@visualautomate/cli 0.3.0

package/dist/index.js

@@ -0,0 +1,2468 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { createServer } from "node:http";
+import { mkdir, readFile as readFile2, writeFile } from "node:fs/promises";
+import { existsSync as existsSync2, watch } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join as join2, relative as relative2, resolve as resolve2, sep } from "node:path";
+import { randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import { build, stop as stopBundler } from "esbuild";
+
+// ../plugin-sdk/src/simulate.ts
+function toBytes(data) {
+  return typeof data === "string" ? new TextEncoder().encode(data) : data;
+}
+function createLocalStorage(seed = {}) {
+  const files = /* @__PURE__ */ new Map();
+  for (const [path, data] of Object.entries(seed)) {
+    files.set(path, {
+      bytes: toBytes(data),
+      contentType: "application/octet-stream",
+      uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  const result = (path, file2) => ({
+    url: `memory://${path}`,
+    size: file2.bytes.length,
+    contentType: file2.contentType,
+    uploadedAt: file2.uploadedAt,
+    // The real one expires; this one does not, and says so rather than
+    // inventing a date a test might come to rely on.
+    expiresAt: "never (local simulation)"
+  });
+  const storage = {
+    async put(path, data, contentType = "application/octet-stream") {
+      const file2 = {
+        bytes: toBytes(data),
+        contentType,
+        uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      files.set(path, file2);
+      return result(path, file2);
+    },
+    async get(path) {
+      return files.get(path)?.bytes ?? null;
+    },
+    async delete(path) {
+      files.delete(path);
+    },
+    async list(prefix) {
+      const listed = [];
+      let totalSize = 0;
+      for (const [path, file2] of files) {
+        if (prefix && !path.startsWith(prefix)) continue;
+        listed.push({
+          url: `memory://${path}`,
+          pathname: path,
+          size: file2.bytes.length,
+          uploadedAt: file2.uploadedAt
+        });
+        totalSize += file2.bytes.length;
+      }
+      return { files: listed, totalSize };
+    },
+    async head(path) {
+      const file2 = files.get(path);
+      return file2 ? { size: file2.bytes.length, contentType: file2.contentType } : null;
+    },
+    async signedUrl(path) {
+      return files.has(path) ? `memory://${path}` : null;
+    },
+    /**
+     * Really fetches, because that is the only way to find out whether the
+     * URL a plugin builds is the URL it meant. The bytes land in the same
+     * in-memory store the rest of these read from.
+     */
+    async download(url, path, contentType) {
+      const res = await fetch(url);
+      if (!res.ok) throw new Error(`Downloading ${url} failed with status ${res.status}`);
+      const file2 = {
+        bytes: new Uint8Array(await res.arrayBuffer()),
+        contentType: contentType ?? res.headers.get("content-type") ?? "application/octet-stream",
+        uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      files.set(path, file2);
+      return result(path, file2);
+    }
+  };
+  return { storage, files };
+}
+function createLocalState(seed = {}) {
+  const values = new Map(Object.entries(seed));
+  const state = {
+    async get(key) {
+      return values.has(key) ? values.get(key) : null;
+    },
+    async set(key, value) {
+      values.set(key, value);
+    },
+    async delete(key) {
+      values.delete(key);
+    },
+    async list(prefix) {
+      const keys = [...values.keys()].filter((k) => !prefix || k.startsWith(prefix));
+      return { keys };
+    }
+  };
+  return { state, values };
+}
+function absent(name, what) {
+  throw new Error(
+    `context.${name} is not available locally. ${what} Pass a stub to simulate({ ${name}: \u2026 }) to test the code around it, or run the step on a canvas to exercise the real thing.`
+  );
+}
+async function simulate(plugin, options = {}) {
+  const startTime = Date.now();
+  const execute = typeof plugin === "function" ? plugin : plugin?.execute;
+  const { storage, files } = createLocalStorage(options.storage);
+  const { state, values } = createLocalState(options.state);
+  if (typeof execute !== "function") {
+    return {
+      status: "error",
+      output: null,
+      error: "This module exports no execute function. A plugin is `export default { execute }`, `module.exports.execute = \u2026`, or a default export that is the function itself.",
+      durationMs: Date.now() - startTime,
+      files,
+      state: values
+    };
+  }
+  const context = {
+    workflowId: options.workflowId ?? "local-workflow",
+    nodeId: options.nodeId ?? "local-node",
+    userId: options.userId ?? "local-user",
+    executionId: options.executionId ?? `local-${Date.now()}`,
+    startedAt: new Date(startTime).toISOString(),
+    secrets: options.secrets ?? {},
+    storage,
+    state,
+    connections: options.connections ?? {
+      get: async () => absent("connections", "It reaches an account somebody connected on the platform.")
+    },
+    media: options.media ?? {
+      run: async () => absent("media", "It runs ffmpeg in a container of its own.")
+    }
+  };
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`Plugin execution timed out after ${timeoutMs}ms`)),
+      timeoutMs
+    );
+  });
+  try {
+    const raw = await Promise.race([
+      Promise.resolve(execute(options.input ?? {}, options.config ?? {}, context)),
+      timeout
+    ]);
+    const durationMs = Date.now() - startTime;
+    if (!raw || typeof raw !== "object") {
+      return {
+        status: "error",
+        output: null,
+        error: `A plugin must return an object like { output: "success", data: {} }. This one returned ${raw === void 0 ? "undefined" : JSON.stringify(raw)}.`,
+        durationMs,
+        files,
+        state: values
+      };
+    }
+    const output = raw;
+    if (typeof output.output !== "string") {
+      return {
+        status: "error",
+        output: null,
+        error: 'The returned object has no `output`. That field names which port the run leaves by \u2014 usually "success" or "error" \u2014 and it has to be one of the `outputs` in your manifest.',
+        durationMs,
+        files,
+        state: values
+      };
+    }
+    return {
+      status: "success",
+      output: { ...output, data: output.data ?? {} },
+      durationMs,
+      outputPort: output.output,
+      logs: output.metadata?.logs,
+      files,
+      state: values
+    };
+  } catch (error) {
+    const durationMs = Date.now() - startTime;
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      status: message.includes("timed out") ? "timeout" : "error",
+      output: null,
+      error: message,
+      durationMs,
+      files,
+      state: values
+    };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+// ../plugin-sdk/src/platform-rules.ts
+var ALLOWED_PACKAGES = [
+  {
+    "name": "nodemailer",
+    "version": "^6.10.0"
+  },
+  {
+    "name": "lodash",
+    "version": "^4.17.21"
+  },
+  {
+    "name": "ramda",
+    "version": "^0.30.1"
+  },
+  {
+    "name": "underscore",
+    "version": "^1.13.8"
+  },
+  {
+    "name": "immer",
+    "version": "^11.1.18"
+  },
+  {
+    "name": "immutable",
+    "version": "^5.1.9"
+  },
+  {
+    "name": "deepmerge",
+    "version": "^4.3.1"
+  },
+  {
+    "name": "defu",
+    "version": "^6.1.7"
+  },
+  {
+    "name": "rfdc",
+    "version": "^1.4.1"
+  },
+  {
+    "name": "klona",
+    "version": "^2.0.6"
+  },
+  {
+    "name": "fast-copy",
+    "version": "^4.1.1"
+  },
+  {
+    "name": "fast-deep-equal",
+    "version": "^3.1.3"
+  },
+  {
+    "name": "dequal",
+    "version": "^2.0.3"
+  },
+  {
+    "name": "object-hash",
+    "version": "^3.0.0"
+  },
+  {
+    "name": "hash-sum",
+    "version": "^2.0.0"
+  },
+  {
+    "name": "flat",
+    "version": "^6.0.1"
+  },
+  {
+    "name": "dot-prop",
+    "version": "^10.2.0"
+  },
+  {
+    "name": "object-path",
+    "version": "^0.11.8"
+  },
+  {
+    "name": "sort-array",
+    "version": "^5.1.1"
+  },
+  {
+    "name": "natural-orderby",
+    "version": "^5.0.0"
+  },
+  {
+    "name": "deep-object-diff",
+    "version": "^1.1.9"
+  },
+  {
+    "name": "microdiff",
+    "version": "^1.6.0"
+  },
+  {
+    "name": "fast-json-patch",
+    "version": "^3.1.1"
+  },
+  {
+    "name": "rfc6902",
+    "version": "^5.3.0"
+  },
+  {
+    "name": "just-clone",
+    "version": "^6.2.0"
+  },
+  {
+    "name": "just-diff",
+    "version": "^6.0.2"
+  },
+  {
+    "name": "just-diff-apply",
+    "version": "^5.5.0"
+  },
+  {
+    "name": "just-omit",
+    "version": "^2.2.0"
+  },
+  {
+    "name": "just-pick",
+    "version": "^4.2.0"
+  },
+  {
+    "name": "just-group-by",
+    "version": "^2.2.0"
+  },
+  {
