@droposs/plugin-cli 0.6.1 → 0.7.0

package/bin/drop-plugin.js

@@ -7,6 +7,7 @@ import {
   initPlugin,
   validateManifest,
   verifyPlugin,
+  startDevServer,
 } from "../dist/index.js";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
@@ -52,7 +53,11 @@ function printUsage() {
   console.log(`Drop Plugin CLI (drop-plugin)
 
 Usage:
-  drop-plugin init [dir]         Initialize a new plugin from starter template
+  drop-plugin init [dir]         Initialize a new plugin from template
+                                 (--template <starter|client-ui|metadata|store|runner|fullstack>)
+                                 (--id <id> --name <name> --author <author>)
+  drop-plugin dev [dir]          Start hot-reloading dev server for live Drop testing
+                                 (--port <number>)
   drop-plugin build [dir]        Bundle server/client entry points with esbuild and sign
                                  (--out-manifest <path> keeps the source manifest clean)
   drop-plugin sign [dir]         Calculate SHA-256 digests and sign drop-plugin.json
@@ -85,7 +90,7 @@ async function main() {
   switch (command) {
     case "sign": {
       const outManifest = readFlagValue(args, "--out-manifest");
-      const dir = positionalArg(args, [outManifest]) || ".";
+      const dir = positionalArg(args, [outManifest].filter(Boolean)) || ".";
       const res = await signPlugin(dir, undefined, true, { outManifest });
       console.log(
         `Signed bundle at ${dir}: ${res.fileCount} files verified (signature: ${res.signed ? "yes" : "no"})` +
@@ -104,21 +109,40 @@ async function main() {
     }
     case "build": {
       const outManifest = readFlagValue(args, "--out-manifest");
-      const dir = positionalArg(args, [outManifest]) || ".";
+      const dir = positionalArg(args, [outManifest].filter(Boolean)) || ".";
       const res = await buildPlugin(dir, { outManifest });
       console.log(
         `Built plugin at ${dir} (server: ${res.serverBuilt ? "yes" : "no"}, client: ${res.clientBuilt ? "yes" : "no"})`,
       );
       break;
     }
+    case "dev": {
+      const portStr = readFlagValue(args, "--port");
+      const port = portStr ? parseInt(portStr, 10) : undefined;
+      const dir = positionalArg(args, [portStr].filter(Boolean)) || ".";
+      const server = await startDevServer(dir, { port });
+      console.log(`Drop plugin dev server running at ${server.url}`);
+      console.log(`Serving manifest: ${server.manifestUrl}`);
+      console.log(`Press Ctrl+C to stop.`);
+      await new Promise(() => {});
+      break;
+    }
     case "test": {
       const dir = args[0] || ".";
       await testPlugin(dir);
       break;
     }
     case "init": {
-      const dir = args[0] || "my-drop-plugin";
-      const res = await initPlugin(dir);
+      const template = readFlagValue(args, "--template");
+      const id = readFlagValue(args, "--id");
+      const name = readFlagValue(args, "--name");
+      const author = readFlagValue(args, "--author");
+      const dir =
+        positionalArg(
+          args,
+          [template, id, name, author].filter(Boolean),
+        ) || (id ? id : "my-drop-plugin");
+      const res = await initPlugin(dir, { template, id, name, author });
       console.log(
         `Initialized new Drop plugin '${res.id}' at ${res.targetPath}`,
       );

package/dist/builder.d.ts

@@ -1,3 +1,4 @@
+import * as esbuild from "esbuild";
 export interface BuildOptions {
     minify?: boolean;
     sourcemap?: boolean;
@@ -5,8 +6,16 @@ export interface BuildOptions {
     signingKey?: string;
     /** Write derived manifest fields here instead of the source manifest. */
     outManifest?: string;
+    /** Watch for changes and rebuild incrementally. */
+    watch?: boolean;
+    /** Callback invoked on incremental rebuild completion (in watch mode). */
+    onRebuild?: (result: {
+        error?: Error;
+    }) => void;
 }
-export declare function buildPlugin(targetDir?: string, options?: BuildOptions): Promise<{
+export interface BuildResult {
     serverBuilt: boolean;
     clientBuilt: boolean;
-}>;
+    contexts?: esbuild.BuildContext[];
+}
+export declare function buildPlugin(targetDir?: string, options?: BuildOptions): Promise<BuildResult>;

