@hoardodile/host 0.0.0

package/dist/index.js

@@ -0,0 +1,3311 @@
+import { createWriteStream, createReadStream, existsSync, readFileSync, renameSync, rmSync, mkdirSync, readdirSync, cpSync, statSync, realpathSync } from 'fs';
+import { dirname, isAbsolute, normalize, resolve, sep, join } from 'path';
+import { pluginAssetError, fileTypeFromName, createFailingPlugin, definePlugin } from '@hoardodile/sdk-types';
+export { HOOK_NAMES, assertPluginShape, createFailingPlugin, createResourceAPIFixture, definePlugin, isDetected, isMissed, stubLogger } from '@hoardodile/sdk-types';
+import { mimeToKind, MIME_FFMPEG_INPUT_FORMAT } from '@hoardodile/sdk-types/media-exts';
+import { PLUGIN_READ_FILE_MAX_BYTES } from '@hoardodile/sdk-types/plugin';
+import { createHash, randomUUID } from 'crypto';
+import { mkdir, writeFile, stat, rename, rm, open, readdir, readFile, chmod, lstat } from 'fs/promises';
+import { tmpdir } from 'os';
+import { Readable } from 'stream';
+import { pipeline } from 'stream/promises';
+import yauzl from 'yauzl';
+import { fork, spawn } from 'child_process';
+import { createRequire } from 'module';
+import { buffer } from 'stream/consumers';
+import { createInflateRaw } from 'zlib';
+import { CAPABILITY_BY_METHOD } from '@hoardodile/sdk-types/plugin-capabilities';
+import { pathToFileURL, fileURLToPath } from 'url';
+import { pluginManifest } from '@hoardodile/sdk-types/schema';
+import { PLUGIN_ASSET_ERROR_NAMES } from '@hoardodile/sdk-types/plugin-asset-limits';
+
+// src/activation.ts
+
+// src/activation.ts
+function createPluginActivation(deps) {
+  async function activateAll(found) {
+    return Promise.all(
+      found.map(async (candidate) => {
+        const plugin = await loadDiskPlugin(deps.sandbox, candidate);
+        return {
+          id: candidate.id,
+          manifest: candidate.manifest,
+          enabled: candidate.enabled,
+          priority: candidate.priority,
+          pinned: candidate.pinned,
+          color: candidate.color,
+          missing: false,
+          builtin: candidate.source === "builtin",
+          dev: candidate.source === "dev",
+          plugin,
+          diskPath: candidate.diskPath
+        };
+      })
+    );
+  }
+  function createFailingEntries(missing) {
+    return missing.map((m) => ({
+      id: m.id,
+      manifest: m.manifest,
+      enabled: m.enabled,
+      priority: m.priority,
+      pinned: m.pinned,
+      color: m.color,
+      missing: true,
+      builtin: false,
+      dev: false,
+      plugin: createFailingPlugin(["plugin directory not found"])
+    }));
+  }
+  return { activateAll, createFailingEntries };
+}
+async function loadDiskPlugin(sandbox, candidate) {
+  const mainJsPath = join(candidate.diskPath, "main.js");
+  if (!existsSync(mainJsPath)) {
+    console.warn(`[plugin-activation] ${candidate.id}: no main.js, not loaded`);
+    return createFailingPlugin(["main.js not found"]);
+  }
+  const plugin = await sandbox.loadPlugin({
+    id: candidate.id,
+    mainPath: mainJsPath,
+    eager: candidate.enabled,
+    // The sandbox enforces manifest-gated API surface (container).
+    permissions: candidate.manifest.permissions
+  });
+  if (plugin === void 0) {
+    return createFailingPlugin(["main.js load error"]);
+  }
+  return plugin;
+}
+
+// src/errors.ts
+var DomainError = class extends Error {
+  code;
+  kind;
+  details;
+  constructor(code, kind, message, details) {
+    super(message);
+    this.name = "DomainError";
+    this.code = code;
+    this.kind = kind;
+    if (details !== void 0) this.details = details;
+  }
+};
+function invalid(kind, message, details) {
+  return new DomainError("VALIDATION", kind, message, details);
+}
+function conflict(kind, message, details) {
+  return new DomainError("CONFLICT", kind, message, details);
+}
+function notFound(kind, message, details) {
+  return new DomainError("NOT_FOUND", kind, message, details);
+}
+
+// src/archive/format.ts
+var SNIFF_WINDOW_BYTES = 4100;
+function hasMagic(head, magic) {
+  if (head.byteLength < magic.length) return false;
+  for (let i = 0; i < magic.length; i++) {
+    if (head[i] !== magic[i]) return false;
+  }
+  return true;
+}
+function sniffContainerFormat(head) {
+  if (hasMagic(head, [80, 75, 3, 4])) return "zip";
+  if (hasMagic(head, [80, 75, 5, 6])) return "zip";
+  if (head.byteLength >= 262) {
+    const magic = String.fromCharCode(
+      head[257],
+      head[258],
+      head[259],
+      head[260],
+      head[261]
+    );
+    if (magic === "ustar") return "tar";
+  }
+  if (hasMagic(head, [55, 122, 188, 175, 39, 28])) return "7z";
+  if (hasMagic(head, [82, 97, 114, 33, 26, 7])) return "rar";
+  if (hasMagic(head, [253, 55, 122, 88, 90, 0])) return "xz";
+  if (hasMagic(head, [31, 139, 8])) return "gzip";
+  return void 0;
+}
+
+// src/archive/name-decode.ts
+var CP437 = String.fromCharCode(
+  0,
+  9786,
+  9787,
+  9829,
+  9830,
+  9827,
+  9824,
+  8226,
+  9688,
+  9675,
+  9689,
+  9794,
+  9792,
+  9834,
+  9835,
+  9788,
+  9658,
+  9668,
+  8597,
+  8252,
+  182,
+  167,
+  9644,
+  8616,
+  8593,
+  8595,
+  8594,
+  8592,
+  8735,
+  8596,
+  9650,
+  9660,
+  32,
+  33,
+  34,
+  35,
+  36,
+  37,
+  38,
+  39,
+  40,
+  41,
+  42,
+  43,
+  44,
+  45,
+  46,
+  47,
+  48,
+  49,
+  50,
+  51,
+  52,
+  53,
+  54,
+  55,
+  56,
+  57,
+  58,
+  59,
+  60,
+  61,
+  62,
+  63,
+  64,
+  65,
+  66,
+  67,
+  68,
+  69,
+  70,
+  71,
+  72,
+  73,
+  74,
+  75,
+  76,
+  77,
+  78,
+  79,
+  80,
+  81,
+  82,
+  83,
+  84,
+  85,
+  86,
+  87,
+  88,
+  89,
+  90,
+  91,
+  92,
+  93,
+  94,
+  95,
+  96,
+  97,
+  98,
+  99,
+  100,
