@mondaydotcomorg/z2h-cli 0.1.0 → 0.2.0

package/dist/esm/commands/create.mjs

@@ -0,0 +1,98 @@
+import path from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { pathExists, ensureDir, writeFile, copy, readdir } from 'fs-extra';
+import { execa } from 'execa';
+import { setOutputMode, info, output } from '../util/logger.mjs';
+import { assertWorkspace } from '../util/workspace.mjs';
+import { APP_TEMPLATES, getTemplatesDir, renderTemplate } from '../util/templates.mjs';
+import { readManifest } from '../util/manifest.mjs';
+import { mfAppName } from '../util/app-name.mjs';
+
+const APP_NAME_RE = /^[a-z][a-z0-9-]{1,49}$/;
+/**
+ * Convert kebab-case to PascalCase. `demo-app` → `DemoApp`.
+ */
+function pascalCase(input) {
+    return input
+        .split('-')
+        .filter(Boolean)
+        .map(part => part.charAt(0).toUpperCase() + part.slice(1))
+        .join('');
+}
+/**
+ * Returns true iff `dir` either does not exist or is an empty directory.
+ */
+async function isDirEmpty(dir) {
+    if (!(await pathExists(dir))) {
+        return true;
+    }
+    const entries = await readdir(dir);
+    return entries.length === 0;
+}
+async function createCommand(appName, opts) {
+    if (opts.json) {
+        setOutputMode('json');
+    }
+    // Validate workspace.
+    const workspace = await assertWorkspace();
+    // Validate app name.
+    if (!APP_NAME_RE.test(appName)) {
+        throw new Error(`App name "${appName}" is invalid. Use lowercase kebab-case (a-z, 0-9, -), ` +
+            `2-50 chars, starting with a letter.`);
+    }
+    // Resolve template.
+    // `--html-file` implies `--template html-embed` unless the user already picked one.
+    const template = (opts.template ?? (opts.htmlFile ? 'html-embed' : 'default'));
+    if (!APP_TEMPLATES.includes(template)) {
+        throw new Error(`Unknown template "${template}". Available: ${APP_TEMPLATES.join(', ')}.`);
+    }
+    if (opts.htmlFile && !(await pathExists(opts.htmlFile))) {
+        throw new Error(`HTML file does not exist: ${opts.htmlFile}`);
+    }
+    // Validate target dir.
+    const appDir = path.join(workspace, appName);
+    if (!(await isDirEmpty(appDir))) {
+        throw new Error(`${appDir} is non-empty. Pick a different name or wipe it first.`);
+    }
+    // Check for manifest collision (network call — after all local checks).
+    const manifest = await readManifest();
+    if (manifest[mfAppName(appName)]) {
+        throw new Error(`An app named "${appName}" already exists in the Z2H registry. Pick a different name.`);
+    }
+    // Compute substitutions.
+    const vars = {
+        __APP_NAME__: appName,
+        __APP_COMPONENT__: pascalCase(appName),
+    };
+    const appTemplatesDir = path.join(getTemplatesDir(), 'app');
+    await ensureDir(path.join(appDir, 'src'));
+    await ensureDir(path.join(appDir, '.claude'));
+    // package.json (templated).
+    const pkgRaw = await readFile(path.join(appTemplatesDir, 'package.json.tmpl'), 'utf8');
+    await writeFile(path.join(appDir, 'package.json'), renderTemplate(pkgRaw, vars));
+    // src/index.tsx (templated; choice driven by template).
+    const indexTemplate = template === 'html-embed' ? 'html-index.tsx.tmpl' : 'default-index.tsx.tmpl';
+    const indexRaw = await readFile(path.join(appTemplatesDir, indexTemplate), 'utf8');
+    await writeFile(path.join(appDir, 'src', 'index.tsx'), renderTemplate(indexRaw, vars));
+    // Copy verbatim files.
+    await copy(path.join(appTemplatesDir, 'gitignore'), path.join(appDir, '.gitignore'));
+    await copy(path.join(appTemplatesDir, 'claude-settings.json'), path.join(appDir, '.claude', 'settings.json'));
+    await copy(path.join(appTemplatesDir, 'CLAUDE.md'), path.join(appDir, 'CLAUDE.md'));
+    // html-embed: also copy the source HTML.
+    if (template === 'html-embed' && opts.htmlFile) {
+        await copy(opts.htmlFile, path.join(appDir, 'src', 'page.html'));
+    }
+    info(`installing into workspace at ${workspace}`);
+    await execa('yarn', ['install'], {
+        cwd: workspace,
+        stdio: 'inherit',
+    });
+    output(`[z2h-cli] app ready at ${appDir}`, {
+        ok: true,
+        appDir,
+        appName,
+        template,
+    });
+}
+
+export { createCommand };

