@zhama/tego-plugin-sdk 0.0.0-stage → 1.36.0

package/dist/server.js

@@ -0,0 +1 @@
+export{PLUGIN_COLLECTION_CONTENT_PAGE_MAX,PLUGIN_COLLECTION_IMPORT_MAX,PLUGIN_CONTEXT_HEADERS,accountInvitationSchema,accountInviteSchema,accountPasswordResetSchema,accountProvisionSchema,definePluginBackend,directoryIdentitySchema,directoryListSchema,directoryMatchSchema,directoryPrincipalSchema,directoryValidateSchema,pluginAdminActionSchema,pluginAdminProofSchema,pluginApprovalDigestSchema,pluginApprovedSchema,pluginCollectionAccessSchema,pluginCollectionDeleteSchema,pluginCollectionDocumentContentSchema,pluginCollectionDocumentsStatusSchema,pluginCollectionEnsureSchema,pluginCollectionImportFilesSchema,pluginCollectionImportSchema,pluginCollectionMoveSchema,pluginCollectionPermissionsSchema,pluginCollectionRemoveSchema,pluginCollectionSearchSchema,pluginCollectionStatusSchema,pluginDiagramSchema,pluginDocumentBatchInputSchema,pluginDocumentBatchItemSchema,pluginDocumentContentInputSchema,pluginKnowledgeBaseInputSchema,pluginKnowledgeListInputSchema,pluginKnowledgeReferenceSchema,pluginKnowledgeVerifySchema}from"./chunk-QKSPPMVN.js";

package/dist/testing.cjs

@@ -0,0 +1,2 @@
+"use strict";var A=Object.defineProperty;var a=(s,l)=>A(s,"name",{value:l,configurable:!0});var crypto=require("crypto"),promises=require("fs/promises"),path=require("path"),DEFAULT_DATABASE_URL=process.env.TEST_DATABASE_URL??"postgresql://zhama:zhama123321@localhost:15432/zhama",TEST_TENANT_ID="00000000-0000-4000-8000-00000000a001";async function createTestPluginHost(s){const{Pool:l}=await import("pg"),c=s.databaseUrl??DEFAULT_DATABASE_URL,u=`plugintest_${(s.label??s.pluginId).replace(/[^a-z0-9]+/gi,"_")}_${Math.random().toString(36).slice(2,8)}`,w=new l({connectionString:c});await w.query(`CREATE SCHEMA "${u}"`);const p=await w.connect();try{await p.query(`SET search_path TO "${u}"`);for(const e of await migrationFiles(s.migrationsDir))await p.query(await promises.readFile(e,"utf8"))}finally{p.release()}await w.end();const f=new l({connectionString:c,options:`-c search_path=${u}`}),m=[],b=[],r=new Map,o=new Map;let T=!1,h={...s.config??{}};const E={query:a(async(e,t)=>(await f.query(e,t)).rows,"query"),transaction:a(async e=>{const t=await f.connect();try{await t.query("BEGIN");const n=await e({query:a(async(i,g)=>(await t.query(i,g)).rows,"query")});return await t.query("COMMIT"),n}catch(n){throw await t.query("ROLLBACK"),n}finally{t.release()}},"transaction")};return{host:{pluginId:s.pluginId,tenantId:s.tenantId??TEST_TENANT_ID,db:E,storage:{put:a(async(e,t,n)=>{r.set(e,t),o.set(e,n??"application/octet-stream")},"put"),copy:a(async(e,t)=>{const n=r.get(e);if(!n)throw new