dsh-penpot-plugin 0.0.0-stage → 0.3.1

package/CHANGELOG.md

@@ -0,0 +1,85 @@
+# Changelog
+
+## 0.3.1
+
+- **Reads ask for JSON.** Penpot answers transit unless the request sends
+  `Accept: application/json`; without it every list came back as transit and
+  parsed into empty refs (`penpot_teams` showed `{"id":"","name":""}`). Every
+  RPC request now sends the header.
+- **`penpot_export` reads Penpot's real response.** `export-binfile` is an SSE
+  stream that ends with the URL of the exported zip; the plugin treated the
+  stream itself as the file and wrote `event: progress` text as a `.penpot`.
+  It now parses the stream, downloads the URL and returns the zip bytes.
+- **`penpot_import` reads Penpot's real response.** `import-binfile` is also
+  SSE and ends with the id(s) of the imported file(s); the plugin called
+  `.json()` and failed after a successful import. It now parses the stream and
+  returns the file id.
+- **`penpot_search` sends the team.** Penpot's `search-files` requires a
+  `team-id`; the tool takes an optional `teamId` and otherwise searches the
+  first team the account can see.
+- SSE event data is transit-encoded (`~:` keys, `~u` uuids); a small normalizer
+  handles both markers so errors and ids are readable without a transit
+  dependency.
+
+## 0.3.0
+
+- **npm distribution.** The package is published as
+  `dsh-penpot-plugin@<version>`; the registry tarball contains `lib/`, so
+  installs no longer run a build script. The release workflow publishes a tag
+  with provenance. The setup pins this npm spec and keeps the GitHub tag as a
+  fallback.
+- **`penpot_import`.** The export counterpart is now a tool: upload a `.penpot`
+  file as a new file (`projectId`) or replace an existing one (`fileId`). The
+  backend already had the multipart `import-binfile` call; the setup CLI was the
+  only caller.
+- **Bundle patch corrected.** `cordis.patch.yml` still passed `backend: auto`
+  and `mcpServer`, which 0.2.0 removed. The row now declares only `apiUrl` and
+  `token`, so a standalone install no longer starts with a stale config key.
+- **Builds clean before packaging.** `lib/` is removed before every build, so
+  compiled files from removed modules (the old MCP backend) can never enter a
+  tarball.
+- **The package description no longer claims an MCP backend.** It was stale
+  since 0.2.0 and is the text GitHub and npm show.
+- **Standalone is documented as a first-class path** (`docs/STANDALONE.md`): no
+  setup, no managed row, same tools. The setup remains the convenience wrapper,
+  not a requirement.
+- **Load fix.** The plugin used `ctx.tools` without declaring
+  `inject = ['tools']`; Cordis refuses that property, so a standalone profile
+  failed at load with `cannot get property "tools" without inject`. The setup
+  masked it only while the plugin happened not to be mounted. Declared now.
+- Tool-surface tests cover the service declaration, the always-registered set,
+  the unconfigured status, and the import destination check.
+
+## 0.2.0
+
+- **MCP backend removed.** The plugin talks to Penpot's local HTTP RPC only.
+  `backend`, `mcpServer` and the `mcp__<server>__*` adapter are gone; the
+  read-only MCP path could not export and could silently replace the API via
+  `auto`.
+- The plugin now loads even when `PENPOT_API_URL`/`PENPOT_ACCESS_TOKEN` are
+  empty: `penpot_status` reports `none`, the other tools throw one readable
+  configuration error.
+- README/DESIGN updated for the systemd/Podman setup (`--design penpot`).
+
+## 0.1.2
+
+Docs only. The setup path now says `/system components` (the command was renamed
+from `/system manage`).
+
+## 0.1.1
+
+- Docs only. The install section now leads with the DSH setup's design
+  component (`install.sh --design docker` / `/system manage`), pins the manual
+  install at a tag, and explains the pnpm `allowBuilds` gate that otherwise
+  aborts a git install. Credentials are described as the runtime process's
+  environment, not a shell export.
+- `COMPATIBILITY.md` records that the setup pins this plugin and the Penpot
+  images, so a ref or image bump is a setup release.
+
+## 0.1.0
+
+- First cut: `penpot_status`, `penpot_teams`, `penpot_projects`,
+  `penpot_files`, `penpot_search`, `penpot_file`, `penpot_export`.
+- Two backends behind one interface: the HTTP API with an access token, and an
+  MCP server already registered in the runtime. `auto` prefers MCP read tools.
+- Export writes a `.penpot` file; import is not exposed as a tool yet.

