@databricks/appkit-ui 0.36.0 → 0.38.0

package/CLAUDE.md

@@ -52,6 +52,7 @@ npx @databricks/appkit docs <query>
 - [Genie plugin](./docs/plugins/genie.md): Integrates Databricks AI/BI Genie spaces into your AppKit application, enabling natural language data queries via a conversational interface.
 - [Jobs plugin](./docs/plugins/jobs.md): Trigger and monitor Databricks Lakeflow Jobs from your AppKit application.
 - [Lakebase plugin](./docs/plugins/lakebase.md): Provides a PostgreSQL connection pool for Databricks Lakebase Autoscaling with automatic OAuth token refresh.
+- [Plugin manifest](./docs/plugins/manifest.md): Every plugin ships a manifest.json next to its source code. The manifest declares plugin metadata, the Databricks resources the plugin needs, and any structured rules a scaffolding agent must honor when running databricks apps init. It is consumed at three stages:
 - [Model Serving plugin](./docs/plugins/model-serving.md): Provides an authenticated proxy to Databricks Model Serving endpoints, with invoke and streaming support.
 - [Plugin management](./docs/plugins/plugin-management.md): AppKit includes a CLI for managing plugins. All commands are available under npx @databricks/appkit plugin.
 - [Server plugin](./docs/plugins/server.md): Provides HTTP server capabilities with development and production modes.
@@ -76,7 +77,7 @@ npx @databricks/appkit docs <query>
 - [Class: TunnelError](./docs/api/appkit/Class.TunnelError.md): Error thrown when remote tunnel operations fail.
 - [Class: ValidationError](./docs/api/appkit/Class.ValidationError.md): Error thrown when input validation fails.
 - [Enumeration: RequestedClaimsPermissionSet](./docs/api/appkit/Enumeration.RequestedClaimsPermissionSet.md): Permission set for Unity Catalog table access
-- [Enumeration: ResourceType](./docs/api/appkit/Enumeration.ResourceType.md): Resource types from schema $defs.resourceType.enum
+- [Enumeration: ResourceType](./docs/api/appkit/Enumeration.ResourceType.md): Resource types from resourceTypeSchema.options
 - [Function: agentIdFromMarkdownPath()](./docs/api/appkit/Function.agentIdFromMarkdownPath.md): Derives the logical agent id from a markdown path. When the file is named
 - [Function: appKitServingTypesPlugin()](./docs/api/appkit/Function.appKitServingTypesPlugin.md): Vite plugin to generate TypeScript types for AppKit serving endpoints.
 - [Function: appKitTypesPlugin()](./docs/api/appkit/Function.appKitTypesPlugin.md): Vite plugin to generate types for AppKit queries.
@@ -141,7 +142,6 @@ npx @databricks/appkit docs <query>
 - [Interface: RequestedClaims](./docs/api/appkit/Interface.RequestedClaims.md): Optional claims for fine-grained Unity Catalog table permissions
 - [Interface: RequestedResource](./docs/api/appkit/Interface.RequestedResource.md): Resource to request permissions for in Unity Catalog
 - [Interface: ResourceEntry](./docs/api/appkit/Interface.ResourceEntry.md): Internal representation of a resource in the registry.
-- [Interface: ResourceFieldEntry](./docs/api/appkit/Interface.ResourceFieldEntry.md): Defines a single field for a resource. Each field has its own environment variable and optional description. Single-value types use one key (e.g. id); multi-value types (database, secret) use multiple (e.g. instancename, databasename or scope, key).
 - [Interface: ResourceRequirement](./docs/api/appkit/Interface.ResourceRequirement.md): Declares a resource requirement for a plugin.
 - [Interface: RunAgentInput](./docs/api/appkit/Interface.RunAgentInput.md): Properties
 - [Interface: RunAgentResult](./docs/api/appkit/Interface.RunAgentResult.md): Properties
@@ -174,6 +174,7 @@ npx @databricks/appkit docs <query>
 - [Type Alias: PluginData<T, U, N>](./docs/api/appkit/TypeAlias.PluginData.md): Tuple of plugin class, config, and name. Created by toPlugin() and passed to createApp().
 - [Type Alias: Plugins](./docs/api/appkit/TypeAlias.Plugins.md): Plugin map passed to the function form of AgentDefinition.tools.
 - [Type Alias: ResolvedToolEntry](./docs/api/appkit/TypeAlias.ResolvedToolEntry.md): Internal tool-index entry after a tool record has been resolved to a dispatchable form.
+- [Type Alias: ResourceFieldEntry](./docs/api/appkit/TypeAlias.ResourceFieldEntry.md)
 - [Type Alias: ResourcePermission](./docs/api/appkit/TypeAlias.ResourcePermission.md): Union of all possible permission levels across all resource types.
 - [Type Alias: ServingFactory](./docs/api/appkit/TypeAlias.ServingFactory.md): Factory function returned by AppKit.serving.
 - [Type Alias: ToolRegistry](./docs/api/appkit/TypeAlias.ToolRegistry.md)

package/NOTICE.md

@@ -68,6 +68,7 @@ This Software contains code from the following open source projects:
 | [input-otp](https://www.npmjs.com/package/input-otp) | 1.4.2 | MIT | https://input-otp.rodz.dev/ |
 | [js-yaml](https://www.npmjs.com/package/js-yaml) | 3.14.2, 4.1.1 | MIT | https://github.com/nodeca/js-yaml#readme |
 | [lucide-react](https://www.npmjs.com/package/lucide-react) | 0.554.0 | ISC | https://lucide.dev |
+| [magic-string](https://www.npmjs.com/package/magic-string) | 0.30.21 | MIT | https://github.com/Rich-Harris/magic-string#readme |
 | [marked](https://www.npmjs.com/package/marked) | 16.4.2, 17.0.3 | MIT | https://marked.js.org |
 | [next-themes](https://www.npmjs.com/package/next-themes) | 0.4.6 | MIT | https://github.com/pacocoursey/next-themes#readme |
 | [obug](https://www.npmjs.com/package/obug) | 2.1.1 | MIT | https://github.com/sxzz/obug#readme |

package/dist/cli/commands/plugin/add-resource/add-resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"add-resource.js","names":[],"sources":["../../../../../src/cli/commands/plugin/add-resource/add-resource.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport process from \"node:process\";\nimport { cancel, intro, outro } from \"@clack/prompts\";\nimport { Command } from \"commander\";\nimport { promptOneResource } from \"../create/prompt-resource\";\nimport {\n  DEFAULT_PERMISSION_BY_TYPE,\n  getDefaultFieldsForType,\n  getValidResourceTypes,\n  humanizeResourceType,\n  resourceKeyFromType,\n} from \"../create/resource-defaults\";\nimport { resolveManifestInDir } from \"../manifest-resolve\";\nimport type { PluginManifest, ResourceRequirement } from \"../manifest-types\";\nimport { validateManifest } from \"../validate/validate-manifest\";\n\n/** Extended manifest type that preserves extra JSON fields (e.g. $schema, author, version) for round-trip writes. */\ninterface ManifestWithExtras extends PluginManifest {\n  [key: string]: unknown;\n}\n\ninterface AddResourceOptions {\n  path?: string;\n  type?: string;\n  required?: boolean;\n  resourceKey?: string;\n  description?: string;\n  permission?: string;\n  fieldsJson?: string;\n  dryRun?: boolean;\n}\n\nfunction loadManifest(\n  pluginDir: string,\n): { manifest: ManifestWithExtras; manifestPath: string } | null {\n  const resolved = resolveManifestInDir(pluginDir, { allowJsManifest: true });\n\n  if (!resolved) {\n    console.error(\n      `No manifest found in ${pluginDir}. This command requires manifest.json (manifest.js cannot be edited in place).`,\n    );\n    console.error(\n      \"  appkit plugin add-resource --path <dir-with-manifest.json>\",\n    );\n    process.exit(1);\n  }\n\n  if (resolved.type !== \"json\") {\n    console.error(\n      `Editable manifest not found. add-resource only supports plugin directories that contain manifest.json (found ${path.basename(resolved.path)}).`,\n    );\n    process.exit(1);\n  }\n\n  const manifestPath = resolved.path;\n\n  try {\n    const raw = fs.readFileSync(manifestPath, \"utf-8\");\n    const parsed = JSON.parse(raw) as unknown;\n    const result = validateManifest(parsed);\n    if (!result.valid || !result.manifest) {\n      console.error(\n        \"Invalid manifest. Run `appkit plugin validate` for details.\",\n      );\n      process.exit(1);\n    }\n    return { manifest: parsed as ManifestWithExtras, manifestPath };\n  } catch (err) {\n    console.error(\n      \"Failed to read or parse manifest.json:\",\n      err instanceof Error ? err.message : err,\n    );\n    process.exit(1);\n  }\n}\n\nfunction buildEntry(\n  type: string,\n  opts: AddResourceOptions,\n): { entry: ResourceRequirement; isRequired: boolean } {\n  const alias = humanizeResourceType(type);\n  const isRequired = opts.required !== false;\n\n  let fields = getDefaultFieldsForType(type);\n  if (opts.fieldsJson) {\n    try {\n      const parsed = JSON.parse(opts.fieldsJson) as Record<\n        string,\n        { env: string; description?: string }\n      >;\n      fields = { ...fields, ...parsed };\n    } catch {\n      console.error(\"Error: --fields-json must be valid JSON.\");\n      console.error(\n        '  Example: --fields-json \\'{\"id\":{\"env\":\"MY_WAREHOUSE_ID\"}}\\'',\n      );\n      process.exit(1);\n    }\n  }\n\n  const entry: ResourceRequirement = {\n    type: type as ResourceRequirement[\"type\"],\n    alias,\n    resourceKey: opts.resourceKey ?? resourceKeyFromType(type),\n    description:\n      opts.description ||\n      `${isRequired ? \"Required\" : \"Optional\"} for ${alias} functionality.`,\n    permission:\n      opts.permission ?? DEFAULT_PERMISSION_BY_TYPE[type] ?? \"CAN_VIEW\",\n    fields,\n  };\n\n  return { entry, isRequired };\n}\n\nfunction runNonInteractive(opts: AddResourceOptions): void {\n  const cwd = process.cwd();\n  const pluginDir = path.resolve(cwd, opts.path ?? \".\");\n  const loaded = loadManifest(pluginDir);\n  if (!loaded) return;\n  const { manifest, manifestPath } = loaded;\n\n  const type = opts.type as string;\n  const validTypes = getValidResourceTypes();\n  if (!validTypes.includes(type)) {\n    console.error(`Error: Unknown resource type \"${type}\".`);\n    console.error(`  Valid types: ${validTypes.join(\", \")}`);\n    process.exit(1);\n  }\n  const { entry, isRequired } = buildEntry(type, opts);\n\n  if (isRequired) {\n    manifest.resources.required.push(entry);\n  } else {\n    manifest.resources.optional.push(entry);\n  }\n\n  if (opts.dryRun) {\n    console.log(JSON.stringify(manifest, null, 2));\n    return;\n  }\n\n  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\\n`);\n  console.log(\n    `Added ${entry.alias} as ${isRequired ? \"required\" : \"optional\"} to ${path.relative(cwd, manifestPath)}`,\n  );\n}\n\nasync function runInteractive(opts: AddResourceOptions): Promise<void> {\n  intro(\"Add resource to plugin manifest\");\n\n  const cwd = process.cwd();\n  const pluginDir = path.resolve(cwd, opts.path ?? \".\");\n  const loaded = loadManifest(pluginDir);\n  if (!loaded) return;\n  const { manifest, manifestPath } = loaded;\n\n  const spec = await promptOneResource();\n  if (!spec) {\n    cancel(\"Cancelled.\");\n    process.exit(0);\n  }\n\n  const alias = humanizeResourceType(spec.type);\n  const entry: ResourceRequirement = {\n    type: spec.type as ResourceRequirement[\"type\"],\n    alias,\n    resourceKey: spec.resourceKey,\n    description: spec.description || `Required for ${alias} functionality.`,\n    permission: spec.permission,\n    fields: spec.fields,\n  };\n\n  if (spec.required) {\n    manifest.resources.required.push(entry);\n  } else {\n    manifest.resources.optional.push(entry);\n  }\n\n  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\\n`);\n\n  outro(\"Resource added.\");\n  console.log(\n    `\\nAdded ${alias} as ${spec.required ? \"required\" : \"optional\"} to ${path.relative(cwd, manifestPath)}`,\n  );\n}\n\nasync function runPluginAddResource(opts: AddResourceOptions): Promise<void> {\n  if (opts.type) {\n    runNonInteractive(opts);\n  } else {\n    await runInteractive(opts);\n  }\n}\n\nexport const pluginAddResourceCommand = new Command(\"add-resource\")\n  .description(\n    \"Add a resource requirement to an existing plugin manifest. Overwrites manifest.json in place.\",\n  )\n  .option(\n    \"-p, --path <dir>\",\n    \"Plugin directory containing manifest.json (default: .)\",\n  )\n  .option(\n    \"-t, --type <resource_type>\",\n    \"Resource type (e.g. sql_warehouse, volume). Enables non-interactive mode.