@namostack/cli 0.1.0-rc.1 → 0.1.0-rc.2

package/dist/index.mjs

@@ -3690,10 +3690,37 @@ objectType({
 	current: PasswordSchema,
 	next: NewPasswordSchema
 });
+/** A one-time token from an emailed link (confirmation, password reset). */
+const EmailTokenSchema = stringType().min(1).max(256);
+objectType({ token: EmailTokenSchema });
+objectType({ email: EmailSchema });
+objectType({
+	token: EmailTokenSchema,
+	password: NewPasswordSchema
+});
+const DisplayNameSchema = stringType().trim().min(1).max(100);
+objectType({ displayName: DisplayNameSchema });
+objectType({ image: stringType().min(1).max(Math.ceil(524288 / 3) * 4).regex(/^[A-Za-z0-9+/]+={0,2}$/, "Image must be base64-encoded") });
+objectType({
+	email: EmailSchema,
+	password: PasswordSchema
+});
+objectType({ token: EmailTokenSchema });
+objectType({
+	token: EmailTokenSchema,
+	password: NewPasswordSchema
+});
+objectType({ password: PasswordSchema });
 const UserSchema = objectType({
 	id: stringType(),
 	email: stringType(),
-	displayName: stringType()
+	displayName: stringType(),
+	/** Confirmed by following the link in the signup email (or a password reset). Installing and publishing need it. */
+	emailVerified: booleanType(),
+	/** Path on the app's origin, e.g. `/avatars/usr_…/….jpg`. Unset until the user picks a photo. */
+	avatarUrl: stringType().optional(),
+	/** A new address waiting for its confirmation link; `email` stays the login until then. */
+	pendingEmail: stringType().optional()
 });
 /** Signup and login: the session itself travels in the cookie. */
 const AuthResponseSchema = objectType({ user: UserSchema });
@@ -3706,106 +3733,36 @@ objectType({ sessions: arrayType(objectType({
 	/** The session making this request. */
 	current: booleanType()
 })) });
+objectType({ 
+/** `usr_<uuid>`, as auth-api generates them: nothing else reaches the handlers. */
+userId: stringType().regex(/^usr_[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/) });
+objectType({ developerName: DisplayNameSchema });
 objectType({ token: stringType().min(1) });
+/**
+* Whether the user has confirmed their email, as of this request. Missing counts as `false`, so a
+* token from before the claim existed (mid-deploy) can't pass the `requiresVerifiedEmail` routes.
+*/
+const EmailVerifiedClaimSchema = booleanType().default(false);
+/** The user as of this request, for responses that show it (`GET /bootstrap`). Missing in a token from before the claims existed (mid-deploy). */
+const ProfileClaimsSchema = {
+	email: stringType().optional(),
+	displayName: stringType().optional(),
+	avatarUrl: stringType().optional(),
+	pendingEmail: stringType().optional()
+};
 discriminatedUnionType("kind", [objectType({
 	kind: literalType("session"),
 	userId: stringType(),
-	sessionId: stringType()
+	sessionId: stringType(),
+	emailVerified: EmailVerifiedClaimSchema,
+	...ProfileClaimsSchema
 }), objectType({
 	kind: literalType("cliToken"),
 	userId: stringType(),
-	tokenId: stringType()
+	tokenId: stringType(),
+	emailVerified: EmailVerifiedClaimSchema,
+	...ProfileClaimsSchema
 })]);
-objectType({
-	code: enumType([
-		"permission_denied",
-		"not_found",
-		"validation_error",
-		"quota_exceeded",
-		"timeout",
-		"upgrade_required",
-		"internal"
-	]).catch("internal"),
-	message: stringType()
-});
-objectType({ sdkVersion: stringType().min(1) });
-/** Enough for a plugin using seedui: its `ThemeProvider` builds the rest from the mode. */
-const PluginThemeSchema = objectType({ mode: enumType(["light", "dark"]) });
-objectType({
-	/** In live testing (`env: 'dev'`), the slug: the plugin may not be published yet. */
-	pluginId: stringType(),
-	slug: stringType(),
