@zhama/tego-plugin-sdk 0.0.0-stage → 1.36.1

package/dist/manifest.js

@@ -0,0 +1 @@
+export{PYTHON_LOCK_FILENAME,PYTHON_RUNNER_VERSION,PYTHON_WHEELS_DIR,checkPluginAccessCatalog,checkPythonVendoring,normalizePackageName,parseRequirementsLock,parseTegoPluginManifest,parseWheelFilename,tegoPluginManifestSchema}from"./chunk-5CU33JVY.js";import"./chunk-BTHXQWHT.js";import"./chunk-7XHF3YSK.js";import"./chunk-VMCGDDGP.js";import"./chunk-SNUCO2MK.js";

package/dist/mcp-identity.cjs

@@ -0,0 +1,2 @@
+"use strict";var p=Object.defineProperty;var a=(e,r)=>p(e,"name",{value:r,configurable:!0});var crypto=require("crypto"),MCP_IDENTITY_VERSION="1",MCP_IDENTITY_MESSAGE_PREFIX="tego-mcp-identity-v1",MCP_IDENTITY_MAX_SKEW_MS=300*1e3,MCP_IDENTITY_HEADERS={version:"x-tego-identity-version",serverId:"x-tego-identity-server-id",keyVersion:"x-tego-identity-key-version",userId:"x-tego-identity-user-id",tenantId:"x-tego-identity-tenant-id",avatarId:"x-tego-identity-avatar-id",email:"x-tego-identity-email",roles:"x-tego-identity-roles",requestId:"x-tego-identity-request-id",issuedAt:"x-tego-identity-issued-at",signature:"x-tego-identity-signature"},MCP_IDENTITY_HEADER_PREFIX="x-tego-identity-";function sha256Hex(e=""){return crypto.createHash("sha256").update(e).digest("hex")}a(sha256Hex,"sha256Hex");function canonicalMessage(e,r){const t=[MCP_IDENTITY_MESSAGE_PREFIX,e.serverId,e.keyVersion,r.method.toUpperCase(),r.pathAndQuery,r.bodySha256,e.userId,e.tenantId,e.avatarId,e.email,e.rolesHeader,e.requestId,e.issuedAt];if(t.some(s=>/[\r\n]/.test(s)))throw new Error("MCP identity fields must not contain line breaks");return t.join(`
+`)}a(canonicalMessage,"canonicalMessage");function signMcpIdentity(e,r,t){return crypto.createHmac("sha256",t).update(canonicalMessage(e,r)).digest("hex")}a(signMcpIdentity,"signMcpIdentity");function buildMcpIdentityHeaders(e,r,t){return{[MCP_IDENTITY_HEADERS.version]:MCP_IDENTITY_VERSION,[MCP_IDENTITY_HEADERS.serverId]:e.serverId,[MCP_IDENTITY_HEADERS.keyVersion]:e.keyVersion,[MCP_IDENTITY_HEADERS.userId]:e.userId,[MCP_IDENTITY_HEADERS.tenantId]:e.tenantId,[MCP_IDENTITY_HEADERS.avatarId]:e.avatarId,[MCP_IDENTITY_HEADERS.email]:e.email,[MCP_IDENTITY_HEADERS.roles]:e.rolesHeader,[MCP_IDENTITY_HEADERS.requestId]:e.requestId,[MCP_IDENTITY_HEADERS.issuedAt]:e.issuedAt,[MCP_IDENTITY_HEADERS.signature]:signMcpIdentity(e,r,t)}}a(buildMcpIdentityHeaders,"buildMcpIdentityHeaders");function readHeader(e,r){if(typeof e.get=="function")return e.get(r)??void 0;const t=e,s=t[r]??Object.entries(t).find(([i])=>i.toLowerCase()===r)?.[1];return Array.isArray(s)?s[0]:s}a(readHeader,"readHeader");function verifyMcpIdentity(e){const r=a(v=>readHeader(e.headers,v),"read"),t={version:r(MCP_IDENTITY_HEADERS.version),serverId:r(MCP_IDENTITY_HEADERS.serverId),keyVersion:r(MCP_IDENTITY_HEADERS.keyVersion),userId:r(MCP_IDENTITY_HEADERS.userId),tenantId:r(MCP_IDENTITY_HEADERS.tenantId),avatarId:r(MCP_IDENTITY_HEADERS.avatarId)??"",email:r(MCP_IDENTITY_HEADERS.email)??"",rolesHeader:r(MCP_IDENTITY_HEADERS.roles)??"[]",requestId:r(MCP_IDENTITY_HEADERS.requestId),issuedAt:r(MCP_IDENTITY_HEADERS.issuedAt),signature:r(MCP_IDENTITY_HEADERS.signature)},{version:s,serverId:i,keyVersion:d,userId:I,tenantId:u,requestId:y,issuedAt:n,signature:f}=t;if(!s||!i||!d||!I||!u||!y||!n||!f)return{ok:!1,reason:"missing_headers"};if(s!==MCP_IDENTITY_VERSION)return{ok:!1,reason:"unsupported_version"};if(e.expectedServerId&&i!==e.expectedServerId)return{ok:!1,reason:"unknown_server"};const _=e.keys[d];if(!_)return{ok:!1,reason:"unknown_key_version"};const g=Number(n);if(!/^\d+$/.test(n)||Math.abs(e.nowMs-g)>MCP_IDENTITY_MAX_SKEW_MS)return{ok:!1,reason:"stale"};const c={serverId:i,keyVersion:d,userId:I,tenantId:u,avatarId:t.avatarId,email:t.email,rolesHeader:t.rolesHeader,requestId:y,issuedAt:n};let l;try{l=Buffer.from(signMcpIdentity(c,{method:e.method,pathAndQuery:e.pathAndQuery,bodySha256:sha256Hex(e.body??"")},_))}catch{return{ok:!1,reason:"bad_signature"}}const E=Buffer.from(f);if(l.length!==E.length||!crypto.timingSafeEqual(l,E))return{ok:!1,reason:"bad_signature"};let o;try{o=JSON.parse(t.rolesHeader)}catch{return{ok:!1,reason:"malformed_roles"}}return!Array.isArray(o)||!o.every(v=>typeof v=="string")?{ok:!1,reason:"malformed_roles"}:{ok:!0,identity:{serverId:i,keyVersion:d,userId:I,tenantId:u,avatarId:t.avatarId,email:t.email,roles:o,requestId:y,issuedAt:g}}}a(verifyMcpIdentity,"verifyMcpIdentity"),exports.MCP_IDENTITY_HEADERS=MCP_IDENTITY_HEADERS,exports.MCP_IDENTITY_HEADER_PREFIX=MCP_IDENTITY_HEADER_PREFIX,exports.MCP_IDENTITY_MAX_SKEW_MS=MCP_IDENTITY_MAX_SKEW_MS,exports.MCP_IDENTITY_MESSAGE_PREFIX=MCP_IDENTITY_MESSAGE_PREFIX,exports.MCP_IDENTITY_VERSION=MCP_IDENTITY_VERSION,exports.buildMcpIdentityHeaders=buildMcpIdentityHeaders,exports.sha256Hex=sha256Hex,exports.signMcpIdentity=signMcpIdentity,exports.verifyMcpIdentity=verifyMcpIdentity;

