@zhama/tego-plugin-sdk 1.37.1 → 1.37.2

package/dist/doctor.js

@@ -1,8 +1,15 @@
-var z=Object.defineProperty;var d=(e,t)=>z(e,"name",{value:t,configurable:!0});import{parseTegoPluginManifest as F}from"./chunk-EIVA5BR6.js";import{verifyFrontendLocales as G,flattenLocaleKeys as H,verifyMigrationNames as Z}from"./chunk-2NTAWYCG.js";import{resolvePluginParts as q}from"./chunk-IVJECPGG.js";import{pluginI18nNamespace as J}from"./chunk-INCA3GFW.js";import{isValidHostApiRange as Q,hostApiRangeMinimum as V}from"./chunk-56QOZQTY.js";import"./chunk-VMCGDDGP.js";import"./chunk-SNUCO2MK.js";import{execFile as X}from"child_process";import{stat as Y,readFile as x,readdir as C}from"fs/promises";import{join as P,relative as ee,extname as I,sep as te}from"path";var oe="ui-colors-allow",re="slate|gray|zinc|neutral|stone|red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose",se="bg|text|border(?:-[trblxyse])?|ring(?:-offset)?|from|via|to|fill|stroke|outline|divide|placeholder|caret|accent|decoration|shadow",ne=[new RegExp(`(?<![\\w-])(?:${se})-(?:(?:${re})-(?:50|[1-9]00|950)|white|black)(?:\\/\\d{1,3})?(?![\\w-])`,"g"),/-\[(?:#[0-9a-fA-F]{3,8}|(?:rgba?|hsla?)\(\s*\d+)/g,/(?<![a-zA-Z0-9[-])(?:rgba?|hsla?)\(\s*\d+/g],ae=/['"`]#[0-9a-fA-F]{3,8}['"`]/g,ie=/(?<![\w&-])#[0-9a-fA-F]{3,8}(?![\w-])/g,j=/(?<![\w-])dark:(?=\S)/g,ce=/\.dark(?![\w-])/g;function B(e){return e.replace(/(^|[\s{(,;])\/\*[\s\S]*?\*\//g,(t,o)=>o+t.slice(o.length).replace(/[^\n]/g," ")).replace(/(^|\s)\/\/.*$/gm,(t,o)=>o)}d(B,"stripComments");function le(e){const t=new Set;return e.forEach((o,r)=>{o.includes(oe)&&(t.add(r),/^\s*(?:\/\/|\/\*|\*|\{\/\*)/.test(o)&&t.add(r+1))}),t}d(le,"allowedLines");function L(e,t){const o=t===".css",r=le(e.split(`
-`)),c=B(e).split(`
-`),i=[...ne,o?ie:ae],s=o?[j,ce]:[j],p=[];return c.forEach((m,n)=>{if(r.has(n))return;const u=[];for(const[a,l]of[["color",i],["dark",s]])for(const b of l)for(const v of m.matchAll(b))u.push({kind:a,match:v[0],at:v.index??0});u.sort((a,l)=>a.kind.localeCompare(l.kind)||a.at-l.at).forEach(({kind:a,match:l})=>p.push({line:n+1,kind:a,match:l}))}),p}d(L,"findColorIssues");var h=d((e,t,o,r)=>({id:e,severity:t,guide:o,title:r}),"rule"),N=[h("TP-MAN-001","error","manifest.md","tego.plugin.json is valid"),h("TP-MAN-002","error","host-api-versions.md","hostApiRange admits every host capability the code uses"),h("TP-PKG-001","error","manifest.md","SDK packages come from npm aliases or workspace links, never a plain @tego/* name"),h("TP-PKG-002","warning","testing.md","package.json has the lint, type-check, test and build gates"),h("TP-CLAW-002","warning","claw.md","Each claw skill's frontmatter name matches its folder"),h("TP-DESK-001","error","desktop-web.md","No eval or new Function (the desktop CSP refuses them)"),h("TP-DESK-002","error","desktop-web.md","No addresses built from location.origin (tauri://localhost on desktop)"),h("TP-DESK-003","error","desktop-web.md","External links open with ctx.openExternal, not window.open"),h("TP-DESK-004","error","desktop-web.md","Files are saved with ctx.download, not <a download> or a.download"),h("TP-DESK-005","warning","desktop-web.md","No streamed responses or EventSource from the frontend (the desktop proxy buffers; use ctx.events)"),h("TP-DESK-006","warning","desktop-web.md","Clipboard writes go through ctx.copyText"),h("TP-WEB-001","error","desktop-web.md","The frontend calls no third-party URL (the web CSP blocks it); call the backend, which declares egress"),h("TP-WEB-002","error","desktop-web.md","No remote or injected scripts; everything ships in the bundle"),h("TP-UI-001","error","ui.md","Colors come from token classes: no hex, rgb(), palette classes or dark: overrides"),h("TP-UI-002","error","ui.md","No direct @radix-ui/* imports; use @tego/ui"),h("TP-UI-003","error","ui.md","The plugin's root element carries its scope class (.<pluginId>) when it compiles its own Tailwind"),h("TP-UI-004","error","frontend.md","The frontend has its own error boundary"),h("TP-I18N-001","error","i18n.md","All ten locales, with the same keys as zh-CN, and every nav label defined"),h("TP-I18N-002","error","i18n.md","Every locale value keeps the {{placeholders}} of zh-CN and is not empty"),h("TP-I18N-003","error","i18n.md","Every literal t('\u2026') key exists in zh-CN"),h("TP-I18N-004","warning","i18n.md","Current terminology: \u6570\u5B57\u5458\u5DE5 / Employee, never \u6570\u5B57\u5206\u8EAB / digital avatar"),h("TP-BE-001","error","backend.md","Identity comes from the verified ctx, never from the raw x-tego-plugin-* headers"),h("TP-BE-002","error","access.md","No host role names in business code; ask the access engine"),h("TP-BE-003","error","migrations.md","Migrations are <ordinal>_<name>.sql with unique ordinals"),h("TP-BE-004","error","migrations.md","Committed migrations are never edited or deleted"),h("TP-BE-005","warning","backend.md","Backend errors are logged through host.log, not console"),h("TP-ACC-001","error","access.md","With an access catalog, a test asserts every route has a policy (assertRouteCoverage)"),h("TP-ACC-002","error","access.md","With an access catalog, start() reconciles it (reconcile(host))"),h("TP-TEST-001","warning","testing.md","The plugin has tests")],de=new Map(N.map(e=>[e.id,e]));function _(e){return de.get(e)}d(_,"doctorRule");var ue=[{pattern:/\.openExternal\s*\(/,since:"1.37.0",name:"ctx.openExternal"},{pattern:/\.copyText\s*\(/,since:"1.37.0",name:"ctx.copyText"},{pattern:/\b(?:ctx|host|context)\.download\s*\(/,since:"1.37.0",name:"ctx.download"},{pattern:/\b(?:ctx|host|context)\.platform\b/,since:"1.37.0",name:"ctx.platform"}],pe=new Set([".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".css"]),he=new Set(["node_modules","dist","build",".tego-dev",".turbo",".drizzle","__fixtures__","coverage"]),fe=/\.(?:test|spec)\.[cm]?[jt]sx?$|(?:^|[\\/])test[\\/]|(?:^|[\\/])test-[\w-]+\.[cm]?[jt]s$|-double\.[cm]?[jt]s$|\.d\.ts$/,me=/tego-doctor-ignore\s+([A-Z0-9-]+(?:\s*,\s*[A-Z0-9-]+)*)/,ge=/\{\{\s*([\w.-]+)\s*\}\}/g,we=["lint","type-check","test","build"];function Te(e){return e.split(te).join("/")}d(Te,"toPosix");async function K(e,t,o){let r;try{r=await C(P(e,t),{withFileTypes:!0})}catch{return}for(const c of r){const i=t?`${t}/${c.name}`:c.name;c.isDirectory()?!he.has(c.name)&&!c.name.startsWith(".")&&await K(e,i,o):pe.has(I(c.name))&&o.push(i)}}d(K,"walk");function O(e){return{async list(t){try{return(await C(P(e,t),{withFileTypes:!0})).filter(r=>r.isFile()).map(r=>r.name)}catch{return[]}},readText:d(t=>x(P(e,t),"utf8").catch(()=>null),"readText")}}d(O,"folderReader");function M(e,t){return new Promise(o=>{X("git",["-C",e,...t],{maxBuffer:8*1024*1024},(r,c)=>o(r?null:c))})}d(M,"runGit");function R(e){const t=new Map;return e.split(`
-`).forEach((o,r)=>{const c=me.exec(o);if(!c?.[1])return;const i=new Set(c[1].split(",").map(p=>p.trim())),s=d(p=>t.set(p,new Set([...t.get(p)??[],...i])),"add");s(r),/^\s*(?:\/\/|\/\*|\*|\{\/\*)/.test(o)&&s(r+1)}),t}d(R,"ignoredLines");var be=class{static{d(this,"Findings")}list=[];add(e,t,o={}){const{severity:r,guide:c}=_(e);this.list.push({rule:e,severity:r,message:t,guide:c,...o})}};function w(e,t,o,r){const c=R(e.text);e.code.split(`
-`).forEach((i,s)=>{if(c.get(s)?.has(t))return;const p=o.exec(i);p&&r(s+1,p[0])})}d(w,"eachMatch");function Pe(e,t){const o=d(r=>!!r&&(e===r||e.startsWith(`${r}/`)),"inside");return o(t.frontend?.dir)||o(t.publicFrontend?.dir)?"frontend":o(t.backend?.dir)?"backend":o(t.claw?.dir)?"claw":o("shared")?"shared":"other"}d(Pe,"partOf");async function ye(e){try{return JSON.parse(await x(e,"utf8"))}catch{return}}d(ye,"readJson");function ke(e,t){if(!t)return;for(const c of["dependencies","devDependencies","peerDependencies"]){const i=t[c];if(!(!i||typeof i!="object"))for(const[s,p]of Object.entries(i))!s.startsWith("@tego/")||typeof p!="string"||/^(?:npm:@zhama\/tego-|workspace:|file:|link:|portal:)/.test(p)||e.add("TP-PKG-001",`${c}.${s} is "${p}": on npm @tego/* belongs to another project. Install it as "npm:@zhama/tego-${s.slice(6)}@^<sdk version>".`,{file:"package.json"})}const o=t.scripts??{},r=we.filter(c=>typeof o[c]!="string");r.length>0&&e.add("TP-PKG-002",`package.json has no ${r.map(c=>`"${c}"`).join(", ")} script; the platform's gates are lint, type-check, test and build.`,{file:"package.json"})}d(ke,"checkPackageJson");async function Ee(e,t,o,r,c){const i=r.frontend;if(!i)return;const{bundles:s,errors:p}=await G(O(t),i);for(const f of p)e.add("TP-I18N-001",f,{file:i.i18nDirPath});const m=s.get("zh-CN");if(!m)return;const n=d((f,g="",y=new Map)=>{if(typeof f!="object"||f===null||Array.isArray(f))return y.set(g,f),y;for(const[E,k]of Object.entries(f))n(k,g?`${g}.${E}`:E,y);return y},"leaves"),u=d(f=>new Set(typeof f=="string"?[...f.matchAll(ge)].map(g=>g[1]):[]),"placeholders"),a=n(m);for(const[f,g]of s){const y=`${i.i18nDirPath}/${f}.json`;let E=0;for(const[k,T]of n(g)){if(E>=10)break;if(typeof T=="string"&&T.trim()===""){e.add("TP-I18N-002",`"${k}" is empty in ${f}.json.`,{file:y}),E++;continue}if(f==="zh-CN"||!a.has(k))continue;const S=u(a.get(k)),$=u(T),U=[...S].filter(A=>!$.has(A)),W=[...$].filter(A=>!S.has(A));(U.length||W.length)&&(e.add("TP-I18N-002",`"${k}" in ${f}.json has placeholders {${[...$].join(", ")}} but zh-CN has {${[...S].join(", ")}}.`,{file:y}),E++)}for(const[k,T]of n(g))if(typeof T=="string"&&/数字分身|digital avatar/i.test(T)){e.add("TP-I18N-004",`"${k}" in ${f}.json says "${/数字分身/.test(T)?"\u6570\u5B57\u5206\u8EAB":"digital avatar"}"; the platform calls them \u6570\u5B57\u5458\u5DE5 / Employee ({{avatarTerm}}).`,{file:y});break}}const l=H(m),b=new Set(Object.keys(m)),v=d(f=>l.has(f)||["_one","_other","_zero","_few","_many","_two"].some(g=>l.has(f+g))||[...l].some(g=>g.startsWith(`${f}.`)),"exists");for(const f of c){if(f.part!=="frontend"||f.test)continue;const g=R(f.text);f.code.split(`