+  101,
+  102,
+  103,
+  104,
+  105,
+  106,
+  107,
+  108,
+  109,
+  110,
+  111,
+  112,
+  113,
+  114,
+  115,
+  116,
+  117,
+  118,
+  119,
+  120,
+  121,
+  122,
+  123,
+  124,
+  125,
+  126,
+  8962,
+  199,
+  252,
+  233,
+  226,
+  228,
+  224,
+  229,
+  231,
+  234,
+  235,
+  232,
+  239,
+  238,
+  236,
+  196,
+  197,
+  201,
+  230,
+  198,
+  244,
+  246,
+  242,
+  251,
+  249,
+  255,
+  214,
+  220,
+  162,
+  163,
+  165,
+  8359,
+  402,
+  225,
+  237,
+  243,
+  250,
+  241,
+  209,
+  170,
+  186,
+  191,
+  8976,
+  172,
+  189,
+  188,
+  161,
+  171,
+  187,
+  9617,
+  9618,
+  9619,
+  9474,
+  9508,
+  9569,
+  9570,
+  9558,
+  9557,
+  9571,
+  9553,
+  9559,
+  9565,
+  9564,
+  9563,
+  9488,
+  9492,
+  9524,
+  9516,
+  9500,
+  9472,
+  9532,
+  9566,
+  9567,
+  9562,
+  9556,
+  9577,
+  9574,
+  9568,
+  9552,
+  9580,
+  9575,
+  9576,
+  9572,
+  9573,
+  9561,
+  9560,
+  9554,
+  9555,
+  9579,
+  9578,
+  9496,
+  9484,
+  9608,
+  9604,
+  9612,
+  9616,
+  9600,
+  945,
+  223,
+  915,
+  960,
+  931,
+  963,
+  181,
+  964,
+  934,
+  920,
+  937,
+  948,
+  8734,
+  966,
+  949,
+  8745,
+  8801,
+  177,
+  8805,
+  8804,
+  8992,
+  8993,
+  247,
+  8776,
+  176,
+  8729,
+  183,
+  8730,
+  8319,
+  178,
+  9632,
+  160
+);
+function decodeLegacyZipName(bytes) {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    let out = "";
+    for (const b of bytes) out += CP437[b] ?? "\uFFFD";
+    return out;
+  }
+}
+var RANGE_READ_CHUNK_BYTES = 256 * 1024;
+async function createFileArchiveSource(zipPath) {
+  const info = await stat(zipPath);
+  return {
+    size: info.size,
+    readRange: (start, end) => readFileRange(zipPath, start, end)
+  };
+}
+async function listZipEntriesFromSource(source, opts = {}) {
+  const zipfile = await openZipFromSource(source);
+  const records = [];
+  try {
+    for await (const entry of zipfile.eachEntry()) {
+      if (entry.fileName.endsWith("/")) continue;
+      const dataOffset = opts.dataOffsets === false ? 0 : await resolveDataOffsetFromSource(
+        source,
+        entry.relativeOffsetOfLocalHeader
+      );
+      records.push({
+        name: entry.fileName,
+        compressionMethod: entry.compressionMethod,
+        encrypted: entry.isEncrypted(),
+        uncompressedSize: entry.uncompressedSize,
+        compressedSize: entry.compressedSize,
+        crc32: entry.crc32,
+        localHeaderOffset: entry.relativeOffsetOfLocalHeader,
+        dataOffset,
+        dataSize: entry.compressedSize,
+        modifiedAt: entry.getLastModDate().getTime()
+      });
+    }
+  } catch (err) {
+    throw invalid(
+      "resource.archive_open_failed",
+      err instanceof Error ? err.message : "could not read archive entries",
+      { size: source.size }
+    );
+  } finally {
+    zipfile.close();
+  }
+  return records;
+}
+async function listZipEntries(zipPath, opts = {}) {
+  return listZipEntriesFromSource(await createFileArchiveSource(zipPath), opts);
+}
+function openZipEntryStream(source, record) {
+  if (record.encrypted) {
+    throw invalid(
+      "resource.archive_open_failed",
+      `zip entry "${record.name}" is encrypted \u2014 password-protected archives are not supported`,
+      { name: record.name }
+    );
+  }
+  switch (record.compressionMethod) {
+    case 0:
+      return streamRange(
+        source,
+        record.dataOffset,
+        record.dataOffset + record.dataSize - 1
+      );
+    case 8: {
+      const raw = streamRange(
+        source,
+        record.dataOffset,
+        record.dataOffset + record.dataSize - 1
+      );
+      const inflater = createInflateRaw();
+      raw.on("error", (err) => inflater.destroy(err));
+      return raw.pipe(inflater);
+    }
+    default:
+      throw invalid(
+        "resource.archive_open_failed",
+        `unsupported zip entry compression method ${record.compressionMethod} for "${record.name}"`,
+        { method: record.compressionMethod, name: record.name }
+      );
+  }
+}
+function streamRange(source, start, end) {
+  return Readable.from(
+    (async function* rangeChunks() {
+      let pos = start;
+      while (pos <= end) {
+        const to = Math.min(end, pos + RANGE_READ_CHUNK_BYTES - 1);
+        const chunk = await source.readRange(pos, to);
+        if (chunk.length === 0) return;
+        yield chunk;
+        pos += chunk.length;
+      }
+    })()
+  );
+}
+function readZipRange(zipPath, start, end) {
+  return createReadStream(zipPath, { start, end });
+}
+async function readFileRange(path, start, end) {
+  if (!Number.isFinite(start) || !Number.isFinite(end) || !Number.isInteger(start) || !Number.isInteger(end) || start < 0 || end < start) {
+    throw invalid(
+      "resource.file_read_failed",
+      `invalid byte range ${start}..${end}`,
+      { path, start, end }
+    );
+  }
+  const length = end - start + 1;
+  if (length <= 0) return Buffer.alloc(0);
+  return buffer(readZipRange(path, start, end));
+}
+function openZipFromSource(source) {
+  const reader = new RangeReader(source);
+  return yauzl.fromRandomAccessReaderPromise(reader, source.size, {
+    lazyEntries: true,
+    decodeStrings: true
+  }).catch((err) => {
+    reader.close(() => {
+    });
+    throw invalid(
+      "resource.archive_open_failed",
+      err instanceof Error ? err.message : "could not open archive",
+      { size: source.size }
+    );
+  });
+}
+var RangeReader = class extends yauzl.RandomAccessReader {
+  // Explicit field + assignment: this package ships source to Node's
+  // type-stripping loader (no build step), which rejects parameter
+  // properties.
