@databricks/appkit 0.82.0 → 0.84.0

package/dist/cache/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/cache/index.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport type { CacheConfig, CacheEntry, CacheStorage } from \"shared\";\n\nimport { createLakebasePool } from \"../connectors/lakebase\";\nimport { getClientOptions } from \"../context/client-options\";\nimport { AppKitError, ExecutionError, InitializationError } from \"../errors\";\nimport { createLogger } from \"../logging/logger\";\nimport type { Counter, TelemetryProvider } from \"../telemetry\";\nimport { SpanStatusCode, TelemetryManager } from \"../telemetry\";\nimport { deepMerge } from \"../utils\";\nimport { ApiError, createWorkspaceClient } from \"../workspace-client\";\nimport { cacheDefaults } from \"./defaults\";\nimport { InMemoryStorage, PersistentStorage } from \"./storage\";\n\nconst logger = createLogger(\"cache\");\n\n/**\n * Reference-counted in-flight cache execution entry.\n *\n * `sharedController` decouples the cached `fn()` from any single caller's\n * abort signal. Callers join an in-flight entry by incrementing `refCount`;\n * when a caller aborts, refCount is decremented. The shared controller is\n * aborted only when refCount drops to 0 — i.e. all callers have abandoned\n * the request. This prevents one caller's cancellation (e.g. React\n * StrictMode unmount) from poisoning the in-flight result for other still-\n * connected awaiters.\n */\ninterface InFlightEntry<T> {\n  promise: Promise<T>;\n  refCount: number;\n  sharedController: AbortController;\n  abortTimer?: ReturnType<typeof setTimeout>;\n}\n\nfunction createAbortError(signal: AbortSignal): unknown {\n  if (signal.reason !== undefined) return signal.reason;\n  return new DOMException(\"The operation was aborted.\", \"AbortError\");\n}\n\n/**\n * Cache manager class to handle cache operations.\n * Can be used with in-memory storage or persistent storage (Lakebase).\n *\n * The cache is automatically initialized by AppKit. Use `getInstanceSync()` to access\n * the singleton instance after initialization.\n *\n * @internal\n * @example\n * ```typescript\n * const cache = CacheManager.getInstanceSync();\n * const result = await cache.getOrExecute([\"users\", userId], () => fetchUser(userId), userKey);\n * ```\n */\nexport class CacheManager {\n  private static readonly MIN_CLEANUP_INTERVAL_MS = 60_000;\n  private static readonly ABORT_GRACE_PERIOD_MS = 100;\n  private readonly name: string = \"cache-manager\";\n  private static instance: CacheManager | null = null;\n  private static initPromise: Promise<CacheManager> | null = null;\n\n  private storage: CacheStorage;\n  private config: CacheConfig;\n  private inFlightRequests: Map<string, InFlightEntry<unknown>>;\n  private cleanupInProgress: boolean;\n  private lastCleanupAttempt: number;\n\n  private telemetry: TelemetryProvider;\n  private telemetryMetrics: {\n    cacheHitCount: Counter;\n    cacheMissCount: Counter;\n  };\n\n  private constructor(storage: CacheStorage, config: CacheConfig) {\n    this.storage = storage;\n    this.config = config;\n    this.inFlightRequests = new Map();\n    this.cleanupInProgress = false;\n    this.lastCleanupAttempt = 0;\n\n    this.telemetry = TelemetryManager.getProvider(\n      this.name,\n      this.config.telemetry,\n    );\n    this.telemetryMetrics = {\n      cacheHitCount: this.telemetry.getMeter().createCounter(\"cache.hit\", {\n        description: \"Total number of cache hits\",\n        unit: \"1\",\n      }),\n      cacheMissCount: this.telemetry.getMeter().createCounter(\"cache.miss\", {\n        description: \"Total number of cache misses\",\n        unit: \"1\",\n      }),\n    };\n  }\n\n  /**\n   * Get the singleton instance of the cache manager (sync version).\n   *\n   * Throws if not initialized - ensure AppKit.create() has completed first.\n   * @returns CacheManager instance\n   */\n  static getInstanceSync(): CacheManager {\n    if (!CacheManager.instance) {\n      throw InitializationError.notInitialized(\n        \"CacheManager\",\n        \"Ensure AppKit.create() has completed before accessing the cache\",\n      );\n    }\n\n    return CacheManager.instance;\n  }\n\n  /**\n   * Initialize and get the singleton instance of the cache manager.\n   * Called internally by AppKit - prefer `getInstanceSync()` for plugin access.\n   * @param userConfig - User configuration for the cache manager\n   * @returns CacheManager instance\n   * @internal\n   */\n  static async getInstance(\n    userConfig?: Partial<CacheConfig>,\n  ): Promise<CacheManager> {\n    if (CacheManager.instance) {\n      return CacheManager.instance;\n    }\n\n    if (!CacheManager.initPromise) {\n      CacheManager.initPromise = CacheManager.create(userConfig).then(\n        (instance) => {\n          // Publishes unconditionally: safe only because every getInstance() is\n          // awaited before any reset(), so a reset() can never land mid-init and\n          // this can never publish over it. A future unawaited-init caller would\n          // reintroduce that stale-publish race (the removed `generation` guard).\n          CacheManager.instance = instance;\n          return instance;\n        },\n      );\n    }\n\n    return CacheManager.initPromise;\n  }\n\n  /**\n   * Create a new cache manager instance\n   *\n   * Storage selection logic:\n   * 1. If `storage` provided and healthy → use provided storage\n   * 2. If `storage` provided but unhealthy → fallback to InMemory (or disable if strictPersistence)\n   * 3. If no `storage` provided and Lakebase available → use Lakebase\n   * 4. If no `storage` provided and Lakebase unavailable → fallback to InMemory (or disable if strictPersistence)\n   *\n   * @param userConfig - User configuration for the cache manager\n   * @returns CacheManager instance\n   */\n  private static async create(\n    userConfig?: Partial<CacheConfig>,\n  ): Promise<CacheManager> {\n    const config = deepMerge(cacheDefaults, userConfig);\n\n    if (config.storage) {\n      const isHealthy = await config.storage.healthCheck();\n      if (isHealthy) {\n        return new CacheManager(config.storage, config);\n      }\n\n      if (config.strictPersistence) {\n        const disabledConfig = { ...config, enabled: false };\n        return new CacheManager(\n          new InMemoryStorage(disabledConfig),\n          disabledConfig,\n        );\n      }\n\n      return new CacheManager(new InMemoryStorage(config), config);\n    }\n\n    // try to use lakebase storage\n    try {\n      const workspaceClient = createWorkspaceClient({\n        clientOptions: getClientOptions(),\n      }).toLegacyWorkspaceClient();\n      const pool = createLakebasePool({ workspaceClient });\n      const persistentStorage = new PersistentStorage(config, pool);\n\n      const isHealthy = await persistentStorage.healthCheck();\n      if (isHealthy) {\n        await persistentStorage.initialize();\n        return new CacheManager(persistentStorage, config);\n      }\n\n      // Health check failed, close the pool and fallback\n      await pool.end();\n    } catch {\n      // lakebase unavailable, continue with in-memory storage\n    }\n\n    if (config.strictPersistence) {\n      const disabledConfig = { ...config, enabled: false };\n      return new CacheManager(\n        new InMemoryStorage(disabledConfig),\n        disabledConfig,\n      );\n    }\n\n    return new CacheManager(new InMemoryStorage(config), config);\n  }\n\n  /**\n   * Get or execute a function and cache the result.\n   *\n   * Multiple concurrent callers with the same `cacheKey` are deduplicated\n   * onto a single in-flight execution. Each caller may pass its own\n   * `callerSignal`; the underlying `fn()` is run with a shared, internally\n   * managed `AbortSignal` that aborts only when *all* callers have\n   * abandoned the request (reference counted). This decouples a single\n   * caller's cancellation (e.g. React StrictMode unmount) from the shared\n   * result, so other still-connected callers receive the cached value\n   * normally.\n   *\n   * @param key - Cache key parts\n   * @param fn - Function to execute. Receives the cache-owned shared signal;\n   *   pass it through to the underlying I/O so the work is cancelled when\n   *   no caller is left waiting.\n   * @param userKey - User key for cache namespacing\n   * @param options - Options for the cache\n   * @returns Promise of the result\n   */\n  async getOrExecute<T>(\n    key: (string | number | object)[],\n    fn: (sharedSignal?: AbortSignal) => Promise<T>,\n    userKey: string,\n    options?: { ttl?: number; callerSignal?: AbortSignal },\n  ): Promise<T> {\n    if (!this.config.enabled) return fn(options?.callerSignal);\n\n    const callerSignal = options?.callerSignal;\n    if (callerSignal?.aborted) {\n      throw createAbortError(callerSignal);\n    }\n\n    const cacheKey = this.generateKey(key, userKey);\n\n    return this.telemetry.startActiveSpan(\n      \"cache.getOrExecute\",\n      {\n        attributes: {\n          \"cache.key\": cacheKey,\n          \"cache.enabled\": this.config.enabled,\n          \"cache.persistent\": this.storage.isPersistent(),\n        },\n      },\n      async (span) => {\n        try {\n          const cached = await this.getValid<T>(cacheKey);\n          if (cached !== null) {\n            span.setAttribute(\"cache.hit\", true);\n            span.setStatus({ code: SpanStatusCode.OK });\n            this.telemetryMetrics.cacheHitCount.add(1, {\n              \"cache.key\": cacheKey,\n            });\n\n            logger.event()?.setExecution({\n              cache_hit: true,\n              cache_key: cacheKey,\n            });\n\n            return cached.value;\n          }\n\n          // check if the value is being processed by another request — join\n          // the existing in-flight entry under reference counting so this\n          // caller's abort doesn't poison the shared result.\n          const existing = this.inFlightRequests.get(cacheKey) as\n            | InFlightEntry<T>\n            | undefined;\n          if (existing && !existing.sharedController.signal.aborted) {\n            existing.refCount++;\n            // Cancel any pending abort timer — a new caller has joined\n            if (existing.abortTimer) {\n              clearTimeout(existing.abortTimer);\n              existing.abortTimer = undefined;\n            }\n            span.setAttribute(\"cache.hit\", true);\n            span.setAttribute(\"cache.deduplication\", true);\n            span.addEvent(\"cache.deduplication_used\", {\n              \"cache.key\": cacheKey,\n            });\n            this.telemetryMetrics.cacheHitCount.add(1, {\n              \"cache.key\": cacheKey,\n              \"cache.deduplication\": \"true\",\n            });\n\n            logger.event()?.setExecution({\n              cache_hit: true,\n              cache_key: cacheKey,\n              cache_deduplication: true,\n            });\n\n            return await this._waitWithRefCount(existing, callerSignal);\n          }\n\n          // cache miss - execute function under a shared abort controller\n          span.setAttribute(\"cache.hit\", false);\n          span.addEvent(\"cache.miss\", { \"cache.key\": cacheKey });\n          this.telemetryMetrics.cacheMissCount.add(1, {\n            \"cache.key\": cacheKey,\n          });\n\n          logger.event()?.setExecution({\n            cache_hit: false,\n            cache_key: cacheKey,\n          });\n\n          const sharedController = new AbortController();\n          const entry: InFlightEntry<T> = {\n            promise: undefined as unknown as Promise<T>,\n            refCount: 1,\n            sharedController,\n          };\n\n          entry.promise = fn(sharedController.signal)\n            .then(async (result) => {\n              await this.set(cacheKey, result, options);\n              span.addEvent(\"cache.value_stored\", {\n                \"cache.key\": cacheKey,\n                \"cache.ttl\": options?.ttl ?? this.config.ttl ?? 3600,\n              });\n              return result;\n            })\n            .catch((error) => {\n              span.recordException(error);\n              span.setStatus({ code: SpanStatusCode.ERROR });\n              // If the shared controller aborted, all callers have already\n              // abandoned the request (or are about to via their own signals)\n              // — propagate the original error without wrapping. No live\n              // awaiter will observe this rejection.\n              if (sharedController.signal.aborted) {\n                throw error;\n              }\n              if (error instanceof AppKitError || error instanceof ApiError) {\n                throw error;\n              }\n              throw ExecutionError.statementFailed(\n                error instanceof Error ? error.message : String(error),\n              );\n            })\n            .finally(() => {\n              if (this.inFlightRequests.get(cacheKey) === entry) {\n                this.inFlightRequests.delete(cacheKey);\n              }\n            });\n\n          // Suppress unhandled rejection warnings when every caller bailed\n          // before fn() resolved (their own promises rejected via\n          // waitWithRefCount; the underlying entry.promise has no awaiter).\n          entry.promise.catch(() => {});\n\n          this.inFlightRequests.set(cacheKey, entry as InFlightEntry<unknown>);\n\n          const result = await this._waitWithRefCount(entry, callerSignal);\n          span.setStatus({ code: SpanStatusCode.OK });\n          return result;\n        } catch (error) {\n          span.recordException(error as Error);\n          span.setStatus({ code: SpanStatusCode.ERROR });\n          throw error;\n        } finally {\n          span.end();\n        }\n      },\n      { name: this.name, includePrefix: true },\n    );\n  }\n\n  /**\n   * Wait on an in-flight entry, racing the underlying promise against the\n   * caller's abort signal. When the caller aborts, the entry's refCount is\n   * decremented; if it hits zero the shared controller is aborted so the\n   * underlying `fn()` can stop. Other callers continue to await the same\n   * entry and receive the result when it arrives.\n   */\n  private _waitWithRefCount<T>(\n    entry: InFlightEntry<T>,\n    callerSignal?: AbortSignal,\n  ): Promise<T> {\n    if (!callerSignal) return entry.promise;\n\n    return new Promise<T>((resolve, reject) => {\n      let settled = false;\n\n      const release = () => {\n        if (entry.refCount > 0) entry.refCount--;\n        if (entry.refCount <= 0 && !entry.sharedController.signal.aborted) {\n          // Grace period: delay abort so a StrictMode remount can join\n          // the in-flight entry before the shared execution is cancelled.\n          entry.abortTimer = setTimeout(() => {\n            if (entry.refCount <= 0 && !entry.sharedController.signal.aborted) {\n              entry.sharedController.abort(\n                callerSignal.reason ?? \"all cache callers aborted\",\n              );\n            }\n          }, CacheManager.ABORT_GRACE_PERIOD_MS);\n        }\n      };\n\n      const onAbort = () => {\n        if (settled) return;\n        settled = true;\n        callerSignal.removeEventListener(\"abort\", onAbort);\n        release();\n        reject(createAbortError(callerSignal));\n      };\n\n      if (callerSignal.aborted) {\n        onAbort();\n        return;\n      }\n\n      callerSignal.addEventListener(\"abort\", onAbort, { once: true });\n\n      entry.promise.then(\n        (value) => {\n          if (settled) return;\n          settled = true;\n          callerSignal.removeEventListener(\"abort\", onAbort);\n          resolve(value);\n        },\n        (error) => {\n          if (settled) return;\n          settled = true;\n          callerSignal.removeEventListener(\"abort\", onAbort);\n          reject(error);\n        },\n      );\n    });\n  }\n\n  /**\n   * Get a cached value\n   * @param key - Cache key\n   * @returns Promise of the value or null if not found or expired\n   */\n  async get<T>(key: string): Promise<T | null> {\n    if (!this.config.enabled) return null;\n\n    // probabilistic cleanup trigger\n    this.maybeCleanup();\n\n    const entry = await this.getValid<T>(key);\n    return entry?.value ?? null;\n  }\n\n  /**\n   * Get a cached entry only if it has not expired.\n   * Returns null on miss or expired (and deletes the expired entry).\n   *\n   * Storage implementations return entries unconditionally — expiry handling\n   * lives at the CacheManager layer.\n   */\n  private async getValid<T>(key: string): Promise<CacheEntry<T> | null> {\n    const entry = await this.storage.get<T>(key);\n    if (!entry) return null;\n\n    if (Date.now() > entry.expiry) {\n      await this.storage.delete(key);\n      return null;\n    }\n    return entry;\n  }\n\n  /** Probabilistically trigger cleanup of expired entries (fire-and-forget) */\n  private maybeCleanup(): void {\n    if (this.cleanupInProgress) return;\n    if (!this.storage.isPersistent()) return;\n    const now = Date.now();\n    if (now - this.lastCleanupAttempt < CacheManager.MIN_CLEANUP_INTERVAL_MS)\n      return;\n\n    const probability = this.config.cleanupProbability ?? 0.01;\n\n    if (Math.random() > probability) return;\n\n    this.lastCleanupAttempt = now;\n\n    this.cleanupInProgress = true;\n    (this.storage as PersistentStorage)\n      .cleanupExpired()\n      .catch((error) => {\n        logger.debug(\"Error cleaning up expired entries: %O\", error);\n      })\n      .finally(() => {\n        this.cleanupInProgress = false;\n      });\n  }\n\n  /**\n   * Set a value in the cache\n   * @param key - Cache key\n   * @param value - Value to set\n   * @param options - Options for the cache\n   * @returns Promise of the result\n   */\n  async set<T>(\n    key: string,\n    value: T,\n    options?: { ttl?: number },\n  ): Promise<void> {\n    if (!this.config.enabled) return;\n\n    const ttl = options?.ttl ?? this.config.ttl ?? 3600;\n    const expiryTime = Date.now() + ttl * 1000;\n    await this.storage.set(key, { value, expiry: expiryTime });\n  }\n\n  /**\n   * Delete a value from the cache\n   * @param key - Cache key\n   * @returns Promise of the result\n   */\n  async delete(key: string): Promise<void> {\n    if (!this.config.enabled) return;\n    await this.storage.delete(key);\n  }\n\n  /** Clear the cache */\n  async clear(): Promise<void> {\n    await this.storage.clear();\n    for (const entry of this.inFlightRequests.values()) {\n      if (entry.abortTimer) clearTimeout(entry.abortTimer);\n    }\n    this.inFlightRequests.clear();\n  }\n\n  /**\n   * Check if a value exists in the cache\n   * @param key - Cache key\n   * @returns Promise of true if the value exists, false otherwise\n   */\n  async has(key: string): Promise<boolean> {\n    if (!this.config.enabled) return false;\n\n    const entry = await this.getValid(key);\n    return entry !