@tomradex/plugin-sdk 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,204 @@
+Copyright 2026 Haoyuan Tang
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,63 @@
-# Temporary Holding Version
+# @tomradex/plugin-sdk
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The contract a Tomrade plugin is written against. `definePlugin` hands `apply()` a `PluginContext`: every call returns a Promise, every function you give it may be async, and every id you register carries your plugin's namespace.
+
+```sh
+npx @tomradex/plugin-cli init my-plugin --id you/my-plugin
+cd my-plugin && npm install && npm run dev
+```
+
+```ts
+import { z } from "zod";
+import { definePlugin, defineTool, requireProjectId } from "@tomradex/plugin-sdk";
+
+export default definePlugin({
+  inject: ["items", "tools", "contributions"],
+  async apply(ctx) {
+    await ctx.tools.register(
+      defineTool({
+        name: "my_plugin_count_open", // starts with the namespace
+        title: "Count open issues",
+        description: "How many issues in the project are not done yet.",
+        input: z.object({ projectId: z.string().optional() }),
+        execute: async ({ projectId }, inv) =>
+          (await ctx.items.list({ projectId: requireProjectId("my_plugin_count_open", projectId, inv) })).filter((i) => i.status !== "done").length
+      })
+    );
+    await ctx.contributions.statusItem({ id: "my_plugin", text: async ({ projectId }) => (projectId ? `${(await ctx.items.list({ projectId })).length} issues` : null) });
+  }
+});
+```
+
+## What the context offers
+
+| Member | |
+|---|---|
+| `items` | `list`, `query`, `get`, `getByKey`, `create`, `update`, `delete`, `addRelation`, `removeRelation`, `labels` — writes take no author; Tomrade records who wrote |
+| `fields`, `boards`, `views`, `projects` | the project's fields (and `create`, `update`, `remove`, `addOption`), workstreams, saved views, projects |
+| `db` | `migrate(steps, { tables })` for `plugin_<namespace>_*`; `all`, `get`, `run`, `batch` against a project id or `"hub"` |
+| `settings` | `register({ title, schema, defaults })`, `get`, `set` |
+| `tools` | `register`, `list`, `call`, `gate` |
+| `contributions` | `command`, `badge`, `statusItem`, `section`, `graph` |
+| `agent` | `playbook({ id, title, when, body })` |
+| `surfaces` | `open({ id, document })` — a document inside your package |
+| `on`, `when`, `has`, `effect`, `interval` | events, optional services, cleanup, timers |
+
+## The manifest
+
+`tomrade-plugin.json` beside `package.json`:
+
+```json
+{
+  "id": "you/my-plugin",
+  "version": "0.1.0",
+  "title": "My plugin",
+  "description": "What it does, in one sentence.",
+  "license": "MIT",
+  "repository": "https://github.com/you/tomrade-plugin-my-plugin",
+  "engines": { "sdk": "^0.2.0" },
+  "permissions": { "network": [], "fs": "none", "exec": false }
+}
+```
+
+Declare what your code does beyond the SDK — the hosts it talks to, whether it touches the disk, whether it starts programs. The store's review compares it with the code. Community lists open-source plugins only, built from your public GitHub repository and reviewed before they are listed.

