Enforce shared, client, and server plugin SDK boundaries (#4347)

* fix(plugins): keep React out of the server plugin host

* fix(plugins): align SDK guidance and tests with runtime boundaries

* fix(plugin): loosen the react peer to ~19.1.0

The plugin SDK pins its react peer to exactly 19.1.0, and that pin is
what a downstream `npm i -g @getpaseo/cli` resolves against. So every
user ends up with react 19.1.0 in their global node_modules, where
corporate dependency scanners flag it: the CVE-2025-55182 advisory range
covers 19.1.0 even though the vulnerability itself lives in
react-server-dom-webpack/-parcel/-turbopack, none of which the CLI
installs. The user is then left hand-patching node_modules or
uninstalling Paseo.

Widening the peer to ~19.1.0 lets a downstream install pick the latest
19.1.x patch (19.1.9 today) while this repo stays on 19.1.0, which the
root override still pins.

Keeping the repo itself on 19.1.0 is deliberate. react-native 0.81.5
embeds a 19.1.0 Paper renderer that hard-throws "Incompatible React
versions" on any exact mismatch, and it is reachable from Fabric builds
too: RendererImplementation.js requires the Paper shim unconditionally
in findNodeHandle, unstable_batchedUpdates, sendAccessibilityEvent and
three other entry points, and react-native-gesture-handler re-exports
findNodeHandle. Bumping the app's react is therefore not safe until
react-native moves.

The published CLI tree contains no react-native, so downstream installs
are not subject to that constraint.

Supersedes the earlier 19.1.5/19.1.9 version-bump approach on this
branch, which would have broken the mobile app.

* Enforce example import ownership including client types

* Update Nix dependency hash for plugin peer metadata

* Group plugin APIs under client and server entry trees

* Resolve plugin type dependencies through declarations

* Validate declarations for implicit plugin type imports

* Preserve optional imports and validate declaration references

* Refresh Nix hash for plugin declaration resolver

* Canonicalize plugin paths consistently on Windows

* Normalize plugin ownership paths across resolver boundaries

---------

Co-authored-by: liujin0506 <liujin0506@qq.com>
Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -40,6 +40,7 @@ This is the section I read most carefully. I need to see that *you* tested this,
 
 ### Checklist
 
+- [ ] Plugin changes follow the [SDK import boundaries](../docs/plugins.md#sdk-import-boundaries) (if applicable)
 - [ ] One focused change
 - [ ] `npm run typecheck` passes
 - [ ] `npm run lint` passes

.github/ci-paths.yml

@@ -50,6 +50,9 @@ app:
   - "packages/expo-two-way-audio/**"
 
 sdk:
+  - "packages/plugin/**"
+  - "plugin-examples/**"
+  - "public-docs/plugins/v0.8/**"
   - "packages/client/**"
   - "packages/highlight/**"
   - "packages/protocol/**"
@@ -66,7 +69,7 @@ browser:
   - "packages/server/src/server/agent/plugin-provider.ts"
   - "packages/server/src/server/plugins/{index,plugin-process,plugin-process-protocol,runtime}.ts"
   - "packages/server/src/executable-resolution/**"
-  - "packages/plugin/src/provider.ts"
+  - "packages/plugin/src/server/provider.ts"
   - "packages/app/src/!(desktop)/**"
   - "packages/app/e2e/browser/**"
   - "packages/app/e2e/support/**"

.github/workflows/ci.yml

@@ -298,6 +298,15 @@ jobs:
       - name: Build client dependencies
         run: npm run build:client
 
+      - name: Build plugin SDK
+        run: npm run build:plugin
+
+      - name: Run plugin SDK tests
+        run: npm run test --workspace=@getpaseo/plugin
+
+      - name: Typecheck plugin examples
+        run: npm run typecheck --workspace=@getpaseo/plugin
+
       - name: Run protocol tests
         run: npm run test --workspace=@getpaseo/protocol