@object-ui/create-plugin 17.3.0 → 17.6.0

package/CHANGELOG.md

@@ -1,5 +1,117 @@
 # @object-ui/create-plugin
 
+## 17.6.0
+
+### Patch Changes
+
+- 195b9e4: A scaffolded plugin's generated manifest now asks for the same `@testing-library/jest-dom` range this repo installs.
+  
+  `src/templates.ts`'s `DEV_DEPENDENCIES` had fossilised one patch behind the repo
+  root: the template said `^7.0.0` while the root manifest had moved to `^7.0.1`.
+  `templates.test.ts`'s anchor rule caught it and was red on `main`.
+  
+  Same defect class, same day and same dependabot wave as the `lucide-react` drift
+  in `@object-ui/cli`'s app generator, so both templates move together here — which
+  is how the previous occurrence of this incident was handled too (objectui#4098 /
+  PR objectui#4099 moved these same two templates in one PR). This one came from
+  the dev-dependencies group bump rather than the single-package bump, and it was
+  found only because the two ratchets live in different packages: the anchor rule
+  throws on its first mismatch, so nothing reports the second template until the
+  first is green.
+  
+  The remaining seven anchored ranges in this template were swept against the same
+  wave and are all in sync.
+
+## 17.5.0
+
+## 17.4.0
+
+### Patch Changes
+
+- e473b6c: Anchor the scaffold's build-side `devDependencies` to this repo's real toolchain, and pin the whole generated manifest against drift
+
+  A freshly scaffolded plugin declared a build stack one to two majors behind the one this monorepo actually builds and tests every in-tree plugin with: `vite ^7.3.1` against the repo's `^8.2.0`, `@vitejs/plugin-react ^4.2.1` against `^6.0.5`, `vite-plugin-dts ^4.5.4` against `^5.0.3`, `typescript ^5.9.3` against `^6.0.3`, `vitest ^4.0.18` against `^4.1.10`. Those five ranges were never sourced from anything — objectui#3716's end-to-end run of the generated artifact only ever exercised the versions installed in this repo, so the declared ranges were not the ones under test. All five now quote an in-repo anchor, the same way the three testing ranges already did.
+
+  Two anchors, because the root manifest does not declare everything. `create-plugin` writes into `<cwd>/packages/plugin-<name>`, so a generated plugin is a literal sibling of `packages/plugin-*`; those manifests anchor the two build-only tools the root omits (`@vitejs/plugin-react`, `vite-plugin-dts`), and the root anchors the rest.
+
+  The parity test now covers **every** entry of the generated `devDependencies` rather than the three testing ones, including a completeness check that fails when a dependency is added without naming its anchor — the five build ranges drifted precisely because nothing pinned them. It also asserts the two anchors agree wherever both declare a dependency, so which one is read cannot hide a drift.
+
+  The generated `vite.config.ts` resolves its library entry from `import.meta.dirname` instead of `__dirname`. vite 8 still defines `__dirname` under its default `bundle` config loader but warns on it ("unsupported by `configLoader: 'native'`, which is planned to become the default in a future major version of Vite ... Use `import.meta.dirname` instead"), and under `native` — which imports the config with Node's own ESM loader, where no `__dirname` exists — the generated config failed to load outright. `apps/console/vite.config.ts` was converted for the same reason in objectui#3384.
+
+  Not a peer-dependency fix: `@vitejs/plugin-react ^4.2.1` resolved to 4.7.0, whose vite peer had widened to `^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0` and accepted the declared `vite ^7.3.1`, so the old manifest installed cleanly. The cost was a scaffold lagging its own monorepo, not a failing install.
+
+- f4f42b4: create-plugin: make the scaffolded plugin's own test suite runnable
+
+  The generator wrote an example test importing `@testing-library/react` and
+  asserting with `toBeInTheDocument()`, plus a `test: 'vitest run'` script, while
+  declaring neither library and giving Vitest no DOM environment — so `pnpm test`
+  in a freshly scaffolded plugin failed on the very first run, at import
+  resolution.
