@visualautomate/cli 0.5.1 → 0.6.0

package/README.md

@@ -1,16 +1,18 @@
 # @visualautomate/cli
 
-Build and publish VisualAutomate plugins.
+Build and test VisualAutomate plugins.
 
 ```bash
 npm install -g @visualautomate/cli
-vsa login
 vsa init my-step
 cd my-step
 vsa dev                 # the sandbox, and a run again on every save
-vsa push
 ```
 
+Nothing here signs in. Your plugin reaches the platform through its GitHub
+repository: push a commit, the tests run there, and Publish on the portal takes
+it from the commit that passed.
+
 `va` and `visualautomate` are the same command.
 
 That is the whole toolchain. There is nothing else to install: the CLI carries
@@ -33,6 +35,52 @@ tsconfig.json        so your editor type-checks it
 Templates: `blank`, `http-request`, `connection`, `file`. Pass one with
 `--template`. Each runs unmodified.
 
+## Types in your editor
+
+Your plugin's code imports nothing — the platform refuses the word `import`
+anywhere in the file, comments included, and the SDK is not a package a step may
+require. So the types are written into your project instead, and one line names
+them:
+
+```js
+/** @type {PluginModule} */
+module.exports = {
+  execute: async (input, config, context) => {
+    //                              ^ completes, with the documentation
+  },
+}
+```
+
+`dev` and `test` write `visualautomate.d.ts` and a `jsconfig.json` beside your
+code and keep them current; `vsa types` does it on its own. In an app's
+repository they go at the root, where they cover every module. Nothing is
+installed, nothing of it exists while your plugin runs, and a file you wrote
+yourself is never written over — delete ours and it comes back.
+
+## `add:property`
+
+A field on the node — what somebody fills in when they drop your module into a
+workflow — written into `manifest.json`:
+
+```bash
+vsa add:property string apiKey "The key to call with"
+vsa add:property number retries "How many times to try again" 2 --required
+vsa add:property select mode "Which way round" fast --options "Fast:fast,Thorough:thorough"
+```
+
+`<type> <name> [description] [default]`, where the name is what your code reads:
+`config.apiKey`. The label is made from the name unless `--label` says otherwise,
+and the default is stored as its type has it, so `2` is a number and `false` is a
+boolean.
+
+Types: `string`, `number`, `boolean`, `select`, `multiselect`, `json`, `color`,
+`date`, `connection`, `file`, `path`, `paths`. A `select` or `multiselect` needs
+`--options`, and a `connection` needs `--provider <name>`.
+
+At the root of an app's repository, `--module <name>` says which one — the same
+short names `test` and `dev` take. The manifest is edited where it stands: your
+comments, the examples underneath and your own formatting stay as they are.
+
 ## `test`
 
 Runs your plugin the way the platform would, in three steps:
@@ -59,6 +107,10 @@ state    {"runs":1}
 A run passes when it succeeds and, if the test file names an `expectOutput`,
 leaves by that port — the same verdict as the GitHub check.
 
+The verdict is green when it passed and red when it did not, in the sandbox as
+well as out here. `NO_COLOR` turns that off, and output that is not a terminal —
+a pipe, a file, a CI log — is plain anyway; `FORCE_COLOR` turns it back on.
+
 ### In a GitHub repository
 
 `test` works wherever the platform tests your code on a push:
@@ -174,22 +226,15 @@ machine, and each run starts a fresh container.
 
 `context.media` is not available locally, in or out of Docker.
 
-## `push`
+## Publishing
 
-Bundles the same code `test` ran, strips the comments out of `manifest.json`,
-and publishes. A version snapshot is saved, so you can roll back from the
-dashboard.
+Not from here. Connect the repository to your app on the portal, push your
+commit, and the platform runs the same checks `vsa test` runs against every
+module it touched. Publish on the portal takes the code from a commit that
+passed, and a version snapshot is saved so you can roll back.
 
 Comments in `manifest.json` are a convenience of this tool: the file on your
-disk may have them, the bytes on the wire never do.
-
-## CI
-
-There is no browser on a build machine, so `login` is not available there. Set
-`VISUALAUTOMATE_API_TOKEN` instead — the same token `login` would have stored,
-which you can read out of `~/.visualautomate/config.json`.
-
-`VISUALAUTOMATE_API_URL` points the CLI at a different installation.
+disk may have them, and they are stripped before the manifest is read.
 
 ## Where things are
 

package/dist/index.js

@@ -1,13 +1,9 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { createServer } from "node:http";
 import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { existsSync as existsSync3, watch } from "node:fs";
-import { homedir } from "node:os";
-import { dirname as dirname2, join as join3, relative as relative3, resolve as resolve3, sep as sep2 } from "node:path";
-import { randomBytes } from "node:crypto";
-import { spawn } from "node:child_process";
+import { existsSync as existsSync4, watch } from "node:fs";
+import { join as join4, relative as relative3, resolve as resolve3, sep as sep2 } from "node:path";
 import { createRequire } from "node:module";
 import { build, stop as stopBundler } from "esbuild";
 