Error("Object not found");r.set(t,n.slice());const i=o.get(e)??"application/octet-stream";return o.set(t,i),{size:n.byteLength,contentType:i}},"copy"),getStream:a(async e=>{const t=r.get(e);return t?new ReadableStream({start(n){n.enqueue(t.slice()),n.close()}}):null},"getStream"),putStream:a(async(e,t,n)=>{const i=t.getReader(),g=[];let d=0;try{for(;;){const y=await i.read();if(y.done)break;if(g.push(y.value),d+=y.value.byteLength,d>n.sizeBytes)throw new Error("Stream exceeds declared size")}}finally{i.releaseLock()}if(d!==n.sizeBytes)throw new Error("Stream size mismatch");const q=new Uint8Array(d);let S=0;for(const y of g)q.set(y,S),S+=y.byteLength;r.set(e,q),o.set(e,n.contentType??"application/octet-stream")},"putStream"),get:a(async(e,t)=>{const n=r.get(e);return n?t?.firstBytes===void 0?n:n.subarray(0,t.firstBytes):null},"get"),head:a(async e=>{const t=r.get(e);return t?{size:t.byteLength,contentType:o.get(e)??null,versionTag:crypto.createHash("sha256").update(t).digest("hex")}:null},"head"),delete:a(async e=>{r.delete(e),o.delete(e)},"delete"),signedUrl:a(async e=>`https://storage.test/${e}`,"signedUrl"),signedPath:a(async e=>`/storage.test/${e}`,"signedPath"),managedPath:a(async e=>`/storage.test/${e}`,"managedPath"),uploadPath:a(async(e,t)=>({path:`/storage.test/upload/${e}`,maxBytes:t?.maxBytes??512*1024*1024,expiresAt:Date.now()+(t?.ttlSeconds??300)*1e3}),"uploadPath")},log:{debug:a(()=>{},"debug"),info:a(()=>{},"info"),warn:a(()=>{},"warn"),error:a((e,t)=>{b.push({message:e,...t?{fields:t}:{}})},"error")},events:{publish:a(async(e,t)=>{if(T)throw new Error("the event bus is down");m.push({topic:e,payload:t})},"publish")},notifications:{send:a(async()=>({id:crypto.randomUUID()}),"send")},config:{current:a(()=>h,"current"),refresh:a(async()=>h,"refresh")}},schema:u,publishedEvents:m,loggedErrors:b,storedObjects:r,failPublish:a((e=!0)=>{T=e},"failPublish"),setConfig:a(e=>{h={...e}},"setConfig"),reset:a(async()=>{const e=await E.query(`select quote_ident(tablename) as name
+           from pg_tables where schemaname = $1`,[u]);e.length>0&&await E.query(`truncate table ${e.map(t=>t.name).join(", ")} restart identity cascade`),m.length=0,b.length=0,r.clear(),o.clear(),T=!1,h={...s.config??{}}},"reset"),close:a(async()=>{await f.end();const e=new l({connectionString:c});await e.query(`DROP SCHEMA "${u}" CASCADE`),await e.end()},"close")}}a(createTestPluginHost,"createTestPluginHost");async function migrationFiles(s){return(await promises.readdir(s)).filter(c=>c.endsWith(".sql")).sort().map(c=>path.join(s,c))}a(migrationFiles,"migrationFiles"),exports.TEST_TENANT_ID=TEST_TENANT_ID,exports.createTestPluginHost=createTestPluginHost;

