@burdenoff/fe-libs 2026.521.2 → 2026.521.4

package/dist/shared/plugins/iframe-mount/PluginIframe.d.ts

@@ -0,0 +1,75 @@
+import { ReactNode } from 'react';
+import { PluginCapabilities, PluginErrorPayload, PluginEventEmitPayload, PluginResizeRequestPayload, PluginSetBadgePayload, PluginSetTitlePayload } from './protocol/index.js';
+export interface PluginIframeRpcContext {
+    capabilities: PluginCapabilities;
+    /** Reflects the iframe iframe back through for downstream handlers. */
+    iframe: HTMLIFrameElement;
+}
+export type PluginIframeRpcHandler = (method: string, args: unknown, ctx: PluginIframeRpcContext) => Promise<unknown>;
+export interface PluginIframeProps {
+    /** Absolute or relative URL the iframe loads. */
+    src: string;
+    /** Origin the iframe is allowed to postMessage to / from. */
+    origin: string;
+    /** Mount point id passed to the plugin in `host:init`. */
+    mountPoint: string;
+    /** Context payload passed to the plugin in `host:init` (e.g. `{ vibeId }`). */
+    context: Record<string, unknown>;
+    /** Agent id whose tunnel serves the iframe. */
+    agentId: string;
+    /** Profile name (CLI segment on the agent). */
+    profile: string;
+    /** Tunnel base URL the plugin should call for REST. */
+    tunnelUrl: string;
+    /** Iframe token scoped to the plugin's `capabilities.restPaths`. */
+    iframeToken: string;
+    /** Capabilities the plugin declared in its manifest. Used to derive sandbox. */
+    capabilities: PluginCapabilities;
+    /** Theme broadcast to the plugin. Updates re-flow into the iframe via host:theme-change. */
+    theme: {
+        colorMode: 'light' | 'dark';
+        tokens: Record<string, string>;
+    };
+    /** Locale broadcast to the plugin. */
+    locale: string;
+    /** Feature-flag snapshot broadcast to the plugin. */
+    featureFlags: Record<string, boolean>;
+    /** Host version surfaced via `host:init`. */
+    hostVersion: string;
+    /** RPC handler the host wires up. Method allow-list is enforced separately. */
+    onRpcRequest: PluginIframeRpcHandler;
+    /** Called when the plugin emits an event UP to the host EventBus. */
+    onPluginEvent?: (payload: PluginEventEmitPayload) => void;
+    /** Called when the plugin asks to update its tab/widget badge. */
+    onBadgeRequest?: (value: PluginSetBadgePayload['value']) => void;
+    /** Called when the plugin asks to update its tab/widget title. */
+    onTitleRequest?: (value: PluginSetTitlePayload['value']) => void;
+    /** Called when the plugin asks the host to resize the iframe. Host decides. */
+    onResizeRequest?: (opts: PluginResizeRequestPayload) => void;
+    /** Called when the plugin self-reports a runtime error. */
+    onPluginError?: (payload: PluginErrorPayload) => void;
+    /** Rendered while the iframe is loading / before `plugin:ready`. */
+    loadingFallback?: ReactNode;
+    /** Rendered when the handshake times out. Receives the error message. */
+    errorFallback?: (error: {
+        message: string;
+    }) => ReactNode;
+    /** Override the 10s ready timeout. */
+    readyTimeoutMs?: number;
+    /** Forwarded `<iframe>` attributes for layout / styling. */
+    title?: string;
+    className?: string;
+    style?: React.CSSProperties;
+}
+/**
+ * Host-side iframe primitive. Mounts an iframe at `src`, runs the v1
+ * postMessage handshake, derives the sandbox attribute from the
+ * plugin's manifest capabilities, and translates the plugin's RPC
+ * requests into host service calls.
+ *
+ * Cross-product: depends only on the inlined `./protocol` + `./client` envelope
+ * but not on any product-specific gateway / tunnel concept. Host pages
+ * supply the URL + token + RPC handler.
+ */
+export declare function PluginIframe(props: PluginIframeProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=PluginIframe.d.ts.map

package/dist/shared/plugins/iframe-mount/PluginIframe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginIframe.d.ts","sourceRoot":"","sources":["../../../../src/shared/plugins/iframe-mount/PluginIframe.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAwC,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAG7E,OAAO,KAAK,EAEV,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EAEtB,0BAA0B,EAE1B,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAY7B,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,kBAAkB,CAAC;IACjC,uEAAuE;IACvE,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,MAAM,sBAAsB,GAAG,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,sBAAsB,KACxB,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,YAAY,EAAE,kBAAkB,CAAC;IACjC,4FAA4F;IAC5F,KAAK,EAAE;QAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACvE,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,YAAY,EAAE,sBAAsB,CAAC;IACrC,qEAAqE;IACrE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAC1D,kEAAkE;IAClE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACjE,kEAAkE;IAClE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACjE,+EAA+E;IAC/E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC7D,2DAA2D;IAC3D,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACtD,oEAAoE;IACpE,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,yEAAyE;IACzE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,CAAC;IAC1D,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,2CA6QpD"}

