@palettelab/cli 0.3.28 → 0.3.30

package/README.md

@@ -224,7 +224,8 @@ Declare database ownership in `palette-plugin.json`:
 }
 ```
 
-Define org-scoped models with the backend SDK:
+Define org-scoped models with the backend SDK. Table names must start with the
+app prefix (`my_app__` for `my-app`):
 
 ```python
 from sqlalchemy import String
@@ -232,7 +233,7 @@ from sqlalchemy.orm import Mapped, mapped_column
 from palette_sdk import OrgScopedTable
 
 class Invoice(OrgScopedTable):
-    __tablename__ = "invoices"
+    __tablename__ = "my_app__invoices"
 
     id: Mapped[int] = mapped_column(primary_key=True)
     customer_name: Mapped[str] = mapped_column(String(255))
@@ -245,7 +246,7 @@ from palette_sdk.db import ensure_org_rls
 
 def upgrade():
     op.create_table(...)
-    ensure_org_rls(op, "invoices")
+    ensure_org_rls(op, "my_app__invoices")
 ```
 
 Use `ctx.repo(Model)` for org-safe CRUD:
@@ -341,6 +342,7 @@ Scaffold a new plugin directory from the official template.
 ```bash
 pltt init data-explorer
 pltt init crm-dashboard --template dashboard
+pltt init next-panel --template next
 cd data-explorer
 ```
 
@@ -349,11 +351,39 @@ Creates `data-explorer/` with a valid `palette-plugin.json`, a frontend React en
 Templates:
 
 - `dashboard`
+- `next`
 - `agent-tool`
 - `external-service`
 - `database`
 - `frontend-only`
 
+### Next-Compatible Frontend Config
+
+Palette native apps publish as a single React module loaded by the OS. They do
+not run a standalone Next server. When an app needs Next-style frontend config,
+set the manifest to Next-compatible native mode:
+
+```json
+{
+  "frontend": {
+    "entry": "./frontend/src/index.tsx",
+    "sandbox": true,
+    "framework": "next",
+    "config": "./frontend/next.config.ts"
+  }
+}
+```
+
+Put the config file at `frontend/next.config.ts` unless you set a custom
+`frontend.config` path. `pltt dev`, `pltt test`, `pltt package`, and
+`pltt publish` load `next.config.ts/js/mjs/cjs`, apply `env` values plus
+`NEXT_PUBLIC_*` environment variables to the native bundle, and honor path
+aliases from `frontend/tsconfig.json`.
+
+Supported today: `env`, `NEXT_PUBLIC_*`, and TypeScript path aliases. Full Next server features
+such as API routes, server components, Next image optimization, middleware, and
+multi-file static export are outside this native module mode.
+
 ### `pltt dev`
 
 Run a no-Docker local SDK simulator with your plugin mounted live. Run this from inside your plugin directory.

package/backend-sdk/palette_sdk/__init__.py

@@ -12,7 +12,14 @@ from palette_sdk.schemas import (
     ErrorResponse,
     PaginatedResponse,
 )
-from palette_sdk.db import OrgScopedTable, PluginBase, ensure_org_rls
+from palette_sdk.db import (
+    OrgScopedTable,
+    PluginBase,
+    ensure_org_rls,
+    plugin_safe_id,
+    plugin_schema,
+    plugin_table_prefix,
+)
 from palette_sdk.permissions import (
     KNOWN_PERMISSIONS,
     is_known_permission,
@@ -39,6 +46,9 @@ __all__ = [
     "OrgScopedTable",
     "PluginBase",
     "ensure_org_rls",
+    "plugin_safe_id",
+    "plugin_schema",
+    "plugin_table_prefix",
     "KNOWN_PERMISSIONS",
     "is_known_permission",
     "require_permission",

package/backend-sdk/palette_sdk/db/__init__.py

@@ -12,7 +12,7 @@ Typical plugin usage:
     from sqlalchemy.orm import Mapped, mapped_column
 
     class Expense(OrgScopedTable):
-        __tablename__ = "expenses"
+        __tablename__ = "my_app__expenses"
         title: Mapped[str] = mapped_column(String(200))
         amount_cents: Mapped[int]
 
@@ -23,16 +23,29 @@ Typical plugin usage:
 
     def upgrade():
         op.create_table(
-            "expenses",
+            "my_app__expenses",
             sa.Column("id", sa.Integer, primary_key=True),
             sa.Column("organization_id", sa.BigInteger, nullable=False, index=True),
             sa.Column("title", sa.String(200), nullable=False),
             sa.Column("amount_cents", sa.Integer, nullable=False),
         )
-        ensure_org_rls(op, "expenses")
+        ensure_org_rls(op, "my_app__expenses")
 """
 
-from palette_sdk.db.base import OrgScopedTable, PluginBase
+from palette_sdk.db.base import (
+    OrgScopedTable,
+    PluginBase,
+    plugin_safe_id,
+    plugin_schema,
+    plugin_table_prefix,
+)
 from palette_sdk.db.rls import ensure_org_rls
 
-__all__ = ["OrgScopedTable", "PluginBase", "ensure_org_rls"]
+__all__ = [
+    "OrgScopedTable",
+    "PluginBase",
+    "ensure_org_rls",
+    "plugin_safe_id",
+    "plugin_schema",
+    "plugin_table_prefix",
+]

package/backend-sdk/palette_sdk/db/base.py

@@ -11,6 +11,23 @@ from sqlalchemy import BigInteger, Index
 from sqlalchemy.orm import DeclarativeBase, Mapped, declared_attr, mapped_column
 
 
+def plugin_safe_id(plugin_id: str) -> str:
+    """Return the DB-safe form of a plugin id."""
+    import re
+
+    return re.sub(r"[^a-z0-9_]", "_", plugin_id.lower())
+
+
+def plugin_schema(plugin_id: str) -> str:
+    """Return the Postgres schema name owned by a plugin."""
+    return f"app_{plugin_safe_id(plugin_id)}"
+
+
+def plugin_table_prefix(plugin_id: str) -> str:
+    """Return the required table-name prefix for plugin-owned tables."""