+    "name": "just-order-by",
+    "version": "^1.0.0"
+  },
+  {
+    "name": "just-unique",
+    "version": "^4.2.0"
+  },
+  {
+    "name": "just-flatten-it",
+    "version": "^5.2.0"
+  },
+  {
+    "name": "just-safe-get",
+    "version": "^4.2.0"
+  },
+  {
+    "name": "just-safe-set",
+    "version": "^4.2.1"
+  },
+  {
+    "name": "just-typeof",
+    "version": "^3.2.0"
+  },
+  {
+    "name": "just-range",
+    "version": "^4.2.0"
+  },
+  {
+    "name": "just-zip-it",
+    "version": "^3.2.0"
+  },
+  {
+    "name": "just-compare",
+    "version": "^2.3.0"
+  },
+  {
+    "name": "just-intersect",
+    "version": "^4.3.0"
+  },
+  {
+    "name": "just-split",
+    "version": "^3.2.0"
+  },
+  {
+    "name": "just-truncate",
+    "version": "^2.2.0"
+  },
+  {
+    "name": "semver",
+    "version": "^7.6.3"
+  },
+  {
+    "name": "compare-versions",
+    "version": "^6.1.1"
+  },
+  {
+    "name": "tiny-invariant",
+    "version": "^1.3.3"
+  },
+  {
+    "name": "json-stringify-safe",
+    "version": "^5.0.1"
+  },
+  {
+    "name": "fast-safe-stringify",
+    "version": "^2.1.1"
+  },
+  {
+    "name": "flatted",
+    "version": "^3.4.4"
+  },
+  {
+    "name": "superjson",
+    "version": "^2.2.6"
+  },
+  {
+    "name": "devalue",
+    "version": "^5.9.2"
+  },
+  {
+    "name": "lru-cache",
+    "version": "^11.5.2"
+  },
+  {
+    "name": "quick-lru",
+    "version": "^7.3.0"
+  },
+  {
+    "name": "memoize-one",
+    "version": "^6.0.0"
+  },
+  {
+    "name": "fast-memoize",
+    "version": "^2.5.2"
+  },
+  {
+    "name": "uuid",
+    "version": "^11.0.5"
+  },
+  {
+    "name": "nanoid",
+    "version": "^5.0.9"
+  },
+  {
+    "name": "ulid",
+    "version": "^3.0.2"
+  },
+  {
+    "name": "@paralleldrive/cuid2",
+    "version": "^3.3.0"
+  },
+  {
+    "name": "slugify",
+    "version": "^1.6.6"
+  },
+  {
+    "name": "slug",
+    "version": "^12.0.1"
+  },
+  {
+    "name": "sanitize-filename",
+    "version": "^1.6.4"
+  },
+  {
+    "name": "filenamify",
+    "version": "^7.0.3"
+  },
+  {
+    "name": "seedrandom",
+    "version": "^3.0.5"
+  },
+  {
+    "name": "random-js",
+    "version": "^2.1.0"
+  },
+  {
+    "name": "chance",
+    "version": "^1.1.13"
+  },
+  {
+    "name": "@faker-js/faker",
+    "version": "^10.6.0"
+  },
+  {
+    "name": "lorem-ipsum",
+    "version": "^3.0.0"
+  },
+  {
+    "name": "randomcolor",
+    "version": "^0.6.2"
+  },
+  {
+    "name": "date-fns",
+    "version": "^4.1.0"
+  },
+  {
+    "name": "date-fns-tz",
+    "version": "^3.2.0"
+  },
+  {
+    "name": "dayjs",
+    "version": "^1.11.13"
+  },
+  {
+    "name": "luxon",
+    "version": "^3.5.0"
+  },
+  {
+    "name": "moment",
+    "version": "^2.30.1"
+  },
+  {
+    "name": "moment-timezone",
+    "version": "^0.6.3"
+  },
+  {
+    "name": "ms",
+    "version": "^2.1.3"
+  },
+  {
+    "name": "pretty-ms",
+    "version": "^9.3.1"
+  },
+  {
+    "name": "parse-duration",
+    "version": "^2.1.8"
+  },
+  {
+    "name": "humanize-duration",
+    "version": "^3.34.1"
+  },
+  {
+    "name": "timeago.js",
+    "version": "^4.0.2"
+  },
+  {
+    "name": "chrono-node",
+    "version": "^2.7.7"
+  },
+  {
+    "name": "rrule",
+    "version": "^2.8.1"
+  },
+  {
+    "name": "cron-parser",
+    "version": "^5.10.0"
+  },
+  {
+    "name": "cronstrue",
+    "version": "^3.26.0"
+  },
+  {
+    "name": "date-and-time",
+    "version": "^4.5.2"
+  },
+  {
+    "name": "fecha",
+    "version": "^4.2.3"
+  },
+  {
+    "name": "dateformat",
+    "version": "^5.0.3"
+  },
+  {
+    "name": "iso8601-duration",
+    "version": "^2.1.4"
+  },
+  {
+    "name": "ics",
+    "version": "^3.12.0"
+  },
+  {
+    "name": "zod",
+    "version": "^3.24.1"
+  },
+  {
+    "name": "yup",
+    "version": "^1.6.1"
+  },
+  {
+    "name": "joi",
+    "version": "^18.2.8"
+  },
+  {
+    "name": "ajv",
+    "version": "^8.17.1"
+  },
+  {
+    "name": "ajv-formats",
+    "version": "^3.0.1"
+  },
+  {
+    "name": "ajv-errors",
+    "version": "^3.0.0"
+  },
+  {
+    "name": "superstruct",
+    "version": "^2.0.2"
+  },
+  {
+    "name": "valibot",
+    "version": "^1.5.0"
+  },
+  {
+    "name": "jsonschema",
+    "version": "^1.5.0"
+  },
+  {
+    "name": "@sinclair/typebox",
+    "version": "^0.34.52"
+  },
+  {
+    "name": "validator",
+    "version": "^13.12.0"
+  },
+  {
+    "name": "email-validator",
+    "version": "^2.0.4"
+  },
+  {
+    "name": "libphonenumber-js",
+    "version": "^1.11.17"
+  },
+  {
+    "name": "iban",
+    "version": "^0.0.14"
+  },
+  {
+    "name": "credit-card-type",
+    "version": "^10.3.0"
+  },
+  {
+    "name": "card-validator",
+    "version": "^10.0.4"
+  },
+  {
+    "name": "psl",
+    "version": "^1.15.0"
+  },
+  {
+    "name": "tldts",
+    "version": "^7.4.12"
+  },
+  {
+    "name": "normalize-url",
+    "version": "^9.0.1"
+  },
+  {
+    "name": "valid-url",
+    "version": "^1.0.9"
+  },
+  {
+    "name": "is-ip",
+    "version": "^5.0.1"
+  },
+  {
+    "name": "ipaddr.js",
+    "version": "^2.5.0"
+  },
+  {
+    "name": "ip-address",
+    "version": "^10.7.0"
+  },
+  {
+    "name": "netmask",
+    "version": "^2.1.1"
+  },
+  {
+    "name": "ua-parser-js",
+    "version": "^2.0.10"
+  },
+  {
+    "name": "bowser",
+    "version": "^2.14.1"
+  },
+  {
+    "name": "papaparse",
+    "version": "^5.4.1"
+  },
+  {
+    "name": "csv-parse",
+    "version": "^7.0.2"
+  },
+  {
+    "name": "csv-stringify",
+    "version": "^6.8.3"
+  },
+  {
+    "name": "json-2-csv",
+    "version": "^5.6.0"
+  },
+  {
+    "name": "js-yaml",
+    "version": "^4.1.0"
+  },
+  {
+    "name": "yaml",
+    "version": "^2.9.0"
+  },
+  {
+    "name": "json5",
+    "version": "^2.2.3"
+  },
+  {
+    "name": "jsonc-parser",
+    "version": "^3.3.1"
+  },
+  {
+    "name": "hjson",
+    "version": "^3.2.2"
+  },
+  {
+    "name": "toml",
+    "version": "^5.0.0"
+  },
+  {
+    "name": "@iarna/toml",
+    "version": "^2.2.5"
+  },
+  {
+    "name": "ini",
+    "version": "^7.0.0"
+  },
+  {
+    "name": "fast-xml-parser",
+    "version": "^4.5.1"
+  },
+  {
+    "name": "xml2js",
+    "version": "^0.6.2"
+  },
+  {
+    "name": "xml-js",
+    "version": "^1.6.11"
+  },
+  {
+    "name": "xmlbuilder2",
+    "version": "^4.0.3"
+  },
+  {
+    "name": "@xmldom/xmldom",
+    "version": "^0.9.12"
+  },
+  {
+    "name": "xpath",
+    "version": "^0.0.34"
+  },
+  {
+    "name": "cheerio",
+    "version": "^1.0.0"
+  },
+  {
+    "name": "htmlparser2",
+    "version": "^12.0.0"
+  },
+  {
+    "name": "node-html-parser",
+    "version": "^9.0.4"
+  },
+  {
+    "name": "parse5",
+    "version": "^8.0.1"
+  },
+  {
+    "name": "sanitize-html",
+    "version": "^2.17.7"
+  },
+  {
+    "name": "marked",
+    "version": "^15.0.6"
+  },
+  {
+    "name": "markdown-it",
+    "version": "^15.0.1"
+  },
+  {
+    "name": "showdown",
+    "version": "^2.1.0"
+  },
+  {
+    "name": "turndown",
+    "version": "^7.2.0"
+  },
+  {
+    "name": "html-to-text",
+    "version": "^9.0.5"
+  },
+  {
+    "name": "he",
+    "version": "^1.2.0"
+  },
+  {
+    "name": "entities",
+    "version": "^8.1.0"
+  },
+  {
+    "name": "striptags",
+    "version": "^3.2.0"
+  },
+  {
+    "name": "front-matter",
+    "version": "^4.0.2"
+  },
+  {
+    "name": "qs",
+    "version": "^6.13.1"
+  },
+  {
+    "name": "query-string",
+    "version": "^9.5.1"
+  },
+  {
+    "name": "url-parse",
+    "version": "^1.5.10"
+  },
+  {
+    "name": "mime-types",
+    "version": "^2.1.35"
+  },
+  {
+    "name": "mime",
+    "version": "^4.1.0"
+  },
+  {
+    "name": "content-type",
+    "version": "^3.0.0"
+  },
+  {
+    "name": "cookie",
+    "version": "^2.0.1"
+  },
+  {
+    "name": "set-cookie-parser",
+    "version": "^3.1.2"
+  },
+  {
+    "name": "jsonpath-plus",
+    "version": "^10.2.0"
+  },
+  {
+    "name": "jmespath",
+    "version": "^0.16.0"
+  },
+  {
+    "name": "jsonata",
+    "version": "^2.2.2"
+  },
+  {
+    "name": "exceljs",
+    "version": "^4.4.0"
+  },
+  {
+    "name": "change-case",
+    "version": "^5.4.4"
+  },
+  {
+    "name": "camelcase",
+    "version": "^9.0.0"
+  },
+  {
+    "name": "decamelize",
+    "version": "^6.0.1"
+  },
+  {
+    "name": "title-case",
+    "version": "^4.3.2"
+  },
+  {
+    "name": "pluralize",
+    "version": "^8.0.0"
+  },
+  {
+    "name": "inflection",
+    "version": "^3.0.2"
+  },
+  {
+    "name": "voca",
+    "version": "^1.4.1"
+  },
+  {
+    "name": "underscore.string",
+    "version": "^3.3.6"
+  },
+  {
+    "name": "string-similarity",
+    "version": "^4.0.4"
+  },
+  {
+    "name": "fastest-levenshtein",
+    "version": "^1.0.16"
+  },
+  {
+    "name": "leven",
+    "version": "^4.1.0"
+  },
+  {
+    "name": "diff",
+    "version": "^7.0.0"
+  },
+  {
+    "name": "diff-match-patch",
+    "version": "^1.0.5"
+  },
+  {
+    "name": "remove-accents",