package/dist/shared/plugins/iframe-mount/PluginIframe.js

@@ -0,0 +1,158 @@
+import { deriveSandbox as e } from "./sandbox.js";
+import { ParentMessageBus as t, buildHostEnvelope as n } from "./client/message-bus.js";
+import { RpcDispatcher as r } from "./client/rpc.js";
+import { useEffect as i, useMemo as a, useRef as o, useState as s } from "react";
+import { jsx as c, jsxs as l } from "react/jsx-runtime";
+//#region src/shared/plugins/iframe-mount/PluginIframe.tsx
+var u = 1e4;
+function d(d) {
+	let { src: f, origin: p, mountPoint: m, context: h, agentId: g, profile: _, tunnelUrl: v, iframeToken: y, capabilities: b, theme: x, locale: S, featureFlags: C, hostVersion: w, onRpcRequest: T, onPluginEvent: E, onBadgeRequest: D, onTitleRequest: O, onResizeRequest: k, onPluginError: A, loadingFallback: j = null, errorFallback: M, readyTimeoutMs: N = u, title: P, className: F, style: I } = d, L = o(null), R = o(null), z = o(null), B = o(!1), [V, H] = s("loading"), [U, W] = s(null), ee = a(() => e(b), [b]), G = o({
+		iframeToken: y,
+		tunnelUrl: v,
+		mountPoint: m,
+		context: h,
+		agentId: g,
+		profile: _,
+		theme: x,
+		locale: S,
+		capabilities: b,
+		featureFlags: C,
+		sdkVersion: "1",
+		hostVersion: w
+	});
+	G.current = {
+		iframeToken: y,
+		tunnelUrl: v,
+		mountPoint: m,
+		context: h,
+		agentId: g,
+		profile: _,
+		theme: x,
+		locale: S,
+		capabilities: b,
+		featureFlags: C,
+		sdkVersion: "1",
+		hostVersion: w
+	};
+	let K = () => G.current, q = o(T);
+	q.current = T;
+	let J = o(b);
+	J.current = b;
+	let Y = o(E);
+	Y.current = E;
+	let X = o(D);
+	X.current = D;
+	let Z = o(O);
+	Z.current = O;
+	let Q = o(k);
+	Q.current = k;
+	let $ = o(A);
+	return $.current = A, i(() => {
+		let e = L.current;
+		if (!e) return;
+		let i = e.contentWindow, a = new t({
+			allowedOrigins: [p],
+			iframe: e,
+			expectedSource: i
+		});
+		R.current = a;
+		let o = new r({ send(e, t, n, r) {} });
+		z.current = o;
+		let s = setTimeout(() => {
+			B.current || (H("error"), W(`Plugin did not respond within ${N}ms`));
+		}, N), c = a.on(async (t) => {
+			switch (t.kind) {
+				case "plugin:ready":
+					t.payload, B.current = !0, H("ready"), W(null), a.send(n("host:init", K()));
+					return;
+				case "plugin:rpc-request": {
+					let r = t.payload, i = t.requestId;
+					if (!i) return;
+					if (!J.current.rpcMethods.includes(r.method)) {
+						a.send(n("host:rpc-response", {
+							ok: !1,
+							error: {
+								code: "capability_denied",
+								message: `Method '${r.method}' is not in the plugin's declared rpcMethods.`
+							}
+						}, i));
+						return;
+					}
+					try {
+						let t = await q.current(r.method, r.args, {
+							capabilities: J.current,
+							iframe: e
+						});
+						a.send(n("host:rpc-response", {
+							ok: !0,
+							result: t
+						}, i));
+					} catch (e) {
+						let t = e instanceof Error ? e.message : String(e), r = e && typeof e == "object" && "code" in e ? String(e.code ?? "rpc_handler_failed") : "rpc_handler_failed";
+						a.send(n("host:rpc-response", {
+							ok: !1,
+							error: {
+								code: r,
+								message: t
+							}
+						}, i));
+					}
+					return;
+				}
+				case "plugin:event-emit":
+					Y.current?.(t.payload);
+					return;
+				case "plugin:set-badge":
+					X.current?.(t.payload.value);
+					return;
+				case "plugin:set-title":
+					Z.current?.(t.payload.value);
+					return;
+				case "plugin:resize-request":
+					Q.current?.(t.payload);
+					return;
+				case "plugin:error":
+					$.current?.(t.payload);
+					return;
+			}
+		});
+		return () => {
+			clearTimeout(s), c(), a.send(n("host:dispose", {})), a.dispose(), o.rejectAll(/* @__PURE__ */ Error("PluginIframe unmounted")), R.current = null, z.current = null, B.current = !1;
+		};
+	}, [f, p]), i(() => {
+		B.current && R.current?.send(n("host:theme-change", {
+			colorMode: x.colorMode,
+			tokens: x.tokens
+		}));
+	}, [x.colorMode, x.tokens]), i(() => {
+		B.current && R.current?.send(n("host:locale-change", { locale: S }));
+	}, [S]), i(() => {
+		B.current && R.current?.send(n("host:context-change", { context: h }));
+	}, [h]), i(() => {
+		if (B.current) for (let [e, t] of Object.entries(C)) R.current?.send(n("host:feature-flag", {
+			flag: e,
+			value: t
+		}));
+	}, [C]), /* @__PURE__ */ l("div", {
+		className: F,
+		style: I,
+		children: [
+			V === "error" && M ? M({ message: U ?? "" }) : null,
+			V === "loading" ? j : null,
+			/* @__PURE__ */ c("iframe", {
+				ref: L,
+				src: f,
+				title: P ?? "Plugin iframe",
+				sandbox: ee,
+				style: {
+					width: "100%",
+					height: "100%",
+					border: 0,
+					display: V === "error" ? "none" : "block"
+				}
+			})
+		]
+	});
+}
+//#endregion
+export { d as PluginIframe };

package/dist/shared/plugins/iframe-mount/PluginMount.d.ts

@@ -0,0 +1,59 @@
+import { ReactNode } from 'react';
+import { PluginIframe, PluginIframeProps, PluginIframeRpcHandler } from './PluginIframe';
+import { DiscoveredContribution, InProcessPluginEntry, RuntimePreference } from './types';
+export interface PluginMountChildProps {
+    /** Discovered contribution being mounted. */
+    contribution: DiscoveredContribution;
+    /** The chosen runtime (`'iframe'` or `'in-process'`). */
+    runtime: 'iframe' | 'in-process';
+    /** Rendered iframe element (only present for `runtime === 'iframe'`). */
+    iframeProps?: Omit<PluginIframeProps, 'loadingFallback' | 'errorFallback' | 'title' | 'className' | 'style'>;
+    /** Rendered React component (only present for `runtime === 'in-process'`). */
+    inProcessNode?: ReactNode;
+}
+export interface PluginMountProps {
+    /** Discovered iframe contributions from the agent. */
+    contributions: DiscoveredContribution[];
+    /** In-process plugin components registered by the host shell. */
+    inProcess?: InProcessPluginEntry[];
+    /** Per-page context passed to the plugin via `host:init`. */
+    context: Record<string, unknown>;
+    /** Agent id whose tunnel serves the iframe contributions. */
+    agentId: string;
+    /** Theme broadcast to plugin iframes (and to in-process plugins via the bridge). */
+    theme: {
+        colorMode: 'light' | 'dark';
+        tokens: Record<string, string>;
+    };
+    /** Locale broadcast to plugins. */
+    locale: string;
+    /** Feature flags surfaced to plugins. */
+    featureFlags: Record<string, boolean>;
+    /** Host shell version surfaced via `host:init`. */
+    hostVersion: string;
+    /** RPC handler that resolves `plugin:rpc-request` calls. */
+    onRpcRequest: PluginIframeRpcHandler;
+    /**
+     * Preference between runtimes when a contribution declares both. The
+     * default is `iframe` (sandboxed; works for user-installable plugins).
+     * Pages that want first-party in-process plugins to win can pass
+     * `'in-process'`.
+     */
+    prefer?: RuntimePreference;
+    /**
+     * Renders each contribution. The host page is responsible for the
+     * actual tab/widget chrome; this primitive just feeds it the right
+     * props.
+     */
+    children: (props: PluginMountChildProps) => ReactNode;
+}
+/**
+ * Iterator over discovered contributions. Picks a runtime per
+ * contribution (iframe or in-process), mints/refreshes the iframe
+ * token, and delegates rendering to the consumer via the `children`
+ * render-prop.
+ */
+export declare function PluginMount(props: PluginMountProps): import("react/jsx-runtime").JSX.Element;
+/** Re-export so consumers can render the iframe directly from their child render-prop. */
+export { PluginIframe };
+//# sourceMappingURL=PluginMount.d.ts.map

package/dist/shared/plugins/iframe-mount/PluginMount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginMount.d.ts","sourceRoot":"","sources":["../../../../src/shared/plugins/iframe-mount/PluginMount.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAwC,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAE7E,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACnG,OAAO,KAAK,EACV,sBAAsB,EACtB,oBAAoB,EAEpB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,YAAY,EAAE,sBAAsB,CAAC;IACrC,yDAAyD;IACzD,OAAO,EAAE,QAAQ,GAAG,YAAY,CAAC;IACjC,yEAAyE;IACzE,WAAW,CAAC,EAAE,IAAI,CAChB,iBAAiB,EACjB,iBAAiB,GAAG,eAAe,GAAG,OAAO,GAAG,WAAW,GAAG,OAAO,CACtE,CAAC;IACF,8EAA8E;IAC9E,aAAa,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,aAAa,EAAE,sBAAsB,EAAE,CAAC;IACxC,iEAAiE;IACjE,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,KAAK,EAAE;QAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACvE,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,YAAY,EAAE,sBAAsB,CAAC;IACrC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,SAAS,CAAC;CACvD;AAOD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,2CAgGlD;AAkKD,0FAA0F;AAC1F,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/shared/plugins/iframe-mount/PluginMount.js

