GAAG,KAAK,MAAM,KAAK,YACnC,QAAQ,CACf,MAAM;AAEvB,kBAAgB,aAAa,KAAK;AAClC,iBAAe,kBAAkB,KAAK;YAC7B,CAAC,QAAQ,OAClB,SAAQ,IACN,wCACA,uBAAuB,KAAK,KAAK,CAClC;CAIH,MAAM,aAAa,cAAc,QAC9B,MAAM,CAAC,EAAE,OAAO,WAAW,IAAI,IAAI,CAAC,EAAE,OAAO,WAAW,IAAI,CAC9D;CACD,MAAM,eAAe,cAAc,QAChC,MAAM,EAAE,OAAO,WAAW,IAAI,IAAI,EAAE,OAAO,WAAW,IAAI,CAC5D;CAGD,MAAM,UAA8C,EAAE;AAEtD,KAAI,QAAQ,YAAY;EACtB,MAAM,cAAc,KAAK,QAAQ,KAAK,QAAQ,WAAW;EACzD,MAAM,UAAU,QAAQ,eAAe;AACvC,MAAI,CAAC,QAAQ,OACX,SAAQ,IAAI,+BAA+B,QAAQ,aAAa;AAElE,SAAO,OAAO,SAAS,eAAe,aAAa,QAAQ,CAAC;QACvD;EACL,MAAM,cAAc,IAAI,IAAI,CAC1B,GAAG,uBACH,GAAG,WAAW,KAAK,MAAM,EAAE,OAAO,CACnC,CAAC;AACF,SAAO,OAAO,SAAS,eAAe,KAAK,YAAY,CAAC;;AAI1D,KAAI,cAAc,aAAa,SAAS,GAAG;EAEzC,MAAM,eAAe,qBAAqB,cADpB,KAAK,QAAQ,WAAW,EACyB,IAAI;AAC3E,SAAO,OAAO,SAAS,aAAa;;CAGtC,MAAM,cAAc,OAAO,KAAK,QAAQ,CAAC;AAEzC,KAAI,gBAAgB,GAAG;AACrB,MAAI,QAAQ,QAAQ;AAClB,iBAAc,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ;AACnD;;AAEF,UAAQ,IAAI,oBAAoB;AAChC,MAAI,QAAQ,WACV,SAAQ,IAAI,sCAAsC,QAAQ,aAAa;MAEvE,SAAQ,IAAI,kDAAkD;AAEhE,UAAQ,KAAK,EAAE;;CAMjB,MAAM,gBAAgB,aAAa,KAAK,QAAQ,WAAW,GAAG;AAE9D,MAAK,MAAM,OAAO,eAAe;AAC/B,MAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAAE;EAEjC,MAAM,UAAU,IAAI,OAAO,WAAW,IAAI,IAAI,IAAI,OAAO,WAAW,IAAI;EACxE,IAAI;AAEJ,MAAI,SAAS;GAEX,MAAM,oBAAoB,KAAK,QAAQ,eAAe,IAAI,OAAO;AACjE,YAAS,OAAO,OAAO,QAAQ,CAAC,MAAM,MAAM;AAC1C,QAAI,CAAC,EAAE,QAAQ,WAAW,IAAI,CAAE,QAAO;AAEvC,WAD0B,KAAK,QAAQ,KAAK,EAAE,QAAQ,KAE9B,qBAAqB,EAAE,SAAS,IAAI;KAE5D;QAGF,UAAS,OAAO,OAAO,QAAQ,CAAC,MAC7B,MAAM,EAAE,YAAY,IAAI,UAAU,EAAE,SAAS,IAAI,aACnD;AAGH,MAAI,OACF,QAAO,qBAAqB;;AAKhC,KAAI,QAAQ,gBAAgB;EAC1B,MAAM,gBAAgB,QAAQ,eAC3B,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,OAAO,QAAQ;AAClB,OAAK,MAAM,QAAQ,cACjB,KAAI,QAAQ,MACV,SAAQ,MAAM,qBAAqB;WAC1B,CAAC,QAAQ,OAClB,SAAQ,KACN,0CAA0C,KAAK,qCAChD;;AAKP,KAAI,CAAC,QAAQ,QAAQ;AACnB,UAAQ,IAAI,WAAW,YAAY,aAAa;AAChD,OAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,EAAE;GACtD,MAAM,gBACJ,SAAS,UAAU,SAAS,SAAS,SAAS,UAAU,SAAS;GACnE,MAAM,eACJ,gBAAgB,IAAI,KAAK,cAAc,iBAAiB;GAC1D,MAAM,eAAe,SAAS,qBAAqB,iBAAiB;AACpE,WAAQ,IACN,KAAK,SAAS,qBAAqB,MAAM,IAAI,GAAG,SAAS,YAAY,IAAI,KAAK,SAAS,SAAS,UAAU,eAAe,eAC1H;;;AAIL,eAAc,YAAY,EAAE,SAAS,EAAE,QAAQ;;AAMjD,MAAa,qBAAqB,IAAI,QAAQ,OAAO,CAClD,YACC,yEACD,CACA,OAAO,eAAe,0BAA0B,CAChD,OACC,uBACA,oDACD,CACA,OACC,gBACA,+EACD,CACA,OACC,6BACA,qFACD,CACA,OACC,wBACA,6FACD,CACA,OACC,yBACA,0FACD,CACA,OAAO,eAAe"}
+{"version":3,"file":"sync.js","names":[],"sources":["../../../../../src/cli/commands/plugin/sync/sync.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { Lang, parse, type SgNode } from \"@ast-grep/napi\";\nimport { Command } from \"commander\";\nimport {\n  loadManifestFromFile,\n  type ResolvedManifest,\n  resolveManifestInDir,\n} from \"../manifest-resolve\";\nimport type {\n  PluginManifest,\n  TemplatePlugin,\n  TemplatePluginsManifest,\n} from \"../manifest-types\";\nimport { shouldAllowJsManifestForPackage } from \"../trusted-js-manifest\";\nimport {\n  formatValidationErrors,\n  validateManifest,\n} from \"../validate/validate-manifest\";\n\n/**\n * Checks whether a resolved file path is within a given directory boundary.\n * Uses path.resolve + startsWith to prevent directory traversal.\n *\n * @param filePath - The path to check (will be resolved to absolute)\n * @param boundary - The directory that must contain filePath\n * @returns true if filePath is inside boundary (or equal to it)\n */\nfunction isWithinDirectory(filePath: string, boundary: string): boolean {\n  const resolvedPath = path.resolve(filePath);\n  const resolvedBoundary = path.resolve(boundary);\n  // Append separator to avoid prefix false-positives (e.g. /foo-bar matching /foo)\n  return (\n    resolvedPath === resolvedBoundary ||\n    resolvedPath.startsWith(`${resolvedBoundary}${path.sep}`)\n  );\n}\n\n/**\n * Validates a parsed JSON object against the plugin-manifest JSON schema.\n * Returns the manifest if valid, or null and logs schema errors.\n */\nfunction validateManifestWithSchema(\n  obj: unknown,\n  sourcePath: string,\n): PluginManifest | null {\n  const result = validateManifest(obj);\n  if (result.valid && result.manifest) return result.manifest;\n  if (result.errors?.length) {\n    console.warn(\n      `Warning: Manifest at ${sourcePath} failed schema validation:\\n${formatValidationErrors(result.errors, obj)}`,\n    );\n  }\n  return null;\n}\n\n/** Safety limit for recursive directory scanning to prevent runaway traversal. */\nconst MAX_SCAN_DEPTH = 5;\n\n/**\n * Load and validate a resolved manifest, returning a TemplatePlugin entry or null.\n * Centralises the resolve → load → validate → build-entry pipeline used by\n * multiple discovery functions.\n */\nasync function loadPluginEntry(\n  resolved: ResolvedManifest,\n  pkg: string,\n  allowJsManifest: boolean,\n): Promise<[string, TemplatePlugin] | null> {\n  const parsed = await loadManifestFromFile(resolved.path, resolved.type, {\n    allowJsManifest,\n  });\n  const manifest = validateManifestWithSchema(parsed, resolved.path);\n  if (!manifest || manifest.hidden) return null;\n\n  return [\n    manifest.name,\n    {\n      name: manifest.name,\n      displayName: manifest.displayName,\n      description: manifest.description,\n      package: pkg,\n      resources: manifest.resources,\n      ...(manifest.onSetupMessage && {\n        onSetupMessage: manifest.onSetupMessage,\n      }),\n    },\n  ];\n}\n\n/**\n * Known packages that may contain AppKit plugins.\n * Always scanned for manifests, even if not imported in the server file.\n */\nconst KNOWN_PLUGIN_PACKAGES = [\"@databricks/appkit\"];\n\n/**\n * Candidate paths for the server entry file, relative to cwd.