@synoikia/create-plugin 0.7.0 → 0.8.1

package/dist/workflow/prose.js

@@ -1,113 +0,0 @@
-const MAX_WORDS = 25;
-/** Inline code and link targets are not prose. */
-const stripInline = (text) => text
-    .replace(/`[^`]*`/g, 'Code')
-    .replace(/\]\([^)]*\)/g, ']')
-    .replace(/<!--.*?-->/g, '')
-    .replace(/https?:\/\/\S+/g, 'link');
-function markdownBlocks(text) {
-    const lines = text.split('\n');
-    const blocks = [];
-    let fence;
-    let comment = false;
-    let para;
-    const flush = () => {
-        if (para)
-            blocks.push(para);
-        para = undefined;
-    };
-    let i = 0;
-    if (lines[0] === '---') {
-        const end = lines.indexOf('---', 1);
-        if (end > 0)
-            i = end + 1;
-    }
-    for (; i < lines.length; i++) {
-        const raw = lines[i];
-        const line = i + 1;
-        const fenceMark = raw.match(/^\s*(`{3,}|~{3,})/)?.[1];
-        if (fence) {
-            if (fenceMark?.startsWith(fence))
-                fence = undefined;
-            continue;
-        }
-        if (fenceMark) {
-            flush();
-            fence = fenceMark;
-            continue;
-        }
-        if (comment || raw.trim().startsWith('<!--')) {
-            comment = !raw.includes('-->');
-            continue;
-        }
-        if (!raw.trim() || (/^\s{4,}\S/.test(raw) && !para)) {
-            flush();
-            continue;
-        }
-        if (/^\s*\|/.test(raw)) {
-            flush();
-            if (!/^\s*\|[\s:|-]+\|\s*$/.test(raw))
-                for (const cell of raw.split('|').slice(1, -1))
-                    blocks.push({ line, lastLine: line, text: cell, label: true });
-            continue;
-        }
-        if (/^\s*#{1,6}\s/.test(raw)) {
-            flush();
-            blocks.push({ line, lastLine: line, text: raw.replace(/^\s*#+\s*/, ''), label: true });
-            continue;
-        }
-        const item = raw.match(/^\s*(?:[-*+]|\d+[.)])\s+(.*)$/);
-        if (item) {
-            flush();
-            para = { line, lastLine: line, text: item[1], label: false };
-            continue;
-        }
-        if (para) {
-            para.text += ` ${raw.trim()}`;
-            para.lastLine = line;
-        }
-        else
-            para = { line, lastLine: line, text: raw.trim().replace(/^>\s*/, ''), label: false };
-    }
-    flush();
-    return blocks;
-}
-function featureBlocks(text) {
-    return text.split('\n').flatMap((raw, i) => {
-        const t = raw.trim();
-        if (!t || t.startsWith('#') || t.startsWith('@'))
-            return [];
-        const label = t.startsWith('|') || /^[A-Za-z ]+:/.test(t);
-        return [{ line: i + 1, lastLine: i + 1, text: t.replace(/^[A-Za-z ]+:\s*/, ''), label }];
-    });
-}
-const words = (sentence) => sentence.split(/\s+/).filter((w) => /[\p{L}\p{N}]/u.test(w)).length;
-/** Problems with the writing rules in one file. With `lines`, only blocks that touch those lines. */
-export function checkProse(file, text, lines) {
-    const blocks = file.endsWith('.feature') ? featureBlocks(text) : markdownBlocks(text);
-    const issues = [];
-    for (const block of blocks) {
-        if (lines) {
-            let touched = false;
-            for (let l = block.line; l <= block.lastLine && !touched; l++)
-                touched = lines.has(l);
-            if (!touched)
-                continue;
-        }
-        const prose = stripInline(block.text);
-        const at = `${file}:${block.line}`;
-        if (prose.includes(';'))
-            issues.push(`${at}: no semicolons. Write two sentences`);
-        if (prose.includes('—'))
-            issues.push(`${at}: no em dashes. Write two sentences or use a colon`);
-        if (block.label)
-            continue;
-        for (const sentence of prose.split(/(?<=[.!?:][*_)"'`]*)\s+(?=[\p{Lu}`*"([])/u)) {
-            const n = words(sentence);
-            if (n > MAX_WORDS)
-                issues.push(`${at}: a sentence has ${n} words. Use ${MAX_WORDS} at most`);
-        }
-    }
-    return issues;
-}
-//# sourceMappingURL=prose.js.map

package/dist/workflow/prose.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"prose.js","sourceRoot":"","sources":["../../src/workflow/prose.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG,EAAE,CAAC;AAUrB,kDAAkD;AAClD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACnC,IAAI;KACD,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC;KAC3B,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;KAC5B,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;KAC1B,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAExC,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,IAAuB,CAAC;IAC5B,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,GAAG,CAAC;YAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC;YACpD,SAAS;QACX,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,EAAE,CAAC;YACR,KAAK,GAAG,SAAS,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACnC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxD,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;;YAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9F,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAExG,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,KAA2B;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE;gBAAE,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,OAAO;gBAAE,SAAS;QACzB,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,KAAK;YAAE,SAAS;QAC1B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,eAAe,SAAS,UAAU,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/workflow/red.d.ts