@@ -0,0 +1,129 @@
+import "./PluginIframe.js";
+import { useEffect as e, useMemo as t, useRef as n, useState as r } from "react";
+import { Fragment as i, jsx as a } from "react/jsx-runtime";
+//#region src/shared/plugins/iframe-mount/PluginMount.tsx
+function o(e) {
+	let { contributions: n, inProcess: r = [], context: o, agentId: l, theme: u, locale: d, featureFlags: f, hostVersion: p, onRpcRequest: m, prefer: h = "iframe", children: g } = e, _ = t(() => {
+		let e = /* @__PURE__ */ new Map();
+		for (let t of r) e.set(`${t.pluginKey}::${t.mountPoint}::${t.id}`, t);
+		return e;
+	}, [r]);
+	return /* @__PURE__ */ a(i, { children: n.map((e) => {
+		let { contribution: t, tunnel: n, url: r } = e, i = _.get(`${e.pluginKey}::${t.mountPoint}::${t.id}`), v = t.runtimes.includes("iframe"), y = t.runtimes.includes("in-process") && !!i, b = null;
+		if (h === "in-process" && y ? b = "in-process" : h === "iframe" && v || v ? b = "iframe" : y && (b = "in-process"), !b) return console.warn(`[PluginMount] No runtime available for contribution ${t.id} (mount ${t.mountPoint}). Declared:`, t.runtimes), null;
+		if (b === "in-process") {
+			let n = i.Component;
+			return /* @__PURE__ */ a(s, {
+				child: g,
+				childProps: {
+					contribution: e,
+					runtime: "in-process",
+					inProcessNode: /* @__PURE__ */ a(n, { context: o })
+				}
+			}, `in-process:${e.pluginKey}::${t.mountPoint}::${t.id}`);
+		}
+		return /* @__PURE__ */ a(c, {
+			discovered: e,
+			tunnel: n,
+			url: r,
+			context: o,
+			agentId: l,
+			theme: u,
+			locale: d,
+			featureFlags: f,
+			hostVersion: p,
+			onRpcRequest: m,
+			render: (t) => g({
+				contribution: e,
+				runtime: "iframe",
+				iframeProps: t
+			})
+		}, `iframe:${e.pluginKey}::${t.mountPoint}::${t.id}`);
+	}) });
+}
+function s(e) {
+	return /* @__PURE__ */ a(i, { children: e.child(e.childProps) });
+}
+function c(o) {
+	let { discovered: s, tunnel: c, url: l, context: u, agentId: d, theme: f, locale: p, featureFlags: m, hostVersion: h, onRpcRequest: g, render: _ } = o, [v, y] = r({
+		token: null,
+		expiresAt: 0
+	}), b = n(!0), x = s.capabilities.restPaths.join("|"), S = t(() => {
+		let e = s.capabilities.restPaths;
+		return e && e.length > 0 ? e : [`/ui/${s.pluginKey}`];
+	}, [s.pluginKey, x]);
+	if (e(() => {
+		return b.current = !0, e(S), () => {
+			b.current = !1;
+		};
+		async function e(e) {
+			try {
+				let { token: t, expiresAt: n } = await c.mintIframeToken({ pathPrefixes: e });
+				if (!b.current) return;
+				let r = Date.parse(n);
+				if (!Number.isFinite(r)) {
+					y({
+						token: null,
+						expiresAt: 0
+					});
+					return;
+				}
+				y({
+					token: t,
+					expiresAt: r
+				});
+			} catch {
+				if (!b.current) return;
+				y({
+					token: null,
+					expiresAt: 0
+				});
+			}
+		}
+	}, [c, S]), e(() => {
+		if (!v.token || v.expiresAt <= 0) return;
+		let e = Math.max(5e3, v.expiresAt - Date.now() - 6e4);
+		if (!Number.isFinite(e)) return;
+		let t = setTimeout(() => {
+			c.mintIframeToken({ pathPrefixes: S }).then(({ token: e, expiresAt: t }) => {
+				if (!b.current) return;
+				let n = Date.parse(t);
+				Number.isFinite(n) && y({
+					token: e,
+					expiresAt: n
+				});
+			}).catch(() => {});
+		}, e);
+		return () => clearTimeout(t);
+	}, [
+		v.token,
+		v.expiresAt,
+		c,
+		S
+	]), !v.token) return null;
+	let C = (() => {
+		try {
+			return new URL(c.tunnelUrl).origin;
+		} catch {
+			return c.tunnelUrl;
+		}
+	})();
+	return /* @__PURE__ */ a(i, { children: _({
+		src: `${c.tunnelUrl.replace(/\/$/, "")}${l.startsWith("/") ? l : `/${l}`}?vt=${encodeURIComponent(v.token)}`,
+		origin: C,
+		mountPoint: s.contribution.mountPoint,
+		context: u,
+		agentId: d,
+		profile: c.profile,
+		tunnelUrl: c.tunnelUrl,
+		iframeToken: v.token,
+		capabilities: s.capabilities,
+		theme: f,
+		locale: p,
+		featureFlags: m,
+		hostVersion: h,
+		onRpcRequest: g
+	}) });
+}
+//#endregion
+export { o as PluginMount };

package/dist/shared/plugins/iframe-mount/client/index.d.ts

@@ -0,0 +1,3 @@
+export * from './message-bus.js';
+export * from './rpc.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/plugins/iframe-mount/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/shared/plugins/iframe-mount/client/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC"}