-`).forEach((y,E)=>{if(!g.get(E)?.has("TP-I18N-003"))for(const k of y.matchAll(/\bt\(\s*['"]([A-Za-z0-9_.-]+)['"]/g)){const T=k[1],S=T.split(".")[0];!T.includes(".")||!b.has(S)||v(T)||e.add("TP-I18N-003",`t('${T}') has no entry in zh-CN.json (namespace ${J(o.id)}).`,{file:f.path,line:E+1})}})}}d(Ee,"checkLocales");async function ve(e,t,o){const r=o.backend;if(!r)return;const{errors:c}=await Z(O(t),r.migrationsDirPath);for(const p of c)e.add("TP-BE-003",p,{file:r.migrationsDirPath});const i=await M(t,["diff","--name-status","HEAD","--",r.migrationsDirPath]);if(!i)return;const s=(await M(t,["rev-parse","--show-prefix"]))?.trim()??"";for(const p of i.split(`
-`)){const[m,n]=p.split("	");if(!n||m!=="M"&&m!=="D")continue;const u=n.startsWith(s)?n.slice(s.length):n;e.add("TP-BE-004",`${u} is a committed migration and was ${m==="M"?"edited":"deleted"}; an install may have applied it already. Revert it and add a new migration instead.`,{file:u})}}d(ve,"checkMigrations");async function xe(e,t,o){const r=o.claw;if(!r)return;const c=P(t,r.dir,"skills");let i=[];try{i=(await C(c,{withFileTypes:!0})).filter(s=>s.isDirectory()).map(s=>s.name)}catch{return}for(const s of i){const p=await x(P(c,s,"SKILL.md"),"utf8").catch(()=>null),m=`${r.dir}/skills/${s}/SKILL.md`,n=p?/^---[\s\S]*?^name:\s*["']?([^"'\n]+)["']?\s*$/m.exec(p)?.[1]?.trim():void 0;n!==s&&e.add("TP-CLAW-002",p?`${m} declares name "${n??"(none)"}"; it must equal the folder name "${s}".`:`${r.dir}/skills/${s} has no SKILL.md.`,{file:m})}}d(xe,"checkClaw");function Se(e,t,o,r,c,i){const s=t.hostApiRange&&Q(t.hostApiRange)?V(t.hostApiRange):void 0,p=d(n=>{if(!s)return!1;const[u,a,l]=s.split(".").map(Number),[b,v,f]=n.split(".").map(Number);return u!==b?u<b:a!==v?a<v:l<f},"below");for(const n of r){if(!c(n)||n.test)continue;const u=d(a=>({file:n.path,line:a}),"at");if(n.part==="frontend"){if(n.path.endsWith(".css")||n.path.endsWith(".tsx")||n.path.endsWith(".ts")){const a=R(n.text);for(const l of L(n.text,I(n.path)))a.get(l.line-1)?.has("TP-UI-001")||e.add("TP-UI-001",l.kind==="dark"?`"${l.match}" is a hand-written dark override; tokens already carry both themes.`:`"${l.match}" is a literal color; use a token class (bg-card, text-muted-foreground, bg-primary\u2026).`,u(l.line))}w(n,"TP-DESK-001",/\beval\s*\(|\bnew\s+Function\s*\(/,a=>e.add("TP-DESK-001","eval / new Function: the desktop app's CSP (script-src 'self') refuses code compiled from strings.",u(a))),w(n,"TP-DESK-002",/\b(?:window\.|document\.)?location\.origin\b/,a=>e.add("TP-DESK-002","location.origin is tauri://localhost in the desktop app; build host addresses with ctx.hostUrl(path) and share links from ctx.publicPagesUrl.",u(a))),w(n,"TP-DESK-003",/\bwindow\.open\s*\(/,a=>e.add("TP-DESK-003","window.open does not reliably open links in the desktop app; use ctx.openExternal(url) (hostApiRange ^1.37.0), or ctx.download for a file.",u(a))),w(n,"TP-DESK-004",/\.download\s*=(?!=)|<a\b[^>]*\sdownload(?:[\s=>]|$)/,a=>e.add("TP-DESK-004","An <a download> save is not handled by the desktop app; use ctx.download({ path | blob, fileName }) (hostApiRange ^1.37.0).",u(a))),w(n,"TP-DESK-005",/\bnew\s+EventSource\s*\(|\.body\s*(?:\?\.|!\.|\.)\s*getReader\s*\(/,a=>e.add("TP-DESK-005","The desktop app buffers ctx.api responses whole (and caps them at 100 MB), so streams arrive at the end; subscribe to ctx.events for pushed updates.",u(a))),w(n,"TP-DESK-006",/\bnavigator\.clipboard\./,a=>e.add("TP-DESK-006","navigator.clipboard is not available in every shell; use ctx.copyText(text) (hostApiRange ^1.37.0).",u(a))),w(n,"TP-WEB-001",/\bfetch\s*\(\s*['"`]https?:\/\//,a=>e.add("TP-WEB-001","The web app's CSP allows connections to the platform only; call your backend through ctx.api and let it reach the service (declare it in parts.backend.egress).",u(a))),w(n,"TP-WEB-002",/\bimport\s*\(\s*['"`]https?:|createElement\(\s*['"]script['"]\s*\)|<script\b[^>]*\bsrc=/,a=>e.add("TP-WEB-002","Remote or injected scripts are refused by both shells' CSP; bundle the code.",u(a))),w(n,"TP-UI-002",/from\s+['"]@radix-ui\//,a=>e.add("TP-UI-002","Import the @tego/ui wrapper instead of @radix-ui/* (the shell shares @tego/ui; a second Radix copy breaks focus and portals).",u(a)));for(const a of ue){if(!p(a.since))continue;const l=a.name.split(".").pop();new RegExp(`\\.${l}\\s*(?:\\)|\\?(?!\\.)|&&)`).test(n.code)||w(n,"TP-MAN-002",a.pattern,b=>e.add("TP-MAN-002",`${a.name} needs host API ${a.since}, but hostApiRange is "${t.hostApiRange}"; raise it to ^${a.since}.`,u(b)))}}n.part==="backend"&&(w(n,"TP-BE-001",/\bheaders?\s*(?:\.get)?\(\s*['"]x-tego-plugin-(?:user-id|tenant-id|roles|avatar-id|delegation)['"]|\bheaders\s*\[\s*['"]x-tego-plugin-(?:user-id|tenant-id|roles|avatar-id|delegation)['"]/i,a=>e.add("TP-BE-001","Take the caller from the verified ctx (ctx.userId, ctx.tenantId, ctx.roles) that serveBackend hands you; the raw x-tego-plugin-* headers are unverified here.",u(a))),w(n,"TP-BE-005",/\bconsole\.(?:error|warn)\s*\(/,a=>e.add("TP-BE-005","Log through host.log so the message reaches the platform's logs; console output from a plugin container is not collected.",u(a)))),n.part!=="other"&&w(n,"TP-BE-002",/\b(?:roles|roleNames)\s*\??\.\s*(?:includes|indexOf)\(\s*['"`](?:admin|owner|super_?admin|tenant_?admin|member|manager)['"`]/i,a=>e.add("TP-BE-002","Do not decide by host role names; declare permissions in the access catalog (hostRoleBindings) and ask the engine (authorize / useAccess).",u(a)))}const m=r.filter(n=>n.part==="frontend"&&!n.test);if(o.frontend&&m.length>0&&(m.some(n=>/getDerivedStateFromError|componentDidCatch|PluginErrorBoundary/.test(n.code))||e.add("TP-UI-004","No error boundary in the frontend: the shell's boundary cannot see into your React root, so a render error leaves a blank page. Wrap the root in PluginErrorBoundary (@tego/plugin-sdk/react) or your own.",{file:o.frontend.dir}),i?.includes("tegoPluginTailwind"))){const n=new RegExp(`(?:className|class)=\\{?\\s*(?:cn\\()?\\s*['"\`][^'"\`]*(?<![\\w-])${t.id.replace(/[.]/g,"\\.")}(?![\\w-])`);m.some(u=>n.test(u.code))||e.add("TP-UI-003",`tegoPluginTailwind scopes every utility under .${t.id}, but no element carries className="${t.id}": none of the plugin's own classes will apply. Put it on the root element (and on portalled content, or use tegoPluginScopeRoot).`,{file:o.frontend.dir})}}d(Se,"checkSources");function $e(e,t,o,r){const c=r.filter(s=>s.test);if(c.length===0&&e.add("TP-TEST-001","The plugin has no *.test.ts files; backend routes and pure frontend logic need tests (createTestPluginHost for SQL)."),!t.access||!o.backend)return;c.some(s=>s.text.includes("assertRouteCoverage"))||e.add("TP-ACC-001","The manifest declares an access catalog but no test calls assertRouteCoverage(app): a route without a policy would be open to everyone who can open the plugin.",{file:o.backend.dir}),r.filter(s=>(s.part==="backend"||s.part==="shared")&&!s.test).some(s=>/\breconcile\s*\(/.test(s.code))||e.add("TP-ACC-002","The manifest declares an access catalog but start() never calls reconcile(host): built-in roles and catalog changes never reach the database.",{file:o.backend.dir})}d($e,"checkAccessAndTests");async function Ae(e){const t=e.root;await Y(P(t,"tego.plugin.json")).catch(()=>{throw new Error(`No tego.plugin.json in ${t}; run doctor in the plugin folder.`)});const o=new be;let r;try{r=JSON.parse(await x(P(t,"tego.plugin.json"),"utf8"))}catch(l){return o.add("TP-MAN-001",`tego.plugin.json is not valid JSON: ${l instanceof Error?l.message:String(l)}`,{file:"tego.plugin.json"}),D(o,void 0)}const c=F(r);if(!c.ok||!c.manifest){for(const l of c.errors)o.add("TP-MAN-001",l,{file:"tego.plugin.json"});return D(o,r.id)}const i=c.manifest,s=q(i),p=[];await K(t,"",p);const m=await Promise.all(p.map(async l=>{const b=await x(P(t,l),"utf8");return{path:l,part:Pe(l,s),text:b,code:B(b),test:fe.test(l)}})),n=e.files?.map(l=>Te(ee(t,P(t,l)))),u=d(l=>!n||n.includes(l.path),"scanned"),a=s.frontend?await x(P(t,s.frontend.dir,"vite.config.ts"),"utf8").catch(()=>null):null;return ke(o,await ye(P(t,"package.json"))),await Ee(o,t,i,s,m.filter(u)),await ve(o,t,s),await xe(o,t,s),Se(o,i,s,m,u,a),$e(o,i,s,m),D(o,i.id)}d(Ae,"runDoctor");function D(e,t){const o={errors:e.list.filter(i=>i.severity==="error").length,warnings:e.list.filter(i=>i.severity==="warning").length},r=new Map(N.map((i,s)=>[i.id,s])),c=[...e.list].sort((i,s)=>(i.severity===s.severity?0:i.severity==="error"?-1:1)||(r.get(i.rule)??0)-(r.get(s.rule)??0)||(i.file??"").localeCompare(s.file??"")||(i.line??0)-(s.line??0));return{...t?{pluginId:t}:{},findings:c,...o}}d(D,"summarize");var Ce=["TP-MAN-001","TP-I18N-001","TP-BE-003"];function Ne(e){const t=e.findings.map(o=>{const r=o.file?`${o.file}${o.line?`:${o.line}`:""}  `:"";return`${o.severity==="error"?"\u2716":"\u26A0"} ${o.rule}  ${r}${o.message}`});return t.push(e.findings.length===0?"\u2705 doctor: no problems":`${e.errors} error(s), ${e.warnings} warning(s). Each rule is explained in node_modules/@tego/plugin-sdk/agent/RULES.md.`),t.join(`
-`)}d(Ne,"formatDoctorReport");export{N as DOCTOR_RULES,Ce as UPLOAD_BLOCKING_RULES,_ as doctorRule,L as findColorIssues,Ne as formatDoctorReport,Ae as runDoctor};
+var pe=Object.defineProperty;var f=(e,t)=>pe(e,"name",{value:t,configurable:!0});import{parseTegoPluginManifest as ue}from"./chunk-EIVA5BR6.js";import{verifyFrontendLocales as he,flattenLocaleKeys as fe,verifyMigrationNames as me}from"./chunk-2NTAWYCG.js";import{resolvePluginParts as ge}from"./chunk-IVJECPGG.js";import{pluginI18nNamespace as be}from"./chunk-INCA3GFW.js";import{isValidHostApiRange as we,hostApiRangeMinimum as Te}from"./chunk-56QOZQTY.js";import"./chunk-VMCGDDGP.js";import"./chunk-SNUCO2MK.js";import{spawn as ke,execFile as Pe}from"child_process";import{access as ye,readFile as S,stat as ve,readdir as B}from"fs/promises";import{resolve as L,join as P,dirname as Ee,relative as z,isAbsolute as xe,sep as G,extname as H,posix as O}from"path";import{createHash as $e}from"crypto";var Se="ui-colors-allow",Ae="slate|gray|zinc|neutral|stone|red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose",Ne="bg|text|border(?:-[trblxyse])?|ring(?:-offset)?|from|via|to|fill|stroke|outline|divide|placeholder|caret|accent|decoration|shadow",Ce=[new RegExp(`(?<![\\w-])(?:${Ne})-(?:(?:${Ae})-(?:50|[1-9]00|950)|white|black)(?:\\/\\d{1,3})?(?![\\w-])`,"g"),/-\[(?:#[0-9a-fA-F]{3,8}|(?:rgba?|hsla?)\(\s*\d+)/g,/(?<![a-zA-Z0-9[-])(?:rgba?|hsla?)\(\s*\d+/g],Ie=/['"`]#[0-9a-fA-F]{3,8}['"`]/g,_e=/(?<![\w&-])#[0-9a-fA-F]{3,8}(?![\w-])/g,q=/(?<![\w-])dark:(?=\S)/g,De=/\.dark(?![\w-])/g;function J(e){return e.replace(/(^|[\s{(,;])\/\*[\s\S]*?\*\//g,(t,s)=>s+t.slice(s.length).replace(/[^\n]/g," ")).replace(/(^|\s)\/\/.*$/gm,(t,s)=>s)}f(J,"stripComments");function Re(e){const t=new Set;return e.forEach((s,n)=>{s.includes(Se)&&(t.add(n),/^\s*(?:\/\/|\/\*|\*|\{\/\*)/.test(s)&&t.add(n+1))}),t}f(Re,"allowedLines");function X(e,t){const s=t===".css",n=Re(e.split(`