package/dist/testing.d.cts

@@ -0,0 +1,92 @@
+import { PluginHostApi } from './server.cjs';
+import 'zod';
+import './frontend.cjs';
+
+/**
+ * Test helpers for a plugin's backend part.
+ *
+ * A plugin backend's interesting code is its SQL — multi-table writes in one
+ * transaction, `FOR UPDATE SKIP LOCKED`, partial unique indexes — and none of
+ * that means anything against a fake. So this stands up the real thing: a
+ * throwaway Postgres schema with the plugin's own migrations applied, behind
+ * the same `PluginScopedDb` the host hands a running backend, plus recording
+ * doubles for the parts of the host API that have no local equivalent.
+ *
+ * Without it every plugin rewrites the same ~150 lines, and each copy gets the
+ * transaction semantics slightly differently — which is exactly the thing that
+ * has to match production, because a body whose statements land on pooled
+ * connections is not a transaction at all and the test would still pass.
+ *
+ * Not part of the barrel: it imports `pg` and `node:fs`.
+ */
+
+interface TestPluginHostOptions {
+    pluginId: string;
+    /** Absolute path to the part's `migrations` directory. */
+    migrationsDir: string;
+    /** Defaults to `TEST_DATABASE_URL`, then the monorepo's test Postgres. */
+    databaseUrl?: string;
+    /**
+     * Distinguishes the schemas of suites running against the same database.
+     * Defaults to the plugin id.
+     */
+    label?: string;
+    /**
+     * What `host.config.current()` answers — the backend section an operator
+     * would have filled in. Defaults to empty, which is what a backend that
+     * declares no required settings gets.
+     */
+    config?: Record<string, unknown>;
+    /** What `host.tenantId` answers. Defaults to {@link TEST_TENANT_ID}. */
+    tenantId?: string;
+}
+/** The tenant a test host belongs to unless the suite names its own. */
+declare const TEST_TENANT_ID = "00000000-0000-4000-8000-00000000a001";
+interface TestPluginHost {
+    /** Pass this straight to the backend module's `fetch`. */
+    host: PluginHostApi;
+    /** The schema this suite owns, for assertions that have to name it. */
+    schema: string;
+    /** Every `events.publish` the backend made, oldest first. */
+    publishedEvents: {
+        topic: string;
+        payload: unknown;
+    }[];
+    /** Every `log.error` the backend made. The other levels are dropped. */
+    loggedErrors: {
+        message: string;
+        fields?: Record<string, unknown>;
+    }[];
+    /** Objects written through `host.storage`, keyed as the backend keyed them. */
+    storedObjects: Map<string, Uint8Array>;
+    /**
+     * Make `events.publish` throw until turned off again.
+     *
+     * A backend that lets a failed announcement undo a committed write is a real
+     * bug, and there is otherwise no way to reach it from a test. Sticky rather
+     * than one-shot because a single request may publish more than once, and a
+     * one-shot flag would let the second publish succeed and mask the case.
+     */
+    failPublish(enabled?: boolean): void;
+    /** Replace what `host.config` answers, for a test that changes a setting mid-suite. */
+    setConfig(values: Record<string, unknown>): void;
+    /** Truncate every table and clear the recorders. Cheap enough for `beforeEach`. */
+    reset(): Promise<void>;
+    /** Drop the schema and close the pools. */
+    close(): Promise<void>;
+}
+/**
+ * Create the schema, apply the migrations, and return a host API over it.
+ *
+ * ```ts
+ * const harness = await createTestPluginHost({
+ *   pluginId: 'acme-crm',
+ *   migrationsDir: new URL('../migrations', import.meta.url).pathname,
+ * });
+ * afterAll(() => harness.close());
+ * beforeEach(() => harness.reset());
+ * ```
+ */
+declare function createTestPluginHost(options: TestPluginHostOptions): Promise<TestPluginHost>;
+
+export { TEST_TENANT_ID, type TestPluginHost, type TestPluginHostOptions, createTestPluginHost };