+    "version": "^0.5.0"
+  },
+  {
+    "name": "transliteration",
+    "version": "^2.6.1"
+  },
+  {
+    "name": "latinize",
+    "version": "^2.0.0"
+  },
+  {
+    "name": "franc",
+    "version": "^6.2.0"
+  },
+  {
+    "name": "stopword",
+    "version": "^3.1.5"
+  },
+  {
+    "name": "emoji-regex",
+    "version": "^10.6.0"
+  },
+  {
+    "name": "node-emoji",
+    "version": "^2.2.0"
+  },
+  {
+    "name": "string-width",
+    "version": "^8.2.2"
+  },
+  {
+    "name": "word-wrap",
+    "version": "^1.2.5"
+  },
+  {
+    "name": "wrap-ansi",
+    "version": "^10.0.1"
+  },
+  {
+    "name": "linkify-it",
+    "version": "^6.1.0"
+  },
+  {
+    "name": "linkifyjs",
+    "version": "^4.3.3"
+  },
+  {
+    "name": "fuse.js",
+    "version": "^7.5.0"
+  },
+  {
+    "name": "minisearch",
+    "version": "^7.2.0"
+  },
+  {
+    "name": "lunr",
+    "version": "^2.3.9"
+  },
+  {
+    "name": "flexsearch",
+    "version": "^0.8.212"
+  },
+  {
+    "name": "mustache",
+    "version": "^4.2.0"
+  },
+  {
+    "name": "liquidjs",
+    "version": "^10.20.1"
+  },
+  {
+    "name": "intl-messageformat",
+    "version": "^11.2.14"
+  },
+  {
+    "name": "gpt-tokenizer",
+    "version": "^4.0.0"
+  },
+  {
+    "name": "js-tiktoken",
+    "version": "^1.0.21"
+  },
+  {
+    "name": "decimal.js",
+    "version": "^10.4.3"
+  },
+  {
+    "name": "big.js",
+    "version": "^6.2.2"
+  },
+  {
+    "name": "bignumber.js",
+    "version": "^11.1.5"
+  },
+  {
+    "name": "currency.js",
+    "version": "^2.0.4"
+  },
+  {
+    "name": "dinero.js",
+    "version": "^2.0.2"
+  },
+  {
+    "name": "numeral",
+    "version": "^2.0.6"
+  },
+  {
+    "name": "accounting",
+    "version": "^0.4.1"
+  },
+  {
+    "name": "fraction.js",
+    "version": "^5.3.4"
+  },
+  {
+    "name": "convert-units",
+    "version": "^2.3.4"
+  },
+  {
+    "name": "js-quantities",
+    "version": "^1.8.0"
+  },
+  {
+    "name": "mathjs",
+    "version": "^15.2.0"
+  },
+  {
+    "name": "simple-statistics",
+    "version": "^7.12.0"
+  },
+  {
+    "name": "ml-matrix",
+    "version": "^6.15.0"
+  },
+  {
+    "name": "d3-array",
+    "version": "^3.2.4"
+  },
+  {
+    "name": "d3-format",
+    "version": "^3.1.2"
+  },
+  {
+    "name": "d3-time-format",
+    "version": "^4.1.0"
+  },
+  {
+    "name": "geolib",
+    "version": "^3.3.14"
+  },
+  {
+    "name": "haversine-distance",
+    "version": "^1.2.4"
+  },
+  {
+    "name": "filesize",
+    "version": "^11.0.23"
+  },
+  {
+    "name": "bytes",
+    "version": "^3.1.2"
+  },
+  {
+    "name": "human-format",
+    "version": "^1.2.1"
+  },
+  {
+    "name": "jsonwebtoken",
+    "version": "^9.0.2"
+  },
+  {
+    "name": "jose",
+    "version": "^5.9.6"
+  },
+  {
+    "name": "jws",
+    "version": "^4.0.1"
+  },
+  {
+    "name": "jwt-decode",
+    "version": "^4.0.0"
+  },
+  {
+    "name": "crypto-js",
+    "version": "^4.2.0"
+  },
+  {
+    "name": "bcryptjs",
+    "version": "^2.4.3"
+  },
+  {
+    "name": "otplib",
+    "version": "^13.5.0"
+  },
+  {
+    "name": "otpauth",
+    "version": "^9.5.2"
+  },
+  {
+    "name": "tweetnacl",
+    "version": "^1.0.3"
+  },
+  {
+    "name": "tweetnacl-util",
+    "version": "^0.15.1"
+  },
+  {
+    "name": "node-forge",
+    "version": "^1.4.0"
+  },
+  {
+    "name": "elliptic",
+    "version": "^6.6.1"
+  },
+  {
+    "name": "bn.js",
+    "version": "^5.2.5"
+  },
+  {
+    "name": "js-base64",
+    "version": "^3.7.7"
+  },
+  {
+    "name": "base64-js",
+    "version": "^1.5.1"
+  },
+  {
+    "name": "base-64",
+    "version": "^1.0.0"
+  },
+  {
+    "name": "hi-base32",
+    "version": "^0.5.1"
+  },
+  {
+    "name": "thirty-two",
+    "version": "^1.0.2"
+  },
+  {
+    "name": "js-sha256",
+    "version": "^1.0.0"
+  },
+  {
+    "name": "js-sha512",
+    "version": "^0.9.0"
+  },
+  {
+    "name": "js-sha1",
+    "version": "^0.7.0"
+  },
+  {
+    "name": "js-md5",
+    "version": "^0.9.2"
+  },
+  {
+    "name": "hash.js",
+    "version": "^1.1.7"
+  },
+  {
+    "name": "spark-md5",
+    "version": "^3.0.2"
+  },
+  {
+    "name": "blueimp-md5",
+    "version": "^2.19.0"
+  },
+  {
+    "name": "crc-32",
+    "version": "^1.2.2"
+  },
+  {
+    "name": "crc",
+    "version": "^4.3.2"
+  },
+  {
+    "name": "utf8",
+    "version": "^3.0.0"
+  },
+  {
+    "name": "iconv-lite",
+    "version": "^0.7.3"
+  },
+  {
+    "name": "punycode",
+    "version": "^2.3.1"
+  },
+  {
+    "name": "pako",
+    "version": "^3.0.1"
+  },
+  {
+    "name": "fflate",
+    "version": "^0.8.3"
+  },
+  {
+    "name": "lz-string",
+    "version": "^1.5.0"
+  },
+  {
+    "name": "color",
+    "version": "^5.0.3"
+  },
+  {
+    "name": "tinycolor2",
+    "version": "^1.6.0"
+  },
+  {
+    "name": "chroma-js",
+    "version": "^3.2.0"
+  },
+  {
+    "name": "color-convert",
+    "version": "^3.1.3"
+  },
+  {
+    "name": "colord",
+    "version": "^2.10.0"
+  },
+  {
+    "name": "i18n-iso-countries",
+    "version": "^7.14.0"
+  },
+  {
+    "name": "iso-3166-1",
+    "version": "^2.1.1"
+  },
+  {
+    "name": "iso-639-1",
+    "version": "^3.1.6"
+  },
+  {
+    "name": "currency-codes",
+    "version": "^2.2.0"
+  },
+  {
+    "name": "qrcode-generator",
+    "version": "^2.0.4"
+  },
+  {
+    "name": "p-limit",
+    "version": "^6.2.0"
+  },
+  {
+    "name": "p-retry",
+    "version": "^6.2.1"
+  },
+  {
+    "name": "p-map",
+    "version": "^7.0.3"
+  },
+  {
+    "name": "p-queue",
+    "version": "^9.3.3"
+  },
+  {
+    "name": "p-timeout",
+    "version": "^7.0.1"
+  },
+  {
+    "name": "p-all",
+    "version": "^5.0.1"
+  },
+  {
+    "name": "p-props",
+    "version": "^6.1.0"
+  },
+  {
+    "name": "p-settle",
+    "version": "^5.2.1"
+  },
+  {
+    "name": "p-throttle",
+    "version": "^8.1.0"
+  },
+  {
+    "name": "p-debounce",
+    "version": "^5.1.0"
+  },
+  {
+    "name": "async",
+    "version": "^3.2.6"
+  },
+  {
+    "name": "bluebird",
+    "version": "^3.7.2"
+  },
+  {
+    "name": "promise-retry",
+    "version": "^2.0.1"
+  },
+  {
+    "name": "retry",
+    "version": "^0.13.1"
+  },
+  {
+    "name": "exponential-backoff",
+    "version": "^3.1.3"
+  },
+  {
+    "name": "bottleneck",
+    "version": "^2.19.5"
+  },
+  {
+    "name": "throttle-debounce",
+    "version": "^5.0.2"
+  },
+  {
+    "name": "delay",
+    "version": "^7.0.0"
+  },
+  {
+    "name": "graphlib",
+    "version": "^2.1.8"
+  }
+];
+var RESTRICTED_PATTERNS = [
+  /\bprocess\s*\.\s*exit/,
+  /\bprocess\s*\.\s*env/,
+  /\bprocess\s*\.\s*binding/,
+  /\bprocess\s*\.\s*mainModule/,
+  /\bprocess\s*\[/,
+  /\bprocess\s*\(/,
+  /\beval\s*\(/,
+  /\bFunction\s*\(/,
+  /\bnew\s+Function\b/,
+  /\bAsyncFunction\b/,
+  /\bGeneratorFunction\b/,
+  /\bglobalThis\b/,
+  /\bself\s*\[/,
+  /\bimport\s+/,
+  /\bimport\s*\(/,
+  /\bReflect\b/,
+  /\bProxy\b/,
+  /\b__proto__\b/,
+  /\bprototype\s*\[/,
+  /\bprototype\s*\.\s*constructor\b/,
+  /\bconstructor\b/,
+  /\bthis\s*\.\s*constructor\b/,
+  /\barguments\s*\.\s*callee\b/,
+  /\bObject\s*\.\s*defineProperty\b/,
+  /\b__defineGetter__\b/,
+  /\b__defineSetter__\b/,
+  /\b__lookupGetter__\b/,
+  /\b__lookupSetter__\b/,
+  /\bmodule\s*\.\s*(?:constructor|extensions|_compile|_path|_sourceMaps)\b/,
+  /\brequire\s*\.\s*cache\b/,
+  /\brequire\s*\.\s*resolve\b/,
+  /\bError\s*\.\s*captureStackTrace\b/,
+  /\bWebAssembly\b/
+];
+
+// ../plugin-sdk/src/validate.ts
+var ALLOWED_PACKAGE_NAMES = new Set(ALLOWED_PACKAGES.map((p) => p.name));
+function validatePluginCode(code) {
+  const hasExecute = code.includes("module.exports") || code.includes("exports.execute") || code.includes("export");
+  if (!hasExecute) {
+    return {
+      valid: false,
+      error: "Plugin code must export an execute function. Example: module.exports = { execute: async (input, config, context) => { ... } }"
+    };
+  }
+  for (const pattern of RESTRICTED_PATTERNS) {
+    if (pattern.test(code)) {
+      return {
+        valid: false,
+        error: `Plugin code contains restricted patterns. Plugins cannot access the filesystem, spawn processes, use eval, import modules, or escape the sandbox. (matched ${pattern})`
+      };
+    }
+  }
+  const packages = [];
+  const requireCall = /\brequire\s*\(\s*(['"])([^'"]+)\1\s*\)/g;
+  let match;
+  while ((match = requireCall.exec(code)) !== null) {
+    const name = match[2];
+    if (!ALLOWED_PACKAGE_NAMES.has(name)) {
+      return {
+        valid: false,
+        error: `Plugin code requires "${name}" which is not an allowed package. See ALLOWED_PACKAGES for the list.`
+      };
+    }
+    if (!packages.includes(name)) packages.push(name);
+  }
+  if (/\brequire\s*\(\s*(?!['"][^'"]+['"]\s*\))/.test(code)) {
+    return {
+      valid: false,
+      error: "Plugin code contains a dynamic require() call. Only require() with string literals of allowed packages is permitted."