-	/** `dev` while live testing with `namostack dev`: its data is kept apart from real data. */
-	env: enumType(["prod", "dev"]),
-	name: stringType(),
-	version: stringType(),
-	theme: PluginThemeSchema,
-	/** The browser's language, e.g. `en-US`. */
-	locale: stringType()
-});
-objectType({ displayName: stringType() });
-objectType({
-	message: stringType().trim().min(1).max(300),
-	tone: enumType([
-		"info",
-		"success",
-		"warning",
-		"error"
-	]).default("info")
-});
-numberType().int().min(0).max(1e5);
-stringType().min(1);
-//#endregion
-//#region ../../packages/types/src/cli.ts
-/** Shown in Settings → Developer; the CLI suggests its hostname, the user confirms it when approving. */
-const TokenNameSchema = stringType().trim().min(1).max(100);
-/** `WDJB-MJHT`: what the user checks in the browser against what the CLI printed. */
-const UserCodeSchema = stringType().trim().toUpperCase().regex(/^[A-Z]{4}-[A-Z]{4}$/, "Invalid code");
-objectType({ tokenName: TokenNameSchema });
-const CliAuthStartResponseSchema = objectType({
-	/** Secret the CLI polls with; never shown to the user. */
-	deviceCode: stringType(),
-	userCode: stringType(),
-	/** The web app's approval page for this login. */
-	verifyUrl: stringType().url(),
-	/** Seconds to wait between polls. */
-	interval: numberType().int(),
-	/** Seconds before the login request expires. */
-	expiresIn: numberType().int()
-});
-objectType({ deviceCode: stringType().min(1) });
-/** `approved` is answered once: the token is issued and the request consumed. */
-const CliAuthPollResponseSchema = discriminatedUnionType("status", [
-	objectType({ status: literalType("pending") }),
-	objectType({
-		status: literalType("approved"),
-		/** `nst_pat_…`: the CLI stores it, the server only keeps its hash. */
-		token: stringType(),
-		expiresAt: TimestampSchema
-	}),
-	objectType({ status: literalType("denied") }),
-	objectType({ status: literalType("expired") })
-]);
-objectType({ userCode: UserCodeSchema });
-/** `GET /cli/auth/requests/:userCode`: what the approval page shows. */
-const CliAuthRequestSchema = objectType({
-	userCode: stringType(),
-	tokenName: stringType()
-});
-objectType({
-	userCode: UserCodeSchema,
-	tokenName: TokenNameSchema
-});
-/** `GET /cli/tokens`: the user's active tokens, newest first. */
-const CliTokensResponseSchema = objectType({ tokens: arrayType(objectType({
-	id: stringType(),
-	name: stringType(),
-	/** Absent until the CLI first uses the token. */
-	lastUsedAt: TimestampSchema.optional(),
-	expiresAt: TimestampSchema
-})) });
-objectType({ tokenId: stringType().min(1) });
-objectType({ token: stringType().min(1) });
 //#endregion
 //#region ../../packages/types/src/plugins.ts
 /** `public`: in the catalog. `unlisted`: installable by direct link. `private`: owner only. */
@@ -3953,8 +3910,8 @@ const StartDevSessionResponseSchema = objectType({
 	/** Seconds before the session ends unless the CLI sends it again. */
 	expiresIn: numberType().int()
 });
-/** `GET /dev-sessions`: the caller's live sessions. */
-const DevSessionsResponseSchema = objectType({ devSessions: arrayType(objectType({
+/** A plugin in live testing, as its author's web app shows it. */
+const DevSessionSchema = objectType({
 	slug: stringType(),
 	name: stringType(),
 	version: stringType(),
@@ -3963,24 +3920,139 @@ const DevSessionsResponseSchema = objectType({ devSessions: arrayType(objectType
 	permissions: arrayType(PluginPermissionSchema),
 	iconUrl: stringType().optional(),
 	startedAt: TimestampSchema
-})) });
-const ApiErrorSchema = objectType({
+});
+/** `GET /dev-sessions`: the caller's live sessions. */
+const DevSessionsResponseSchema = objectType({ devSessions: arrayType(DevSessionSchema) });
