@mondaydotcomorg/z2h-cli 0.1.0 → 0.1.1

package/dist/esm/shadow/__tests__/consumer-pkg.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-pkg.test.d.ts","sourceRoot":"","sources":["../../../../src/shadow/__tests__/consumer-pkg.test.ts"],"names":[],"mappings":""}

package/dist/esm/shadow/__tests__/merge-package-json.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=merge-package-json.test.d.ts.map

package/dist/esm/shadow/__tests__/merge-package-json.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-package-json.test.d.ts","sourceRoot":"","sources":["../../../../src/shadow/__tests__/merge-package-json.test.ts"],"names":[],"mappings":""}

package/dist/esm/shadow/consumer-pkg.d.ts

@@ -1,21 +1,11 @@
 import type { ConsumerPkg } from '../types';
 /**
- * Return the consumer's `workspaces` field extended with `.zth`. Handles
- * all three shapes: missing, array form, or object form (`{ packages }`).
- * Always extends — never replaces the user's existing entries.
- */
-export declare function ensureConsumerWorkspaces(pkg: ConsumerPkg): {
-    changed: boolean;
-    workspaces: ConsumerPkg['workspaces'];
-};
-/**
- * Idempotently reshape the consumer's package.json so that:
- *  - it is marked `"private": true`
- *  - `.zth` is declared as a yarn workspace member (yarn will hoist)
- *  - the protected runtime deps are present at compatible versions
- *  - the protected dev deps are present at compatible versions
+ * The consumer pkg is a thin manifest. Z2H apps live inside a yarn
+ * workspace at `~/zth-projects/`; runtime and dev deps come from the
+ * workspace root, hoisted into a single `node_modules/`.
  *
- * Always extends — never overrides existing fields.
+ * The only thing this file enforces today is `private: true` — apps must
+ * never accidentally publish to npm.
  */
 export declare function ensureConsumerPkg(pkgPath: string, pkg: ConsumerPkg): Promise<{
     changed: boolean;

package/dist/esm/shadow/consumer-pkg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumer-pkg.d.ts","sourceRoot":"","sources":["../../../src/shadow/consumer-pkg.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,GAAG;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;CACvC,CAsBA;AAqBD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,WAAW,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC,CAgCjD"}
+{"version":3,"file":"consumer-pkg.d.ts","sourceRoot":"","sources":["../../../src/shadow/consumer-pkg.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,WAAW,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC,CAOjD"}

package/dist/esm/shadow/consumer-pkg.mjs

@@ -1,81 +1,20 @@
 import { writeJson } from 'fs-extra';
-import { SHADOW_DIR_NAME, PROTECTED_DEPS, PROTECTED_DEV_DEPS } from '../constants.mjs';
 