== null;\n  }\n\n  /**\n   * Generate a cache key\n   * @param parts - Parts of the key\n   * @param userKey - User key\n   * @returns Cache key\n   */\n  generateKey(parts: (string | number | object)[], userKey: string): string {\n    const allParts = [userKey, ...parts];\n    const serialized = JSON.stringify(allParts);\n    return createHash(\"sha256\").update(serialized).digest(\"hex\");\n  }\n\n  /** Close the cache */\n  async close(): Promise<void> {\n    await this.storage.close();\n  }\n\n  /**\n   * Drop the singleton so the next {@link getInstance} builds a fresh manager.\n   *\n   * Both fields must clear — `getInstance()` falls back to `initPromise` when\n   * `instance` is null. A pointer drop, not teardown: call {@link close} first\n   * or the old storage leaks (a `pg.Pool` under `PersistentStorage`).\n   *\n   * @internal\n   */\n  static reset(): void {\n    CacheManager.instance = null;\n    CacheManager.initPromise = null;\n  }\n\n  /**\n   * Check if the storage is healthy\n   * @returns Promise of true if the storage is healthy, false otherwise\n   */\n  async isStorageHealthy(): Promise<boolean> {\n    return this.storage.healthCheck();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAeA,MAAM,SAAS,aAAa,QAAQ;AAoBpC,SAAS,iBAAiB,QAA8B;AACtD,KAAI,OAAO,WAAW,OAAW,QAAO,OAAO;AAC/C,QAAO,IAAI,aAAa,8BAA8B,aAAa;;;;;;;;;;;;;;;;AAiBrE,IAAa,eAAb,MAAa,aAAa;CACxB,OAAwB,0BAA0B;CAClD,OAAwB,wBAAwB;CAChD,AAAiB,OAAe;CAChC,OAAe,WAAgC;CAC/C,OAAe,cAA4C;CAE3D,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,AAAQ;CACR,AAAQ;CAKR,AAAQ,YAAY,SAAuB,QAAqB;AAC9D,OAAK,UAAU;AACf,OAAK,SAAS;AACd,OAAK,mCAAmB,IAAI,KAAK;AACjC,OAAK,oBAAoB;AACzB,OAAK,qBAAqB;AAE1B,OAAK,YAAY,iBAAiB,YAChC,KAAK,MACL,KAAK,OAAO,UACb;AACD,OAAK,mBAAmB;GACtB,eAAe,KAAK,UAAU,UAAU,CAAC,cAAc,aAAa;IAClE,aAAa;IACb,MAAM;IACP,CAAC;GACF,gBAAgB,KAAK,UAAU,UAAU,CAAC,cAAc,cAAc;IACpE,aAAa;IACb,MAAM;IACP,CAAC;GACH;;;;;;;;CASH,OAAO,kBAAgC;AACrC,MAAI,CAAC,aAAa,SAChB,OAAM,oBAAoB,eACxB,gBACA,kEACD;AAGH,SAAO,aAAa;;;;;;;;;CAUtB,aAAa,YACX,YACuB;AACvB,MAAI,aAAa,SACf,QAAO,aAAa;AAGtB,MAAI,CAAC,aAAa,YAChB,cAAa,cAAc,aAAa,OAAO,WAAW,CAAC,MACxD,aAAa;AAKZ,gBAAa,WAAW;AACxB,UAAO;IAEV;AAGH,SAAO,aAAa;;;;;;;;;;;;;;CAetB,aAAqB,OACnB,YACuB;EACvB,MAAM,SAAS,UAAU,eAAe,WAAW;AAEnD,MAAI,OAAO,SAAS;AAElB,OADkB,MAAM,OAAO,QAAQ,aAAa,CAElD,QAAO,IAAI,aAAa,OAAO,SAAS,OAAO;AAGjD,OAAI,OAAO,mBAAmB;IAC5B,MAAM,iBAAiB;KAAE,GAAG;KAAQ,SAAS;KAAO;AACpD,WAAO,IAAI,aACT,IAAI,gBAAgB,eAAe,EACnC,eACD;;AAGH,UAAO,IAAI,aAAa,IAAI,gBAAgB,OAAO,EAAE,OAAO;;AAI9D,MAAI;GAIF,MAAM,OAAO,mBAAmB,EAAE,iBAHV,sBAAsB,EAC5C,eAAe,kBAAkB,EAClC,CAAC,CAAC,yBAAyB,EACuB,CAAC;GACpD,MAAM,oBAAoB,IAAI,kBAAkB,QAAQ,KAAK;AAG7D,OADkB,MAAM,kBAAkB,aAAa,EACxC;AACb,UAAM,kBAAkB,YAAY;AACpC,WAAO,IAAI,aAAa,mBAAmB,OAAO;;AAIpD,SAAM,KAAK,KAAK;UACV;AAIR,MAAI,OAAO,mBAAmB;GAC5B,MAAM,iBAAiB;IAAE,GAAG;IAAQ,SAAS;IAAO;AACpD,UAAO,IAAI,aACT,IAAI,gBAAgB,eAAe,EACnC,eACD;;AAGH,SAAO,IAAI,aAAa,IAAI,gBAAgB,OAAO,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;CAuB9D,MAAM,aACJ,KACA,IACA,SACA,SACY;AACZ,MAAI,CAAC,KAAK,OAAO,QAAS,QAAO,GAAG,SAAS,aAAa;EAE1D,MAAM,eAAe,SAAS;AAC9B,MAAI,cAAc,QAChB,OAAM,iBAAiB,aAAa;EAGtC,MAAM,WAAW,KAAK,YAAY,KAAK,QAAQ;AAE/C,SAAO,KAAK,UAAU,gBACpB,sBACA,EACE,YAAY;GACV,aAAa;GACb,iBAAiB,KAAK,OAAO;GAC7B,oBAAoB,KAAK,QAAQ,cAAc;GAChD,EACF,EACD,OAAO,SAAS;AACd,OAAI;IACF,MAAM,SAAS,MAAM,KAAK,SAAY,SAAS;AAC/C,QAAI,WAAW,MAAM;AACnB,UAAK,aAAa,aAAa,KAAK;AACpC,UAAK,UAAU,EAAE,MAAM,eAAe,IAAI,CAAC;AAC3C,UAAK,iBAAiB,cAAc,IAAI,GAAG,EACzC,aAAa,UACd,CAAC;AAEF,YAAO,OAAO,EAAE,aAAa;MAC3B,WAAW;MACX,WAAW;MACZ,CAAC;AAEF,YAAO,OAAO;;IAMhB,MAAM,WAAW,KAAK,iBAAiB,IAAI,SAAS;AAGpD,QAAI,YAAY,CAAC,SAAS,iBAAiB,OAAO,SAAS;AACzD,cAAS;AAET,SAAI,SAAS,YAAY;AACvB,mBAAa,SAAS,WAAW;AACjC,eAAS,aAAa;;AAExB,UAAK,aAAa,aAAa,KAAK;AACpC,UAAK,aAAa,uBAAuB,KAAK;AAC9C,UAAK,SAAS,4BAA4B,EACxC,aAAa,UACd,CAAC;AACF,UAAK,iBAAiB,cAAc,IAAI,GAAG;MACzC,aAAa;MACb,uBAAuB;MACxB,CAAC;AAEF,YAAO,OAAO,EAAE,aAAa;MAC3B,WAAW;MACX,WAAW;MACX,qBAAqB;MACtB,CAAC;AAEF,YAAO,MAAM,KAAK,kBAAkB,UAAU,aAAa;;AAI7D,SAAK,aAAa,aAAa,MAAM;AACrC,SAAK,SAAS,cAAc,EAAE,aAAa,UAAU,CAAC;AACtD,SAAK,iBAAiB,eAAe,IAAI,GAAG,EAC1C,aAAa,UACd,CAAC;AAEF,WAAO,OAAO,EAAE,aAAa;KAC3B,WAAW;KACX,WAAW;KACZ,CAAC;IAEF,MAAM,mBAAmB,IAAI,iBAAiB;IAC9C,MAAM,QAA0B;KAC9B,SAAS;KACT,UAAU;KACV;KACD;AAED,UAAM,UAAU,GAAG,iBAAiB,OAAO,CACxC,KAAK,OAAO,WAAW;AACtB,WAAM,KAAK,IAAI,UAAU,QAAQ,QAAQ;AACzC,UAAK,SAAS,sBAAsB;MAClC,aAAa;MACb,aAAa,SAAS,OAAO,KAAK,OAAO,OAAO;MACjD,CAAC;AACF,YAAO;MACP,CACD,OAAO,UAAU;AAChB,UAAK,gBAAgB,MAAM;AAC3B,UAAK,UAAU,EAAE,MAAM,eAAe,OAAO,CAAC;AAK9C,SAAI,iBAAiB,OAAO,QAC1B,OAAM;AAER,SAAI,iBAAiB,eAAe,iBAAiB,SACnD,OAAM;AAER,WAAM,eAAe,gBACnB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CACvD;MACD,CACD,cAAc;AACb,SAAI,KAAK,iBAAiB,IAAI,SAAS,KAAK,MAC1C,MAAK,iBAAiB,OAAO,SAAS;MAExC;AAKJ,UAAM,QAAQ,YAAY,GAAG;AAE7B,SAAK,iBAAiB,IAAI,UAAU,MAAgC;IAEpE,MAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,aAAa;AAChE,SAAK,UAAU,EAAE,MAAM,eAAe,IAAI,CAAC;AAC3C,WAAO;YACA,OAAO;AACd,SAAK,gBAAgB,MAAe;AACpC,SAAK,UAAU,EAAE,MAAM,eAAe,OAAO,CAAC;AAC9C,UAAM;aACE;AACR,SAAK,KAAK;;KAGd;GAAE,MAAM,KAAK;GAAM,eAAe;GAAM,CACzC;;;;;;;;;CAUH,AAAQ,kBACN,OACA,cACY;AACZ,MAAI,CAAC,aAAc,QAAO,MAAM;AAEhC,SAAO,IAAI,SAAY,SAAS,WAAW;GACzC,IAAI,UAAU;GAEd,MAAM,gBAAgB;AACpB,QAAI,MAAM,WAAW,EAAG,OAAM;AAC9B,QAAI,MAAM,YAAY,KAAK,CAAC,MAAM,iBAAiB,OAAO,QAGxD,OAAM,aAAa,iBAAiB;AAClC,SAAI,MAAM,YAAY,KAAK,CAAC,MAAM,iBAAiB,OAAO,QACxD,OAAM,iBAAiB,MACrB,aAAa,UAAU,4BACxB;OAEF,aAAa,sBAAsB;;GAI1C,MAAM,gBAAgB;AACpB,QAAI,QAAS;AACb,cAAU;AACV,iBAAa,oBAAoB,SAAS,QAAQ;AAClD,aAAS;AACT,WAAO,iBAAiB,aAAa,CAAC;;AAGxC,OAAI,aAAa,SAAS;AACxB,aAAS;AACT;;AAGF,gBAAa,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;AAE/D,SAAM,QAAQ,MACX,UAAU;AACT,QAAI,QAAS;AACb,cAAU;AACV,iBAAa,oBAAoB,SAAS,QAAQ;AAClD,YAAQ,MAAM;OAEf,UAAU;AACT,QAAI,QAAS;AACb,cAAU;AACV,iBAAa,oBAAoB,SAAS,QAAQ;AAClD,WAAO,MAAM;KAEhB;IACD;;;;;;;CAQJ,MAAM,IAAO,KAAgC;AAC3C,MAAI,CAAC,KAAK,OAAO,QAAS,QAAO;AAGjC,OAAK,cAAc;AAGnB,UADc,MAAM,KAAK,SAAY,IAAI,GAC3B,SAAS;;;;;;;;;CAUzB,MAAc,SAAY,KAA4C;EACpE,MAAM,QAAQ,MAAM,KAAK,QAAQ,IAAO,IAAI;AAC5C,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,KAAK,KAAK,GAAG,MAAM,QAAQ;AAC7B,SAAM,KAAK,QAAQ,OAAO,IAAI;AAC9B,UAAO;;AAET,SAAO;;;CAIT,AAAQ,eAAqB;AAC3B,MAAI,KAAK,kBAAmB;AAC5B,MAAI,CAAC,KAAK,QAAQ,cAAc,CAAE;EAClC,MAAM,MAAM,KAAK,KAAK;AACtB,MAAI,MAAM,KAAK,qBAAqB,aAAa,wBAC/C;EAEF,MAAM,cAAc,KAAK,OAAO,sBAAsB;AAEtD,MAAI,KAAK,QAAQ,GAAG,YAAa;AAEjC,OAAK,qBAAqB;AAE1B,OAAK,oBAAoB;AACzB,EAAC,KAAK,QACH,gBAAgB,CAChB,OAAO,UAAU;AAChB,UAAO,MAAM,yCAAyC,MAAM;IAC5D,CACD,cAAc;AACb,QAAK,oBAAoB;IACzB;;;;;;;;;CAUN,MAAM,IACJ,KACA,OACA,SACe;AACf,MAAI,CAAC,KAAK,OAAO,QAAS;EAE1B,MAAM,MAAM,SAAS,OAAO,KAAK,OAAO,OAAO;EAC/C,MAAM,aAAa,KAAK,KAAK,GAAG,MAAM;AACtC,QAAM,KAAK,QAAQ,IAAI,KAAK;GAAE;GAAO,QAAQ;GAAY,CAAC;;;;;;;CAQ5D,MAAM,OAAO,KAA4B;AACvC,MAAI,CAAC,KAAK,OAAO,QAAS;AAC1B,QAAM,KAAK,QAAQ,OAAO,IAAI;;;CAIhC,MAAM,QAAuB;AAC3B,QAAM,KAAK,QAAQ,OAAO;AAC1B,OAAK,MAAM,SAAS,KAAK,iBAAiB,QAAQ,CAChD,KAAI,MAAM,WAAY,cAAa,MAAM,WAAW;AAEtD,OAAK,iBAAiB,OAAO;;;;;;;CAQ/B,MAAM,IAAI,KAA+B;AACvC,MAAI,CAAC,KAAK,OAAO,QAAS,QAAO;AAGjC,SADc,MAAM,KAAK,SAAS,IAAI,KACrB;;;;;;;;CASnB,YAAY,OAAqC,SAAyB;EACxE,MAAM,WAAW,CAAC,SAAS,GAAG,MAAM;EACpC,MAAM,aAAa,KAAK,UAAU,SAAS;AAC3C,SAAO,WAAW,SAAS,CAAC,OAAO,WAAW,CAAC,OAAO,MAAM;;;CAI9D,MAAM,QAAuB;AAC3B,QAAM,KAAK,QAAQ,OAAO;;;;;;;;;;;CAY5B,OAAO,QAAc;AACnB,eAAa,WAAW;AACxB,eAAa,cAAc;;;;;;CAO7B,MAAM,mBAAqC;AACzC,SAAO,KAAK,QAAQ,aAAa"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/cache/index.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport type { CacheConfig, CacheEntry, CacheStorage } from \"shared\";\n\nimport { createLakebasePool } from \"../connectors/lakebase\";\nimport { getClientOptions } from \"../context/client-options\";\nimport { getCurrentPrincipalKey } from \"../context/execution-context\";\nimport { AppKitError, ExecutionError, InitializationError } from \"../errors\";\nimport { createLogger } from \"../logging/logger\";\nimport type { Counter, TelemetryProvider } from \"../telemetry\";\nimport { SpanStatusCode, TelemetryManager } from \"../telemetry\";\nimport { deepMerge } from \"../utils\";\nimport { ApiError, createWorkspaceClient } from \"../workspace-client\";\nimport { cacheDefaults } from \"./defaults\";\nimport { InMemoryStorage, PersistentStorage } from \"./storage\";\n\nconst logger = createLogger(\"cache\");\n\n/**\n * Reference-counted in-flight cache execution entry.\n *\n * `sharedController` decouples the cached `fn()` from any single caller's\n * abort signal. Callers join an in-flight entry by incrementing `refCount`;\n * when a caller aborts, refCount is decremented. The shared controller is\n * aborted only when refCount drops to 0 — i.e. all callers have abandoned\n * the request. This prevents one caller's cancellation (e.g. React\n * StrictMode unmount) from poisoning the in-flight result for other still-\n * connected awaiters.\n */\ninterface InFlightEntry<T> {\n  promise: Promise<T>;\n  refCount: number;\n  sharedController: AbortController;\n  abortTimer?: ReturnType<typeof setTimeout>;\n}\n\nfunction createAbortError(signal: AbortSignal): unknown {\n  if (signal.reason !== undefined) return signal.reason;\n  return new DOMException(\"The operation was aborted.\", \"AbortError\");\n}\n\n/**\n * Cache manager class to handle cache operations.\n * Can be used with in-memory storage or persistent storage (Lakebase).\n *\n * The cache is automatically initialized by AppKit. Use `getInstanceSync()` to access\n * the singleton instance after initialization.\n *\n * @internal\n * @example\n * ```typescript\n * const cache = CacheManager.getInstanceSync();\n * const result = await cache.getOrExecute([\"users\", userId], () => fetchUser(userId), userKey);\n * ```\n */\nexport class CacheManager {\n  private static readonly MIN_CLEANUP_INTERVAL_MS = 60_000;\n  private static readonly ABORT_GRACE_PERIOD_MS = 100;\n  private readonly name: string = \"cache-manager\";\n  private static instance: CacheManager | null = null;\n  private static initPromise: Promise<CacheManager> | null = null;\n\n  private storage: CacheStorage;\n  private config: CacheConfig;\n  private inFlightRequests: Map<string, InFlightEntry<unknown>>;\n  private cleanupInProgress: boolean;\n  private lastCleanupAttempt: number;\n\n  private telemetry: TelemetryProvider;\n  private telemetryMetrics: {\n    cacheHitCount: Counter;\n    cacheMissCount: Counter;\n  };\n\n  private constructor(storage: CacheStorage, config: CacheConfig) {\n    this.storage = storage;\n    this.config = config;\n    this.inFlightRequests = new Map();\n    this.cleanupInProgress = false;\n    this.lastCleanupAttempt = 0;\n\n    this.telemetry = TelemetryManager.getProvider(\n      this.name,\n      this.config.telemetry,\n    );\n    this.telemetryMetrics = {\n      cacheHitCount: this.telemetry.getMeter().createCounter(\"cache.hit\", {\n        description: \"Total number of cache hits\",\n        unit: \"1\",\n      }),\n      cacheMissCount: this.telemetry.getMeter().createCounter(\"cache.miss\", {\n        description: \"Total number of cache misses\",\n        unit: \"1\",\n      }),\n    };\n  }\n\n  /**\n   * Get the singleton instance of the cache manager (sync version).\n   *\n   * Throws if not initialized - ensure AppKit.create() has completed first.\n   * @returns CacheManager instance\n   */\n  static getInstanceSync(): CacheManager {\n    if (!CacheManager.instance) {\n      throw InitializationError.notInitialized(\n        \"CacheManager\",\n        \"Ensure AppKit.create() has completed before accessing the cache\",\n      );\n    }\n\n    return CacheManager.instance;\n  }\n\n  /**\n   * Initialize and get the singleton instance of the cache manager.\n   * Called internally by AppKit - prefer `getInstanceSync()` for plugin access.\n   * @param userConfig - User configuration for the cache manager\n   * @returns CacheManager instance\n   * @internal\n   */\n  static async getInstance(\n    userConfig?: Partial<CacheConfig>,\n  ): Promise<CacheManager> {\n    if (CacheManager.instance) {\n      return CacheManager.instance;\n    }\n\n    if (!CacheManager.initPromise) {\n      CacheManager.initPromise = CacheManager.create(userConfig).then(\n        (instance) => {\n          // Publishes unconditionally: safe only because every getInstance() is\n          // awaited before any reset(), so a reset() can never land mid-init and\n          // this can never publish over it. A future unawaited-init caller would\n          // reintroduce that stale-publish race (the removed `generation` guard).\n          CacheManager.instance = instance;\n          return instance;\n        },\n      );\n    }\n\n    return CacheManager.initPromise;\n  }\n\n  /**\n   * Create a new cache manager instance\n   *\n   * Storage selection logic:\n   * 1. If `storage` provided and healthy → use provided storage\n   * 2. If `storage` provided but unhealthy → fallback to InMemory (or disable if strictPersistence)\n   * 3. If no `storage` provided and Lakebase available → use Lakebase\n   * 4. If no `storage` provided and Lakebase unavailable → fallback to InMemory (or disable if strictPersistence)\n   *\n   * @param userConfig - User configuration for the cache manager\n   * @returns CacheManager instance\n   */\n  private static async create(\n    userConfig?: Partial<CacheConfig>,\n  ): Promise<CacheManager> {\n    const config = deepMerge(cacheDefaults, userConfig);\n\n    if (config.storage) {\n      const isHealthy = await config.storage.healthCheck();\n      if (isHealthy) {\n        return new CacheManager(config.storage, config);\n      }\n\n      if (config.strictPersistence) {\n        const disabledConfig = { ...config, enabled: false };\n        return new CacheManager(\n          new InMemoryStorage(disabledConfig),\n          disabledConfig,\n        );\n      }\n\n      return new CacheManager(new InMemoryStorage(config), config);\n    }\n\n    // try to use lakebase storage\n    try {\n      const workspaceClient = createWorkspaceClient({\n        clientOptions: getClientOptions(),\n      }).toLegacyWorkspaceClient();\n      const pool = createLakebasePool({ workspaceClient });\n      const persistentStorage = new PersistentStorage(config, pool);\n\n      const isHealthy = await persistentStorage.healthCheck();\n      if (isHealthy) {\n        await persistentStorage.initialize();\n        return new CacheManager(persistentStorage, config);\n      }\n\n      // Health check failed, close the pool and fallback\n      await pool.end();\n    } catch {\n      // lakebase unavailable, continue with in-memory storage\n    }\n\n    if (config.strictPersistence) {\n      const disabledConfig = { ...config, enabled: false };\n      return new CacheManager(\n        new InMemoryStorage(disabledConfig),\n        disabledConfig,\n      );\n    }\n\n    return new CacheManager(new InMemoryStorage(config), config);\n  }\n\n  /**\n   * Get or execute a function and cache the result.\n   *\n   * Multiple concurrent callers with the same `cacheKey` are deduplicated\n   * onto a single in-flight execution. Each caller may pass its own\n   * `callerSignal`; the underlying `fn()` is run with a shared, internally\n   * managed `AbortSignal` that aborts only when *all* callers have\n   * abandoned the request (reference counted). This decouples a single\n   * caller's cancellation (e.g. React StrictMode unmount) from the shared\n   * result, so other still-connected callers receive the cached value\n   * normally.\n   *\n   * @param key - Cache key parts\n   * @param fn - Function to execute. Receives the cache-owned shared signal;\n   *   pass it through to the underlying I/O so the work is cancelled when\n   *   no caller is left waiting.\n   * @param userKey - User key for cache namespacing\n   * @param options - Options for the cache\n   * @returns Promise of the result\n   */\n  async getOrExecute<T>(\n    key: (string | number | object)[],\n    fn: (sharedSignal?: AbortSignal) => Promise<T>,\n    userKey: string,\n    options?: { ttl?: number; callerSignal?: AbortSignal },\n  ): Promise<T> {\n    if (!this.config.enabled) return fn(options?.callerSignal);\n\n    const callerSignal = options?.callerSignal;\n    if (callerSignal?.aborted) {\n      throw createAbortError(callerSignal);\n    }\n\n    const cacheKey = this.generateKey(key, userKey);\n\n    return this.telemetry.startActiveSpan(\n      \"cache.getOrExecute\",\n      {\n        attributes: {\n          \"cache.key\": cacheKey,\n          \"cache.enabled\": this.config.enabled,\n          \"cache.persistent\": this.storage.isPersistent(),\n        },\n      },\n      async (span) => {\n        try {\n          const cached = await this.getValid<T>(cacheKey);\n          if (cached !== null) {\n            span.setAttribute(\"cache.hit\", true);\n            span.setStatus({ code: SpanStatusCode.OK });\n            this.telemetryMetrics.cacheHitCount.add(1, {\n              \"cache.key\": cacheKey,\n            });\n\n            logger.event()?.setExecution({\n              cache_hit: true,\n              cache_key: cacheKey,\n            });\n\n            return cached.value;\n          }\n\n          // check if the value is being processed by another request — join\n          // the existing in-flight entry under reference counting so this\n          // caller's abort doesn't poison the shared result.\n          const existing = this.inFlightRequests.get(cacheKey) as\n            | InFlightEntry<T>\n            | undefined;\n          if (existing && !existing.sharedController.signal.aborted) {\n            existing.refCount++;\n            // Cancel any pending abort timer — a new caller has joined\n            if (existing.abortTimer) {\n              clearTimeout(existing.abortTimer);\n              existing.abortTimer = undefined;\n            }\n            span.setAttribute(\"cache.hit\", true);\n            span.setAttribute(\"cache.deduplication\", true);\n            span.addEvent(\"cache.deduplication_used\", {\n              \"cache.key\": cacheKey,\n            });\n            this.telemetryMetrics.cacheHitCount.add(1, {\n              \"cache.key\": cacheKey,\n              \"cache.deduplication\": \"true\",\n            });\n\n            logger.event()?.setExecution({\n              cache_hit: true,\n              cache_key: cacheKey,\n              cache_deduplication: true,\n            });\n\n            return await this._waitWithRefCount(existing, callerSignal);\n          }\n\n          // cache miss - execute function under a shared abort controller\n          span.setAttribute(\"cache.hit\", false);\n          span.addEvent(\"cache.miss\", { \"cache.key\": cacheKey });\n          this.telemetryMetrics.cacheMissCount.add(1, {\n            \"cache.key\": cacheKey,\n          });\n\n          logger.event()?.setExecution({\n            cache_hit: false,\n            cache_key: cacheKey,\n          });\n\n          const sharedController = new AbortController();\n          const entry: InFlightEntry<T> = {\n            promise: undefined as unknown as Promise<T>,\n            refCount: 1,\n            sharedController,\n          };\n\n          entry.promise = fn(sharedController.signal)\n            .then(async (result) => {\n              await this.set(cacheKey, result, options);\n              span.addEvent(\"cache.value_stored\", {\n                \"cache.key\": cacheKey,\n                \"cache.ttl\": options?.ttl ?? this.config.ttl ?? 