\",\n  )\n  .option(\"--required\", \"Mark resource as required (default: true)\", true)\n  .option(\"--no-required\", \"Mark resource as optional\")\n  .option(\"--resource-key <key>\", \"Resource key (default: derived from type)\")\n  .option(\"--description <text>\", \"Description of the resource requirement\")\n  .option(\"--permission <perm>\", \"Permission level (default: from schema)\")\n  .option(\n    \"--fields-json <json>\",\n    'JSON object overriding field env vars (e.g. \\'{\"id\":{\"env\":\"MY_WAREHOUSE_ID\"}}\\')',\n  )\n  .option(\"--dry-run\", \"Preview the updated manifest without writing\")\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  $ appkit plugin add-resource\n  $ appkit plugin add-resource --path plugins/my-plugin --type sql_warehouse\n  $ appkit plugin add-resource --path plugins/my-plugin --type volume --no-required --dry-run\n  $ appkit plugin add-resource --type sql_warehouse --fields-json '{\"id\":{\"env\":\"MY_WAREHOUSE_ID\"}}'`,\n  )\n  .action((opts) =>\n    runPluginAddResource(opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;;AAiCA,SAAS,aACP,WAC+D;CAC/D,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,MAAM,CAAC;AAE3E,KAAI,CAAC,UAAU;AACb,UAAQ,MACN,wBAAwB,UAAU,gFACnC;AACD,UAAQ,MACN,+DACD;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,SAAS,SAAS,QAAQ;AAC5B,UAAQ,MACN,gHAAgH,KAAK,SAAS,SAAS,KAAK,CAAC,IAC9I;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,eAAe,SAAS;AAE9B,KAAI;EACF,MAAM,MAAM,GAAG,aAAa,cAAc,QAAQ;EAClD,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,MAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,CAAC,OAAO,SAAS,CAAC,OAAO,UAAU;AACrC,WAAQ,MACN,8DACD;AACD,WAAQ,KAAK,EAAE;;AAEjB,SAAO;GAAE,UAAU;GAA8B;GAAc;UACxD,KAAK;AACZ,UAAQ,MACN,0CACA,eAAe,QAAQ,IAAI,UAAU,IACtC;AACD,UAAQ,KAAK,EAAE;;;AAInB,SAAS,WACP,MACA,MACqD;CACrD,MAAM,QAAQ,qBAAqB,KAAK;CACxC,MAAM,aAAa,KAAK,aAAa;CAErC,IAAI,SAAS,wBAAwB,KAAK;AAC1C,KAAI,KAAK,WACP,KAAI;EACF,MAAM,SAAS,KAAK,MAAM,KAAK,WAAW;AAI1C,WAAS;GAAE,GAAG;GAAQ,GAAG;GAAQ;SAC3B;AACN,UAAQ,MAAM,2CAA2C;AACzD,UAAQ,MACN,oEACD;AACD,UAAQ,KAAK,EAAE;;AAgBnB,QAAO;EAAE,OAZ0B;GAC3B;GACN;GACA,aAAa,KAAK,eAAe,oBAAoB,KAAK;GAC1D,aACE,KAAK,eACL,GAAG,aAAa,aAAa,WAAW,OAAO,MAAM;GACvD,YACE,KAAK,cAAc,2BAA2B,SAAS;GACzD;GACD;EAEe;EAAY;;AAG9B,SAAS,kBAAkB,MAAgC;CACzD,MAAM,MAAM,QAAQ,KAAK;CAEzB,MAAM,SAAS,aADG,KAAK,QAAQ,KAAK,KAAK,QAAQ,IAAI,CACf;AACtC,KAAI,CAAC,OAAQ;CACb,MAAM,EAAE,UAAU,iBAAiB;CAEnC,MAAM,OAAO,KAAK;CAClB,MAAM,aAAa,uBAAuB;AAC1C,KAAI,CAAC,WAAW,SAAS,KAAK,EAAE;AAC9B,UAAQ,MAAM,iCAAiC,KAAK,IAAI;AACxD,UAAQ,MAAM,kBAAkB,WAAW,KAAK,KAAK,GAAG;AACxD,UAAQ,KAAK,EAAE;;CAEjB,MAAM,EAAE,OAAO,eAAe,WAAW,MAAM,KAAK;AAEpD,KAAI,WACF,UAAS,UAAU,SAAS,KAAK,MAAM;KAEvC,UAAS,UAAU,SAAS,KAAK,MAAM;AAGzC,KAAI,KAAK,QAAQ;AACf,UAAQ,IAAI,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC;AAC9C;;AAGF,IAAG,cAAc,cAAc,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,IAAI;AACxE,SAAQ,IACN,SAAS,MAAM,MAAM,MAAM,aAAa,aAAa,WAAW,MAAM,KAAK,SAAS,KAAK,aAAa,GACvG;;AAGH,eAAe,eAAe,MAAyC;AACrE,OAAM,kCAAkC;CAExC,MAAM,MAAM,QAAQ,KAAK;CAEzB,MAAM,SAAS,aADG,KAAK,QAAQ,KAAK,KAAK,QAAQ,IAAI,CACf;AACtC,KAAI,CAAC,OAAQ;CACb,MAAM,EAAE,UAAU,iBAAiB;CAEnC,MAAM,OAAO,MAAM,mBAAmB;AACtC,KAAI,CAAC,MAAM;AACT,SAAO,aAAa;AACpB,UAAQ,KAAK,EAAE;;CAGjB,MAAM,QAAQ,qBAAqB,KAAK,KAAK;CAC7C,MAAM,QAA6B;EACjC,MAAM,KAAK;EACX;EACA,aAAa,KAAK;EAClB,aAAa,KAAK,eAAe,gBAAgB,MAAM;EACvD,YAAY,KAAK;EACjB,QAAQ,KAAK;EACd;AAED,KAAI,KAAK,SACP,UAAS,UAAU,SAAS,KAAK,MAAM;KAEvC,UAAS,UAAU,SAAS,KAAK,MAAM;AAGzC,IAAG,cAAc,cAAc,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,IAAI;AAExE,OAAM,kBAAkB;AACxB,SAAQ,IACN,WAAW,MAAM,MAAM,KAAK,WAAW,aAAa,WAAW,MAAM,KAAK,SAAS,KAAK,aAAa,GACtG;;AAGH,eAAe,qBAAqB,MAAyC;AAC3E,KAAI,KAAK,KACP,mBAAkB,KAAK;KAEvB,OAAM,eAAe,KAAK;;AAI9B,MAAa,2BAA2B,IAAI,QAAQ,eAAe,CAChE,YACC,gGACD,CACA,OACC,oBACA,yDACD,CACA,OACC,8BACA,4EACD,CACA,OAAO,cAAc,6CAA6C,KAAK,CACvE,OAAO,iBAAiB,4BAA4B,CACpD,OAAO,wBAAwB,4CAA4C,CAC3E,OAAO,wBAAwB,0CAA0C,CACzE,OAAO,uBAAuB,0CAA0C,CACxE,OACC,wBACA,wFACD,CACA,OAAO,aAAa,+CAA+C,CACnE,YACC,SACA;;;;;sGAMD,CACA,QAAQ,SACP,qBAAqB,KAAK,CAAC,OAAO,QAAQ;AACxC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}
+{"version":3,"file":"add-resource.js","names":[],"sources":["../../../../../src/cli/commands/plugin/add-resource/add-resource.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport process from \"node:process\";\nimport { cancel, intro, outro } from \"@clack/prompts\";\nimport { Command } from \"commander\";\nimport { promptOneResource } from \"../create/prompt-resource\";\nimport {\n  DEFAULT_PERMISSION_BY_TYPE,\n  getDefaultFieldsForType,\n  getValidResourceTypes,\n  humanizeResourceType,\n  resourceKeyFromType,\n} from \"../create/resource-defaults\";\nimport { resolveManifestInDir } from \"../manifest-resolve\";\nimport type { PluginManifest, ResourceRequirement } from \"../manifest-types\";\nimport { validateManifest } from \"../validate/validate-manifest\";\n\n/** Extended manifest type that preserves extra JSON fields (e.g. $schema, author, version) for round-trip writes. */\ninterface ManifestWithExtras extends PluginManifest {\n  [key: string]: unknown;\n}\n\ninterface AddResourceOptions {\n  path?: string;\n  type?: string;\n  required?: boolean;\n  resourceKey?: string;\n  description?: string;\n  permission?: string;\n  fieldsJson?: string;\n  dryRun?: boolean;\n}\n\nfunction loadManifest(\n  pluginDir: string,\n): { manifest: ManifestWithExtras; manifestPath: string } | null {\n  const resolved = resolveManifestInDir(pluginDir, { allowJsManifest: true });\n\n  if (!resolved) {\n    console.error(\n      `No manifest found in ${pluginDir}. This command requires manifest.json (manifest.js cannot be edited in place).`,\n    );\n    console.error(\n      \"  appkit plugin add-resource --path <dir-with-manifest.json>\",\n    );\n    process.exit(1);\n  }\n\n  if (resolved.type !== \"json\") {\n    console.error(\n      `Editable manifest not found. add-resource only supports plugin directories that contain manifest.json (found ${path.basename(resolved.path)}).`,\n    );\n    process.exit(1);\n  }\n\n  const manifestPath = resolved.path;\n\n  try {\n    const raw = fs.readFileSync(manifestPath, \"utf-8\");\n    const parsed = JSON.parse(raw) as unknown;\n    const result = validateManifest(parsed);\n    if (!result.valid || !result.manifest) {\n      console.error(\n        \"Invalid manifest. Run `appkit plugin validate` for details.\",\n      );\n      process.exit(1);\n    }\n    return { manifest: parsed as ManifestWithExtras, manifestPath };\n  } catch (err) {\n    console.error(\n      \"Failed to read or parse manifest.json:\",\n      err instanceof Error ? err.message : err,\n    );\n    process.exit(1);\n  }\n}\n\nfunction buildEntry(\n  type: string,\n  opts: AddResourceOptions,\n): { entry: ResourceRequirement; isRequired: boolean } {\n  const alias = humanizeResourceType(type);\n  const isRequired = opts.required !== false;\n\n  let fields = getDefaultFieldsForType(type);\n  if (opts.fieldsJson) {\n    try {\n      const parsed = JSON.parse(opts.fieldsJson) as Record<\n        string,\n        { env: string; description?: string }\n      >;\n      fields = { ...fields, ...parsed };\n    } catch {\n      console.error(\"Error: --fields-json must be valid JSON.\");\n      console.error(\n        '  Example: --fields-json \\'{\"id\":{\"env\":\"MY_WAREHOUSE_ID\"}}\\'',\n      );\n      process.exit(1);\n    }\n  }\n\n  // Constructed dynamically from a string `type` and string `permission`;\n  // the per-type permission tightness from the discriminated union is\n  // recovered at runtime by `validateManifest` before the entry is written.\n  const entry = {\n    type,\n    alias,\n    resourceKey: opts.resourceKey ?? resourceKeyFromType(type),\n    description:\n      opts.description ||\n      `${isRequired ? \"Required\" : \"Optional\"} for ${alias} functionality.`,\n    permission:\n      opts.permission ?? DEFAULT_PERMISSION_BY_TYPE[type] ?? \"CAN_VIEW\",\n    fields,\n  } as ResourceRequirement;\n\n  return { entry, isRequired };\n}\n\nfunction runNonInteractive(opts: AddResourceOptions): void {\n  const cwd = process.cwd();\n  const pluginDir = path.resolve(cwd, opts.path ?? \".\");\n  const loaded = loadManifest(pluginDir);\n  if (!loaded) return;\n  const { manifest, manifestPath } = loaded;\n\n  const type = opts.type as string;\n  const validTypes = getValidResourceTypes();\n  if (!validTypes.includes(type)) {\n    console.error(`Error: Unknown resource type \"${type}\".`);\n    console.error(`  Valid types: ${validTypes.join(\", \")}`);\n    process.exit(1);\n  }\n  const { entry, isRequired } = buildEntry(type, opts);\n\n  if (isRequired) {\n    manifest.resources.required.push(entry);\n  } else {\n    manifest.resources.optional.push(entry);\n  }\n\n  if (opts.dryRun) {\n    console.log(JSON.stringify(manifest, null, 2));\n    return;\n  }\n\n  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\\n`);\n  console.log(\n    `Added ${entry.alias} as ${isRequired ? \"required\" : \"optional\"} to ${path.relative(cwd, manifestPath)}`,\n  );\n}\n\nasync function runInteractive(opts: AddResourceOptions): Promise<void> {\n  intro(\"Add resource to plugin manifest\");\n\n  const cwd = process.cwd();\n  const pluginDir = path.resolve(cwd, opts.path ?? \".\");\n  const loaded = loadManifest(pluginDir);\n  if (!loaded) return;\n  const { manifest, manifestPath } = loaded;\n\n  const spec = await promptOneResource();\n  if (!spec) {\n    cancel(\"Cancelled.\");\n    process.exit(0);\n  }\n\n  const alias = humanizeResourceType(spec.type);\n  // See note on the non-interactive variant in `buildEntry` — the entry is\n  // assembled from prompt strings and validated by Zod at write time.\n  const entry = {\n    type: spec.type,\n    alias,\n    resourceKey: spec.resourceKey,\n    description: spec.description || `Required for ${alias} functionality.`,\n    permission: spec.permission,\n    fields: spec.fields,\n  } as ResourceRequirement;\n\n  if (spec.required) {\n    manifest.resources.required.push(entry);\n  } else {\n    manifest.resources.optional.push(entry);\n  }\n\n  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\\n`);\n\n  outro(\"Resource added.\");\n  console.log(\n    `\\nAdded ${alias} as ${spec.required ? \"required\" : \"optional\"} to ${path.relative(cwd, manifestPath)}`,\n  );\n}\n\nasync function runPluginAddResource(opts: AddResourceOptions): Promise<void> {\n  if (opts.type) {\n    runNonInteractive(opts);\n  } else {\n    await runInteractive(opts);\n  }\n}\n\nexport const pluginAddResourceCommand = new Command(\"add-resource\")\n  .description(\n    \"Add a resource requirement to an existing plugin manifest. Overwrites manifest.json in place.\",\n  )\n  .option(\n    \"-p, --path <dir>\",\n    \"Plugin directory containing manifest.json (default: .)\",\n  )\n  .option(\n    \"-t, --type <resource_type>\",\n    \"Resource type (e.g. sql_warehouse, volume). Enables non-interactive mode.\",\n  )\n  .option(\"--required\", \"Mark resource as required (default: true)\", true)\n  .option(\"--no-required\", \"Mark resource as optional\")\n  .option(\"--resource-key <key>\", \"Resource key (default: derived from type)\")\n  .option(\"--description <text>\", \"Description of the resource requirement\")\n  .option(\"--permission <perm>\", \"Permission level (default: from schema)\")\n  .option(\n    \"--fields-json <json>\",\n    'JSON object overriding field env vars (e.g. \\'{\"id\":{\"env\":\"MY_WAREHOUSE_ID\"}}\\')',\n  )\n  .option(\"--dry-run\", \"Preview the updated manifest without writing\")\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  $ appkit plugin add-resource\n  $ appkit plugin add-resource --path plugins/my-plugin --type sql_warehouse\n  $ appkit plugin add-resource --path plugins/my-plugin --type volume --no-required --dry-run\n  $ appkit plugin add-resource --type sql_warehouse --fields-json '{\"id\":{\"env\":\"MY_WAREHOUSE_ID\"}}'`,\n  )\n  .action((opts) =>\n    runPluginAddResource(opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;;AAiCA,SAAS,aACP,WAC+D;CAC/D,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,MAAM,CAAC;AAE3E,KAAI,CAAC,UAAU;AACb,UAAQ,MACN,wBAAwB,UAAU,gFACnC;AACD,UAAQ,MACN,+DACD;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,SAAS,SAAS,QAAQ;AAC5B,UAAQ,MACN,gHAAgH,KAAK,SAAS,SAAS,KAAK,CAAC,IAC9I;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,eAAe,SAAS;AAE9B,KAAI;EACF,MAAM,MAAM,GAAG,aAAa,cAAc,QAAQ;EAClD,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,MAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,CAAC,OAAO,SAAS,CAAC,OAAO,UAAU;AACrC,WAAQ,MACN,8DACD;AACD,WAAQ,KAAK,EAAE;;AAEjB,SAAO;GAAE,UAAU;GAA8B;GAAc;UACxD,KAAK;AACZ,UAAQ,MACN,0CACA,eAAe,QAAQ,IAAI,UAAU,IACtC;AACD,UAAQ,KAAK,EAAE;;;AAInB,SAAS,WACP,MACA,MACqD;CACrD,MAAM,QAAQ,qBAAqB,KAAK;CACxC,MAAM,aAAa,KAAK,aAAa;CAErC,IAAI,SAAS,wBAAwB,KAAK;AAC1C,KAAI,KAAK,WACP,KAAI;EACF,MAAM,SAAS,KAAK,MAAM,KAAK,WAAW;AAI1C,WAAS;GAAE,GAAG;GAAQ,GAAG;GAAQ;SAC3B;AACN,UAAQ,MAAM,2CAA2C;AACzD,UAAQ,MACN,oEACD;AACD,UAAQ,KAAK,EAAE;;AAmBnB,QAAO;EAAE,OAZK;GACZ;GACA;GACA,aAAa,KAAK,eAAe,oBAAoB,KAAK;GAC1D,aACE,KAAK,eACL,GAAG,aAAa,aAAa,WAAW,OAAO,MAAM;GACvD,YACE,KAAK,cAAc,2BAA2B,SAAS;GACzD;GACD;EAEe;EAAY;;AAG9B,SAAS,kBAAkB,MAAgC;CACzD,MAAM,MAAM,QAAQ,KAAK;CAEzB,MAAM,SAAS,aADG,KAAK,QAAQ,KAAK,KAAK,QAAQ,IAAI,CACf;AACtC,KAAI,CAAC,OAAQ;CACb,MAAM,EAAE,UAAU,iBAAiB;CAEnC,MAAM,OAAO,KAAK;CAClB,MAAM,aAAa,uBAAuB;AAC1C,KAAI,CAAC,WAAW,SAAS,KAAK,EAAE;AAC9B,UAAQ,MAAM,iCAAiC,KAAK,IAAI;AACxD,UAAQ,MAAM,kBAAkB,WAAW,KAAK,KAAK,GAAG;AACxD,UAAQ,KAAK,EAAE;;CAEjB,MAAM,EAAE,OAAO,eAAe,WAAW,MAAM,KAAK;AAEpD,KAAI,WACF,UAAS,UAAU,SAAS,KAAK,MAAM;KAEvC,UAAS,UAAU,SAAS,KAAK,MAAM;AAGzC,KAAI,KAAK,QAAQ;AACf,UAAQ,IAAI,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC;AAC9C;;AAGF,IAAG,cAAc,cAAc,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,IAAI;AACxE,SAAQ,IACN,SAAS,MAAM,MAAM,MAAM,aAAa,aAAa,WAAW,MAAM,KAAK,SAAS,KAAK,aAAa,GACvG;;AAGH,eAAe,eAAe,MAAyC;AACrE,OAAM,kCAAkC;CAExC,MAAM,MAAM,QAAQ,KAAK;CAEzB,MAAM,SAAS,aADG,KAAK,QAAQ,KAAK,KAAK,QAAQ,IAAI,CACf;AACtC,KAAI,CAAC,OAAQ;CACb,MAAM,EAAE,UAAU,iBAAiB;CAEnC,MAAM,OAAO,MAAM,mBAAmB;AACtC,KAAI,CAAC,MAAM;AACT,SAAO,aAAa;AACpB,UAAQ,KAAK,EAAE;;CAGjB,MAAM,QAAQ,qBAAqB,KAAK,KAAK;CAG7C,MAAM,QAAQ;EACZ,MAAM,KAAK;EACX;EACA,aAAa,KAAK;EAClB,aAAa,KAAK,eAAe,gBAAgB,MAAM;EACvD,YAAY,KAAK;EACjB,QAAQ,KAAK;EACd;AAED,KAAI,KAAK,SACP,UAAS,UAAU,SAAS,KAAK,MAAM;KAEvC,UAAS,UAAU,SAAS,KAAK,MAAM;AAGzC,IAAG,cAAc,cAAc,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,IAAI;AAExE,OAAM,kBAAkB;AACxB,SAAQ,IACN,WAAW,MAAM,MAAM,KAAK,WAAW,aAAa,WAAW,MAAM,KAAK,SAAS,KAAK,aAAa,GACtG;;AAGH,eAAe,qBAAqB,MAAyC;AAC3E,KAAI,KAAK,KACP,mBAAkB,KAAK;KAEvB,OAAM,eAAe,KAAK;;AAI9B,MAAa,2BAA2B,IAAI,QAAQ,eAAe,CAChE,YACC,gGACD,CACA,OACC,oBACA,yDACD,CACA,OACC,8BACA,4EACD,CACA,OAAO,cAAc,6CAA6C,KAAK,CACvE,OAAO,iBAAiB,4BAA4B,CACpD,OAAO,wBAAwB,4CAA4C,CAC3E,OAAO,wBAAwB,0CAA0C,CACzE,OAAO,uBAAuB,0CAA0C,CACxE,OACC,wBACA,wFACD,CACA,OAAO,aAAa,+CAA+C,CACnE,YACC,SACA;;;;;sGAMD,CACA,QAAQ,SACP,qBAAqB,KAAK,CAAC,OAAO,QAAQ;AACxC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}