package/dist/esm/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAaD,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA6EtE"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAaD,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFtE"}

package/dist/esm/commands/deploy.mjs

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import os from 'node:os';
 import { readJson, pathExists } from 'fs-extra';
 import 'execa';
 import { setOutputMode, info, output, warn } from '../util/logger.mjs';
@@ -22,14 +23,19 @@ async function deployCommand(opts) {
     }
     info('checking S3 bucket');
     await assertBucketExists();
-    info('building');
-    await buildCommand({ json: opts.json });
     const paths = resolveConsumerPaths(process.cwd());
     const consumerPkg = (await readJson(paths.consumerPkg));
     if (!consumerPkg.name) {
         throw new Error('Consumer package.json must have a "name" field');
     }
     const appName = mfAppName(consumerPkg.name);
+    info('reading current Z2H manifest');
+    const manifest = await readManifest();
+    const version = nextVersion(manifest, appName);
+    const keyPrefix = `${appName}/${version}`;
+    const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
+    info('building');
+    await buildCommand({ json: opts.json, publicUrl: url });
     if (!(await pathExists(paths.shadowBuild))) {
         throw new Error(`No build output at ${paths.shadowBuild} after build step.`);
     }
@@ -39,11 +45,6 @@ async function deployCommand(opts) {
         throw new Error(`Missing asset-manifest.json at ${assetManifestPath}.`);
     }
     const assetManifest = (await readJson(assetManifestPath));
-    info('reading current Z2H manifest');
-    const manifest = await readManifest();
-    const version = nextVersion(manifest, appName);
-    const keyPrefix = `${appName}/${version}`;
-    const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
     if (opts.dryRun) {
         output(`[z2h-cli] dry-run: would upload to s3://${BUCKET_WRITE_NAME}/${keyPrefix}/ as v${version}`, {
             ok: true,
@@ -58,13 +59,15 @@ async function deployCommand(opts) {
         return;
     }
     await requestAponoAccess();
-    info(`uploading build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
-    await uploadDir(paths.shadowBuild, keyPrefix);
+    const deployedBy = os.userInfo().username;
     const entry = {
         ...assetManifest,
         version,
         url,
+        deployedBy,
     };
+    info(`uploading build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
+    await uploadDir(paths.shadowBuild, keyPrefix);
     info(`updating manifest entry "${appName}" → v${version}`);
     await writeManifest(upsertEntry(manifest, appName, entry));
     // The host MF parses the app name from the URL and prepends `mf-` itself

package/dist/esm/commands/dev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../../src/commands/dev.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAID,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDhE"}
+{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../../src/commands/dev.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAID,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuEhE"}

