@agimon-ai/po 0.0.0-alpha.0

package/dist/src/builders/web/webPluginManifest.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webPluginManifest.cjs","names":["fs","path","crypto"],"sources":["../../../../src/builders/web/webPluginManifest.ts"],"sourcesContent":["/**\n * The poWeb manifest vocabulary: how a package declares its web plugin in\n * package.json, validated and ordered; the filesystem is read only to name each\n * copy's slot by its real directory. The\n * scan adapter feeds this from real manifests; the sync bundler feeds it from\n * the installed composition's package roots.\n *\n * Plugins are independent: a manifest names no other plugin, and the order\n * plugins install in is only a tiebreak (registrationOrder, then pluginId),\n * because every relation between two plugins resolves by name once all of\n * them are installed. A collision between two packages is a notice for the\n * sync log and the first package keeps the name; only a malformed block is an\n * error, which the scanner turns into a notice for that package alone.\n *\n * The native app's poNative blocks share this exact shape, so the same\n * validation reads either field.\n */\n\nimport crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nconst PLUGIN_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;\n\n/** The order a plugin installs at when its manifest names none. */\nexport const DEFAULT_REGISTRATION_ORDER = 1000;\n\nexport interface WebPluginEntryDeclaration {\n  /** Package-relative ./path to the source entry. */\n  entry: string;\n}\n\nexport interface DeclaredWebPlugin {\n  pluginId: string;\n  /**\n   * The registry name of this installed copy: the pluginId for a host plugin, otherwise\n   * `${pluginId}.${first 8 hex of sha256(realpath(packageDir))}`, so two copies of one\n   * pluginId installed from different directories never share a name.\n   */\n  slot: string;\n  registrationOrder: number;\n  packageDir: string;\n  packageName: string;\n  isHost: boolean;\n  client: WebPluginEntryDeclaration;\n  scopes: readonly ('global' | 'workspace' | 'session')[];\n}\n\n/** The package.json field a plugin block lives in: the browser cockpit's or the native app's. */\nexport type PluginManifestField = 'poWeb' | 'poNative';\n\nexport class WebPluginManifestError extends Error {\n  constructor(packageDir: string, message: string, field: PluginManifestField = 'poWeb') {\n    super(`${field} manifest in ${packageDir}: ${message}`);\n    this.name = 'WebPluginManifestError';\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction normalizeEntry(\n  packageDir: string,\n  kind: string,\n  value: unknown,\n  field: PluginManifestField,\n): WebPluginEntryDeclaration {\n  const raw = typeof value === 'string' ? { entry: value } : value;\n  if (!isRecord(raw)) throw new WebPluginManifestError(packageDir, `${kind} must be a path or {entry}.`, field);\n  const { entry } = raw;\n  if (typeof entry !== 'string' || !entry.startsWith('./') || entry.includes('..')) {\n    throw new WebPluginManifestError(\n      packageDir,\n      `${kind}.entry must be a package-relative ./path with no '..'.`,\n      field,\n    );\n  }\n  return { entry };\n}\n\nconst SLOT_HASH_LENGTH = 8;\n\n/** The slot of one installed plugin copy; see DeclaredWebPlugin.slot. */\nexport function pluginSlot(plugin: { pluginId: string; packageDir: string; isHost: boolean }): string {\n  if (plugin.isHost) return plugin.pluginId;\n  let directory: string;\n  try {\n    directory = fs.realpathSync(plugin.packageDir);\n  } catch {\n    // A directory that no longer exists has no real path; its resolved path still names it stably.\n    directory = path.resolve(plugin.packageDir);\n  }\n  const digest = crypto.createHash('sha256').update(directory).digest('hex');\n  return `${plugin.pluginId}.${digest.slice(0, SLOT_HASH_LENGTH)}`;\n}\n\n/** The field's value normalized to a list: one plugin object or an array of them. */\nexport function pluginBlocksOf(manifest: Record<string, unknown>, field: PluginManifestField = 'poWeb'): unknown[] {\n  const value = manifest[field];\n  if (value === undefined) return [];\n  return Array.isArray(value) ? value : [value];\n}\n\n/** Validates one manifest's blocks into declared plugins; throws WebPluginManifestError on bad shape. */\nexport function declaredPluginsOf(\n  packageDir: string,\n  manifest: Record<string, unknown>,\n  isHost: boolean,\n  field: PluginManifestField = 'poWeb',\n): DeclaredWebPlugin[] {\n  const plugins: DeclaredWebPlugin[] = [];\n  for (const block of pluginBlocksOf(manifest, field)) {\n    if (!isRecord(block)) throw new WebPluginManifestError(packageDir, 'each block must be an object.', field);\n    const { pluginId, registrationOrder = DEFAULT_REGISTRATION_ORDER, client, scopes } = block;\n    if (\n      !Array.isArray(scopes) ||\n      scopes.length === 0 ||\n      scopes.some((scope) => !['global', 'workspace', 'session'].includes(scope))\n    ) {\n      throw new WebPluginManifestError(\n        packageDir,\n        'scopes must explicitly name global, workspace, or session; resync the plugin.',\n        field,\n      );\n    }\n    if (typeof pluginId !== 'string' || !PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new WebPluginManifestError(packageDir, `pluginId '${String(pluginId)}' must be kebab-case.`, field);\n    }\n    if (!Number.isInteger(registrationOrder) || (registrationOrder as number) < 0) {\n      throw new WebPluginManifestError(\n        packageDir,\n        `'${pluginId}' needs a non-negative integer registrationOrder.`,\n        field,\n      );\n    }\n    plugins.push({\n      pluginId,\n      slot: pluginSlot({ pluginId, packageDir, isHost }),\n      registrationOrder: registrationOrder as number,\n      packageDir,\n      packageName: typeof manifest.name === 'string' ? manifest.name : packageDir,\n      isHost,\n      client: normalizeEntry(packageDir, 'client', client, field),\n      scopes,\n    });\n  }\n  return plugins;\n}\n\n/** Code-unit order, never the locale's: the same packages must order the same on every machine. */\nexport function compareCodeUnits(left: string, right: string): number {\n  return left < right ? -1 : left > right ? 1 : 0;\n}\n\nconst byInstallOrder = (left: DeclaredWebPlugin, right: DeclaredWebPlugin): number =>\n  left.registrationOrder - right.registrationOrder ||\n  compareCodeUnits(left.pluginId, right.pluginId) ||\n  compareCodeUnits(left.packageDir, right.packageDir);\n\n/**\n * The deterministic install order, (registrationOrder, pluginId), with the\n * cross-package collisions resolved by the browser client registry: the first\n * plugin keeps a shared pluginId and the later package is dropped with a notice.\n */\nexport function orderDeclaredPlugins(\n  plugins: readonly DeclaredWebPlugin[],\n  onNotice: (message: string) => void = () => undefined,\n): DeclaredWebPlugin[] {\n  const sorted = [...plugins].sort(byInstallOrder);\n  const byId = new Map<string, DeclaredWebPlugin>();\n  const kept: DeclaredWebPlugin[] = [];\n  for (const plugin of sorted) {\n    const holder = byId.get(plugin.pluginId);\n    if (holder !== undefined) {\n      onNotice(\n        `web plugin '${plugin.pluginId}' from ${plugin.packageDir} is skipped: ${holder.packageDir} already declares it.`,\n      );\n      continue;\n    }\n    byId.set(plugin.pluginId, plugin);\n    kept.push(plugin);\n  }\n  return kept;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAM,oBAAoB;;AAG1B,MAAa,6BAA6B;AA0B1C,IAAa,yBAAb,cAA4C,MAAM;CAChD,YAAY,YAAoB,SAAiB,QAA6B,SAAS;EACrF,MAAM,GAAG,MAAM,eAAe,WAAW,IAAI,SAAS;EACtD,KAAK,OAAO;CACd;AACF;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,eACP,YACA,MACA,OACA,OAC2B;CAC3B,MAAM,MAAM,OAAO,UAAU,WAAW,EAAE,OAAO,MAAM,IAAI;CAC3D,IAAI,CAAC,SAAS,GAAG,GAAG,MAAM,IAAI,uBAAuB,YAAY,GAAG,KAAK,8BAA8B,KAAK;CAC5G,MAAM,EAAE,UAAU;CAClB,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,IAAI,KAAK,MAAM,SAAS,IAAI,GAC7E,MAAM,IAAI,uBACR,YACA,GAAG,KAAK,yDACR,KACF;CAEF,OAAO,EAAE,MAAM;AACjB;AAEA,MAAM,mBAAmB;;AAGzB,SAAgB,WAAW,QAA2E;CACpG,IAAI,OAAO,QAAQ,OAAO,OAAO;CACjC,IAAI;CACJ,IAAI;EACF,YAAYA,QAAAA,QAAG,aAAa,OAAO,UAAU;CAC/C,QAAQ;EAEN,YAAYC,UAAAA,QAAK,QAAQ,OAAO,UAAU;CAC5C;CACA,MAAM,SAASC,YAAAA,QAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAAK;CACzE,OAAO,GAAG,OAAO,SAAS,GAAG,OAAO,MAAM,GAAG,gBAAgB;AAC/D;;AAGA,SAAgB,eAAe,UAAmC,QAA6B,SAAoB;CACjH,MAAM,QAAQ,SAAS;CACvB,IAAI,UAAU,KAAA,GAAW,OAAO,CAAC;CACjC,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AAC9C;;AAGA,SAAgB,kBACd,YACA,UACA,QACA,QAA6B,SACR;CACrB,MAAM,UAA+B,CAAC;CACtC,KAAK,MAAM,SAAS,eAAe,UAAU,KAAK,GAAG;EACnD,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,IAAI,uBAAuB,YAAY,iCAAiC,KAAK;EACzG,MAAM,EAAE,UAAU,oBAAoB,4BAA4B,QAAQ,WAAW;EACrF,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,OAAO,WAAW,KAClB,OAAO,MAAM,UAAU,CAAC;GAAC;GAAU;GAAa;EAAS,CAAC,CAAC,SAAS,KAAK,CAAC,GAE1E,MAAM,IAAI,uBACR,YACA,iFACA,KACF;EAEF,IAAI,OAAO,aAAa,YAAY,CAAC,kBAAkB,KAAK,QAAQ,GAClE,MAAM,IAAI,uBAAuB,YAAY,aAAa,OAAO,QAAQ,EAAE,wBAAwB,KAAK;EAE1G,IAAI,CAAC,OAAO,UAAU,iBAAiB,KAAM,oBAA+B,GAC1E,MAAM,IAAI,uBACR,YACA,IAAI,SAAS,oDACb,KACF;EAEF,QAAQ,KAAK;GACX;GACA,MAAM,WAAW;IAAE;IAAU;IAAY;GAAO,CAAC;GAC9B;GACnB;GACA,aAAa,OAAO,SAAS,SAAS,WAAW,SAAS,OAAO;GACjE;GACA,QAAQ,eAAe,YAAY,UAAU,QAAQ,KAAK;GAC1D;EACF,CAAC;CACH;CACA,OAAO;AACT;;AAGA,SAAgB,iBAAiB,MAAc,OAAuB;CACpE,OAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAChD;AAEA,MAAM,kBAAkB,MAAyB,UAC/C,KAAK,oBAAoB,MAAM,qBAC/B,iBAAiB,KAAK,UAAU,MAAM,QAAQ,KAC9C,iBAAiB,KAAK,YAAY,MAAM,UAAU;;;;;;AAOpD,SAAgB,qBACd,SACA,iBAA4C,KAAA,GACvB;CACrB,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,cAAc;CAC/C,MAAM,uBAAO,IAAI,IAA+B;CAChD,MAAM,OAA4B,CAAC;CACnC,KAAK,MAAM,UAAU,QAAQ;EAC3B,MAAM,SAAS,KAAK,IAAI,OAAO,QAAQ;EACvC,IAAI,WAAW,KAAA,GAAW;GACxB,SACE,eAAe,OAAO,SAAS,SAAS,OAAO,WAAW,eAAe,OAAO,WAAW,sBAC7F;GACA;EACF;EACA,KAAK,IAAI,OAAO,UAAU,MAAM;EAChC,KAAK,KAAK,MAAM;CAClB;CACA,OAAO;AACT"}