+  source;
+  constructor(source) {
+    super();
+    this.source = source;
+  }
+  _readStreamForRange(start, end) {
+    return streamRange(this.source, start, end - 1);
+  }
+  // yauzl's runtime contract calls `_close` even though the shipped
+  // types only expose the public `close` — no `override` here.
+  _close(callback) {
+    callback(null);
+  }
+};
+async function resolveDataOffsetFromSource(source, localHeaderOffset) {
+  if (localHeaderOffset + 30 > source.size) {
+    throw invalid(
+      "resource.archive_open_failed",
+      `truncated local file header at offset ${localHeaderOffset}`,
+      { localHeaderOffset }
+    );
+  }
+  const head = await source.readRange(localHeaderOffset, localHeaderOffset + 29);
+  if (head.length < 30) {
+    throw invalid(
+      "resource.archive_open_failed",
+      `truncated local file header at offset ${localHeaderOffset}`,
+      { localHeaderOffset }
+    );
+  }
+  const sig = head.readUInt32LE(0);
+  if (sig !== 67324752) {
+    throw invalid(
+      "resource.archive_open_failed",
+      `bad local file header signature at offset ${localHeaderOffset}`,
+      { localHeaderOffset, sig: sig.toString(16) }
+    );
+  }
+  const nameLen = head.readUInt16LE(26);
+  const extraLen = head.readUInt16LE(28);
+  return localHeaderOffset + 30 + nameLen + extraLen;
+}
+
+// src/archive/7z.ts
+var requireCjs = createRequire(import.meta.url);
+var SEVEN_ZIP_PATH_ENV = "7Z_BIN_PATH";
+function resolveSevenZipPath() {
+  const fromEnv = process.env[SEVEN_ZIP_PATH_ENV];
+  if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
+  try {
+    const mod = requireCjs("@hoardodile/7z-bin");
+    if (typeof mod === "string" && mod.length > 0) return mod;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sevenZipUnavailable() {
+  return invalid(
+    "resource.archive_open_failed",
+    "7-Zip is not installed \u2014 install @hoardodile/7z-bin or set 7Z_BIN_PATH to enable archive extraction",
+    {}
+  );
+}
+function run7z(bin, args, timeoutMs) {
+  return new Promise((resolveDone, rejectDone) => {
+    const child = spawn(bin, [...args], {
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
+    });
+    const stdout = [];
+    const stderr = [];
+    let settled = false;
+    child.stdout.on("data", (chunk) => stdout.push(chunk));
+    child.stderr.on("data", (chunk) => stderr.push(chunk));
+    const fail = (err) => {
+      if (settled) return;
+      settled = true;
+      rejectDone(err);
+    };
+    const timer = setTimeout(() => {
+      child.kill();
+      fail(
+        invalid(
+          "resource.archive_open_failed",
+          `7-Zip timed out after ${timeoutMs}ms`,
+          { timeoutMs }
+        )
+      );
+    }, timeoutMs);
+    timer.unref();
+    child.on("error", (err) => {
+      fail(
+        invalid(
+          "resource.archive_open_failed",
+          `could not start 7-Zip: ${err.message}`,
+          {}
+        )
+      );
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timer);
+      if (settled) return;
+      if (code === 0) {
+        settled = true;
+        resolveDone({ stdout: Buffer.concat(stdout) });
+        return;
+      }
+      const detail = signal !== null ? `killed by ${signal}` : `exit ${code ?? "?"}`;
+      const tail = Buffer.concat(stderr).toString("utf8").trim().split("\n").at(-1);
+      fail(
+        invalid(
+          "resource.archive_open_failed",
+          `7-Zip ${detail}${tail !== void 0 && tail.length > 0 ? `: ${tail}` : ""}`,
+          { code }
+        )
+      );
+    });
+  });
+}
+function isEncryptedField(value) {
+  return value === "+";
+}
+function parseSltListing(stdout, legacyNames) {
+  const entries = [];
+  let name;
+  let sizeBytes = 0;
+  let folder = false;
+  let encrypted = false;
+  for (const line of stdout.toString("latin1").split(/\r?\n/)) {
+    if (line.length === 0) {
+      if (name !== void 0) {
+        entries.push({ name, sizeBytes, folder, encrypted });
+        name = void 0;
+      }
+      continue;
+    }
+    const sep4 = line.indexOf(" = ");
+    if (sep4 < 0) continue;
+    const key = line.slice(0, sep4);
+    if (key === "Path") {
+      const raw = Buffer.from(line.slice(sep4 + 3), "latin1");
+      const decoded = legacyNames ? decodeLegacyZipName(raw) : raw.toString("utf8");
+      name = decoded.replace(/\\/g, "/");
+      continue;
+    }
+    const value = line.slice(sep4 + 3);
+    switch (key) {
+      case "Size":
+        sizeBytes = Number.parseInt(value, 10) || 0;
+        break;
+      case "Attributes":
+        folder = value.includes("D");
+        break;
+      case "Encrypted":
+        encrypted = isEncryptedField(value);
+        break;
+    }
+  }
+  if (name !== void 0) {
+    entries.push({ name, sizeBytes, folder, encrypted });
+  }
+  return entries;
+}
+async function isZipArchive(archivePath) {
+  const head = await readFileRange(
+    archivePath,
+    0,
+    SNIFF_WINDOW_BYTES - 1
+  ).catch(() => void 0);
+  if (head === void 0 || head.length === 0) return false;
+  return sniffContainerFormat(head) === "zip";
+}
+async function listSevenZipEntries(archivePath, opts = {}) {
+  const bin = resolveSevenZipPath();
+  if (bin === void 0) throw sevenZipUnavailable();
+  const args = ["l", "-slt", "-ba", "-sccUTF-8"];
+  const legacyNames = await isZipArchive(archivePath);
+  args.push(archivePath);
+  const { stdout } = await run7z(bin, args, opts.timeoutMs ?? 12e4);
+  return parseSltListing(stdout, legacyNames);
+}
+async function extractSevenZipInto(archivePath, destDir, opts = {}) {
+  const bin = resolveSevenZipPath();
+  if (bin === void 0) throw sevenZipUnavailable();
+  const args = ["x", archivePath, `-o${destDir}`, "-y", "-bd"];
+  await run7z(bin, args, opts.timeoutMs ?? 10 * 6e4);
+}
+
+// src/archive/extract.ts
+async function assertExtractedTree(root, maxBytes) {
+  let total = 0;
+  async function walk(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = join(dir, entry.name);
+      const info = await lstat(full);
+      if (info.isSymbolicLink()) {
+        throw invalid(
+          "resource.archive_invalid_entry",
+          `extracted entry is a symlink: ${entry.name}`,