+    return f"{plugin_safe_id(plugin_id)}__"
+
+
 class PluginBase(DeclarativeBase):
     """Declarative base for plugin models.
 

package/backend-sdk/palette_sdk/manifest.py

@@ -29,6 +29,8 @@ class ToolEntry(BaseModel):
 class FrontendEntry(BaseModel):
     entry: str
     sandbox: bool = True
+    framework: Literal["react", "next"] = "react"
+    config: str | None = None
 
 
 class BackendEntry(BaseModel):

package/docs/python-backend-sdk.md

@@ -183,7 +183,7 @@ from palette_sdk import OrgScopedTable
 
 
 class Invoice(OrgScopedTable):
-    __tablename__ = "invoices"
+    __tablename__ = "finance_tools__invoices"
 
     id: Mapped[int] = mapped_column(primary_key=True)
     customer_name: Mapped[str] = mapped_column(String(255), nullable=False)
@@ -191,8 +191,10 @@ class Invoice(OrgScopedTable):
     status: Mapped[str] = mapped_column(String(32), default="draft")
 ```
 
-`OrgScopedTable` adds `organization_id` automatically. Do not manually set
-`organization_id` in route code; `ctx.repo(Model)` handles it.
+`OrgScopedTable` adds `organization_id` automatically. Table names must start
+with the app prefix (`finance_tools__` for `finance-tools`) so app-owned data is
+easy to identify and validate. Do not manually set `organization_id` in route
+code; `ctx.repo(Model)` handles it.
 
 ### Migration Example
 
@@ -210,22 +212,22 @@ down_revision = None
 
 def upgrade():
     op.create_table(
-        "invoices",
+        "finance_tools__invoices",
         sa.Column("id", sa.Integer(), primary_key=True),
         sa.Column("organization_id", sa.BigInteger(), nullable=False),
         sa.Column("customer_name", sa.String(length=255), nullable=False),
         sa.Column("amount", sa.Numeric(12, 2), nullable=False),
         sa.Column("status", sa.String(length=32), nullable=False),
     )
-    op.create_index("ix_invoices_org", "invoices", ["organization_id"])
-    ensure_org_rls(op, "invoices")
+    op.create_index("ix_finance_tools__invoices_org", "finance_tools__invoices", ["organization_id"])
+    ensure_org_rls(op, "finance_tools__invoices")
 
 
 def downgrade():
-    op.drop_table("invoices")
+    op.drop_table("finance_tools__invoices")
 ```
 
-`ensure_org_rls(op, "invoices")` enables row-level security so each
+`ensure_org_rls(op, "finance_tools__invoices")` enables row-level security so each
 organization can only access its own rows.
 
 ## 7. Repository CRUD

package/lib/bundler.js

@@ -4,6 +4,13 @@ const path = require("path")
 const fs = require("fs")
 const os = require("os")
 
+const NEXT_CONFIG_NAMES = [
+  "frontend/next.config.ts",
+  "frontend/next.config.mjs",
+  "frontend/next.config.js",
+  "frontend/next.config.cjs",
+]
+
 // esbuild is declared as a dependency in package.json; installed via npm install.
 // We require it lazily so `pltt init` / `pltt dev` / `pltt build` do
 // not pay the load cost.
@@ -18,6 +25,184 @@ function loadEsbuild() {
   }
 }
 
+function frontendFramework(frontend = {}) {
+  return frontend.framework || "react"
+}
+
+function resolveNextConfigPath(pluginDir, frontend = {}) {
+  if (frontend.config) {
+    const explicit = path.resolve(pluginDir, frontend.config)
+    if (!fs.existsSync(explicit)) {
+      throw new Error(`frontend.config not found: ${frontend.config}`)
+    }
+    return explicit
+  }
+
+  for (const candidate of NEXT_CONFIG_NAMES) {
+    const abs = path.resolve(pluginDir, candidate)
+    if (fs.existsSync(abs)) return abs
+  }
+  return null
+}
+
+function requireBundledConfig(absConfig) {
+  const esbuild = loadEsbuild()
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "palette-next-config-"))
+  const outfile = path.join(tmp, "next.config.cjs")
+  try {
+    esbuild.buildSync({
+      entryPoints: [absConfig],
+      bundle: true,
+      platform: "node",
+      target: ["node18"],
+      format: "cjs",
+      outfile,
+      logLevel: "silent",
+      external: ["next"],
+    })
+    delete require.cache[require.resolve(outfile)]
+    const mod = require(outfile)
+    return mod.default || mod
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+}
+
+function loadNextConfig(pluginDir, frontend = {}) {
+  if (frontendFramework(frontend) !== "next") return { config: {}, configPath: null }
+
+  const configPath = resolveNextConfigPath(pluginDir, frontend)
+  if (!configPath) {
+    return { config: {}, configPath: null }
+  }
+
+  const loaded = requireBundledConfig(configPath)
+  const config =
+    typeof loaded === "function"
+      ? loaded("phase-production-build", { defaultConfig: {} })
+      : loaded
+  if (config && typeof config.then === "function") {
+    throw new Error("async next.config is not supported by Palette native Next mode")
+  }
+  if (config && (typeof config !== "object" || Array.isArray(config))) {
+    throw new Error("next.config must export an object or a function returning an object")
+  }
+  return { config: config || {}, configPath }
+}
+
+function readJson(absPath) {
+  try {
+    return JSON.parse(fs.readFileSync(absPath, "utf8"))
+  } catch {
+    return null
+  }
+}
+
+function resolveTsconfig(pluginDir, frontend = {}) {
+  const entryDir = frontend.entry ? path.dirname(path.resolve(pluginDir, frontend.entry)) : path.resolve(pluginDir, "frontend")
+  const candidates = [
+    path.join(entryDir, "tsconfig.json"),
+    path.join(pluginDir, "frontend", "tsconfig.json"),
+    path.join(pluginDir, "tsconfig.json"),
+  ]
+  return candidates.find((candidate) => fs.existsSync(candidate)) || null
+}
+
+function makeTsconfigPathsPlugin(pluginDir, frontend = {}) {
+  const tsconfigPath = resolveTsconfig(pluginDir, frontend)
+  if (!tsconfigPath) return null
+
+  const tsconfig = readJson(tsconfigPath)
+  const compilerOptions = tsconfig?.compilerOptions || {}
+  const paths = compilerOptions.paths || {}
+  const baseUrl = path.resolve(path.dirname(tsconfigPath), compilerOptions.baseUrl || ".")