 /**
- * Return the consumer's `workspaces` field extended with `.zth`. Handles
- * all three shapes: missing, array form, or object form (`{ packages }`).
- * Always extends — never replaces the user's existing entries.
- */
-function ensureConsumerWorkspaces(pkg) {
-    const { workspaces } = pkg;
-    if (Array.isArray(workspaces)) {
-        if (workspaces.includes(SHADOW_DIR_NAME)) {
-            return { changed: false, workspaces };
-        }
-        return { changed: true, workspaces: [...workspaces, SHADOW_DIR_NAME] };
-    }
-    if (workspaces && typeof workspaces === 'object') {
-        const pkgs = workspaces.packages ?? [];
-        if (pkgs.includes(SHADOW_DIR_NAME)) {
-            return { changed: false, workspaces };
-        }
-        return {
-            changed: true,
-            workspaces: { ...workspaces, packages: [...pkgs, SHADOW_DIR_NAME] },
-        };
-    }
-    return { changed: true, workspaces: [SHADOW_DIR_NAME] };
-}
-/**
- * Extend a deps map with the protected entries; only fills in missing ones,
- * never overrides versions the consumer already pinned.
- */
-function applyProtected(current, protectedMap) {
-    const next = { ...(current ?? {}) };
-    let changed = false;
-    for (const [name, version] of Object.entries(protectedMap)) {
-        if (!next[name]) {
-            next[name] = version;
-            changed = true;
-        }
-    }
-    return { changed, next };
-}
-/**
- * Idempotently reshape the consumer's package.json so that:
- *  - it is marked `"private": true`
- *  - `.zth` is declared as a yarn workspace member (yarn will hoist)
- *  - the protected runtime deps are present at compatible versions
- *  - the protected dev deps are present at compatible versions
+ * The consumer pkg is a thin manifest. Z2H apps live inside a yarn
+ * workspace at `~/zth-projects/`; runtime and dev deps come from the
+ * workspace root, hoisted into a single `node_modules/`.
  *
- * Always extends — never overrides existing fields.
+ * The only thing this file enforces today is `private: true` — apps must
+ * never accidentally publish to npm.
  */
 async function ensureConsumerPkg(pkgPath, pkg) {
-    let changed = false;
-    const next = { ...pkg };
-    if (next.private !== true) {
-        next.private = true;
-        changed = true;
-    }
-    const ws = ensureConsumerWorkspaces(next);
-    if (ws.changed) {
-        next.workspaces = ws.workspaces;
-        changed = true;
-    }
-    const deps = applyProtected(next.dependencies, PROTECTED_DEPS);
-    if (deps.changed) {
-        next.dependencies = deps.next;
-        changed = true;
-    }
-    const devDeps = applyProtected(next.devDependencies, PROTECTED_DEV_DEPS);
-    if (devDeps.changed) {
-        next.devDependencies = devDeps.next;
-        changed = true;
-    }
-    if (changed) {
-        await writeJson(pkgPath, next, { spaces: 2 });
+    if (pkg.private === true) {
+        return { changed: false, pkg };
     }
-    return { changed, pkg: next };
+    const next = { ...pkg, private: true };
+    await writeJson(pkgPath, next, { spaces: 2 });
+    return { changed: true, pkg: next };
 }
 
-export { ensureConsumerPkg, ensureConsumerWorkspaces };
+export { ensureConsumerPkg };

package/dist/esm/shadow/merge-package-json.d.ts

@@ -1,9 +1,15 @@
 import type { ConsumerPkg, ShadowPkg } from '../types';
 /**
- * Build the shadow package.json. Declares the shared runtime deps as
- * peerDependencies — yarn resolves them from the workspace root (the
- * consumer's package.json), guaranteeing a single React instance across
- * the wrapper and consumer src.
+ * Build the shadow package.json.
+ *
+ * Runtime deps live at the workspace root (`~/zth-projects/`) and are
+ * hoisted in via yarn workspaces — no need to mirror them here. The shadow
+ * only declares the toolchain it directly executes (`trident-toolkit`) so
+ * yarn berry wires the `trident` bin into the shadow's script PATH.
+ *
+ * The `@trident/` scope is preserved so trident-toolkit strips it and the
+ * emitted bundle becomes `MF-mf-<appName>`, matching the URL the host MF
+ * routes to.
  */
 export declare function buildShadowPkg(consumerPkg: ConsumerPkg): ShadowPkg;
 /**

package/dist/esm/shadow/merge-package-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-package-json.d.ts","sourceRoot":"","sources":["../../../src/shadow/merge-package-json.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAalE;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAW9D;AAED,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F"}
+{"version":3,"file":"merge-package-json.d.ts","sourceRoot":"","sources":["../../../src/shadow/merge-package-json.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAQlE;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAW9D;AAED,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F"}

package/dist/esm/shadow/merge-package-json.mjs

@@ -1,26 +1,27 @@
 import crypto from 'node:crypto';
 import { writeJson } from 'fs-extra';
-import { SHADOW_SCRIPTS, PROTECTED_DEPS, WORKSPACE_DEV_DEPS } from '../constants.mjs';
+import { SHADOW_SCRIPTS, SHADOW_DEV_DEPS } from '../constants.mjs';
 import { mfAppName } from '../util/app-name.mjs';
 