+`)),l=J(e).split(`
+`),o=[...Ce,s?_e:Ie],a=s?[q,De]:[q],r=[];return l.forEach((p,i)=>{if(n.has(i))return;const h=[];for(const[d,c]of[["color",o],["dark",a]])for(const u of c)for(const b of p.matchAll(u))h.push({kind:d,match:b[0],at:b.index??0});h.sort((d,c)=>d.kind.localeCompare(c.kind)||d.at-c.at).forEach(({kind:d,match:c})=>r.push({line:i+1,kind:d,match:c}))}),r}f(X,"findColorIssues");function A(e,t,s){return $e("sha1").update(`${e}\0${t??""}\0${s.replace(/\s+/g," ").trim()}`).digest("hex").slice(0,16)}f(A,"findingFingerprint");var m=f((e,t,s,n)=>({id:e,severity:t,guide:s,title:n}),"rule"),I=[m("TP-MAN-001","error","manifest.md","tego.plugin.json is valid"),m("TP-MAN-002","error","host-api-versions.md","hostApiRange admits every host capability the code uses"),m("TP-PKG-001","error","manifest.md","SDK packages come from npm aliases or workspace links, never a plain @tego/* name"),m("TP-PKG-002","warning","testing.md","package.json has the lint, type-check, test and build gates"),m("TP-PKG-003","error","manifest.md","No imports of @tego/shared or host app code; only published packages"),m("TP-CLAW-002","warning","claw.md","Each claw skill's frontmatter name matches its folder"),m("TP-DESK-001","error","desktop-web.md","No eval or new Function (the desktop CSP refuses them)"),m("TP-DESK-002","error","desktop-web.md","No addresses built from location.origin (tauri://localhost on desktop)"),m("TP-DESK-003","error","desktop-web.md","External links open with ctx.openExternal, not window.open"),m("TP-DESK-004","error","desktop-web.md","Files are saved with ctx.download, not <a download> or a.download"),m("TP-DESK-005","warning","desktop-web.md","No streamed responses or EventSource from the frontend (the desktop proxy buffers; use ctx.events)"),m("TP-DESK-006","warning","desktop-web.md","Clipboard writes go through ctx.copyText"),m("TP-WEB-001","error","desktop-web.md","The frontend calls no third-party URL (the web CSP blocks it); call the backend, which declares egress"),m("TP-WEB-002","error","desktop-web.md","No remote or injected scripts; everything ships in the bundle"),m("TP-WEB-003","error","frontend.md","The frontend calls its backend through ctx.api (createApiClient), never a raw fetch of a path"),m("TP-WEB-004","error","desktop-web.md","No cookie-based auth (document.cookie, hono/cookie); ctx.api carries the credentials"),m("TP-UI-001","error","ui.md","Colors come from token classes: no hex, rgb(), palette classes or dark: overrides"),m("TP-UI-002","error","ui.md","No direct @radix-ui/* imports; use @tego/ui"),m("TP-UI-003","error","ui.md","The plugin's root element carries its scope class (.<pluginId>) when it compiles its own Tailwind"),m("TP-UI-004","error","frontend.md","The frontend has its own error boundary"),m("TP-UI-005","warning","ui.md","Interface copy stays within budget: explanations \u2264 24 characters, any string \u2264 40 (zh-CN)"),m("TP-I18N-001","error","i18n.md","All ten locales, with the same keys as zh-CN, and every nav label defined"),m("TP-I18N-002","error","i18n.md","Every locale value keeps the {{placeholders}} of zh-CN and is not empty"),m("TP-I18N-003","error","i18n.md","Every literal t('\u2026') key exists in zh-CN"),m("TP-I18N-004","warning","i18n.md","Current terminology: \u6570\u5B57\u5458\u5DE5 / Employee, never \u6570\u5B57\u5206\u8EAB / digital avatar"),m("TP-I18N-005","error","i18n.md","tegoAccess.* strings are merged by pack; the plugin locales do not copy them"),m("TP-BE-001","error","backend.md","Identity comes from the verified ctx, never from the raw x-tego-plugin-* headers"),m("TP-BE-002","error","access.md","No host role names in business code; ask the access engine"),m("TP-BE-003","error","migrations.md","Migrations are <ordinal>_<name>.sql with unique ordinals"),m("TP-BE-004","error","migrations.md","Committed migrations are never edited or deleted"),m("TP-BE-005","warning","backend.md","Backend errors are logged through host.log, not console"),m("TP-BE-006","error","backend.md","Configuration comes from host.config, never process.env"),m("TP-BE-007","warning","backend.md","The backend app turns every error into JSON with pluginErrorHandler"),m("TP-ACC-001","error","access.md","With an access catalog, a test asserts every route has a policy (assertRouteCoverage)"),m("TP-ACC-002","error","access.md","With an access catalog, start() reconciles it (reconcile(host))"),m("TP-TEST-001","warning","testing.md","The plugin has tests"),m("TP-TEST-002","warning","testing.md","Each test file starts with a Business Cases list"),m("TP-TPL-001","error","agent-templates.md","A template whose content changed raises its version (existing employees only see updates by version)"),m("TP-TPL-002","warning","agent-templates.md","usageGuide.summary is at most 30 characters and quickPrompts lists 3\u20134 prompts")],je=new Map(I.map(e=>[e.id,e]));function V(e){return je.get(e)}f(V,"doctorRule");var Y={"manifest.md":["tego.plugin.json","package.json"],"host-api-versions.md":["tego.plugin.json"],"desktop-web.md":["<frontend>/src/**"],"frontend.md":["<frontend>/src/**"],"ui.md":["<frontend>/src/**/*.tsx","<frontend>/src/**/*.css"],"i18n.md":["<frontend>/i18n/**"],"backend.md":["<backend>/src/**"],"storage.md":["<backend>/src/**/storage*","<backend>/src/**/upload*","<backend>/src/**/files*"],"migrations.md":["<backend>/migrations/**","<backend>/src/**/schema*.ts","<backend>/drizzle.config.ts"],"access.md":["shared/access.json","<backend>/src/access*.ts","<backend>/src/**/access/**"],"claw.md":["<claw>/**"],"testing.md":["**/*.test.ts"],"agent-templates.md":["templates/**"]};function Be(e={}){const t=f(n=>n.replace("<frontend>",e.frontend??"frontend").replace("<backend>",e.backend??"backend").replace("<claw>",e.claw??"claw"),"resolve2"),s=Y;return{catalogVersion:1,rules:I.map(n=>({...n,appliesTo:(s[n.guide]??[]).map(t),enforcedBy:"doctor"})),guides:Object.entries(s).map(([n,l])=>({file:n,appliesTo:l.map(t)}))}}f(Be,"ruleCatalog");var Z=["doctor","lint","type-check","test"],Le=[["pnpm-lock.yaml","pnpm"],["package-lock.json","npm"],["yarn.lock","yarn"],["bun.lockb","bun"],["bun.lock","bun"]],Q=4e3,K=50;async function ee(e){let t=L(e);for(;;){for(const[n,l]of Le)if(await ye(P(t,n)).then(()=>!0,()=>!1))return l;const s=Ee(t);if(s===t)return"npm";t=s}}f(ee,"detectPackageManager");function te(e,t,s,n){return new Promise(l=>{const o=ke(e,t,{cwd:s,signal:n,shell:process.platform==="win32",env:{...process.env,FORCE_COLOR:"0",NO_COLOR:"1",CI:"1"}});let a="";o.stdout.on("data",r=>a+=String(r)),o.stderr.on("data",r=>a+=String(r)),o.on("error",r=>l({code:null,output:`${a}
+${r.message}`})),o.on("close",r=>l({code:r,output:a}))})}f(te,"run");function W(e){return e.replace(/\u001b\[[0-9;]*m/g,"")}f(W,"stripAnsi");function M(e,t){const s=xe(t)?t:L(e,t),n=z(e,s);return(n.startsWith("..")?t:n).split(G).join("/")}f(M,"toRelative");var Oe=/^(.+?)\((\d+),\d+\):\s+error\s+(TS\d+):\s+(.*)$/,Ke=/^(.+?):(\d+):\d+\s+-\s+error\s+(TS\d+):\s+(.*)$/;function se(e,t){const s=[];for(const n of W(e).split(`
+`)){const l=n.trim();if(l.startsWith(">"))continue;const o=Oe.exec(l)??Ke.exec(l);if(!o)continue;const a=M(t,o[1]);if(s.push({source:"type-check",severity:"error",rule:o[3],file:a,line:Number(o[2]),message:o[4],fingerprint:A(o[3],a,o[4])}),s.length>=K)break}return s}f(se,"parseTypeErrors");function ne(e,t){const s=e.indexOf("[{"),n=e.lastIndexOf("}]");if(s<0||n<s)return e.trim().startsWith("[]")?[]:void 0;let l;try{l=JSON.parse(e.slice(s,n+2))}catch{return}const o=[];for(const a of l){const r=M(t,a.filePath);for(const p of a.messages){const i=p.ruleId??"eslint";if(o.push({source:"lint",severity:p.severity>=2?"error":"warning",rule:i,file:r,...p.line?{line:p.line}:{},message:p.message,fingerprint:A(i,r,p.message)}),o.length>=K)return o}}return o}f(ne,"parseEslintJson");function oe(e,t){const s=[],n=new Set;for(const l of W(e).split(`
+`)){const o=/^\s*(?:FAIL|×|✗)\s+(\S+\.(?:test|spec)\.[cm]?[jt]sx?)\s*(?:>\s*(.*))?$/.exec(l);if(!o)continue;const a=M(t,o[1]),r=o[2]?.trim().replace(/^$/,"a test failed")??"a test failed",p=`${a}\0${r}`;if(!n.has(p)&&(n.add(p),s.push({source:"test",severity:"error",rule:"test",file:a,message:r,fingerprint:A("test",a,r)}),s.length>=K))break}return s}f(oe,"parseTestFailures");function _(e){const t=W(e).trim();return t.length>Q?`\u2026${t.slice(-Q)}`:t}f(_,"tail");async function We(e){const t=L(e.root),s=e.steps??Z,l=JSON.parse(await S(P(t,"package.json"),"utf8").catch(()=>"{}")).scripts??{},o=await ee(t),a=[],r=[];for(const p of s){const i=Date.now(),h=f((b,k)=>{a.push({step:p,status:b,durationMs:Date.now()-i,...k?{detail:k}:{}})},"done");if(e.signal?.aborted)break;if(p==="doctor"){const b=await ce(e.files?{root:t,files:e.files}:{root:t});for(const k of b.findings)r.push({source:"doctor",...k});h(b.errors>0?"failed":"passed");continue}const d=l[p];if(!d){h("skipped",`package.json has no "${p}" script`);continue}if(p==="lint"&&/^\s*eslint\b/.test(d)){const b=e.files?.length?e.files.filter(w=>/\.[cm]?[jt]sx?$/.test(w)):["."];if(b.length===0){h("skipped","no lintable files among the given ones");continue}const y=await te(o,[...o==="npm"?["exec","--","eslint"]:["exec","eslint"],"--format","json","--no-warn-ignored",...b],t,e.signal),g=ne(y.output,t);if(g){r.push(...g),h(g.some(w=>w.severity==="error")?"failed":"passed");continue}if(y.code===0){h("passed");continue}r.push({source:"lint",severity:"error",rule:"lint",message:_(y.output),fingerprint:A("lint",void 0,"lint failed")}),h("failed",_(y.output));continue}const c=await te(o,["run",p],t,e.signal);if(c.code===0){h("passed");continue}const u=p==="type-check"?se(c.output,t):p==="test"?oe(c.output,t):[];r.push(...u.length>0?u:[{source:p,severity:"error",rule:p,message:_(c.output),fingerprint:A(p,void 0,`${p} failed`)}]),h("failed",_(c.output))}return{passed:!a.some(p=>p.status==="failed"),steps:a,findings:r}}f(We,"runChecks");function Me(e){const t=e.steps.map(s=>`${s.status==="passed"?"\u2713":s.status==="failed"?"\u2716":"\u2013"} ${s.step}${s.status==="skipped"&&s.detail?` (${s.detail})`:""}`);for(const s of e.findings){const n=s.file?`${s.file}${s.line?`:${s.line}`:""}  `:"";t.push(`  ${s.severity==="error"?"\u2716":"\u26A0"} [${s.source}] ${s.rule??""}  ${n}${s.message.split(`