+  const mappings = []
+
+  for (const [pattern, targets] of Object.entries(paths)) {
+    if (!Array.isArray(targets) || targets.length === 0) continue
+    const starIndex = pattern.indexOf("*")
+    mappings.push({
+      pattern,
+      prefix: starIndex >= 0 ? pattern.slice(0, starIndex) : pattern,
+      suffix: starIndex >= 0 ? pattern.slice(starIndex + 1) : "",
+      hasStar: starIndex >= 0,
+      targets,
+    })
+  }
+
+  if (mappings.length === 0) return null
+
+  const extensions = ["", ".tsx", ".ts", ".jsx", ".js", ".mjs", ".json"]
+  const resolveTarget = (target) => {
+    for (const ext of extensions) {
+      const candidate = path.resolve(baseUrl, `${target}${ext}`)
+      if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) return candidate
+    }
+    const indexCandidates = ["index.tsx", "index.ts", "index.jsx", "index.js", "index.mjs"]
+    for (const indexFile of indexCandidates) {
+      const candidate = path.resolve(baseUrl, target, indexFile)
+      if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) return candidate
+    }
+    return null
+  }
+
+  return {
+    name: "palette-tsconfig-paths",
+    setup(build) {
+      build.onResolve({ filter: /^[^./].*/ }, (args) => {
+        for (const mapping of mappings) {
+          let starValue = ""
+          if (mapping.hasStar) {
+            if (!args.path.startsWith(mapping.prefix) || !args.path.endsWith(mapping.suffix)) continue
+            starValue = args.path.slice(mapping.prefix.length, args.path.length - mapping.suffix.length)
+          } else if (args.path !== mapping.pattern) {
+            continue
+          }
+
+          for (const target of mapping.targets) {
+            const resolved = resolveTarget(String(target).replace("*", starValue))
+            if (resolved) return { path: resolved }
+          }
+        }
+        return null
+      })
+    },
+  }
+}
+
+function frontendBuildConfig(pluginDir, frontend = {}) {
+  const framework = frontendFramework(frontend)
+  const define = {
+    "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV || "production"),
+  }
+  const plugins = []
+  const tsconfigPaths = framework === "next" ? makeTsconfigPathsPlugin(pluginDir, frontend) : null
+  if (tsconfigPaths) plugins.push(tsconfigPaths)
+
+  let nextConfigPath = null
+  if (framework === "next") {
+    const { config, configPath } = loadNextConfig(pluginDir, frontend)
+    nextConfigPath = configPath
+    for (const [key, value] of Object.entries(process.env)) {
+      if (key.startsWith("NEXT_PUBLIC_")) {
+        define[`process.env.${key}`] = JSON.stringify(value)
+      }
+    }
+    for (const [key, value] of Object.entries(config.env || {})) {
+      if (/^[A-Z0-9_]+$/i.test(key)) {
+        define[`process.env.${key}`] = JSON.stringify(value)
+      }
+    }
+    define["process.env.NEXT_RUNTIME"] = JSON.stringify("browser")
+  }
+
+  return { define, plugins, framework, nextConfigPath }
+}
+
+function mergePlugins(...pluginGroups) {
+  return pluginGroups.flat().filter(Boolean)
+}
+
 /**
  * Bundle the plugin's frontend entry into a single ESM file.
  *
@@ -26,13 +211,14 @@ function loadEsbuild() {
  *
  * Returns the bundle as a Buffer.
  */
-async function bundleFrontend(pluginDir, entry) {
+async function bundleFrontend(pluginDir, entry, frontend = {}) {
   pluginDir = path.resolve(pluginDir)
   const esbuild = loadEsbuild()
   const absEntry = path.resolve(pluginDir, entry)
   if (!fs.existsSync(absEntry)) {
     throw new Error(`frontend entry not found: ${entry}`)
   }
+  const buildConfig = frontendBuildConfig(pluginDir, { ...frontend, entry })
 
   const result = await esbuild.build({
     entryPoints: [absEntry],
@@ -43,6 +229,7 @@ async function bundleFrontend(pluginDir, entry) {
     write: false,
     jsx: "automatic",
     loader: { ".ts": "tsx", ".tsx": "tsx", ".js": "jsx", ".jsx": "jsx" },
+    define: buildConfig.define,
     external: [
       "react",
       "react-dom",
@@ -55,6 +242,7 @@ async function bundleFrontend(pluginDir, entry) {
     sourcemap: "inline",
     logLevel: "silent",
     absWorkingDir: pluginDir,
+    plugins: buildConfig.plugins,
   })
 
   if (!result.outputFiles || result.outputFiles.length === 0) {
@@ -63,7 +251,7 @@ async function bundleFrontend(pluginDir, entry) {
   return Buffer.from(result.outputFiles[0].contents)
 }
 
-async function watchFrontend(pluginDir, entry, outfile) {
+async function watchFrontend(pluginDir, entry, outfile, frontend = {}) {
   pluginDir = path.resolve(pluginDir)
   outfile = path.resolve(outfile)
   const esbuild = loadEsbuild()
@@ -71,6 +259,7 @@ async function watchFrontend(pluginDir, entry, outfile) {
   if (!fs.existsSync(absEntry)) {
     throw new Error(`frontend entry not found: ${entry}`)
   }
+  const buildConfig = frontendBuildConfig(pluginDir, { ...frontend, entry })
 
   fs.mkdirSync(path.dirname(outfile), { recursive: true })
 
@@ -83,6 +272,7 @@ async function watchFrontend(pluginDir, entry, outfile) {
     outfile,
     jsx: "automatic",
     loader: { ".ts": "tsx", ".tsx": "tsx", ".js": "jsx", ".jsx": "jsx" },
+    define: buildConfig.define,
     external: [
       "react",
       "react-dom",
@@ -96,6 +286,7 @@ async function watchFrontend(pluginDir, entry, outfile) {
     logLevel: "silent",
     absWorkingDir: pluginDir,
     plugins: [
+      ...buildConfig.plugins,
       {