package/dist/contract.d.ts

@@ -0,0 +1,341 @@
+import type { z } from "zod";
+import type { Author, Board, CreateItemInput, FieldDef, FieldOption, FieldType, FilterClause, Item, ListItemsFilter, OplogEntity, OplogEntry, OplogOp, Patch, Project, SortKey, View } from "@tomradex/domain";
+/**
+ * The plugin contract. Everything a plugin reaches returns a Promise, and every
+ * function it hands the host may return one: the same code runs in the app's
+ * process today and behind a process boundary later. Values that cross are
+ * plain data — never a live object of the host's.
+ */
+export type Disposer = () => void;
+/** The services a plugin names in `inject` (required) or `optional`. */
+export type ServiceName = "items" | "fields" | "boards" | "views" | "projects" | "db" | "settings" | "tools" | "contributions" | "agent" | "surfaces" | "oplog";
+export interface Logger {
+    debug(...args: unknown[]): void;
+    info(...args: unknown[]): void;
+    warn(...args: unknown[]): void;
+    error(...args: unknown[]): void;
+}
+export interface ItemQuery {
+    projectId: string;
+    filter?: FilterClause[];
+    sortBy?: SortKey[];
+    search?: string;
+    limit?: number;
+    widen?: boolean;
+}
+/** Writes never take an author: the host says who wrote — a person, the agent run it serves, or the plugin itself. */
+export interface ItemsApi {
+    list(filter?: ListItemsFilter): Promise<Item[]>;
+    query(q: ItemQuery): Promise<Item[]>;
+    get(projectId: string, id: string): Promise<Item | null>;
+    getByKey(projectId: string, key: string): Promise<Item | null>;
+    create(input: Omit<CreateItemInput, "by">): Promise<Item>;
+    update(projectId: string, id: string, patch: Patch, opts?: {
+        baseVersion?: number;
+    }): Promise<Item>;
+    delete(projectId: string, id: string): Promise<void>;
+    addRelation(projectId: string, id: string, blockedId: string): Promise<void>;
+    removeRelation(projectId: string, id: string, blockedId: string): Promise<void>;
+    labels(projectId: string): Promise<string[]>;
+}
+export interface FieldsApi {
+    list(projectId: string): Promise<FieldDef[]>;
+    get(projectId: string, id: string): Promise<FieldDef | null>;
+    create(input: {
+        projectId: string;
+        name: string;
+        type: FieldType;
+        options?: {
+            name: string;
+            description?: string | null;
+        }[];
+    }): Promise<FieldDef>;
+    update(projectId: string, id: string, patch: {
+        name?: string;
+        rank?: number;
+    }): Promise<FieldDef>;
+    remove(projectId: string, id: string): Promise<void>;
+    addOption(projectId: string, fieldId: string, input: {
+        name: string;
+        description?: string | null;
+    }): Promise<FieldOption>;
+}
+export interface BoardsApi {
+    list(projectId: string): Promise<Board[]>;
+    get(projectId: string, id: string): Promise<Board | null>;
+    defaultFor(projectId: string): Promise<Board>;
+}
+export interface ViewsApi {
+    list(projectId: string): Promise<View[]>;
+    get(projectId: string, id: string): Promise<View | null>;
+}
+export interface ProjectsApi {
+    list(): Promise<Project[]>;
+    get(id: string): Promise<Project | null>;
+}
+/** `"hub"` addresses the Hub's own database, for tables migrated with `scope: "hub"`. */
+export type DbTarget = string;
+export type SqlParams = unknown[] | Record<string, unknown>;
+export interface TableSpec {
+    /** Project-scope tables: the column holding the project id, or a chain through another table. */
+    project?: string | {
+        via: string;
+        table: string;
+    };
+    /** Exported tables travel in the project's folder; `false` keeps them on this machine. */
+    export: {
+        order: string;
+        appendOnly?: boolean;
+        always?: boolean;
+    } | false;
+}
+/**
+ * Plain SQL against the caches. The namespace is the plugin's own: tables are
+ * `plugin_<namespace>_*`. Reads of the app's tables are allowed; writing them
+ * goes around history and undo, and review says so.
+ */
+export interface DbApi {
+    migrate(steps: {
+        version: number;
+        up: string;
+    }[], opts: {
+        scope?: "project" | "hub";
+        tables: Record<string, TableSpec>;
+    }): Promise<void>;
+    all<T = Record<string, unknown>>(target: DbTarget, sql: string, params?: SqlParams): Promise<T[]>;
+    get<T = Record<string, unknown>>(target: DbTarget, sql: string, params?: SqlParams): Promise<T | undefined>;
+    run(target: DbTarget, sql: string, params?: SqlParams): Promise<{
+        changes: number;
+        lastInsertRowid: number;
+    }>;
+    /** One transaction: every statement lands, or none does. */
+    batch(target: DbTarget, statements: {
+        sql: string;
+        params?: SqlParams;
+    }[]): Promise<{
+        changes: number;
+    }[]>;
+    isOpen(projectId: string): Promise<boolean>;
+}
+export interface SettingsSectionSpec<T> {
+    /** Defaults to the namespace; otherwise it must start with it. */
+    id?: string;
+    title: string;
+    description?: string;
+    schema: z.ZodType<T>;
+    defaults: T;
+    scope?: "machine" | "user";
+}
+export interface SettingsApi {
+    register<T>(section: SettingsSectionSpec<T>): Promise<void>;
+    get<T = unknown>(id?: string): Promise<T>;
+    set<T = unknown>(value: T, id?: string): Promise<void>;
+}
+export interface ToolInvocation {
+    projectId?: string;
+    /** Present when an agent run made the call. */
+    runId?: string;
+    author: Author;
+}
+export interface ToolSpec<S extends z.ZodObject = z.ZodObject> {
+    /** Must start with the plugin's namespace. */
+    name: string;
+    title: string;
+    description: string;
+    input: S;
+    execute(args: z.output<S>, invocation: ToolInvocation): unknown | Promise<unknown>;
+}
+export interface ToolCallInfo {
+    name: string;
+    args: unknown;
+    author: Author;
+    projectId?: string;
+    runId?: string;