package/dist/mcp-identity.d.cts

@@ -0,0 +1,106 @@
+/**
+ * Proof of who an MCP tool call acts for, as a downstream HTTP service sees it.
+ *
+ * tego-mcp relays a tool call to a service outside the platform — an intranet
+ * system, a team's own API. That service never receives the container's
+ * gateway token: it would be a standing credential for every user of the
+ * avatar. It receives the identity tego-server verified instead, signed per
+ * request with a key that belongs to that one MCP server.
+ *
+ * The key is random and stored by tego-mcp rather than derived from a platform
+ * secret. Avatar containers hold the platform JWT secret to verify user tokens
+ * locally, so anything derived from it is computable inside a container — and
+ * the point of this signature is that a container cannot produce it.
+ *
+ * The signature covers the request itself (method, path and query, body hash),
+ * not only the identity, so a captured header set cannot be replayed against
+ * another endpoint or with another body.
+ *
+ * Both ends live here so there is one definition of the signed bytes; the
+ * Python SDK is held to the same vector file.
+ */
+declare const MCP_IDENTITY_VERSION = "1";
+declare const MCP_IDENTITY_MESSAGE_PREFIX = "tego-mcp-identity-v1";
+/** Same window as the plugin gateway: loose enough for NTP-synced hosts. */
+declare const MCP_IDENTITY_MAX_SKEW_MS: number;
+declare const MCP_IDENTITY_HEADERS: {
+    readonly version: "x-tego-identity-version";
+    readonly serverId: "x-tego-identity-server-id";
+    readonly keyVersion: "x-tego-identity-key-version";
+    readonly userId: "x-tego-identity-user-id";
+    readonly tenantId: "x-tego-identity-tenant-id";
+    readonly avatarId: "x-tego-identity-avatar-id";
+    readonly email: "x-tego-identity-email";
+    readonly roles: "x-tego-identity-roles";
+    readonly requestId: "x-tego-identity-request-id";
+    readonly issuedAt: "x-tego-identity-issued-at";
+    readonly signature: "x-tego-identity-signature";
+};
+/** Every identity header, for callers that must strip or forbid them. */
+declare const MCP_IDENTITY_HEADER_PREFIX = "x-tego-identity-";
+interface McpIdentityContext {
+    serverId: string;
+    keyVersion: string;
+    userId: string;
+    tenantId: string;
+    /** Empty string when the caller is a person rather than an avatar. */
+    avatarId: string;
+    /** Empty string when the user has none. */
+    email: string;
+    /** The `roles` header verbatim — a JSON array — never re-serialized. */
+    rolesHeader: string;
+    requestId: string;
+    /** Unix milliseconds, as it appears in the header. */
+    issuedAt: string;
+}
+interface McpIdentityRequest {
+    method: string;
+    /** Path and query exactly as sent, e.g. `/orders?status=open`. */
+    pathAndQuery: string;
+    /** Lowercase hex SHA-256 of the body bytes; of the empty string when none. */
+    bodySha256: string;
+}
+declare function sha256Hex(body?: string | Uint8Array): string;
+declare function signMcpIdentity(context: McpIdentityContext, request: McpIdentityRequest, key: string): string;
+/** The full header set for one signed request. */
+declare function buildMcpIdentityHeaders(context: McpIdentityContext, request: McpIdentityRequest, key: string): Record<string, string>;
+interface VerifiedMcpIdentity {
+    serverId: string;
+    keyVersion: string;
+    userId: string;
+    tenantId: string;
+    avatarId: string;
+    email: string;
+    roles: string[];
+    requestId: string;
+    issuedAt: number;
+}
+type McpIdentityVerification = {
+    ok: true;
+    identity: VerifiedMcpIdentity;
+} | {
+    ok: false;
+    reason: 'missing_headers' | 'unsupported_version' | 'unknown_server' | 'unknown_key_version' | 'stale' | 'bad_signature' | 'malformed_roles';
+};
+type HeaderReader = Record<string, string | string[] | undefined> | {
+    get(name: string): string | null;
+};
+/**
+ * Whether a request carries a recent identity signed by one of `keys`.
+ *
+ * `keys` maps a key version to its secret, so a service can accept the
+ * previous key for the grace period after a rotation. `expectedServerId`
+ * pins the MCP server the service was configured for; leave it out only when
+ * one key set is shared deliberately.
+ */
+declare function verifyMcpIdentity(input: {
+    headers: HeaderReader;
+    method: string;
+    pathAndQuery: string;
+    body?: string | Uint8Array;
+    keys: Record<string, string>;
+    nowMs: number;
+    expectedServerId?: string;
+}): McpIdentityVerification;
+
+export { MCP_IDENTITY_HEADERS, MCP_IDENTITY_HEADER_PREFIX, MCP_IDENTITY_MAX_SKEW_MS, MCP_IDENTITY_MESSAGE_PREFIX, MCP_IDENTITY_VERSION, type McpIdentityContext, type McpIdentityRequest, type McpIdentityVerification, type VerifiedMcpIdentity, buildMcpIdentityHeaders, sha256Hex, signMcpIdentity, verifyMcpIdentity };