+    };
+  }
+  return { valid: true, packages };
+}
+function sandboxRequire(load) {
+  return (name) => {
+    const allowed = ALLOWED_PACKAGES.find((p) => p.name === name);
+    if (!allowed) throw new Error(`Cannot require "${name}"`);
+    try {
+      return load(name);
+    } catch {
+      throw new Error(
+        `"${name}" is available in the sandbox but not installed here. To run this locally: npm install --save-dev ${name}@${allowed.version}`
+      );
+    }
+  };
+}
+function loadPluginCode(code, require2) {
+  const module = { exports: {} };
+  const body = new Function("module", "exports", "require", `"use strict"; ${code}`);
+  body(module, module.exports, require2);
+  return module.exports;
+}
+
+// src/declarations.ts
+var TYPE_DECLARATIONS = '/**\n * What a plugin is handed, and what it must hand back.\n *\n * This file is the contract between a plugin and the VisualAutomate runtime:\n * the arguments `execute` is called with, every helper on `context`, the shape\n * of the result, and the manifest that declares the step. When a helper is only\n * present under some condition, that is said here rather than left for somebody\n * to discover from a TypeError.\n *\n * context-api.ts describes the same runtime as data, for tools that cannot read\n * a TypeScript interface, such as an editor\'s autocomplete.\n */\n\n// \u2500\u2500\u2500 What a step is called with \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * The output of the steps that led here, keyed by step name and node id.\n *\n * A step reads `input.download_clips.file` where `download_clips` is what the\n * step before it is called on the canvas. Every route into this step is merged,\n * so a step at the join of two branches sees both.\n */\nexport interface PluginInput {\n    [key: string]: unknown\n}\n\n/** The fields somebody filled in on the canvas, as the manifest declared them. */\nexport interface PluginConfig {\n    [key: string]: unknown\n}\n\n// \u2500\u2500\u2500 context.storage \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** What `storage.put` reports about the file it wrote. */\nexport interface StorageResult {\n    url: string\n    size: number\n    contentType: string\n    uploadedAt: string\n    expiresAt: string\n}\n\n/** What `storage.list` reports. */\nexport interface StorageListResult {\n    files: Array<{\n        url: string\n        pathname: string\n        size: number\n        uploadedAt: string\n    }>\n    totalSize: number\n}\n\n/**\n * The account\'s own files. Paths are scoped to the user; you cannot name\n * anybody else\'s, and you do not have to prefix your own.\n *\n * The account\'s plan caps what it may hold at once, and a `put` past that\n * ceiling is refused rather than silently dropped.\n */\nexport interface PluginStorage {\n    /** Write a file. Bytes may be a string, a Buffer or any typed array. */\n    put(path: string, data: Uint8Array | string, contentType?: string): Promise<StorageResult>\n    /** Read a file back. `null` when it is not there. */\n    get(path: string): Promise<Uint8Array | null>\n    delete(path: string): Promise<void>\n    /** Everything under a prefix, or everything when no prefix is given. */\n    list(prefix?: string): Promise<StorageListResult>\n    /** Size and content type without moving the bytes. `null` when absent. */\n    head(path: string): Promise<{ size: number; contentType: string } | null>\n    /**\n     * A URL somebody else can fetch this file from, for a few minutes.\n     *\n     * For the common API that takes a link and pulls the file itself. Clamped\n     * to between one minute and one hour; the default is fifteen minutes.\n     */\n    signedUrl(path: string, expiresInSeconds?: number): Promise<string | null>\n    /**\n     * Pull a URL straight into storage without the bytes passing through this\n     * step. A hundred-megabyte file costs the run no memory and no egress,\n     * because a Worker fetches it and writes it to storage directly.\n     *\n     * ONLY PRESENT when the download Worker is configured on the server. Guard\n     * with `if (context.storage.download)` if you want to degrade gracefully.\n     */\n    download?(url: string, path: string, contentType?: string): Promise<StorageResult>\n}\n\n// \u2500\u2500\u2500 context.state \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Values that outlive one run, scoped to this workflow and this account.\n *\n * For a cursor, a last-seen id, a counter \u2014 the things a workflow needs to\n * remember between firings. Not for large data: that is what storage is for.\n * The account\'s plan caps how many keys it may hold.\n */\nexport interface PluginState {\n    /** The stored value, or `null` when the key has never been set. */\n    get(key: string): Promise<unknown>\n    set(key: string, value: unknown, options?: { ttlSeconds?: number }): Promise<void>\n    delete(key: string): Promise<void>\n    list(prefix?: string): Promise<{ keys: string[] }>\n}\n\n// \u2500\u2500\u2500 context.media \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * ffmpeg, for a step that has a file in storage and wants a different one.\n *\n * A PLUGIN NEVER BUILDS AN FFMPEG COMMAND LINE, and cannot. You name an\n * operation and supply values; the command line is assembled on the server, one\n * operation at a time, and the only paths in it are placeholders the container\n * fills from a list the server wrote. That is deliberate: `-i` takes any path\n * and several filters open files of their own, so an ffmpeg taking its flags\n * from plugin config would be a plugin reading the container\'s filesystem \u2014\n * including the file holding that run\'s own credentials.\n *\n * The job runs in a container of its own and talks to storage directly, so a\n * two hundred megabyte clip never crosses this step.\n *\n * ONLY PRESENT when the sandbox and storage are both configured.\n */\nexport interface PluginMedia {\n    run(operation: string, params: Record<string, unknown>): Promise<Record<string, unknown>>\n}\n\n// \u2500\u2500\u2500 context.connections \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** One request through the integration proxy. */\nexport interface ConnectionRequest {\n    path: string\n    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE"\n    query?: Record<string, string | number | boolean | undefined>\n    headers?: Record<string, string>\n    body?: unknown\n}\n\n/** What the proxy answers with. The provider\'s own reply, unwrapped. */\nexport interface ConnectionResponse {\n    ok: boolean\n    status: number\n    headers?: Record<string, string>\n    body: unknown\n}\n\n/**\n * One of the accounts the user connected.\n *\n * THERE IS NO getToken(), deliberately. A token that can be read can be logged\n * or posted somewhere, and this is where third-party code runs. You name a path\n * and the proxy attaches the credential on the way past.\n *\n * You also never name a host. The base URL belongs to the provider\n * configuration, which is what stops a connection being pointed at an internal\n * address or at somebody\'s collection server.\n */\nexport interface PluginConnection {\n    /** This platform\'s id for the connection, not the provider\'s. */\n    id: string\n    request(options: ConnectionRequest): Promise<ConnectionResponse>\n}\n\n/**\n * The accounts this step was configured with.\n *\n * `get` takes the name of one of your own `connection` properties \u2014 not a\n * connection id \u2014 so a step can only reach the accounts it was set up with.\n *\n * ONLY PRESENT when the step declares at least one `connection` property and\n * the user has chosen an account for it.\n */\nexport interface PluginConnections {\n    get(propertyName: string): Promise<PluginConnection>\n}\n\n// \u2500\u2500\u2500 The context itself \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Everything a step is told about the run it is part of.\n *\n * The optional members are optional for a reason and not out of caution: each\n * is absent when the thing behind it is not configured or not applicable, and\n * a plugin that needs one should say so plainly rather than crash on a dot.\n */\nexport interface PluginContext {\n    /** The workflow this run belongs to. */\n    workflowId: string\n    /** This step\'s id on the canvas. */\n    nodeId: string\n    /** Whose run it is. */\n    userId: string\n    /** This run, distinct from every other run of the same workflow. */\n    executionId: string\n    /** When the run started, as an ISO string. */\n    startedAt: string\n    /** Values the plugin was published with. Not the user\'s credentials. */\n    secrets: Record<string, string>\n\n    /** The account\'s files. See PluginStorage. */\n    storage: PluginStorage\n    /** Values that outlive one run. See PluginState. */\n    state: PluginState\n    /** ffmpeg. Absent when the server has no sandbox or storage configured. */\n    media?: PluginMedia\n    /** The accounts this step was configured with. Absent when it has none. */\n    connections?: PluginConnections\n}\n\n// \u2500\u2500\u2500 What a step hands back \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * The result of a step.\n *\n * `output` names which port the run leaves by, and therefore which lines on the\n * canvas are followed. It has to be one of the `outputs` in the manifest \u2014\n * usually `"success"` or `"error"`.\n *\n * `data` is what the next steps read as `{{this_step.field}}`. Keep it flat and\n * named for what it is; those names are what somebody picks from a dropdown.\n */\nexport interface PluginOutput {\n    output: string\n    data: Record<string, unknown>\n    metadata?: {\n        durationMs?: number\n        memoryUsedMb?: number\n        logs?: string[]\n    }\n}\n\n/**\n * A plugin.\n *\n * Export `execute`, either as `module.exports.execute` or as the default export\n * of a module with an `execute` on it. Both are accepted, and so is a bare\n * function as the default export.\n *\n * @example\n * export default {\n *   async execute(input, config, context) {\n *     const file = await context.storage.get(config.path as string)\n *     return { output: "success", data: { bytes: file?.length ?? 0 } }\n *   }\n * }\n */\nexport interface PluginModule {\n    execute(\n        input: PluginInput,\n        config: PluginConfig,\n        context: PluginContext,\n    ): Promise<PluginOutput> | PluginOutput\n}\n\n/** The bare function form, for a plugin that is only an execute. */\nexport type PluginExecute = PluginModule["execute"]\n\n// \u2500\u2500\u2500 How a run reports on a step \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * `skipped` is a decision rather than a fault: the filters on every line into\n * the step said no, so it never ran. Counting it as an error turns a branch\n * that was simply not chosen into a broken workflow.\n */\nexport type ExecutionStatus = "success" | "error" | "timeout" | "skipped" | "cancelled"\n\nexport interface PluginExecutionResult {\n    status: ExecutionStatus\n    output: PluginOutput | null\n    error?: string\n    durationMs: number\n    memoryMb?: number\n    outputPort?: string\n    logs?: string[]\n}\n\n// \u2500\u2500\u2500 The manifest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * The declaration that sits beside the code.