+}
+export interface ToolsApi {
+    register<S extends z.ZodObject>(tool: ToolSpec<S>): Promise<Disposer>;
+    list(): Promise<{
+        name: string;
+        title: string;
+        description: string;
+        inputSchema: Record<string, unknown>;
+    }[]>;
+    call(name: string, args: unknown, opts?: {
+        projectId?: string;
+    }): Promise<unknown>;
+    /** A policy over every tool call: throw to refuse it. */
+    gate(check: (call: ToolCallInfo) => void | Promise<void>): Promise<Disposer>;
+}
+export type BadgeTone = "faint" | "neutral" | "strong";
+export interface Badge {
+    id: string;
+    label: string;
+    tone?: BadgeTone;
+    title?: string;
+}
+export interface CommandScope {
+    projectId?: string;
+    boardId?: string;
+    viewId?: string;
+    itemId?: string | null;
+}
+export type SectionState = "live" | "waiting" | "idle" | "ended" | "lost" | "ok" | "warn";
+export interface SectionRow {
+    label: string;
+    value: string;
+    icon?: string;
+    mono?: boolean;
+    state?: SectionState;
+    href?: string;
+    command?: string;
+}
+export interface GraphEdge {
+    from: string;
+    to: string;
+    tone?: BadgeTone | "danger";
+    title?: string;
+}
+type Maybe<T> = T | Promise<T>;
+/** Ids must equal the namespace or start with it followed by `.`, `-` or `_`. */
+export interface ContributionsApi {
+    command(def: {
+        id: string;
+        title: string;
+        group?: string;
+        shortcut?: string;
+        run(scope: CommandScope): Maybe<{
+            toast?: string;
+        } | void>;
+    }): Promise<Disposer>;
+    badge(def: {
+        id: string;
+        compute(items: Item[], scope: {
+            projectId: string;
+        }): Maybe<Record<string, Badge[]>>;
+    }): Promise<Disposer>;
+    statusItem(def: {
+        id: string;
+        text(scope: {
+            projectId?: string;
+        }): Maybe<string | null>;
+    }): Promise<Disposer>;
+    section(def: {
+        id: string;
+        title: string;
+        render(item: Item): Maybe<{
+            rows?: SectionRow[];
+            text?: string;
+        } | null>;
+    }): Promise<Disposer>;
+    graph(def: {
+        id: string;
+        title: string;
+        icon?: string;
+        edits?: "blocks";
+        compute(items: Item[], scope: {
+            projectId: string;
+        }): Maybe<GraphEdge[]>;
+    }): Promise<Disposer>;
+}
+export interface PlaybookSpec {
+    /** Must start with the namespace. */
+    id: string;
+    title: string;
+    /** One line the agent reads to decide when to open it. */
+    when: string;
+    body: string;
+    tools?: string[];
+}
+export interface AgentApi {
+    playbook(spec: PlaybookSpec): Promise<Disposer>;
+}
+export interface SurfaceSpec {
+    id: string;
+    title: string;
+    /** A document inside the plugin's package, relative to its root. Remote pages are refused. */
+    document: string;
+    width: number;
+    height: number;
+    transparent?: boolean;
+    alwaysOnTop?: boolean;
+    clickThrough?: boolean;
+    initialState?: unknown;
+    /** Messages the document sends; a person is driving, so writes made here are theirs. */
+    onMessage?(message: unknown): Maybe<void>;
+}
+export interface SurfaceHandle {
+    readonly id: string;
+    setState(state: unknown): Promise<void>;
+    setPosition(x: number, y: number): Promise<void>;
+    bounds(): Promise<{
+        x: number;
+        y: number;
+        width: number;
+        height: number;
+    }>;
+    workArea(): Promise<{
+        x: number;
+        y: number;
+        width: number;
+        height: number;
+    }>;
+    close(): Promise<void>;
+}
+export interface SurfacesApi {
+    open(spec: SurfaceSpec): Promise<SurfaceHandle>;
+}
+export interface OplogApi {
+    recent(projectId: string, limit?: number): Promise<OplogEntry[]>;
+    history(projectId: string, entity: OplogEntity, id: string, limit?: number): Promise<OplogEntry[]>;
+}
+/** What landed, as the host tells every listener after the commit. */
+export interface WriteEvent {
+    projectId: string;
+    entity: OplogEntity;
+    op: OplogOp;
+    id: string;
+    by: Author;
+    via: string | null;
+    runId: string | null;
+}
+export interface Events {
+    write: (event: WriteEvent) => Maybe<void>;
+    "tool.result": (call: ToolCallInfo, outcome: {
+        ok: boolean;
+        error?: string;
+    }) => Maybe<void>;
+    "project.opened": (projectId: string) => Maybe<void>;
+    "project.closed": (projectId: string) => Maybe<void>;
+    "settings.changed": () => Maybe<void>;
+}
+export interface PluginContext {
+    /** `publisher/name` for an extension; the row id for a built-in. */
+    readonly id: string;
+    readonly namespace: string;
+    readonly logger: Logger;
+    /** A directory only this plugin writes to, kept across updates; null for a built-in. */
+    readonly dataDir: string | null;
+    readonly items: ItemsApi;
+    readonly fields: FieldsApi;
+    readonly boards: BoardsApi;
+    readonly views: ViewsApi;
+    readonly projects: ProjectsApi;
+    readonly db: DbApi;
+    readonly settings: SettingsApi;
+    readonly tools: ToolsApi;
+    readonly contributions: ContributionsApi;
+    readonly agent: AgentApi;
+    readonly surfaces: SurfacesApi;
+    readonly oplog: OplogApi;
+    on<K extends keyof Events>(event: K, listener: Events[K]): Disposer;
+    /** Runs `fn` while an optional service is present; what it returns is disposed when the service goes. */
+    when(name: ServiceName, fn: (ctx: PluginContext) => Maybe<Disposer | void>): Disposer;
+    /** Whether a service is present right now. */
+    has(name: ServiceName): boolean;
+    /** Cleanup that runs when the plugin unloads. */
+    effect(fn: () => Maybe<Disposer>): void;
+    /** A timer cleared with the plugin. */
+    interval(fn: () => Maybe<void>, ms: number): Disposer;
+}
+export {};
+//# sourceMappingURL=contract.d.ts.map