package/dist/shared/plugins/iframe-mount/client/message-bus.d.ts

@@ -0,0 +1,71 @@
+import { Envelope, HostEnvelope, HostOp, PluginEnvelope, PluginOp } from '../protocol/envelope.js';
+export type EnvelopeHandler<E extends Envelope = Envelope> = (env: E) => void;
+/** Subset of the DOM `Window` we depend on. Tests pass a stub. */
+export interface MessageWindow {
+    addEventListener(type: 'message', listener: (event: MessageEvent) => void, options?: {
+        signal?: AbortSignal;
+    }): void;
+    removeEventListener(type: 'message', listener: (event: MessageEvent) => void): void;
+}
+export interface MessageTarget {
+    postMessage(message: unknown, targetOrigin: string): void;
+}
+export interface BusOptions {
+    /** Identity check on every receive. Tightens the trust boundary. */
+    allowedOrigins: string[];
+    /** Optional handle to a specific `MessageEventSource` we expect. */
+    expectedSource?: MessageEventSource | null;
+    /** Stub-friendly window. Defaults to the platform `window` at runtime. */
+    window?: MessageWindow;
+}
+declare abstract class BaseMessageBus<TSend extends Envelope, TRecv extends Envelope> {
+    protected readonly options: BusOptions;
+    protected handlers: Set<EnvelopeHandler<TRecv>>;
+    protected disposed: boolean;
+    private readonly listener;
+    private readonly hostWindow;
+    constructor(options: BusOptions);
+    on(handler: EnvelopeHandler<TRecv>): () => void;
+    dispose(): void;
+    protected abstract get target(): MessageTarget;
+    protected abstract get targetOrigin(): string;
+    protected abstract isExpectedDirection(env: Envelope): env is TRecv;
+    send(envelope: TSend): void;
+    private handleMessage;
+}
+export interface IframeBusOptions extends BusOptions {
+    /** The parent we postMessage UP to. Defaults to `window.parent`. */
+    parent?: MessageTarget;
+}
+/**
+ * The bus a plugin instance uses to talk to its host shell. Send a
+ * `PluginEnvelope` UP, receive `HostEnvelope`s DOWN.
+ */
+export declare class IframeMessageBus extends BaseMessageBus<PluginEnvelope, HostEnvelope> {
+    private readonly parentTarget;
+    private readonly origin;
+    constructor(opts: IframeBusOptions);
+    protected get target(): MessageTarget;
+    protected get targetOrigin(): string;
+    protected isExpectedDirection(env: Envelope): env is HostEnvelope;
+}
+export interface ParentBusOptions extends BusOptions {
+    /** The iframe element we postMessage DOWN to. */
+    iframe: HTMLIFrameElement;
+}
+/**
+ * The bus a host page uses to talk to one iframe-mounted plugin instance.
+ * Send a `HostEnvelope` DOWN, receive `PluginEnvelope`s UP.
+ */
+export declare class ParentMessageBus extends BaseMessageBus<HostEnvelope, PluginEnvelope> {
+    private readonly iframe;
+    private readonly origin;
+    constructor(opts: ParentBusOptions);
+    protected get target(): MessageTarget;
+    protected get targetOrigin(): string;
+    protected isExpectedDirection(env: Envelope): env is PluginEnvelope;
+}
+export declare function buildHostEnvelope<P = unknown>(kind: HostOp, payload: P, requestId?: string): HostEnvelope<P>;
+export declare function buildPluginEnvelope<P = unknown>(kind: PluginOp, payload: P, requestId?: string): PluginEnvelope<P>;
+export {};
+//# sourceMappingURL=message-bus.d.ts.map

package/dist/shared/plugins/iframe-mount/client/message-bus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-bus.d.ts","sourceRoot":"","sources":["../../../../../src/shared/plugins/iframe-mount/client/message-bus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,MAAM,EACX,KAAK,cAAc,EACnB,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC;AAE9E,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,EACvC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACjC,IAAI,CAAC;IACR,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,IAAI,CAAC;CACrF;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oEAAoE;IACpE,cAAc,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC3C,0EAA0E;IAC1E,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAiBD,uBAAe,cAAc,CAAC,KAAK,SAAS,QAAQ,EAAE,KAAK,SAAS,QAAQ;IAM9D,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU;IALlD,SAAS,CAAC,QAAQ,8BAAqC;IACvD,SAAS,CAAC,QAAQ,UAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgC;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;gBAEZ,OAAO,EAAE,UAAU;IAMlD,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI;IAK/C,OAAO,IAAI,IAAI;IAOf,SAAS,CAAC,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC;IAC/C,SAAS,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC;IAC9C,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,IAAI,KAAK;IAEnE,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,IAAI;IAU3B,OAAO,CAAC,aAAa;CAsBtB;AAID,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,oEAAoE;IACpE,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,cAAc,EAAE,YAAY,CAAC;IAChF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,IAAI,EAAE,gBAAgB;IAelC,SAAS,KAAK,MAAM,IAAI,aAAa,CAEpC;IAED,SAAS,KAAK,YAAY,IAAI,MAAM,CAEnC;IAED,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,IAAI,YAAY;CAGlE;AAID,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,iDAAiD;IACjD,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,YAAY,EAAE,cAAc,CAAC;IAChF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,IAAI,EAAE,gBAAgB;IAOlC,SAAS,KAAK,MAAM,IAAI,aAAa,CAMpC;IAED,SAAS,KAAK,YAAY,IAAI,MAAM,CAEnC;IAED,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,IAAI,cAAc;CAGpE;AAID,wBAAgB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAC3C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,CAAC,EACV,SAAS,CAAC,EAAE,MAAM,GACjB,YAAY,CAAC,CAAC,CAAC,CAEjB;AAED,wBAAgB,mBAAmB,CAAC,CAAC,GAAG,OAAO,EAC7C,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,CAAC,EACV,SAAS,CAAC,EAAE,MAAM,GACjB,cAAc,CAAC,CAAC,CAAC,CAEnB"}

package/dist/shared/plugins/iframe-mount/client/message-bus.js

@@ -0,0 +1,65 @@
+import { isEnvelope as e, isPluginEnvelope as t } from "../protocol/envelope.js";
+//#region src/shared/plugins/iframe-mount/client/message-bus.ts
+function n(e, t) {
+	return t.includes("*") ? !0 : t.includes(e);
+}
+function r() {
+	if (typeof globalThis > "u" || !("window" in globalThis)) throw Error("No `window` available — postMessage transport unavailable");
+	return globalThis.window;
+}
+var i = class {
+	handlers = /* @__PURE__ */ new Set();
+	disposed = !1;
+	listener;
+	hostWindow;
+	constructor(e) {
+		this.options = e, this.hostWindow = e.window ?? r(), this.listener = (e) => this.handleMessage(e), this.hostWindow.addEventListener("message", this.listener);
+	}
+	on(e) {
+		return this.handlers.add(e), () => this.handlers.delete(e);
+	}
+	dispose() {
+		this.disposed || (this.disposed = !0, this.handlers.clear(), this.hostWindow.removeEventListener("message", this.listener));
+	}
+	send(e) {
+		if (!this.disposed) {
+			if (e.v !== 1) throw Error(`Refusing to send envelope with version ${e.v} — runtime expects v1`);
+			this.target.postMessage(e, this.targetOrigin);
+		}
+	}
+	handleMessage(t) {
+		if (!this.disposed && n(t.origin, this.options.allowedOrigins) && !(this.options.expectedSource !== void 0 && this.options.expectedSource !== null && t.source !== this.options.expectedSource) && e(t.data) && this.isExpectedDirection(t.data)) for (let e of this.handlers) try {
+			e(t.data);
+		} catch (e) {
+			console.error("[vibecontrols-ui-plugin-sdk] handler threw", e);
+		}
+	}
+}, a = class extends i {
+	iframe;
+	origin;
+	constructor(e) {
+		super(e), this.iframe = e.iframe, this.origin = e.allowedOrigins.length === 1 ? e.allowedOrigins[0] : e.allowedOrigins[0] ?? "*";
+	}
+	get target() {
+		let e = this.iframe.contentWindow;
+		if (!e) throw Error("iframe.contentWindow is null — iframe is not yet loaded");
+		return e;
+	}
+	get targetOrigin() {
+		return this.origin;
+	}
+	isExpectedDirection(e) {
+		return t(e);
+	}
+};
+function o(e, t, n) {
+	return {
+		v: 1,
+		source: "host",
+		kind: e,
+		payload: t,
+		requestId: n
+	};
+}
+//#endregion
+export { a as ParentMessageBus, o as buildHostEnvelope };