+
+  The generated `package.json` now declares `@testing-library/react`,
+  `@testing-library/jest-dom` and `jsdom` (each range copied from this
+  monorepo's own manifest), the generated `vite.config.ts` gains a `test` block
+  with `environment: 'jsdom'`, `globals: true` and `setupFiles`, and a
+  `vitest.setup.ts` registering the jest-dom matchers is written alongside it.
+  The templates moved to `src/templates.ts` so the generated artifacts can be
+  pinned by unit tests without executing the CLI.
+
+- c852682: Remove the scaffold's unused pinned icon dependency, and make its generated schema interface reachable
+
+  Two declared-but-unreachable artifacts in the generated plugin, both on the blind side of
+  the import gate objectui#3733 added — that gate rejects an import nothing declares, and
+  never looked for a declaration nothing imports.
+
+  **The generated `dependencies` no longer pin `lucide-react`** (objectui#3755). It was
+  declared at `^0.563.0` and imported by no generated source file, so every freshly
+  scaffolded plugin really installed lucide 0.563.x for code that never referenced it — two
+  majors behind the 23 in-repo declarations, all `^1.28.0`. Worse than ordinary caret drift:
+  a `0.x` caret does not cross minors, so `^0.563.0` is `>=0.563.0 <0.564.0` and could not
+  float even within `0.x`. It is removed rather than re-anchored because this repo declares
+  an icon library where it imports one — of the 24 manifests mentioning `lucide-react`, 23
+  import it, and none pre-declares it for code not yet written. An author who wants icons
+  runs `pnpm add lucide-react` and lands the current version by construction, with no anchor
+  table to maintain for an unused entry. The generated `dependencies` is now exactly the four
+  `workspace:*` platform packages, which cannot drift at all.
+
+  **The generated `src/index.tsx` now re-exports the schema interface** from `src/types.ts`
+  (objectui#3759). The generated `exports` map exposes exactly one key — `.` — so the entry
+  is a consumer's only door, and nothing walked through it to `src/types.ts`: no generated
+  source imported it, and the deep paths that would have reached it (`<pkg>/types`,
+  `<pkg>/dist/types`) are closed by that same map. The interface in it is the plugin's schema
+  contract, and it shipped dead — while the generator's own documentation page told authors to
+  "export your schema types … make it importable rather than internal". A named type-only
+  re-export, matching the four in-repo plugins that ship a `src/types.ts` and the worked
+  example in the plugin-development guide.
+
+  **That interface now extends `BaseSchema` from `@object-ui/types`** instead of re-declaring
+  a subset of the base node. Unreachable, a hand-rolled `{ type; id?; className? }` was only
+  dead weight; published, it would be a second dialect of a node the protocol already defines,
+  silently missing everything else `BaseSchema` carries (`name`, `label`, `visible`, …). Only
+  the `type` literal is narrowed locally, the same shape every in-repo plugin uses. This also
+  makes the generated `@object-ui/types` dependency a used declaration.
+
+  Both halves are pinned structurally rather than by string match, so the next dead artifact
+  fails a test instead of shipping: no versioned runtime dependency may be declared that no
+  generated source imports (`workspace:*` exempt — it cannot drift), and no generated `src/**`
+  module may be unreachable from the single entry the `exports` map exposes. Each of those
+  gates passes over an empty result on today's templates, so each is paired with a self-test
+  that plants the removed defect back and asserts the rule names it — a gate that is green
+  because it produces nothing is not a gate.
+
+- c29ceff: Move the generator templates' dependency ranges onto the repo's current ones
+
+  The dependabot wave of 2026-08-10 bumped `lucide-react` to `1.29.0` and `vite`
+  to `8.2.1` in this repo's own manifests, but the ranges hard-coded in the
+  scaffold generators do not move with it — dependabot does not know the
+  templates exist. A project scaffolded by `objectui init` / `objectui dev` or by
+  `create-plugin` therefore declared a range the repo itself had already moved
+  past.
+
+  Three ranges are re-anchored: `lucide-react` `^1.28.0` → `^1.29.0` in the routed
+  app generator, and `vite` `^8.2.0` → `^8.2.1` in both the shared CLI scaffold
+  devDependencies and the create-plugin template.