@@ -1406,6 +1402,82 @@ function loadPluginCode(code, require2) {
 // src/declarations.ts
 var TYPE_DECLARATIONS = '/**\n * What a plugin is handed, and what it must hand back.\n *\n * This file is the contract between a plugin and the VisualAutomate runtime:\n * the arguments `execute` is called with, every helper on `context`, the shape\n * of the result, and the manifest that declares the step. When a helper is only\n * present under some condition, that is said here rather than left for somebody\n * to discover from a TypeError.\n *\n * context-api.ts describes the same runtime as data, for tools that cannot read\n * a TypeScript interface, such as an editor\'s autocomplete.\n */\n\n// \u2500\u2500\u2500 What a step is called with \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * The output of the steps that led here, keyed by step name and node id.\n *\n * A step reads `input.download_clips.file` where `download_clips` is what the\n * step before it is called on the canvas. Every route into this step is merged,\n * so a step at the join of two branches sees both.\n */\nexport interface PluginInput {\n    [key: string]: unknown\n}\n\n/** The fields somebody filled in on the canvas, as the manifest declared them. */\nexport interface PluginConfig {\n    [key: string]: unknown\n}\n\n// \u2500\u2500\u2500 context.storage \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** What `storage.put` reports about the file it wrote. */\nexport interface StorageResult {\n    url: string\n    size: number\n    contentType: string\n    uploadedAt: string\n    expiresAt: string\n}\n\n/** What `storage.list` reports. */\nexport interface StorageListResult {\n    files: Array<{\n        url: string\n        pathname: string\n        size: number\n        uploadedAt: string\n    }>\n    totalSize: number\n}\n\n/**\n * The account\'s own files. Paths are scoped to the user; you cannot name\n * anybody else\'s, and you do not have to prefix your own.\n *\n * The account\'s plan caps what it may hold at once, and a `put` past that\n * ceiling is refused rather than silently dropped.\n */\nexport interface PluginStorage {\n    /** Write a file. Bytes may be a string, a Buffer or any typed array. */\n    put(path: string, data: Uint8Array | string, contentType?: string): Promise<StorageResult>\n    /** Read a file back. `null` when it is not there. */\n    get(path: string): Promise<Uint8Array | null>\n    delete(path: string): Promise<void>\n    /** Everything under a prefix, or everything when no prefix is given. */\n    list(prefix?: string): Promise<StorageListResult>\n    /** Size and content type without moving the bytes. `null` when absent. */\n    head(path: string): Promise<{ size: number; contentType: string } | null>\n    /**\n     * A URL somebody else can fetch this file from, for a few minutes.\n     *\n     * For the common API that takes a link and pulls the file itself. Clamped\n     * to between one minute and one hour; the default is fifteen minutes.\n     */\n    signedUrl(path: string, expiresInSeconds?: number): Promise<string | null>\n    /**\n     * Pull a URL straight into storage without the bytes passing through this\n     * step. A hundred-megabyte file costs the run no memory and no egress,\n     * because a Worker fetches it and writes it to storage directly.\n     *\n     * ONLY PRESENT when the download Worker is configured on the server. Guard\n     * with `if (context.storage.download)` if you want to degrade gracefully.\n     */\n    download?(url: string, path: string, contentType?: string): Promise<StorageResult>\n}\n\n// \u2500\u2500\u2500 context.state \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Values that outlive one run, scoped to this workflow and this account.\n *\n * For a cursor, a last-seen id, a counter \u2014 the things a workflow needs to\n * remember between firings. Not for large data: that is what storage is for.\n * The account\'s plan caps how many keys it may hold.\n */\nexport interface PluginState {\n    /** The stored value, or `null` when the key has never been set. */\n    get(key: string): Promise<unknown>\n    set(key: string, value: unknown, options?: { ttlSeconds?: number }): Promise<void>\n    delete(key: string): Promise<void>\n    list(prefix?: string): Promise<{ keys: string[] }>\n}\n\n// \u2500\u2500\u2500 context.media \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * ffmpeg, for a step that has a file in storage and wants a different one.\n *\n * A PLUGIN NEVER BUILDS AN FFMPEG COMMAND LINE, and cannot. You name an\n * operation and supply values; the command line is assembled on the server, one\n * operation at a time, and the only paths in it are placeholders the container\n * fills from a list the server wrote. That is deliberate: `-i` takes any path\n * and several filters open files of their own, so an ffmpeg taking its flags\n * from plugin config would be a plugin reading the container\'s filesystem \u2014\n * including the file holding that run\'s own credentials.\n *\n * The job runs in a container of its own and talks to storage directly, so a\n * two hundred megabyte clip never crosses this step.\n *\n * ONLY PRESENT when the sandbox and storage are both configured.\n */\nexport interface PluginMedia {\n    run(operation: string, params: Record<string, unknown>): Promise<Record<string, unknown>>\n}\n\n// \u2500\u2500\u2500 context.connections \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** One request through the integration proxy. */\nexport interface ConnectionRequest {\n    path: string\n    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE"\n    query?: Record<string, string | number | boolean | undefined>\n    headers?: Record<string, string>\n    body?: unknown\n}\n\n/** What the proxy answers with. The provider\'s own reply, unwrapped. */\nexport interface ConnectionResponse {\n    ok: boolean\n    status: number\n    headers?: Record<string, string>\n    body: unknown\n}\n\n/**\n * One of the accounts the user connected.\n *\n * THERE IS NO getToken(), deliberately. A token that can be read can be logged\n * or posted somewhere, and this is where third-party code runs. You name a path\n * and the proxy attaches the credential on the way past.\n *\n * You also never name a host. The base URL belongs to the provider\n * configuration, which is what stops a connection being pointed at an internal\n * address or at somebody\'s collection server.\n */\nexport interface PluginConnection {\n    /** This platform\'s id for the connection, not the provider\'s. */\n    id: string\n    request(options: ConnectionRequest): Promise<ConnectionResponse>\n}\n\n/**\n * The accounts this step was configured with.\n *\n * `get` takes the name of one of your own `connection` properties \u2014 not a\n * connection id \u2014 so a step can only reach the accounts it was set up with.\n *\n * ONLY PRESENT when the step declares at least one `connection` property and\n * the user has chosen an account for it.\n */\nexport interface PluginConnections {\n    get(propertyName: string): Promise<PluginConnection>\n}\n\n// \u2500\u2500\u2500 The context itself \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Everything a step is told about the run it is part of.\n *\n * The optional members are optional for a reason and not out of caution: each\n * is absent when the thing behind it is not configured or not applicable, and\n * a plugin that needs one should say so plainly rather than crash on a dot.\n */\nexport interface PluginContext {\n    /** The workflow this run belongs to. */\n    workflowId: string\n    /** This step\'s id on the canvas. */\n    nodeId: string\n    /** Whose run it is. */\n    userId: string\n    /** This run, distinct from every other run of the same workflow. */\n    executionId: string\n    /** When the run started, as an ISO string. */\n    startedAt: string\n    /** Values the plugin was published with. Not the user\'s credentials. */\n    secrets: Record<string, string>\n\n    /** The account\'s files. See PluginStorage. */\n    storage: PluginStorage\n    /** Values that outlive one run. See PluginState. */\n    state: PluginState\n    /** ffmpeg. Absent when the server has no sandbox or storage configured. */\n    media?: PluginMedia\n    /** The accounts this step was configured with. Absent when it has none. */\n    connections?: PluginConnections\n}\n\n// \u2500\u2500\u2500 What a step hands back \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * The result of a step.\n *\n * `output` names which port the run leaves by, and therefore which lines on the\n * canvas are followed. It has to be one of the `outputs` in the manifest \u2014\n * usually `"success"` or `"error"`.\n *\n * `data` is what the next steps read as `{{this_step.field}}`. Keep it flat and\n * named for what it is; those names are what somebody picks from a dropdown.\n */\nexport interface PluginOutput {\n    output: string\n    data: Record<string, unknown>\n    metadata?: {\n        durationMs?: number\n        memoryUsedMb?: number\n        logs?: string[]\n    }\n}\n\n/**\n * A plugin.\n *\n * Export `execute`, either as `module.exports.execute` or as the default export\n * of a module with an `execute` on it. Both are accepted, and so is a bare\n * function as the default export.\n *\n * @example\n * export default {\n *   async execute(input, config, context) {\n *     const file = await context.storage.get(config.path as string)\n *     return { output: "success", data: { bytes: file?.length ?? 0 } }\n *   }\n * }\n */\nexport interface PluginModule {\n    execute(\n        input: PluginInput,\n        config: PluginConfig,\n        context: PluginContext,\n    ): Promise<PluginOutput> | PluginOutput\n}\n\n/** The bare function form, for a plugin that is only an execute. */\nexport type PluginExecute = PluginModule["execute"]\n\n// \u2500\u2500\u2500 How a run reports on a step \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * `skipped` is a decision rather than a fault: the filters on every line into\n * the step said no, so it never ran. Counting it as an error turns a branch\n * that was simply not chosen into a broken workflow.\n */\nexport type ExecutionStatus = "success" | "error" | "timeout" | "skipped" | "cancelled"\n\nexport interface PluginExecutionResult {\n    status: ExecutionStatus\n    output: PluginOutput | null\n    error?: string\n    durationMs: number\n    memoryMb?: number\n    outputPort?: string\n    logs?: string[]\n}\n\n// \u2500\u2500\u2500 The manifest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * The declaration that sits beside the code.\n *\n * It says which fields the canvas renders, which account the step acts as, what\n * it hands downstream, and whether it is a starting point that watches\n * something. One shape wherever it is stored \u2014 `manifest.json` next to your\n * code, or an `@schema` comment in the source.\n *\n * Every name below is one the platform keeps. A block it does not recognise is\n * dropped when the plugin is saved, so a field that is not listed here will not\n * survive an upload.\n */\nexport type PluginPropertyType =\n    | "string"\n    | "number"\n    | "boolean"\n    | "select"\n    | "multiselect"\n    | "json"\n    /**\n     * A program, not a value.\n     *\n     * Stored exactly as typed and never parsed, which is the difference from\n     * `json` above: that one keeps its value structured, so `return 5` would be\n     * saved as the number five and the step would run nothing.\n     */\n    | "code"\n    | "color"\n    | "date"\n    /** An account the user connected. Rendered as a picker, not a text box. */\n    | "connection"\n    /**\n     * A file the account already has, read into the config before the step\n     * runs. `{{config.attachment.name}}`, `.contentType`, `.size`,\n     * `.contentBytes`. Right for attaching a PDF; a video would be hundreds of\n     * megabytes of base64 \u2014 use `path` for those.\n     */\n    | "file"\n    /** A file in storage, named rather than read. What ffmpeg steps take. */\n    | "path"\n    /** Several of them, one per line, in the order they were chosen. */\n    | "paths"\n\nexport interface PluginProperty {\n    /** Shown above the input on the canvas. Defaults to the property name. */\n    label: string\n    type: PluginPropertyType\n    required?: boolean\n    default?: unknown\n    /** Helper text under the input. */\n    description?: string\n    /** For `select` and `multiselect`. */\n    options?: Array<{ label: string; value: string }>\n    /** Puts related fields in a section together. */\n    group?: string\n    /** For `number`. */\n    min?: number\n    max?: number\n    /** For `string`: a regex the value must match. */\n    pattern?: string\n    /**\n     * For `connection`: which integration the account must belong to, e.g.\n     * `outlook`. A module inherits its app\'s, so it does not repeat this.\n     */\n    provider?: string\n}\n\n/**\n * How a step reaches the account it acts as.\n *\n * `none` means the plugin holds its own key in a property. That is not the same\n * as leaving the block out, which means "written before auth could be\n * declared".\n *\n * A MANIFEST MAY NOT NAME A HOST. `url`, `baseUrl`, `base_url` and `host` are\n * refused outright rather than ignored, so nobody writes one and believes it\n * took effect: the base URL belongs to the provider configuration, and that is\n * what stops a connection being pointed at an internal address.\n */\nexport interface PluginAuth {\n    type: "oauth2" | "api_key" | "basic" | "none"\n    provider?: string\n    scopes?: string[]\n}\n\n/** One request the platform makes on your behalf. Relative paths only. */\nexport interface TriggerRequest {\n    method?: "GET" | "POST"\n    /** Relative to the provider\'s base URL. The proxy refuses anything else. */\n    path: string\n    query?: Record<string, string>\n    headers?: Record<string, string>\n    body?: unknown\n}\n\n/** Where the next poll should carry on from. */\nexport interface TriggerCursor {\n    from: "response" | "item"\n    /** Dotted path to the value. `@odata.deltaLink` is one key, not two. */\n    path: string\n    into?: string\n}\n\n/**\n * A second request per item, for providers that answer with identifiers.\n *\n * Gmail\'s message list returns `{ id, threadId }` \u2014 enough to know a mail\n * arrived, not enough to tell anyone what it says. Without this the trigger\n * polls correctly, dedupes correctly, and hands every workflow an empty\n * message, which is the worst kind of working.\n */\nexport interface TriggerHydrate {\n    path: string\n    method?: "GET" | "POST"\n    query?: Record<string, string>\n    headers?: Record<string, string>\n}\n\n/** For providers that can tell us instead of being asked. */\nexport interface TriggerPush {\n    resource: string\n    changeType: string\n    maxMinutes?: number\n}\n\n/**\n * What makes a plugin a starting point.\n *\n * A declaration rather than code, because the runtime is billed by the second\n * and a step blocking on an empty inbox would be paid for every second of doing\n * nothing. The platform polls for you and starts the workflow when something\n * arrives.\n */\nexport interface PluginTrigger {\n    /** Must name one of your own properties of type `connection`. */\n    connection: string\n    /** Minutes between checks. The account\'s plan sets the floor. */\n    poll?: string | number\n    request: TriggerRequest\n    /** Dotted path to the array of items in the response. */\n    items: string\n    /** Dotted path, within one item, to what makes it unique. */\n    id: string\n    cursor?: TriggerCursor\n    hydrate?: TriggerHydrate\n    push?: TriggerPush\n    /** How many items one poll may start workflows for. */\n    maxPerPoll?: number\n}\n\n/**\n * A step that is a declaration rather than a program.\n *\n * One request built from the properties somebody filled in, or no request at\n * all for a step that only reshapes what reached it. No container, no code, and\n * nothing for a review to be about \u2014 which is why most steps should be one.\n *\n * Left loosely typed here on purpose: writing an action is a different job from\n * writing a plugin, and the platform validates its shape when it is saved.\n */\nexport type PluginAction = Record<string, unknown>\n\n/**\n * Every block the validator keeps. Anything else is dropped on save.\n *\n * Note what is NOT here: the hosts a plugin may contact are set on the platform\n * rather than declared in the manifest, so a plugin cannot widen its own egress.\n */\nexport interface PluginManifest {\n    description?: string\n    icon?: string\n    color?: string\n    /** Bumped by you when the declaration changes shape. */\n    version?: number\n    /** How long one run may take. Capped by the account\'s plan. */\n    timeoutMs?: number\n    memoryLimitMb?: number\n    auth?: PluginAuth\n    properties?: Record<string, PluginProperty>\n    inputs?: string[]\n    outputs?: string[]\n    /** What downstream steps can read, described for the picker. */\n    outputFields?: Record<string, string>\n    trigger?: PluginTrigger\n    action?: PluginAction\n}\n\n/** The older name for the same thing, kept because authors still say it. */\nexport type PluginSchema = PluginManifest\n';
 