package/dist/mcp-identity.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Proof of who an MCP tool call acts for, as a downstream HTTP service sees it.
+ *
+ * tego-mcp relays a tool call to a service outside the platform — an intranet
+ * system, a team's own API. That service never receives the container's
+ * gateway token: it would be a standing credential for every user of the
+ * avatar. It receives the identity tego-server verified instead, signed per
+ * request with a key that belongs to that one MCP server.
+ *
+ * The key is random and stored by tego-mcp rather than derived from a platform
+ * secret. Avatar containers hold the platform JWT secret to verify user tokens
+ * locally, so anything derived from it is computable inside a container — and
+ * the point of this signature is that a container cannot produce it.
+ *
+ * The signature covers the request itself (method, path and query, body hash),
+ * not only the identity, so a captured header set cannot be replayed against
+ * another endpoint or with another body.
+ *
+ * Both ends live here so there is one definition of the signed bytes; the
+ * Python SDK is held to the same vector file.
+ */
+declare const MCP_IDENTITY_VERSION = "1";
+declare const MCP_IDENTITY_MESSAGE_PREFIX = "tego-mcp-identity-v1";
+/** Same window as the plugin gateway: loose enough for NTP-synced hosts. */
+declare const MCP_IDENTITY_MAX_SKEW_MS: number;
+declare const MCP_IDENTITY_HEADERS: {
+    readonly version: "x-tego-identity-version";
+    readonly serverId: "x-tego-identity-server-id";
+    readonly keyVersion: "x-tego-identity-key-version";
+    readonly userId: "x-tego-identity-user-id";
+    readonly tenantId: "x-tego-identity-tenant-id";
+    readonly avatarId: "x-tego-identity-avatar-id";
+    readonly email: "x-tego-identity-email";
+    readonly roles: "x-tego-identity-roles";
+    readonly requestId: "x-tego-identity-request-id";
+    readonly issuedAt: "x-tego-identity-issued-at";
+    readonly signature: "x-tego-identity-signature";
+};
+/** Every identity header, for callers that must strip or forbid them. */
+declare const MCP_IDENTITY_HEADER_PREFIX = "x-tego-identity-";
+interface McpIdentityContext {
+    serverId: string;
+    keyVersion: string;
+    userId: string;
+    tenantId: string;
+    /** Empty string when the caller is a person rather than an avatar. */
+    avatarId: string;
+    /** Empty string when the user has none. */
+    email: string;
+    /** The `roles` header verbatim — a JSON array — never re-serialized. */
+    rolesHeader: string;
+    requestId: string;
+    /** Unix milliseconds, as it appears in the header. */
+    issuedAt: string;
+}
+interface McpIdentityRequest {
+    method: string;
+    /** Path and query exactly as sent, e.g. `/orders?status=open`. */
+    pathAndQuery: string;
+    /** Lowercase hex SHA-256 of the body bytes; of the empty string when none. */
+    bodySha256: string;
+}
+declare function sha256Hex(body?: string | Uint8Array): string;
+declare function signMcpIdentity(context: McpIdentityContext, request: McpIdentityRequest, key: string): string;
+/** The full header set for one signed request. */
+declare function buildMcpIdentityHeaders(context: McpIdentityContext, request: McpIdentityRequest, key: string): Record<string, string>;
+interface VerifiedMcpIdentity {
+    serverId: string;
+    keyVersion: string;
+    userId: string;
+    tenantId: string;
+    avatarId: string;
+    email: string;
+    roles: string[];
+    requestId: string;
+    issuedAt: number;
+}
+type McpIdentityVerification = {
+    ok: true;
+    identity: VerifiedMcpIdentity;
+} | {
+    ok: false;
+    reason: 'missing_headers' | 'unsupported_version' | 'unknown_server' | 'unknown_key_version' | 'stale' | 'bad_signature' | 'malformed_roles';
+};
+type HeaderReader = Record<string, string | string[] | undefined> | {
+    get(name: string): string | null;
+};
+/**
+ * Whether a request carries a recent identity signed by one of `keys`.
+ *
+ * `keys` maps a key version to its secret, so a service can accept the
+ * previous key for the grace period after a rotation. `expectedServerId`
+ * pins the MCP server the service was configured for; leave it out only when
+ * one key set is shared deliberately.
+ */
+declare function verifyMcpIdentity(input: {
+    headers: HeaderReader;
+    method: string;
+    pathAndQuery: string;
+    body?: string | Uint8Array;
+    keys: Record<string, string>;
+    nowMs: number;
+    expectedServerId?: string;
+}): McpIdentityVerification;
+
+export { MCP_IDENTITY_HEADERS, MCP_IDENTITY_HEADER_PREFIX, MCP_IDENTITY_MAX_SKEW_MS, MCP_IDENTITY_MESSAGE_PREFIX, MCP_IDENTITY_VERSION, type McpIdentityContext, type McpIdentityRequest, type McpIdentityVerification, type VerifiedMcpIdentity, buildMcpIdentityHeaders, sha256Hex, signMcpIdentity, verifyMcpIdentity };

