chore(sdk): refresh byte-pinned mirror to plugin-types@3.0.1 (fn-182.4 mirror order)

.sdk-integrity

@@ -1,3 +1,3 @@
 package=@appos.space/plugin-types
-version=3.0.0
-integrity=sha512-Sw6Ro/MNq07cn/idU1d+ccyjjf0vAYrr09Mh/O3vnHXqrgjpg1l5YO7lpCMHqLoxJAxw3pRXD1pcLDJ1GMhT7g==
+version=3.0.1
+integrity=sha512-tJ7BPSpaWk8BVJFvO9BKyKIj953ra30bZ9hEnMLtB+VRPqM57MDhO+TEYn69gXFa05OT+BGEwigXvcZ1P8Jd9w==

package.json

@@ -10,7 +10,7 @@
     "check": "npm run freshness && npm run verify && npm run freshness:compiled"
   },
   "devDependencies": {
-    "@appos.space/plugin-types": "3.0.0",
+    "@appos.space/plugin-types": "3.0.1",
     "@appos.space/plugin-utils": "3.0.0",
     "@appos.space/view-builders": "3.0.0",
     "typescript": "5.9.3"

plugins/appos-dev/compiled/manifest.json

@@ -8,14 +8,14 @@
     "SKILL.md": "f4868a887ab7726ca8c6463b90953a1efb82712fb1a3df5e68888f9b43644cd6",
     "reference/extension-api.md": "b37b24cd2a5e02345b361ee08aea29a885084ebfb4a8a73358036a91572c49e8",
     "reference/patterns.md": "93fc7e840176ab625fe848fb6df92f1c98301b5e13811906696eca3be91822f9",
-    "reference/plugin-api/index.d.ts": "cbdd7a4aa96001d3fe664427ffc30039ce09ba80dca2eee32960c5c925c4d8d4",
+    "reference/plugin-api/index.d.ts": "7299f52226d577aa8ad6160357a8dee2e02f90bb19a18f93ec31d605f5756b27",
     "reference/plugin-api/core.d.ts": "3e951ef56e6148879fbe92d592399711f4bad5556f1549233ec3d32d0d9c49f9",
-    "reference/plugin-api/views.d.ts": "dc3ae9b751b1cce8541e269c8000001dd819622fe1d5dfdbee7c6ca88c06f551",
-    "reference/plugin-api/namespaces.d.ts": "17c3364ad01ecc2b341a487bc0f286afa11cb2471f1fddb3735b1b0379bdad17",
+    "reference/plugin-api/views.d.ts": "323f8570fe1c0e6140b5ee1f46cf79f368dc4d920e4b14544e5bf5753ae05f1e",
+    "reference/plugin-api/namespaces.d.ts": "467e6374fced48f027c22e9d01fe6daa68839b2f9881726725b901c66ccc8b1f",
     "reference/plugin-api/namespaces-core-plugins.d.ts": "1b6c76836a6cfc87a3699ab40b8f6fd19d2c88bc8d6f90cd4ca6604d236cb7f6",
-    "reference/plugin-api/permissions.d.ts": "cd947682aed902d4878e56a03cd864f930fdc65f61588cc9e7c132c28772ab18",
-    "reference/plugin-api/colors.d.ts": "dbabe48e8d4615db877035f422c2e3200b591641161037a01cda60e51ab0981d",
-    "reference/plugin-api/fonts.d.ts": "479ade3790891953f4302d5f8729ad67621f9b69dccec317bb8e5b47175d58ac",
-    "reference/plugin-api/icons.d.ts": "8465ce60f8e4f426dd04777cce38ce03dbcaa113f4c115ce76a715020ce9960d"
+    "reference/plugin-api/permissions.d.ts": "80b890f0eac15d612cd45b6892e348a16bbcd2eee2d515909583a7d25ed3c775",
+    "reference/plugin-api/colors.d.ts": "bb57988f9a884aac5688adfc3e498e92617dfae257829a78aae1ed18ae051a95",
+    "reference/plugin-api/fonts.d.ts": "a0fbe8f1c761bc1d5418ac5b15f2ba7c1bd33be14dd3a0bc3f007b84d28335e2",
+    "reference/plugin-api/icons.d.ts": "67d8c54c447c0f8b5a8f28f6375dc1956b68770221ff3028c0b73d8d039b546e"
   }
 }

plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/INDEX.md

@@ -1,4 +1,4 @@
-# Bundled SDK type mirror — @appos.space/plugin-types@3.0.0
+# Bundled SDK type mirror — @appos.space/plugin-types@3.0.1
 
 GENERATED by `scripts/check-sdk-freshness.sh --update` — DO NOT EDIT BY HAND.
 