\n * Checked in order; the first that exists is used.\n */\nconst SERVER_FILE_CANDIDATES = [\"server/server.ts\", \"server/index.ts\"];\n\n/**\n * Conventional directories to scan for local plugin manifests when\n * --local-plugins-dir is not set. Checked in order; each that exists is scanned.\n * Plugins found here are added to the manifest even if not imported in the server.\n */\nconst CONVENTIONAL_LOCAL_PLUGIN_DIRS = [\"plugins\", \"server\"];\n\n/**\n * Find the server entry file by checking candidate paths in order.\n *\n * @param cwd - Current working directory\n * @returns Absolute path to the server file, or null if none found\n */\nfunction findServerFile(cwd: string): string | null {\n  for (const candidate of SERVER_FILE_CANDIDATES) {\n    const fullPath = path.join(cwd, candidate);\n    if (fs.existsSync(fullPath)) {\n      return fullPath;\n    }\n  }\n  return null;\n}\n\n/**\n * Represents a single named import extracted from the server file.\n */\ninterface ParsedImport {\n  /** The imported name (or local alias if renamed) */\n  name: string;\n  /** The original exported name (differs from name when using `import { foo as bar }`) */\n  originalName: string;\n  /** The module specifier (package name or relative path) */\n  source: string;\n}\n\n/**\n * Extract all named imports from the AST root using structural node traversal.\n * Handles single/double quotes, multiline imports, and aliased imports.\n *\n * @param root - AST root node\n * @returns Array of parsed imports with name, original name, and source\n */\nfunction parseImports(root: SgNode): ParsedImport[] {\n  const imports: ParsedImport[] = [];\n\n  // Find all import_statement nodes in the AST\n  const importStatements = root.findAll({\n    rule: { kind: \"import_statement\" },\n  });\n\n  for (const stmt of importStatements) {\n    // Extract the module specifier (the string node, e.g. '@databricks/appkit')\n    const sourceNode = stmt.find({ rule: { kind: \"string\" } });\n    if (!sourceNode) continue;\n\n    // Strip surrounding quotes from the string node text\n    const source = sourceNode.text().replace(/^['\"]|['\"]$/g, \"\");\n\n    // Find named_imports block: { createApp, analytics, server }\n    const namedImports = stmt.find({ rule: { kind: \"named_imports\" } });\n    if (!namedImports) continue;\n\n    // Extract each import_specifier\n    const specifiers = namedImports.findAll({\n      rule: { kind: \"import_specifier\" },\n    });\n\n    for (const specifier of specifiers) {\n      const children = specifier.children();\n      if (children.length >= 3) {\n        // Aliased import: `foo as bar` — children are [name, \"as\", alias]\n        const originalName = children[0].text();\n        const localName = children[children.length - 1].text();\n        imports.push({ name: localName, originalName, source });\n      } else {\n        // Simple import: `foo`\n        const name = specifier.text();\n        imports.push({ name, originalName: name, source });\n      }\n    }\n  }\n\n  return imports;\n}\n\n/**\n * Extract local names of plugins actually used in the `plugins: [...]` array\n * passed to `createApp()`. Uses structural AST traversal to find `pair` nodes\n * with key \"plugins\" and array values containing call expressions.\n *\n * @param root - AST root node\n * @returns Set of local variable names used as plugin calls in the plugins array\n */\nfunction parsePluginUsages(root: SgNode): Set<string> {\n  const usedNames = new Set<string>();\n\n  // Find all property pairs in the AST\n  const pairs = root.findAll({ rule: { kind: \"pair\" } });\n\n  for (const pair of pairs) {\n    // Check if the property key is \"plugins\"\n    const key = pair.find({ rule: { kind: \"property_identifier\" } });\n    if (!key || key.text() !== \"plugins\") continue;\n\n    // Find the array value\n    const arrayNode = pair.find({ rule: { kind: \"array\" } });\n    if (!arrayNode) continue;\n\n    // Iterate direct children of the array to find call expressions\n    for (const child of arrayNode.children()) {\n      if (child.kind() === \"call_expression\") {\n        // The callee is the first child (the identifier being called)\n        const callee = child.children()[0];\n        if (callee?.kind() === \"identifier\") {\n          usedNames.add(callee.text());\n        }\n      }\n    }\n  }\n\n  return usedNames;\n}\n\n/**\n * File extensions to try when resolving a relative import to a file path.\n */\nconst RESOLVE_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".jsx\"];\n\n/**\n * Resolve a relative import source to the plugin directory containing a manifest\n * (manifest.json or manifest.js). Follows the convention that plugins live in\n * their own directory with a manifest file.