\n *\n * It says which fields the canvas renders, which account the step acts as, what\n * it hands downstream, and whether it is a starting point that watches\n * something. One shape wherever it is stored \u2014 `manifest.json` next to your\n * code, or an `@schema` comment in the source.\n *\n * Every name below is one the platform keeps. A block it does not recognise is\n * dropped when the plugin is saved, so a field that is not listed here will not\n * survive an upload.\n */\nexport type PluginPropertyType =\n    | "string"\n    | "number"\n    | "boolean"\n    | "select"\n    | "multiselect"\n    | "json"\n    /**\n     * A program, not a value.\n     *\n     * Stored exactly as typed and never parsed, which is the difference from\n     * `json` above: that one keeps its value structured, so `return 5` would be\n     * saved as the number five and the step would run nothing.\n     */\n    | "code"\n    | "color"\n    | "date"\n    /** An account the user connected. Rendered as a picker, not a text box. */\n    | "connection"\n    /**\n     * A file the account already has, read into the config before the step\n     * runs. `{{config.attachment.name}}`, `.contentType`, `.size`,\n     * `.contentBytes`. Right for attaching a PDF; a video would be hundreds of\n     * megabytes of base64 \u2014 use `path` for those.\n     */\n    | "file"\n    /** A file in storage, named rather than read. What ffmpeg steps take. */\n    | "path"\n    /** Several of them, one per line, in the order they were chosen. */\n    | "paths"\n\nexport interface PluginProperty {\n    /** Shown above the input on the canvas. Defaults to the property name. */\n    label: string\n    type: PluginPropertyType\n    required?: boolean\n    default?: unknown\n    /** Helper text under the input. */\n    description?: string\n    /** For `select` and `multiselect`. */\n    options?: Array<{ label: string; value: string }>\n    /** Puts related fields in a section together. */\n    group?: string\n    /** For `number`. */\n    min?: number\n    max?: number\n    /** For `string`: a regex the value must match. */\n    pattern?: string\n    /**\n     * For `connection`: which integration the account must belong to, e.g.\n     * `outlook`. A module inherits its app\'s, so it does not repeat this.\n     */\n    provider?: string\n}\n\n/**\n * How a step reaches the account it acts as.\n *\n * `none` means the plugin holds its own key in a property. That is not the same\n * as leaving the block out, which means "written before auth could be\n * declared".\n *\n * A MANIFEST MAY NOT NAME A HOST. `url`, `baseUrl`, `base_url` and `host` are\n * refused outright rather than ignored, so nobody writes one and believes it\n * took effect: the base URL belongs to the provider configuration, and that is\n * what stops a connection being pointed at an internal address.\n */\nexport interface PluginAuth {\n    type: "oauth2" | "api_key" | "basic" | "none"\n    provider?: string\n    scopes?: string[]\n}\n\n/** One request the platform makes on your behalf. Relative paths only. */\nexport interface TriggerRequest {\n    method?: "GET" | "POST"\n    /** Relative to the provider\'s base URL. The proxy refuses anything else. */\n    path: string\n    query?: Record<string, string>\n    headers?: Record<string, string>\n    body?: unknown\n}\n\n/** Where the next poll should carry on from. */\nexport interface TriggerCursor {\n    from: "response" | "item"\n    /** Dotted path to the value. `@odata.deltaLink` is one key, not two. */\n    path: string\n    into?: string\n}\n\n/**\n * A second request per item, for providers that answer with identifiers.\n *\n * Gmail\'s message list returns `{ id, threadId }` \u2014 enough to know a mail\n * arrived, not enough to tell anyone what it says. Without this the trigger\n * polls correctly, dedupes correctly, and hands every workflow an empty\n * message, which is the worst kind of working.\n */\nexport interface TriggerHydrate {\n    path: string\n    method?: "GET" | "POST"\n    query?: Record<string, string>\n    headers?: Record<string, string>\n}\n\n/** For providers that can tell us instead of being asked. */\nexport interface TriggerPush {\n    resource: string\n    changeType: string\n    maxMinutes?: number\n}\n\n/**\n * What makes a plugin a starting point.\n *\n * A declaration rather than code, because the runtime is billed by the second\n * and a step blocking on an empty inbox would be paid for every second of doing\n * nothing. The platform polls for you and starts the workflow when something\n * arrives.\n */\nexport interface PluginTrigger {\n    /** Must name one of your own properties of type `connection`. */\n    connection: string\n    /** Minutes between checks. The account\'s plan sets the floor. */\n    poll?: string | number\n    request: TriggerRequest\n    /** Dotted path to the array of items in the response. */\n    items: string\n    /** Dotted path, within one item, to what makes it unique. */\n    id: string\n    cursor?: TriggerCursor\n    hydrate?: TriggerHydrate\n    push?: TriggerPush\n    /** How many items one poll may start workflows for. */\n    maxPerPoll?: number\n}\n\n/**\n * A step that is a declaration rather than a program.\n *\n * One request built from the properties somebody filled in, or no request at\n * all for a step that only reshapes what reached it. No container, no code, and\n * nothing for a review to be about \u2014 which is why most steps should be one.\n *\n * Left loosely typed here on purpose: writing an action is a different job from\n * writing a plugin, and the platform validates its shape when it is saved.\n */\nexport type PluginAction = Record<string, unknown>\n\n/**\n * Every block the validator keeps. Anything else is dropped on save.\n *\n * Note what is NOT here: the hosts a plugin may contact are set on the platform\n * rather than declared in the manifest, so a plugin cannot widen its own egress.\n */\nexport interface PluginManifest {\n    description?: string\n    icon?: string\n    color?: string\n    /** Bumped by you when the declaration changes shape. */\n    version?: number\n    /** How long one run may take. Capped by the account\'s plan. */\n    timeoutMs?: number\n    memoryLimitMb?: number\n    auth?: PluginAuth\n    properties?: Record<string, PluginProperty>\n    inputs?: string[]\n    outputs?: string[]\n    /** What downstream steps can read, described for the picker. */\n    outputFields?: Record<string, string>\n    trigger?: PluginTrigger\n    action?: PluginAction\n}\n\n/** The older name for the same thing, kept because authors still say it. */\nexport type PluginSchema = PluginManifest\n';
+
+// src/templates.ts
+var EXAMPLES = `
+  // -- The rest of what you can declare --------------------------------
+  //
+  // All commented out. Uncomment what you need -- the CLI strips these before
+  // it sends the manifest, so the file stays readable and the server still
+  // receives strict JSON.
+  //
+  // PROPERTY TYPES: string, number, boolean, select, multiselect, json,
+  // color, date, connection, file, path, paths.
+  //
+  //   "properties": {
+  //     "mode": {
+  //       "label": "Mode",
+  //       "type": "select",
+  //       "required": true,
+  //       "default": "fast",
+  //       "options": [
+  //         { "label": "Fast", "value": "fast" },
+  //         { "label": "Thorough", "value": "thorough" }
+  //       ]
+  //     },
+  //     "retries":    { "label": "Retries", "type": "number", "min": 0, "max": 5, "default": 2 },
+  //     "account":    { "label": "Account", "type": "connection", "provider": "outlook", "required": true },
+  //     "attachment": { "label": "Attachment", "type": "file", "description": "Read into config before the step runs -- right for a PDF" },
+  //     "clip":       { "label": "Clip", "type": "path", "description": "Named, not read. What an ffmpeg step takes." },
+  //     "advanced":   { "label": "Raw options", "type": "json", "group": "Advanced" }
+  //   },
+  //
+  // OUTPUT FIELDS are what the next step picks from a dropdown. Without them
+  // somebody downstream has to guess your field names.
+  //
+  //   "outputFields": { "id": "The id the provider gave it" },
+  //
+  // PORTS. Every name here is a line somebody can draw from on the canvas.
+  // Return one of them as the "output" of your step.
+  //
+  //   "outputs": ["success", "error", "empty"],
+  //
+  // HOW LONG one run may take. Capped by the account's plan, so asking for
+  // more than the plan allows gets you the plan's number rather than an error.
+  //
+  //   "timeoutMs": 60000,
+  //
+  // A TRIGGER makes this a starting point: the platform polls for you and
+  // starts the workflow once per new item, so nothing is billed for waiting.
+  // "connection" must name one of your own properties of type "connection".
+  //
+  //   "trigger": {
+  //     "connection": "account",
+  //     "poll": 5,
+  //     "request": { "method": "GET", "path": "/me/messages", "query": { "$top": "25" } },
+  //     "items": "value",
+  //     "id": "id",
+  //     "cursor": { "from": "response", "path": "@odata.deltaLink" },
+  //     "hydrate": { "path": "/me/messages/{id}" }
+  //   }
+`;
+function manifestFile(active) {
+  const body = JSON.stringify(active, null, 2);
+  return body.slice(0, body.lastIndexOf("}")) + EXAMPLES + "}\n";
+}
+var blank = {
+  description: "A step that reshapes what reached it.",
+  category: "utility",
+  code: `import type { PluginModule } from "./visualautomate"
+
+/**
+ * A step that takes what the steps before it produced and hands on something
+ * new. No network, no account, no file \u2014 the most common step there is.
+ */
+const plugin: PluginModule = {
+    async execute(input, config, context) {
+        const name = (config.name as string) || "world"
+
+        // Anything you log shows up in the run's log panel.
+        console.log(\`greeting \${name}\`)
+
+        // \`output\` names which port the run leaves by, and has to be one of the
+        // \`outputs\` in manifest.json. \`data\` is what the next steps can read as
+        // {{this_step.field}}.
+        return {
+            output: "success",
+            data: {
+                greeting: \`Hello, \${name}!\`,
+                at: context.startedAt,
+            },
+        }
+    },
+}
+
+export default plugin
+`,
+  manifest: manifestFile({
+    description: "Say hello",
+    icon: "sparkles",
+    auth: { type: "none" },
+    properties: {
+      name: { label: "Name", type: "string", required: false, description: "Who to greet" }
+    },
+    inputs: ["input"],
+    outputs: ["success", "error"],
+    outputFields: {
+      greeting: "The greeting that was built",
+      at: "When the run started"
+    }
+  }),
+  testInput: { config: { name: "VisualAutomate" } }
+};
+var httpRequest = {
+  description: "Call an API with a key the user pastes in.",
+  category: "utility",
+  code: `import type { PluginModule } from "./visualautomate"
+
+/**
+ * A step that calls an API the user holds their own key for.
+ *
+ * The key is a \`password\` property, so it is filled in on the canvas and never
+ * lives in this code. If you are integrating a provider the platform already
+ * connects to, use the "connection" template instead \u2014 then nobody pastes a key
+ * at all.