package/COMPATIBILITY.md

@@ -0,0 +1,20 @@
+# Compatibility
+
+The plugin talks to Penpot, not to DSH internals, so its DSH requirement is only
+the peer range of the tool registry. Penpot's RPC is internal and moves between
+releases; every row states what was actually exercised.
+
+| Plugin | DSH | Penpot | Status | Notes |
+|---|---|---|---|---|
+| 0.3.1 | `>=0.1.0-rc.6 <0.3.0-0` | 2.18.6 | live instance: teams/projects/search/import/export exercised | fixes the JSON accept header, the SSE export/import responses and the required `team-id` on search |
+| 0.3.0 | `>=0.1.0-rc.6 <0.3.0-0` | 2.18.6 | API import covered by a fake server; live instance run is the release gate | adds `penpot_import`; bundle patch drops the removed `backend`/`mcpServer` keys; standalone install documented |
+| 0.2.0 | `>=0.1.0-rc.6 <0.3.0-0` | 2.18.6 | API exercised against a live self-hosted instance | API only: the optional MCP backend and `backend`/`mcpServer` config were removed; the plugin now loads unconfigured and `penpot_status` says `none` |
+| 0.1.2 | `>=0.1.0-rc.6 <0.3.0-0` | 2.18 | untested against a live instance | docs only: `/system components` after the setup rename; same code as 0.1.1 |
+| 0.1.1 | `>=0.1.0-rc.6 <0.3.0-0` | 2.18 | untested against a live instance | docs only: the setup path is documented as primary, the manual install is pinned and the pnpm build gate is explained; same code as 0.1.0 |
+| 0.1.0 | `>=0.1.0-rc.6 <0.3.0-0` | 2.18 | untested against a live instance | read tools + export; request shapes checked against Penpot's OpenAPI and a fake server, not a real deployment |
+
+The setup's design component is the reference deployment: `plugins.json` pins
+this plugin at `v0.3.0` and `components.json` pins the Penpot images at `2.18`.
+The plugin version is independent of the setup release; the setup pin is what a
+fresh deployment installs, and a newer compatible tag installed from the bot
+stays installed across reboots.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vladtsvirko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,125 @@
-# Temporary Holding Version
+# dsh-penpot-plugin
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Penpot for [DeepSeek Harness](https://github.com/deepseek-ai): list, search,
+inspect and export design files from a DSH agent over Penpot's local HTTP API.
+
+`0.2` is deliberately read + export. Writing designs needs Penpot's
+`update-file` change format; the design questions are in
+[docs/DESIGN.md](docs/DESIGN.md).
+
+There is no MCP backend. The setup runs a local Penpot instance and talks to it
+over `/api/rpc/command/*` with an access token; a second transport added a
+read-only path that could not export, so it was removed in 0.2.0.
+
+## Install
+
+### In the DSH setup (recommended)
+
+The setup's optional design component installs Penpot, the `penpot` CLI and this
+plugin together, with the plugin ref pinned in `components.json`:
+
+```sh
+./install.sh --design penpot       # or add it later: /system components -> Enable
+```
+
+That path is self-contained: it writes `PENPOT_API_URL` and
+`PENPOT_ACCESS_TOKEN` into the runtime environment, installs the pinned plugin
+and mounts a managed `dsh-penpot` row. Nothing below is needed.
+
+### Standalone (any DSH runtime)
+
+See [docs/STANDALONE.md](docs/STANDALONE.md) for the complete walkthrough.
+
+The plugin is a normal DSH bundle: it works in any profile, with or without the
+setup. It needs a Penpot instance and an access token, nothing else from this
+project. It is published to npm as an exact version:
+
+```sh
+dsh plugin --profile web add dsh-penpot-plugin@0.3.0
+```
+
+The registry tarball contains the built `lib/`, so there is no `prepare` build
+and no `allowBuilds` entry. Restart the runtime after adding it.
+
+From the source repository instead, allow the build and pin the tag:
+
+```yaml
+allowBuilds:
+  dsh-penpot-plugin@https://github.com/vladtsvirko/dsh-penpot-plugin.git: true
+```
+
+```sh
+dsh plugin --profile web add github:vladtsvirko/dsh-penpot-plugin#v0.3.0
+```
+ The row reads its credentials from the
+environment of the **runtime process** — exporting them in a shell later does
+not reach a running runtime:
+
+```sh
+export PENPOT_API_URL='http://192.168.2.50:8090'   # no /api/rpc suffix needed
+export PENPOT_ACCESS_TOKEN='...'                    # Penpot: Settings -> Access tokens
+```
+
+In the DSH setup that means adding both to `.env` and restarting
+`dsh.service`; the design component does it for you. Ask the agent for
+`penpot_status` to verify: it names the endpoint, and a missing variable is
+reported by name.
+
+## Tools
+
+| Tool | What it does |
+|---|---|
+| `penpot_status` | whether the API is configured, and its endpoint |
+| `penpot_teams` | teams the account can see |
+| `penpot_projects` | projects, optionally per team |
+| `penpot_files` | files in a project |
+| `penpot_search` | files by name or term |
+| `penpot_file` | one file: id, name, pages |
+| `penpot_export` | write a `.penpot` file to disk |
+| `penpot_import` | upload a `.penpot` file as a new or replacement file |
+
+Export gives a zip of Penpot JSON: unzip it, read or edit with the normal file
+tools, then import it back with `penpot_import` — no setup CLI and no second
+toolchain. A new file needs `projectId`; replacing one needs `fileId`.
+
+## Backend
+
+One backend: Penpot's HTTP RPC.
+
+- `POST /api/rpc/command/<name>` with `Authorization: Token …`, kebab-case
+  payloads (`get-teams`, `get-all-projects`, `get-files`, `search-files`,
+  `get-file-summary`, `export-binfile`, `import-binfile`).
+- Configuration is `apiUrl` + `token`; both come from the environment in the
+  setup's managed row. If either is empty the plugin still loads, and
+  `penpot_status` says `none` while the other tools explain what to set.
+
+```yaml
+- id: dsh-penpot
+  config:
+    apiUrl: http://192.168.2.50:8090
+    token: !!js process.env.PENPOT_ACCESS_TOKEN ?? ''
+```
+
+## Updating
+
+Plugin versions are independent of DSH and of the setup release.
+
+- **In the setup:** `/system update penpot` in the bot (or `/system update
+  plugin dsh-penpot-plugin`) resolves the newest version, opens a rollback trial,
+  and replaces the bundle through the host's plugin manager.
+- **Standalone:** `dsh plugin --profile <name> remove dsh-penpot-plugin`, then
+  `add` the new tag. The plugin manager cannot install over an already-installed
+  git package, so it is two steps; restart the runtime when it reports
+  `restart-required`.
+
+The `dsh-penpot` row's configuration is preserved across an update; only the
+package moves.
+
+## Compatibility
+
+Plugin versions are independent of DSH and of the setup release. Each release
+states the DSH range and the Penpot versions it was tested against in
+[COMPATIBILITY.md](COMPATIBILITY.md). The setup pins an exact npm spec in
+`plugins.json`; a newer compatible version installed from the bot stays
+installed across reboots, and the GitHub tag of the same release is the
+registry-unreachable fallback.