@@ -1,2 +0,0 @@
-/** Runs the feature files at `sha` in a temporary worktree. True when at least one package fails. */
-export declare function featuresFailAt(root: string, sha: string, features: readonly string[]): boolean;

package/dist/workflow/red.js

@@ -1,36 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { git } from './git.js';
-const run = (cwd, cmd, args) => spawnSync(cmd, args, { cwd, stdio: 'inherit', env: { ...process.env, CI: 'true' } }).status ?? 1;
-/** The nearest directory up from `file` with a package.json, below `root`. */
-function packageOf(root, file) {
-    let dir = path.dirname(path.join(root, file));
-    while (dir !== root && !existsSync(path.join(dir, 'package.json')))
-        dir = path.dirname(dir);
-    return dir;
-}
-/** Runs the feature files at `sha` in a temporary worktree. True when at least one package fails. */
-export function featuresFailAt(root, sha, features) {
-    const dir = mkdtempSync(path.join(tmpdir(), 'synoikia-red-'));
-    try {
-        git(root, 'worktree', 'add', '--detach', dir, sha);
-        if (run(dir, 'pnpm', ['install', '--frozen-lockfile', '--prefer-offline']) !== 0)
-            throw new Error(`pnpm install failed at ${sha.slice(0, 7)}`);
-        const byPackage = new Map();
-        for (const f of features.filter((f) => existsSync(path.join(dir, f)))) {
-            const pkg = packageOf(dir, f);
-            byPackage.set(pkg, [...(byPackage.get(pkg) ?? []), path.relative(pkg, path.join(dir, f))]);
-        }
-        let failed = false;
-        for (const [pkg, files] of byPackage)
-            failed = run(pkg, 'pnpm', ['exec', 'vitest', 'run', ...files]) !== 0 || failed;
-        return failed;
-    }
-    finally {
-        spawnSync('git', ['worktree', 'remove', '--force', dir], { cwd: root });
-        rmSync(dir, { recursive: true, force: true });
-    }
-}
-//# sourceMappingURL=red.js.map

package/dist/workflow/red.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"red.js","sourceRoot":"","sources":["../../src/workflow/red.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAW,EAAE,IAAc,EAAE,EAAE,CACvD,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;AAEnG,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW,EAAE,QAA2B;IACnF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9B,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS;YAClC,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;QACjF,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/workflow/secrets.d.ts

@@ -1,2 +0,0 @@
-/** Staged paths that look like credential files, by name rather than content. */
-export declare const credentialPaths: (files: readonly string[]) => string[];

package/dist/workflow/secrets.js

@@ -1,5 +0,0 @@
-const EXAMPLE = /(?:\.|^|\/)(?:example|sample|template)(?:\.[^/]+)?$/;
-const CREDENTIAL = /(?:^|\/)(?:secrets?(?:\.[^/]+)*\.ya?ml|\.env(?:\..+)?|\.dev\.vars(?:\..+)?|[^/]+\.secret(?:\..+)?|[^/]+\.(?:pem|key|p12|pfx)|id_(?:rsa|dsa|ecdsa|ed25519)|\.npmrc|\.netrc)$/;
-/** Staged paths that look like credential files, by name rather than content. */
-export const credentialPaths = (files) => files.filter((f) => !EXAMPLE.test(f) && CREDENTIAL.test(f));
-//# sourceMappingURL=secrets.js.map

package/dist/workflow/secrets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/workflow/secrets.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,qDAAqD,CAAC;AACtE,MAAM,UAAU,GACd,6KAA6K,CAAC;AAEhL,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAwB,EAAE,EAAE,CAC1D,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/workflow/security-line.d.ts

