@ai-switch/tauri-plugin-runtime 0.1.0

package/dist/host/index.js

@@ -0,0 +1,791 @@
+import {
+  appendBootstrapHint,
+  createRpcPeer
+} from "../chunk-PW7XHHWG.js";
+import {
+  AplgError,
+  standardCapabilities,
+  validateCapabilityRequest,
+  validateCapabilityResult,
+  validateHostEvent,
+  validateJson,
+  validateSessionDescriptor
+} from "../chunk-RKQEK7DY.js";
+import {
+  protocolVersion
+} from "../chunk-WT62GTMC.js";
+import "../chunk-JSBRDJBE.js";
+
+// src/host/policy.ts
+function checkedTimeout(value) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > 2147483647) {
+    throw new AplgError("E_INVALID_ARGUMENT", "Host timeouts must be positive timer-safe integers.");
+  }
+  return value;
+}
+function checkedOrigin(origin) {
+  try {
+    const url = new URL(origin);
+    const loopback = url.hostname === "localhost" || url.hostname === "[::1]" || /^127(?:\.[0-9]{1,3}){3}$/.test(url.hostname);
+    if (url.origin !== origin || url.username || url.password || !(url.protocol === "https:" || url.protocol === "http:" && loopback)) throw new Error();
+    return origin;
+  } catch {
+    throw new AplgError("E_INVALID_ARGUMENT", "Asset origins must be explicit HTTPS or loopback HTTP origins.");
+  }
+}
+function requireAssetOrigin(assetUrl, origins) {
+  if (!origins.includes(new URL(assetUrl).origin)) throw new AplgError("E_PERMISSION_DENIED", "The plugin asset origin is not allowed by this host.");
+}
+function randomId(prefix = "") {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  return prefix + Array.from(bytes, (value) => value.toString(16).padStart(2, "0")).join("");
+}
+function randomNonce() {
+  return btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(32)))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function bounded(operation, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new AplgError("E_TIMEOUT", "The host operation timed out.")), timeoutMs);
+    void Promise.resolve().then(operation).then(resolve, reject).finally(() => clearTimeout(timer));
+  });
+}
+
+// src/host/requests.ts
+function createSessionRequests(options) {
+  const timeoutMs = checkedTimeout(options.timeoutMs);
+  const active = /* @__PURE__ */ new Map();
+  return {
+    async run(operation, args, signal, onLate) {
+      if (signal?.aborted) throw new AplgError("E_CANCELLED", "The request was cancelled.");
+      if (!validateJson(args).ok || ["sessionId", "requestId", "principal", "pluginId", "token"].some((key) => Object.hasOwn(args, key))) {
+        throw new AplgError("E_INVALID_ARGUMENT", "Backend identity must come from the bound host session.");
+      }
+      if (active.size >= 64) throw new AplgError("E_LIMIT_EXCEEDED", "Too many active host requests.");
+      const requestId = randomId("request-");
+      const payload = { ...args, sessionId: options.sessionId, requestId };
+      return new Promise((resolve, reject) => {
+        let settled = false;
+        let sent = false;
+        const timer = setTimeout(() => stop(new AplgError("E_TIMEOUT", "The host request timed out.")), timeoutMs);
+        const abort = () => stop(new AplgError("E_CANCELLED", "The request was cancelled."));
+        function cleanup() {
+          active.delete(requestId);
+          clearTimeout(timer);
+          signal?.removeEventListener("abort", abort);
+        }
+        function stop(reason) {
+          if (settled) return;
+          settled = true;
+          cleanup();
+          reject(reason);
+          if (sent) void Promise.resolve().then(() => options.transport.call("request.cancel", { sessionId: options.sessionId, requestId })).catch(() => {
+          });
+        }
+        active.set(requestId, stop);
+        signal?.addEventListener("abort", abort, { once: true });
+        void Promise.resolve().then(() => {
+          if (settled) return;
+          sent = true;
+          return options.transport.call(operation, payload);
+        }).then((result) => {
+          if (!sent) return;
+          if (settled) {
+            if (onLate) void Promise.resolve().then(() => onLate(result)).catch(() => {
+            });
+            return;
+          }
+          settled = true;
+          cleanup();