package/dist/cli/commands/plugin/create/resource-defaults.js

@@ -3,7 +3,8 @@ import { getResourceTypeOptions, getResourceTypePermissions } from "../schema-re
 //#region src/cli/commands/plugin/create/resource-defaults.ts
 /**
 * Resource type and permission defaults for plugin scaffolding.
-* Values are derived from plugin-manifest.schema.json via schema-resources.
+* Values are sourced from the canonical Zod schemas in `schemas/manifest`,
+* surfaced through the `schema-resources` module.
 */
 const MANIFEST_SCHEMA_ID = "https://databricks.github.io/appkit/schemas/plugin-manifest.schema.json";
 /** Resource types from schema resourceType enum (value, human label). */

package/dist/cli/commands/plugin/create/resource-defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-defaults.js","names":[],"sources":["../../../../../src/cli/commands/plugin/create/resource-defaults.ts"],"sourcesContent":["/**\n * Resource type and permission defaults for plugin scaffolding.\n * Values are derived from plugin-manifest.schema.json via schema-resources.\n */\n\nimport {\n  getResourceTypeOptions,\n  getResourceTypePermissions,\n  type ResourceTypeOption,\n} from \"../schema-resources\";\n\nexport const MANIFEST_SCHEMA_ID =\n  \"https://databricks.github.io/appkit/schemas/plugin-manifest.schema.json\";\n\nexport type { ResourceTypeOption };\n\n/** Resource types from schema resourceType enum (value, human label). */\nexport const RESOURCE_TYPE_OPTIONS: ResourceTypeOption[] =\n  getResourceTypeOptions();\n\n/** All valid permissions per resource type, from schema allOf/if-then rules. */\nexport const PERMISSIONS_BY_TYPE: Record<string, string[]> =\n  getResourceTypePermissions();\n\n/** Default (first) permission per resource type for scaffolding. */\nexport const DEFAULT_PERMISSION_BY_TYPE: Record<string, string> =\n  Object.fromEntries(\n    Object.entries(PERMISSIONS_BY_TYPE).map(([type, perms]) => [\n      type,\n      perms[0],\n    ]),\n  );\n\n/** Default fields per resource type: field key -> { env, description }. */\nexport const DEFAULT_FIELDS_BY_TYPE: Record<\n  string,\n  Record<string, { env: string; description?: string }>\n> = {\n  sql_warehouse: {\n    id: { env: \"DATABRICKS_WAREHOUSE_ID\", description: \"SQL Warehouse ID\" },\n  },\n  secret: {\n    scope: { env: \"SECRET_SCOPE\", description: \"Secret scope name\" },\n    key: { env: \"SECRET_KEY\", description: \"Secret key\" },\n  },\n  job: {\n    id: { env: \"DATABRICKS_JOB_ID\", description: \"Job ID\" },\n  },\n  serving_endpoint: {\n    id: {\n      env: \"DATABRICKS_SERVING_ENDPOINT_ID\",\n      description: \"Serving endpoint ID\",\n    },\n  },\n  volume: {\n    name: { env: \"VOLUME_NAME\", description: \"Volume name\" },\n  },\n  vector_search_index: {\n    endpoint_name: {\n      env: \"VECTOR_SEARCH_ENDPOINT_NAME\",\n      description: \"Vector search endpoint name\",\n    },\n    index_name: {\n      env: \"VECTOR_SEARCH_INDEX_NAME\",\n      description: \"Vector search index name\",\n    },\n  },\n  uc_function: {\n    name: {\n      env: \"UC_FUNCTION_NAME\",\n      description: \"Unity Catalog function name\",\n    },\n  },\n  uc_connection: {\n    name: {\n      env: \"UC_CONNECTION_NAME\",\n      description: \"Unity Catalog connection name\",\n    },\n  },\n  database: {\n    instance_name: {\n      env: \"DATABRICKS_INSTANCE_NAME\",\n      description: \"Databricks instance name\",\n    },\n    database_name: {\n      env: \"DATABASE_NAME\",\n      description: \"Database name\",\n    },\n  },\n  genie_space: {\n    id: { env: \"GENIE_SPACE_ID\", description: \"Genie Space ID\" },\n  },\n  experiment: {\n    id: { env: \"MLFLOW_EXPERIMENT_ID\", description: \"MLflow experiment ID\" },\n  },\n  app: {\n    id: { env: \"DATABRICKS_APP_ID\", description: \"Databricks App ID\" },\n  },\n};\n\n/** Valid resource type values from the schema. */\nexport function getValidResourceTypes(): string[] {\n  return RESOURCE_TYPE_OPTIONS.map((o) => o.value);\n}\n\n/** Humanized alias from resource type (e.g. sql_warehouse -> \"SQL Warehouse\"). */\nexport function humanizeResourceType(type: string): string {\n  const option = RESOURCE_TYPE_OPTIONS.find((o) => o.value === type);\n  return option ? option.label : type.replace(/_/g, \" \");\n}\n\n/** Kebab-case resource key from type (e.g. sql_warehouse -> \"sql-warehouse\"). */\nexport function resourceKeyFromType(type: string): string {\n  return type.replace(/_/g, \"-\");\n}\n\n/** Get default fields for a resource type; fallback to single id field. */\nexport function getDefaultFieldsForType(\n  type: string,\n): Record<string, { env: string; description?: string }> {\n  const known = DEFAULT_FIELDS_BY_TYPE[type];\n  if (known) return known;\n  const key = resourceKeyFromType(type);\n  const envName = `DATABRICKS_${key.toUpperCase().replace(/-/g, \"_\")}_ID`;\n  return {\n    id: { env: envName, description: `${humanizeResourceType(type)} ID` },\n  };\n}\n"],"mappings":";;;;;;;AAWA,MAAa,qBACX;;AAKF,MAAa,wBACX,wBAAwB;;AAG1B,MAAa,sBACX,4BAA4B;;AAG9B,MAAa,6BACX,OAAO,YACL,OAAO,QAAQ,oBAAoB,CAAC,KAAK,CAAC,MAAM,WAAW,CACzD,MACA,MAAM,GACP,CAAC,CACH;;AAGH,MAAa,yBAGT;CACF,eAAe,EACb,IAAI;EAAE,KAAK;EAA2B,aAAa;EAAoB,EACxE;CACD,QAAQ;EACN,OAAO;GAAE,KAAK;GAAgB,aAAa;GAAqB;EAChE,KAAK;GAAE,KAAK;GAAc,aAAa;GAAc;EACtD;CACD,KAAK,EACH,IAAI;EAAE,KAAK;EAAqB,aAAa;EAAU,EACxD;CACD,kBAAkB,EAChB,IAAI;EACF,KAAK;EACL,aAAa;EACd,EACF;CACD,QAAQ,EACN,MAAM;EAAE,KAAK;EAAe,aAAa;EAAe,EACzD;CACD,qBAAqB;EACnB,eAAe;GACb,KAAK;GACL,aAAa;GACd;EACD,YAAY;GACV,KAAK;GACL,aAAa;GACd;EACF;CACD,aAAa,EACX,MAAM;EACJ,KAAK;EACL,aAAa;EACd,EACF;CACD,eAAe,EACb,MAAM;EACJ,KAAK;EACL,aAAa;EACd,EACF;CACD,UAAU;EACR,eAAe;GACb,KAAK;GACL,aAAa;GACd;EACD,eAAe;GACb,KAAK;GACL,aAAa;GACd;EACF;CACD,aAAa,EACX,IAAI;EAAE,KAAK;EAAkB,aAAa;EAAkB,EAC7D;CACD,YAAY,EACV,IAAI;EAAE,KAAK;EAAwB,aAAa;EAAwB,EACzE;CACD,KAAK,EACH,IAAI;EAAE,KAAK;EAAqB,aAAa;EAAqB,EACnE;CACF;;AAGD,SAAgB,wBAAkC;AAChD,QAAO,sBAAsB,KAAK,MAAM,EAAE,MAAM;;;AAIlD,SAAgB,qBAAqB,MAAsB;CACzD,MAAM,SAAS,sBAAsB,MAAM,MAAM,EAAE,UAAU,KAAK;AAClE,QAAO,SAAS,OAAO,QAAQ,KAAK,QAAQ,MAAM,IAAI;;;AAIxD,SAAgB,oBAAoB,MAAsB;AACxD,QAAO,KAAK,QAAQ,MAAM,IAAI;;;AAIhC,SAAgB,wBACd,MACuD;CACvD,MAAM,QAAQ,uBAAuB;AACrC,KAAI,MAAO,QAAO;AAGlB,QAAO,EACL,IAAI;EAAE,KAFQ,cADJ,oBAAoB,KAAK,CACH,aAAa,CAAC,QAAQ,MAAM,IAAI,CAAC;EAE7C,aAAa,GAAG,qBAAqB,KAAK,CAAC;EAAM,EACtE"}
+{"version":3,"file":"resource-defaults.js","names":[],"sources":["../../../../../src/cli/commands/plugin/create/resource-defaults.ts"],"sourcesContent":["/**\n * Resource type and permission defaults for plugin scaffolding.\n * Values are sourced from the canonical Zod schemas in `schemas/manifest`,\n * surfaced through the `schema-resources` module.\n */\n\nimport {\n  getResourceTypeOptions,\n  getResourceTypePermissions,\n  type ResourceTypeOption,\n} from \"../schema-resources\";\n\nexport const MANIFEST_SCHEMA_ID =\n  \"https://databricks.github.io/appkit/schemas/plugin-manifest.schema.json\";\n\nexport type { ResourceTypeOption };\n\n/** Resource types from schema resourceType enum (value, human label). */\nexport const RESOURCE_TYPE_OPTIONS: ResourceTypeOption[] =\n  getResourceTypeOptions();\n\n/** All valid permissions per resource type, from schema allOf/if-then rules. */\nexport const PERMISSIONS_BY_TYPE: Record<string, string[]> =\n  getResourceTypePermissions();\n\n/** Default (first) permission per resource type for scaffolding. */\nexport const DEFAULT_PERMISSION_BY_TYPE: Record<string, string> =\n  Object.fromEntries(\n    Object.entries(PERMISSIONS_BY_TYPE).map(([type, perms]) => [\n      type,\n      perms[0],\n    ]),\n  );\n\n/** Default fields per resource type: field key -> { env, description }. */\nexport const DEFAULT_FIELDS_BY_TYPE: Record<\n  string,\n  Record<string, { env: string; description?: string }>\n> = {\n  sql_warehouse: {\n    id: { env: \"DATABRICKS_WAREHOUSE_ID\", description: \"SQL Warehouse ID\" },\n  },\n  secret: {\n    scope: { env: \"SECRET_SCOPE\", description: \"Secret scope name\" },\n    key: { env: \"SECRET_KEY\", description: \"Secret key\" },\n  },\n  job: {\n    id: { env: \"DATABRICKS_JOB_ID\", description: \"Job ID\" },\n  },\n  serving_endpoint: {\n    id: {\n      env: \"DATABRICKS_SERVING_ENDPOINT_ID\",\n      description: \"Serving endpoint ID\",\n    },\n  },\n  volume: {\n    name: { env: \"VOLUME_NAME\", description: \"Volume name\" },\n  },\n  vector_search_index: {\n    endpoint_name: {\n      env: \"VECTOR_SEARCH_ENDPOINT_NAME\",\n      description: \"Vector search endpoint name\",\n    },\n    index_name: {\n      env: \"VECTOR_SEARCH_INDEX_NAME\",\n      description: \"Vector search index name\",\n    },\n  },\n  uc_function: {\n    name: {\n      env: \"UC_FUNCTION_NAME\",\n      description: \"Unity Catalog function name\",\n    },\n  },\n  uc_connection: {\n    name: {\n      env: \"UC_CONNECTION_NAME\",\n      description: \"Unity Catalog connection name\",\n    },\n  },\n  database: {\n    instance_name: {\n      env: \"DATABRICKS_INSTANCE_NAME\",\n      description: \"Databricks instance name\",\n    },\n    database_name: {\n      env: \"DATABASE_NAME\",\n      description: \"Database name\",\n    },\n  },\n  genie_space: {\n    id: { env: \"GENIE_SPACE_ID\", description: \"Genie Space ID\" },\n  },\n  experiment: {\n    id: { env: \"MLFLOW_EXPERIMENT_ID\", description: \"MLflow experiment ID\" },\n  },\n  app: {\n    id: { env: \"DATABRICKS_APP_ID\", description: \"Databricks App ID\" },\n  },\n};\n\n/** Valid resource type values from the schema. */\nexport function getValidResourceTypes(): string[] {\n  return RESOURCE_TYPE_OPTIONS.map((o) => o.value);\n}\n\n/** Humanized alias from resource type (e.g. sql_warehouse -> \"SQL Warehouse\"). */\nexport function humanizeResourceType(type: string): string {\n  const option = RESOURCE_TYPE_OPTIONS.find((o) => o.value === type);\n  return option ? option.label : type.replace(/_/g, \" \");\n}\n\n/** Kebab-case resource key from type (e.g. sql_warehouse -> \"sql-warehouse\"). */\nexport function resourceKeyFromType(type: string): string {\n  return type.replace(/_/g, \"-\");\n}\n\n/** Get default fields for a resource type; fallback to single id field. */\nexport function getDefaultFieldsForType(\n  type: string,\n): Record<string, { env: string; description?: string }> {\n  const known = DEFAULT_FIELDS_BY_TYPE[type];\n  if (known) return known;\n  const key = resourceKeyFromType(type);\n  const envName = `DATABRICKS_${key.toUpperCase().replace(/-/g, \"_\")}_ID`;\n  return {\n    id: { env: envName, description: `${humanizeResourceType(type)} ID` },\n  };\n}\n"],"mappings":";;;;;;;;AAYA,MAAa,qBACX;;AAKF,MAAa,wBACX,wBAAwB;;AAG1B,MAAa,sBACX,4BAA4B;;AAG9B,MAAa,6BACX,OAAO,YACL,OAAO,QAAQ,oBAAoB,CAAC,KAAK,CAAC,MAAM,WAAW,CACzD,MACA,MAAM,GACP,CAAC,CACH;;AAGH,MAAa,yBAGT;CACF,eAAe,EACb,IAAI;EAAE,KAAK;EAA2B,aAAa;EAAoB,EACxE;CACD,QAAQ;EACN,OAAO;GAAE,KAAK;GAAgB,aAAa;GAAqB;EAChE,KAAK;GAAE,KAAK;GAAc,aAAa;GAAc;EACtD;CACD,KAAK,EACH,IAAI;EAAE,KAAK;EAAqB,aAAa;EAAU,EACxD;CACD,kBAAkB,EAChB,IAAI;EACF,KAAK;EACL,aAAa;EACd,EACF;CACD,QAAQ,EACN,MAAM;EAAE,KAAK;EAAe,aAAa;EAAe,EACzD;CACD,qBAAqB;EACnB,eAAe;GACb,KAAK;GACL,aAAa;GACd;EACD,YAAY;GACV,KAAK;GACL,aAAa;GACd;EACF;CACD,aAAa,EACX,MAAM;EACJ,KAAK;EACL,aAAa;EACd,EACF;CACD,eAAe,EACb,MAAM;EACJ,KAAK;EACL,aAAa;EACd,EACF;CACD,UAAU;EACR,eAAe;GACb,KAAK;GACL,aAAa;GACd;EACD,eAAe;GACb,KAAK;GACL,aAAa;GACd;EACF;CACD,aAAa,EACX,IAAI;EAAE,KAAK;EAAkB,aAAa;EAAkB,EAC7D;CACD,YAAY,EACV,IAAI;EAAE,KAAK;EAAwB,aAAa;EAAwB,EACzE;CACD,KAAK,EACH,IAAI;EAAE,KAAK;EAAqB,aAAa;EAAqB,EACnE;CACF;;AAGD,SAAgB,wBAAkC;AAChD,QAAO,sBAAsB,KAAK,MAAM,EAAE,MAAM;;;AAIlD,SAAgB,qBAAqB,MAAsB;CACzD,MAAM,SAAS,sBAAsB,MAAM,MAAM,EAAE,UAAU,KAAK;AAClE,QAAO,SAAS,OAAO,QAAQ,KAAK,QAAQ,MAAM,IAAI;;;AAIxD,SAAgB,oBAAoB,MAAsB;AACxD,QAAO,KAAK,QAAQ,MAAM,IAAI;;;AAIhC,SAAgB,wBACd,MACuD;CACvD,MAAM,QAAQ,uBAAuB;AACrC,KAAI,MAAO,QAAO;AAGlB,QAAO,EACL,IAAI;EAAE,KAFQ,cADJ,oBAAoB,KAAK,CACH,aAAa,CAAC,QAAQ,MAAM,IAAI,CAAC;EAE7C,aAAa,GAAG,qBAAqB,KAAK,CAAC;EAAM,EACtE"}

package/dist/cli/commands/plugin/schema-resources.js

@@ -1,21 +1,14 @@
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { appPermissionSchema, databasePermissionSchema, experimentPermissionSchema, genieSpacePermissionSchema, jobPermissionSchema, postgresPermissionSchema, resourceTypeSchema, secretPermissionSchema, servingEndpointPermissionSchema, sqlWarehousePermissionSchema, ucConnectionPermissionSchema, ucFunctionPermissionSchema, vectorSearchIndexPermissionSchema, volumePermissionSchema } from "../../../schemas/manifest.js";
 
 //#region src/cli/commands/plugin/schema-resources.ts
 /**
-* Resource types and permissions derived from plugin-manifest.schema.json.
-* Single source of truth so create, add-resource, and validate stay in sync with the schema.
+* Resource types and permissions sourced from the canonical Zod schemas in
+* `schemas/manifest.ts`. Single source of truth so create, add-resource, and
+* validate stay in sync with the schema.
+*
+* Values are constant at module load (direct Zod imports, no runtime JSON-schema
+* read), so no caching is needed.
 */
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const SCHEMA_NAME = "plugin-manifest.schema.json";
-const SCHEMA_PATHS = [path.join(__dirname, "..", "..", "..", "schemas", SCHEMA_NAME), path.join(__dirname, "..", "..", "schemas", SCHEMA_NAME)];
-function loadSchema() {
-	for (const schemaPath of SCHEMA_PATHS) try {
-		if (fs.existsSync(schemaPath)) return JSON.parse(fs.readFileSync(schemaPath, "utf-8"));
-	} catch {}
-	return null;
-}
 /** Optional display overrides for acronyms (e.g. SQL, UC). Omitted entries use title-case of value. */
 const LABEL_OVERRIDES = {
 	sql_warehouse: "SQL Warehouse",
@@ -26,54 +19,44 @@ function humanize(value) {
 	if (LABEL_OVERRIDES[value]) return LABEL_OVERRIDES[value];
 	return value.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 }
-let cachedOptions = null;
-let cachedPermissions = null;
 /**
-* Resource type options (value + label) from schema $defs.resourceType.enum.
+* Map from resource type literal to its permission enum schema. Mirrors the
+* `allOf + if/then` block in the previous hand-written JSON Schema, but driven
+* directly from the Zod source. Add an entry here when extending
+* `resourceTypeSchema`.
+*/
+const PERMISSION_SCHEMAS_BY_TYPE = {
+	secret: secretPermissionSchema,
+	job: jobPermissionSchema,
+	sql_warehouse: sqlWarehousePermissionSchema,
+	serving_endpoint: servingEndpointPermissionSchema,
+	volume: volumePermissionSchema,
+	vector_search_index: vectorSearchIndexPermissionSchema,
+	uc_function: ucFunctionPermissionSchema,
+	uc_connection: ucConnectionPermissionSchema,
+	database: databasePermissionSchema,
+	postgres: postgresPermissionSchema,
+	genie_space: genieSpacePermissionSchema,
+	experiment: experimentPermissionSchema,
+	app: appPermissionSchema
+};
+/**
+* Resource type options (value + label) from `resourceTypeSchema.options`.
 */
 function getResourceTypeOptions() {
-	if (cachedOptions) return cachedOptions;
-	const enumArr = ((loadSchema()?.$defs)?.resourceType)?.enum;
-	if (!Array.isArray(enumArr)) {
-		cachedOptions = [];
-		return cachedOptions;
-	}
-	cachedOptions = enumArr.map((value) => ({
+	return resourceTypeSchema.options.map((value) => ({
 		value,
 		label: humanize(value)
 	}));
-	return cachedOptions;
 }
 /**
-* Permissions per resource type from schema resourceRequirement.allOf (if/then).
+* Permissions per resource type, derived from each type's per-type permission
+* schema's `.options` array. Order is weakest-to-strongest (matches Zod enum
+* declaration order, which the original JSON Schema also preserved).
 */
 function getResourceTypePermissions() {
-	if (cachedPermissions) return cachedPermissions;
-	const schema = loadSchema();
 	const out = {};
-	if (!schema?.$defs || typeof schema.$defs !== "object") {
-		cachedPermissions = out;
-		return out;
-	}
-	const allOf = schema.$defs.resourceRequirement?.allOf;
-	if (!Array.isArray(allOf)) {
-		cachedPermissions = out;
-		return out;
-	}
-	for (const branch of allOf) {
-		const typeConst = branch?.if?.properties?.type?.const;
-		const ref = branch?.then?.properties?.permission?.$ref;
-		if (typeof typeConst !== "string" || typeof ref !== "string") continue;
-		const refSegments = ref.replace(/^#\//, "").split("/");
-		let def = schema;
-		for (const seg of refSegments) {
-			if (def == null || typeof def !== "object") break;
-			def = def[seg];
-		}
-		const enumArr = Array.isArray(def?.enum) ? def.enum : void 0;
-		if (enumArr?.length) out[typeConst] = enumArr;
-	}
-	cachedPermissions = out;
+	for (const [type, schema] of Object.entries(PERMISSION_SCHEMAS_BY_TYPE)) out[type] = [...schema.options];
 	return out;
 }
 

package/dist/cli/commands/plugin/schema-resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-resources.js","names":[],"sources":["../../../../src/cli/commands/plugin/schema-resources.ts"],"sourcesContent":["/**\n * Resource types and permissions derived from plugin-manifest.schema.json.\n * Single source of truth so create, add-resource, and validate stay in sync with the schema.\n */\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst __dirname = path.dirname(fileURLToPath(import.meta.url));\nconst SCHEMA_NAME = \"plugin-manifest.schema.json\";\n// Try dist/schemas first (shared build + appkit pack), then dist/cli/schemas\nconst SCHEMA_PATHS = [\n  path.join(__dirname, \"..\", \"..\", \"..\", \"schemas\", SCHEMA_NAME),\n  path.join(__dirname, \"..\", \"..\", \"schemas\", SCHEMA_NAME),\n];\n\nexport interface ResourceTypeOption {\n  value: string;\n  label: string;\n}\n\nfunction loadSchema(): Record<string, unknown> | null {\n  for (const schemaPath of SCHEMA_PATHS) {\n    try {\n      if (fs.existsSync(schemaPath)) {\n        return JSON.parse(fs.readFileSync(schemaPath, \"utf-8\")) as Record<\n          string,\n          unknown\n        >;\n      }\n    } catch {\n      // try next path\n    }\n  }\n  return null;\n}\n\n/** Optional display overrides for acronyms (e.g. SQL, UC). Omitted entries use title-case of value. */\nconst LABEL_OVERRIDES: Record<string, string> = {\n  sql_warehouse: \"SQL Warehouse\",\n  uc_function: \"UC Function\",\n  uc_connection: \"UC Connection\",\n};\n\nfunction humanize(value: string): string {\n  if (LABEL_OVERRIDES[value]) return LABEL_OVERRIDES[value];\n  return value.replace(/_/g, \" \").replace(/\\b\\w/g, (c) => c.toUpperCase());\n}\n\nlet cachedOptions: ResourceTypeOption[] | null = null;\nlet cachedPermissions: Record<string, string[]> | null = null;\n\n/**\n * Resource type options (value + label) from schema $defs.resourceType.enum.\n */\nexport function getResourceTypeOptions(): ResourceTypeOption[] {\n  if (cachedOptions) return cachedOptions;\n  const schema = loadSchema();\n  const defs = schema?.$defs as Record<string, unknown> | undefined;\n  const resourceType = defs?.resourceType as { enum?: string[] } | undefined;\n  const enumArr = resourceType?.enum;\n  if (!Array.isArray(enumArr)) {\n    cachedOptions = [];\n    return cachedOptions;\n  }\n  cachedOptions = enumArr.map((value) => ({\n    value,\n    label: humanize(value),\n  }));\n  return cachedOptions;\n}\n\n/**\n * Permissions per resource type from schema resourceRequirement.allOf (if/then).\n */\nexport function getResourceTypePermissions(): Record<string, string[]> {\n  if (cachedPermissions) return cachedPermissions;\n  const schema = loadSchema();\n  const out: Record<string, string[]> = {};\n  if (!schema?.$defs || typeof schema.$defs !== \"object\") {\n    cachedPermissions = out;\n    return out;\n  }\n  const defs = schema.$defs as Record<string, unknown>;\n  const resourceReq = defs.resourceRequirement as\n    | Record<string, unknown>\n    | undefined;\n  const allOf = resourceReq?.allOf as\n    | Array<{\n        if?: { properties?: { type?: { const?: string } } };\n        then?: { properties?: { permission?: { $ref?: string } } };\n      }>\n    | undefined;\n  if (!Array.isArray(allOf)) {\n    cachedPermissions = out;\n    return out;\n  }\n  for (const branch of allOf) {\n    const typeConst = branch?.if?.properties?.type?.const;\n    const ref = branch?.then?.properties?.permission?.$ref;\n    if (typeof typeConst !== \"string\" || typeof ref !== \"string\") continue;\n    const refSegments = ref.replace(/^#\\//, \"\").split(\"/\");\n    let def: unknown = schema;\n    for (const seg of refSegments) {\n      if (def == null || typeof def !== \"object\") break;\n      def = (def as Record<string, unknown>)[seg];\n    }\n    const enumArr = Array.isArray((def as { enum?: string[] })?.enum)\n      ? (def as { enum: string[] }).enum\n      : undefined;\n    if (enumArr?.length) out[typeConst] = enumArr;\n  }\n  cachedPermissions = out;\n  return out;\n}\n"],"mappings":";;;;;;;;;AAQA,MAAM,YAAY,KAAK,QAAQ,cAAc,OAAO,KAAK,IAAI,CAAC;AAC9D,MAAM,cAAc;AAEpB,MAAM,eAAe,CACnB,KAAK,KAAK,WAAW,MAAM,MAAM,MAAM,WAAW,YAAY,EAC9D,KAAK,KAAK,WAAW,MAAM,MAAM,WAAW,YAAY,CACzD;AAOD,SAAS,aAA6C;AACpD,MAAK,MAAM,cAAc,aACvB,KAAI;AACF,MAAI,GAAG,WAAW,WAAW,CAC3B,QAAO,KAAK,MAAM,GAAG,aAAa,YAAY,QAAQ,CAAC;SAKnD;AAIV,QAAO;;;AAIT,MAAM,kBAA0C;CAC9C,eAAe;CACf,aAAa;CACb,eAAe;CAChB;AAED,SAAS,SAAS,OAAuB;AACvC,KAAI,gBAAgB,OAAQ,QAAO,gBAAgB;AACnD,QAAO,MAAM,QAAQ,MAAM,IAAI,CAAC,QAAQ,UAAU,MAAM,EAAE,aAAa,CAAC;;AAG1E,IAAI,gBAA6C;AACjD,IAAI,oBAAqD;;;;AAKzD,SAAgB,yBAA+C;AAC7D,KAAI,cAAe,QAAO;CAI1B,MAAM,YAHS,YAAY,EACN,QACM,eACG;AAC9B,KAAI,CAAC,MAAM,QAAQ,QAAQ,EAAE;AAC3B,kBAAgB,EAAE;AAClB,SAAO;;AAET,iBAAgB,QAAQ,KAAK,WAAW;EACtC;EACA,OAAO,SAAS,MAAM;EACvB,EAAE;AACH,QAAO;;;;;AAMT,SAAgB,6BAAuD;AACrE,KAAI,kBAAmB,QAAO;CAC9B,MAAM,SAAS,YAAY;CAC3B,MAAM,MAAgC,EAAE;AACxC,KAAI,CAAC,QAAQ,SAAS,OAAO,OAAO,UAAU,UAAU;AACtD,sBAAoB;AACpB,SAAO;;CAMT,MAAM,QAJO,OAAO,MACK,qBAGE;AAM3B,KAAI,CAAC,MAAM,QAAQ,MAAM,EAAE;AACzB,sBAAoB;AACpB,SAAO;;AAET,MAAK,MAAM,UAAU,OAAO;EAC1B,MAAM,YAAY,QAAQ,IAAI,YAAY,MAAM;EAChD,MAAM,MAAM,QAAQ,MAAM,YAAY,YAAY;AAClD,MAAI,OAAO,cAAc,YAAY,OAAO,QAAQ,SAAU;EAC9D,MAAM,cAAc,IAAI,QAAQ,QAAQ,GAAG,CAAC,MAAM,IAAI;EACtD,IAAI,MAAe;AACnB,OAAK,MAAM,OAAO,aAAa;AAC7B,OAAI,OAAO,QAAQ,OAAO,QAAQ,SAAU;AAC5C,SAAO,IAAgC;;EAEzC,MAAM,UAAU,MAAM,QAAS,KAA6B,KAAK,GAC5D,IAA2B,OAC5B;AACJ,MAAI,SAAS,OAAQ,KAAI,aAAa;;AAExC,qBAAoB;AACpB,QAAO"}
+{"version":3,"file":"schema-resources.js","names":[],"sources":["../../../../src/cli/commands/plugin/schema-resources.ts"],"sourcesContent":["/**\n * Resource types and permissions sourced from the canonical Zod schemas in\n * `schemas/manifest.ts`. Single source of truth so create, add-resource, and\n * validate stay in sync with the schema.\n *\n * Values are constant at module load (direct Zod imports, no runtime JSON-schema\n * read), so no caching is needed.\n */\nimport {\n  appPermissionSchema,\n  databasePermissionSchema,\n  experimentPermissionSchema,\n  genieSpacePermissionSchema,\n  jobPermissionSchema,\n  postgresPermissionSchema,\n  resourceTypeSchema,\n  secretPermissionSchema,\n  servingEndpointPermissionSchema,\n  sqlWarehousePermissionSchema,\n  ucConnectionPermissionSchema,\n  ucFunctionPermissionSchema,\n  vectorSearchIndexPermissionSchema,\n  volumePermissionSchema,\n} from \"../../../schemas/manifest\";\n\nexport interface ResourceTypeOption {\n  value: string;\n  label: string;\n}\n\n/** Optional display overrides for acronyms (e.g. SQL, UC). Omitted entries use title-case of value. */\nconst LABEL_OVERRIDES: Record<string, string> = {\n  sql_warehouse: \"SQL Warehouse\",\n  uc_function: \"UC Function\",\n  uc_connection: \"UC Connection\",\n};\n\nfunction humanize(value: string): string {\n  if (LABEL_OVERRIDES[value]) return LABEL_OVERRIDES[value];\n  return value.replace(/_/g, \" \").replace(/\\b\\w/g, (c) => c.toUpperCase());\n}\n\n/**\n * Map from resource type literal to its permission enum schema. Mirrors the\n * `allOf + if/then` block in the previous hand-written JSON Schema, but driven\n * directly from the Zod source. Add an entry here when extending\n * `resourceTypeSchema`.\n */\nconst PERMISSION_SCHEMAS_BY_TYPE = {\n  secret: secretPermissionSchema,\n  job: jobPermissionSchema,\n  sql_warehouse: sqlWarehousePermissionSchema,\n  serving_endpoint: servingEndpointPermissionSchema,\n  volume: volumePermissionSchema,\n  vector_search_index: vectorSearchIndexPermissionSchema,\n  uc_function: ucFunctionPermissionSchema,\n  uc_connection: ucConnectionPermissionSchema,\n  database: databasePermissionSchema,\n  postgres: postgresPermissionSchema,\n  genie_space: genieSpacePermissionSchema,\n  experiment: experimentPermissionSchema,\n  app: appPermissionSchema,\n} as const;\n\n/**\n * Resource type options (value + label) from `resourceTypeSchema.options`.\n */\nexport function getResourceTypeOptions(): ResourceTypeOption[] {\n  return resourceTypeSchema.options.map((value) => ({\n    value,\n    label: humanize(value),\n  }));\n}\n\n/**\n * Permissions per resource type, derived from each type's per-type permission\n * schema's `.options` array. Order is weakest-to-strongest (matches Zod enum\n * declaration order, which the original JSON Schema also preserved).\n */\nexport function getResourceTypePermissions(): Record<string, string[]> {\n  const out: Record<string, string[]> = {};\n  for (const [type, schema] of Object.entries(PERMISSION_SCHEMAS_BY_TYPE)) {\n    out[type] = [...schema.options];\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAM,kBAA0C;CAC9C,eAAe;CACf,aAAa;CACb,eAAe;CAChB;AAED,SAAS,SAAS,OAAuB;AACvC,KAAI,gBAAgB,OAAQ,QAAO,gBAAgB;AACnD,QAAO,MAAM,QAAQ,MAAM,IAAI,CAAC,QAAQ,UAAU,MAAM,EAAE,aAAa,CAAC;;;;;;;;AAS1E,MAAM,6BAA6B;CACjC,QAAQ;CACR,KAAK;CACL,eAAe;CACf,kBAAkB;CAClB,QAAQ;CACR,qBAAqB;CACrB,aAAa;CACb,eAAe;CACf,UAAU;CACV,UAAU;CACV,aAAa;CACb,YAAY;CACZ,KAAK;CACN;;;;AAKD,SAAgB,yBAA+C;AAC7D,QAAO,mBAAmB,QAAQ,KAAK,WAAW;EAChD;EACA,OAAO,SAAS,MAAM;EACvB,EAAE;;;;;;;AAQL,SAAgB,6BAAuD;CACrE,MAAM,MAAgC,EAAE;AACxC,MAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,2BAA2B,CACrE,KAAI,QAAQ,CAAC,GAAG,OAAO,QAAQ;AAEjC,QAAO"}