\n *\n * Resolution strategy:\n * 1. If the import path is a directory, look for manifest.json/js in it\n * 2. If the import path + extension is a file, look for manifest in its parent directory\n * 3. If the import path is a directory with an index file, look for manifest in that directory\n *\n * @param importSource - The relative import specifier (e.g. \"./plugins/my-plugin\")\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @returns Resolved manifest file path and type, or null if not found\n */\nfunction resolveLocalManifest(\n  importSource: string,\n  serverFileDir: string,\n  allowJsManifest: boolean,\n  projectRoot?: string,\n): ResolvedManifest | null {\n  const resolved = path.resolve(serverFileDir, importSource);\n\n  // Security: Reject paths that escape the project root\n  const boundary = projectRoot || serverFileDir;\n  if (!isWithinDirectory(resolved, boundary)) {\n    console.warn(\n      `Warning: Skipping import \"${importSource}\" — resolves outside the project directory`,\n    );\n    return null;\n  }\n\n  // Case 1: Import path is a directory\n  if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n    return resolveManifestInDir(resolved, { allowJsManifest });\n  }\n\n  // Case 2: Import path + extension resolves to a file — manifest in parent dir\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const filePath = `${resolved}${ext}`;\n    if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {\n      const dir = path.dirname(filePath);\n      if (!isWithinDirectory(dir, boundary)) return null;\n      return resolveManifestInDir(dir, { allowJsManifest });\n    }\n  }\n\n  // Case 3: Import path is a directory with an index file\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const indexPath = path.join(resolved, `index${ext}`);\n    if (fs.existsSync(indexPath)) {\n      return resolveManifestInDir(resolved, { allowJsManifest });\n    }\n  }\n\n  return null;\n}\n\n/**\n * Discover plugin manifests from local (relative) imports in the server file.\n * Resolves each relative import to a directory and loads manifest.json or manifest.js.\n *\n * @param relativeImports - Parsed imports with relative sources (starting with . or /)\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @param cwd - Current working directory (for computing relative paths in output)\n * @returns Map of plugin name to template plugin entry for local plugins\n */\nasync function discoverLocalPlugins(\n  relativeImports: ParsedImport[],\n  serverFileDir: string,\n  cwd: string,\n  allowJsManifest: boolean,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const imp of relativeImports) {\n    const resolved = resolveLocalManifest(\n      imp.source,\n      serverFileDir,\n      allowJsManifest,\n      cwd,\n    );\n    if (!resolved) continue;\n\n    try {\n      const relativePath = path.relative(cwd, path.dirname(resolved.path));\n      const entry = await loadPluginEntry(\n        resolved,\n        `./${relativePath}`,\n        allowJsManifest,\n      );\n      if (entry) plugins[entry[0]] = entry[1];\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Discover plugin manifests from a package's dist folder.\n * Looks for manifest.json or manifest.js in dist/plugins/{plugin-name}/ directories.\n *\n * @param packagePath - Path to the package in node_modules\n * @returns Array of plugin manifests found in the package\n */\nasync function discoverPluginManifests(\n  packagePath: string,\n  allowJsManifest: boolean,\n): Promise<PluginManifest[]> {\n  const pluginsDir = path.join(packagePath, \"dist\", \"plugins\");\n  const manifests: PluginManifest[] = [];\n\n  if (!fs.existsSync(pluginsDir)) {\n    return manifests;\n  }\n\n  const entries = fs.readdirSync(pluginsDir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n    const resolved = resolveManifestInDir(path.join(pluginsDir, entry.name), {\n      allowJsManifest,\n    });\n    if (!resolved) continue;\n\n    try {\n      const parsed = await loadManifestFromFile(resolved.path, resolved.type, {\n        allowJsManifest,\n      });\n      const manifest = validateManifestWithSchema(parsed, resolved.path);\n      if (manifest) {\n        manifests.push(manifest);\n      }\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return manifests;\n}\n\n/**\n * Scan node_modules for packages with plugin manifests.\n *\n * @param cwd - Current working directory to search from\n * @param packages - Set of npm package names to scan for plugin manifests\n * @returns Map of plugin name to template plugin entry\n */\nasync function scanForPlugins(\n  cwd: string,\n  packages: Iterable<string>,\n  allowJsManifest: boolean,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const packageName of packages) {\n    const packagePath = path.join(cwd, \"node_modules\", packageName);\n    if (!fs.existsSync(packagePath)) {\n      continue;\n    }\n\n    const allowJsForPackage =\n      allowJsManifest || shouldAllowJsManifestForPackage(packageName);\n\n    const manifests = await discoverPluginManifests(\n      packagePath,\n      allowJsForPackage,\n    );\n    for (const manifest of manifests) {\n      if (manifest.hidden) continue;\n      plugins[manifest.name] = {\n        name: manifest.name,\n        displayName: manifest.displayName,\n        description: manifest.description,\n        package: packageName,\n        resources: manifest.resources,\n        ...(manifest.onSetupMessage && {\n          onSetupMessage: manifest.onSetupMessage,\n        }),\n      } satisfies TemplatePlugin;\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Recursively scan a directory for plugin manifests. Any directory that\n * contains manifest.json or manifest.js is treated as a plugin root; we do\n * not descend into that directory's children. Used for local plugins discovery\n * so nested paths like server/plugins/category/my-plugin are found.\n */\nasync function scanPluginsDirRecursive(\n  dir: string,\n  cwd: string,\n  allowJsManifest: boolean,\n  depth = 0,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n  if (!fs.existsSync(dir) || depth >= MAX_SCAN_DEPTH) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const pluginDir = path.join(dir, entry.name);\n    const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });\n\n    if (resolved) {\n      const pkg = `./${path.relative(cwd, pluginDir)}`;\n      try {\n        const pluginEntry = await loadPluginEntry(\n          resolved,\n          pkg,\n          allowJsManifest,\n        );\n        if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];\n      } catch (error) {\n        console.warn(\n          `Warning: Failed to load manifest at ${resolved.path}:`,\n          error instanceof Error ? error.message : error,\n        );\n      }\n      continue;\n    }\n\n    Object.assign(\n      plugins,\n      await scanPluginsDirRecursive(pluginDir, cwd, allowJsManifest, depth + 1),\n    );\n  }\n\n  return plugins;\n}\n\n/**\n * Scan a directory for plugin manifests in direct subdirectories only.