+// src/repo-types.ts
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+
+// src/ambient-declarations.ts
+var AMBIENT_DECLARATIONS = '/**\n * What a plugin is handed, and what it must hand back.\n *\n * This file is the contract between a plugin and the VisualAutomate runtime:\n * the arguments `execute` is called with, every helper on `context`, the shape\n * of the result, and the manifest that declares the step. When a helper is only\n * present under some condition, that is said here rather than left for somebody\n * to discover from a TypeError.\n *\n * context-api.ts describes the same runtime as data, for tools that cannot read\n * a TypeScript interface, such as an editor\'s autocomplete.\n */\n\n// \u2500\u2500\u2500 What a step is called with \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * The output of the steps that led here, keyed by step name and node id.\n *\n * A step reads `input.download_clips.file` where `download_clips` is what the\n * step before it is called on the canvas. Every route into this step is merged,\n * so a step at the join of two branches sees both.\n */\ndeclare interface PluginInput {\n    [key: string]: unknown\n}\n\n/** The fields somebody filled in on the canvas, as the manifest declared them. */\ndeclare interface PluginConfig {\n    [key: string]: unknown\n}\n\n// \u2500\u2500\u2500 context.storage \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** What `storage.put` reports about the file it wrote. */\ndeclare interface StorageResult {\n    url: string\n    size: number\n    contentType: string\n    uploadedAt: string\n    expiresAt: string\n}\n\n/** What `storage.list` reports. */\ndeclare interface StorageListResult {\n    files: Array<{\n        url: string\n        pathname: string\n        size: number\n        uploadedAt: string\n    }>\n    totalSize: number\n}\n\n/**\n * The account\'s own files. Paths are scoped to the user; you cannot name\n * anybody else\'s, and you do not have to prefix your own.\n *\n * The account\'s plan caps what it may hold at once, and a `put` past that\n * ceiling is refused rather than silently dropped.\n */\ndeclare interface PluginStorage {\n    /** Write a file. Bytes may be a string, a Buffer or any typed array. */\n    put(path: string, data: Uint8Array | string, contentType?: string): Promise<StorageResult>\n    /** Read a file back. `null` when it is not there. */\n    get(path: string): Promise<Uint8Array | null>\n    delete(path: string): Promise<void>\n    /** Everything under a prefix, or everything when no prefix is given. */\n    list(prefix?: string): Promise<StorageListResult>\n    /** Size and content type without moving the bytes. `null` when absent. */\n    head(path: string): Promise<{ size: number; contentType: string } | null>\n    /**\n     * A URL somebody else can fetch this file from, for a few minutes.\n     *\n     * For the common API that takes a link and pulls the file itself. Clamped\n     * to between one minute and one hour; the default is fifteen minutes.\n     */\n    signedUrl(path: string, expiresInSeconds?: number): Promise<string | null>\n    /**\n     * Pull a URL straight into storage without the bytes passing through this\n     * step. A hundred-megabyte file costs the run no memory and no egress,\n     * because a Worker fetches it and writes it to storage directly.\n     *\n     * ONLY PRESENT when the download Worker is configured on the server. Guard\n     * with `if (context.storage.download)` if you want to degrade gracefully.\n     */\n    download?(url: string, path: string, contentType?: string): Promise<StorageResult>\n}\n\n// \u2500\u2500\u2500 context.state \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Values that outlive one run, scoped to this workflow and this account.\n *\n * For a cursor, a last-seen id, a counter \u2014 the things a workflow needs to\n * remember between firings. Not for large data: that is what storage is for.\n * The account\'s plan caps how many keys it may hold.\n */\ndeclare interface PluginState {\n    /** The stored value, or `null` when the key has never been set. */\n    get(key: string): Promise<unknown>\n    set(key: string, value: unknown, options?: { ttlSeconds?: number }): Promise<void>\n    delete(key: string): Promise<void>\n    list(prefix?: string): Promise<{ keys: string[] }>\n}\n\n// \u2500\u2500\u2500 context.media \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * ffmpeg, for a step that has a file in storage and wants a different one.\n *\n * A PLUGIN NEVER BUILDS AN FFMPEG COMMAND LINE, and cannot. You name an\n * operation and supply values; the command line is assembled on the server, one\n * operation at a time, and the only paths in it are placeholders the container\n * fills from a list the server wrote. That is deliberate: `-i` takes any path\n * and several filters open files of their own, so an ffmpeg taking its flags\n * from plugin config would be a plugin reading the container\'s filesystem \u2014\n * including the file holding that run\'s own credentials.\n *\n * The job runs in a container of its own and talks to storage directly, so a\n * two hundred megabyte clip never crosses this step.\n *\n * ONLY PRESENT when the sandbox and storage are both configured.\n */\ndeclare interface PluginMedia {\n    run(operation: string, params: Record<string, unknown>): Promise<Record<string, unknown>>\n}\n\n// \u2500\u2500\u2500 context.connections \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** One request through the integration proxy. */\ndeclare interface ConnectionRequest {\n    path: string\n    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE"\n    query?: Record<string, string | number | boolean | undefined>\n    headers?: Record<string, string>\n    body?: unknown\n}\n\n/** What the proxy answers with. The provider\'s own reply, unwrapped. */\ndeclare interface ConnectionResponse {\n    ok: boolean\n    status: number\n    headers?: Record<string, string>\n    body: unknown\n}\n\n/**\n * One of the accounts the user connected.\n *\n * THERE IS NO getToken(), deliberately. A token that can be read can be logged\n * or posted somewhere, and this is where third-party code runs. You name a path\n * and the proxy attaches the credential on the way past.\n *\n * You also never name a host. The base URL belongs to the provider\n * configuration, which is what stops a connection being pointed at an internal\n * address or at somebody\'s collection server.\n */\ndeclare interface PluginConnection {\n    /** This platform\'s id for the connection, not the provider\'s. */\n    id: string\n    request(options: ConnectionRequest): Promise<ConnectionResponse>\n}\n\n/**\n * The accounts this step was configured with.\n *\n * `get` takes the name of one of your own `connection` properties \u2014 not a\n * connection id \u2014 so a step can only reach the accounts it was set up with.\n *\n * ONLY PRESENT when the step declares at least one `connection` property and\n * the user has chosen an account for it.\n */\ndeclare interface PluginConnections {\n    get(propertyName: string): Promise<PluginConnection>\n}\n\n// \u2500\u2500\u2500 The context itself \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Everything a step is told about the run it is part of.\n *\n * The optional members are optional for a reason and not out of caution: each\n * is absent when the thing behind it is not configured or not applicable, and\n * a plugin that needs one should say so plainly rather than crash on a dot.\n */\ndeclare interface PluginContext {\n    /** The workflow this run belongs to. */\n    workflowId: string\n    /** This step\'s id on the canvas. */\n    nodeId: string\n    /** Whose run it is. */\n    userId: string\n    /** This run, distinct from every other run of the same workflow. */\n    executionId: string\n    /** When the run started, as an ISO string. */\n    startedAt: string\n    /** Values the plugin was published with. Not the user\'s credentials. */\n    secrets: Record<string, string>\n\n    /** The account\'s files. See PluginStorage. */\n    storage: PluginStorage\n    /** Values that outlive one run. See PluginState. */\n    state: PluginState\n    /** ffmpeg. Absent when the server has no sandbox or storage configured. */\n    media?: PluginMedia\n    /** The accounts this step was configured with. Absent when it has none. */\n    connections?: PluginConnections\n}\n\n// \u2500\u2500\u2500 What a step hands back \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * The result of a step.\n *\n * `output` names which port the run leaves by, and therefore which lines on the\n * canvas are followed. It has to be one of the `outputs` in the manifest \u2014\n * usually `"success"` or `"error"`.\n *\n * `data` is what the next steps read as `{{this_step.field}}`. Keep it flat and\n * named for what it is; those names are what somebody picks from a dropdown.\n */\ndeclare interface PluginOutput {\n    output: string\n    data: Record<string, unknown>\n    metadata?: {\n        durationMs?: number\n        memoryUsedMb?: number\n        logs?: string[]\n    }\n}\n\n/**\n * A plugin.\n *\n * Export `execute`, either as `module.exports.execute` or as the default export\n * of a module with an `execute` on it. Both are accepted, and so is a bare\n * function as the default export.\n *\n * @example\n * export default {\n *   async execute(input, config, context) {\n *     const file = await context.storage.get(config.path as string)\n *     return { output: "success", data: { bytes: file?.length ?? 0 } }\n *   }\n * }\n */\ndeclare interface PluginModule {\n    execute(\n        input: PluginInput,\n        config: PluginConfig,\n        context: PluginContext,\n    ): Promise<PluginOutput> | PluginOutput\n}\n\n/** The bare function form, for a plugin that is only an execute. */\ndeclare type PluginExecute = PluginModule["execute"]\n\n// \u2500\u2500\u2500 How a run reports on a step \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * `skipped` is a decision rather than a fault: the filters on every line into\n * the step said no, so it never ran. Counting it as an error turns a branch\n * that was simply not chosen into a broken workflow.\n */\ndeclare type ExecutionStatus = "success" | "error" | "timeout" | "skipped" | "cancelled"\n\ndeclare interface PluginExecutionResult {\n    status: ExecutionStatus\n    output: PluginOutput | null\n    error?: string\n    durationMs: number\n    memoryMb?: number\n    outputPort?: string\n    logs?: string[]\n}\n\n// \u2500\u2500\u2500 The manifest \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * The declaration that sits beside the code.\n *\n * It says which fields the canvas renders, which account the step acts as, what\n * it hands downstream, and whether it is a starting point that watches\n * something. One shape wherever it is stored \u2014 `manifest.json` next to your\n * code, or an `@schema` comment in the source.\n *\n * Every name below is one the platform keeps. A block it does not recognise is\n * dropped when the plugin is saved, so a field that is not listed here will not\n * survive an upload.\n */\ndeclare type PluginPropertyType =\n    | "string"\n    | "number"\n    | "boolean"\n    | "select"\n    | "multiselect"\n    | "json"\n    /**\n     * A program, not a value.\n     *\n     * Stored exactly as typed and never parsed, which is the difference from\n     * `json` above: that one keeps its value structured, so `return 5` would be\n     * saved as the number five and the step would run nothing.\n     */\n    | "code"\n    | "color"\n    | "date"\n    /** An account the user connected. Rendered as a picker, not a text box. */\n    | "connection"\n    /**\n     * A file the account already has, read into the config before the step\n     * runs. `{{config.attachment.name}}`, `.contentType`, `.size`,\n     * `.contentBytes`. Right for attaching a PDF; a video would be hundreds of\n     * megabytes of base64 \u2014 use `path` for those.\n     */\n    | "file"\n    /** A file in storage, named rather than read. What ffmpeg steps take. */\n    | "path"\n    /** Several of them, one per line, in the order they were chosen. */\n    | "paths"\n\ndeclare interface PluginProperty {\n    /** Shown above the input on the canvas. Defaults to the property name. */\n    label: string\n    type: PluginPropertyType\n    required?: boolean\n    default?: unknown\n    /** Helper text under the input. */\n    description?: string\n    /** For `select` and `multiselect`. */\n    options?: Array<{ label: string; value: string }>\n    /** Puts related fields in a section together. */\n    group?: string\n    /** For `number`. */\n    min?: number\n    max?: number\n    /** For `string`: a regex the value must match. */\n    pattern?: string\n    /**\n     * For `connection`: which integration the account must belong to, e.g.\n     * `outlook`. A module inherits its app\'s, so it does not repeat this.\n     */\n    provider?: string\n}\n\n/**\n * How a step reaches the account it acts as.\n *\n * `none` means the plugin holds its own key in a property. That is not the same\n * as leaving the block out, which means "written before auth could be\n * declared".\n *\n * A MANIFEST MAY NOT NAME A HOST. `url`, `baseUrl`, `base_url` and `host` are\n * refused outright rather than ignored, so nobody writes one and believes it\n * took effect: the base URL belongs to the provider configuration, and that is\n * what stops a connection being pointed at an internal address.\n */\ndeclare interface PluginAuth {\n    type: "oauth2" | "api_key" | "basic" | "none"\n    provider?: string\n    scopes?: string[]\n}\n\n/** One request the platform makes on your behalf. Relative paths only. */\ndeclare interface TriggerRequest {\n    method?: "GET" | "POST"\n    /** Relative to the provider\'s base URL. The proxy refuses anything else. */\n    path: string\n    query?: Record<string, string>\n    headers?: Record<string, string>\n    body?: unknown\n}\n\n/** Where the next poll should carry on from. */\ndeclare interface TriggerCursor {\n    from: "response" | "item"\n    /** Dotted path to the value. `@odata.deltaLink` is one key, not two. */\n    path: string\n    into?: string\n}\n\n/**\n * A second request per item, for providers that answer with identifiers.\n *\n * Gmail\'s message list returns `{ id, threadId }` \u2014 enough to know a mail\n * arrived, not enough to tell anyone what it says. Without this the trigger\n * polls correctly, dedupes correctly, and hands every workflow an empty\n * message, which is the worst kind of working.\n */\ndeclare interface TriggerHydrate {\n    path: string\n    method?: "GET" | "POST"\n    query?: Record<string, string>\n    headers?: Record<string, string>\n}\n\n/** For providers that can tell us instead of being asked. */\ndeclare interface TriggerPush {\n    resource: string\n    changeType: string\n    maxMinutes?: number\n}\n\n/**\n * What makes a plugin a starting point.\n *\n * A declaration rather than code, because the runtime is billed by the second\n * and a step blocking on an empty inbox would be paid for every second of doing\n * nothing. The platform polls for you and starts the workflow when something\n * arrives.\n */\ndeclare interface PluginTrigger {\n    /** Must name one of your own properties of type `connection`. */\n    connection: string\n    /** Minutes between checks. The account\'s plan sets the floor. */\n    poll?: string | number\n    request: TriggerRequest\n    /** Dotted path to the array of items in the response. */\n    items: string\n    /** Dotted path, within one item, to what makes it unique. */\n    id: string\n    cursor?: TriggerCursor\n    hydrate?: TriggerHydrate\n    push?: TriggerPush\n    /** How many items one poll may start workflows for. */\n    maxPerPoll?: number\n}\n\n/**\n * A step that is a declaration rather than a program.\n *\n * One request built from the properties somebody filled in, or no request at\n * all for a step that only reshapes what reached it. No container, no code, and\n * nothing for a review to be about \u2014 which is why most steps should be one.\n *\n * Left loosely typed here on purpose: writing an action is a different job from\n * writing a plugin, and the platform validates its shape when it is saved.\n */\ndeclare type PluginAction = Record<string, unknown>\n\n/**\n * Every block the validator keeps. Anything else is dropped on save.\n *\n * Note what is NOT here: the hosts a plugin may contact are set on the platform\n * rather than declared in the manifest, so a plugin cannot widen its own egress.\n */\ndeclare interface PluginManifest {\n    description?: string\n    icon?: string\n    color?: string\n    /** Bumped by you when the declaration changes shape. */\n    version?: number\n    /** How long one run may take. Capped by the account\'s plan. */\n    timeoutMs?: number\n    memoryLimitMb?: number\n    auth?: PluginAuth\n    properties?: Record<string, PluginProperty>\n    inputs?: string[]\n    outputs?: string[]\n    /** What downstream steps can read, described for the picker. */\n    outputFields?: Record<string, string>\n    trigger?: PluginTrigger\n    action?: PluginAction\n}\n\n/** The older name for the same thing, kept because authors still say it. */\ndeclare type PluginSchema = PluginManifest\n';
+
+// src/repo-types.ts
+var TYPES_FILE = "visualautomate.d.ts";
+var JSCONFIG_FILE = "jsconfig.json";
+var TYPES_MARKER = "// The VisualAutomate plugin contract, for your editor.";
+function declarationsFor(version) {
+  return `${TYPES_MARKER}
+//
+// Written by the VisualAutomate CLI ${version}. Nothing here exists while your
+// plugin runs, and your code imports none of it: the line "@type {PluginModule}"
+// above module.exports is what connects the two.
+//
+// Edits to this file are overwritten. Delete it and it is written again.
+
+${AMBIENT_DECLARATIONS}`;
+}
+var JSCONFIG = `${JSON.stringify(
+  {
+    compilerOptions: {
+      target: "ES2022",
+      lib: ["ES2022"],
+      module: "node16",
+      moduleResolution: "node16",
+      allowJs: true,
+      // Off on purpose: a plugin may require any of the packages the
+      // sandbox has, which are installed there and not here, and checking
+      // would report every one of them as a module that cannot be found.
+      // Completion and hover documentation do not need it.
+      checkJs: false,
+      noEmit: true
+    },
+    include: [TYPES_FILE, "*.js", "modules/**/*.js", "examples/**/*.js"],
+    exclude: ["node_modules", ".visualautomate"]
+  },
+  null,
+  2
+)}
+`;
+function ensureRepoTypes(root, version) {
+  const written = [];
+  const typesPath = join(root, TYPES_FILE);
+  const wanted2 = declarationsFor(version);
+  const current = existsSync(typesPath) ? read(typesPath) : null;
+  if (current === null || current.startsWith(TYPES_MARKER) && current !== wanted2) {
+    writeFileSync(typesPath, wanted2);
+    written.push(TYPES_FILE);
+  }
+  const jsconfigPath = join(root, JSCONFIG_FILE);
+  if (!existsSync(jsconfigPath)) {
+    writeFileSync(jsconfigPath, JSCONFIG);
+    written.push(JSCONFIG_FILE);
+  }
+  return written;
+}
+function read(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function projectRoot(cwd) {
+  const parent = dirname(cwd);
+  if (basename(parent) === "modules") {
+    const root = dirname(parent);
+    if (existsSync(join(root, "package.json")) || existsSync(join(root, TYPES_FILE))) return root;
+  }
+  return cwd;
+}
+
 // src/templates.ts
 var EXAMPLES = `
   // -- The rest of what you can declare --------------------------------
@@ -1813,28 +1885,231 @@ function parseJsonc(text) {
   return { value, json: JSON.stringify(value, null, 2) };
 }
 
