feat: release 0.13 development tools and diagnostics

.github/workflows/ci.yml

@@ -46,3 +46,4 @@ jobs:
           npm run benchmark:browser-artifacts
           npm run benchmark:uploads
           npm run benchmark:transfer-queue
+          npm run benchmark:devtools

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.13.0 — 2026-10-05
+
+- Add command/language/theme/job/browser/configuration scaffolds with preview,
+  generated runtime metadata, TypeScript declarations, JSON schemas and tests.
+  Exact-digest regeneration preserves edited/additional files and cooperatively
+  stages verified output; doctor detects source drift and packaging omissions.
+- Add owner-injected clocks, deterministic scenario fixtures, CAS memory files,
+  settings/secret ports, memory checkpoints, fault injection and explicit resource
+  ledgers. Retain actual activation/diagnostic work slots after ignored cancellation.
+  Expose host inspection and explicit grant replacement without implicit authority.
+- Add opt-in synthetic fixture hashes and versioned pure replay, bounded local
+  diagnostic sessions, host/transport adapters, redacted error codes and measured
+  profiler overhead. Reports do not collect request/response bodies or paths.
+- Add explicit CLI profile and ephemeral loopback debug/wait flags. Each debugger
+  child has a hard lifetime limit and uses the existing owned process cleanup.
+- Exercise all templates and the combined scenario from an actual packed install;
+  keep existing protocol contracts and historical archive verification through 0.12.
+  New plugin packages declare `>=0.13.0 <0.14.0`.
+
 ## 0.12.0 — 2026-10-05
 
 - Add bounded versioned settings, default/user/workspace precedence, atomic CAS,

PUBLIC_SURFACE.json

@@ -14,6 +14,7 @@
     "docs/CONSENT.md",
     "docs/DATA_SCHEMAS.md",
     "docs/DEVTOOLS.md",
+    "docs/DIAGNOSTICS.md",
     "docs/FILE_REVISIONS.md",
     "docs/host-contract.md",
     "docs/JOB_HISTORY.md",
@@ -65,6 +66,7 @@
     "examples/configuration/serve.mjs",
     "examples/consent/prompt.mjs",
     "examples/consent/README.md",
+    "examples/development-tools/run.mjs",
     "examples/durable-jobs/run.mjs",
     "examples/hello-diagnostics/plugin.mjs",
     "examples/hello-diagnostics/run.mjs",
@@ -143,13 +145,17 @@
     "schemas/command.schema.json",
     "schemas/completion-item.schema.json",
     "schemas/data-schema.schema.json",
+    "schemas/development-definition.schema.json",
+    "schemas/diagnostic-report.schema.json",
     "schemas/diagnostics-request.schema.json",
     "schemas/diagnostics-result.schema.json",
     "schemas/display-metadata.schema.json",
     "schemas/document-symbol-tree.schema.json",
     "schemas/error.schema.json",
     "schemas/folding-ranges.schema.json",
     "schemas/formatting-options.schema.json",
+    "schemas/generation-receipt.schema.json",
+    "schemas/generation-report.schema.json",
     "schemas/inlay-hints.schema.json",
     "schemas/job-artifact-content.schema.json",
     "schemas/job-capabilities.schema.json",
@@ -169,6 +175,8 @@
     "schemas/locale-catalog.schema.json",
     "schemas/localized-message.schema.json",
     "schemas/manifest.schema.json",
+    "schemas/memory-job-snapshot.schema.json",
+    "schemas/plugin-plan.schema.json",
     "schemas/project-entry.schema.json",
     "schemas/project-query-capabilities.schema.json",
     "schemas/project-query-options.schema.json",
@@ -191,6 +199,7 @@
     "schemas/stored-artifact-reference.schema.json",
     "schemas/stored-artifact.schema.json",
     "schemas/stored-job.schema.json",
+    "schemas/test-trace.schema.json",
     "schemas/theme.schema.json",
     "schemas/transfer-queue-options.schema.json",
     "schemas/transfer-snapshot.schema.json",
@@ -236,9 +245,16 @@
     "src/data-schema-schemas.mjs",
     "src/data-schema.d.mts",
     "src/data-schema.mjs",
+    "src/dev-files.mjs",
+    "src/dev-generation.mjs",
+    "src/dev-scaffolds.mjs",
     "src/dev-worker.mjs",
+    "src/development-schemas.mjs",
     "src/devtools.d.mts",
     "src/devtools.mjs",
+    "src/diagnostics.d.mts",
+    "src/diagnostics.mjs",
+    "src/host-runtime.mjs",
     "src/host.d.mts",
     "src/host.mjs",
     "src/index.d.mts",
@@ -297,6 +313,12 @@
     "src/sha256-stream.mjs",
     "src/stored-artifact-download-node.d.mts",
     "src/stored-artifact-download-node.mjs",
+    "src/testing-faults.mjs",
+    "src/testing-job-store.mjs",
+    "src/testing-runtime.mjs",
+    "src/testing-scenario.mjs",
+    "src/testing-trace.mjs",
+    "src/testing-workspace.mjs",
     "src/testing.d.mts",
     "src/testing.mjs",
     "src/text-edits.mjs",

README.md

@@ -10,6 +10,13 @@ a small ESM package, TypeScript declarations and versioned contracts. Connect
 your own workspace and tools with the Node.js host and HTTP client. The SDK has
 **zero runtime dependencies**.
 