3600,\n              });\n              return result;\n            })\n            .catch((error) => {\n              span.recordException(error);\n              span.setStatus({ code: SpanStatusCode.ERROR });\n              // If the shared controller aborted, all callers have already\n              // abandoned the request (or are about to via their own signals)\n              // — propagate the original error without wrapping. No live\n              // awaiter will observe this rejection.\n              if (sharedController.signal.aborted) {\n                throw error;\n              }\n              if (error instanceof AppKitError || error instanceof ApiError) {\n                throw error;\n              }\n              throw ExecutionError.statementFailed(\n                error instanceof Error ? error.message : String(error),\n              );\n            })\n            .finally(() => {\n              if (this.inFlightRequests.get(cacheKey) === entry) {\n                this.inFlightRequests.delete(cacheKey);\n              }\n            });\n\n          // Suppress unhandled rejection warnings when every caller bailed\n          // before fn() resolved (their own promises rejected via\n          // waitWithRefCount; the underlying entry.promise has no awaiter).\n          entry.promise.catch(() => {});\n\n          this.inFlightRequests.set(cacheKey, entry as InFlightEntry<unknown>);\n\n          const result = await this._waitWithRefCount(entry, callerSignal);\n          span.setStatus({ code: SpanStatusCode.OK });\n          return result;\n        } catch (error) {\n          span.recordException(error as Error);\n          span.setStatus({ code: SpanStatusCode.ERROR });\n          throw error;\n        } finally {\n          span.end();\n        }\n      },\n      { name: this.name, includePrefix: true },\n    );\n  }\n\n  /**\n   * Wait on an in-flight entry, racing the underlying promise against the\n   * caller's abort signal. When the caller aborts, the entry's refCount is\n   * decremented; if it hits zero the shared controller is aborted so the\n   * underlying `fn()` can stop. Other callers continue to await the same\n   * entry and receive the result when it arrives.\n   */\n  private _waitWithRefCount<T>(\n    entry: InFlightEntry<T>,\n    callerSignal?: AbortSignal,\n  ): Promise<T> {\n    if (!callerSignal) return entry.promise;\n\n    return new Promise<T>((resolve, reject) => {\n      let settled = false;\n\n      const release = () => {\n        if (entry.refCount > 0) entry.refCount--;\n        if (entry.refCount <= 0 && !entry.sharedController.signal.aborted) {\n          // Grace period: delay abort so a StrictMode remount can join\n          // the in-flight entry before the shared execution is cancelled.\n          entry.abortTimer = setTimeout(() => {\n            if (entry.refCount <= 0 && !entry.sharedController.signal.aborted) {\n              entry.sharedController.abort(\n                callerSignal.reason ?? \"all cache callers aborted\",\n              );\n            }\n          }, CacheManager.ABORT_GRACE_PERIOD_MS);\n        }\n      };\n\n      const onAbort = () => {\n        if (settled) return;\n        settled = true;\n        callerSignal.removeEventListener(\"abort\", onAbort);\n        release();\n        reject(createAbortError(callerSignal));\n      };\n\n      if (callerSignal.aborted) {\n        onAbort();\n        return;\n      }\n\n      callerSignal.addEventListener(\"abort\", onAbort, { once: true });\n\n      entry.promise.then(\n        (value) => {\n          if (settled) return;\n          settled = true;\n          callerSignal.removeEventListener(\"abort\", onAbort);\n          resolve(value);\n        },\n        (error) => {\n          if (settled) return;\n          settled = true;\n          callerSignal.removeEventListener(\"abort\", onAbort);\n          reject(error);\n        },\n      );\n    });\n  }\n\n  /**\n   * Get a cached value\n   * @param key - Cache key\n   * @returns Promise of the value or null if not found or expired\n   */\n  async get<T>(key: string): Promise<T | null> {\n    if (!this.config.enabled) return null;\n\n    // probabilistic cleanup trigger\n    this.maybeCleanup();\n\n    const entry = await this.getValid<T>(key);\n    return entry?.value ?? null;\n  }\n\n  /**\n   * Get a cached entry only if it has not expired.\n   * Returns null on miss or expired (and deletes the expired entry).\n   *\n   * Storage implementations return entries unconditionally — expiry handling\n   * lives at the CacheManager layer.\n   */\n  private async getValid<T>(key: string): Promise<CacheEntry<T> | null> {\n    const entry = await this.storage.get<T>(key);\n    if (!entry) return null;\n\n    if (Date.now() > entry.expiry) {\n      await this.storage.delete(key);\n      return null;\n    }\n    return entry;\n  }\n\n  /** Probabilistically trigger cleanup of expired entries (fire-and-forget) */\n  private maybeCleanup(): void {\n    if (this.cleanupInProgress) return;\n    if (!this.storage.isPersistent()) return;\n    const now = Date.now();\n    if (now - this.lastCleanupAttempt < CacheManager.MIN_CLEANUP_INTERVAL_MS)\n      return;\n\n    const probability = this.config.cleanupProbability ?? 0.01;\n\n    if (Math.random() > probability) return;\n\n    this.lastCleanupAttempt = now;\n\n    this.cleanupInProgress = true;\n    (this.storage as PersistentStorage)\n      .cleanupExpired()\n      .catch((error) => {\n        logger.debug(\"Error cleaning up expired entries: %O\", error);\n      })\n      .finally(() => {\n        this.cleanupInProgress = false;\n      });\n  }\n\n  /**\n   * Set a value in the cache\n   * @param key - Cache key\n   * @param value - Value to set\n   * @param options - Options for the cache\n   * @returns Promise of the result\n   */\n  async set<T>(\n    key: string,\n    value: T,\n    options?: { ttl?: number },\n  ): Promise<void> {\n    if (!this.config.enabled) return;\n\n    const ttl = options?.ttl ?? this.config.ttl ?? 3600;\n    const expiryTime = Date.now() + ttl * 1000;\n    await this.storage.set(key, { value, expiry: expiryTime });\n  }\n\n  /**\n   * Delete a value from the cache\n   * @param key - Cache key\n   * @returns Promise of the result\n   */\n  async delete(key: string): Promise<void> {\n    if (!this.config.enabled) return;\n    await this.storage.delete(key);\n  }\n\n  /** Clear the cache */\n  async clear(): Promise<void> {\n    await this.storage.clear();\n    for (const entry of this.inFlightRequests.values()) {\n      if (entry.abortTimer) clearTimeout(entry.abortTimer);\n    }\n    this.inFlightRequests.clear();\n  }\n\n  /**\n   * Check if a value exists in the cache\n   * @param key - Cache key\n   * @returns Promise of true if the value exists, false otherwise\n   */\n  async has(key: string): Promise<boolean> {\n    if (!this.config.enabled) return false;\n\n    const entry = await this.getValid(key);\n    return entry !== null;\n  }\n\n  /**\n   * Generate a cache key\n   * @param parts - Parts of the key\n   * @param userKey - User key\n   * @returns Cache key\n   */\n  generateKey(parts: (string | number | object)[], userKey: string): string {\n    // Legacy partitions remain supported, but cannot override the principal namespace.\n    const allParts = [getCurrentPrincipalKey(), userKey, ...parts];\n    const serialized = JSON.stringify(allParts);\n    return createHash(\"sha256\").update(serialized).digest(\"hex\");\n  }\n\n  /** Close the cache */\n  async close(): Promise<void> {\n    await this.storage.close();\n  }\n\n  /**\n   * Drop the singleton so the next {@link getInstance} builds a fresh manager.\n   *\n   * Both fields must clear — `getInstance()` falls back to `initPromise` when\n   * `instance` is null. A pointer drop, not teardown: call {@link close} first\n   * or the old storage leaks (a `pg.Pool` under `PersistentStorage`).\n   *\n   * @internal\n   */\n  static reset(): void {\n    CacheManager.instance = null;\n    CacheManager.initPromise = null;\n  }\n\n  /**\n   * Check if the storage is healthy\n   * @returns Promise of true if the storage is healthy, false otherwise\n   */\n  async isStorageHealthy(): Promise<boolean> {\n    return this.storage.healthCheck();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,MAAM,SAAS,aAAa,QAAQ;AAoBpC,SAAS,iBAAiB,QAA8B;AACtD,KAAI,OAAO,WAAW,OAAW,QAAO,OAAO;AAC/C,QAAO,IAAI,aAAa,8BAA8B,aAAa;;;;;;;;;;;;;;;;AAiBrE,IAAa,eAAb,MAAa,aAAa;CACxB,OAAwB,0BAA0B;CAClD,OAAwB,wBAAwB;CAChD,AAAiB,OAAe;CAChC,OAAe,WAAgC;CAC/C,OAAe,cAA4C;CAE3D,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,AAAQ;CACR,AAAQ;CAKR,AAAQ,YAAY,SAAuB,QAAqB;AAC9D,OAAK,UAAU;AACf,OAAK,SAAS;AACd,OAAK,mCAAmB,IAAI,KAAK;AACjC,OAAK,oBAAoB;AACzB,OAAK,qBAAqB;AAE1B,OAAK,YAAY,iBAAiB,YAChC,KAAK,MACL,KAAK,OAAO,UACb;AACD,OAAK,mBAAmB;GACtB,eAAe,KAAK,UAAU,UAAU,CAAC,cAAc,aAAa;IAClE,aAAa;IACb,MAAM;IACP,CAAC;GACF,gBAAgB,KAAK,UAAU,UAAU,CAAC,cAAc,cAAc;IACpE,aAAa;IACb,MAAM;IACP,CAAC;GACH;;;;;;;;CASH,OAAO,kBAAgC;AACrC,MAAI,CAAC,aAAa,SAChB,OAAM,oBAAoB,eACxB,gBACA,kEACD;AAGH,SAAO,aAAa;;;;;;;;;CAUtB,aAAa,YACX,YACuB;AACvB,MAAI,aAAa,SACf,QAAO,aAAa;AAGtB,MAAI,CAAC,aAAa,YAChB,cAAa,cAAc,aAAa,OAAO,WAAW,CAAC,MACxD,aAAa;AAKZ,gBAAa,WAAW;AACxB,UAAO;IAEV;AAGH,SAAO,aAAa;;;;;;;;;;;;;;CAetB,aAAqB,OACnB,YACuB;EACvB,MAAM,SAAS,UAAU,eAAe,WAAW;AAEnD,MAAI,OAAO,SAAS;AAElB,OADkB,MAAM,OAAO,QAAQ,aAAa,CAElD,QAAO,IAAI,aAAa,OAAO,SAAS,OAAO;AAGjD,OAAI,OAAO,mBAAmB;IAC5B,MAAM,iBAAiB;KAAE,GAAG;KAAQ,SAAS;KAAO;AACpD,WAAO,IAAI,aACT,IAAI,gBAAgB,eAAe,EACnC,eACD;;AAGH,UAAO,IAAI,aAAa,IAAI,gBAAgB,OAAO,EAAE,OAAO;;AAI9D,MAAI;GAIF,MAAM,OAAO,mBAAmB,EAAE,iBAHV,sBAAsB,EAC5C,eAAe,kBAAkB,EAClC,CAAC,CAAC,yBAAyB,EACuB,CAAC;GACpD,MAAM,oBAAoB,IAAI,kBAAkB,QAAQ,KAAK;AAG7D,OADkB,MAAM,kBAAkB,aAAa,EACxC;AACb,UAAM,kBAAkB,YAAY;AACpC,WAAO,IAAI,aAAa,mBAAmB,OAAO;;AAIpD,SAAM,KAAK,KAAK;UACV;AAIR,MAAI,OAAO,mBAAmB;GAC5B,MAAM,iBAAiB;IAAE,GAAG;IAAQ,SAAS;IAAO;AACpD,UAAO,IAAI,aACT,IAAI,gBAAgB,eAAe,EACnC,eACD;;AAGH,SAAO,IAAI,aAAa,IAAI,gBAAgB,OAAO,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;CAuB9D,MAAM,aACJ,KACA,IACA,SACA,SACY;AACZ,MAAI,CAAC,KAAK,OAAO,QAAS,QAAO,GAAG,SAAS,aAAa;EAE1D,MAAM,eAAe,SAAS;AAC9B,MAAI,cAAc,QAChB,OAAM,iBAAiB,aAAa;EAGtC,MAAM,WAAW,KAAK,YAAY,KAAK,QAAQ;AAE/C,SAAO,KAAK,UAAU,gBACpB,sBACA,EACE,YAAY;GACV,aAAa;GACb,iBAAiB,KAAK,OAAO;GAC7B,oBAAoB,KAAK,QAAQ,cAAc;GAChD,EACF,EACD,OAAO,SAAS;AACd,OAAI;IACF,MAAM,SAAS,MAAM,KAAK,SAAY,SAAS;AAC/C,QAAI,WAAW,MAAM;AACnB,UAAK,aAAa,aAAa,KAAK;AACpC,UAAK,UAAU,EAAE,MAAM,eAAe,IAAI,CAAC;AAC3C,UAAK,iBAAiB,cAAc,IAAI,GAAG,EACzC,aAAa,UACd,CAAC;AAEF,YAAO,OAAO,EAAE,aAAa;MAC3B,WAAW;MACX,WAAW;MACZ,CAAC;AAEF,YAAO,OAAO;;IAMhB,MAAM,WAAW,KAAK,iBAAiB,IAAI,SAAS;AAGpD,QAAI,YAAY,CAAC,SAAS,iBAAiB,OAAO,SAAS;AACzD,cAAS;AAET,SAAI,SAAS,YAAY;AACvB,mBAAa,SAAS,WAAW;AACjC,eAAS,aAAa;;AAExB,UAAK,aAAa,aAAa,KAAK;AACpC,UAAK,aAAa,uBAAuB,KAAK;AAC9C,UAAK,SAAS,4BAA4B,EACxC,aAAa,UACd,CAAC;AACF,UAAK,iBAAiB,cAAc,IAAI,GAAG;MACzC,aAAa;MACb,uBAAuB;MACxB,CAAC;AAEF,YAAO,OAAO,EAAE,aAAa;MAC3B,WAAW;MACX,WAAW;MACX,qBAAqB;MACtB,CAAC;AAEF,YAAO,MAAM,KAAK,kBAAkB,UAAU,aAAa;;AAI7D,SAAK,aAAa,aAAa,MAAM;AACrC,SAAK,SAAS,cAAc,EAAE,aAAa,UAAU,CAAC;AACtD,SAAK,iBAAiB,eAAe,IAAI,GAAG,EAC1C,aAAa,UACd,CAAC;AAEF,WAAO,OAAO,EAAE,aAAa;KAC3B,WAAW;KACX,WAAW;KACZ,CAAC;IAEF,MAAM,mBAAmB,IAAI,iBAAiB;IAC9C,MAAM,QAA0B;KAC9B,SAAS;KACT,UAAU;KACV;KACD;AAED,UAAM,UAAU,GAAG,iBAAiB,OAAO,CACxC,KAAK,OAAO,WAAW;AACtB,WAAM,KAAK,IAAI,UAAU,QAAQ,QAAQ;AACzC,UAAK,SAAS,sBAAsB;MAClC,aAAa;MACb,aAAa,SAAS,OAAO,KAAK,OAAO,OAAO;MACjD,CAAC;AACF,YAAO;MACP,CACD,OAAO,UAAU;AAChB,UAAK,gBAAgB,MAAM;AAC3B,UAAK,UAAU,EAAE,MAAM,eAAe,OAAO,CAAC;AAK9C,SAAI,iBAAiB,OAAO,QAC1B,OAAM;AAER,SAAI,iBAAiB,eAAe,iBAAiB,SACnD,OAAM;AAER,WAAM,eAAe,gBACnB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CACvD;MACD,CACD,cAAc;AACb,SAAI,KAAK,iBAAiB,IAAI,SAAS,KAAK,MAC1C,MAAK,iBAAiB,OAAO,SAAS;MAExC;AAKJ,UAAM,QAAQ,YAAY,GAAG;AAE7B,SAAK,iBAAiB,IAAI,UAAU,MAAgC;IAEpE,MAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,aAAa;AAChE,SAAK,UAAU,EAAE,MAAM,eAAe,IAAI,CAAC;AAC3C,WAAO;YACA,OAAO;AACd,SAAK,gBAAgB,MAAe;AACpC,SAAK,UAAU,EAAE,MAAM,eAAe,OAAO,CAAC;AAC9C,UAAM;aACE;AACR,SAAK,KAAK;;KAGd;GAAE,MAAM,KAAK;GAAM,eAAe;GAAM,CACzC;;;;;;;;;CAUH,AAAQ,kBACN,OACA,cACY;AACZ,MAAI,CAAC,aAAc,QAAO,MAAM;AAEhC,SAAO,IAAI,SAAY,SAAS,WAAW;GACzC,IAAI,UAAU;GAEd,MAAM,gBAAgB;AACpB,QAAI,MAAM,WAAW,EAAG,OAAM;AAC9B,QAAI,MAAM,YAAY,KAAK,CAAC,MAAM,iBAAiB,OAAO,QAGxD,OAAM,aAAa,iBAAiB;AAClC,SAAI,MAAM,YAAY,KAAK,CAAC,MAAM,iBAAiB,OAAO,QACxD,OAAM,iBAAiB,MACrB,aAAa,UAAU,4BACxB;OAEF,aAAa,sBAAsB;;GAI1C,MAAM,gBAAgB;AACpB,QAAI,QAAS;AACb,cAAU;AACV,iBAAa,oBAAoB,SAAS,QAAQ;AAClD,aAAS;AACT,WAAO,iBAAiB,aAAa,CAAC;;AAGxC,OAAI,aAAa,SAAS;AACxB,aAAS;AACT;;AAGF,gBAAa,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;AAE/D,SAAM,QAAQ,MACX,UAAU;AACT,QAAI,QAAS;AACb,cAAU;AACV,iBAAa,oBAAoB,SAAS,QAAQ;AAClD,YAAQ,MAAM;OAEf,UAAU;AACT,QAAI,QAAS;AACb,cAAU;AACV,iBAAa,oBAAoB,SAAS,QAAQ;AAClD,WAAO,MAAM;KAEhB;IACD;;;;;;;CAQJ,MAAM,IAAO,KAAgC;AAC3C,MAAI,CAAC,KAAK,OAAO,QAAS,QAAO;AAGjC,OAAK,cAAc;AAGnB,UADc,MAAM,KAAK,SAAY,IAAI,GAC3B,SAAS;;;;;;;;;CAUzB,MAAc,SAAY,KAA4C;EACpE,MAAM,QAAQ,MAAM,KAAK,QAAQ,IAAO,IAAI;AAC5C,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,KAAK,KAAK,GAAG,MAAM,QAAQ;AAC7B,SAAM,KAAK,QAAQ,OAAO,IAAI;AAC9B,UAAO;;AAET,SAAO;;;CAIT,AAAQ,eAAqB;AAC3B,MAAI,KAAK,kBAAmB;AAC5B,MAAI,CAAC,KAAK,QAAQ,cAAc,CAAE;EAClC,MAAM,MAAM,KAAK,KAAK;AACtB,MAAI,MAAM,KAAK,qBAAqB,aAAa,wBAC/C;EAEF,MAAM,cAAc,KAAK,OAAO,sBAAsB;AAEtD,MAAI,KAAK,QAAQ,GAAG,YAAa;AAEjC,OAAK,qBAAqB;AAE1B,OAAK,oBAAoB;AACzB,EAAC,KAAK,QACH,gBAAgB,CAChB,OAAO,UAAU;AAChB,UAAO,MAAM,yCAAyC,MAAM;IAC5D,CACD,cAAc;AACb,QAAK,oBAAoB;IACzB;;;;;;;;;CAUN,MAAM,IACJ,KACA,OACA,SACe;AACf,MAAI,CAAC,KAAK,OAAO,QAAS;EAE1B,MAAM,MAAM,SAAS,OAAO,KAAK,OAAO,OAAO;EAC/C,MAAM,aAAa,KAAK,KAAK,GAAG,MAAM;AACtC,QAAM,KAAK,QAAQ,IAAI,KAAK;GAAE;GAAO,QAAQ;GAAY,CAAC;;;;;;;CAQ5D,MAAM,OAAO,KAA4B;AACvC,MAAI,CAAC,KAAK,OAAO,QAAS;AAC1B,QAAM,KAAK,QAAQ,OAAO,IAAI;;;CAIhC,MAAM,QAAuB;AAC3B,QAAM,KAAK,QAAQ,OAAO;AAC1B,OAAK,MAAM,SAAS,KAAK,iBAAiB,QAAQ,CAChD,KAAI,MAAM,WAAY,cAAa,MAAM,WAAW;AAEtD,OAAK,iBAAiB,OAAO;;;;;;;CAQ/B,MAAM,IAAI,KAA+B;AACvC,MAAI,CAAC,KAAK,OAAO,QAAS,QAAO;AAGjC,SADc,MAAM,KAAK,SAAS,IAAI,KACrB;;;;;;;;CASnB,YAAY,OAAqC,SAAyB;EAExE,MAAM,WAAW;GAAC,wBAAwB;GAAE;GAAS,GAAG;GAAM;EAC9D,MAAM,aAAa,KAAK,UAAU,SAAS;AAC3C,SAAO,WAAW,SAAS,CAAC,OAAO,WAAW,CAAC,OAAO,MAAM;;;CAI9D,MAAM,QAAuB;AAC3B,QAAM,KAAK,QAAQ,OAAO;;;;;;;;;;;CAY5B,OAAO,QAAc;AACnB,eAAa,WAAW;AACxB,eAAa,cAAc;;;;;;CAO7B,MAAM,mBAAqC;AACzC,SAAO,KAAK,QAAQ,aAAa"}

package/dist/cli/commands/agent/eval.js

@@ -1,6 +1,6 @@
+import { spawn } from "node:child_process";
 import fs from "node:fs";
 import { Command, Option } from "commander";
-import { spawn } from "node:child_process";
 
 //#region src/cli/commands/agent/eval.ts
 /**

package/dist/cli/commands/generate-types.js

@@ -1,9 +1,9 @@
 import { METRIC_CONFIG_FILE } from "../../schemas/metric-fqn.js";
 import { acquireSpawnLock, getSpawnLockPath, releaseSpawnLock } from "./spawn-lock.js";
+import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { Command, Option } from "commander";
-import { spawn } from "node:child_process";
 
 //#region src/cli/commands/generate-types.ts
 /**

package/dist/cli/commands/plugin/sync/sync.js

@@ -1,4 +1,4 @@
-import { TEMPLATE_SCAFFOLDING, templateFieldEntrySchema } from "../../../../schemas/manifest.js";
+import { APP_ONLY_RESOURCE_TYPES, DABS_BINDING_BY_TYPE, SCOPE_BY_TYPE, TEMPLATE_SCAFFOLDING, templateFieldEntrySchema } from "../../../../schemas/manifest.js";
 import { loadManifestFromFile, resolveManifestInDir } from "../manifest-resolve.js";
 import { formatValidationErrors, validateManifest } from "../validate/validate-manifest.js";
 import { shouldAllowJsManifestForPackage } from "../trusted-js-manifest.js";
@@ -41,17 +41,40 @@ const MAX_SCAN_DEPTH = 5;
 async function loadPluginEntry(resolved, pkg, allowJsManifest) {
 	const manifest = validateManifestWithSchema(await loadManifestFromFile(resolved.path, resolved.type, { allowJsManifest }), resolved.path);
 	if (!manifest || manifest.hidden) return null;
-	return [manifest.name, {
+	return [manifest.name, toTemplatePlugin(manifest, pkg)];
+}
+/** Bake the type-level execution facts into the resource so the CLI reads plain data. */
+function withExecutionCapabilities(resource) {
+	const scope = Object.hasOwn(SCOPE_BY_TYPE, resource.type) ? SCOPE_BY_TYPE[resource.type] : void 0;
+	const binding = Object.hasOwn(DABS_BINDING_BY_TYPE, resource.type) ? DABS_BINDING_BY_TYPE[resource.type] : void 0;
+	return {
+		...resource,
+		...scope && { scope },
+		...APP_ONLY_RESOURCE_TYPES.has(resource.type) && { appOnly: true },
+		...binding && { binding: {
+			yamlKey: binding.yamlKey,
+			varFields: binding.varFields.map((pair) => [pair[0], pair[1]]),
+			...binding.staticFields && { staticFields: binding.staticFields.map((pair) => [pair[0], pair[1]]) }
+		} }
+	};
+}
+/** Build a TemplatePlugin entry. Every discovery path goes through here. */
+function toTemplatePlugin(manifest, pkg) {
+	return {
 		name: manifest.name,
 		displayName: manifest.displayName,
 		description: manifest.description,
 		package: pkg,
-		resources: manifest.resources,
+		resources: {
+			required: manifest.resources.required.map((resource) => withExecutionCapabilities(resource)),
+			optional: manifest.resources.optional.map((resource) => withExecutionCapabilities(resource))
+		},
+		...manifest.scopes?.length && { scopes: manifest.scopes },
 		...manifest.onSetupMessage && { onSetupMessage: manifest.onSetupMessage },
 		...manifest.stability && manifest.stability !== "ga" && { stability: manifest.stability },
 		...manifest.deprecated && { deprecated: manifest.deprecated },
 		...manifest.scaffolding && { scaffolding: manifest.scaffolding }
-	}];
+	};
 }
 /**
 * Known packages that may contain AppKit plugins.