\n * Each subdirectory may contain manifest.json or manifest.js.\n * Used with --plugins-dir to discover plugins from source instead of node_modules.\n *\n * @param dir - Absolute path to the directory containing plugin subdirectories\n * @param packageName - Package name to assign to discovered plugins (used when cwd is not set)\n * @param cwd - When set, each plugin's package is set to ./<path from cwd to plugin subdir>, e.g. ./server/my-plugin\n * @returns Map of plugin name to template plugin entry\n */\nasync function scanPluginsDir(\n  dir: string,\n  packageName: string,\n  allowJsManifest: boolean,\n  cwd?: string,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (!fs.existsSync(dir)) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const pluginDir = path.join(dir, entry.name);\n    const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });\n    if (!resolved) continue;\n\n    const pkg =\n      cwd !== undefined ? `./${path.relative(cwd, pluginDir)}` : packageName;\n\n    try {\n      const pluginEntry = await loadPluginEntry(resolved, pkg, allowJsManifest);\n      if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Write (or preview) the template plugins manifest to disk.\n */\nfunction writeManifest(\n  outputPath: string,\n  { plugins }: { plugins: TemplatePluginsManifest[\"plugins\"] },\n  options: { write?: boolean; silent?: boolean },\n) {\n  const templateManifest: TemplatePluginsManifest = {\n    $schema:\n      \"https://databricks.github.io/appkit/schemas/template-plugins.schema.json\",\n    version: \"1.0\",\n    plugins,\n  };\n\n  if (options.write) {\n    fs.writeFileSync(\n      outputPath,\n      `${JSON.stringify(templateManifest, null, 2)}\\n`,\n    );\n    if (!options.silent) {\n      console.log(`\\n✓ Wrote ${outputPath}`);\n    }\n  } else if (!options.silent) {\n    console.log(\"\\nTo write the manifest, run:\");\n    console.log(\"  npx appkit plugin sync --write\\n\");\n    console.log(\"Preview:\");\n    console.log(\"─\".repeat(60));\n    console.log(JSON.stringify(templateManifest, null, 2));\n    console.log(\"─\".repeat(60));\n  }\n}\n\n/**\n * Run the plugin sync command.\n * Parses the server entry file to discover which packages to scan for plugin\n * manifests, then marks plugins that are actually used in the `plugins: [...]`\n * array as requiredByTemplate.\n */\nasync function runPluginsSync(options: {\n  write?: boolean;\n  output?: string;\n  silent?: boolean;\n  requirePlugins?: string;\n  pluginsDir?: string;\n  packageName?: string;\n  localPluginsDir?: string;\n  allowJsManifest?: boolean;\n}): Promise<void> {\n  const cwd = process.cwd();\n  const allowJsManifest = Boolean(options.allowJsManifest);\n  const outputPath = path.resolve(cwd, options.output || \"appkit.plugins.json\");\n\n  // Security: Reject output paths that escape the project root\n  if (!isWithinDirectory(outputPath, cwd)) {\n    console.error(\n      `Error: Output path \"${options.output}\" resolves outside the project directory.`,\n    );\n    process.exit(1);\n  }\n\n  if (!options.silent) {\n    console.log(\"Scanning for AppKit plugins...\\n\");\n    if (allowJsManifest) {\n      console.warn(\n        \"Warning: --allow-js-manifest executes manifest.js/manifest.cjs files. Only use with trusted code.\",\n      );\n    }\n  }\n\n  // Step 1: Parse server file to discover imports and plugin usages\n  const serverFile = findServerFile(cwd);\n  let serverImports: ParsedImport[] = [];\n  let pluginUsages = new Set<string>();\n\n  if (serverFile) {\n    if (!options.silent) {\n      const relativePath = path.relative(cwd, serverFile);\n      console.log(`Server entry file: ${relativePath}`);\n    }\n\n    const content = fs.readFileSync(serverFile, \"utf-8\");\n    const lang = serverFile.endsWith(\".tsx\") ? Lang.Tsx : Lang.TypeScript;\n    const ast = parse(lang, content);\n    const root = ast.root();\n\n    serverImports = parseImports(root);\n    pluginUsages = parsePluginUsages(root);\n  } else if (!options.silent) {\n    console.log(\n      \"No server entry file found. Checked:\",\n      SERVER_FILE_CANDIDATES.join(\", \"),\n    );\n  }\n\n  // Step 2: Split imports into npm packages and local (relative) imports\n  const npmImports = serverImports.filter(\n    (i) => !i.source.startsWith(\".\") && !i.source.startsWith(\"/\"),\n  );\n  const localImports = serverImports.filter(\n    (i) => i.source.startsWith(\".\") || i.source.startsWith(\"/\"),\n  );\n\n  // Step 3: Scan for plugin manifests (--plugins-dir or node_modules)\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (options.pluginsDir) {\n    const resolvedDir = path.resolve(cwd, options.pluginsDir);\n    const pkgName = options.packageName ?? \"@databricks/appkit\";\n    if (!options.silent) {\n      console.log(`Scanning plugins directory: ${options.pluginsDir}`);\n    }\n    Object.assign(\n      plugins,\n      await scanPluginsDir(resolvedDir, pkgName, allowJsManifest),\n    );\n  } else {\n    const npmPackages = new Set([\n      ...KNOWN_PLUGIN_PACKAGES,\n      ...npmImports.map((i) => i.source),\n    ]);\n    Object.assign(\n      plugins,\n      await scanForPlugins(cwd, npmPackages, allowJsManifest),\n    );\n  }\n\n  // Step 4: Discover local plugin manifests from relative imports\n  if (serverFile && localImports.length > 0) {\n    const serverFileDir = path.dirname(serverFile);\n    const localPlugins = await discoverLocalPlugins(\n      localImports,\n      serverFileDir,\n      cwd,\n      allowJsManifest,\n    );\n    Object.assign(plugins, localPlugins);\n  }\n\n  // Step 4b: Discover local plugins from conventional directory (or --local-plugins-dir).