+          { name: entry.name }
+        );
+      }
+      if (info.isDirectory()) {
+        await walk(full);
+        continue;
+      }
+      if (!info.isFile()) {
+        throw invalid(
+          "resource.archive_invalid_entry",
+          `extracted entry is not a regular file: ${entry.name}`,
+          { name: entry.name }
+        );
+      }
+      total += info.size;
+      if (total > maxBytes) {
+        throw invalid(
+          "resource.archive_too_large",
+          `archive extracts to more than ${maxBytes} bytes`,
+          { maxExtractedBytes: maxBytes }
+        );
+      }
+    }
+  }
+  await walk(root);
+}
+async function normalizeExtractedTree(root, opts) {
+  if (opts.legacyZipNames) {
+    const expected = opts.expectedNames ? new Set(opts.expectedNames.map((n) => n.replace(/\/+$/, ""))) : void 0;
+    await renameLegacyZipNames(Buffer.from(root), root, root, expected);
+  }
+  await makeReadable(root);
+}
+async function decodeZipNames(zipPath, fallback) {
+  try {
+    const records = await listZipEntries(zipPath, { dataOffsets: false });
+    const files = records.map((e) => ({
+      name: e.name,
+      sizeBytes: e.uncompressedSize
+    }));
+    const paths = /* @__PURE__ */ new Set();
+    for (const file of files) {
+      const segments = file.name.split("/");
+      for (let i = 1; i < segments.length; i++) {
+        paths.add(segments.slice(0, i).join("/"));
+      }
+      paths.add(file.name);
+    }
+    return { files, paths: [...paths] };
+  } catch {
+    return { files: fallback, paths: fallback.map((e) => e.name) };
+  }
+}
+async function renameLegacyZipNames(rawRoot, decodedRoot, root, expected) {
+  const entries = await readdir(rawRoot, {
+    withFileTypes: true,
+    encoding: "buffer"
+  });
+  for (const entry of entries) {
+    const childRaw = Buffer.concat([rawRoot, Buffer.from(sep), entry.name]);
+    const decoded = decodeLegacyZipName(entry.name);
+    const target = legacyRenameTarget(
+      entry.name,
+      decoded,
+      decodedRoot,
+      root,
+      expected
+    );
+    if (entry.isDirectory()) {
+      if (target !== void 0 && !existsSync(target)) {
+        await rename(childRaw, target);
+        await renameLegacyZipNames(Buffer.from(target), target, root, expected);
+        continue;
+      }
+      await renameLegacyZipNames(
+        childRaw,
+        target ?? `${decodedRoot}/${decoded}`,
+        root,
+        expected
+      );
+      continue;
+    }
+    if (target === void 0 || existsSync(target)) continue;
+    await rename(childRaw, target);
+  }
+}
+function legacyRenameTarget(rawName, decoded, decodedRoot, root, expected) {
+  const utf8Name = rawName.toString("utf8");
+  if (decoded !== utf8Name) {
+    return `${decodedRoot}/${decoded}`;
+  }
+  const raw = recoverRawLegacyName(rawName);
+  if (raw === void 0) return void 0;
+  const recovered = decodeLegacyZipName(raw);
+  if (recovered === utf8Name || expected === void 0) return void 0;
+  const rel = decodedRoot === root ? recovered : `${decodedRoot.slice(root.length + 1)}/${recovered}`;
+  return expected.has(rel) ? `${decodedRoot}/${recovered}` : void 0;
+}
+function recoverRawLegacyName(name) {
+  const escaped = unescapePercentEscapes(name);
+  if (escaped !== void 0) return escaped;
+  const text = name.toString("utf8");
+  const out = [];
+  for (const ch of text) {
+    const code = ch.codePointAt(0) ?? 0;
+    if (code >= 61312 && code <= 61439) {
+      out.push(code - 61184);
+      continue;
+    }
+    if (code > 127) return void 0;
+    out.push(code);
+  }
+  return out.length === text.length ? Buffer.from(out) : void 0;
+}
+function unescapePercentEscapes(name) {
+  const text = name.toString("latin1");
+  if (!text.includes("%")) return void 0;
+  const out = [];
+  let changed = false;
+  for (let i = 0; i < text.length; i++) {
+    const hex = i + 2 < text.length ? text.slice(i + 1, i + 3) : void 0;
+    if (text[i] === "%" && hex !== void 0 && /^[0-9a-fA-F]{2}$/.test(hex)) {
+      out.push(Number.parseInt(hex, 16));
+      changed = true;
+      i += 2;
+      continue;
+    }
+    out.push(text.charCodeAt(i));
+  }
+  return changed ? Buffer.from(out) : void 0;
+}
+async function makeReadable(root) {
+  const entries = await readdir(root, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = join(root, entry.name);
+    if (entry.isDirectory()) {
+      await chmod(full, (await lstat(full)).mode | 448);
+      await makeReadable(full);
+      continue;
+    }
+    if (entry.isFile()) {
+      await chmod(full, (await lstat(full)).mode | 384);
+    }
+  }
+}
+async function materializeFile(opts) {
+  const { key } = opts;
+  if (key !== void 0) {
+    return withSingleFlight(key, () => materializeFileWithoutFlight(opts));
+  }
+  return materializeFileWithoutFlight(opts);
+}
+async function materializeFileWithoutFlight(opts) {
+  const { openStream, target, expectedSize } = opts;
+  await mkdir(dirname(target), { recursive: true });
+  const partial = `${target}.partial-${process.pid}-${Date.now()}`;
+  try {
+    if (expectedSize === 0) {
+      await writeFile(partial, Buffer.alloc(0));
+    } else {
+      await pipeline(await openStream(), createWriteStream(partial));
+    }
+    const written = await stat(partial);
+    if (written.size !== expectedSize) {
+      throw new Error(
+        `materialized ${target} size mismatch: expected ${expectedSize}, got ${written.size}`
+      );
+    }
+    await rename(partial, target);
+  } catch (err) {
+    await rm(partial, { force: true }).catch(() => {
+    });
+    throw err;
+  }
+}
+function withSingleFlight(key, run, inflight = globalMaterializeInflight) {
+  const pending = inflight.get(key);
+  if (pending !== void 0) return pending;
+  const work = run();
+  inflight.set(key, work);
+  void work.then(
+    () => inflight.delete(key),
+    () => inflight.delete(key)
+  );
+  return work;
+}
+var globalMaterializeInflight = /* @__PURE__ */ new Map();
+
+// src/archive/nested-entry.ts
+var VIRTUAL_PATH_SEPARATOR = "!";
+function splitVirtualPath(path) {
+  const sep4 = path.indexOf(VIRTUAL_PATH_SEPARATOR);