+`)[0]}`)}return t.push(e.passed?"\u2705 check: passed":"\u2716 check: failed"),t.join(`
+`)}f(Me,"formatCheckReport");var Ue=[{pattern:/\.openExternal\s*\(/,since:"1.37.0",name:"ctx.openExternal"},{pattern:/\.copyText\s*\(/,since:"1.37.0",name:"ctx.copyText"},{pattern:/\b(?:ctx|host|context)\.download\s*\(/,since:"1.37.0",name:"ctx.download"},{pattern:/\b(?:ctx|host|context)\.platform\b/,since:"1.37.0",name:"ctx.platform"},{pattern:/\b(?:ctx|context)\.events\b/,since:"1.3.0",name:"ctx.events"},{pattern:/\bhost\.directory\b/,since:"1.5.0",name:"host.directory"},{pattern:/\b(?:ctx|context)\.ai\b/,since:"1.9.0",name:"ctx.ai"},{pattern:/\.hostUrl\s*\(/,since:"1.12.0",name:"ctx.hostUrl"},{pattern:/\.uploadPath\s*\(/,since:"1.12.0",name:"storage.uploadPath"},{pattern:/\.collapseSidebar\s*\(/,since:"1.14.0",name:"ctx.layout.collapseSidebar"},{pattern:/\.managedPath\s*\(/,since:"1.15.0",name:"storage.managedPath"},{pattern:/\bstorage\.copy\s*\(/,since:"1.19.0",name:"storage.copy"},{pattern:/\b(?:ctx|context)\.office\b/,since:"1.21.0",name:"ctx.office"},{pattern:/\bhost\.tenantId\b/,since:"1.22.0",name:"host.tenantId"},{pattern:/\bproactive\.emit\s*\(/,since:"1.26.0",name:"proactive.emit"},{pattern:/\bmail\.send\s*\(/,since:"1.29.0",name:"mail.send"},{pattern:/\battention\.request\s*\(/,since:"1.34.0",name:"attention.request"}],Fe=new Set([".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".css"]),ze=new Set(["node_modules","dist","build",".tego-dev",".turbo",".drizzle","__fixtures__","coverage"]),Ge=/\.(?:test|spec)\.[cm]?[jt]sx?$|(?:^|[\\/])test[\\/]|(?:^|[\\/])test-[\w-]+\.[cm]?[jt]s$|-double\.[cm]?[jt]s$|\.d\.ts$/,He=/tego-doctor-ignore\s+([A-Z0-9-]+(?:\s*,\s*[A-Z0-9-]+)*)/,qe=/\{\{\s*([\w.-]+)\s*\}\}/g,Je=["lint","type-check","test","build"];function Xe(e){return e.split(G).join("/")}f(Xe,"toPosix");async function re(e,t,s){let n;try{n=await B(P(e,t),{withFileTypes:!0})}catch{return}for(const l of n){const o=t?`${t}/${l.name}`:l.name;l.isDirectory()?!ze.has(l.name)&&!l.name.startsWith(".")&&await re(e,o,s):Fe.has(H(l.name))&&s.push(o)}}f(re,"walk");function ae(e){return{async list(t){try{return(await B(P(e,t),{withFileTypes:!0})).filter(n=>n.isFile()).map(n=>n.name)}catch{return[]}},readText:f(t=>S(P(e,t),"utf8").catch(()=>null),"readText")}}f(ae,"folderReader");function C(e,t){return new Promise(s=>{Pe("git",["-C",e,...t],{maxBuffer:8*1024*1024},(n,l)=>s(n?null:l))})}f(C,"runGit");function D(e){const t=new Map;return e.split(`
+`).forEach((s,n)=>{const l=He.exec(s);if(!l?.[1])return;const o=new Set(l[1].split(",").map(r=>r.trim())),a=f(r=>t.set(r,new Set([...t.get(r)??[],...o])),"add");a(n),/^\s*(?:\/\/|\/\*|\*|\{\/\*)/.test(s)&&a(n+1)}),t}f(D,"ignoredLines");var Ve=class{static{f(this,"Findings")}list=[];add(e,t,s={}){const{severity:n,guide:l}=V(e),{evidence:o,...a}=s;this.list.push({rule:e,severity:n,message:t,guide:l,...a,fingerprint:A(e,a.file,o??t)})}};function T(e,t,s,n){const l=D(e.text);e.code.split(`
+`).forEach((o,a)=>{if(l.get(a)?.has(t))return;const r=s.exec(o);r&&n(a+1,r[0],o.trim())})}f(T,"eachMatch");function Ye(e,t){const s=f(n=>!!n&&(e===n||e.startsWith(`${n}/`)),"inside");return s(t.frontend?.dir)||s(t.publicFrontend?.dir)?"frontend":s(t.backend?.dir)?"backend":s(t.claw?.dir)?"claw":s("shared")?"shared":"other"}f(Ye,"partOf");async function ie(e){try{return JSON.parse(await S(e,"utf8"))}catch{return}}f(ie,"readJson");function Ze(e,t){if(!t)return;for(const l of["dependencies","devDependencies","peerDependencies"]){const o=t[l];if(!(!o||typeof o!="object"))for(const[a,r]of Object.entries(o))!a.startsWith("@tego/")||typeof r!="string"||/^(?:npm:@zhama\/tego-|workspace:|file:|link:|portal:)/.test(r)||e.add("TP-PKG-001",`${l}.${a} is "${r}": on npm @tego/* belongs to another project. Install it as "npm:@zhama/tego-${a.slice(6)}@^<sdk version>".`,{file:"package.json"})}const s=t.scripts??{},n=Je.filter(l=>typeof s[l]!="string");n.length>0&&e.add("TP-PKG-002",`package.json has no ${n.map(l=>`"${l}"`).join(", ")} script; the platform's gates are lint, type-check, test and build.`,{file:"package.json"})}f(Ze,"checkPackageJson");async function Qe(e,t,s,n,l){const o=n.frontend;if(!o)return;const{bundles:a,errors:r}=await he(ae(t),o);for(const g of r)e.add("TP-I18N-001",g,{file:o.i18nDirPath});const p=a.get("zh-CN");if(!p)return;const i=f((g,w="",v=new Map)=>{if(typeof g!="object"||g===null||Array.isArray(g))return v.set(w,g),v;for(const[x,E]of Object.entries(g))i(E,w?`${w}.${x}`:x,v);return v},"leaves"),h=f(g=>new Set(typeof g=="string"?[...g.matchAll(qe)].map(w=>w[1]):[]),"placeholders"),d=i(p),c=`${o.i18nDirPath}/zh-CN.json`;[...d.keys()].some(g=>g==="tegoAccess"||g.startsWith("tegoAccess."))&&e.add("TP-I18N-005","zh-CN.json contains tegoAccess.* strings; pack merges the access UI strings, remove the copy from every locale.",{file:c,evidence:"tegoAccess"});let u=0;for(const[g,w]of d){if(typeof w!="string"||u>=10)continue;const v=g.slice(g.lastIndexOf(".")+1);if(tt.test(v))continue;const x=et.test(v)?st:nt,E=U(w);E>x&&(u++,e.add("TP-UI-005",`"${g}" is ${E} characters (budget ${x}); shorten it, or move the explanation into an InfoTip.`,{file:c,evidence:g}))}for(const[g,w]of a){const v=`${o.i18nDirPath}/${g}.json`;let x=0;for(const[E,$]of i(w)){if(x>=10)break;if(typeof $=="string"&&$.trim()===""){e.add("TP-I18N-002",`"${E}" is empty in ${g}.json.`,{file:v}),x++;continue}if(g==="zh-CN"||!d.has(E))continue;const N=h(d.get(E)),R=h($),le=[...N].filter(j=>!R.has(j)),de=[...R].filter(j=>!N.has(j));(le.length||de.length)&&(e.add("TP-I18N-002",`"${E}" in ${g}.json has placeholders {${[...R].join(", ")}} but zh-CN has {${[...N].join(", ")}}.`,{file:v}),x++)}for(const[E,$]of i(w))if(typeof $=="string"&&/数字分身|digital avatar/i.test($)){e.add("TP-I18N-004",`"${E}" in ${g}.json says "${/数字分身/.test($)?"\u6570\u5B57\u5206\u8EAB":"digital avatar"}"; the platform calls them \u6570\u5B57\u5458\u5DE5 / Employee ({{avatarTerm}}).`,{file:v});break}}const b=fe(p),k=new Set(Object.keys(p)),y=f(g=>b.has(g)||["_one","_other","_zero","_few","_many","_two"].some(w=>b.has(g+w))||[...b].some(w=>w.startsWith(`${g}.`)),"exists");for(const g of l){if(g.part!=="frontend"||g.test)continue;const w=D(g.text);g.code.split(`
+`).forEach((v,x)=>{if(!w.get(x)?.has("TP-I18N-003"))for(const E of v.matchAll(/\bt\(\s*['"]([A-Za-z0-9_.-]+)['"]/g)){const $=E[1],N=$.split(".")[0];!$.includes(".")||!k.has(N)||y($)||e.add("TP-I18N-003",`t('${$}') has no entry in zh-CN.json (namespace ${be(s.id)}).`,{file:g.path,line:x+1})}})}}f(Qe,"checkLocales");function U(e){return[...e.replace(/\{\{[^}]*\}\}/g,"X")].length}f(U,"copyLength");var et=/(help|hint|description|desc|subtitle|intro)$/i,tt=/prompt/i,st=24,nt=40;async function ot(e,t,s){const n=s.agentTemplates??[];if(n.length===0)return;const l=(await C(t,["rev-parse","--show-prefix"]))?.trim()??"";for(const o of n){const a=o.entry.split("/").slice(0,-1).join("/"),r=`${a}/template.config.json`,p=await ie(P(t,r));if(!p)continue;const i=p.content??{},h=i.usageGuide;typeof h?.summary=="string"&&U(h.summary)>30&&e.add("TP-TPL-002",`${o.key}: usageGuide.summary is ${U(h.summary)} characters; the landing page shows one line, keep it within 30.`,{file:r,evidence:"summary"});const d=i.quickPrompts;Array.isArray(d)&&(d.length<3||d.length>4)&&e.add("TP-TPL-002",`${o.key}: quickPrompts has ${d.length} prompt(s); offer 3\u20134 ready-to-click prompts.`,{file:r,evidence:"quickPrompts"});const u=(await C(t,["status","--porcelain","--untracked-files=all","--",a])??"").split(`
+`).map(y=>y.slice(3).trim()).filter(y=>y&&!y.endsWith("/template.json"));if(u.length===0)continue;const b=await C(t,["show",`HEAD:${l}${r}`]);if(!b)continue;let k;try{k=JSON.parse(b).version}catch{continue}k!==void 0&&k===p.version&&e.add("TP-TPL-001",`${o.key} changed (${u.length} file(s)) but its version is still ${String(p.version)}; raise version in ${r} so existing employees see the update.`,{file:r,evidence:"version"})}}f(ot,"checkTemplates");async function rt(e,t,s){const n=s.backend;if(!n)return;const{errors:l}=await me(ae(t),n.migrationsDirPath);for(const r of l)e.add("TP-BE-003",r,{file:n.migrationsDirPath});const o=await C(t,["diff","--name-status","HEAD","--",n.migrationsDirPath]);if(!o)return;const a=(await C(t,["rev-parse","--show-prefix"]))?.trim()??"";for(const r of o.split(`