package/dist/mcp-identity.js

@@ -0,0 +1,2 @@
+var H=Object.defineProperty;var i=(e,r)=>H(e,"name",{value:r,configurable:!0});import{createHash as S,createHmac as b,timingSafeEqual as T}from"crypto";var g="1",A="tego-mcp-identity-v1",E=300*1e3,t={version:"x-tego-identity-version",serverId:"x-tego-identity-server-id",keyVersion:"x-tego-identity-key-version",userId:"x-tego-identity-user-id",tenantId:"x-tego-identity-tenant-id",avatarId:"x-tego-identity-avatar-id",email:"x-tego-identity-email",roles:"x-tego-identity-roles",requestId:"x-tego-identity-request-id",issuedAt:"x-tego-identity-issued-at",signature:"x-tego-identity-signature"},C="x-tego-identity-";function M(e=""){return S("sha256").update(e).digest("hex")}i(M,"sha256Hex");function N(e,r){const s=[A,e.serverId,e.keyVersion,r.method.toUpperCase(),r.pathAndQuery,r.bodySha256,e.userId,e.tenantId,e.avatarId,e.email,e.rolesHeader,e.requestId,e.issuedAt];if(s.some(a=>/[\r\n]/.test(a)))throw new Error("MCP identity fields must not contain line breaks");return s.join(`
+`)}i(N,"canonicalMessage");function m(e,r,s){return b("sha256",s).update(N(e,r)).digest("hex")}i(m,"signMcpIdentity");function P(e,r,s){return{[t.version]:g,[t.serverId]:e.serverId,[t.keyVersion]:e.keyVersion,[t.userId]:e.userId,[t.tenantId]:e.tenantId,[t.avatarId]:e.avatarId,[t.email]:e.email,[t.roles]:e.rolesHeader,[t.requestId]:e.requestId,[t.issuedAt]:e.issuedAt,[t.signature]:m(e,r,s)}}i(P,"buildMcpIdentityHeaders");function V(e,r){if(typeof e.get=="function")return e.get(r)??void 0;const s=e,a=s[r]??Object.entries(s).find(([d])=>d.toLowerCase()===r)?.[1];return Array.isArray(a)?a[0]:a}i(V,"readHeader");function q(e){const r=i(f=>V(e.headers,f),"read"),s={version:r(t.version),serverId:r(t.serverId),keyVersion:r(t.keyVersion),userId:r(t.userId),tenantId:r(t.tenantId),avatarId:r(t.avatarId)??"",email:r(t.email)??"",rolesHeader:r(t.roles)??"[]",requestId:r(t.requestId),issuedAt:r(t.issuedAt),signature:r(t.signature)},{version:a,serverId:d,keyVersion:n,userId:I,tenantId:l,requestId:y,issuedAt:o,signature:k}=s;if(!a||!d||!n||!I||!l||!y||!o||!k)return{ok:!1,reason:"missing_headers"};if(a!==g)return{ok:!1,reason:"unsupported_version"};if(e.expectedServerId&&d!==e.expectedServerId)return{ok:!1,reason:"unknown_server"};const _=e.keys[n];if(!_)return{ok:!1,reason:"unknown_key_version"};const c=Number(o);if(!/^\d+$/.test(o)||Math.abs(e.nowMs-c)>E)return{ok:!1,reason:"stale"};const p={serverId:d,keyVersion:n,userId:I,tenantId:l,avatarId:s.avatarId,email:s.email,rolesHeader:s.rolesHeader,requestId:y,issuedAt:o};let v;try{v=Buffer.from(m(p,{method:e.method,pathAndQuery:e.pathAndQuery,bodySha256:M(e.body??"")},_))}catch{return{ok:!1,reason:"bad_signature"}}const h=Buffer.from(k);if(v.length!==h.length||!T(v,h))return{ok:!1,reason:"bad_signature"};let u;try{u=JSON.parse(s.rolesHeader)}catch{return{ok:!1,reason:"malformed_roles"}}return!Array.isArray(u)||!u.every(f=>typeof f=="string")?{ok:!1,reason:"malformed_roles"}:{ok:!0,identity:{serverId:d,keyVersion:n,userId:I,tenantId:l,avatarId:s.avatarId,email:s.email,roles:u,requestId:y,issuedAt:c}}}i(q,"verifyMcpIdentity");export{t as MCP_IDENTITY_HEADERS,C as MCP_IDENTITY_HEADER_PREFIX,E as MCP_IDENTITY_MAX_SKEW_MS,A as MCP_IDENTITY_MESSAGE_PREFIX,g as MCP_IDENTITY_VERSION,P as buildMcpIdentityHeaders,M as sha256Hex,m as signMcpIdentity,q as verifyMcpIdentity};