package/dist/testing.d.ts

@@ -0,0 +1,92 @@
+import { PluginHostApi } from './server.js';
+import 'zod';
+import './frontend.js';
+
+/**
+ * Test helpers for a plugin's backend part.
+ *
+ * A plugin backend's interesting code is its SQL — multi-table writes in one
+ * transaction, `FOR UPDATE SKIP LOCKED`, partial unique indexes — and none of
+ * that means anything against a fake. So this stands up the real thing: a
+ * throwaway Postgres schema with the plugin's own migrations applied, behind
+ * the same `PluginScopedDb` the host hands a running backend, plus recording
+ * doubles for the parts of the host API that have no local equivalent.
+ *
+ * Without it every plugin rewrites the same ~150 lines, and each copy gets the
+ * transaction semantics slightly differently — which is exactly the thing that
+ * has to match production, because a body whose statements land on pooled
+ * connections is not a transaction at all and the test would still pass.
+ *
+ * Not part of the barrel: it imports `pg` and `node:fs`.
+ */
+
+interface TestPluginHostOptions {
+    pluginId: string;
+    /** Absolute path to the part's `migrations` directory. */
+    migrationsDir: string;
+    /** Defaults to `TEST_DATABASE_URL`, then the monorepo's test Postgres. */
+    databaseUrl?: string;
+    /**
+     * Distinguishes the schemas of suites running against the same database.
+     * Defaults to the plugin id.
+     */
+    label?: string;
+    /**
+     * What `host.config.current()` answers — the backend section an operator
+     * would have filled in. Defaults to empty, which is what a backend that
+     * declares no required settings gets.
+     */
+    config?: Record<string, unknown>;
+    /** What `host.tenantId` answers. Defaults to {@link TEST_TENANT_ID}. */
+    tenantId?: string;
+}
+/** The tenant a test host belongs to unless the suite names its own. */
+declare const TEST_TENANT_ID = "00000000-0000-4000-8000-00000000a001";
+interface TestPluginHost {
+    /** Pass this straight to the backend module's `fetch`. */
+    host: PluginHostApi;
+    /** The schema this suite owns, for assertions that have to name it. */
+    schema: string;
+    /** Every `events.publish` the backend made, oldest first. */
+    publishedEvents: {
+        topic: string;
+        payload: unknown;
+    }[];
+    /** Every `log.error` the backend made. The other levels are dropped. */
+    loggedErrors: {
+        message: string;
+        fields?: Record<string, unknown>;
+    }[];
+    /** Objects written through `host.storage`, keyed as the backend keyed them. */
+    storedObjects: Map<string, Uint8Array>;
+    /**
+     * Make `events.publish` throw until turned off again.
+     *
+     * A backend that lets a failed announcement undo a committed write is a real
+     * bug, and there is otherwise no way to reach it from a test. Sticky rather
+     * than one-shot because a single request may publish more than once, and a
+     * one-shot flag would let the second publish succeed and mask the case.
+     */
+    failPublish(enabled?: boolean): void;
+    /** Replace what `host.config` answers, for a test that changes a setting mid-suite. */
+    setConfig(values: Record<string, unknown>): void;
+    /** Truncate every table and clear the recorders. Cheap enough for `beforeEach`. */
+    reset(): Promise<void>;
+    /** Drop the schema and close the pools. */
+    close(): Promise<void>;
+}
+/**
+ * Create the schema, apply the migrations, and return a host API over it.
+ *
+ * ```ts
+ * const harness = await createTestPluginHost({
+ *   pluginId: 'acme-crm',
+ *   migrationsDir: new URL('../migrations', import.meta.url).pathname,
+ * });
+ * afterAll(() => harness.close());
+ * beforeEach(() => harness.reset());
+ * ```
+ */
+declare function createTestPluginHost(options: TestPluginHostOptions): Promise<TestPluginHost>;
+
+export { TEST_TENANT_ID, type TestPluginHost, type TestPluginHostOptions, createTestPluginHost };