 /**
- * Build the shadow package.json. Declares the shared runtime deps as
- * peerDependencies — yarn resolves them from the workspace root (the
- * consumer's package.json), guaranteeing a single React instance across
- * the wrapper and consumer src.
+ * Build the shadow package.json.
+ *
+ * Runtime deps live at the workspace root (`~/zth-projects/`) and are
+ * hoisted in via yarn workspaces — no need to mirror them here. The shadow
+ * only declares the toolchain it directly executes (`trident-toolkit`) so
+ * yarn berry wires the `trident` bin into the shadow's script PATH.
+ *
+ * The `@trident/` scope is preserved so trident-toolkit strips it and the
+ * emitted bundle becomes `MF-mf-<appName>`, matching the URL the host MF
+ * routes to.
  */
 function buildShadowPkg(consumerPkg) {
-    // Use the `@trident/` scope so trident-toolkit strips it and the emitted
-    // bundle becomes `MF-mf-<appName>`, matching the URL the host MF routes to.
-    // The scope also keeps the shadow's name distinct from the consumer's
-    // package.json name (same workspace, different identifiers).
     return {
         name: `@trident/${mfAppName(consumerPkg.name)}`,
         version: '0.0.1',
         private: true,
         scripts: SHADOW_SCRIPTS,
-        peerDependencies: { ...PROTECTED_DEPS },
-        devDependencies: WORKSPACE_DEV_DEPS,
+        devDependencies: { ...SHADOW_DEV_DEPS },
     };
 }
 /**

package/dist/esm/shadow/sync.mjs

@@ -16,8 +16,8 @@ async function syncShadow(paths, consumerPkg) {
     const oldHash = (await pathExists(paths.shadowDepsHash)) ? await readFile(paths.shadowDepsHash, 'utf8') : null;
     if (oldHash !== newHash) {
         info(oldHash ? 'consumer deps changed — yarn install' : 'first run — yarn install');
-        // Yarn 4 is cache-first and non-interactive by default
-        // in non-TTY contexts, so no flags are needed
+        // Yarn 4 is cache-first and non-interactive by default in non-TTY
+        // contexts, so plain `yarn install` is all we need.
         await execa('yarn', ['install'], {
             cwd: paths.consumerDir,
             stdio: 'inherit',

package/dist/esm/templates/app/claude-settings.mjs

@@ -0,0 +1,10 @@
+var permissions = {
+	allow: [
+		"Skill(z2h:*)"
+	]
+};
+const claudeSettings = {
+	permissions: permissions
+};
+
+export { claudeSettings as default, permissions };

package/dist/esm/types.d.ts

@@ -20,7 +20,6 @@ export interface ShadowPkg {
     version: string;
     private: true;
     scripts: Record<string, string>;
-    peerDependencies: Record<string, string>;
     devDependencies: Record<string, string>;
 }
 export interface ShadowMetadata {

package/dist/esm/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAGD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAGD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAOD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAGD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;CACtB"}

package/dist/esm/util/__tests__/templates.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=templates.test.d.ts.map

package/dist/esm/util/__tests__/templates.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.test.d.ts","sourceRoot":"","sources":["../../../../src/util/__tests__/templates.test.ts"],"names":[],"mappings":""}

package/dist/esm/util/__tests__/workspace-templates-shipped.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=workspace-templates-shipped.test.d.ts.map

package/dist/esm/util/__tests__/workspace-templates-shipped.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-templates-shipped.test.d.ts","sourceRoot":"","sources":["../../../../src/util/__tests__/workspace-templates-shipped.test.ts"],"names":[],"mappings":""}

package/dist/esm/util/__tests__/workspace.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=workspace.test.d.ts.map

package/dist/esm/util/__tests__/workspace.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.test.d.ts","sourceRoot":"","sources":["../../../../src/util/__tests__/workspace.test.ts"],"names":[],"mappings":""}