@@ -1,6 +0,0 @@
-export declare const SECURITY_LINE: RegExp;
-/** A ready PR that changes a security path states its audit on a line of its own. */
-export declare function checkSecurityLine(pr: {
-    draft: boolean;
-    body: string | null;
-}, changed: readonly string[], paths: readonly string[]): string[];

package/dist/workflow/security-line.js

@@ -1,14 +0,0 @@
-import { matchesAny } from './glob.js';
-export const SECURITY_LINE = /^Security audit: \S/m;
-/** A ready PR that changes a security path states its audit on a line of its own. */
-export function checkSecurityLine(pr, changed, paths) {
-    if (pr.draft)
-        return [];
-    const touched = changed.filter((f) => matchesAny(f, paths));
-    if (!touched.length || SECURITY_LINE.test(pr.body ?? ''))
-        return [];
-    return [
-        `this PR changes security paths (${touched.slice(0, 5).join(', ')}${touched.length > 5 ? ', …' : ''}). Add a line "Security audit: <boundary and findings>" or "Security audit: none. <why>" to its description`,
-    ];
-}
-//# sourceMappingURL=security-line.js.map

package/dist/workflow/security-line.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-line.js","sourceRoot":"","sources":["../../src/workflow/security-line.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,CAAC,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAEpD,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAC/B,EAA2C,EAC3C,OAA0B,EAC1B,KAAwB;IAExB,IAAI,EAAE,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IACpE,OAAO;QACL,mCAAmC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,6GAA6G;KACjN,CAAC;AACJ,CAAC"}

package/dist/workflow/sync.d.ts

@@ -1,4 +0,0 @@
-/** The shared workflow files, as repo-relative path → template path. Claude files only for repos that use Claude. */
-export declare function workflowFiles(root: string): Map<string, string>;
-/** Writes the shared files, or with `check` lists the ones that differ. Returns the paths written or out of date. */
-export declare function syncWorkflow(root: string, check?: boolean): string[];

package/dist/workflow/sync.js

@@ -1,47 +0,0 @@
-import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync, } from 'node:fs';
-import path from 'node:path';
-import { TEMPLATES_DIR } from '../repo-root.js';
-const WORKFLOW_DIR = path.join(TEMPLATES_DIR, 'workflow');
-const outName = (name) => (/^_[a-zA-Z]/.test(name) ? `.${name.slice(1)}` : name);
-/** The shared workflow files, as repo-relative path → template path. Claude files only for repos that use Claude. */
-export function workflowFiles(root) {
-    const files = new Map();
-    const walk = (from, to) => {
-        for (const entry of readdirSync(from).sort()) {
-            const src = path.join(from, entry);
-            const dest = path.posix.join(to, outName(entry));
-            if (statSync(src).isDirectory())
-                walk(src, dest);
-            else
-                files.set(dest, src);
-        }
-    };
-    walk(path.join(WORKFLOW_DIR, 'base'), '');
-    if (existsSync(path.join(root, '.claude')))
-        walk(path.join(WORKFLOW_DIR, 'claude'), '');
-    return files;
-}
-/** Writes the shared files, or with `check` lists the ones that differ. Returns the paths written or out of date. */
-export function syncWorkflow(root, check = false) {
-    const changed = [];
-    for (const [rel, src] of workflowFiles(root)) {
-        const dest = path.join(root, rel);
-        if (lstatSync(dest, { throwIfNoEntry: false })?.isSymbolicLink())
-            throw new Error(`${rel} is a symlink. Remove it before the sync`);
-        const text = readFileSync(src, 'utf8');
-        if (existsSync(dest) && readFileSync(dest, 'utf8') === text)
-            continue;
-        changed.push(rel);
-        if (check)
-            continue;
-        mkdirSync(path.dirname(dest), { recursive: true });
-        const real = realpathSync(path.dirname(dest));
-        if (path.relative(realpathSync(root), real).startsWith('..'))
-            throw new Error(`${rel} resolves outside the repository`);
-        writeFileSync(dest, text);
-        if (rel.startsWith('.githooks/'))
-            chmodSync(dest, 0o755);
-    }
-    return changed;
-}
-//# sourceMappingURL=sync.js.map

package/dist/workflow/sync.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/workflow/sync.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AAC1D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEzF,qHAAqH;AACrH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE;QACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;;gBAC5C,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAK,GAAG,KAAK;IACtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE;YAC9D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,0CAA0C,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI;YAAE,SAAS;QACtE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,KAAK;YAAE,SAAS;QACpB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kCAAkC,CAAC,CAAC;QAC5D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/workflow/tests.d.ts

@@ -1,2 +0,0 @@
-/** New test files must be pure-function unit tests. Behavior is specified in feature files. */
-export declare const unlistedTests: (added: readonly string[], unitTests: readonly string[]) => string[];

package/dist/workflow/tests.js

@@ -1,6 +0,0 @@
-import { matchesAny } from './glob.js';
-/** New test files must be pure-function unit tests. Behavior is specified in feature files. */
-export const unlistedTests = (added, unitTests) => added
-    .filter((f) => /\.(?:test|spec)\.[cm]?[jt]sx?$/.test(f) && !matchesAny(f, unitTests))
-    .map((f) => `${f}: a new test file must be a pure-function unit test (${unitTests.join(', ')}). Specify behavior in a feature file`);
-//# sourceMappingURL=tests.js.map