+Version 0.13 adds six [project templates and guarded contract generation](docs/DEVTOOLS.md),
+[deterministic synthetic test hosts](docs/testing.md) and opt-in
+[local diagnostics and loopback debugging](docs/DIAGNOSTICS.md). Run
+`npm run example:devtools` to exercise virtual time, fault injection, pure trace
+replay and resource cleanup. Generated projects include separate runtime, test,
+TypeScript and distribution checks.
+
 Version 0.12 adds [versioned settings](docs/SETTINGS.md), [execution-scoped secret
 references](docs/SECRETS.md), [structured command schemas](docs/DATA_SCHEMAS.md)
 and [localization/accessibility helpers](docs/LOCALIZATION.md). Run
@@ -40,7 +47,7 @@ application, private engines/services and production signing systems are outside
 this repository. Read the [public scope](docs/PUBLIC_SCOPE.md) and
 [compatibility table](docs/COMPATIBILITY.md) for exact boundaries.
 
-Version **0.12.0** supports Node 22 and 24. Manifest v1 diagnostic plugins remain
+Version **0.13.0** supports Node 22 and 24. Manifest v1 diagnostic plugins remain
 compatible. Manifest v2 adds commands, permission-scoped workspace and backend
 APIs, and open-source or proprietary distribution metadata. Themes export to
 the XML format already supported by DDS. The workspace host runs trusted plugins
@@ -100,7 +107,7 @@ mkdir my-dds-plugin
 cd my-dds-plugin
 npm init -y
 npm pkg set type=module
-npm install --ignore-scripts --save-exact https://github.com/Altifigence/dds-plugin-sdk/releases/download/v0.12.0/altifigence-dds-plugin-sdk-0.12.0.tgz
+npm install --ignore-scripts --save-exact https://github.com/Altifigence/dds-plugin-sdk/releases/download/v0.13.0/altifigence-dds-plugin-sdk-0.13.0.tgz
 ```
 
 Copy the example's `plugin.mjs` and `run.mjs` into this directory, then run:

bin/dds-plugin.mjs

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import {packPlugin, validatePluginPackage, verifyPluginArchive} from '../src/publishing.mjs';
-import {initPlugin, doctorPlugin, runPluginDev} from '../src/devtools.mjs';
+import {initPlugin, doctorPlugin, runPluginDev, generatePluginContracts} from '../src/devtools.mjs';
 
 const usage = `Usage:
-  dds-plugin init <new-directory> [--id <id>] [--publisher <id>] [--name <name>]
+  dds-plugin init <new-directory> [--id <id>] [--publisher <id>] [--name <name>] [--template <command|language|theme|job|browser|configuration>] [--dry-run] [--license <Apache-2.0|LicenseRef-Proprietary>] [--license-file <file>]
+  dds-plugin generate <directory> [--check|--dry-run] [--expected-digest <previous-sha256>]
   dds-plugin doctor <directory> [--json]
-  dds-plugin dev <directory> --trust-local-code [--watch] [--command <id>] [--input <json>] [--job] [--timeout-ms <ms>]
+  dds-plugin dev <directory> --trust-local-code [--watch] [--command <id>] [--input <json>] [--job] [--timeout-ms <ms>] [--profile] [--debug] [--debug-wait]
   dds-plugin validate <directory>
   dds-plugin pack <directory> --out <directory>
   dds-plugin verify <archive.tgz> [--metadata <release.json>] [--sha256 <expected-hash>]`;
@@ -26,19 +27,23 @@ try {
     if (!directory) throw new Error(usage);
     let result;
     if (command === 'init') {
-      const values = flags(args, ['--id', '--publisher', '--name']);
-      result = await initPlugin(directory, Object.fromEntries(Object.entries(values).map(([key, value]) => [key.slice(2), value])));
+      const values = flags(args, ['--id', '--publisher', '--name', '--template', '--license', '--license-file'], ['--dry-run']);
+      result = await initPlugin(directory, Object.fromEntries(Object.entries(values).map(([key, value]) => [key.slice(2).replace(/-([a-z])/g,(_,c)=>c.toUpperCase()), value])));
+    } else if (command === 'generate') {
+      const values=flags(args,['--expected-digest'],['--check','--dry-run']);
+      result=await generatePluginContracts(directory,{...(values['--check']?{check:true}:{}),...(values['--dry-run']?{dryRun:true}:{}),...(values['--expected-digest']?{expectedDigest:values['--expected-digest']}:{})});
+      if(result.ok===false)process.exitCode=1;
     } else if (command === 'doctor') {
       const values = flags(args, [], ['--json']); result = await doctorPlugin(directory);
       if (!result.ok) process.exitCode = 1;
       if (!values['--json']) {process.stdout.write(`${result.checks.map(check => `${check.status.toUpperCase()} ${check.id}: ${check.message}${check.status === 'error' && check.fix ? `\n  ${check.fix}` : ''}`).join('\n')}\n`); result = undefined;}
     } else if (command === 'dev') {