         name: "palette-dev-watch-logger",
         setup(build) {
@@ -176,4 +367,10 @@ async function bundleBackend(pluginDir) {
   }
 }
 
-module.exports = { bundleFrontend, bundleBackend, watchFrontend }
+module.exports = {
+  bundleFrontend,
+  bundleBackend,
+  watchFrontend,
+  frontendBuildConfig,
+  mergePlugins,
+}

package/lib/cli.js

@@ -64,7 +64,7 @@ function printHelp() {
   console.log("  --token <token>  Publish token for pltt login")
   console.log("  --no-default     Do not make this environment the default")
   console.log("\nInit flags:")
-  console.log("  --template <name>  One of: dashboard, agent-tool, external-service, database, frontend-only")
+  console.log("  --template <name>  One of: dashboard, agent-tool, external-service, database, frontend-only, next")
   console.log("\nLogs flags:")
   console.log("  --tail <n>       Tail last n events (default 50)")
   console.log("  -f, --follow     Stream events (poll every 3s)")

package/lib/commands/build.js

@@ -19,9 +19,35 @@ const BANNED_PATTERNS = [
   { re: /\bDROP\s+SCHEMA\b/i, reason: "DROP SCHEMA is not allowed in plugin migrations" },
 ]
 
-function lintMigrationFile(absPath) {
+function pluginSafeId(pluginId) {
+  return String(pluginId || "").toLowerCase().replace(/[^a-z0-9_]/g, "_")
+}
+
+function pluginSchema(pluginId) {
+  return `app_${pluginSafeId(pluginId)}`
+}
+
+function pluginTablePrefix(pluginId) {
+  return `${pluginSafeId(pluginId)}__`
+}
+
+function crossPluginSchemaRefs(src, allowedSchema) {
+  if (!allowedSchema) return []
+  const refs = new Set()
+  const re = /(^|[^a-z0-9_])"?((?:app)_[a-z0-9_]+)"?\s*\./gi
+  let match
+  while ((match = re.exec(src)) !== null) {
+    const schema = match[2].toLowerCase()
+    if (schema !== allowedSchema) refs.add(schema)
+  }
+  return [...refs].sort()
+}
+
+function lintMigrationFile(absPath, pluginId) {
   const issues = []
   const src = fs.readFileSync(absPath, "utf8")
+  const requiredPrefix = pluginId ? pluginTablePrefix(pluginId) : null
+  const allowedSchema = pluginId ? pluginSchema(pluginId) : null
 
   for (const { re, reason } of BANNED_PATTERNS) {
     if (re.test(src)) {
@@ -29,12 +55,16 @@ function lintMigrationFile(absPath) {
     }
   }
 
+  for (const schema of crossPluginSchemaRefs(src, allowedSchema)) {
+    issues.push(`${path.basename(absPath)}: plugin migrations must not reference another app schema (${schema})`)
+  }
+
   // Every op.create_table("foo", ...) in the file must have a matching
   // ensure_org_rls(op, "foo") somewhere in the same file. Caveat: this is a
   // cheap syntactic check, not a full AST walk. If your table name is dynamic
   // or your migration is unusual, you can silence the check by adding the
   // magic comment `# palette:rls-ok` on the same logical migration.
-  if (/#\s*palette:rls-ok\b/.test(src)) return issues
+  const skipRlsCheck = /#\s*palette:rls-ok\b/.test(src)
 
   const tableNames = new Set()
   const createTableRe = /op\.create_table\(\s*['"]([a-zA-Z_][a-zA-Z0-9_]*)['"]/g
@@ -44,8 +74,13 @@ function lintMigrationFile(absPath) {
   }
 
   for (const name of tableNames) {
+    if (requiredPrefix && !name.startsWith(requiredPrefix)) {
+      issues.push(
+        `${path.basename(absPath)}: create_table("${name}") must use the app table prefix "${requiredPrefix}"`,
+      )
+    }
     const rlsRe = new RegExp(`ensure_org_rls\\(\\s*op\\s*,\\s*['"]${name}['"]`)
-    if (!rlsRe.test(src)) {
+    if (!skipRlsCheck && !rlsRe.test(src)) {
       issues.push(
         `${path.basename(absPath)}: create_table("${name}") is missing ensure_org_rls(op, "${name}"). ` +
           `Inherit from OrgScopedTable and call ensure_org_rls, or mark the migration with # palette:rls-ok if the table is intentionally global.`,
@@ -56,7 +91,7 @@ function lintMigrationFile(absPath) {
   return issues
 }
 
-function lintMigrationsDir(migrationsDir) {
+function lintMigrationsDir(migrationsDir, pluginId) {
   const errors = []
   const versionsDir = path.join(migrationsDir, "versions")
   if (!fs.existsSync(versionsDir)) {
@@ -66,7 +101,7 @@ function lintMigrationsDir(migrationsDir) {
   for (const entry of fs.readdirSync(versionsDir)) {
     if (!entry.endsWith(".py")) continue
     const abs = path.join(versionsDir, entry)
-    errors.push(...lintMigrationFile(abs))
+    errors.push(...lintMigrationFile(abs, pluginId))
   }
   return errors
 }
@@ -92,7 +127,7 @@ async function run(args, { cwd }) {
     } else if (!fs.existsSync(path.join(migrationsAbs, "env.py"))) {
       errors.push(`database.migrations directory is missing env.py: ${migrationsRel}`)
     } else {
-      errors.push(...lintMigrationsDir(migrationsAbs))
+      errors.push(...lintMigrationsDir(migrationsAbs, manifest.id))
     }
   }
 
@@ -107,3 +142,4 @@ async function run(args, { cwd }) {
 module.exports = run
 module.exports.lintMigrationsDir = lintMigrationsDir
 module.exports.lintMigrationFile = lintMigrationFile
+module.exports.pluginTablePrefix = pluginTablePrefix

package/lib/commands/dev.js

@@ -132,7 +132,7 @@ async function run(args, { cwd }) {
   if (manifest.frontend?.entry) {
     console.log(`[pltt] bundling frontend ${frontendEntry} → .palette/dist/frontend.mjs`)
     try {
-      frontendWatcher = await watchFrontend(cwd, frontendEntry, frontendBundle)
+      frontendWatcher = await watchFrontend(cwd, frontendEntry, frontendBundle, manifest.frontend)