package/dist/cli/commands/plugin/sync/sync.js

@@ -1,3 +1,4 @@
+import { TEMPLATE_SCAFFOLDING, templateFieldEntrySchema } from "../../../../schemas/manifest.js";
 import { loadManifestFromFile, resolveManifestInDir } from "../manifest-resolve.js";
 import { formatValidationErrors, validateManifest } from "../validate/validate-manifest.js";
 import { shouldAllowJsManifestForPackage } from "../trusted-js-manifest.js";
@@ -21,13 +22,13 @@ function isWithinDirectory(filePath, boundary) {
 	return resolvedPath === resolvedBoundary || resolvedPath.startsWith(`${resolvedBoundary}${path.sep}`);
 }
 /**
-* Validates a parsed JSON object against the plugin-manifest JSON schema.
+* Validates a parsed JSON object against the plugin-manifest schema.
 * Returns the manifest if valid, or null and logs schema errors.
 */
 function validateManifestWithSchema(obj, sourcePath) {
 	const result = validateManifest(obj);
 	if (result.valid && result.manifest) return result.manifest;
-	if (result.errors?.length) console.warn(`Warning: Manifest at ${sourcePath} failed schema validation:\n${formatValidationErrors(result.errors, obj)}`);
+	if (result.errors?.length) console.warn(`Warning: Manifest at ${sourcePath} failed schema validation:\n${formatValidationErrors(result.errors)}`);
 	return null;
 }
 /** Safety limit for recursive directory scanning to prevent runaway traversal. */
@@ -47,7 +48,8 @@ async function loadPluginEntry(resolved, pkg, allowJsManifest) {
 		package: pkg,
 		resources: manifest.resources,
 		...manifest.onSetupMessage && { onSetupMessage: manifest.onSetupMessage },
-		...manifest.stability && manifest.stability !== "ga" && { stability: manifest.stability }
+		...manifest.stability && manifest.stability !== "ga" && { stability: manifest.stability },
+		...manifest.scaffolding && { scaffolding: manifest.scaffolding }
 	}];
 }
 /**
@@ -256,7 +258,8 @@ async function scanForPlugins(cwd, packages, allowJsManifest) {
 				package: packageName,
 				resources: manifest.resources,
 				...manifest.onSetupMessage && { onSetupMessage: manifest.onSetupMessage },
-				...manifest.stability && manifest.stability !== "ga" && { stability: manifest.stability }
+				...manifest.stability && manifest.stability !== "ga" && { stability: manifest.stability },
+				...manifest.scaffolding && { scaffolding: manifest.scaffolding }
 			};
 		}
 	}
@@ -321,12 +324,23 @@ async function scanPluginsDir(dir, packageName, allowJsManifest, cwd) {
 }
 /**
 * Write (or preview) the template plugins manifest to disk.
+*
+* Each resource field is parsed through `templateFieldEntrySchema` so the
+* `origin` transform fires and produces canonical `origin` values, even
+* when the input carries a stale `origin`. Parsing per-field (rather than
+* the whole manifest) keeps the surrounding plugin/resource key order
+* stable so the synced JSON's diff stays minimal.
 */
 function writeManifest(outputPath, { plugins }, options) {
+	for (const plugin of Object.values(plugins)) for (const group of [plugin.resources.required, plugin.resources.optional]) for (const resource of group) {
+		if (!resource.fields) continue;
+		for (const fieldName of Object.keys(resource.fields)) resource.fields[fieldName] = templateFieldEntrySchema.parse(resource.fields[fieldName]);
+	}
 	const templateManifest = {
 		$schema: "https://databricks.github.io/appkit/schemas/template-plugins.schema.json",
-		version: "1.1",
-		plugins
+		version: "2.0",
+		plugins,
+		scaffolding: TEMPLATE_SCAFFOLDING
 	};
 	const serialized = JSON.stringify(templateManifest, null, 2);
 	if (options.json) console.log(serialized);