-      const values = flags(args, ['--command', '--input', '--timeout-ms'], ['--trust-local-code', '--watch', '--job']);
+      const values = flags(args, ['--command', '--input', '--timeout-ms'], ['--trust-local-code', '--watch', '--job', '--profile', '--debug', '--debug-wait']);
       if (values['--timeout-ms'] && !/^[1-9]\d*$/.test(values['--timeout-ms'])) throw new Error('Invalid --timeout-ms');
       const controller = new AbortController(); const stop = () => controller.abort();
       process.once('SIGINT', stop); process.once('SIGTERM', stop);
       try {
-        result = await runPluginDev(directory, {trustLocalCode: values['--trust-local-code'] === true, watch: values['--watch'] === true, job: values['--job'] === true, ...(values['--command'] ? {command: values['--command']} : {}), ...(values['--input'] ? {input: JSON.parse(values['--input'])} : {}), ...(values['--timeout-ms'] ? {timeoutMs: Number(values['--timeout-ms'])} : {}), signal: controller.signal, onEvent: event => process.stdout.write(`${JSON.stringify(event)}\n`)});
+        result = await runPluginDev(directory, {trustLocalCode: values['--trust-local-code'] === true, watch: values['--watch'] === true, profile: values['--profile'] === true, debug: values['--debug'] === true, debugWait: values['--debug-wait'] === true, job: values['--job'] === true, ...(values['--command'] ? {command: values['--command']} : {}), ...(values['--input'] ? {input: JSON.parse(values['--input'])} : {}), ...(values['--timeout-ms'] ? {timeoutMs: Number(values['--timeout-ms'])} : {}), signal: controller.signal, onEvent: event => process.stdout.write(`${JSON.stringify(event)}\n`)});
         if (!result.ok) process.exitCode = 1;
       } finally {process.removeListener('SIGINT', stop); process.removeListener('SIGTERM', stop);}
     } else if (command === 'verify') {

docs/COMPATIBILITY.md

@@ -1,5 +1,23 @@
 # Compatibility and availability
 
+## 0.13 development and diagnostics
+
+Six feature templates, guarded contract generation, synthetic scenario ports,
+optional owner-supplied runtimes and local diagnostics add no workspace protocol
+method or implicit grant. Existing `createTestHost()` diagnostics defaults remain.
+New `host.inspect()` reports unsettled SDK-owned operations after disposal;
+diagnostic providers and pending activations now retain their slots until actual
+settlement. Operator `replaceGrants()` deactivates plugins losing permissions.
+Ports are trusted host controls, not APIs granted to a plugin.
+Settings-store `inspect()` now also remains available after disposal for cleanup
+checks; its data read and mutation methods still reject a disposed store.
+
+New plugin archives use `>=0.13.0 <0.14.0`. Archive verification retains exact
+released 0.3.x through 0.12.x metadata, without widening an old plugin's declared
+range. Independent source/contract compatibility checks are separate from that
+package-manager range. See [development tools](DEVTOOLS.md), [testing](testing.md)
+and [local diagnostics](DIAGNOSTICS.md) for the v1 report and trace contracts.
+
 ## 0.12 configuration and display
 
 [Settings](SETTINGS.md) and [secret references](SECRETS.md) are operator-owned
@@ -45,8 +63,8 @@ is unchanged. These features do not establish a DDS product editor integration.
 | Browser-only DDS host | Native workspace transport is unavailable |
 | Language providers | Diagnostics plus completion, hover, definition, references and document symbols in SDK hosts since 0.3.0; no released DDS editor bridge is implied |
 | Project edit sessions | Client helpers in 0.3.0 over unchanged workspace protocol v1, including 0.2.x servers |
-| Download verification | Node API/CLI since 0.3.1; 0.12.0 accepts exact 0.3.x–0.12.x package metadata; no extraction, code execution or publisher authentication |
-| Development tools | `init`, `doctor`, `dev` since 0.4.0; local Node tools, explicit trusted-code execution |
+| Download verification | Node API/CLI since 0.3.1; 0.13.0 accepts exact 0.3.x–0.13.x package metadata; no extraction, code execution or publisher authentication |
+| Development tools | `init`, `doctor`, `dev` since 0.4.0; six templates, `generate`, synthetic testing and local profiles in 0.13 |
 | Command jobs | Opt-in SDK host/client extension since 0.4.0; progress/logs/UTF-8 artifacts; v1 hello unchanged |
 | File and job observation | Client helpers since 0.5.0; 0.6 uses revision reads when supported; job reads need enabled 0.4+ hosts |
 | Binary job results | Optional 0.7.0 extension; explicit host opt-in; 1 GiB files and 64 KiB chunks; Node resume/full-file verification |