package/dist/workflow/tests.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tests.js","sourceRoot":"","sources":["../../src/workflow/tests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAwB,EAAE,SAA4B,EAAE,EAAE,CACtF,KAAK;KACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;KACpF,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,wDAAwD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAC1H,CAAC"}

package/templates/repo/claude/_claude/agents/security-reviewer.md

@@ -1,70 +0,0 @@
----
-name: security-reviewer
-description: Reviews a change to a Synoikia plugin, or to this repository's release tooling, for security problems and known CVEs in its dependencies. Use proactively before opening or merging a PR that touches a path in synoikia.workflow.securityPaths of the root package.json, such as plugins/*/manifest.json, plugins/*/plugin.yaml, plugins/*/src, plugins/*/test/compliance.yaml, a plugin's dependencies or .github/workflows; or when asked for a security review or dependency audit.
-tools: Read, Grep, Glob, Bash
----
-
-You review changes to Synoikia plugins for security problems. You are read-only: never edit files, commit, push or change the environment. Use Bash only for read-only commands such as `git diff`, `git log`, `git show`, `pnpm audit`, `pnpm why`, `pnpm ls`, and for running existing tests (`pnpm --filter ./plugins/<id> test`).
-
-## The trust model
-
-Synoikia core runs every plugin instance as a child process under the Node permission model. It puts every call through its own sandbox, permission gate, human approvals, redaction and audit log. Core enforces policy, but it enforces it based on what the plugin tells it. A plugin that labels a destructive call `read`, leaves a secret out of `sensitiveKeys`, or writes a misleading approval summary weakens every install. Core can't detect it. Most findings in this repository are cases where the plugin gave core wrong information. Background: `CLAUDE.md`, `README.md`, and Synoikia's design §3–§5 and §12 (`https://github.com/via-justa/synoikia-core/blob/main/docs/design/`).
-
-## Scope
-
-Start from the diff you were given. Otherwise use `git diff origin/main...HEAD` plus uncommitted changes. Follow each changed function to its callers and callees. Read the plugin's `manifest.json` and `plugin.yaml` in full whenever its `src/` changes.
-
-## What to check
-
-- **`plugin.yaml` rules** (applied by the SDK's `compileRules`): precedence fails closed. The order is excluded, then locked or split twin, then a rule's `classification`, then the plugin's heuristic, else write. These are findings unless the PR justifies them:
-  - removing or narrowing a `locked`, `split`, `sensitiveParams` or `sensitiveResult` rule
-  - adding a `classification: read` override
-  - widening `include` past an `exclude`
-
-  A `splitWhen` predicate must fail closed (unknown means the locked twin). `plugin.yaml` is parsed and inlined at build time only. Nothing reads files at runtime.
-- **The compliance profile** (`test/compliance.yaml`): it is what core certifies the plugin against, so review its diff like a `plugin.yaml` diff. A removed or weakened `reads`, `writes`, `rejects`, `locks`, `secrets` or `connectionTest` case is a finding unless the PR justifies it. A read that moves to `writes` or out of the profile needs a reason. Each locked operation and split twin has a `locks` case with its literal. The fake upstream (`test/fake*.ts`) must answer as the real upstream does, so a fake that hides a secret or an error weakens the certification.
-- **Classification** (discovery in `src/`): no operation with side effects is labeled read. That includes GETs with side effects, and RPC methods whose names sound like reads. Destructive or hard-to-undo operations are `locked` with `typedConfirmation`, for example delete, wipe, restart, unlock, regenerate a key, or change auth or users. Operations the plugin doesn't know yet fail closed: write or locked, never read. Values taken from the upstream's own spec or introspection are untrusted and must not be able to downgrade a classification.
-- **Request building** (`src/`, `resolveOperation`/`invoke`): model-supplied arguments cannot change the host, scheme or port. Path parameters are encoded (`encodeURIComponent`), so `../`, `?`, `#` and `%2F` can't change which operation runs. Model arguments cannot set auth headers or impersonation headers. The operation key that core gated is the one that is invoked: no aliasing, no smuggling a second call through params.
-- **Targets and summaries** (`resolveTargets`, `summarize`, `prepareWrite`): the approval page shows exactly what will be affected. A summary or target that understates the effect is an approval-integrity finding. So is one that the model can make misleading through crafted params (display names, markdown, control characters). Summaries never contain secrets. Core passes them redacted params, so the plugin must not add secrets back from its own state.