+// src/manifest-property.ts
+var PROPERTY_TYPES = [
+  "string",
+  "number",
+  "boolean",
+  "select",
+  "multiselect",
+  "json",
+  "color",
+  "date",
+  "connection",
+  "file",
+  "path",
+  "paths"
+];
+function isPropertyType(value) {
+  return PROPERTY_TYPES.includes(value);
+}
+function isPropertyName(name) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name);
+}
+function labelFor(name) {
+  const words = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim().toLowerCase();
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+function defaultFor(type, raw) {
+  switch (type) {
+    case "number": {
+      const value = Number(raw);
+      if (raw.trim() === "" || Number.isNaN(value)) throw new Error(`"${raw}" is not a number.`);
+      return value;
+    }
+    case "boolean": {
+      const value = raw.trim().toLowerCase();
+      if (["true", "yes", "1"].includes(value)) return true;
+      if (["false", "no", "0"].includes(value)) return false;
+      throw new Error(`"${raw}" is not true or false.`);
+    }
+    case "json":
+      try {
+        return JSON.parse(raw);
+      } catch {
+        throw new Error(`"${raw}" is not JSON. Quote it as your shell needs: '{"a":1}'`);
+      }
+    case "multiselect":
+    case "paths":
+      return raw.trim() === "" ? [] : raw.split(",").map((part) => part.trim()).filter(Boolean);
+    default:
+      return raw;
+  }
+}
+function optionsFrom(raw) {
+  return raw.split(",").map((part) => part.trim()).filter(Boolean).map((part) => {
+    const at = part.indexOf(":");
+    if (at === -1) return { label: labelFor(part), value: part };
+    return { label: part.slice(0, at).trim(), value: part.slice(at + 1).trim() };
+  });
+}
+function buildProperty(spec) {
+  const property = {
+    label: spec.label?.trim() || labelFor(spec.name),
+    type: spec.type
+  };
+  if (spec.type === "select" || spec.type === "multiselect") {
+    const options = optionsFrom(spec.options ?? "");
+    if (options.length === 0) {
+      throw new Error(
+        `A ${spec.type} needs its choices: --options "Fast:fast,Thorough:thorough", or --options fast,thorough.`
+      );
+    }
+    property.options = options;
+  }
+  if (spec.type === "connection") {
+    if (!spec.provider) {
+      throw new Error("A connection needs the provider it is for: --provider outlook.");
+    }
+    property.provider = spec.provider;
+  }
+  if (spec.required) property.required = true;
+  if (spec.value !== void 0) property.default = defaultFor(spec.type, spec.value);
+  if (spec.description?.trim()) property.description = spec.description.trim();
+  return property;
+}
+function topLevelMembers(bare) {
+  const members = /* @__PURE__ */ new Map();
+  let object = null;
+  let depth = 0;
+  let key = null;
+  let expectValue = false;
+  for (let i = 0; i < bare.length; i++) {
+    const char = bare[i];
+    if (char === '"') {
+      let end = i + 1;
+      while (end < bare.length && bare[end] !== '"') end += bare[end] === "\\" ? 2 : 1;
+      if (depth === 1 && !expectValue) key = bare.slice(i + 1, end);
+      if (depth === 1 && expectValue && key) {
+        members.set(key, { start: i, end });
+        key = null;
+        expectValue = false;
+      }
+      i = end;
+      continue;
+    }
+    if (char === ":" && depth === 1 && key) {
+      expectValue = true;
+      continue;
+    }
+    if (char === "{" || char === "[") {
+      depth++;
+      if (depth === 1) object = { start: i, end: -1 };
+      if (depth === 2 && expectValue && key) {
+        const close = matchBracket(bare, i);
+        members.set(key, { start: i, end: close });
+        key = null;
+        expectValue = false;
+        i = close;
+        depth--;
+      }
+      continue;
+    }
+    if (char === "}" || char === "]") {
+      if (depth === 1 && object) object.end = i;
+      depth--;
+      continue;
+    }
+    if (depth === 1 && expectValue && !/[\s,]/.test(char)) {
+      let end = i;
+      while (end < bare.length && !/[,}\]]/.test(bare[end])) end++;
+      if (key) members.set(key, { start: i, end: end - 1 });
+      key = null;
+      expectValue = false;
+      i = end - 1;
+    }
+  }
+  return { object, members };
+}
+function matchBracket(bare, open) {
+  let depth = 0;
+  for (let i = open; i < bare.length; i++) {
+    const char = bare[i];
+    if (char === '"') {
+      i++;
+      while (i < bare.length && bare[i] !== '"') i += bare[i] === "\\" ? 2 : 1;
+      continue;
+    }
+    if (char === "{" || char === "[") depth++;
+    if (char === "}" || char === "]") {
+      depth--;
+      if (depth === 0) return i;
+    }
+  }
+  throw new Error("This manifest has a bracket that is never closed.");
+}
+function indentOf(text) {
+  const found = /\n([ \t]+)"/.exec(text);
+  return found ? found[1] : "  ";
+}
+function lastContent(bare, from, to) {
+  for (let i = to - 1; i > from; i--) {
+    if (!/\s/.test(bare[i])) return i;
+  }
+  return -1;
+}
+function indented(value, indent, depth) {
+  return JSON.stringify(value, null, indent.length === 1 ? "	" : indent.length).replace(/\{\s*"label": ("(?:[^"\\]|\\.)*"),\s*"value": ("(?:[^"\\]|\\.)*")\s*\}/g, '{ "label": $1, "value": $2 }').split("\n").map((line2, index) => index === 0 ? line2 : indent.repeat(depth) + line2).join("\n");
+}
+function withProperty(text, name, property) {
+  const bare = stripJsonComments(text);
+  const { object, members } = topLevelMembers(bare);
+  if (!object || object.end === -1) throw new Error("This manifest is not a JSON object.");
+  const indent = indentOf(text);
+  const entry = `"${name}": ${indented(property, indent, 2)}`;
+  const existing = members.get("properties");
+  let next;
+  if (existing && bare[existing.start] === "{") {
+    const last = lastContent(bare, existing.start, existing.end);
+    next = last === -1 ? text.slice(0, existing.start + 1) + `
+${indent.repeat(2)}${entry}
+${indent}` + text.slice(existing.end) : text.slice(0, last + 1) + `,
+${indent.repeat(2)}${entry}` + text.slice(last + 1);
+  } else if (existing) {
+    throw new Error('"properties" in this manifest is not an object, so nothing can be added to it.');
+  } else {
+    const block = `"properties": {
+${indent.repeat(2)}${entry}
+${indent}}`;
+    const last = lastContent(bare, object.start, object.end);
+    next = last === -1 ? text.slice(0, object.start + 1) + `
+${indent}${block}
+` + text.slice(object.end) : text.slice(0, last + 1) + `,
+${indent}${block}` + text.slice(last + 1);
+  }
+  const parsed = JSON.parse(stripJsonComments(next));
+  if (!parsed.properties || !(name in parsed.properties)) {
+    throw new Error("The property could not be placed in this manifest. Add it by hand, or say where this went wrong.");
+  }
+  return next;
+}
+function hasProperty(text, name) {
+  const parsed = JSON.parse(stripJsonComments(text));
+  return Boolean(parsed.properties && typeof parsed.properties === "object" && name in parsed.properties);
+}
+
 // src/project.ts
-import { existsSync, readdirSync, statSync } from "node:fs";
+import { existsSync as existsSync2, readdirSync, statSync } from "node:fs";
 import { readFile } from "node:fs/promises";
-import { basename, join, relative, resolve } from "node:path";
+import { basename as basename2, join as join2, relative, resolve } from "node:path";
 var TEST_FILES = ["visualautomate.test.json", "test.json"];
 var ENTRIES = ["plugin.ts", "plugin.js", "index.ts", "index.js"];
 function entryIn(dir) {
-  return ENTRIES.map((file2) => join(dir, file2)).find((file2) => existsSync(file2)) ?? null;
+  return ENTRIES.map((file2) => join2(dir, file2)).find((file2) => existsSync2(file2)) ?? null;
 }
 function matchFolders(folders, name) {
-  const wanted = name.trim().toLowerCase();
-  const exact = folders.filter((folder) => folder.toLowerCase() === wanted);
+  const wanted2 = name.trim().toLowerCase();
+  const exact = folders.filter((folder) => folder.toLowerCase() === wanted2);
   if (exact.length > 0) return exact;
-  const prefix = folders.filter((folder) => folder.toLowerCase().startsWith(wanted));
+  const prefix = folders.filter((folder) => folder.toLowerCase().startsWith(wanted2));
   if (prefix.length > 0) return prefix;
-  return folders.filter((folder) => folder.toLowerCase().includes(wanted));
+  return folders.filter((folder) => folder.toLowerCase().includes(wanted2));
 }
 function findTargets(cwd, only) {
   const dir = resolve(cwd);
-  const modulesDir = join(dir, "modules");
-  if (!entryIn(dir) && existsSync(modulesDir) && statSync(modulesDir).isDirectory()) {
-    const folders = readdirSync(modulesDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync(join(modulesDir, d.name, "manifest.json"))).map((d) => d.name).sort();
+  const modulesDir = join2(dir, "modules");
+  if (!entryIn(dir) && existsSync2(modulesDir) && statSync(modulesDir).isDirectory()) {
+    const folders = readdirSync(modulesDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync2(join2(modulesDir, d.name, "manifest.json"))).map((d) => d.name).sort();
     if (folders.length === 0) {
       throw new Error("There is a modules/ folder here, but none of its folders has a manifest.json.");
     }
@@ -1842,9 +2117,9 @@ function findTargets(cwd, only) {
     if (only && chosen.length === 0) {
       throw new Error(`No module matches "${only}". This repository has: ${folders.join(", ")}.`);
     }
-    return chosen.map((folder) => targetIn(join(modulesDir, folder), `modules/${folder}`)).filter(Boolean);
+    return chosen.map((folder) => targetIn(join2(modulesDir, folder), `modules/${folder}`)).filter(Boolean);
   }
-  const target = targetIn(dir, basename(dir));
+  const target = targetIn(dir, basename2(dir));
   if (!target) {
     throw new Error(
       "Nothing to test here: no plugin.ts, plugin.js or index.js, and no modules/ folder.\nRun this in a module's folder, at the root of its repository, or run `vsa init <name>`."
@@ -1855,7 +2130,7 @@ function findTargets(cwd, only) {
 function targetIn(dir, name) {
   const entry = entryIn(dir);
   if (!entry) return null;
-  const raw = basename(entry) === "index.js" && !existsSync(join(dir, "plugin.json"));
+  const raw = basename2(entry) === "index.js" && !existsSync2(join2(dir, "plugin.json"));
   return { name, dir, entry, raw };
 }
 function targetForPath(targets, changed) {
@@ -1869,9 +2144,9 @@ function isPlainObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 async function readTestFile(dir, override) {
-  const path = override ? resolve(override) : TEST_FILES.map((f) => join(dir, f)).find((f) => existsSync(f)) ?? null;
+  const path = override ? resolve(override) : TEST_FILES.map((f) => join2(dir, f)).find((f) => existsSync2(f)) ?? null;
   if (!path) return { path: null, config: {}, input: {} };
-  if (!existsSync(path)) throw new Error(`${path} does not exist.`);
+  if (!existsSync2(path)) throw new Error(`${path} does not exist.`);
   let raw;
   try {
     raw = JSON.parse(await readFile(path, "utf8"));
@@ -2023,12 +2298,12 @@ function guardFetch(policy, base, onDenied) {
 }
 