+
 ## 17.3.0
 
 ## 17.2.0

package/README.md

@@ -29,6 +29,7 @@ packages/plugin-my-plugin/
 ├── package.json
 ├── tsconfig.json
 ├── vite.config.ts
+├── vitest.setup.ts         # Registers the jest-dom matchers
 └── README.md
 ```
 
@@ -37,7 +38,8 @@ packages/plugin-my-plugin/
 - ✅ TypeScript support out of the box
 - ✅ Vite build configuration
 - ✅ Component registration with ComponentRegistry
-- ✅ Test setup with Vitest
+- ✅ Runnable Vitest setup — jsdom environment, Testing Library and the jest-dom
+  matchers are all declared, so `pnpm test` is green on the first run
 - ✅ Proper package.json with workspace dependencies
 - ✅ README template
 - ✅ Type definitions
@@ -83,16 +85,6 @@ pnpm create @object-ui/plugin my-plugin --description "My awesome plugin" --auth
    pnpm test
    ```
 
-<!-- release-metadata:v3.3.0 -->
-
-## Compatibility
-
-- **Node.js:** ≥ 18
-- **TypeScript:** ≥ 5.0 (strict mode)
-- **`@objectstack/spec`:** ^3.3.0
-- **`@objectstack/client`:** ^3.3.0
-- **Tailwind CSS:** ≥ 3.4 (for packages with UI)
-
 ## Links
 
 - 📚 [Documentation](https://www.objectui.org/docs/guide/plugin-development)

package/dist/index.js

@@ -6,90 +6,32 @@ import chalk from "chalk";
 import prompts from "prompts";
 import * as path from "path";
 import fs from "fs-extra";
-import { fileURLToPath } from "url";
-var __filename = fileURLToPath(import.meta.url);
-var __dirname = path.dirname(__filename);
-var program = new Command();
-async function createPlugin(pluginName, options = {}) {
-  console.log(chalk.blue("\n\u{1F680} ObjectUI Plugin Generator\n"));
-  if (!pluginName) {
-    const response = await prompts({
-      type: "text",
-      name: "name",
-      message: "Plugin name (without prefix):",
-      validate: (value) => {
-        if (value.length === 0) return "Plugin name is required";
-        if (!/^[a-z0-9-]+$/.test(value)) {
-          return "Plugin name must contain only lowercase letters, numbers, and hyphens";
-        }
-        if (value.includes("..") || value.includes("/") || value.includes("\\")) {
-          return 'Plugin name cannot contain path separators or ".."';
-        }
-        return true;
-      }
-    });
-    pluginName = response.name;
-    if (!pluginName) {
-      console.log(chalk.red("\n\u274C Plugin name is required"));
-      process.exit(1);
-    }
-  }
-  if (!/^[a-z0-9-]+$/.test(pluginName)) {
-    console.log(chalk.red("\n\u274C Plugin name must contain only lowercase letters, numbers, and hyphens"));
-    process.exit(1);
-  }
-  if (pluginName.includes("..") || pluginName.includes("/") || pluginName.includes("\\") || path.isAbsolute(pluginName)) {
-    console.log(chalk.red("\n\u274C Invalid plugin name: path traversal detected"));
-    process.exit(1);
-  }
-  const cleanName = pluginName.replace(/^plugin-/, "").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-");
-  if (cleanName.length === 0) {
-    console.log(chalk.red("\n\u274C Plugin name cannot be empty after sanitization"));
-    process.exit(1);
-  }
-  const fullPackageName = `plugin-${cleanName}`;
-  const pascalCaseName = cleanName.split("-").filter((part) => part.length > 0).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
-  const answers = await prompts([
-    {
-      type: "text",
-      name: "description",
-      message: "Plugin description:",
-      initial: options.description || `${pascalCaseName} plugin for ObjectUI`
-    },
-    {
-      type: "text",
-      name: "author",
-      message: "Author name:",
-      initial: options.author || ""
-    }
-  ]);
-  const targetDir = path.join(process.cwd(), "packages", fullPackageName);
-  if (fs.existsSync(targetDir)) {
-    console.log(chalk.red(`
-\u274C Directory already exists: ${targetDir}`));
-    process.exit(1);
-  }
-  console.log(chalk.green(`
-\u2728 Creating plugin: ${fullPackageName}...