+  if (sep4 <= 0) return void 0;
+  const inner = path.slice(sep4 + 1);
+  if (inner.length === 0) return void 0;
+  return { outer: path.slice(0, sep4), inner };
+}
+function createOuterArchiveSource(outer, outerName, size) {
+  return {
+    size,
+    readRange: (start, end) => outer.readSlice(outerName, start, end + 1)
+  };
+}
+function createNestedResolver(outer, opts = {}) {
+  const cdCache = opts.cdCache;
+  const scope = opts.scope;
+  const cacheKey = (outerName) => scope === void 0 ? outerName : `${scope}:${outerName}`;
+  const listingMemo = /* @__PURE__ */ new Map();
+  const listedMemo = /* @__PURE__ */ new Map();
+  function listOuter(outerName) {
+    const key = cacheKey(outerName);
+    const pending = listingMemo.get(key);
+    if (pending !== void 0) return pending;
+    const shared = cdCache?.get(key);
+    if (shared !== void 0) {
+      listingMemo.set(key, shared);
+      return shared;
+    }
+    const work = listOuterOnce(outerName);
+    listingMemo.set(key, work);
+    cdCache?.set(key, work);
+    void work.then(
+      () => void 0,
+      () => void 0
+    );
+    return work;
+  }
+  async function listOuterOnce(outerName) {
+    const size = await outer.sizeOf(outerName);
+    if (size === void 0) return void 0;
+    if (size === 0) return void 0;
+    const head = await outer.readSlice(
+      outerName,
+      0,
+      Math.min(size, SNIFF_WINDOW_BYTES)
+    );
+    const format = sniffContainerFormat(head);
+    if (format !== "zip") return void 0;
+    const source = createOuterArchiveSource(outer, outerName, size);
+    const records = await listZipEntriesFromSource(source);
+    return records.map((r) => ({
+      name: r.name,
+      sizeBytes: r.uncompressedSize,
+      outerSize: size,
+      zip: r
+    }));
+  }
+  async function resolve5(path) {
+    const parts = splitVirtualPath(path);
+    if (parts === void 0) return { kind: "literal" };
+    const { outer: outerName, inner } = parts;
+    const entries = await listOuter(outerName);
+    const found = entries?.find((e) => e.name === inner);
+    if (found === void 0) return { kind: "literal" };
+    return {
+      kind: "container",
+      outer: outerName,
+      entry: { name: found.name, sizeBytes: found.sizeBytes },
+      openStream: () => openListedEntry(outer, outerName, found)
+    };
+  }
+  async function list(outerName) {
+    const pending = listedMemo.get(outerName);
+    if (pending !== void 0) return pending;
+    const work = listOuter(outerName).then(
+      (entries) => entries === void 0 ? void 0 : entries.map((e) => listedWithStream(outer, outerName, e))
+    );
+    listedMemo.set(outerName, work);
+    void work.then(
+      () => void 0,
+      () => void 0
+    );
+    return work;
+  }
+  return { resolve: resolve5, list };
+}
+function listedWithStream(outer, outerName, entry) {
+  return {
+    name: entry.name,
+    sizeBytes: entry.sizeBytes,
+    openStream: () => openListedEntry(outer, outerName, entry)
+  };
+}
+function openListedEntry(outer, outerName, entry) {
+  const source = createOuterArchiveSource(outer, outerName, entry.outerSize);
+  if (entry.zip !== void 0) return openZipEntryStream(source, entry.zip);
+  throw invalid(
+    "resource.archive_open_failed",
+    `entry "${entry.name}" has no stream backend`,
+    { name: entry.name }
+  );
+}
+
+// src/archive/extract-archive.ts
+var PROBE_HEADER_BYTES = 256 * 1024;
+var EXTRACT_INDEX_VERSION = 1;
+function createArchiveExtractor(deps) {
+  const resolver = createNestedResolver(deps.outer, {
+    cdCache: deps.nestedCdCache
+  });
+  const inflight = /* @__PURE__ */ new Map();
+  function extract(archiveName) {
+    const pending = inflight.get(archiveName);
+    if (pending !== void 0) return pending;
+    const work = extractOnce(archiveName);
+    inflight.set(archiveName, work);
+    void work.then(
+      () => void 0,
+      () => void 0
+    );
+    return work;
+  }
+  async function extractOnce(archiveName) {
+    const size = await deps.outer.sizeOf(archiveName);
+    if (size === void 0) {
+      throw invalid(
+        "plugin.container_extract_failed",
+        `"${archiveName}" does not exist`,
+        { archiveName }
+      );
+    }
+    const markerPath = join(deps.cacheDir, archiveName, "index.json");
+    const existing = await readExistingManifest(markerPath, archiveName);
+    if (existing !== void 0) return { entries: existing };
+    if (size > 0) {
+      const head = await deps.outer.readSlice(
+        archiveName,
+        0,
+        Math.min(size, SNIFF_WINDOW_BYTES)
+      );
+      const format = sniffContainerFormat(head);
+      if (format !== void 0) {
+        return extractWithSevenZip(archiveName, size, markerPath, format);
+      }
+    }
+    throw invalid(
+      "plugin.container_extract_failed",
+      `"${archiveName}" is not a supported archive (zip/tar/7z/rar/xz/gzip)`,
+      { archiveName }
+    );
+  }
+  async function extractWithSevenZip(archiveName, size, markerPath, format) {
+    const source = createOuterArchiveSource(deps.outer, archiveName, size);
+    const tempPath = join(
+      deps.cacheDir,
+      `${archiveName}.7z-partial-${process.pid}-${randomUUID().slice(0, 8)}`
+    );
+    await mkdir(deps.cacheDir, { recursive: true });
+    try {
+      await materializeFile({
+        openStream: () => streamRange(source, 0, size - 1),
+        target: tempPath,
+        expectedSize: size
+      });
+      const entries = await listSevenZipEntries(tempPath);
+      const files = entries.filter((e) => !e.folder);
+      checkExtractionBudgets(archiveName, files, deps.maxBytes, deps.maxEntries);
+      if (entries.some((e) => e.encrypted)) {
+        throw invalid(
+          "plugin.container_extract_failed",
+          `archive "${archiveName}" is password-protected \xE2\u20AC\u201D encrypted archives are not supported`,
+          { archiveName }
+        );
+      }
+      const decoded = format === "zip" ? await decodeZipNames(
+        tempPath,
+        files.map((e) => ({ name: e.name, sizeBytes: e.sizeBytes }))
+      ) : void 0;
+      const materialized = decoded?.files ?? files;