     } catch (err) {
       console.error(
         `[pltt] could not start frontend bundler: ${

package/lib/commands/doctor.js

@@ -122,7 +122,7 @@ async function run(args, { cwd }) {
 
     if (manifest.frontend?.entry) {
       try {
-        const bundle = await bundleFrontend(cwd, manifest.frontend.entry)
+        const bundle = await bundleFrontend(cwd, manifest.frontend.entry, manifest.frontend)
         ok(`frontend bundles successfully (${bundle.length} bytes)`)
       } catch (err) {
         failures += fail(

package/lib/commands/init.js

@@ -9,7 +9,7 @@ const DEFAULT_TEMPLATE_REPO = "palette-lab/plugin-template"
 const TEMPLATE_REPO = process.env.PALETTE_TEMPLATE_REPO || DEFAULT_TEMPLATE_REPO
 const TEMPLATE_REF = process.env.PALETTE_TEMPLATE_REF || "main"
 
-const KNOWN_TEMPLATES = ["frontend-only", "dashboard", "agent-tool", "external-service", "database"]
+const KNOWN_TEMPLATES = ["frontend-only", "next", "dashboard", "agent-tool", "external-service", "database"]
 
 function toSlug(name) {
   return name
@@ -19,6 +19,10 @@ function toSlug(name) {
     .replace(/^-|-$/g, "")
 }
 
+function toDbSafeId(pluginId) {
+  return pluginId.toLowerCase().replace(/[^a-z0-9_]/g, "_")
+}
+
 function fetchTemplate(destDir) {
   const git = spawnSync(
     "git",
@@ -69,11 +73,16 @@ function rewriteScaffold(destDir, slug, displayName) {
   if (!fs.existsSync(manifestPath)) return
   const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"))
   const originalId = manifest.id
+  const originalDbSafeId = originalId ? toDbSafeId(originalId) : null
+  const nextDbSafeId = toDbSafeId(slug)
   if (originalId && originalId !== slug) {
     walkFiles(destDir, (filePath) => {
       try {
         const before = fs.readFileSync(filePath, "utf8")
-        const after = before.split(originalId).join(slug)
+        let after = before.split(originalId).join(slug)
+        if (originalDbSafeId && originalDbSafeId !== nextDbSafeId) {
+          after = after.split(originalDbSafeId).join(nextDbSafeId)
+        }
         if (after !== before) fs.writeFileSync(filePath, after)
       } catch (_err) {
         // Ignore non-text files. Templates are expected to be text, but this
@@ -85,7 +94,7 @@ function rewriteScaffold(destDir, slug, displayName) {
   rewrittenManifest.id = slug
   rewrittenManifest.name = displayName
   if (rewrittenManifest.database?.schema) {
-    rewrittenManifest.database.schema = `app_${slug.replace(/-/g, "_")}`
+    rewrittenManifest.database.schema = `app_${nextDbSafeId}`
   }
   fs.writeFileSync(manifestPath, JSON.stringify(rewrittenManifest, null, 2) + "\n")
 }
@@ -96,6 +105,14 @@ function getOpt(args, name) {
   return null
 }
 
+function hasPathSegment(value) {
+  return value.includes("/") || value.includes("\\")
+}
+
+function targetName(input) {
+  return path.basename(input.replace(/[\\/]+$/, ""))
+}
+
 async function run(args, { cwd }) {
   const positional = args.filter((a) => !a.startsWith("-"))
   const name = positional[0]
@@ -110,11 +127,18 @@ async function run(args, { cwd }) {
     console.error(`[pltt] templates: ${KNOWN_TEMPLATES.join(", ")}`)
     process.exit(1)
   }
-  const slug = toSlug(name)
-  const displayName = name
+  const targetBase = targetName(name)
+  const slug = toSlug(targetBase)
+  if (!slug) {
+    console.error(`[pltt] invalid plugin name: ${name}`)
+    process.exit(1)
+  }
+  const displayName = targetBase
     .replace(/[-_]+/g, " ")
     .replace(/\b\w/g, (c) => c.toUpperCase())
-  const destDir = path.join(cwd, slug)
+  const destDir = path.isAbsolute(name) || hasPathSegment(name)
+    ? path.resolve(cwd, name)
+    : path.join(cwd, slug)
   if (fs.existsSync(destDir)) {
     console.error(`[pltt] directory already exists: ${destDir}`)
     process.exit(1)
@@ -144,7 +168,7 @@ async function run(args, { cwd }) {
 
   console.log(`[pltt] created ${destDir}`)
   console.log("[pltt] next steps:")
-  console.log(`  cd ${slug}`)
+  console.log(`  cd ${path.relative(cwd, destDir) || "."}`)
   console.log("  npm install")
   console.log(`  npx @palettelab/cli dev`)
   console.log(`  # or, after global install: pltt dev`)

package/lib/commands/package.js

@@ -24,7 +24,7 @@ async function run(argv, { cwd }) {
   fs.mkdirSync(distDir, { recursive: true })
 
   const frontend = manifest.frontend
-    ? await bundleFrontend(cwd, manifest.frontend.entry || "./frontend/src/index.tsx")
+    ? await bundleFrontend(cwd, manifest.frontend.entry || "./frontend/src/index.tsx", manifest.frontend)
     : null
   const backend = manifest.backend ? await bundleBackend(cwd) : null
 

package/lib/commands/publish.js

@@ -125,7 +125,7 @@ async function run(argv, { cwd }) {
   let frontend = null
   if (manifest.frontend?.entry) {
     log("[pltt]   bundling frontend")
-    frontend = await bundleFrontend(cwd, manifest.frontend.entry)
+    frontend = await bundleFrontend(cwd, manifest.frontend.entry, manifest.frontend)
     log(`[pltt]     ${frontend.length} bytes`)
   } else {
     log("[pltt]   no frontend declared")

package/lib/commands/test.js

@@ -252,7 +252,7 @@ function lintMigrations(cwd, manifest, out) {
   if (!fs.existsSync(path.join(migrationsAbs, "env.py"))) {
     return out.fail(`database.migrations directory is missing env.py: ${migrationsRel}`)
   }
-  const errors = buildCommand.lintMigrationsDir(migrationsAbs)