package/dist/builder.js

@@ -1,13 +1,53 @@
 import * as esbuild from "esbuild";
 import path from "node:path";
-import { readFile, stat } from "node:fs/promises";
+import { readFile, writeFile, stat } from "node:fs/promises";
+import vue from "unplugin-vue/esbuild";
 import { signPlugin } from "./signer.js";
+/**
+ * Global shim so bundled Vue SFCs and imports from "vue" resolve to globalThis.Vue (set by Drop Desktop)
+ * at runtime without requiring browser import maps.
+ */
+const vueGlobalShimPlugin = {
+    name: "vue-global-shim",
+    setup(build) {
+        build.onResolve({ filter: /^vue$/ }, () => {
+            return { path: "virtual:vue", namespace: "vue-shim" };
+        });
+        build.onLoad({ filter: /.*/, namespace: "vue-shim" }, () => {
+            return {
+                contents: `
+          const v = globalThis.Vue || (typeof window !== "undefined" ? window.Vue : {});
+          export default v;
+          export const {
+            ref, reactive, computed, watch, watchEffect,
+            onMounted, onUnmounted, onUpdated, onBeforeMount, onBeforeUnmount,
+            h, defineComponent, nextTick, shallowRef, shallowReactive,
+            toRef, toRefs, isRef, isReactive, unref,
+            openBlock, createElementBlock, createBlock, createVNode, createCommentVNode,
+            createTextVNode, createElementVNode, toDisplayString, withDirectives,
+            vShow, vModelText, vModelCheckbox, vModelRadio, vModelSelect,
+            Fragment, Static, Comment, Text, Teleport, Suspense, KeepAlive,
+            renderSlot, resolveComponent, resolveDirective, normalizeClass, normalizeStyle,
+            withCtx, withModifiers, withKeys, renderList, pushScopeId, popScopeId
+          } = new Proxy(v, {
+            get: (target, prop) => {
+              const root = globalThis.Vue || (typeof window !== "undefined" ? window.Vue : undefined);
+              return root ? root[prop] : target[prop];
+            }
+          });
+        `,
+                loader: "js",
+            };
+        });
+    },
+};
 export async function buildPlugin(targetDir = ".", options = {}) {
     const dir = path.resolve(process.cwd(), targetDir);
     const manifestPath = path.join(dir, "drop-plugin.json");
     const manifest = JSON.parse(await readFile(manifestPath, "utf-8"));
     let serverBuilt = false;
     let clientBuilt = false;
+    const contexts = [];
     // 1. Build Server Entry if source exists
     const serverSourceCandidates = [
         manifest.server?.source,
@@ -25,7 +65,7 @@ export async function buildPlugin(targetDir = ".", options = {}) {
     }
     const serverOutFile = path.resolve(dir, manifest.server?.entry ?? manifest.entry ?? "dist/src/index.js");
     if (serverEntrySource) {
-        await esbuild.build({
+        const serverConfig = {
             entryPoints: [serverEntrySource],
             outfile: serverOutFile,
             bundle: true,
@@ -41,7 +81,15 @@ export async function buildPlugin(targetDir = ".", options = {}) {
                 "h3",
                 "pino",
             ],
-        });
+        };
+        if (options.watch) {
+            const serverCtx = await esbuild.context(serverConfig);
+            await serverCtx.watch();
+            contexts.push(serverCtx);
+        }
+        else {
+            await esbuild.build(serverConfig);
+        }
         serverBuilt = true;
     }
     // 2. Build Client Entry if source exists
@@ -60,7 +108,14 @@ export async function buildPlugin(targetDir = ".", options = {}) {
     }
     const clientOutFile = path.resolve(dir, manifest.client?.entry ?? manifest.clientEntry ?? "dist/src/client.js");
     if (clientEntrySource) {
-        await esbuild.build({
+        const clientPlugins = [
+            vueGlobalShimPlugin,
+            vue({
+                isProduction: true,
+                sourceMap: false,
+            }),
+        ];
+        const clientConfig = {
             entryPoints: [clientEntrySource],
             outfile: clientOutFile,
             bundle: true,
@@ -69,14 +124,33 @@ export async function buildPlugin(targetDir = ".", options = {}) {
             format: "esm",
             sourcemap: options.sourcemap ?? true,
             minify: options.minify ?? false,
+            plugins: clientPlugins,
             external: [
-                "vue",
                 "@droposs/plugin-sdk",
                 "@droposs/plugin-sdk",
                 "@drop/plugin-sdk",
             ],
-        });
+        };
+        if (options.watch) {
+            const clientCtx = await esbuild.context(clientConfig);
+            await clientCtx.watch();
+            contexts.push(clientCtx);
+        }
+        else {
+            await esbuild.build(clientConfig);
+        }
         clientBuilt = true;
+        // Check if CSS was emitted and update manifest.client.css if necessary
+        const clientCssCandidate = clientOutFile.replace(/\.[^.]+$/, ".css");
+        if (await stat(clientCssCandidate).catch(() => null)) {
+            const relCss = path
+                .relative(dir, clientCssCandidate)
+                .replaceAll("\\", "/");
+            if (manifest.client && manifest.client.css !== relCss) {
+                manifest.client.css = relCss;
+                await writeFile(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+            }
+        }
     }
     // 3. Automatically re-sign the plugin bundle after building
     if (options.sign !== false) {
@@ -84,5 +158,5 @@ export async function buildPlugin(targetDir = ".", options = {}) {
             outManifest: options.outManifest,
         });
     }
-    return { serverBuilt, clientBuilt };
+    return { serverBuilt, clientBuilt, contexts: contexts.length > 0 ? contexts : undefined };
 }