package/dist/esm/commands/dev.mjs

@@ -1,4 +1,6 @@
-import { readJson } from 'fs-extra';
+import path from 'node:path';
+import fs from 'node:fs';
+import { writeFile, readJson } from 'fs-extra';
 import { watch } from 'chokidar';
 import { execa } from 'execa';
 import { setOutputMode, info, output, warn, errorLog } from '../util/logger.mjs';
@@ -22,6 +24,28 @@ async function devCommand(opts) {
         cwd: ctx.paths.shadowDir,
         stdio: ['inherit', 'pipe', 'inherit'],
     });
+    const pidFile = path.join(ctx.paths.shadowDir, 'dev.pid');
+    if (server.pid) {
+        await writeFile(pidFile, String(server.pid));
+    }
+    const cleanupPid = () => {
+        try {
+            fs.unlinkSync(pidFile);
+        }
+        catch (_) {
+            // file already gone — ignore
+        }
+    };
+    server.on('exit', cleanupPid);
+    process.on('exit', cleanupPid);
+    process.on('SIGINT', () => {
+        server.kill();
+        process.exit(0);
+    });
+    process.on('SIGTERM', () => {
+        server.kill();
+        process.exit(0);
+    });
     let readyPrinted = false;
     server.stdout?.on('data', (chunk) => {
         process.stdout.write(chunk);

package/dist/esm/constants.d.ts

@@ -3,21 +3,8 @@
  * one place) stay local to their file to keep this index small.
  */
 export declare const SHADOW_DIR_NAME = ".zth";
-/**
- * Protected runtime deps that MUST resolve to a single instance across the
- * wrapper (.zth) and the consumer's src. Declared as peerDependencies in
- * the shadow pkg so yarn hoists them from the workspace root — which is
- * why we enforce their presence in the consumer's own package.json.
- */
-export declare const PROTECTED_DEPS: Record<string, string>;
-/**
- * Protected dev deps. Same idempotent treatment as PROTECTED_DEPS but live
- * in the consumer's `devDependencies`. These give the LLM-authored consumer
- * code access to monday.com platform types out of the box.
- */
-export declare const PROTECTED_DEV_DEPS: Record<string, string>;
-export declare const WORKSPACE_DEV_DEPS: Record<string, string>;
 export declare const SHADOW_SCRIPTS: Record<string, string>;
+export declare const SHADOW_DEV_DEPS: Record<string, string>;
 export declare const MIN_PORT = 13000;
 export declare const MAX_PORT = 19999;
 export declare const GITIGNORE_ENTRIES: string[];

package/dist/esm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAMjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGrD,CAAC;AAIF,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKrD,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAG3C,eAAO,MAAM,YAAY,UAIxB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAG3C,eAAO,MAAM,YAAY,UAIxB,CAAC"}

package/dist/esm/constants.mjs

@@ -4,41 +4,20 @@
  */
 // ─────────── Shadow dir layout ───────────
 const SHADOW_DIR_NAME = '.zth';
-// ─────────── Consumer pkg enforcement ──────
-/**
- * Protected runtime deps that MUST resolve to a single instance across the
- * wrapper (.zth) and the consumer's src. Declared as peerDependencies in
- * the shadow pkg so yarn hoists them from the workspace root — which is
- * why we enforce their presence in the consumer's own package.json.
- */
-const PROTECTED_DEPS = {
-    react: '^18.2.0',
-    'react-dom': '^18.2.0',
-    'react-error-boundary': '^3.1.3',
-    '@mondaydotcomorg/trident-runtime': '^1.24.1',
-    '@vibe/core': '^4.0.1',
-};
-/**
- * Protected dev deps. Same idempotent treatment as PROTECTED_DEPS but live
- * in the consumer's `devDependencies`. These give the LLM-authored consumer
- * code access to monday.com platform types out of the box.
- */
-const PROTECTED_DEV_DEPS = {
-    '@mondaydotcomorg/mf-api-types': '^0.1.1',
-    '@mondaydotcomorg/bigbrain-types': '^0.3.3',
-};
-// ─────────── Shadow pkg template ───────────
-// TODO — Add trident mf-types / bigbrain-types opt-in.
-const WORKSPACE_DEV_DEPS = {
-    '@mondaydotcomorg/trident-toolkit': '^2.9.25',
-    '@types/react': '^18.0.14',
-    '@types/react-dom': '^18.0.5',
-    typescript: '^5.7.2',
-};
+// ─────────── Shadow scripts ───────
 const SHADOW_SCRIPTS = {
     start: 'trident start',
     build: 'trident build',
 };
+// ─────────── Shadow dev deps ───────
+// Yarn berry only wires a workspace member's `node_modules/.bin/` PATH
+// for packages that member explicitly declares. The shadow's scripts
+// invoke `trident`, so trident-toolkit must be declared here for the
+// bin to resolve. `*` is fine — yarn workspaces resolve the actual
+// version from the workspace root's pinned entry.
+const SHADOW_DEV_DEPS = {
+    '@mondaydotcomorg/trident-toolkit': '*',
+};
 // ─────────── Auto-allocated dev port range ────
 // High enough to dodge common dev defaults (3000 Next, 5173 Vite, 8080).
 // Collisions within the 7k-port pool are rare for POC; if trident can't
@@ -54,4 +33,4 @@ const YARNRC_LINES = [
     "npmRegistryServer: 'https://registry.npmjs.org/'",
 ];
 