package/dist/src/builders/web/webPluginManifest.d.mts

@@ -0,0 +1,64 @@
+//#region src/builders/web/webPluginManifest.d.ts
+/**
+ * The poWeb manifest vocabulary: how a package declares its web plugin in
+ * package.json, validated and ordered; the filesystem is read only to name each
+ * copy's slot by its real directory. The
+ * scan adapter feeds this from real manifests; the sync bundler feeds it from
+ * the installed composition's package roots.
+ *
+ * Plugins are independent: a manifest names no other plugin, and the order
+ * plugins install in is only a tiebreak (registrationOrder, then pluginId),
+ * because every relation between two plugins resolves by name once all of
+ * them are installed. A collision between two packages is a notice for the
+ * sync log and the first package keeps the name; only a malformed block is an
+ * error, which the scanner turns into a notice for that package alone.
+ *
+ * The native app's poNative blocks share this exact shape, so the same
+ * validation reads either field.
+ */
+/** The order a plugin installs at when its manifest names none. */
+export declare const DEFAULT_REGISTRATION_ORDER = 1000;
+export interface WebPluginEntryDeclaration {
+  /** Package-relative ./path to the source entry. */
+  entry: string;
+}
+export interface DeclaredWebPlugin {
+  pluginId: string;
+  /**
+   * The registry name of this installed copy: the pluginId for a host plugin, otherwise
+   * `${pluginId}.${first 8 hex of sha256(realpath(packageDir))}`, so two copies of one
+   * pluginId installed from different directories never share a name.
+   */
+  slot: string;
+  registrationOrder: number;
+  packageDir: string;
+  packageName: string;
+  isHost: boolean;
+  client: WebPluginEntryDeclaration;
+  scopes: readonly ('global' | 'workspace' | 'session')[];
+}
+/** The package.json field a plugin block lives in: the browser cockpit's or the native app's. */
+export type PluginManifestField = 'poWeb' | 'poNative';
+export declare class WebPluginManifestError extends Error {
+  constructor(packageDir: string, message: string, field?: PluginManifestField);
+}
+/** The slot of one installed plugin copy; see DeclaredWebPlugin.slot. */
+export declare function pluginSlot(plugin: {
+  pluginId: string;
+  packageDir: string;
+  isHost: boolean;
+}): string;
+/** The field's value normalized to a list: one plugin object or an array of them. */
+export declare function pluginBlocksOf(manifest: Record<string, unknown>, field?: PluginManifestField): unknown[];
+/** Validates one manifest's blocks into declared plugins; throws WebPluginManifestError on bad shape. */
+export declare function declaredPluginsOf(packageDir: string, manifest: Record<string, unknown>, isHost: boolean, field?: PluginManifestField): DeclaredWebPlugin[];
+/** Code-unit order, never the locale's: the same packages must order the same on every machine. */
+export declare function compareCodeUnits(left: string, right: string): number;
+/**
+ * The deterministic install order, (registrationOrder, pluginId), with the
+ * cross-package collisions resolved by the browser client registry: the first
+ * plugin keeps a shared pluginId and the later package is dropped with a notice.
+ */
+export declare function orderDeclaredPlugins(plugins: readonly DeclaredWebPlugin[], onNotice?: (message: string) => void): DeclaredWebPlugin[];
+//#endregion
+//# sourceMappingURL=webPluginManifest.d.mts.map

package/dist/src/builders/web/webPluginManifest.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webPluginManifest.d.mts","names":[],"sources":["../../../../src/builders/web/webPluginManifest.ts"],"mappings":";;;;;;;;;;;;;;;;;;;qBAyBa;iBAEI;;EAEf;;iBAGe;EACf;;;;;;EAMA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;;;YAIU;qBAEC,+BAA+B;EAC1C,YAAY,oBAAoB,iBAAiB,QAAO;;;wBAgC1C,WAAW;EAAU;EAAkB;EAAoB;;;wBAc3D,eAAe,UAAU,yBAAyB,QAAO;;wBAOzD,kBACd,oBACA,UAAU,yBACV,iBACA,QAAO,sBACN;;wBAyCa,iBAAiB,cAAc;;;;;;wBAc/B,qBACd,kBAAkB,qBAClB,YAAW,2BACV"}