+          if (!validateJson(result).ok) reject(new AplgError("E_INVALID_MESSAGE", "The backend returned an invalid JSON value."));
+          else resolve(result);
+        }, (error) => {
+          if (!settled) {
+            settled = true;
+            cleanup();
+            reject(error);
+          }
+        });
+      });
+    },
+    abortAll(reason) {
+      for (const cancel of [...active.values()]) cancel(reason);
+    }
+  };
+}
+
+// src/host/file-handles.ts
+function createFileHandleGuard(options) {
+  const handles = /* @__PURE__ */ new Set();
+  const opening = /* @__PURE__ */ new Set();
+  const releasing = /* @__PURE__ */ new Map();
+  let disposed = false;
+  let cleanup;
+  function handleOf(value) {
+    if (!validateJson(value).ok || !value || typeof value !== "object" || Array.isArray(value)) return void 0;
+    const handle = value.handle;
+    return typeof handle === "string" && /^[\x21-\x7e]{1,128}$/.test(handle) ? handle : void 0;
+  }
+  function release(handle) {
+    const previous = releasing.get(handle);
+    if (previous) return previous;
+    const work = bounded(() => options.transport.call("capability.call", {
+      sessionId: options.sessionId,
+      requestId: randomId("file-cleanup-"),
+      capability: "aplg.fs",
+      method: "transfer.abort",
+      params: { handle }
+    }), Math.min(options.timeoutMs, 1e3)).then((result) => {
+      if (result === null) handles.delete(handle);
+    }).catch(() => {
+    }).finally(() => releasing.delete(handle));
+    releasing.set(handle, work);
+    return work;
+  }
+  async function releaseUnclaimed(value) {
+    const handle = handleOf(value);
+    if (handle && !handles.has(handle)) {
+      handles.add(handle);
+      await release(handle);
+    }
+  }
+  return {
+    async call(method, params, signal) {
+      if (disposed) throw new AplgError("E_SESSION_CLOSED", "The file transfer session is closed.");
+      if (signal.aborted) throw new AplgError("E_CANCELLED", "The file transfer request was cancelled.");
+      if (!validateCapabilityRequest("aplg.fs", method, params).ok) throw new AplgError("E_INVALID_ARGUMENT", "Invalid filesystem request.");
+      const isOpen = method === "transfer.openRead" || method === "transfer.openWrite";
+      const reservation = /* @__PURE__ */ Symbol("file-open");
+      let received = false;
+      if (isOpen) {
+        if (handles.size + opening.size >= options.maxTransfers) throw new AplgError("E_LIMIT_EXCEEDED", "Too many file transfers in this session.");
+        opening.add(reservation);
+      } else if (method.startsWith("transfer.")) {
+        if (!handles.has(params.handle)) throw new AplgError("E_PERMISSION_DENIED", "This session does not own the file transfer handle.");
+      }
+      try {
+        const result = await options.requests.run("capability.call", { capability: "aplg.fs", method, params }, signal, isOpen ? async (late) => {
+          opening.delete(reservation);
+          await releaseUnclaimed(late);
+        } : void 0);
+        received = true;
+        opening.delete(reservation);
+        if (isOpen) {
+          const handle = handleOf(result);
+          if (handle && handles.has(handle)) throw new AplgError("E_INVALID_MESSAGE", "The backend reused an active file transfer handle.");
+          if (!validateCapabilityResult("aplg.fs", method, result).ok || disposed || signal.aborted) {
+            await releaseUnclaimed(result);
+            throw new AplgError(disposed || signal.aborted ? "E_SESSION_CLOSED" : "E_INVALID_MESSAGE", "The file transfer could not be opened safely.");
+          }
+          handles.add(handle);
+        } else {
+          if (!validateCapabilityResult("aplg.fs", method, result).ok) throw new AplgError("E_INVALID_MESSAGE", "The backend returned an invalid filesystem result.");
+          if (method === "transfer.finish" || method === "transfer.abort") handles.delete(params.handle);
+        }
+        return result;
+      } catch (error) {
+        const code = error && typeof error === "object" ? error.code : void 0;
+        if (received || !["E_TIMEOUT", "E_CANCELLED", "E_HOST_UNAVAILABLE", "E_SESSION_CLOSED"].includes(code ?? "")) opening.delete(reservation);
+        throw error;
+      }
+    },