package/dist/cli/commands/plugin/sync/sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync.js","names":[],"sources":["../../../../../src/cli/commands/plugin/sync/sync.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { Lang, parse, type SgNode } from \"@ast-grep/napi\";\nimport { Command } from \"commander\";\nimport {\n  loadManifestFromFile,\n  type ResolvedManifest,\n  resolveManifestInDir,\n} from \"../manifest-resolve\";\nimport type {\n  PluginManifest,\n  TemplatePlugin,\n  TemplatePluginsManifest,\n} from \"../manifest-types\";\nimport { shouldAllowJsManifestForPackage } from \"../trusted-js-manifest\";\nimport {\n  formatValidationErrors,\n  validateManifest,\n} from \"../validate/validate-manifest\";\n\n/**\n * Checks whether a resolved file path is within a given directory boundary.\n * Uses path.resolve + startsWith to prevent directory traversal.\n *\n * @param filePath - The path to check (will be resolved to absolute)\n * @param boundary - The directory that must contain filePath\n * @returns true if filePath is inside boundary (or equal to it)\n */\nfunction isWithinDirectory(filePath: string, boundary: string): boolean {\n  const resolvedPath = path.resolve(filePath);\n  const resolvedBoundary = path.resolve(boundary);\n  // Append separator to avoid prefix false-positives (e.g. /foo-bar matching /foo)\n  return (\n    resolvedPath === resolvedBoundary ||\n    resolvedPath.startsWith(`${resolvedBoundary}${path.sep}`)\n  );\n}\n\n/**\n * Validates a parsed JSON object against the plugin-manifest JSON schema.\n * Returns the manifest if valid, or null and logs schema errors.\n */\nfunction validateManifestWithSchema(\n  obj: unknown,\n  sourcePath: string,\n): PluginManifest | null {\n  const result = validateManifest(obj);\n  if (result.valid && result.manifest) return result.manifest;\n  if (result.errors?.length) {\n    console.warn(\n      `Warning: Manifest at ${sourcePath} failed schema validation:\\n${formatValidationErrors(result.errors, obj)}`,\n    );\n  }\n  return null;\n}\n\n/** Safety limit for recursive directory scanning to prevent runaway traversal. */\nconst MAX_SCAN_DEPTH = 5;\n\n/**\n * Load and validate a resolved manifest, returning a TemplatePlugin entry or null.\n * Centralises the resolve → load → validate → build-entry pipeline used by\n * multiple discovery functions.\n */\nasync function loadPluginEntry(\n  resolved: ResolvedManifest,\n  pkg: string,\n  allowJsManifest: boolean,\n): Promise<[string, TemplatePlugin] | null> {\n  const parsed = await loadManifestFromFile(resolved.path, resolved.type, {\n    allowJsManifest,\n  });\n  const manifest = validateManifestWithSchema(parsed, resolved.path);\n  if (!manifest || manifest.hidden) return null;\n\n  return [\n    manifest.name,\n    {\n      name: manifest.name,\n      displayName: manifest.displayName,\n      description: manifest.description,\n      package: pkg,\n      resources: manifest.resources,\n      ...(manifest.onSetupMessage && {\n        onSetupMessage: manifest.onSetupMessage,\n      }),\n      // Narrowing on `!== \"ga\"` removes \"ga\"; the truthy check\n      // removes `undefined`. What's left is the non-GA tier set,\n      // which TypeScript already knows is assignable to TemplatePlugin's\n      // `stability` field — so no cast is needed and adding a future\n      // tier (e.g. \"alpha\") flows through type-correctly.\n      ...(manifest.stability &&\n        manifest.stability !== \"ga\" && {\n          stability: manifest.stability,\n        }),\n    },\n  ];\n}\n\n/**\n * Known packages that may contain AppKit plugins.\n * Always scanned for manifests, even if not imported in the server file.\n */\nconst KNOWN_PLUGIN_PACKAGES = [\"@databricks/appkit\"];\n\n/**\n * Candidate paths for the server entry file, relative to cwd.\n * Checked in order; the first that exists is used.\n */\nconst SERVER_FILE_CANDIDATES = [\"server/server.ts\", \"server/index.ts\"];\n\n/**\n * Conventional directories to scan for local plugin manifests when\n * --local-plugins-dir is not set. Checked in order; each that exists is scanned.\n * Plugins found here are added to the manifest even if not imported in the server.\n */\nconst CONVENTIONAL_LOCAL_PLUGIN_DIRS = [\"plugins\", \"server\"];\n\n/**\n * Find the server entry file by checking candidate paths in order.\n *\n * @param cwd - Current working directory\n * @returns Absolute path to the server file, or null if none found\n */\nfunction findServerFile(cwd: string): string | null {\n  for (const candidate of SERVER_FILE_CANDIDATES) {\n    const fullPath = path.join(cwd, candidate);\n    if (fs.existsSync(fullPath)) {\n      return fullPath;\n    }\n  }\n  return null;\n}\n\n/**\n * Represents a single named import extracted from the server file.\n */\ninterface ParsedImport {\n  /** The imported name (or local alias if renamed) */\n  name: string;\n  /** The original exported name (differs from name when using `import { foo as bar }`) */\n  originalName: string;\n  /** The module specifier (package name or relative path) */\n  source: string;\n}\n\n/**\n * Extract all named imports from the AST root using structural node traversal.\n * Handles single/double quotes, multiline imports, and aliased imports.\n *\n * @param root - AST root node\n * @returns Array of parsed imports with name, original name, and source\n */\nfunction parseImports(root: SgNode): ParsedImport[] {\n  const imports: ParsedImport[] = [];\n\n  // Find all import_statement nodes in the AST\n  const importStatements = root.findAll({\n    rule: { kind: \"import_statement\" },\n  });\n\n  for (const stmt of importStatements) {\n    // Extract the module specifier (the string node, e.g. '@databricks/appkit')\n    const sourceNode = stmt.find({ rule: { kind: \"string\" } });\n    if (!sourceNode) continue;\n\n    // Strip surrounding quotes from the string node text\n    const source = sourceNode.text().replace(/^['\"]|['\"]$/g, \"\");\n\n    // Find named_imports block: { createApp, analytics, server }\n    const namedImports = stmt.find({ rule: { kind: \"named_imports\" } });\n    if (!namedImports) continue;\n\n    // Extract each import_specifier\n    const specifiers = namedImports.findAll({\n      rule: { kind: \"import_specifier\" },\n    });\n\n    for (const specifier of specifiers) {\n      const children = specifier.children();\n      if (children.length >= 3) {\n        // Aliased import: `foo as bar` — children are [name, \"as\", alias]\n        const originalName = children[0].text();\n        const localName = children[children.length - 1].text();\n        imports.push({ name: localName, originalName, source });\n      } else {\n        // Simple import: `foo`\n        const name = specifier.text();\n        imports.push({ name, originalName: name, source });\n      }\n    }\n  }\n\n  return imports;\n}\n\n/**\n * Extract local names of plugins actually used in the `plugins: [...]` array\n * passed to `createApp()`. Uses structural AST traversal to find `pair` nodes\n * with key \"plugins\" and array values containing call expressions.\n *\n * @param root - AST root node\n * @returns Set of local variable names used as plugin calls in the plugins array\n */\nfunction parsePluginUsages(root: SgNode): Set<string> {\n  const usedNames = new Set<string>();\n\n  // Find all property pairs in the AST\n  const pairs = root.findAll({ rule: { kind: \"pair\" } });\n\n  for (const pair of pairs) {\n    // Check if the property key is \"plugins\"\n    const key = pair.find({ rule: { kind: \"property_identifier\" } });\n    if (!key || key.text() !== \"plugins\") continue;\n\n    // Find the array value\n    const arrayNode = pair.find({ rule: { kind: \"array\" } });\n    if (!arrayNode) continue;\n\n    // Iterate direct children of the array to find call expressions\n    for (const child of arrayNode.children()) {\n      if (child.kind() === \"call_expression\") {\n        // The callee is the first child (the identifier being called)\n        const callee = child.children()[0];\n        if (callee?.kind() === \"identifier\") {\n          usedNames.add(callee.text());\n        }\n      }\n    }\n  }\n\n  return usedNames;\n}\n\n/**\n * File extensions to try when resolving a relative import to a file path.\n */\nconst RESOLVE_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".jsx\"];\n\n/**\n * Resolve a relative import source to the plugin directory containing a manifest\n * (manifest.json or manifest.js). Follows the convention that plugins live in\n * their own directory with a manifest file.\n *\n * Resolution strategy:\n * 1. If the import path is a directory, look for manifest.json/js in it\n * 2. If the import path + extension is a file, look for manifest in its parent directory\n * 3. If the import path is a directory with an index file, look for manifest in that directory\n *\n * @param importSource - The relative import specifier (e.g. \"./plugins/my-plugin\")\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @returns Resolved manifest file path and type, or null if not found\n */\nfunction resolveLocalManifest(\n  importSource: string,\n  serverFileDir: string,\n  allowJsManifest: boolean,\n  projectRoot?: string,\n): ResolvedManifest | null {\n  const resolved = path.resolve(serverFileDir, importSource);\n\n  // Security: Reject paths that escape the project root\n  const boundary = projectRoot || serverFileDir;\n  if (!isWithinDirectory(resolved, boundary)) {\n    console.warn(\n      `Warning: Skipping import \"${importSource}\" — resolves outside the project directory`,\n    );\n    return null;\n  }\n\n  // Case 1: Import path is a directory\n  if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n    return resolveManifestInDir(resolved, { allowJsManifest });\n  }\n\n  // Case 2: Import path + extension resolves to a file — manifest in parent dir\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const filePath = `${resolved}${ext}`;\n    if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {\n      const dir = path.dirname(filePath);\n      if (!isWithinDirectory(dir, boundary)) return null;\n      return resolveManifestInDir(dir, { allowJsManifest });\n    }\n  }\n\n  // Case 3: Import path is a directory with an index file\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const indexPath = path.join(resolved, `index${ext}`);\n    if (fs.existsSync(indexPath)) {\n      return resolveManifestInDir(resolved, { allowJsManifest });\n    }\n  }\n\n  return null;\n}\n\n/**\n * Discover plugin manifests from local (relative) imports in the server file.\n * Resolves each relative import to a directory and loads manifest.json or manifest.js.\n *\n * @param relativeImports - Parsed imports with relative sources (starting with . or /)\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @param cwd - Current working directory (for computing relative paths in output)\n * @returns Map of plugin name to template plugin entry for local plugins\n */\nasync function discoverLocalPlugins(\n  relativeImports: ParsedImport[],\n  serverFileDir: string,\n  cwd: string,\n  allowJsManifest: boolean,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const imp of relativeImports) {\n    const resolved = resolveLocalManifest(\n      imp.source,\n      serverFileDir,\n      allowJsManifest,\n      cwd,\n    );\n    if (!resolved) continue;\n\n    try {\n      const relativePath = path.relative(cwd, path.dirname(resolved.path));\n      const entry = await loadPluginEntry(\n        resolved,\n        `./${relativePath}`,\n        allowJsManifest,\n      );\n      if (entry) plugins[entry[0]] = entry[1];\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Discover plugin manifests from a package's dist folder.\n * Looks for manifest.json or manifest.js in dist/plugins/{plugin-name}/ directories.\n *\n * @param packagePath - Path to the package in node_modules\n * @returns Array of plugin manifests found in the package\n */\nasync function discoverPluginManifests(\n  packagePath: string,\n  allowJsManifest: boolean,\n): Promise<PluginManifest[]> {\n  const pluginsDir = path.join(packagePath, \"dist\", \"plugins\");\n  const manifests: PluginManifest[] = [];\n\n  if (!fs.existsSync(pluginsDir)) {\n    return manifests;\n  }\n\n  const entries = fs.readdirSync(pluginsDir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n    const resolved = resolveManifestInDir(path.join(pluginsDir, entry.name), {\n      allowJsManifest,\n    });\n    if (!resolved) continue;\n\n    try {\n      const parsed = await loadManifestFromFile(resolved.path, resolved.type, {\n        allowJsManifest,\n      });\n      const manifest = validateManifestWithSchema(parsed, resolved.path);\n      if (manifest) {\n        manifests.push(manifest);\n      }\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return manifests;\n}\n\n/**\n * Scan node_modules for packages with plugin manifests.\n *\n * @param cwd - Current working directory to search from\n * @param packages - Set of npm package names to scan for plugin manifests\n * @returns Map of plugin name to template plugin entry\n */\nasync function scanForPlugins(\n  cwd: string,\n  packages: Iterable<string>,\n  allowJsManifest: boolean,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const packageName of packages) {\n    const packagePath = path.join(cwd, \"node_modules\", packageName);\n    if (!fs.existsSync(packagePath)) {\n      continue;\n    }\n\n    const allowJsForPackage =\n      allowJsManifest || shouldAllowJsManifestForPackage(packageName);\n\n    const manifests = await discoverPluginManifests(\n      packagePath,\n      allowJsForPackage,\n    );\n    for (const manifest of manifests) {\n      if (manifest.hidden) continue;\n      plugins[manifest.name] = {\n        name: manifest.name,\n        displayName: manifest.displayName,\n        description: manifest.description,\n        package: packageName,\n        resources: manifest.resources,\n        ...(manifest.onSetupMessage && {\n          onSetupMessage: manifest.onSetupMessage,\n        }),\n        ...(manifest.stability &&\n          manifest.stability !== \"ga\" && {\n            stability: manifest.stability,\n          }),\n      } satisfies TemplatePlugin;\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Recursively scan a directory for plugin manifests. Any directory that\n * contains manifest.json or manifest.js is treated as a plugin root; we do\n * not descend into that directory's children. Used for local plugins discovery\n * so nested paths like server/plugins/category/my-plugin are found.\n */\nasync function scanPluginsDirRecursive(\n  dir: string,\n  cwd: string,\n  allowJsManifest: boolean,\n  depth = 0,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n  if (!fs.existsSync(dir) || depth >= MAX_SCAN_DEPTH) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const pluginDir = path.join(dir, entry.name);\n    const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });\n\n    if (resolved) {\n      const pkg = `./${path.relative(cwd, pluginDir)}`;\n      try {\n        const pluginEntry = await loadPluginEntry(\n          resolved,\n          pkg,\n          allowJsManifest,\n        );\n        if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];\n      } catch (error) {\n        console.warn(\n          `Warning: Failed to load manifest at ${resolved.path}:`,\n          error instanceof Error ? error.message : error,\n        );\n      }\n      continue;\n    }\n\n    Object.assign(\n      plugins,\n      await scanPluginsDirRecursive(pluginDir, cwd, allowJsManifest, depth + 1),\n    );\n  }\n\n  return plugins;\n}\n\n/**\n * Scan a directory for plugin manifests in direct subdirectories only.\n * Each subdirectory may contain manifest.json or manifest.js.\n * Used with --plugins-dir to discover plugins from source instead of node_modules.\n *\n * @param dir - Absolute path to the directory containing plugin subdirectories\n * @param packageName - Package name to assign to discovered plugins (used when cwd is not set)\n * @param cwd - When set, each plugin's package is set to ./<path from cwd to plugin subdir>, e.g. ./server/my-plugin\n * @returns Map of plugin name to template plugin entry\n */\nasync function scanPluginsDir(\n  dir: string,\n  packageName: string,\n  allowJsManifest: boolean,\n  cwd?: string,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (!fs.existsSync(dir)) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const pluginDir = path.join(dir, entry.name);\n    const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });\n    if (!resolved) continue;\n\n    const pkg =\n      cwd !== undefined ? `./${path.relative(cwd, pluginDir)}` : packageName;\n\n    try {\n      const pluginEntry = await loadPluginEntry(resolved, pkg, allowJsManifest);\n      if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Write (or preview) the template plugins manifest to disk.\n */\nfunction writeManifest(\n  outputPath: string,\n  { plugins }: { plugins: TemplatePluginsManifest[\"plugins\"] },\n  options: { write?: boolean; silent?: boolean; json?: boolean },\n) {\n  const templateManifest: TemplatePluginsManifest = {\n    $schema:\n      \"https://databricks.github.io/appkit/schemas/template-plugins.schema.json\",\n    version: \"1.1\",\n    plugins,\n  };\n\n  const serialized = JSON.stringify(templateManifest, null, 2);\n\n  if (options.json) {\n    console.log(serialized);\n  }\n\n  if (options.write) {\n    fs.writeFileSync(outputPath, `${serialized}\\n`);\n    if (!options.silent && !options.json) {\n      console.log(`\\n✓ Wrote ${outputPath}`);\n    }\n  } else if (!options.silent && !options.json) {\n    console.log(\"\\nTo write the manifest, run:\");\n    console.log(\"  npx appkit plugin sync --write\\n\");\n    console.log(\"Preview:\");\n    console.log(\"─\".repeat(60));\n    console.log(serialized);\n    console.log(\"─\".repeat(60));\n  }\n}\n\n/**\n * Run the plugin sync command.\n * Parses the server entry file to discover which packages to scan for plugin\n * manifests, then marks plugins that are actually used in the `plugins: [...]`\n * array as requiredByTemplate.\n */\nasync function runPluginsSync(options: {\n  write?: boolean;\n  output?: string;\n  silent?: boolean;\n  json?: boolean;\n  requirePlugins?: string;\n  pluginsDir?: string;\n  packageName?: string;\n  localPluginsDir?: string;\n  allowJsManifest?: boolean;\n}): Promise<void> {\n  const cwd = process.cwd();\n  const allowJsManifest = Boolean(options.allowJsManifest);\n  const outputPath = path.resolve(cwd, options.output || \"appkit.plugins.json\");\n\n  // Security: Reject output paths that escape the project root\n  if (!isWithinDirectory(outputPath, cwd)) {\n    console.error(\n      `Error: Output path \"${options.output}\" resolves outside the project directory.`,\n    );\n    process.exit(1);\n  }\n\n  if (!options.silent && !options.json) {\n    console.log(\"Scanning for AppKit plugins...\\n\");\n    if (allowJsManifest) {\n      console.warn(\n        \"Warning: --allow-js-manifest executes manifest.js/manifest.cjs files. Only use with trusted code.\",\n      );\n    }\n  }\n\n  // Step 1: Parse server file to discover imports and plugin usages\n  const serverFile = findServerFile(cwd);\n  let serverImports: ParsedImport[] = [];\n  let pluginUsages = new Set<string>();\n\n  if (serverFile) {\n    if (!options.silent && !options.json) {\n      const relativePath = path.relative(cwd, serverFile);\n      console.log(`Server entry file: ${relativePath}`);\n    }\n\n    const content = fs.readFileSync(serverFile, \"utf-8\");\n    const lang = serverFile.endsWith(\".tsx\") ? Lang.Tsx : Lang.TypeScript;\n    const ast = parse(lang, content);\n    const root = ast.root();\n\n    serverImports = parseImports(root);\n    pluginUsages = parsePluginUsages(root);\n  } else if (!options.silent && !options.json) {\n    console.log(\n      \"No server entry file found. Checked:\",\n      SERVER_FILE_CANDIDATES.join(\", \"),\n    );\n  }\n\n  // Step 2: Split imports into npm packages and local (relative) imports\n  const npmImports = serverImports.filter(\n    (i) => !i.source.startsWith(\".