package/cordis.patch.yml

@@ -0,0 +1,9 @@
+- insert:
+    - id: dsh-penpot
+      name: dsh-penpot-plugin
+      config:
+        # Both are required for a working backend; the environment is the safe
+        # place for them. An empty pair is supported: the plugin still loads and
+        # penpot_status reports that it is not configured.
+        apiUrl: !!js process.env.PENPOT_API_URL ?? ""
+        token: !!js process.env.PENPOT_ACCESS_TOKEN ?? ""

package/docs/DESIGN.md

@@ -0,0 +1,53 @@
+# Design
+
+## Shape
+
+```
+tools (defineTool)  ──►  PenpotBackend  ──►  api: Penpot RPC + access token
+```
+
+One backend, one set of model-facing names. There is no MCP path: the plugin
+runs beside a local Penpot instance and uses its HTTP RPC, which is the same
+surface the `penpot` CLI uses.
+
+## Backend
+
+`POST /api/rpc/command/<name>` with `Authorization: Token …`, kebab-case
+payloads. Ported from the `penpot` CLI in the setup repo.
+
+- `get-teams`, `get-all-projects`/`get-projects`, `get-files`,
+  `search-files`, `get-file-summary`, `export-binfile`, `import-binfile`.
+- A missing `PENPOT_API_URL` or `PENPOT_ACCESS_TOKEN` leaves the plugin loaded
+  but unconfigured: `penpot_status` reports `none`, every other tool throws the
+  same readable error instead of failing the whole plugin at load.
+
+## Why no MCP
+
+MCP was an optional second transport in 0.1. It delegated to tools registered by
+`@deepseek-ai/dsh-mcp-client`, so it needed a separate MCP server, exposed only
+read operations, and refused export/import. With the direct API available, it
+added a configuration footgun (`backend: auto` would pick the read-only MCP and
+break `penpot_export`) and no capability. Removed in 0.2.0.
+
+The hosted `penpot.app` MCP is a remote service for Penpot's cloud account; it is
+not used by this local setup, and routing designs through it would leave the
+host.
+
+## Open questions (v0.2+)
+
+1. **Writes.** Penpot's `update-file` takes a `changes` array (`add-obj`,
+   `mod-obj`, `del-obj`) against its shape model. The pragmatic path is
+   shape-by-shape: text first, then fill, then geometry, each with a Penpot
+   version row in the matrix.
+2. **Import.** Implemented in 0.3.0 as `penpot_import` (multipart
+   `import-binfile`). The shape is covered by a fake server; a real instance
+   run is still the release gate for the compatibility row.
+3. **Resources.** A file could be exposed as a DSH resource rather than fetched
+   through a tool; depends on what DSH's resource surface wants.
+
+## Non-goals
+
+- The live canvas. That is the browser plugin API, reachable only through a
+  human tab, not a headless plugin.
+- Owning Penpot's data model. Everything goes through the API; no direct
+  Postgres reads.

package/docs/STANDALONE.md

@@ -0,0 +1,76 @@
+# Standalone use
+
+`dsh-penpot-plugin` is a normal DSH bundle. The setup's design component is a
+convenience: it installs Penpot, the `penpot` CLI and this plugin, and wires the
+environment. None of that is required by the plugin.
+
+## Requirements
+
+| What | Why |
+|---|---|
+| DSH matching the range in [COMPATIBILITY.md](../COMPATIBILITY.md) | the tool registry API |
+| A reachable Penpot instance (2.x) | the HTTP RPC backend |
+| A Penpot access token | Settings → Access tokens |
+| Node 22 and pnpm | `dsh plugin`; source installs also need the build script |
+
+## Install
+
+```sh
+# Published package: the tarball already contains lib/, so no build script.
+dsh plugin --profile penpot add dsh-penpot-plugin@0.3.0
+```
+
+From the source repository instead, allow the build and pin the tag:
+
+```yaml
+allowBuilds:
+  dsh-penpot-plugin@https://github.com/vladtsvirko/dsh-penpot-plugin.git: true
+```
+```sh
+dsh plugin --profile penpot add github:vladtsvirko/dsh-penpot-plugin#v0.3.0
+```
+
+The bundle's own patch inserts the `dsh-penpot` row and reads both values from
+the runtime environment, so there is no configuration file to edit:
+
+```sh
+export PENPOT_API_URL='http://192.168.2.50:8090'   # /api/rpc suffix is optional
+export PENPOT_ACCESS_TOKEN='...'
+dsh --profile penpot
+```
+
+Export the variables in the environment that starts the runtime. A shell export
+made after the runtime is already running does not reach it.
+
+## Verify
+
+Ask the agent for `penpot_status`. It reports either `api <url>` or
+`none — not configured`, naming the missing variables. The other tools return
+one readable error when the backend is unconfigured; the plugin itself still
+loads, so a missing token never takes the runtime down.
+
+## Update and remove
+
+```sh
+dsh plugin --profile penpot remove dsh-penpot-plugin
+dsh plugin --profile penpot add dsh-penpot-plugin@<new>
+```
+
+The host's plugin manager refuses to install a git package over an installed
+one, so removal comes first. Restart the runtime if the command reports
+`restart-required`. In a setup deployment the bot does this through the plugin
+manager and wraps it in a rollback trial (`/system update penpot`); the package
+and the row are exactly the same.
+
+## What the setup adds
+
+| Setup feature | Standalone equivalent |
+|---|---|
+| `install.sh --design penpot` installs Penpot and the token | run Penpot yourself |
+| managed `dsh-penpot` row in `cordis.patch.yml` | the bundle's own insert row |
+| `/system components` enable/disable | `dsh plugin … add/remove` |
+| `/system update penpot` with a trial | the two `dsh plugin` commands above |
+| `/system rollback` | keep the previous tag; re-add it |
+
+Nothing in the tool surface changes. The setup adds lifecycle and packaging, not
+capability.