package/dist/shared/plugins/iframe-mount/client/rpc.d.ts

@@ -0,0 +1,25 @@
+import { HostRpcProgressPayload, HostRpcResponsePayload } from '../protocol/envelope.js';
+export type RpcMethod = string;
+export interface RpcCallOpts<TProgress = unknown> {
+    /** Receive intermediate progress events for a streaming call. */
+    onProgress?: (progress: TProgress) => void;
+    /** Optional abort. The dispatcher fires `controller.abort` reasons through. */
+    signal?: AbortSignal;
+    /** Overrides the default 30s timeout. Set to `null` to disable. */
+    timeoutMs?: number | null;
+}
+export interface RpcSender {
+    /** Push the outbound RPC over the underlying transport. */
+    send(requestId: string, method: RpcMethod, args: unknown, streaming: boolean): void;
+}
+export declare class RpcDispatcher {
+    private readonly sender;
+    private readonly pending;
+    constructor(sender: RpcSender);
+    call<TResult = unknown, TProgress = unknown>(method: RpcMethod, args: unknown, opts?: RpcCallOpts<TProgress>): Promise<TResult>;
+    handleResponse(requestId: string, payload: HostRpcResponsePayload): void;
+    handleProgress(requestId: string, payload: HostRpcProgressPayload): void;
+    rejectAll(reason: unknown): void;
+    private settle;
+}
+//# sourceMappingURL=rpc.d.ts.map

package/dist/shared/plugins/iframe-mount/client/rpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../../../../../src/shared/plugins/iframe-mount/client/rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAE9F,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,WAAW,WAAW,CAAC,SAAS,GAAG,OAAO;IAC9C,iEAAiE;IACjE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,IAAI,CAAC;IAC3C,+EAA+E;IAC/E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAWD,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;CACrF;AAUD,qBAAa,aAAa;IAGZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;gBAE5B,MAAM,EAAE,SAAS;IAE9C,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,SAAS,GAAG,OAAO,EACzC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,GAAE,WAAW,CAAC,SAAS,CAAM,GAChC,OAAO,CAAC,OAAO,CAAC;IAqCnB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,IAAI;IAaxE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,IAAI;IAKxE,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAMhC,OAAO,CAAC,MAAM;CAWf"}

package/dist/shared/plugins/iframe-mount/client/rpc.js

@@ -0,0 +1,63 @@
+//#region src/shared/plugins/iframe-mount/client/rpc.ts
+var e = 3e4, t = 0;
+function n() {
+	return t = (t + 1) % (2 ** 53 - 1), `rpc-${Date.now().toString(36)}-${t.toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+}
+var r = class {
+	pending = /* @__PURE__ */ new Map();
+	constructor(e) {
+		this.sender = e;
+	}
+	call(t, r, i = {}) {
+		let a = n(), o = !!i.onProgress;
+		return new Promise((n, s) => {
+			let c = i.timeoutMs === null ? null : i.timeoutMs ?? e, l = {
+				resolve: (e) => n(e),
+				reject: s,
+				onProgress: i.onProgress,
+				signal: i.signal
+			};
+			if (this.pending.set(a, l), c !== null && c > 0 && (l.timeoutHandle = setTimeout(() => {
+				this.settle(a, !1, /* @__PURE__ */ Error(`RPC timed out after ${c}ms`));
+			}, c)), i.signal) {
+				if (i.signal.aborted) {
+					this.settle(a, !1, /* @__PURE__ */ Error("RPC aborted"));
+					return;
+				}
+				l.abortHandler = () => {
+					this.settle(a, !1, /* @__PURE__ */ Error("RPC aborted"));
+				}, i.signal.addEventListener("abort", l.abortHandler, { once: !0 });
+			}
+			try {
+				this.sender.send(a, t, r, o);
+			} catch (e) {
+				this.settle(a, !1, e);
+			}
+		});
+	}
+	handleResponse(e, t) {
+		if (t.ok) this.settle(e, !0, t.result);
+		else {
+			let n = t.error ?? {
+				code: "rpc_unknown_error",
+				message: "Unknown RPC error"
+			}, r = Object.assign(Error(n.message), {
+				code: n.code,
+				data: n.data
+			});
+			this.settle(e, !1, r);
+		}
+	}
+	handleProgress(e, t) {
+		this.pending.get(e)?.onProgress?.(t.progress);
+	}
+	rejectAll(e) {
+		for (let [t] of this.pending) this.settle(t, !1, e);
+	}
+	settle(e, t, n) {
+		let r = this.pending.get(e);
+		r && (this.pending.delete(e), r.timeoutHandle !== void 0 && clearTimeout(r.timeoutHandle), r.signal && r.abortHandler && r.signal.removeEventListener("abort", r.abortHandler), t ? r.resolve(n) : r.reject(n));
+	}
+};
+//#endregion
+export { r as RpcDispatcher };

package/dist/shared/plugins/iframe-mount/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types';
+export { deriveSandbox } from './sandbox';
+export { usePluginContributions, type UsePluginContributionsOptions, } from './useFetchContributions';
+export { PluginIframe, type PluginIframeProps, type PluginIframeRpcContext, type PluginIframeRpcHandler, } from './PluginIframe';
+export { PluginMount, type PluginMountProps, type PluginMountChildProps } from './PluginMount';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/plugins/iframe-mount/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/shared/plugins/iframe-mount/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC"}

package/dist/shared/plugins/iframe-mount/index.js

@@ -0,0 +1,4 @@
+import "./sandbox.js";
+import "./useFetchContributions.js";
+import "./PluginIframe.js";
+import "./PluginMount.js";