+  const errors = buildCommand.lintMigrationsDir(migrationsAbs, manifest.id)
   for (const err of errors) out.fail(err)
   if (errors.length === 0) out.ok("migration lint passed")
   return errors.length
@@ -498,9 +498,13 @@ function scanForbiddenImports(cwd, manifest, out) {
   const roots = []
   if (manifest.frontend?.entry) roots.push(path.resolve(cwd, "frontend"))
   if (manifest.backend?.entry) roots.push(path.resolve(cwd, "backend"))
+  const allowLocalNextAlias = manifest.frontend?.framework === "next"
+  const frontendImportPrefix = allowLocalNextAlias
+    ? "(?:app/|backend/|frontend/)"
+    : "(?:@/|app/|backend/|frontend/)"
   const forbidden = [
-    { re: /from\s+["'](?:@\/|app\/|backend\/|frontend\/)/, reason: "frontend imports platform source" },
-    { re: /import\s+["'](?:@\/|app\/|backend\/|frontend\/)/, reason: "frontend imports platform source" },
+    { re: new RegExp(`from\\s+["']${frontendImportPrefix}`), reason: "frontend imports platform source" },
+    { re: new RegExp(`import\\s+["']${frontendImportPrefix}`), reason: "frontend imports platform source" },
     { re: /^\s*(?:from|import)\s+app(?:\.|\s)/m, reason: "backend imports platform app source" },
   ]
   const issues = []
@@ -655,7 +659,7 @@ async function run(args, { cwd }) {
 
   if (manifest.frontend?.entry) {
     try {
-      const frontend = await bundleFrontend(cwd, manifest.frontend.entry)
+      const frontend = await bundleFrontend(cwd, manifest.frontend.entry, manifest.frontend)
       out.ok(`frontend bundles successfully (${frontend.length} bytes)`, { bytes: frontend.length })
       failures += checkBundleSize("frontend", frontend.length, out)
       failures += sandboxBridgeSmoke(cwd, manifest, out)

package/lib/dev-simulator.js

@@ -6,6 +6,7 @@ const path = require("path")
 const { spawn, spawnSync } = require("child_process")
 
 const { loadManifest } = require("./manifest")
+const { frontendBuildConfig } = require("./bundler")
 
 function loadEsbuild() {
   try {
@@ -360,6 +361,7 @@ async function startFrontend(cwd, devDir, manifest, frontendPort, backendPort) {
   const generatedEntry = path.join(devDir, "simulator-entry.jsx")
   const bundlePath = path.join(devDir, "simulator.js")
   fs.writeFileSync(generatedEntry, simulatorEntrySource(absEntry, manifest, backendPort))
+  const buildConfig = frontendBuildConfig(cwd, { ...(manifest.frontend || {}), entry })
 
   const esbuild = loadEsbuild()
   const ctx = await esbuild.context({
@@ -371,10 +373,12 @@ async function startFrontend(cwd, devDir, manifest, frontendPort, backendPort) {
     outfile: bundlePath,
     jsx: "automatic",
     loader: { ".ts": "tsx", ".tsx": "tsx", ".js": "jsx", ".jsx": "jsx" },
+    define: buildConfig.define,
     absWorkingDir: cwd,
     sourcemap: "inline",
     logLevel: "silent",
     plugins: [
+      ...buildConfig.plugins,
       {
         name: "palette-simulator-watch",
         setup(build) {

package/lib/manifest.js

@@ -69,6 +69,18 @@ function isObject(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v)
 }
 
+function pluginSafeId(pluginId) {
+  return String(pluginId || "").toLowerCase().replace(/[^a-z0-9_]/g, "_")
+}
+
+function expectedPluginSchema(pluginId) {
+  return `app_${pluginSafeId(pluginId)}`
+}
+
+function expectedTablePrefix(pluginId) {
+  return `${pluginSafeId(pluginId)}__`
+}
+
 function unknownKeys(obj, allowed, label, errors) {
   if (!isObject(obj)) return
   for (const key of Object.keys(obj)) {
@@ -127,11 +139,19 @@ function validateManifest(m) {
   if (m.frontend !== undefined) {
     if (!isObject(m.frontend)) errors.push("frontend must be an object")
     else {
-      unknownKeys(m.frontend, new Set(["entry", "sandbox"]), "frontend", errors)
+      unknownKeys(m.frontend, new Set(["entry", "sandbox", "framework", "config"]), "frontend", errors)
       if (!m.frontend.entry || typeof m.frontend.entry !== "string") {
         errors.push("frontend.entry is required when frontend is set")
       }
       requireBoolean(m.frontend, "sandbox", "frontend", errors)
+      requireString(m.frontend, "framework", "frontend", errors)
+      requireString(m.frontend, "config", "frontend", errors)
+      if (m.frontend.framework !== undefined && !["react", "next"].includes(m.frontend.framework)) {
+        errors.push('frontend.framework must be "react" or "next"')
+      }
+      if (m.frontend.config !== undefined && m.frontend.framework !== "next") {
+        errors.push('frontend.config is only supported when frontend.framework is "next"')
+      }
     }
   }
   if (m.backend !== undefined) {
@@ -241,11 +261,21 @@ function validateManifest(m) {
       }
       if (m.database.schema !== undefined && !/^app_[a-z0-9_]+$/.test(m.database.schema)) {
         errors.push("database.schema must match /^app_[a-z0-9_]+$/")
+      } else if (m.database.schema !== undefined && m.id && m.database.schema !== expectedPluginSchema(m.id)) {
+        errors.push(`database.schema must be ${expectedPluginSchema(m.id)} for plugin ${m.id}`)
       }
     }
   }
 
   validateArray(m.shared_tables, "shared_tables", errors)
+  if (Array.isArray(m.shared_tables) && m.id) {
+    const prefix = expectedTablePrefix(m.id)
+    for (const table of m.shared_tables) {
+      if (typeof table === "string" && !table.startsWith(prefix)) {
+        errors.push(`shared_tables entries must use the app table prefix "${prefix}": ${table}`)