package/dist/contract.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=contract.js.map

package/dist/define.d.ts

@@ -0,0 +1,27 @@
+import type { z } from "zod";
+import type { PluginContext, ServiceName, ToolSpec } from "./contract.js";
+/** Shared by every copy of the SDK, so a plugin that bundled one is still recognised. */
+export declare const SDK_PLUGIN: unique symbol;
+export interface PluginSpec<C = undefined> {
+    /** Loaded when every one is present; unloaded when one goes. */
+    inject?: ServiceName[];
+    /** Reached through `ctx.when` / `ctx.has`. */
+    optional?: ServiceName[];
+    /** Validates the row's config before `apply` runs. */
+    config?: z.ZodType<C>;
+    apply(ctx: PluginContext, config: C): void | Promise<void>;
+}
+export interface SdkPlugin<C = undefined> extends PluginSpec<C> {
+    readonly [SDK_PLUGIN]: 1;
+}
+export declare const definePlugin: <C = undefined>(spec: PluginSpec<C>) => SdkPlugin<C>;
+export declare const isSdkPlugin: (value: unknown) => value is SdkPlugin<unknown>;
+export declare const defineTool: <S extends z.ZodObject>(tool: ToolSpec<S>) => ToolSpec<S>;
+export declare class ToolInputError extends Error {
+    name: string;
+}
+/** Tools scope to the caller's project; without one there is nothing safe to default to. */
+export declare function requireProjectId(tool: string, given: string | undefined, invocation: {
+    projectId?: string;
+}): string;
+//# sourceMappingURL=define.d.ts.map