package/dist/shared/plugins/iframe-mount/protocol/contribution.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Plugin contribution shape — the manifest entry a plugin author writes to
+ * declare that they want to be mounted at a given extension point.
+ *
+ * Mount points are open-ended strings the host page declares
+ * (`vibe.detailTab`, `agent.detailTab`, `target.detailTab`,
+ * `dashboard.widget`, …). Adding a new mount point does NOT require an
+ * SDK release: the host page consumes the matching contributions and
+ * interprets `meta` however it needs.
+ */
+export type PluginRuntime = 'iframe' | 'in-process';
+export interface PluginCapabilities {
+    /**
+     * REST path prefixes the plugin is allowed to hit via the iframe token.
+     * Globs (`*`) are honoured by `request-security` on the agent.
+     *
+     * Example: `["/api/profiles/*\/my-plugin/*"]`
+     */
+    restPaths: string[];
+    /** WebSocket topics this plugin subscribes to via the host relay. */
+    wsTopics: string[];
+    /**
+     * Host RPC methods the plugin may call (e.g. `navigate`, `toast`,
+     * `storage.get`). The host enforces this allow-list before invocation;
+     * mismatches return a structured error rather than executing.
+     */
+    rpcMethods: string[];
+}
+export interface ContributionGate {
+    /** Vibe-level feature catalog id (`isFeatureEnabled(feature)`). */
+    feature?: string;
+    /** Platform-level GrowthBook flag (`isPlatformTabEnabled(flag)`). */
+    platformFlag?: string;
+    /** Hide the contribution when no agent is attached to the surface. */
+    requiresAgent?: boolean;
+}
+export interface PluginContribution {
+    /** Open-ended mount point id. The host page knows how to read it. */
+    mountPoint: string;
+    /** Unique within (pluginKey, mountPoint). */
+    id: string;
+    title: string;
+    /** Lucide icon name. Host resolves to a component; SDK stays icon-set agnostic. */
+    icon?: string;
+    /** Lower = earlier in the strip / grid. */
+    order?: number;
+    /**
+     * Which runtimes this contribution supports. The host picks the first
+     * entry that matches its preference and is available; warns and skips
+     * the contribution when nothing matches.
+     */
+    runtimes: PluginRuntime[];
+    capabilities: PluginCapabilities;
+    gate?: ContributionGate;
+    /** Mount-point-specific extras (e.g. `defaultSize` for dashboard widgets). */
+    meta?: Record<string, unknown>;
+}
+export interface PluginManifest {
+    /** Globally unique. Convention: npm-package-style (`vibe-plugin-ui-git`). */
+    id: string;
+    /** Human-readable. */
+    name?: string;
+    /** CalVer version of the plugin package itself. */
+    version?: string;
+    description?: string;
+    contributions: PluginContribution[];
+}
+/**
+ * `defineUiPlugin` is a typed identity helper — it lets the plugin author
+ * declare the manifest + render function once and have the resulting
+ * object accepted by both adapters without `as const` ceremony.
+ *
+ * The `render` thunk runs *inside* the chosen adapter, after the host
+ * handshake has populated `VibeHostContext`. The hooks in `./react` are
+ * what consumers actually use; this signature is intentionally untyped
+ * for React to keep the protocol module DOM-free.
+ */
+export interface UiPluginDefinition<TRender = unknown> {
+    manifest: PluginManifest;
+    render: () => TRender;
+}
+export declare function defineUiPlugin<TRender>(plugin: UiPluginDefinition<TRender>): UiPluginDefinition<TRender>;
+//# sourceMappingURL=contribution.d.ts.map

package/dist/shared/plugins/iframe-mount/protocol/contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contribution.d.ts","sourceRoot":"","sources":["../../../../../src/shared/plugins/iframe-mount/protocol/contribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,YAAY,EAAE,kBAAkB,CAAC;IACjC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,kBAAkB,EAAE,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB,CAAC,OAAO,GAAG,OAAO;IACnD,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,MAAM,OAAO,CAAC;CACvB;AAED,wBAAgB,cAAc,CAAC,OAAO,EACpC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAClC,kBAAkB,CAAC,OAAO,CAAC,CAE7B"}

package/dist/shared/plugins/iframe-mount/protocol/envelope.d.ts

@@ -0,0 +1,136 @@
+/**
+ * Versioned envelope shared by every postMessage between a UI plugin
+ * (iframe-mounted or in-process) and its host shell.
+ *
+ * Both sides import these types from this module — there is no other
+ * source of truth for the wire format. Bumping the envelope is a
+ * deliberate breaking-change event; the major version embedded in
+ * `ENVELOPE_VERSION` rides independently of the package's CalVer.
+ */
+export declare const ENVELOPE_VERSION: 1;
+export type EnvelopeVersion = typeof ENVELOPE_VERSION;
+/** Operations the host sends to the plugin. */
+export type HostOp = 'host:init' | 'host:theme-change' | 'host:locale-change' | 'host:feature-flag' | 'host:context-change' | 'host:event' | 'host:rpc-response' | 'host:rpc-progress' | 'host:dispose';
+/** Operations the plugin sends to the host. */
+export type PluginOp = 'plugin:ready' | 'plugin:rpc-request' | 'plugin:event-emit' | 'plugin:set-badge' | 'plugin:set-title' | 'plugin:resize-request' | 'plugin:error';
+export interface HostEnvelope<P = unknown> {
+    v: EnvelopeVersion;
+    source: 'host';
+    kind: HostOp;
+    /** Set when this envelope answers (or progresses) a prior plugin RPC. */
+    requestId?: string;
+    payload: P;
+}
+export interface PluginEnvelope<P = unknown> {
+    v: EnvelopeVersion;
+    source: 'plugin';
+    kind: PluginOp;
+    /** Set on rpc-request / set on plugin:error when caused by a specific RPC. */
+    requestId?: string;
+    payload: P;
+}
+export type Envelope<P = unknown> = HostEnvelope<P> | PluginEnvelope<P>;
+/**
+ * Type guard that an unknown postMessage payload looks like a valid v1
+ * envelope. Origin and `event.source` checks are *not* performed here —
+ * the caller must do those *before* trusting the payload, because a
+ * well-formed envelope from a hostile origin is still hostile.
+ */
+export declare function isEnvelope(value: unknown): value is Envelope;
+/** Convenience: narrow to a HostEnvelope (caller already trusts the origin). */
+export declare function isHostEnvelope(value: unknown): value is HostEnvelope;
+/** Convenience: narrow to a PluginEnvelope (caller already trusts the origin). */
+export declare function isPluginEnvelope(value: unknown): value is PluginEnvelope;
+/** Sent in reply to `plugin:ready`. The plugin blocks render until it arrives. */
+export interface HostInitPayload {
+    /** Scoped iframe token. Bounded by manifest capabilities. */
+    iframeToken: string;
+    tunnelUrl: string;
+    mountPoint: string;
+    context: Record<string, unknown>;
+    agentId: string;
+    profile: string;
+    theme: {
+        colorMode: 'light' | 'dark';
+        tokens: Record<string, string>;
+    };
+    locale: string;
+    capabilities: {
+        restPaths: string[];
+        wsTopics: string[];
+        rpcMethods: string[];
+    };
+    featureFlags: Record<string, boolean>;
+    sdkVersion: string;
+    hostVersion: string;
+}
+export interface HostThemeChangePayload {
+    colorMode: 'light' | 'dark';
+    tokens: Record<string, string>;
+}
+export interface HostLocaleChangePayload {
+    locale: string;
+}
+export interface HostFeatureFlagPayload {
+    flag: string;
+    value: boolean;
+}
+export interface HostContextChangePayload {
+    context: Record<string, unknown>;
+}
+export interface HostEventPayload<T = unknown> {
+    name: string;
+    data: T;
+}
+export interface HostRpcResponsePayload<T = unknown> {
+    ok: boolean;
+    result?: T;
+    error?: {
+        code: string;
+        message: string;
+        data?: unknown;
+    };
+}
+export interface HostRpcProgressPayload<T = unknown> {
+    progress: T;
+}
+export type HostDisposePayload = Record<string, never>;
+export interface PluginReadyPayload {
+    pluginId: string;
+    pluginVersion: string;
+    sdkVersion: string;
+    declaredCapabilities: {
+        restPaths: string[];
+        wsTopics: string[];
+        rpcMethods: string[];
+    };
+}
+export interface PluginRpcRequestPayload {
+    method: string;
+    args: unknown;
+    /** Caller hint that the RPC may stream progress before terminal response. */
+    streaming?: boolean;
+}
+export interface PluginEventEmitPayload<T = unknown> {
+    name: string;
+    data: T;
+}
+export interface PluginSetBadgePayload {
+    value: string | number | null;
+}
+export interface PluginSetTitlePayload {
+    value: string;
+}
+export interface PluginResizeRequestPayload {
+    /** Suggested iframe height in pixels. Host may ignore. */
+    height?: number;
+    width?: number;
+}
+export interface PluginErrorPayload {
+    code: string;
+    message: string;
+    stack?: string;
+    /** Optional reference to a specific in-flight requestId. */
+    requestId?: string;
+}
+//# sourceMappingURL=envelope.d.ts.map