package/dist/devServer.d.ts

@@ -0,0 +1,15 @@
+import http from "node:http";
+export interface DevServerOptions {
+    port?: number;
+    host?: string;
+    sign?: boolean;
+}
+export interface DevServerInstance {
+    server: http.Server;
+    port: number;
+    url: string;
+    manifestUrl: string;
+    close: () => Promise<void>;
+    stop: () => Promise<void>;
+}
+export declare function startDevServer(targetDir?: string, options?: DevServerOptions): Promise<DevServerInstance>;

package/dist/devServer.js

@@ -0,0 +1,94 @@
+import http from "node:http";
+import path from "node:path";
+import { readFile, stat } from "node:fs/promises";
+import { buildPlugin } from "./builder.js";
+const MIME_TYPES = {
+    ".js": "application/javascript",
+    ".mjs": "application/javascript",
+    ".css": "text/css",
+    ".json": "application/json",
+    ".html": "text/html",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".svg": "image/svg+xml",
+};
+export async function startDevServer(targetDir = ".", options = {}) {
+    const dir = path.resolve(process.cwd(), targetDir);
+    const manifestPath = path.join(dir, "drop-plugin.json");
+    const manifest = JSON.parse(await readFile(manifestPath, "utf-8"));
+    const port = options.port ?? 4567;
+    const host = options.host ?? "localhost";
+    // 1. Start incremental watch build
+    const buildResult = await buildPlugin(dir, {
+        watch: true,
+        sign: options.sign ?? true,
+    });
+    // 2. Start HTTP static server with CORS
+    const server = http.createServer(async (req, res) => {
+        // CORS headers for Drop Desktop webview
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.setHeader("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS");
+        res.setHeader("Access-Control-Allow-Headers", "*");
+        if (req.method === "OPTIONS") {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        const urlPath = (req.url || "/").split("?")[0] || "/";
+        const filePath = path.join(dir, urlPath);
+        // Prevent directory traversal
+        const rel = path.relative(dir, filePath);
+        if (rel.startsWith("..") || path.isAbsolute(rel)) {
+            res.writeHead(403);
+            res.end("Forbidden");
+            return;
+        }
+        const fileStat = await stat(filePath).catch(() => null);
+        if (!fileStat || fileStat.isDirectory()) {
+            res.writeHead(404);
+            res.end("File not found");
+            return;
+        }
+        const ext = path.extname(filePath).toLowerCase();
+        const contentType = MIME_TYPES[ext] || "application/octet-stream";
+        try {
+            const content = await readFile(filePath);
+            res.writeHead(200, { "Content-Type": contentType });
+            res.end(content);
+        }
+        catch {
+            res.writeHead(500);
+            res.end("Internal Server Error");
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.listen(port, host, () => resolve());
+        server.on("error", reject);
+    });
+    const address = server.address();
+    const actualPort = typeof address === "object" && address ? address.port : port;
+    const url = `http://${host}:${actualPort}`;
+    const manifestUrl = `${url}/drop-plugin.json`;
+    const clientEntry = manifest.client?.entry ?? "dist/src/client.js";
+    console.log(`[drop-plugin] Dev server running at ${url}/`);
+    console.log(`[drop-plugin] Client bundle URL: ${url}/${clientEntry}`);
+    console.log(`[drop-plugin] In Drop Desktop, test this plugin via Extension Settings -> Load Dev Plugin:`);
+    console.log(`              ${url}/${clientEntry}`);
+    console.log(`[drop-plugin] Watching for file changes... (Press Ctrl+C to stop)`);
+    const close = async () => {
+        if (buildResult.contexts) {
+            for (const ctx of buildResult.contexts) {
+                await ctx.dispose();
+            }
+        }
+        await new Promise((resolve) => server.close(() => resolve()));
+    };
+    return {
+        server,
+        port: actualPort,
+        url,
+        manifestUrl,
+        close,
+        stop: close,
+    };
+}