+    async restore() {
+      if (disposed) return;
+      if (opening.size) throw new AplgError("E_HOST_UNAVAILABLE", "An interrupted file open is still unconfirmed.");
+      const previous = [...handles];
+      await Promise.all(previous.map(release));
+      if (!disposed && previous.some((handle) => handles.has(handle))) {
+        throw new AplgError("E_HOST_UNAVAILABLE", "Interrupted file transfers could not be released after reconnect.");
+      }
+    },
+    dispose() {
+      if (cleanup) return cleanup;
+      disposed = true;
+      opening.clear();
+      cleanup = Promise.allSettled([...handles].map(release)).then(() => {
+      });
+      return cleanup;
+    }
+  };
+}
+
+// src/host/event-router.ts
+function createEventRouter(options) {
+  const subscriptions = /* @__PURE__ */ new Map();
+  const backendIds = /* @__PURE__ */ new Map();
+  const buffered = [];
+  let bufferTimer;
+  let online = true;
+  let ready = true;
+  let disposed = false;
+  let generation = 0;
+  let opening = 0;
+  let cleanup;
+  let reconnecting;
+  function status(state) {
+    if (!disposed) options.send({ protocol: protocolVersion, kind: "connection", state });
+  }
+  function release(id) {
+    return bounded(() => options.transport.call("subscription.close", { sessionId: options.sessionId, subscriptionId: id }), options.timeoutMs).then(() => {
+    });
+  }
+  function resultId(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== 1 || typeof value.subscriptionId !== "string" || !/^[\x21-\x7e]{1,128}$/.test(value.subscriptionId)) {
+      throw new AplgError("E_INVALID_MESSAGE", "Invalid backend subscription identifier.");
+    }
+    return value.subscriptionId;
+  }
+  function lateRelease(value) {
+    try {
+      void release(resultId(value)).catch(() => {
+      });
+    } catch {
+    }
+  }
+  function expire() {
+    clearTimeout(bufferTimer);
+    bufferTimer = void 0;
+    const now = Date.now();
+    for (let index = buffered.length - 1; index >= 0; index--) if (buffered[index].expires <= now) buffered.splice(index, 1);
+    if (buffered.length) bufferTimer = setTimeout(expire, Math.max(1, buffered[0].expires - now));
+  }
+  function clearBuffer() {
+    buffered.length = 0;
+    clearTimeout(bufferTimer);
+    bufferTimer = void 0;
+  }
+  function deliver(subscription, event) {
+    if (event.seq <= subscription.backendSeq) return;
+    const delta = event.seq - subscription.backendSeq;
+    if (!Number.isSafeInteger(subscription.seq + delta)) {
+      void router.setConnected(false);
+      return;
+    }
+    if (delta > 1) {
+      status("disconnected");
+      status("connected");
+    }
+    subscription.backendSeq = event.seq;
+    subscription.seq += delta;
+    options.send({ protocol: protocolVersion, kind: "event", subscriptionId: subscription.id, seq: subscription.seq, payload: event.payload });
+  }
+  function flush() {
+    expire();
+    if (!ready || disposed) return;
+    for (let index = 0; index < buffered.length; ) {
+      const item = buffered[index];
+      const subscription = backendIds.get(item.event.subscriptionId);
+      if (subscription) {
+        buffered.splice(index, 1);
+        deliver(subscription, item.event);
+      } else index++;
+    }
+    if (opening === 0) clearBuffer();
+  }
+  async function attach(subscription, signal, restoring = false) {
+    const epoch = generation;
+    opening++;
+    try {
+      const value = await options.requests.run("subscription.open", { capability: subscription.capability, topic: subscription.topic }, signal, lateRelease);
+      const id = resultId(value);
+      if (restoring && !subscriptions.has(subscription.id)) {
+        void release(id).catch(() => {
+        });
+        return;
+      }
+      if (disposed || !online || epoch !== generation || !subscriptions.has(subscription.id) || signal?.aborted) {
+        void release(id).catch(() => {
+        });
+        throw new AplgError(disposed ? "E_SESSION_CLOSED" : "E_HOST_UNAVAILABLE", "The subscription session changed while opening.");
+      }
+      if (backendIds.has(id)) throw new AplgError("E_INVALID_MESSAGE", "The backend reused an active subscription identifier.");
+      subscription.backend = id;