+`)){const[p,i]=r.split("	");if(!i||p!=="M"&&p!=="D")continue;const h=i.startsWith(a)?i.slice(a.length):i;e.add("TP-BE-004",`${h} is a committed migration and was ${p==="M"?"edited":"deleted"}; an install may have applied it already. Revert it and add a new migration instead.`,{file:h})}}f(rt,"checkMigrations");async function at(e,t,s){const n=s.claw;if(!n)return;const l=P(t,n.dir,"skills");let o=[];try{o=(await B(l,{withFileTypes:!0})).filter(a=>a.isDirectory()).map(a=>a.name)}catch{return}for(const a of o){const r=await S(P(l,a,"SKILL.md"),"utf8").catch(()=>null),p=`${n.dir}/skills/${a}/SKILL.md`,i=r?/^---[\s\S]*?^name:\s*["']?([^"'\n]+)["']?\s*$/m.exec(r)?.[1]?.trim():void 0;i!==a&&e.add("TP-CLAW-002",r?`${p} declares name "${i??"(none)"}"; it must equal the folder name "${a}".`:`${n.dir}/skills/${a} has no SKILL.md.`,{file:p})}}f(at,"checkClaw");function it(e,t,s,n,l,o){const a=t.hostApiRange&&we(t.hostApiRange)?Te(t.hostApiRange):void 0,r=f(i=>{if(!a)return!1;const[h,d,c]=a.split(".").map(Number),[u,b,k]=i.split(".").map(Number);return h!==u?h<u:d!==b?d<b:c<k},"below");for(const i of n){if(!l(i)||i.test)continue;const h=f((d,c)=>({file:i.path,line:d,evidence:c}),"at");if(i.part==="frontend"){if(i.path.endsWith(".css")||i.path.endsWith(".tsx")||i.path.endsWith(".ts")){const d=D(i.text);for(const c of X(i.text,H(i.path)))d.get(c.line-1)?.has("TP-UI-001")||e.add("TP-UI-001",c.kind==="dark"?`"${c.match}" is a hand-written dark override; tokens already carry both themes.`:`"${c.match}" is a literal color; use a token class (bg-card, text-muted-foreground, bg-primary\u2026).`,h(c.line,c.match))}T(i,"TP-DESK-001",/\beval\s*\(|\bnew\s+Function\s*\(/,(d,c,u)=>e.add("TP-DESK-001","eval / new Function: the desktop app's CSP (script-src 'self') refuses code compiled from strings.",h(d,u))),T(i,"TP-DESK-002",/\b(?:window\.|document\.)?location\.origin\b/,(d,c,u)=>e.add("TP-DESK-002","location.origin is tauri://localhost in the desktop app; build host addresses with ctx.hostUrl(path) and share links from ctx.publicPagesUrl.",h(d,u))),T(i,"TP-DESK-003",/\bwindow\.open\s*\(/,(d,c,u)=>e.add("TP-DESK-003","window.open does not reliably open links in the desktop app; use ctx.openExternal(url) (hostApiRange ^1.37.0), or ctx.download for a file.",h(d,u))),T(i,"TP-DESK-004",/\.download\s*=(?!=)|<a\b[^>]*\sdownload(?:[\s=>]|$)/,(d,c,u)=>e.add("TP-DESK-004","An <a download> save is not handled by the desktop app; use ctx.download({ path | blob, fileName }) (hostApiRange ^1.37.0).",h(d,u))),T(i,"TP-DESK-005",/\bnew\s+EventSource\s*\(|\.body\s*(?:\?\.|!\.|\.)\s*getReader\s*\(/,(d,c,u)=>e.add("TP-DESK-005","The desktop app buffers ctx.api responses whole (and caps them at 100 MB), so streams arrive at the end; subscribe to ctx.events for pushed updates.",h(d,u))),T(i,"TP-DESK-006",/\bnavigator\.clipboard\./,(d,c,u)=>e.add("TP-DESK-006","navigator.clipboard is not available in every shell; use ctx.copyText(text) (hostApiRange ^1.37.0).",h(d,u))),T(i,"TP-WEB-001",/\bfetch\s*\(\s*['"`]https?:\/\//,(d,c,u)=>e.add("TP-WEB-001","The web app's CSP allows connections to the platform only; call your backend through ctx.api and let it reach the service (declare it in parts.backend.egress).",h(d,u))),T(i,"TP-WEB-002",/\bimport\s*\(\s*['"`]https?:|createElement\(\s*['"]script['"]\s*\)|<script\b[^>]*\bsrc=/,(d,c,u)=>e.add("TP-WEB-002","Remote or injected scripts are refused by both shells' CSP; bundle the code.",h(d,u))),T(i,"TP-UI-002",/from\s+['"]@radix-ui\//,(d,c,u)=>e.add("TP-UI-002","Import the @tego/ui wrapper instead of @radix-ui/* (the shell shares @tego/ui; a second Radix copy breaks focus and portals).",h(d,u))),T(i,"TP-WEB-003",/\bfetch\s*\(\s*['"`](?!https?:|data:|blob:)/,(d,c,u)=>e.add("TP-WEB-003","Call your backend through ctx.api (createApiClient from @tego/plugin-sdk/react): a raw fetch misses the base path and the credentials in the desktop app, and loses the error body.",h(d,u))),T(i,"TP-WEB-004",/\bdocument\.cookie\b/,(d,c,u)=>e.add("TP-WEB-004","Cookies do not carry the session in the desktop app; ctx.api sends the credentials in both shells.",h(d,u)))}if(i.part==="backend"&&(T(i,"TP-BE-001",/\bheaders?\s*(?:\.get)?\(\s*['"]x-tego-plugin-(?:user-id|tenant-id|roles|avatar-id|delegation)['"]|\bheaders\s*\[\s*['"]x-tego-plugin-(?:user-id|tenant-id|roles|avatar-id|delegation)['"]/i,(d,c,u)=>e.add("TP-BE-001","Take the caller from the verified ctx (ctx.userId, ctx.tenantId, ctx.roles) that serveBackend hands you; the raw x-tego-plugin-* headers are unverified here.",h(d,u))),T(i,"TP-BE-005",/\bconsole\.(?:error|warn)\s*\(/,(d,c,u)=>e.add("TP-BE-005","Log through host.log so the message reaches the platform's logs; console output from a plugin container is not collected.",h(d,u))),T(i,"TP-BE-006",/\bprocess\.env\b(?!\.NODE_ENV\b|\[\s*['"]NODE_ENV['"]\s*\])/,(d,c,u)=>e.add("TP-BE-006","Read configuration from host.config.current() (declared in the manifest's config schema); the platform does not pass a plugin its own environment variables.",h(d,u))),T(i,"TP-WEB-004",/from\s+['"]hono\/cookie['"]/,(d,c,u)=>e.add("TP-WEB-004","The caller is the verified ctx that serveBackend hands you; cookies are not how plugins authenticate.",h(d,u)))),i.part!=="other"){T(i,"TP-PKG-003",/(?:from\s+|import\s*\(\s*|require\s*\(\s*)['"](?:@tego\/shared(?:\/|['"])|@tego\/chat(?!\/plugin-surface)(?:\/|['"]))/,(c,u,b)=>e.add("TP-PKG-003","Plugins only import published packages (@tego/plugin-sdk, @tego/ui, @tego/chat/plugin-surface, \u2026); @tego/shared and host app code do not exist outside the platform.",h(c,b)));const d=D(i.text);i.code.split(`
+`).forEach((c,u)=>{if(!d.get(u)?.has("TP-PKG-003"))for(const b of c.matchAll(/(?:from\s+|import\s*\(\s*|require\s*\(\s*)['"](\.\.?\/[^'"]*)['"]/g)){const k=O.normalize(O.join(O.dirname(i.path),b[1]));k.startsWith("../")&&e.add("TP-PKG-003",`"${b[1]}" resolves outside the plugin folder (${k}); a packed plugin only has its own files and published packages.`,h(u+1,c.trim()))}});for(const c of Ue){if(!r(c.since))continue;const u=c.name.split(".").pop();new RegExp(`\\.${u}\\s*(?:\\)|\\?(?!\\.)|&&)`).test(i.code)||T(i,"TP-MAN-002",c.pattern,(b,k,y)=>e.add("TP-MAN-002",`${c.name} needs host API ${c.since}, but hostApiRange is "${t.hostApiRange}"; raise it to ^${c.since}.`,h(b,y)))}}i.part!=="other"&&T(i,"TP-BE-002",/\b(?:roles|roleNames)\s*\??\.\s*(?:includes|indexOf)\(\s*['"`](?:admin|owner|super_?admin|tenant_?admin|member|manager)['"`]/i,(d,c,u)=>e.add("TP-BE-002","Do not decide by host role names; declare permissions in the access catalog (hostRoleBindings) and ask the engine (authorize / useAccess).",h(d,u)))}const p=n.filter(i=>i.part==="frontend"&&!i.test);if(s.frontend&&p.length>0&&(p.some(i=>/getDerivedStateFromError|componentDidCatch|PluginErrorBoundary/.test(i.code))||e.add("TP-UI-004","No error boundary in the frontend: the shell's boundary cannot see into your React root, so a render error leaves a blank page. Wrap the root in PluginErrorBoundary (@tego/plugin-sdk/react) or your own.",{file:s.frontend.dir}),o?.includes("tegoPluginTailwind"))){const i=new RegExp(`(?:className|class)=\\{?\\s*(?:cn\\()?\\s*['"\`][^'"\`]*(?<![\\w-])${t.id.replace(/[.]/g,"\\.")}(?![\\w-])`);p.some(h=>i.test(h.code))||e.add("TP-UI-003",`tegoPluginTailwind scopes every utility under .${t.id}, but no element carries className="${t.id}": none of the plugin's own classes will apply. Put it on the root element (and on portalled content, or use tegoPluginScopeRoot).`,{file:s.frontend.dir})}}f(it,"checkSources");function ct(e,t,s,n,l=()=>!0){const o=n.filter(r=>r.test);for(const r of o)!l(r)||!/\.(?:test|spec)\.[cm]?[jt]sx?$/.test(r.path)||/Business Cases/.test(r.text)||e.add("TP-TEST-002",`${r.path} has no Business Cases list: start it with the cases it covers (one line each, an id per case) and begin each it() title with its id.`,{file:r.path,line:1,evidence:"no business cases"});if(s.backend){const r=n.filter(p=>p.part==="backend"&&!p.test);r.some(p=>/\bnew\s+Hono\b/.test(p.code))&&!r.some(p=>/\.onError\s*\(/.test(p.code))&&e.add("TP-BE-007","The backend app has no error handler (app.onError(pluginErrorHandler())): an uncaught error becomes Hono's plain-text 500 instead of JSON the frontend can show.",{file:s.backend.dir})}if(o.length===0&&e.add("TP-TEST-001","The plugin has no *.test.ts files; backend routes and pure frontend logic need tests (createTestPluginHost for SQL)."),!t.access||!s.backend)return;o.some(r=>r.text.includes("assertRouteCoverage"))||e.add("TP-ACC-001","The manifest declares an access catalog but no test calls assertRouteCoverage(app): a route without a policy would be open to everyone who can open the plugin.",{file:s.backend.dir}),n.filter(r=>(r.part==="backend"||r.part==="shared")&&!r.test).some(r=>/\breconcile\s*\(/.test(r.code))||e.add("TP-ACC-002","The manifest declares an access catalog but start() never calls reconcile(host): built-in roles and catalog changes never reach the database.",{file:s.backend.dir})}f(ct,"checkAccessAndTests");async function ce(e){const t=e.root;await ve(P(t,"tego.plugin.json")).catch(()=>{throw new Error(`No tego.plugin.json in ${t}; run doctor in the plugin folder.`)});const s=new Ve;let n;try{n=JSON.parse(await S(P(t,"tego.plugin.json"),"utf8"))}catch(c){return s.add("TP-MAN-001",`tego.plugin.json is not valid JSON: ${c instanceof Error?c.message:String(c)}`,{file:"tego.plugin.json"}),F(s,void 0)}const l=ue(n);if(!l.ok||!l.manifest){for(const c of l.errors)s.add("TP-MAN-001",c,{file:"tego.plugin.json"});return F(s,n.id)}const o=l.manifest,a=ge(o),r=[];await re(t,"",r);const p=await Promise.all(r.map(async c=>{const u=await S(P(t,c),"utf8");return{path:c,part:Ye(c,a),text:u,code:J(u),test:Ge.test(c)}})),i=e.files?.map(c=>Xe(z(t,P(t,c)))),h=f(c=>!i||i.includes(c.path),"scanned"),d=a.frontend?await S(P(t,a.frontend.dir,"vite.config.ts"),"utf8").catch(()=>null):null;return Ze(s,await ie(P(t,"package.json"))),await Qe(s,t,o,a,p.filter(h)),await rt(s,t,a),await at(s,t,a),it(s,o,a,p,h,d),ct(s,o,a,p,h),await ot(s,t,o),F(s,o.id)}f(ce,"runDoctor");function F(e,t){const s={errors:e.list.filter(o=>o.severity==="error").length,warnings:e.list.filter(o=>o.severity==="warning").length},n=new Map(I.map((o,a)=>[o.id,a])),l=[...e.list].sort((o,a)=>(o.severity===a.severity?0:o.severity==="error"?-1:1)||(n.get(o.rule)??0)-(n.get(a.rule)??0)||(o.file??"").localeCompare(a.file??"")||(o.line??0)-(a.line??0));return{...t?{pluginId:t}:{},findings:l,...s}}f(F,"summarize");var lt=["TP-MAN-001","TP-I18N-001","TP-BE-003"];function dt(e){const t=e.findings.map(s=>{const n=s.file?`${s.file}${s.line?`:${s.line}`:""}  `:"";return`${s.severity==="error"?"\u2716":"\u26A0"} ${s.rule}  ${n}${s.message}`});return t.push(e.findings.length===0?"\u2705 doctor: no problems":`${e.errors} error(s), ${e.warnings} warning(s). Each rule is explained in node_modules/@tego/plugin-sdk/agent/RULES.md.`),t.join(`
+`)}f(dt,"formatDoctorReport");export{Z as DEFAULT_CHECK_STEPS,I as DOCTOR_RULES,Y as GUIDE_SCOPES,lt as UPLOAD_BLOCKING_RULES,ee as detectPackageManager,V as doctorRule,X as findColorIssues,A as findingFingerprint,Me as formatCheckReport,dt as formatDoctorReport,ne as parseEslintJson,oe as parseTestFailures,se as parseTypeErrors,Be as ruleCatalog,We as runChecks,ce as runDoctor};