+      for (const entry of materialized) sanitizeExtractPath(entry.name);
+      const root = join(deps.cacheDir, archiveName);
+      await mkdir(root, { recursive: true });
+      await extractSevenZipInto(tempPath, root);
+      await normalizeExtractedTree(root, {
+        legacyZipNames: format === "zip",
+        expectedNames: decoded?.paths
+      });
+      await assertExtractedTree(root, deps.maxBytes);
+      deps.onProgress?.({ done: files.length, total: files.length });
+      const manifest = await buildManifest(
+        archiveName,
+        materialized.map((e) => ({ name: e.name, sizeBytes: e.sizeBytes }))
+      );
+      await writeManifest(markerPath, archiveName, manifest);
+      await rm(join(deps.cacheDir, `${archiveName}.7z-list`), {
+        force: true
+      }).catch(() => {
+      });
+      await rm(join(deps.cacheDir, `${archiveName}.7z-list.json`), {
+        force: true
+      }).catch(() => {
+      });
+      return { entries: manifest };
+    } finally {
+      await rm(tempPath, { force: true }).catch(() => {
+      });
+    }
+  }
+  function checkExtractionBudgets(archiveName, entries, maxBytes, maxEntries) {
+    if (entries.length > maxEntries) {
+      throw invalid(
+        "plugin.container_extract_failed",
+        `archive "${archiveName}" has ${entries.length} entries, exceeding the limit of ${maxEntries}`,
+        { archiveName, entries: entries.length, maxEntries }
+      );
+    }
+    let totalBytes = 0;
+    for (const entry of entries) totalBytes += entry.sizeBytes;
+    if (totalBytes > maxBytes) {
+      throw invalid(
+        "plugin.container_extract_failed",
+        `archive "${archiveName}" unpacks to ${totalBytes} bytes, exceeding the limit of ${maxBytes}`,
+        { archiveName, totalBytes, maxBytes }
+      );
+    }
+  }
+  async function buildManifest(archiveName, entries) {
+    const manifest = [];
+    for (const entry of entries) {
+      const kind = fileTypeFromName(entry.name)?.kind ?? "other";
+      const row = {
+        path: entry.name,
+        sizeBytes: entry.sizeBytes,
+        kind
+      };
+      if (kind === "image" && deps.probeImage !== void 0) {
+        const rel = sanitizeExtractPath(entry.name);
+        const filePath = join(deps.cacheDir, archiveName, rel);
+        const probe = await probeImageHead(
+          deps.probeImage,
+          filePath,
+          entry.name
+        );
+        if (probe !== void 0) {
+          row.width = probe.width;
+          row.height = probe.height;
+          row.animated = probe.animated;
+        }
+      }
+      manifest.push(row);
+    }
+    return manifest;
+  }
+  async function list(archiveName) {
+    const size = await deps.outer.sizeOf(archiveName);
+    if (size === void 0) return void 0;
+    const markerPath = join(deps.cacheDir, archiveName, "index.json");
+    const extracted = await readExistingManifest(markerPath, archiveName);
+    if (extracted !== void 0) {
+      return extracted.map((e) => ({ name: e.path, sizeBytes: e.sizeBytes }));
+    }
+    if (size === 0) return void 0;
+    const head = await deps.outer.readSlice(
+      archiveName,
+      0,
+      Math.min(size, SNIFF_WINDOW_BYTES)
+    );
+    const format = sniffContainerFormat(head);
+    if (format === "zip") {
+      const entries = await resolver.list(archiveName);
+      if (entries === void 0) return void 0;
+      return entries.map((e) => ({ name: e.name, sizeBytes: e.sizeBytes }));
+    }
+    if (format === "tar" || format === "7z" || format === "rar" || format === "xz") {
+      return listViaSevenZip(archiveName, size);
+    }
+    return void 0;
+  }
+  async function listViaSevenZip(archiveName, size) {
+    if (resolveSevenZipPath() === void 0) return void 0;
+    await mkdir(deps.cacheDir, { recursive: true });
+    const cachePath = join(deps.cacheDir, `${archiveName}.7z-list`);
+    const entriesPath = join(deps.cacheDir, `${archiveName}.7z-list.json`);
+    const cached = await stat(cachePath).catch(() => void 0);
+    if (cached?.size === size) {
+      const raw = await readFile(entriesPath, "utf8").catch(() => void 0);
+      if (raw !== void 0) {
+        try {
+          return JSON.parse(raw);
+        } catch {
+        }
+      }
+    }
+    try {
+      const source = createOuterArchiveSource(deps.outer, archiveName, size);
+      await materializeFile({
+        openStream: () => streamRange(source, 0, size - 1),
+        target: cachePath,
+        expectedSize: size
+      });
+      const listed = await listSevenZipEntries(cachePath);
+      const files = listed.filter((e) => !e.folder).map((e) => ({ name: e.name, sizeBytes: e.sizeBytes }));
+      await writeFile(entriesPath, JSON.stringify(files));
+      return files;
+    } catch (err) {
+      await rm(cachePath, { force: true }).catch(() => {
+      });
+      await rm(entriesPath, { force: true }).catch(() => {
+      });
+      throw err;
+    }
+  }
+  return { extract, list };
+}
+async function readExistingManifest(markerPath, archiveName) {
+  const raw = await readFile(markerPath, "utf8").catch(() => void 0);
+  if (raw === void 0) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.v !== EXTRACT_INDEX_VERSION || parsed.archiveName !== archiveName || !Array.isArray(parsed.entries)) {
+      return void 0;
+    }
+    return parsed.entries;
+  } catch {
+    return void 0;
+  }
+}
+async function writeManifest(markerPath, archiveName, entries) {
+  const payload = JSON.stringify({
+    v: EXTRACT_INDEX_VERSION,
+    archiveName,
+    entries
+  });
+  const partial = `${markerPath}.partial-${process.pid}`;
+  await writeFile(partial, payload);
+  await rename(partial, markerPath);
+}
+function sanitizeExtractPath(name) {
+  const normalized = name.replace(/\\/g, "/");
+  if (normalized.startsWith("/") || /^[A-Za-z]:/.test(normalized)) {
+    throw invalid(
+      "plugin.container_extract_failed",
+      `archive entry has an absolute path: "${name}"`,
+      { name }
+    );
+  }
+  const segments = normalized.split("/");
+  for (const seg of segments) {
+    if (seg.length === 0 || seg === "." || seg === "..") {
+      throw invalid(