-- **Secrets** (`manifest.json`, `src/`): every credential field is `writeOnly`, uses the `secret` widget and is in `sensitiveKeys`. Every secret field the upstream can **return** (API keys in settings, webhook URLs, tokens, passwords, push keys) is in `sensitiveKeys`. A `secrets` case in `test/compliance.yaml` checks that it is redacted, and the fake returns it. Credentials are never in error messages, logs, thrown `PluginError` text or catalog descriptions. They are never sent to any host except the upstream: for example, the auth header must not go to a spec mirror.
-- **Network** (`manifest.json` `network.hosts`): as small as possible, with templated hosts only from connection fields. No wildcards or extra third-party hosts without a stated reason. TLS verification is on by default (`verifyTls !== false`), and turning it off is an explicit connection setting.
-- **Staying inside core's model**: no plugin-side allow/deny lists, approval prompts, retries of denied calls, or caching that serves data after core denied a call. No `eval`, `new Function`, dynamic `import()` of computed paths, or filesystem access outside the plugin's own package directory. Everything is bundled and nothing is loaded at runtime.
-- **Parsing untrusted upstream data**: YAML, JSON and WebSocket frames from the upstream are untrusted. Look for prototype pollution through merges, unbounded sizes and recursion, and YAML features beyond plain data.
-- **Release tooling** (`.github/workflows/`, and the `synoikia-plugin repo` steps of the pinned `@synoikia/create-plugin` version):
-  - `MINISIGN_SECRET_KEY` is exposed only to the Sign step, never echoed, and written with `umask 077`.
-  - Packing is deterministic. Publishing happens only after the signature is verified against `minisign.pub` and the install check passes.
-  - Released versions are never overwritten. The index download fails on errors other than "release not found", and `repo publish` refuses an existing tag whose tarball differs.
-  - Workflow permissions are the minimum needed. A new third-party action is pinned by commit SHA.
-- **Tests**: new secret fields, locked operations and classification rules come with a test that fails if they regress. That is a profile case, a feature scenario or a unit test.
-
-## Known vulnerabilities (CVEs)
-
-Always run this section, even when the diff touches no dependencies, because new advisories appear against unchanged code.
-
-1. Run `pnpm audit --json` from the repository root, and `pnpm audit --prod` to separate shipped dependencies from dev-only ones.
-2. For each advisory, use `pnpm why <package>` to find which plugin pulls it in, and whether it is a `dependency` or a `devDependency` of that plugin:
-   - A plugin's `dependencies` are bundled into `dist/index.js` and **ship to every install**. Judge whether the vulnerable code is reachable from that plugin. Find what input reaches it, and whether the model, the upstream or the admin supplies it.
-   - `devDependencies` (`@synoikia/core`, esbuild, vitest) don't ship, but they run in CI, including the Release workflow that handles the signing key. Report them as lower severity unless the advisory is about code execution at install or build time.
-3. Also check new or bumped dependencies in the diff:
-   - whether the version is current and has advisories (the audit covers this once it is in the lockfile)
-   - whether it has install scripts (they need an `onlyBuiltDependencies` entry in `pnpm-workspace.yaml`)
-   - whether the package is a typosquat of a well-known name
-4. For each CVE finding, give the advisory ID (GHSA/CVE), the affected and patched version ranges, the dependency path, and the smallest fix. That is a direct bump, or a `pnpm.overrides` entry when only a transitive dependency is vulnerable.
-
-If `pnpm audit` can't reach the registry, say so. Don't report the dependency surface as clean.
-
-## Reporting
-
-Report only issues you can tie to concrete code or a concrete advisory. For each finding give:
-
-- **Severity**:
-  - critical: a write or secret leak core can't stop.
-  - high: realistic misuse, or a reachable CVE in shipped code.
-  - medium: defense in depth lost, or a dev-only CVE that affects CI.
-  - low: hardening.
-- **Location**: `path:line`, or the dependency path for a CVE.
-- **What breaks**: which promise to core or to the admin no longer holds.
-- **Scenario**: who does what, with which input, and what they gain.
-- **Fix**: the smallest change, plus the test that would catch a regression.
-
-Rank findings by severity. If there are none, say so plainly, and list what you checked and the `pnpm audit` result. Say what you could not verify rather than guessing.

