feat(plugins)!: 插件 API 单一基线（版本归 0），插件契约、文档与 SDK 并入 Core

.github/workflows/plugins-release-java-sdk.yml

@@ -0,0 +1,79 @@
+# Releases the official Java plugin SDK (`shared/plugins/sdk/java`) through its own tag series
+# (`sdk-java-v<version>`). The release holds `lithe-plugin-sdk-java-<version>.jar`
+# and its `.sha256`; plugin repositories pin both and shade the JAR into their
+# backend at build time.
+name: Release Java Plugin SDK
+
+on:
+  push:
+    tags:
+      - "sdk-java-v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-java-plugin-sdk-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Release ${{ github.ref_name }}
+    if: github.repository == 'Lithe-IDEA/Lithe-core-rust'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: write
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v7
+
+      # The SDK supports Java 8: the tests run on a Java 8 runtime, while
+      # Maven builds with the newer JDK set up last.
+      - name: Set up Java 8 runtime
+        id: java8
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '8'
+
+      - name: Set up Java 21 for Maven
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Require the tag to match the SDK version
+        id: version
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          version=$(mvn -B -ntp -q -f shared/plugins/sdk/java/plugin-sdk/pom.xml help:evaluate -Dexpression=project.version -DforceStdout)
+          test "$TAG" = "sdk-java-v$version" || { echo "Tag $TAG does not match shared/plugins/sdk/java version $version"; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Build and test on Java 8
+        env:
+          JAVA8: ${{ steps.java8.outputs.path }}/bin/java
+        run: mvn -B -ntp -f shared/plugins/sdk/java/pom.xml verify -Djvm="$JAVA8"
+
+      - name: Collect the release assets
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          mkdir -p dist
+          asset="lithe-plugin-sdk-java-$VERSION.jar"
+          cp "shared/plugins/sdk/java/plugin-sdk/target/$asset" "dist/$asset"
+          (cd dist && sha256sum "$asset" | cut -d' ' -f1 > "$asset.sha256")
+
+      - name: Publish the SDK release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          asset="lithe-plugin-sdk-java-$VERSION.jar"
+          gh release create "$TAG" "dist/$asset" "dist/$asset.sha256" \
+            --title "Java plugin SDK $VERSION" \
+            --notes "Official Java plugin SDK $VERSION for Lithe plugin backends. Requires Java 8 or newer and has no runtime dependencies. Pin the JAR by its SHA-256 (\`$asset.sha256\`) and shade it into the backend JAR; see shared/plugins/sdk/java/README.md."

.github/workflows/plugins-release-node-sdk.yml

@@ -0,0 +1,76 @@
+# Releases the official Node.js plugin SDK (`shared/plugins/sdk/node`) through its own tag
+# series (`sdk-node-v<version>`). The release holds
+# `lithe-plugin-sdk-node-<version>.tgz` and its `.sha256`; plugin repositories
+# pin both and vendor the unpacked package into their backend at build time,
+# because an installed plugin has no `node_modules` install step.
+name: Release Node Plugin SDK
+
+on:
+  push:
+    tags:
+      - "sdk-node-v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-node-plugin-sdk-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Release ${{ github.ref_name }}
+    if: github.repository == 'Lithe-IDEA/Lithe-core-rust'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v7
+
+      # The SDK supports Node.js 20.3 and newer, so the release is tested on
+      # the oldest supported major.
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+
+      - name: Require the tag to match the SDK version
+        id: version
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          version=$(node -p "require('./shared/plugins/sdk/node/package.json').version")
+          test "$TAG" = "sdk-node-v$version" || { echo "Tag $TAG does not match shared/plugins/sdk/node version $version"; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Test
+        run: node --test shared/plugins/sdk/node/test/*.test.mjs
+
+      # `npm pack` only builds the archive; `private: true` still keeps the
+      # SDK off the npm registry. The repository LICENSE is copied in so the
+      # archive carries its own license text.
+      - name: Collect the release assets
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          mkdir -p dist
+          cp shared/plugins/LICENSE shared/plugins/sdk/node/LICENSE
+          (cd shared/plugins/sdk/node && npm pack --pack-destination ../../../../dist)
+          asset="lithe-plugin-sdk-node-$VERSION.tgz"
+          mv "dist/lithe-plugin-sdk-$VERSION.tgz" "dist/$asset"
+          tar -tzf "dist/$asset" | sort
+          (cd dist && sha256sum "$asset" | cut -d' ' -f1 > "$asset.sha256")
+
+      - name: Publish the SDK release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          asset="lithe-plugin-sdk-node-$VERSION.tgz"
+          gh release create "$TAG" "dist/$asset" "dist/$asset.sha256" \
+            --title "Node.js plugin SDK $VERSION" \
+            --notes "Official Node.js plugin SDK $VERSION for Lithe plugin backends. Requires Node.js 20.3 or newer and has no dependencies. Pin the archive by its SHA-256 (\`$asset.sha256\`), unpack it, and vendor its \`package/\` directory into the plugin package; see shared/plugins/sdk/node/README.md."