package/lib/api-backend.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Direct HTTP backend: Penpot's own RPC, authenticated with an access token.
+ *
+ * This is a port of `design/penpot.mjs` from the dsh-tg-docker-setup CLI, kept
+ * here as a typed module so the plugin has no dependency on that repository.
+ *
+ * @module dsh-penpot-plugin/api-backend
+ */
+import type { PenpotBackend } from './backend.js';
+export interface ApiBackendOptions {
+    apiUrl: string;
+    token: string;
+    /** Injectable for tests. */
+    fetchImpl?: typeof fetch;
+}
+/** Strip a trailing /api/rpc or slash so any pasted form works. */
+export declare function normalizeBase(url: string): string;
+export declare class PenpotApiError extends Error {
+    readonly status: number;
+    constructor(status: number, detail: string);
+}
+/** Read an SSE body into `{ event, data }` records, ignoring comments. */
+export declare const readSse: (response: Response) => Promise<Array<{
+    event: string;
+    data: unknown;
+}>>;
+export declare function createApiBackend(options: ApiBackendOptions): PenpotBackend;

package/lib/api-backend.js

@@ -0,0 +1,172 @@
+/**
+ * Direct HTTP backend: Penpot's own RPC, authenticated with an access token.
+ *
+ * This is a port of `design/penpot.mjs` from the dsh-tg-docker-setup CLI, kept
+ * here as a typed module so the plugin has no dependency on that repository.
+ *
+ * @module dsh-penpot-plugin/api-backend
+ */
+import { readFile } from 'node:fs/promises';
+import { basename } from 'node:path';
+/** Strip a trailing /api/rpc or slash so any pasted form works. */
+export function normalizeBase(url) {
+    return url.replace(/\/+$/, '').replace(/\/api\/rpc$/, '');
+}
+export class PenpotApiError extends Error {
+    status;
+    constructor(status, detail) {
+        super(`Penpot answered ${String(status)}${detail === '' ? '' : `: ${detail}`}`);
+        this.name = 'PenpotApiError';
+        this.status = status;
+    }
+}
+const asRefs = (value) => {
+    if (!Array.isArray(value))
+        return [];
+    return value
+        .filter((item) => typeof item === 'object' && item !== null)
+        .map((item) => ({ id: String(item['id'] ?? ''), name: String(item['name'] ?? '') }));
+};
+/**
+ * Penpot's export/import endpoints answer as Server-Sent Events, and the event
+ * data is transit-encoded even when the request asked for JSON. The only
+ * markers these endpoints emit are `~:` (keyword key) and `~u` (uuid), so a
+ * small normalizer is enough and avoids a transit dependency.
+ */
+const decodeTransit = (value) => {
+    if (typeof value === 'string') {
+        if (value.startsWith('~u'))
+            return value.slice(2);
+        if (value.startsWith('~:'))
+            return value.slice(2);
+        return value;
+    }
+    if (Array.isArray(value))
+        return value.map(decodeTransit);
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key.startsWith('~:') ? key.slice(2) : key, decodeTransit(item)]));
+    }
+    return value;
+};
+/** Read an SSE body into `{ event, data }` records, ignoring comments. */
+export const readSse = async (response) => {
+    const text = await response.text();
+    const events = [];
+    for (const block of text.split(/\r?\n\r?\n/)) {
+        let event = 'message';
+        const data = [];
+        for (const line of block.split(/\r?\n/)) {
+            if (line.startsWith('event:'))
+                event = line.slice(6).trim();
+            else if (line.startsWith('data:'))
+                data.push(line.slice(5).trim());
+        }
+        if (data.length === 0)
+            continue;
+        const raw = data.join('\n');
+        let parsed = raw;
+        try {
+            parsed = decodeTransit(JSON.parse(raw));
+        }
+        catch {
+            // A non-JSON payload stays a string; the caller decides what it means.
+        }
+        events.push({ event, data: parsed });
+    }
+    return events;
+};
+/** The payload of the last `end` event, or undefined when the stream had none. */
+const lastEnd = (events) => {
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        if (events[index]?.event === 'end')
+            return events[index]?.data;
+    }
+    return undefined;
+};
+const failOnErrorEvent = (events) => {
+    const error = events.find((item) => item.event === 'error');
+    if (error !== undefined) {
+        throw new PenpotApiError(200, JSON.stringify(error.data).slice(0, 300));
+    }
+};
+export function createApiBackend(options) {
+    const base = normalizeBase(options.apiUrl);
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const headers = { authorization: `Token ${options.token}`, accept: 'application/json' };
+    const rpc = async (command, body = {}) => {
+        const response = await fetchImpl(`${base}/api/rpc/command/${command}`, {
+            method: 'POST',
+            headers: { ...headers, 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new PenpotApiError(response.status, text.slice(0, 300).trim());
+        }
+        return response;
+    };
+    return {
+        kind: 'api',
+        label: `api ${base}`,
+        async listTeams() {
+            return asRefs(await (await rpc('get-teams')).json());
+        },
+        async listProjects(teamId) {
+            const command = teamId === undefined ? 'get-all-projects' : 'get-projects';
+            return asRefs(await (await rpc(command, teamId === undefined ? {} : { 'team-id': teamId })).json());
+        },
+        async listFiles(projectId) {
+            return asRefs(await (await rpc('get-project-files', { 'project-id': projectId })).json());
+        },
+        async searchFiles(teamId, term) {
+            return asRefs(await (await rpc('search-files', { 'team-id': teamId, 'search-term': term })).json());
+        },
+        async fileSummary(fileId) {
+            const raw = await (await rpc('get-file-summary', { id: fileId })).json();
+            const pages = Array.isArray(raw['pages']) ? asRefs(raw['pages']) : undefined;
+            return { id: String(raw['id'] ?? fileId), name: String(raw['name'] ?? ''), ...(pages === undefined ? {} : { pages }), raw };
+        },
+        async exportFile(fileId) {
+            // `export-binfile` streams SSE and ends with the URL of the exported zip.
+            const response = await rpc('export-binfile', {
+                'file-id': fileId,
+                'include-libraries': false,
+                'embed-assets': true,
+            });
+            const events = await readSse(response);
+            failOnErrorEvent(events);
+            const url = lastEnd(events);
+            if (typeof url !== 'string' || url.length === 0) {
+                throw new PenpotApiError(response.status, 'the export finished without a download URL');
+            }
+            const download = await fetchImpl(url);
+            if (!download.ok) {
+                throw new PenpotApiError(download.status, `the export download failed (${String(download.status)})`);
+            }
+            return new Uint8Array(await download.arrayBuffer());
+        },
+        async importFile({ path, projectId, fileId, name }) {
+            const bytes = await readFile(path);
+            const form = new FormData();
+            if (name !== undefined)
+                form.set('name', name);
+            if (projectId !== undefined)
+                form.set('project-id', projectId);
+            if (fileId !== undefined)
+                form.set('file-id', fileId);
+            form.set('file', new Blob([bytes], { type: 'application/octet-stream' }), basename(path));
+            const response = await fetchImpl(`${base}/api/rpc/command/import-binfile`, { method: 'POST', headers, body: form });
+            if (!response.ok) {
+                const text = await response.text().catch(() => '');
+                throw new PenpotApiError(response.status, text.slice(0, 300).trim());
+            }
+            // The stream ends with the id(s) of the imported file(s).
+            const events = await readSse(response);
+            failOnErrorEvent(events);
+            const result = lastEnd(events);
+            const first = Array.isArray(result) ? result[0] : result;
+            return { id: typeof first === 'string' && first.length > 0 ? first : undefined, raw: events };
+        },
+    };
+}
+//# sourceMappingURL=api-backend.js.map