+ */
+const plugin: PluginModule = {
+    async execute(input, config) {
+        const url = config.url as string
+        const apiKey = config.apiKey as string
+
+        if (!url) {
+            return { output: "error", data: { error: "No URL was set on this step." } }
+        }
+
+        const response = await fetch(url, {
+            headers: apiKey ? { Authorization: \`Bearer \${apiKey}\` } : {},
+        })
+
+        // A provider saying no is not a crash. Leaving by the error port lets
+        // somebody draw a line from it and handle the case on the canvas.
+        if (!response.ok) {
+            return {
+                output: "error",
+                data: { error: \`The request failed with status \${response.status}\`, status: response.status },
+            }
+        }
+
+        // Not response.json(). An API that is having a bad day answers with an
+        // HTML error page and a 200, and a plugin that assumes otherwise fails
+        // with "Unexpected token '<'" \u2014 which tells nobody anything.
+        const text = await response.text()
+        let body: unknown = text
+        try {
+            body = JSON.parse(text)
+        } catch {
+            return {
+                output: "error",
+                data: { error: "The reply was not JSON.", status: response.status, body: text.slice(0, 500) },
+            }
+        }
+
+        return { output: "success", data: { body, status: response.status } }
+    },
+}
+
+export default plugin
+`,
+  manifest: manifestFile({
+    description: "Fetch JSON from an API",
+    icon: "globe",
+    auth: { type: "none" },
+    properties: {
+      url: { label: "URL", type: "string", required: true, description: "The endpoint to call" },
+      apiKey: {
+        label: "API key",
+        type: "string",
+        required: false,
+        description: "Sent as a Bearer token, if the API needs one"
+      }
+    },
+    inputs: ["input"],
+    outputs: ["success", "error"],
+    outputFields: {
+      body: "The parsed JSON the API returned",
+      status: "The HTTP status code"
+    }
+  }),
+  testInput: { config: { url: "https://api.github.com/repos/nodejs/node" } }
+};
+var connection = {
+  description: "Act on an account the user already connected.",
+  category: "integration",
+  code: `import type { PluginModule } from "./visualautomate"
+
+/**
+ * A step that acts as one of the user's connected accounts.
+ *
+ * You never see a token and you never name a host. You name a path, and the
+ * platform attaches the credential on the way past \u2014 which is what stops a
+ * plugin pointing somebody's account at an address of its own choosing.
+ *
+ * \`connections.get\` takes the name of one of YOUR properties ("account"
+ * below), not a connection id, so this step can only reach the account it was
+ * configured with.
+ */
+const plugin: PluginModule = {
+    async execute(input, config, context) {
+        if (!context.connections) {
+            return { output: "error", data: { error: "No account is connected to this step." } }
+        }
+
+        const account = await context.connections.get("account")
+
+        const response = await account.request({
+            method: "GET",
+            path: (config.path as string) || "/me/messages",
+            query: { $top: String(config.limit ?? 10) },
+        })
+
+        if (!response.ok) {
+            return {
+                output: "error",
+                data: { error: \`The provider answered \${response.status}\`, status: response.status },
+            }
+        }
+
+        const body = response.body as { value?: unknown[] }
+        return {
+            output: "success",
+            data: { items: body.value ?? [], count: (body.value ?? []).length },
+        }
+    },
+}
+
+export default plugin
+`,
+  manifest: manifestFile({
+    description: "Read from a connected account",
+    icon: "link",
+    auth: { type: "oauth2", provider: "outlook" },
+    properties: {
+      account: {
+        label: "Account",
+        type: "connection",
+        provider: "outlook",
+        required: true,
+        description: "The account this step acts as"
+      },
+      path: {
+        label: "Path",
+        type: "string",
+        required: false,
+        default: "/me/messages",
+        description: "Relative to the provider's base URL. Never a full URL."
+      },
+      limit: { label: "How many", type: "number", required: false, default: 10, min: 1, max: 100 }
+    },
+    inputs: ["input"],
+    outputs: ["success", "error"],
+    outputFields: {
+      items: "What the provider returned",
+      count: "How many items came back"
+    }
+  }),
+  testInput: {
+    config: { path: "/me/messages", limit: 2 }
+    // context.connections cannot be simulated honestly, so `test` refuses
+    // it. Stub it in a test of your own to exercise the code around it.
+  }
+};
+var file = {
+  description: "Work on a file in the account's storage.",
+  category: "utility",
+  code: `import type { PluginModule } from "./visualautomate"
+
+/**
+ * A step that reads a file the account already has and writes another.
+ *
+ * \`path\` properties give the user a picker over their own storage, so nobody
+ * types a filename and hopes. Storage is scoped to the account: you cannot name
+ * anybody else's file, and you do not prefix your own.
+ */
+const plugin: PluginModule = {
+    async execute(input, config, context) {
+        const source = config.source as string
+        const bytes = await context.storage.get(source)
+
+        if (!bytes) {
+            return { output: "error", data: { error: \`There is no file at \${source}.\` } }
+        }
+
+        const text = new TextDecoder().decode(bytes)
+        const upper = text.toUpperCase()
+
+        const target = (config.target as string) || source.replace(/(\\.[^.]+)?$/, "-shouted$1")
+        const written = await context.storage.put(target, upper, "text/plain")
+
+        // Remembered between runs. Useful for a cursor or a last-seen id; this
+        // one just counts.
+        const runs = ((await context.state.get("runs")) as number) ?? 0
+        await context.state.set("runs", runs + 1)
+
+        return {
+            output: "success",
+            data: { path: target, size: written.size, runs: runs + 1 },
+        }
+    },
+}
+
+export default plugin
+`,
+  manifest: manifestFile({
+    description: "Shout a text file",
+    icon: "file-text",
+    auth: { type: "none" },
+    properties: {
+      source: { label: "File", type: "path", required: true, description: "A file already in your storage" },
+      target: {
+        label: "Save as",
+        type: "string",
+        required: false,
+        description: "Where to write the result. Defaults to the source with -shouted added."
+      }
+    },
+    inputs: ["input"],
+    outputs: ["success", "error"],
+    outputFields: {
+      path: "Where the result was written",
+      size: "How large it is, in bytes",
+      runs: "How many times this workflow has run this step"
+    }
+  }),
+  testInput: {
+    config: { source: "notes/hello.txt" },
+    // `test` starts with these already in storage and in state, so the step
+    // has something to read on its very first run.
+    storage: { "notes/hello.txt": "hello from a file" },
+    state: { runs: 0 }
+  }
+};
+var TEMPLATES = {
+  blank,
+  "http-request": httpRequest,
+  connection,
+  file
+};
+
+// src/jsonc.ts
+function stripJsonComments(text) {
+  let out = "";
+  let inString = false;
+  let inLine = false;
+  let inBlock = false;
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    const next = text[i + 1];
+    if (inLine) {
+      if (char === "\n") {
+        inLine = false;
+        out += char;
+      } else {
+        out += " ";
+      }
+      continue;
+    }
+    if (inBlock) {
+      if (char === "*" && next === "/") {
+        inBlock = false;
+        out += "  ";
+        i++;
+      } else {
+        out += char === "\n" ? char : " ";
+      }
+      continue;
+    }
+    if (inString) {
+      out += char;
+      if (char === "\\") {
+        out += text[++i] ?? "";
+      } else if (char === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      out += char;
+      continue;
+    }
+    if (char === "/" && next === "/") {
+      inLine = true;
+      out += "  ";
+      i++;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      inBlock = true;
+      out += "  ";
+      i++;
+      continue;
+    }
+    out += char;
+  }
+  return out;
+}
+function parseJsonc(text) {
+  const value = JSON.parse(stripJsonComments(text));
+  return { value, json: JSON.stringify(value, null, 2) };
+}
+
+// src/project.ts
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { basename, join, relative, resolve } from "node:path";
+var TEST_FILES = ["visualautomate.test.json", "test.json"];
+var ENTRIES = ["plugin.ts", "plugin.js", "index.ts", "index.js"];
+function entryIn(dir) {
+  return ENTRIES.map((file2) => join(dir, file2)).find((file2) => existsSync(file2)) ?? null;
+}
+function findTargets(cwd, only) {
+  const dir = resolve(cwd);
+  const modulesDir = join(dir, "modules");
+  if (!entryIn(dir) && existsSync(modulesDir) && statSync(modulesDir).isDirectory()) {
+    const folders = readdirSync(modulesDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync(join(modulesDir, d.name, "manifest.json"))).map((d) => d.name).sort();
+    if (folders.length === 0) {
+      throw new Error("There is a modules/ folder here, but none of its folders has a manifest.json.");
+    }
+    const chosen = only ? folders.filter((f) => f === only) : folders;
+    if (only && chosen.length === 0) {
+      throw new Error(`No module "${only}" in modules/. There is: ${folders.join(", ")}.`);
+    }
+    return chosen.map((folder) => targetIn(join(modulesDir, folder), `modules/${folder}`)).filter(Boolean);
+  }
+  const target = targetIn(dir, basename(dir));
+  if (!target) {
+    throw new Error(
+      "Nothing to test here: no plugin.ts, plugin.js or index.js, and no modules/ folder.\nRun this in a plugin's folder, at the root of its repository, or run `visualautomate init <name>`."