 // src/persist.ts
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync3 } from "node:fs";
 import { mkdir, readdir, readFile as readFile2, rm, writeFile } from "node:fs/promises";
-import { dirname, join as join2, relative as relative2, resolve as resolve2, sep } from "node:path";
+import { dirname as dirname2, join as join3, relative as relative2, resolve as resolve2, sep } from "node:path";
 var PERSIST_DIR = ".visualautomate";
 function persistEnabled(dir, flag) {
-  return flag === "true" || existsSync2(join2(dir, PERSIST_DIR));
+  return flag === "true" || existsSync3(join3(dir, PERSIST_DIR));
 }
 function diskPathFor(storageRoot, path) {
   if (!path || path.includes("\0")) return null;
@@ -2038,22 +2313,22 @@ function diskPathFor(storageRoot, path) {
   return target;
 }
 async function walk(root, dir = root) {
-  if (!existsSync2(dir)) return [];
+  if (!existsSync3(dir)) return [];
   const entries = await readdir(dir, { withFileTypes: true });
   const nested = await Promise.all(
-    entries.map((entry) => entry.isDirectory() ? walk(root, join2(dir, entry.name)) : Promise.resolve([join2(dir, entry.name)]))
+    entries.map((entry) => entry.isDirectory() ? walk(root, join3(dir, entry.name)) : Promise.resolve([join3(dir, entry.name)]))
   );
   return nested.flat();
 }
 async function loadPersisted(dir) {
-  const storageRoot = join2(dir, PERSIST_DIR, "storage");
+  const storageRoot = join3(dir, PERSIST_DIR, "storage");
   const storage = {};
   for (const file2 of await walk(storageRoot)) {
     storage[relative2(storageRoot, file2).split(sep).join("/")] = new Uint8Array(await readFile2(file2));
   }
   let state = {};
-  const statePath = join2(dir, PERSIST_DIR, "state.json");
-  if (existsSync2(statePath)) {
+  const statePath = join3(dir, PERSIST_DIR, "state.json");
+  if (existsSync3(statePath)) {
     try {
       const parsed = JSON.parse(await readFile2(statePath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) state = parsed;
@@ -2064,7 +2339,7 @@ async function loadPersisted(dir) {
   return { storage, state };
 }
 async function savePersisted(dir, files, state) {
-  const storageRoot = join2(dir, PERSIST_DIR, "storage");
+  const storageRoot = join3(dir, PERSIST_DIR, "storage");
   const refused = [];
   const keep = /* @__PURE__ */ new Set();
   for (const [path, file2] of files) {
@@ -2074,19 +2349,51 @@ async function savePersisted(dir, files, state) {
       continue;
     }
     keep.add(target);
-    await mkdir(dirname(target), { recursive: true });
+    await mkdir(dirname2(target), { recursive: true });
     await writeFile(target, file2.bytes);
   }
   for (const existing of await walk(storageRoot)) {
     if (!keep.has(existing)) await rm(existing);
   }
-  await mkdir(join2(dir, PERSIST_DIR), { recursive: true });
-  await writeFile(join2(dir, PERSIST_DIR, "state.json"), JSON.stringify(Object.fromEntries(state), null, 2) + "\n");
+  await mkdir(join3(dir, PERSIST_DIR), { recursive: true });
+  await writeFile(join3(dir, PERSIST_DIR, "state.json"), JSON.stringify(Object.fromEntries(state), null, 2) + "\n");
   return refused;
 }
 