+      subscription.backendSeq = 0;
+      backendIds.set(id, subscription);
+    } finally {
+      opening--;
+    }
+    flush();
+  }
+  const router = {
+    async open(capability, topic, signal) {
+      if (disposed) throw new AplgError("E_SESSION_CLOSED", "The plugin session is closed.");
+      if (!ready) throw new AplgError("E_HOST_UNAVAILABLE", "The plugin host is disconnected.");
+      if (subscriptions.size >= 64) throw new AplgError("E_LIMIT_EXCEEDED", "Too many subscriptions for this plugin session.");
+      const subscription = { id: randomId("subscription-"), capability, topic, backendSeq: 0, seq: 0 };
+      subscriptions.set(subscription.id, subscription);
+      try {
+        await attach(subscription, signal);
+        return subscription.id;
+      } catch (error) {
+        subscriptions.delete(subscription.id);
+        if (opening === 0) clearBuffer();
+        throw error;
+      }
+    },
+    async close(id) {
+      const subscription = subscriptions.get(id);
+      if (!subscription) throw new AplgError("E_PERMISSION_DENIED", "This session does not own the requested subscription.");
+      subscriptions.delete(id);
+      if (subscription.backend) {
+        backendIds.delete(subscription.backend);
+        await release(subscription.backend);
+      }
+    },
+    accept(event) {
+      if (disposed || !online || event.kind !== "capability.event" || event.sessionId !== options.sessionId) return;
+      const subscription = backendIds.get(event.subscriptionId);
+      if (ready && subscription) {
+        deliver(subscription, event);
+        return;
+      }
+      if (opening > 0 && buffered.length < 32) {
+        buffered.push({ event, expires: Date.now() + 2e3 });
+        if (!bufferTimer) bufferTimer = setTimeout(expire, 2e3);
+      }
+    },
+    isConnected() {
+      return ready && !disposed;
+    },
+    async setConnected(connected) {
+      if (disposed) return;
+      if (!connected) {
+        if (!online && !ready) return;
+        online = false;
+        ready = false;
+        generation++;
+        reconnecting = void 0;
+        options.requests.abortAll(new AplgError("E_HOST_UNAVAILABLE", "The host transport disconnected."));
+        clearBuffer();
+        for (const subscription of subscriptions.values()) {
+          if (subscription.backend) void release(subscription.backend).catch(() => {
+          });
+          subscription.backend = void 0;
+          subscription.backendSeq = 0;
+        }
+        backendIds.clear();
+        status("disconnected");
+        return;
+      }
+      if (ready) return;
+      if (reconnecting) return reconnecting;
+      online = true;
+      const epoch = generation;
+      reconnecting = (async () => {
+        try {
+          await Promise.all([...subscriptions.values()].map((subscription) => attach(subscription, void 0, true)));
+          if (disposed || epoch !== generation || !online) return;
+          ready = true;
+          status("connected");
+          flush();
+        } catch (error) {
+          if (disposed || epoch !== generation) return;
+          await router.setConnected(false);
+          throw error;
+        } finally {
+          if (epoch === generation) reconnecting = void 0;
+        }
+      })();
+      return reconnecting;
+    },
+    dispose() {
+      if (cleanup) return cleanup;
+      disposed = true;
+      online = false;
+      ready = false;
+      generation++;
+      options.requests.abortAll(new AplgError("E_SESSION_CLOSED", "The plugin session is closed."));
+      clearBuffer();
+      const closing = [...backendIds.keys()].map((id) => release(id));
+      subscriptions.clear();
+      backendIds.clear();
+      cleanup = Promise.allSettled(closing).then(() => {
+      });
+      return cleanup;
+    }
+  };
+  return router;
+}
+
+// src/host/view.ts
+function createManagedView(options) {
+  const { descriptor, container, transport } = options;
+  const document = container.ownerDocument;
+  const window2 = document.defaultView;
+  const iframe = document.createElement("iframe");
+  iframe.title = descriptor.manifest.name;
+  iframe.setAttribute("sandbox", "allow-scripts");
+  iframe.referrerPolicy = "no-referrer";