package/dist/esm/util/s3/upload.mjs

@@ -1,6 +1,6 @@
 import path from 'node:path';
-import { readFile } from 'fs-extra';
 import { readdir } from 'node:fs/promises';
+import { readFile } from 'fs-extra';
 import { lookup } from 'mime-types';
 import pMap from 'p-map';
 import { PutObjectCommand } from '@aws-sdk/client-s3';

package/dist/esm/util/templates.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Substitute `__PLACEHOLDER__` tokens in `content` with values from `vars`.
+ * Values are inserted literally — no regex special-char interpretation —
+ * which matters for content like `$1` or `&` that could otherwise be
+ * captured by `String.prototype.replace`.
+ */
+export declare function renderTemplate(content: string, vars: Record<string, string>): string;
+/**
+ * Absolute path to the bundled `templates/` directory under `src/`.
+ *
+ * The CLI's `package.json` `files` array ships `src/` (so `src/templates/`
+ * lands in published packages). The build emits `.ts` files to `dist/`,
+ * but raw template assets (`.tmpl`, `.md`, `gitignore`, `.json`) live only
+ * under `src/templates/`. Resolving here keeps a single source of truth
+ * for both:
+ *   - dev (vitest, tsx)             → `<pkg>/src/util/`     +  ../../src/templates  → `<pkg>/src/templates`
+ *   - published install (dist/util) → `<pkg>/dist/util/`    +  ../../src/templates  → `<pkg>/src/templates`
+ */
+export declare function getTemplatesDir(): string;
+export type AppTemplate = 'default' | 'html-embed';
+export declare const APP_TEMPLATES: AppTemplate[];
+//# sourceMappingURL=templates.d.ts.map

package/dist/esm/util/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../../src/util/templates.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAQpF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAGxC;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,YAAY,CAAC;AACnD,eAAO,MAAM,aAAa,EAAE,WAAW,EAA8B,CAAC"}

package/dist/esm/util/templates.mjs

@@ -0,0 +1,36 @@
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * Substitute `__PLACEHOLDER__` tokens in `content` with values from `vars`.
+ * Values are inserted literally — no regex special-char interpretation —
+ * which matters for content like `$1` or `&` that could otherwise be
+ * captured by `String.prototype.replace`.
+ */
+function renderTemplate(content, vars) {
+    let out = content;
+    for (const [key, value] of Object.entries(vars)) {
+        // Use split+join (literal pattern) to avoid regex interpretation of
+        // special chars in `value`.
+        out = out.split(key).join(value);
+    }
+    return out;
+}
+/**
+ * Absolute path to the bundled `templates/` directory under `src/`.
+ *
+ * The CLI's `package.json` `files` array ships `src/` (so `src/templates/`
+ * lands in published packages). The build emits `.ts` files to `dist/`,
+ * but raw template assets (`.tmpl`, `.md`, `gitignore`, `.json`) live only
+ * under `src/templates/`. Resolving here keeps a single source of truth
+ * for both:
+ *   - dev (vitest, tsx)             → `<pkg>/src/util/`     +  ../../src/templates  → `<pkg>/src/templates`
+ *   - published install (dist/util) → `<pkg>/dist/util/`    +  ../../src/templates  → `<pkg>/src/templates`
+ */
+function getTemplatesDir() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, '..', '..', 'src', 'templates');
+}
+const APP_TEMPLATES = ['default', 'html-embed'];
+
+export { APP_TEMPLATES, getTemplatesDir, renderTemplate };