package/dist/testing.js

@@ -0,0 +1,2 @@
+var _=Object.defineProperty;var a=(s,l)=>_(s,"name",{value:l,configurable:!0});import{randomUUID as $,createHash as z}from"crypto";import{readFile as v,readdir as B}from"fs/promises";import{join as L}from"path";var D=process.env.TEST_DATABASE_URL??"postgresql://zhama:zhama123321@localhost:15432/zhama",A="00000000-0000-4000-8000-00000000a001";async function I(s){const{Pool:l}=await import("pg"),c=s.databaseUrl??D,u=`plugintest_${(s.label??s.pluginId).replace(/[^a-z0-9]+/gi,"_")}_${Math.random().toString(36).slice(2,8)}`,w=new l({connectionString:c});await w.query(`CREATE SCHEMA "${u}"`);const m=await w.connect();try{await m.query(`SET search_path TO "${u}"`);for(const e of await U(s.migrationsDir))await m.query(await v(e,"utf8"))}finally{m.release()}await w.end();const f=new l({connectionString:c,options:`-c search_path=${u}`}),p=[],b=[],r=new Map,o=new Map;let E=!1,h={...s.config??{}};const T={query:a(async(e,t)=>(await f.query(e,t)).rows,"query"),transaction:a(async e=>{const t=await f.connect();try{await t.query("BEGIN");const n=await e({query:a(async(i,g)=>(await t.query(i,g)).rows,"query")});return await t.query("COMMIT"),n}catch(n){throw await t.query("ROLLBACK"),n}finally{t.release()}},"transaction")};return{host:{pluginId:s.pluginId,tenantId:s.tenantId??A,db:T,storage:{put:a(async(e,t,n)=>{r.set(e,t),o.set(e,n??"application/octet-stream")},"put"),copy:a(async(e,t)=>{const n=r.get(e);if(!n)throw new Error("Object not found");r.set(t,n.slice());const i=o.get(e)??"application/octet-stream";return o.set(t,i),{size:n.byteLength,contentType:i}},"copy"),getStream:a(async e=>{const t=r.get(e);return t?new ReadableStream({start(n){n.enqueue(t.slice()),n.close()}}):null},"getStream"),putStream:a(async(e,t,n)=>{const i=t.getReader(),g=[];let d=0;try{for(;;){const y=await i.read();if(y.done)break;if(g.push(y.value),d+=y.value.byteLength,d>n.sizeBytes)throw new Error("Stream exceeds declared size")}}finally{i.releaseLock()}if(d!==n.sizeBytes)throw new Error("Stream size mismatch");const S=new Uint8Array(d);let q=0;for(const y of g)S.set(y,q),q+=y.byteLength;r.set(e,S),o.set(e,n.contentType??"application/octet-stream")},"putStream"),get:a(async(e,t)=>{const n=r.get(e);return n?t?.firstBytes===void 0?n:n.subarray(0,t.firstBytes):null},"get"),head:a(async e=>{const t=r.get(e);return t?{size:t.byteLength,contentType:o.get(e)??null,versionTag:z("sha256").update(t).digest("hex")}:null},"head"),delete:a(async e=>{r.delete(e),o.delete(e)},"delete"),signedUrl:a(async e=>`https://storage.test/${e}`,"signedUrl"),signedPath:a(async e=>`/storage.test/${e}`,"signedPath"),managedPath:a(async e=>`/storage.test/${e}`,"managedPath"),uploadPath:a(async(e,t)=>({path:`/storage.test/upload/${e}`,maxBytes:t?.maxBytes??512*1024*1024,expiresAt:Date.now()+(t?.ttlSeconds??300)*1e3}),"uploadPath")},log:{debug:a(()=>{},"debug"),info:a(()=>{},"info"),warn:a(()=>{},"warn"),error:a((e,t)=>{b.push({message:e,...t?{fields:t}:{}})},"error")},events:{publish:a(async(e,t)=>{if(E)throw new Error("the event bus is down");p.push({topic:e,payload:t})},"publish")},notifications:{send:a(async()=>({id:$()}),"send")},config:{current:a(()=>h,"current"),refresh:a(async()=>h,"refresh")}},schema:u,publishedEvents:p,loggedErrors:b,storedObjects:r,failPublish:a((e=!0)=>{E=e},"failPublish"),setConfig:a(e=>{h={...e}},"setConfig"),reset:a(async()=>{const e=await T.query(`select quote_ident(tablename) as name
+           from pg_tables where schemaname = $1`,[u]);e.length>0&&await T.query(`truncate table ${e.map(t=>t.name).join(", ")} restart identity cascade`),p.length=0,b.length=0,r.clear(),o.clear(),E=!1,h={...s.config??{}}},"reset"),close:a(async()=>{await f.end();const e=new l({connectionString:c});await e.query(`DROP SCHEMA "${u}" CASCADE`),await e.end()},"close")}}a(I,"createTestPluginHost");async function U(s){return(await B(s)).filter(c=>c.endsWith(".sql")).sort().map(c=>L(s,c))}a(U,"migrationFiles");export{A as TEST_TENANT_ID,I as createTestPluginHost};