+/** `GET /preferences` answers it, `PUT /preferences` replaces it whole. */
+const PreferencesSchema = objectType({
+	theme: enumType([
+		"light",
+		"dark",
+		"system"
+	]),
+	sidebarCollapsed: booleanType(),
+	/** Applies plugin updates on its own, except those adding permissions. */
+	autoUpdatePlugins: booleanType()
+});
+//#endregion
+//#region ../../packages/types/src/bootstrap.ts
+/** `GET /bootstrap`: everything the web app needs to show its first page, in one request. */
+const BootstrapResponseSchema = objectType({
+	user: UserSchema,
+	preferences: PreferencesSchema,
+	installedPlugins: arrayType(InstalledPluginSchema),
+	devSessions: arrayType(DevSessionSchema)
+});
+objectType({
 	code: enumType([
-		"unauthenticated",
-		"invalid_credentials",
 		"permission_denied",
 		"not_found",
-		"email_unavailable",
-		"already_installed",
-		"slug_taken",
-		"rate_limited",
-		"quota_exceeded",
 		"validation_error",
+		"quota_exceeded",
+		"timeout",
 		"upgrade_required",
 		"internal"
 	]).catch("internal"),
 	message: stringType()
 });
+objectType({ sdkVersion: stringType().min(1) });
+/** Enough for a plugin using seedui: its `ThemeProvider` builds the rest from the mode. */
+const PluginThemeSchema = objectType({ mode: enumType(["light", "dark"]) });
+objectType({
+	/** In live testing (`env: 'dev'`), the slug: the plugin may not be published yet. */
+	pluginId: stringType(),
+	slug: stringType(),
+	/** `dev` while live testing with `namostack dev`: its data is kept apart from real data. */
+	env: enumType(["prod", "dev"]),
+	name: stringType(),
+	version: stringType(),
+	theme: PluginThemeSchema,
+	/** The browser's language, e.g. `en-US`. */
+	locale: stringType()
+});
+objectType({ displayName: stringType() });
+objectType({
+	message: stringType().trim().min(1).max(300),
+	tone: enumType([
+		"info",
+		"success",
+		"warning",
+		"error"
+	]).default("info")
+});
+numberType().int().min(0).max(1e5);
+stringType().min(1);
+//#endregion
+//#region ../../packages/types/src/cli.ts
+/** Shown in Settings → Developer; the CLI suggests its hostname, the user confirms it when approving. */
+const TokenNameSchema = stringType().trim().min(1).max(100);
+/** `WDJB-MJHT`: what the user checks in the browser against what the CLI printed. */
+const UserCodeSchema = stringType().trim().toUpperCase().regex(/^[A-Z]{4}-[A-Z]{4}$/, "Invalid code");
+objectType({ tokenName: TokenNameSchema });
+const CliAuthStartResponseSchema = objectType({
+	/** Secret the CLI polls with; never shown to the user. */
+	deviceCode: stringType(),
+	userCode: stringType(),
+	/** The web app's approval page for this login. */
+	verifyUrl: stringType().url(),
+	/** Seconds to wait between polls. */
+	interval: numberType().int(),
+	/** Seconds before the login request expires. */
+	expiresIn: numberType().int()
+});
+objectType({ deviceCode: stringType().min(1) });
+/** `approved` is answered once: the token is issued and the request consumed. */
+const CliAuthPollResponseSchema = discriminatedUnionType("status", [
+	objectType({ status: literalType("pending") }),
+	objectType({
+		status: literalType("approved"),
+		/** `nst_pat_…`: the CLI stores it, the server only keeps its hash. */
+		token: stringType(),
+		expiresAt: TimestampSchema
+	}),
+	objectType({ status: literalType("denied") }),
+	objectType({ status: literalType("expired") })
+]);
+objectType({ userCode: UserCodeSchema });
+/** `GET /cli/auth/requests/:userCode`: what the approval page shows. */
+const CliAuthRequestSchema = objectType({
+	userCode: stringType(),
+	tokenName: stringType()
+});
+objectType({
+	userCode: UserCodeSchema,
+	tokenName: TokenNameSchema
+});