package/dist/eslint.cjs

@@ -0,0 +1 @@
+"use strict";var n=Object.defineProperty;var r=(e,t)=>n(e,"name",{value:t,configurable:!0});var TESTS=["**/*.test.*","**/*.spec.*","**/test/**"];function sources(e){return[`${e}/**/*.{ts,tsx,js,jsx,mts,cts,mjs}`]}r(sources,"sources");var restrictedImports=r(e=>[e,{patterns:[{group:["@radix-ui/*"],message:"TP-UI-002: import the @tego/ui wrapper instead of @radix-ui/*."},{group:["@tego/shared","@tego/shared/*"],message:"TP-PKG-003: @tego/shared is not published to plugins; use @tego/plugin-sdk or your own code."},{group:["**/apps/*"],message:"TP-PKG-003: plugins never import host app code."}]}],"restrictedImports");function tegoPluginEslint(e={}){const t=e.frontend??"frontend",o=e.backend??"backend",s=e.claw??"claw";return[{name:"tego-plugin/all-parts",files:[...sources(t),...sources(o),...sources(s),"shared/**/*.ts"],rules:{"no-restricted-imports":restrictedImports("error")}},{name:"tego-plugin/frontend",files:sources(t),ignores:TESTS,rules:{"no-eval":"error","no-new-func":"error","no-implied-eval":"error","no-restricted-properties":["error",{object:"location",property:"origin",message:"TP-DESK-002: location.origin is tauri://localhost on desktop; use ctx.hostUrl(path) or ctx.publicPagesUrl."},{object:"window",property:"open",message:"TP-DESK-003: open links with ctx.openExternal(url)."},{object:"navigator",property:"clipboard",message:"TP-DESK-006: copy text with ctx.copyText(text)."},{object:"document",property:"cookie",message:"TP-WEB-004: no cookie auth; ctx.api carries the credentials."}],"no-restricted-syntax":["error",{selector:"NewExpression[callee.name='EventSource']",message:"TP-DESK-005: the desktop app buffers responses; subscribe to ctx.events instead of streaming."},{selector:"CallExpression[callee.name='fetch'] > Literal.arguments:first-child[value=/^(?!https?:|data:|blob:)/]",message:"TP-WEB-003: call your backend through ctx.api (createApiClient), not a raw fetch."},{selector:"CallExpression[callee.name='fetch'] > Literal.arguments:first-child[value=/^https?:/]",message:"TP-WEB-001: the frontend calls no third-party URL; call your backend, which declares egress."},{selector:"AssignmentExpression[left.property.name='download']",message:"TP-DESK-004: save files with ctx.download({ path | blob, fileName })."}]}},{name:"tego-plugin/backend",files:sources(o),ignores:TESTS,rules:{"no-console":["warn",{allow:["log","info","debug"]}],"no-restricted-properties":["error",{object:"process",property:"env",message:"TP-BE-006: read configuration from host.config.current(), not process.env."}],"no-restricted-imports":["error",{paths:[{name:"hono/cookie",message:"TP-WEB-004: the caller is the verified ctx; plugins do not authenticate with cookies."}],patterns:restrictedImports("error")[1].patterns}]}}]}r(tegoPluginEslint,"tegoPluginEslint"),exports.tegoPluginEslint=tegoPluginEslint;

package/dist/eslint.d.cts

@@ -0,0 +1,29 @@
+/**
+ * The platform's rules as ESLint configuration, for a plugin's `eslint.config.js`:
+ *
+ *   import { tegoPluginEslint } from '@tego/plugin-sdk/eslint';
+ *   export default [...yourConfig, ...tegoPluginEslint()];
+ *
+ * Built from ESLint's core rules only (no plugin to install), so the editor
+ * flags a broken rule while the code is written; each message names the
+ * doctor rule (`TP-…`) that explains it in `agent/RULES.md`. `tego-plugin
+ * doctor` stays the authority — it also checks what spans files (locales,
+ * migrations, access wiring) — this is the early warning.
+ */
+/** A flat-config object, typed loosely so the SDK does not depend on ESLint's types. */
+interface TegoEslintConfig {
+    name: string;
+    files: string[];
+    ignores?: string[];
+    rules: Record<string, unknown>;
+}
+interface TegoPluginEslintOptions {
+    /** Part folders, as the manifest declares them. */
+    frontend?: string;
+    backend?: string;
+    claw?: string;
+}
+/** The configuration objects for a plugin with the given part folders. */
+declare function tegoPluginEslint(options?: TegoPluginEslintOptions): TegoEslintConfig[];
+
+export { type TegoEslintConfig, type TegoPluginEslintOptions, tegoPluginEslint };

package/dist/eslint.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The platform's rules as ESLint configuration, for a plugin's `eslint.config.js`:
+ *
+ *   import { tegoPluginEslint } from '@tego/plugin-sdk/eslint';
+ *   export default [...yourConfig, ...tegoPluginEslint()];
+ *
+ * Built from ESLint's core rules only (no plugin to install), so the editor
+ * flags a broken rule while the code is written; each message names the
+ * doctor rule (`TP-…`) that explains it in `agent/RULES.md`. `tego-plugin
+ * doctor` stays the authority — it also checks what spans files (locales,
+ * migrations, access wiring) — this is the early warning.
+ */
+/** A flat-config object, typed loosely so the SDK does not depend on ESLint's types. */
+interface TegoEslintConfig {
+    name: string;
+    files: string[];
+    ignores?: string[];
+    rules: Record<string, unknown>;
+}
+interface TegoPluginEslintOptions {
+    /** Part folders, as the manifest declares them. */
+    frontend?: string;
+    backend?: string;
+    claw?: string;
+}
+/** The configuration objects for a plugin with the given part folders. */
+declare function tegoPluginEslint(options?: TegoPluginEslintOptions): TegoEslintConfig[];
+
+export { type TegoEslintConfig, type TegoPluginEslintOptions, tegoPluginEslint };

package/dist/eslint.js

@@ -0,0 +1 @@
+var c=Object.defineProperty;var o=(e,r)=>c(e,"name",{value:r,configurable:!0});var n=["**/*.test.*","**/*.spec.*","**/test/**"];function t(e){return[`${e}/**/*.{ts,tsx,js,jsx,mts,cts,mjs}`]}o(t,"sources");var a=o(e=>[e,{patterns:[{group:["@radix-ui/*"],message:"TP-UI-002: import the @tego/ui wrapper instead of @radix-ui/*."},{group:["@tego/shared","@tego/shared/*"],message:"TP-PKG-003: @tego/shared is not published to plugins; use @tego/plugin-sdk or your own code."},{group:["**/apps/*"],message:"TP-PKG-003: plugins never import host app code."}]}],"restrictedImports");function l(e={}){const r=e.frontend??"frontend",s=e.backend??"backend",i=e.claw??"claw";return[{name:"tego-plugin/all-parts",files:[...t(r),...t(s),...t(i),"shared/**/*.ts"],rules:{"no-restricted-imports":a("error")}},{name:"tego-plugin/frontend",files:t(r),ignores:n,rules:{"no-eval":"error","no-new-func":"error","no-implied-eval":"error","no-restricted-properties":["error",{object:"location",property:"origin",message:"TP-DESK-002: location.origin is tauri://localhost on desktop; use ctx.hostUrl(path) or ctx.publicPagesUrl."},{object:"window",property:"open",message:"TP-DESK-003: open links with ctx.openExternal(url)."},{object:"navigator",property:"clipboard",message:"TP-DESK-006: copy text with ctx.copyText(text)."},{object:"document",property:"cookie",message:"TP-WEB-004: no cookie auth; ctx.api carries the credentials."}],"no-restricted-syntax":["error",{selector:"NewExpression[callee.name='EventSource']",message:"TP-DESK-005: the desktop app buffers responses; subscribe to ctx.events instead of streaming."},{selector:"CallExpression[callee.name='fetch'] > Literal.arguments:first-child[value=/^(?!https?:|data:|blob:)/]",message:"TP-WEB-003: call your backend through ctx.api (createApiClient), not a raw fetch."},{selector:"CallExpression[callee.name='fetch'] > Literal.arguments:first-child[value=/^https?:/]",message:"TP-WEB-001: the frontend calls no third-party URL; call your backend, which declares egress."},{selector:"AssignmentExpression[left.property.name='download']",message:"TP-DESK-004: save files with ctx.download({ path | blob, fileName })."}]}},{name:"tego-plugin/backend",files:t(s),ignores:n,rules:{"no-console":["warn",{allow:["log","info","debug"]}],"no-restricted-properties":["error",{object:"process",property:"env",message:"TP-BE-006: read configuration from host.config.current(), not process.env."}],"no-restricted-imports":["error",{paths:[{name:"hono/cookie",message:"TP-WEB-004: the caller is the verified ctx; plugins do not authenticate with cookies."}],patterns:a("error")[1].patterns}]}}]}o(l,"tegoPluginEslint");export{l as tegoPluginEslint};