package/templates/repo/claude/_claude/hooks/format.mjs

@@ -1,20 +0,0 @@
-// PostToolUse hook: runs Prettier on the file just edited, so `pnpm format:check` in CI stays green.
-// Prettier skips files in .prettierignore and unknown types; a failure here never blocks the edit.
-import { execFileSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import path from 'node:path';
-
-let input = '';
-for await (const chunk of process.stdin) input += chunk;
-const { tool_input: toolInput = {}, cwd } = JSON.parse(input || '{}');
-const root = process.env.CLAUDE_PROJECT_DIR ?? cwd ?? process.cwd();
-const prettier = path.join(root, 'node_modules/.bin/prettier');
-const file = toolInput.file_path;
-
-if (file && existsSync(file) && existsSync(prettier)) {
-  try {
-    execFileSync(prettier, ['--write', '--ignore-unknown', '--log-level=warn', file], { cwd: root, stdio: 'ignore' });
-  } catch {
-    // A file Prettier can't parse is left as written; lint and format:check will report it.
-  }
-}

package/templates/repo/claude/_claude/hooks/guard-paths.mjs

@@ -1,43 +0,0 @@
-// PreToolUse hook: stops edits to generated files and asks before edits to the signing key.
-// Reads the tool call from stdin; prints a permission decision for matching paths, nothing otherwise.
-import path from 'node:path';
-
-const RULES = [
-  {
-    match: /(^|\/)pnpm-lock\.yaml$/,
-    decision: 'deny',
-    reason: 'pnpm-lock.yaml is generated. Change package.json and run `pnpm install` instead.',
-  },
-  {
-    match: /^plugins\/[^/]+\/dist\//,
-    decision: 'deny',
-    reason: 'dist/ is the esbuild bundle. Edit src/ and run `pnpm --filter ./plugins/<id> build`.',
-  },
-  {
-    match: /^minisign\.pub$/,
-    decision: 'ask',
-    reason:
-      'minisign.pub is the key every Synoikia install pins for this repository. Changing it blocks installs until each admin confirms the new key; only for a compromised key.',
-  },
-];
-
-let input = '';
-for await (const chunk of process.stdin) input += chunk;
-const { tool_input: toolInput = {}, cwd } = JSON.parse(input || '{}');
-const file = toolInput.file_path ?? toolInput.notebook_path;
-if (!file) process.exit(0);
-
-const root = process.env.CLAUDE_PROJECT_DIR ?? cwd ?? process.cwd();
-const rel = path.relative(root, path.resolve(root, file)).split(path.sep).join('/');
-const rule = RULES.find((r) => r.match.test(rel));
-if (!rule) process.exit(0);
-
-console.log(
-  JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: rule.decision,
-      permissionDecisionReason: `${rel}: ${rule.reason}`,
-    },
-  }),
-);

package/templates/repo/claude/_claude/skills/add-plugin/SKILL.md

@@ -1,46 +0,0 @@
----
-name: add-plugin
-description: Scaffold a new Synoikia plugin under plugins/<id> with `pnpm new`, then fill in its plugin.yaml rules, discovery and tests. Use when asked to add, create or start a plugin for a new upstream service.
----
-
-# Add a plugin
-
-Run the change as the `change-workflow` skill and `docs/workflow.md` say. Write the code as the `plugin-development` skill says. Background: Synoikia's plugin authoring guide (`https://github.com/via-justa/synoikia-core/blob/main/docs/plugin-authoring.md`).
-
-## 1. Settle the basics
-
-- **`<id>`**: lowercase, the directory name and manifest `id`. The sandbox namespace defaults to it in camelCase.
-- **Archetype**: `openapi-rest` (the upstream serves an OpenAPI spec), `static-rest` (a REST API without one, with operations declared in `plugin.yaml`), `websocket-rpc` (JSON-RPC over WebSocket), or `blank`.
-- **Auth**: `bearer`, `api-key` (with its header), `basic` or `none`.
-- **Destructive operations**: which ones are `locked` (always a human who types a confirmation literal), and what that literal is.
-- **Secrets**: which connection fields are credentials, and which fields the upstream returns hold secrets.
-
-## 2. Scaffold
-
-```sh
-pnpm new --id <id> --name "<Name>" --archetype <archetype> --auth <auth> --yes
-```
-
-This writes `plugins/<id>/` and runs `pnpm install`. The plugin holds `manifest.json`, `plugin.yaml`, `src/`, `test/compliance.yaml`, a fake upstream, a README and a RUNBOOK. For the `openapi-rest`, `static-rest` and `websocket-rpc` archetypes, the plugin passes the compliance suite as generated.
-
-## 3. Describe the upstream
-
-- `manifest.json`: connection fields and help, `sensitiveKeys` (add every secret field the upstream returns), `network.hosts` (every host the plugin calls).
-- `plugin.yaml`: `rules` for locks, splits, classification overrides, `sensitiveParams`, `sensitiveResult`, `confirm` literals, summary notes and guidance. Use `exclude` for plumbing the model has no business calling, and `operations` for declared operations. A rule's `classification` never unlocks, and anything unclassified is a write.
-- `src/plugin.ts`: only what needs logic, such as a `splitWhen` predicate, a custom confirm source, or discovery.
-
-## 4. Tests
-
-- Extend the fake upstream (`test/fake-upstream.ts`, on `startFakeHttp` from `@synoikia/core/testing` for HTTP) to answer what the plugin calls. Include the responses that hold secrets.
-- Fill in `test/compliance.yaml`: reads, writes, rejects, the secrets, and a `locks` case for each locked operation and split twin.
-- Write plugin-specific behavior in `features/<id>.feature` with the suite's steps, on calls named in `calls`.
-- Put tests of pure logic in `test/unit/`.
-
-```sh
-pnpm --filter ./plugins/<id> test
-pnpm typecheck && pnpm lint && pnpm format:check
-```
-
-The plugin run must end with "<Name> 0.1.0 is fit for production." and no failed test.
-
-Leave the version at `0.1.0`. Run the `security-reviewer` subagent on the diff before you open the PR.