package/dist/define.js

@@ -0,0 +1,16 @@
+/** Shared by every copy of the SDK, so a plugin that bundled one is still recognised. */
+export const SDK_PLUGIN = Symbol.for("tomrade.sdk-plugin");
+export const definePlugin = (spec) => Object.freeze({ ...spec, [SDK_PLUGIN]: 1 });
+export const isSdkPlugin = (value) => typeof value === "object" && value !== null && value[SDK_PLUGIN] === 1 && typeof value.apply === "function";
+export const defineTool = (tool) => tool;
+export class ToolInputError extends Error {
+    name = "ToolInputError";
+}
+/** Tools scope to the caller's project; without one there is nothing safe to default to. */
+export function requireProjectId(tool, given, invocation) {
+    const id = given ?? invocation.projectId;
+    if (!id)
+        throw new ToolInputError(`${tool}: projectId is required here — call list_projects and pass one`);
+    return id;
+}
+//# sourceMappingURL=define.js.map

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./contract.js";
+export { SDK_PLUGIN, ToolInputError, definePlugin, defineTool, isSdkPlugin, requireProjectId, type PluginSpec, type SdkPlugin } from "./define.js";
+export * from "./manifest.js";
+export { compareVersions, isVersion, parseVersion, satisfies } from "./semver.js";
+export type { Author, Board, CreateItemInput, FieldDef, FieldOption, FieldType, FieldValue, FilterClause, Item, ItemKind, ItemStatus, ListItemsFilter, OplogEntity, OplogEntry, OplogOp, Patch, Priority, Project, SortKey, View, WorkType } from "@tomradex/domain";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,5 @@
+export * from "./contract.js";
+export { SDK_PLUGIN, ToolInputError, definePlugin, defineTool, isSdkPlugin, requireProjectId } from "./define.js";
+export * from "./manifest.js";
+export { compareVersions, isVersion, parseVersion, satisfies } from "./semver.js";
+//# sourceMappingURL=index.js.map