package/dist/pack.cjs

@@ -0,0 +1 @@
+"use strict";var u=Object.defineProperty;var e=(r,n)=>u(r,"name",{value:n,configurable:!0});var chunkTHMWRUAT_cjs=require("./chunk-THMWRUAT.cjs");require("./chunk-W7C357A6.cjs"),require("./chunk-3WA3M347.cjs"),require("./chunk-ROFUQLOZ.cjs"),require("./chunk-C2OCOPZQ.cjs"),require("./chunk-AJY7ZHXK.cjs"),require("./chunk-OP64Y4IN.cjs"),Object.defineProperty(exports,"buildAgentTemplate",{enumerable:!0,get:e(function(){return chunkTHMWRUAT_cjs.buildAgentTemplate},"get")}),Object.defineProperty(exports,"buildPluginBackend",{enumerable:!0,get:e(function(){return chunkTHMWRUAT_cjs.buildPluginBackend},"get")}),Object.defineProperty(exports,"buildPluginTemplates",{enumerable:!0,get:e(function(){return chunkTHMWRUAT_cjs.buildPluginTemplates},"get")}),Object.defineProperty(exports,"lockPlugin",{enumerable:!0,get:e(function(){return chunkTHMWRUAT_cjs.lockPlugin},"get")}),Object.defineProperty(exports,"packPlugin",{enumerable:!0,get:e(function(){return chunkTHMWRUAT_cjs.packPlugin},"get")}),Object.defineProperty(exports,"watchPluginFrontend",{enumerable:!0,get:e(function(){return chunkTHMWRUAT_cjs.watchPluginFrontend},"get")});

