@palettelab/cli 0.3.48 → 0.3.50

package/lib/bundler.js

@@ -4,6 +4,7 @@ const path = require("path")
 const fs = require("fs")
 const os = require("os")
 const { generatePaletteAppEntry } = require("./app-router")
+const { appendCssExport, scopePluginCss } = require("./css-scope")
 
 const NEXT_CONFIG_NAMES = [
   "frontend/next.config.ts",
@@ -382,6 +383,43 @@ function mergePlugins(...pluginGroups) {
   return pluginGroups.flat().filter(Boolean)
 }
 
+function pluginCssScopeId(frontend = {}) {
+  return frontend.pluginId || frontend.id || "plugin"
+}
+
+function cssOutputForJs(outfile) {
+  const ext = path.extname(outfile)
+  return `${outfile.slice(0, outfile.length - ext.length)}.css`
+}
+
+function outputPathFromMetafile(result, suffix) {
+  const outputs = Object.keys(result.metafile?.outputs || {})
+  return outputs.find((output) => output.endsWith(suffix)) || null
+}
+
+function writeScopedCssExport({ jsPath, cssPath, pluginId, deleteCss = true }) {
+  if (!cssPath || !fs.existsSync(cssPath)) return
+  const css = fs.readFileSync(cssPath, "utf8")
+  const scopedCss = scopePluginCss(css, pluginId)
+  if (scopedCss.trim()) {
+    const js = fs.readFileSync(jsPath, "utf8")
+    fs.writeFileSync(jsPath, appendCssExport(js, scopedCss))
+  }
+  if (deleteCss) fs.rmSync(cssPath, { force: true })
+}
+
+function bundleOutputsToFrontendBuffer(result, pluginId) {
+  const outputs = result.outputFiles || []
+  const jsOutput = outputs.find((file) => /\.(mjs|js)$/.test(file.path))
+  if (!jsOutput) throw new Error("esbuild produced no JavaScript output")
+  const css = outputs
+    .filter((file) => file.path.endsWith(".css"))
+    .map((file) => file.text)
+    .join("\n")
+  const js = jsOutput.text
+  return Buffer.from(appendCssExport(js, scopePluginCss(css, pluginId)))
+}
+
 /**
  * Bundle the plugin's frontend entry into a single ESM file.
  *
@@ -393,8 +431,8 @@ function mergePlugins(...pluginGroups) {
 async function bundleFrontend(pluginDir, entry, frontend = {}) {
   pluginDir = path.resolve(pluginDir)
   const esbuild = loadEsbuild()
-  const tmp = isPaletteApp(frontend) ? fs.mkdtempSync(path.join(os.tmpdir(), "palette-app-entry-")) : null
-  const bundleEntry = tmp
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "palette-frontend-"))
+  const bundleEntry = isPaletteApp(frontend)
     ? generatePaletteAppEntry(pluginDir, entry || "./frontend/app", path.join(tmp, "entry.tsx"))
     : entry
   const absEntry = path.resolve(pluginDir, bundleEntry)
@@ -407,6 +445,7 @@ async function bundleFrontend(pluginDir, entry, frontend = {}) {
     const result = await esbuild.build({
       entryPoints: [absEntry],
       bundle: true,
+      outfile: path.join(tmp, "frontend.mjs"),
       format: "esm",
       platform: "browser",
       target: ["es2022"],
@@ -432,9 +471,9 @@ async function bundleFrontend(pluginDir, entry, frontend = {}) {
     if (!result.outputFiles || result.outputFiles.length === 0) {
       throw new Error("esbuild produced no output")
     }
-    return Buffer.from(result.outputFiles[0].contents)
+    return bundleOutputsToFrontendBuffer(result, pluginCssScopeId(frontend))
   } finally {
-    if (tmp) fs.rmSync(tmp, { recursive: true, force: true })
+    fs.rmSync(tmp, { recursive: true, force: true })
   }
 }
 