package/dist/src/builders/web/webPluginManifest.mjs

@@ -0,0 +1,118 @@
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+//#region src/builders/web/webPluginManifest.ts
+/**
+* The poWeb manifest vocabulary: how a package declares its web plugin in
+* package.json, validated and ordered; the filesystem is read only to name each
+* copy's slot by its real directory. The
+* scan adapter feeds this from real manifests; the sync bundler feeds it from
+* the installed composition's package roots.
+*
+* Plugins are independent: a manifest names no other plugin, and the order
+* plugins install in is only a tiebreak (registrationOrder, then pluginId),
+* because every relation between two plugins resolves by name once all of
+* them are installed. A collision between two packages is a notice for the
+* sync log and the first package keeps the name; only a malformed block is an
+* error, which the scanner turns into a notice for that package alone.
+*
+* The native app's poNative blocks share this exact shape, so the same
+* validation reads either field.
+*/
+const PLUGIN_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+/** The order a plugin installs at when its manifest names none. */
+const DEFAULT_REGISTRATION_ORDER = 1e3;
+var WebPluginManifestError = class extends Error {
+	constructor(packageDir, message, field = "poWeb") {
+		super(`${field} manifest in ${packageDir}: ${message}`);
+		this.name = "WebPluginManifestError";
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeEntry(packageDir, kind, value, field) {
+	const raw = typeof value === "string" ? { entry: value } : value;
+	if (!isRecord(raw)) throw new WebPluginManifestError(packageDir, `${kind} must be a path or {entry}.`, field);
+	const { entry } = raw;
+	if (typeof entry !== "string" || !entry.startsWith("./") || entry.includes("..")) throw new WebPluginManifestError(packageDir, `${kind}.entry must be a package-relative ./path with no '..'.`, field);
+	return { entry };
+}
+const SLOT_HASH_LENGTH = 8;
+/** The slot of one installed plugin copy; see DeclaredWebPlugin.slot. */
+function pluginSlot(plugin) {
+	if (plugin.isHost) return plugin.pluginId;
+	let directory;
+	try {
+		directory = fs.realpathSync(plugin.packageDir);
+	} catch {
+		directory = path.resolve(plugin.packageDir);
+	}
+	const digest = crypto.createHash("sha256").update(directory).digest("hex");
+	return `${plugin.pluginId}.${digest.slice(0, SLOT_HASH_LENGTH)}`;
+}
+/** The field's value normalized to a list: one plugin object or an array of them. */
+function pluginBlocksOf(manifest, field = "poWeb") {
+	const value = manifest[field];
+	if (value === void 0) return [];
+	return Array.isArray(value) ? value : [value];
+}
+/** Validates one manifest's blocks into declared plugins; throws WebPluginManifestError on bad shape. */
+function declaredPluginsOf(packageDir, manifest, isHost, field = "poWeb") {
+	const plugins = [];
+	for (const block of pluginBlocksOf(manifest, field)) {
+		if (!isRecord(block)) throw new WebPluginManifestError(packageDir, "each block must be an object.", field);
+		const { pluginId, registrationOrder = DEFAULT_REGISTRATION_ORDER, client, scopes } = block;
+		if (!Array.isArray(scopes) || scopes.length === 0 || scopes.some((scope) => ![
+			"global",
+			"workspace",
+			"session"
+		].includes(scope))) throw new WebPluginManifestError(packageDir, "scopes must explicitly name global, workspace, or session; resync the plugin.", field);
+		if (typeof pluginId !== "string" || !PLUGIN_ID_PATTERN.test(pluginId)) throw new WebPluginManifestError(packageDir, `pluginId '${String(pluginId)}' must be kebab-case.`, field);
+		if (!Number.isInteger(registrationOrder) || registrationOrder < 0) throw new WebPluginManifestError(packageDir, `'${pluginId}' needs a non-negative integer registrationOrder.`, field);
+		plugins.push({
+			pluginId,
+			slot: pluginSlot({
+				pluginId,
+				packageDir,
+				isHost
+			}),
+			registrationOrder,
+			packageDir,
+			packageName: typeof manifest.name === "string" ? manifest.name : packageDir,
+			isHost,
+			client: normalizeEntry(packageDir, "client", client, field),
+			scopes
+		});
+	}
+	return plugins;
+}
+/** Code-unit order, never the locale's: the same packages must order the same on every machine. */
+function compareCodeUnits(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+const byInstallOrder = (left, right) => left.registrationOrder - right.registrationOrder || compareCodeUnits(left.pluginId, right.pluginId) || compareCodeUnits(left.packageDir, right.packageDir);
+/**
+* The deterministic install order, (registrationOrder, pluginId), with the
+* cross-package collisions resolved by the browser client registry: the first
+* plugin keeps a shared pluginId and the later package is dropped with a notice.
+*/
+function orderDeclaredPlugins(plugins, onNotice = () => void 0) {
+	const sorted = [...plugins].sort(byInstallOrder);
+	const byId = /* @__PURE__ */ new Map();
+	const kept = [];
+	for (const plugin of sorted) {
+		const holder = byId.get(plugin.pluginId);
+		if (holder !== void 0) {
+			onNotice(`web plugin '${plugin.pluginId}' from ${plugin.packageDir} is skipped: ${holder.packageDir} already declares it.`);
+			continue;
+		}
+		byId.set(plugin.pluginId, plugin);
+		kept.push(plugin);
+	}
+	return kept;
+}
+//#endregion
+export { DEFAULT_REGISTRATION_ORDER, WebPluginManifestError, compareCodeUnits, declaredPluginsOf, orderDeclaredPlugins, pluginBlocksOf, pluginSlot };
+
+//# sourceMappingURL=webPluginManifest.mjs.map