\n  // These are included even when not imported in the server.\n  const localDirsToScan: string[] = options.localPluginsDir\n    ? [options.localPluginsDir]\n    : CONVENTIONAL_LOCAL_PLUGIN_DIRS.filter((d) =>\n        fs.existsSync(path.join(cwd, d)),\n      );\n  for (const dir of localDirsToScan) {\n    const resolvedDir = path.resolve(cwd, dir);\n    if (!fs.existsSync(resolvedDir)) continue;\n    if (!options.silent) {\n      console.log(`Scanning local plugins directory: ${dir}`);\n    }\n    const discovered = await scanPluginsDirRecursive(\n      resolvedDir,\n      cwd,\n      allowJsManifest,\n    );\n    for (const [name, entry] of Object.entries(discovered)) {\n      if (!plugins[name]) plugins[name] = entry;\n    }\n  }\n\n  const pluginCount = Object.keys(plugins).length;\n\n  if (pluginCount === 0) {\n    if (options.silent) {\n      writeManifest(outputPath, { plugins: {} }, options);\n      return;\n    }\n    console.log(\"No plugins found.\");\n    if (options.pluginsDir) {\n      console.log(\n        `\\nNo manifest (${allowJsManifest ? \"manifest.json or manifest.js\" : \"manifest.json\"}) found in: ${options.pluginsDir}`,\n      );\n    } else {\n      console.log(\"\\nMake sure you have plugin packages installed.\");\n    }\n    process.exit(1);\n  }\n\n  // Step 5: Mark plugins that are imported AND used in the plugins array as mandatory.\n  // For npm imports, match by package name + plugin name.\n  // For local imports, resolve both paths to absolute and compare.\n  const serverFileDir = serverFile ? path.dirname(serverFile) : cwd;\n\n  for (const imp of serverImports) {\n    if (!pluginUsages.has(imp.name)) continue;\n\n    const isLocal = imp.source.startsWith(\".\") || imp.source.startsWith(\"/\");\n    let plugin: TemplatePlugin | undefined;\n\n    if (isLocal) {\n      // Resolve the import source to an absolute path from the server file directory\n      const resolvedImportDir = path.resolve(serverFileDir, imp.source);\n      plugin = Object.values(plugins).find((p) => {\n        if (!p.package.startsWith(\".\")) return false;\n        const resolvedPluginDir = path.resolve(cwd, p.package);\n        return (\n          resolvedPluginDir === resolvedImportDir && p.name === imp.originalName\n        );\n      });\n    } else {\n      // npm import: direct string comparison\n      plugin = Object.values(plugins).find(\n        (p) => p.package === imp.source && p.name === imp.originalName,\n      );\n    }\n\n    if (plugin) {\n      plugin.requiredByTemplate = true;\n    }\n  }\n\n  // Step 6: Apply explicit --require-plugins overrides\n  if (options.requirePlugins) {\n    const explicitNames = options.requirePlugins\n      .split(\",\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n    for (const name of explicitNames) {\n      if (plugins[name]) {\n        plugins[name].requiredByTemplate = true;\n      } else if (!options.silent) {\n        console.warn(\n          `Warning: --require-plugins referenced \"${name}\" but no such plugin was discovered`,\n        );\n      }\n    }\n  }\n\n  if (!options.silent) {\n    console.log(`\\nFound ${pluginCount} plugin(s):`);\n    for (const [name, manifest] of Object.entries(plugins)) {\n      const resourceCount =\n        manifest.resources.required.length + manifest.resources.optional.length;\n      const resourceInfo =\n        resourceCount > 0 ? ` [${resourceCount} resource(s)]` : \"\";\n      const mandatoryTag = manifest.requiredByTemplate ? \" (mandatory)\" : \"\";\n      console.log(\n        `  ${manifest.requiredByTemplate ? \"●\" : \"○\"} ${manifest.displayName} (${name}) from ${manifest.package}${resourceInfo}${mandatoryTag}`,\n      );\n    }\n  }\n\n  writeManifest(outputPath, { plugins }, options);\n}\n\n/** Exported for testing: path boundary check, AST parsing, trust checks. */\nexport {\n  isWithinDirectory,\n  parseImports,\n  parsePluginUsages,\n  shouldAllowJsManifestForPackage,\n};\n\nexport const pluginsSyncCommand = new Command(\"sync\")\n  .description(\n    \"Sync plugin manifests from installed packages into appkit.plugins.json\",\n  )\n  .option(\"-w, --write\", \"Write the manifest file\")\n  .option(\n    \"-o, --output <path>\",\n    \"Output file path (default: ./appkit.plugins.json)\",\n  )\n  .option(\n    \"-s, --silent\",\n    \"Suppress output and never exit with error (for use in predev/prebuild hooks)\",\n  )\n  .option(\n    \"--require-plugins <names>\",\n    \"Comma-separated plugin names to mark as requiredByTemplate (e.g. server,analytics)\",\n  )\n  .option(\n    \"--plugins-dir <path>\",\n    \"Scan this directory for plugin subdirectories with manifest.json (instead of node_modules)\",\n  )\n  .option(\n    \"--package-name <name>\",\n    \"Package name to assign to plugins found via --plugins-dir (default: @databricks/appkit)\",\n  )\n  .option(\n    \"--local-plugins-dir <path>\",\n    \"Also scan this directory for local plugin manifests (default: plugins, server)\",\n  )\n  .option(\n    \"--allow-js-manifest\",\n    \"Allow reading manifest.js/manifest.cjs (executes code; use only with trusted plugins)\",\n  )\n  .action((opts) =>\n    runPluginsSync(opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,SAAS,kBAAkB,UAAkB,UAA2B;CACtE,MAAM,eAAe,KAAK,QAAQ,SAAS;CAC3C,MAAM,mBAAmB,KAAK,QAAQ,SAAS;AAE/C,QACE,iBAAiB,oBACjB,aAAa,WAAW,GAAG,mBAAmB,KAAK,MAAM;;;;;;AAQ7D,SAAS,2BACP,KACA,YACuB;CACvB,MAAM,SAAS,iBAAiB,IAAI;AACpC,KAAI,OAAO,SAAS,OAAO,SAAU,QAAO,OAAO;AACnD,KAAI,OAAO,QAAQ,OACjB,SAAQ,KACN,wBAAwB,WAAW,8BAA8B,uBAAuB,OAAO,QAAQ,IAAI,GAC5G;AAEH,QAAO;;;AAIT,MAAM,iBAAiB;;;;;;AAOvB,eAAe,gBACb,UACA,KACA,iBAC0C;CAI1C,MAAM,WAAW,2BAHF,MAAM,qBAAqB,SAAS,MAAM,SAAS,MAAM,EACtE,iBACD,CAAC,EACkD,SAAS,KAAK;AAClE,KAAI,CAAC,YAAY,SAAS,OAAQ,QAAO;AAEzC,QAAO,CACL,SAAS,MACT;EACE,MAAM,SAAS;EACf,aAAa,SAAS;EACtB,aAAa,SAAS;EACtB,SAAS;EACT,WAAW,SAAS;EACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;EACF,CACF;;;;;;AAOH,MAAM,wBAAwB,CAAC,qBAAqB;;;;;AAMpD,MAAM,yBAAyB,CAAC,oBAAoB,kBAAkB;;;;;;AAOtE,MAAM,iCAAiC,CAAC,WAAW,SAAS;;;;;;;AAQ5D,SAAS,eAAe,KAA4B;AAClD,MAAK,MAAM,aAAa,wBAAwB;EAC9C,MAAM,WAAW,KAAK,KAAK,KAAK,UAAU;AAC1C,MAAI,GAAG,WAAW,SAAS,CACzB,QAAO;;AAGX,QAAO;;;;;;;;;AAsBT,SAAS,aAAa,MAA8B;CAClD,MAAM,UAA0B,EAAE;CAGlC,MAAM,mBAAmB,KAAK,QAAQ,EACpC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,MAAK,MAAM,QAAQ,kBAAkB;EAEnC,MAAM,aAAa,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,EAAE,CAAC;AAC1D,MAAI,CAAC,WAAY;EAGjB,MAAM,SAAS,WAAW,MAAM,CAAC,QAAQ,gBAAgB,GAAG;EAG5D,MAAM,eAAe,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,EAAE,CAAC;AACnE,MAAI,CAAC,aAAc;EAGnB,MAAM,aAAa,aAAa,QAAQ,EACtC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,OAAK,MAAM,aAAa,YAAY;GAClC,MAAM,WAAW,UAAU,UAAU;AACrC,OAAI,SAAS,UAAU,GAAG;IAExB,MAAM,eAAe,SAAS,GAAG,MAAM;IACvC,MAAM,YAAY,SAAS,SAAS,SAAS,GAAG,MAAM;AACtD,YAAQ,KAAK;KAAE,MAAM;KAAW;KAAc;KAAQ,CAAC;UAClD;IAEL,MAAM,OAAO,UAAU,MAAM;AAC7B,YAAQ,KAAK;KAAE;KAAM,cAAc;KAAM;KAAQ,CAAC;;;;AAKxD,QAAO;;;;;;;;;;AAWT,SAAS,kBAAkB,MAA2B;CACpD,MAAM,4BAAY,IAAI,KAAa;CAGnC,MAAM,QAAQ,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,EAAE,CAAC;AAEtD,MAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,MAAM,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,EAAE,CAAC;AAChE,MAAI,CAAC,OAAO,IAAI,MAAM,KAAK,UAAW;EAGtC,MAAM,YAAY,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,CAAC;AACxD,MAAI,CAAC,UAAW;AAGhB,OAAK,MAAM,SAAS,UAAU,UAAU,CACtC,KAAI,MAAM,MAAM,KAAK,mBAAmB;GAEtC,MAAM,SAAS,MAAM,UAAU,CAAC;AAChC,OAAI,QAAQ,MAAM,KAAK,aACrB,WAAU,IAAI,OAAO,MAAM,CAAC;;;AAMpC,QAAO;;;;;AAMT,MAAM,qBAAqB;CAAC;CAAO;CAAQ;CAAO;CAAO;;;;;;;;;;;;;;;AAgBzD,SAAS,qBACP,cACA,eACA,iBACA,aACyB;CACzB,MAAM,WAAW,KAAK,QAAQ,eAAe,aAAa;CAG1D,MAAM,WAAW,eAAe;AAChC,KAAI,CAAC,kBAAkB,UAAU,SAAS,EAAE;AAC1C,UAAQ,KACN,6BAA6B,aAAa,4CAC3C;AACD,SAAO;;AAIT,KAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,aAAa,CAChE,QAAO,qBAAqB,UAAU,EAAE,iBAAiB,CAAC;AAI5D,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,WAAW,GAAG,WAAW;AAC/B,MAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,QAAQ,EAAE;GAC7D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,OAAI,CAAC,kBAAkB,KAAK,SAAS,CAAE,QAAO;AAC9C,UAAO,qBAAqB,KAAK,EAAE,iBAAiB,CAAC;;;AAKzD,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,YAAY,KAAK,KAAK,UAAU,QAAQ,MAAM;AACpD,MAAI,GAAG,WAAW,UAAU,CAC1B,QAAO,qBAAqB,UAAU,EAAE,iBAAiB,CAAC;;AAI9D,QAAO;;;;;;;;;;;AAYT,eAAe,qBACb,iBACA,eACA,KACA,iBAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,WAAW,qBACf,IAAI,QACJ,eACA,iBACA,IACD;AACD,MAAI,CAAC,SAAU;AAEf,MAAI;GAEF,MAAM,QAAQ,MAAM,gBAClB,UACA,KAHmB,KAAK,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK,CAAC,IAIlE,gBACD;AACD,OAAI,MAAO,SAAQ,MAAM,MAAM,MAAM;WAC9B,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,eAAe,wBACb,aACA,iBAC2B;CAC3B,MAAM,aAAa,KAAK,KAAK,aAAa,QAAQ,UAAU;CAC5D,MAAM,YAA8B,EAAE;AAEtC,KAAI,CAAC,GAAG,WAAW,WAAW,CAC5B,QAAO;CAGT,MAAM,UAAU,GAAG,YAAY,YAAY,EAAE,eAAe,MAAM,CAAC;AACnE,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAC1B,MAAM,WAAW,qBAAqB,KAAK,KAAK,YAAY,MAAM,KAAK,EAAE,EACvE,iBACD,CAAC;AACF,MAAI,CAAC,SAAU;AAEf,MAAI;GAIF,MAAM,WAAW,2BAHF,MAAM,qBAAqB,SAAS,MAAM,SAAS,MAAM,EACtE,iBACD,CAAC,EACkD,SAAS,KAAK;AAClE,OAAI,SACF,WAAU,KAAK,SAAS;WAEnB,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,eAAe,eACb,KACA,UACA,iBAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,eAAe,UAAU;EAClC,MAAM,cAAc,KAAK,KAAK,KAAK,gBAAgB,YAAY;AAC/D,MAAI,CAAC,GAAG,WAAW,YAAY,CAC7B;EAMF,MAAM,YAAY,MAAM,wBACtB,aAHA,mBAAmB,gCAAgC,YAAY,CAKhE;AACD,OAAK,MAAM,YAAY,WAAW;AAChC,OAAI,SAAS,OAAQ;AACrB,WAAQ,SAAS,QAAQ;IACvB,MAAM,SAAS;IACf,aAAa,SAAS;IACtB,aAAa,SAAS;IACtB,SAAS;IACT,WAAW,SAAS;IACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;IACF;;;AAIL,QAAO;;;;;;;;AAST,eAAe,wBACb,KACA,KACA,iBACA,QAAQ,GACqC;CAC7C,MAAM,UAA8C,EAAE;AACtD,KAAI,CAAC,GAAG,WAAW,IAAI,IAAI,SAAS,eAAgB,QAAO;CAE3D,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,CAAC;AAErE,MAAI,UAAU;GACZ,MAAM,MAAM,KAAK,KAAK,SAAS,KAAK,UAAU;AAC9C,OAAI;IACF,MAAM,cAAc,MAAM,gBACxB,UACA,KACA,gBACD;AACD,QAAI,YAAa,SAAQ,YAAY,MAAM,YAAY;YAChD,OAAO;AACd,YAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;AAEH;;AAGF,SAAO,OACL,SACA,MAAM,wBAAwB,WAAW,KAAK,iBAAiB,QAAQ,EAAE,CAC1E;;AAGH,QAAO;;;;;;;;;;;;AAaT,eAAe,eACb,KACA,aACA,iBACA,KAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,KAAI,CAAC,GAAG,WAAW,IAAI,CAAE,QAAO;CAEhC,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,CAAC;AACrE,MAAI,CAAC,SAAU;EAEf,MAAM,MACJ,QAAQ,SAAY,KAAK,KAAK,SAAS,KAAK,UAAU,KAAK;AAE7D,MAAI;GACF,MAAM,cAAc,MAAM,gBAAgB,UAAU,KAAK,gBAAgB;AACzE,OAAI,YAAa,SAAQ,YAAY,MAAM,YAAY;WAChD,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;AAMT,SAAS,cACP,YACA,EAAE,WACF,SACA;CACA,MAAM,mBAA4C;EAChD,SACE;EACF,SAAS;EACT;EACD;AAED,KAAI,