+/** `GET /cli/tokens`: the user's active tokens, newest first. */
+const CliTokensResponseSchema = objectType({ tokens: arrayType(objectType({
+	id: stringType(),
+	name: stringType(),
+	/** Absent until the CLI first uses the token. */
+	lastUsedAt: TimestampSchema.optional(),
+	expiresAt: TimestampSchema
+})) });
+objectType({ tokenId: stringType().min(1) });
+objectType({ token: stringType().min(1) });
+const ErrorCodeSchema = enumType([
+	"unauthenticated",
+	"invalid_credentials",
+	"permission_denied",
+	"not_found",
+	"email_unavailable",
+	"email_unverified",
+	"already_installed",
+	"published_plugins",
+	"slug_taken",
+	"rate_limited",
+	"quota_exceeded",
+	"validation_error",
+	"upgrade_required",
+	"internal"
+]);
+const ApiErrorSchema = objectType({
+	code: stringType().pipe(ErrorCodeSchema.catch("internal")),
+	message: stringType()
+});
 /**
 * Base for every domain error. `code` decides the HTTP status (api-kit maps it),
 * and `message` is sent to the client as is, so it must be safe to show.
@@ -4046,20 +4118,9 @@ const FindResponseSchema = objectType({
 	/** Present while there may be more matching documents. */
 	cursor: stringType().optional()
 });
-/** `GET /preferences` answers it, `PUT /preferences` replaces it whole. */
-const PreferencesSchema = objectType({
-	theme: enumType([
-		"light",
-		"dark",
-		"system"
-	]),
-	sidebarCollapsed: booleanType(),
-	/** Applies plugin updates on its own, except those adding permissions. */
-	autoUpdatePlugins: booleanType()
-});
 //#endregion
 //#region ../../packages/libraries/plugin-sdk/package.json
-var version$1 = "0.1.0-rc.1";
+var version$1 = "0.1.0-rc.2";
 //#endregion
 //#region src/paths.ts
 /** `pnpm dev:cli` runs the `.ts` sources; npm installs the bundle (`dist/index.mjs`). */
@@ -4315,8 +4376,75 @@ function createApiClient({ baseUrl, token, client }) {
 				method: "GET",
 				path: "/auth/me",
 				schema: UserSchema
+			}),
+			verifyEmail: (body) => request({
+				method: "POST",
+				path: "/auth/email/verify",
+				body
+			}),
+			resendVerification: () => request({
+				method: "POST",
+				path: "/auth/email/resend"
+			}),
+			forgotPassword: (body) => request({
+				method: "POST",
+				path: "/auth/password/forgot",
+				body
+			}),
+			resetPassword: (body) => request({
+				method: "POST",
+				path: "/auth/password/reset",
+				body
+			}),
+			updateProfile: (body) => request({
+				method: "PATCH",
+				path: "/auth/me",
+				body,
+				schema: UserSchema
+			}),
+			setAvatar: (body) => request({
+				method: "PUT",
+				path: "/auth/me/avatar",
+				body,
+				schema: UserSchema
+			}),
+			removeAvatar: () => request({
+				method: "DELETE",
+				path: "/auth/me/avatar",
+				schema: UserSchema
+			}),
+			changeEmail: (body) => request({
+				method: "POST",
+				path: "/auth/email/change",
+				body,
+				schema: UserSchema
+			}),
+			cancelEmailChange: () => request({
+				method: "DELETE",
+				path: "/auth/email/change",
+				schema: UserSchema
+			}),
+			confirmEmailChange: (body) => request({
+				method: "POST",
+				path: "/auth/email/change/confirm",
+				body
+			}),
+			revertEmailChange: (body) => request({
+				method: "POST",
+				path: "/auth/email/revert",
+				body
+			}),
+			deleteAccount: (body) => request({
+				method: "POST",
+				path: "/auth/me/delete",
+				body
 			})
 		},
+		bootstrap: { get: () => request({
+			method: "GET",
+			path: "/bootstrap",
+			schema: BootstrapResponseSchema
+		}) },
 		preferences: {
 			get: () => request({
 				method: "GET",
@@ -4466,7 +4594,7 @@ function createApiClient({ baseUrl, token, client }) {
 //#endregion
 //#region src/version.ts
 /** Sent to the APIs on every call (`cli/<version>`) and printed by `--version`. */