-`));
-  fs.mkdirpSync(targetDir);
-  fs.mkdirpSync(path.join(targetDir, "src"));
-  const templateDir = path.join(__dirname, "..", "templates", "plugin");
-  const vars = {
-    PACKAGE_NAME: `@object-ui/${fullPackageName}`,
-    PLUGIN_NAME: cleanName,
-    PASCAL_NAME: pascalCaseName,
-    DESCRIPTION: answers.description,
-    AUTHOR: answers.author,
-    VERSION: "0.1.0",
-    YEAR: (/* @__PURE__ */ new Date()).getFullYear()
-  };
-  const packageJson = {
-    name: vars.PACKAGE_NAME,
-    version: vars.VERSION,
+
+// src/templates.ts
+var VITEST_SETUP_FILE = "vitest.setup.ts";
+var DEV_DEPENDENCIES = {
+  "@testing-library/jest-dom": "^7.0.1",
+  "@testing-library/react": "^16.3.2",
+  "@vitejs/plugin-react": "^6.0.5",
+  jsdom: "^30.0.1",
+  typescript: "^6.0.3",
+  vite: "^8.2.1",
+  "vite-plugin-dts": "^5.0.3",
+  vitest: "^4.1.10"
+};
+var DEPENDENCIES = {
+  "@object-ui/components": "workspace:*",
+  "@object-ui/core": "workspace:*",
+  "@object-ui/react": "workspace:*",
+  "@object-ui/types": "workspace:*"
+};
+function buildPackageJson(vars) {
+  return {
+    name: vars.packageName,
+    version: vars.version,
     type: "module",
     license: "MIT",
-    description: vars.DESCRIPTION,
+    description: vars.description,
     main: "dist/index.umd.cjs",
     module: "dist/index.js",
     types: "dist/index.d.ts",
@@ -105,30 +47,16 @@ async function createPlugin(pluginName, options = {}) {
       test: "vitest run",
       lint: "eslint ."
     },
-    dependencies: {
-      "@object-ui/components": "workspace:*",
-      "@object-ui/core": "workspace:*",
-      "@object-ui/react": "workspace:*",
-      "@object-ui/types": "workspace:*",
-      "lucide-react": "^0.563.0"
-    },
+    dependencies: { ...DEPENDENCIES },
     peerDependencies: {
       react: "^18.0.0 || ^19.0.0",
       "react-dom": "^18.0.0 || ^19.0.0"
     },
-    devDependencies: {
-      "@vitejs/plugin-react": "^4.2.1",
-      typescript: "^5.9.3",
-      vite: "^7.3.1",
-      "vite-plugin-dts": "^4.5.4",
-      vitest: "^4.0.18"
-    }
+    devDependencies: { ...DEV_DEPENDENCIES }
   };
-  fs.writeFileSync(
-    path.join(targetDir, "package.json"),
-    JSON.stringify(packageJson, null, 2)
-  );
-  const tsconfig = {
+}
+function buildTsconfig() {
+  return {
     extends: "../../tsconfig.json",
     compilerOptions: {
       outDir: "./dist",
@@ -139,11 +67,9 @@ async function createPlugin(pluginName, options = {}) {
     include: ["src/**/*"],
     exclude: ["node_modules", "dist", "**/*.test.ts", "**/*.test.tsx"]
   };
-  fs.writeFileSync(
-    path.join(targetDir, "tsconfig.json"),
-    JSON.stringify(tsconfig, null, 2)
-  );
-  const viteConfig = `import { defineConfig } from 'vite';
+}
+function buildViteConfig(vars) {
+  return `import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 import dts from 'vite-plugin-dts';
 import * as path from 'path';
@@ -157,8 +83,8 @@ export default defineConfig({
   ],
   build: {
     lib: {
-      entry: path.resolve(__dirname, 'src/index.tsx'),
-      name: '${pascalCaseName}',
+      entry: path.resolve(import.meta.dirname, 'src/index.tsx'),
+      name: '${vars.pascalName}',
       formats: ['es', 'umd'],
       fileName: (format) => \`index.\${format === 'es' ? 'js' : 'umd.cjs'}\`,
     },
@@ -172,26 +98,38 @@ export default defineConfig({
       },
     },
   },
+  test: {
+    globals: true,
+    environment: 'jsdom',
+    setupFiles: ['./${VITEST_SETUP_FILE}'],
+  },
 });
 `;
-  fs.writeFileSync(path.join(targetDir, "vite.config.ts"), viteConfig);
-  const readme = `# ${vars.PACKAGE_NAME}
+}
+function buildVitestSetup() {
+  return `// Registers @testing-library/jest-dom's matchers (\`toBeInTheDocument\` and
+// friends) on Vitest's \`expect\`, which the example test in src/ relies on.
