@elementspanel/epanel-plugin-config 1.0.0 → 1.0.2

package/daemon/backend/index.cjs

@@ -1,10 +1,107 @@
 /******/ (() => { // webpackBootstrap
-/******/ 	"use strict";
 /******/ 	var __webpack_modules__ = ({
 
+/***/ "../../plugins/config/daemon/src/backend/settings.ts"
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.SettingsFormService = void 0;
+const mcsmanager_common_1 = __webpack_require__("../common/src/index.ts");
+const cordis_1 = __webpack_require__("cordis");
+const cosmokit_1 = __webpack_require__("cosmokit");
+/** Configuration declarations are owned by the daemon config plugin. */
+class SettingsFormService extends cordis_1.Service {
+    declarations = [];
+    constructor(ctx) {
+        super(ctx, "settingsForm", true);
+    }
+    declare(declaration) {
+        const entry = { id: this.ctx.name, declaration };
+        return this.ctx.effect(() => {
+            this.declarations.push(entry);
+            return () => (0, cosmokit_1.remove)(this.declarations, entry);
+        });
+    }
+    declared() {
+        return this.declarations.map((entry) => entry.id);
+    }
+    async read(id) {
+        const entry = this.declarations.find((item) => item.id === id);
+        if (!entry) {
+            const schema = this.ctx.plugins.configuration(id);
+            return schema.fields.length ? schema : null;
+        }
+        return { id, fields: entry.declaration.fields(), values: await entry.declaration.read() };
+    }
+    async write(id, values) {
+        const entry = this.declarations.find((item) => item.id === id);
+        if (!entry)
+            return (await this.ctx.plugins.configure(id, values)).result;
+        return this.ctx.plugins.runExclusive(async () => {
+            (0, mcsmanager_common_1.validatePluginSettings)(entry.declaration.fields(), values);
+            await entry.declaration.write(values);
+            return {
+                saved: true,
+                application: entry.declaration.restartRequired ? "restart-required" : "applied"
+            };
+        });
+    }
+}
+exports.SettingsFormService = SettingsFormService;
+
+
+/***/ },
+
+/***/ "../../plugins/config/daemon/src/i18n/index.ts"
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.localeMessages = void 0;
+const de_DE_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/de_DE.json"));
+const en_US_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/en_US.json"));
+const es_ES_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/es_ES.json"));
+const fr_FR_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/fr_FR.json"));
+const ja_JP_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/ja_JP.json"));
+const ko_KR_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/ko_KR.json"));
+const pt_BR_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/pt_BR.json"));
+const ru_RU_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/ru_RU.json"));
+const th_TH_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/th_TH.json"));
+const tr_TR_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/tr_TR.json"));
+const zh_CN_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/zh_CN.json"));
+const zh_TW_json_1 = __importDefault(__webpack_require__("../../plugins/config/daemon/src/i18n/zh_TW.json"));
+// The refusals this plugin's protocol handlers throw. The panel surfaces them
+// verbatim on its plugin manager page, so they are translated here rather than
+// in the panel: this daemon knows which of its own plugins may not be switched
+// off remotely, and it answers in the language it was told to speak.
+exports.localeMessages = {
+    de_de: de_DE_json_1.default,
+    en_us: en_US_json_1.default,
+    es_es: es_ES_json_1.default,
+    fr_fr: fr_FR_json_1.default,
+    ja_jp: ja_JP_json_1.default,
+    ko_kr: ko_KR_json_1.default,
+    pt_br: pt_BR_json_1.default,
+    ru_ru: ru_RU_json_1.default,
+    th_th: th_TH_json_1.default,
+    tr_tr: tr_TR_json_1.default,
+    zh_cn: zh_CN_json_1.default,
+    zh_tw: zh_TW_json_1.default
+};
+
+
+/***/ },
+
 /***/ "../common/src/array.ts"
 (__unused_webpack_module, exports) {
 
+"use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.arrayUnique = arrayUnique;
@@ -21,6 +118,7 @@ function arrayUnique(arr, felidName) {
 /***/ "../common/src/docker_utils.ts"
 (__unused_webpack_module, exports) {
 
+"use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.normalizeDockerArchitecture = normalizeDockerArchitecture;
@@ -63,6 +161,7 @@ function normalizeDockerPlatform(platform) {
 /***/ "../common/src/global_variable.ts"
 (__unused_webpack_module, exports) {
 
+"use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 class GlobalVariable {
@@ -90,6 +189,7 @@ exports["default"] = GlobalVariable;
 /***/ "../common/src/index.ts"
 (__unused_webpack_module, exports, __webpack_require__) {
 
+"use strict";
 
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -109,7 +209,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.StorageSubsystem = exports.MCServerStatus = exports.InstanceStreamListener = exports.GlobalVariable = exports.normalizeDockerPlatform = exports.normalizeDockerOS = exports.normalizeDockerArchitecture = exports.removeTrail = exports.uninstallNpmPlugin = exports.npmPluginRoots = exports.listNpmPlugins = exports.installNpmPlugin = exports.currentProjectRoot = exports.currentPackageRoot = exports.sortPlugins = exports.resolvePluginEntry = exports.readPluginManifest = exports.createFrontendPluginMetadata = exports.discoverPluginsFromRoots = exports.discoverPlugins = exports.arrayUnique = exports.toText = exports.toNumber = exports.toBoolean = exports.supposeValue = exports.isEmpty = exports.configureEntityParams = exports.systemInfo = exports.QueryWrapper = exports.QueryMapWrapper = exports.MySqlSource = exports.LocalFileSource = exports.killProcess = exports.ProcessWrapper = void 0;
+exports.StorageSubsystem = exports.MCServerStatus = exports.InstanceStreamListener = exports.GlobalVariable = exports.normalizeDockerPlatform = exports.normalizeDockerOS = exports.normalizeDockerArchitecture = exports.removeTrail = exports.uninstallNpmPlugin = exports.isEssentialNpmPlugin = exports.npmPluginOperationPending = exports.npmPluginRoots = exports.listNpmPlugins = exports.installNpmPlugin = exports.currentProjectRoot = exports.currentPackageRoot = exports.sortPlugins = exports.resolvePluginEntry = exports.readPluginManifest = exports.createFrontendPluginMetadata = exports.discoverPluginsFromRoots = exports.discoverPlugins = exports.arrayUnique = exports.toText = exports.toNumber = exports.toBoolean = exports.supposeValue = exports.isEmpty = exports.configureEntityParams = exports.systemInfo = exports.QueryWrapper = exports.QueryMapWrapper = exports.MySqlSource = exports.LocalFileSource = exports.killProcess = exports.ProcessWrapper = void 0;
 const global_variable_1 = __importDefault(__webpack_require__("../common/src/global_variable.ts"));
 exports.GlobalVariable = global_variable_1.default;
 const instance_stream_1 = __importDefault(__webpack_require__("../common/src/instance_stream.ts"));
@@ -141,6 +241,8 @@ __exportStar(__webpack_require__("../common/src/plugin_contract.ts"), exports);
 __exportStar(__webpack_require__("../common/src/plugin_overrides.ts"), exports);
 __exportStar(__webpack_require__("../common/src/plugin_lifecycle.ts"), exports);
 __exportStar(__webpack_require__("../common/src/plugin_revision.ts"), exports);
+__exportStar(__webpack_require__("../common/src/plugin_modules.ts"), exports);
+__exportStar(__webpack_require__("../common/src/plugin_watch.ts"), exports);
 __exportStar(__webpack_require__("../common/src/runtime_paths.ts"), exports);
 var plugin_manifest_1 = __webpack_require__("../common/src/plugin_manifest.ts");
 Object.defineProperty(exports, "discoverPlugins", ({ enumerable: true, get: function () { return plugin_manifest_1.discoverPlugins; } }));
@@ -155,6 +257,8 @@ Object.defineProperty(exports, "currentProjectRoot", ({ enumerable: true, get: f
 Object.defineProperty(exports, "installNpmPlugin", ({ enumerable: true, get: function () { return plugin_npm_1.installNpmPlugin; } }));
 Object.defineProperty(exports, "listNpmPlugins", ({ enumerable: true, get: function () { return plugin_npm_1.listNpmPlugins; } }));
 Object.defineProperty(exports, "npmPluginRoots", ({ enumerable: true, get: function () { return plugin_npm_1.npmPluginRoots; } }));
+Object.defineProperty(exports, "npmPluginOperationPending", ({ enumerable: true, get: function () { return plugin_npm_1.npmPluginOperationPending; } }));
+Object.defineProperty(exports, "isEssentialNpmPlugin", ({ enumerable: true, get: function () { return plugin_npm_1.isEssentialNpmPlugin; } }));
 Object.defineProperty(exports, "uninstallNpmPlugin", ({ enumerable: true, get: function () { return plugin_npm_1.uninstallNpmPlugin; } }));
 var string_utils_1 = __webpack_require__("../common/src/string_utils.ts");
 Object.defineProperty(exports, "removeTrail", ({ enumerable: true, get: function () { return string_utils_1.removeTrail; } }));
@@ -169,6 +273,7 @@ Object.defineProperty(exports, "normalizeDockerPlatform", ({ enumerable: true, g
 /***/ "../common/src/instance_stream.ts"
 (__unused_webpack_module, exports) {
 
+"use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 // Application instance data stream forwarding adapter
@@ -228,6 +333,7 @@ exports["default"] = InstanceStreamListener;
 /***/ "../common/src/mcping.ts"
 (__unused_webpack_module, exports, __webpack_require__) {
 
+"use strict";
 
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -346,6 +452,7 @@ exports["default"] = PingMinecraftServer;
 /***/ "../common/src/plugin_contract.ts"
 (__unused_webpack_module, exports) {
 