+      }
+    }
+  }
   validateArray(m.permissions, "permissions", errors)
   if (Array.isArray(m.permissions)) {
     const seen = new Set()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@palettelab/cli",
-  "version": "0.3.28",
+  "version": "0.3.30",
   "description": "Developer CLI for building Palette platform plugins — no platform source access required.",
   "bin": {
     "pltt": "bin/pltt.js"

package/template-fallback/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "description": "A Palette platform plugin",
   "dependencies": {
-    "@palettelab/sdk": "^0.1.11"
+    "@palettelab/sdk": "^0.1.12"
   },
   "devDependencies": {
     "typescript": "^5.0.0",

package/template-fallback/palette-plugin.json

@@ -13,7 +13,7 @@
     "text": "#fff"
   },
   "sdk": {
-    "frontend": "^0.1.11",
+    "frontend": "^0.1.12",
     "backend": "^0.1.0"
   },
   "platform": {

package/template-fallback/templates/dashboard/package.json

@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "private": true,
   "dependencies": {
-    "@palettelab/sdk": "^0.1.11",
+    "@palettelab/sdk": "^0.1.12",
     "react": "^19.0.0"
   }
 }

package/template-fallback/templates/dashboard/palette-plugin.json

@@ -9,7 +9,7 @@
   "description": "A widget that exposes a dashboard data source and renders a chart from it.",
   "icon": "ChartBar",
   "gradient": { "bg": "linear-gradient(135deg, #06B6D4, #6366F1)", "text": "#fff" },
-  "sdk": { "frontend": "^0.1.11", "backend": "^0.1.0" },
+  "sdk": { "frontend": "^0.1.12", "backend": "^0.1.0" },
   "platform": { "min_version": "0.1.0" },
   "capabilities": {
     "frontend": true,

package/template-fallback/templates/database/backend/api/models.py

@@ -5,7 +5,7 @@ from palette_sdk.db import OrgScopedTable
 
 
 class Note(OrgScopedTable):
-    __tablename__ = "notes"
+    __tablename__ = "my_db_plugin__notes"
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
     body: Mapped[str] = mapped_column(Text, nullable=False)

package/template-fallback/templates/database/backend/migrations/versions/001_init.py

@@ -11,15 +11,15 @@ down_revision = None
 
 def upgrade() -> None:
     op.create_table(
-        "notes",
+        "my_db_plugin__notes",
         sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
         sa.Column("organization_id", sa.BigInteger(), nullable=False),
         sa.Column("body", sa.Text(), nullable=False),
     )
-    op.create_index("ix_notes_org", "notes", ["organization_id"])
-    ensure_org_rls(op, "notes")
+    op.create_index("ix_my_db_plugin__notes_org", "my_db_plugin__notes", ["organization_id"])
+    ensure_org_rls(op, "my_db_plugin__notes")
 
 
 def downgrade() -> None:
-    op.drop_index("ix_notes_org", table_name="notes")
-    op.drop_table("notes")
+    op.drop_index("ix_my_db_plugin__notes_org", table_name="my_db_plugin__notes")
+    op.drop_table("my_db_plugin__notes")

package/template-fallback/templates/database/package.json

@@ -2,5 +2,5 @@
   "name": "my-db-plugin",
   "version": "1.0.0",
   "private": true,
-  "dependencies": { "@palettelab/sdk": "^0.1.11", "react": "^19.0.0" }
+  "dependencies": { "@palettelab/sdk": "^0.1.12", "react": "^19.0.0" }
 }

package/template-fallback/templates/database/palette-plugin.json

@@ -9,7 +9,7 @@
   "description": "Stores notes per organization with RLS-enforced isolation.",
   "icon": "Database",
   "gradient": { "bg": "linear-gradient(135deg, #8B5CF6, #EC4899)", "text": "#fff" },
-  "sdk": { "frontend": "^0.1.11", "backend": "^0.1.0" },
+  "sdk": { "frontend": "^0.1.12", "backend": "^0.1.0" },
   "platform": { "min_version": "0.1.0" },
   "capabilities": {
     "frontend": true,

package/template-fallback/templates/external-service/package.json

@@ -2,5 +2,5 @@
   "name": "my-external-svc",
   "version": "1.0.0",
   "private": true,
-  "dependencies": { "@palettelab/sdk": "^0.1.11", "react": "^19.0.0" }
+  "dependencies": { "@palettelab/sdk": "^0.1.12", "react": "^19.0.0" }
 }

package/template-fallback/templates/external-service/palette-plugin.json

@@ -9,7 +9,7 @@
   "description": "Demonstrates declared external_network access and a scoped per-org config token.",
   "icon": "CloudArrowUp",
   "gradient": { "bg": "linear-gradient(135deg, #10B981, #06B6D4)", "text": "#fff" },
-  "sdk": { "frontend": "^0.1.11", "backend": "^0.1.0" },
+  "sdk": { "frontend": "^0.1.12", "backend": "^0.1.0" },
   "platform": { "min_version": "0.1.0" },
   "capabilities": {
     "frontend": true,

package/template-fallback/templates/frontend-only/package.json

@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "private": true,
   "dependencies": {
-    "@palettelab/sdk": "^0.1.11",
+    "@palettelab/sdk": "^0.1.12",
     "react": "^19.0.0"
   }
 }

package/template-fallback/templates/frontend-only/palette-plugin.json

@@ -9,7 +9,7 @@
   "description": "A frontend-only plugin — renders inside the platform iframe sandbox with no backend.",
   "icon": "Puzzle",
   "gradient": { "bg": "linear-gradient(135deg, #6366F1, #8B5CF6)", "text": "#fff" },
-  "sdk": { "frontend": "^0.1.11" },
+  "sdk": { "frontend": "^0.1.12" },
   "platform": { "min_version": "0.1.0" },
   "capabilities": {
     "frontend": true,

package/template-fallback/templates/next/README.md

@@ -0,0 +1,40 @@
+# Next-Compatible Palette Plugin
+
+This template keeps config at `frontend/next.config.ts`.
