# Agent Guidance

This project was scaffolded by `create-thortiq-plugin` for the Thortiq
**sandboxed-page** runtime (template: `sandbox`). Read
`PLUGIN_TASK.md` first; it is the authoritative requirements contract.

## Read first

- `PLUGIN_TASK.md` — functional requirements, contributions, permissions, and pins.
- `node_modules/@thortiq/plugin-api/README.md` — the authoritative public API reference.
- `node_modules/@thortiq/plugin-api/LIMITS.md` — the enforced size/rate limits.
- Manifest schema: `@thortiq/plugin-api/schemas/manifest-v2.json`.
- Type definitions ship with `@thortiq/plugin-api` and `@thortiq/plugin-sdk`.

This file routes to those authoritative sources; it does not restate the API.

## Non-negotiables

- Do not import Thortiq application internals (`@thortiq/data`, `/shared/*`,
  or `shell/*`). Only `@thortiq/plugin-api`, `@thortiq/plugin-sdk`, `react`, `react-dom`, and this
  project's own `./` modules are allowed.
- Never scaffold into, read, write, or point tooling at the user's live vault.
  Use temporary directories and the synthetic fixtures under `test/fixtures/`.
- Keep every example credential and data value synthetic.
- Verify with the fixture host from `@thortiq/plugin-sdk/testing` rather than
  the live app.

## Checks

Run `npm run validate`, then `npm run build`, then `npm run package`, plus `npm test` and `npm run typecheck`.