+"use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PLUGIN_SDK_VERSION = exports.PLUGIN_API_VERSION = void 0;
@@ -512,6 +619,7 @@ function validatePluginSettings(fields, values) {
 /***/ "../common/src/plugin_lifecycle.ts"
 (__unused_webpack_module, exports) {
 
+"use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.trackPluginDisposal = trackPluginDisposal;
@@ -578,6 +686,7 @@ function trackPluginDisposal(ctx) {
 /***/ "../common/src/plugin_manifest.ts"
 (__unused_webpack_module, exports, __webpack_require__) {
 
+"use strict";
 
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -622,7 +731,52 @@ function createFrontendPluginMetadata(manifest, extras = {}) {
     };
 }
 const MANIFEST_FILES = ["plugin.json", "manifest.json", "package.json"];
-/** Reads the manifest of one plugin directory, or null if it has none. */
+const ENTRY_FIELDS = ["backend", "frontend", "panel", "daemon", "main", "entry", "ui"];
+function objectValue(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+/**
+ * Source plugins keep package.json beside plugin.json. Published npm plugins
+ * keep it at the package root, with runtime metadata under elementspanel.<side>.
+ * Stop at the first package boundary so a host's metadata cannot reach a plugin.
+ */
+function readPackageMetadata(directory) {
+    const pluginDirectory = node_path_1.default.resolve(directory);
+    let current = pluginDirectory;
+    while (true) {
+        const filename = node_path_1.default.join(current, "package.json");
+        if (node_fs_1.default.existsSync(filename)) {
+            const { elementspanel, ...metadata } = objectValue(JSON.parse(node_fs_1.default.readFileSync(filename, "utf8")));
+            const { id: packageId, panel, daemon, ...shared } = objectValue(elementspanel);
+            const definition = [panel, daemon]
+                .map(objectValue)
+                .find((side) => typeof side.directory === "string" &&
+                node_path_1.default.resolve(current, side.directory) === pluginDirectory);
+            if (current !== pluginDirectory && (typeof packageId !== "string" || !definition))
+                return {};
+            const { directory: _directory, folder: _folder, ...sideMetadata } = definition ?? {};
+            const result = {
+                ...metadata,
+                ...shared,
+                ...sideMetadata,
+                ...(packageId === undefined ? {} : { id: packageId })
+            };
+            if (metadata.version !== undefined)
+                result.version = metadata.version;
+            // npm's main/entry fields do not define a side's execution entry.
+            for (const field of ENTRY_FIELDS)
+                delete result[field];
+            return result;
+        }
+        const parent = node_path_1.default.dirname(current);
+        if (parent === current)
+            return {};
+        current = parent;
+    }
+}
+/** Combines execution entries with package metadata. Legacy manifests still load. */
 function readPluginManifest(directory, onWarning, fallbackId = node_path_1.default.basename(directory)) {
     for (const file of MANIFEST_FILES) {
         const filePath = node_path_1.default.join(directory, file);
@@ -632,10 +786,26 @@ function readPluginManifest(directory, onWarning, fallbackId = node_path_1.defau
             const value = JSON.parse(node_fs_1.default.readFileSync(filePath, "utf8"));
             if (!value || typeof value !== "object" || Array.isArray(value))
                 return null;
-            const id = typeof value.id === "string" ? value.id : fallbackId;
+            const packageMetadata = readPackageMetadata(directory);
+            const id = typeof packageMetadata.id === "string"
+                ? packageMetadata.id
+                : typeof value.id === "string"
+                    ? value.id
+                    : fallbackId;
             if (!id.trim())
                 return null;
-            return { ...value, id: id.trim() };
+            const manifest = {
+                ...value,
+                ...packageMetadata,
+                id: id.trim()
+            };
+            // Only execution paths come from plugin.json; package.json owns identity,
+            // version, dual status and all other metadata.
+            for (const field of ENTRY_FIELDS) {
+                if (value[field] !== undefined)
+                    manifest[field] = value[field];
+            }
+            return manifest;
         }
         catch (error) {
             onWarning?.(`Failed to read plugin manifest: ${filePath}`, error);
@@ -733,6 +903,13 @@ function discoverPluginsFromRoots(roots, options) {
             discovered.push({
                 ...plugin,
                 manifest,
+                ...(root.packageRoot
+                    ? {
+                        packageRoot: root.packageRoot,
+                        packageName: root.packageName,
+                        npmSource: root.npmSource
+                    }
+                    : {}),
                 ...(root.folder ? { folder: root.folder } : {})
             });
         }
@@ -746,11 +923,184 @@ function sortPlugins(plugins) {
 }
 
 
+/***/ },
+
+/***/ "../common/src/plugin_modules.ts"
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.pluginBackendRevision = pluginBackendRevision;
+exports.forgetPluginModules = forgetPluginModules;
+exports.loadPluginModule = loadPluginModule;
+const node_fs_1 = __importDefault(__webpack_require__("node:fs"));
+const node_path_1 = __importDefault(__webpack_require__("node:path"));
+const node_url_1 = __webpack_require__("node:url");
+const node_crypto_1 = __webpack_require__("node:crypto");
+const node_module_1 = __webpack_require__("node:module");
+const plugin_revision_1 = __webpack_require__("../common/src/plugin_revision.ts");
+const REVISION = "epanelPluginRevision";
+const graphs = new Map();
+const previousRoots = new Map();
+let hooksInstalled = false;
+const sharedModules = new Set([
+    "cordis",
+    "@cordisjs/core",
+    "@cordisjs/logger",
+    "@cordisjs/timer",
+    "@cordisjs/schema",
+    "cosmokit",
+    "schemastery",
+    "reggol"
+]);
+function dependencyRoots(directory) {
+    const visited = new Set([directory]);
+    const walk = (root) => {
+        const filename = node_path_1.default.join(root, "package.json");
+        if (!node_fs_1.default.existsSync(filename))
+            return;
+        const metadata = JSON.parse(node_fs_1.default.readFileSync(filename, "utf8"));
+        const localRequire = (0, node_module_1.createRequire)(filename);
+        for (const name of Object.keys({
+            ...metadata.dependencies,
+            ...metadata.optionalDependencies
+        })) {
+            if (sharedModules.has(name))
+                continue;
+            const target = (localRequire.resolve.paths(name) || [])
+                .map((directory) => node_path_1.default.join(directory, name, "package.json"))
+                .find((candidate) => node_fs_1.default.existsSync(candidate));
+            if (!target)
+                continue;
+            const dependency = node_fs_1.default.realpathSync(node_path_1.default.dirname(target));
+            if (visited.has(dependency))
+                continue;
+            visited.add(dependency);
+            walk(dependency);
+        }
+    };
+    walk(directory);
+    visited.delete(directory);
+    return [...visited];
+}
+/** Include transitive dependency versions so npm updates replace the affected graph. */
+function pluginBackendRevision(entry, directory) {
+    const hash = (0, node_crypto_1.createHash)("sha256").update((0, plugin_revision_1.pluginDirectoryRevision)(node_path_1.default.dirname(entry)));
+    for (const root of [directory, ...dependencyRoots(directory)]) {
+        const filename = node_path_1.default.join(root, "package.json");
+        if (node_fs_1.default.existsSync(filename))
+            hash.update(root).update(node_fs_1.default.readFileSync(filename));
+    }
+    return hash.digest("hex").slice(0, 24);
+}
+function within(root, filename) {
+    const relative = node_path_1.default.relative(root, filename);
+    return (relative === "" ||
+        (!relative.startsWith(`..${node_path_1.default.sep}`) && relative !== ".." && !node_path_1.default.isAbsolute(relative)));
+}
+/** Clear the plugin's complete CJS graph, keeping shared host modules intact. */
+function forgetPluginModules(directory) {
+    const runtimeRequire = eval("require");
+    const owned = [directory, ...(previousRoots.get(directory) || []), ...dependencyRoots(directory)];
+    previousRoots.delete(directory);
+    const belongs = (filename) => {
+        const parts = filename.split(`${node_path_1.default.sep}node_modules${node_path_1.default.sep}`);
+        if (parts.slice(1).some((part) => {
+            const name = part.startsWith("@")
+                ? part.split(node_path_1.default.sep).slice(0, 2).join("/")
+                : part.split(node_path_1.default.sep)[0];
+            return sharedModules.has(name);
+        }))
+            return false;
+        return owned.some((root) => within(root, filename));
+    };
+    for (const filename of Object.keys(runtimeRequire.cache)) {
+        if (belongs(filename))
+            delete runtimeRequire.cache[filename];
+    }
+    for (const mod of Object.values(runtimeRequire.cache)) {
+        if (mod)
+            mod.children = mod.children.filter((child) => !belongs(child.filename));
+    }
+    // npm can move a dependency or change its main entry. Node's CJS resolver
+    // retains those paths separately from require.cache.
+    const pathCache = runtimeRequire("node:module")._pathCache;
+    for (const [key, filename] of Object.entries(pathCache)) {
+        if (belongs(filename) || owned.some((root) => key.includes(root)))
+            delete pathCache[key];
+    }
+}
+function isEsm(entry) {
+    if (entry.endsWith(".mjs"))
+        return true;
+    if (entry.endsWith(".cjs"))
+        return false;
+    let directory = node_path_1.default.dirname(entry);
+    while (true) {
+        const filename = node_path_1.default.join(directory, "package.json");
+        if (node_fs_1.default.existsSync(filename))
+            return JSON.parse(node_fs_1.default.readFileSync(filename, "utf8")).type === "module";
+        const parent = node_path_1.default.dirname(directory);
+        if (parent === directory)
+            return false;
+        directory = parent;
+    }
+}
+/** Give an ESM entry and its local imports the same immutable revision URL. */
+async function loadPluginModule(entry, directory, revision) {
+    const runtimeRequire = eval("require");
+    previousRoots.set(directory, dependencyRoots(directory));
+    if (!isEsm(entry)) {
+        try {
+            return runtimeRequire(entry);
+        }
+        catch (error) {
+            if (error?.code !== "ERR_REQUIRE_ESM")
+                throw error;
+        }
+    }
+    graphs.set(revision, [directory, ...dependencyRoots(directory)]);
+    if (!hooksInstalled) {
+        const { registerHooks } = runtimeRequire("node:module");
+        if (typeof registerHooks !== "function")
+            throw new Error("ESM plugin updates require Node.js 22.15 or newer.");
+        registerHooks({
+            resolve(specifier, context, nextResolve) {
+                const resolved = nextResolve(specifier, context);
+                if (!context.parentURL?.startsWith("file:") || !resolved.url.startsWith("file:"))
+                    return resolved;
+                const parent = new URL(context.parentURL);
+                const parentRevision = parent.searchParams.get(REVISION);
+                if (!parentRevision)
+                    return resolved;
+                const roots = graphs.get(parentRevision);
+                if (!roots?.some((root) => within(root, (0, node_url_1.fileURLToPath)(parent))) ||
+                    !roots.some((root) => within(root, (0, node_url_1.fileURLToPath)(resolved.url))))
+                    return resolved;
+                const url = new URL(resolved.url);
+                url.searchParams.set(REVISION, parentRevision);
+                return { ...resolved, url: url.href };
+            }
+        });
+        hooksInstalled = true;
+    }
+    const url = (0, node_url_1.pathToFileURL)(entry);
+    url.searchParams.set(REVISION, revision);
+    const dynamicImport = new Function("specifier", "return import(specifier)");
+    return dynamicImport(url.href);
+}
+
+
 /***/ },
 