 // src/docker.ts
 import { spawnSync } from "node:child_process";
+
+// src/colour.ts
+var CODES = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  red: "\x1B[31m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  blue: "\x1B[34m"
+};
+function wanted() {
+  const env = process.env;
+  if (env.NO_COLOR !== void 0 && env.NO_COLOR !== "") return false;
+  if (env.FORCE_COLOR !== void 0 && env.FORCE_COLOR !== "" && env.FORCE_COLOR !== "0") return true;
+  return Boolean(process.stdout.isTTY);
+}
+var ON = wanted();
+function paint(code) {
+  return (text) => ON ? `${code}${text}${CODES.reset}` : text;
+}
+var red = paint(CODES.red);
+var green = paint(CODES.green);
+var yellow = paint(CODES.yellow);
+var blue = paint(CODES.blue);
+var dim = paint(CODES.dim);
+var bold = paint(CODES.bold);
+function colourEnv() {
+  return ON ? ["--env", "FORCE_COLOR=1"] : ["--env", "NO_COLOR=1"];
+}
+
+// src/docker.ts
 var IMAGE = "ghcr.io/visualautomate/plugin-sandbox";
 var TIERS = {
   standard: { cpus: "0.25", memory: "1g" },
@@ -2119,6 +2426,9 @@ function dockerArgs(run) {
     "ALL",
     "--security-opt",
     "no-new-privileges",
+    // So a run inside the container is as readable as one out here: its
+    // stdout is a pipe to Docker, which would otherwise turn colour off.
+    ...colourEnv(),
     ...run.user ? ["--user", `${run.user.uid}:${run.user.gid}`] : [],
     run.image,
     ...run.args
@@ -2142,16 +2452,18 @@ function dockerProblem() {
 function explainExit(code, tier) {
   if (code === 137) {
     const next = Object.keys(TIERS)[Object.keys(TIERS).indexOf(tier) + 1];
-    return `\u2717 stopped   the step used more than the ${TIERS[tier].memory.replace("g", " GB")} of memory the ${tier} tier has, and the container was killed. On the platform it would stop the same way.` + (next ? ` To check it fits a bigger machine: --tier ${next}` : "");
+    return red(
+      `\u2717 stopped   the step used more than the ${TIERS[tier].memory.replace("g", " GB")} of memory the ${tier} tier has, and the container was killed. On the platform it would stop the same way.` + (next ? ` To check it fits a bigger machine: --tier ${next}` : "")
+    );
   }
-  if (code === 125) return "\u2717 Docker could not start the container. Is the image available? Try: docker pull " + IMAGE;
+  if (code === 125) return red("\u2717 Docker could not start the container. Is the image available? Try: docker pull " + IMAGE);
   return null;
 }
 function ensureDocker(say, waitMs = 12e4) {
   const problem = dockerProblem();
   if (!problem) return null;
   if (problem.includes("not installed")) return problem;
-  say("Docker is not running. Starting Docker Desktop\u2026");
+  say(yellow("Docker is not running. Starting Docker Desktop\u2026"));
   const started = spawnSync("docker", ["desktop", "start"], { encoding: "utf8" });
   if (started.status !== 0) {
     say("Could not start it from here \u2014 start Docker Desktop yourself; this will carry on when it is up.");
@@ -2185,34 +2497,9 @@ function runInDocker(run) {
 }
 
 // src/index.ts
-var VERSION = true ? "0.5.1" : "0.0.0-dev";
-var DEFAULT_API_URL = "https://visualautomate.com";
-function configPath() {
-  return join3(homedir(), ".visualautomate", "config.json");
-}
-async function readConfig() {
-  try {
-    return JSON.parse(await readFile3(configPath(), "utf8"));
-  } catch {
-    return {};
-  }
-}
-async function writeConfig(next) {
-  const path = configPath();
-  await mkdir2(dirname2(path), { recursive: true });
-  await writeFile2(path, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
-}
-async function tokenFor(flags) {
-  const stored = await readConfig();
-  const apiUrl = (flags["api-url"] || process.env.VISUALAUTOMATE_API_URL || stored.apiUrl || DEFAULT_API_URL).replace(/\/+$/, "");
-  const token = flags.token || process.env.VISUALAUTOMATE_API_TOKEN || stored.token;
-  if (!token) {
-    fail("Not signed in. Run `visualautomate login` first.");
-  }
-  return { token, apiUrl };
-}
+var VERSION = true ? "0.6.0" : "0.0.0-dev";
 function fail(message) {
-  console.error(message);
+  console.error(red(message));
   throw new SilentExit();
 }
 var SilentExit = class extends Error {
@@ -2224,97 +2511,6 @@ var SilentExit = class extends Error {
 function ok(message) {
   console.log(message);
 }
-function openBrowser(url) {
-  const command = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
-  try {
-    spawn(command, args, { stdio: "ignore", detached: true }).unref();
-  } catch {
-  }
-}
-async function cmdLogin(flags) {
-  const stored = await readConfig();
-  const apiUrl = (flags["api-url"] || process.env.VISUALAUTOMATE_API_URL || stored.apiUrl || DEFAULT_API_URL).replace(/\/+$/, "");
-  const state = randomBytes(24).toString("base64url");
-  const token = await new Promise((resolveToken, rejectToken) => {
-    const server = createServer((req, res) => {
-      if (!req.url?.startsWith("/callback") || req.method !== "POST") {
-        res.writeHead(404).end("Not found");
-        return;
-      }
-      let body = "";
-      req.on("data", (chunk) => {
-        body += chunk;
-        if (body.length > 8192) req.destroy();
-      });
-      req.on("end", () => {
-        const fields = new URLSearchParams(body);
-        const answer = (status, text) => {
-          res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(
-            `<!doctype html><meta charset="utf-8"><title>VisualAutomate</title><body style="font:16px system-ui;padding:3rem;max-width:32rem;margin:auto">${text}</body>`
-          );
-        };
-        if (fields.get("state") !== state) {
-          answer(400, "<h1>That did not match</h1><p>Run <code>visualautomate login</code> again.</p>");
-          return;
-        }
-        const received = fields.get("token");
-        if (!received) {
-          answer(400, "<h1>No token in the reply</h1><p>Run <code>visualautomate login</code> again.</p>");
-          return;
-        }
-        answer(200, "<h1>Signed in</h1><p>You can close this tab and go back to your terminal.</p>");
-        server.close();
-        resolveToken(received);
-      });
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        rejectToken(new Error("Could not open a port to listen on"));
-        return;
-      }
-      const url = `${apiUrl}/cli/login?port=${address.port}&state=${state}`;
-      ok(`Opening ${url}
-`);
-      ok("If your browser did not open, paste that address into it.");
-      openBrowser(url);
-    });
-    server.on("error", rejectToken);
-    setTimeout(() => {
-      server.close();
-      rejectToken(new Error("Timed out after five minutes waiting for the browser."));
-    }, 5 * 6e4).unref();
-  });
-  const who = await whoami(apiUrl, token);
-  await writeConfig({ token, apiUrl, email: who.email });
-  ok(`
-\u2713 Signed in as ${who.email}`);
-  ok(`  Token stored in ${configPath()}`);
-}
-async function whoami(apiUrl, token) {
-  const res = await fetch(`${apiUrl}/api/cli/whoami`, {
-    headers: { Authorization: `Bearer ${token}` }
-  });
-  if (res.status === 401) fail("That token is not valid. Run `visualautomate login` again.");
-  if (!res.ok) fail(`Could not reach ${apiUrl} (status ${res.status}).`);
-  const data = await res.json();
-  return { email: data.email ?? "(unknown)", developer: Boolean(data.pluginDeveloper) };
-}
-async function cmdWhoami(flags) {
-  const { token, apiUrl } = await tokenFor(flags);
-  const who = await whoami(apiUrl, token);
-  ok(`${who.email} on ${apiUrl}`);
-  if (!who.developer) {
-    ok("\nThis account is not a plugin developer yet, so `push` will be refused.");
-    ok("Turn it on from the dashboard under Developer settings.");
-  }
-}
-async function cmdLogout() {
-  await writeConfig({});
-  ok("Signed out. The token file is empty.");
-}
 async function cmdInit(args, flags) {
   const name = args[0];
   if (!name) fail("Usage: visualautomate init <name> [--template <name>]");
@@ -2324,22 +2520,22 @@ async function cmdInit(args, flags) {
     fail(`Unknown template "${templateName}". Available: ${Object.keys(TEMPLATES).join(", ")}`);
   }
   const target = resolve3(process.cwd(), name);
-  if (existsSync3(target)) fail(`"${name}" already exists here.`);
+  if (existsSync4(target)) fail(`"${name}" already exists here.`);
   const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
   await mkdir2(target, { recursive: true });
-  await writeFile2(join3(target, "plugin.ts"), template.code);
-  await writeFile2(join3(target, "manifest.json"), template.manifest);
+  await writeFile2(join4(target, "plugin.ts"), template.code);
+  await writeFile2(join4(target, "manifest.json"), template.manifest);
   await writeFile2(
-    join3(target, "plugin.json"),
+    join4(target, "plugin.json"),
     JSON.stringify(
       { name: slug, version: "1.0.0", description: template.description, category: template.category },
       null,
       2
     ) + "\n"
   );
-  await writeFile2(join3(target, "visualautomate.d.ts"), TYPE_DECLARATIONS);
+  await writeFile2(join4(target, "visualautomate.d.ts"), TYPE_DECLARATIONS);
   await writeFile2(
-    join3(target, "tsconfig.json"),
+    join4(target, "tsconfig.json"),
     JSON.stringify(
       {
         compilerOptions: {
@@ -2358,11 +2554,11 @@ async function cmdInit(args, flags) {
     ) + "\n"
   );
   await writeFile2(
-    join3(target, "test.json"),
+    join4(target, "test.json"),
     JSON.stringify(template.testInput, null, 2) + "\n"
   );
   await writeFile2(
-    join3(target, "README.md"),
+    join4(target, "README.md"),
     `# ${name}
 