+import '@testing-library/jest-dom/vitest';
+`;
+}
+function buildReadme(vars) {
+  return `# ${vars.packageName}
 
-${vars.DESCRIPTION}
+${vars.description}
 
 ## Installation
 
 \`\`\`bash
-pnpm add ${vars.PACKAGE_NAME}
+pnpm add ${vars.packageName}
 \`\`\`
 
 ## Usage
 
 \`\`\`tsx
-import { ${pascalCaseName} } from '${vars.PACKAGE_NAME}';
+import { ${vars.pascalName} } from '${vars.packageName}';
 
 // Use the component
-<${pascalCaseName} />
+<${vars.pascalName} />
 \`\`\`
 
 ## Development
@@ -209,12 +147,13 @@ pnpm lint
 
 ## License
 
-MIT \xA9 ${vars.AUTHOR}
+MIT \xA9 ${vars.author}
 `;
-  fs.writeFileSync(path.join(targetDir, "README.md"), readme);
-  const indexFile = `/**
+}
+function buildIndexFile(vars) {
+  return `/**
  * ObjectUI
- * Copyright (c) ${vars.YEAR}-present ObjectStack Inc.
+ * Copyright (c) ${vars.year}-present ObjectStack Inc.
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
@@ -222,18 +161,19 @@ MIT \xA9 ${vars.AUTHOR}
 
 import React from 'react';
 import { ComponentRegistry } from '@object-ui/core';
-import { ${pascalCaseName} } from './${pascalCaseName}Impl';
+import { ${vars.pascalName} } from './${vars.pascalName}Impl';
 
-export { ${pascalCaseName} };
-export type { ${pascalCaseName}Props } from './${pascalCaseName}Impl';
+export { ${vars.pascalName} };
+export type { ${vars.pascalName}Props } from './${vars.pascalName}Impl';
+export type { ${vars.pascalName}Schema } from './types';
 
 // Register component with ComponentRegistry
-const ${pascalCaseName}Renderer: React.FC<{ schema: any }> = ({ schema }) => {
-  return <${pascalCaseName} {...schema} />;
+const ${vars.pascalName}Renderer: React.FC<{ schema: any }> = ({ schema }) => {
+  return <${vars.pascalName} {...schema} />;
 };
 
-ComponentRegistry.register('${cleanName}', ${pascalCaseName}Renderer, {
-  label: '${pascalCaseName}',
+ComponentRegistry.register('${vars.pluginName}', ${vars.pascalName}Renderer, {
+  label: '${vars.pascalName}',
   category: 'plugin',
   inputs: [
     // Define your component inputs here
@@ -243,10 +183,11 @@ ComponentRegistry.register('${cleanName}', ${pascalCaseName}Renderer, {
   }
 });
 `;
-  fs.writeFileSync(path.join(targetDir, "src", "index.tsx"), indexFile);
-  const implFile = `/**
+}
+function buildImplFile(vars) {
+  return `/**
  * ObjectUI
- * Copyright (c) ${vars.YEAR}-present ObjectStack Inc.
+ * Copyright (c) ${vars.year}-present ObjectStack Inc.