package/dist/pack.cjs

@@ -1 +1 @@
-"use strict";var u=Object.defineProperty;var e=(r,n)=>u(r,"name",{value:n,configurable:!0});var chunk4LKRXDYY_cjs=require("./chunk-4LKRXDYY.cjs");require("./chunk-HZ4YWRYX.cjs"),require("./chunk-SKNPNPJP.cjs"),require("./chunk-45Y4CR4R.cjs"),require("./chunk-2P6UEAPV.cjs"),require("./chunk-N4SXZZPY.cjs"),require("./chunk-6HNG5OZI.cjs"),require("./chunk-AJY7ZHXK.cjs"),require("./chunk-OP64Y4IN.cjs"),Object.defineProperty(exports,"buildAgentTemplate",{enumerable:!0,get:e(function(){return chunk4LKRXDYY_cjs.buildAgentTemplate},"get")}),Object.defineProperty(exports,"buildPluginBackend",{enumerable:!0,get:e(function(){return chunk4LKRXDYY_cjs.buildPluginBackend},"get")}),Object.defineProperty(exports,"buildPluginTemplates",{enumerable:!0,get:e(function(){return chunk4LKRXDYY_cjs.buildPluginTemplates},"get")}),Object.defineProperty(exports,"lockPlugin",{enumerable:!0,get:e(function(){return chunk4LKRXDYY_cjs.lockPlugin},"get")}),Object.defineProperty(exports,"packPlugin",{enumerable:!0,get:e(function(){return chunk4LKRXDYY_cjs.packPlugin},"get")}),Object.defineProperty(exports,"readManifest",{enumerable:!0,get:e(function(){return chunk4LKRXDYY_cjs.readManifest},"get")}),Object.defineProperty(exports,"watchPluginFrontend",{enumerable:!0,get:e(function(){return chunk4LKRXDYY_cjs.watchPluginFrontend},"get")});
+"use strict";var u=Object.defineProperty;var e=(r,n)=>u(r,"name",{value:n,configurable:!0});var chunkDRHBXEPK_cjs=require("./chunk-DRHBXEPK.cjs");require("./chunk-HZ4YWRYX.cjs"),require("./chunk-SKNPNPJP.cjs"),require("./chunk-45Y4CR4R.cjs"),require("./chunk-2P6UEAPV.cjs"),require("./chunk-N4SXZZPY.cjs"),require("./chunk-6HNG5OZI.cjs"),require("./chunk-AJY7ZHXK.cjs"),require("./chunk-OP64Y4IN.cjs"),Object.defineProperty(exports,"buildAgentTemplate",{enumerable:!0,get:e(function(){return chunkDRHBXEPK_cjs.buildAgentTemplate},"get")}),Object.defineProperty(exports,"buildPluginBackend",{enumerable:!0,get:e(function(){return chunkDRHBXEPK_cjs.buildPluginBackend},"get")}),Object.defineProperty(exports,"buildPluginTemplates",{enumerable:!0,get:e(function(){return chunkDRHBXEPK_cjs.buildPluginTemplates},"get")}),Object.defineProperty(exports,"lockPlugin",{enumerable:!0,get:e(function(){return chunkDRHBXEPK_cjs.lockPlugin},"get")}),Object.defineProperty(exports,"packPlugin",{enumerable:!0,get:e(function(){return chunkDRHBXEPK_cjs.packPlugin},"get")}),Object.defineProperty(exports,"readManifest",{enumerable:!0,get:e(function(){return chunkDRHBXEPK_cjs.readManifest},"get")}),Object.defineProperty(exports,"watchPluginFrontend",{enumerable:!0,get:e(function(){return chunkDRHBXEPK_cjs.watchPluginFrontend},"get")});

package/dist/pack.d.cts

@@ -162,6 +162,11 @@ interface BuildPluginBackendOptions {
     outDir: string;
     /** Source entry, relative to root. Defaults to `<dir>/src/index.ts`. */
     entry?: string;
+    /**
+     * Inline source maps (the local preview, so stack traces and a debugger
+     * point at the TypeScript). Releases ship without.
+     */
+    sourcemap?: boolean;
     /** Extra modules to leave unbundled, on top of the built-in list. */
     external?: string[];
 }

package/dist/pack.d.ts

@@ -162,6 +162,11 @@ interface BuildPluginBackendOptions {
     outDir: string;
     /** Source entry, relative to root. Defaults to `<dir>/src/index.ts`. */
     entry?: string;
+    /**
+     * Inline source maps (the local preview, so stack traces and a debugger
+     * point at the TypeScript). Releases ship without.
+     */
+    sourcemap?: boolean;
     /** Extra modules to leave unbundled, on top of the built-in list. */
     external?: string[];
 }

package/dist/pack.js

@@ -1 +1 @@
-export{buildAgentTemplate,buildPluginBackend,buildPluginTemplates,lockPlugin,packPlugin,readManifest,watchPluginFrontend}from"./chunk-FCYAAOHC.js";import"./chunk-I5Z3ECC4.js";import"./chunk-EIVA5BR6.js";import"./chunk-2NTAWYCG.js";import"./chunk-IVJECPGG.js";import"./chunk-INCA3GFW.js";import"./chunk-56QOZQTY.js";import"./chunk-VMCGDDGP.js";import"./chunk-SNUCO2MK.js";
+export{buildAgentTemplate,buildPluginBackend,buildPluginTemplates,lockPlugin,packPlugin,readManifest,watchPluginFrontend}from"./chunk-IQNSBHBI.js";import"./chunk-I5Z3ECC4.js";import"./chunk-EIVA5BR6.js";import"./chunk-2NTAWYCG.js";import"./chunk-IVJECPGG.js";import"./chunk-INCA3GFW.js";import"./chunk-56QOZQTY.js";import"./chunk-VMCGDDGP.js";import"./chunk-SNUCO2MK.js";

package/dist/publish.cjs

@@ -1 +1 @@
-"use strict";var $=Object.defineProperty;var s=(e,a)=>$(e,"name",{value:a,configurable:!0});var chunk4LKRXDYY_cjs=require("./chunk-4LKRXDYY.cjs");require("./chunk-HZ4YWRYX.cjs"),require("./chunk-SKNPNPJP.cjs"),require("./chunk-45Y4CR4R.cjs");var chunk2P6UEAPV_cjs=require("./chunk-2P6UEAPV.cjs");require("./chunk-N4SXZZPY.cjs"),require("./chunk-6HNG5OZI.cjs"),require("./chunk-AJY7ZHXK.cjs"),require("./chunk-OP64Y4IN.cjs");var promises=require("fs/promises"),path=require("path"),API_PREFIX="/api/v1/tego-os";async function publishPlugin(e){const a=e.log===null?()=>{}:e.log??(t=>console.log(t)),n=await chunk4LKRXDYY_cjs.packPlugin({root:e.root,log:a});return publishPackedPlugin(n,e)}s(publishPlugin,"publishPlugin");async function publishPackedPlugin(e,a){const n=a.log===null?()=>{}:a.log??(p=>console.log(p)),t=a.fetchImpl??fetch,r=createCaller(a.server,a.token,t),u=await promises.readFile(e.file),o=path.basename(e.file);n("\u203A presigning upload");const l=await r("POST","/admin/runtime-plugins/presign-stream",{filename:o,mimeType:"application/zip",size:u.byteLength});n(`\u203A uploading ${o} (${u.byteLength} bytes)`),await putArchive(a.server,l.uploadUrl,u,t),n("\u203A inspecting package");const c=await r("POST","/admin/runtime-plugins/inspect",{uploadToken:l.uploadToken});n(`  ${c.pluginId}@${c.semanticVersion} \u2014 ${describeParts(c)}${c.isUpgrade?" (upgrade)":""}${c.requiresConfig?", needs config":""}`),n("\u203A finalizing release");const g=await r("POST","/admin/runtime-plugins/upload",{uploadToken:l.uploadToken,...a.meta});let i=g.release;n(`  release ${i.id} (${i.status})`),(a.approve??!0)&&(n("\u203A approving release"),i=await r("POST",`/admin/runtime-plugins/releases/${encodeURIComponent(i.id)}/approve`,{}),n(`  release ${i.id} (${i.status})`));let d=null;if(a.install??!0){const p=chunk2P6UEAPV_cjs.resolvePluginScope(e.manifest),f=p==="avatar"?{releaseId:i.id,avatarIds:a.avatarIds??[]}:{releaseId:i.id};n(`\u203A installing for tenant (${p}-scoped)`),d=await r("POST","/admin/runtime-plugins/installs",f),reportInstall(d,n)}return{packed:e,preview:c,catalog:g.catalog,release:i,install:d}}s(publishPackedPlugin,"publishPackedPlugin");function describeParts(e){const a=[];return e.parts.frontend&&a.push(`frontend (${e.parts.frontend.locales.length} locales)`),e.parts.backend&&a.push(`backend (${e.parts.backend.migrationCount} migrations)`),e.parts.claw&&a.push("claw"),a.join(", ")||"no parts"}s(describeParts,"describeParts");function reportInstall(e,a){const n=e.avatars;if(!n||n.attempted===0){a(`  installed ${e.pluginId}@${e.version}`);return}const t=n.attempted-n.failures.length;a(`  installed ${e.pluginId}@${e.version} \u2014 ${t}/${n.attempted} avatars`);for(const r of n.failures)a(`    \u2717 ${r.avatarId}: ${r.message}`)}s(reportInstall,"reportInstall");function createCaller(e,a,n){const t=e.replace(/\/+$/,"");return s(async function(u,o,l){const c=await n(`${t}${API_PREFIX}${o}`,{method:u,headers:{authorization:`Bearer ${a}`,...l===void 0?{}:{"content-type":"application/json"}},...l===void 0?{}:{body:JSON.stringify(l)}});return unwrap(c,`${u} ${o}`)},"call")}s(createCaller,"createCaller");async function putArchive(e,a,n,t){const r=e.replace(/\/+$/,""),u=await t(`${r}${a}`,{method:"PUT",headers:{"content-type":"application/zip"},body:n});await unwrap(u,"PUT upload")}s(putArchive,"putArchive");async function unwrap(e,a){let n;try{n=await e.json()}catch{n=null}if(!e.ok||!n?.success){const t=n?.error?.message??`HTTP ${e.status}`;throw new Error(`${a} failed: ${t}`)}return n.data}s(unwrap,"unwrap"),exports.publishPackedPlugin=publishPackedPlugin,exports.publishPlugin=publishPlugin;
+"use strict";var $=Object.defineProperty;var s=(e,a)=>$(e,"name",{value:a,configurable:!0});var chunkDRHBXEPK_cjs=require("./chunk-DRHBXEPK.cjs");require("./chunk-HZ4YWRYX.cjs"),require("./chunk-SKNPNPJP.cjs"),require("./chunk-45Y4CR4R.cjs");var chunk2P6UEAPV_cjs=require("./chunk-2P6UEAPV.cjs");require("./chunk-N4SXZZPY.cjs"),require("./chunk-6HNG5OZI.cjs"),require("./chunk-AJY7ZHXK.cjs"),require("./chunk-OP64Y4IN.cjs");var promises=require("fs/promises"),path=require("path"),API_PREFIX="/api/v1/tego-os";async function publishPlugin(e){const a=e.log===null?()=>{}:e.log??(t=>console.log(t)),n=await chunkDRHBXEPK_cjs.packPlugin({root:e.root,log:a});return publishPackedPlugin(n,e)}s(publishPlugin,"publishPlugin");async function publishPackedPlugin(e,a){const n=a.log===null?()=>{}:a.log??(p=>console.log(p)),t=a.fetchImpl??fetch,r=createCaller(a.server,a.token,t),u=await promises.readFile(e.file),o=path.basename(e.file);n("\u203A presigning upload");const l=await r("POST","/admin/runtime-plugins/presign-stream",{filename:o,mimeType:"application/zip",size:u.byteLength});n(`\u203A uploading ${o} (${u.byteLength} bytes)`),await putArchive(a.server,l.uploadUrl,u,t),n("\u203A inspecting package");const c=await r("POST","/admin/runtime-plugins/inspect",{uploadToken:l.uploadToken});n(`  ${c.pluginId}@${c.semanticVersion} \u2014 ${describeParts(c)}${c.isUpgrade?" (upgrade)":""}${c.requiresConfig?", needs config":""}`),n("\u203A finalizing release");const g=await r("POST","/admin/runtime-plugins/upload",{uploadToken:l.uploadToken,...a.meta});let i=g.release;n(`  release ${i.id} (${i.status})`),(a.approve??!0)&&(n("\u203A approving release"),i=await r("POST",`/admin/runtime-plugins/releases/${encodeURIComponent(i.id)}/approve`,{}),n(`  release ${i.id} (${i.status})`));let d=null;if(a.install??!0){const p=chunk2P6UEAPV_cjs.resolvePluginScope(e.manifest),f=p==="avatar"?{releaseId:i.id,avatarIds:a.avatarIds??[]}:{releaseId:i.id};n(`\u203A installing for tenant (${p}-scoped)`),d=await r("POST","/admin/runtime-plugins/installs",f),reportInstall(d,n)}return{packed:e,preview:c,catalog:g.catalog,release:i,install:d}}s(publishPackedPlugin,"publishPackedPlugin");function describeParts(e){const a=[];return e.parts.frontend&&a.push(`frontend (${e.parts.frontend.locales.length} locales)`),e.parts.backend&&a.push(`backend (${e.parts.backend.migrationCount} migrations)`),e.parts.claw&&a.push("claw"),a.join(", ")||"no parts"}s(describeParts,"describeParts");function reportInstall(e,a){const n=e.avatars;if(!n||n.attempted===0){a(`  installed ${e.pluginId}@${e.version}`);return}const t=n.attempted-n.failures.length;a(`  installed ${e.pluginId}@${e.version} \u2014 ${t}/${n.attempted} avatars`);for(const r of n.failures)a(`    \u2717 ${r.avatarId}: ${r.message}`)}s(reportInstall,"reportInstall");function createCaller(e,a,n){const t=e.replace(/\/+$/,"");return s(async function(u,o,l){const c=await n(`${t}${API_PREFIX}${o}`,{method:u,headers:{authorization:`Bearer ${a}`,...l===void 0?{}:{"content-type":"application/json"}},...l===void 0?{}:{body:JSON.stringify(l)}});return unwrap(c,`${u} ${o}`)},"call")}s(createCaller,"createCaller");async function putArchive(e,a,n,t){const r=e.replace(/\/+$/,""),u=await t(`${r}${a}`,{method:"PUT",headers:{"content-type":"application/zip"},body:n});await unwrap(u,"PUT upload")}s(putArchive,"putArchive");async function unwrap(e,a){let n;try{n=await e.json()}catch{n=null}if(!e.ok||!n?.success){const t=n?.error?.message??`HTTP ${e.status}`;throw new Error(`${a} failed: ${t}`)}return n.data}s(unwrap,"unwrap"),exports.publishPackedPlugin=publishPackedPlugin,exports.publishPlugin=publishPlugin;