package/dist/shared/plugins/iframe-mount/protocol/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../../../../src/shared/plugins/iframe-mount/protocol/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAC3C,MAAM,MAAM,eAAe,GAAG,OAAO,gBAAgB,CAAC;AAEtD,+CAA+C;AAC/C,MAAM,MAAM,MAAM,GACd,WAAW,GACX,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,YAAY,GACZ,mBAAmB,GACnB,mBAAmB,GACnB,cAAc,CAAC;AAEnB,+CAA+C;AAC/C,MAAM,MAAM,QAAQ,GAChB,cAAc,GACd,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,GAClB,uBAAuB,GACvB,cAAc,CAAC;AAEnB,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,CAAC,EAAE,eAAe,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;CACZ;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IACzC,CAAC,EAAE,eAAe,CAAC;IACnB,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;CACZ;AAED,MAAM,MAAM,QAAQ,CAAC,CAAC,GAAG,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;AAExE;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAU5D;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAExE;AAID,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE;QACZ,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,OAAO;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,CAAC;CACT;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,OAAO;IACjD,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,CAAC,CAAC;IACX,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC3D;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,OAAO;IACjD,QAAQ,EAAE,CAAC,CAAC;CACb;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAEvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,EAAE;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,OAAO;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,CAAC;CACT;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/shared/plugins/iframe-mount/protocol/envelope.js

@@ -0,0 +1,10 @@
+function e(e) {
+	if (typeof e != "object" || !e) return !1;
+	let t = e;
+	return t.v !== 1 || t.source !== "host" && t.source !== "plugin" || typeof t.kind != "string" || "requestId" in t && typeof t.requestId != "string" && t.requestId !== void 0 ? !1 : "payload" in t;
+}
+function t(t) {
+	return e(t) && t.source === "plugin";
+}
+//#endregion
+export { e as isEnvelope, t as isPluginEnvelope };

package/dist/shared/plugins/iframe-mount/protocol/index.d.ts

@@ -0,0 +1,3 @@
+export * from './envelope.js';
+export * from './contribution.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/plugins/iframe-mount/protocol/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/shared/plugins/iframe-mount/protocol/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC"}

package/dist/shared/plugins/iframe-mount/sandbox.d.ts

@@ -0,0 +1,3 @@
+import { PluginCapabilities } from './protocol/index.js';
+export declare function deriveSandbox(capabilities: PluginCapabilities | undefined | null): string;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/shared/plugins/iframe-mount/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../../src/shared/plugins/iframe-mount/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAuC9D,wBAAgB,aAAa,CAAC,YAAY,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAmBzF"}

package/dist/shared/plugins/iframe-mount/sandbox.js

@@ -0,0 +1,19 @@
+//#region src/shared/plugins/iframe-mount/sandbox.ts
+var e = ["allow-scripts", "allow-same-origin"], t = {
+	"clipboard.write": ["allow-clipboard-write"],
+	"clipboard.read": ["allow-clipboard-read"],
+	openExternal: ["allow-popups", "allow-popups-to-escape-sandbox"],
+	downloads: ["allow-downloads"],
+	pointerLock: ["allow-pointer-lock"],
+	fullscreen: ["allow-presentation"]
+};
+function n(n) {
+	let r = new Set(e), i = n?.rpcMethods ?? [];
+	for (let e of i) {
+		let n = t[e];
+		if (n) for (let e of n) r.add(e);
+	}
+	return Array.from(r).join(" ");
+}
+//#endregion
+export { n as deriveSandbox };

package/dist/shared/plugins/iframe-mount/types.d.ts

@@ -0,0 +1,64 @@
+import { PluginCapabilities, PluginContribution, PluginRuntime } from './protocol/index.js';
+/**
+ * A "tunnel" the host page can query for contributions and from which
+ * iframe-mounted plugins are served. For VibeControls this is the
+ * vibecontrols-agent's Cloudflare tunnel + the current profile name;
+ * other products map to whatever serves their plugins.
+ */
+export interface MountTunnel {
+    /** Base URL — used for both fetch + iframe src. */
+    tunnelUrl: string;
+    /** Profile or scope segment the agent uses to namespace plugins. */
+    profile: string;
+    /** Optional human-readable label for picker UIs / errors. */
+    label?: string;
+    /**
+     * Factory that mints a fresh iframe token scoped to a contribution's
+     * capability `restPaths`. Called once on first mount + on each
+     * scheduled refresh. The host supplies this so the SDK stays
+     * transport-agnostic.
+     */
+    mintIframeToken: (input: {
+        pathPrefixes: string[];
+    }) => Promise<{
+        token: string;
+        expiresAt: string;
+    }>;
+}
+/**
+ * What `usePluginContributions` returns per-contribution after
+ * fetching from one or more tunnels. The `tunnel` is the source the
+ * contribution came from; multiple tunnels' results are unioned (last
+ * wins on id collisions).
+ */
+export interface DiscoveredContribution {
+    pluginKey: string;
+    pluginPackageName?: string;
+    contribution: PluginContribution;
+    capabilities: PluginCapabilities;
+    /**
+     * Relative URL — the host concatenates with `tunnel.tunnelUrl` to
+     * mount the iframe. Returned by the agent as e.g. `/ui/<pluginKey>`.
+     */
+    url: string;
+    tunnel: MountTunnel;
+}
+export type RuntimePreference = PluginRuntime | 'auto';
+export interface InProcessPluginEntry {
+    /**
+     * Plugin package key (matches `DiscoveredContribution.pluginKey`).
+     * Required to disambiguate when two different plugins contribute
+     * the same local `id` at the same `mountPoint` — without this, the
+     * later registration silently overwrites the earlier one.
+     */
+    pluginKey: string;
+    /** Matches `contribution.id`. */
+    id: string;
+    /** Matches `contribution.mountPoint`. */
+    mountPoint: string;
+    /** React component to render. Receives the same context object the iframe would. */
+    Component: React.ComponentType<{
+        context: Record<string, unknown>;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/shared/plugins/iframe-mount/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/shared/plugins/iframe-mount/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,eAAe,EAAE,CAAC,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,KAAK,OAAO,CAAC;QAC9D,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,kBAAkB,CAAC;IACjC;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CACtE"}

package/dist/shared/plugins/iframe-mount/useFetchContributions.d.ts

@@ -0,0 +1,31 @@
+import { DiscoveredContribution, MountTunnel } from './types';
+export interface UsePluginContributionsOptions {
+    /**
+     * Filter to a single mount point. When omitted, the hook returns the
+     * union of every contribution across every mount point so the host
+     * can seed multiple tab strips from one request.
+     */
+    mountPoint?: string;
+    /**
+     * Polling cadence. Defaults to 60s. Set to `false` to disable; the
+     * hook will only refetch on tunnel reconnect / focus.
+     */
+    refetchIntervalMs?: number | false;
+    enabled?: boolean;
+}
+/**
+ * Fetch plugin contributions from every supplied tunnel. Results are
+ * unioned; if two tunnels report contributions with the same `id`, the
+ * one whose tunnel.label is lexicographically smaller wins (stable,
+ * deterministic, debuggable). Authors should pick unique ids anyway.
+ */
+export declare function usePluginContributions(tunnels: MountTunnel[], opts?: UsePluginContributionsOptions): {
+    data: DiscoveredContribution[];
+    isFetching: boolean;
+    errors: Array<{
+        tunnel: MountTunnel;
+        error: unknown;
+    }>;
+    refetch: () => void;
+};
+//# sourceMappingURL=useFetchContributions.d.ts.map