-const CLI_VERSION = "0.1.0-rc.1";
+const CLI_VERSION = "0.1.0-rc.2";
 //#endregion
 //#region src/api.ts
 const DEFAULT_API_URL = semver.prerelease(CLI_VERSION) ? CLI_CONFIG.apiUrls.staging : CLI_CONFIG.apiUrls.prod;
@@ -4529,9 +4657,36 @@ async function deleteCredentials(apiUrl) {
 }
 //#endregion
 //#region src/utils/json.ts
-/** Two-space indented, with a final newline, like the files developers edit by hand. */
+/** Prettier's default; arrays that fit on one line stay on one line. */
+const PRINT_WIDTH = 80;
+const INDENT = "  ";
+/** Written as Prettier would format it, so generated files pass `prettier --check`. */
 async function writeJson(path, value) {
-	await writeFile(path, `${JSON.stringify(value, null, 2)}\n`);
+	const text = basename(path) === "package.json" ? JSON.stringify(value, null, 2) : format(value, "", 0, false);
+	await writeFile(path, `${text}\n`);
+}
+/** `column` is where the value starts; `comma`, whether one follows it on the line. */
+function format(value, indent, column, comma) {
+	if (Array.isArray(value)) {
+		if (value.length === 0) return "[]";
+		const inline = `[${value.map((item) => JSON.stringify(item)).join(", ")}]`;
+		if (value.every(isPrimitive) && column + inline.length + (comma ? 1 : 0) <= PRINT_WIDTH) return inline;
+		const inner = indent + INDENT;
+		return `[\n${value.map((item, index) => inner + format(item, inner, inner.length, index < value.length - 1)).join(",\n")}\n${indent}]`;
+	}
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value).filter(([, item]) => item !== void 0);
+		if (entries.length === 0) return "{}";
+		const inner = indent + INDENT;
+		return `{\n${entries.map(([key, item], index) => {
+			const prefix = `${inner}${JSON.stringify(key)}: `;
+			return prefix + format(item, inner, prefix.length, index < entries.length - 1);
+		}).join(",\n")}\n${indent}}`;
+	}
+	return JSON.stringify(value);
+}
+function isPrimitive(value) {
+	return value === null || typeof value !== "object";
 }
 //#endregion
 //#region src/utils/prompts.ts
@@ -4574,37 +4729,67 @@ const createCommand = defineCommand({
 		dir: {
 			type: "string",
 			description: "Folder to create the plugin in (default: the current one)"
+		},
+		slug: {
+			type: "string",
+			description: "Slug (default: from the name)"
+		},
+		template: {
+			type: "string",
+			description: `${CLI_CONFIG.templates.join(" or ")} (default: ${CLI_CONFIG.templates[0]})`
+		},
+		permissions: {
+			type: "string",
+			description: "Comma-separated, \"\" for none (default: all)"
+		},
+		"package-manager": {
+			type: "string",
+			description: `${CLI_CONFIG.packageManagers.join(", ")} or none (default: the one running the CLI)`
+		},
+		yes: {
+			type: "boolean",
+			description: "No prompts: defaults for anything not passed"
 		}
 	},
 	async run({ args }) {
 		const apiUrl = resolveApiUrl(args["api-url"]);
+		const parentDir = resolve(args.dir ?? ".");
+		const inHouse = isInHouseFolder(parentDir);
+		const templateArg = parseChoice("--template", args.template, CLI_CONFIG.templates);
+		const permissionsArg = parsePermissions(args.permissions);
+		const packageManagerArg = parseChoice("--package-manager", args["package-manager"], [...CLI_CONFIG.packageManagers, "none"]);
+		if (args.yes && !args.name) fail("--yes needs the plugin name: namostack create <name> --yes");
 		intro(pc.bold("namostack create"));
-		const name = answered(await text({
+		const name = (args.yes ? checkName(args.name) : answered(await text({
 			message: "Plugin name",
 			initialValue: args.name,
-			validate: (value) => PluginManifestSchema.shape.name.safeParse(value).success ? void 0 : "Use 1–50 characters."