@@ -252,17 +275,7 @@ async function scanForPlugins(cwd, packages, allowJsManifest) {
 		const manifests = await discoverPluginManifests(packagePath, allowJsManifest || shouldAllowJsManifestForPackage(packageName));
 		for (const manifest of manifests) {
 			if (manifest.hidden) continue;
-			plugins[manifest.name] = {
-				name: manifest.name,
-				displayName: manifest.displayName,
-				description: manifest.description,
-				package: packageName,
-				resources: manifest.resources,
-				...manifest.onSetupMessage && { onSetupMessage: manifest.onSetupMessage },
-				...manifest.stability && manifest.stability !== "ga" && { stability: manifest.stability },
-				...manifest.deprecated && { deprecated: manifest.deprecated },
-				...manifest.scaffolding && { scaffolding: manifest.scaffolding }
-			};
+			plugins[manifest.name] = toTemplatePlugin(manifest, packageName);
 		}
 	}
 	return plugins;

package/dist/cli/commands/plugin/sync/sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync.js","names":[],"sources":["../../../../../src/cli/commands/plugin/sync/sync.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\n\nimport type { SgNode } from \"@ast-grep/napi\";\nimport { Command } from \"commander\";\n\nimport {\n  TEMPLATE_SCAFFOLDING,\n  templateFieldEntrySchema,\n} from \"../../../../schemas/manifest\";\nimport {\n  loadManifestFromFile,\n  type ResolvedManifest,\n  resolveManifestInDir,\n} from \"../manifest-resolve\";\nimport type {\n  PluginManifest,\n  TemplatePlugin,\n  TemplatePluginsManifest,\n} from \"../manifest-types\";\nimport { shouldAllowJsManifestForPackage } from \"../trusted-js-manifest\";\nimport {\n  formatValidationErrors,\n  validateManifest,\n} from \"../validate/validate-manifest\";\n\n/**\n * Checks whether a resolved file path is within a given directory boundary.\n * Uses path.resolve + startsWith to prevent directory traversal.\n *\n * @param filePath - The path to check (will be resolved to absolute)\n * @param boundary - The directory that must contain filePath\n * @returns true if filePath is inside boundary (or equal to it)\n */\nfunction isWithinDirectory(filePath: string, boundary: string): boolean {\n  const resolvedPath = path.resolve(filePath);\n  const resolvedBoundary = path.resolve(boundary);\n  // Append separator to avoid prefix false-positives (e.g. /foo-bar matching /foo)\n  return (\n    resolvedPath === resolvedBoundary ||\n    resolvedPath.startsWith(`${resolvedBoundary}${path.sep}`)\n  );\n}\n\n/**\n * Validates a parsed JSON object against the plugin-manifest schema.\n * Returns the manifest if valid, or null and logs schema errors.\n */\nfunction validateManifestWithSchema(\n  obj: unknown,\n  sourcePath: string,\n): PluginManifest | null {\n  const result = validateManifest(obj);\n  if (result.valid && result.manifest) return result.manifest;\n  if (result.errors?.length) {\n    console.warn(\n      `Warning: Manifest at ${sourcePath} failed schema validation:\\n${formatValidationErrors(result.errors)}`,\n    );\n  }\n  return null;\n}\n\n/** Safety limit for recursive directory scanning to prevent runaway traversal. */\nconst MAX_SCAN_DEPTH = 5;\n\n/**\n * Load and validate a resolved manifest, returning a TemplatePlugin entry or null.\n * Centralises the resolve → load → validate → build-entry pipeline used by\n * multiple discovery functions.\n */\nasync function loadPluginEntry(\n  resolved: ResolvedManifest,\n  pkg: string,\n  allowJsManifest: boolean,\n): Promise<[string, TemplatePlugin] | null> {\n  const parsed = await loadManifestFromFile(resolved.path, resolved.type, {\n    allowJsManifest,\n  });\n  const manifest = validateManifestWithSchema(parsed, resolved.path);\n  if (!manifest || manifest.hidden) return null;\n\n  return [\n    manifest.name,\n    {\n      name: manifest.name,\n      displayName: manifest.displayName,\n      description: manifest.description,\n      package: pkg,\n      resources: manifest.resources,\n      ...(manifest.onSetupMessage && {\n        onSetupMessage: manifest.onSetupMessage,\n      }),\n      // Narrowing on `!== \"ga\"` removes \"ga\"; the truthy check\n      // removes `undefined`. What's left is the non-GA tier set,\n      // which TypeScript already knows is assignable to TemplatePlugin's\n      // `stability` field — so no cast is needed and adding a future\n      // tier (e.g. \"alpha\") flows through type-correctly.\n      ...(manifest.stability &&\n        manifest.stability !== \"ga\" && {\n          stability: manifest.stability,\n        }),\n      ...(manifest.deprecated && { deprecated: manifest.deprecated }),\n      ...(manifest.scaffolding && {\n        scaffolding: manifest.scaffolding,\n      }),\n    },\n  ];\n}\n\n/**\n * Known packages that may contain AppKit plugins.\n * Always scanned for manifests, even if not imported in the server file.\n */\nconst KNOWN_PLUGIN_PACKAGES = [\"@databricks/appkit\"];\n\n/**\n * Candidate paths for the server entry file, relative to cwd.\n * Checked in order; the first that exists is used.\n */\nconst SERVER_FILE_CANDIDATES = [\"server/server.ts\", \"server/index.ts\"];\n\n/**\n * Conventional directories to scan for local plugin manifests when\n * --local-plugins-dir is not set. Checked in order; each that exists is scanned.\n * Plugins found here are added to the manifest even if not imported in the server.\n */\nconst CONVENTIONAL_LOCAL_PLUGIN_DIRS = [\"plugins\", \"server\"];\n\n/**\n * Find the server entry file by checking candidate paths in order.\n *\n * @param cwd - Current working directory\n * @returns Absolute path to the server file, or null if none found\n */\nfunction findServerFile(cwd: string): string | null {\n  for (const candidate of SERVER_FILE_CANDIDATES) {\n    const fullPath = path.join(cwd, candidate);\n    if (fs.existsSync(fullPath)) {\n      return fullPath;\n    }\n  }\n  return null;\n}\n\n/**\n * Represents a single named import extracted from the server file.\n */\ninterface ParsedImport {\n  /** The imported name (or local alias if renamed) */\n  name: string;\n  /** The original exported name (differs from name when using `import { foo as bar }`) */\n  originalName: string;\n  /** The module specifier (package name or relative path) */\n  source: string;\n}\n\n/**\n * Extract all named imports from the AST root using structural node traversal.\n * Handles single/double quotes, multiline imports, and aliased imports.\n *\n * @param root - AST root node\n * @returns Array of parsed imports with name, original name, and source\n */\nfunction parseImports(root: SgNode): ParsedImport[] {\n  const imports: ParsedImport[] = [];\n\n  // Find all import_statement nodes in the AST\n  const importStatements = root.findAll({\n    rule: { kind: \"import_statement\" },\n  });\n\n  for (const stmt of importStatements) {\n    // Extract the module specifier (the string node, e.g. '@databricks/appkit')\n    const sourceNode = stmt.find({ rule: { kind: \"string\" } });\n    if (!sourceNode) continue;\n\n    // Strip surrounding quotes from the string node text\n    const source = sourceNode.text().replace(/^['\"]|['\"]$/g, \"\");\n\n    // Find named_imports block: { createApp, analytics, server }\n    const namedImports = stmt.find({ rule: { kind: \"named_imports\" } });\n    if (!namedImports) continue;\n\n    // Extract each import_specifier\n    const specifiers = namedImports.findAll({\n      rule: { kind: \"import_specifier\" },\n    });\n\n    for (const specifier of specifiers) {\n      const children = specifier.children();\n      if (children.length >= 3) {\n        // Aliased import: `foo as bar` — children are [name, \"as\", alias]\n        const originalName = children[0].text();\n        const localName = children[children.length - 1].text();\n        imports.push({ name: localName, originalName, source });\n      } else {\n        // Simple import: `foo`\n        const name = specifier.text();\n        imports.push({ name, originalName: name, source });\n      }\n    }\n  }\n\n  return imports;\n}\n\n/**\n * Extract local names of plugins actually used in the `plugins: [...]` array\n * passed to `createApp()`. Uses structural AST traversal to find `pair` nodes\n * with key \"plugins\" and array values containing call expressions.\n *\n * @param root - AST root node\n * @returns Set of local variable names used as plugin calls in the plugins array\n */\nfunction parsePluginUsages(root: SgNode): Set<string> {\n  const usedNames = new Set<string>();\n\n  // Find all property pairs in the AST\n  const pairs = root.findAll({ rule: { kind: \"pair\" } });\n\n  for (const pair of pairs) {\n    // Check if the property key is \"plugins\"\n    const key = pair.find({ rule: { kind: \"property_identifier\" } });\n    if (!key || key.text() !== \"plugins\") continue;\n\n    // Find the array value\n    const arrayNode = pair.find({ rule: { kind: \"array\" } });\n    if (!arrayNode) continue;\n\n    // Iterate direct children of the array to find call expressions\n    for (const child of arrayNode.children()) {\n      if (child.kind() === \"call_expression\") {\n        // The callee is the first child (the identifier being called)\n        const callee = child.children()[0];\n        if (callee?.kind() === \"identifier\") {\n          usedNames.add(callee.text());\n        }\n      }\n    }\n  }\n\n  return usedNames;\n}\n\n/**\n * File extensions to try when resolving a relative import to a file path.\n */\nconst RESOLVE_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".jsx\"];\n\n/**\n * Resolve a relative import source to the plugin directory containing a manifest\n * (manifest.json or manifest.js). Follows the convention that plugins live in\n * their own directory with a manifest file.\n *\n * Resolution strategy:\n * 1. If the import path is a directory, look for manifest.json/js in it\n * 2. If the import path + extension is a file, look for manifest in its parent directory\n * 3. If the import path is a directory with an index file, look for manifest in that directory\n *\n * @param importSource - The relative import specifier (e.g. \"./plugins/my-plugin\")\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @returns Resolved manifest file path and type, or null if not found\n */\nfunction resolveLocalManifest(\n  importSource: string,\n  serverFileDir: string,\n  allowJsManifest: boolean,\n  projectRoot?: string,\n): ResolvedManifest | null {\n  const resolved = path.resolve(serverFileDir, importSource);\n\n  // Security: Reject paths that escape the project root\n  const boundary = projectRoot || serverFileDir;\n  if (!isWithinDirectory(resolved, boundary)) {\n    console.warn(\n      `Warning: Skipping import \"${importSource}\" — resolves outside the project directory`,\n    );\n    return null;\n  }\n\n  // Case 1: Import path is a directory\n  if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n    return resolveManifestInDir(resolved, { allowJsManifest });\n  }\n\n  // Case 2: Import path + extension resolves to a file — manifest in parent dir\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const filePath = `${resolved}${ext}`;\n    if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {\n      const dir = path.dirname(filePath);\n      if (!isWithinDirectory(dir, boundary)) return null;\n      return resolveManifestInDir(dir, { allowJsManifest });\n    }\n  }\n\n  // Case 3: Import path is a directory with an index file\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const indexPath = path.join(resolved, `index${ext}`);\n    if (fs.existsSync(indexPath)) {\n      return resolveManifestInDir(resolved, { allowJsManifest });\n    }\n  }\n\n  return null;\n}\n\n/**\n * Discover plugin manifests from local (relative) imports in the server file.\n * Resolves each relative import to a directory and loads manifest.json or manifest.js.\n *\n * @param relativeImports - Parsed imports with relative sources (starting with . or /)\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @param cwd - Current working directory (for computing relative paths in output)\n * @returns Map of plugin name to template plugin entry for local plugins\n */\nasync function discoverLocalPlugins(\n  relativeImports: ParsedImport[],\n  serverFileDir: string,\n  cwd: string,\n  allowJsManifest: boolean,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const imp of relativeImports) {\n    const resolved = resolveLocalManifest(\n      imp.source,\n      serverFileDir,\n      allowJsManifest,\n      cwd,\n    );\n    if (!resolved) continue;\n\n    try {\n      const relativePath = path.relative(cwd, path.dirname(resolved.path));\n      const entry = await loadPluginEntry(\n        resolved,\n        `./${relativePath}`,\n        allowJsManifest,\n      );\n      if (entry) plugins[entry[0]] = entry[1];\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Discover plugin manifests from a package's dist folder.\n * Looks for manifest.json or manifest.js in dist/plugins/{plugin-name}/ directories.\n *\n * @param packagePath - Path to the package in node_modules\n * @returns Array of plugin manifests found in the package\n */\nasync function discoverPluginManifests(\n  packagePath: string,\n  allowJsManifest: boolean,\n): Promise<PluginManifest[]> {\n  const pluginsDir = path.join(packagePath, \"dist\", \"plugins\");\n  const manifests: PluginManifest[] = [];\n\n  if (!fs.existsSync(pluginsDir)) {\n    return manifests;\n  }\n\n  const entries = fs.readdirSync(pluginsDir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n    const resolved = resolveManifestInDir(path.join(pluginsDir, entry.name), {\n      allowJsManifest,\n    });\n    if (!resolved) continue;\n\n    try {\n      const parsed = await loadManifestFromFile(resolved.path, resolved.type, {\n        allowJsManifest,\n      });\n      const manifest = validateManifestWithSchema(parsed, resolved.path);\n      if (manifest) {\n        manifests.push(manifest);\n      }\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return manifests;\n}\n\n/**\n * Scan node_modules for packages with plugin manifests.\n *\n * @param cwd - Current working directory to search from\n * @param packages - Set of npm package names to scan for plugin manifests\n * @returns Map of plugin name to template plugin entry\n */\nasync function scanForPlugins(\n  cwd: string,\n  packages: Iterable<string>,\n  allowJsManifest: boolean,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const packageName of packages) {\n    const packagePath = path.join(cwd, \"node_modules\", packageName);\n    if (!fs.existsSync(packagePath)) {\n      continue;\n    }\n\n    const allowJsForPackage =\n      allowJsManifest || shouldAllowJsManifestForPackage(packageName);\n\n    const manifests = await discoverPluginManifests(\n      packagePath,\n      allowJsForPackage,\n    );\n    for (const manifest of manifests) {\n      if (manifest.hidden) continue;\n      plugins[manifest.name] = {\n        name: manifest.name,\n        displayName: manifest.displayName,\n        description: manifest.description,\n        package: packageName,\n        resources: manifest.resources,\n        ...(manifest.onSetupMessage && {\n          onSetupMessage: manifest.onSetupMessage,\n        }),\n        ...(manifest.stability &&\n          manifest.stability !== \"ga\" && {\n            stability: manifest.stability,\n          }),\n        ...(manifest.deprecated && { deprecated: manifest.deprecated }),\n        ...(manifest.scaffolding && {\n          scaffolding: manifest.scaffolding,\n        }),\n      } satisfies TemplatePlugin;\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Recursively scan a directory for plugin manifests. Any directory that\n * contains manifest.json or manifest.js is treated as a plugin root; we do\n * not descend into that directory's children. Used for local plugins discovery\n * so nested paths like server/plugins/category/my-plugin are found.\n */\nasync function scanPluginsDirRecursive(\n  dir: string,\n  cwd: string,\n  allowJsManifest: boolean,\n  depth = 0,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n  if (!fs.existsSync(dir) || depth >= MAX_SCAN_DEPTH) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const pluginDir = path.join(dir, entry.name);\n    const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });\n\n    if (resolved) {\n      const pkg = `./${path.relative(cwd, pluginDir)}`;\n      try {\n        const pluginEntry = await loadPluginEntry(\n          resolved,\n          pkg,\n          allowJsManifest,\n        );\n        if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];\n      } catch (error) {\n        console.warn(\n          `Warning: Failed to load manifest at ${resolved.path}:`,\n          error instanceof Error ? error.message : error,\n        );\n      }\n      continue;\n    }\n\n    Object.assign(\n      plugins,\n      await scanPluginsDirRecursive(pluginDir, cwd, allowJsManifest, depth + 1),\n    );\n  }\n\n  return plugins;\n}\n\n/**\n * Scan a directory for plugin manifests in direct subdirectories only.\n * Each subdirectory may contain manifest.json or manifest.js.\n * Used with --plugins-dir to discover plugins from source instead of node_modules.\n *\n * @param dir - Absolute path to the directory containing plugin subdirectories\n * @param packageName - Package name to assign to discovered plugins (used when cwd is not set)\n * @param cwd - When set, each plugin's package is set to ./<path from cwd to plugin subdir>, e.g. ./server/my-plugin\n * @returns Map of plugin name to template plugin entry\n */\nasync function scanPluginsDir(\n  dir: string,\n  packageName: string,\n  allowJsManifest: boolean,\n  cwd?: string,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (!fs.existsSync(dir)) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const pluginDir = path.join(dir, entry.name);\n    const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });\n    if (!resolved) continue;\n\n    const pkg =\n      cwd !