package/dist/index.d.ts

@@ -2,3 +2,4 @@ export * from "./signer.js";
 export * from "./builder.js";
 export * from "./testRunner.js";
 export * from "./scaffolder.js";
+export * from "./devServer.js";

package/dist/index.js

@@ -2,3 +2,4 @@ export * from "./signer.js";
 export * from "./builder.js";
 export * from "./testRunner.js";
 export * from "./scaffolder.js";
+export * from "./devServer.js";

package/dist/scaffolder.d.ts

@@ -1,8 +1,18 @@
+export type TemplateType = "starter" | "client-ui" | "metadata" | "store" | "runner" | "fullstack";
 export interface InitOptions {
     id?: string;
     name?: string;
     author?: string;
+    template?: string;
 }
+/**
+ * Rewrites a freshly copied template so its `@drop-oss` monorepo specifiers
+ * and `workspace:*` dependencies point at the scope/version declared in the
+ * template's `.sdk-scope.json`. Without this a scaffolded repo keeps
+ * `workspace:*` and cannot install outside the SDK monorepo.
+ */
+export declare function applySdkScope(targetPath: string): Promise<boolean>;
+export declare function resolveTemplateFolder(templateName?: string): string;
 export declare function initPlugin(targetDir: string, options?: InitOptions): Promise<{
     targetPath: string;
     id: string;