package/dist/vite.cjs

@@ -0,0 +1 @@
+"use strict";var n=Object.defineProperty;var e=(r,t)=>n(r,"name",{value:t,configurable:!0});var chunkW7C357A6_cjs=require("./chunk-W7C357A6.cjs");require("./chunk-C2OCOPZQ.cjs"),Object.defineProperty(exports,"TEGO_PLUGIN_DEV_OVERRIDES",{enumerable:!0,get:e(function(){return chunkW7C357A6_cjs.TEGO_PLUGIN_DEV_OVERRIDES},"get")}),Object.defineProperty(exports,"tegoPluginFrontend",{enumerable:!0,get:e(function(){return chunkW7C357A6_cjs.tegoPluginFrontend},"get")}),Object.defineProperty(exports,"tegoPluginTailwind",{enumerable:!0,get:e(function(){return chunkW7C357A6_cjs.tegoPluginTailwind},"get")});

package/dist/vite.d.cts

@@ -0,0 +1,133 @@
+import { UserConfig } from 'vite';
+
+/**
+ * The Tailwind config a plugin frontend compiles its own utilities with.
+ *
+ * A plugin's CSS is inlined into its bundle and lands in the shell's document,
+ * next to the shell's own stylesheet. Three things make that safe, and each
+ * one, left out, produces a plugin that builds fine and then looks wrong
+ * inside the shell:
+ *
+ * - The design tokens come from `@tego/ui`'s preset, the same one the shell
+ *   compiles with, so `bg-primary` means the same colour on both sides.
+ * - Preflight is off: the shell already ships the reset, and a second copy
+ *   loaded later would restyle the shell's own elements.
+ * - Every utility is scoped under `.<pluginId>`, the class the shell puts on
+ *   the plugin's root, so a plugin's `.hidden` cannot hide shell UI.
+ *
+ * Content also covers the compiled `@tego/ui` and `@tego/plugin-access-ui`
+ * code, because their components carry class names the plugin's bundle must
+ * define: the shell does not compile classes for components it never renders
+ * itself.
+ *
+ * Resolution starts from `root` — the plugin's frontend directory — so the
+ * same call works inside this repo and in a plugin installed from npm.
+ * `tailwindcss` stays the plugin's own dependency; this returns plain config:
+ *
+ * ```ts
+ * import tailwindcss from 'tailwindcss';
+ * import { tegoPluginTailwind } from '@tego/plugin-sdk/vite';
+ *
+ * config.css = {
+ *   postcss: {
+ *     plugins: [
+ *       tailwindcss(
+ *         tegoPluginTailwind({
+ *           pluginId: 'acme-crm',
+ *           root: import.meta.dirname,
+ *           content: [resolve(import.meta.dirname, 'src/**\/*.{ts,tsx}')],
+ *         })
+ *       ),
+ *     ],
+ *   },
+ * };
+ * ```
+ */
+interface TegoPluginTailwindOptions {
+    /** The plugin id; utilities are scoped under `.<pluginId>`. */
+    pluginId: string;
+    /** Directory package resolution starts from: the plugin's frontend dir. */
+    root: string;
+    /** Absolute globs of the plugin's own sources. */
+    content: string[];
+}
+/**
+ * The subset of a Tailwind v3 config this produces, typed so it passes
+ * straight to `tailwindcss(…)` without the SDK depending on tailwindcss.
+ * The preset is `@tego/ui`'s CommonJS module, opaque here.
+ */
+interface TegoPluginTailwindConfig {
+    presets: object[];
+    content: string[];
+    corePlugins: {
+        preflight: false;
+    };
+    important: string;
+}
+declare function tegoPluginTailwind({ pluginId, root, content, }: TegoPluginTailwindOptions): TegoPluginTailwindConfig;
+
+/**
+ * The Vite config a plugin's frontend part is built with.
+ *
+ * Not a convenience wrapper: the shell can only load a bundle that is a
+ * SystemJS module whose shared imports were rewritten to the exact ids the
+ * shell registered. Both of those are one-line mistakes that produce a plugin
+ * which builds cleanly and then fails at load with a message about an unknown
+ * scheme, so the settings live here rather than in every plugin's own config.
+ *
+ * Imported only by a plugin's `vite.config.ts`; `vite` is a peer dependency
+ * and nothing else in the SDK reaches this module.
+ */
+
+interface TegoPluginFrontendOptions {
+    /** Entry module whose default export is the `PluginFrontendModule`. */
+    entry: string;
+    /**
+     * The manifest `id`, stamped onto the inlined `<style>` as
+     * `data-tego-plugin`. The shell removes styles by this attribute when the
+     * plugin page unmounts. Omit it and the attribute is left empty — an older
+     * bundle's behaviour, which the shell leaves in place rather than removing.
+     */
+    pluginId?: string;
+    /** Defaults to `dist`, which is what the packaging step expects. */
+    outDir?: string;
+    /**
+     * Build the development form instead of the distributable one.
+     *
+     * See {@link TEGO_PLUGIN_DEV_OVERRIDES}. `tego-plugin-pack --watch` applies
+     * the same overrides without this flag, so a plugin only needs it when it
+     * drives Vite itself.
+     */
+    development?: boolean;
+}
+/**
+ * The development form, as a config patch.
+ *
+ * What it does *not* change is the point: the module format, the externals and
+ * the browser target stay exactly as they are in a packed archive, because
+ * those are what the shell's loader requires and a bundle that differed there
+ * would not be testing the real thing. It changes only the two things that
+ * make a watch loop unusable — a minified frame in an anonymous SystemJS
+ * module points nowhere, and minifying on every keystroke is the slowest part
+ * of the rebuild.
+ *
+ * Exported so `tego-plugin-pack --watch` and the preset apply one definition
+ * rather than two that can drift.
+ */
+declare const TEGO_PLUGIN_DEV_OVERRIDES: {
+    readonly mode: "development";
+    readonly build: {
+        readonly minify: false;
+        readonly sourcemap: "inline";
+    };
+};
+/**
+ * @example
+ * ```ts
+ * import { tegoPluginFrontend } from '@tego/plugin-sdk/vite';
+ * export default tegoPluginFrontend({ entry: 'src/index.tsx' });
+ * ```
+ */
+declare function tegoPluginFrontend(options: TegoPluginFrontendOptions): UserConfig;
+
+export { TEGO_PLUGIN_DEV_OVERRIDES, type TegoPluginFrontendOptions, type TegoPluginTailwindConfig, type TegoPluginTailwindOptions, tegoPluginFrontend, tegoPluginTailwind };