 /***/ "../common/src/plugin_npm.ts"
 (__unused_webpack_module, exports, __webpack_require__) {
 
+"use strict";
 
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -760,15 +1110,19 @@ exports.currentPackageRoot = currentPackageRoot;
 exports.currentProjectRoot = currentProjectRoot;
 exports.npmPluginRoots = npmPluginRoots;
 exports.listNpmPlugins = listNpmPlugins;
+exports.npmPluginOperationPending = npmPluginOperationPending;
+exports.isEssentialNpmPlugin = isEssentialNpmPlugin;
 exports.installNpmPlugin = installNpmPlugin;
 exports.uninstallNpmPlugin = uninstallNpmPlugin;
 const child_process_1 = __webpack_require__("child_process");
 const fs_extra_1 = __importDefault(__webpack_require__("fs-extra"));
 const path_1 = __importDefault(__webpack_require__("path"));
 const module_1 = __webpack_require__("module");
+const plugin_manifest_1 = __webpack_require__("../common/src/plugin_manifest.ts");
+const plugin_contract_1 = __webpack_require__("../common/src/plugin_contract.ts");
 const PLUGIN_ID = /^[a-z][a-z0-9_-]{1,63}$/;
 const PACKAGE_NAME = /^(?:@[a-z0-9_.-]+\/)?epanel-plugin-[a-z0-9_.-]+$/;
-const VERSION = /^[0-9][^\s/]{0,63}$/;
+const VERSION = /^[a-zA-Z0-9][a-zA-Z0-9._+-]{0,63}$/;
 function readJson(filename) {
     try {
         const parsed = JSON.parse(fs_extra_1.default.readFileSync(filename, "utf8"));
@@ -791,7 +1145,7 @@ function stringValue(value) {
     return typeof value === "string" ? value : "";
 }
 function currentPackageRoot() {
-    return path_1.default.resolve(process.env.EPANEL_PACKAGE_ROOT || process.cwd());
+    return path_1.default.resolve(process.env.EPANEL_PACKAGE_ROOT || process.env.EPANEL_SOURCE_ROOT || process.cwd());
 }
 function currentProjectRoot(packageRoot = currentPackageRoot()) {
     // The npm worker sets EPANEL_PROJECT_ROOT to the installation directory. In a
@@ -799,6 +1153,8 @@ function currentProjectRoot(packageRoot = currentPackageRoot()) {
     if (process.env.EPANEL_PROJECT_ROOT)
         return path_1.default.resolve(process.env.EPANEL_PROJECT_ROOT);
     const scope = path_1.default.resolve(packageRoot, "..");
+    if (path_1.default.basename(scope) === "core")
+        return path_1.default.dirname(scope);
     const nodeModules = path_1.default.dirname(scope);
     if (path_1.default.basename(nodeModules) === "node_modules" && path_1.default.basename(scope).startsWith("@"))
         return path_1.default.dirname(nodeModules);
@@ -834,8 +1190,20 @@ function pluginRecord(pluginId, name, source, packageRoot, directory, folder, ve
     return { pluginId, name, version, sides: [], directory, folder, packageRoot, source };
 }
 function readPackageEntry(packageRoot, name) {
-    const hostRequire = (0, module_1.createRequire)(path_1.default.join(packageRoot, "package.json"));
-    const manifestPath = hostRequire.resolve(`${name}/package.json`);
+    // Read package boundaries directly: Node caches require.resolve() paths even
+    // after npm moves an installation between nested and hoisted node_modules.
+    let manifestPath;
+    for (const root of [packageRoot, currentProjectRoot(packageRoot)]) {
+        const localRequire = (0, module_1.createRequire)(path_1.default.join(root, "package.json"));
+        manifestPath = (localRequire.resolve.paths(name) || [])
+            .map((directory) => path_1.default.join(directory, name, "package.json"))
+            .find((filename) => fs_extra_1.default.existsSync(filename));
+        if (manifestPath)
+            break;
+    }
+    if (!manifestPath)
+        throw new Error(`Missing npm plugin package: ${name}.`);
+    manifestPath = fs_extra_1.default.realpathSync(manifestPath);
     const metadata = readJson(manifestPath);
     if (!metadata)
         throw new Error(`Missing package metadata for ${name}.`);
@@ -849,7 +1217,10 @@ function sideDirectory(packageRoot, metadata, side) {
         return undefined;
     const target = path_1.default.resolve(packageRoot, directory);
     const relative = path_1.default.relative(packageRoot, target);
-    if (relative === "" || relative.startsWith(`..${path_1.default.sep}`) || path_1.default.isAbsolute(relative))
+    if (relative === "" ||
+        relative === ".." ||
+        relative.startsWith(`..${path_1.default.sep}`) ||
+        path_1.default.isAbsolute(relative))
         return undefined;
     return target;
 }
@@ -866,7 +1237,7 @@ function recordFromPackage(pluginId, name, source, packageRoot, metadata, side)
         return undefined;
     const directory = sideDirectory(packageRoot, metadata, target);
     const folder = stringValue(objectValue(elements[target])?.folder);
-    if (!directory || !folder)
+    if (!directory || !PLUGIN_ID.test(folder))
         return undefined;
     return {
         ...pluginRecord(pluginId, name, source, packageRoot, directory, folder, version),
@@ -886,9 +1257,24 @@ function listNpmPlugins(side, options = {}) {
     const host = readJson(path_1.default.join(packageRoot, "package.json"));
     if (!host)
         throw new Error(`Missing runtime package metadata: ${packageRoot}`);
-    const project = path_1.default.resolve(projectRoot) === path_1.default.resolve(packageRoot) ? null : readProjectManifest(projectRoot);
+    const project = path_1.default.resolve(projectRoot) === path_1.default.resolve(packageRoot)
+        ? null
+        : readProjectManifest(projectRoot);
     const hostMappings = mappingsOf(host);
-    const projectMappings = mappingsOf(project);
+    const projectMappings = { ...mappingsOf(project) };
+    for (const name of Object.keys(dependenciesOf(project))) {
+        if (!PACKAGE_NAME.test(name) || Object.values(projectMappings).includes(name))
+            continue;
+        try {
+            const entry = readPackageEntry(projectRoot, name);
+            const id = stringValue(objectValue(entry.metadata.elementspanel)?.id);
+            if (PLUGIN_ID.test(id) && projectMappings[id] === undefined)
+                projectMappings[id] = name;
+        }
+        catch {
+            /* npm may still be writing the package. */
+        }
+    }
     const mappings = new Map();
     for (const [pluginId, name] of Object.entries(projectMappings)) {
         if (!PLUGIN_ID.test(pluginId) || typeof name !== "string" || !PACKAGE_NAME.test(name))
@@ -898,6 +1284,8 @@ function listNpmPlugins(side, options = {}) {
     for (const [pluginId, name] of Object.entries(hostMappings)) {
         if (!PLUGIN_ID.test(pluginId) || typeof name !== "string" || !PACKAGE_NAME.test(name))
             continue;
+        if (dependenciesOf(host)[name] === undefined)
+            continue;
         mappings.set(pluginId, { name, source: "bundled" });
     }
     const hostDependencies = dependenciesOf(host);
@@ -913,7 +1301,7 @@ function listNpmPlugins(side, options = {}) {
         }
         let entry;
         try {
-            entry = readPackageEntry(packageRoot, mapping.name);
+            entry = readPackageEntry(mapping.source === "project" ? projectRoot : packageRoot, mapping.name);
         }
         catch (error) {
             if (options.skipInvalid)
@@ -945,7 +1333,12 @@ function runNpm(args, cwd) {
             : process.platform === "win32"
                 ? {
                     command: process.env.ComSpec || "cmd.exe",
-                    args: ["/d", "/s", "/c", `npm ${args.map((item) => `"${item.replace(/"/g, '""')}"`).join(" ")}`],
+                    args: [
+                        "/d",
+                        "/s",
+                        "/c",
+                        `npm ${args.map((item) => `"${item.replace(/"/g, '""')}"`).join(" ")}`
+                    ],
                     shell: false
                 }
                 : { command: "npm", args, shell: false };
@@ -964,9 +1357,10 @@ function runNpm(args, cwd) {
         };
         child.stdout?.on("data", append);
         child.stderr?.on("data", append);
+        const action = args.find((argument) => argument === "install" || argument === "uninstall") || "operation";
         const timer = setTimeout(() => {
             child.kill("SIGKILL");
-            reject(new Error(`npm ${args[0] ?? ""} timed out.`));
+            reject(new Error(`npm ${action} timed out.`));
         }, 10 * 60 * 1000);
         timer.unref?.();
         child.once("error", (error) => {
@@ -977,15 +1371,69 @@ function runNpm(args, cwd) {
             clearTimeout(timer);
             if (code === 0)
                 return resolve(output);
-            reject(new Error(`npm ${args[0] ?? ""} failed (${code}): ${output.trim()}`));
+            reject(new Error(`npm ${action} failed (${code}): ${output.trim()}`));
         });
     });
 }
-const operations = new Map();
+const operationsKey = Symbol.for("elementspanel.npm.operations");
+const shared = globalThis;
+const operations = (shared[operationsKey] ??= new Map());
+const LOCK_NAME = ".elementspanel-npm.lock";
+async function acquireProjectLock(projectRoot) {
+    await fs_extra_1.default.ensureDir(projectRoot);
+    const directory = path_1.default.join(projectRoot, LOCK_NAME);
+    const deadline = Date.now() + 11 * 60 * 1000;
+    while (true) {
+        try {
+            await fs_extra_1.default.mkdir(directory);
+            await fs_extra_1.default.writeJson(path_1.default.join(directory, "owner.json"), { pid: process.pid });
+            return () => fs_extra_1.default.remove(directory);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            try {
+                const owner = await fs_extra_1.default.readJson(path_1.default.join(directory, "owner.json"));
+                try {
+                    process.kill(owner.pid, 0);
+                }
+                catch (failure) {
+                    if (failure.code === "ESRCH") {
+                        await fs_extra_1.default.remove(directory);
+                        continue;
+                    }
+                }
+            }
+            catch {
+                if (Date.now() - ((await fs_extra_1.default.stat(directory).catch(() => null))?.mtimeMs ?? Date.now()) >
+                    60_000) {
+                    await fs_extra_1.default.remove(directory);
+                    continue;
+                }
+            }
+            if (Date.now() > deadline)
+                throw new Error("Another npm plugin operation is still running.");
+            await new Promise((resolve) => setTimeout(resolve, 200));
+        }
+    }
+}
+function npmPluginOperationPending() {
+    const { packageRoot, projectRoot } = npmPluginRoots();
+    return (operations.size > 0 ||
+        [packageRoot, projectRoot].some((root) => fs_extra_1.default.existsSync(path_1.default.join(root, LOCK_NAME))));
+}
 function withProjectLock(projectRoot, operation) {
     const key = process.platform === "win32" ? projectRoot.toLowerCase() : projectRoot;
     const previous = operations.get(key) ?? Promise.resolve();
-    const result = previous.then(operation);
+    const result = previous.then(async () => {
+        const release = await acquireProjectLock(projectRoot);
+        try {
+            return await operation();
+        }
+        finally {
+            await release();
+        }
+    });
     const settled = result.then(() => { }, () => { });
     operations.set(key, settled);
     return result.finally(() => {
@@ -993,18 +1441,18 @@ function withProjectLock(projectRoot, operation) {
             operations.delete(key);
     });
 }
-/**
- * Installs (or updates) one npm plugin as a project dependency.
- *
- * The version is pinned with `--save-exact`: the panel performs updates, so a
- * later bare `npm install` must not silently move the plugin to another release.
- */
+/** Core services keep the connection and management interface available. */
+function isEssentialNpmPlugin(pluginId) {
+    return ["i18n", "storage", "runtime", "server", "console", "config"].includes(pluginId);
+}
+/** npm changes dependencies and lockfiles; only append our plugin mapping afterwards. */
 async function installNpmPlugin(options) {
-    const { name, pluginId, version, side } = options;
-    if (!PLUGIN_ID.test(pluginId))