package/dist/scaffolder.js

@@ -1,12 +1,163 @@
 import path from "node:path";
-import { cp, mkdir, readFile, writeFile, stat } from "node:fs/promises";
+import { cp, mkdir, readFile, writeFile, stat, readdir, realpath, } from "node:fs/promises";
+/** npm scopes the templates may resolve the SDK/CLI from. */
+const SDK_SCOPES = ["@drop-oss", "@droposs", "@drop"];
+const SKIP_DIRS = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "dist-package",
+    "dist-packages",
+]);
+const TEXT_EXT = new Set([
+    ".ts",
+    ".tsx",
+    ".js",
+    ".mjs",
+    ".cjs",
+    ".json",
+    ".md",
+    ".yml",
+    ".yaml",
+]);
+function parseSdkScope(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const { sdk, sdkVersion, cliVersion } = parsed;
+    if (typeof sdk !== "string" ||
+        typeof sdkVersion !== "string" ||
+        typeof cliVersion !== "string" ||
+        !SDK_SCOPES.includes(sdk)) {
+        return null;
+    }
+    return { sdk, sdkVersion, cliVersion };
+}
+function rewriteSpecifiers(text, scope) {
+    let out = text;
+    for (const other of SDK_SCOPES) {
+        if (other === scope)
+            continue;
+        out = out
+            .replaceAll(`${other}/plugin-sdk`, `${scope}/plugin-sdk`)
+            .replaceAll(`${other}/plugin-cli`, `${scope}/plugin-cli`);
+    }
+    return out;
+}
+function rewritePackageDeps(text, config) {
+    let pkg;
+    try {
+        pkg = JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+    for (const sectionName of [
+        "dependencies",
+        "devDependencies",
+        "peerDependencies",
+        "optionalDependencies",
+    ]) {
+        const section = pkg[sectionName];
+        if (!section)
+            continue;
+        for (const dep of Object.keys(section)) {
+            const kind = dep.endsWith("/plugin-sdk")
+                ? "plugin-sdk"
+                : dep.endsWith("/plugin-cli")
+                    ? "plugin-cli"
+                    : null;
+            if (!kind)
+                continue;
+            delete section[dep];
+            section[`${config.sdk}/${kind}`] =
+                kind === "plugin-sdk" ? config.sdkVersion : config.cliVersion;
+        }
+    }
+    return JSON.stringify(pkg, null, 2) + "\n";
+}
+async function walkFiles(dir, files = [], visited = new Set()) {
+    const real = await realpath(dir).catch(() => dir);
+    if (visited.has(real))
+        return files;
+    visited.add(real);
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        if (entry.isSymbolicLink())
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            await walkFiles(full, files, visited);
+        else
+            files.push(full);
+    }
+    return files;
+}
+/**
+ * Rewrites a freshly copied template so its `@drop-oss` monorepo specifiers
+ * and `workspace:*` dependencies point at the scope/version declared in the
+ * template's `.sdk-scope.json`. Without this a scaffolded repo keeps
+ * `workspace:*` and cannot install outside the SDK monorepo.
+ */
+export async function applySdkScope(targetPath) {
+    const raw = await readFile(path.join(targetPath, ".sdk-scope.json"), "utf-8").catch(() => null);
+    if (raw === null)
+        return false;
+    const config = parseSdkScope(raw);
+    if (!config)
+        return false;
+    for (const file of await walkFiles(targetPath)) {
+        if (path.basename(file).match(/lock\.(json|yaml|lockb)$/))
+            continue;
+        if (!TEXT_EXT.has(path.extname(file)))
+            continue;
+        const before = await readFile(file, "utf-8");
+        let after = rewriteSpecifiers(before, config.sdk);
+        if (path.basename(file) === "package.json") {
+            after = rewritePackageDeps(after, config);
+        }
+        if (after !== before)
+            await writeFile(file, after);
+    }
+    return true;
+}
+export function resolveTemplateFolder(templateName = "starter") {
+    const norm = templateName.replace(/^template-/, "").toLowerCase();
+    switch (norm) {
+        case "client-ui":
+        case "ui":
+        case "client":
+            return "template-client-ui";
+        case "metadata":
+            return "template-metadata";
+        case "store":
+            return "template-store";
+        case "runner":
+            return "template-runner";
+        case "fullstack":
+        case "full":
+            return "template-fullstack";
+        case "starter":
+        case "default":
+            return "starter-plugin";
+        default:
+            throw new Error(`Unknown template "${templateName}". Available templates: starter, client-ui, metadata, store, runner, fullstack`);
+    }
+}
 export async function initPlugin(targetDir, options = {}) {
     const targetPath = path.resolve(process.cwd(), targetDir);
     await mkdir(targetPath, { recursive: true });
+    const folder = resolveTemplateFolder(options.template);
     const candidates = [
-        path.resolve(path.dirname(new URL(import.meta.url).pathname), "../../../templates/starter-plugin"),
-        path.resolve(path.dirname(new URL(import.meta.url).pathname), "../templates/starter-plugin"),
-        path.resolve(process.cwd(), "templates/starter-plugin"),
+        path.resolve(path.dirname(new URL(import.meta.url).pathname), "../../../templates", folder),
+        path.resolve(path.dirname(new URL(import.meta.url).pathname), "../../templates", folder),
+        path.resolve(path.dirname(new URL(import.meta.url).pathname), "../templates", folder),
+        path.resolve(process.cwd(), "templates", folder),
     ];
     let templateDir = null;
     for (const cand of candidates) {
@@ -16,7 +167,7 @@ export async function initPlugin(targetDir, options = {}) {
         }
     }
     if (!templateDir) {
-        throw new Error("Starter plugin template directory not found");
+        throw new Error(`Plugin template directory for "${folder}" not found`);
     }
     await cp(templateDir, targetPath, {
         recursive: true,
@@ -25,6 +176,9 @@ export async function initPlugin(targetDir, options = {}) {
             return basename !== "node_modules" && basename !== "dist";
         },
     });
+    // Point the scaffolded repo at the configured npm scope/version instead of
+    // the monorepo's `workspace:*` links.
+    await applySdkScope(targetPath);
     const pluginId = options.id ||
         path
             .basename(targetPath)