 ${template.description}
@@ -2376,9 +2572,9 @@ visualautomate push     # publish it to your account
 \`test.json\` is the input, config and state \`test\` runs with.
 `
   );
-  ok(`
+  ok(green(`
 \u2713 Created ${name} from the "${templateName}" template
-`);
+`));
   ok("  cd " + name);
   ok("  visualautomate test");
   ok("  visualautomate push\n");
@@ -2412,12 +2608,12 @@ function line(indent, text) {
 async function runTarget(target, flags, several) {
   const say = (text) => line(several, text);
   if (several) ok(`
-\u25B8 ${target.name}`);
+${bold(`\u25B8 ${target.name}`)}`);
   try {
     const code = await codeFor(target);
     const check = validatePluginCode(code);
     if (!check.valid) {
-      say(`\u2717 refused   ${check.error}`);
+      say(`${red("\u2717 refused")}   ${check.error}`);
       return false;
     }
     const settings = await readTestFile(target.dir, flags.input);
@@ -2425,13 +2621,13 @@ async function runTarget(target, flags, several) {
     const exported = loadPluginCode(code, sandboxRequire(packageLoader(target.dir)));
     const plugin = typeof exported === "function" ? exported : typeof exported?.execute === "function" ? exported : exported?.default;
     let outputs = [];
-    const manifestPath = join3(target.dir, "manifest.json");
-    if (existsSync3(manifestPath)) {
+    const manifestPath = join4(target.dir, "manifest.json");
+    if (existsSync4(manifestPath)) {
       try {
         const manifest = parseJsonc(await readFile3(manifestPath, "utf8")).value;
         outputs = manifest.outputs ?? [];
       } catch (error) {
-        say(`\u2717 manifest.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+        say(red(`\u2717 manifest.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`));
         return false;
       }
     }
@@ -2457,33 +2653,37 @@ async function runTarget(target, flags, several) {
     const port = result.output?.output ?? null;
     const expected = settings.expectOutput;
     const passed = result.status === "success" && (!expected || port === expected);
-    say(`${passed ? "\u2713 passed" : "\u2717 failed"}  ${result.status}, ${result.durationMs}ms`);
-    if (result.error) say(`error    ${result.error}`);
+    const verdict = passed ? green(bold("\u2713 passed")) : red(bold("\u2717 failed"));
+    say(`${verdict}  ${dim(`${result.status}, ${result.durationMs}ms`)}`);
+    if (result.error) say(`${dim("error")}    ${red(result.error)}`);
     if (result.output) {
-      say(`output   ${port}${expected ? ` (expected ${expected})` : ""}`);
-      say(`data     ${JSON.stringify(result.output.data, null, 2).replace(/\n/g, "\n         ")}`);
+      const port_ = passed || !expected ? port : red(String(port));
+      say(`${dim("output")}   ${port_}${expected ? dim(` (expected ${expected})`) : ""}`);
+      say(`${dim("data")}     ${JSON.stringify(result.output.data, null, 2).replace(/\n/g, "\n         ")}`);
     }
-    if (result.files.size > 0) say(`files    ${[...result.files.keys()].join(", ")}`);
-    if (result.state.size > 0) say(`state    ${JSON.stringify(Object.fromEntries(result.state))}`);
-    for (const entry of result.logs ?? []) say(`log      ${entry}`);
+    if (result.files.size > 0) say(`${dim("files")}    ${[...result.files.keys()].join(", ")}`);
+    if (result.state.size > 0) say(`${dim("state")}    ${JSON.stringify(Object.fromEntries(result.state))}`);
+    for (const entry of result.logs ?? []) say(`${dim("log")}      ${entry}`);
     for (const [host, enforced] of denied) {
       say(
-        enforced ? `egress   blocked ${host} \u2014 not in allowedDomains` : `! egress ${host} is not allowed on the platform unless the plugin declares it. Add "allowedDomains": ["${host}"] to the test file to check with the same rule.`
+        enforced ? `${dim("egress")}   ${red(`blocked ${host}`)} \u2014 not in allowedDomains` : yellow(`! egress ${host} is not allowed on the platform unless the plugin declares it. `) + `Add "allowedDomains": ["${host}"] to the test file to check with the same rule.`
       );
     }
     if (persist) {
       const refused = await savePersisted(target.dir, result.files, result.state);
-      say(`kept     storage and state in ${relative3(process.cwd(), join3(target.dir, ".visualautomate")) || ".visualautomate"}`);
-      for (const path of refused) say(`! storage path "${path}" points outside the storage folder and was not written`);
+      say(`${dim("kept")}     ${dim(`storage and state in ${relative3(process.cwd(), join4(target.dir, ".visualautomate")) || ".visualautomate"}`)}`);
+      for (const path of refused) say(yellow(`! storage path "${path}" points outside the storage folder and was not written`));
     }
     if (port && outputs.length > 0 && !outputs.includes(port)) {
       say(
-        `! This returned output "${port}", which manifest.json does not list (it has ${outputs.map((o) => `"${o}"`).join(", ")}). On a canvas nothing would follow it.`
+        yellow(
+          `! This returned output "${port}", which manifest.json does not list (it has ${outputs.map((o) => `"${o}"`).join(", ")}). On a canvas nothing would follow it.`
+        )
       );
     }
     return passed;
   } catch (error) {
-    say(`\u2717 ${error instanceof Error ? error.message : String(error)}`);
+    say(red(`\u2717 ${error instanceof Error ? error.message : String(error)}`));
     return false;
   }
 }
@@ -2492,14 +2692,17 @@ async function runTargets(targets, flags) {
   for (const target of targets) {
     if (await runTarget(target, flags, targets.length > 1)) passed++;
   }
-  if (targets.length > 1) ok(`
-${passed} of ${targets.length} passed`);
+  if (targets.length > 1) {
+    const tally = `${passed} of ${targets.length} passed`;
+    ok(`
+${passed === targets.length ? green(bold(tally)) : red(bold(tally))}`);
+  }
   return passed === targets.length;
 }
 function packageLoader(dir) {
-  const fromProject = createRequire(join3(dir, "noop.js"));
+  const fromProject = createRequire(join4(dir, "noop.js"));
   const imageDir = process.env.VISUALAUTOMATE_PACKAGES;
-  const fromImage = imageDir ? createRequire(join3(imageDir, "noop.js")) : null;
+  const fromImage = imageDir ? createRequire(join4(imageDir, "noop.js")) : null;
   return (name) => {
     try {
       return fromProject(name);
@@ -2559,28 +2762,103 @@ function sayWhatRuns(targets, picked) {
     return;
   }
   ok(`Running ${targets.length} modules: ${targets.map((t) => t.name.replace(/^modules\//, "")).join(", ")}`);
-  if (!picked) ok(`One of them: vsa dev ${targets[0].name.replace(/^modules\//, "")}`);
+  if (!picked) ok(dim(`One of them: vsa dev ${targets[0].name.replace(/^modules\//, "")}`));
+}
+function keepTypes() {
+  try {
+    return ensureRepoTypes(projectRoot(process.cwd()), VERSION);
+  } catch {
+    return [];
+  }
+}
+async function cmdTypes() {
+  const root = projectRoot(process.cwd());
+  const written = ensureRepoTypes(root, VERSION);
+  if (written.length === 0) {
+    ok(`${TYPES_FILE} and ${JSCONFIG_FILE} are already what this CLI writes.`);
+    return;
+  }
+  ok(green(`\u2713 Wrote ${written.join(" and ")}`));
+  ok(dim("Your editor now completes input, config and context. Name the type above module.exports:"));
+  ok(dim("  /** @type {PluginModule} */"));
 }
 async function cmdTest(args, flags) {
   const targets = targetsOrFail(args, flags);
+  keepTypes();
   if (flags.docker) prepareSandbox(flags);
   const passed = flags.docker ? runTargetsInDocker(targets, targets, flags) : await runTargets(targets, flags);
   if (!passed) process.exitCode = 1;
 }
+async function cmdAddProperty(args, flags) {
+  const [type, name, description, value] = args;
+  if (!type || !name) {
+    fail(
+      `What property? vsa add:property <type> <name> [description] [default]
+  vsa add:property string apiKey "The key to call with"
+  vsa add:property number retries "How many times to try again" 2
+Types: ${PROPERTY_TYPES.join(", ")}`
+    );
+  }
+  if (!isPropertyType(type)) {
+    fail(`There is no "${type}" property. Types: ${PROPERTY_TYPES.join(", ")}`);
+  }
+  if (!isPropertyName(name)) {
+    fail(`"${name}" is not a name your code can read: config.${name} has to be something you can write.`);
+  }
+  const targets = targetsOrFail([], flags);
+  if (targets.length > 1) {
+    const names2 = targets.map((t) => t.name.replace(/^modules\//, ""));
+    fail(
+      `Which module? This repository has ${names2.join(", ")}.
+  vsa add:property ${type} ${name} --module ${names2[0]}`
+    );
+  }
+  const target = targets[0];
+  const file2 = join4(target.dir, "manifest.json");
+  if (!existsSync4(file2)) fail(`${target.name} has no manifest.json.`);
+  const text = await readFile3(file2, "utf8");
+  if (hasProperty(text, name)) {
+    fail(`${target.name} already has a property called ${name}. Change it in ${target.name}/manifest.json.`);
+  }
+  let next;
+  try {
+    next = withProperty(
+      text,
+      name,
+      buildProperty({
+        type,
+        name,
+        description,
+        value,
+        label: flags.label,
+        required: flags.required === "true",
+        options: flags.options,
+        provider: flags.provider
+      })
+    );
+  } catch (error) {
+    fail(error instanceof Error ? error.message : String(error));
+  }
+  await writeFile2(file2, next, "utf8");
+  ok(green(`\u2713 Added ${name} to ${target.name}`));
+  ok(dim(`  Read it in your code as config.${name}`));
+}
 async function cmdDev(args, flags) {
   const root = process.cwd();
   const picked = args[0] ?? flags.module;
   let targets = targetsOrFail(args, flags);
+  const typesWritten = keepTypes();
   const inSandbox = flags.local !== "true";
   if (inSandbox) prepareSandbox(flags);
   const header = () => {
     process.stdout.write("\x1Bc");
-    ok(`vsa dev \u2014 ${(/* @__PURE__ */ new Date()).toLocaleTimeString()} \u2014 Ctrl+C to stop`);
+    ok(`${bold("vsa dev")} ${dim(`\u2014 ${(/* @__PURE__ */ new Date()).toLocaleTimeString()} \u2014 Ctrl+C to stop`)}`);
   };
   const run = async (chosen) => inSandbox ? runTargetsInDocker(chosen, targets, flags) : runTargets(chosen, flags);
   header();
-  ok(inSandbox ? `in ${imageFor(flags)}, tier ${flags.tier || "standard"}` : "on this machine, not in the sandbox");
+  ok(dim(inSandbox ? `in ${imageFor(flags)}, tier ${flags.tier || "standard"}` : "on this machine, not in the sandbox"));
   sayWhatRuns(targets, Boolean(picked));
+  if (typesWritten.length > 0) ok(dim(`Wrote ${typesWritten.join(" and ")} \u2014 your editor now knows what context is`));
   await run(targets);
   const ignored = [`${sep2}node_modules${sep2}`, `${sep2}.git${sep2}`, `${sep2}dist${sep2}`, `${sep2}.visualautomate${sep2}`];
   const pending = /* @__PURE__ */ new Set();
@@ -2598,20 +2876,20 @@ async function cmdDev(args, flags) {
       targets = findTargets(root, picked);
     } catch (error) {
       header();
-      ok(`\u2717 ${error instanceof Error ? error.message : String(error)}`);
+      ok(red(`\u2717 ${error instanceof Error ? error.message : String(error)}`));
       running = false;
       return;
     }
     const hit = changed.map((path) => targetForPath(targets, path));
     const chosen = hit.some((t) => t === null) ? targets : [...new Set(hit)];
     header();
-    ok(`changed: ${changed.map((p) => relative3(root, p)).join(", ")}`);
+    ok(dim(`changed: ${changed.map((p) => relative3(root, p)).join(", ")}`));
     await run(chosen);
     running = false;
   };
   const watcher = watch(root, { recursive: true }, (_event, name) => {
     if (!name) return;
-    const path = join3(root, name.toString());
+    const path = join4(root, name.toString());
     if (ignored.some((part) => `${sep2}${relative3(root, path)}${sep2}`.includes(part))) return;
     pending.add(path);
     if (timer) clearTimeout(timer);
@@ -2624,104 +2902,16 @@ async function cmdDev(args, flags) {
     });
   });
 }
-async function cmdPush(flags) {
-  const dir = process.cwd();
-  const { token, apiUrl } = await tokenFor(flags);
-  const metaPath = join3(dir, "plugin.json");
-  const pkgPath = join3(dir, "package.json");
-  const metaFile = existsSync3(metaPath) ? metaPath : existsSync3(pkgPath) ? pkgPath : null;
-  if (!metaFile) {
-    fail("No plugin.json here. Run `visualautomate init <name>` to start a plugin.");
-  }
-  const meta = JSON.parse(await readFile3(metaFile, "utf8"));
-  if (!meta.name) fail(`${metaFile} has no "name".`);
-  if (!meta.version || !/^\d+\.\d+\.\d+$/.test(meta.version)) {
-    fail(`${metaFile} needs a "version" like 1.0.0.`);
-  }
-  const manifestPath = resolve3(process.cwd(), "manifest.json");
-  let parsed = {};
-  let manifest = null;
-  if (existsSync3(manifestPath)) {
-    try {
-      const result = parseJsonc(await readFile3(manifestPath, "utf8"));
-      parsed = result.value;
-      manifest = result.json;
-    } catch (error) {
-      fail(`manifest.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
-    }
-  }
-  const entry = ["plugin.ts", "plugin.js", "index.ts", "index.js"].map((f) => join3(dir, f)).find((f) => existsSync3(f));
-  if (!entry) {
-    fail("No plugin.ts or plugin.js here. Run `visualautomate init <name>` to start one.");
-  }
-  let code;
-  try {
-    code = await bundlePlugin(entry);
-  } catch (error) {
-    fail(error instanceof Error ? error.message : String(error));
-  }
-  let schemaJson = null;
-  if (!manifest) {
-    const source = await readFile3(entry, "utf8");
-    const match = source.match(/@schema\s*\n([\s\S]*?)(?:\*\s*\/|\*\/)/);
-    if (match) {
-      schemaJson = match[1].replace(/^\s*\*\s?/gm, "").trim();
-      try {
-        parsed = JSON.parse(schemaJson);
-      } catch (error) {
-        fail(`The @schema block is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
-      }
-    }
-  }
-  if (!manifest && !schemaJson) {
-    fail(
-      "This plugin declares nothing, so it would have no fields, no ports and no trigger \u2014\nthe canvas would show an empty box. Add a manifest.json next to your code (run\n`visualautomate init` somewhere to see one), or keep an @schema block in the source."
-    );
-  }
-  ok(`Pushing ${meta.name}@${meta.version} to ${apiUrl}...`);
-  const res = await fetch(`${apiUrl}/api/plugins/push`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({
-      name: meta.name,
-      version: meta.version,
-      description: meta.description ?? parsed.description ?? "",
-      category: meta.category ?? "utility",
-      icon: meta.icon ?? parsed.icon ?? "plugin",
-      // Whichever the author actually has. The route takes either.
-      ...manifest ? { manifest } : { schemaJson },
-      code
-    })
-  });
-  const text = await res.text();
-  let data = {};
-  try {
-    data = JSON.parse(text);
-  } catch {
-    fail(`The server answered ${res.status} with something that is not JSON:
-${text.slice(0, 500)}`);
-  }
-  if (res.status === 401) {
-    fail("Your session has expired. Run `visualautomate login` again.");
-  }
-  if (!res.ok || !data.success) {
-    fail(`Push refused: ${data.error ?? `status ${res.status}`}`);
-  }
-  ok(`
-\u2713 Published (id: ${data.pluginId})`);
-  ok(`  A version snapshot was saved, so you can roll back from the dashboard.`);
-}
 function printHelp() {
   console.log(`
-vsa \u2014 build and publish VisualAutomate plugins
+vsa \u2014 build and test VisualAutomate plugins
 