-export { GITIGNORE_ENTRIES, MAX_PORT, MIN_PORT, PROTECTED_DEPS, PROTECTED_DEV_DEPS, SHADOW_DIR_NAME, SHADOW_SCRIPTS, WORKSPACE_DEV_DEPS, YARNRC_LINES };
+export { GITIGNORE_ENTRIES, MAX_PORT, MIN_PORT, SHADOW_DEV_DEPS, SHADOW_DIR_NAME, SHADOW_SCRIPTS, YARNRC_LINES };

package/dist/esm/index.mjs

@@ -3,6 +3,8 @@ import { devCommand } from './commands/dev.mjs';
 import { buildCommand } from './commands/build.mjs';
 import { cleanCommand } from './commands/clean.mjs';
 import { deployCommand } from './commands/deploy.mjs';
+import { createWorkspaceCommand } from './commands/create-workspace.mjs';
+import { createCommand } from './commands/create.mjs';
 import { errorLog, fail } from './util/logger.mjs';
 
 async function main() {
@@ -74,6 +76,32 @@ async function main() {
             fail(`deploy failed: ${err.message}`, { command: 'deploy' }, 2);
         }
     });
+    program
+        .command('create-workspace')
+        .description('Bootstrap the ~/zth-projects/ yarn workspace (one-time setup)')
+        .option('--json', 'emit structured JSON on stdout')
+        .action(async (opts) => {
+        try {
+            await createWorkspaceCommand(opts);
+        }
+        catch (err) {
+            fail(`create-workspace failed: ${err.message}`, { command: 'create-workspace' }, 1);
+        }
+    });
+    program
+        .command('create <app-name>')
+        .description('Scaffold a new Z2H consumer app inside ~/zth-projects/')
+        .option('--template <name>', 'Template name (default | html-embed)')
+        .option('--html-file <path>', 'Path to an HTML file to embed (implies --template html-embed)')
+        .option('--json', 'emit structured JSON on stdout')
+        .action(async (appName, opts) => {
+        try {
+            await createCommand(appName, opts);
+        }
+        catch (err) {
+            fail(`create failed: ${err.message}`, { command: 'create' }, 1);
+        }
+    });
     await program.parseAsync(process.argv);
 }
 void main()

package/dist/esm/shadow/__tests__/consumer-pkg.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=consumer-pkg.test.d.ts.map

package/dist/esm/shadow/__tests__/consumer-pkg.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-pkg.test.d.ts","sourceRoot":"","sources":["../../../../src/shadow/__tests__/consumer-pkg.test.ts"],"names":[],"mappings":""}

package/dist/esm/shadow/__tests__/merge-package-json.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=merge-package-json.test.d.ts.map

package/dist/esm/shadow/__tests__/merge-package-json.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-package-json.test.d.ts","sourceRoot":"","sources":["../../../../src/shadow/__tests__/merge-package-json.test.ts"],"names":[],"mappings":""}