package/lib/api-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-backend.js","sourceRoot":"","sources":["../src/api-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAUpC,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,MAAM,CAAQ;IACvB,YAAY,MAAc,EAAE,MAAc;QACxC,KAAK,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC,CAAA;QAC/E,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAe,EAAE;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACpC,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAI,EAAmC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC;SAC5F,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AACxF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,CAAC,KAAc,EAAW,EAAE;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAC7G,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAAE,QAAkB,EAAoD,EAAE;IACpG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,MAAM,MAAM,GAA4C,EAAE,CAAA;IAC1D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,SAAS,CAAA;QACrB,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;iBACtD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,MAAM,GAAY,GAAG,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,kFAAkF;AAClF,MAAM,OAAO,GAAG,CAAC,MAA+C,EAAW,EAAE;IAC3E,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAA;IAChE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,MAA+C,EAAQ,EAAE;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,CAAA;IAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IACzE,CAAC;AACH,CAAC,CAAA;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAA;IACvD,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,SAAS,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IAEvF,MAAM,GAAG,GAAG,KAAK,EAAE,OAAe,EAAE,OAAgC,EAAE,EAAqB,EAAE;QAC3F,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,oBAAoB,OAAO,EAAE,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACtE,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;IAED,OAAO;QACL,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,OAAO,IAAI,EAAE;QAEpB,KAAK,CAAC,SAAS;YACb,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACtD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAA;YAC1E,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACrG,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,SAAS;YACvB,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3F,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI;YAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACrG,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAA6B,CAAA;YACnG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5E,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAA;QAC7H,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,gBAAgB,EAAE;gBAC3C,SAAS,EAAE,MAAM;gBACjB,mBAAmB,EAAE,KAAK;gBAC1B,cAAc,EAAE,IAAI;aACrB,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAA;YACtC,gBAAgB,CAAC,MAAM,CAAC,CAAA;YACxB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;YAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,4CAA4C,CAAC,CAAA;YACzF,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,+BAA+B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACtG,CAAC;YACD,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;QACrD,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;YAChD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAA;YAC3B,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC9C,IAAI,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;YAC9D,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YACrD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;YACzF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,iCAAiC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACnH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;gBAClD,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtE,CAAC;YACD,0DAA0D;YAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAA;YACtC,gBAAgB,CAAC,MAAM,CAAC,CAAA;YACxB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YACxD,OAAO,EAAE,EAAE,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC/F,CAAC;KACF,CAAA;AACH,CAAC"}