-  vsa login                    sign this machine in
   vsa init <name> [--template] start a plugin
   vsa dev [<module>]           the sandbox, and a run again on every save
   vsa test [<module>]          run it once, as the platform's check does
-  vsa push                     publish it
-  vsa whoami                   which account this is
-  vsa logout                   forget the token
+  vsa types                    write the types your editor reads
+  vsa add:property <type> <name> [description] [default]
+                               add a field to a module's manifest
   vsa --version                this CLI's version
 
 \`va\` and \`visualautomate\` are the same command.
@@ -2733,6 +2923,15 @@ GitHub repository, and at the root of an app's repository, where every folder
 in modules/ is run (or the one you name: vsa dev send-message). The run's settings come
 from visualautomate.test.json, test.json, or --input <file>.
 
+Options for \`add:property\`:
+  --module <name>      which module, from the root of an app's repository
+  --required           the workflow will not run without it
+  --label <text>       instead of one made from the name
+  --options <list>     for select and multiselect: "Fast:fast,Thorough:thorough"
+  --provider <name>    for connection: whose account this is
+
+Property types: ${PROPERTY_TYPES.join(", ")}
+
 Options for \`dev\` and \`test\`:
   --module <name>      the same as naming it: vsa dev send-message
   --tier <name>        the sandbox's size: standard, boosted, high or max
@@ -2741,9 +2940,9 @@ Options for \`dev\` and \`test\`:
   --local              \`dev\` without the sandbox, on this machine's Node
   --docker             \`test\` inside the sandbox, as \`dev\` does
 
-Environment (for CI, where there is no browser):
-  VISUALAUTOMATE_API_TOKEN   use instead of \`login\`
-  VISUALAUTOMATE_API_URL     a different installation
+Your plugin reaches the platform through its GitHub repository: push a commit,
+the tests run there, and Publish on the portal takes it from the commit that
+passed. Nothing here needs an account.
 `);
 }
 function parse(argv) {
@@ -2769,28 +2968,22 @@ async function main() {
     return;
   }
   switch (command) {
-    case "login":
-      return cmdLogin(flags);
-    case "logout":
-      return cmdLogout();
-    case "whoami":
-      return cmdWhoami(flags);
     case "init":
     case "new":
       return cmdInit(args, flags);
     case "test":
       return cmdTest(args, flags);
+    case "types":
+      return cmdTypes();
+    case "add:property":
+    case "add:prop":
+      return cmdAddProperty(args, flags);
     case "dev":
     case "watch":
       return cmdDev(args, flags);
-    case "push":
-    case "publish":
-      return cmdPush(flags);
-    // `plugin test` and `plugin push` are accepted as aliases.
+    // `plugin test` is accepted as an alias.
     case "plugin": {
-      const sub = args.shift();
-      if (sub === "test") return cmdTest(args, flags);
-      if (sub === "push") return cmdPush(flags);
+      if (args.shift() === "test") return cmdTest(args, flags);
       printHelp();
       return;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@visualautomate/cli",
-  "version": "0.5.1",
-  "description": "Build and publish VisualAutomate plugins.",
+  "version": "0.6.0",
+  "description": "Build and test VisualAutomate plugins.",
   "license": "MIT",
   "type": "module",
   "bin": {