package/dist/shared/plugins/iframe-mount/useFetchContributions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useFetchContributions.d.ts","sourceRoot":"","sources":["../../../../src/shared/plugins/iframe-mount/useFetchContributions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAwCnE,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,EAAE,EACtB,IAAI,GAAE,6BAAkC,GACvC;IACD,IAAI,EAAE,sBAAsB,EAAE,CAAC;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACvD,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAsEA"}

package/dist/shared/plugins/iframe-mount/useFetchContributions.js

@@ -0,0 +1,68 @@
+import { useMemo as e } from "react";
+import { useQueries as t } from "@tanstack/react-query";
+//#region src/shared/plugins/iframe-mount/useFetchContributions.ts
+var n = 6e4;
+async function r(e, t, n) {
+	let r = `${e.tunnelUrl.replace(/\/$/, "")}/api/profiles/${encodeURIComponent(e.profile)}/plugins/contributions${t ? `?mountPoint=${encodeURIComponent(t)}` : ""}`, i = await fetch(r, {
+		signal: n,
+		headers: { Accept: "application/json" }
+	});
+	if (!i.ok) throw Error(`Contributions fetch failed: ${i.status} ${i.statusText}`);
+	return ((await i.json()).contributions ?? []).map((t) => ({
+		pluginKey: t.pluginKey,
+		pluginPackageName: t.pluginPackageName,
+		contribution: t.contribution,
+		capabilities: t.capabilities,
+		url: t.url,
+		tunnel: e
+	}));
+}
+function i(i, a = {}) {
+	let { mountPoint: o, refetchIntervalMs: s = n, enabled: c = !0 } = a, l = t({ queries: i.map((e) => ({
+		queryKey: [
+			"vibe-plugin-contributions",
+			e.tunnelUrl,
+			e.profile,
+			o
+		],
+		queryFn: ({ signal: t }) => r(e, o, t),
+		refetchInterval: s === !1 ? !1 : s,
+		staleTime: 3e4,
+		enabled: c
+	})) }), u = l.map((e) => `${e.dataUpdatedAt}:${e.data?.length ?? 0}`).join("|"), d = l.map((e) => e.error ? `${e.errorUpdatedAt}` : "").join("|"), f = e(() => {
+		let e = (e) => `${e.pluginKey}::${e.contribution.mountPoint}::${e.contribution.id}`, t = /* @__PURE__ */ new Map();
+		for (let n = 0; n < l.length; n += 1) {
+			let r = l[n].data ?? [];
+			for (let n of r) {
+				let r = e(n), i = t.get(r);
+				if (!i) {
+					t.set(r, n);
+					continue;
+				}
+				let a = i.tunnel.label ?? i.tunnel.tunnelUrl;
+				(n.tunnel.label ?? n.tunnel.tunnelUrl) < a && t.set(r, n);
+			}
+		}
+		return Array.from(t.values());
+	}, [u]), p = e(() => {
+		let e = [];
+		for (let t = 0; t < l.length; t += 1) {
+			let n = l[t]?.error;
+			n && e.push({
+				tunnel: i[t],
+				error: n
+			});
+		}
+		return e;
+	}, [d, i]);
+	return {
+		data: f,
+		isFetching: l.some((e) => e.isFetching),
+		errors: p,
+		refetch: () => {
+			for (let e of l) e.refetch();
+		}
+	};
+}
+//#endregion
+export { i as usePluginContributions };

package/dist/shared/plugins/index.d.ts

@@ -37,4 +37,5 @@ export { useSettingsRegistryStore } from './registries/useSettingsRegistry';
 export { useWidgetRegistryStore } from './registries/useWidgetRegistry';
 export { useToolbarRegistryStore } from './registries/useToolbarRegistry';
 export { useContextMenuRegistryStore } from './registries/useContextMenuRegistry';
+export * from './iframe-mount';
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,YAAY,EACV,QAAQ,EACR,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,eAAe,EACf,WAAW,EACX,YAAY,EACZ,SAAS,GACV,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,oBAAoB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAGrE,OAAO,EACL,QAAQ,EACR,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGpE,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,0BAA0B,EAC1B,KAAK,YAAY,EACjB,KAAK,yBAAyB,GAC/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,YAAY,EACV,QAAQ,EACR,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,eAAe,EACf,WAAW,EACX,YAAY,EACZ,SAAS,GACV,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,oBAAoB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAGrE,OAAO,EACL,QAAQ,EACR,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGpE,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,0BAA0B,EAC1B,KAAK,YAAY,EACjB,KAAK,yBAAyB,GAC/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAKlF,cAAc,gBAAgB,CAAC"}

package/dist/shared-plugins.js

@@ -12,4 +12,9 @@ import { useWidgetRegistryStore as d } from "./shared/plugins/registries/useWidg
 import { useToolbarRegistryStore as f } from "./shared/plugins/registries/useToolbarRegistry.js";
 import { useContextMenuRegistryStore as p } from "./shared/plugins/registries/useContextMenuRegistry.js";
 import { PluginRuntimeProvider as m, usePluginRuntime as h } from "./shared/plugins/PluginRuntimeProvider.js";
-export { e as DisposableCollection, t as EventBus, i as PluginRuntime, m as PluginRuntimeProvider, a as createContributionRegistry, r as createPluginContext, o as useCommandRegistryStore, p as useContextMenuRegistryStore, c as usePanelRegistryStore, n as usePluginEvent, h as usePluginRuntime, s as useRouteRegistryStore, u as useSettingsRegistryStore, l as useStatusBarRegistryStore, f as useToolbarRegistryStore, d as useWidgetRegistryStore };
+import { deriveSandbox as g } from "./shared/plugins/iframe-mount/sandbox.js";
+import { usePluginContributions as _ } from "./shared/plugins/iframe-mount/useFetchContributions.js";
+import { PluginIframe as v } from "./shared/plugins/iframe-mount/PluginIframe.js";
+import { PluginMount as y } from "./shared/plugins/iframe-mount/PluginMount.js";
+import "./shared/plugins/iframe-mount/index.js";
+export { e as DisposableCollection, t as EventBus, v as PluginIframe, y as PluginMount, i as PluginRuntime, m as PluginRuntimeProvider, a as createContributionRegistry, r as createPluginContext, g as deriveSandbox, o as useCommandRegistryStore, p as useContextMenuRegistryStore, c as usePanelRegistryStore, _ as usePluginContributions, n as usePluginEvent, h as usePluginRuntime, s as useRouteRegistryStore, u as useSettingsRegistryStore, l as useStatusBarRegistryStore, f as useToolbarRegistryStore, d as useWidgetRegistryStore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/fe-libs",
-  "version": "2026.521.2",
+  "version": "2026.521.4",
   "description": "Burdenoff frontend primitives and domain libraries",
   "type": "module",
   "imports": {