+  iframe.setAttribute("allow", "camera 'none'; microphone 'none'; geolocation 'none'");
+  const nonce = randomNonce();
+  const requests = createSessionRequests({ transport, sessionId: descriptor.sessionId, timeoutMs: options.requestTimeoutMs });
+  const fileHandles = createFileHandleGuard({ transport, requests, sessionId: descriptor.sessionId, timeoutMs: options.requestTimeoutMs, maxTransfers: descriptor.info.limits.fileTransfers });
+  let peer;
+  let closed = false;
+  let established = false;
+  let loaded = false;
+  let transportGeneration = 0;
+  let disposePromise;
+  let resolveReady;
+  let rejectReady;
+  const ready = new Promise((resolve, reject) => {
+    resolveReady = resolve;
+    rejectReady = reject;
+  });
+  const events = createEventRouter({
+    transport,
+    requests,
+    sessionId: descriptor.sessionId,
+    timeoutMs: options.requestTimeoutMs,
+    send(event) {
+      if (established && !closed) {
+        try {
+          peer?.sendEvent(event);
+        } catch {
+          void dispose(new AplgError("E_INVALID_MESSAGE", "The plugin event could not be delivered."));
+        }
+      }
+    }
+  });
+  const timer = setTimeout(() => {
+    void dispose(new AplgError("E_TIMEOUT", "The plugin handshake timed out."));
+  }, options.handshakeTimeoutMs);
+  const observer = new MutationObserver(() => {
+    if (!container.isConnected || iframe.parentElement !== container || iframe.getAttribute("sandbox") !== "allow-scripts") {
+      void dispose(new AplgError("E_SESSION_CLOSED", "The plugin container was removed or changed."));
+    }
+  });
+  const view = { pluginId: descriptor.manifest.id, element: iframe, dispose: () => dispose() };
+  function requireCapability(name, method) {
+    if (closed || !established) throw new AplgError("E_SESSION_CLOSED", "The plugin session is not active.");
+    if (!events.isConnected()) throw new AplgError("E_HOST_UNAVAILABLE", "The host transport is disconnected.");
+    const capability = Object.hasOwn(descriptor.info.capabilities, name) ? descriptor.info.capabilities[name] : void 0;
+    if (!capability || method !== void 0 && !capability.methods.includes(method)) {
+      throw new AplgError("E_CAPABILITY_UNAVAILABLE", "The session does not grant this capability or method.");
+    }
+  }
+  async function handle(request) {
+    if (request.operation === "capability.call") {
+      const { capability, method, params } = request.args;
+      requireCapability(capability, method);
+      const standard = Object.hasOwn(standardCapabilities, capability);
+      if (standard && !validateCapabilityRequest(capability, method, params).ok) throw new AplgError("E_INVALID_ARGUMENT", "The capability request is invalid.");
+      const result = capability === "aplg.fs" ? await fileHandles.call(method, params, request.signal) : await requests.run("capability.call", { capability, method, params }, request.signal);
+      if (standard && !validateCapabilityResult(capability, method, result).ok) throw new AplgError("E_INVALID_MESSAGE", "The backend capability result is invalid.");
+      return result;
+    }
+    if (request.operation === "subscription.open") {
+      requireCapability(request.args.capability);
+      return { subscriptionId: await events.open(request.args.capability, request.args.topic, request.signal) };
+    }
+    if (request.operation === "subscription.close") {
+      if (closed || !established) throw new AplgError("E_SESSION_CLOSED", "The plugin session is closed.");
+      await events.close(request.args.subscriptionId);
+      return null;
+    }
+    throw new AplgError("E_PERMISSION_DENIED", "The plugin cannot call this host operation.");
+  }
+  function receive(event) {
+    if (closed || peer) return;
+    if (event.source !== iframe.contentWindow || event.origin !== "null") return;
+    if (!validateJson(event.data, 4096).ok || !event.data || typeof event.data !== "object") return;
+    const data = event.data;
+    if (data.nonce !== nonce) return;
+    if (Object.keys(data).length !== 4 || data.channel !== "aplg.bootstrap" || data.protocol !== protocolVersion || data.kind !== "ready" || event.ports.length !== 0) {
+      event.ports.forEach((port) => port.close());