-        throw new Error(`Invalid plugin id: ${pluginId}`);
+    const { name, side } = options;
+    const version = options.version || "latest";
     if (!PACKAGE_NAME.test(name))
         throw new Error(`Invalid npm plugin package: ${name}`);
+    if (options.pluginId && !PLUGIN_ID.test(options.pluginId))
+        throw new Error(`Invalid plugin id: ${options.pluginId}`);
     if (!VERSION.test(version))
         throw new Error(`Invalid plugin version: ${version}`);
     const { packageRoot, projectRoot } = npmPluginRoots(options);
@@ -1012,64 +1460,154 @@ async function installNpmPlugin(options) {
         const host = readJson(path_1.default.join(packageRoot, "package.json"));
         if (!host)
             throw new Error(`Missing runtime package metadata: ${packageRoot}`);
-        if (mappingsOf(host)[pluginId] !== undefined)
-            throw new Error(`BUNDLED:${pluginId}`);
-        const existing = mappingsOf(readProjectManifest(projectRoot))[pluginId];
-        if (existing !== undefined && existing !== name)
-            throw new Error(`Plugin id ${pluginId} is already installed as ${String(existing)}.`);
-        await fs_extra_1.default.ensureDir(projectRoot);
-        await runNpm(["install", `${name}@${version}`, "--save", "--save-exact", "--no-fund", "--no-audit", "--ignore-scripts"], projectRoot);
-        let entry;
+        const hostId = Object.entries(mappingsOf(host)).find(([, value]) => value === name && dependenciesOf(host)[name] !== undefined)?.[0];
+        const targetRoot = hostId ? packageRoot : projectRoot;
+        if (hostId && isEssentialNpmPlugin(hostId))
+            throw new Error(`The essential plugin "${hostId}" cannot be replaced while running.`);
+        if (options.pluginId &&
+            mappingsOf(host)[options.pluginId] &&
+            dependenciesOf(host)[String(mappingsOf(host)[options.pluginId])] !== undefined &&
+            mappingsOf(host)[options.pluginId] !== name)
+            throw new Error(`BUNDLED:${options.pluginId}`);
+        const original = readProjectManifest(targetRoot);
+        const previous = dependenciesOf(original)[name];
+        let previousVersion = previous;
+        if (previous) {
+            try {
+                previousVersion = readPackageEntry(targetRoot, name).metadata.version || previous;
+            }
+            catch {
+                /* Keep the declared spec if the previous package is incomplete. */
+            }
+        }
+        const backups = new Map();
+        for (const filename of ["package.json", "package-lock.json", "npm-shrinkwrap.json"]) {
+            const target = path_1.default.join(targetRoot, filename);
+            backups.set(target, fs_extra_1.default.existsSync(target) ? fs_extra_1.default.readFileSync(target) : null);
+        }
         try {
-            entry = readPackageEntry(packageRoot, name);
+            await runNpm([
+                "--prefix",
+                targetRoot,
+                "install",
+                `${name}@${version}`,
+                "--save",
+                "--save-exact",
+                "--no-fund",
+                "--no-audit",
+                "--ignore-scripts"
+            ], targetRoot);
+            const entry = readPackageEntry(targetRoot, name);
+            const pluginId = options.pluginId || stringValue(objectValue(entry.metadata.elementspanel)?.id);
+            if (!PLUGIN_ID.test(pluginId))
+                throw new Error(`Invalid plugin id in ${name}.`);
+            if (mappingsOf(host)[pluginId] &&
+                dependenciesOf(host)[String(mappingsOf(host)[pluginId])] !== undefined &&
+                mappingsOf(host)[pluginId] !== name)
+                throw new Error(`Plugin id ${pluginId} belongs to a bundled dependency.`);
+            if (hostId && pluginId !== hostId)
+                throw new Error(`The package ${name} changed its plugin id from ${hostId} to ${pluginId}.`);
+            const mapped = mappingsOf(readProjectManifest(targetRoot))[pluginId];
+            if (mapped !== undefined && mapped !== name)
+                throw new Error(`Plugin id ${pluginId} is already installed as ${String(mapped)}.`);
+            const record = recordFromPackage(pluginId, name, hostId ? "bundled" : "project", entry.root, entry.metadata, side);
+            if (!record)
+                throw new Error(`The package ${name} does not provide a ${side} plugin named ${pluginId}.`);
+            if (/^[0-9]/.test(version) && record.version !== version)
+                throw new Error(`The installed package ${name} is ${record.version}, expected ${version}.`);
+            if (!process.env.EPANEL_PACKAGE_ROOT &&
+                (0, plugin_manifest_1.discoverPlugins)(path_1.default.join(packageRoot, "plugins"), {
+                    entryFields: [],
+                    includeDisabled: true
+                }).some((plugin) => plugin.manifest.id === pluginId))
+                throw new Error(`Source plugin ${pluginId} cannot be replaced with an npm dependency.`);
+            const manifest = (0, plugin_manifest_1.readPluginManifest)(record.directory);
+            if (!manifest || manifest.id !== pluginId || manifest.version !== record.version)
+                throw new Error(`The plugin manifest in ${name} does not match its package.`);
+            (0, plugin_contract_1.validatePluginCompatibility)(manifest.elements);
+            for (const field of ["backend", "frontend", "panel", "daemon", "main", "entry", "ui"]) {
+                if (typeof manifest[field] === "string" &&
+                    !(0, plugin_manifest_1.resolvePluginEntry)(record.directory, manifest, { entryFields: [field] }))
+                    throw new Error(`Invalid ${field} entry in ${name}.`);
+            }
+            const others = listNpmPlugins(side, { packageRoot, projectRoot, skipInvalid: true });
+            if (others.some((plugin) => plugin.pluginId === pluginId && plugin.name !== name))
+                throw new Error(`Plugin id ${pluginId} is already provided by another dependency.`);
+            const collision = others.find((plugin) => plugin.pluginId !== pluginId && plugin.folder === record.folder);
+            if (collision)
+                throw new Error(`Plugin asset directory ${record.folder} is already used by ${collision.name}.`);
+            const updated = readProjectManifest(targetRoot);
+            updated.dependencies = { ...dependenciesOf(updated), [name]: record.version };
+            updated.elementspanel = {
+                ...objectValue(updated.elementspanel),
+                plugins: { ...mappingsOf(updated), [pluginId]: name }
+            };
+            writeProjectManifest(targetRoot, updated);
+            return record;
         }
         catch (error) {
-            await runNpm(["uninstall", name, "--no-fund", "--no-audit", "--ignore-scripts"], projectRoot).catch(() => { });
+            try {
+                await runNpm(previous
+                    ? [
+                        "--prefix",
+                        targetRoot,
+                        "install",
+                        `${name}@${String(previousVersion)}`,
+                        "--save",
+                        "--no-fund",
+                        "--no-audit",
+                        "--ignore-scripts"
+                    ]
+                    : [
+                        "--prefix",
+                        targetRoot,
+                        "uninstall",
+                        name,
+                        "--no-fund",
+                        "--no-audit",
+                        "--ignore-scripts"
+                    ], targetRoot);
+            }
+            catch (rollback) {
+                throw new Error(`${String(error)}; npm rollback failed: ${String(rollback)}`);
+            }
+            finally {
+                for (const [filename, content] of backups) {
+                    if (content === null)
+                        await fs_extra_1.default.remove(filename);
+                    else
+                        await fs_extra_1.default.writeFile(filename, content);
+                }
+            }
             throw error;
         }
-        const record = recordFromPackage(pluginId, name, "project", entry.root, entry.metadata, side);
-        if (!record) {
-            await runNpm(["uninstall", name, "--no-fund", "--no-audit", "--ignore-scripts"], projectRoot).catch(() => { });
-            throw new Error(`The package ${name} does not provide a ${side} plugin named ${pluginId}.`);
-        }
-        if (record.version !== version) {
-            await runNpm(["uninstall", name, "--no-fund", "--no-audit", "--ignore-scripts"], projectRoot).catch(() => { });
-            throw new Error(`The installed package ${name} is ${record.version}, expected ${version}.`);
-        }
-        const manifest = readProjectManifest(projectRoot);
-        const dependencies = { ...dependenciesOf(manifest), [name]: version };
-        const elementspanel = { ...(objectValue(manifest.elementspanel) ?? {}) };
-        const plugins = { ...mappingsOf(manifest), [pluginId]: name };
-        manifest.dependencies = dependencies;
-        manifest.elementspanel = { ...elementspanel, plugins };
-        writeProjectManifest(projectRoot, manifest);
-        return record;
     });
 }
-/** Removes one project-installed npm plugin. Built-in packages are left alone. */
+/** Remove the dependency from the manifest that owns it, preserving user configuration. */
 async function uninstallNpmPlugin(pluginId, options = {}) {
     if (!PLUGIN_ID.test(pluginId))
         throw new Error(`Invalid plugin id: ${pluginId}`);
+    if (isEssentialNpmPlugin(pluginId))
+        throw new Error(`The essential plugin "${pluginId}" cannot be uninstalled.`);
     const { packageRoot, projectRoot } = npmPluginRoots(options);
     return withProjectLock(projectRoot, async () => {
         const host = readJson(path_1.default.join(packageRoot, "package.json"));
-        if (host && mappingsOf(host)[pluginId] !== undefined)
-            throw new Error(`BUNDLED:${pluginId}`);
-        const manifest = readProjectManifest(projectRoot);
-        const name = mappingsOf(manifest)[pluginId];
+        const bundledName = mappingsOf(host)[pluginId];
+        const targetRoot = typeof bundledName === "string" && dependenciesOf(host)[bundledName] !== undefined
+            ? packageRoot
+            : projectRoot;
+        const manifest = readProjectManifest(targetRoot);
+        const name = mappingsOf(manifest)[pluginId] ??
+            listNpmPlugins(undefined, { packageRoot, projectRoot, skipInvalid: true }).find((item) => item.pluginId === pluginId)?.name;
         if (typeof name !== "string" || !PACKAGE_NAME.test(name))
             return null;
         const record = listNpmPlugins(undefined, { packageRoot, projectRoot, skipInvalid: true }).find((item) => item.pluginId === pluginId);
-        await runNpm(["uninstall", name, "--no-fund", "--no-audit", "--ignore-scripts"], projectRoot);
-        const plugins = { ...mappingsOf(manifest) };
+        await runNpm(["--prefix", targetRoot, "uninstall", name, "--no-fund", "--no-audit", "--ignore-scripts"], targetRoot);
+        const updated = readProjectManifest(targetRoot);
+        const plugins = { ...mappingsOf(updated) };
         delete plugins[pluginId];
-        const elementspanel = { ...(objectValue(manifest.elementspanel) ?? {}) };
-        if (Object.keys(plugins).length)
-            elementspanel.plugins = plugins;
-        else
-            delete elementspanel.plugins;
-        manifest.elementspanel = elementspanel;
-        writeProjectManifest(projectRoot, manifest);
+        updated.elementspanel = { ...objectValue(updated.elementspanel), plugins };
+        writeProjectManifest(targetRoot, updated);
         return record ?? null;
     });
 }
@@ -1080,6 +1618,7 @@ async function uninstallNpmPlugin(pluginId, options = {}) {
 /***/ "../common/src/plugin_overrides.ts"
 (__unused_webpack_module, exports, __webpack_require__) {
 