package/dist/src/builders/web/webPluginManifest.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webPluginManifest.mjs","names":[],"sources":["../../../../src/builders/web/webPluginManifest.ts"],"sourcesContent":["/**\n * The poWeb manifest vocabulary: how a package declares its web plugin in\n * package.json, validated and ordered; the filesystem is read only to name each\n * copy's slot by its real directory. The\n * scan adapter feeds this from real manifests; the sync bundler feeds it from\n * the installed composition's package roots.\n *\n * Plugins are independent: a manifest names no other plugin, and the order\n * plugins install in is only a tiebreak (registrationOrder, then pluginId),\n * because every relation between two plugins resolves by name once all of\n * them are installed. A collision between two packages is a notice for the\n * sync log and the first package keeps the name; only a malformed block is an\n * error, which the scanner turns into a notice for that package alone.\n *\n * The native app's poNative blocks share this exact shape, so the same\n * validation reads either field.\n */\n\nimport crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nconst PLUGIN_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;\n\n/** The order a plugin installs at when its manifest names none. */\nexport const DEFAULT_REGISTRATION_ORDER = 1000;\n\nexport interface WebPluginEntryDeclaration {\n  /** Package-relative ./path to the source entry. */\n  entry: string;\n}\n\nexport interface DeclaredWebPlugin {\n  pluginId: string;\n  /**\n   * The registry name of this installed copy: the pluginId for a host plugin, otherwise\n   * `${pluginId}.${first 8 hex of sha256(realpath(packageDir))}`, so two copies of one\n   * pluginId installed from different directories never share a name.\n   */\n  slot: string;\n  registrationOrder: number;\n  packageDir: string;\n  packageName: string;\n  isHost: boolean;\n  client: WebPluginEntryDeclaration;\n  scopes: readonly ('global' | 'workspace' | 'session')[];\n}\n\n/** The package.json field a plugin block lives in: the browser cockpit's or the native app's. */\nexport type PluginManifestField = 'poWeb' | 'poNative';\n\nexport class WebPluginManifestError extends Error {\n  constructor(packageDir: string, message: string, field: PluginManifestField = 'poWeb') {\n    super(`${field} manifest in ${packageDir}: ${message}`);\n    this.name = 'WebPluginManifestError';\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction normalizeEntry(\n  packageDir: string,\n  kind: string,\n  value: unknown,\n  field: PluginManifestField,\n): WebPluginEntryDeclaration {\n  const raw = typeof value === 'string' ? { entry: value } : value;\n  if (!isRecord(raw)) throw new WebPluginManifestError(packageDir, `${kind} must be a path or {entry}.`, field);\n  const { entry } = raw;\n  if (typeof entry !== 'string' || !entry.startsWith('./') || entry.includes('..')) {\n    throw new WebPluginManifestError(\n      packageDir,\n      `${kind}.entry must be a package-relative ./path with no '..'.`,\n      field,\n    );\n  }\n  return { entry };\n}\n\nconst SLOT_HASH_LENGTH = 8;\n\n/** The slot of one installed plugin copy; see DeclaredWebPlugin.slot. */\nexport function pluginSlot(plugin: { pluginId: string; packageDir: string; isHost: boolean }): string {\n  if (plugin.isHost) return plugin.pluginId;\n  let directory: string;\n  try {\n    directory = fs.realpathSync(plugin.packageDir);\n  } catch {\n    // A directory that no longer exists has no real path; its resolved path still names it stably.\n    directory = path.resolve(plugin.packageDir);\n  }\n  const digest = crypto.createHash('sha256').update(directory).digest('hex');\n  return `${plugin.pluginId}.${digest.slice(0, SLOT_HASH_LENGTH)}`;\n}\n\n/** The field's value normalized to a list: one plugin object or an array of them. */\nexport function pluginBlocksOf(manifest: Record<string, unknown>, field: PluginManifestField = 'poWeb'): unknown[] {\n  const value = manifest[field];\n  if (value === undefined) return [];\n  return Array.isArray(value) ? value : [value];\n}\n\n/** Validates one manifest's blocks into declared plugins; throws WebPluginManifestError on bad shape. */\nexport function declaredPluginsOf(\n  packageDir: string,\n  manifest: Record<string, unknown>,\n  isHost: boolean,\n  field: PluginManifestField = 'poWeb',\n): DeclaredWebPlugin[] {\n  const plugins: DeclaredWebPlugin[] = [];\n  for (const block of pluginBlocksOf(manifest, field)) {\n    if (!isRecord(block)) throw new WebPluginManifestError(packageDir, 'each block must be an object.', field);\n    const { pluginId, registrationOrder = DEFAULT_REGISTRATION_ORDER, client, scopes } = block;\n    if (\n      !Array.isArray(scopes) ||\n      scopes.length === 0 ||\n      scopes.some((scope) => !['global', 'workspace', 'session'].includes(scope))\n    ) {\n      throw new WebPluginManifestError(\n        packageDir,\n        'scopes must explicitly name global, workspace, or session; resync the plugin.',\n        field,\n      );\n    }\n    if (typeof pluginId !== 'string' || !PLUGIN_ID_PATTERN.test(pluginId)) {\n      throw new WebPluginManifestError(packageDir, `pluginId '${String(pluginId)}' must be kebab-case.`, field);\n    }\n    if (!Number.isInteger(registrationOrder) || (registrationOrder as number) < 0) {\n      throw new WebPluginManifestError(\n        packageDir,\n        `'${pluginId}' needs a non-negative integer registrationOrder.`,\n        field,\n      );\n    }\n    plugins.push({\n      pluginId,\n      slot: pluginSlot({ pluginId, packageDir, isHost }),\n      registrationOrder: registrationOrder as number,\n      packageDir,\n      packageName: typeof manifest.name === 'string' ? manifest.name : packageDir,\n      isHost,\n      client: normalizeEntry(packageDir, 'client', client, field),\n      scopes,\n    });\n  }\n  return plugins;\n}\n\n/** Code-unit order, never the locale's: the same packages must order the same on every machine. */\nexport function compareCodeUnits(left: string, right: string): number {\n  return left < right ? -1 : left > right ? 1 : 0;\n}\n\nconst byInstallOrder = (left: DeclaredWebPlugin, right: DeclaredWebPlugin): number =>\n  left.registrationOrder - right.registrationOrder ||\n  compareCodeUnits(left.pluginId, right.pluginId) ||\n  compareCodeUnits(left.packageDir, right.packageDir);\n\n/**\n * The deterministic install order, (registrationOrder, pluginId), with the\n * cross-package collisions resolved by the browser client registry: the first\n * plugin keeps a shared pluginId and the later package is dropped with a notice.\n */\nexport function orderDeclaredPlugins(\n  plugins: readonly DeclaredWebPlugin[],\n  onNotice: (message: string) => void = () => undefined,\n): DeclaredWebPlugin[] {\n  const sorted = [...plugins].sort(byInstallOrder);\n  const byId = new Map<string, DeclaredWebPlugin>();\n  const kept: DeclaredWebPlugin[] = [];\n  for (const plugin of sorted) {\n    const holder = byId.get(plugin.pluginId);\n    if (holder !== undefined) {\n      onNotice(\n        `web plugin '${plugin.pluginId}' from ${plugin.packageDir} is skipped: ${holder.packageDir} already declares it.`,\n      );\n      continue;\n    }\n    byId.set(plugin.pluginId, plugin);\n    kept.push(plugin);\n  }\n  return kept;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsBA,MAAM,oBAAoB;;AAG1B,MAAa,6BAA6B;AA0B1C,IAAa,yBAAb,cAA4C,MAAM;CAChD,YAAY,YAAoB,SAAiB,QAA6B,SAAS;EACrF,MAAM,GAAG,MAAM,eAAe,WAAW,IAAI,SAAS;EACtD,KAAK,OAAO;CACd;AACF;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,eACP,YACA,MACA,OACA,OAC2B;CAC3B,MAAM,MAAM,OAAO,UAAU,WAAW,EAAE,OAAO,MAAM,IAAI;CAC3D,IAAI,CAAC,SAAS,GAAG,GAAG,MAAM,IAAI,uBAAuB,YAAY,GAAG,KAAK,8BAA8B,KAAK;CAC5G,MAAM,EAAE,UAAU;CAClB,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,IAAI,KAAK,MAAM,SAAS,IAAI,GAC7E,MAAM,IAAI,uBACR,YACA,GAAG,KAAK,yDACR,KACF;CAEF,OAAO,EAAE,MAAM;AACjB;AAEA,MAAM,mBAAmB;;AAGzB,SAAgB,WAAW,QAA2E;CACpG,IAAI,OAAO,QAAQ,OAAO,OAAO;CACjC,IAAI;CACJ,IAAI;EACF,YAAY,GAAG,aAAa,OAAO,UAAU;CAC/C,QAAQ;EAEN,YAAY,KAAK,QAAQ,OAAO,UAAU;CAC5C;CACA,MAAM,SAAS,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAAK;CACzE,OAAO,GAAG,OAAO,SAAS,GAAG,OAAO,MAAM,GAAG,gBAAgB;AAC/D;;AAGA,SAAgB,eAAe,UAAmC,QAA6B,SAAoB;CACjH,MAAM,QAAQ,SAAS;CACvB,IAAI,UAAU,KAAA,GAAW,OAAO,CAAC;CACjC,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AAC9C;;AAGA,SAAgB,kBACd,YACA,UACA,QACA,QAA6B,SACR;CACrB,MAAM,UAA+B,CAAC;CACtC,KAAK,MAAM,SAAS,eAAe,UAAU,KAAK,GAAG;EACnD,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,IAAI,uBAAuB,YAAY,iCAAiC,KAAK;EACzG,MAAM,EAAE,UAAU,oBAAoB,4BAA4B,QAAQ,WAAW;EACrF,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,OAAO,WAAW,KAClB,OAAO,MAAM,UAAU,CAAC;GAAC;GAAU;GAAa;EAAS,CAAC,CAAC,SAAS,KAAK,CAAC,GAE1E,MAAM,IAAI,uBACR,YACA,iFACA,KACF;EAEF,IAAI,OAAO,aAAa,YAAY,CAAC,kBAAkB,KAAK,QAAQ,GAClE,MAAM,IAAI,uBAAuB,YAAY,aAAa,OAAO,QAAQ,EAAE,wBAAwB,KAAK;EAE1G,IAAI,CAAC,OAAO,UAAU,iBAAiB,KAAM,oBAA+B,GAC1E,MAAM,IAAI,uBACR,YACA,IAAI,SAAS,oDACb,KACF;EAEF,QAAQ,KAAK;GACX;GACA,MAAM,WAAW;IAAE;IAAU;IAAY;GAAO,CAAC;GAC9B;GACnB;GACA,aAAa,OAAO,SAAS,SAAS,WAAW,SAAS,OAAO;GACjE;GACA,QAAQ,eAAe,YAAY,UAAU,QAAQ,KAAK;GAC1D;EACF,CAAC;CACH;CACA,OAAO;AACT;;AAGA,SAAgB,iBAAiB,MAAc,OAAuB;CACpE,OAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAChD;AAEA,MAAM,kBAAkB,MAAyB,UAC/C,KAAK,oBAAoB,MAAM,qBAC/B,iBAAiB,KAAK,UAAU,MAAM,QAAQ,KAC9C,iBAAiB,KAAK,YAAY,MAAM,UAAU;;;;;;AAOpD,SAAgB,qBACd,SACA,iBAA4C,KAAA,GACvB;CACrB,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,cAAc;CAC/C,MAAM,uBAAO,IAAI,IAA+B;CAChD,MAAM,OAA4B,CAAC;CACnC,KAAK,MAAM,UAAU,QAAQ;EAC3B,MAAM,SAAS,KAAK,IAAI,OAAO,QAAQ;EACvC,IAAI,WAAW,KAAA,GAAW;GACxB,SACE,eAAe,OAAO,SAAS,SAAS,OAAO,WAAW,eAAe,OAAO,WAAW,sBAC7F;GACA;EACF;EACA,KAAK,IAAI,OAAO,UAAU,MAAM;EAChC,KAAK,KAAK,MAAM;CAClB;CACA,OAAO;AACT"}