+      void dispose(new AplgError("E_PROTOCOL_MISMATCH", "The plugin bootstrap request is invalid."));
+      return;
+    }
+    const channel = new MessageChannel();
+    peer = createRpcPeer(channel.port1, { timeoutMs: options.requestTimeoutMs, maxBytes: descriptor.info.limits.controlBytes });
+    peer.onRequest(handle);
+    peer.onEvent((message) => {
+      if (message.kind !== "connection" || message.state === "disconnected") {
+        void dispose(new AplgError("E_INVALID_MESSAGE", "Plugins cannot emit host events."));
+        return;
+      }
+      if (message.state === "closed") {
+        void dispose();
+        return;
+      }
+      if (established) {
+        void dispose(new AplgError("E_INVALID_MESSAGE", "Duplicate plugin handshake acknowledgement."));
+        return;
+      }
+      if (!events.isConnected()) {
+        void dispose(new AplgError("E_HOST_UNAVAILABLE", "The host disconnected during plugin startup."));
+        return;
+      }
+      established = true;
+      clearTimeout(timer);
+      window2.removeEventListener("message", receive);
+      try {
+        peer.sendEvent({ protocol: protocolVersion, kind: "connection", state: "connected" });
+      } catch {
+        void dispose(new AplgError("E_SESSION_CLOSED", "The plugin handshake port closed."));
+        return;
+      }
+      resolveReady(view);
+    });
+    try {
+      iframe.contentWindow.postMessage({ channel: "aplg.bootstrap", protocol: protocolVersion, kind: "connect", nonce, info: descriptor.info }, "*", [channel.port2]);
+    } catch {
+      channel.port2.close();
+      void dispose(new AplgError("E_SESSION_CLOSED", "The plugin bootstrap could not be sent."));
+    }
+  }
+  function load() {
+    if (loaded) void dispose(new AplgError("E_SESSION_CLOSED", "The plugin document navigated or reloaded."));
+    loaded = true;
+  }
+  function leave() {
+    void dispose();
+  }
+  function dispose(reason = new AplgError("E_SESSION_CLOSED", "The plugin view closed.")) {
+    if (disposePromise) return disposePromise;
+    let done;
+    disposePromise = new Promise((resolve) => {
+      done = resolve;
+    });
+    closed = true;
+    clearTimeout(timer);
+    observer.disconnect();
+    window2.removeEventListener("message", receive);
+    window2.removeEventListener("pagehide", leave);
+    iframe.removeEventListener("load", load);
+    if (!established) rejectReady(reason);
+    requests.abortAll(reason);
+    peer?.close(reason);
+    iframe.remove();
+    options.onDisposed();
+    void Promise.allSettled([events.dispose(), fileHandles.dispose(), options.closeSession()]).then(() => done());
+    return disposePromise;
+  }
+  try {
+    window2.addEventListener("message", receive);
+    window2.addEventListener("pagehide", leave, { once: true });
+    iframe.addEventListener("load", load);
+    iframe.src = appendBootstrapHint(descriptor.assetUrl, nonce, window2.location.origin);
+    container.append(iframe);
+    for (let node = container; node; node = node.parentNode) observer.observe(node, { childList: true });
+    observer.observe(iframe, { attributes: true, attributeFilter: ["sandbox"] });
+  } catch {
+    void dispose(new AplgError("E_HOST_UNAVAILABLE", "The plugin container could not be mounted."));
+  }
+  return {
+    view,
+    ready,
+    dispose,
+    accept(event) {
+      if (closed) return;
+      if (event.kind === "session.closed") {
+        if (event.sessionId === descriptor.sessionId) void dispose();
+        return;
+      }
+      if (event.kind === "transport.state") {
+        if (event.state === "disconnected") {
+          transportGeneration++;
+          void events.setConnected(false);
+        } else {
+          if (events.isConnected()) return;
+          const generation = transportGeneration;
+          void fileHandles.restore().then(() => {
+            if (!closed && generation === transportGeneration) return events.setConnected(true);
+          }).catch(() => {
+            if (!closed && generation === transportGeneration) void dispose(new AplgError("E_HOST_UNAVAILABLE", "The plugin resources could not be restored."));
+          });
+        }
+      } else events.accept(event);
+    }
+  };
+}
+
+// src/host/host.ts
+function createPluginHost(options) {