+        "plugin.container_extract_failed",
+        `archive entry has an unsafe path: "${name}"`,
+        { name }
+      );
+    }
+    if (hasControlChar(seg)) {
+      throw invalid(
+        "plugin.container_extract_failed",
+        `archive entry contains control characters: "${name}"`,
+        { name }
+      );
+    }
+  }
+  return segments.join("/");
+}
+function hasControlChar(value) {
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
+async function probeImageHead(probeImage, filePath, name) {
+  const head = await readFile(filePath).then(
+    (b) => b.subarray(0, PROBE_HEADER_BYTES)
+  );
+  if (head.length === 0) return void 0;
+  const ext = name.slice(name.lastIndexOf(".")).toLowerCase();
+  return probeImage(head, ext);
+}
+
+// src/archive/nested-cd-cache.ts
+var DEFAULT_MAX_ENTRIES = 512;
+function createNestedCdCache(opts) {
+  const maxEntries = opts?.maxEntries ?? DEFAULT_MAX_ENTRIES;
+  const lru = /* @__PURE__ */ new Map();
+  function get(key) {
+    const value = lru.get(key);
+    if (value === void 0) return void 0;
+    lru.delete(key);
+    lru.set(key, value);
+    return value;
+  }
+  function set(key, value) {
+    lru.set(key, value);
+    while (lru.size > maxEntries) {
+      const oldest = lru.keys().next().value;
+      if (oldest === void 0) break;
+      lru.delete(oldest);
+    }
+  }
+  function clear() {
+    lru.clear();
+  }
+  return { get, set, clear };
+}
+var PHASH_GRID = 32;
+var MIN_PERCEPTUAL_STDDEV = 8;
+function hashStream(stream, algo) {
+  return new Promise((resolve5, reject) => {
+    const hash = createHash(algo);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("end", () => resolve5(hash.digest("hex")));
+    stream.on("error", reject);
+  });
+}
+function computeDHash(gray, grid = PHASH_GRID) {
+  let bits = 0n;
+  for (let row = 0; row < 8; row++) {
+    for (let col = 0; col < 8; col++) {
+      const left = sampleAt(gray, grid, row, col);
+      const right = sampleAt(gray, grid, row, col + 1);
+      bits = bits << 1n | BigInt(left > right ? 1 : 0);
+    }
+  }
+  return bits.toString(16).padStart(16, "0");
+}
+function sampleAt(gray, grid, row, col) {
+  const x = Math.round(col * (grid - 1) / 8);
+  return gray[row * grid + x] ?? 0;
+}
+function computePHash(gray, grid = PHASH_GRID) {
+  const n = 8;
+  const small = meanPool(gray, grid, n);
+  const cos = precomputeCosines(n, n);
+  const coefficients = [];
+  for (let v = 0; v < n; v++) {
+    for (let u = 0; u < n; u++) {
+      let sum = 0;
+      for (let y = 0; y < n; y++) {
+        const cosYv = cos[v]?.[y] ?? 0;
+        const cosXu = cos[u] ?? [];
+        let rowSum = 0;
+        for (let x = 0; x < n; x++) {
+          rowSum += (small[y * n + x] ?? 0) * (cosXu[x] ?? 0);
+        }
+        sum += rowSum * cosYv;
+      }
+      const cu = u === 0 ? 1 / Math.SQRT2 : 1;
+      const cv = v === 0 ? 1 / Math.SQRT2 : 1;
+      coefficients.push(0.25 * cu * cv * sum);
+    }
+  }
+  const median = medianOf(coefficients);
+  let bits = 0n;
+  for (const coefficient of coefficients) {
+    bits = bits << 1n | BigInt(coefficient > median ? 1 : 0);
+  }
+  return bits.toString(16).padStart(16, "0");
+}
+function meanPool(gray, grid, n) {
+  const step = grid / n;
+  const pooled = [];
+  for (let by = 0; by < n; by++) {
+    for (let bx = 0; bx < n; bx++) {
+      let sum = 0;
+      for (let y = 0; y < step; y++) {
+        for (let x = 0; x < step; x++) {
+          sum += gray[(by * step + y) * grid + bx * step + x] ?? 0;
+        }
+      }
+      pooled.push(sum / (step * step));
+    }
+  }
+  return pooled;
+}
+function grayStddev(gray) {
+  if (gray.length === 0) return 0;
+  let mean = 0;
+  for (const value of gray) mean += value;
+  mean /= gray.length;
+  let squared = 0;
+  for (const value of gray) {
+    const delta = value - mean;
+    squared += delta * delta;
+  }
+  return Math.sqrt(squared / gray.length);
+}
+function precomputeCosines(grid, n) {
+  const cosX = [];
+  for (let k = 0; k < n; k++) {
+    const row = [];
+    for (let x = 0; x < grid; x++) {
+      row.push(Math.cos((2 * x + 1) * k * Math.PI / (2 * grid)));
+    }
+    cosX.push(row);
+  }
+  return cosX;
+}
+function medianOf(values) {
+  const sorted = [...values].sort((a, b) => a - b);
+  return sorted[Math.floor(sorted.length / 2)] ?? 0;
+}
+var PERCEPTUAL_HASH_KINDS = [
+  "dhash",
+  "phash"
+];
+function createNestedAwareContainer(base, nestedCdCache, scope, extractCacheDir) {
+  const resolver = createNestedResolver(
+    {
+      sizeOf: (rel) => base.resolveByteRange(rel).then((r) => r?.size),
+      readSlice: (rel, start, end) => base.readEntrySlice(rel, start, end)
+    },
+    { cdCache: nestedCdCache, scope }
+  );
+  const manifestMemo = /* @__PURE__ */ new Map();
+  function readManifest(outer) {
+    const key = `${extractCacheDir}:${outer}`;
+    const pending = manifestMemo.get(key);
+    if (pending !== void 0) return pending;
+    const work = readExistingManifest(
+      join(extractCacheDir, outer, "index.json"),
+      outer
+    ).catch(() => void 0);
+    manifestMemo.set(key, work);
+    return work;
+  }
+  async function resolveMaterialized(rel) {
+    if (extractCacheDir === void 0) return void 0;
+    const parts = splitVirtualPath(rel);
+    if (parts === void 0) return void 0;
+    const { outer, inner } = parts;
+    const manifest = await readManifest(outer);
+    const entry = manifest?.find((e) => e.path === inner);
+    if (entry === void 0) return void 0;
+    return {
+      kind: "materialized",
+      absPath: join(extractCacheDir, outer, inner),
+      sizeBytes: entry.sizeBytes
+    };
+  }
+  async function resolve5(rel) {
+    const nested = await resolver.resolve(rel);
+    if (nested.kind === "container") return nested;
+    const materialized = await resolveMaterialized(rel);
+    return materialized ?? nested;
+  }
+  async function readEntrySlice(rel, start, end) {
+    const resolved = await resolve5(rel);
+    if (resolved.kind === "literal") {
+      return base.readEntrySlice(rel, start, end);
+    }
+    if (resolved.kind === "materialized") {
+      return readFileRange(resolved.absPath, start, end - 1);