package/dist/src/builders/web/webPluginScan.cjs

@@ -0,0 +1,57 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+const require_webPluginManifest = require("./webPluginManifest.cjs");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+//#region src/builders/web/webPluginScan.ts
+/**
+* Reads poWeb declarations from explicit package roots.
+*
+* No workspace walking and no hardcoded plugin names: the caller says which
+* packages are in play. At po-web's own build time that is just the host
+* package (its built-in plugins); at `po sync` time it is the installed
+* composition's package roots. A plugin package whose manifest is malformed
+* or whose entry file is missing is skipped with a notice, so one broken or
+* half-installed package never costs the rest of the cockpit; only the host's
+* own manifest still throws, because that is a build error of this package.
+*
+* `field` selects poNative for the native composition, which has no host
+* package: pass `undefined` as `hostDir` and only the plugin roots are read.
+*/
+function scanWebPlugins(hostDir, pluginRoots = [], onNotice = () => void 0, field = "poWeb") {
+	const seen = /* @__PURE__ */ new Set();
+	const plugins = [];
+	const hostResolved = hostDir === void 0 ? void 0 : node_path.default.resolve(hostDir);
+	const kind = field === "poNative" ? "native" : "web";
+	for (const root of hostDir === void 0 ? pluginRoots : [hostDir, ...pluginRoots]) {
+		const resolved = node_path.default.resolve(root);
+		if (seen.has(resolved)) continue;
+		seen.add(resolved);
+		try {
+			plugins.push(...declaredPluginsIn(resolved, resolved === hostResolved, field));
+		} catch (error) {
+			if (resolved === hostResolved) throw error;
+			onNotice(`${kind} plugin package ${resolved} skipped: ${error instanceof require_webPluginManifest.WebPluginManifestError ? error.message : String(error)}`);
+		}
+	}
+	return require_webPluginManifest.orderDeclaredPlugins(plugins, onNotice);
+}
+function declaredPluginsIn(resolved, isHost, field) {
+	let manifest;
+	try {
+		manifest = JSON.parse(node_fs.default.readFileSync(node_path.default.join(resolved, "package.json"), "utf8"));
+	} catch (error) {
+		throw new require_webPluginManifest.WebPluginManifestError(resolved, `package.json is unreadable: ${String(error)}`, field);
+	}
+	const declared = require_webPluginManifest.declaredPluginsOf(resolved, manifest, isHost, field);
+	for (const plugin of declared) {
+		const entryPath = node_path.default.join(resolved, plugin.client.entry);
+		if (!node_fs.default.existsSync(entryPath)) throw new require_webPluginManifest.WebPluginManifestError(resolved, `client.entry '${plugin.client.entry}' does not exist.`, field);
+	}
+	return declared;
+}
+//#endregion
+exports.scanWebPlugins = scanWebPlugins;
+
+//# sourceMappingURL=webPluginScan.cjs.map

package/dist/src/builders/web/webPluginScan.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webPluginScan.cjs","names":["path","WebPluginManifestError","orderDeclaredPlugins","fs","declaredPluginsOf"],"sources":["../../../../src/builders/web/webPluginScan.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\n\nimport {\n  type DeclaredWebPlugin,\n  declaredPluginsOf,\n  orderDeclaredPlugins,\n  type PluginManifestField,\n  WebPluginManifestError,\n} from './webPluginManifest';\n\n/**\n * Reads poWeb declarations from explicit package roots.\n *\n * No workspace walking and no hardcoded plugin names: the caller says which\n * packages are in play. At po-web's own build time that is just the host\n * package (its built-in plugins); at `po sync` time it is the installed\n * composition's package roots. A plugin package whose manifest is malformed\n * or whose entry file is missing is skipped with a notice, so one broken or\n * half-installed package never costs the rest of the cockpit; only the host's\n * own manifest still throws, because that is a build error of this package.\n *\n * `field` selects poNative for the native composition, which has no host\n * package: pass `undefined` as `hostDir` and only the plugin roots are read.\n */\nexport function scanWebPlugins(\n  hostDir: string | undefined,\n  pluginRoots: readonly string[] = [],\n  onNotice: (message: string) => void = () => undefined,\n  field: PluginManifestField = 'poWeb',\n): DeclaredWebPlugin[] {\n  const seen = new Set<string>();\n  const plugins: DeclaredWebPlugin[] = [];\n  const hostResolved = hostDir === undefined ? undefined : path.resolve(hostDir);\n  const kind = field === 'poNative' ? 'native' : 'web';\n  for (const root of hostDir === undefined ? pluginRoots : [hostDir, ...pluginRoots]) {\n    const resolved = path.resolve(root);\n    if (seen.has(resolved)) continue;\n    seen.add(resolved);\n    try {\n      plugins.push(...declaredPluginsIn(resolved, resolved === hostResolved, field));\n    } catch (error) {\n      if (resolved === hostResolved) throw error;\n      const reason = error instanceof WebPluginManifestError ? error.message : String(error);\n      onNotice(`${kind} plugin package ${resolved} skipped: ${reason}`);\n    }\n  }\n  return orderDeclaredPlugins(plugins, onNotice);\n}\n\nfunction declaredPluginsIn(resolved: string, isHost: boolean, field: PluginManifestField): DeclaredWebPlugin[] {\n  let manifest: Record<string, unknown>;\n  try {\n    manifest = JSON.parse(fs.readFileSync(path.join(resolved, 'package.json'), 'utf8')) as Record<string, unknown>;\n  } catch (error) {\n    throw new WebPluginManifestError(resolved, `package.json is unreadable: ${String(error)}`, field);\n  }\n  const declared = declaredPluginsOf(resolved, manifest, isHost, field);\n  for (const plugin of declared) {\n    const entryPath = path.join(resolved, plugin.client.entry);\n    if (!fs.existsSync(entryPath)) {\n      throw new WebPluginManifestError(resolved, `client.entry '${plugin.client.entry}' does not exist.`, field);\n    }\n  }\n  return declared;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,eACd,SACA,cAAiC,CAAC,GAClC,iBAA4C,KAAA,GAC5C,QAA6B,SACR;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,UAA+B,CAAC;CACtC,MAAM,eAAe,YAAY,KAAA,IAAY,KAAA,IAAYA,UAAAA,QAAK,QAAQ,OAAO;CAC7E,MAAM,OAAO,UAAU,aAAa,WAAW;CAC/C,KAAK,MAAM,QAAQ,YAAY,KAAA,IAAY,cAAc,CAAC,SAAS,GAAG,WAAW,GAAG;EAClF,MAAM,WAAWA,UAAAA,QAAK,QAAQ,IAAI;EAClC,IAAI,KAAK,IAAI,QAAQ,GAAG;EACxB,KAAK,IAAI,QAAQ;EACjB,IAAI;GACF,QAAQ,KAAK,GAAG,kBAAkB,UAAU,aAAa,cAAc,KAAK,CAAC;EAC/E,SAAS,OAAO;GACd,IAAI,aAAa,cAAc,MAAM;GAErC,SAAS,GAAG,KAAK,kBAAkB,SAAS,YAD7B,iBAAiBC,0BAAAA,yBAAyB,MAAM,UAAU,OAAO,KAAK,GACrB;EAClE;CACF;CACA,OAAOC,0BAAAA,qBAAqB,SAAS,QAAQ;AAC/C;AAEA,SAAS,kBAAkB,UAAkB,QAAiB,OAAiD;CAC7G,IAAI;CACJ,IAAI;EACF,WAAW,KAAK,MAAMC,QAAAA,QAAG,aAAaH,UAAAA,QAAK,KAAK,UAAU,cAAc,GAAG,MAAM,CAAC;CACpF,SAAS,OAAO;EACd,MAAM,IAAIC,0BAAAA,uBAAuB,UAAU,+BAA+B,OAAO,KAAK,KAAK,KAAK;CAClG;CACA,MAAM,WAAWG,0BAAAA,kBAAkB,UAAU,UAAU,QAAQ,KAAK;CACpE,KAAK,MAAM,UAAU,UAAU;EAC7B,MAAM,YAAYJ,UAAAA,QAAK,KAAK,UAAU,OAAO,OAAO,KAAK;EACzD,IAAI,CAACG,QAAAA,QAAG,WAAW,SAAS,GAC1B,MAAM,IAAIF,0BAAAA,uBAAuB,UAAU,iBAAiB,OAAO,OAAO,MAAM,oBAAoB,KAAK;CAE7G;CACA,OAAO;AACT"}