+  const handshakeTimeoutMs = checkedTimeout(options.handshakeTimeoutMs ?? 1e4);
+  const requestTimeoutMs = checkedTimeout(options.requestTimeoutMs ?? 3e4);
+  const allowedAssetOrigins = options.allowedAssetOrigins?.map(checkedOrigin);
+  const views = /* @__PURE__ */ new Map();
+  const sessionOwners = /* @__PURE__ */ new Map();
+  const mounts = /* @__PURE__ */ new Map();
+  const inUse = /* @__PURE__ */ new Set();
+  const recentlyClosed = /* @__PURE__ */ new Set();
+  let disposed = false;
+  let online = true;
+  let subscribed;
+  let unsubscribe;
+  let subscriptionGeneration = 0;
+  let disposing;
+  function releaseListenerIfIdle() {
+    if (views.size || mounts.size) return;
+    subscriptionGeneration++;
+    const remove = unsubscribe;
+    unsubscribe = void 0;
+    subscribed = void 0;
+    recentlyClosed.clear();
+    try {
+      remove?.();
+    } catch {
+    }
+  }
+  function receive(input) {
+    const validation = validateHostEvent(input);
+    if (disposed || !validation.ok) return;
+    const event = validation.value;
+    if (event.kind === "transport.state") {
+      online = event.state === "connected";
+      for (const view of views.values()) view.accept(event);
+      return;
+    }
+    if (event.kind === "session.closed" && mounts.size) {
+      if (!recentlyClosed.has(event.sessionId) && recentlyClosed.size >= 256) {
+        for (const controller of mounts.values()) controller.abort(new AplgError("E_LIMIT_EXCEEDED", "Too many session changes occurred during startup."));
+      } else recentlyClosed.add(event.sessionId);
+    }
+    views.get(event.sessionId)?.accept(event);
+  }
+  async function ensureSubscribed() {
+    if (subscribed) return subscribed;
+    online = true;
+    const generation = subscriptionGeneration;
+    const pending = Promise.resolve().then(() => options.transport.subscribe(receive)).then((remove) => {
+      if (typeof remove !== "function") throw new AplgError("E_INVALID_MESSAGE", "The host transport returned an invalid event subscription.");
+      if (disposed || generation !== subscriptionGeneration) {
+        try {
+          remove();
+        } catch {
+        }
+        return;
+      }
+      unsubscribe = remove;
+    });
+    subscribed = pending;
+    try {
+      await pending;
+    } catch (error) {
+      if (subscribed === pending) subscribed = void 0;
+      throw error;
+    }
+  }
+  function closeBackend(sessionId) {
+    return bounded(() => options.transport.call("session.close", { sessionId }), requestTimeoutMs).then(() => {
+    });
+  }
+  function rawSessionId(raw) {
+    if (!validateJson(raw).ok || !raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+    const id = raw.sessionId;
+    return typeof id === "string" && /^[\x21-\x7e]{1,128}$/.test(id) ? id : void 0;
+  }
+  function waitFor(work, signal) {
+    return new Promise((resolve, reject) => {
+      if (signal.aborted) {
+        reject(signal.reason);
+        return;
+      }
+      const abort = () => reject(signal.reason);
+      signal.addEventListener("abort", abort, { once: true });
+      void work.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+  }
+  return {
+    async mount({ pluginId, container }) {
+      if (disposed) throw new AplgError("E_SESSION_CLOSED", "The plugin host is closed.");
+      if (typeof window === "undefined" || !container?.ownerDocument?.defaultView || !container.isConnected || typeof container.append !== "function") {
+        throw new AplgError("E_HOST_UNAVAILABLE", "Plugin mounting requires a connected browser container.");
+      }
+      if (typeof pluginId !== "string" || !/^[a-z0-9]+(?:[.-][a-z0-9]+)+$/.test(pluginId) || pluginId.length > 160) throw new AplgError("E_INVALID_ARGUMENT", "Invalid plugin identifier.");
+      if (inUse.has(container)) throw new AplgError("E_INVALID_ARGUMENT", "The container already holds a plugin view.");
+      if (views.size + mounts.size >= 64) throw new AplgError("E_LIMIT_EXCEEDED", "Too many plugin views.");
+      const origins = allowedAssetOrigins ?? [checkedOrigin(container.ownerDocument.defaultView.location.origin)];
+      const controller = new AbortController();
+      mounts.set(container, controller);
+      inUse.add(container);