== undefined ? `./${path.relative(cwd, pluginDir)}` : packageName;\n\n    try {\n      const pluginEntry = await loadPluginEntry(resolved, pkg, allowJsManifest);\n      if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Write (or preview) the template plugins manifest to disk.\n *\n * Each resource field is parsed through `templateFieldEntrySchema` so the\n * `origin` transform fires and produces canonical `origin` values, even\n * when the input carries a stale `origin`. Parsing per-field (rather than\n * the whole manifest) keeps the surrounding plugin/resource key order\n * stable so the synced JSON's diff stays minimal.\n */\nfunction writeManifest(\n  outputPath: string,\n  { plugins }: { plugins: TemplatePluginsManifest[\"plugins\"] },\n  options: { write?: boolean; silent?: boolean; json?: boolean },\n) {\n  for (const plugin of Object.values(plugins)) {\n    for (const group of [\n      plugin.resources.required,\n      plugin.resources.optional,\n    ]) {\n      for (const resource of group) {\n        if (!resource.fields) continue;\n        for (const fieldName of Object.keys(resource.fields)) {\n          resource.fields[fieldName] = templateFieldEntrySchema.parse(\n            resource.fields[fieldName],\n          );\n        }\n      }\n    }\n  }\n\n  const templateManifest: TemplatePluginsManifest = {\n    $schema:\n      \"https://databricks.github.io/appkit/schemas/template-plugins.schema.json\",\n    version: \"2.0\",\n    plugins,\n    scaffolding: TEMPLATE_SCAFFOLDING,\n  };\n\n  const serialized = JSON.stringify(templateManifest, null, 2);\n\n  if (options.json) {\n    console.log(serialized);\n  }\n\n  if (options.write) {\n    fs.writeFileSync(outputPath, `${serialized}\\n`);\n    if (!options.silent && !options.json) {\n      console.log(`\\n✓ Wrote ${outputPath}`);\n    }\n  } else if (!options.silent && !options.json) {\n    console.log(\"\\nTo write the manifest, run:\");\n    console.log(\"  npx appkit plugin sync --write\\n\");\n    console.log(\"Preview:\");\n    console.log(\"─\".repeat(60));\n    console.log(serialized);\n    console.log(\"─\".repeat(60));\n  }\n}\n\n/**\n * Run the plugin sync command.\n * Parses the server entry file to discover which packages to scan for plugin\n * manifests, then marks plugins that are actually used in the `plugins: [...]`\n * array as requiredByTemplate.\n */\nasync function runPluginsSync(options: {\n  write?: boolean;\n  output?: string;\n  silent?: boolean;\n  json?: boolean;\n  requirePlugins?: string;\n  pluginsDir?: string;\n  packageName?: string;\n  localPluginsDir?: string;\n  allowJsManifest?: boolean;\n}): Promise<void> {\n  const cwd = process.cwd();\n  const allowJsManifest = Boolean(options.allowJsManifest);\n  const outputPath = path.resolve(cwd, options.output || \"appkit.plugins.json\");\n\n  // Security: Reject output paths that escape the project root\n  if (!isWithinDirectory(outputPath, cwd)) {\n    console.error(\n      `Error: Output path \"${options.output}\" resolves outside the project directory.`,\n    );\n    process.exit(1);\n  }\n\n  if (!options.silent && !options.json) {\n    console.log(\"Scanning for AppKit plugins...\\n\");\n    if (allowJsManifest) {\n      console.warn(\n        \"Warning: --allow-js-manifest executes manifest.js/manifest.cjs files. Only use with trusted code.\",\n      );\n    }\n  }\n\n  // Step 1: Parse server file to discover imports and plugin usages\n  const serverFile = findServerFile(cwd);\n  let serverImports: ParsedImport[] = [];\n  let pluginUsages = new Set<string>();\n\n  if (serverFile) {\n    if (!options.silent && !options.json) {\n      const relativePath = path.relative(cwd, serverFile);\n      console.log(`Server entry file: ${relativePath}`);\n    }\n\n    const require = createRequire(import.meta.url);\n    const { Lang, parse } =\n      require(\"@ast-grep/napi\") as typeof import(\"@ast-grep/napi\");\n    const content = fs.readFileSync(serverFile, \"utf-8\");\n    const lang = serverFile.endsWith(\".tsx\") ? Lang.Tsx : Lang.TypeScript;\n    const ast = parse(lang, content);\n    const root = ast.root();\n\n    serverImports = parseImports(root);\n    pluginUsages = parsePluginUsages(root);\n  } else if (!options.silent && !options.json) {\n    console.log(\n      \"No server entry file found. Checked:\",\n      SERVER_FILE_CANDIDATES.join(\", \"),\n    );\n  }\n\n  // Step 2: Split imports into npm packages and local (relative) imports\n  const npmImports = serverImports.filter(\n    (i) => !i.source.startsWith(\".\") && !i.source.startsWith(\"/\"),\n  );\n  const localImports = serverImports.filter(\n    (i) => i.source.startsWith(\".\") || i.source.startsWith(\"/\"),\n  );\n\n  // Step 3: Scan for plugin manifests (--plugins-dir or node_modules)\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (options.pluginsDir) {\n    const resolvedDir = path.resolve(cwd, options.pluginsDir);\n    const pkgName = options.packageName ?? \"@databricks/appkit\";\n    if (!options.silent && !options.json) {\n      console.log(`Scanning plugins directory: ${options.pluginsDir}`);\n    }\n    Object.assign(\n      plugins,\n      await scanPluginsDir(resolvedDir, pkgName, allowJsManifest),\n    );\n  } else {\n    const npmPackages = new Set([\n      ...KNOWN_PLUGIN_PACKAGES,\n      ...npmImports.map((i) => i.source),\n    ]);\n    Object.assign(\n      plugins,\n      await scanForPlugins(cwd, npmPackages, allowJsManifest),\n    );\n  }\n\n  // Step 4: Discover local plugin manifests from relative imports\n  if (serverFile && localImports.length > 0) {\n    const serverFileDir = path.dirname(serverFile);\n    const localPlugins = await discoverLocalPlugins(\n      localImports,\n      serverFileDir,\n      cwd,\n      allowJsManifest,\n    );\n    Object.assign(plugins, localPlugins);\n  }\n\n  // Step 4b: Discover local plugins from conventional directory (or --local-plugins-dir).\n  // These are included even when not imported in the server.\n  const localDirsToScan: string[] = options.localPluginsDir\n    ? [options.localPluginsDir]\n    : CONVENTIONAL_LOCAL_PLUGIN_DIRS.filter((d) =>\n        fs.existsSync(path.join(cwd, d)),\n      );\n  for (const dir of localDirsToScan) {\n    const resolvedDir = path.resolve(cwd, dir);\n    if (!fs.existsSync(resolvedDir)) continue;\n    if (!options.silent && !options.json) {\n      console.log(`Scanning local plugins directory: ${dir}`);\n    }\n    const discovered = await scanPluginsDirRecursive(\n      resolvedDir,\n      cwd,\n      allowJsManifest,\n    );\n    for (const [name, entry] of Object.entries(discovered)) {\n      if (!plugins[name]) plugins[name] = entry;\n    }\n  }\n\n  const pluginCount = Object.keys(plugins).length;\n\n  if (pluginCount === 0) {\n    if (options.silent || options.json) {\n      writeManifest(outputPath, { plugins: {} }, options);\n      if (options.silent) return;\n      process.exit(1);\n    }\n    console.log(\"No plugins found.\");\n    if (options.pluginsDir) {\n      console.log(\n        `\\nNo manifest (${allowJsManifest ? \"manifest.json or manifest.js\" : \"manifest.json\"}) found in: ${options.pluginsDir}`,\n      );\n    } else {\n      console.log(\n        \"\\nMake sure you have plugin packages installed, or specify a directory:\",\n      );\n      console.log(\"  appkit plugin sync --plugins-dir <path>\");\n    }\n    process.exit(1);\n  }\n\n  // Step 5: Mark plugins that are imported AND used in the plugins array as mandatory.\n  // For npm imports, match by package name + plugin name.\n  // For local imports, resolve both paths to absolute and compare.\n  const serverFileDir = serverFile ? path.dirname(serverFile) : cwd;\n  const usedDeprecated: string[] = [];\n\n  for (const imp of serverImports) {\n    if (!pluginUsages.has(imp.name)) continue;\n\n    const isLocal = imp.source.startsWith(\".\") || imp.source.startsWith(\"/\");\n    let plugin: TemplatePlugin | undefined;\n\n    if (isLocal) {\n      // Resolve the import source to an absolute path from the server file directory\n      const resolvedImportDir = path.resolve(serverFileDir, imp.source);\n      plugin = Object.values(plugins).find((p) => {\n        if (!p.package.startsWith(\".\")) return false;\n        const resolvedPluginDir = path.resolve(cwd, p.package);\n        return (\n          resolvedPluginDir === resolvedImportDir && p.name === imp.originalName\n        );\n      });\n    } else {\n      // npm import: direct string comparison\n      plugin = Object.values(plugins).find(\n        (p) => p.package === imp.source && p.name === imp.originalName,\n      );\n    }\n\n    if (plugin) {\n      plugin.requiredByTemplate = true;\n      if (plugin.deprecated) usedDeprecated.push(plugin.name);\n    }\n  }\n\n  // Step 6: Apply explicit --require-plugins overrides\n  if (options.requirePlugins) {\n    const explicitNames = options.requirePlugins\n      .split(\",\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n    for (const name of explicitNames) {\n      if (plugins[name]) {\n        plugins[name].requiredByTemplate = true;\n      } else if (!options.silent) {\n        console.warn(\n          `Warning: --require-plugins referenced \"${name}\" but no such plugin was discovered`,\n        );\n      }\n    }\n  }\n\n  // Step 6b: Strip requiredByTemplate for non-GA plugins\n  for (const plugin of Object.values(plugins)) {\n    if (\n      plugin.requiredByTemplate &&\n      plugin.stability &&\n      plugin.stability !== \"ga\"\n    ) {\n      plugin.requiredByTemplate = undefined;\n    }\n  }\n\n  if (!options.silent && !options.json) {\n    console.log(`\\nFound ${pluginCount} plugin(s):`);\n    for (const [name, manifest] of Object.entries(plugins)) {\n      const resourceCount =\n        manifest.resources.required.length + manifest.resources.optional.length;\n      const resourceInfo =\n        resourceCount > 0 ? ` [${resourceCount} resource(s)]` : \"\";\n      const mandatoryTag = manifest.requiredByTemplate ? \" (mandatory)\" : \"\";\n      const deprecatedTag = manifest.deprecated ? \" (deprecated)\" : \"\";\n      console.log(\n        `  ${manifest.requiredByTemplate ? \"●\" : \"○\"} ${manifest.displayName} (${name}) from ${manifest.package}${resourceInfo}${mandatoryTag}${deprecatedTag}`,\n      );\n    }\n  }\n\n  // Warn about deprecated plugins that are actually used in the app.\n  if (!options.silent && usedDeprecated.length > 0) {\n    for (const name of usedDeprecated) {\n      console.warn(\n        `Warning: plugin \"${name}\" is deprecated. See its description for the recommended replacement.`,\n      );\n    }\n  }\n\n  // Step 7: Detect orphaned resources from removed plugins\n  if (!options.silent && fs.existsSync(outputPath)) {\n    try {\n      const oldRaw = fs.readFileSync(outputPath, \"utf-8\");\n      const oldManifest = JSON.parse(oldRaw) as TemplatePluginsManifest;\n      const oldNames = new Set(Object.keys(oldManifest.plugins ?? {}));\n      const newNames = new Set(Object.keys(plugins));\n      for (const name of oldNames) {\n        if (newNames.has(name)) continue;\n        const oldPlugin = oldManifest.plugins?.[name];\n        if (!oldPlugin || typeof oldPlugin !== \"object\") continue;\n        const envVars: string[] = [];\n        for (const res of [\n          ...(oldPlugin.resources?.required ?? []),\n          ...(oldPlugin.resources?.optional ?? []),\n        ]) {\n          if (res?.fields) {\n            for (const field of Object.values(res.fields)) {\n              if (field?.env) envVars.push(field.env);\n            }\n          }\n        }\n        const envInfo =\n          envVars.length > 0\n            ? ` The following resource env vars may be orphaned: ${envVars.join(\", \")}`\n            : \"\";\n        console.warn(`Warning: Plugin \"${name}\" was removed.${envInfo}`);\n      }\n    } catch {\n      // Ignore parse errors on existing manifest\n    }\n  }\n\n  writeManifest(outputPath, { plugins }, options);\n}\n\n/** Exported for testing: path boundary check, AST parsing, trust checks. */\nexport {\n  isWithinDirectory,\n  parseImports,\n  parsePluginUsages,\n  shouldAllowJsManifestForPackage,\n};\n\nexport const pluginsSyncCommand = new Command(\"sync\")\n  .description(\n    \"Sync plugin manifests from installed packages into appkit.plugins.json\",\n  )\n  .option(\"-w, --write\", \"Write the manifest file\")\n  .option(\n    \"-o, --output <path>\",\n    \"Output file path (default: ./appkit.plugins.json)\",\n  )\n  .option(\n    \"-s, --silent\",\n    \"Suppress output and never exit with error (for use in predev/prebuild hooks)\",\n  )\n  .option(\n    \"--require-plugins <names>\",\n    \"Comma-separated plugin names to mark as requiredByTemplate (e.g. server,analytics)\",\n  )\n  .option(\n    \"--plugins-dir <path>\",\n    \"Scan this directory for plugin subdirectories with manifest.json (instead of node_modules)\",\n  )\n  .option(\n    \"--package-name <name>\",\n    \"Package name to assign to plugins found via --plugins-dir (default: @databricks/appkit)\",\n  )\n  .option(\n    \"--local-plugins-dir <path>\",\n    \"Also scan this directory for local plugin manifests (default: plugins, server)\",\n  )\n  .option(\n    \"--allow-js-manifest\",\n    \"Allow reading manifest.js/manifest.cjs (executes code; use only with trusted plugins)\",\n  )\n  .option(\"--json\", \"Output manifest as JSON to stdout\")\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  $ appkit plugin sync\n  $ appkit plugin sync --write\n  $ appkit plugin sync --write --require-plugins server,analytics\n  $ appkit plugin sync --write --plugins-dir src/plugins --package-name @my/pkg\n  $ appkit plugin sync --json\n  $ appkit plugin sync --silent`,\n  )\n  .action((opts) =>\n    runPluginsSync(opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmCA,SAAS,kBAAkB,UAAkB,UAA2B;CACtE,MAAM,eAAe,KAAK,QAAQ,SAAS;CAC3C,MAAM,mBAAmB,KAAK,QAAQ,SAAS;AAE/C,QACE,iBAAiB,oBACjB,aAAa,WAAW,GAAG,mBAAmB,KAAK,MAAM;;;;;;AAQ7D,SAAS,2BACP,KACA,YACuB;CACvB,MAAM,SAAS,iBAAiB,IAAI;AACpC,KAAI,OAAO,SAAS,OAAO,SAAU,QAAO,OAAO;AACnD,KAAI,OAAO,QAAQ,OACjB,SAAQ,KACN,wBAAwB,WAAW,8BAA8B,uBAAuB,OAAO,OAAO,GACvG;AAEH,QAAO;;;AAIT,MAAM,iBAAiB;;;;;;AAOvB,eAAe,gBACb,UACA,KACA,iBAC0C;CAI1C,MAAM,WAAW,2BAHF,MAAM,qBAAqB,SAAS,MAAM,SAAS,MAAM,EACtE,iBACD,CAAC,EACkD,SAAS,KAAK;AAClE,KAAI,CAAC,YAAY,SAAS,OAAQ,QAAO;AAEzC,QAAO,CACL,SAAS,MACT;EACE,MAAM,SAAS;EACf,aAAa,SAAS;EACtB,aAAa,SAAS;EACtB,SAAS;EACT,WAAW,SAAS;EACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;EAMD,GAAI,SAAS,aACX,SAAS,cAAc,QAAQ,EAC7B,WAAW,SAAS,WACrB;EACH,GAAI,SAAS,cAAc,EAAE,YAAY,SAAS,YAAY;EAC9D,GAAI,SAAS,eAAe,EAC1B,aAAa,SAAS,aACvB;EACF,CACF;;;;;;AAOH,MAAM,wBAAwB,CAAC,qBAAqB;;;;;AAMpD,MAAM,yBAAyB,CAAC,oBAAoB,kBAAkB;;;;;;AAOtE,MAAM,iCAAiC,CAAC,WAAW,SAAS;;;;;;;AAQ5D,SAAS,eAAe,KAA4B;AAClD,MAAK,MAAM,aAAa,wBAAwB;EAC9C,MAAM,WAAW,KAAK,KAAK,KAAK,UAAU;AAC1C,MAAI,GAAG,WAAW,SAAS,CACzB,QAAO;;AAGX,QAAO;;;;;;;;;AAsBT,SAAS,aAAa,MAA8B;CAClD,MAAM,UAA0B,EAAE;CAGlC,MAAM,mBAAmB,KAAK,QAAQ,EACpC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,MAAK,MAAM,QAAQ,kBAAkB;EAEnC,MAAM,aAAa,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,EAAE,CAAC;AAC1D,MAAI,CAAC,WAAY;EAGjB,MAAM,SAAS,WAAW,MAAM,CAAC,QAAQ,gBAAgB,GAAG;EAG5D,MAAM,eAAe,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,EAAE,CAAC;AACnE,MAAI,CAAC,aAAc;EAGnB,MAAM,aAAa,aAAa,QAAQ,EACtC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,OAAK,MAAM,aAAa,YAAY;GAClC,MAAM,WAAW,UAAU,UAAU;AACrC,OAAI,SAAS,UAAU,GAAG;IAExB,MAAM,eAAe,SAAS,GAAG,MAAM;IACvC,MAAM,YAAY,SAAS,SAAS,SAAS,GAAG,MAAM;AACtD,YAAQ,KAAK;KAAE,MAAM;KAAW;KAAc;KAAQ,CAAC;UAClD;IAEL,MAAM,OAAO,UAAU,MAAM;AAC7B,YAAQ,KAAK;KAAE;KAAM,cAAc;KAAM;KAAQ,CAAC;;;;AAKxD,QAAO;;;;;;;;;;AAWT,SAAS,kBAAkB,MAA2B;CACpD,MAAM,4BAAY,IAAI,KAAa;CAGnC,MAAM,QAAQ,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,EAAE,CAAC;AAEtD,MAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,MAAM,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,EAAE,CAAC;AAChE,MAAI,CAAC,OAAO,IAAI,MAAM,KAAK,UAAW;EAGtC,MAAM,YAAY,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,CAAC;AACxD,MAAI,CAAC,UAAW;AAGhB,OAAK,MAAM,SAAS,UAAU,UAAU,CACtC,KAAI,MAAM,MAAM,KAAK,mBAAmB;GAEtC,MAAM,SAAS,MAAM,UAAU,CAAC;AAChC,OAAI,QAAQ,MAAM,KAAK,aACrB,WAAU,IAAI,OAAO,MAAM,CAAC;;;AAMpC,QAAO;;;;;AAMT,MAAM,qBAAqB;CAAC;CAAO;CAAQ;CAAO;CAAO;;;;;;;;;;;;;;;AAgBzD,SAAS,qBACP,cACA,eACA,iBACA,aACyB;CACzB,MAAM,WAAW,KAAK,QAAQ,eAAe,aAAa;CAG1D,MAAM,WAAW,eAAe;AAChC,KAAI,CAAC,kBAAkB,UAAU,SAAS,EAAE;AAC1C,UAAQ,KACN,6BAA6B,aAAa,4CAC3C;AACD,SAAO;;AAIT,KAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,aAAa,CAChE,QAAO,qBAAqB,UAAU,EAAE,iBAAiB,CAAC;AAI5D,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,WAAW,GAAG,WAAW;AAC/B,MAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,QAAQ,EAAE;GAC7D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,OAAI,CAAC,kBAAkB,KAAK,SAAS,CAAE,QAAO;AAC9C,UAAO,qBAAqB,KAAK,EAAE,iBAAiB,CAAC;;;AAKzD,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,YAAY,KAAK,KAAK,UAAU,QAAQ,MAAM;AACpD,MAAI,GAAG,WAAW,UAAU,CAC1B,QAAO,qBAAqB,UAAU,EAAE,iBAAiB,CAAC;;AAI9D,QAAO;;;;;;;;;;;AAYT,eAAe,qBACb,iBACA,eACA,KACA,iBAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,WAAW,qBACf,IAAI,QACJ,eACA,iBACA,IACD;AACD,MAAI,CAAC,SAAU;AAEf,MAAI;GAEF,MAAM,QAAQ,MAAM,gBAClB,UACA,KAHmB,KAAK,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK,CAAC,IAIlE,gBACD;AACD,OAAI,MAAO,SAAQ,MAAM,MAAM,MAAM;WAC9B,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,eAAe,wBACb,aACA,iBAC2B;CAC3B,MAAM,aAAa,KAAK,KAAK,aAAa,QAAQ,UAAU;CAC5D,MAAM,YAA8B,EAAE;AAEtC,KAAI,CAAC,GAAG,WAAW,WAAW,CAC5B,QAAO;CAGT,MAAM,UAAU,GAAG,YAAY,YAAY,EAAE,eAAe,MAAM,CAAC;AACnE,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAC1B,MAAM,WAAW,qBAAqB,KAAK,KAAK,YAAY,MAAM,KAAK,EAAE,EACvE,iBACD,CAAC;AACF,MAAI,CAAC,SAAU;