+"use strict";
 
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -1168,6 +1707,7 @@ function writePluginOverride(id, patch, filename = pluginOverridesPath()) {
 /***/ "../common/src/plugin_revision.ts"
 (__unused_webpack_module, exports, __webpack_require__) {
 
+"use strict";
 
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -1218,11 +1758,89 @@ function pluginDirectoryRevision(directory) {
 }
 
 
+/***/ },
+
+/***/ "../common/src/plugin_watch.ts"
+(__unused_webpack_module, exports, __webpack_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.watchNpmPlugins = watchNpmPlugins;
+const node_fs_1 = __importDefault(__webpack_require__("node:fs"));
+const node_path_1 = __importDefault(__webpack_require__("node:path"));
+const plugin_npm_1 = __webpack_require__("../common/src/plugin_npm.ts");
+/** Poll package boundaries, allowing npm to finish replacing files before reconciliation. */
+function watchNpmPlugins(ctx, side, reload, changed) {
+    const stamp = () => {
+        const { packageRoot, projectRoot } = (0, plugin_npm_1.npmPluginRoots)();
+        if (!node_fs_1.default.existsSync(node_path_1.default.join(packageRoot, "package.json")))
+            return "";
+        const files = [];
+        for (const root of [packageRoot, projectRoot])
+            for (const name of [
+                "package.json",
+                "package-lock.json",
+                "npm-shrinkwrap.json",
+                "node_modules/.package-lock.json"
+            ])
+                files.push(node_path_1.default.join(root, name));
+        for (const plugin of (0, plugin_npm_1.listNpmPlugins)(side, { skipInvalid: true }))
+            files.push(node_path_1.default.join(plugin.packageRoot, "package.json"), node_path_1.default.join(plugin.directory, "plugin.json"));
+        return JSON.stringify(files.map((filename) => {
+            try {
+                const stat = node_fs_1.default.statSync(filename);
+                return [filename, stat.size, stat.mtimeMs, stat.ctimeMs];
+            }
+            catch {
+                return [filename, null];
+            }
+        }));
+    };
+    let applied = stamp();
+    let candidate = applied;
+    let busy = false;
+    ctx.setInterval(() => {
+        if (busy || (0, plugin_npm_1.npmPluginOperationPending)())
+            return;
+        try {
+            const next = stamp();
+            if (next === applied) {
+                candidate = next;
+                return;
+            }
+            if (next !== candidate) {
+                candidate = next;
+                return;
+            }
+            busy = true;
+            void reload()
+                .then(() => {
+                applied = next;
+                candidate = next;
+                changed?.();
+            })
+                .catch((error) => ctx.logger.warn("Failed to synchronize npm plugins", error))
+                .finally(() => {
+                busy = false;
+            });
+        }
+        catch (error) {
+            ctx.logger.warn("Failed to inspect npm plugins", error);
+        }
+    }, 2000);
+}
+
+
 /***/ },
 
 /***/ "../common/src/process_tools.ts"
 (__unused_webpack_module, exports, __webpack_require__) {
 
+"use strict";
 
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -1387,6 +2005,7 @@ function killProcess(pid, process, signal) {
 /***/ "../common/src/query_wrapper.ts"
 (__unused_webpack_module, exports) {
 
+"use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.QueryWrapper = exports.LocalFileSource = exports.MySqlSource = exports.QueryMapWrapper = void 0;
@@ -1500,6 +2119,7 @@ exports.QueryWrapper = QueryWrapper;
 /***/ "../common/src/runtime_paths.ts"
 (__unused_webpack_module, exports, __webpack_require__) {
 
+"use strict";
 