+
+Palette native apps still publish as a single React module, so `pltt` does not
+run a full Next server. In `frontend.framework: "next"` mode the CLI reads the
+Next config for supported native-bundle settings.
+
+## Files
+
+```text
+frontend/
+├── next.config.ts
+├── tsconfig.json
+└── src/
+    ├── index.tsx
+    └── translations.ts
+```
+
+The manifest enables this mode:
+
+```json
+{
+  "frontend": {
+    "entry": "./frontend/src/index.tsx",
+    "sandbox": true,
+    "framework": "next",
+    "config": "./frontend/next.config.ts"
+  }
+}
+```
+
+`pltt dev`, `pltt test`, `pltt package`, and `pltt publish` load
+`next.config.ts/js/mjs/cjs`, apply `env` values plus `NEXT_PUBLIC_*`
+environment variables to the native bundle, and honor aliases from
+`frontend/tsconfig.json`.
+
+Supported today: `env`, `NEXT_PUBLIC_*`, and TypeScript path aliases. Full Next
+server features such as API routes, server components, middleware, image
+optimization, and static export hosting are outside this native module mode.

package/template-fallback/templates/next/frontend/next.config.ts

@@ -0,0 +1,8 @@
+const nextConfig = {
+  env: {
+    NEXT_PUBLIC_PLUGIN_FRAMEWORK: "next",
+  },
+  transpilePackages: ["@palettelab/sdk"],
+}
+
+export default nextConfig

package/template-fallback/templates/next/frontend/src/index.tsx

@@ -0,0 +1,30 @@
+"use client"
+
+import { usePluginTranslations } from "@palettelab/sdk"
+import type { PluginComponentProps } from "@palettelab/sdk"
+import { translations } from "@/translations"
+
+export default function NextCompatiblePlugin(_props: PluginComponentProps) {
+  const { t, language, setLanguage } = usePluginTranslations(translations)
+  const framework = process.env.NEXT_PUBLIC_PLUGIN_FRAMEWORK || "next"
+
+  return (
+    <main className="p-6 space-y-4">
+      <div className="flex items-start justify-between gap-3">
+        <div>
+          <h1 className="text-2xl font-bold">{t("title")}</h1>
+          <p className="mt-2 text-muted-foreground">{t("body")}</p>
+        </div>
+        <button
+          className="px-3 py-1.5 text-sm border rounded-md hover:bg-muted"
+          onClick={() => setLanguage(language === "ko" ? "en" : "ko")}
+        >
+          {language === "ko" ? "EN" : "KO"}
+        </button>
+      </div>
+      <p className="text-sm text-muted-foreground">
+        {t("framework", { framework })}
+      </p>
+    </main>
+  )
+}

package/template-fallback/templates/next/frontend/src/translations.ts

@@ -0,0 +1,14 @@
+import type { TranslationResources } from "@palettelab/sdk"
+
+export const translations = {
+  en: {
+    title: "Next-Compatible App",
+    body: "This app reads frontend/next.config.ts and follows the Palette OS language.",
+    framework: "Framework: {{framework}}",
+  },
+  ko: {
+    title: "Next 호환 앱",
+    body: "이 앱은 frontend/next.config.ts를 읽고 Palette OS 언어를 따릅니다.",
+    framework: "프레임워크: {{framework}}",
+  },
+} satisfies TranslationResources

package/template-fallback/templates/next/frontend/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["src/*"]
+    },
+    "jsx": "react-jsx",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "target": "es2022",
+    "strict": true,
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts", "src/**/*.tsx", "next.config.ts"]
+}

package/template-fallback/templates/next/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "my-next-plugin",
+  "version": "1.0.0",
+  "private": true,
+  "dependencies": {
+    "@palettelab/sdk": "^0.1.12",
+    "react": "^19.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.0.0",
+    "@types/react": "^19.0.0"
+  }
+}

package/template-fallback/templates/next/palette-plugin.json

@@ -0,0 +1,30 @@
+{
+  "manifest_version": "1",
+  "id": "my-next-plugin",
+  "name": "My Next Plugin",
+  "version": "1.0.0",
+  "developer": "Your Team",
+  "category": "Productivity",
+  "tagline": "A native Palette app with Next-compatible frontend config",
+  "description": "Uses frontend.framework=next so pltt reads frontend/next.config.ts while still publishing a native Palette module.",
+  "icon": "Puzzle",
+  "gradient": { "bg": "linear-gradient(135deg, #0F766E, #2563EB)", "text": "#fff" },
+  "sdk": { "frontend": "^0.1.12" },
+  "platform": { "min_version": "0.1.0" },
+  "capabilities": {
+    "frontend": true,
+    "backend": false,
+    "database": false,
+    "webhooks": false,
+    "scheduled_jobs": false,
+    "file_uploads": false,
+    "external_network": []
+  },
+  "frontend": {
+    "entry": "./frontend/src/index.tsx",
+    "sandbox": true,
+    "framework": "next",
+    "config": "./frontend/next.config.ts"
+  },
+  "permissions": []
+}