package/dist/src/builders/web/webPluginScan.d.mts

@@ -0,0 +1,19 @@
+import { DeclaredWebPlugin, PluginManifestField } from "./webPluginManifest.mjs";
+//#region src/builders/web/webPluginScan.d.ts
+/**
+ * Reads poWeb declarations from explicit package roots.
+ *
+ * No workspace walking and no hardcoded plugin names: the caller says which
+ * packages are in play. At po-web's own build time that is just the host
+ * package (its built-in plugins); at `po sync` time it is the installed
+ * composition's package roots. A plugin package whose manifest is malformed
+ * or whose entry file is missing is skipped with a notice, so one broken or
+ * half-installed package never costs the rest of the cockpit; only the host's
+ * own manifest still throws, because that is a build error of this package.
+ *
+ * `field` selects poNative for the native composition, which has no host
+ * package: pass `undefined` as `hostDir` and only the plugin roots are read.
+ */
+export declare function scanWebPlugins(hostDir: string | undefined, pluginRoots?: readonly string[], onNotice?: (message: string) => void, field?: PluginManifestField): DeclaredWebPlugin[];
+//#endregion
+//# sourceMappingURL=webPluginScan.d.mts.map

package/dist/src/builders/web/webPluginScan.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webPluginScan.d.mts","names":[],"sources":["../../../../src/builders/web/webPluginScan.ts"],"mappings":";;;;;;;;;;;;;;;;wBAyBgB,eACd,6BACA,iCACA,YAAW,0BACX,QAAO,sBACN"}

package/dist/src/builders/web/webPluginScan.mjs

@@ -0,0 +1,54 @@
+import { WebPluginManifestError, declaredPluginsOf, orderDeclaredPlugins } from "./webPluginManifest.mjs";
+import fs from "node:fs";
+import path from "node:path";
+//#region src/builders/web/webPluginScan.ts
+/**
+* Reads poWeb declarations from explicit package roots.
+*
+* No workspace walking and no hardcoded plugin names: the caller says which
+* packages are in play. At po-web's own build time that is just the host
+* package (its built-in plugins); at `po sync` time it is the installed
+* composition's package roots. A plugin package whose manifest is malformed
+* or whose entry file is missing is skipped with a notice, so one broken or
+* half-installed package never costs the rest of the cockpit; only the host's
+* own manifest still throws, because that is a build error of this package.
+*
+* `field` selects poNative for the native composition, which has no host
+* package: pass `undefined` as `hostDir` and only the plugin roots are read.
+*/
+function scanWebPlugins(hostDir, pluginRoots = [], onNotice = () => void 0, field = "poWeb") {
+	const seen = /* @__PURE__ */ new Set();
+	const plugins = [];
+	const hostResolved = hostDir === void 0 ? void 0 : path.resolve(hostDir);
+	const kind = field === "poNative" ? "native" : "web";
+	for (const root of hostDir === void 0 ? pluginRoots : [hostDir, ...pluginRoots]) {
+		const resolved = path.resolve(root);
+		if (seen.has(resolved)) continue;
+		seen.add(resolved);
+		try {
+			plugins.push(...declaredPluginsIn(resolved, resolved === hostResolved, field));
+		} catch (error) {
+			if (resolved === hostResolved) throw error;
+			onNotice(`${kind} plugin package ${resolved} skipped: ${error instanceof WebPluginManifestError ? error.message : String(error)}`);
+		}
+	}
+	return orderDeclaredPlugins(plugins, onNotice);
+}
+function declaredPluginsIn(resolved, isHost, field) {
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFileSync(path.join(resolved, "package.json"), "utf8"));
+	} catch (error) {
+		throw new WebPluginManifestError(resolved, `package.json is unreadable: ${String(error)}`, field);
+	}
+	const declared = declaredPluginsOf(resolved, manifest, isHost, field);
+	for (const plugin of declared) {
+		const entryPath = path.join(resolved, plugin.client.entry);
+		if (!fs.existsSync(entryPath)) throw new WebPluginManifestError(resolved, `client.entry '${plugin.client.entry}' does not exist.`, field);
+	}
+	return declared;
+}
+//#endregion
+export { scanWebPlugins };
+
+//# sourceMappingURL=webPluginScan.mjs.map