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -1514,22 +2134,24 @@ exports.ensureExecutable = ensureExecutable;
 const node_fs_1 = __importDefault(__webpack_require__("node:fs"));
 const node_os_1 = __importDefault(__webpack_require__("node:os"));
 const node_path_1 = __importDefault(__webpack_require__("node:path"));
+// @ts-ignore Shared source layout is also consumed by the Node build tools.
+const workspace_layout_cjs_1 = __webpack_require__("../../scripts/workspace-layout.cjs");
 /** Set by the npm worker before any application module is loaded. */
 function isPackagedRuntime() {
     return Boolean(process.env.EPANEL_PACKAGE_ROOT);
 }
 /** Code and bundled assets belong to the package; cwd always belongs to the user. */
 function packagePath(...parts) {
-    return node_path_1.default.resolve(process.env.EPANEL_PACKAGE_ROOT || process.cwd(), ...parts);
+    return node_path_1.default.resolve(process.env.EPANEL_PACKAGE_ROOT || process.env.EPANEL_SOURCE_ROOT || process.cwd(), ...parts);
 }
 function npmPluginRoots(side) {
     // The same resolver is used by the CLI before the bundled application starts.
-    // A development checkout keeps it in the repository, beside the side packages,
+    // A development checkout keeps it in the repository above core/<side>,
     // so project-installed npm plugins work there as well.
     const runtimeRequire = eval("require");
     const resolver = isPackagedRuntime()
         ? packagePath("runtime/npm-plugins.cjs")
-        : node_path_1.default.resolve(packagePath(), "..", "scripts", "runtime", "npm-plugins.cjs");
+        : node_path_1.default.resolve(packagePath(), "../..", "scripts", "runtime", "npm-plugins.cjs");
     // A development process may run from a fixture directory without a runtime
     // package; there is nothing to resolve in that case.
     if (!node_fs_1.default.existsSync(node_path_1.default.join(packagePath(), "package.json")))
@@ -1539,6 +2161,9 @@ function npmPluginRoots(side) {
     const { resolveNpmPlugins } = runtimeRequire(resolver);
     return resolveNpmPlugins(packagePath(), side, { skipInvalid: true }).map((record) => ({
         directory: record.directory,
+        packageRoot: record.packageRoot,
+        packageName: record.name,
+        npmSource: record.source,
         ...(record.folder ? { folder: record.folder } : {}),
         // Built-in packages are part of the runtime's default configuration. A
         // project dependency is installed but remains dormant until the user
@@ -1547,9 +2172,16 @@ function npmPluginRoots(side) {
     }));
 }
 function packagePluginRoots(side) {
+    const sourceCheckout = process.env.EPANEL_SOURCE_ROOT || node_path_1.default.basename(node_path_1.default.dirname(packagePath())) === "core";
     const roots = isPackagedRuntime()
         ? []
-        : [{ directory: packagePath("plugins"), defaultEnabled: true }];
+        : !sourceCheckout
+            ? [{ directory: packagePath("plugins"), defaultEnabled: true }]
+            : (0, workspace_layout_cjs_1.sourcePlugins)(side, node_path_1.default.resolve(packagePath(), "../..")).map((plugin) => ({
+                directory: plugin.directory,
+                folder: plugin.folder,
+                defaultEnabled: true
+            }));
     // Project-installed npm plugins load in development too: they are dependencies
     // of the development project, not of the published runtime package.
     roots.push(...npmPluginRoots(side));
@@ -1570,7 +2202,7 @@ function bundledToolPath(name) {
     // Published daemon packages download native tools into the installation's
     // writable lib directory on first start. Development checkouts use the same
     // repository-local sibling of data and logs.
-    const root = isPackagedRuntime() ? node_path_1.default.resolve(process.cwd(), "lib") : packagePath("lib");
+    const root = node_path_1.default.resolve(process.cwd(), "lib");
     const primary = node_path_1.default.join(root, filename);
     // Zip-Tools names its Intel macOS binary "amd64", while Node reports "x64".
     if (!node_fs_1.default.existsSync(primary) && name === "file_zip" && platform === "darwin" && arch === "x64") {
@@ -1598,6 +2230,7 @@ function ensureExecutable(filename) {
 /***/ "../common/src/string_utils.ts"
 (__unused_webpack_module, exports) {
 
+"use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.removeTrail = removeTrail;
@@ -1616,6 +2249,7 @@ function removeTrail(origin, trail) {
 /***/ "../common/src/system_info.ts"
 (__unused_webpack_module, exports, __webpack_require__) {
 
+"use strict";
 
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -1708,6 +2342,7 @@ function systemInfo() {
 /***/ "../common/src/system_storage.ts"
 (__unused_webpack_module, exports, __webpack_require__) {
 
+"use strict";
 
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -1839,6 +2474,7 @@ exports["default"] = StorageSubsystem;
 /***/ "../common/src/typecheck.ts"
 (__unused_webpack_module, exports) {
 
+"use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.configureEntityParams = configureEntityParams;
@@ -1913,113 +2549,12 @@ function supposeValue(v, def) {
 }
 
 
-/***/ },
-
-/***/ "./plugins/config/src/backend/settings.ts"
-(__unused_webpack_module, exports, __webpack_require__) {
-
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.SettingsFormService = void 0;
-const mcsmanager_common_1 = __webpack_require__("../common/src/index.ts");
-const cordis_1 = __webpack_require__("cordis");
-const cosmokit_1 = __webpack_require__("cosmokit");
-/** Configuration declarations are owned by the daemon config plugin. */
-class SettingsFormService extends cordis_1.Service {
-    declarations = [];
-    constructor(ctx) {
-        super(ctx, "settingsForm", true);
-    }
-    declare(declaration) {
-        const entry = { id: this.ctx.name, declaration };
-        return this.ctx.effect(() => {
-            this.declarations.push(entry);
-            return () => (0, cosmokit_1.remove)(this.declarations, entry);
-        });
-    }
-    declared() {
-        return this.declarations.map((entry) => entry.id);
-    }
-    async read(id) {
-        const entry = this.declarations.find((item) => item.id === id);
-        if (!entry) {
-            const schema = this.ctx.plugins.configuration(id);
-            return schema.fields.length ? schema : null;
-        }
-        return { id, fields: entry.declaration.fields(), values: await entry.declaration.read() };
-    }
-    async write(id, values) {
-        const entry = this.declarations.find((item) => item.id === id);
-        if (!entry)
-            return (await this.ctx.plugins.configure(id, values)).result;
-        return this.ctx.plugins.runExclusive(async () => {
-            (0, mcsmanager_common_1.validatePluginSettings)(entry.declaration.fields(), values);
-            await entry.declaration.write(values);
-            return {
-                saved: true,
-                application: entry.declaration.restartRequired ? "restart-required" : "applied"
-            };
-        });
-    }
-}
-exports.SettingsFormService = SettingsFormService;
-
-
-/***/ },
-
-/***/ "./plugins/config/src/i18n/index.ts"
-(__unused_webpack_module, exports, __webpack_require__) {
-
-
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.localeMessages = void 0;
-const de_DE_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/de_DE.json"));
-const en_US_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/en_US.json"));
-const es_ES_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/es_ES.json"));
-const fr_FR_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/fr_FR.json"));
-const ja_JP_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/ja_JP.json"));
-const ko_KR_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/ko_KR.json"));
-const pt_BR_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/pt_BR.json"));
-const ru_RU_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/ru_RU.json"));
-const th_TH_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/th_TH.json"));
-const tr_TR_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/tr_TR.json"));
-const zh_CN_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/zh_CN.json"));
-const zh_TW_json_1 = __importDefault(__webpack_require__("./plugins/config/src/i18n/zh_TW.json"));
-// The refusals this plugin's protocol handlers throw. The panel surfaces them
-// verbatim on its plugin manager page, so they are translated here rather than
-// in the panel: this daemon knows which of its own plugins may not be switched
-// off remotely, and it answers in the language it was told to speak.
-exports.localeMessages = {
-    de_de: de_DE_json_1.default,
-    en_us: en_US_json_1.default,
-    es_es: es_ES_json_1.default,
-    fr_fr: fr_FR_json_1.default,
-    ja_jp: ja_JP_json_1.default,
-    ko_kr: ko_KR_json_1.default,
-    pt_br: pt_BR_json_1.default,
-    ru_ru: ru_RU_json_1.default,
-    th_th: th_TH_json_1.default,
-    tr_tr: tr_TR_json_1.default,
-    zh_cn: zh_CN_json_1.default,
-    zh_tw: zh_TW_json_1.default
-};
-
-
-/***/ },
-
-/***/ "events"
-(module) {
-
-module.exports = require("events");
-
 /***/ },
 
 /***/ "fs-extra"
 (module) {
 
+"use strict";
 module.exports = require("fs-extra");
 
 /***/ },
@@ -2027,6 +2562,7 @@ module.exports = require("fs-extra");
 /***/ "iconv-lite"
 (module) {
 
+"use strict";
 module.exports = require("iconv-lite");
 
 /***/ },
@@ -2034,6 +2570,7 @@ module.exports = require("iconv-lite");
 /***/ "os-utils"
 (module) {
 
+"use strict";
 module.exports = require("os-utils");
 
 /***/ },
@@ -2041,6 +2578,7 @@ module.exports = require("os-utils");
 /***/ "cordis"
 (module) {
 
+"use strict";
 module.exports = require("cordis");
 
 /***/ },
@@ -2048,6 +2586,7 @@ module.exports = require("cordis");
 /***/ "cosmokit"
 (module) {
 
+"use strict";
 module.exports = require("cosmokit");
 
 /***/ },
@@ -2055,6 +2594,7 @@ module.exports = require("cosmokit");
 /***/ "child_process"
 (module) {
 
+"use strict";
 module.exports = require("child_process");
 
 /***/ },
@@ -2062,13 +2602,23 @@ module.exports = require("child_process");
 /***/ "crypto"
 (module) {
 
+"use strict";
 module.exports = require("crypto");
 
 /***/ },
 
+/***/ "events"
+(module) {
+
+"use strict";
+module.exports = require("events");
+
+/***/ },
+
 /***/ "fs"
 (module) {
 