+      const timer = setTimeout(() => controller.abort(new AplgError("E_TIMEOUT", "Plugin startup timed out.")), handshakeTimeoutMs);
+      let sessionId;
+      let closePromise;
+      let managed;
+      const close = () => {
+        if (closePromise) return closePromise;
+        if (!sessionId || sessionOwners.get(sessionId) !== controller) return Promise.resolve();
+        const ownedId = sessionId;
+        closePromise = closeBackend(ownedId).catch(() => {
+        }).finally(() => {
+          if (sessionOwners.get(ownedId) === controller) sessionOwners.delete(ownedId);
+        });
+        return closePromise;
+      };
+      try {
+        await waitFor(ensureSubscribed(), controller.signal);
+        if (!online) throw new AplgError("E_HOST_UNAVAILABLE", "The host transport is disconnected.");
+        const opening = Promise.resolve().then(() => {
+          if (controller.signal.aborted) throw controller.signal.reason;
+          return options.transport.call("session.open", { pluginId });
+        }).then((raw2) => {
+          const id = rawSessionId(raw2);
+          if (id && !sessionOwners.has(id)) {
+            sessionOwners.set(id, controller);
+            sessionId = id;
+          }
+          if (controller.signal.aborted || disposed) {
+            void close();
+            throw controller.signal.reason ?? new AplgError("E_SESSION_CLOSED", "The plugin host closed.");
+          }
+          return raw2;
+        });
+        const raw = await waitFor(opening, controller.signal);
+        const result = validateSessionDescriptor(raw);
+        if (!result.ok) throw new AplgError("E_PROTOCOL_MISMATCH", "The host returned an invalid plugin session.");
+        const descriptor = JSON.parse(JSON.stringify(result.value));
+        if (sessionOwners.get(descriptor.sessionId) !== controller || views.has(descriptor.sessionId)) throw new AplgError("E_PROTOCOL_MISMATCH", "The backend reused an active session.");
+        if (descriptor.manifest.id !== pluginId) throw new AplgError("E_PROTOCOL_MISMATCH", "The backend returned a different plugin identity.");
+        if (recentlyClosed.has(descriptor.sessionId)) throw new AplgError("E_SESSION_CLOSED", "The plugin session closed during startup.");
+        requireAssetOrigin(descriptor.assetUrl, origins);
+        if (controller.signal.aborted || disposed || !container.isConnected || !online) throw controller.signal.reason ?? new AplgError("E_SESSION_CLOSED", "The plugin container is no longer available.");
+        managed = createManagedView({
+          descriptor,
+          container,
+          transport: options.transport,
+          handshakeTimeoutMs,
+          requestTimeoutMs,
+          closeSession: close,
+          onDisposed() {
+            if (views.get(descriptor.sessionId) === managed) views.delete(descriptor.sessionId);
+            inUse.delete(container);
+            releaseListenerIfIdle();
+          }
+        });
+        views.set(descriptor.sessionId, managed);
+        const view = await waitFor(managed.ready, controller.signal);
+        if (controller.signal.aborted || disposed) throw controller.signal.reason ?? new AplgError("E_SESSION_CLOSED", "The plugin host closed.");
+        return view;
+      } catch (error) {
+        if (managed) {
+          views.delete(sessionId);
+          void managed.dispose(error instanceof Error ? error : void 0);
+        } else if (sessionId) void close();
+        inUse.delete(container);
+        throw error;
+      } finally {
+        clearTimeout(timer);
+        mounts.delete(container);
+        if (mounts.size === 0) recentlyClosed.clear();
+        releaseListenerIfIdle();
+      }
+    },
+    dispose() {
+      if (disposing) return disposing;
+      disposed = true;
+      for (const controller of mounts.values()) controller.abort(new AplgError("E_SESSION_CLOSED", "The plugin host closed."));
+      const closing = [...views.values()].map((view) => view.dispose());
+      views.clear();
+      mounts.clear();
+      inUse.clear();
+      releaseListenerIfIdle();
+      disposing = Promise.allSettled(closing).then(() => {
+      });
+      return disposing;
+    }
+  };
+}
+export {
+  createPluginHost
+};