-		})).trim();
-		const parentDir = resolve(args.dir ?? ".");
-		const slug = await promptSlug(apiUrl, toSlug(name), parentDir);
+			validate: (value) => nameProblem(value)
+		}))).trim();
+		const slug = await resolveSlug(apiUrl, parentDir, {
+			suggestion: args.slug ?? toSlug(name),
+			fromFlag: args.slug !== void 0,
+			yes: Boolean(args.yes)
+		});
 		const dir = join(parentDir, slug);
 		const displayDir = relative(process.cwd(), dir);
-		const inHouse = isInHouseFolder(parentDir);
-		const template = answered(await select({
+		const template = templateArg ?? (args.yes ? CLI_CONFIG.templates[0] : answered(await select({
 			message: "Template",
 			options: CLI_CONFIG.templates.map((value) => ({
 				value,
 				label: TEMPLATE_LABELS[value]
 			}))
-		}));
-		const permissions = answered(await multiselect({
+		})));
+		const permissions = permissionsArg ?? (args.yes ? [...PluginPermissionSchema.options] : answered(await multiselect({
 			message: "Permissions (users see these before installing)",
 			options: PluginPermissionSchema.options.map((value) => ({
 				value,
 				hint: PERMISSION_HINTS[value]
 			})),
+			initialValues: [...PluginPermissionSchema.options],
 			required: false
-		}));
-		const packageManager = inHouse ? "pnpm" : answered(await select({
+		})));
+		if (inHouse && packageManagerArg && packageManagerArg !== "pnpm") log.warn("In-house plugins install with pnpm: ignored --package-manager.");
+		const packageManager = inHouse ? "pnpm" : packageManagerArg ? packageManagerArg === "none" ? null : packageManagerArg : args.yes ? detectPackageManager() : answered(await select({
 			message: "Install dependencies with",
 			initialValue: detectPackageManager(),
 			options: [...CLI_CONFIG.packageManagers.map((value) => ({ value })), {
@@ -4642,26 +4827,64 @@ const createCommand = defineCommand({
 	}
 });
 /** Asks until the slug is valid and free on disk, then confirms it if the API flags it (docs/plugins.md). */
-async function promptSlug(apiUrl, suggestion, parentDir) {
-	for (;;) {
-		const slug = answered(await text({
+async function resolveSlug(apiUrl, parentDir, { suggestion, fromFlag, yes }) {
+	for (let first = true;; first = false) {
+		const slug = first && (fromFlag || yes) ? checkSlugFormat(suggestion, parentDir) : answered(await text({
 			message: "Slug (your plugin's unique name)",
 			initialValue: suggestion,
-			validate: (value) => {
-				const parsed = PluginSlugSchema.safeParse(value);
-				if (!parsed.success) return parsed.error.issues[0]?.message;
-				return existsSync(join(parentDir, parsed.data)) ? `A folder named ${parsed.data} already exists in ${parentDir}.` : void 0;
-			}
+			validate: (value) => slugProblem(value ?? "", parentDir)
 		}));
 		const availability = await checkSlug(apiUrl, slug);
 		if (!availability || availability.available && availability.publishable) return slug;
+		const message = !availability.available ? `You already have a plugin named ${slug}: publishing this one would publish a new version of it.` : `${slug} is used by another public or unlisted plugin: this one could only be published as private.`;
+		if (yes) {
+			if (!availability.available) fail(`${message} Pass another --slug.`);