package/templates/repo/claude/_claude/skills/plugin-development/SKILL.md

@@ -1,64 +0,0 @@
----
-name: plugin-development
-description: >-
-  How to write and review plugin code in this Synoikia plugin repository: plugins/<id>/src, plugin.yaml,
-  manifest.json and the plugin's tests. Use it for any task that changes or reviews a plugin, even when the
-  request names only an operation, an upstream endpoint, a lock, a secret or a bug and never says
-  "TypeScript" or "plugin.yaml". Examples: add or lock an operation; split an operation into twins; mark a
-  param or result field sensitive; change a summary or confirmation literal; fix a client, a transport or
-  discovery; add a connection field; extend a fake upstream; write or fix unit tests, the compliance profile
-  or a plugin feature; review a plugin diff. Not for scaffolding a new plugin (add-plugin, then this skill for
-  the code) or version bumps (release-plugin).
----
-
-# Plugin development
-
-A plugin is a Node 22 ESM process that describes one upstream API to core: its catalog, classification, targets, summaries, confirmation literals and sensitive fields. Core does the rest. New code must look like the code around it. Make the smallest change that does the job, with one shared way to do each thing. Add no dependency for what a few lines or the SDK already do.
-
-`CLAUDE.md` holds the repo rules (bundle, network hosts, secrets, versions, security review). This skill is how to write the change. Load a reference only when the task touches its area:
-
-| Task touches                                                                | Read                       |
-| --------------------------------------------------------------------------- | -------------------------- |
-| Types, narrowing upstream data, errors, imports, module layout              | `references/typescript.md` |
-| Tests, the fake upstream, `test/compliance.yaml`, the plugin's feature file | `references/testing.md`    |
-
-## Rules for every change
-
-1. **Reuse first.** Before you write a helper, look in the plugin's own `src/` and in `@synoikia/plugin-sdk`. The SDK has `definePlugin`, `compileRules`, `parsePluginSettings`, `requireString`, `requireField`, `isPlainObject`, `truncate` and `clip`. It also has `PluginError`/`ErrorCodes`, `upstreamError`, `HttpJsonClient`, `singleFlight`, `PendingRequests` and the OpenAPI and static catalog adapters. Use it, or extend it. If the SDK lacks it and another plugin would need it too, it belongs in core's SDK, released first.
-2. **Policy in `plugin.yaml`, logic in `src/`.** Locks, splits, classification overrides, `sensitiveParams`, `sensitiveResult`, confirm literals, guidance, `exclude`/`include` and upstream lists are YAML. Code is only for a decision YAML can't express (a path check, a target lookup, a `splitWhen` predicate).
-3. **Describe, don't decide.** No plugin-side allow/deny switch, approval prompt, rate limit or secret handling: core's gate, approvals and redaction own them.
-4. **Fail closed.** Anything unclassified is a write. A rule's `classification` never unlocks. An upstream shape the code doesn't know is redacted or refused, not passed through.
-5. **Narrow upstream data at the edge.** Responses, events and specs are `unknown` until checked with `isPlainObject`, `requireString` and friends. Past that point, trust the narrowed type.
-6. **Secrets never leave masked.** Credential fields are `writeOnly`, use the `secret` widget and are in `sensitiveKeys`. Secret fields the upstream returns go in `sensitiveKeys` and `sensitiveResult`. Summaries, errors and logs never carry a secret or a raw upstream body.
-7. **Every host is declared.** A new upstream URL goes in `manifest.json` `network.hosts`, and every runtime dependency and data file is bundled into `dist/index.js`.
-8. **Profile diffs are security diffs.** A change to `test/compliance.yaml` changes what core certifies. Change it only on purpose, and say in the PR what changed and why.
-9. **Small and direct.** No speculative options, wrappers or config for one caller. Comments are one or two lines, for a reason or a design `§` reference only.
-10. **Tests ship with the change.** Specify the behavior first, as `docs/workflow.md` says. Logic gets a unit test in `test/unit/`. Behavior at the plugin boundary gets a profile case or a scenario in `features/<id>.feature`. Extend the fake upstream to match.
-
-## Checks
-
-Run from the repo root before finishing:
-
-```sh
-pnpm --filter ./plugins/<id> test                   # check, build, unit tests, compliance suite, features
-pnpm lint && pnpm format:check && pnpm typecheck
-pnpm check                                           # manifests, plugin.yaml and versions
-pnpm workflow pre-push                               # branch, phases, features and prose
-```
-
-The plugin run must end with "<Name> <version> is fit for production." and no failed test.
-
-Then run the `security-reviewer` subagent when `CLAUDE.md` › Security review lists a path you touched. Don't bump the version unless the user asked (`release-plugin`).
-
-## Reviewing
-
-Lead with what tools can't catch. Say why each one matters:
-
-- A lock or sensitive rule dropped or narrowed.
-- A classification that turns a write into a read.
-- A secret that reaches a summary or an error.
-- A host missing from `network.hosts`.
-- Logic in `src/` that belongs in `plugin.yaml`, or a plugin-side check that duplicates core.
-- An `as` cast that hides an upstream shape.
-- A `test/compliance.yaml` change with no reason given, or a case removed or weakened.
-- A new upstream secret with no `secrets` entry, or no fake response that holds it.