@@ -8,20 +8,21 @@ source; `scripts/check-sdk-freshness.sh` re-verifies this mirror against the
 registry on every CI run.
 
 - package: `@appos.space/plugin-types`
-- version: `3.0.0`
-- dist.integrity: `sha512-Sw6Ro/MNq07cn/idU1d+ccyjjf0vAYrr09Mh/O3vnHXqrgjpg1l5YO7lpCMHqLoxJAxw3pRXD1pcLDJ1GMhT7g==`
-- surface (derived from these files): 43 API namespaces on `PluginContext` (of which 21 core-plugin namespaces) + 3 metadata scalars, 135 canonical permission scopes, 5 legacy aliases (deprecated), 1 dynamic `oauth.<provider>` scope family, 2880 lines total
+- version: `3.0.1`
+- dist.integrity: `sha512-tJ7BPSpaWk8BVJFvO9BKyKIj953ra30bZ9hEnMLtB+VRPqM57MDhO+TEYn69gXFa05OT+BGEwigXvcZ1P8Jd9w==`
+- surface (derived from these files): 43 API namespaces on `PluginContext` (of which 21 core-plugin namespaces) + 3 metadata scalars, 135 canonical permission scopes, 5 legacy aliases (deprecated), 1 dynamic `oauth.<provider>` scope family, 3065 lines total
 - regenerate: `scripts/check-sdk-freshness.sh --update` (after bumping the `@appos.space/plugin-types` devDependency + lockfile)
 - verify: `scripts/check-sdk-freshness.sh`
 
 | file | sha256 |
 |---|---|
-| colors.d.ts | dbabe48e8d4615db877035f422c2e3200b591641161037a01cda60e51ab0981d |
+| colors.d.ts | bb57988f9a884aac5688adfc3e498e92617dfae257829a78aae1ed18ae051a95 |
 | core.d.ts | 3e951ef56e6148879fbe92d592399711f4bad5556f1549233ec3d32d0d9c49f9 |
-| fonts.d.ts | 479ade3790891953f4302d5f8729ad67621f9b69dccec317bb8e5b47175d58ac |
-| icons.d.ts | 8465ce60f8e4f426dd04777cce38ce03dbcaa113f4c115ce76a715020ce9960d |
-| index.d.ts | cbdd7a4aa96001d3fe664427ffc30039ce09ba80dca2eee32960c5c925c4d8d4 |
+| fonts.d.ts | a0fbe8f1c761bc1d5418ac5b15f2ba7c1bd33be14dd3a0bc3f007b84d28335e2 |
+| globals.d.ts | a70c80ddc1ae463ff414784074aac43e9c10fb34f4ab540f443a910d1d97ec3b |
+| icons.d.ts | 67d8c54c447c0f8b5a8f28f6375dc1956b68770221ff3028c0b73d8d039b546e |
+| index.d.ts | 7299f52226d577aa8ad6160357a8dee2e02f90bb19a18f93ec31d605f5756b27 |
 | namespaces-core-plugins.d.ts | 1b6c76836a6cfc87a3699ab40b8f6fd19d2c88bc8d6f90cd4ca6604d236cb7f6 |
-| namespaces.d.ts | 17c3364ad01ecc2b341a487bc0f286afa11cb2471f1fddb3735b1b0379bdad17 |
-| permissions.d.ts | cd947682aed902d4878e56a03cd864f930fdc65f61588cc9e7c132c28772ab18 |
-| views.d.ts | dc3ae9b751b1cce8541e269c8000001dd819622fe1d5dfdbee7c6ca88c06f551 |
+| namespaces.d.ts | 467e6374fced48f027c22e9d01fe6daa68839b2f9881726725b901c66ccc8b1f |
+| permissions.d.ts | 80b890f0eac15d612cd45b6892e348a16bbcd2eee2d515909583a7d25ed3c775 |
+| views.d.ts | 323f8570fe1c0e6140b5ee1f46cf79f368dc4d920e4b14544e5bf5753ae05f1e |

plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/colors.d.ts

@@ -12,3 +12,4 @@ export type DesignTokenColor = "ux_synapse" | "ux_cortex" | "ux_pulse" | "ux_sig
 export type HexColor = `#${string}`;
 /** All valid color values */
 export type PluginColor = SystemColor | SemanticColor | DesignTokenColor | HexColor;
+//# sourceMappingURL=colors.d.ts.map

plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/fonts.d.ts

@@ -3,3 +3,4 @@
  * Maps to SwiftUI Font enum.
  */
 export type PluginFont = "largeTitle" | "title" | "title2" | "title3" | "headline" | "subheadline" | "body" | "callout" | "footnote" | "caption" | "caption2";
+//# sourceMappingURL=fonts.d.ts.map

plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/globals.d.ts

@@ -0,0 +1,180 @@
+/**
+ * `@appos.space/plugin-types/globals` — OPT-IN ambient declarations for
+ * globals the AppOS host injects into the JavaScriptCore plugin runtime.
+ *
+ * This subpath is deliberately NOT re-exported from the package's main
+ * entry. Importing `@appos.space/plugin-types` declares nothing global;
+ * the declarations below apply ONLY to compilations that reference this
+ * subpath explicitly, e.g. from a plugin entry file:
+ *
+ *     /// <reference types="@appos.space/plugin-types/globals" />
+ *
+ * or from `tsconfig.json`:
+ *
+ *     { "compilerOptions": { "types": ["@appos.space/plugin-types/globals"] } }
+ *
+ * Reference it ONLY from plugin-runtime (JSC) tsconfigs, and that tsconfig
+ * MUST use a DOM-free `lib` (e.g. `"lib": ["ES2020"]`). Webview code
+ * compiled against `lib.dom` already has a (mutable, `searchParams`-bearing)
+ * `URL`. These declarations conflict with lib.dom's, but do NOT rely on
+ * that conflict as a safeguard: with `skipLibCheck` enabled (the default
+ * in most scaffolds) TypeScript suppresses declaration-file conflicts and
+ * silently MERGES the interfaces, so browser-only surface (`searchParams`,
+ * mutable accessors, unguarded construction) can type-check against the
+ * narrower JSC contract. The DOM-free `lib` is the only reliable isolation.
+ */
+export {};
+declare global {
+    /**
+     * A parsed, immutable URL produced by the AppOS host's Foundation-bridged
+     * `URL` constructor (see the {@link URL} global for availability and the
+     * full contract).
+     *
+     * All accessors are readonly: the runtime exposes non-enumerable getter
+     * properties, so assignment is a sloppy-mode no-op / strict-mode
+     * `TypeError`. Setters are a possible v2 addition.
+     *
+     * `searchParams` is deliberately ABSENT from this type. The v1 runtime has
+     * no `URLSearchParams`; at runtime the `searchParams` getter THROWS a
+     * `TypeError` ("URLSearchParams is not available in the AppOS plugin
+     * runtime v1 — parse url.search manually"). Parse `url.search` yourself.
+     */
+    interface URL {
+        /**
+         * The absolute URL string (Foundation's serialization). Also returned by
+         * `toString()` and `toJSON()`, so template literals, `String(u)` and
+         * `JSON.stringify(u)` all yield the href.
+         *
+         * Pinned divergence: pre-percent-encoded query values are DOUBLE-encoded
+         * on an href round-trip (`%3A` → `%253A`).
+         */
+        readonly href: string;
+        /** Lowercased scheme followed by `":"` (e.g. `"https:"`). */
+        readonly protocol: string;
+        /**
+         * The host, lowercased, WITHOUT brackets for IPv6 literals — this is
+         * Foundation's `URL.host` verbatim (lowercased), i.e. the exact host
+         * string that enters the AppOS host's own security normalizers for the
+         * same input. Example: `https://[::1]:8443/x` → hostname `"::1"`.
+         */
+        readonly hostname: string;
+        /**
+         * `hostname`, plus `":" + port` when a port is present. IPv6 literals
+         * are RE-bracketed here so the concatenation is unambiguous:
+         * `https://[::1]:8443/x` → host `"[::1]:8443"`;
+         * `https://[2001:db8::1]/` → host `"[2001:db8::1]"`.
+         */
+        readonly host: string;
+        /**
+         * The port as a string, `""` when absent.
+         *
+         * Pinned divergences: default ports are RETAINED (`https://x:443/` keeps
+         * port `"443"`; WHATWG would drop it) and out-of-range ports are
+         * accepted.
+         */
+        readonly port: string;
+        /**
+         * The path component. Pinned divergence: an empty path stays `""`
+         * (WHATWG would normalize `https://example.com` to pathname `"/"`).
+         */
+        readonly pathname: string;
+        /** The query: `""`, or `"?"`-prefixed when present. */
+        readonly search: string;
+        /** The fragment: `""`, or `"#"`-prefixed when present. */
+        readonly hash: string;
+        /**
+         * `scheme://host` (with the re-bracketed, port-bearing {@link URL.host})
+         * for `http`/`https`/`ws`/`wss`/`ftp`; the literal string `"null"` for