package/dist/pack.d.cts

@@ -0,0 +1,169 @@
+import { T as TegoPluginManifest, R as ResolvedBackendPart } from './manifest-types-DQARCQJt.cjs';
+
+/**
+ * Staging a `runtime: "python"` backend: source, locked wheels, and a lock
+ * whose hashes are exactly the wheels shipped.
+ *
+ * Two locks, deliberately different:
+ *
+ * - the plugin's `backend/requirements.lock` is the provenance record —
+ *   compiled by `tego-plugin-pack lock` with hashes of what PyPI serves, and
+ *   committed;
+ * - the packaged lock is what the runner installs with `--require-hashes` —
+ *   one line per package with the hashes of the wheels in the archive.
+ *
+ * They differ only where a locked package has no wheel on PyPI (pure-python
+ * sdists such as `antlr4-python3-runtime`). Those are downloaded against the
+ * provenance hash, built here into a wheel, and the built wheel's hash is what
+ * the package records. A sdist with native code builds a wheel for this
+ * machine, not for linux, and `checkPythonVendoring` then refuses it by name.
+ *
+ * Needs `uv` on PATH. pip does the downloading (through `uvx`), because it is
+ * the tool that can fetch for a foreign platform while verifying hashes.
+ */
+
+interface PythonBackendOptions {
+    /**
+     * Paths relative to the backend dir to ship besides the entry. Defaults to
+     * `src`, `resources`, `migrations`. An allowlist so a stray `.env` or
+     * `.venv` never ends up in a release.
+     */
+    include?: string[];
+    /**
+     * Directory of the `tego-plugin-sdk` python project. Defaults to the
+     * nearest `packages/plugin-sdk-python` above the plugin root.
+     */
+    sdkProject?: string;
+}
+
+/** Returns the `template.json` text (with trailing newline) for `dir`. */
+declare function buildAgentTemplate(dir: string): Promise<string>;
+
+/** Everything a plugin may need to say that the conventions cannot infer. */
+interface PackPluginOptions {
+    /** Package root: the directory holding `tego.plugin.json`. */
+    root: string;
+    /** Where to write the archive. Defaults to `<root>/build`. */
+    outDir?: string;
+    /** Archive filename. Defaults to `<id>-<version>.zip`. */
+    fileName?: string;
+    frontend?: {
+        /** Vite config, relative to root. Defaults to `<dir>/vite.config.ts`. */
+        viteConfig?: string;
+        /**
+         * Where the vite build writes. Defaults to `<dir>/dist`, matching the
+         * `outDir` the SDK's vite preset defaults to.
+         */
+        buildDir?: string;
+    };
+    /**
+     * The anonymous pages. A standalone vite app, not a host module: it is
+     * served as a document of its own, so its config should set `base: './'`
+     * and emit `index.html`.
+     */
+    publicFrontend?: {
+        /** Vite config, relative to root. Defaults to `<dir>/vite.config.ts`. */
+        viteConfig?: string;
+        /** Where the vite build writes. Defaults to `<dir>/dist`. */
+        buildDir?: string;
+    };
+    backend?: {
+        /** Entry source, relative to root. Defaults to `<dir>/src/index.ts`. */
+        entry?: string;
+        /** Extra modules to leave unbundled, on top of the built-in list. */
+        external?: string[];
+        /** Only for `runtime: "python"`. */
+        python?: PythonBackendOptions;
+    };
+    claw?: {
+        /** Entry source, relative to root. Defaults to `<dir>/src/index.ts`. */
+        entry?: string;
+        /** Skills directory, relative to root. Defaults to `<dir>/skills`. */
+        skillsDir?: string;
+        /** Extra modules to leave unbundled, on top of the built-in list. */
+        external?: string[];
+    };
+    /** Where to report progress. Defaults to `console.log`. Pass `null` to mute. */
+    log?: ((message: string) => void) | null;
+}
+interface PackedPlugin {
+    /** Absolute path of the archive. */
+    file: string;
+    bytes: number;
+    /** Hex sha256 of the archive, the same digest the upload endpoint records. */
+    sha256: string;
+    manifest: TegoPluginManifest;
+}
+declare function packPlugin(options: PackPluginOptions): Promise<PackedPlugin>;
+/**
+ * Rebuild every declared template authored in directory form (a
+ * `template.config.json` beside its entry) and write its `template.json`.
+ *
+ * The built file is committed so a reviewer sees what ships; packing rebuilds
+ * it first, so a package never carries a stale one. Returns the entries that
+ * changed.
+ */
+declare function buildPluginTemplates(options: {
+    root: string;
+    log?: PackPluginOptions['log'];
+}): Promise<string[]>;
+/**
+ * Re-compile a python backend's `requirements.lock` from `requirements.in`.
+ * Commit the result: it is the provenance every pack verifies against.
+ */
+declare function lockPlugin(options: {
+    root: string;
+    python?: PythonBackendOptions;
+}): Promise<string>;
+interface WatchPluginOptions {
+    /** Package root: the directory holding `tego.plugin.json`. */
+    root: string;
+    /** Port for the local bundle server. Defaults to 5180. */
+    port?: number;
+    frontend?: PackPluginOptions['frontend'];
+    log?: PackPluginOptions['log'];
+}
+/**
+ * Rebuild the frontend part on change and serve it over HTTP.
+ *
+ * The loop this replaces is pack → upload → install → refresh, which is a
+ * minute per one-line change. With this running and
+ * `VITE_TEGO_LOCAL_PLUGINS=<id>=http://localhost:5180/index.js` set on the
+ * shell, saving a file rebuilds the bundle and reloads the plugin page.
+ *
+ * **No module-level HMR.** State inside the plugin page is lost on every
+ * rebuild. Hot replacement across the SystemJS boundary would mean unmounting
+ * the plugin's own React root and re-registering shared modules, which is a
+ * lot of machinery for something that would silently desync; a reload takes
+ * about a second and is always right.
+ *
+ * Frontend only. The backend runs on the host through
+ * `run-plugin-backend-locally.ts`, and the claw part runs inside a container
+ * that has to be given a new bundle either way.
+ *
+ * Never resolves — the caller is a foreground command the author interrupts.
+ */
+declare function watchPluginFrontend(options: WatchPluginOptions): Promise<never>;
+interface BuildPluginBackendOptions {
+    /** Package root: the directory holding `tego.plugin.json`. */
+    root: string;
+    /**
+     * Where to write, using the part's own layout — the entry lands at
+     * `<outDir>/<part.entryPath>`, migrations and the `type: module` marker
+     * beside it. In a pack this is the staging dir; the local dev runner points
+     * it straight at its scratch dir and skips the zip entirely.
+     */
+    outDir: string;
+    /** Source entry, relative to root. Defaults to `<dir>/src/index.ts`. */
+    entry?: string;
+    /** Extra modules to leave unbundled, on top of the built-in list. */
+    external?: string[];
+}
+/**
+ * Build one plugin's backend the way the packer does — one definition of the
+ * externals, the target and the emitted `package.json`, so the local dev
+ * rebuild loop cannot drift from what a release actually ships.
+ */
+declare function buildPluginBackend(part: ResolvedBackendPart, options: BuildPluginBackendOptions): Promise<void>;
+
+export { type BuildPluginBackendOptions, type PackPluginOptions, type PackedPlugin, type WatchPluginOptions, buildAgentTemplate, buildPluginBackend, buildPluginTemplates, lockPlugin, packPlugin, watchPluginFrontend };