package/dist/manifest.d.ts

@@ -0,0 +1,134 @@
+import { z } from "zod";
+/** The contract this SDK describes. A plugin's `engines.sdk` range is checked against the host's. */
+export declare const SDK_CONTRACT = "0.2.0";
+export declare const PLUGIN_ID: RegExp;
+export declare const NAMESPACE: RegExp;
+/** The app's own names, and the official publisher's. */
+export declare const RESERVED_NAMESPACES: Set<string>;
+export declare const OFFICIAL_PUBLISHER = "tomrade";
+export declare const PermissionsSchema: z.ZodDefault<z.ZodObject<{
+    network: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    fs: z.ZodDefault<z.ZodEnum<{
+        project: "project";
+        plugin: "plugin";
+        any: "any";
+        none: "none";
+    }>>;
+    exec: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>>;
+export declare const ContributesSchema: z.ZodObject<{
+    tools: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    commands: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    badges: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    statusItems: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    sections: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    graphs: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    playbooks: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    settings: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    surfaces: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    tables: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+}, z.core.$strip>;
+export declare const ManifestSchema: z.ZodObject<{
+    id: z.ZodString;
+    namespace: z.ZodOptional<z.ZodString>;
+    version: z.ZodString;
+    title: z.ZodString;
+    description: z.ZodDefault<z.ZodString>;
+    license: z.ZodString;
+    repository: z.ZodOptional<z.ZodURL>;
+    homepage: z.ZodOptional<z.ZodURL>;
+    author: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        url: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strip>>;
+    engines: z.ZodObject<{
+        sdk: z.ZodString;
+    }, z.core.$strip>;
+    main: z.ZodDefault<z.ZodString>;
+    icon: z.ZodOptional<z.ZodString>;
+    permissions: z.ZodDefault<z.ZodObject<{
+        network: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        fs: z.ZodDefault<z.ZodEnum<{
+            project: "project";
+            plugin: "plugin";
+            any: "any";
+            none: "none";
+        }>>;
+        exec: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    inject: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        items: "items";
+        fields: "fields";
+        boards: "boards";
+        views: "views";
+        projects: "projects";
+        db: "db";
+        settings: "settings";
+        tools: "tools";
+        contributions: "contributions";
+        agent: "agent";
+        surfaces: "surfaces";
+        oplog: "oplog";
+    }>>>;
+    optional: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        items: "items";
+        fields: "fields";
+        boards: "boards";
+        views: "views";
+        projects: "projects";
+        db: "db";
+        settings: "settings";
+        tools: "tools";
+        contributions: "contributions";
+        agent: "agent";
+        surfaces: "surfaces";
+        oplog: "oplog";
+    }>>>;
+    contributes: z.ZodDefault<z.ZodObject<{
+        tools: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        commands: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        badges: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        statusItems: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        sections: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        graphs: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        playbooks: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        settings: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        surfaces: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        tables: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    }, z.core.$strip>>;
+    authoredBy: z.ZodDefault<z.ZodEnum<{
+        agent: "agent";
+        human: "human";
+        mixed: "mixed";
+    }>>;
+    forkOf: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type Manifest = z.output<typeof ManifestSchema>;
+export type ManifestInput = z.input<typeof ManifestSchema>;
+export type Permissions = z.output<typeof PermissionsSchema>;
+export declare const MANIFEST_FILE = "tomrade-plugin.json";
+export declare function parseManifest(raw: unknown): Manifest;
+export declare const publisherOf: (id: string) => string;
+export declare const nameOf: (id: string) => string;
+/** The prefix every id the plugin registers carries, and the name of its tables. */
+export declare const namespaceOf: (manifest: Pick<Manifest, "id" | "namespace">) => string;
+export declare const ownsId: (namespace: string, id: string) => boolean;
+export declare function assertOwned(namespace: string, id: string, kind: string): void;
+export type RiskLevel = "low" | "elevated" | "high";
+export interface Risk {
+    level: RiskLevel;
+    /** Stable keys the UI words: `exec`, `fs-any`, `network-any`, `network`, `fs-project`, `db`. */
+    reasons: string[];
+}
+/**
+ * High risk is labelled, not refused: running programs, reading anywhere on
+ * disk, or talking to any host. Elevated is what a person should still see.
+ */
+export declare function riskOf(manifest: Pick<Manifest, "permissions" | "inject" | "optional">): Risk;
+/** OSI-approved licenses the store accepts without a second look. */
+export declare const OSI_LICENSES: Set<string>;
+export declare const isOpenSource: (license: string) => boolean;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.js