package/dist/vite.d.ts

@@ -0,0 +1,133 @@
+import { UserConfig } from 'vite';
+
+/**
+ * The Tailwind config a plugin frontend compiles its own utilities with.
+ *
+ * A plugin's CSS is inlined into its bundle and lands in the shell's document,
+ * next to the shell's own stylesheet. Three things make that safe, and each
+ * one, left out, produces a plugin that builds fine and then looks wrong
+ * inside the shell:
+ *
+ * - The design tokens come from `@tego/ui`'s preset, the same one the shell
+ *   compiles with, so `bg-primary` means the same colour on both sides.
+ * - Preflight is off: the shell already ships the reset, and a second copy
+ *   loaded later would restyle the shell's own elements.
+ * - Every utility is scoped under `.<pluginId>`, the class the shell puts on
+ *   the plugin's root, so a plugin's `.hidden` cannot hide shell UI.
+ *
+ * Content also covers the compiled `@tego/ui` and `@tego/plugin-access-ui`
+ * code, because their components carry class names the plugin's bundle must
+ * define: the shell does not compile classes for components it never renders
+ * itself.
+ *
+ * Resolution starts from `root` — the plugin's frontend directory — so the
+ * same call works inside this repo and in a plugin installed from npm.
+ * `tailwindcss` stays the plugin's own dependency; this returns plain config:
+ *
+ * ```ts
+ * import tailwindcss from 'tailwindcss';
+ * import { tegoPluginTailwind } from '@tego/plugin-sdk/vite';
+ *
+ * config.css = {
+ *   postcss: {
+ *     plugins: [
+ *       tailwindcss(
+ *         tegoPluginTailwind({
+ *           pluginId: 'acme-crm',
+ *           root: import.meta.dirname,
+ *           content: [resolve(import.meta.dirname, 'src/**\/*.{ts,tsx}')],
+ *         })
+ *       ),
+ *     ],
+ *   },
+ * };
+ * ```
+ */
+interface TegoPluginTailwindOptions {
+    /** The plugin id; utilities are scoped under `.<pluginId>`. */
+    pluginId: string;
+    /** Directory package resolution starts from: the plugin's frontend dir. */
+    root: string;
+    /** Absolute globs of the plugin's own sources. */
+    content: string[];
+}
+/**
+ * The subset of a Tailwind v3 config this produces, typed so it passes
+ * straight to `tailwindcss(…)` without the SDK depending on tailwindcss.
+ * The preset is `@tego/ui`'s CommonJS module, opaque here.
+ */
+interface TegoPluginTailwindConfig {
+    presets: object[];
+    content: string[];
+    corePlugins: {
+        preflight: false;
+    };
+    important: string;
+}
+declare function tegoPluginTailwind({ pluginId, root, content, }: TegoPluginTailwindOptions): TegoPluginTailwindConfig;
+
+/**
+ * The Vite config a plugin's frontend part is built with.
+ *
+ * Not a convenience wrapper: the shell can only load a bundle that is a
+ * SystemJS module whose shared imports were rewritten to the exact ids the
+ * shell registered. Both of those are one-line mistakes that produce a plugin
+ * which builds cleanly and then fails at load with a message about an unknown
+ * scheme, so the settings live here rather than in every plugin's own config.
+ *
+ * Imported only by a plugin's `vite.config.ts`; `vite` is a peer dependency
+ * and nothing else in the SDK reaches this module.
+ */
+
+interface TegoPluginFrontendOptions {
+    /** Entry module whose default export is the `PluginFrontendModule`. */
+    entry: string;
+    /**
+     * The manifest `id`, stamped onto the inlined `<style>` as
+     * `data-tego-plugin`. The shell removes styles by this attribute when the
+     * plugin page unmounts. Omit it and the attribute is left empty — an older
+     * bundle's behaviour, which the shell leaves in place rather than removing.
+     */
+    pluginId?: string;
+    /** Defaults to `dist`, which is what the packaging step expects. */
+    outDir?: string;
+    /**
+     * Build the development form instead of the distributable one.
+     *
+     * See {@link TEGO_PLUGIN_DEV_OVERRIDES}. `tego-plugin-pack --watch` applies
+     * the same overrides without this flag, so a plugin only needs it when it
+     * drives Vite itself.
+     */
+    development?: boolean;
+}
+/**
+ * The development form, as a config patch.
+ *
+ * What it does *not* change is the point: the module format, the externals and
+ * the browser target stay exactly as they are in a packed archive, because
+ * those are what the shell's loader requires and a bundle that differed there
+ * would not be testing the real thing. It changes only the two things that
+ * make a watch loop unusable — a minified frame in an anonymous SystemJS
+ * module points nowhere, and minifying on every keystroke is the slowest part
+ * of the rebuild.
+ *
+ * Exported so `tego-plugin-pack --watch` and the preset apply one definition
+ * rather than two that can drift.
+ */
+declare const TEGO_PLUGIN_DEV_OVERRIDES: {
+    readonly mode: "development";
+    readonly build: {
+        readonly minify: false;
+        readonly sourcemap: "inline";
+    };
+};
+/**
+ * @example
+ * ```ts
+ * import { tegoPluginFrontend } from '@tego/plugin-sdk/vite';
+ * export default tegoPluginFrontend({ entry: 'src/index.tsx' });
+ * ```
+ */
+declare function tegoPluginFrontend(options: TegoPluginFrontendOptions): UserConfig;
+
+export { TEGO_PLUGIN_DEV_OVERRIDES, type TegoPluginFrontendOptions, type TegoPluginTailwindConfig, type TegoPluginTailwindOptions, tegoPluginFrontend, tegoPluginTailwind };

package/dist/vite.js

@@ -0,0 +1 @@
+export{TEGO_PLUGIN_DEV_OVERRIDES,tegoPluginFrontend,tegoPluginTailwind}from"./chunk-7K37PVGV.js";import"./chunk-7XHF3YSK.js";