@@ -473,6 +512,7 @@ async function watchFrontend(pluginDir, entry, outfile, frontend = {}) {
     ],
     minify: false,
     sourcemap: "inline",
+    metafile: true,
     logLevel: "silent",
     absWorkingDir: pluginDir,
     plugins: [
@@ -488,6 +528,12 @@ async function watchFrontend(pluginDir, entry, outfile, frontend = {}) {
               }
               return
             }
+            const cssPath = outputPathFromMetafile(result, ".css") || cssOutputForJs(outfile)
+            writeScopedCssExport({
+              jsPath: outfile,
+              cssPath,
+              pluginId: pluginCssScopeId(frontend),
+            })
             const size = fs.existsSync(outfile) ? fs.statSync(outfile).size : 0
             console.log(`[pltt] frontend bundle ready (${size} bytes)`)
           })
@@ -509,7 +555,7 @@ async function watchFrontend(pluginDir, entry, outfile, frontend = {}) {
  *   ./backend/...
  *   ./palette-plugin.json
  */
-async function bundleBackend(pluginDir) {
+async function bundleBackend(pluginDir, options = {}) {
   pluginDir = path.resolve(pluginDir)
   const { spawnSync } = require("child_process")
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "palette-bundle-"))
@@ -531,9 +577,16 @@ async function bundleBackend(pluginDir) {
     const backendDir = path.join(pluginDir, "backend")
     if (fs.existsSync(backendDir)) copy(backendDir, path.join(stage, "backend"))
     for (const metadataFile of ["package.json", "pyproject.toml", "palette-plugin.json"]) {
+      if (metadataFile === "palette-plugin.json" && options.manifest) continue
       const src = path.join(pluginDir, metadataFile)
       if (fs.existsSync(src)) fs.copyFileSync(src, path.join(stage, metadataFile))
     }
+    if (options.manifest) {
+      fs.writeFileSync(
+        path.join(stage, "palette-plugin.json"),
+        JSON.stringify(options.manifest, null, 2),
+      )
+    }
 
     const sdkDir = path.resolve(__dirname, "..", "backend-sdk", "palette_sdk")
     const targetSdkDir = path.join(stage, "backend", "palette_sdk")

package/lib/cli.js

@@ -11,6 +11,7 @@ const pkg = require("./commands/package")
 const status = require("./commands/status")
 const logs = require("./commands/logs")
 const secrets = require("./commands/secrets")
+const services = require("./commands/services")
 
 const COMMANDS = {
   init: { run: init, help: "Scaffold a new plugin directory from the template" },
@@ -50,6 +51,10 @@ const COMMANDS = {
     run: secrets,
     help: "Initialize local env files and manage plugin-scope secrets",
   },
+  services: {
+    run: services,
+    help: "Inspect / pull / scaffold OS-broker services (list, pull, scaffold)",
+  },
 }
 
 function printHelp() {
@@ -77,6 +82,11 @@ function printHelp() {
   console.log("\nLogs flags:")
   console.log("  --tail <n>       Tail last n events (default 50)")
   console.log("  -f, --follow     Stream events (poll every 3s)")
+  console.log("\nServices (OS broker):")
+  console.log("  pltt services list            # show provided services/events in the org")
+  console.log("  pltt services add TARGET      # add a consumed service/event target")
+  console.log("  pltt services pull            # generate typed TS+Python clients from consumes")
+  console.log("  pltt services scaffold NAME   # add a provider method (schemas + handler stub)")
   console.log("\nSecrets:")
   console.log("  pltt secrets init")
   console.log("  pltt secrets set NAME --value <secret> --env staging")

package/lib/commands/dev.js

@@ -172,7 +172,10 @@ async function run(args, { cwd }) {
   if (manifest.frontend?.entry) {
     console.log(`[pltt] bundling frontend ${frontendEntry} → .palette/dist/frontend.mjs`)
     try {
-      frontendWatcher = await watchFrontend(cwd, frontendEntry, frontendBundle, manifest.frontend)
+      frontendWatcher = await watchFrontend(cwd, frontendEntry, frontendBundle, {
+        ...manifest.frontend,
+        pluginId,
+      })
     } catch (err) {
       console.error(
         `[pltt] could not start frontend bundler: ${