package/dist/esm/util/workspace.d.ts

@@ -0,0 +1,20 @@
+export declare const WORKSPACE_DIR_NAME = "zth-projects";
+export declare const WORKSPACE_MARKER_FIELD = "z2hWorkspace";
+/**
+ * The Z2H workspace home is hardcoded to `~/zth-projects/` for users.
+ * Tests override via the `Z2H_WORKSPACE_HOME` env var so they can use a
+ * tmp dir without touching the user's real home.
+ */
+export declare function getWorkspaceHome(): string;
+/**
+ * Returns true iff `<dir>/package.json` exists and has `"z2hWorkspace": true`.
+ * Any read or parse error returns false (defensive — callers route to a
+ * helpful message via assertWorkspace).
+ */
+export declare function isZ2hWorkspace(dir: string): Promise<boolean>;
+/**
+ * Resolves to the workspace home path if the marker is present; otherwise
+ * throws an Error pointing the user at `z2h-cli create-workspace`.
+ */
+export declare function assertWorkspace(): Promise<string>;
+//# sourceMappingURL=workspace.d.ts.map

package/dist/esm/util/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/util/workspace.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AACjD,eAAO,MAAM,sBAAsB,iBAAiB,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWlE;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CASvD"}

package/dist/esm/util/workspace.mjs

@@ -0,0 +1,46 @@
+import path from 'node:path';
+import os from 'node:os';
+import { pathExists, readJson } from 'fs-extra';
+
+const WORKSPACE_DIR_NAME = 'zth-projects';
+const WORKSPACE_MARKER_FIELD = 'z2hWorkspace';
+/**
+ * The Z2H workspace home is hardcoded to `~/zth-projects/` for users.
+ * Tests override via the `Z2H_WORKSPACE_HOME` env var so they can use a
+ * tmp dir without touching the user's real home.
+ */
+function getWorkspaceHome() {
+    return process.env.Z2H_WORKSPACE_HOME ?? path.join(os.homedir(), WORKSPACE_DIR_NAME);
+}
+/**
+ * Returns true iff `<dir>/package.json` exists and has `"z2hWorkspace": true`.
+ * Any read or parse error returns false (defensive — callers route to a
+ * helpful message via assertWorkspace).
+ */
+async function isZ2hWorkspace(dir) {
+    const pkgPath = path.join(dir, 'package.json');
+    if (!(await pathExists(pkgPath))) {
+        return false;
+    }
+    try {
+        const pkg = (await readJson(pkgPath));
+        return pkg[WORKSPACE_MARKER_FIELD] === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Resolves to the workspace home path if the marker is present; otherwise
+ * throws an Error pointing the user at `z2h-cli create-workspace`.
+ */
+async function assertWorkspace() {
+    const home = getWorkspaceHome();
+    if (await isZ2hWorkspace(home)) {
+        return home;
+    }
+    throw new Error(`No Z2H workspace at ${home}. Run "z2h-cli create-workspace" first ` +
+        `(or set Z2H_WORKSPACE_HOME if you keep the workspace elsewhere).`);
+}
+
+export { WORKSPACE_DIR_NAME, WORKSPACE_MARKER_FIELD, assertWorkspace, getWorkspaceHome, isZ2hWorkspace };

package/dist/index.js

@@ -3,6 +3,8 @@ const commands_dev = require('./commands/dev.js');
 const commands_build = require('./commands/build.js');
 const commands_clean = require('./commands/clean.js');
 const commands_deploy = require('./commands/deploy.js');
+const commands_createWorkspace = require('./commands/create-workspace.js');
+const commands_create = require('./commands/create.js');
 const util_logger = require('./util/logger.js');
 
 async function main() {
@@ -74,6 +76,32 @@ async function main() {
             util_logger.fail(`deploy failed: ${err.message}`, { command: 'deploy' }, 2);
         }
     });
+    program
+        .command('create-workspace')
+        .description('Bootstrap the ~/zth-projects/ yarn workspace (one-time setup)')
+        .option('--json', 'emit structured JSON on stdout')
+        .action(async (opts) => {
+        try {
+            await commands_createWorkspace.createWorkspaceCommand(opts);
+        }
+        catch (err) {
+            util_logger.fail(`create-workspace failed: ${err.message}`, { command: 'create-workspace' }, 1);
+        }
+    });
+    program
+        .command('create <app-name>')
+        .description('Scaffold a new Z2H consumer app inside ~/zth-projects/')
+        .option('--template <name>', 'Template name (default | html-embed)')
+        .option('--html-file <path>', 'Path to an HTML file to embed (implies --template html-embed)')
+        .option('--json', 'emit structured JSON on stdout')
+        .action(async (appName, opts) => {
+        try {
+            await commands_create.createCommand(appName, opts);
+        }
+        catch (err) {
+            util_logger.fail(`create failed: ${err.message}`, { command: 'create' }, 1);
+        }
+    });
     await program.parseAsync(process.argv);
 }
 void main()

