The docs told authors to run `npx create-trek-plugin` / `npx trek-plugin`, but nothing published under those names, so npx couldn't resolve them. - Ship one package, `trek-plugin-sdk`, with a bin that matches the package name (`trek-plugin-sdk`) so `npx trek-plugin-sdk <command>` resolves with zero install. The dispatcher gained a `create` subcommand, so every step (create/validate/pack/entry/release) runs through that one entry point. The short `trek-plugin` / `create-trek-plugin` bins still work once installed. - Package hardening for publish: repository+directory (monorepo subdir), homepage/bugs/author/engines, publishConfig public, a prepublishOnly that builds + tests, and a LICENSE file. - A publish workflow: pushing a `plugin-sdk-v*` tag builds and publishes with the NPM_TOKEN repo secret. - Docs (SDK README + the four wiki pages) now use `npx trek-plugin-sdk <cmd>`, the invocation that actually resolves.
trek-plugin-sdk
The SDK for building TREK plugins.
Scaffold a plugin
npx trek-plugin-sdk create my-plugin --type integration|page|widget
cd my-plugin
# build server/index.js, fill in the README
npx trek-plugin-sdk validate .
Write a plugin
const { definePlugin } = require('trek-plugin-sdk')
module.exports = definePlugin({
async onLoad(ctx) {
await ctx.db.migrate('001', 'CREATE TABLE cache (k TEXT PRIMARY KEY, v TEXT)')
},
routes: [
{ method: 'GET', path: '/status', auth: true, async handler(req, ctx) {
return { status: 200, headers: { 'content-type': 'application/json' }, body: '{"ok":true}' }
}},
],
})
Your plugin runs in an isolated child process. ctx is the only way to reach
TREK, and it grants exactly the permissions your trek-plugin.json declares — an
ungranted call throws PERMISSION_DENIED.
Test without a running TREK
import { createMockHost } from 'trek-plugin-sdk/testing'
const { ctx, broadcasts } = createMockHost({
grants: ['db:read:trips', 'ws:broadcast:trip'],
trips: { 1: { members: [42], data: { id: 1, name: 'Japan' } } },
})
// the mock enforces the SAME permission model, so you can prove your plugin
// degrades gracefully when a permission is missing.
Publish
The SDK does the fiddly parts (zipping, hashing, sizing, writing the registry entry) so you don't compute anything by hand:
npx trek-plugin-sdk validate # manifest + layout OK?
npx trek-plugin-sdk pack # -> plugin.zip, prints sha256 + size
gh release create v1.0.0 plugin.zip # attach the artifact to your tag
npx trek-plugin-sdk entry --repo you/repo --tag v1.0.0
# -> the ready-to-PR registry entry JSON
Or in one step: npx trek-plugin-sdk release --repo you/repo --tag v1.0.0 packs,
creates the GitHub release, and prints the entry. Then paste the entry into a PR
against TREK-Plugins as
registry/plugins/<id>.json.
Updating an already-listed plugin: bump version, tag, and pass
--merge registry/plugins/<id>.json to entry — it prepends the new version,
keeping the array newest-first.
Exports
definePlugin(def)+ all the plugin types (PluginContext,PluginRoute,PluginJob,PhotoProvider,CalendarSource).PLUGIN_API_VERSION— embed asapiVersionin your manifest.validateManifest(json)— the manifest rules the server loader uses.createMockHost(opts)(fromtrek-plugin-sdk/testing).
CLIs
create-trek-plugin <name> --type …— scaffold a working plugin.trek-plugin validate [dir]— check the manifest + layout locally (the manifest rules the registry CI also runs; CI additionally verifies the release, artifact hash and README over the network).trek-plugin pack [dir] [--out plugin.zip] [--json]— build the artifact, printsha256+size.trek-plugin entry --repo o/n --tag vX [--zip z] [--merge entry.json] [--out f]— emit the registry entry.trek-plugin release [dir] --repo o/n --tag vX— pack → GitHub release → entry, in one go.
The SDK tooling in this repo is MIT. Your plugin is your own code under your own license.