+    );
+  }
+  return [target];
+}
+function targetIn(dir, name) {
+  const entry = entryIn(dir);
+  if (!entry) return null;
+  const raw = basename(entry) === "index.js" && !existsSync(join(dir, "plugin.json"));
+  return { name, dir, entry, raw };
+}
+function targetForPath(targets, changed) {
+  const hit = targets.find((t) => {
+    const rel = relative(t.dir, changed);
+    return !rel.startsWith("..") && !rel.startsWith("/") && !/^[a-zA-Z]:/.test(rel);
+  });
+  return targets.length > 1 ? hit ?? null : targets[0] ?? null;
+}
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+async function readTestFile(dir, override) {
+  const path = override ? resolve(override) : TEST_FILES.map((f) => join(dir, f)).find((f) => existsSync(f)) ?? null;
+  if (!path) return { path: null, config: {}, input: {} };
+  if (!existsSync(path)) throw new Error(`${path} does not exist.`);
+  let raw;
+  try {
+    raw = JSON.parse(await readFile(path, "utf8"));
+  } catch (error) {
+    throw new Error(`${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (!isPlainObject(raw)) throw new Error(`${path} must be an object with "config" and "input".`);
+  for (const key of ["config", "input", "storage", "state", "secrets"]) {
+    if (raw[key] !== void 0 && !isPlainObject(raw[key])) {
+      throw new Error(`${path}: "${key}" must be an object.`);
+    }
+  }
+  if (raw.expectOutput !== void 0 && (typeof raw.expectOutput !== "string" || raw.expectOutput === "")) {
+    throw new Error(`${path}: "expectOutput" must be the name of an output port, like "success".`);
+  }
+  if (raw.timeoutMs !== void 0 && (typeof raw.timeoutMs !== "number" || raw.timeoutMs <= 0 || raw.timeoutMs > 6e4)) {
+    throw new Error(`${path}: "timeoutMs" must be a number of milliseconds up to 60000.`);
+  }
+  return {
+    path,
+    config: raw.config ?? {},
+    input: raw.input ?? {},
+    storage: raw.storage,
+    state: raw.state,
+    secrets: raw.secrets,
+    timeoutMs: raw.timeoutMs,
+    expectOutput: raw.expectOutput
+  };
+}
+
+// src/sandbox-module.ts
+var IMPORT = /^import\s+(?:([\w$]+)\s*,\s*)?(?:([\w$]+)|\*\s+as\s+([\w$]+)|\{([\s\S]*?)\})\s+from\s+"([^"]+)";?[ \t]*$/gm;
+var BARE_IMPORT = /^import\s+"([^"]+)";?[ \t]*$/gm;
+var EXPORT = /^export\s*\{([\s\S]*?)\};?[ \t]*$/m;
+var FILE_MARKER = /^\/\/ (?:\.{1,2}\/|[A-Za-z]:[\\/]|\/)?[^\n]*\.(?:[cm]?[jt]sx?)[ \t]*$\n?/gm;
+function names(list) {
+  return list.split(",").map((part) => part.trim()).filter(Boolean).map((part) => {
+    const [from, as] = part.split(/\s+as\s+/);
+    return { from: from.trim(), as: (as ?? from).trim() };
+  });
+}
+function toSandboxModule(esm) {
+  let code = esm.replace(FILE_MARKER, "");
+  code = code.replace(IMPORT, (_all, defaultWithOthers, defaultOnly, namespace, list, pkg) => {
+    const target = `require(${JSON.stringify(pkg)})`;
+    const lines = [];
+    const main2 = defaultWithOthers ?? defaultOnly ?? namespace;
+    if (main2) lines.push(`const ${main2} = ${target};`);
+    if (list !== void 0) {
+      const pattern = names(list).map(({ from, as }) => from === as ? from : `${from}: ${as}`).join(", ");
+      lines.push(`const { ${pattern} } = ${main2 ?? target};`);
+    }
+    return lines.join("\n");
+  });
+  code = code.replace(BARE_IMPORT, (_all, pkg) => `require(${JSON.stringify(pkg)});`);
+  const exported = code.match(EXPORT);
+  if (exported) {
+    const list = names(exported[1]);
+    const byName = new Map(list.map(({ from, as }) => [as, from]));
+    const fallback = byName.get("default");
+    let assignment;
+    if (!byName.has("execute") && fallback && list.length === 1) {
+      assignment = `module.exports = ${fallback};`;
+    } else {
+      const fields = list.map(({ from, as }) => from === as ? from : `${as}: ${from}`);
+      assignment = `module.exports = { ${fields.join(", ")} };`;
+      if (!byName.has("execute") && fallback) {
+        assignment += `
+if (${fallback} && typeof ${fallback}.execute === "function") module.exports.execute = ${fallback}.execute;`;
+      }
+    }
+    code = code.replace(EXPORT, assignment);
+  }
+  return code.replace(/^\n+/, "");
+}
+
+// src/index.ts
+var DEFAULT_API_URL = "https://visualautomate.com";
+function configPath() {
+  return join2(homedir(), ".visualautomate", "config.json");
+}
+async function readConfig() {
+  try {
+    return JSON.parse(await readFile2(configPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function writeConfig(next) {
+  const path = configPath();
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
+}
+async function tokenFor(flags) {
+  const stored = await readConfig();
+  const apiUrl = (flags["api-url"] || process.env.VISUALAUTOMATE_API_URL || stored.apiUrl || DEFAULT_API_URL).replace(/\/+$/, "");
+  const token = flags.token || process.env.VISUALAUTOMATE_API_TOKEN || stored.token;
+  if (!token) {
+    fail("Not signed in. Run `visualautomate login` first.");
+  }
+  return { token, apiUrl };
+}
+function fail(message) {
+  console.error(message);
+  throw new SilentExit();
+}
+var SilentExit = class extends Error {
+  constructor() {
+    super("");
+    this.name = "SilentExit";
+  }
+};
+function ok(message) {
+  console.log(message);
+}
+function openBrowser(url) {
+  const command = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawn(command, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+async function cmdLogin(flags) {
+  const stored = await readConfig();
+  const apiUrl = (flags["api-url"] || process.env.VISUALAUTOMATE_API_URL || stored.apiUrl || DEFAULT_API_URL).replace(/\/+$/, "");
+  const state = randomBytes(24).toString("base64url");
+  const token = await new Promise((resolveToken, rejectToken) => {
+    const server = createServer((req, res) => {
+      if (!req.url?.startsWith("/callback") || req.method !== "POST") {
+        res.writeHead(404).end("Not found");
+        return;
+      }
+      let body = "";
+      req.on("data", (chunk) => {
+        body += chunk;
+        if (body.length > 8192) req.destroy();
+      });
+      req.on("end", () => {
+        const fields = new URLSearchParams(body);
+        const answer = (status, text) => {
+          res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(
+            `<!doctype html><meta charset="utf-8"><title>VisualAutomate</title><body style="font:16px system-ui;padding:3rem;max-width:32rem;margin:auto">${text}</body>`
+          );
+        };
+        if (fields.get("state") !== state) {
+          answer(400, "<h1>That did not match</h1><p>Run <code>visualautomate login</code> again.</p>");
+          return;
+        }
+        const received = fields.get("token");
+        if (!received) {
+          answer(400, "<h1>No token in the reply</h1><p>Run <code>visualautomate login</code> again.</p>");
+          return;
+        }
+        answer(200, "<h1>Signed in</h1><p>You can close this tab and go back to your terminal.</p>");
+        server.close();
+        resolveToken(received);
+      });
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        rejectToken(new Error("Could not open a port to listen on"));
+        return;
+      }
+      const url = `${apiUrl}/cli/login?port=${address.port}&state=${state}`;
+      ok(`Opening ${url}
+`);
+      ok("If your browser did not open, paste that address into it.");
+      openBrowser(url);
+    });
+    server.on("error", rejectToken);
+    setTimeout(() => {
+      server.close();
+      rejectToken(new Error("Timed out after five minutes waiting for the browser."));
+    }, 5 * 6e4).unref();
+  });
+  const who = await whoami(apiUrl, token);
+  await writeConfig({ token, apiUrl, email: who.email });
+  ok(`
+\u2713 Signed in as ${who.email}`);
+  ok(`  Token stored in ${configPath()}`);
+}
+async function whoami(apiUrl, token) {
+  const res = await fetch(`${apiUrl}/api/cli/whoami`, {
+    headers: { Authorization: `Bearer ${token}` }
+  });
+  if (res.status === 401) fail("That token is not valid. Run `visualautomate login` again.");
+  if (!res.ok) fail(`Could not reach ${apiUrl} (status ${res.status}).`);
+  const data = await res.json();
+  return { email: data.email ?? "(unknown)", developer: Boolean(data.pluginDeveloper) };
+}
+async function cmdWhoami(flags) {
+  const { token, apiUrl } = await tokenFor(flags);
+  const who = await whoami(apiUrl, token);
+  ok(`${who.email} on ${apiUrl}`);
+  if (!who.developer) {
+    ok("\nThis account is not a plugin developer yet, so `push` will be refused.");
+    ok("Turn it on from the dashboard under Developer settings.");
+  }
+}
+async function cmdLogout() {
+  await writeConfig({});
+  ok("Signed out. The token file is empty.");
+}
+async function cmdInit(args, flags) {
+  const name = args[0];
+  if (!name) fail("Usage: visualautomate init <name> [--template <name>]");
+  const templateName = flags.template ?? "blank";
+  const template = TEMPLATES[templateName];
+  if (!template) {
+    fail(`Unknown template "${templateName}". Available: ${Object.keys(TEMPLATES).join(", ")}`);
+  }
+  const target = resolve2(process.cwd(), name);
+  if (existsSync2(target)) fail(`"${name}" already exists here.`);
+  const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  await mkdir(target, { recursive: true });
+  await writeFile(join2(target, "plugin.ts"), template.code);
+  await writeFile(join2(target, "manifest.json"), template.manifest);
+  await writeFile(
+    join2(target, "plugin.json"),
+    JSON.stringify(
+      { name: slug, version: "1.0.0", description: template.description, category: template.category },
+      null,
+      2
+    ) + "\n"
+  );
+  await writeFile(join2(target, "visualautomate.d.ts"), TYPE_DECLARATIONS);
+  await writeFile(
+    join2(target, "tsconfig.json"),
+    JSON.stringify(
+      {
+        compilerOptions: {
+          target: "ES2022",
+          module: "ESNext",
+          moduleResolution: "bundler",
+          lib: ["ES2022"],
+          strict: true,
+          noEmit: true,
+          skipLibCheck: true
+        },
+        include: ["plugin.ts", "visualautomate.d.ts"]
+      },
+      null,
+      2
+    ) + "\n"
+  );
+  await writeFile(
+    join2(target, "test.json"),
+    JSON.stringify(template.testInput, null, 2) + "\n"
+  );
+  await writeFile(
+    join2(target, "README.md"),
+    `# ${name}
+
+${template.description}
+
+\`\`\`bash
+visualautomate test     # run it here
+visualautomate push     # publish it to your account
+\`\`\`
+
+\`manifest.json\` declares the fields the canvas shows and what this step hands on.
+\`test.json\` is the input, config and state \`test\` runs with.
+`
+  );
+  ok(`
+\u2713 Created ${name} from the "${templateName}" template
+`);
+  ok("  cd " + name);
+  ok("  visualautomate test");
+  ok("  visualautomate push\n");
+}
+async function bundlePlugin(entry) {
+  try {
+    const result = await build({
+      entryPoints: [entry],
+      bundle: true,
+      write: false,
+      platform: "node",
+      format: "esm",
+      target: "node18",
+      packages: "external",
+      logLevel: "silent"
+    });
+    return toSandboxModule(result.outputFiles[0].text);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Your plugin did not compile.