package/dist/signer.d.ts

@@ -1,4 +1,4 @@
-import { SIGNATURE_VERSION } from "@drop-oss/plugin-sdk";
+import { SIGNATURE_VERSION, type PluginManifest } from "@drop-oss/plugin-sdk";
 /** Current signature scheme; re-exported for backwards compatibility. */
 export { SIGNATURE_VERSION };
 /**
@@ -39,6 +39,13 @@ export interface VerifyResult {
 export declare function verifyPlugin(targetDir: string, signingKey?: string, options?: {
     allowUnsigned?: boolean;
 }): Promise<VerifyResult>;
+/**
+ * Validate the `client.sidecars` declaration against the bundle contents:
+ * each target path must resolve inside the bundle, point to a present regular
+ * file covered by the `files` checksums, and cite a matching SHA-256 of the
+ * binary. Every sidecar name must be allowlisted in `client.commands`, and
+ */
+export declare function verifySidecars(bundleDir: string, manifest: PluginManifest & Record<string, unknown>, files: string[], present: Set<string>, errors: string[]): Promise<void>;
 export declare function packPlugin(targetDir: string, outputDir?: string): Promise<{
     packagePath: string;
     id: string;

package/dist/signer.js

@@ -91,7 +91,6 @@ let cachedErrors = [];
 export async function validateManifest(manifest) {
     if (!cachedValidator) {
         const schema = await loadSchema();
-        // @ts-ignore
         const AjvClass = Ajv.default ?? Ajv;
         const ajv = new AjvClass({ allErrors: true, strict: false });
         const compiled = ajv.compile(schema);
@@ -189,6 +188,13 @@ export async function signPlugin(targetDir, signingKey, validate = true, options
         if (!validation.valid) {
             throw new Error(`Manifest validation failed against schema:\n  ${validation.errors.join("\n  ")}`);
         }
+        const files = await listFiles(bundleDir);
+        const present = new Set(files);
+        const sidecarErrors = [];
+        await verifySidecars(bundleDir, manifest, files, present, sidecarErrors);
+        if (sidecarErrors.length > 0) {
+            throw new Error(`Sidecar validation failed:\n  ${sidecarErrors.join("\n  ")}`);
+        }
     }
     const derived = await deriveManifest(bundleDir, manifest, signingKey);
     const outPath = options.outManifest
@@ -246,6 +252,7 @@ export async function verifyPlugin(targetDir, signingKey, options = {}) {
         errors.push("bundle contains multiple code files but no 'files' checksums; refusing unverified imports");
     }
     const entry = manifest.entry ?? manifest.server?.entry ?? manifest.client?.entry;
+    await verifySidecars(bundleDir, manifest, files, present, errors);
     if (entry) {
         const entryPath = path.resolve(bundleDir, entry);
         if (!isInside(bundleDir, entryPath)) {
@@ -320,6 +327,72 @@ async function resolveSignedPayload(bundleDir, manifest, filesAggregate, entry)
         error: "legacy signature has neither file checksums nor an entry checksum",
     };
 }
+/**
+ * Validate the `client.sidecars` declaration against the bundle contents:
+ * each target path must resolve inside the bundle, point to a present regular
+ * file covered by the `files` checksums, and cite a matching SHA-256 of the
+ * binary. Every sidecar name must be allowlisted in `client.commands`, and
+ */
+export async function verifySidecars(bundleDir, manifest, files, present, errors) {
+    const sidecars = manifest.client?.sidecars;
+    if (sidecars === undefined)
+        return;
+    if (!Array.isArray(sidecars) || sidecars.length === 0) {
+        errors.push("client.sidecars must be a non-empty array when declared");
+        return;
+    }
+    const commands = new Set(Array.isArray(manifest.client?.commands) ? manifest.client.commands : []);
+    for (const [idx, sidecar] of sidecars.entries()) {
+        const label = `client.sidecars[${idx}]`;
+        if (typeof sidecar !== "object" ||
+            sidecar === null ||
+            typeof sidecar.name !== "string" ||