AAEf,MAAI;GAIF,MAAM,WAAW,2BAHF,MAAM,qBAAqB,SAAS,MAAM,SAAS,MAAM,EACtE,iBACD,CAAC,EACkD,SAAS,KAAK;AAClE,OAAI,SACF,WAAU,KAAK,SAAS;WAEnB,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,eAAe,eACb,KACA,UACA,iBAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,eAAe,UAAU;EAClC,MAAM,cAAc,KAAK,KAAK,KAAK,gBAAgB,YAAY;AAC/D,MAAI,CAAC,GAAG,WAAW,YAAY,CAC7B;EAMF,MAAM,YAAY,MAAM,wBACtB,aAHA,mBAAmB,gCAAgC,YAAY,CAKhE;AACD,OAAK,MAAM,YAAY,WAAW;AAChC,OAAI,SAAS,OAAQ;AACrB,WAAQ,SAAS,QAAQ;IACvB,MAAM,SAAS;IACf,aAAa,SAAS;IACtB,aAAa,SAAS;IACtB,SAAS;IACT,WAAW,SAAS;IACpB,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;IACD,GAAI,SAAS,aACX,SAAS,cAAc,QAAQ,EAC7B,WAAW,SAAS,WACrB;IACH,GAAI,SAAS,cAAc,EAAE,YAAY,SAAS,YAAY;IAC9D,GAAI,SAAS,eAAe,EAC1B,aAAa,SAAS,aACvB;IACF;;;AAIL,QAAO;;;;;;;;AAST,eAAe,wBACb,KACA,KACA,iBACA,QAAQ,GACqC;CAC7C,MAAM,UAA8C,EAAE;AACtD,KAAI,CAAC,GAAG,WAAW,IAAI,IAAI,SAAS,eAAgB,QAAO;CAE3D,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,CAAC;AAErE,MAAI,UAAU;GACZ,MAAM,MAAM,KAAK,KAAK,SAAS,KAAK,UAAU;AAC9C,OAAI;IACF,MAAM,cAAc,MAAM,gBACxB,UACA,KACA,gBACD;AACD,QAAI,YAAa,SAAQ,YAAY,MAAM,YAAY;YAChD,OAAO;AACd,YAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;AAEH;;AAGF,SAAO,OACL,SACA,MAAM,wBAAwB,WAAW,KAAK,iBAAiB,QAAQ,EAAE,CAC1E;;AAGH,QAAO;;;;;;;;;;;;AAaT,eAAe,eACb,KACA,aACA,iBACA,KAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,KAAI,CAAC,GAAG,WAAW,IAAI,CAAE,QAAO;CAEhC,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,CAAC;AACrE,MAAI,CAAC,SAAU;EAEf,MAAM,MACJ,QAAQ,SAAY,KAAK,KAAK,SAAS,KAAK,UAAU,KAAK;AAE7D,MAAI;GACF,MAAM,cAAc,MAAM,gBAAgB,UAAU,KAAK,gBAAgB;AACzE,OAAI,YAAa,SAAQ,YAAY,MAAM,YAAY;WAChD,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;;;AAYT,SAAS,cACP,YACA,EAAE,WACF,SACA;AACA,MAAK,MAAM,UAAU,OAAO,OAAO,QAAQ,CACzC,MAAK,MAAM,SAAS,CAClB,OAAO,UAAU,UACjB,OAAO,UAAU,SAClB,CACC,MAAK,MAAM,YAAY,OAAO;AAC5B,MAAI,CAAC,SAAS,OAAQ;AACtB,OAAK,MAAM,aAAa,OAAO,KAAK,SAAS,OAAO,CAClD,UAAS,OAAO,aAAa,yBAAyB,MACpD,SAAS,OAAO,WACjB;;CAMT,MAAM,mBAA4C;EAChD,SACE;EACF,SAAS;EACT;EACA,aAAa;EACd;CAED,MAAM,aAAa,KAAK,UAAU,kBAAkB,MAAM,EAAE;AAE5D,KAAI,QAAQ,KACV,SAAQ,IAAI,WAAW;AAGzB,KAAI,QAAQ,OAAO;AACjB,KAAG,cAAc,YAAY,GAAG,WAAW,IAAI;AAC/C,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,aAAa,aAAa;YAE/B,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AAC3C,UAAQ,IAAI,gCAAgC;AAC5C,UAAQ,IAAI,qCAAqC;AACjD,UAAQ,IAAI,WAAW;AACvB,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;AAC3B,UAAQ,IAAI,WAAW;AACvB,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;;;;;;;;;AAU/B,eAAe,eAAe,SAUZ;CAChB,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,kBAAkB,QAAQ,QAAQ,gBAAgB;CACxD,MAAM,aAAa,KAAK,QAAQ,KAAK,QAAQ,UAAU,sBAAsB;AAG7E,KAAI,CAAC,kBAAkB,YAAY,IAAI,EAAE;AACvC,UAAQ,MACN,uBAAuB,QAAQ,OAAO,2CACvC;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AACpC,UAAQ,IAAI,mCAAmC;AAC/C,MAAI,gBACF,SAAQ,KACN,oGACD;;CAKL,MAAM,aAAa,eAAe,IAAI;CACtC,IAAI,gBAAgC,EAAE;CACtC,IAAI,+BAAe,IAAI,KAAa;AAEpC,KAAI,YAAY;AACd,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;GACpC,MAAM,eAAe,KAAK,SAAS,KAAK,WAAW;AACnD,WAAQ,IAAI,sBAAsB,eAAe;;EAInD,MAAM,EAAE,MAAM,UADE,cAAc,OAAO,KAAK,IAAI,CAEpC,iBAAiB;EAC3B,MAAM,UAAU,GAAG,aAAa,YAAY,QAAQ;EAGpD,MAAM,OADM,MADC,WAAW,SAAS,OAAO,GAAG,KAAK,MAAM,KAAK,YACnC,QAAQ,CACf,MAAM;AAEvB,kBAAgB,aAAa,KAAK;AAClC,iBAAe,kBAAkB,KAAK;YAC7B,CAAC,QAAQ,UAAU,CAAC,QAAQ,KACrC,SAAQ,IACN,wCACA,uBAAuB,KAAK,KAAK,CAClC;CAIH,MAAM,aAAa,cAAc,QAC9B,MAAM,CAAC,EAAE,OAAO,WAAW,IAAI,IAAI,CAAC,EAAE,OAAO,WAAW,IAAI,CAC9D;CACD,MAAM,eAAe,cAAc,QAChC,MAAM,EAAE,OAAO,WAAW,IAAI,IAAI,EAAE,OAAO,WAAW,IAAI,CAC5D;CAGD,MAAM,UAA8C,EAAE;AAEtD,KAAI,QAAQ,YAAY;EACtB,MAAM,cAAc,KAAK,QAAQ,KAAK,QAAQ,WAAW;EACzD,MAAM,UAAU,QAAQ,eAAe;AACvC,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,+BAA+B,QAAQ,aAAa;AAElE,SAAO,OACL,SACA,MAAM,eAAe,aAAa,SAAS,gBAAgB,CAC5D;QACI;EACL,MAAM,cAAc,IAAI,IAAI,CAC1B,GAAG,uBACH,GAAG,WAAW,KAAK,MAAM,EAAE,OAAO,CACnC,CAAC;AACF,SAAO,OACL,SACA,MAAM,eAAe,KAAK,aAAa,gBAAgB,CACxD;;AAIH,KAAI,cAAc,aAAa,SAAS,GAAG;EAEzC,MAAM,eAAe,MAAM,qBACzB,cAFoB,KAAK,QAAQ,WAAW,EAI5C,KACA,gBACD;AACD,SAAO,OAAO,SAAS,aAAa;;CAKtC,MAAM,kBAA4B,QAAQ,kBACtC,CAAC,QAAQ,gBAAgB,GACzB,+BAA+B,QAAQ,MACrC,GAAG,WAAW,KAAK,KAAK,KAAK,EAAE,CAAC,CACjC;AACL,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,cAAc,KAAK,QAAQ,KAAK,IAAI;AAC1C,MAAI,CAAC,GAAG,WAAW,YAAY,CAAE;AACjC,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,qCAAqC,MAAM;EAEzD,MAAM,aAAa,MAAM,wBACvB,aACA,KACA,gBACD;AACD,OAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,WAAW,CACpD,KAAI,CAAC,QAAQ,MAAO,SAAQ,QAAQ;;CAIxC,MAAM,cAAc,OAAO,KAAK,QAAQ,CAAC;AAEzC,KAAI,gBAAgB,GAAG;AACrB,MAAI,QAAQ,UAAU,QAAQ,MAAM;AAClC,iBAAc,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ;AACnD,OAAI,QAAQ,OAAQ;AACpB,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,IAAI,oBAAoB;AAChC,MAAI,QAAQ,WACV,SAAQ,IACN,kBAAkB,kBAAkB,iCAAiC,gBAAgB,cAAc,QAAQ,aAC5G;OACI;AACL,WAAQ,IACN,0EACD;AACD,WAAQ,IAAI,4CAA4C;;AAE1D,UAAQ,KAAK,EAAE;;CAMjB,MAAM,gBAAgB,aAAa,KAAK,QAAQ,WAAW,GAAG;CAC9D,MAAM,iBAA2B,EAAE;AAEnC,MAAK,MAAM,OAAO,eAAe;AAC/B,MAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAAE;EAEjC,MAAM,UAAU,IAAI,OAAO,WAAW,IAAI,IAAI,IAAI,OAAO,WAAW,IAAI;EACxE,IAAI;AAEJ,MAAI,SAAS;GAEX,MAAM,oBAAoB,KAAK,QAAQ,eAAe,IAAI,OAAO;AACjE,YAAS,OAAO,OAAO,QAAQ,CAAC,MAAM,MAAM;AAC1C,QAAI,CAAC,EAAE,QAAQ,WAAW,IAAI,CAAE,QAAO;AAEvC,WAD0B,KAAK,QAAQ,KAAK,EAAE,QAAQ,KAE9B,qBAAqB,EAAE,SAAS,IAAI;KAE5D;QAGF,UAAS,OAAO,OAAO,QAAQ,CAAC,MAC7B,MAAM,EAAE,YAAY,IAAI,UAAU,EAAE,SAAS,IAAI,aACnD;AAGH,MAAI,QAAQ;AACV,UAAO,qBAAqB;AAC5B,OAAI,OAAO,WAAY,gBAAe,KAAK,OAAO,KAAK;;;AAK3D,KAAI,QAAQ,gBAAgB;EAC1B,MAAM,gBAAgB,QAAQ,eAC3B,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,OAAO,QAAQ;AAClB,OAAK,MAAM,QAAQ,cACjB,KAAI,QAAQ,MACV,SAAQ,MAAM,qBAAqB;WAC1B,CAAC,QAAQ,OAClB,SAAQ,KACN,0CAA0C,KAAK,qCAChD;;AAMP,MAAK,MAAM,UAAU,OAAO,OAAO,QAAQ,CACzC,KACE,OAAO,sBACP,OAAO,aACP,OAAO,cAAc,KAErB,QAAO,qBAAqB;AAIhC,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AACpC,UAAQ,IAAI,WAAW,YAAY,aAAa;AAChD,OAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,EAAE;GACtD,MAAM,gBACJ,SAAS,UAAU,SAAS,SAAS,SAAS,UAAU,SAAS;GACnE,MAAM,eACJ,gBAAgB,IAAI,KAAK,cAAc,iBAAiB;GAC1D,MAAM,eAAe,SAAS,qBAAqB,iBAAiB;GACpE,MAAM,gBAAgB,SAAS,aAAa,kBAAkB;AAC9D,WAAQ,IACN,KAAK,SAAS,qBAAqB,MAAM,IAAI,GAAG,SAAS,YAAY,IAAI,KAAK,SAAS,SAAS,UAAU,eAAe,eAAe,gBACzI;;;AAKL,KAAI,CAAC,QAAQ,UAAU,eAAe,SAAS,EAC7C,MAAK,MAAM,QAAQ,eACjB,SAAQ,KACN,oBAAoB,KAAK,uEAC1B;AAKL,KAAI,CAAC,QAAQ,UAAU,GAAG,WAAW,WAAW,CAC9C,KAAI;EACF,MAAM,SAAS,GAAG,aAAa,YAAY,QAAQ;EACnD,MAAM,cAAc,KAAK,MAAM,OAAO;EACtC,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,YAAY,WAAW,EAAE,CAAC,CAAC;EAChE,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC;AAC9C,OAAK,MAAM,QAAQ,UAAU;AAC3B,OAAI,SAAS,IAAI,KAAK,CAAE;GACxB,MAAM,YAAY,YAAY,UAAU;AACxC,OAAI,CAAC,aAAa,OAAO,cAAc,SAAU;GACjD,MAAM,UAAoB,EAAE;AAC5B,QAAK,MAAM,OAAO,CAChB,GAAI,UAAU,WAAW,YAAY,EAAE,EACvC,GAAI,UAAU,WAAW,YAAY,EAAE,CACxC,CACC,KAAI,KAAK,QACP;SAAK,MAAM,SAAS,OAAO,OAAO,IAAI,OAAO,CAC3C,KAAI,OAAO,IAAK,SAAQ,KAAK,MAAM,IAAI;;GAI7C,MAAM,UACJ,QAAQ,SAAS,IACb,qDAAqD,QAAQ,KAAK,KAAK,KACvE;AACN,WAAQ,KAAK,oBAAoB,KAAK,gBAAgB,UAAU;;SAE5D;AAKV,eAAc,YAAY,EAAE,SAAS,EAAE,QAAQ;;AAWjD,MAAa,qBAAqB,IAAI,QAAQ,OAAO,CAClD,YACC,yEACD,CACA,OAAO,eAAe,0BAA0B,CAChD,OACC,uBACA,oDACD,CACA,OACC,gBACA,+EACD,CACA,OACC,6BACA,qFACD,CACA,OACC,wBACA,6FACD,CACA,OACC,yBACA,0FACD,CACA,OACC,8BACA,iFACD,CACA,OACC,uBACA,wFACD,CACA,OAAO,UAAU,oCAAoC,CACrD,YACC,SACA;;;;;;;iCAQD,CACA,QAAQ,SACP,eAAe,KAAK,CAAC,OAAO,QAAQ;AAClC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}
+{"version":3,"file":"sync.js","names":[],"sources":["../../../../../src/cli/commands/plugin/sync/sync.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\n\nimport type { SgNode } from \"@ast-grep/napi\";\nimport { Command } from \"commander\";\n\nimport {\n  APP_ONLY_RESOURCE_TYPES,\n  DABS_BINDING_BY_TYPE,\n  type ResourceBinding,\n  SCOPE_BY_TYPE,\n  TEMPLATE_SCAFFOLDING,\n  templateFieldEntrySchema,\n} from \"../../../../schemas/manifest\";\nimport {\n  loadManifestFromFile,\n  type ResolvedManifest,\n  resolveManifestInDir,\n} from \"../manifest-resolve\";\nimport type {\n  PluginManifest,\n  TemplatePlugin,\n  TemplatePluginsManifest,\n} from \"../manifest-types\";\nimport { shouldAllowJsManifestForPackage } from \"../trusted-js-manifest\";\nimport {\n  formatValidationErrors,\n  validateManifest,\n} from \"../validate/validate-manifest\";\n\n/**\n * Checks whether a resolved file path is within a given directory boundary.\n * Uses path.resolve + startsWith to prevent directory traversal.\n *\n * @param filePath - The path to check (will be resolved to absolute)\n * @param boundary - The directory that must contain filePath\n * @returns true if filePath is inside boundary (or equal to it)\n */\nfunction isWithinDirectory(filePath: string, boundary: string): boolean {\n  const resolvedPath = path.resolve(filePath);\n  const resolvedBoundary = path.resolve(boundary);\n  // Append separator to avoid prefix false-positives (e.g. /foo-bar matching /foo)\n  return (\n    resolvedPath === resolvedBoundary ||\n    resolvedPath.startsWith(`${resolvedBoundary}${path.sep}`)\n  );\n}\n\n/**\n * Validates a parsed JSON object against the plugin-manifest schema.\n * Returns the manifest if valid, or null and logs schema errors.\n */\nfunction validateManifestWithSchema(\n  obj: unknown,\n  sourcePath: string,\n): PluginManifest | null {\n  const result = validateManifest(obj);\n  if (result.valid && result.manifest) return result.manifest;\n  if (result.errors?.length) {\n    console.warn(\n      `Warning: Manifest at ${sourcePath} failed schema validation:\\n${formatValidationErrors(result.errors)}`,\n    );\n  }\n  return null;\n}\n\n/** Safety limit for recursive directory scanning to prevent runaway traversal. */\nconst MAX_SCAN_DEPTH = 5;\n\n/**\n * Load and validate a resolved manifest, returning a TemplatePlugin entry or null.\n * Centralises the resolve → load → validate → build-entry pipeline used by\n * multiple discovery functions.\n */\nasync function loadPluginEntry(\n  resolved: ResolvedManifest,\n  pkg: string,\n  allowJsManifest: boolean,\n): Promise<[string, TemplatePlugin] | null> {\n  const parsed = await loadManifestFromFile(resolved.path, resolved.type, {\n    allowJsManifest,\n  });\n  const manifest = validateManifestWithSchema(parsed, resolved.path);\n  if (!manifest || manifest.hidden) return null;\n\n  return [manifest.name, toTemplatePlugin(manifest, pkg)];\n}\n\ntype ManifestResource = PluginManifest[\"resources\"][\"required\"][number];\n\n/** Bake the type-level execution facts into the resource so the CLI reads plain data. */\nfunction withExecutionCapabilities(resource: ManifestResource) {\n  const scope = Object.hasOwn(SCOPE_BY_TYPE, resource.type)\n    ? SCOPE_BY_TYPE[resource.type as keyof typeof SCOPE_BY_TYPE]\n    : undefined;\n  const binding: ResourceBinding | undefined = Object.hasOwn(\n    DABS_BINDING_BY_TYPE,\n    resource.type,\n  )\n    ? DABS_BINDING_BY_TYPE[resource.type as keyof typeof DABS_BINDING_BY_TYPE]\n    : undefined;\n  return {\n    ...resource,\n    ...(scope && { scope }),\n    ...(APP_ONLY_RESOURCE_TYPES.has(resource.type) && {\n      appOnly: true as const,\n    }),\n    ...(binding && {\n      // Materialize mutable tuples so the baked entry matches the template\n      // schema and never shares a reference with the source const table.\n      binding: {\n        yamlKey: binding.yamlKey,\n        varFields: binding.varFields.map(\n          (pair) => [pair[0], pair[1]] as [string, string],\n        ),\n        ...(binding.staticFields && {\n          staticFields: binding.staticFields.map(\n            (pair) => [pair[0], pair[1]] as [string, string],\n          ),\n        }),\n      },\n    }),\n  };\n}\n\n/** Build a TemplatePlugin entry. Every discovery path goes through here. */\nfunction toTemplatePlugin(\n  manifest: PluginManifest,\n  pkg: string,\n): TemplatePlugin {\n  return {\n    name: manifest.name,\n    displayName: manifest.displayName,\n    description: manifest.description,\n    package: pkg,\n    resources: {\n      required: manifest.resources.required.map((resource) =>\n        withExecutionCapabilities(resource),\n      ),\n      optional: manifest.resources.optional.map((resource) =>\n        withExecutionCapabilities(resource),\n      ),\n    },\n    ...(manifest.scopes?.length && { scopes: manifest.scopes }),\n    ...(manifest.onSetupMessage && {\n      onSetupMessage: manifest.onSetupMessage,\n    }),\n    // Narrowing on `!== \"ga\"` removes \"ga\"; the truthy check\n    // removes `undefined`. What's left is the non-GA tier set,\n    // which TypeScript already knows is assignable to TemplatePlugin's\n    // `stability` field — so no cast is needed and adding a future\n    // tier (e.g. \"alpha\") flows through type-correctly.\n    ...(manifest.stability &&\n      manifest.stability !== \"ga\" && {\n        stability: manifest.stability,\n      }),\n    ...(manifest.deprecated && { deprecated: manifest.deprecated }),\n    ...(manifest.scaffolding && {\n      scaffolding: manifest.scaffolding,\n    }),\n  };\n}\n\n/**\n * Known packages that may contain AppKit plugins.\n * Always scanned for manifests, even if not imported in the server file.\n */\nconst KNOWN_PLUGIN_PACKAGES = [\"@databricks/appkit\"];\n\n/**\n * Candidate paths for the server entry file, relative to cwd.\n * Checked in order; the first that exists is used.\n */\nconst SERVER_FILE_CANDIDATES = [\"server/server.ts\", \"server/index.ts\"];\n\n/**\n * Conventional directories to scan for local plugin manifests when\n * --local-plugins-dir is not set. Checked in order; each that exists is scanned.\n * Plugins found here are added to the manifest even if not imported in the server.\n */\nconst CONVENTIONAL_LOCAL_PLUGIN_DIRS = [\"plugins\", \"server\"];\n\n/**\n * Find the server entry file by checking candidate paths in order.\n *\n * @param cwd - Current working directory\n * @returns Absolute path to the server file, or null if none found\n */\nfunction findServerFile(cwd: string): string | null {\n  for (const candidate of SERVER_FILE_CANDIDATES) {\n    const fullPath = path.join(cwd, candidate);\n    if (fs.existsSync(fullPath)) {\n      return fullPath;\n    }\n  }\n  return null;\n}\n\n/**\n * Represents a single named import extracted from the server file.\n */\ninterface ParsedImport {\n  /** The imported name (or local alias if renamed) */\n  name: string;\n  /** The original exported name (differs from name when using `import { foo as bar }`) */\n  originalName: string;\n  /** The module specifier (package name or relative path) */\n  source: string;\n}\n\n/**\n * Extract all named imports from the AST root using structural node traversal.\n * Handles single/double quotes, multiline imports, and aliased imports.\n *\n * @param root - AST root node\n * @returns Array of parsed imports with name, original name, and source\n */\nfunction parseImports(root: SgNode): ParsedImport[] {\n  const imports: ParsedImport[] = [];\n\n  // Find all import_statement nodes in the AST\n  const importStatements = root.findAll({\n    rule: { kind: \"import_statement\" },\n  });\n\n  for (const stmt of importStatements) {\n    // Extract the module specifier (the string node, e.g. '@databricks/appkit')\n    const sourceNode = stmt.find({ rule: { kind: \"string\" } });\n    if (!sourceNode) continue;\n\n    // Strip surrounding quotes from the string node text\n    const source = sourceNode.text().replace(/^['\"]|['\"]$/g, \"\");\n\n    // Find named_imports block: { createApp, analytics, server }\n    const namedImports = stmt.find({ rule: { kind: \"named_imports\" } });\n    if (!namedImports) continue;\n\n    // Extract each import_specifier\n    const specifiers = namedImports.findAll({\n      rule: { kind: \"import_specifier\" },\n    });\n\n    for (const specifier of specifiers) {\n      const children = specifier.children();\n      if (children.length >= 3) {\n        // Aliased import: `foo as bar` — children are [name, \"as\", alias]\n        const originalName = children[0].text();\n        const localName = children[children.length - 1].text();\n        imports.push({ name: localName, originalName, source });\n      } else {\n        // Simple import: `foo`\n        const name = specifier.text();\n        imports.push({ name, originalName: name, source });\n      }\n    }\n  }\n\n  return imports;\n}\n\n/**\n * Extract local names of plugins actually used in the `plugins: [...]` array\n * passed to `createApp()`. Uses structural AST traversal to find `pair` nodes\n * with key \"plugins\" and array values containing call expressions.\n *\n * @param root - AST root node\n * @returns Set of local variable names used as plugin calls in the plugins array\n */\nfunction parsePluginUsages(root: SgNode): Set<string> {\n  const usedNames = new Set<string>();\n\n  // Find all property pairs in the AST\n  const pairs = root.findAll({ rule: { kind: \"pair\" } });\n\n  for (const pair of pairs) {\n    // Check if the property key is \"plugins\"\n    const key = pair.find({ rule: { kind: \"property_identifier\" } });\n    if (!key || key.text() !== \"plugins\") continue;\n\n    // Find the array value\n    const arrayNode = pair.find({ rule: { kind: \"array\" } });\n    if (!arrayNode) continue;\n\n    // Iterate direct children of the array to find call expressions\n    for (const child of arrayNode.children()) {\n      if (child.kind() === \"call_expression\") {\n        // The callee is the first child (the identifier being called)\n        const callee = child.children()[0];\n        if (callee?.kind() === \"identifier\") {\n          usedNames.add(callee.text());\n        }\n      }\n    }\n  }\n\n  return usedNames;\n}\n\n/**\n * File extensions to try when resolving a relative import to a file path.\n */\nconst RESOLVE_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".jsx\"];\n\n/**\n * Resolve a relative import source to the plugin directory containing a manifest\n * (manifest.json or manifest.js). Follows the convention that plugins live in\n * their own directory with a manifest file.