package/dist/pack.d.ts

@@ -0,0 +1,169 @@
+import { T as TegoPluginManifest, R as ResolvedBackendPart } from './manifest-types-DQARCQJt.js';
+
+/**
+ * Staging a `runtime: "python"` backend: source, locked wheels, and a lock
+ * whose hashes are exactly the wheels shipped.
+ *
+ * Two locks, deliberately different:
+ *
+ * - the plugin's `backend/requirements.lock` is the provenance record —
+ *   compiled by `tego-plugin-pack lock` with hashes of what PyPI serves, and
+ *   committed;
+ * - the packaged lock is what the runner installs with `--require-hashes` —
+ *   one line per package with the hashes of the wheels in the archive.
+ *
+ * They differ only where a locked package has no wheel on PyPI (pure-python
+ * sdists such as `antlr4-python3-runtime`). Those are downloaded against the
+ * provenance hash, built here into a wheel, and the built wheel's hash is what
+ * the package records. A sdist with native code builds a wheel for this
+ * machine, not for linux, and `checkPythonVendoring` then refuses it by name.
+ *
+ * Needs `uv` on PATH. pip does the downloading (through `uvx`), because it is
+ * the tool that can fetch for a foreign platform while verifying hashes.
+ */
+
+interface PythonBackendOptions {
+    /**
+     * Paths relative to the backend dir to ship besides the entry. Defaults to
+     * `src`, `resources`, `migrations`. An allowlist so a stray `.env` or
+     * `.venv` never ends up in a release.
+     */
+    include?: string[];
+    /**
+     * Directory of the `tego-plugin-sdk` python project. Defaults to the
+     * nearest `packages/plugin-sdk-python` above the plugin root.
+     */
+    sdkProject?: string;
+}
+
+/** Returns the `template.json` text (with trailing newline) for `dir`. */
+declare function buildAgentTemplate(dir: string): Promise<string>;
+
+/** Everything a plugin may need to say that the conventions cannot infer. */
+interface PackPluginOptions {
+    /** Package root: the directory holding `tego.plugin.json`. */
+    root: string;
+    /** Where to write the archive. Defaults to `<root>/build`. */
+    outDir?: string;
+    /** Archive filename. Defaults to `<id>-<version>.zip`. */
+    fileName?: string;
+    frontend?: {
+        /** Vite config, relative to root. Defaults to `<dir>/vite.config.ts`. */
+        viteConfig?: string;
+        /**
+         * Where the vite build writes. Defaults to `<dir>/dist`, matching the
+         * `outDir` the SDK's vite preset defaults to.
+         */
+        buildDir?: string;
+    };
+    /**
+     * The anonymous pages. A standalone vite app, not a host module: it is
+     * served as a document of its own, so its config should set `base: './'`
+     * and emit `index.html`.
+     */
+    publicFrontend?: {
+        /** Vite config, relative to root. Defaults to `<dir>/vite.config.ts`. */
+        viteConfig?: string;
+        /** Where the vite build writes. Defaults to `<dir>/dist`. */
+        buildDir?: string;
+    };
+    backend?: {
+        /** Entry source, relative to root. Defaults to `<dir>/src/index.ts`. */
+        entry?: string;
+        /** Extra modules to leave unbundled, on top of the built-in list. */
+        external?: string[];
+        /** Only for `runtime: "python"`. */
+        python?: PythonBackendOptions;
+    };
+    claw?: {
+        /** Entry source, relative to root. Defaults to `<dir>/src/index.ts`. */
+        entry?: string;
+        /** Skills directory, relative to root. Defaults to `<dir>/skills`. */
+        skillsDir?: string;
+        /** Extra modules to leave unbundled, on top of the built-in list. */
+        external?: string[];
+    };
+    /** Where to report progress. Defaults to `console.log`. Pass `null` to mute. */
+    log?: ((message: string) => void) | null;
+}
+interface PackedPlugin {
+    /** Absolute path of the archive. */
+    file: string;
+    bytes: number;
+    /** Hex sha256 of the archive, the same digest the upload endpoint records. */
+    sha256: string;
+    manifest: TegoPluginManifest;
+}
+declare function packPlugin(options: PackPluginOptions): Promise<PackedPlugin>;
+/**
+ * Rebuild every declared template authored in directory form (a
+ * `template.config.json` beside its entry) and write its `template.json`.
+ *
+ * The built file is committed so a reviewer sees what ships; packing rebuilds
+ * it first, so a package never carries a stale one. Returns the entries that
+ * changed.
+ */
+declare function buildPluginTemplates(options: {
+    root: string;
+    log?: PackPluginOptions['log'];
+}): Promise<string[]>;
+/**
+ * Re-compile a python backend's `requirements.lock` from `requirements.in`.
+ * Commit the result: it is the provenance every pack verifies against.
+ */
+declare function lockPlugin(options: {
+    root: string;
+    python?: PythonBackendOptions;
+}): Promise<string>;
+interface WatchPluginOptions {
+    /** Package root: the directory holding `tego.plugin.json`. */
+    root: string;
+    /** Port for the local bundle server. Defaults to 5180. */
+    port?: number;
+    frontend?: PackPluginOptions['frontend'];
+    log?: PackPluginOptions['log'];
+}
+/**
+ * Rebuild the frontend part on change and serve it over HTTP.
+ *
+ * The loop this replaces is pack → upload → install → refresh, which is a
+ * minute per one-line change. With this running and
+ * `VITE_TEGO_LOCAL_PLUGINS=<id>=http://localhost:5180/index.js` set on the
+ * shell, saving a file rebuilds the bundle and reloads the plugin page.
+ *
+ * **No module-level HMR.** State inside the plugin page is lost on every
+ * rebuild. Hot replacement across the SystemJS boundary would mean unmounting
+ * the plugin's own React root and re-registering shared modules, which is a
+ * lot of machinery for something that would silently desync; a reload takes
+ * about a second and is always right.
+ *
+ * Frontend only. The backend runs on the host through
+ * `run-plugin-backend-locally.ts`, and the claw part runs inside a container
+ * that has to be given a new bundle either way.
+ *
+ * Never resolves — the caller is a foreground command the author interrupts.
+ */
+declare function watchPluginFrontend(options: WatchPluginOptions): Promise<never>;
+interface BuildPluginBackendOptions {
+    /** Package root: the directory holding `tego.plugin.json`. */
+    root: string;
+    /**
+     * Where to write, using the part's own layout — the entry lands at
+     * `<outDir>/<part.entryPath>`, migrations and the `type: module` marker
+     * beside it. In a pack this is the staging dir; the local dev runner points
+     * it straight at its scratch dir and skips the zip entirely.
+     */
+    outDir: string;
+    /** Source entry, relative to root. Defaults to `<dir>/src/index.ts`. */
+    entry?: string;
+    /** Extra modules to leave unbundled, on top of the built-in list. */
+    external?: string[];
+}
+/**
+ * Build one plugin's backend the way the packer does — one definition of the
+ * externals, the target and the emitted `package.json`, so the local dev
+ * rebuild loop cannot drift from what a release actually ships.
+ */
+declare function buildPluginBackend(part: ResolvedBackendPart, options: BuildPluginBackendOptions): Promise<void>;
+
+export { type BuildPluginBackendOptions, type PackPluginOptions, type PackedPlugin, type WatchPluginOptions, buildAgentTemplate, buildPluginBackend, buildPluginTemplates, lockPlugin, packPlugin, watchPluginFrontend };