.github/workflows/plugins-release-rust-sdk.yml

@@ -0,0 +1,73 @@
+# Releases the official Rust plugin SDK (`shared/plugins/sdk/rust/plugin-sdk`) through its
+# own tag series (`sdk-rust-v<version>`). Plugin repositories either depend
+# on the tag through Git, which their Cargo.lock pins to the commit, or pin
+# `lithe-plugin-sdk-rust-<version>.crate` by its `.sha256` and vendor the
+# unpacked crate; the SDK is not published to crates.io.
+name: Release Rust Plugin SDK
+
+on:
+  push:
+    tags:
+      - "sdk-rust-v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-rust-plugin-sdk-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Release ${{ github.ref_name }}
+    if: github.repository == 'Lithe-IDEA/Lithe-core-rust'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: write
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v7
+
+      # The release is tested on the oldest supported Rust.
+      - uses: dtolnay/rust-toolchain@1.87
+
+      - name: Require the tag to match the SDK version
+        id: version
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          version=$(cargo +1.87 metadata --locked --no-deps --format-version 1 --manifest-path shared/plugins/sdk/rust/Cargo.toml \
+            | jq -r '.packages[] | select(.name == "lithe-plugin-sdk") | .version')
+          test "$TAG" = "sdk-rust-v$version" || { echo "Tag $TAG does not match shared/plugins/sdk/rust version $version"; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Test
+        run: cargo +1.87 test --locked --manifest-path shared/plugins/sdk/rust/Cargo.toml
+
+      # `cargo package` only builds the archive; `publish = false` keeps the
+      # SDK off crates.io. The repository LICENSE is copied in so the archive
+      # carries its own license text.
+      - name: Collect the release assets
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          cp shared/plugins/LICENSE shared/plugins/sdk/rust/plugin-sdk/LICENSE
+          cargo +1.87 package --locked --allow-dirty --manifest-path shared/plugins/sdk/rust/Cargo.toml -p lithe-plugin-sdk
+          mkdir -p dist
+          asset="lithe-plugin-sdk-rust-$VERSION.crate"
+          cp "shared/plugins/sdk/rust/target/package/lithe-plugin-sdk-$VERSION.crate" "dist/$asset"
+          tar -tzf "dist/$asset" | sort
+          (cd dist && sha256sum "$asset" | cut -d' ' -f1 > "$asset.sha256")
+
+      - name: Publish the SDK release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          asset="lithe-plugin-sdk-rust-$VERSION.crate"
+          gh release create "$TAG" "dist/$asset" "dist/$asset.sha256" \
+            --title "Rust plugin SDK $VERSION" \
+            --notes "Official Rust plugin SDK $VERSION for Lithe plugin backends. Requires Rust 1.87 or newer and depends only on serde_json and base64. Depend on the tag through Git, or pin the archive by its SHA-256 (\`$asset.sha256\`) and vendor the unpacked crate; see shared/plugins/sdk/rust/README.md."