\") && !i.source.startsWith(\"/\"),\n  );\n  const localImports = serverImports.filter(\n    (i) => i.source.startsWith(\".\") || i.source.startsWith(\"/\"),\n  );\n\n  // Step 3: Scan for plugin manifests (--plugins-dir or node_modules)\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (options.pluginsDir) {\n    const resolvedDir = path.resolve(cwd, options.pluginsDir);\n    const pkgName = options.packageName ?? \"@databricks/appkit\";\n    if (!options.silent && !options.json) {\n      console.log(`Scanning plugins directory: ${options.pluginsDir}`);\n    }\n    Object.assign(\n      plugins,\n      await scanPluginsDir(resolvedDir, pkgName, allowJsManifest),\n    );\n  } else {\n    const npmPackages = new Set([\n      ...KNOWN_PLUGIN_PACKAGES,\n      ...npmImports.map((i) => i.source),\n    ]);\n    Object.assign(\n      plugins,\n      await scanForPlugins(cwd, npmPackages, allowJsManifest),\n    );\n  }\n\n  // Step 4: Discover local plugin manifests from relative imports\n  if (serverFile && localImports.length > 0) {\n    const serverFileDir = path.dirname(serverFile);\n    const localPlugins = await discoverLocalPlugins(\n      localImports,\n      serverFileDir,\n      cwd,\n      allowJsManifest,\n    );\n    Object.assign(plugins, localPlugins);\n  }\n\n  // Step 4b: Discover local plugins from conventional directory (or --local-plugins-dir).\n  // These are included even when not imported in the server.\n  const localDirsToScan: string[] = options.localPluginsDir\n    ? [options.localPluginsDir]\n    : CONVENTIONAL_LOCAL_PLUGIN_DIRS.filter((d) =>\n        fs.existsSync(path.join(cwd, d)),\n      );\n  for (const dir of localDirsToScan) {\n    const resolvedDir = path.resolve(cwd, dir);\n    if (!fs.existsSync(resolvedDir)) continue;\n    if (!options.silent && !options.json) {\n      console.log(`Scanning local plugins directory: ${dir}`);\n    }\n    const discovered = await scanPluginsDirRecursive(\n      resolvedDir,\n      cwd,\n      allowJsManifest,\n    );\n    for (const [name, entry] of Object.entries(discovered)) {\n      if (!plugins[name]) plugins[name] = entry;\n    }\n  }\n\n  const pluginCount = Object.keys(plugins).length;\n\n  if (pluginCount === 0) {\n    if (options.silent || options.json) {\n      writeManifest(outputPath, { plugins: {} }, options);\n      if (options.silent) return;\n      process.exit(1);\n    }\n    console.log(\"No plugins found.\");\n    if (options.pluginsDir) {\n      console.log(\n        `\\nNo manifest (${allowJsManifest ? \"manifest.json or manifest.js\" : \"manifest.json\"}) found in: ${options.pluginsDir}`,\n      );\n    } else {\n      console.log(\n        \"\\nMake sure you have plugin packages installed, or specify a directory:\",\n      );\n      console.log(\"  appkit plugin sync --plugins-dir <path>\");\n    }\n    process.exit(1);\n  }\n\n  // Step 5: Mark plugins that are imported AND used in the plugins array as mandatory.\n  // For npm imports, match by package name + plugin name.\n  // For local imports, resolve both paths to absolute and compare.\n  const serverFileDir = serverFile ? path.dirname(serverFile) : cwd;\n\n  for (const imp of serverImports) {\n    if (!pluginUsages.has(imp.name)) continue;\n\n    const isLocal = imp.source.startsWith(\".\") || imp.source.startsWith(\"/\");\n    let plugin: TemplatePlugin | undefined;\n\n    if (isLocal) {\n      // Resolve the import source to an absolute path from the server file directory\n      const resolvedImportDir = path.resolve(serverFileDir, imp.source);\n      plugin = Object.values(plugins).find((p) => {\n        if (!p.package.startsWith(\".\")) return false;\n        const resolvedPluginDir = path.resolve(cwd, p.package);\n        return (\n          resolvedPluginDir === resolvedImportDir && p.name === imp.originalName\n        );\n      });\n    } else {\n      // npm import: direct string comparison\n      plugin = Object.values(plugins).find(\n        (p) => p.package === imp.source && p.name === imp.originalName,\n      );\n    }\n\n    if (plugin) {\n      plugin.requiredByTemplate = true;\n    }\n  }\n\n  // Step 6: Apply explicit --require-plugins overrides\n  if (options.requirePlugins) {\n    const explicitNames = options.requirePlugins\n      .split(\",\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n    for (const name of explicitNames) {\n      if (plugins[name]) {\n        plugins[name].requiredByTemplate = true;\n      } else if (!options.silent) {\n        console.warn(\n          `Warning: --require-plugins referenced \"${name}\" but no such plugin was discovered`,\n        );\n      }\n    }\n  }\n\n  // Step 6b: Strip requiredByTemplate for non-GA plugins\n  for (const plugin of Object.values(plugins)) {\n    if (\n      plugin.requiredByTemplate &&\n      plugin.stability &&\n      plugin.stability !== \"ga\"\n    ) {\n      plugin.requiredByTemplate = undefined;\n    }\n  }\n\n  if (!options.silent && !options.json) {\n    console.log(`\\nFound ${pluginCount} plugin(s):`);\n    for (const [name, manifest] of Object.entries(plugins)) {\n      const resourceCount =\n        manifest.resources.required.length + manifest.resources.optional.length;\n      const resourceInfo =\n        resourceCount > 0 ? ` [${resourceCount} resource(s)]` : \"\";\n      const mandatoryTag = manifest.requiredByTemplate ? \" (mandatory)\" : \"\";\n      console.log(\n        `  ${manifest.requiredByTemplate ? \"●\" : \"○\"} ${manifest.displayName} (${name}) from ${manifest.package}${resourceInfo}${mandatoryTag}`,\n      );\n    }\n  }\n\n  // Step 7: Detect orphaned resources from removed plugins\n  if (!options.silent && fs.existsSync(outputPath)) {\n    try {\n      const oldRaw = fs.readFileSync(outputPath, \"utf-8\");\n      const oldManifest = JSON.parse(oldRaw) as TemplatePluginsManifest;\n      const oldNames = new Set(Object.keys(oldManifest.plugins ?? {}));\n      const newNames = new Set(Object.keys(plugins));\n      for (const name of oldNames) {\n        if (newNames.has(name)) continue;\n        const oldPlugin = oldManifest.plugins?.[name];\n        if (!oldPlugin || typeof oldPlugin !== \"object\") continue;\n        const envVars: string[] = [];\n        for (const res of [\n          ...(oldPlugin.resources?.required ?? []),\n          ...(oldPlugin.resources?.optional ?? []),\n        ]) {\n          if (res?.fields) {\n            for (const field of Object.values(res.fields)) {\n              if (field?.env) envVars.push(field.env);\n            }\n          }\n        }\n        const envInfo =\n          envVars.length > 0\n            ? ` The following resource env vars may be orphaned: ${envVars.join(\", \")}`\n            : \"\";\n        console.warn(`Warning: Plugin \"${name}\" was removed.${envInfo}`);\n      }\n    } catch {\n      // Ignore parse errors on existing manifest\n    }\n  }\n\n  writeManifest(outputPath, { plugins }, options);\n}\n\n/** Exported for testing: path boundary check, AST parsing, trust checks. */\nexport {\n  isWithinDirectory,\n  parseImports,\n  parsePluginUsages,\n  shouldAllowJsManifestForPackage,\n};\n\nexport const pluginsSyncCommand = new Command(\"sync\")\n  .description(\n    \"Sync plugin manifests from installed packages into appkit.plugins.json\",\n  )\n  .option(\"-w, --write\", \"Write the manifest file\")\n  .option(\n    \"-o, --output <path>\",\n    \"Output file path (default: ./appkit.plugins.json)\",\n  )\n  .option(\n    \"-s, --silent\",\n    \"Suppress output and never exit with error (for use in predev/prebuild hooks)\",\n  )\n  .option(\n    \"--require-plugins <names>\",\n    \"Comma-separated plugin names to mark as requiredByTemplate (e.g. server,analytics)\",\n  )\n  .option(\n    \"--plugins-dir <path>\",\n    \"Scan this directory for plugin subdirectories with manifest.json (instead of node_modules)\",\n  )\n  .option(\n    \"--package-name <name>\",\n    \"Package name to assign to plugins found via --plugins-dir (default: @databricks/appkit)\",\n  )\n  .option(\n    \"--local-plugins-dir <path>\",\n    \"Also scan this directory for local plugin manifests (default: plugins, server)\",\n  )\n  .option(\n    \"--allow-js-manifest\",\n    \"Allow reading manifest.js/manifest.cjs (executes code; use only with trusted plugins)\",\n  )\n  .option(\"--json\", \"Output manifest as JSON to stdout\")\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  $ appkit plugin sync\n  $ appkit plugin sync --write\n  $ appkit plugin sync --write --require-plugins server,analytics\n  $ appkit plugin sync --write --plugins-dir src/plugins --package-name @my/pkg\n  $ appkit plugin sync --json\n  $ appkit plugin sync --silent`,\n  )\n  .action((opts) =>\n    runPluginsSync(opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,SAAS,kBAAkB,UAAkB,UAA2B;CACtE,MAAM,eAAe,KAAK,QAAQ,SAAS;CAC3C,MAAM,mBAAmB,KAAK,QAAQ,SAAS;AAE/C,QACE,iBAAiB,oBACjB,aAAa,WAAW,GAAG,mBAAmB,KAAK,MAAM;;;;;;AAQ7D,SAAS,2BACP,KACA,YACuB;CACvB,MAAM,SAAS,iBAAiB,IAAI;AACpC,KAAI,OAAO,SAAS,OAAO,SAAU,QAAO,OAAO;AACnD,KAAI,OAAO,QAAQ,OACjB,SAAQ,KACN,wBAAwB,WAAW,8BAA8B,uBAAuB,OAAO,QAAQ,IAAI,GAC5G;AAEH,QAAO;;;AAIT,MAAM,iBAAiB;;;;;;AAOvB,eAAe,gBACb,UACA,KACA,iBAC0C;CAI1C,MAAM,WAAW,2BAHF,MAAM,qBAAqB,SAAS,MAAM,SAAS,MAAM,EACtE,iBACD,CAAC,EACkD,SAAS,KAAK;AAClE,KAAI,CAAC,YAAY,SAAS,OAAQ,QAAO;AAEzC,QAAO,CACL,SAAS,MACT;EACE,MAAM,SAAS;EACf,aAAa,SAAS;EACtB,aAAa,SAAS;EACtB,SAAS;EACT,WAAW,SAAS;EACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;EAMD,GAAI,SAAS,aACX,SAAS,cAAc,QAAQ,EAC7B,WAAW,SAAS,WACrB;EACJ,CACF;;;;;;AAOH,MAAM,wBAAwB,CAAC,qBAAqB;;;;;AAMpD,MAAM,yBAAyB,CAAC,oBAAoB,kBAAkB;;;;;;AAOtE,MAAM,iCAAiC,CAAC,WAAW,SAAS;;;;;;;AAQ5D,SAAS,eAAe,KAA4B;AAClD,MAAK,MAAM,aAAa,wBAAwB;EAC9C,MAAM,WAAW,KAAK,KAAK,KAAK,UAAU;AAC1C,MAAI,GAAG,WAAW,SAAS,CACzB,QAAO;;AAGX,QAAO;;;;;;;;;AAsBT,SAAS,aAAa,MAA8B;CAClD,MAAM,UAA0B,EAAE;CAGlC,MAAM,mBAAmB,KAAK,QAAQ,EACpC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,MAAK,MAAM,QAAQ,kBAAkB;EAEnC,MAAM,aAAa,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,EAAE,CAAC;AAC1D,MAAI,CAAC,WAAY;EAGjB,MAAM,SAAS,WAAW,MAAM,CAAC,QAAQ,gBAAgB,GAAG;EAG5D,MAAM,eAAe,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,EAAE,CAAC;AACnE,MAAI,CAAC,aAAc;EAGnB,MAAM,aAAa,aAAa,QAAQ,EACtC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,OAAK,MAAM,aAAa,YAAY;GAClC,MAAM,WAAW,UAAU,UAAU;AACrC,OAAI,SAAS,UAAU,GAAG;IAExB,MAAM,eAAe,SAAS,GAAG,MAAM;IACvC,MAAM,YAAY,SAAS,SAAS,SAAS,GAAG,MAAM;AACtD,YAAQ,KAAK;KAAE,MAAM;KAAW;KAAc;KAAQ,CAAC;UAClD;IAEL,MAAM,OAAO,UAAU,MAAM;AAC7B,YAAQ,KAAK;KAAE;KAAM,cAAc;KAAM;KAAQ,CAAC;;;;AAKxD,QAAO;;;;;;;;;;AAWT,SAAS,kBAAkB,MAA2B;CACpD,MAAM,4BAAY,IAAI,KAAa;CAGnC,MAAM,QAAQ,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,EAAE,CAAC;AAEtD,MAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,MAAM,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,EAAE,CAAC;AAChE,MAAI,CAAC,OAAO,IAAI,MAAM,KAAK,UAAW;EAGtC,MAAM,YAAY,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,CAAC;AACxD,MAAI,CAAC,UAAW;AAGhB,OAAK,MAAM,SAAS,UAAU,UAAU,CACtC,KAAI,MAAM,MAAM,KAAK,mBAAmB;GAEtC,MAAM,SAAS,MAAM,UAAU,CAAC;AAChC,OAAI,QAAQ,MAAM,KAAK,aACrB,WAAU,IAAI,OAAO,MAAM,CAAC;;;AAMpC,QAAO;;;;;AAMT,MAAM,qBAAqB;CAAC;CAAO;CAAQ;CAAO;CAAO;;;;;;;;;;;;;;;AAgBzD,SAAS,qBACP,cACA,eACA,iBACA,aACyB;CACzB,MAAM,WAAW,KAAK,QAAQ,eAAe,aAAa;CAG1D,MAAM,WAAW,eAAe;AAChC,KAAI,CAAC,kBAAkB,UAAU,SAAS,EAAE;AAC1C,UAAQ,KACN,6BAA6B,aAAa,4CAC3C;AACD,SAAO;;AAIT,KAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,aAAa,CAChE,QAAO,qBAAqB,UAAU,EAAE,iBAAiB,CAAC;AAI5D,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,WAAW,GAAG,WAAW;AAC/B,MAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,QAAQ,EAAE;GAC7D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,OAAI,CAAC,kBAAkB,KAAK,SAAS,CAAE,QAAO;AAC9C,UAAO,qBAAqB,KAAK,EAAE,iBAAiB,CAAC;;;AAKzD,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,YAAY,KAAK,KAAK,UAAU,QAAQ,MAAM;AACpD,MAAI,GAAG,WAAW,UAAU,CAC1B,QAAO,qBAAqB,UAAU,EAAE,iBAAiB,CAAC;;AAI9D,QAAO;;;;;;;;;;;AAYT,eAAe,qBACb,iBACA,eACA,KACA,iBAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,WAAW,qBACf,IAAI,QACJ,eACA,iBACA,IACD;AACD,MAAI,CAAC,SAAU;AAEf,MAAI;GAEF,MAAM,QAAQ,MAAM,gBAClB,UACA,KAHmB,KAAK,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK,CAAC,IAIlE,gBACD;AACD,OAAI,MAAO,SAAQ,MAAM,MAAM,MAAM;WAC9B,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,eAAe,wBACb,aACA,iBAC2B;CAC3B,MAAM,aAAa,KAAK,KAAK,aAAa,QAAQ,UAAU;CAC5D,MAAM,YAA8B,EAAE;AAEtC,KAAI,CAAC,GAAG,WAAW,WAAW,CAC5B,QAAO;CAGT,MAAM,UAAU,GAAG,YAAY,YAAY,EAAE,eAAe,MAAM,CAAC;AACnE,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAC1B,MAAM,WAAW,qBAAqB,KAAK,KAAK,YAAY,MAAM,KAAK,EAAE,EACvE,iBACD,CAAC;AACF,MAAI,CAAC,SAAU;AAEf,MAAI;GAIF,MAAM,WAAW,2BAHF,MAAM,qBAAqB,SAAS,MAAM,SAAS,MAAM,EACtE,iBACD,CAAC,EACkD,SAAS,KAAK;AAClE,OAAI,SACF,WAAU,KAAK,SAAS;WAEnB,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,eAAe,eACb,KACA,UACA,iBAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,eAAe,UAAU;EAClC,MAAM,cAAc,KAAK,KAAK,KAAK,gBAAgB,YAAY;AAC/D,MAAI,CAAC,GAAG,WAAW,YAAY,CAC7B;EAMF,MAAM,YAAY,MAAM,wBACtB,aAHA,mBAAmB,gCAAgC,YAAY,CAKhE;AACD,OAAK,MAAM,YAAY,WAAW;AAChC,OAAI,SAAS,OAAQ;AACrB,WAAQ,SAAS,QAAQ;IACvB,MAAM,SAAS;IACf,aAAa,SAAS;IACtB,aAAa,SAAS;IACtB,SAAS;IACT,WAAW,SAAS;IACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;IACD,GAAI,SAAS,aACX,SAAS,cAAc,QAAQ,EAC7B,WAAW,SAAS,WACrB;IACJ;;;AAIL,QAAO;;;;;;;;AAST,eAAe,wBACb,KACA,KACA,iBACA,QAAQ,GACqC;CAC7C,MAAM,UAA8C,EAAE;AACtD,KAAI,CAAC,GAAG,WAAW,IAAI,IAAI,SAAS,eAAgB,QAAO;CAE3D,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,CAAC;AAErE,MAAI,UAAU;GACZ,MAAM,MAAM,KAAK,KAAK,SAAS,KAAK,UAAU;AAC9C,OAAI;IACF,MAAM,cAAc,MAAM,gBACxB,UACA,KACA,gBACD;AACD,QAAI,YAAa,SAAQ,YAAY,MAAM,YAAY;YAChD,OAAO;AACd,YAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;AAEH;;AAGF,SAAO,OACL,SACA,MAAM,wBAAwB,WAAW,KAAK,iBAAiB,QAAQ,EAAE,CAC1E;;AAGH,QAAO;;;;;;;;;;;;AAaT,eAAe,eACb,KACA,aACA,iBACA,KAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,KAAI,CAAC,GAAG,WAAW,IAAI,CAAE,QAAO;CAEhC,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,CAAC;AACrE,MAAI,CAAC,SAAU;EAEf,MAAM,MACJ,QAAQ,SAAY,KAAK,KAAK,SAAS,KAAK,UAAU,KAAK;AAE7D,MAAI;GACF,MAAM,cAAc,MAAM,gBAAgB,UAAU,KAAK,gBAAgB;AACzE,OAAI,YAAa,SAAQ,YAAY,MAAM,YAAY;WAChD,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;AAMT,SAAS,cACP,YACA,EAAE,WACF,SACA;CACA,MAAM,mBAA4C;EAChD,SACE;EACF,SAAS;EACT;EACD;CAED,MAAM,aAAa,KAAK,UAAU,kBAAkB,MAAM,EAAE;AAE5D,KAAI,QAAQ,KACV,SAAQ,IAAI,WAAW;AAGzB,KAAI,QAAQ,OAAO;AACjB,KAAG,cAAc,YAAY,GAAG,WAAW,IAAI;AAC/C,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,aAAa,aAAa;YAE/B,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AAC3C,UAAQ,IAAI,gCAAgC;AAC5C,UAAQ,IAAI,qCAAqC;AACjD,UAAQ,IAAI,WAAW;AACvB,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;AAC3B,UAAQ,IAAI,WAAW;AACvB,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;;;;;;;;;AAU/B,eAAe,eAAe,SAUZ;CAChB,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,kBAAkB,QAAQ,QAAQ,gBAAgB;CACxD,MAAM,aAAa,KAAK,QAAQ,KAAK,QAAQ,UAAU,sBAAsB;AAG7E,KAAI,CAAC,kBAAkB,YAAY,IAAI,EAAE;AACvC,UAAQ,MACN,uBAAuB,QAAQ,OAAO,2CACvC;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AACpC,UAAQ,IAAI,mCAAmC;AAC/C,MAAI,gBACF,SAAQ,KACN,oGACD;;CAKL,MAAM,aAAa,eAAe,IAAI;CACtC,IAAI,gBAAgC,EAAE;CACtC,IAAI,+BAAe,IAAI,KAAa;AAEpC,KAAI,YAAY;AACd,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;GACpC,MAAM,eAAe,KAAK,SAAS,KAAK,WAAW;AACnD,WAAQ,IAAI,sBAAsB,eAAe;;EAGnD,MAAM,UAAU,GAAG,aAAa,YAAY,QAAQ;EAGpD,MAAM,OADM,MADC,WAAW,SAAS,OAAO,GAAG,KAAK,MAAM,KAAK,YACnC,QAAQ,CACf,MAAM;AAEvB,kBAAgB,aAAa,KAAK;AAClC,iBAAe,kBAAkB,KAAK;YAC7B,CAAC,QAAQ,UAAU,CAAC,QAAQ,KACrC,SAAQ,IACN,wCACA,uBAAuB,KAAK,KAAK,CAClC;CAIH,MAAM,aAAa,cAAc,QAC9B,MAAM,CAAC,EAAE,OAAO,WAAW,IAAI,IAAI,CAAC,EAAE,OAAO,WAAW,IAAI,CAC9D;CACD,MAAM,eAAe,cAAc,QAChC,MAAM,EAAE,OAAO,WAAW,IAAI,IAAI,EAAE,OAAO,WAAW,IAAI,CAC5D;CAGD,MAAM,UAA8C,EAAE;AAEtD,KAAI,QAAQ,YAAY;EACtB,MAAM,cAAc,KAAK,QAAQ,KAAK,QAAQ,WAAW;EACzD,MAAM,UAAU,QAAQ,eAAe;AACvC,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,+BAA+B,QAAQ,aAAa;AAElE,SAAO,OACL,SACA,MAAM,eAAe,aAAa,SAAS,gBAAgB,CAC5D;QACI;EACL,MAAM,cAAc,IAAI,IAAI,CAC1B,GAAG,uBACH,GAAG,WAAW,KAAK,MAAM,EAAE,OAAO,CACnC,CAAC;AACF,SAAO,OACL,SACA,MAAM,eAAe,KAAK,aAAa,gBAAgB,CACxD;;AAIH,KAAI,cAAc,aAAa,SAAS,GAAG;EAEzC,MAAM,eAAe,MAAM,qBACzB,cAFoB,KAAK,QAAQ,WAAW,EAI5C,KACA,gBACD;AACD,SAAO,OAAO,SAAS,aAAa;;CAKtC,MAAM,kBAA4B,QAAQ,kBACtC,CAAC,QAAQ,gBAAgB,GACzB,+BAA+B,QAAQ,MACrC,GAAG,WAAW,KAAK,KAAK,KAAK,EAAE,CAAC,CACjC;AACL,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,cAAc,KAAK,QAAQ,KAAK,IAAI;AAC1C,MAAI,CAAC,GAAG,WAAW,YAAY,CAAE;AACjC,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,qCAAqC,MAAM;EAEzD,MAAM,aAAa,MAAM,wBACvB,aACA,KACA,gBACD;AACD,OAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,WAAW,CACpD,KAAI,CAAC,QAAQ,MAAO,SAAQ,QAAQ;;CAIxC,MAAM,cAAc,OAAO,KAAK,QAAQ,CAAC;AAEzC,KAAI,gBAAgB,GAAG;AACrB,MAAI,QAAQ,UAAU,QAAQ,MAAM;AAClC,iBAAc,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ;AACnD,OAAI,QAAQ,OAAQ;AACpB,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,IAAI,oBAAoB;AAChC,MAAI,QAAQ,WACV,SAAQ,IACN,kBAAkB,kBAAkB,iCAAiC,gBAAgB,cAAc,QAAQ,aAC5G;OACI;AACL,WAAQ,IACN,0EACD;AACD,WAAQ,IAAI,4CAA4C;;AAE1D,UAAQ,KAAK,EAAE;;CAMjB,MAAM,gBAAgB,aAAa,KAAK,QAAQ,WAAW,GAAG;AAE9D,MAAK,MAAM,OAAO,eAAe;AAC/B,MAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAAE;EAEjC,MAAM,UAAU,IAAI,OAAO,WAAW,IAAI,IAAI,IAAI,OAAO,WAAW,IAAI;EACxE,IAAI;AAEJ,MAAI,SAAS;GAEX,MAAM,oBAAoB,KAAK,QAAQ,eAAe,IAAI,OAAO;AACjE,YAAS,OAAO,OAAO,QAAQ,CAAC,MAAM,MAAM;AAC1C,QAAI,CAAC,EAAE,QAAQ,WAAW,IAAI,CAAE,QAAO;AAEvC,WAD0B,KAAK,QAAQ,KAAK,EAAE,QAAQ,KAE9B,qBAAqB,EAAE,SAAS,IAAI;KAE5D;QAGF,UAAS,OAAO,OAAO,QAAQ,CAAC,MAC7B,MAAM,EAAE,YAAY,IAAI,UAAU,EAAE,SAAS,IAAI,aACnD;AAGH,MAAI,OACF,QAAO,qBAAqB;;AAKhC,KAAI,QAAQ,gBAAgB;EAC1B,MAAM,gBAAgB,QAAQ,eAC3B,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,OAAO,QAAQ;AAClB,OAAK,MAAM,QAAQ,cACjB,KAAI,QAAQ,MACV,SAAQ,MAAM,qBAAqB;WAC1B,CAAC,QAAQ,OAClB,SAAQ,KACN,0CAA0C,KAAK,qCAChD;;AAMP,MAAK,MAAM,UAAU,OAAO,OAAO,QAAQ,CACzC,KACE,OAAO,sBACP,OAAO,aACP,OAAO,cAAc,KAErB,QAAO,qBAAqB;AAIhC,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AACpC,UAAQ,IAAI,WAAW,YAAY,aAAa;AAChD,OAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,EAAE;GACtD,MAAM,gBACJ,SAAS,UAAU,SAAS,SAAS,SAAS,UAAU,SAAS;GACnE,MAAM,eACJ,gBAAgB,IAAI,KAAK,cAAc,iBAAiB;GAC1D,MAAM,eAAe,SAAS,qBAAqB,iBAAiB;AACpE,WAAQ,IACN,KAAK,SAAS,qBAAqB,MAAM,IAAI,GAAG,SAAS,YAAY,IAAI,KAAK,SAAS,SAAS,UAAU,eAAe,eAC1H;;;AAKL,KAAI,CAAC,QAAQ,UAAU,GAAG,WAAW,WAAW,CAC9C,KAAI;EACF,MAAM,SAAS,GAAG,aAAa,YAAY,QAAQ;EACnD,MAAM,cAAc,KAAK,MAAM,OAAO;EACtC,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,YAAY,WAAW,EAAE,CAAC,CAAC;EAChE,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC;AAC9C,OAAK,MAAM,QAAQ,UAAU;AAC3B,OAAI,SAAS,IAAI,KAAK,CAAE;GACxB,MAAM,YAAY,YAAY,UAAU;AACxC,OAAI,CAAC,aAAa,OAAO,cAAc,SAAU;GACjD,MAAM,UAAoB,EAAE;AAC5B,QAAK,MAAM,OAAO,CAChB,GAAI,UAAU,WAAW,YAAY,EAAE,EACvC,GAAI,UAAU,WAAW,YAAY,EAAE,CACxC,CACC,KAAI,KAAK,QACP;SAAK,MAAM,SAAS,OAAO,OAAO,IAAI,OAAO,CAC3C,KAAI,OAAO,IAAK,SAAQ,KAAK,MAAM,IAAI;;GAI7C,MAAM,UACJ,QAAQ,SAAS,IACb,qDAAqD,QAAQ,KAAK,KAAK,KACvE;AACN,WAAQ,KAAK,oBAAoB,KAAK,gBAAgB,UAAU;;SAE5D;AAKV,eAAc,YAAY,EAAE,SAAS,EAAE,QAAQ;;AAWjD,MAAa,qBAAqB,IAAI,QAAQ,OAAO,CAClD,YACC,yEACD,CACA,OAAO,eAAe,0BAA0B,CAChD,OACC,uBACA,oDACD,CACA,OACC,gBACA,+EACD,CACA,OACC,6BACA,qFACD,CACA,OACC,wBACA,6FACD,CACA,OACC,yBACA,0FACD,CACA,OACC,8BACA,iFACD,CACA,OACC,uBACA,wFACD,CACA,OAAO,UAAU,oCAAoC,CACrD,YACC,SACA;;;;;;;iCAQD,CACA,QAAQ,SACP,eAAe,KAAK,CAAC,OAAO,QAAQ;AAClC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}