package/templates/repo/claude/_claude/skills/plugin-development/references/testing.md

@@ -1,60 +0,0 @@
-# Testing
-
-Vitest, with quickpickle for feature files. The plugin's `vitest.config.ts` uses `complianceConfig` from `@synoikia/core/testing/compliance`. The `test` script runs these steps:
-
-1. `synoikia-plugin check`
-2. `synoikia-plugin build`, which rebuilds `dist/index.js`
-3. the unit tests in `test/unit/`
-4. core's compliance suite, from `test/compliance.yaml`
-5. the plugin's own `features/<id>.feature`
-
-The suite and the features run the **built** bundle. Rebuild after any change to `src/` or `plugin.yaml` before you run one file.
-
-The run must end with "<Name> <version> is fit for production." and no failed test. A failing own feature does not change the verdict line, but it fails the run.
-
-## Pick the place that proves the behavior
-
-| What                                                                  | Where                                                         |
-| --------------------------------------------------------------------- | ------------------------------------------------------------- |
-| A pure function (catalog building, classification, a transform)       | A unit test in `test/unit/` that imports and calls it         |
-| Reads, writes, rejected calls, locks, secrets and the connection test | A case in `test/compliance.yaml`                              |
-| Plugin-specific behavior through core: approvals, summaries, levels   | A scenario in `features/<id>.feature`, with the suite's steps |
-
-`docs/workflow.md` › Tests has the rules for test files. A new `*.test.ts` file is a pure-function unit test in `test/unit/`.
-
-## The compliance profile
-
-`test/compliance.yaml` tells core's suite how to drive the plugin against its fake upstream. The format and the steps are in core's `docs/plugin-authoring.md` › The compliance suite.
-
-| Key              | What                                                                     |
-| ---------------- | ------------------------------------------------------------------------ |
-| `fake`           | `test/fake.ts`, the module that starts the fake upstream                 |
-| `connection`     | The connection values, with `${fake.<name>}` for the fake's values       |
-| `reads`          | Calls that must classify as reads                                        |
-| `writes`         | Calls that must classify as writes                                       |
-| `rejects`        | Calls that core or the plugin must refuse                                |
-| `locks`          | One case for each locked operation and each split twin, with its literal |
-| `secrets`        | Calls whose upstream values must never reach the agent                   |
-| `connectionTest` | Connection values that the connection test must reject                   |
-| `calls`          | Named calls that `features/<id>.feature` uses                            |
-
-- A lock with no case fails the suite. Add a case when you add a lock or a split twin.
-- A diff of `test/compliance.yaml` is a security change. Change a case only on purpose, and explain it in the PR.
-
-## The fake upstream
-
-- Each plugin has one in `test/` (`fake-upstream.ts` as `pnpm new` writes it). Build it on `startFakeHttp` from `@synoikia/core/testing` for HTTP, or on a local server for WebSocket.
-- Tests never reach the real network.
-- `test/fake.ts` exports `start()`. It starts the fake and returns its URL, `close()` and the values that the profile names. It can also return `reset()`.
-- Extend the fake to answer every call the change makes. Include the responses that hold secrets, the error statuses and the permission denials.
-
-## Feature files
-
-- Write scenarios with the suite's steps on the profile's named calls. The step table is in core's `docs/plugin-authoring.md`.
-- Follow `docs/workflow.md` › Feature files: a `Rule:` for each scenario, outcomes and not solutions, five steps at most.
-- Assert on what the agent or the human sees: the result, the approval text, the literal to type, the error code.
-
-## Unit tests
-
-- Assert on what core or the model sees: the descriptor, the summary, the confirm literal, the masked result, the error code. Not on private fields.
-- Give each new error path a test that hits it and checks its `ErrorCodes` value.