package/lib/commands/doctor.js

@@ -6,7 +6,7 @@ const { spawnSync } = require("child_process")
 const { loadManifest, validateManifest } = require("../manifest")
 const { bundleFrontend } = require("../bundler")
 const { DEFAULT_BACKEND_DEV_PORT, DEFAULT_FRONTEND_DEV_PORT, resolveDevPorts } = require("../ports")
-const { declaredSecrets, loadLocalEnv } = require("../secrets")
+const { declaredSecrets, loadLocalEnvDetails } = require("../secrets")
 
 const DEFAULT_IMAGE =
   process.env.PALETTE_DEV_IMAGE || "ghcr.io/palette-lab/platform-dev:latest"
@@ -122,19 +122,20 @@ async function run(args, { cwd }) {
     }
 
     const secrets = declaredSecrets(manifest)
-    const localSecrets = loadLocalEnv(cwd, { apply: false })
+    const localEnv = loadLocalEnvDetails(cwd, { apply: false })
+    const localSecrets = localEnv.values
     if (Object.keys(secrets).length === 0) {
       ok("no manifest secrets declared")
     } else {
       ok(`manifest declares ${Object.keys(secrets).length} secret(s)`)
       for (const [name, spec] of Object.entries(secrets)) {
         if (spec.scope.includes("dev") && !localSecrets[name]) {
-          warn(`local dev secret missing: ${name}`, "Run pltt secrets init and fill .palette/.env.local.")
+          warn(`local dev secret missing: ${name}`, "Add it to .env, .env.local, or an environment-specific .env file.")
         }
         if (spec.scope.includes("plugin") && spec.required && !localSecrets[name] && !process.env[name]) {
           warn(
             `plugin secret missing locally: ${name}`,
-            "Set an env var, pass --secrets-file to publish, or run pltt secrets set after first publish.",
+            "Add it to .env/.env.local, set an env var, pass --secrets-file, or run pltt secrets set.",
           )
         }
       }
@@ -142,7 +143,10 @@ async function run(args, { cwd }) {
 
     if (manifest.frontend?.entry) {
       try {
-        const bundle = await bundleFrontend(cwd, manifest.frontend.entry, manifest.frontend)
+        const bundle = await bundleFrontend(cwd, manifest.frontend.entry, {
+          ...manifest.frontend,
+          pluginId: manifest.id,
+        })
         ok(`frontend bundles successfully (${bundle.length} bytes)`)
       } catch (err) {
         failures += fail(

package/lib/commands/package.js

@@ -43,7 +43,10 @@ async function run(argv, { cwd }) {
   fs.mkdirSync(distDir, { recursive: true })
 
   const frontend = manifest.frontend
-    ? await bundleFrontend(cwd, manifest.frontend.entry || "./frontend/src/index.tsx", manifest.frontend)
+    ? await bundleFrontend(cwd, manifest.frontend.entry || "./frontend/src/index.tsx", {
+        ...manifest.frontend,
+        pluginId: manifest.id,
+      })
     : null
   const backend = manifest.backend ? await bundleBackend(cwd) : null
 

package/lib/commands/publish.js

@@ -12,10 +12,13 @@ const {
   confirmProduction,
 } = require("../environments")
 const {
+  canAutoUploadEnvKey,
   declaredSecrets,
+  isPublicEnvKey,
+  isReservedAutoEnvKey,
+  loadLocalEnvDetails,
   loadLocalEnv,
   parseDotEnv,
-  readDotEnvFile,
   redactValue,
 } = require("../secrets")
 
@@ -138,12 +141,12 @@ function printPreflightFailure(payload, fallbackOutput) {
   console.error("[pltt] Need machine-readable details? Run `pltt test --json`.")
 }
 