@@ -0,0 +1,101 @@
+import { z } from "zod";
+import { isRange, isVersion } from "./semver.js";
+/** The contract this SDK describes. A plugin's `engines.sdk` range is checked against the host's. */
+export const SDK_CONTRACT = "0.2.0";
+export const PLUGIN_ID = /^[a-z0-9][a-z0-9-]{0,38}\/[a-z0-9][a-z0-9-]{0,63}$/;
+export const NAMESPACE = /^[a-z][a-z0-9_]{1,31}$/;
+/** The app's own names, and the official publisher's. */
+export const RESERVED_NAMESPACES = new Set([
+    "agent", "archify", "boards", "code_link", "contributions", "core", "db", "deps", "deps_graph", "fields", "files", "hub", "ipc", "items",
+    "llm", "mcp", "oplog", "pet", "plugin", "plugins", "projects", "repos", "settings", "storage", "surfaces", "system", "tomrade", "tools", "views", "write"
+]);
+export const OFFICIAL_PUBLISHER = "tomrade";
+const SERVICE = z.enum(["items", "fields", "boards", "views", "projects", "db", "settings", "tools", "contributions", "agent", "surfaces", "oplog"]);
+export const PermissionsSchema = z
+    .object({
+    /** Hosts the plugin talks to; `*` means any. */
+    network: z.array(z.string().min(1)).default([]),
+    /** `plugin`: its own data directory. `project`: the project folders. `any`: anywhere on disk. */
+    fs: z.enum(["none", "plugin", "project", "any"]).default("none"),
+    /** Starts other programs. */
+    exec: z.boolean().default(false)
+})
+    .default({ network: [], fs: "none", exec: false });
+export const ContributesSchema = z
+    .object({
+    tools: z.array(z.string()).default([]),
+    commands: z.array(z.string()).default([]),
+    badges: z.array(z.string()).default([]),
+    statusItems: z.array(z.string()).default([]),
+    sections: z.array(z.string()).default([]),
+    graphs: z.array(z.string()).default([]),
+    playbooks: z.array(z.string()).default([]),
+    settings: z.array(z.string()).default([]),
+    surfaces: z.array(z.string()).default([]),
+    tables: z.array(z.string()).default([])
+})
+    .partial();
+export const ManifestSchema = z.object({
+    id: z.string().regex(PLUGIN_ID, "publisher/name, lowercase letters, digits and dashes"),
+    namespace: z.string().regex(NAMESPACE, "lowercase letters, digits and underscores, 2–32 long, starting with a letter").optional(),
+    version: z.string().refine(isVersion, "a semantic version such as 1.2.0"),
+    title: z.string().min(1).max(60),
+    description: z.string().max(500).default(""),
+    /** An SPDX identifier of an OSI-approved license. */
+    license: z.string().min(1),
+    repository: z.url().optional(),
+    homepage: z.url().optional(),
+    author: z.object({ name: z.string().min(1), url: z.url().optional() }).optional(),
+    engines: z.object({ sdk: z.string().refine(isRange, "a version range such as ^0.2.0") }),
+    main: z.string().default("dist/index.js"),
+    icon: z.string().optional(),
+    permissions: PermissionsSchema,
+    /** Stamped by `tomrade-plugin build` from the exported plugin. */
+    inject: z.array(SERVICE).default([]),
+    optional: z.array(SERVICE).default([]),
+    contributes: ContributesSchema.default({}),
+    authoredBy: z.enum(["human", "agent", "mixed"]).default("human"),
+    /** A fork names what it came from; the store credits the original. */
+    forkOf: z.object({ id: z.string().regex(PLUGIN_ID), version: z.string() }).optional()
+});
+export const MANIFEST_FILE = "tomrade-plugin.json";
+export function parseManifest(raw) {
+    const manifest = ManifestSchema.parse(raw);
+    const ns = namespaceOf(manifest);
+    if (!NAMESPACE.test(ns))
+        throw new Error(`${manifest.id}: the name part does not make a valid namespace ("${ns}"); set "namespace" in ${MANIFEST_FILE}`);
+    if (RESERVED_NAMESPACES.has(ns) && publisherOf(manifest.id) !== OFFICIAL_PUBLISHER)
+        throw new Error(`${manifest.id}: namespace "${ns}" is reserved`);
+    return manifest;
+}
+export const publisherOf = (id) => id.split("/")[0];
+export const nameOf = (id) => id.split("/")[1] ?? id;
+/** The prefix every id the plugin registers carries, and the name of its tables. */
+export const namespaceOf = (manifest) => manifest.namespace ?? nameOf(manifest.id).replace(/-/g, "_");
+export const ownsId = (namespace, id) => id === namespace || [".", "-", "_"].some((sep) => id.startsWith(namespace + sep));
+export function assertOwned(namespace, id, kind) {
+    if (!ownsId(namespace, id))
+        throw new Error(`${kind} "${id}" must be named "${namespace}" or start with "${namespace}." "${namespace}-" or "${namespace}_"`);
+}
+/**
+ * High risk is labelled, not refused: running programs, reading anywhere on
+ * disk, or talking to any host. Elevated is what a person should still see.
+ */
+export function riskOf(manifest) {
+    const p = manifest.permissions;
+    const high = [p.exec && "exec", p.fs === "any" && "fs-any", p.network.includes("*") && "network-any"].filter(Boolean);
+    const elevated = [
+        p.network.length && !p.network.includes("*") && "network",
+        p.fs === "project" && "fs-project",
+        [...manifest.inject, ...manifest.optional].includes("db") && "db"
+    ].filter(Boolean);
+    return { level: high.length ? "high" : elevated.length ? "elevated" : "low", reasons: [...high, ...elevated] };
+}
+/** OSI-approved licenses the store accepts without a second look. */
+export const OSI_LICENSES = new Set([
+    "0BSD", "AGPL-3.0", "AGPL-3.0-only", "AGPL-3.0-or-later", "Apache-2.0", "Artistic-2.0", "BSD-2-Clause", "BSD-3-Clause", "BSL-1.0", "CDDL-1.0", "EPL-1.0", "EPL-2.0",
+    "EUPL-1.2", "GPL-2.0", "GPL-2.0-only", "GPL-2.0-or-later", "GPL-3.0", "GPL-3.0-only", "GPL-3.0-or-later", "ISC", "LGPL-2.1", "LGPL-2.1-only", "LGPL-2.1-or-later",
+    "LGPL-3.0", "LGPL-3.0-only", "LGPL-3.0-or-later", "MIT", "MIT-0", "MPL-2.0", "MS-PL", "MulanPSL-2.0", "NCSA", "OSL-3.0", "PostgreSQL", "Unlicense", "UPL-1.0", "Zlib"
+]);
+export const isOpenSource = (license) => license.split(/\s+OR\s+/i).some((l) => OSI_LICENSES.has(l.replace(/[()]/g, "").trim()));
+//# sourceMappingURL=manifest.js.map