+{"version":3,"file":"sync.js","names":[],"sources":["../../../../../src/cli/commands/plugin/sync/sync.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { Lang, parse, type SgNode } from \"@ast-grep/napi\";\nimport { Command } from \"commander\";\nimport {\n  TEMPLATE_SCAFFOLDING,\n  templateFieldEntrySchema,\n} from \"../../../../schemas/manifest\";\nimport {\n  loadManifestFromFile,\n  type ResolvedManifest,\n  resolveManifestInDir,\n} from \"../manifest-resolve\";\nimport type {\n  PluginManifest,\n  TemplatePlugin,\n  TemplatePluginsManifest,\n} from \"../manifest-types\";\nimport { shouldAllowJsManifestForPackage } from \"../trusted-js-manifest\";\nimport {\n  formatValidationErrors,\n  validateManifest,\n} from \"../validate/validate-manifest\";\n\n/**\n * Checks whether a resolved file path is within a given directory boundary.\n * Uses path.resolve + startsWith to prevent directory traversal.\n *\n * @param filePath - The path to check (will be resolved to absolute)\n * @param boundary - The directory that must contain filePath\n * @returns true if filePath is inside boundary (or equal to it)\n */\nfunction isWithinDirectory(filePath: string, boundary: string): boolean {\n  const resolvedPath = path.resolve(filePath);\n  const resolvedBoundary = path.resolve(boundary);\n  // Append separator to avoid prefix false-positives (e.g. /foo-bar matching /foo)\n  return (\n    resolvedPath === resolvedBoundary ||\n    resolvedPath.startsWith(`${resolvedBoundary}${path.sep}`)\n  );\n}\n\n/**\n * Validates a parsed JSON object against the plugin-manifest schema.\n * Returns the manifest if valid, or null and logs schema errors.\n */\nfunction validateManifestWithSchema(\n  obj: unknown,\n  sourcePath: string,\n): PluginManifest | null {\n  const result = validateManifest(obj);\n  if (result.valid && result.manifest) return result.manifest;\n  if (result.errors?.length) {\n    console.warn(\n      `Warning: Manifest at ${sourcePath} failed schema validation:\\n${formatValidationErrors(result.errors)}`,\n    );\n  }\n  return null;\n}\n\n/** Safety limit for recursive directory scanning to prevent runaway traversal. */\nconst MAX_SCAN_DEPTH = 5;\n\n/**\n * Load and validate a resolved manifest, returning a TemplatePlugin entry or null.\n * Centralises the resolve → load → validate → build-entry pipeline used by\n * multiple discovery functions.\n */\nasync function loadPluginEntry(\n  resolved: ResolvedManifest,\n  pkg: string,\n  allowJsManifest: boolean,\n): Promise<[string, TemplatePlugin] | null> {\n  const parsed = await loadManifestFromFile(resolved.path, resolved.type, {\n    allowJsManifest,\n  });\n  const manifest = validateManifestWithSchema(parsed, resolved.path);\n  if (!manifest || manifest.hidden) return null;\n\n  return [\n    manifest.name,\n    {\n      name: manifest.name,\n      displayName: manifest.displayName,\n      description: manifest.description,\n      package: pkg,\n      resources: manifest.resources,\n      ...(manifest.onSetupMessage && {\n        onSetupMessage: manifest.onSetupMessage,\n      }),\n      // Narrowing on `!== \"ga\"` removes \"ga\"; the truthy check\n      // removes `undefined`. What's left is the non-GA tier set,\n      // which TypeScript already knows is assignable to TemplatePlugin's\n      // `stability` field — so no cast is needed and adding a future\n      // tier (e.g. \"alpha\") flows through type-correctly.\n      ...(manifest.stability &&\n        manifest.stability !== \"ga\" && {\n          stability: manifest.stability,\n        }),\n      ...(manifest.scaffolding && {\n        scaffolding: manifest.scaffolding,\n      }),\n    },\n  ];\n}\n\n/**\n * Known packages that may contain AppKit plugins.\n * Always scanned for manifests, even if not imported in the server file.\n */\nconst KNOWN_PLUGIN_PACKAGES = [\"@databricks/appkit\"];\n\n/**\n * Candidate paths for the server entry file, relative to cwd.\n * Checked in order; the first that exists is used.\n */\nconst SERVER_FILE_CANDIDATES = [\"server/server.ts\", \"server/index.ts\"];\n\n/**\n * Conventional directories to scan for local plugin manifests when\n * --local-plugins-dir is not set. Checked in order; each that exists is scanned.\n * Plugins found here are added to the manifest even if not imported in the server.\n */\nconst CONVENTIONAL_LOCAL_PLUGIN_DIRS = [\"plugins\", \"server\"];\n\n/**\n * Find the server entry file by checking candidate paths in order.\n *\n * @param cwd - Current working directory\n * @returns Absolute path to the server file, or null if none found\n */\nfunction findServerFile(cwd: string): string | null {\n  for (const candidate of SERVER_FILE_CANDIDATES) {\n    const fullPath = path.join(cwd, candidate);\n    if (fs.existsSync(fullPath)) {\n      return fullPath;\n    }\n  }\n  return null;\n}\n\n/**\n * Represents a single named import extracted from the server file.\n */\ninterface ParsedImport {\n  /** The imported name (or local alias if renamed) */\n  name: string;\n  /** The original exported name (differs from name when using `import { foo as bar }`) */\n  originalName: string;\n  /** The module specifier (package name or relative path) */\n  source: string;\n}\n\n/**\n * Extract all named imports from the AST root using structural node traversal.\n * Handles single/double quotes, multiline imports, and aliased imports.\n *\n * @param root - AST root node\n * @returns Array of parsed imports with name, original name, and source\n */\nfunction parseImports(root: SgNode): ParsedImport[] {\n  const imports: ParsedImport[] = [];\n\n  // Find all import_statement nodes in the AST\n  const importStatements = root.findAll({\n    rule: { kind: \"import_statement\" },\n  });\n\n  for (const stmt of importStatements) {\n    // Extract the module specifier (the string node, e.g. '@databricks/appkit')\n    const sourceNode = stmt.find({ rule: { kind: \"string\" } });\n    if (!sourceNode) continue;\n\n    // Strip surrounding quotes from the string node text\n    const source = sourceNode.text().replace(/^['\"]|['\"]$/g, \"\");\n\n    // Find named_imports block: { createApp, analytics, server }\n    const namedImports = stmt.find({ rule: { kind: \"named_imports\" } });\n    if (!namedImports) continue;\n\n    // Extract each import_specifier\n    const specifiers = namedImports.findAll({\n      rule: { kind: \"import_specifier\" },\n    });\n\n    for (const specifier of specifiers) {\n      const children = specifier.children();\n      if (children.length >= 3) {\n        // Aliased import: `foo as bar` — children are [name, \"as\", alias]\n        const originalName = children[0].text();\n        const localName = children[children.length - 1].text();\n        imports.push({ name: localName, originalName, source });\n      } else {\n        // Simple import: `foo`\n        const name = specifier.text();\n        imports.push({ name, originalName: name, source });\n      }\n    }\n  }\n\n  return imports;\n}\n\n/**\n * Extract local names of plugins actually used in the `plugins: [...]` array\n * passed to `createApp()`. Uses structural AST traversal to find `pair` nodes\n * with key \"plugins\" and array values containing call expressions.\n *\n * @param root - AST root node\n * @returns Set of local variable names used as plugin calls in the plugins array\n */\nfunction parsePluginUsages(root: SgNode): Set<string> {\n  const usedNames = new Set<string>();\n\n  // Find all property pairs in the AST\n  const pairs = root.findAll({ rule: { kind: \"pair\" } });\n\n  for (const pair of pairs) {\n    // Check if the property key is \"plugins\"\n    const key = pair.find({ rule: { kind: \"property_identifier\" } });\n    if (!key || key.text() !== \"plugins\") continue;\n\n    // Find the array value\n    const arrayNode = pair.find({ rule: { kind: \"array\" } });\n    if (!arrayNode) continue;\n\n    // Iterate direct children of the array to find call expressions\n    for (const child of arrayNode.children()) {\n      if (child.kind() === \"call_expression\") {\n        // The callee is the first child (the identifier being called)\n        const callee = child.children()[0];\n        if (callee?.kind() === \"identifier\") {\n          usedNames.add(callee.text());\n        }\n      }\n    }\n  }\n\n  return usedNames;\n}\n\n/**\n * File extensions to try when resolving a relative import to a file path.\n */\nconst RESOLVE_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".jsx\"];\n\n/**\n * Resolve a relative import source to the plugin directory containing a manifest\n * (manifest.json or manifest.js). Follows the convention that plugins live in\n * their own directory with a manifest file.\n *\n * Resolution strategy:\n * 1. If the import path is a directory, look for manifest.json/js in it\n * 2. If the import path + extension is a file, look for manifest in its parent directory\n * 3. If the import path is a directory with an index file, look for manifest in that directory\n *\n * @param importSource - The relative import specifier (e.g. \"./plugins/my-plugin\")\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @returns Resolved manifest file path and type, or null if not found\n */\nfunction resolveLocalManifest(\n  importSource: string,\n  serverFileDir: string,\n  allowJsManifest: boolean,\n  projectRoot?: string,\n): ResolvedManifest | null {\n  const resolved = path.resolve(serverFileDir, importSource);\n\n  // Security: Reject paths that escape the project root\n  const boundary = projectRoot || serverFileDir;\n  if (!isWithinDirectory(resolved, boundary)) {\n    console.warn(\n      `Warning: Skipping import \"${importSource}\" — resolves outside the project directory`,\n    );\n    return null;\n  }\n\n  // Case 1: Import path is a directory\n  if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n    return resolveManifestInDir(resolved, { allowJsManifest });\n  }\n\n  // Case 2: Import path + extension resolves to a file — manifest in parent dir\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const filePath = `${resolved}${ext}`;\n    if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {\n      const dir = path.dirname(filePath);\n      if (!isWithinDirectory(dir, boundary)) return null;\n      return resolveManifestInDir(dir, { allowJsManifest });\n    }\n  }\n\n  // Case 3: Import path is a directory with an index file\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const indexPath = path.join(resolved, `index${ext}`);\n    if (fs.existsSync(indexPath)) {\n      return resolveManifestInDir(resolved, { allowJsManifest });\n    }\n  }\n\n  return null;\n}\n\n/**\n * Discover plugin manifests from local (relative) imports in the server file.\n * Resolves each relative import to a directory and loads manifest.json or manifest.js.\n *\n * @param relativeImports - Parsed imports with relative sources (starting with . or /)\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @param cwd - Current working directory (for computing relative paths in output)\n * @returns Map of plugin name to template plugin entry for local plugins\n */\nasync function discoverLocalPlugins(\n  relativeImports: ParsedImport[],\n  serverFileDir: string,\n  cwd: string,\n  allowJsManifest: boolean,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const imp of relativeImports) {\n    const resolved = resolveLocalManifest(\n      imp.source,\n      serverFileDir,\n      allowJsManifest,\n      cwd,\n    );\n    if (!resolved) continue;\n\n    try {\n      const relativePath = path.relative(cwd, path.dirname(resolved.path));\n      const entry = await loadPluginEntry(\n        resolved,\n        `./${relativePath}`,\n        allowJsManifest,\n      );\n      if (entry) plugins[entry[0]] = entry[1];\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Discover plugin manifests from a package's dist folder.\n * Looks for manifest.json or manifest.js in dist/plugins/{plugin-name}/ directories.\n *\n * @param packagePath - Path to the package in node_modules\n * @returns Array of plugin manifests found in the package\n */\nasync function discoverPluginManifests(\n  packagePath: string,\n  allowJsManifest: boolean,\n): Promise<PluginManifest[]> {\n  const pluginsDir = path.join(packagePath, \"dist\", \"plugins\");\n  const manifests: PluginManifest[] = [];\n\n  if (!fs.existsSync(pluginsDir)) {\n    return manifests;\n  }\n\n  const entries = fs.readdirSync(pluginsDir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n    const resolved = resolveManifestInDir(path.join(pluginsDir, entry.name), {\n      allowJsManifest,\n    });\n    if (!resolved) continue;\n\n    try {\n      const parsed = await loadManifestFromFile(resolved.path, resolved.type, {\n        allowJsManifest,\n      });\n      const manifest = validateManifestWithSchema(parsed, resolved.path);\n      if (manifest) {\n        manifests.push(manifest);\n      }\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return manifests;\n}\n\n/**\n * Scan node_modules for packages with plugin manifests.\n *\n * @param cwd - Current working directory to search from\n * @param packages - Set of npm package names to scan for plugin manifests\n * @returns Map of plugin name to template plugin entry\n */\nasync function scanForPlugins(\n  cwd: string,\n  packages: Iterable<string>,\n  allowJsManifest: boolean,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const packageName of packages) {\n    const packagePath = path.join(cwd, \"node_modules\", packageName);\n    if (!fs.existsSync(packagePath)) {\n      continue;\n    }\n\n    const allowJsForPackage =\n      allowJsManifest || shouldAllowJsManifestForPackage(packageName);\n\n    const manifests = await discoverPluginManifests(\n      packagePath,\n      allowJsForPackage,\n    );\n    for (const manifest of manifests) {\n      if (manifest.hidden) continue;\n      plugins[manifest.name] = {\n        name: manifest.name,\n        displayName: manifest.displayName,\n        description: manifest.description,\n        package: packageName,\n        resources: manifest.resources,\n        ...(manifest.onSetupMessage && {\n          onSetupMessage: manifest.onSetupMessage,\n        }),\n        ...(manifest.stability &&\n          manifest.stability !== \"ga\" && {\n            stability: manifest.stability,\n          }),\n        ...(manifest.scaffolding && {\n          scaffolding: manifest.scaffolding,\n        }),\n      } satisfies TemplatePlugin;\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Recursively scan a directory for plugin manifests. Any directory that\n * contains manifest.json or manifest.js is treated as a plugin root; we do\n * not descend into that directory's children. Used for local plugins discovery\n * so nested paths like server/plugins/category/my-plugin are found.\n */\nasync function scanPluginsDirRecursive(\n  dir: string,\n  cwd: string,\n  allowJsManifest: boolean,\n  depth = 0,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n  if (!fs.existsSync(dir) || depth >= MAX_SCAN_DEPTH) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const pluginDir = path.join(dir, entry.name);\n    const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });\n\n    if (resolved) {\n      const pkg = `./${path.relative(cwd, pluginDir)}`;\n      try {\n        const pluginEntry = await loadPluginEntry(\n          resolved,\n          pkg,\n          allowJsManifest,\n        );\n        if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];\n      } catch (error) {\n        console.warn(\n          `Warning: Failed to load manifest at ${resolved.path}:`,\n          error instanceof Error ? error.message : error,\n        );\n      }\n      continue;\n    }\n\n    Object.assign(\n      plugins,\n      await scanPluginsDirRecursive(pluginDir, cwd, allowJsManifest, depth + 1),\n    );\n  }\n\n  return plugins;\n}\n\n/**\n * Scan a directory for plugin manifests in direct subdirectories only.\n * Each subdirectory may contain manifest.json or manifest.js.\n * Used with --plugins-dir to discover plugins from source instead of node_modules.\n *\n * @param dir - Absolute path to the directory containing plugin subdirectories\n * @param packageName - Package name to assign to discovered plugins (used when cwd is not set)\n * @param cwd - When set, each plugin's package is set to ./<path from cwd to plugin subdir>, e.g. ./server/my-plugin\n * @returns Map of plugin name to template plugin entry\n */\nasync function scanPluginsDir(\n  dir: string,\n  packageName: string,\n  allowJsManifest: boolean,\n  cwd?: string,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (!fs.existsSync(dir)) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const pluginDir = path.join(dir, entry.name);\n    const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });\n    if (!resolved) continue;\n\n    const pkg =\n      cwd !== undefined ? `./${path.relative(cwd, pluginDir)}` : packageName;\n\n    try {\n      const pluginEntry = await loadPluginEntry(resolved, pkg, allowJsManifest);\n      if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Write (or preview) the template plugins manifest to disk.\n *\n * Each resource field is parsed through `templateFieldEntrySchema` so the\n * `origin` transform fires and produces canonical `origin` values, even\n * when the input carries a stale `origin`. Parsing per-field (rather than\n * the whole manifest) keeps the surrounding plugin/resource key order\n * stable so the synced JSON's diff stays minimal.\n */\nfunction writeManifest(\n  outputPath: string,\n  { plugins }: { plugins: TemplatePluginsManifest[\"plugins\"] },\n  options: { write?: boolean; silent?: boolean; json?: boolean },\n) {\n  for (const plugin of Object.values(plugins)) {\n    for (const group of [\n      plugin.resources.required,\n      plugin.resources.optional,\n    ]) {\n      for (const resource of group) {\n        if (!resource.fields) continue;\n        for (const fieldName of Object.keys(resource.fields)) {\n          resource.fields[fieldName] = templateFieldEntrySchema.parse(\n            resource.fields[fieldName],\n          );\n        }\n      }\n    }\n  }\n\n  const templateManifest: TemplatePluginsManifest = {\n    $schema:\n      \"https://databricks.github.io/appkit/schemas/template-plugins.schema.json\",\n    version: \"2.0\",\n    plugins,\n    scaffolding: TEMPLATE_SCAFFOLDING,\n  };\n\n  const serialized = JSON.stringify(templateManifest, null, 2);\n\n  if (options.json) {\n    console.log(serialized);\n  }\n\n  if (options.write) {\n    fs.writeFileSync(outputPath, `${serialized}\\n`);\n    if (!options.silent && !options.json) {\n      console.log(`\\n✓ Wrote ${outputPath}`);\n    }\n  } else if (!options.silent && !options.json) {\n    console.log(\"\\nTo write the manifest, run:\");\n    console.log(\"  npx appkit plugin sync --write\\n\");\n    console.log(\"Preview:\");\n    console.log(\"─\".repeat(60));\n    console.log(serialized);\n    console.log(\"─\".repeat(60));\n  }\n}\n\n/**\n * Run the plugin sync command.\n * Parses the server entry file to discover which packages to scan for plugin\n * manifests, then marks plugins that are actually used in the `plugins: [...]`\n * array as requiredByTemplate.\n */\nasync function runPluginsSync(options: {\n  write?: boolean;\n  output?: string;\n  silent?: boolean;\n  json?: boolean;\n  requirePlugins?: string;\n  pluginsDir?: string;\n  packageName?: string;\n  localPluginsDir?: string;\n  allowJsManifest?: boolean;\n}): Promise<void> {\n  const cwd = process.cwd();\n  const allowJsManifest = Boolean(options.allowJsManifest);\n  const outputPath = path.resolve(cwd, options.output || \"appkit.plugins.json\");\n\n  // Security: Reject output paths that escape the project root\n  if (!isWithinDirectory(outputPath, cwd)) {\n    console.error(\n      `Error: Output path \"${options.output}\" resolves outside the project directory.`,\n    );\n    process.exit(1);\n  }\n\n  if (!options.silent && !options.json) {\n    console.log(\"Scanning for AppKit plugins...\\n\");\n    if (allowJsManifest) {\n      console.warn(\n        \"Warning: --allow-js-manifest executes manifest.js/manifest.cjs files. Only use with trusted code.\",\n      );\n    }\n  }\n\n  // Step 1: Parse server file to discover imports and plugin usages\n  const serverFile = findServerFile(cwd);\n  let serverImports: ParsedImport[] = [];\n  let pluginUsages = new Set<string>();\n\n  if (serverFile) {\n    if (!options.silent && !options.json) {\n      const relativePath = path.relative(cwd, serverFile);\n      console.log(`Server entry file: ${relativePath}`);\n    }\n\n    const content = fs.readFileSync(serverFile, \"utf-8\");\n    const lang = serverFile.endsWith(\".tsx\") ? Lang.Tsx : Lang.TypeScript;\n    const ast = parse(lang, content);\n    const root = ast.root();\n\n    serverImports = parseImports(root);\n    pluginUsages = parsePluginUsages(root);\n  } else if (!options.silent && !options.json) {\n    console.log(\n      \"No server entry file found. Checked:\",\n      SERVER_FILE_CANDIDATES.join(\", \"),\n    );\n  }\n\n  // Step 2: Split imports into npm packages and local (relative) imports\n  const npmImports = serverImports.filter(\n    (i) => !i.source.startsWith(\".