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
@@ -254,49 +195,51 @@ ComponentRegistry.register('${cleanName}', ${pascalCaseName}Renderer, {
 
 import React from 'react';
 
-export interface ${pascalCaseName}Props {
+export interface ${vars.pascalName}Props {
   // Define your props here
   className?: string;
 }
 
 /**
- * ${pascalCaseName} component
+ * ${vars.pascalName} component
  */
-export const ${pascalCaseName}: React.FC<${pascalCaseName}Props> = ({ className }) => {
+export const ${vars.pascalName}: React.FC<${vars.pascalName}Props> = ({ className }) => {
   return (
     <div className={className}>
-      <h2>${pascalCaseName} Plugin</h2>
+      <h2>${vars.pascalName} Plugin</h2>
       <p>Implement your plugin logic here.</p>
     </div>
   );
 };
 `;
-  fs.writeFileSync(
-    path.join(targetDir, "src", `${pascalCaseName}Impl.tsx`),
-    implFile
-  );
-  const typesFile = `/**
+}
+function buildTypesFile(vars) {
+  return `/**
  * ObjectUI
- * Copyright (c) ${vars.YEAR}-present ObjectStack Inc.
+ * Copyright (c) ${vars.year}-present ObjectStack Inc.
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
 
+import type { BaseSchema } from '@object-ui/types';
+
 /**
- * Schema definition for ${pascalCaseName}
+ * Schema definition for ${vars.pascalName}.
+ *
+ * This is the contract between a metadata author and the renderer: it is
+ * re-exported from \`src/index.tsx\`, which is the package's only entry point.
  */
-export interface ${pascalCaseName}Schema {
-  type: '${cleanName}';
-  id?: string;
-  className?: string;
+export interface ${vars.pascalName}Schema extends BaseSchema {
+  type: '${vars.pluginName}';
   // Add schema properties here
 }
 `;
-  fs.writeFileSync(path.join(targetDir, "src", "types.ts"), typesFile);
-  const testFile = `/**
+}
+function buildTestFile(vars) {
+  return `/**
  * ObjectUI
- * Copyright (c) ${vars.YEAR}-present ObjectStack Inc.
+ * Copyright (c) ${vars.year}-present ObjectStack Inc.
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
@@ -305,26 +248,116 @@ export interface ${pascalCaseName}Schema {
 import { describe, it, expect } from 'vitest';
 import { render, screen } from '@testing-library/react';
 import React from 'react';
-import { ${pascalCaseName} } from './${pascalCaseName}Impl';
+import { ${vars.pascalName} } from './${vars.pascalName}Impl';
 
-describe('${pascalCaseName}', () => {
+describe('${vars.pascalName}', () => {
   it('should render', () => {
-    render(<${pascalCaseName} />);
-    expect(screen.getByText('${pascalCaseName} Plugin')).toBeInTheDocument();
+    render(<${vars.pascalName} />);
+    expect(screen.getByText('${vars.pascalName} Plugin')).toBeInTheDocument();
   });
 });
 `;
-  fs.writeFileSync(
-    path.join(targetDir, "src", `${pascalCaseName}Impl.test.tsx`),
-    testFile
-  );
+}
+function buildPluginFiles(vars) {
+  return {
+    "package.json": `${JSON.stringify(buildPackageJson(vars), null, 2)}`,
+    "tsconfig.json": `${JSON.stringify(buildTsconfig(), null, 2)}`,
+    "vite.config.ts": buildViteConfig(vars),
+    [VITEST_SETUP_FILE]: buildVitestSetup(),
+    "README.md": buildReadme(vars),
+    "src/index.tsx": buildIndexFile(vars),
+    [`src/${vars.pascalName}Impl.tsx`]: buildImplFile(vars),
+    "src/types.ts": buildTypesFile(vars),
+    [`src/${vars.pascalName}Impl.test.tsx`]: buildTestFile(vars)
+  };
+}
+
+// src/index.ts
+var program = new Command();
+async function createPlugin(pluginName, options = {}) {
+  console.log(chalk.blue("\n\u{1F680} ObjectUI Plugin Generator\n"));
+  if (!pluginName) {
+    const response = await prompts({
+      type: "text",
+      name: "name",
+      message: "Plugin name (without prefix):",
+      validate: (value) => {
+        if (value.length === 0) return "Plugin name is required";
+        if (!/^[a-z0-9-]+$/.test(value)) {
+          return "Plugin name must contain only lowercase letters, numbers, and hyphens";
+        }