package/dist/pack.js

@@ -0,0 +1 @@
+export{buildAgentTemplate,buildPluginBackend,buildPluginTemplates,lockPlugin,packPlugin,watchPluginFrontend}from"./chunk-3KUOBGJN.js";import"./chunk-7K37PVGV.js";import"./chunk-5CU33JVY.js";import"./chunk-BTHXQWHT.js";import"./chunk-7XHF3YSK.js";import"./chunk-VMCGDDGP.js";import"./chunk-SNUCO2MK.js";

package/dist/publish.cjs

@@ -0,0 +1 @@
+"use strict";var $=Object.defineProperty;var s=(e,a)=>$(e,"name",{value:a,configurable:!0});var chunkTHMWRUAT_cjs=require("./chunk-THMWRUAT.cjs");require("./chunk-W7C357A6.cjs"),require("./chunk-3WA3M347.cjs");var chunkROFUQLOZ_cjs=require("./chunk-ROFUQLOZ.cjs");require("./chunk-C2OCOPZQ.cjs"),require("./chunk-AJY7ZHXK.cjs"),require("./chunk-OP64Y4IN.cjs");var promises=require("fs/promises"),path=require("path"),API_PREFIX="/api/v1/tego-os";async function publishPlugin(e){const a=e.log===null?()=>{}:e.log??(t=>console.log(t)),n=await chunkTHMWRUAT_cjs.packPlugin({root:e.root,log:a});return publishPackedPlugin(n,e)}s(publishPlugin,"publishPlugin");async function publishPackedPlugin(e,a){const n=a.log===null?()=>{}:a.log??(p=>console.log(p)),t=a.fetchImpl??fetch,r=createCaller(a.server,a.token,t),u=await promises.readFile(e.file),o=path.basename(e.file);n("\u203A presigning upload");const c=await r("POST","/admin/runtime-plugins/presign-stream",{filename:o,mimeType:"application/zip",size:u.byteLength});n(`\u203A uploading ${o} (${u.byteLength} bytes)`),await putArchive(a.server,c.uploadUrl,u,t),n("\u203A inspecting package");const l=await r("POST","/admin/runtime-plugins/inspect",{uploadToken:c.uploadToken});n(`  ${l.pluginId}@${l.semanticVersion} \u2014 ${describeParts(l)}${l.isUpgrade?" (upgrade)":""}${l.requiresConfig?", needs config":""}`),n("\u203A finalizing release");const g=await r("POST","/admin/runtime-plugins/upload",{uploadToken:c.uploadToken,...a.meta});let i=g.release;n(`  release ${i.id} (${i.status})`),(a.approve??!0)&&(n("\u203A approving release"),i=await r("POST",`/admin/runtime-plugins/releases/${encodeURIComponent(i.id)}/approve`,{}),n(`  release ${i.id} (${i.status})`));let d=null;if(a.install??!0){const p=chunkROFUQLOZ_cjs.resolvePluginScope(e.manifest),f=p==="avatar"?{releaseId:i.id,avatarIds:a.avatarIds??[]}:{releaseId:i.id};n(`\u203A installing for tenant (${p}-scoped)`),d=await r("POST","/admin/runtime-plugins/installs",f),reportInstall(d,n)}return{packed:e,preview:l,catalog:g.catalog,release:i,install:d}}s(publishPackedPlugin,"publishPackedPlugin");function describeParts(e){const a=[];return e.parts.frontend&&a.push(`frontend (${e.parts.frontend.locales.length} locales)`),e.parts.backend&&a.push(`backend (${e.parts.backend.migrationCount} migrations)`),e.parts.claw&&a.push("claw"),a.join(", ")||"no parts"}s(describeParts,"describeParts");function reportInstall(e,a){const n=e.avatars;if(!n||n.attempted===0){a(`  installed ${e.pluginId}@${e.version}`);return}const t=n.attempted-n.failures.length;a(`  installed ${e.pluginId}@${e.version} \u2014 ${t}/${n.attempted} avatars`);for(const r of n.failures)a(`    \u2717 ${r.avatarId}: ${r.message}`)}s(reportInstall,"reportInstall");function createCaller(e,a,n){const t=e.replace(/\/+$/,"");return s(async function(u,o,c){const l=await n(`${t}${API_PREFIX}${o}`,{method:u,headers:{authorization:`Bearer ${a}`,...c===void 0?{}:{"content-type":"application/json"}},...c===void 0?{}:{body:JSON.stringify(c)}});return unwrap(l,`${u} ${o}`)},"call")}s(createCaller,"createCaller");async function putArchive(e,a,n,t){const r=e.replace(/\/+$/,""),u=await t(`${r}${a}`,{method:"PUT",headers:{"content-type":"application/zip"},body:n});await unwrap(u,"PUT upload")}s(putArchive,"putArchive");async function unwrap(e,a){let n;try{n=await e.json()}catch{n=null}if(!e.ok||!n?.success){const t=n?.error?.message??`HTTP ${e.status}`;throw new Error(`${a} failed: ${t}`)}return n.data}s(unwrap,"unwrap"),exports.publishPackedPlugin=publishPackedPlugin,exports.publishPlugin=publishPlugin;