\n *\n * Resolution strategy:\n * 1. If the import path is a directory, look for manifest.json/js in it\n * 2. If the import path + extension is a file, look for manifest in its parent directory\n * 3. If the import path is a directory with an index file, look for manifest in that directory\n *\n * @param importSource - The relative import specifier (e.g. \"./plugins/my-plugin\")\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @returns Resolved manifest file path and type, or null if not found\n */\nfunction resolveLocalManifest(\n  importSource: string,\n  serverFileDir: string,\n  allowJsManifest: boolean,\n  projectRoot?: string,\n): ResolvedManifest | null {\n  const resolved = path.resolve(serverFileDir, importSource);\n\n  // Security: Reject paths that escape the project root\n  const boundary = projectRoot || serverFileDir;\n  if (!isWithinDirectory(resolved, boundary)) {\n    console.warn(\n      `Warning: Skipping import \"${importSource}\" — resolves outside the project directory`,\n    );\n    return null;\n  }\n\n  // Case 1: Import path is a directory\n  if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n    return resolveManifestInDir(resolved, { allowJsManifest });\n  }\n\n  // Case 2: Import path + extension resolves to a file — manifest in parent dir\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const filePath = `${resolved}${ext}`;\n    if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {\n      const dir = path.dirname(filePath);\n      if (!isWithinDirectory(dir, boundary)) return null;\n      return resolveManifestInDir(dir, { allowJsManifest });\n    }\n  }\n\n  // Case 3: Import path is a directory with an index file\n  for (const ext of RESOLVE_EXTENSIONS) {\n    const indexPath = path.join(resolved, `index${ext}`);\n    if (fs.existsSync(indexPath)) {\n      return resolveManifestInDir(resolved, { allowJsManifest });\n    }\n  }\n\n  return null;\n}\n\n/**\n * Discover plugin manifests from local (relative) imports in the server file.\n * Resolves each relative import to a directory and loads manifest.json or manifest.js.\n *\n * @param relativeImports - Parsed imports with relative sources (starting with . or /)\n * @param serverFileDir - Absolute path to the directory containing the server file\n * @param cwd - Current working directory (for computing relative paths in output)\n * @returns Map of plugin name to template plugin entry for local plugins\n */\nasync function discoverLocalPlugins(\n  relativeImports: ParsedImport[],\n  serverFileDir: string,\n  cwd: string,\n  allowJsManifest: boolean,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const imp of relativeImports) {\n    const resolved = resolveLocalManifest(\n      imp.source,\n      serverFileDir,\n      allowJsManifest,\n      cwd,\n    );\n    if (!resolved) continue;\n\n    try {\n      const relativePath = path.relative(cwd, path.dirname(resolved.path));\n      const entry = await loadPluginEntry(\n        resolved,\n        `./${relativePath}`,\n        allowJsManifest,\n      );\n      if (entry) plugins[entry[0]] = entry[1];\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Discover plugin manifests from a package's dist folder.\n * Looks for manifest.json or manifest.js in dist/plugins/{plugin-name}/ directories.\n *\n * @param packagePath - Path to the package in node_modules\n * @returns Array of plugin manifests found in the package\n */\nasync function discoverPluginManifests(\n  packagePath: string,\n  allowJsManifest: boolean,\n): Promise<PluginManifest[]> {\n  const pluginsDir = path.join(packagePath, \"dist\", \"plugins\");\n  const manifests: PluginManifest[] = [];\n\n  if (!fs.existsSync(pluginsDir)) {\n    return manifests;\n  }\n\n  const entries = fs.readdirSync(pluginsDir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n    const resolved = resolveManifestInDir(path.join(pluginsDir, entry.name), {\n      allowJsManifest,\n    });\n    if (!resolved) continue;\n\n    try {\n      const parsed = await loadManifestFromFile(resolved.path, resolved.type, {\n        allowJsManifest,\n      });\n      const manifest = validateManifestWithSchema(parsed, resolved.path);\n      if (manifest) {\n        manifests.push(manifest);\n      }\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return manifests;\n}\n\n/**\n * Scan node_modules for packages with plugin manifests.\n *\n * @param cwd - Current working directory to search from\n * @param packages - Set of npm package names to scan for plugin manifests\n * @returns Map of plugin name to template plugin entry\n */\nasync function scanForPlugins(\n  cwd: string,\n  packages: Iterable<string>,\n  allowJsManifest: boolean,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  for (const packageName of packages) {\n    const packagePath = path.join(cwd, \"node_modules\", packageName);\n    if (!fs.existsSync(packagePath)) {\n      continue;\n    }\n\n    const allowJsForPackage =\n      allowJsManifest || shouldAllowJsManifestForPackage(packageName);\n\n    const manifests = await discoverPluginManifests(\n      packagePath,\n      allowJsForPackage,\n    );\n    for (const manifest of manifests) {\n      if (manifest.hidden) continue;\n      plugins[manifest.name] = toTemplatePlugin(manifest, packageName);\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Recursively scan a directory for plugin manifests. Any directory that\n * contains manifest.json or manifest.js is treated as a plugin root; we do\n * not descend into that directory's children. Used for local plugins discovery\n * so nested paths like server/plugins/category/my-plugin are found.\n */\nasync function scanPluginsDirRecursive(\n  dir: string,\n  cwd: string,\n  allowJsManifest: boolean,\n  depth = 0,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n  if (!fs.existsSync(dir) || depth >= MAX_SCAN_DEPTH) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const pluginDir = path.join(dir, entry.name);\n    const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });\n\n    if (resolved) {\n      const pkg = `./${path.relative(cwd, pluginDir)}`;\n      try {\n        const pluginEntry = await loadPluginEntry(\n          resolved,\n          pkg,\n          allowJsManifest,\n        );\n        if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];\n      } catch (error) {\n        console.warn(\n          `Warning: Failed to load manifest at ${resolved.path}:`,\n          error instanceof Error ? error.message : error,\n        );\n      }\n      continue;\n    }\n\n    Object.assign(\n      plugins,\n      await scanPluginsDirRecursive(pluginDir, cwd, allowJsManifest, depth + 1),\n    );\n  }\n\n  return plugins;\n}\n\n/**\n * Scan a directory for plugin manifests in direct subdirectories only.\n * Each subdirectory may contain manifest.json or manifest.js.\n * Used with --plugins-dir to discover plugins from source instead of node_modules.\n *\n * @param dir - Absolute path to the directory containing plugin subdirectories\n * @param packageName - Package name to assign to discovered plugins (used when cwd is not set)\n * @param cwd - When set, each plugin's package is set to ./<path from cwd to plugin subdir>, e.g. ./server/my-plugin\n * @returns Map of plugin name to template plugin entry\n */\nasync function scanPluginsDir(\n  dir: string,\n  packageName: string,\n  allowJsManifest: boolean,\n  cwd?: string,\n): Promise<TemplatePluginsManifest[\"plugins\"]> {\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (!fs.existsSync(dir)) return plugins;\n\n  const entries = fs.readdirSync(dir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory()) continue;\n\n    const pluginDir = path.join(dir, entry.name);\n    const resolved = resolveManifestInDir(pluginDir, { allowJsManifest });\n    if (!resolved) continue;\n\n    const pkg =\n      cwd !== undefined ? `./${path.relative(cwd, pluginDir)}` : packageName;\n\n    try {\n      const pluginEntry = await loadPluginEntry(resolved, pkg, allowJsManifest);\n      if (pluginEntry) plugins[pluginEntry[0]] = pluginEntry[1];\n    } catch (error) {\n      console.warn(\n        `Warning: Failed to load manifest at ${resolved.path}:`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return plugins;\n}\n\n/**\n * Write (or preview) the template plugins manifest to disk.\n *\n * Each resource field is parsed through `templateFieldEntrySchema` so the\n * `origin` transform fires and produces canonical `origin` values, even\n * when the input carries a stale `origin`. Parsing per-field (rather than\n * the whole manifest) keeps the surrounding plugin/resource key order\n * stable so the synced JSON's diff stays minimal.\n */\nfunction writeManifest(\n  outputPath: string,\n  { plugins }: { plugins: TemplatePluginsManifest[\"plugins\"] },\n  options: { write?: boolean; silent?: boolean; json?: boolean },\n) {\n  for (const plugin of Object.values(plugins)) {\n    for (const group of [\n      plugin.resources.required,\n      plugin.resources.optional,\n    ]) {\n      for (const resource of group) {\n        if (!resource.fields) continue;\n        for (const fieldName of Object.keys(resource.fields)) {\n          resource.fields[fieldName] = templateFieldEntrySchema.parse(\n            resource.fields[fieldName],\n          );\n        }\n      }\n    }\n  }\n\n  const templateManifest: TemplatePluginsManifest = {\n    $schema:\n      \"https://databricks.github.io/appkit/schemas/template-plugins.schema.json\",\n    version: \"2.0\",\n    plugins,\n    scaffolding: TEMPLATE_SCAFFOLDING,\n  };\n\n  const serialized = JSON.stringify(templateManifest, null, 2);\n\n  if (options.json) {\n    console.log(serialized);\n  }\n\n  if (options.write) {\n    fs.writeFileSync(outputPath, `${serialized}\\n`);\n    if (!options.silent && !options.json) {\n      console.log(`\\n✓ Wrote ${outputPath}`);\n    }\n  } else if (!options.silent && !options.json) {\n    console.log(\"\\nTo write the manifest, run:\");\n    console.log(\"  npx appkit plugin sync --write\\n\");\n    console.log(\"Preview:\");\n    console.log(\"─\".repeat(60));\n    console.log(serialized);\n    console.log(\"─\".repeat(60));\n  }\n}\n\n/**\n * Run the plugin sync command.\n * Parses the server entry file to discover which packages to scan for plugin\n * manifests, then marks plugins that are actually used in the `plugins: [...]`\n * array as requiredByTemplate.\n */\nasync function runPluginsSync(options: {\n  write?: boolean;\n  output?: string;\n  silent?: boolean;\n  json?: boolean;\n  requirePlugins?: string;\n  pluginsDir?: string;\n  packageName?: string;\n  localPluginsDir?: string;\n  allowJsManifest?: boolean;\n}): Promise<void> {\n  const cwd = process.cwd();\n  const allowJsManifest = Boolean(options.allowJsManifest);\n  const outputPath = path.resolve(cwd, options.output || \"appkit.plugins.json\");\n\n  // Security: Reject output paths that escape the project root\n  if (!isWithinDirectory(outputPath, cwd)) {\n    console.error(\n      `Error: Output path \"${options.output}\" resolves outside the project directory.`,\n    );\n    process.exit(1);\n  }\n\n  if (!options.silent && !options.json) {\n    console.log(\"Scanning for AppKit plugins...\\n\");\n    if (allowJsManifest) {\n      console.warn(\n        \"Warning: --allow-js-manifest executes manifest.js/manifest.cjs files. Only use with trusted code.\",\n      );\n    }\n  }\n\n  // Step 1: Parse server file to discover imports and plugin usages\n  const serverFile = findServerFile(cwd);\n  let serverImports: ParsedImport[] = [];\n  let pluginUsages = new Set<string>();\n\n  if (serverFile) {\n    if (!options.silent && !options.json) {\n      const relativePath = path.relative(cwd, serverFile);\n      console.log(`Server entry file: ${relativePath}`);\n    }\n\n    const require = createRequire(import.meta.url);\n    const { Lang, parse } =\n      require(\"@ast-grep/napi\") as typeof import(\"@ast-grep/napi\");\n    const content = fs.readFileSync(serverFile, \"utf-8\");\n    const lang = serverFile.endsWith(\".tsx\") ? Lang.Tsx : Lang.TypeScript;\n    const ast = parse(lang, content);\n    const root = ast.root();\n\n    serverImports = parseImports(root);\n    pluginUsages = parsePluginUsages(root);\n  } else if (!options.silent && !options.json) {\n    console.log(\n      \"No server entry file found. Checked:\",\n      SERVER_FILE_CANDIDATES.join(\", \"),\n    );\n  }\n\n  // Step 2: Split imports into npm packages and local (relative) imports\n  const npmImports = serverImports.filter(\n    (i) => !i.source.startsWith(\".\") && !i.source.startsWith(\"/\"),\n  );\n  const localImports = serverImports.filter(\n    (i) => i.source.startsWith(\".\") || i.source.startsWith(\"/\"),\n  );\n\n  // Step 3: Scan for plugin manifests (--plugins-dir or node_modules)\n  const plugins: TemplatePluginsManifest[\"plugins\"] = {};\n\n  if (options.pluginsDir) {\n    const resolvedDir = path.resolve(cwd, options.pluginsDir);\n    const pkgName = options.packageName ?? \"@databricks/appkit\";\n    if (!options.silent && !options.json) {\n      console.log(`Scanning plugins directory: ${options.pluginsDir}`);\n    }\n    Object.assign(\n      plugins,\n      await scanPluginsDir(resolvedDir, pkgName, allowJsManifest),\n    );\n  } else {\n    const npmPackages = new Set([\n      ...KNOWN_PLUGIN_PACKAGES,\n      ...npmImports.map((i) => i.source),\n    ]);\n    Object.assign(\n      plugins,\n      await scanForPlugins(cwd, npmPackages, allowJsManifest),\n    );\n  }\n\n  // Step 4: Discover local plugin manifests from relative imports\n  if (serverFile && localImports.length > 0) {\n    const serverFileDir = path.dirname(serverFile);\n    const localPlugins = await discoverLocalPlugins(\n      localImports,\n      serverFileDir,\n      cwd,\n      allowJsManifest,\n    );\n    Object.assign(plugins, localPlugins);\n  }\n\n  // Step 4b: Discover local plugins from conventional directory (or --local-plugins-dir).\n  // These are included even when not imported in the server.\n  const localDirsToScan: string[] = options.localPluginsDir\n    ? [options.localPluginsDir]\n    : CONVENTIONAL_LOCAL_PLUGIN_DIRS.filter((d) =>\n        fs.existsSync(path.join(cwd, d)),\n      );\n  for (const dir of localDirsToScan) {\n    const resolvedDir = path.resolve(cwd, dir);\n    if (!fs.existsSync(resolvedDir)) continue;\n    if (!options.silent && !options.json) {\n      console.log(`Scanning local plugins directory: ${dir}`);\n    }\n    const discovered = await scanPluginsDirRecursive(\n      resolvedDir,\n      cwd,\n      allowJsManifest,\n    );\n    for (const [name, entry] of Object.entries(discovered)) {\n      if (!plugins[name]) plugins[name] = entry;\n    }\n  }\n\n  const pluginCount = Object.keys(plugins).length;\n\n  if (pluginCount === 0) {\n    if (options.silent || options.json) {\n      writeManifest(outputPath, { plugins: {} }, options);\n      if (options.silent) return;\n      process.exit(1);\n    }\n    console.log(\"No plugins found.\");\n    if (options.pluginsDir) {\n      console.log(\n        `\\nNo manifest (${allowJsManifest ? \"manifest.json or manifest.js\" : \"manifest.json\"}) found in: ${options.pluginsDir}`,\n      );\n    } else {\n      console.log(\n        \"\\nMake sure you have plugin packages installed, or specify a directory:\",\n      );\n      console.log(\"  appkit plugin sync --plugins-dir <path>\");\n    }\n    process.exit(1);\n  }\n\n  // Step 5: Mark plugins that are imported AND used in the plugins array as mandatory.\n  // For npm imports, match by package name + plugin name.\n  // For local imports, resolve both paths to absolute and compare.\n  const serverFileDir = serverFile ? path.dirname(serverFile) : cwd;\n  const usedDeprecated: string[] = [];\n\n  for (const imp of serverImports) {\n    if (!pluginUsages.has(imp.name)) continue;\n\n    const isLocal = imp.source.startsWith(\".\") || imp.source.startsWith(\"/\");\n    let plugin: TemplatePlugin | undefined;\n\n    if (isLocal) {\n      // Resolve the import source to an absolute path from the server file directory\n      const resolvedImportDir = path.resolve(serverFileDir, imp.source);\n      plugin = Object.values(plugins).find((p) => {\n        if (!p.package.startsWith(\".\")) return false;\n        const resolvedPluginDir = path.resolve(cwd, p.package);\n        return (\n          resolvedPluginDir === resolvedImportDir && p.name === imp.originalName\n        );\n      });\n    } else {\n      // npm import: direct string comparison\n      plugin = Object.values(plugins).find(\n        (p) => p.package === imp.source && p.name === imp.originalName,\n      );\n    }\n\n    if (plugin) {\n      plugin.requiredByTemplate = true;\n      if (plugin.deprecated) usedDeprecated.push(plugin.name);\n    }\n  }\n\n  // Step 6: Apply explicit --require-plugins overrides\n  if (options.requirePlugins) {\n    const explicitNames = options.requirePlugins\n      .split(\",\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n    for (const name of explicitNames) {\n      if (plugins[name]) {\n        plugins[name].requiredByTemplate = true;\n      } else if (!options.silent) {\n        console.warn(\n          `Warning: --require-plugins referenced \"${name}\" but no such plugin was discovered`,\n        );\n      }\n    }\n  }\n\n  // Step 6b: Strip requiredByTemplate for non-GA plugins\n  for (const plugin of Object.values(plugins)) {\n    if (\n      plugin.requiredByTemplate &&\n      plugin.stability &&\n      plugin.stability !