-function runPreflight(cwd, json, publishType = "release") {
+function runPreflight(cwd, json, publishType = "release", environment) {
   const cliBin = path.resolve(__dirname, "..", "..", "bin", "pltt.js")
   const res = spawnSync(process.execPath, [cliBin, "test", "--json", "--publish-type", publishType], {
     cwd,
     encoding: "utf8",
-    env: process.env,
+    env: environment ? { ...process.env, PALETTE_ENV: environment } : process.env,
   })
 
   if (res.status === 0) {
@@ -218,7 +221,18 @@ async function put(url, buf, contentType) {
   }
 }
 
-function collectPluginSecrets(cwd, manifest, env, flags, log) {
+function scopesOf(spec) {
+  if (!spec || typeof spec !== "object" || Array.isArray(spec)) return ["dev"]
+  if (Array.isArray(spec.scope)) return spec.scope
+  if (typeof spec.scope === "string") return [spec.scope]
+  return ["dev"]
+}
+
+function cloneManifest(manifest) {
+  return JSON.parse(JSON.stringify(manifest))
+}
+
+function collectPluginSecrets(cwd, manifest, env, flags, log, localEnv) {
   const declared = declaredSecrets(manifest)
   const pluginSecrets = Object.entries(declared).filter(([, spec]) => spec.scope.includes("plugin"))
   const devRequired = Object.entries(declared).filter(([, spec]) => spec.scope.includes("dev") && spec.required)
@@ -232,7 +246,8 @@ function collectPluginSecrets(cwd, manifest, env, flags, log) {
   if (flags.secretsFile) {
     fileValues = parseDotEnv(fs.readFileSync(path.resolve(cwd, flags.secretsFile), "utf8"))
   }
-  const localValues = readDotEnvFile(path.join(cwd, ".palette", ".env.local"))
+  const localValues = localEnv?.values || loadLocalEnv(cwd, { apply: false, environment: env.name })
+  const candidateValues = { ...localValues, ...fileValues }
   const values = {}
   const missing = []
   for (const [name, spec] of pluginSecrets) {
@@ -249,10 +264,61 @@ function collectPluginSecrets(cwd, manifest, env, flags, log) {
         `Set env vars, pass --secrets-file, or run pltt secrets set <NAME> --env ${env.name}.`,
     )
   }
+  const effectiveManifest = cloneManifest(manifest)
+  effectiveManifest.secrets =
+    effectiveManifest.secrets && typeof effectiveManifest.secrets === "object" && !Array.isArray(effectiveManifest.secrets)
+      ? { ...effectiveManifest.secrets }
+      : {}
+  const autoUploaded = []
+  const publicBundled = []
+  const skippedReserved = []
+  const skippedInvalid = []
+  for (const [name, value] of Object.entries(candidateValues)) {
+    if (!value) continue
+    if (isPublicEnvKey(name)) {
+      publicBundled.push(name)
+      continue
+    }
+    const explicitSpec = effectiveManifest.secrets[name]
+    if (explicitSpec) {
+      if (scopesOf(explicitSpec).includes("plugin")) values[name] = fileValues[name] ?? process.env[name] ?? localValues[name]
+      continue
+    }
+    if (isReservedAutoEnvKey(name)) {
+      skippedReserved.push(name)
+      continue
+    }
+    if (!canAutoUploadEnvKey(name)) {
+      skippedInvalid.push(name)
+      continue
+    }
+    effectiveManifest.secrets[name] = {
+      scope: "plugin",
+      required: false,
+      help: "Auto-uploaded from local .env by Palette CLI.",
+    }
+    values[name] = fileValues[name] ?? process.env[name] ?? localValues[name]
+    autoUploaded.push(name)
+  }
+  if (localEnv?.files?.length) {
+    log(`[pltt]   env files: ${localEnv.files.join(", ")}`)
+  }
+  if (autoUploaded.length) {
+    log(`[pltt]   auto plugin secrets from .env: ${autoUploaded.sort().join(", ")}`)
+  }
+  if (publicBundled.length) {
+    log(`[pltt]   public env bundled in frontend: ${Array.from(new Set(publicBundled)).sort().join(", ")}`)
+  }
+  if (skippedReserved.length) {
+    log(`[pltt]   skipped reserved env keys: ${Array.from(new Set(skippedReserved)).sort().join(", ")}`)
+  }
+  if (skippedInvalid.length) {
+    log(`[pltt]   skipped invalid env keys: ${Array.from(new Set(skippedInvalid)).sort().join(", ")}`)
+  }
   for (const [name, value] of Object.entries(values)) {
     log(`[pltt]   plugin secret ${name}=${redactValue(value)} (${env.name})`)
   }
-  return values
+  return { manifest: effectiveManifest, pluginSecrets: values }
 }
 