package/package.json

@@ -1,6 +1,162 @@
 {
   "name": "@zhama/tego-plugin-sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.36.0",
+  "type": "module",
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs",
+      "default": "./dist/index.js"
+    },
+    "./manifest": {
+      "types": "./dist/manifest.d.ts",
+      "import": "./dist/manifest.js",
+      "require": "./dist/manifest.cjs",
+      "default": "./dist/manifest.js"
+    },
+    "./frontend": {
+      "types": "./dist/frontend.d.ts",
+      "import": "./dist/frontend.js",
+      "require": "./dist/frontend.cjs",
+      "default": "./dist/frontend.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs",
+      "default": "./dist/server.js"
+    },
+    "./access": {
+      "types": "./dist/access.d.ts",
+      "import": "./dist/access.js",
+      "require": "./dist/access.cjs",
+      "default": "./dist/access.js"
+    },
+    "./access/drizzle": {
+      "types": "./dist/access-drizzle.d.ts",
+      "import": "./dist/access-drizzle.js",
+      "require": "./dist/access-drizzle.cjs",
+      "default": "./dist/access-drizzle.js"
+    },
+    "./access/hono": {
+      "types": "./dist/access-hono.d.ts",
+      "import": "./dist/access-hono.js",
+      "require": "./dist/access-hono.cjs",
+      "default": "./dist/access-hono.js"
+    },
+    "./access/implications": {
+      "types": "./dist/access-implications.d.ts",
+      "import": "./dist/access-implications.js",
+      "require": "./dist/access-implications.cjs",
+      "default": "./dist/access-implications.js"
+    },
+    "./access.sql": "./sql/access.sql",
+    "./access-catalog.schema.json": "./access-catalog.schema.json",
+    "./vite": {
+      "types": "./dist/vite.d.ts",
+      "import": "./dist/vite.js",
+      "require": "./dist/vite.cjs",
+      "default": "./dist/vite.js"
+    },
+    "./scaffold": {
+      "types": "./dist/scaffold.d.ts",
+      "import": "./dist/scaffold.js",
+      "require": "./dist/scaffold.cjs",
+      "default": "./dist/scaffold.js"
+    },
+    "./server-runtime": {
+      "types": "./dist/server-runtime.d.ts",
+      "import": "./dist/server-runtime.js",
+      "require": "./dist/server-runtime.cjs",
+      "default": "./dist/server-runtime.js"
+    },
+    "./egress": {
+      "types": "./dist/egress.d.ts",
+      "import": "./dist/egress.js",
+      "require": "./dist/egress.cjs",
+      "default": "./dist/egress.js"
+    },
+    "./gateway-signature": {
+      "types": "./dist/gateway-signature.d.ts",
+      "import": "./dist/gateway-signature.js",
+      "require": "./dist/gateway-signature.cjs",
+      "default": "./dist/gateway-signature.js"
+    },
+    "./mcp-identity": {
+      "types": "./dist/mcp-identity.d.ts",
+      "import": "./dist/mcp-identity.js",
+      "require": "./dist/mcp-identity.cjs",
+      "default": "./dist/mcp-identity.js"
+    },
+    "./pack": {
+      "types": "./dist/pack.d.ts",
+      "import": "./dist/pack.js",
+      "default": "./dist/pack.js"
+    },
+    "./publish": {
+      "types": "./dist/publish.d.ts",
+      "import": "./dist/publish.js",
+      "default": "./dist/publish.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "import": "./dist/testing.js",
+      "default": "./dist/testing.js"
+    }
+  },
+  "bin": {
+    "tego-plugin-pack": "./bin/tego-plugin-pack.mjs",
+    "tego-plugin": "./bin/tego-plugin.mjs"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "sql",
+    "access-fixtures",
+    "access-catalog.schema.json"
+  ],
+  "dependencies": {
+    "esbuild": "^0.25.12",
+    "jszip": "^3.10.1",
+    "magic-string": "^0.30.21",
+    "zod": "^3.24.1",
+    "zod-to-json-schema": "^3.25.2"
+  },
+  "peerDependencies": {
+    "pg": "^8.13.1",
+    "vite": "^6.0.0",
+    "hono": "^4.10.7",
+    "drizzle-orm": "^0.38.3"
+  },
+  "peerDependenciesMeta": {
+    "pg": {
+      "optional": true
+    },
+    "vite": {
+      "optional": true
+    },
+    "hono": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    }
+  },
+  "description": "Create, build, package and test Tego plugins: tego-plugin create, manifest, frontend/backend APIs, access control and tego-plugin-pack",
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zhama-ai/tego-os.git",
+    "directory": "packages/plugin-sdk"
+  },
+  "homepage": "https://github.com/zhama-ai/tego-os/tree/main/packages/plugin-sdk#readme",
+  "keywords": [
+    "tego",
+    "tego-plugin"
+  ]
+}