package/dist/semver.d.ts

@@ -0,0 +1,9 @@
+type Version = [number, number, number];
+export declare function parseVersion(text: string): Version | null;
+export declare const isVersion: (text: string) => boolean;
+export declare function compareVersions(a: string, b: string): number;
+/** The subset of npm ranges plugins need: `^`, `~`, comparisons, `*`, spaces for AND and `||` for OR. */
+export declare function satisfies(version: string, range: string): boolean;
+export declare const isRange: (range: string) => boolean;
+export {};
+//# sourceMappingURL=semver.d.ts.map

package/dist/semver.js

@@ -0,0 +1,67 @@
+const VERSION = /^(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+export function parseVersion(text) {
+    const m = VERSION.exec(text.trim());
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+export const isVersion = (text) => parseVersion(text) !== null;
+export function compareVersions(a, b) {
+    const x = parseVersion(a);
+    const y = parseVersion(b);
+    if (!x || !y)
+        throw new Error(`not a version: ${!x ? a : b}`);
+    for (let i = 0; i < 3; i++)
+        if (x[i] !== y[i])
+            return x[i] - y[i];
+    return 0;
+}
+function comparator(version, token) {
+    const cmp = (v) => {
+        for (let i = 0; i < 3; i++)
+            if (version[i] !== v[i])
+                return version[i] - v[i];
+        return 0;
+    };
+    if (token === "*" || token === "x")
+        return true;
+    const op = /^(\^|~|>=|<=|>|<|=)?(.+)$/.exec(token);
+    if (!op)
+        return false;
+    const base = parseVersion(op[2]);
+    if (!base)
+        return false;
+    switch (op[1]) {
+        case "^": {
+            if (cmp(base) < 0)
+                return false;
+            if (base[0] > 0)
+                return version[0] === base[0];
+            if (base[1] > 0)
+                return version[0] === 0 && version[1] === base[1];
+            return version[0] === 0 && version[1] === 0 && version[2] === base[2];
+        }
+        case "~":
+            return cmp(base) >= 0 && version[0] === base[0] && version[1] === base[1];
+        case ">=":
+            return cmp(base) >= 0;
+        case "<=":
+            return cmp(base) <= 0;
+        case ">":
+            return cmp(base) > 0;
+        case "<":
+            return cmp(base) < 0;
+        default:
+            return cmp(base) === 0;
+    }
+}
+/** The subset of npm ranges plugins need: `^`, `~`, comparisons, `*`, spaces for AND and `||` for OR. */
+export function satisfies(version, range) {
+    const v = parseVersion(version);
+    if (!v)
+        return false;
+    return range.split("||").some((part) => {
+        const tokens = part.trim().split(/\s+/).filter(Boolean);
+        return tokens.length > 0 && tokens.every((token) => comparator(v, token));
+    });
+}
+export const isRange = (range) => range.split("||").every((part) => part.trim().split(/\s+/).filter(Boolean).every((t) => t === "*" || t === "x" || /^(\^|~|>=|<=|>|<|=)?\d+\.\d+\.\d+/.test(t)));
+//# sourceMappingURL=semver.js.map

package/package.json

@@ -1,6 +1,35 @@
 {
   "name": "@tomradex/plugin-sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "type": "module",
+  "author": "Haoyuan Tang",
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "Apache-2.0",
+  "description": "The Tomrade plugin contract: definePlugin, the async PluginContext every extension receives, and the manifest schema",
+  "keywords": [
+    "tomrade",
+    "tomrade-plugin",
+    "plugin",
+    "sdk"
+  ],
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@tomradex/domain": "0.2.0",
+    "zod": "^4.4.3"
+  }
+}