package/dist/src/builders/web/webPluginScan.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webPluginScan.mjs","names":[],"sources":["../../../../src/builders/web/webPluginScan.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\n\nimport {\n  type DeclaredWebPlugin,\n  declaredPluginsOf,\n  orderDeclaredPlugins,\n  type PluginManifestField,\n  WebPluginManifestError,\n} from './webPluginManifest';\n\n/**\n * Reads poWeb declarations from explicit package roots.\n *\n * No workspace walking and no hardcoded plugin names: the caller says which\n * packages are in play. At po-web's own build time that is just the host\n * package (its built-in plugins); at `po sync` time it is the installed\n * composition's package roots. A plugin package whose manifest is malformed\n * or whose entry file is missing is skipped with a notice, so one broken or\n * half-installed package never costs the rest of the cockpit; only the host's\n * own manifest still throws, because that is a build error of this package.\n *\n * `field` selects poNative for the native composition, which has no host\n * package: pass `undefined` as `hostDir` and only the plugin roots are read.\n */\nexport function scanWebPlugins(\n  hostDir: string | undefined,\n  pluginRoots: readonly string[] = [],\n  onNotice: (message: string) => void = () => undefined,\n  field: PluginManifestField = 'poWeb',\n): DeclaredWebPlugin[] {\n  const seen = new Set<string>();\n  const plugins: DeclaredWebPlugin[] = [];\n  const hostResolved = hostDir === undefined ? undefined : path.resolve(hostDir);\n  const kind = field === 'poNative' ? 'native' : 'web';\n  for (const root of hostDir === undefined ? pluginRoots : [hostDir, ...pluginRoots]) {\n    const resolved = path.resolve(root);\n    if (seen.has(resolved)) continue;\n    seen.add(resolved);\n    try {\n      plugins.push(...declaredPluginsIn(resolved, resolved === hostResolved, field));\n    } catch (error) {\n      if (resolved === hostResolved) throw error;\n      const reason = error instanceof WebPluginManifestError ? error.message : String(error);\n      onNotice(`${kind} plugin package ${resolved} skipped: ${reason}`);\n    }\n  }\n  return orderDeclaredPlugins(plugins, onNotice);\n}\n\nfunction declaredPluginsIn(resolved: string, isHost: boolean, field: PluginManifestField): DeclaredWebPlugin[] {\n  let manifest: Record<string, unknown>;\n  try {\n    manifest = JSON.parse(fs.readFileSync(path.join(resolved, 'package.json'), 'utf8')) as Record<string, unknown>;\n  } catch (error) {\n    throw new WebPluginManifestError(resolved, `package.json is unreadable: ${String(error)}`, field);\n  }\n  const declared = declaredPluginsOf(resolved, manifest, isHost, field);\n  for (const plugin of declared) {\n    const entryPath = path.join(resolved, plugin.client.entry);\n    if (!fs.existsSync(entryPath)) {\n      throw new WebPluginManifestError(resolved, `client.entry '${plugin.client.entry}' does not exist.`, field);\n    }\n  }\n  return declared;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAyBA,SAAgB,eACd,SACA,cAAiC,CAAC,GAClC,iBAA4C,KAAA,GAC5C,QAA6B,SACR;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,UAA+B,CAAC;CACtC,MAAM,eAAe,YAAY,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,OAAO;CAC7E,MAAM,OAAO,UAAU,aAAa,WAAW;CAC/C,KAAK,MAAM,QAAQ,YAAY,KAAA,IAAY,cAAc,CAAC,SAAS,GAAG,WAAW,GAAG;EAClF,MAAM,WAAW,KAAK,QAAQ,IAAI;EAClC,IAAI,KAAK,IAAI,QAAQ,GAAG;EACxB,KAAK,IAAI,QAAQ;EACjB,IAAI;GACF,QAAQ,KAAK,GAAG,kBAAkB,UAAU,aAAa,cAAc,KAAK,CAAC;EAC/E,SAAS,OAAO;GACd,IAAI,aAAa,cAAc,MAAM;GAErC,SAAS,GAAG,KAAK,kBAAkB,SAAS,YAD7B,iBAAiB,yBAAyB,MAAM,UAAU,OAAO,KAAK,GACrB;EAClE;CACF;CACA,OAAO,qBAAqB,SAAS,QAAQ;AAC/C;AAEA,SAAS,kBAAkB,UAAkB,QAAiB,OAAiD;CAC7G,IAAI;CACJ,IAAI;EACF,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,KAAK,UAAU,cAAc,GAAG,MAAM,CAAC;CACpF,SAAS,OAAO;EACd,MAAM,IAAI,uBAAuB,UAAU,+BAA+B,OAAO,KAAK,KAAK,KAAK;CAClG;CACA,MAAM,WAAW,kBAAkB,UAAU,UAAU,QAAQ,KAAK;CACpE,KAAK,MAAM,UAAU,UAAU;EAC7B,MAAM,YAAY,KAAK,KAAK,UAAU,OAAO,OAAO,KAAK;EACzD,IAAI,CAAC,GAAG,WAAW,SAAS,GAC1B,MAAM,IAAI,uBAAuB,UAAU,iBAAiB,OAAO,OAAO,MAAM,oBAAoB,KAAK;CAE7G;CACA,OAAO;AACT"}