+"use strict";
 module.exports = require("fs");
 
 /***/ },
@@ -2076,6 +2626,7 @@ module.exports = require("fs");
 /***/ "module"
 (module) {
 
+"use strict";
 module.exports = require("module");
 
 /***/ },
@@ -2083,6 +2634,7 @@ module.exports = require("module");
 /***/ "net"
 (module) {
 
+"use strict";
 module.exports = require("net");
 
 /***/ },
@@ -2090,6 +2642,7 @@ module.exports = require("net");
 /***/ "node:crypto"
 (module) {
 
+"use strict";
 module.exports = require("node:crypto");
 
 /***/ },
@@ -2097,13 +2650,23 @@ module.exports = require("node:crypto");
 /***/ "node:fs"
 (module) {
 
+"use strict";
 module.exports = require("node:fs");
 
 /***/ },
 
+/***/ "node:module"
+(module) {
+
+"use strict";
+module.exports = require("node:module");
+
+/***/ },
+
 /***/ "node:os"
 (module) {
 
+"use strict";
 module.exports = require("node:os");
 
 /***/ },
@@ -2111,13 +2674,23 @@ module.exports = require("node:os");
 /***/ "node:path"
 (module) {
 
+"use strict";
 module.exports = require("node:path");
 
 /***/ },
 
+/***/ "node:url"
+(module) {
+
+"use strict";
+module.exports = require("node:url");
+
+/***/ },
+
 /***/ "os"
 (module) {
 
+"use strict";
 module.exports = require("os");
 
 /***/ },
@@ -2125,6 +2698,7 @@ module.exports = require("os");
 /***/ "path"
 (module) {
 
+"use strict";
 module.exports = require("path");
 
 /***/ },
@@ -2132,91 +2706,158 @@ module.exports = require("path");
 /***/ "process"
 (module) {
 
+"use strict";
 module.exports = require("process");
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/de_DE.json"
+/***/ "../../scripts/workspace-layout.cjs"
+(module, __unused_webpack_exports, __webpack_require__) {
+
+const fs = __webpack_require__("node:fs");
+const path = __webpack_require__("node:path");
+
+const repository = path.resolve(__dirname, "..");
+const coreDirectory = (side, root = repository) => path.join(root, "core", side);
+const developmentDirectory = (side, root = repository) => path.join(root, "data", side);
+
+/** Source packages use the same per-side metadata as their published npm packages. */
+function sourcePlugins(side, root = repository) {
+  if (!["panel", "daemon"].includes(side)) throw new Error(`Unknown plugin side: ${side}`);
+  const directory = path.join(root, "plugins");
+  if (!fs.existsSync(directory)) return [];
+  const plugins = [];
+  for (const item of fs.readdirSync(directory, { withFileTypes: true })) {
+    if (!item.isDirectory()) continue;
+    const packageRoot = path.join(directory, item.name);
+    const filename = path.join(packageRoot, "package.json");
+    if (!fs.existsSync(filename)) continue;
+    const metadata = JSON.parse(fs.readFileSync(filename, "utf8"));
+    const definition = metadata.elementspanel?.[side];
+    if (!definition) continue;
+    const id = metadata.elementspanel.id;
+    if (typeof id !== "string" || typeof definition.directory !== "string")
+      throw new Error(`Invalid ${side} plugin metadata: ${filename}`);
+    const pluginDirectory = path.resolve(packageRoot, definition.directory);
+    const relative = path.relative(packageRoot, pluginDirectory);
+    if (
+      !relative ||
+      relative === ".." ||
+      relative.startsWith(`..${path.sep}`) ||
+      path.isAbsolute(relative)
+    )
+      throw new Error(`Plugin directory must stay inside its package: ${filename}`);
+    if (!fs.existsSync(path.join(pluginDirectory, "plugin.json")))
+      throw new Error(`Missing ${side} plugin manifest: ${pluginDirectory}`);
+    plugins.push({
+      id,
+      folder: definition.folder || id,
+      directory: pluginDirectory,
+      packageRoot,
+      metadata
+    });
+  }
+  return plugins.sort((a, b) => a.id.localeCompare(b.id));
+}
+
+module.exports = { repository, coreDirectory, developmentDirectory, sourcePlugins };
+
+
+/***/ },
+
+/***/ "../../plugins/config/daemon/src/i18n/de_DE.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Der Webserver kann nicht aus der Ferne deaktiviert werden: Das Panel würde die Verbindung verlieren, über die es diesen Daemon verwaltet. Setze enabled auf dem Host in seiner plugin.json auf false.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"Eine Plugin-ID ist erforderlich.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"Die Plugin-Verwaltung kann sich nicht selbst deaktivieren: Das Panel würde die Events verlieren, mit denen es diesen Daemon verwaltet. Setze enabled auf dem Host in seiner plugin.json auf false."}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Der Webserver kann nicht aus der Ferne deaktiviert werden: Das Panel würde die Verbindung verlieren, über die es diesen Daemon verwaltet. Setze plugins.server.enabled auf dem Host in seiner data/plugin-overrides.json auf false.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"Eine Plugin-ID ist erforderlich.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"Die Plugin-Verwaltung kann sich nicht selbst deaktivieren: Das Panel würde die Events verlieren, mit denen es diesen Daemon verwaltet. Setze plugins.config.enabled auf dem Host in seiner data/plugin-overrides.json auf false."}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/en_US.json"
+/***/ "../../plugins/config/daemon/src/i18n/en_US.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"The web server cannot be disabled remotely: the panel would lose the connection it manages this daemon over. Set enabled to false in its plugin.json on the host instead.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"A plugin id is required.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"Plugin management cannot disable itself: the panel would lose the events it administers this daemon with. Set enabled to false in its plugin.json on the host instead."}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"The web server cannot be disabled remotely: the panel would lose the connection it manages this daemon over. Set plugins.server.enabled to false in its data/plugin-overrides.json on the host instead.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"A plugin id is required.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"Plugin management cannot disable itself: the panel would lose the events it administers this daemon with. Set plugins.config.enabled to false in its data/plugin-overrides.json on the host instead."}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/es_ES.json"
+/***/ "../../plugins/config/daemon/src/i18n/es_ES.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"El servidor web no puede desactivarse de forma remota: el panel perdería la conexión con la que administra este demonio. Establece enabled en false en su plugin.json en el host.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"Se requiere un id de complemento.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"La gestión de complementos no puede desactivarse a sí misma: el panel perdería los eventos con los que administra este demonio. Establece enabled en false en su plugin.json en el host."}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"El servidor web no puede desactivarse de forma remota: el panel perdería la conexión con la que administra este demonio. Establece plugins.server.enabled en false en su data/plugin-overrides.json en el host.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"Se requiere un id de complemento.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"La gestión de complementos no puede desactivarse a sí misma: el panel perdería los eventos con los que administra este demonio. Establece plugins.config.enabled en false en su data/plugin-overrides.json en el host."}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/fr_FR.json"
+/***/ "../../plugins/config/daemon/src/i18n/fr_FR.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Le serveur web ne peut pas être désactivé à distance : le panneau perdrait la connexion par laquelle il administre ce démon. Définissez enabled à false dans son plugin.json sur l hôte.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"Un identifiant d extension est requis.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"Le gestionnaire d extensions ne peut pas se désactiver lui-même : le panneau perdrait les événements par lesquels il administre ce démon. Définissez enabled à false dans son plugin.json sur l hôte."}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Le serveur web ne peut pas être désactivé à distance : le panneau perdrait la connexion par laquelle il administre ce démon. Définissez plugins.server.enabled à false dans son data/plugin-overrides.json sur l hôte.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"Un identifiant d extension est requis.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"Le gestionnaire d extensions ne peut pas se désactiver lui-même : le panneau perdrait les événements par lesquels il administre ce démon. Définissez plugins.config.enabled à false dans son data/plugin-overrides.json sur l hôte."}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/ja_JP.json"
+/***/ "../../plugins/config/daemon/src/i18n/ja_JP.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Web サーバーはリモートから無効にできません。パネルがこのデーモンを管理している接続を失います。ホスト上で plugin.json の enabled を false に設定してください。","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"プラグイン ID を指定してください。","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"プラグイン管理は自身を無効にできません。パネルがこのデーモンを管理しているイベントを失います。ホスト上で plugin.json の enabled を false に設定してください。"}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Web サーバーはリモートから無効にできません。パネルがこのデーモンを管理している接続を失います。ホスト上で data/plugin-overrides.json の plugins.server.enabled を false に設定してください。","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"プラグイン ID を指定してください。","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"プラグイン管理は自身を無効にできません。パネルがこのデーモンを管理しているイベントを失います。ホスト上で data/plugin-overrides.json の plugins.config.enabled を false に設定してください。"}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/ko_KR.json"
+/***/ "../../plugins/config/daemon/src/i18n/ko_KR.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"웹 서버는 원격으로 비활성화할 수 없습니다. 패널이 이 데몬을 관리하는 연결을 잃게 됩니다. 호스트에서 plugin.json의 enabled 를 false 로 설정하세요.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"플러그인 ID가 필요합니다.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"플러그인 관리는 자신을 비활성화할 수 없습니다. 패널이 이 데몬을 관리하는 이벤트를 잃게 됩니다. 호스트에서 plugin.json의 enabled 를 false 로 설정하세요."}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"웹 서버는 원격으로 비활성화할 수 없습니다. 패널이 이 데몬을 관리하는 연결을 잃게 됩니다. 호스트에서 data/plugin-overrides.json의 plugins.server.enabled 를 false 로 설정하세요.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"플러그인 ID가 필요합니다.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"플러그인 관리는 자신을 비활성화할 수 없습니다. 패널이 이 데몬을 관리하는 이벤트를 잃게 됩니다. 호스트에서 data/plugin-overrides.json의 plugins.config.enabled 를 false 로 설정하세요."}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/pt_BR.json"
+/***/ "../../plugins/config/daemon/src/i18n/pt_BR.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"O servidor web não pode ser desativado remotamente: o painel perderia a conexão pela qual administra este daemon. Defina enabled como false no plugin.json dele no host.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"É necessário informar o id do plugin.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"O gerenciador de plugins não pode desativar a si mesmo: o painel perderia os eventos pelos quais administra este daemon. Defina enabled como false no plugin.json dele no host."}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"O servidor web não pode ser desativado remotamente: o painel perderia a conexão pela qual administra este daemon. Defina plugins.server.enabled como false no data/plugin-overrides.json dele no host.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"É necessário informar o id do plugin.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"O gerenciador de plugins não pode desativar a si mesmo: o painel perderia os eventos pelos quais administra este daemon. Defina plugins.config.enabled como false no data/plugin-overrides.json dele no host."}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/ru_RU.json"
+/***/ "../../plugins/config/daemon/src/i18n/ru_RU.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Веб-сервер нельзя отключить удалённо: панель потеряет соединение, через которое управляет этим демоном. Укажите enabled: false в его plugin.json на хосте.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"Требуется идентификатор плагина.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"Менеджер плагинов не может отключить сам себя: панель потеряет события, через которые управляет этим демоном. Укажите enabled: false в его plugin.json на хосте."}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Веб-сервер нельзя отключить удалённо: панель потеряет соединение, через которое управляет этим демоном. Укажите plugins.server.enabled: false в его data/plugin-overrides.json на хосте.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"Требуется идентификатор плагина.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"Менеджер плагинов не может отключить сам себя: панель потеряет события, через которые управляет этим демоном. Укажите plugins.config.enabled: false в его data/plugin-overrides.json на хосте."}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/th_TH.json"
+/***/ "../../plugins/config/daemon/src/i18n/th_TH.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"ไม่สามารถปิดใช้งานเว็บเซิร์ฟเวอร์จากระยะไกลได้ แผงควบคุมจะเสียการเชื่อมต่อที่ใช้จัดการดีมอนนี้ กรุณาตั้ง enabled เป็น false ใน plugin.json ของมันบนเครื่องโฮสต์","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"ต้องระบุรหัสปลั๊กอิน","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"ตัวจัดการปลั๊กอินปิดใช้งานตัวเองไม่ได้ แผงควบคุมจะเสียอีเวนต์ที่ใช้จัดการดีมอนนี้ กรุณาตั้ง enabled เป็น false ใน plugin.json ของมันบนเครื่องโฮสต์"}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"ไม่สามารถปิดใช้งานเว็บเซิร์ฟเวอร์จากระยะไกลได้ แผงควบคุมจะเสียการเชื่อมต่อที่ใช้จัดการดีมอนนี้ กรุณาตั้ง plugins.server.enabled เป็น false ใน data/plugin-overrides.json ของมันบนเครื่องโฮสต์","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"ต้องระบุรหัสปลั๊กอิน","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"ตัวจัดการปลั๊กอินปิดใช้งานตัวเองไม่ได้ แผงควบคุมจะเสียอีเวนต์ที่ใช้จัดการดีมอนนี้ กรุณาตั้ง plugins.config.enabled เป็น false ใน data/plugin-overrides.json ของมันบนเครื่องโฮสต์"}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/tr_TR.json"
+/***/ "../../plugins/config/daemon/src/i18n/tr_TR.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Web sunucusu uzaktan devre dışı bırakılamaz: panel bu daemon u yönettiği bağlantıyı kaybeder. Bunun yerine ana makinede plugin.json dosyasında enabled değerini false yapın.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"Bir eklenti kimliği gerekli.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"Eklenti yöneticisi kendisini devre dışı bırakamaz: panel bu daemon u yönettiği olayları kaybeder. Bunun yerine ana makinede plugin.json dosyasında enabled değerini false yapın."}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Web sunucusu uzaktan devre dışı bırakılamaz: panel bu daemon u yönettiği bağlantıyı kaybeder. Bunun yerine ana makinede data/plugin-overrides.json dosyasında plugins.server.enabled değerini false yapın.","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"Bir eklenti kimliği gerekli.","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"Eklenti yöneticisi kendisini devre dışı bırakamaz: panel bu daemon u yönettiği olayları kaybeder. Bunun yerine ana makinede data/plugin-overrides.json dosyasında plugins.config.enabled değerini false yapın."}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/zh_CN.json"
+/***/ "../../plugins/config/daemon/src/i18n/zh_CN.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Web 服务器不能远程禁用：面板会失去用来管理这个守护进程的连接。请在宿主机上把它的 plugin.json 里的 enabled 设为 false。","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"必须提供插件 ID。","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"插件管理无法禁用自己：面板会失去用来管理这个守护进程的事件。请在宿主机上把它的 plugin.json 里的 enabled 设为 false。"}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Web 服务器不能远程禁用：面板会失去用来管理这个守护进程的连接。请在宿主机上把它的 data/plugin-overrides.json 里的 plugins.server.enabled 设为 false。","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"必须提供插件 ID。","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"插件管理无法禁用自己：面板会失去用来管理这个守护进程的事件。请在宿主机上把它的 data/plugin-overrides.json 里的 plugins.config.enabled 设为 false。"}');
 