+			log.warn(message);
+			return slug;
+		}
 		if (answered(await confirm({
-			message: !availability.available ? `You already have a plugin named ${slug}: publishing this one would publish a new version of it. Keep it anyway?` : `${slug} is used by another public or unlisted plugin: this one could only be published as private. Keep it?`,
+			message: `${message} Keep it${availability.available ? "" : " anyway"}?`,
 			initialValue: availability.available
 		}))) return slug;
 		suggestion = slug;
 	}
 }
+function slugProblem(value, parentDir) {
+	const parsed = PluginSlugSchema.safeParse(value);
+	if (!parsed.success) return parsed.error.issues[0]?.message;
+	return existsSync(join(parentDir, parsed.data)) ? `A folder named ${parsed.data} already exists in ${parentDir}.` : void 0;
+}
+function checkSlugFormat(slug, parentDir) {
+	const problem = slugProblem(slug, parentDir);
+	if (problem) fail(`Slug ${slug}: ${problem}`);
+	return slug;
+}
+function nameProblem(value) {
+	return PluginManifestSchema.shape.name.safeParse(value).success ? void 0 : "Use 1–50 characters.";
+}
+function checkName(name) {
+	const problem = nameProblem(name);
+	if (problem) fail(`Plugin name: ${problem}`);
+	return name;
+}
+/** A flag's value if it's one of `options`; exits otherwise. */
+function parseChoice(flag, value, options) {
+	if (value === void 0) return;
+	if (!options.includes(value)) fail(`${flag} must be ${options.slice(0, -1).join(", ")} or ${options.at(-1)}.`);
+	return value;
+}
+/** `--permissions storage,ui:notify`; `""` means none. */
+function parsePermissions(value) {
+	if (value === void 0) return;
+	const names = value.split(",").map((name) => name.trim()).filter(Boolean);
+	const unknown = names.filter((name) => !PluginPermissionSchema.safeParse(name).success);
+	if (unknown.length > 0) fail(`Unknown permission ${unknown.join(", ")}. Use ${PluginPermissionSchema.options.join(", ")}.`);
+	return [...new Set(names)];
+}
+function fail(message) {
+	log.error(message);
+	process.exit(CLI_CONFIG.exitCodes.validation);
+}
 /** Best effort: `undefined` when not logged in or the API can't be reached. */
 async function checkSlug(apiUrl, slug) {
 	const token = await getToken(apiUrl);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namostack/cli",
-  "version": "0.1.0-rc.1",
+  "version": "0.1.0-rc.2",
   "description": "Create, live test and publish namostack plugins.",
   "license": "MIT",
   "homepage": "https://docs.namostack.com",
@@ -39,10 +39,10 @@
     "@types/semver": "^7.8.0",
     "tsdown": "^0.23.1",
     "typescript": "~6.0.2",
-    "@namostack/config": "0.0.0",
-    "@namostack/tsconfig": "0.0.0",
     "@namostack/api-client": "0.0.0",
-    "@namostack/types": "0.0.0"
+    "@namostack/config": "0.0.0",
+    "@namostack/types": "0.0.0",
+    "@namostack/tsconfig": "0.0.0"
   },
   "scripts": {
     "build": "tsdown",

package/templates/react/public/icon.svg

@@ -1,4 +1,4 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
-  <rect width="64" height="64" rx="14" fill="#4f46e5" />
+  <rect width="64" height="64" rx="14" fill="#6344e5" />
   <path d="M22 16h13a11 11 0 0 1 0 22h-6v10h-7zm7 6v10h6a5 5 0 0 0 0-10z" fill="#fff" fill-rule="evenodd" />
 </svg>