package/lib/backend.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The backend seam.
+ *
+ * Penpot is reached over its HTTP RPC with an access token. The plugin owns one
+ * small interface so the model-facing tools stay independent of the transport
+ * details (and of future changes to them).
+ *
+ * Write operations are deliberately absent from v0.1: Penpot's `update-file`
+ * needs its change format, and the read/export/import set is the part that can
+ * be proven first.
+ *
+ * @module dsh-penpot-plugin/backend
+ */
+/** One addressable Penpot object, reduced to what a tool reply needs. */
+export interface PenpotRef {
+    id: string;
+    name: string;
+}
+/** A file summary: enough to identify a design without shipping its contents. */
+export interface PenpotFileSummary {
+    id: string;
+    name: string;
+    /** Pages in the file, when the backend reports them. */
+    pages?: PenpotRef[];
+    /** Backend-specific extras, passed through as-is. */
+    raw?: unknown;
+}
+/** What a backend must provide. Every method throws on refusal. */
+export interface PenpotBackend {
+    /** Which implementation is live; surfaced by the status tool and `/system status`-style checks. */
+    readonly kind: 'api';
+    /** Short human label, e.g. `api http://192.168.2.50:8090`. */
+    readonly label: string;
+    listTeams(): Promise<PenpotRef[]>;
+    listProjects(teamId?: string): Promise<PenpotRef[]>;
+    listFiles(projectId: string): Promise<PenpotRef[]>;
+    searchFiles(teamId: string, term: string): Promise<PenpotRef[]>;
+    fileSummary(fileId: string): Promise<PenpotFileSummary>;
+    /** Whole-file export as `.penpot` bytes. */
+    exportFile(fileId: string): Promise<Uint8Array>;
+    /** Import a `.penpot` file, either as a new file or in place. */
+    importFile(input: {
+        path: string;
+        projectId?: string;
+        fileId?: string;
+        name?: string;
+    }): Promise<{
+        id?: string;
+        raw?: unknown;
+    }>;
+}

package/lib/backend.js

@@ -0,0 +1,15 @@
+/**
+ * The backend seam.
+ *
+ * Penpot is reached over its HTTP RPC with an access token. The plugin owns one
+ * small interface so the model-facing tools stay independent of the transport
+ * details (and of future changes to them).
+ *
+ * Write operations are deliberately absent from v0.1: Penpot's `update-file`
+ * needs its change format, and the read/export/import set is the part that can
+ * be proven first.
+ *
+ * @module dsh-penpot-plugin/backend
+ */
+export {};
+//# sourceMappingURL=backend.js.map

package/lib/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/lib/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * dsh-penpot — Penpot tools for a DeepSeek Harness runtime.
+ *
+ * The plugin is a thin shell over Penpot's HTTP RPC API: one local backend,
+ * one small stable tool surface. There is deliberately no MCP path; see
+ * docs/DESIGN.md in the setup repository.
+ *
+ * v0.1 is read + export. Writing (Penpot's `update-file` change format) is the
+ * open design question; see docs/DESIGN.md.
+ *
+ * @module dsh-penpot-plugin
+ */
+import Schema from '@deepseek-ai/schemastery';
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "dsh-penpot";
+export declare const inject: string[];
+export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+    apiUrl: Schema<string, string, "defined">;
+    token: Schema<string, string, "defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    apiUrl: Schema<string, string, "defined">;
+    token: Schema<string, string, "defined">;
+}>>, "plain">;
+export interface PenpotPluginConfig {
+    apiUrl?: string;
+    token?: string;
+}
+export declare function apply(ctx: Context, config: PenpotPluginConfig): void;