package/dist/src/builders/web/webPluginVite.cjs

@@ -0,0 +1,255 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+const require_index = require("./index.cjs");
+const require_sessionComposition = require("../cli/sessionComposition.cjs");
+const require_webDevRoots = require("./webDevRoots.cjs");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+let node_module = require("node:module");
+//#region src/builders/web/webPluginVite.ts
+const PO_ROOT_ENV = "PO_ROOT";
+/**
+* The modules the cockpit supplies page-wide, rather than each plugin
+* carrying its own copy.
+*
+* Build-time metadata, and it stays here rather than in a browser-facing
+* barrel on purpose: exporting it from po-core/web put the literal list
+* into the shipped cockpit bundle, where a plugin's own specifier strings
+* would then appear as data.
+*/
+const WEB_PLUGIN_RUNTIME_SPECIFIERS = [
+	"react",
+	"react/jsx-runtime",
+	"react/jsx-dev-runtime",
+	"react-dom",
+	"react-dom/client",
+	"@tanstack/store",
+	"@tanstack/react-store",
+	"@tanstack/react-router",
+	"@agimon-ai/po-web-dashboard",
+	"@agimon-ai/po-web-dashboard/views",
+	"@agimon-ai/po-core/web",
+	"@agimon-ai/po-web-components",
+	"@agimon-ai/po-web-security/browser",
+	"@codemirror/state",
+	"@codemirror/view"
+];
+const WEB_PLUGIN_RUNTIME_PROPERTIES = {
+	react: "react",
+	"react/jsx-runtime": "reactJsxRuntime",
+	"react/jsx-dev-runtime": "reactJsxDevRuntime",
+	"react-dom": "reactDom",
+	"react-dom/client": "reactDomClient",
+	"@tanstack/store": "tanstackStore",
+	"@tanstack/react-store": "tanstackReactStore",
+	"@tanstack/react-router": "tanstackRouter",
+	"@agimon-ai/po-web-dashboard": "dashboard",
+	"@agimon-ai/po-web-dashboard/views": "dashboardViews",
+	"@agimon-ai/po-core/web": "webContracts",
+	"@agimon-ai/po-web-components": "webComponents",
+	"@agimon-ai/po-web-security/browser": "webSecurityBrowser",
+	"@codemirror/state": "codemirrorState",
+	"@codemirror/view": "codemirrorView"
+};
+/** Expression for a shared module supplied by the session shell. */
+function webPluginRuntimeGlobal(specifier) {
+	return `globalThis.PoWebPluginRuntime.${WEB_PLUGIN_RUNTIME_PROPERTIES[specifier]}`;
+}
+/** The React family ships CommonJS, so its names come from loading it rather than parsing it. */
+const COMMONJS_RUNTIME_SPECIFIERS = /* @__PURE__ */ new Set([
+	"react",
+	"react/jsx-runtime",
+	"react/jsx-dev-runtime",
+	"react-dom",
+	"react-dom/client"
+]);
+const FACADE_PREFIX = "\0po-web-runtime:";
+/** The chunk every facade lands in, so each shared module is read from the runtime once. */
+const WEB_PLUGIN_FACADE_CHUNK = "po-web-runtime";
+/** True for a module id that is one of the shared-module facades. */
+function isWebPluginFacade(id) {
+	return id.startsWith(FACADE_PREFIX);
+}
+/** The ES module name of a default export. */
+const DEFAULT_EXPORT = "default";
+function patternNames(pattern) {
+	switch (pattern.type) {
+		case "Identifier": return [pattern.name];
+		case "ObjectPattern": return pattern.properties.flatMap((property) => patternNames(property.type === "RestElement" ? property.argument : property.value));
+		case "ArrayPattern": return pattern.elements.flatMap((element) => element ? patternNames(element) : []);
+		case "RestElement": return patternNames(pattern.argument);
+		case "AssignmentPattern": return patternNames(pattern.left);
+		default: return [];
+	}
+}
+function exportedName(node) {
+	return node.type === "Identifier" ? node.name : String(node.value);
+}
+/**
+* The export names of an ES module file. `export *` is followed through relative paths,
+* and through a bare specifier only when that specifier is itself a shared module
+* (resolved from the re-exporting file, since that is the copy the runtime object holds).
+* Any other bare `export *` and any unparseable file fail the build.
+*/
+async function esModuleExportNames(specifier, file, reader, seen = /* @__PURE__ */ new Set()) {
+	const names = /* @__PURE__ */ new Set();
+	if (seen.has(file)) return names;
+	seen.add(file);
+	let body;
+	try {
+		body = reader.parse(node_fs.default.readFileSync(file, "utf8")).body;
+	} catch (error) {
+		throw new Error(`The shared module '${specifier}' cannot be parsed at ${file}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const shared = new Set(WEB_PLUGIN_RUNTIME_SPECIFIERS);
+	for (const node of body) {
+		if (node.type === "ExportDefaultDeclaration") names.add(DEFAULT_EXPORT);
+		if (node.type === "ExportNamedDeclaration") {
+			const declaration = node.declaration;
+			if (declaration?.type === "VariableDeclaration") for (const declarator of declaration.declarations) for (const name of patternNames(declarator.id)) names.add(name);
+			else if (declaration) names.add(declaration.id.name);
+			for (const entry of node.specifiers ?? []) names.add(exportedName(entry.exported));
+		}
+		if (node.type === "ExportAllDeclaration") {
+			if (node.exported) {
+				names.add(exportedName(node.exported));
+				continue;
+			}
+			const source = String(node.source.value);
+			let target;
+			if (source.startsWith("./") || source.startsWith("../")) target = node_path.default.resolve(node_path.default.dirname(file), source);
+			else if (shared.has(source)) {
+				target = await reader.resolve(source, file);
+				if (target === void 0) throw new Error(`The shared module '${specifier}' re-exports '${source}', which does not resolve from ${file}.`);
+			} else throw new Error(`The shared module '${specifier}' re-exports everything from the bare specifier '${source}' (${file}), which is not a shared module; its names cannot be listed.`);
+			for (const name of await esModuleExportNames(specifier, target, reader, seen)) if (name !== DEFAULT_EXPORT) names.add(name);
+		}
+	}
+	return names;
+}
+const IDENTIFIER = /^[A-Za-z_$][\w$]*$/u;
+/** A module that reads one shared module from the page runtime and re-exports the given names. */
+function renderWebPluginFacade(specifier, names) {
+	const all = new Set(names);
+	const lines = [`const runtime = ${webPluginRuntimeGlobal(specifier)};`];
+	const exported = [];
+	let index = 0;
+	for (const name of [...all].sort()) {
+		if (name === DEFAULT_EXPORT) continue;
+		const local = `_${String(index++)}`;
+		lines.push(`const ${local} = runtime[${JSON.stringify(name)}];`);
+		exported.push(`${local} as ${IDENTIFIER.test(name) ? name : JSON.stringify(name)}`);
+	}
+	if (exported.length > 0) lines.push(`export { ${exported.join(", ")} };`);
+	if (all.has(DEFAULT_EXPORT)) lines.push("export default runtime[\"default\"];");
+	else if (COMMONJS_RUNTIME_SPECIFIERS.has(specifier)) lines.push("export default runtime;");
+	lines.push("");
+	return lines.join("\n");
+}
+/**
+* Resolves every shared runtime specifier to a virtual facade that re-exports, by name,
+* from `globalThis.PoWebPluginRuntime`, so ES-module slot entries can import them without
+* the page providing an import map. Names come from the host's own copy of each module.
+*/
+function webPluginRuntimeFacadePlugin(hostRoot) {
+	const shared = new Set(WEB_PLUGIN_RUNTIME_SPECIFIERS);
+	const hostImporter = node_path.default.join(hostRoot, "package.json");
+	const hostRequire = (0, node_module.createRequire)(hostImporter);
+	return {
+		name: "po-web-runtime-facades",
+		enforce: "pre",
+		resolveId(source) {
+			return shared.has(source) ? `${FACADE_PREFIX}${source}` : null;
+		},
+		async load(id) {
+			if (!isWebPluginFacade(id)) return null;
+			const specifier = id.slice(16);
+			if (COMMONJS_RUNTIME_SPECIFIERS.has(specifier)) return renderWebPluginFacade(specifier, Object.keys(hostRequire(specifier)));
+			const resolveFile = async (source, importer) => {
+				const resolved = await this.resolve(source, importer, { skipSelf: true });
+				return resolved ? resolved.id.split("?")[0] ?? resolved.id : void 0;
+			};
+			const file = await resolveFile(specifier, hostImporter);
+			if (file === void 0) throw new Error(`The shared module '${specifier}' does not resolve from ${hostRoot}.`);
+			const { parseAst } = await import("vite");
+			return renderWebPluginFacade(specifier, await esModuleExportNames(specifier, file, {
+				parse: (code) => parseAst(code),
+				resolve: resolveFile
+			}));
+		}
+	};
+}
+/** Resolves generated JSX imports from the host instead of a plugin's optional React peer tree. */
+function webPluginRuntimeAliases(clientRoot) {
+	const runtimeRequire = (0, node_module.createRequire)(node_path.default.join(clientRoot, "index.html"));
+	return WEB_PLUGIN_RUNTIME_SPECIFIERS.filter((specifier) => specifier.startsWith("react/jsx-")).map((specifier) => ({
+		find: new RegExp(`^${specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "u"),
+		replacement: runtimeRequire.resolve(specifier)
+	}));
+}
+/**
+* Swaps the committed builtin registry modules for generated ones. A
+* resolveId hook rather than resolve.alias because aliases match raw import
+* specifiers while these two are known by their resolved paths. Both the
+* sync-time build and the dev server use it, so a plugin edit in dev is the
+* same module the bundle would carry.
+*/
+function webPluginOverridePlugin(clientRoot, generated) {
+	const overrides = /* @__PURE__ */ new Map([[node_path.default.join(clientRoot, "app", "webPlugins.generated.ts"), generated.clientModulePath], [node_path.default.join(clientRoot, "styles", "webPluginSources.generated.css"), generated.cssModulePath]]);
+	return {
+		name: "po-web-plugin-overrides",
+		enforce: "pre",
+		async resolveId(source, importer, options) {
+			if (!source.includes("webPlugins.generated") && !source.includes("webPluginSources.generated.css")) return null;
+			const resolved = await this.resolve(source, importer, {
+				...options,
+				skipSelf: true
+			});
+			if (!resolved) return null;
+			return overrides.get(resolved.id) ?? null;
+		}
+	};
+}
+/**
+* The CSS sources module cannot ride the resolveId hook: Vite and Tailwind
+* resolve CSS @import through Vite's own id resolver, which consults aliases
+* but no plugin hooks. Without this the builtin (empty) @source list ships
+* and every plugin-only utility class is missing.
+*/
+function webPluginCssAlias(generated) {
+	return {
+		find: /^\.\/webPluginSources\.generated\.css$/,
+		replacement: generated.cssModulePath
+	};
+}
+/** The plugin package roots the dev server should serve, from an explicit override or PO_ROOT. */
+function readDevPluginRoots(environment, homeDirectory) {
+	const explicit = environment[require_webDevRoots.PLUGIN_ROOTS_ENV];
+	if (explicit !== void 0 && explicit !== "") return require_webDevRoots.devPluginRoots({
+		envValue: explicit,
+		rootsFileText: void 0,
+		delimiter: node_path.default.delimiter
+	});
+	const repoRoot = environment[PO_ROOT_ENV];
+	if (repoRoot === void 0 || repoRoot === "") return [];
+	return require_index.compositionPackageRoots(require_sessionComposition.rootCompositions({
+		root: repoRoot,
+		homeDirectory,
+		environment
+	}));
+}
+//#endregion
+exports.WEB_PLUGIN_FACADE_CHUNK = WEB_PLUGIN_FACADE_CHUNK;
+exports.WEB_PLUGIN_RUNTIME_SPECIFIERS = WEB_PLUGIN_RUNTIME_SPECIFIERS;
+exports.esModuleExportNames = esModuleExportNames;
+exports.isWebPluginFacade = isWebPluginFacade;
+exports.readDevPluginRoots = readDevPluginRoots;
+exports.renderWebPluginFacade = renderWebPluginFacade;
+exports.webPluginCssAlias = webPluginCssAlias;
+exports.webPluginOverridePlugin = webPluginOverridePlugin;
+exports.webPluginRuntimeAliases = webPluginRuntimeAliases;
+exports.webPluginRuntimeFacadePlugin = webPluginRuntimeFacadePlugin;
+exports.webPluginRuntimeGlobal = webPluginRuntimeGlobal;
+
+//# sourceMappingURL=webPluginVite.cjs.map