+
+${message}`);
+  }
+}
+async function codeFor(target) {
+  return target.raw ? readFile2(target.entry, "utf8") : bundlePlugin(target.entry);
+}
+function line(indent, text) {
+  ok(indent ? "  " + text.replace(/\n/g, "\n  ") : text);
+}
+async function runTarget(target, flags, several) {
+  const say = (text) => line(several, text);
+  if (several) ok(`
+\u25B8 ${target.name}`);
+  try {
+    const code = await codeFor(target);
+    const check = validatePluginCode(code);
+    if (!check.valid) {
+      say(`\u2717 refused   ${check.error}`);
+      return false;
+    }
+    const settings = await readTestFile(target.dir, flags.input);
+    if (!settings.path) say("No visualautomate.test.json \u2014 running with empty input and config.");
+    const load = createRequire(join2(target.dir, "noop.js"));
+    const exported = loadPluginCode(code, sandboxRequire(load));
+    const plugin = typeof exported === "function" ? exported : typeof exported?.execute === "function" ? exported : exported?.default;
+    let outputs = [];
+    const manifestPath = join2(target.dir, "manifest.json");
+    if (existsSync2(manifestPath)) {
+      try {
+        const manifest = parseJsonc(await readFile2(manifestPath, "utf8")).value;
+        outputs = manifest.outputs ?? [];
+      } catch (error) {
+        say(`\u2717 manifest.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+        return false;
+      }
+    }
+    const result = await simulate(plugin, {
+      input: settings.input,
+      config: settings.config,
+      storage: settings.storage,
+      state: settings.state,
+      secrets: settings.secrets,
+      timeoutMs: settings.timeoutMs
+    });
+    const port = result.output?.output ?? null;
+    const expected = settings.expectOutput;
+    const passed = result.status === "success" && (!expected || port === expected);
+    say(`${passed ? "\u2713 passed" : "\u2717 failed"}  ${result.status}, ${result.durationMs}ms`);
+    if (result.error) say(`error    ${result.error}`);
+    if (result.output) {
+      say(`output   ${port}${expected ? ` (expected ${expected})` : ""}`);
+      say(`data     ${JSON.stringify(result.output.data, null, 2).replace(/\n/g, "\n         ")}`);
+    }
+    if (result.files.size > 0) say(`files    ${[...result.files.keys()].join(", ")}`);
+    if (result.state.size > 0) say(`state    ${JSON.stringify(Object.fromEntries(result.state))}`);
+    for (const entry of result.logs ?? []) say(`log      ${entry}`);
+    if (port && outputs.length > 0 && !outputs.includes(port)) {
+      say(
+        `! This returned output "${port}", which manifest.json does not list (it has ${outputs.map((o) => `"${o}"`).join(", ")}). On a canvas nothing would follow it.`
+      );
+    }
+    return passed;
+  } catch (error) {
+    say(`\u2717 ${error instanceof Error ? error.message : String(error)}`);
+    return false;
+  }
+}
+async function runTargets(targets, flags) {
+  let passed = 0;
+  for (const target of targets) {
+    if (await runTarget(target, flags, targets.length > 1)) passed++;
+  }
+  if (targets.length > 1) ok(`
+${passed} of ${targets.length} passed`);
+  return passed === targets.length;
+}
+function targetsOrFail(flags) {
+  try {
+    return findTargets(process.cwd(), flags.module);
+  } catch (error) {
+    fail(error instanceof Error ? error.message : String(error));
+  }
+}
+async function cmdTest(flags) {
+  const targets = targetsOrFail(flags);
+  if (!await runTargets(targets, flags)) process.exitCode = 1;
+}
+async function cmdDev(flags) {
+  const root = process.cwd();
+  let targets = targetsOrFail(flags);
+  const header = () => {
+    process.stdout.write("\x1Bc");
+    ok(`visualautomate dev \u2014 ${(/* @__PURE__ */ new Date()).toLocaleTimeString()} \u2014 Ctrl+C to stop`);
+  };
+  header();
+  await runTargets(targets, flags);
+  const ignored = [`${sep}node_modules${sep}`, `${sep}.git${sep}`, `${sep}dist${sep}`, `${sep}.visualautomate${sep}`];
+  const pending = /* @__PURE__ */ new Set();
+  let timer;
+  let running = false;
+  const flush = async () => {
+    if (running) {
+      timer = setTimeout(flush, 100);
+      return;
+    }
+    running = true;
+    const changed = [...pending];
+    pending.clear();
+    try {
+      targets = findTargets(root, flags.module);
+    } catch (error) {
+      header();
+      ok(`\u2717 ${error instanceof Error ? error.message : String(error)}`);
+      running = false;
+      return;
+    }
+    const hit = changed.map((path) => targetForPath(targets, path));
+    const chosen = hit.some((t) => t === null) ? targets : [...new Set(hit)];
+    header();
+    ok(`changed: ${changed.map((p) => relative2(root, p)).join(", ")}`);
+    await runTargets(chosen, flags);
+    running = false;
+  };
+  const watcher = watch(root, { recursive: true }, (_event, name) => {
+    if (!name) return;
+    const path = join2(root, name.toString());
+    if (ignored.some((part) => `${sep}${relative2(root, path)}${sep}`.includes(part))) return;
+    pending.add(path);
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(flush, 150);
+  });
+  await new Promise((resolveStop) => {
+    process.once("SIGINT", () => {
+      watcher.close();
+      resolveStop();
+    });
+  });
+}
+async function cmdPush(flags) {
+  const dir = process.cwd();
+  const { token, apiUrl } = await tokenFor(flags);
+  const metaPath = join2(dir, "plugin.json");
+  const pkgPath = join2(dir, "package.json");
+  const metaFile = existsSync2(metaPath) ? metaPath : existsSync2(pkgPath) ? pkgPath : null;
+  if (!metaFile) {
+    fail("No plugin.json here. Run `visualautomate init <name>` to start a plugin.");
+  }
+  const meta = JSON.parse(await readFile2(metaFile, "utf8"));
+  if (!meta.name) fail(`${metaFile} has no "name".`);
+  if (!meta.version || !/^\d+\.\d+\.\d+$/.test(meta.version)) {
+    fail(`${metaFile} needs a "version" like 1.0.0.`);
+  }
+  const manifestPath = resolve2(process.cwd(), "manifest.json");
+  let parsed = {};
+  let manifest = null;
+  if (existsSync2(manifestPath)) {
+    try {
+      const result = parseJsonc(await readFile2(manifestPath, "utf8"));
+      parsed = result.value;
+      manifest = result.json;
+    } catch (error) {
+      fail(`manifest.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  const entry = ["plugin.ts", "plugin.js", "index.ts", "index.js"].map((f) => join2(dir, f)).find((f) => existsSync2(f));
+  if (!entry) {
+    fail("No plugin.ts or plugin.js here. Run `visualautomate init <name>` to start one.");
+  }
+  let code;
+  try {
+    code = await bundlePlugin(entry);
+  } catch (error) {
+    fail(error instanceof Error ? error.message : String(error));
+  }
+  let schemaJson = null;
+  if (!manifest) {
+    const source = await readFile2(entry, "utf8");
+    const match = source.match(/@schema\s*\n([\s\S]*?)(?:\*\s*\/|\*\/)/);
+    if (match) {
+      schemaJson = match[1].replace(/^\s*\*\s?/gm, "").trim();
+      try {
+        parsed = JSON.parse(schemaJson);
+      } catch (error) {
+        fail(`The @schema block is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+  }
+  if (!manifest && !schemaJson) {
+    fail(
+      "This plugin declares nothing, so it would have no fields, no ports and no trigger \u2014\nthe canvas would show an empty box. Add a manifest.json next to your code (run\n`visualautomate init` somewhere to see one), or keep an @schema block in the source."
+    );
+  }
+  ok(`Pushing ${meta.name}@${meta.version} to ${apiUrl}...`);
+  const res = await fetch(`${apiUrl}/api/plugins/push`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({
+      name: meta.name,
+      version: meta.version,
+      description: meta.description ?? parsed.description ?? "",
+      category: meta.category ?? "utility",
+      icon: meta.icon ?? parsed.icon ?? "plugin",
+      // Whichever the author actually has. The route takes either.
+      ...manifest ? { manifest } : { schemaJson },
+      code
+    })
+  });
+  const text = await res.text();
+  let data = {};
+  try {
+    data = JSON.parse(text);
+  } catch {
+    fail(`The server answered ${res.status} with something that is not JSON:
+${text.slice(0, 500)}`);
+  }
+  if (res.status === 401) {
+    fail("Your session has expired. Run `visualautomate login` again.");
+  }
+  if (!res.ok || !data.success) {
+    fail(`Push refused: ${data.error ?? `status ${res.status}`}`);
+  }
+  ok(`
+\u2713 Published (id: ${data.pluginId})`);
+  ok(`  A version snapshot was saved, so you can roll back from the dashboard.`);
+}
+function printHelp() {
+  console.log(`
+visualautomate \u2014 build and publish plugins
+
+  visualautomate login                    sign this machine in
+  visualautomate init <name> [--template] start a plugin
+  visualautomate test [--module <name>]   run it here, as the platform's check does
+  visualautomate dev [--module <name>]    run it again on every save
+  visualautomate push                     publish it
+  visualautomate whoami                   which account this is
+  visualautomate logout                   forget the token
+
+Templates: ${Object.keys(TEMPLATES).join(", ")}
+
+\`test\` and \`dev\` work in a plugin made with \`init\`, at the root of a plugin's
+GitHub repository, and at the root of an app's repository, where every folder
+in modules/ is run (or the one named with --module). The run's settings come
+from visualautomate.test.json, test.json, or --input <file>.
+
+Environment (for CI, where there is no browser):
+  VISUALAUTOMATE_API_TOKEN   use instead of \`login\`
+  VISUALAUTOMATE_API_URL     a different installation
+`);
+}
+function parse(argv) {
+  const args = [];
+  const flags = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg.startsWith("--")) {
+      const key = arg.slice(2);
+      const next = argv[i + 1];
+      flags[key] = next && !next.startsWith("--") ? argv[++i] : "true";
+    } else {
+      args.push(arg);
+    }
+  }
+  return { args, flags };
+}
+async function main() {
+  const { args, flags } = parse(process.argv.slice(2));
+  const command = args.shift();
+  switch (command) {
+    case "login":
+      return cmdLogin(flags);
+    case "logout":
+      return cmdLogout();
+    case "whoami":
+      return cmdWhoami(flags);
+    case "init":
+    case "new":
+      return cmdInit(args, flags);
+    case "test":
+      return cmdTest(flags);
+    case "dev":
+    case "watch":
+      return cmdDev(flags);
+    case "push":
+    case "publish":
+      return cmdPush(flags);
+    // `plugin test` and `plugin push` are accepted as aliases.
+    case "plugin": {
+      const sub = args.shift();
+      if (sub === "test") return cmdTest(flags);
+      if (sub === "push") return cmdPush(flags);
+      printHelp();
+      return;
+    }
+    default:
+      printHelp();
+      if (command) process.exit(1);
+  }
+}
+async function finish(code) {
+  try {
+    stopBundler();
+  } catch {
+  }
+  process.exit(code);
+}
+main().then(() => finish(Number(process.exitCode ?? 0))).catch((error) => {
+  if (!(error instanceof SilentExit)) {
+    console.error(error instanceof Error ? error.message : String(error));
+  }
+  return finish(1);
+});