package/lib/index.js

@@ -0,0 +1,291 @@
+/**
+ * dsh-penpot — Penpot tools for a DeepSeek Harness runtime.
+ *
+ * The plugin is a thin shell over Penpot's HTTP RPC API: one local backend,
+ * one small stable tool surface. There is deliberately no MCP path; see
+ * docs/DESIGN.md in the setup repository.
+ *
+ * v0.1 is read + export. Writing (Penpot's `update-file` change format) is the
+ * open design question; see docs/DESIGN.md.
+ *
+ * @module dsh-penpot-plugin
+ */
+import Schema from '@deepseek-ai/schemastery';
+import { defineTool } from '@deepseek-ai/dsh-tools';
+import { createApiBackend } from './api-backend.js';
+export const name = 'dsh-penpot';
+// `ctx.tools` is a declared service: Cordis refuses the property without an
+// injection declaration, even when the profile has the service mounted. This is
+// what makes the plugin load in a plain profile, not only beside the setup.
+export const inject = ['tools'];
+export const Config = Schema.object({
+    apiUrl: Schema.string().default(''),
+    token: Schema.string().default(''),
+});
+/** Render one list result: id and name per line, backend in parentheses. */
+function describeRefs(value) {
+    return value.items.length === 0
+        ? `no results (${value.backend})`
+        : `${value.items.map((item) => `${item.id}\t${item.name}`).join('\n')}\n(${value.backend})`;
+}
+export function apply(ctx, config) {
+    const configured = typeof config.apiUrl === 'string' && config.apiUrl.length > 0
+        && typeof config.token === 'string' && config.token.length > 0;
+    const backend = configured
+        ? createApiBackend({ apiUrl: config.apiUrl, token: config.token })
+        : undefined;
+    const requireBackend = () => {
+        if (backend === undefined) {
+            throw new Error('Penpot is not configured: set PENPOT_API_URL and PENPOT_ACCESS_TOKEN, then restart dsh');
+        }
+        return backend;
+    };
+    ctx.tools.register(defineTool({
+        name: 'penpot_status',
+        description: 'Report whether the Penpot HTTP API is configured. Call it when a Penpot tool fails.',
+        parameters: {},
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    backend: { type: 'string', required: true, description: 'api, or none when not configured.' },
+                    label: { type: 'string', required: true, description: 'Human-readable endpoint, e.g. "api http://host:8090".' },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: `${value.backend} — ${value.label}` }],
+        },
+        async execute() {
+            return backend === undefined
+                ? { backend: 'none', label: 'not configured (PENPOT_API_URL / PENPOT_ACCESS_TOKEN)' }
+                : { backend: requireBackend().kind, label: requireBackend().label };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'penpot_teams',
+        description: 'List the Penpot teams the configured account can see. Start here when you do not know any ids.',
+        parameters: {},
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    backend: { type: 'string', required: true, description: 'Which backend answered: api.' },
+                    items: {
+                        type: 'array',
+                        required: true,
+                        description: 'Penpot objects, id and name only.',
+                        items: {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                id: { type: 'string', required: true, description: 'Penpot uuid.' },
+                                name: { type: 'string', required: true, description: 'Display name.' },
+                            },
+                        },
+                    },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: describeRefs(value) }],
+        },
+        async execute() {
+            return { backend: requireBackend().kind, items: await requireBackend().listTeams() };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'penpot_projects',
+        description: 'List Penpot projects, optionally restricted to one team.',
+        parameters: {
+            teamId: { type: 'string', description: 'Team uuid from penpot_teams. Omit for every project the account can see.' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    backend: { type: 'string', required: true, description: 'Which backend answered: api.' },
+                    items: {
+                        type: 'array',
+                        required: true,
+                        description: 'Penpot objects, id and name only.',
+                        items: {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                id: { type: 'string', required: true, description: 'Penpot uuid.' },
+                                name: { type: 'string', required: true, description: 'Display name.' },
+                            },
+                        },
+                    },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: describeRefs(value) }],
+        },
+        async execute(args) {
+            return { backend: requireBackend().kind, items: await requireBackend().listProjects(args.teamId) };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'penpot_files',
+        description: 'List the design files in a Penpot project.',
+        parameters: {
+            projectId: { type: 'string', required: true, description: 'Project uuid from penpot_projects.' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    backend: { type: 'string', required: true, description: 'Which backend answered: api.' },
+                    items: {
+                        type: 'array',
+                        required: true,
+                        description: 'Penpot objects, id and name only.',
+                        items: {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                id: { type: 'string', required: true, description: 'Penpot uuid.' },
+                                name: { type: 'string', required: true, description: 'Display name.' },
+                            },
+                        },
+                    },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: describeRefs(value) }],
+        },
+        async execute(args) {
+            return { backend: requireBackend().kind, items: await requireBackend().listFiles(args.projectId) };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'penpot_search',
+        description: 'Search Penpot design files by name or content term. Penpot searches within one team, so pass teamId or let the first team be used.',
+        parameters: {
+            query: { type: 'string', required: true, description: 'Search term.' },
+            teamId: { type: 'string', description: 'Team uuid from penpot_teams; defaults to the first team.' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    backend: { type: 'string', required: true, description: 'Which backend answered: api.' },
+                    items: {
+                        type: 'array',
+                        required: true,
+                        description: 'Penpot objects, id and name only.',
+                        items: {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                id: { type: 'string', required: true, description: 'Penpot uuid.' },
+                                name: { type: 'string', required: true, description: 'Display name.' },
+                            },
+                        },
+                    },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: describeRefs(value) }],
+        },
+        async execute(args) {
+            const backend = requireBackend();
+            const teamId = args.teamId ?? (await backend.listTeams())[0]?.id;
+            if (teamId === undefined || teamId.length === 0) {
+                throw new Error('no Penpot team found — create one in Penpot before searching');
+            }
+            return { backend: backend.kind, items: await backend.searchFiles(teamId, args.query) };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'penpot_file',
+        description: 'Show one design file: its id, name and pages. Use it to find the page ids an export or a future write needs.',
+        parameters: {
+            fileId: { type: 'string', required: true, description: 'File uuid from penpot_files or penpot_search.' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    backend: { type: 'string', required: true, description: 'api, or none when not configured.' },
+                    file: {
+                        type: 'object',
+                        required: true,
+                        additionalProperties: false,
+                        properties: {
+                            id: { type: 'string', required: true, description: 'File uuid.' },
+                            name: { type: 'string', required: true, description: 'File name.' },
+                        },
+                    },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: `${value.file.id}\t${value.file.name} (${value.backend})` }],
+        },
+        async execute(args) {
+            const summary = await requireBackend().fileSummary(args.fileId);
+            return { backend: requireBackend().kind, file: { id: summary.id, name: summary.name } };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'penpot_export',
+        description: 'Export a design file to a .penpot file on disk (a zip of Penpot JSON). Read it with the normal file tools, then import it back with penpot_import.',
+        parameters: {
+            fileId: { type: 'string', required: true, description: 'File uuid.' },
+            path: { type: 'string', required: true, description: 'Absolute path to write.' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    path: { type: 'string', required: true, description: 'Where the file was written.' },
+                    bytes: { type: 'number', required: true, description: 'Size in bytes.' },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: `${value.path} (${String(value.bytes)} bytes)` }],