QAAQ,OAAO;AACjB,KAAG,cACD,YACA,GAAG,KAAK,UAAU,kBAAkB,MAAM,EAAE,CAAC,IAC9C;AACD,MAAI,CAAC,QAAQ,OACX,SAAQ,IAAI,aAAa,aAAa;YAE/B,CAAC,QAAQ,QAAQ;AAC1B,UAAQ,IAAI,gCAAgC;AAC5C,UAAQ,IAAI,qCAAqC;AACjD,UAAQ,IAAI,WAAW;AACvB,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;AAC3B,UAAQ,IAAI,KAAK,UAAU,kBAAkB,MAAM,EAAE,CAAC;AACtD,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;;;;;;;;;AAU/B,eAAe,eAAe,SASZ;CAChB,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,kBAAkB,QAAQ,QAAQ,gBAAgB;CACxD,MAAM,aAAa,KAAK,QAAQ,KAAK,QAAQ,UAAU,sBAAsB;AAG7E,KAAI,CAAC,kBAAkB,YAAY,IAAI,EAAE;AACvC,UAAQ,MACN,uBAAuB,QAAQ,OAAO,2CACvC;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,CAAC,QAAQ,QAAQ;AACnB,UAAQ,IAAI,mCAAmC;AAC/C,MAAI,gBACF,SAAQ,KACN,oGACD;;CAKL,MAAM,aAAa,eAAe,IAAI;CACtC,IAAI,gBAAgC,EAAE;CACtC,IAAI,+BAAe,IAAI,KAAa;AAEpC,KAAI,YAAY;AACd,MAAI,CAAC,QAAQ,QAAQ;GACnB,MAAM,eAAe,KAAK,SAAS,KAAK,WAAW;AACnD,WAAQ,IAAI,sBAAsB,eAAe;;EAGnD,MAAM,UAAU,GAAG,aAAa,YAAY,QAAQ;EAGpD,MAAM,OADM,MADC,WAAW,SAAS,OAAO,GAAG,KAAK,MAAM,KAAK,YACnC,QAAQ,CACf,MAAM;AAEvB,kBAAgB,aAAa,KAAK;AAClC,iBAAe,kBAAkB,KAAK;YAC7B,CAAC,QAAQ,OAClB,SAAQ,IACN,wCACA,uBAAuB,KAAK,KAAK,CAClC;CAIH,MAAM,aAAa,cAAc,QAC9B,MAAM,CAAC,EAAE,OAAO,WAAW,IAAI,IAAI,CAAC,EAAE,OAAO,WAAW,IAAI,CAC9D;CACD,MAAM,eAAe,cAAc,QAChC,MAAM,EAAE,OAAO,WAAW,IAAI,IAAI,EAAE,OAAO,WAAW,IAAI,CAC5D;CAGD,MAAM,UAA8C,EAAE;AAEtD,KAAI,QAAQ,YAAY;EACtB,MAAM,cAAc,KAAK,QAAQ,KAAK,QAAQ,WAAW;EACzD,MAAM,UAAU,QAAQ,eAAe;AACvC,MAAI,CAAC,QAAQ,OACX,SAAQ,IAAI,+BAA+B,QAAQ,aAAa;AAElE,SAAO,OACL,SACA,MAAM,eAAe,aAAa,SAAS,gBAAgB,CAC5D;QACI;EACL,MAAM,cAAc,IAAI,IAAI,CAC1B,GAAG,uBACH,GAAG,WAAW,KAAK,MAAM,EAAE,OAAO,CACnC,CAAC;AACF,SAAO,OACL,SACA,MAAM,eAAe,KAAK,aAAa,gBAAgB,CACxD;;AAIH,KAAI,cAAc,aAAa,SAAS,GAAG;EAEzC,MAAM,eAAe,MAAM,qBACzB,cAFoB,KAAK,QAAQ,WAAW,EAI5C,KACA,gBACD;AACD,SAAO,OAAO,SAAS,aAAa;;CAKtC,MAAM,kBAA4B,QAAQ,kBACtC,CAAC,QAAQ,gBAAgB,GACzB,+BAA+B,QAAQ,MACrC,GAAG,WAAW,KAAK,KAAK,KAAK,EAAE,CAAC,CACjC;AACL,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,cAAc,KAAK,QAAQ,KAAK,IAAI;AAC1C,MAAI,CAAC,GAAG,WAAW,YAAY,CAAE;AACjC,MAAI,CAAC,QAAQ,OACX,SAAQ,IAAI,qCAAqC,MAAM;EAEzD,MAAM,aAAa,MAAM,wBACvB,aACA,KACA,gBACD;AACD,OAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,WAAW,CACpD,KAAI,CAAC,QAAQ,MAAO,SAAQ,QAAQ;;CAIxC,MAAM,cAAc,OAAO,KAAK,QAAQ,CAAC;AAEzC,KAAI,gBAAgB,GAAG;AACrB,MAAI,QAAQ,QAAQ;AAClB,iBAAc,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ;AACnD;;AAEF,UAAQ,IAAI,oBAAoB;AAChC,MAAI,QAAQ,WACV,SAAQ,IACN,kBAAkB,kBAAkB,iCAAiC,gBAAgB,cAAc,QAAQ,aAC5G;MAED,SAAQ,IAAI,kDAAkD;AAEhE,UAAQ,KAAK,EAAE;;CAMjB,MAAM,gBAAgB,aAAa,KAAK,QAAQ,WAAW,GAAG;AAE9D,MAAK,MAAM,OAAO,eAAe;AAC/B,MAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAAE;EAEjC,MAAM,UAAU,IAAI,OAAO,WAAW,IAAI,IAAI,IAAI,OAAO,WAAW,IAAI;EACxE,IAAI;AAEJ,MAAI,SAAS;GAEX,MAAM,oBAAoB,KAAK,QAAQ,eAAe,IAAI,OAAO;AACjE,YAAS,OAAO,OAAO,QAAQ,CAAC,MAAM,MAAM;AAC1C,QAAI,CAAC,EAAE,QAAQ,WAAW,IAAI,CAAE,QAAO;AAEvC,WAD0B,KAAK,QAAQ,KAAK,EAAE,QAAQ,KAE9B,qBAAqB,EAAE,SAAS,IAAI;KAE5D;QAGF,UAAS,OAAO,OAAO,QAAQ,CAAC,MAC7B,MAAM,EAAE,YAAY,IAAI,UAAU,EAAE,SAAS,IAAI,aACnD;AAGH,MAAI,OACF,QAAO,qBAAqB;;AAKhC,KAAI,QAAQ,gBAAgB;EAC1B,MAAM,gBAAgB,QAAQ,eAC3B,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,OAAO,QAAQ;AAClB,OAAK,MAAM,QAAQ,cACjB,KAAI,QAAQ,MACV,SAAQ,MAAM,qBAAqB;WAC1B,CAAC,QAAQ,OAClB,SAAQ,KACN,0CAA0C,KAAK,qCAChD;;AAKP,KAAI,CAAC,QAAQ,QAAQ;AACnB,UAAQ,IAAI,WAAW,YAAY,aAAa;AAChD,OAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,EAAE;GACtD,MAAM,gBACJ,SAAS,UAAU,SAAS,SAAS,SAAS,UAAU,SAAS;GACnE,MAAM,eACJ,gBAAgB,IAAI,KAAK,cAAc,iBAAiB;GAC1D,MAAM,eAAe,SAAS,qBAAqB,iBAAiB;AACpE,WAAQ,IACN,KAAK,SAAS,qBAAqB,MAAM,IAAI,GAAG,SAAS,YAAY,IAAI,KAAK,SAAS,SAAS,UAAU,eAAe,eAC1H;;;AAIL,eAAc,YAAY,EAAE,SAAS,EAAE,QAAQ;;AAWjD,MAAa,qBAAqB,IAAI,QAAQ,OAAO,CAClD,YACC,yEACD,CACA,OAAO,eAAe,0BAA0B,CAChD,OACC,uBACA,oDACD,CACA,OACC,gBACA,+EACD,CACA,OACC,6BACA,qFACD,CACA,OACC,wBACA,6FACD,CACA,OACC,yBACA,0FACD,CACA,OACC,8BACA,iFACD,CACA,OACC,uBACA,wFACD,CACA,QAAQ,SACP,eAAe,KAAK,CAAC,OAAO,QAAQ;AAClC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}

package/dist/cli/commands/plugin/trusted-js-manifest.js

@@ -0,0 +1,28 @@
+import path from "node:path";
+
+//#region src/cli/commands/plugin/trusted-js-manifest.ts
+const TRUSTED_JS_MANIFEST_PACKAGE_PREFIXES = ["@databricks/"];
+function shouldAllowJsManifestForPackage(packageName) {
+	return TRUSTED_JS_MANIFEST_PACKAGE_PREFIXES.some((prefix) => packageName.startsWith(prefix));
+}
+function getNodeModulesPackageName(filePath) {
+	const parts = path.resolve(filePath).split(path.sep).filter(Boolean);
+	const nodeModulesIndex = parts.lastIndexOf("node_modules");
+	if (nodeModulesIndex === -1 || nodeModulesIndex + 1 >= parts.length) return null;
+	const maybeScope = parts[nodeModulesIndex + 1];
+	if (maybeScope.startsWith("@")) {
+		const packageName = parts[nodeModulesIndex + 2];
+		if (!packageName) return null;
+		return `${maybeScope}/${packageName}`;
+	}
+	return maybeScope;
+}
+function shouldAllowJsManifestForDir(dirPath) {
+	const packageName = getNodeModulesPackageName(dirPath);
+	if (!packageName) return false;
+	return shouldAllowJsManifestForPackage(packageName);
+}
+
+//#endregion
+export { shouldAllowJsManifestForDir, shouldAllowJsManifestForPackage };
+//# sourceMappingURL=trusted-js-manifest.js.map