package/dist/esm/shadow/consumer-pkg.d.ts

@@ -1,21 +1,11 @@
 import type { ConsumerPkg } from '../types';
 /**
- * Return the consumer's `workspaces` field extended with `.zth`. Handles
- * all three shapes: missing, array form, or object form (`{ packages }`).
- * Always extends — never replaces the user's existing entries.
- */
-export declare function ensureConsumerWorkspaces(pkg: ConsumerPkg): {
-    changed: boolean;
-    workspaces: ConsumerPkg['workspaces'];
-};
-/**
- * Idempotently reshape the consumer's package.json so that:
- *  - it is marked `"private": true`
- *  - `.zth` is declared as a yarn workspace member (yarn will hoist)
- *  - the protected runtime deps are present at compatible versions
- *  - the protected dev deps are present at compatible versions
+ * The consumer pkg is a thin manifest. Z2H apps live inside a yarn
+ * workspace at `~/zth-projects/`; runtime and dev deps come from the
+ * workspace root, hoisted into a single `node_modules/`.
  *
- * Always extends — never overrides existing fields.
+ * The only thing this file enforces today is `private: true` — apps must
+ * never accidentally publish to npm.
  */
 export declare function ensureConsumerPkg(pkgPath: string, pkg: ConsumerPkg): Promise<{
     changed: boolean;

package/dist/esm/shadow/consumer-pkg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumer-pkg.d.ts","sourceRoot":"","sources":["../../../src/shadow/consumer-pkg.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,GAAG;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;CACvC,CAsBA;AAqBD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,WAAW,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC,CAgCjD"}
+{"version":3,"file":"consumer-pkg.d.ts","sourceRoot":"","sources":["../../../src/shadow/consumer-pkg.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,WAAW,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC,CAOjD"}

package/dist/esm/shadow/consumer-pkg.mjs

@@ -1,81 +1,20 @@
 import { writeJson } from 'fs-extra';
-import { SHADOW_DIR_NAME, PROTECTED_DEPS, PROTECTED_DEV_DEPS } from '../constants.mjs';
 
 /**
- * Return the consumer's `workspaces` field extended with `.zth`. Handles
- * all three shapes: missing, array form, or object form (`{ packages }`).
- * Always extends — never replaces the user's existing entries.
- */
-function ensureConsumerWorkspaces(pkg) {
-    const { workspaces } = pkg;
-    if (Array.isArray(workspaces)) {
-        if (workspaces.includes(SHADOW_DIR_NAME)) {
-            return { changed: false, workspaces };
-        }
-        return { changed: true, workspaces: [...workspaces, SHADOW_DIR_NAME] };
-    }
-    if (workspaces && typeof workspaces === 'object') {
-        const pkgs = workspaces.packages ?? [];
-        if (pkgs.includes(SHADOW_DIR_NAME)) {
-            return { changed: false, workspaces };
-        }
-        return {
-            changed: true,
-            workspaces: { ...workspaces, packages: [...pkgs, SHADOW_DIR_NAME] },
-        };
-    }
-    return { changed: true, workspaces: [SHADOW_DIR_NAME] };
-}
-/**
- * Extend a deps map with the protected entries; only fills in missing ones,
- * never overrides versions the consumer already pinned.
- */
-function applyProtected(current, protectedMap) {
-    const next = { ...(current ?? {}) };
-    let changed = false;
-    for (const [name, version] of Object.entries(protectedMap)) {
-        if (!next[name]) {
-            next[name] = version;
-            changed = true;
-        }
-    }
-    return { changed, next };
-}
-/**
- * Idempotently reshape the consumer's package.json so that:
- *  - it is marked `"private": true`
- *  - `.zth` is declared as a yarn workspace member (yarn will hoist)
- *  - the protected runtime deps are present at compatible versions
- *  - the protected dev deps are present at compatible versions
+ * The consumer pkg is a thin manifest. Z2H apps live inside a yarn
+ * workspace at `~/zth-projects/`; runtime and dev deps come from the
+ * workspace root, hoisted into a single `node_modules/`.
  *
- * Always extends — never overrides existing fields.
+ * The only thing this file enforces today is `private: true` — apps must
+ * never accidentally publish to npm.
  */
 async function ensureConsumerPkg(pkgPath, pkg) {
-    let changed = false;
-    const next = { ...pkg };
-    if (next.private !== true) {
-        next.private = true;
-        changed = true;
-    }
-    const ws = ensureConsumerWorkspaces(next);
-    if (ws.changed) {
-        next.workspaces = ws.workspaces;
-        changed = true;
-    }
-    const deps = applyProtected(next.dependencies, PROTECTED_DEPS);
-    if (deps.changed) {
-        next.dependencies = deps.next;
-        changed = true;
-    }
-    const devDeps = applyProtected(next.devDependencies, PROTECTED_DEV_DEPS);
-    if (devDeps.changed) {
-        next.devDependencies = devDeps.next;
-        changed = true;
-    }
-    if (changed) {
-        await writeJson(pkgPath, next, { spaces: 2 });
+    if (pkg.private === true) {
+        return { changed: false, pkg };
     }
-    return { changed, pkg: next };
+    const next = { ...pkg, private: true };
+    await writeJson(pkgPath, next, { spaces: 2 });
+    return { changed: true, pkg: next };
 }
 