package/dist/shadow/__tests__/consumer-pkg.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=consumer-pkg.test.d.ts.map

package/dist/shadow/__tests__/consumer-pkg.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-pkg.test.d.ts","sourceRoot":"","sources":["../../../src/shadow/__tests__/consumer-pkg.test.ts"],"names":[],"mappings":""}

package/dist/shadow/__tests__/merge-package-json.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=merge-package-json.test.d.ts.map

package/dist/shadow/__tests__/merge-package-json.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-package-json.test.d.ts","sourceRoot":"","sources":["../../../src/shadow/__tests__/merge-package-json.test.ts"],"names":[],"mappings":""}

package/dist/shadow/consumer-pkg.d.ts

@@ -1,21 +1,11 @@
 import type { ConsumerPkg } from '../types';
 /**
- * Return the consumer's `workspaces` field extended with `.zth`. Handles
- * all three shapes: missing, array form, or object form (`{ packages }`).
- * Always extends — never replaces the user's existing entries.
- */
-export declare function ensureConsumerWorkspaces(pkg: ConsumerPkg): {
-    changed: boolean;
-    workspaces: ConsumerPkg['workspaces'];
-};
-/**
- * Idempotently reshape the consumer's package.json so that:
- *  - it is marked `"private": true`
- *  - `.zth` is declared as a yarn workspace member (yarn will hoist)
- *  - the protected runtime deps are present at compatible versions
- *  - the protected dev deps are present at compatible versions
+ * The consumer pkg is a thin manifest. Z2H apps live inside a yarn
+ * workspace at `~/zth-projects/`; runtime and dev deps come from the
+ * workspace root, hoisted into a single `node_modules/`.
  *
- * Always extends — never overrides existing fields.
+ * The only thing this file enforces today is `private: true` — apps must
+ * never accidentally publish to npm.
  */
 export declare function ensureConsumerPkg(pkgPath: string, pkg: ConsumerPkg): Promise<{
     changed: boolean;

package/dist/shadow/consumer-pkg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumer-pkg.d.ts","sourceRoot":"","sources":["../../src/shadow/consumer-pkg.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,GAAG;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;CACvC,CAsBA;AAqBD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,WAAW,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC,CAgCjD"}
+{"version":3,"file":"consumer-pkg.d.ts","sourceRoot":"","sources":["../../src/shadow/consumer-pkg.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,WAAW,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC,CAOjD"}

package/dist/shadow/consumer-pkg.js

@@ -1,84 +1,22 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 const fsExtra = require('fs-extra');
-const constants = require('../constants.js');
 