 /***/ },
 
-/***/ "./plugins/config/src/i18n/zh_TW.json"
+/***/ "../../plugins/config/daemon/src/i18n/zh_TW.json"
 (module) {
 
-module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Web 伺服器不能遠端停用：面板會失去用來管理這個守護行程的連線。請在主機上把它的 plugin.json 裡的 enabled 設為 false。","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"必須提供外掛 ID。","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"外掛管理無法停用自己：面板會失去用來管理這個守護行程的事件。請在主機上把它的 plugin.json 裡的 enabled 設為 false。"}');
+"use strict";
+module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DISABLE":"Web 伺服器不能遠端停用：面板會失去用來管理這個守護行程的連線。請在主機上把它的 data/plugin-overrides.json 裡的 plugins.server.enabled 設為 false。","TXT_CODE_DAEMON_PLUGIN_ID_REQUIRED":"必須提供外掛 ID。","TXT_CODE_DAEMON_PLUGIN_SELF_DISABLE":"外掛管理無法停用自己：面板會失去用來管理這個守護行程的事件。請在主機上把它的 data/plugin-overrides.json 裡的 plugins.config.enabled 設為 false。"}');
 
 /***/ }
 
@@ -2248,16 +2889,18 @@ module.exports = /*#__PURE__*/JSON.parse('{"TXT_CODE_DAEMON_PLUGIN_ESSENTIAL_DIS
 /******/ 	
 /************************************************************************/
 var __webpack_exports__ = {};
-// This entry needs to be wrapped in an IIFE because it uses a non-standard name for the exports (exports).
+// This entry needs to be wrapped in an IIFE because it needs to be in strict mode.
 (() => {
+"use strict";
 var exports = __webpack_exports__;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.inject = void 0;
 exports.apply = apply;
 const mcsmanager_common_1 = __webpack_require__("../common/src/index.ts");
-const i18n_1 = __webpack_require__("./plugins/config/src/i18n/index.ts");
-const settings_1 = __webpack_require__("./plugins/config/src/backend/settings.ts");
+const i18n_1 = __webpack_require__("../../plugins/config/daemon/src/i18n/index.ts");
+const settings_1 = __webpack_require__("../../plugins/config/daemon/src/backend/settings.ts");
+const mcsmanager_common_2 = __webpack_require__("../common/src/index.ts");
 // Daemon side of the plugin manager. The daemon core owns the mechanism —
 // `ctx.plugins` lists what is installed and persists the enable switch — and
 // this plugin only exposes it over the protocol, because the panel's plugin
@@ -2376,11 +3019,10 @@ function apply(ctx) {
     ctx.protocol.on("plugin/npm/install", async (routerCtx, data) => {
         try {
             const payload = (data ?? {});
-            const record = await (0, mcsmanager_common_1.installNpmPlugin)({
+            const record = await ctx.plugins.install({
                 name: String(payload.name ?? ""),
-                pluginId: String(payload.pluginId ?? ""),
-                version: String(payload.version ?? ""),
-                side: "daemon"
+                pluginId: payload.pluginId ? String(payload.pluginId) : undefined,
+                version: payload.version ? String(payload.version) : undefined
             });
             ctx.protocol.response(routerCtx, record);
         }
@@ -2391,16 +3033,18 @@ function apply(ctx) {
     ctx.protocol.on("plugin/npm/uninstall", async (routerCtx, data) => {
         try {
             const pluginId = String(data?.pluginId ?? "");
-            const removed = await (0, mcsmanager_common_1.uninstallNpmPlugin)(pluginId);
-            ctx.protocol.response(routerCtx, { removed, pluginId });
+            await ctx.plugins.remove(pluginId);
+            if (data?.removeConfig === true) {
+                await ctx.plugins.runExclusive(async () => (0, mcsmanager_common_2.writePluginOverride)(pluginId, { config: {} }));
+            }
+            ctx.protocol.response(routerCtx, { removed: true, pluginId });
         }
         catch (error) {
             ctx.protocol.responseError(routerCtx, error);
         }
     });
-    // Re-scan the plugin directories for a plugin that arrived while the daemon
-    // was running. The panel reconnects after this response so protocol handlers
-    // from a newly loaded plugin are bound to a fresh socket.
+    // Reconcile dependencies and make their current handlers available on
+    // existing authenticated sockets.
     ctx.protocol.on("plugin/reload", async (routerCtx) => {
         try {
             await ctx.plugins.reload();