-export { ensureConsumerPkg, ensureConsumerWorkspaces };
+export { ensureConsumerPkg };

package/dist/esm/shadow/merge-package-json.d.ts

@@ -1,9 +1,15 @@
 import type { ConsumerPkg, ShadowPkg } from '../types';
 /**
- * Build the shadow package.json. Declares the shared runtime deps as
- * peerDependencies — yarn resolves them from the workspace root (the
- * consumer's package.json), guaranteeing a single React instance across
- * the wrapper and consumer src.
+ * Build the shadow package.json.
+ *
+ * Runtime deps live at the workspace root (`~/zth-projects/`) and are
+ * hoisted in via yarn workspaces — no need to mirror them here. The shadow
+ * only declares the toolchain it directly executes (`trident-toolkit`) so
+ * yarn berry wires the `trident` bin into the shadow's script PATH.
+ *
+ * The `@trident/` scope is preserved so trident-toolkit strips it and the
+ * emitted bundle becomes `MF-mf-<appName>`, matching the URL the host MF
+ * routes to.
  */
 export declare function buildShadowPkg(consumerPkg: ConsumerPkg): ShadowPkg;
 /**

package/dist/esm/shadow/merge-package-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-package-json.d.ts","sourceRoot":"","sources":["../../../src/shadow/merge-package-json.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAalE;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAW9D;AAED,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F"}
+{"version":3,"file":"merge-package-json.d.ts","sourceRoot":"","sources":["../../../src/shadow/merge-package-json.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAQlE;AAgBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAW9D;AAED,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F"}

package/dist/esm/shadow/merge-package-json.mjs

@@ -1,26 +1,27 @@
 import crypto from 'node:crypto';
 import { writeJson } from 'fs-extra';
-import { SHADOW_SCRIPTS, PROTECTED_DEPS, WORKSPACE_DEV_DEPS } from '../constants.mjs';
+import { SHADOW_SCRIPTS, SHADOW_DEV_DEPS } from '../constants.mjs';
 import { mfAppName } from '../util/app-name.mjs';
 
 /**
- * Build the shadow package.json. Declares the shared runtime deps as
- * peerDependencies — yarn resolves them from the workspace root (the
- * consumer's package.json), guaranteeing a single React instance across
- * the wrapper and consumer src.
+ * Build the shadow package.json.
+ *
+ * Runtime deps live at the workspace root (`~/zth-projects/`) and are
+ * hoisted in via yarn workspaces — no need to mirror them here. The shadow
+ * only declares the toolchain it directly executes (`trident-toolkit`) so
+ * yarn berry wires the `trident` bin into the shadow's script PATH.
+ *
+ * The `@trident/` scope is preserved so trident-toolkit strips it and the
+ * emitted bundle becomes `MF-mf-<appName>`, matching the URL the host MF
+ * routes to.
  */
 function buildShadowPkg(consumerPkg) {
-    // Use the `@trident/` scope so trident-toolkit strips it and the emitted
-    // bundle becomes `MF-mf-<appName>`, matching the URL the host MF routes to.
-    // The scope also keeps the shadow's name distinct from the consumer's
-    // package.json name (same workspace, different identifiers).
     return {
         name: `@trident/${mfAppName(consumerPkg.name)}`,
         version: '0.0.1',
         private: true,
         scripts: SHADOW_SCRIPTS,
-        peerDependencies: { ...PROTECTED_DEPS },
-        devDependencies: WORKSPACE_DEV_DEPS,
+        devDependencies: { ...SHADOW_DEV_DEPS },
     };
 }
 /**