.github/workflows/plugins-verify.yml

@@ -0,0 +1,142 @@
+name: Plugin SDKs
+
+# The plugin contract, developer guides and official SDKs live in
+# shared/plugins next to the Rust Core that executes the contract, so every
+# change is tested against Core at the same commit. Only changes that can
+# affect them start this workflow.
+on:
+  pull_request:
+    paths:
+      - 'shared/plugins/**'
+      - 'rust/**'
+      - '.github/workflows/plugins-verify.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'shared/plugins/**'
+      - 'rust/**'
+      - '.github/workflows/plugins-verify.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: plugins-verify-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  docs:
+    name: Contract and docs
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+
+      - name: Test the tooling
+        run: node --test shared/plugins/scripts/*.test.mjs
+      - name: Check schema IDs and links
+        run: node shared/plugins/scripts/verify-docs.mjs
+
+  sdk-node:
+    name: Node.js SDK
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      # The SDK supports Node.js 20.3 and newer, so it is tested on the oldest
+      # supported major.
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20
+
+      - name: Test
+        run: node --test shared/plugins/sdk/node/test/*.test.mjs
+      - name: Check TypeScript consumers
+        run: |
+          npm ci --prefix shared/plugins/sdk/node --ignore-scripts --no-audit --no-fund
+          npm run --prefix shared/plugins/sdk/node test:types
+
+  sdk-java:
+    name: Java SDK
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      # The SDK supports Java 8: the tests run on a Java 8 runtime, while
+      # Maven builds with the newer JDK set up last.
+      - name: Set up Java 8 runtime
+        id: java8
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '8'
+      - name: Set up Java 21 for Maven
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Build and test on Java 8
+        env:
+          JAVA8: ${{ steps.java8.outputs.path }}/bin/java
+        run: mvn -B -ntp -f shared/plugins/sdk/java/pom.xml verify -Djvm="$JAVA8"
+
+  sdk-rust:
+    name: Rust SDK
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      # The SDK supports Rust 1.87 and newer: the tests run on that release,
+      # and formatting and lints on the current stable toolchain.
+      - uses: dtolnay/rust-toolchain@1.87
+      - name: Test on the oldest supported Rust
+        run: cargo +1.87 test --locked --manifest-path shared/plugins/sdk/rust/Cargo.toml
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - name: Check formatting and lints
+        run: |
+          cargo fmt --manifest-path shared/plugins/sdk/rust/Cargo.toml --all -- --check
+          cargo clippy --locked --manifest-path shared/plugins/sdk/rust/Cargo.toml --all-targets -- -D warnings
+
+  sdk-e2e:
+    name: SDK end-to-end with Rust Core
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20
+      - name: Set up Java 8 runtime
+        id: java8
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '8'
+      - name: Set up Java 21 for Maven
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '21'
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            rust/target
+            shared/plugins/sdk/rust/target
+          key: sdk-e2e-${{ runner.os }}-${{ hashFiles('rust/Cargo.lock', 'shared/plugins/sdk/rust/Cargo.lock') }}
+          restore-keys: sdk-e2e-${{ runner.os }}-
+
+      - name: Run the SDK scenarios against this Core
+        env:
+          LITHE_PLUGIN_SDK_JAVA_RUNTIME: ${{ steps.java8.outputs.path }}/bin/java
+        run: node shared/plugins/scripts/sdk-e2e.mjs

.gitignore

@@ -1,3 +1,8 @@
 /.artifacts/
 /rust/target/
 /scripts/rust-core/comment-lexer/target/
+node_modules/
+/shared/plugins/sdk/java/**/target/
+/shared/plugins/sdk/rust/target/
+*.tmp
+.DS_Store