== \"ga\"\n    ) {\n      plugin.requiredByTemplate = undefined;\n    }\n  }\n\n  if (!options.silent && !options.json) {\n    console.log(`\\nFound ${pluginCount} plugin(s):`);\n    for (const [name, manifest] of Object.entries(plugins)) {\n      const resourceCount =\n        manifest.resources.required.length + manifest.resources.optional.length;\n      const resourceInfo =\n        resourceCount > 0 ? ` [${resourceCount} resource(s)]` : \"\";\n      const mandatoryTag = manifest.requiredByTemplate ? \" (mandatory)\" : \"\";\n      const deprecatedTag = manifest.deprecated ? \" (deprecated)\" : \"\";\n      console.log(\n        `  ${manifest.requiredByTemplate ? \"●\" : \"○\"} ${manifest.displayName} (${name}) from ${manifest.package}${resourceInfo}${mandatoryTag}${deprecatedTag}`,\n      );\n    }\n  }\n\n  // Warn about deprecated plugins that are actually used in the app.\n  if (!options.silent && usedDeprecated.length > 0) {\n    for (const name of usedDeprecated) {\n      console.warn(\n        `Warning: plugin \"${name}\" is deprecated. See its description for the recommended replacement.`,\n      );\n    }\n  }\n\n  // Step 7: Detect orphaned resources from removed plugins\n  if (!options.silent && fs.existsSync(outputPath)) {\n    try {\n      const oldRaw = fs.readFileSync(outputPath, \"utf-8\");\n      const oldManifest = JSON.parse(oldRaw) as TemplatePluginsManifest;\n      const oldNames = new Set(Object.keys(oldManifest.plugins ?? {}));\n      const newNames = new Set(Object.keys(plugins));\n      for (const name of oldNames) {\n        if (newNames.has(name)) continue;\n        const oldPlugin = oldManifest.plugins?.[name];\n        if (!oldPlugin || typeof oldPlugin !== \"object\") continue;\n        const envVars: string[] = [];\n        for (const res of [\n          ...(oldPlugin.resources?.required ?? []),\n          ...(oldPlugin.resources?.optional ?? []),\n        ]) {\n          if (res?.fields) {\n            for (const field of Object.values(res.fields)) {\n              if (field?.env) envVars.push(field.env);\n            }\n          }\n        }\n        const envInfo =\n          envVars.length > 0\n            ? ` The following resource env vars may be orphaned: ${envVars.join(\", \")}`\n            : \"\";\n        console.warn(`Warning: Plugin \"${name}\" was removed.${envInfo}`);\n      }\n    } catch {\n      // Ignore parse errors on existing manifest\n    }\n  }\n\n  writeManifest(outputPath, { plugins }, options);\n}\n\n/** Exported for testing: path boundary check, AST parsing, trust checks, discovery paths. */\nexport {\n  discoverLocalPlugins,\n  isWithinDirectory,\n  parseImports,\n  parsePluginUsages,\n  scanForPlugins,\n  scanPluginsDir,\n  shouldAllowJsManifestForPackage,\n};\n\nexport const pluginsSyncCommand = new Command(\"sync\")\n  .description(\n    \"Sync plugin manifests from installed packages into appkit.plugins.json\",\n  )\n  .option(\"-w, --write\", \"Write the manifest file\")\n  .option(\n    \"-o, --output <path>\",\n    \"Output file path (default: ./appkit.plugins.json)\",\n  )\n  .option(\n    \"-s, --silent\",\n    \"Suppress output and never exit with error (for use in predev/prebuild hooks)\",\n  )\n  .option(\n    \"--require-plugins <names>\",\n    \"Comma-separated plugin names to mark as requiredByTemplate (e.g. server,analytics)\",\n  )\n  .option(\n    \"--plugins-dir <path>\",\n    \"Scan this directory for plugin subdirectories with manifest.json (instead of node_modules)\",\n  )\n  .option(\n    \"--package-name <name>\",\n    \"Package name to assign to plugins found via --plugins-dir (default: @databricks/appkit)\",\n  )\n  .option(\n    \"--local-plugins-dir <path>\",\n    \"Also scan this directory for local plugin manifests (default: plugins, server)\",\n  )\n  .option(\n    \"--allow-js-manifest\",\n    \"Allow reading manifest.js/manifest.cjs (executes code; use only with trusted plugins)\",\n  )\n  .option(\"--json\", \"Output manifest as JSON to stdout\")\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  $ appkit plugin sync\n  $ appkit plugin sync --write\n  $ appkit plugin sync --write --require-plugins server,analytics\n  $ appkit plugin sync --write --plugins-dir src/plugins --package-name @my/pkg\n  $ appkit plugin sync --json\n  $ appkit plugin sync --silent`,\n  )\n  .action((opts) =>\n    runPluginsSync(opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;AAuCA,SAAS,kBAAkB,UAAkB,UAA2B;CACtE,MAAM,eAAe,KAAK,QAAQ,SAAS;CAC3C,MAAM,mBAAmB,KAAK,QAAQ,SAAS;AAE/C,QACE,iBAAiB,oBACjB,aAAa,WAAW,GAAG,mBAAmB,KAAK,MAAM;;;;;;AAQ7D,SAAS,2BACP,KACA,YACuB;CACvB,MAAM,SAAS,iBAAiB,IAAI;AACpC,KAAI,OAAO,SAAS,OAAO,SAAU,QAAO,OAAO;AACnD,KAAI,OAAO,QAAQ,OACjB,SAAQ,KACN,wBAAwB,WAAW,8BAA8B,uBAAuB,OAAO,OAAO,GACvG;AAEH,QAAO;;;AAIT,MAAM,iBAAiB;;;;;;AAOvB,eAAe,gBACb,UACA,KACA,iBAC0C;CAI1C,MAAM,WAAW,2BAHF,MAAM,qBAAqB,SAAS,MAAM,SAAS,MAAM,EACtE,iBACD,CAAC,EACkD,SAAS,KAAK;AAClE,KAAI,CAAC,YAAY,SAAS,OAAQ,QAAO;AAEzC,QAAO,CAAC,SAAS,MAAM,iBAAiB,UAAU,IAAI,CAAC;;;AAMzD,SAAS,0BAA0B,UAA4B;CAC7D,MAAM,QAAQ,OAAO,OAAO,eAAe,SAAS,KAAK,GACrD,cAAc,SAAS,QACvB;CACJ,MAAM,UAAuC,OAAO,OAClD,sBACA,SAAS,KACV,GACG,qBAAqB,SAAS,QAC9B;AACJ,QAAO;EACL,GAAG;EACH,GAAI,SAAS,EAAE,OAAO;EACtB,GAAI,wBAAwB,IAAI,SAAS,KAAK,IAAI,EAChD,SAAS,MACV;EACD,GAAI,WAAW,EAGb,SAAS;GACP,SAAS,QAAQ;GACjB,WAAW,QAAQ,UAAU,KAC1B,SAAS,CAAC,KAAK,IAAI,KAAK,GAAG,CAC7B;GACD,GAAI,QAAQ,gBAAgB,EAC1B,cAAc,QAAQ,aAAa,KAChC,SAAS,CAAC,KAAK,IAAI,KAAK,GAAG,CAC7B,EACF;GACF,EACF;EACF;;;AAIH,SAAS,iBACP,UACA,KACgB;AAChB,QAAO;EACL,MAAM,SAAS;EACf,aAAa,SAAS;EACtB,aAAa,SAAS;EACtB,SAAS;EACT,WAAW;GACT,UAAU,SAAS,UAAU,SAAS,KAAK,aACzC,0BAA0B,SAAS,CACpC;GACD,UAAU,SAAS,UAAU,SAAS,KAAK,aACzC,0BAA0B,SAAS,CACpC;GACF;EACD,GAAI,SAAS,QAAQ,UAAU,EAAE,QAAQ,SAAS,QAAQ;EAC1D,GAAI,SAAS,kBAAkB,EAC7B,gBAAgB,SAAS,gBAC1B;EAMD,GAAI,SAAS,aACX,SAAS,cAAc,QAAQ,EAC7B,WAAW,SAAS,WACrB;EACH,GAAI,SAAS,cAAc,EAAE,YAAY,SAAS,YAAY;EAC9D,GAAI,SAAS,eAAe,EAC1B,aAAa,SAAS,aACvB;EACF;;;;;;AAOH,MAAM,wBAAwB,CAAC,qBAAqB;;;;;AAMpD,MAAM,yBAAyB,CAAC,oBAAoB,kBAAkB;;;;;;AAOtE,MAAM,iCAAiC,CAAC,WAAW,SAAS;;;;;;;AAQ5D,SAAS,eAAe,KAA4B;AAClD,MAAK,MAAM,aAAa,wBAAwB;EAC9C,MAAM,WAAW,KAAK,KAAK,KAAK,UAAU;AAC1C,MAAI,GAAG,WAAW,SAAS,CACzB,QAAO;;AAGX,QAAO;;;;;;;;;AAsBT,SAAS,aAAa,MAA8B;CAClD,MAAM,UAA0B,EAAE;CAGlC,MAAM,mBAAmB,KAAK,QAAQ,EACpC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,MAAK,MAAM,QAAQ,kBAAkB;EAEnC,MAAM,aAAa,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,EAAE,CAAC;AAC1D,MAAI,CAAC,WAAY;EAGjB,MAAM,SAAS,WAAW,MAAM,CAAC,QAAQ,gBAAgB,GAAG;EAG5D,MAAM,eAAe,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,EAAE,CAAC;AACnE,MAAI,CAAC,aAAc;EAGnB,MAAM,aAAa,aAAa,QAAQ,EACtC,MAAM,EAAE,MAAM,oBAAoB,EACnC,CAAC;AAEF,OAAK,MAAM,aAAa,YAAY;GAClC,MAAM,WAAW,UAAU,UAAU;AACrC,OAAI,SAAS,UAAU,GAAG;IAExB,MAAM,eAAe,SAAS,GAAG,MAAM;IACvC,MAAM,YAAY,SAAS,SAAS,SAAS,GAAG,MAAM;AACtD,YAAQ,KAAK;KAAE,MAAM;KAAW;KAAc;KAAQ,CAAC;UAClD;IAEL,MAAM,OAAO,UAAU,MAAM;AAC7B,YAAQ,KAAK;KAAE;KAAM,cAAc;KAAM;KAAQ,CAAC;;;;AAKxD,QAAO;;;;;;;;;;AAWT,SAAS,kBAAkB,MAA2B;CACpD,MAAM,4BAAY,IAAI,KAAa;CAGnC,MAAM,QAAQ,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,EAAE,CAAC;AAEtD,MAAK,MAAM,QAAQ,OAAO;EAExB,MAAM,MAAM,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,EAAE,CAAC;AAChE,MAAI,CAAC,OAAO,IAAI,MAAM,KAAK,UAAW;EAGtC,MAAM,YAAY,KAAK,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,CAAC;AACxD,MAAI,CAAC,UAAW;AAGhB,OAAK,MAAM,SAAS,UAAU,UAAU,CACtC,KAAI,MAAM,MAAM,KAAK,mBAAmB;GAEtC,MAAM,SAAS,MAAM,UAAU,CAAC;AAChC,OAAI,QAAQ,MAAM,KAAK,aACrB,WAAU,IAAI,OAAO,MAAM,CAAC;;;AAMpC,QAAO;;;;;AAMT,MAAM,qBAAqB;CAAC;CAAO;CAAQ;CAAO;CAAO;;;;;;;;;;;;;;;AAgBzD,SAAS,qBACP,cACA,eACA,iBACA,aACyB;CACzB,MAAM,WAAW,KAAK,QAAQ,eAAe,aAAa;CAG1D,MAAM,WAAW,eAAe;AAChC,KAAI,CAAC,kBAAkB,UAAU,SAAS,EAAE;AAC1C,UAAQ,KACN,6BAA6B,aAAa,4CAC3C;AACD,SAAO;;AAIT,KAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,aAAa,CAChE,QAAO,qBAAqB,UAAU,EAAE,iBAAiB,CAAC;AAI5D,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,WAAW,GAAG,WAAW;AAC/B,MAAI,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,QAAQ,EAAE;GAC7D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,OAAI,CAAC,kBAAkB,KAAK,SAAS,CAAE,QAAO;AAC9C,UAAO,qBAAqB,KAAK,EAAE,iBAAiB,CAAC;;;AAKzD,MAAK,MAAM,OAAO,oBAAoB;EACpC,MAAM,YAAY,KAAK,KAAK,UAAU,QAAQ,MAAM;AACpD,MAAI,GAAG,WAAW,UAAU,CAC1B,QAAO,qBAAqB,UAAU,EAAE,iBAAiB,CAAC;;AAI9D,QAAO;;;;;;;;;;;AAYT,eAAe,qBACb,iBACA,eACA,KACA,iBAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,WAAW,qBACf,IAAI,QACJ,eACA,iBACA,IACD;AACD,MAAI,CAAC,SAAU;AAEf,MAAI;GAEF,MAAM,QAAQ,MAAM,gBAClB,UACA,KAHmB,KAAK,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK,CAAC,IAIlE,gBACD;AACD,OAAI,MAAO,SAAQ,MAAM,MAAM,MAAM;WAC9B,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,eAAe,wBACb,aACA,iBAC2B;CAC3B,MAAM,aAAa,KAAK,KAAK,aAAa,QAAQ,UAAU;CAC5D,MAAM,YAA8B,EAAE;AAEtC,KAAI,CAAC,GAAG,WAAW,WAAW,CAC5B,QAAO;CAGT,MAAM,UAAU,GAAG,YAAY,YAAY,EAAE,eAAe,MAAM,CAAC;AACnE,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAC1B,MAAM,WAAW,qBAAqB,KAAK,KAAK,YAAY,MAAM,KAAK,EAAE,EACvE,iBACD,CAAC;AACF,MAAI,CAAC,SAAU;AAEf,MAAI;GAIF,MAAM,WAAW,2BAHF,MAAM,qBAAqB,SAAS,MAAM,SAAS,MAAM,EACtE,iBACD,CAAC,EACkD,SAAS,KAAK;AAClE,OAAI,SACF,WAAU,KAAK,SAAS;WAEnB,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;AAUT,eAAe,eACb,KACA,UACA,iBAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,MAAK,MAAM,eAAe,UAAU;EAClC,MAAM,cAAc,KAAK,KAAK,KAAK,gBAAgB,YAAY;AAC/D,MAAI,CAAC,GAAG,WAAW,YAAY,CAC7B;EAMF,MAAM,YAAY,MAAM,wBACtB,aAHA,mBAAmB,gCAAgC,YAAY,CAKhE;AACD,OAAK,MAAM,YAAY,WAAW;AAChC,OAAI,SAAS,OAAQ;AACrB,WAAQ,SAAS,QAAQ,iBAAiB,UAAU,YAAY;;;AAIpE,QAAO;;;;;;;;AAST,eAAe,wBACb,KACA,KACA,iBACA,QAAQ,GACqC;CAC7C,MAAM,UAA8C,EAAE;AACtD,KAAI,CAAC,GAAG,WAAW,IAAI,IAAI,SAAS,eAAgB,QAAO;CAE3D,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,CAAC;AAErE,MAAI,UAAU;GACZ,MAAM,MAAM,KAAK,KAAK,SAAS,KAAK,UAAU;AAC9C,OAAI;IACF,MAAM,cAAc,MAAM,gBACxB,UACA,KACA,gBACD;AACD,QAAI,YAAa,SAAQ,YAAY,MAAM,YAAY;YAChD,OAAO;AACd,YAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;AAEH;;AAGF,SAAO,OACL,SACA,MAAM,wBAAwB,WAAW,KAAK,iBAAiB,QAAQ,EAAE,CAC1E;;AAGH,QAAO;;;;;;;;;;;;AAaT,eAAe,eACb,KACA,aACA,iBACA,KAC6C;CAC7C,MAAM,UAA8C,EAAE;AAEtD,KAAI,CAAC,GAAG,WAAW,IAAI,CAAE,QAAO;CAEhC,MAAM,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,MAAM,CAAC;AAC5D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,CAAC,MAAM,aAAa,CAAE;EAE1B,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,KAAK;EAC5C,MAAM,WAAW,qBAAqB,WAAW,EAAE,iBAAiB,CAAC;AACrE,MAAI,CAAC,SAAU;EAEf,MAAM,MACJ,QAAQ,SAAY,KAAK,KAAK,SAAS,KAAK,UAAU,KAAK;AAE7D,MAAI;GACF,MAAM,cAAc,MAAM,gBAAgB,UAAU,KAAK,gBAAgB;AACzE,OAAI,YAAa,SAAQ,YAAY,MAAM,YAAY;WAChD,OAAO;AACd,WAAQ,KACN,uCAAuC,SAAS,KAAK,IACrD,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;;;AAIL,QAAO;;;;;;;;;;;AAYT,SAAS,cACP,YACA,EAAE,WACF,SACA;AACA,MAAK,MAAM,UAAU,OAAO,OAAO,QAAQ,CACzC,MAAK,MAAM,SAAS,CAClB,OAAO,UAAU,UACjB,OAAO,UAAU,SAClB,CACC,MAAK,MAAM,YAAY,OAAO;AAC5B,MAAI,CAAC,SAAS,OAAQ;AACtB,OAAK,MAAM,aAAa,OAAO,KAAK,SAAS,OAAO,CAClD,UAAS,OAAO,aAAa,yBAAyB,MACpD,SAAS,OAAO,WACjB;;CAMT,MAAM,mBAA4C;EAChD,SACE;EACF,SAAS;EACT;EACA,aAAa;EACd;CAED,MAAM,aAAa,KAAK,UAAU,kBAAkB,MAAM,EAAE;AAE5D,KAAI,QAAQ,KACV,SAAQ,IAAI,WAAW;AAGzB,KAAI,QAAQ,OAAO;AACjB,KAAG,cAAc,YAAY,GAAG,WAAW,IAAI;AAC/C,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,aAAa,aAAa;YAE/B,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AAC3C,UAAQ,IAAI,gCAAgC;AAC5C,UAAQ,IAAI,qCAAqC;AACjD,UAAQ,IAAI,WAAW;AACvB,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;AAC3B,UAAQ,IAAI,WAAW;AACvB,UAAQ,IAAI,IAAI,OAAO,GAAG,CAAC;;;;;;;;;AAU/B,eAAe,eAAe,SAUZ;CAChB,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,kBAAkB,QAAQ,QAAQ,gBAAgB;CACxD,MAAM,aAAa,KAAK,QAAQ,KAAK,QAAQ,UAAU,sBAAsB;AAG7E,KAAI,CAAC,kBAAkB,YAAY,IAAI,EAAE;AACvC,UAAQ,MACN,uBAAuB,QAAQ,OAAO,2CACvC;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AACpC,UAAQ,IAAI,mCAAmC;AAC/C,MAAI,gBACF,SAAQ,KACN,oGACD;;CAKL,MAAM,aAAa,eAAe,IAAI;CACtC,IAAI,gBAAgC,EAAE;CACtC,IAAI,+BAAe,IAAI,KAAa;AAEpC,KAAI,YAAY;AACd,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;GACpC,MAAM,eAAe,KAAK,SAAS,KAAK,WAAW;AACnD,WAAQ,IAAI,sBAAsB,eAAe;;EAInD,MAAM,EAAE,MAAM,UADE,cAAc,OAAO,KAAK,IAAI,CAEpC,iBAAiB;EAC3B,MAAM,UAAU,GAAG,aAAa,YAAY,QAAQ;EAGpD,MAAM,OADM,MADC,WAAW,SAAS,OAAO,GAAG,KAAK,MAAM,KAAK,YACnC,QAAQ,CACf,MAAM;AAEvB,kBAAgB,aAAa,KAAK;AAClC,iBAAe,kBAAkB,KAAK;YAC7B,CAAC,QAAQ,UAAU,CAAC,QAAQ,KACrC,SAAQ,IACN,wCACA,uBAAuB,KAAK,KAAK,CAClC;CAIH,MAAM,aAAa,cAAc,QAC9B,MAAM,CAAC,EAAE,OAAO,WAAW,IAAI,IAAI,CAAC,EAAE,OAAO,WAAW,IAAI,CAC9D;CACD,MAAM,eAAe,cAAc,QAChC,MAAM,EAAE,OAAO,WAAW,IAAI,IAAI,EAAE,OAAO,WAAW,IAAI,CAC5D;CAGD,MAAM,UAA8C,EAAE;AAEtD,KAAI,QAAQ,YAAY;EACtB,MAAM,cAAc,KAAK,QAAQ,KAAK,QAAQ,WAAW;EACzD,MAAM,UAAU,QAAQ,eAAe;AACvC,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,+BAA+B,QAAQ,aAAa;AAElE,SAAO,OACL,SACA,MAAM,eAAe,aAAa,SAAS,gBAAgB,CAC5D;QACI;EACL,MAAM,cAAc,IAAI,IAAI,CAC1B,GAAG,uBACH,GAAG,WAAW,KAAK,MAAM,EAAE,OAAO,CACnC,CAAC;AACF,SAAO,OACL,SACA,MAAM,eAAe,KAAK,aAAa,gBAAgB,CACxD;;AAIH,KAAI,cAAc,aAAa,SAAS,GAAG;EAEzC,MAAM,eAAe,MAAM,qBACzB,cAFoB,KAAK,QAAQ,WAAW,EAI5C,KACA,gBACD;AACD,SAAO,OAAO,SAAS,aAAa;;CAKtC,MAAM,kBAA4B,QAAQ,kBACtC,CAAC,QAAQ,gBAAgB,GACzB,+BAA+B,QAAQ,MACrC,GAAG,WAAW,KAAK,KAAK,KAAK,EAAE,CAAC,CACjC;AACL,MAAK,MAAM,OAAO,iBAAiB;EACjC,MAAM,cAAc,KAAK,QAAQ,KAAK,IAAI;AAC1C,MAAI,CAAC,GAAG,WAAW,YAAY,CAAE;AACjC,MAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAC9B,SAAQ,IAAI,qCAAqC,MAAM;EAEzD,MAAM,aAAa,MAAM,wBACvB,aACA,KACA,gBACD;AACD,OAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,WAAW,CACpD,KAAI,CAAC,QAAQ,MAAO,SAAQ,QAAQ;;CAIxC,MAAM,cAAc,OAAO,KAAK,QAAQ,CAAC;AAEzC,KAAI,gBAAgB,GAAG;AACrB,MAAI,QAAQ,UAAU,QAAQ,MAAM;AAClC,iBAAc,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ;AACnD,OAAI,QAAQ,OAAQ;AACpB,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,IAAI,oBAAoB;AAChC,MAAI,QAAQ,WACV,SAAQ,IACN,kBAAkB,kBAAkB,iCAAiC,gBAAgB,cAAc,QAAQ,aAC5G;OACI;AACL,WAAQ,IACN,0EACD;AACD,WAAQ,IAAI,4CAA4C;;AAE1D,UAAQ,KAAK,EAAE;;CAMjB,MAAM,gBAAgB,aAAa,KAAK,QAAQ,WAAW,GAAG;CAC9D,MAAM,iBAA2B,EAAE;AAEnC,MAAK,MAAM,OAAO,eAAe;AAC/B,MAAI,CAAC,aAAa,IAAI,IAAI,KAAK,CAAE;EAEjC,MAAM,UAAU,IAAI,OAAO,WAAW,IAAI,IAAI,IAAI,OAAO,WAAW,IAAI;EACxE,IAAI;AAEJ,MAAI,SAAS;GAEX,MAAM,oBAAoB,KAAK,QAAQ,eAAe,IAAI,OAAO;AACjE,YAAS,OAAO,OAAO,QAAQ,CAAC,MAAM,MAAM;AAC1C,QAAI,CAAC,EAAE,QAAQ,WAAW,IAAI,CAAE,QAAO;AAEvC,WAD0B,KAAK,QAAQ,KAAK,EAAE,QAAQ,KAE9B,qBAAqB,EAAE,SAAS,IAAI;KAE5D;QAGF,UAAS,OAAO,OAAO,QAAQ,CAAC,MAC7B,MAAM,EAAE,YAAY,IAAI,UAAU,EAAE,SAAS,IAAI,aACnD;AAGH,MAAI,QAAQ;AACV,UAAO,qBAAqB;AAC5B,OAAI,OAAO,WAAY,gBAAe,KAAK,OAAO,KAAK;;;AAK3D,KAAI,QAAQ,gBAAgB;EAC1B,MAAM,gBAAgB,QAAQ,eAC3B,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,OAAO,QAAQ;AAClB,OAAK,MAAM,QAAQ,cACjB,KAAI,QAAQ,MACV,SAAQ,MAAM,qBAAqB;WAC1B,CAAC,QAAQ,OAClB,SAAQ,KACN,0CAA0C,KAAK,qCAChD;;AAMP,MAAK,MAAM,UAAU,OAAO,OAAO,QAAQ,CACzC,KACE,OAAO,sBACP,OAAO,aACP,OAAO,cAAc,KAErB,QAAO,qBAAqB;AAIhC,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,MAAM;AACpC,UAAQ,IAAI,WAAW,YAAY,aAAa;AAChD,OAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,QAAQ,EAAE;GACtD,MAAM,gBACJ,SAAS,UAAU,SAAS,SAAS,SAAS,UAAU,SAAS;GACnE,MAAM,eACJ,gBAAgB,IAAI,KAAK,cAAc,iBAAiB;GAC1D,MAAM,eAAe,SAAS,qBAAqB,iBAAiB;GACpE,MAAM,gBAAgB,SAAS,aAAa,kBAAkB;AAC9D,WAAQ,IACN,KAAK,SAAS,qBAAqB,MAAM,IAAI,GAAG,SAAS,YAAY,IAAI,KAAK,SAAS,SAAS,UAAU,eAAe,eAAe,gBACzI;;;AAKL,KAAI,CAAC,QAAQ,UAAU,eAAe,SAAS,EAC7C,MAAK,MAAM,QAAQ,eACjB,SAAQ,KACN,oBAAoB,KAAK,uEAC1B;AAKL,KAAI,CAAC,QAAQ,UAAU,GAAG,WAAW,WAAW,CAC9C,KAAI;EACF,MAAM,SAAS,GAAG,aAAa,YAAY,QAAQ;EACnD,MAAM,cAAc,KAAK,MAAM,OAAO;EACtC,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,YAAY,WAAW,EAAE,CAAC,CAAC;EAChE,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC;AAC9C,OAAK,MAAM,QAAQ,UAAU;AAC3B,OAAI,SAAS,IAAI,KAAK,CAAE;GACxB,MAAM,YAAY,YAAY,UAAU;AACxC,OAAI,CAAC,aAAa,OAAO,cAAc,SAAU;GACjD,MAAM,UAAoB,EAAE;AAC5B,QAAK,MAAM,OAAO,CAChB,GAAI,UAAU,WAAW,YAAY,EAAE,EACvC,GAAI,UAAU,WAAW,YAAY,EAAE,CACxC,CACC,KAAI,KAAK,QACP;SAAK,MAAM,SAAS,OAAO,OAAO,IAAI,OAAO,CAC3C,KAAI,OAAO,IAAK,SAAQ,KAAK,MAAM,IAAI;;GAI7C,MAAM,UACJ,QAAQ,SAAS,IACb,qDAAqD,QAAQ,KAAK,KAAK,KACvE;AACN,WAAQ,KAAK,oBAAoB,KAAK,gBAAgB,UAAU;;SAE5D;AAKV,eAAc,YAAY,EAAE,SAAS,EAAE,QAAQ;;AAcjD,MAAa,qBAAqB,IAAI,QAAQ,OAAO,CAClD,YACC,yEACD,CACA,OAAO,eAAe,0BAA0B,CAChD,OACC,uBACA,oDACD,CACA,OACC,gBACA,+EACD,CACA,OACC,6BACA,qFACD,CACA,OACC,wBACA,6FACD,CACA,OACC,yBACA,0FACD,CACA,OACC,8BACA,iFACD,CACA,OACC,uBACA,wFACD,CACA,OAAO,UAAU,oCAAoC,CACrD,YACC,SACA;;;;;;;iCAQD,CACA,QAAQ,SACP,eAAe,KAAK,CAAC,OAAO,QAAQ;AAClC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}

package/dist/cli/commands/registry/add.js

@@ -1,3 +1,4 @@
+import { SCOPE_BY_TYPE } from "../../../schemas/manifest.js";
 import { detectPackageManager } from "../../package-manager.js";
 import { JS_IDENTIFIER, REGISTRY_REPO, resolveToken } from "./constants.js";
 import { fetchRegistryItem, fetchVerifiedNames, isValidItemName, stripNamespace } from "./client.js";
@@ -5,10 +6,10 @@ import { extractRequirements, renderRequirements } from "./requirements.js";
 import { buildConfigPlan, collectBindingValueNeeds, planHasContent } from "./config-plan.js";
 import { reportConfigWrite, validateBundle, writeConfig } from "./config-writer.js";
 import { parseEnv } from "./env-reconcile.js";
+import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { Command } from "commander";
-import { spawnSync } from "node:child_process";
 import process from "node:process";
 import pc from "picocolors";
 
@@ -412,19 +413,10 @@ async function runAdd(refs, opts) {
 * extension). Warn when an added plugin's resource type is known to need one,
 * so the user adds it before deploy.
 */
-/** Resource types known to require a user_api_scope, and the scope each needs. */
-const SCOPE_BY_RESOURCE_TYPE = {
-	genie_space: "dashboards.genie",
-	serving_endpoint: "serving.serving-endpoints",
-	volume: "files.files"
-};
 /** Returns the user_api_scopes implied by a set of resource rows (deduped). */
 function scopesForResources(rows) {
 	const needed = /* @__PURE__ */ new Map();
-	for (const row of rows) {
-		const scope = SCOPE_BY_RESOURCE_TYPE[row.type];
-		if (scope) needed.set(row.type, scope);
-	}
+	for (const row of rows) if (Object.hasOwn(SCOPE_BY_TYPE, row.type)) needed.set(row.type, SCOPE_BY_TYPE[row.type]);
 	return needed;
 }
 function warnScopeNeeding(rows) {