package/dist/publish.js

@@ -1 +1 @@
-var h=Object.defineProperty;var o=(e,a)=>h(e,"name",{value:a,configurable:!0});import{packPlugin as v}from"./chunk-FCYAAOHC.js";import"./chunk-I5Z3ECC4.js";import"./chunk-EIVA5BR6.js";import"./chunk-2NTAWYCG.js";import{resolvePluginScope as P}from"./chunk-IVJECPGG.js";import"./chunk-INCA3GFW.js";import"./chunk-56QOZQTY.js";import"./chunk-VMCGDDGP.js";import"./chunk-SNUCO2MK.js";import{readFile as w}from"fs/promises";import{basename as y}from"path";var I="/api/v1/tego-os";async function T(e){const a=e.log===null?()=>{}:e.log??(n=>console.log(n)),t=await v({root:e.root,log:a});return m(t,e)}o(T,"publishPlugin");async function m(e,a){const t=a.log===null?()=>{}:a.log??(p=>console.log(p)),n=a.fetchImpl??fetch,r=A(a.server,a.token,n),s=await w(e.file),c=y(e.file);t("\u203A presigning upload");const u=await r("POST","/admin/runtime-plugins/presign-stream",{filename:c,mimeType:"application/zip",size:s.byteLength});t(`\u203A uploading ${c} (${s.byteLength} bytes)`),await S(a.server,u.uploadUrl,s,n),t("\u203A inspecting package");const l=await r("POST","/admin/runtime-plugins/inspect",{uploadToken:u.uploadToken});t(`  ${l.pluginId}@${l.semanticVersion} \u2014 ${b(l)}${l.isUpgrade?" (upgrade)":""}${l.requiresConfig?", needs config":""}`),t("\u203A finalizing release");const g=await r("POST","/admin/runtime-plugins/upload",{uploadToken:u.uploadToken,...a.meta});let i=g.release;t(`  release ${i.id} (${i.status})`),(a.approve??!0)&&(t("\u203A approving release"),i=await r("POST",`/admin/runtime-plugins/releases/${encodeURIComponent(i.id)}/approve`,{}),t(`  release ${i.id} (${i.status})`));let d=null;if(a.install??!0){const p=P(e.manifest),$=p==="avatar"?{releaseId:i.id,avatarIds:a.avatarIds??[]}:{releaseId:i.id};t(`\u203A installing for tenant (${p}-scoped)`),d=await r("POST","/admin/runtime-plugins/installs",$),k(d,t)}return{packed:e,preview:l,catalog:g.catalog,release:i,install:d}}o(m,"publishPackedPlugin");function b(e){const a=[];return e.parts.frontend&&a.push(`frontend (${e.parts.frontend.locales.length} locales)`),e.parts.backend&&a.push(`backend (${e.parts.backend.migrationCount} migrations)`),e.parts.claw&&a.push("claw"),a.join(", ")||"no parts"}o(b,"describeParts");function k(e,a){const t=e.avatars;if(!t||t.attempted===0){a(`  installed ${e.pluginId}@${e.version}`);return}const n=t.attempted-t.failures.length;a(`  installed ${e.pluginId}@${e.version} \u2014 ${n}/${t.attempted} avatars`);for(const r of t.failures)a(`    \u2717 ${r.avatarId}: ${r.message}`)}o(k,"reportInstall");function A(e,a,t){const n=e.replace(/\/+$/,"");return o(async function(s,c,u){const l=await t(`${n}${I}${c}`,{method:s,headers:{authorization:`Bearer ${a}`,...u===void 0?{}:{"content-type":"application/json"}},...u===void 0?{}:{body:JSON.stringify(u)}});return f(l,`${s} ${c}`)},"call")}o(A,"createCaller");async function S(e,a,t,n){const r=e.replace(/\/+$/,""),s=await n(`${r}${a}`,{method:"PUT",headers:{"content-type":"application/zip"},body:t});await f(s,"PUT upload")}o(S,"putArchive");async function f(e,a){let t;try{t=await e.json()}catch{t=null}if(!e.ok||!t?.success){const n=t?.error?.message??`HTTP ${e.status}`;throw new Error(`${a} failed: ${n}`)}return t.data}o(f,"unwrap");export{m as publishPackedPlugin,T as publishPlugin};
+var h=Object.defineProperty;var o=(e,a)=>h(e,"name",{value:a,configurable:!0});import{packPlugin as v}from"./chunk-IQNSBHBI.js";import"./chunk-I5Z3ECC4.js";import"./chunk-EIVA5BR6.js";import"./chunk-2NTAWYCG.js";import{resolvePluginScope as P}from"./chunk-IVJECPGG.js";import"./chunk-INCA3GFW.js";import"./chunk-56QOZQTY.js";import"./chunk-VMCGDDGP.js";import"./chunk-SNUCO2MK.js";import{readFile as w}from"fs/promises";import{basename as y}from"path";var I="/api/v1/tego-os";async function T(e){const a=e.log===null?()=>{}:e.log??(n=>console.log(n)),t=await v({root:e.root,log:a});return m(t,e)}o(T,"publishPlugin");async function m(e,a){const t=a.log===null?()=>{}:a.log??(p=>console.log(p)),n=a.fetchImpl??fetch,r=A(a.server,a.token,n),s=await w(e.file),c=y(e.file);t("\u203A presigning upload");const u=await r("POST","/admin/runtime-plugins/presign-stream",{filename:c,mimeType:"application/zip",size:s.byteLength});t(`\u203A uploading ${c} (${s.byteLength} bytes)`),await S(a.server,u.uploadUrl,s,n),t("\u203A inspecting package");const l=await r("POST","/admin/runtime-plugins/inspect",{uploadToken:u.uploadToken});t(`  ${l.pluginId}@${l.semanticVersion} \u2014 ${b(l)}${l.isUpgrade?" (upgrade)":""}${l.requiresConfig?", needs config":""}`),t("\u203A finalizing release");const g=await r("POST","/admin/runtime-plugins/upload",{uploadToken:u.uploadToken,...a.meta});let i=g.release;t(`  release ${i.id} (${i.status})`),(a.approve??!0)&&(t("\u203A approving release"),i=await r("POST",`/admin/runtime-plugins/releases/${encodeURIComponent(i.id)}/approve`,{}),t(`  release ${i.id} (${i.status})`));let d=null;if(a.install??!0){const p=P(e.manifest),$=p==="avatar"?{releaseId:i.id,avatarIds:a.avatarIds??[]}:{releaseId:i.id};t(`\u203A installing for tenant (${p}-scoped)`),d=await r("POST","/admin/runtime-plugins/installs",$),k(d,t)}return{packed:e,preview:l,catalog:g.catalog,release:i,install:d}}o(m,"publishPackedPlugin");function b(e){const a=[];return e.parts.frontend&&a.push(`frontend (${e.parts.frontend.locales.length} locales)`),e.parts.backend&&a.push(`backend (${e.parts.backend.migrationCount} migrations)`),e.parts.claw&&a.push("claw"),a.join(", ")||"no parts"}o(b,"describeParts");function k(e,a){const t=e.avatars;if(!t||t.attempted===0){a(`  installed ${e.pluginId}@${e.version}`);return}const n=t.attempted-t.failures.length;a(`  installed ${e.pluginId}@${e.version} \u2014 ${n}/${t.attempted} avatars`);for(const r of t.failures)a(`    \u2717 ${r.avatarId}: ${r.message}`)}o(k,"reportInstall");function A(e,a,t){const n=e.replace(/\/+$/,"");return o(async function(s,c,u){const l=await t(`${n}${I}${c}`,{method:s,headers:{authorization:`Bearer ${a}`,...u===void 0?{}:{"content-type":"application/json"}},...u===void 0?{}:{body:JSON.stringify(u)}});return f(l,`${s} ${c}`)},"call")}o(A,"createCaller");async function S(e,a,t,n){const r=e.replace(/\/+$/,""),s=await n(`${r}${a}`,{method:"PUT",headers:{"content-type":"application/zip"},body:t});await f(s,"PUT upload")}o(S,"putArchive");async function f(e,a){let t;try{t=await e.json()}catch{t=null}if(!e.ok||!t?.success){const n=t?.error?.message??`HTTP ${e.status}`;throw new Error(`${a} failed: ${n}`)}return t.data}o(f,"unwrap");export{m as publishPackedPlugin,T as publishPlugin};