+        if (value.includes("..") || value.includes("/") || value.includes("\\")) {
+          return 'Plugin name cannot contain path separators or ".."';
+        }
+        return true;
+      }
+    });
+    pluginName = response.name;
+    if (!pluginName) {
+      console.log(chalk.red("\n\u274C Plugin name is required"));
+      process.exit(1);
+    }
+  }
+  if (!/^[a-z0-9-]+$/.test(pluginName)) {
+    console.log(chalk.red("\n\u274C Plugin name must contain only lowercase letters, numbers, and hyphens"));
+    process.exit(1);
+  }
+  if (pluginName.includes("..") || pluginName.includes("/") || pluginName.includes("\\") || path.isAbsolute(pluginName)) {
+    console.log(chalk.red("\n\u274C Invalid plugin name: path traversal detected"));
+    process.exit(1);
+  }
+  const cleanName = pluginName.replace(/^plugin-/, "").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-");
+  if (cleanName.length === 0) {
+    console.log(chalk.red("\n\u274C Plugin name cannot be empty after sanitization"));
+    process.exit(1);
+  }
+  const fullPackageName = `plugin-${cleanName}`;
+  const pascalCaseName = cleanName.split("-").filter((part) => part.length > 0).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+  const answers = await prompts([
+    {
+      type: "text",
+      name: "description",
+      message: "Plugin description:",
+      initial: options.description || `${pascalCaseName} plugin for ObjectUI`
+    },
+    {
+      type: "text",
+      name: "author",
+      message: "Author name:",
+      initial: options.author || ""
+    }
+  ]);
+  const targetDir = path.join(process.cwd(), "packages", fullPackageName);
+  if (fs.existsSync(targetDir)) {
+    console.log(chalk.red(`
+\u274C Directory already exists: ${targetDir}`));
+    process.exit(1);
+  }
+  console.log(chalk.green(`
+\u2728 Creating plugin: ${fullPackageName}...
+`));
+  fs.mkdirpSync(targetDir);
+  const vars = {
+    packageName: `@object-ui/${fullPackageName}`,
+    pluginName: cleanName,
+    pascalName: pascalCaseName,
+    description: answers.description,
+    author: answers.author,
+    version: "0.1.0",
+    year: (/* @__PURE__ */ new Date()).getFullYear()
+  };
+  for (const [relativePath, contents] of Object.entries(buildPluginFiles(vars))) {
+    const filePath = path.join(targetDir, relativePath);
+    fs.mkdirpSync(path.dirname(filePath));
+    fs.writeFileSync(filePath, contents);
+  }
   console.log(chalk.green("\u2705 Plugin created successfully!\n"));
   console.log(chalk.blue("Next steps:\n"));
   console.log(chalk.gray(`  cd packages/${fullPackageName}`));
   console.log(chalk.gray("  pnpm install"));
   console.log(chalk.gray("  pnpm build\n"));
   console.log(chalk.blue("To use the plugin:\n"));
-  console.log(chalk.gray(`  import { ${pascalCaseName} } from '${vars.PACKAGE_NAME}';
+  console.log(chalk.gray(`  import { ${pascalCaseName} } from '${vars.packageName}';
 `));
 }
 program.name("create-plugin").description("Create a new ObjectUI plugin").argument("[plugin-name]", "Name of the plugin (without plugin- prefix)").option("-d, --description <description>", "Plugin description").option("-a, --author <author>", "Author name").action(createPlugin);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/create-plugin",
-  "version": "17.3.0",
+  "version": "17.6.0",
   "description": "CLI tool to scaffold ObjectUI plugins",
   "type": "module",
   "license": "MIT",
@@ -9,7 +9,6 @@
   },
   "files": [
     "dist",
-    "templates",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
@@ -22,7 +21,7 @@
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
     "@types/prompts": "^2.4.9",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
@@ -56,7 +55,7 @@
   },
   "scripts": {
     "build": "tsup",
-    "type-check": "tsc --noEmit",
+    "type-check": "tsc --noEmit && tsc -p tsconfig.test.json",
     "dev": "tsup --watch",
     "test": "vitest run",
     "lint": "eslint ."