 /**
- * Return the consumer's `workspaces` field extended with `.zth`. Handles
- * all three shapes: missing, array form, or object form (`{ packages }`).
- * Always extends — never replaces the user's existing entries.
- */
-function ensureConsumerWorkspaces(pkg) {
-    const { workspaces } = pkg;
-    if (Array.isArray(workspaces)) {
-        if (workspaces.includes(constants.SHADOW_DIR_NAME)) {
-            return { changed: false, workspaces };
-        }
-        return { changed: true, workspaces: [...workspaces, constants.SHADOW_DIR_NAME] };
-    }
-    if (workspaces && typeof workspaces === 'object') {
-        const pkgs = workspaces.packages ?? [];
-        if (pkgs.includes(constants.SHADOW_DIR_NAME)) {
-            return { changed: false, workspaces };
-        }
-        return {
-            changed: true,
-            workspaces: { ...workspaces, packages: [...pkgs, constants.SHADOW_DIR_NAME] },
-        };
-    }
-    return { changed: true, workspaces: [constants.SHADOW_DIR_NAME] };
-}
-/**
- * Extend a deps map with the protected entries; only fills in missing ones,
- * never overrides versions the consumer already pinned.
- */
-function applyProtected(current, protectedMap) {
-    const next = { ...(current ?? {}) };
-    let changed = false;
-    for (const [name, version] of Object.entries(protectedMap)) {
-        if (!next[name]) {
-            next[name] = version;
-            changed = true;
-        }
-    }
-    return { changed, next };
-}
-/**
- * Idempotently reshape the consumer's package.json so that:
- *  - it is marked `"private": true`
- *  - `.zth` is declared as a yarn workspace member (yarn will hoist)
- *  - the protected runtime deps are present at compatible versions
- *  - the protected dev deps are present at compatible versions
+ * The consumer pkg is a thin manifest. Z2H apps live inside a yarn
+ * workspace at `~/zth-projects/`; runtime and dev deps come from the
+ * workspace root, hoisted into a single `node_modules/`.
  *
- * Always extends — never overrides existing fields.
+ * The only thing this file enforces today is `private: true` — apps must
+ * never accidentally publish to npm.
  */
 async function ensureConsumerPkg(pkgPath, pkg) {
-    let changed = false;
-    const next = { ...pkg };
-    if (next.private !== true) {
-        next.private = true;
-        changed = true;
-    }
-    const ws = ensureConsumerWorkspaces(next);
-    if (ws.changed) {
-        next.workspaces = ws.workspaces;
-        changed = true;
-    }
-    const deps = applyProtected(next.dependencies, constants.PROTECTED_DEPS);
-    if (deps.changed) {
-        next.dependencies = deps.next;
-        changed = true;
-    }
-    const devDeps = applyProtected(next.devDependencies, constants.PROTECTED_DEV_DEPS);
-    if (devDeps.changed) {
-        next.devDependencies = devDeps.next;
-        changed = true;
-    }
-    if (changed) {
-        await fsExtra.writeJson(pkgPath, next, { spaces: 2 });
+    if (pkg.private === true) {
+        return { changed: false, pkg };
     }
-    return { changed, pkg: next };
+    const next = { ...pkg, private: true };
+    await fsExtra.writeJson(pkgPath, next, { spaces: 2 });
+    return { changed: true, pkg: next };
 }
 
 exports.ensureConsumerPkg = ensureConsumerPkg;
-exports.ensureConsumerWorkspaces = ensureConsumerWorkspaces;

package/dist/shadow/merge-package-json.d.ts

@@ -1,9 +1,15 @@
 import type { ConsumerPkg, ShadowPkg } from '../types';
 /**
- * Build the shadow package.json. Declares the shared runtime deps as
- * peerDependencies — yarn resolves them from the workspace root (the
- * consumer's package.json), guaranteeing a single React instance across
- * the wrapper and consumer src.
+ * Build the shadow package.json.
+ *
+ * Runtime deps live at the workspace root (`~/zth-projects/`) and are
+ * hoisted in via yarn workspaces — no need to mirror them here. The shadow
+ * only declares the toolchain it directly executes (`trident-toolkit`) so
+ * yarn berry wires the `trident` bin into the shadow's script PATH.
+ *
+ * The `@trident/` scope is preserved so trident-toolkit strips it and the
+ * emitted bundle becomes `MF-mf-<appName>`, matching the URL the host MF
+ * routes to.
  */
 export declare function buildShadowPkg(consumerPkg: ConsumerPkg): ShadowPkg;
 /**

package/dist/shadow/merge-package-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-package-json.d.ts","sourceRoot":"","sources":["../../src/shadow/merge-package-json.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAalE;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAW9D;AAED,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F"}
+{"version":3,"file":"merge-package-json.d.ts","sourceRoot":"","sources":["../../src/shadow/merge-package-json.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAQlE;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAW9D;AAED,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F"}