package/dist/cli/commands/plugin/trusted-js-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-js-manifest.js","names":[],"sources":["../../../../src/cli/commands/plugin/trusted-js-manifest.ts"],"sourcesContent":["import path from \"node:path\";\n\nexport const TRUSTED_JS_MANIFEST_PACKAGE_PREFIXES = [\"@databricks/\"];\n\nexport function shouldAllowJsManifestForPackage(packageName: string): boolean {\n  return TRUSTED_JS_MANIFEST_PACKAGE_PREFIXES.some((prefix) =>\n    packageName.startsWith(prefix),\n  );\n}\n\nexport function getNodeModulesPackageName(filePath: string): string | null {\n  const parts = path.resolve(filePath).split(path.sep).filter(Boolean);\n  const nodeModulesIndex = parts.lastIndexOf(\"node_modules\");\n  if (nodeModulesIndex === -1 || nodeModulesIndex + 1 >= parts.length) {\n    return null;\n  }\n\n  const maybeScope = parts[nodeModulesIndex + 1];\n  if (maybeScope.startsWith(\"@\")) {\n    const packageName = parts[nodeModulesIndex + 2];\n    if (!packageName) return null;\n    return `${maybeScope}/${packageName}`;\n  }\n\n  return maybeScope;\n}\n\nexport function shouldAllowJsManifestForDir(dirPath: string): boolean {\n  const packageName = getNodeModulesPackageName(dirPath);\n  if (!packageName) return false;\n  return shouldAllowJsManifestForPackage(packageName);\n}\n"],"mappings":";;;AAEA,MAAa,uCAAuC,CAAC,eAAe;AAEpE,SAAgB,gCAAgC,aAA8B;AAC5E,QAAO,qCAAqC,MAAM,WAChD,YAAY,WAAW,OAAO,CAC/B;;AAGH,SAAgB,0BAA0B,UAAiC;CACzE,MAAM,QAAQ,KAAK,QAAQ,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,QAAQ;CACpE,MAAM,mBAAmB,MAAM,YAAY,eAAe;AAC1D,KAAI,qBAAqB,MAAM,mBAAmB,KAAK,MAAM,OAC3D,QAAO;CAGT,MAAM,aAAa,MAAM,mBAAmB;AAC5C,KAAI,WAAW,WAAW,IAAI,EAAE;EAC9B,MAAM,cAAc,MAAM,mBAAmB;AAC7C,MAAI,CAAC,YAAa,QAAO;AACzB,SAAO,GAAG,WAAW,GAAG;;AAG1B,QAAO;;AAGT,SAAgB,4BAA4B,SAA0B;CACpE,MAAM,cAAc,0BAA0B,QAAQ;AACtD,KAAI,CAAC,YAAa,QAAO;AACzB,QAAO,gCAAgC,YAAY"}

package/dist/cli/commands/plugin/validate/validate.js

@@ -1,3 +1,4 @@
+import { loadManifestFromFile, resolveManifestInDir } from "../manifest-resolve.js";
 import { detectSchemaType, formatValidationErrors, validateManifest, validateTemplateManifest } from "./validate-manifest.js";
 import fs from "node:fs";
 import path from "node:path";
@@ -5,7 +6,7 @@ import { Command } from "commander";
 import process from "node:process";
 
 //#region src/cli/commands/plugin/validate/validate.ts
-function resolveManifestPaths(paths, cwd) {
+function resolveManifestPaths(paths, cwd, allowJsManifest) {
 	const out = [];
 	for (const p of paths) {
 		const resolved = path.resolve(cwd, p);
@@ -14,35 +15,49 @@ function resolveManifestPaths(paths, cwd) {
 			continue;
 		}
 		if (fs.statSync(resolved).isDirectory()) {
-			const pluginManifest = path.join(resolved, "manifest.json");
-			const templateManifest = path.join(resolved, "appkit.plugins.json");
 			let found = false;
-			if (fs.existsSync(pluginManifest)) {
-				out.push(pluginManifest);
+			const pluginResolved = resolveManifestInDir(resolved, { allowJsManifest });
+			if (pluginResolved) {
+				out.push(pluginResolved);
 				found = true;
 			}
+			const templateManifest = path.join(resolved, "appkit.plugins.json");
 			if (fs.existsSync(templateManifest)) {
-				out.push(templateManifest);
+				out.push({
+					path: templateManifest,
+					type: "json"
+				});
 				found = true;
 			}
-			if (!found) console.error(`No manifest.json or appkit.plugins.json in directory: ${p}`);
-		} else out.push(resolved);
+			if (!found) console.error(`No ${allowJsManifest ? "manifest.json, manifest.js, or" : "manifest.json or"} appkit.plugins.json in directory: ${p}`);
+		} else {
+			const ext = path.extname(resolved).toLowerCase();
+			if (!allowJsManifest && (ext === ".js" || ext === ".cjs")) {
+				console.error(`JS manifest provided but disabled by default: ${p}. Re-run with --allow-js-manifest to opt in.`);
+				continue;
+			}
+			out.push({
+				path: resolved,
+				type: ext === ".js" || ext === ".cjs" ? "js" : "json"
+			});
+		}
 	}
 	return out;
 }
-function runPluginValidate(paths) {
+async function runPluginValidate(paths, options) {
 	const cwd = process.cwd();
-	const manifestPaths = resolveManifestPaths(paths.length > 0 ? paths : ["."], cwd);
+	const allowJsManifest = Boolean(options.allowJsManifest);
+	if (allowJsManifest) console.warn("Warning: --allow-js-manifest executes manifest.js/manifest.cjs files. Only use with trusted code.");
+	const manifestPaths = resolveManifestPaths(paths.length > 0 ? paths : ["."], cwd, allowJsManifest);
 	if (manifestPaths.length === 0) {
 		console.error("No manifest files to validate.");
 		process.exit(1);
 	}
 	let hasFailure = false;
-	for (const manifestPath of manifestPaths) {
+	for (const { path: manifestPath, type } of manifestPaths) {
 		let obj;
 		try {
-			const raw = fs.readFileSync(manifestPath, "utf-8");
-			obj = JSON.parse(raw);
+			obj = await loadManifestFromFile(manifestPath, type, { allowJsManifest });
 		} catch (err) {
 			console.error(`✗ ${manifestPath}`);
 			console.error(`  ${err instanceof Error ? err.message : String(err)}`);
@@ -60,7 +75,10 @@ function runPluginValidate(paths) {
 	}
 	process.exit(hasFailure ? 1 : 0);
 }
-const pluginValidateCommand = new Command("validate").description("Validate plugin manifest(s) or template manifests against their JSON schema").argument("[paths...]", "Paths to manifest.json, appkit.plugins.json, or plugin directories (default: .)").action(runPluginValidate);
+const pluginValidateCommand = new Command("validate").description("Validate plugin manifest(s) or template manifests against their JSON schema").argument("[paths...]", "Paths to manifest.json or appkit.plugins.json (or plugin directories); use --allow-js-manifest to include manifest.js").option("--allow-js-manifest", "Allow reading manifest.js/manifest.cjs (executes code; use only with trusted plugins)").action((paths, opts) => runPluginValidate(paths, opts).catch((err) => {
+	console.error(err);
+	process.exit(1);
+}));
 
 //#endregion
 export { pluginValidateCommand };