+        },
+        async execute(args) {
+            const bytes = await requireBackend().exportFile(args.fileId);
+            const { writeFile } = await import('node:fs/promises');
+            await writeFile(args.path, bytes);
+            return { path: args.path, bytes: bytes.byteLength };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'penpot_import',
+        description: 'Import a .penpot file (a zip of Penpot JSON) as a new file in a project, or replace an existing file. Use penpot_export to produce the input.',
+        parameters: {
+            path: { type: 'string', required: true, description: 'Absolute path of the .penpot file to upload.' },
+            projectId: { type: 'string', description: 'Target project uuid from penpot_projects. Required unless fileId is given.' },
+            fileId: { type: 'string', description: 'Existing file uuid to replace. Omit to create a new file.' },
+            name: { type: 'string', description: 'Display name for a new file. Ignored when fileId is given.' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    id: { type: 'string', required: true, description: 'Penpot uuid of the imported file.' },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: `imported ${value.id}` }],
+        },
+        async execute(args) {
+            if ((args.projectId === undefined || args.projectId.length === 0)
+                && (args.fileId === undefined || args.fileId.length === 0)) {
+                throw new Error('penpot_import needs a projectId for a new file, or a fileId to replace one');
+            }
+            const result = await requireBackend().importFile({
+                path: args.path,
+                ...(args.projectId === undefined ? {} : { projectId: args.projectId }),
+                ...(args.fileId === undefined ? {} : { fileId: args.fileId }),
+                ...(args.name === undefined ? {} : { name: args.name }),
+            });
+            // Penpot's import answers the new file id. A backend that cannot report
+            // one has still done the import, so name what is known rather than lie.
+            return { id: result.id ?? 'unknown (Penpot did not return a file id)' };
+        },
+    }));
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGnD,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,CAAA;AAChC,4EAA4E;AAC5E,gFAAgF;AAChF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AAE/B,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACnC,CAAC,CAAA;AAOF,4EAA4E;AAC5E,SAAS,YAAY,CAAC,KAAuD;IAC3E,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,CAAC,eAAe,KAAK,CAAC,OAAO,GAAG;QACjC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,OAAO,GAAG,CAAA;AAC/F,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAA0B;IAC5D,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;WAC3E,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IAChE,MAAM,OAAO,GAA8B,UAAU;QACnD,CAAC,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAe,EAAE,CAAC;QACtF,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,cAAc,GAAG,GAAkB,EAAE;QACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;QAC3G,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,qFAAqF;QAClG,UAAU,EAAE,EAAE;QACd,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE;oBAC7F,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uDAAuD,EAAE;iBAChH;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;SACxF;QACD,KAAK,CAAC,OAAO;YACX,OAAO,OAAO,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,uDAAuD,EAAE;gBACrF,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,KAAK,EAAE,CAAA;QACvE,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gGAAgG;QAC7G,UAAU,EAAE,EAAE;QACd,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8BAA8B,EAAE;oBACxF,KAAK,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,IAAI;wBACd,WAAW,EAAE,mCAAmC;wBAChD,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,oBAAoB,EAAE,KAAK;4BAC3B,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE;gCACnE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE;6BACvE;yBACF;qBACF;iBACF;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;SACxE;QACD,KAAK,CAAC,OAAO;YACX,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAA;QACtF,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,0DAA0D;QACvE,UAAU,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0EAA0E,EAAE;SACpH;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8BAA8B,EAAE;oBACxF,KAAK,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,IAAI;wBACd,WAAW,EAAE,mCAAmC;wBAChD,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,oBAAoB,EAAE,KAAK;4BAC3B,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE;gCACnE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE;6BACvE;yBACF;qBACF;iBACF;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;SACxE;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,cAAc,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAA;QACpG,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,4CAA4C;QACzD,UAAU,EAAE;YACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oCAAoC,EAAE;SACjG;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8BAA8B,EAAE;oBACxF,KAAK,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,IAAI;wBACd,WAAW,EAAE,mCAAmC;wBAChD,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,oBAAoB,EAAE,KAAK;4BAC3B,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE;gCACnE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE;6BACvE;yBACF;qBACF;iBACF;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;SACxE;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,cAAc,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAA;QACpG,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,oIAAoI;QACjJ,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE;YACtE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0DAA0D,EAAE;SACpG;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8BAA8B,EAAE;oBACxF,KAAK,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,IAAI;wBACd,WAAW,EAAE,mCAAmC;wBAChD,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,oBAAoB,EAAE,KAAK;4BAC3B,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE;gCACnE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE;6BACvE;yBACF;qBACF;iBACF;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;SACxE;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAA;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;YAChE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;YACjF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;QACxF,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,8GAA8G;QAC3H,UAAU,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+CAA+C,EAAE;SACzG;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE;oBAC7F,IAAI,EAAE;wBACJ,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,IAAI;wBACd,oBAAoB,EAAE,KAAK;wBAC3B,UAAU,EAAE;4BACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE;4BACjE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE;yBACpE;qBACF;iBACF;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;SAC9G;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC/D,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAA;QACzF,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,oJAAoJ;QACjK,UAAU,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE;YACrE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE;SACjF;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6BAA6B,EAAE;oBACpF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE;iBACzE;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;SACnG;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC5D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;YACtD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACjC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;QACrD,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,+IAA+I;QAC5J,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8CAA8C,EAAE;YACrG,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4EAA4E,EAAE;YACxH,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2DAA2D,EAAE;YACpG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4DAA4D,EAAE;SACpG;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE;iBACzF;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;SAC3E;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;mBAC5D,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;YAC/F,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC,UAAU,CAAC;gBAC/C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC7D,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;aACxD,CAAC,CAAA;YACF,wEAAwE;YACxE,wEAAwE;YACxE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,2CAA2C,EAAE,CAAA;QACzE,CAAC;KACF,CAAC,CAAC,CAAA;AACL,CAAC"}

package/package.json

@@ -1,6 +1,63 @@
 {
   "name": "dsh-penpot-plugin",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.1",
+  "description": "Penpot for DeepSeek Harness — read, export and import design files from a DSH agent over Penpot's local HTTP RPC API.",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "CHANGELOG.md",
+    "COMPATIBILITY.md",
+    "docs"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vladtsvirko/dsh-penpot-plugin.git"
+  },
+  "homepage": "https://github.com/vladtsvirko/dsh-penpot-plugin#readme",
+  "bugs": {
+    "url": "https://github.com/vladtsvirko/dsh-penpot-plugin/issues"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepare": "npm run build",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build",
+    "clean": "node -e \"require('node:fs').rmSync('lib',{recursive:true,force:true})\"",
+    "prebuild": "npm run clean"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.6 <0.3.0-0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.2",
+    "@types/node": "^24.0.0",
+    "typescript": "^5.9.0",
+    "vitest": "^4.1.10"
+  },
+  "license": "MIT",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "penpot",
+    "design"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}