package/dist/esm/shadow/scaffold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../../src/shadow/scaffold.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAqG9C;;;GAGG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYvG"}
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../../src/shadow/scaffold.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AA0G9C;;;GAGG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYvG"}

package/dist/esm/shadow/scaffold.mjs

@@ -73,6 +73,11 @@ declare module '*.wasm' {
   const e: string;
   export default e;
 }
+
+declare module '*.html?url' {
+  const src: string;
+  export default src;
+}
 `;
 const TSCONFIG_TEMPLATE = {
     compilerOptions: {

package/dist/esm/shadow/sync.mjs

@@ -16,8 +16,8 @@ async function syncShadow(paths, consumerPkg) {
     const oldHash = (await pathExists(paths.shadowDepsHash)) ? await readFile(paths.shadowDepsHash, 'utf8') : null;
     if (oldHash !== newHash) {
         info(oldHash ? 'consumer deps changed — yarn install' : 'first run — yarn install');
-        // Yarn 4 is cache-first and non-interactive by default
-        // in non-TTY contexts, so no flags are needed
+        // Yarn 4 is cache-first and non-interactive by default in non-TTY
+        // contexts, so plain `yarn install` is all we need.
         await execa('yarn', ['install'], {
             cwd: paths.consumerDir,
             stdio: 'inherit',

package/dist/esm/templates/app/claude-settings.mjs

@@ -0,0 +1,23 @@
+var permissions = {
+	allow: [
+		"Skill(z2h:*)"
+	]
+};
+var hooks = {
+	Stop: [
+		{
+			hooks: [
+				{
+					type: "command",
+					command: "if [ -f .zth/dev.pid ]; then kill $(cat .zth/dev.pid) 2>/dev/null; rm .zth/dev.pid; fi"
+				}
+			]
+		}
+	]
+};
+const claudeSettings = {
+	permissions: permissions,
+	hooks: hooks
+};
+
+export { claudeSettings as default, hooks, permissions };

package/dist/esm/types.d.ts

@@ -20,7 +20,6 @@ export interface ShadowPkg {
     version: string;
     private: true;
     scripts: Record<string, string>;
-    peerDependencies: Record<string, string>;
     devDependencies: Record<string, string>;
 }
 export interface ShadowMetadata {

package/dist/esm/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAGD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAGD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAOD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAGD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;CACtB"}

package/dist/esm/util/__tests__/templates.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=templates.test.d.ts.map

package/dist/esm/util/__tests__/templates.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.test.d.ts","sourceRoot":"","sources":["../../../../src/util/__tests__/templates.test.ts"],"names":[],"mappings":""}

package/dist/esm/util/__tests__/workspace-templates-shipped.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=workspace-templates-shipped.test.d.ts.map

package/dist/esm/util/__tests__/workspace-templates-shipped.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-templates-shipped.test.d.ts","sourceRoot":"","sources":["../../../../src/util/__tests__/workspace-templates-shipped.test.ts"],"names":[],"mappings":""}

package/dist/esm/util/__tests__/workspace.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=workspace.test.d.ts.map

package/dist/esm/util/__tests__/workspace.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.test.d.ts","sourceRoot":"","sources":["../../../../src/util/__tests__/workspace.test.ts"],"names":[],"mappings":""}