+         * every other scheme. Example: `https://[::1]:8443/x` → origin
+         * `"https://[::1]:8443"`.
+         */
+        readonly origin: string;
+        /** The username component, `""` when absent. */
+        readonly username: string;
+        /** The password component, `""` when absent. */
+        readonly password: string;
+        /** The absolute URL string — same value as {@link URL.href}. */
+        toString(): string;
+        /** The absolute URL string — same value as {@link URL.href}. */
+        toJSON(): string;
+    }
+    /**
+     * Constructor/static surface of the host-injected `URL` global. See the
+     * {@link URL} var declaration for availability, semantics and the pinned
+     * Foundation-vs-WHATWG divergences.
+     */
+    interface URLConstructor {
+        /**
+         * Parses `url` (resolving against `base` when given) with Foundation's
+         * RFC 3986 parser. Requires `new` (a bare `URL(...)` call throws a
+         * `TypeError`).
+         *
+         * Throws `TypeError` (`e instanceof TypeError === true`) when:
+         * - `url` has no scheme or is scheme-relative (`//host/x`) and no valid
+         *   absolute `base` is supplied;
+         * - `base` is supplied but does not itself parse as an absolute URL
+         *   (the base is validated FIRST, matching WHATWG ordering);
+         * - the input does not parse at all.
+         *
+         * Arguments are coerced via `toString`; a throwing `toString` propagates
+         * out of the constructor (unlike {@link URLConstructor.canParse}).
+         */
+        new (url: string | URL, base?: string | URL): URL;
+        /**
+         * `true` iff `new URL(url, base)` would succeed. NEVER throws and never
+         * leaves a pending exception — even when argument coercion itself throws
+         * (e.g. an object whose `toString` throws), `canParse` suppresses the
+         * exception fully and returns `false`.
+         */
+        canParse(url: string | URL, base?: string | URL): boolean;
+        readonly prototype: URL;
+    }
+    /**
+     * Host-injected `URL` constructor for the AppOS JavaScriptCore plugin
+     * runtime — a native, Foundation-bridged implementation (macOS 14+
+     * `URL(string:)`, RFC 3986), NOT a WHATWG spec polyfill.
+     *
+     * Coherence guarantee: for the same input, `url.hostname` is the same
+     * (lowercased) host string that enters the AppOS host's own security
+     * normalizers (permission validation, initial-hop network checks) — so
+     * plugin-side URL validation parses identically to host-side enforcement.
+     *
+     * ## Why the type is optional (`URLConstructor | undefined`)
+     *
+     * - Hosts OLDER than the injecting release (targeted for AppOS host
+     *   1.1.0) do not provide the global.
+     * - Menu-bar raw `JSContext` pools do not carry it in v1 — only the main
+     *   plugin contexts do.
+     * - Users can disable the injection with the host kill switch
+     *   (`appos.jsc.urlGlobal.disabled`).
+     *
+     * ALWAYS guard before use — `if (typeof URL === "function") { ... }`.
+     * Setting `minHostVersion` to an injecting host release removes only the
+     * older-host reason for absence; it does NOT override the user kill
+     * switch or the menu-bar context limitation, so unguarded use (e.g. a
+     * non-null assertion) can still crash at runtime.
+     *
+     * ## Pinned Foundation-vs-WHATWG divergences (intended — do not "fix")
+     *
+     * - Default ports are RETAINED in `href`/`port` (`:443` is not dropped).
+     * - An empty path stays `""` (WHATWG would give `"/"`).
+     * - Out-of-range ports are accepted.
+     * - Pre-percent-encoded query values double-encode on an href round-trip
+     *   (`%3A` → `%253A`).
+     * - `hostname` is lowercased and IPv6 literals come WITHOUT brackets;
+     *   `host`/`origin` re-bracket them (`https://[::1]:8443/x` → hostname
+     *   `"::1"`, host `"[::1]:8443"`, origin `"https://[::1]:8443"`).
+     * - Invalid characters are auto percent-/IDNA-encoded by Foundation
+     *   (scheme-less inputs like `"not a url"` are rejected by the validity
+     *   predicate, not by Foundation's parser).
+     *
+     * ## Out-of-subset surface (fails loudly, never silently wrong)
+     *
+     * - `url.searchParams`: absent from these types; the runtime getter
+     *   throws a `TypeError` — parse `url.search` manually.
+     * - `URL.parse(...)` static: absent in v1.
+     * - Accessor setters: absent in v1 (all accessors readonly).
+     */
+    var URL: URLConstructor | undefined;
+}
+//# sourceMappingURL=globals.d.ts.map

plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/icons.d.ts

@@ -7,3 +7,4 @@
  * provides autocomplete for the most common ones.
  */
 export type SFSymbolName = "doc" | "doc.fill" | "doc.on.doc" | "doc.on.clipboard" | "doc.text" | "doc.text.fill" | "doc.richtext" | "folder" | "folder.fill" | "folder.badge.plus" | "arrow.left" | "arrow.right" | "arrow.up" | "arrow.down" | "arrow.up.forward.app" | "arrow.triangle.branch" | "arrow.clockwise" | "arrow.counterclockwise" | "plus" | "minus" | "xmark" | "checkmark" | "pencil" | "pencil.line" | "trash" | "trash.fill" | "square.and.arrow.up" | "square.and.arrow.down" | "sidebar.left" | "sidebar.right" | "rectangle.split.2x1" | "tray" | "tray.fill" | "tray.2.fill" | "sparkles" | "star" | "star.fill" | "heart" | "heart.fill" | "bolt" | "bolt.fill" | "flame" | "flame.fill" | "hand.wave" | "puzzlepiece.extension" | "play" | "play.fill" | "pause" | "pause.fill" | "stop" | "stop.fill" | "forward" | "backward" | "gear" | "gearshape" | "terminal" | "hammer" | "gauge.medium" | "chart.bar" | "chart.line.uptrend.xyaxis" | "envelope" | "message" | "bell" | "bell.fill" | (string & {});
+//# sourceMappingURL=icons.d.ts.map

plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/index.d.ts

@@ -1,10 +1,15 @@
 /**
  * @appos.space/plugin-types — Type definitions for the AppOS Plugin API
  *
- * Version: 3.0.0
+ * Version: 3.0.1
  *
- * Usage (module imports only — the package ships no ambient globals):
+ * Usage (module imports; the ONE exception is the opt-in globals subpath
+ * `@appos.space/plugin-types/globals`, which declares the host-injected
+ * `URL` global only in compilations that reference it — this main entry
+ * ships no ambient globals):
  *   import type { PluginContext, ViewDescriptor } from "@appos.space/plugin-types";
+ *   // JSC plugin entry files may additionally opt in:
+ *   //   /// <reference types="@appos.space/plugin-types/globals" />
  */
 export * from "./core";
 export * from "./views";

plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/namespaces.d.ts

@@ -1,8 +1,9 @@
 /**
- * API namespace interfaces — all 22 namespaces.
- * Each maps to a property on PluginContext.
+ * API namespace interfaces — the 22 host-core namespaces.
+ * Each maps to a property on PluginContext. The 21 core-plugin namespaces
+ * live in namespaces-core-plugins.ts; PluginContext exposes all 43.
  *
- * @version 2.4.0-fn50
+ * @version 3.0.0
  */
 import type { ViewDescriptor } from "./views";
 import type { PluginFileDescriptor, DependencyStatus } from "./core";

plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/permissions.d.ts

@@ -47,3 +47,4 @@ export interface PermissionEntry {
     /** Optional brief reason why this permission is needed (max 120 chars). */
     reason?: string;
 }
+//# sourceMappingURL=permissions.d.ts.map

plugins/appos-dev/skills/appos-plugin-dev/reference/plugin-api/views.d.ts

@@ -152,3 +152,4 @@ export interface RemoteImageDescriptor extends ViewDescriptorBase {
 }
 export type ViewDescriptor = VStackDescriptor | HStackDescriptor | ScrollDescriptor | ListDescriptor | GridDescriptor | SectionDescriptor | TextDescriptor | LabelDescriptor | ImageDescriptor | BadgeDescriptor | ButtonDescriptor | ListItemDescriptor | DividerDescriptor | SpacerDescriptor | TextFieldDescriptor | ProgressDescriptor | RemoteImageDescriptor;
 export type ViewDescriptorType = ViewDescriptor["type"];
+//# sourceMappingURL=views.d.ts.map