 async function run(argv, { cwd }) {
@@ -288,7 +354,7 @@ async function run(argv, { cwd }) {
 
   const manifest = loadManifest(cwd)
   const publishType = parsePublishType(argv)
-  loadLocalEnv(cwd)
+  const localEnv = loadLocalEnvDetails(cwd, { environment: env.name })
   const errors = validateManifest(manifest)
   if (errors.length) {
     console.error("[pltt] manifest invalid:")
@@ -296,7 +362,23 @@ async function run(argv, { cwd }) {
     process.exit(1)
   }
 
-  runPreflight(cwd, flags.json, publishType)
+  runPreflight(cwd, flags.json, publishType, env.name)
+  let pluginSecrets = {}
+  let publishManifest = manifest
+  try {
+    const collected = collectPluginSecrets(cwd, manifest, env, flags, log, localEnv)
+    pluginSecrets = collected.pluginSecrets
+    publishManifest = collected.manifest
+  } catch (err) {
+    console.error(`[pltt] ${err instanceof Error ? err.message : String(err)}`)
+    process.exit(1)
+  }
+  const effectiveErrors = validateManifest(publishManifest)
+  if (effectiveErrors.length) {
+    console.error("[pltt] generated manifest invalid:")
+    for (const e of effectiveErrors) console.error(`  - ${e}`)
+    process.exit(1)
+  }
 
   log(
     `[pltt] publishing ${manifest.id}@${manifest.version} → ${env.name} (${env.url})`,
@@ -305,25 +387,21 @@ async function run(argv, { cwd }) {
   let frontend = null
   if (manifest.frontend?.entry) {
     log("[pltt]   bundling frontend")
-    frontend = await bundleFrontend(cwd, manifest.frontend.entry, manifest.frontend)
+    frontend = await bundleFrontend(cwd, manifest.frontend.entry, {
+      ...manifest.frontend,
+      pluginId: manifest.id,
+    })
     log(`[pltt]     ${frontend.length} bytes`)
   } else {
     log("[pltt]   no frontend declared")
   }
 
   log("[pltt]   bundling backend")
-  const backend = await bundleBackend(cwd)
+  const backend = await bundleBackend(cwd, { manifest: publishManifest })
   log(`[pltt]     ${backend.length} bytes`)
 
   const backendSha = sha256(backend)
   const api = makeApi(env)
-  let pluginSecrets = {}
-  try {
-    pluginSecrets = collectPluginSecrets(cwd, manifest, env, flags, log)
-  } catch (err) {
-    console.error(`[pltt] ${err instanceof Error ? err.message : String(err)}`)
-    process.exit(1)
-  }
 
   log("[pltt]   requesting signed URLs")
   const signed = await api("/api/v1/appstore/sign-upload", {
@@ -341,7 +419,7 @@ async function run(argv, { cwd }) {
     put(signed.backend_upload_url, backend, "application/gzip"),
     put(
       signed.manifest_upload_url,
-      Buffer.from(JSON.stringify(manifest, null, 2)),
+      Buffer.from(JSON.stringify(publishManifest, null, 2)),
       "application/json",
     ),
   ]
@@ -356,7 +434,7 @@ async function run(argv, { cwd }) {
     version: manifest.version,
     bundle_path: signed.bundle_path,
     bundle_sha256: backendSha,
-    manifest,
+    manifest: publishManifest,
     publish_type: publishType,
     environment: env.name,
   }