\") && !i.source.startsWith(\"/\"),\n  );\n  const localImports = serverImports.filter(\n    (i) => i.source.startsWith(\".\") || i.source.startsWith(\"/\"),\n  );\n\n  // Step 3: Scan for plugin manifests (--plugins-dir or node_modules)\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (options.pluginsDir) {\n    const resolvedDir = path.resolve(cwd, options.pluginsDir);\n    const pkgName = options.packageName ?? \"@databricks/appkit\";\n    if (!options.silent && !options.json) {\n      console.log(`Scanning plugins directory: ${options.pluginsDir}`);\n    }\n    Object.assign(\n      plugins,\n      await scanPluginsDir(resolvedDir, pkgName, allowJsManifest),\n    );\n  } else {\n    const npmPackages = new Set([\n      ...KNOWN_PLUGIN_PACKAGES,\n      ...npmImports.map((i) => i.source),\n    ]);\n    Object.assign(\n      plugins,\n      await scanForPlugins(cwd, npmPackages, allowJsManifest),\n    );\n  }\n\n  // Step 4: Discover local plugin manifests from relative imports\n  if (serverFile && localImports.length > 0) {\n    const serverFileDir = path.dirname(serverFile);\n    const localPlugins = await discoverLocalPlugins(\n      localImports,\n      serverFileDir,\n      cwd,\n      allowJsManifest,\n    );\n    Object.assign(plugins, localPlugins);\n  }\n\n  // Step 4b: Discover local plugins from conventional directory (or --local-plugins-dir).\n  // These are included even when not imported in the server.\n  const localDirsToScan: string[] = options.localPluginsDir\n    ? [options.localPluginsDir]\n    : CONVENTIONAL_LOCAL_PLUGIN_DIRS.filter((d) =>\n        fs.existsSync(path.join(cwd, d)),\n      );\n  for (const dir of localDirsToScan) {\n    const resolvedDir = path.resolve(cwd, dir);\n    if (!fs.existsSync(resolvedDir)) continue;\n    if (!options.silent && !options.json) {\n      console.log(`Scanning local plugins directory: ${dir}`);\n    }\n    const discovered = await scanPluginsDirRecursive(\n      resolvedDir,\n      cwd,\n      allowJsManifest,\n    );\n    for (const [name, entry] of Object.entries(discovered)) {\n      if (!plugins[name]) plugins[name] = entry;\n    }\n  }\n\n  const pluginCount = Object.keys(plugins).length;\n\n  if (pluginCount === 0) {\n    if (options.silent || options.json) {\n      writeManifest(outputPath, { plugins: {} }, options);\n      if (options.silent) return;\n      process.exit(1);\n    }\n    console.log(\"No plugins found.\");\n    if (options.pluginsDir) {\n      console.log(\n        `\\nNo manifest (${allowJsManifest ? \"manifest.json or manifest.js\" : \"manifest.json\"}) found in: ${options.pluginsDir}`,\n      );\n    } else {\n      console.log(\n        \"\\nMake sure you have plugin packages installed, or specify a directory:\",\n      );\n      console.log(\"  appkit plugin sync --plugins-dir <path>\");\n    }\n    process.exit(1);\n  }\n\n  // Step 5: Mark plugins that are imported AND used in the plugins array as mandatory.\n  // For npm imports, match by package name + plugin name.\n  // For local imports, resolve both paths to absolute and compare.\n  const serverFileDir = serverFile ? path.dirname(serverFile) : cwd;\n\n  for (const imp of serverImports) {\n    if (!pluginUsages.has(imp.name)) continue;\n\n    const isLocal = imp.source.startsWith(\".\") || imp.source.startsWith(\"/\");\n    let plugin: TemplatePlugin | undefined;\n\n    if (isLocal) {\n      // Resolve the import source to an absolute path from the server file directory\n      const resolvedImportDir = path.resolve(serverFileDir, imp.source);\n      plugin = Object.values(plugins).find((p) => {\n        if (!p.package.startsWith(\".\")) return false;\n        const resolvedPluginDir = path.resolve(cwd, p.package);\n        return (\n          resolvedPluginDir === resolvedImportDir && p.name === imp.originalName\n        );\n      });\n    } else {\n      // npm import: direct string comparison\n      plugin = Object.values(plugins).find(\n        (p) => p.package === imp.source && p.name === imp.originalName,\n      );\n    }\n\n    if (plugin) {\n      plugin.requiredByTemplate = true;\n    }\n  }\n\n  // Step 6: Apply explicit --require-plugins overrides\n  if (options.requirePlugins) {\n    const explicitNames = options.requirePlugins\n      .split(\",\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n    for (const name of explicitNames) {\n      if (plugins[name]) {\n        plugins[name].requiredByTemplate = true;\n      } else if (!options.silent) {\n        console.warn(\n          `Warning: --require-plugins referenced \"${name}\" but no such plugin was discovered`,\n        );\n      }\n    }\n  }\n\n  // Step 6b: Strip requiredByTemplate for non-GA plugins\n  for (const plugin of Object.values(plugins)) {\n    if (\n      plugin.requiredByTemplate &&\n      plugin.stability &&\n      plugin.stability !== \"ga\"\n    ) {\n      plugin.requiredByTemplate = undefined;\n    }\n  }\n\n  if (!options.silent && !options.json) {\n    console.log(`\\nFound ${pluginCount} plugin(s):`);\n    for (const [name, manifest] of Object.entries(plugins)) {\n      const resourceCount =\n        manifest.resources.required.length + manifest.resources.optional.length;\n      const resourceInfo =\n        resourceCount > 0 ? ` [${resourceCount} resource(s)]` : \"\";\n      const mandatoryTag = manifest.requiredByTemplate ? \" (mandatory)\" : \"\";\n      console.log(\n        `  ${manifest.requiredByTemplate ? \"●\" : \"○\"} ${manifest.displayName} (${name}) from ${manifest.package}${resourceInfo}${mandatoryTag}`,\n      );\n    }\n  }\n\n  // Step 7: Detect orphaned resources from removed plugins\n  if (!options.silent && fs.existsSync(outputPath)) {\n    try {\n      const oldRaw = fs.readFileSync(outputPath, \"utf-8\");\n      const oldManifest = JSON.parse(oldRaw) as TemplatePluginsManifest;\n      const oldNames = new Set(Object.keys(oldManifest.plugins ?? {}));\n      const newNames = new Set(Object.keys(plugins));\n      for (const name of oldNames) {\n        if (newNames.has(name)) continue;\n        const oldPlugin = oldManifest.plugins?.[name];\n        if (!oldPlugin || typeof oldPlugin !== \"object\") continue;\n        const envVars: string[] = [];\n        for (const res of [\n          ...(oldPlugin.resources?.required ?? []),\n          ...(oldPlugin.resources?.optional ?? []),\n        ]) {\n          if (res?.fields) {\n            for (const field of Object.values(res.fields)) {\n              if (field?.env) envVars.push(field.env);\n            }\n          }\n        }\n        const envInfo =\n          envVars.length > 0\n            ? ` The following resource env vars may be orphaned: ${envVars.join(\", \")}`\n            : \"\";\n        console.warn(`Warning: Plugin \"${name}\" was removed.${envInfo}`);\n      }\n    } catch {\n      // Ignore parse errors on existing manifest\n    }\n  }\n\n  writeManifest(outputPath, { plugins }, options);\n}\n\n/** Exported for testing: path boundary check, AST parsing, trust checks. */\nexport {\n  isWithinDirectory,\n  parseImports,\n  parsePluginUsages,\n  shouldAllowJsManifestForPackage,\n};\n\nexport const pluginsSyncCommand = new Command(\"sync\")\n  .description(\n    \"Sync plugin manifests from installed packages into appkit.plugins.json\",\n  )\n  .option(\"-w, --write\", \"Write the manifest file\")\n  .option(\n    \"-o, --output <path>\",\n    \"Output file path (default: ./appkit.plugins.json)\",\n  )\n  .option(\n    \"-s, --silent\",\n    \"Suppress output and never exit with error (for use in predev/prebuild hooks)\",\n  )\n  .option(\n    \"--require-plugins <names>\",\n    \"Comma-separated plugin names to mark as requiredByTemplate (e.g. server,analytics)\",\n  )\n  .option(\n    \"--plugins-dir <path>\",\n    \"Scan this directory for plugin subdirectories with manifest.json (instead of node_modules)\",\n  )\n  .option(\n    \"--package-name <name>\",\n    \"Package name to assign to plugins found via --plugins-dir (default: @databricks/appkit)\",\n  )\n  .option(\n    \"--local-plugins-dir <path>\",\n    \"Also scan this directory for local plugin manifests (default: plugins, server)\",\n  )\n  .option(\n    \"--allow-js-manifest\",\n    \"Allow reading manifest.js/manifest.cjs (executes code; use only with trusted plugins)\",\n  )\n  .option(\"--json\", \"Output manifest as JSON to stdout\")\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  $ appkit plugin sync\n  $ appkit plugin sync --write\n  $ appkit plugin sync --write --require-plugins server,analytics\n  $ appkit plugin sync --write --plugins-dir src/plugins --package-name @my/pkg\n  $ appkit plugin sync --json\n  $ appkit plugin sync --silent`,\n  )\n  .action((opts) =>\n    runPluginsSync(opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgCA,SAAS,kBAAkB,UAAkB,UAA2B;CACtE,MAAM,eAAe,KAAK,QAAQ,SAAS;CAC3C,MAAM,mBAAmB,KAAK,QAAQ,SAAS;AAE/C,QACE,iBAAiB,oBACjB,aAAa,WAAW,GAAG,mBAAmB,KAAK,MAAM;;;;;;AAQ7D,SAAS,2BACP,KACA,YACuB;CACvB,MAAM,SAAS,iBAAiB,IAAI;AACpC,KAAI,OAAO,SAAS,OAAO,SAAU,QAAO,OAAO;AACnD,KAAI,OAAO,QAAQ,OACjB,SAAQ,KACN,wBAAwB,WAAW,8BAA8B,uBAAuB,OAAO,OAAO,GACvG;AAEH,QAAO;;;AAIT,MAAM,iBAAiB;;;;;;AAOvB,eAAe,gBACb,UACA,KACA,iBAC0C;CAI1C,MAAM,WAAW,2BAHF,MAAM,qBAAqB,SAAS,MAAM,SAAS,MAAM,EACtE,iBACD,CAAC,EACkD,SAAS,KAAK;AAClE,KAAI,CAAC,YAAY,SAAS,OAAQ,QAAO;AAEzC,QAAO,CACL,SAAS,MACT;EACE,MAAM,SAAS;EACf,aAAa,SAAS;EACtB,aAAa,SAAS;EACtB,SAAS;EACT,WAAW,SAAS;EACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;EAMD,GAAI,SAAS,aACX,SAAS,cAAc,QAAQ,EAC7B,WAAW,SAAS,WACrB;EACH,GAAI,SAAS,eAAe,EAC1B,aAAa,SAAS,aACvB;EACF,CACF;;;;;;AAOH,MAAM,wBAAwB,CAAC,qBAAqB;;;;;AAMpD,MAAM,yBAAyB,CAAC,oBAAoB,kBAAkB;;;;;;AAOtE,MAAM,iCAAiC,CAAC,WAAW,SAAS;;;;;;;AAQ5D,SAAS,eAAe,KAA4B;AAClD,MAAK,MAAM,aAAa,wBAAwB;EAC9C,MAAM,WAAW,KAAK,KAAK,KAAK,UAAU;AAC1C,MAAI,GAAG,WAAW,SAAS,CACzB,QAAO;;AAGX,QAAO;;;;;;;;;AAsBT,SAAS,aAAa,MAA8B;CAClD,MAAM,UAA0B,EAAE;CAGlC,MAAM,mBAAmB,KAAK,QAAQ,EACpC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,MAAK,MAAM,QAAQ,kBAAkB;EAEnC,MAAM,aAAa,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,EAAE,CAAC;AAC1D,MAAI,CAAC,WAAY;EAGjB,MAAM,SAAS,WAAW,MAAM,CAAC,QAAQ,gBAAgB,GAAG;EAG5D,MAAM,eAAe,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,EAAE,CAAC;AACnE,MAAI,CAAC,aAAc;EAGnB,MAAM,aAAa,aAAa,QAAQ,EACtC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,OAAK,MAAM,aAAa,YAAY;GAClC,MAAM,WAAW,UAAU,UAAU;AACrC,OAAI,SAAS,UAAU,GAAG;IAExB,MAAM,eAAe,SAAS,GAAG,MAAM;IACvC,MAAM,YAAY,SAAS,SAAS,SAAS,GAAG,MAAM;AACtD,YAAQ,KAAK;KAAE,MAAM;KAAW;KAAc;KAAQ,CAAC;UAClD;IAEL,MAAM,OAAO,UAAU,MAAM;AAC7B,YAAQ,KAAK;KAAE;KAAM,cAAc;KAAM;KAAQ,CAAC;;;;AAKxD,QAAO;;;;;;;;;;AAWT,SAAS,kBAAkB,MAA2B;CACpD,MAAM,4BAAY,IAAI,KAAa;CAGnC,MAAM,QAAQ,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,EAAE,CAAC;AAEtD,MAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,MAAM,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,EAAE,CAAC;AAChE,MAAI,CAAC,OAAO,IAAI,MAAM,KAAK,UAAW;EAGtC,MAAM,YAAY,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,CAAC;AACxD,MAAI,CAAC,UAAW;AAGhB,OAAK,MAAM,SAAS,UAAU,UAAU,CACtC,KAAI,MAAM,MAAM,KAAK,mBAAmB;GAEtC,MAAM,SAAS,MAAM,UAAU,CAAC;AAChC,OAAI,QAAQ,MAAM,KAAK,aACrB,WAAU,IAAI,OAAO,MAAM,CAAC;;;AAMpC,QAAO;;;;;AAMT,MAAM,qBAAqB;CAAC;CAAO;CAAQ;CAAO;CAAO;;;;;;;;;;;;;;;AAgBzD,SAAS,qBACP,cACA,eACA,iBACA,aACyB;CACzB,MAAM,WAAW,KAAK,QAAQ,eAAe,aAAa;CAG1D,MAAM,WAAW,eAAe;AAChC,KAAI,CAAC,kBAAkB,UAAU,SAAS,EAAE;AAC1C,UAAQ,KACN,6BAA6B,aAAa,4CAC3C;AACD,SAAO;;AAIT,KAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,aAAa,CAChE,QAAO,qBAAqB,UAAU,EAAE,iBAAiB,CAAC;AAI5D,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,WAAW,GAAG,WAAW;AAC/B,MAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,QAAQ,EAAE;GAC7D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,OAAI,CAAC,kBAAkB,KAAK,SAAS,CAAE,QAAO;AAC9C,UAAO,qBAAqB,KAAK,EAAE,iBAAiB,CAAC;;;AAKzD,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,YAAY,KAAK,KAAK,UAAU,QAAQ,MAAM;AACpD,MAAI,GAAG,WAAW,UAAU,CAC1B,QAAO,qBAAqB,UAAU,EAAE,iBAAiB,CAAC;;AAI9D,QAAO;;;;;;;;;;;AAYT,eAAe,qBACb,iBACA,eACA,KACA,iBAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,WAAW,qBACf,IAAI,QACJ,eACA,iBACA,IACD;AACD,MAAI,CAAC,SAAU;AAEf,MAAI;GAEF,MAAM,QAAQ,MAAM,gBAClB,UACA,KAHmB,KAAK,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK,CAAC,IAIlE,gBACD;AACD,OAAI,MAAO,SAAQ,MAAM,MAAM,MAAM;WAC9B,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,eAAe,wBACb,aACA,iBAC2B;CAC3B,MAAM,aAAa,KAAK,KAAK,aAAa,QAAQ,UAAU;CAC5D,MAAM,YAA8B,EAAE;AAEtC,KAAI,CAAC,GAAG,WAAW,WAAW,CAC5B,QAAO;CAGT,MAAM,UAAU,GAAG,YAAY,YAAY,EAAE,eAAe,MAAM,CAAC;AACnE,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAC1B,MAAM,WAAW,qBAAqB,KAAK,KAAK,YAAY,MAAM,KAAK,EAAE,EACvE,iBACD,CAAC;AACF,MAAI,CAAC,SAAU;AAEf,MAAI;GAIF,MAAM,WAAW,2BAHF,MAAM,qBAAqB,SAAS,MAAM,SAAS,MAAM,EACtE,iBACD,CAAC,EACkD,SAAS,KAAK;AAClE,OAAI,SACF,WAAU,KAAK,SAAS;WAEnB,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,eAAe,eACb,KACA,UACA,iBAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,eAAe,UAAU;EAClC,MAAM,cAAc,KAAK,KAAK,KAAK,gBAAgB,YAAY;AAC/D,MAAI,CAAC,GAAG,WAAW,YAAY,CAC7B;EAMF,MAAM,YAAY,MAAM,wBACtB,aAHA,mBAAmB,gCAAgC,YAAY,CAKhE;AACD,OAAK,MAAM,YAAY,WAAW;AAChC,OAAI,SAAS,OAAQ;AACrB,WAAQ,SAAS,QAAQ;IACvB,MAAM,SAAS;IACf,aAAa,SAAS;IACtB,aAAa,SAAS;IACtB,SAAS;IACT,WAAW,SAAS;IACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;IACD,GAAI,SAAS,aACX,SAAS,cAAc,QAAQ,EAC7B,WAAW,SAAS,WACrB;IACH,GAAI,SAAS,eAAe,EAC1B,aAAa,SAAS,aACvB;IACF;;;AAIL,QAAO;;;;;;;;AAST,eAAe,wBACb,KACA,KACA,iBACA,QAAQ,GACqC;CAC7C,MAAM,UAA8C,EAAE;AACtD,KAAI,CAAC,GAAG,WAAW,IAAI,IAAI,SAAS,eAAgB,QAAO;CAE3D,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,CAAC;AAErE,MAAI,UAAU;GACZ,MAAM,MAAM,KAAK,KAAK,SAAS,KAAK,UAAU;AAC9C,OAAI;IACF,MAAM,cAAc,MAAM,gBACxB,UACA,KACA,gBACD;AACD,QAAI,YAAa,SAAQ,YAAY,MAAM,YAAY;YAChD,OAAO;AACd,YAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;AAEH;;AAGF,SAAO,OACL,SACA,MAAM,wBAAwB,WAAW,KAAK,iBAAiB,QAAQ,EAAE,CAC1E;;AAGH,QAAO;;;;;;;;;;;;AAaT,eAAe,eACb,KACA,aACA,iBACA,KAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,KAAI,CAAC,GAAG,WAAW,IAAI,CAAE,QAAO;CAEhC,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,CAAC;AACrE,MAAI,CAAC,SAAU;EAEf,MAAM,MACJ,QAAQ,SAAY,KAAK,KAAK,SAAS,KAAK,UAAU,KAAK;AAE7D,MAAI;GACF,MAAM,cAAc,MAAM,gBAAgB,UAAU,KAAK,gBAAgB;AACzE,OAAI,YAAa,SAAQ,YAAY,MAAM,YAAY;WAChD,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;;;AAYT,SAAS,cACP,YACA,EAAE,WACF,SACA;AACA,MAAK,MAAM,UAAU,OAAO,OAAO,QAAQ,CACzC,MAAK,MAAM,SAAS,CAClB,OAAO,UAAU,UACjB,OAAO,UAAU,SAClB,CACC,MAAK,MAAM,YAAY,OAAO;AAC5B,MAAI,CAAC,SAAS,OAAQ;AACtB,OAAK,MAAM,aAAa,OAAO,KAAK,SAAS,OAAO,CAClD,UAAS,OAAO,aAAa,yBAAyB,MACpD,SAAS,OAAO,WACjB;;CAMT,MAAM,mBAA4C;EAChD,SACE;EACF,SAAS;EACT;EACA,aAAa;EACd;CAED,MAAM,aAAa,KAAK,UAAU,kBAAkB,MAAM,EAAE;AAE5D,KAAI,QAAQ,KACV,SAAQ,IAAI,WAAW;AAGzB,KAAI,QAAQ,OAAO;AACjB,KAAG,cAAc,YAAY,GAAG,WAAW,IAAI;AAC/C,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,aAAa,aAAa;YAE/B,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AAC3C,UAAQ,IAAI,gCAAgC;AAC5C,UAAQ,IAAI,qCAAqC;AACjD,UAAQ,IAAI,WAAW;AACvB,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;AAC3B,UAAQ,IAAI,WAAW;AACvB,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;;;;;;;;;AAU/B,eAAe,eAAe,SAUZ;CAChB,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,kBAAkB,QAAQ,QAAQ,gBAAgB;CACxD,MAAM,aAAa,KAAK,QAAQ,KAAK,QAAQ,UAAU,sBAAsB;AAG7E,KAAI,CAAC,kBAAkB,YAAY,IAAI,EAAE;AACvC,UAAQ,MACN,uBAAuB,QAAQ,OAAO,2CACvC;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AACpC,UAAQ,IAAI,mCAAmC;AAC/C,MAAI,gBACF,SAAQ,KACN,oGACD;;CAKL,MAAM,aAAa,eAAe,IAAI;CACtC,IAAI,gBAAgC,EAAE;CACtC,IAAI,+BAAe,IAAI,KAAa;AAEpC,KAAI,YAAY;AACd,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;GACpC,MAAM,eAAe,KAAK,SAAS,KAAK,WAAW;AACnD,WAAQ,IAAI,sBAAsB,eAAe;;EAGnD,MAAM,UAAU,GAAG,aAAa,YAAY,QAAQ;EAGpD,MAAM,OADM,MADC,WAAW,SAAS,OAAO,GAAG,KAAK,MAAM,KAAK,YACnC,QAAQ,CACf,MAAM;AAEvB,kBAAgB,aAAa,KAAK;AAClC,iBAAe,kBAAkB,KAAK;YAC7B,CAAC,QAAQ,UAAU,CAAC,QAAQ,KACrC,SAAQ,IACN,wCACA,uBAAuB,KAAK,KAAK,CAClC;CAIH,MAAM,aAAa,cAAc,QAC9B,MAAM,CAAC,EAAE,OAAO,WAAW,IAAI,IAAI,CAAC,EAAE,OAAO,WAAW,IAAI,CAC9D;CACD,MAAM,eAAe,cAAc,QAChC,MAAM,EAAE,OAAO,WAAW,IAAI,IAAI,EAAE,OAAO,WAAW,IAAI,CAC5D;CAGD,MAAM,UAA8C,EAAE;AAEtD,KAAI,QAAQ,YAAY;EACtB,MAAM,cAAc,KAAK,QAAQ,KAAK,QAAQ,WAAW;EACzD,MAAM,UAAU,QAAQ,eAAe;AACvC,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,+BAA+B,QAAQ,aAAa;AAElE,SAAO,OACL,SACA,MAAM,eAAe,aAAa,SAAS,gBAAgB,CAC5D;QACI;EACL,MAAM,cAAc,IAAI,IAAI,CAC1B,GAAG,uBACH,GAAG,WAAW,KAAK,MAAM,EAAE,OAAO,CACnC,CAAC;AACF,SAAO,OACL,SACA,MAAM,eAAe,KAAK,aAAa,gBAAgB,CACxD;;AAIH,KAAI,cAAc,aAAa,SAAS,GAAG;EAEzC,MAAM,eAAe,MAAM,qBACzB,cAFoB,KAAK,QAAQ,WAAW,EAI5C,KACA,gBACD;AACD,SAAO,OAAO,SAAS,aAAa;;CAKtC,MAAM,kBAA4B,QAAQ,kBACtC,CAAC,QAAQ,gBAAgB,GACzB,+BAA+B,QAAQ,MACrC,GAAG,WAAW,KAAK,KAAK,KAAK,EAAE,CAAC,CACjC;AACL,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,cAAc,KAAK,QAAQ,KAAK,IAAI;AAC1C,MAAI,CAAC,GAAG,WAAW,YAAY,CAAE;AACjC,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,qCAAqC,MAAM;EAEzD,MAAM,aAAa,MAAM,wBACvB,aACA,KACA,gBACD;AACD,OAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,WAAW,CACpD,KAAI,CAAC,QAAQ,MAAO,SAAQ,QAAQ;;CAIxC,MAAM,cAAc,OAAO,KAAK,QAAQ,CAAC;AAEzC,KAAI,gBAAgB,GAAG;AACrB,MAAI,QAAQ,UAAU,QAAQ,MAAM;AAClC,iBAAc,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ;AACnD,OAAI,QAAQ,OAAQ;AACpB,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,IAAI,oBAAoB;AAChC,MAAI,QAAQ,WACV,SAAQ,IACN,kBAAkB,kBAAkB,iCAAiC,gBAAgB,cAAc,QAAQ,aAC5G;OACI;AACL,WAAQ,IACN,0EACD;AACD,WAAQ,IAAI,4CAA4C;;AAE1D,UAAQ,KAAK,EAAE;;CAMjB,MAAM,gBAAgB,aAAa,KAAK,QAAQ,WAAW,GAAG;AAE9D,MAAK,MAAM,OAAO,eAAe;AAC/B,MAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAAE;EAEjC,MAAM,UAAU,IAAI,OAAO,WAAW,IAAI,IAAI,IAAI,OAAO,WAAW,IAAI;EACxE,IAAI;AAEJ,MAAI,SAAS;GAEX,MAAM,oBAAoB,KAAK,QAAQ,eAAe,IAAI,OAAO;AACjE,YAAS,OAAO,OAAO,QAAQ,CAAC,MAAM,MAAM;AAC1C,QAAI,CAAC,EAAE,QAAQ,WAAW,IAAI,CAAE,QAAO;AAEvC,WAD0B,KAAK,QAAQ,KAAK,EAAE,QAAQ,KAE9B,qBAAqB,EAAE,SAAS,IAAI;KAE5D;QAGF,UAAS,OAAO,OAAO,QAAQ,CAAC,MAC7B,MAAM,EAAE,YAAY,IAAI,UAAU,EAAE,SAAS,IAAI,aACnD;AAGH,MAAI,OACF,QAAO,qBAAqB;;AAKhC,KAAI,QAAQ,gBAAgB;EAC1B,MAAM,gBAAgB,QAAQ,eAC3B,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,OAAO,QAAQ;AAClB,OAAK,MAAM,QAAQ,cACjB,KAAI,QAAQ,MACV,SAAQ,MAAM,qBAAqB;WAC1B,CAAC,QAAQ,OAClB,SAAQ,KACN,0CAA0C,KAAK,qCAChD;;AAMP,MAAK,MAAM,UAAU,OAAO,OAAO,QAAQ,CACzC,KACE,OAAO,sBACP,OAAO,aACP,OAAO,cAAc,KAErB,QAAO,qBAAqB;AAIhC,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AACpC,UAAQ,IAAI,WAAW,YAAY,aAAa;AAChD,OAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,EAAE;GACtD,MAAM,gBACJ,SAAS,UAAU,SAAS,SAAS,SAAS,UAAU,SAAS;GACnE,MAAM,eACJ,gBAAgB,IAAI,KAAK,cAAc,iBAAiB;GAC1D,MAAM,eAAe,SAAS,qBAAqB,iBAAiB;AACpE,WAAQ,IACN,KAAK,SAAS,qBAAqB,MAAM,IAAI,GAAG,SAAS,YAAY,IAAI,KAAK,SAAS,SAAS,UAAU,eAAe,eAC1H;;;AAKL,KAAI,CAAC,QAAQ,UAAU,GAAG,WAAW,WAAW,CAC9C,KAAI;EACF,MAAM,SAAS,GAAG,aAAa,YAAY,QAAQ;EACnD,MAAM,cAAc,KAAK,MAAM,OAAO;EACtC,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,YAAY,WAAW,EAAE,CAAC,CAAC;EAChE,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC;AAC9C,OAAK,MAAM,QAAQ,UAAU;AAC3B,OAAI,SAAS,IAAI,KAAK,CAAE;GACxB,MAAM,YAAY,YAAY,UAAU;AACxC,OAAI,CAAC,aAAa,OAAO,cAAc,SAAU;GACjD,MAAM,UAAoB,EAAE;AAC5B,QAAK,MAAM,OAAO,CAChB,GAAI,UAAU,WAAW,YAAY,EAAE,EACvC,GAAI,UAAU,WAAW,YAAY,EAAE,CACxC,CACC,KAAI,KAAK,QACP;SAAK,MAAM,SAAS,OAAO,OAAO,IAAI,OAAO,CAC3C,KAAI,OAAO,IAAK,SAAQ,KAAK,MAAM,IAAI;;GAI7C,MAAM,UACJ,QAAQ,SAAS,IACb,qDAAqD,QAAQ,KAAK,KAAK,KACvE;AACN,WAAQ,KAAK,oBAAoB,KAAK,gBAAgB,UAAU;;SAE5D;AAKV,eAAc,YAAY,EAAE,SAAS,EAAE,QAAQ;;AAWjD,MAAa,qBAAqB,IAAI,QAAQ,OAAO,CAClD,YACC,yEACD,CACA,OAAO,eAAe,0BAA0B,CAChD,OACC,uBACA,oDACD,CACA,OACC,gBACA,+EACD,CACA,OACC,6BACA,qFACD,CACA,OACC,wBACA,6FACD,CACA,OACC,yBACA,0FACD,CACA,OACC,8BACA,iFACD,CACA,OACC,uBACA,wFACD,CACA,OAAO,UAAU,oCAAoC,CACrD,YACC,SACA;;;;;;;iCAQD,CACA,QAAQ,SACP,eAAe,KAAK,CAAC,OAAO,QAAQ;AAClC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}