+            !Array.isArray(sidecar.targets)) {
+            errors.push(`${label}: expected { name: string, targets: array }`);
+            continue;
+        }
+        const { name, targets } = sidecar;
+        if (!commands.has(name)) {
+            errors.push(`${label}: sidecar name '${name}' must be allowlisted in client.commands`);
+        }
+        const seenTargets = new Set();
+        for (const [tIdx, target] of targets.entries()) {
+            const tLabel = `${label}.targets[${tIdx}]`;
+            if (!target || typeof target !== "object") {
+                errors.push(`${tLabel}: expected target object`);
+                continue;
+            }
+            if (typeof target.os !== "string" || typeof target.arch !== "string") {
+                errors.push(`${tLabel}: expected string os and arch`);
+                continue;
+            }
+            const key = `${target.os}-${target.arch}`;
+            if (seenTargets.has(key)) {
+                errors.push(`${tLabel}: duplicate target '${key}' (only one binary per os+arch for sidecar '${name}')`);
+                continue;
+            }
+            seenTargets.add(key);
+            if (typeof target.path !== "string" ||
+                path.isAbsolute(target.path) ||
+                !isInside(bundleDir, path.resolve(bundleDir, target.path))) {
+                errors.push(`${tLabel}: path must be a bundle-relative path`);
+                continue;
+            }
+            if (isBundleCodeFile(target.path)) {
+                errors.push(`${tLabel}: 'sidecars' paths must not be JavaScript code files`);
+                continue;
+            }
+            if (!present.has(target.path)) {
+                errors.push(`${tLabel}: declared sidecar file missing: ${target.path}`);
+                continue;
+            }
+            const digest = sha256Hex(await readFile(path.join(bundleDir, target.path)));
+            if (target.sha256 !== digest) {
+                errors.push(`${tLabel}: sha256 mismatch for ${target.path} (declared ${target.sha256}, actual ${digest})`);
+            }
+        }
+    }
+}
 export async function packPlugin(targetDir, outputDir) {
     const resolvedPath = path.resolve(process.cwd(), targetDir);
     const bundleDir = await realpath(resolvedPath).catch(() => null);
@@ -332,6 +405,13 @@ export async function packPlugin(targetDir, outputDir) {
     if (!validation.valid) {
         throw new Error(`Manifest validation failed against schema:\n  ${validation.errors.join("\n  ")}`);
     }
+    const files = await listFiles(bundleDir);
+    const present = new Set(files);
+    const sidecarErrors = [];
+    await verifySidecars(bundleDir, rawManifest, files, present, sidecarErrors);
+    if (sidecarErrors.length > 0) {
+        throw new Error(`Sidecar validation failed:\n  ${sidecarErrors.join("\n  ")}`);
+    }
     // Derive the signed manifest in memory: packing must not dirty the source
     // tree, the derived fields live in the archive only.
     const { manifest } = await deriveManifest(bundleDir, rawManifest);
@@ -344,7 +424,6 @@ export async function packPlugin(targetDir, outputDir) {
         ? path.resolve(process.cwd(), outputDir)
         : path.join(bundleDir, "dist-package");
     await mkdir(outDir, { recursive: true });
-    const files = await listFiles(bundleDir);
     const bundleMap = {};
     for (const rel of files) {
         const content = await readFile(path.join(bundleDir, rel));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@droposs/plugin-cli",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Drop Plugin build, test, signing, and packaging CLI for Drop OSS",
   "type": "module",
   "bin": {
@@ -50,6 +50,8 @@
   "dependencies": {
     "ajv": "^8.20.0",
     "esbuild": "^0.28.2",
-    "@droposs/plugin-sdk": "0.6.1"
+    "unplugin-vue": "^8.0.0",
+    "vue": "^3.5.42",
+    "@droposs/plugin-sdk": "0.7.0"
   }
 }