+    }
+    return readVirtualSlice(() => resolved.openStream(), start, end);
+  }
+  async function openEntryStream(rel) {
+    const resolved = await resolve5(rel);
+    if (resolved.kind === "literal") {
+      return base.openEntryStream(rel);
+    }
+    if (resolved.kind === "materialized") {
+      return {
+        stream: createReadStream(resolved.absPath),
+        size: resolved.sizeBytes,
+        path: resolved.absPath
+      };
+    }
+    return { stream: resolved.openStream(), size: resolved.entry.sizeBytes };
+  }
+  async function readEntry(rel) {
+    const resolved = await resolve5(rel);
+    if (resolved.kind === "literal") {
+      return base.readEntry(rel);
+    }
+    if (resolved.kind === "materialized") {
+      return readFile(resolved.absPath);
+    }
+    return buffer(resolved.openStream());
+  }
+  async function resolveByteRange(rel) {
+    const resolved = await resolve5(rel);
+    if (resolved.kind === "literal") {
+      return base.resolveByteRange(rel);
+    }
+    if (resolved.kind === "materialized") {
+      return { size: resolved.sizeBytes };
+    }
+    return { size: resolved.entry.sizeBytes };
+  }
+  async function resolveSeekablePath(rel) {
+    const resolved = await resolve5(rel);
+    if (resolved.kind === "literal") {
+      return base.resolveSeekablePath?.(rel);
+    }
+    if (resolved.kind === "materialized") {
+      return resolved.absPath;
+    }
+    return void 0;
+  }
+  return {
+    listEntries: base.listEntries,
+    readEntry,
+    readEntrySlice,
+    openEntryStream,
+    resolveByteRange,
+    resolveSeekablePath
+  };
+}
+async function readVirtualSlice(openStream, start, end) {
+  if (end <= start) return Buffer.alloc(0);
+  const chunks = [];
+  let collected = 0;
+  await new Promise((resolveDone, rejectDone) => {
+    const stream = openStream();
+    stream.on("data", (chunk) => {
+      const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+      const need = end - collected;
+      if (need <= 0) {
+        stream.destroy();
+        resolveDone();
+        return;
+      }
+      const take = bytes.subarray(0, Math.min(need, bytes.length));
+      chunks.push(take);
+      collected += take.length;
+      if (collected >= end) {
+        stream.destroy();
+        resolveDone();
+      }
+    });
+    stream.on("end", () => resolveDone());
+    stream.on("error", (err) => rejectDone(err));
+  });
+  const full = Buffer.concat(chunks, collected);
+  const sliceStart = Math.min(start, full.length);
+  return full.subarray(sliceStart);
+}
+var sharpPromise;
+function loadSharp() {
+  sharpPromise ??= import('sharp').catch((err) => {
+    sharpPromise = void 0;
+    throw new Error(
+      `sharp is not installed \u2014 add "sharp" to your dependencies to enable image probing: ${err instanceof Error ? err.message : String(err)}`
+    );
+  });
+  return sharpPromise;
+}
+var ANIMATED_EXT_HINTS = /* @__PURE__ */ new Set([".gif", ".webp", ".avif"]);
+function isAnimatedCandidateExt(ext) {
+  return ANIMATED_EXT_HINTS.has(ext);
+}
+async function sharpFromReadable(stream, options) {
+  if (typeof stream.read !== "function") {
+    throw new Error("expected a readable stream");
+  }
+  const { default: sharp } = await loadSharp();
+  const descriptor = options === void 0 || Object.keys(options).length === 0 ? void 0 : { ...options };
+  const instance = descriptor === void 0 ? sharp() : sharp(descriptor);
+  stream.pipe(instance);
+  return instance;
+}
+var SNIFF_HEADER_BYTES = 4100;
+var fileTypePromise;
+function loadFileType() {
+  fileTypePromise ??= import('file-type');
+  return fileTypePromise;
+}
+async function sniffBytes(head, path) {
+  if (head.byteLength > 0) {
+    try {
+      const { fileTypeFromBuffer } = await loadFileType();
+      const detected = await fileTypeFromBuffer(head);
+      if (detected !== void 0) {
+        return {
+          mime: detected.mime,
+          ext: `.${detected.ext}`,
+          kind: mimeToKind(detected.mime),
+          source: "magic"
+        };
+      }
+    } catch {
+    }
+  }
+  return fileTypeFromName(path);
+}
+var ORDER_MANIFEST_NAME = ".order";
+function orderManifestPath(dataDir) {
+  return join(dataDir, ORDER_MANIFEST_NAME);
+}
+async function readOrderManifest(dataDir) {
+  let raw;
+  try {
+    raw = await readFile(orderManifestPath(dataDir), "utf8");
+  } catch {
+    return void 0;
+  }
+  return parseOrderManifest(raw);
+}
+function parseOrderManifest(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  if (!Array.isArray(parsed) || parsed.length === 0) return void 0;
+  const names = [];
+  for (const entry of parsed) {
+    if (typeof entry !== "string") return void 0;
+    if (!isManifestPathSafe(entry)) return void 0;
+    names.push(entry);
+  }
+  if (names.length === 0) return void 0;
+  return names;
+}
+function orderEntries(manifest, listed) {
+  const available = new Set(listed);
+  const uniqueManifest = /* @__PURE__ */ new Set();
+  for (const name of manifest) {
+    if (uniqueManifest.has(name)) return void 0;
+    uniqueManifest.add(name);
+    if (!available.has(name)) return void 0;
+  }
+  const ordered = manifest.filter((name) => available.has(name));
+  const rest = naturalSort(listed.filter((name) => !uniqueManifest.has(name)));
+  return [...ordered, ...rest];
+}
+function naturalSort(names) {
+  return [...names].sort(
+    (a, b) => a.localeCompare(b, void 0, { sensitivity: "base", numeric: true })
+  );
+}
+function isManifestPathSafe(entry) {
+  if (entry.length === 0 || entry.includes("\0") || entry.includes("\\")) {
+    return false;
+  }
+  const segments = entry.split("/");
+  for (const segment of segments) {
+    if (segment.length === 0 || segment === "." || segment === "..") {
+      return false;
+    }
+  }
+  return true;
+}
+
+// src/directory-container.ts
+function createDirectoryContainer(dir) {
+  async function resolvePath(relPath) {
+    return resolveSafeImportPath(dir, relPath);
+  }
+  return {
+    async listEntries() {
+      const out = [];
+      async function collect(current, prefix) {
+        const entries = await readdir(join(dir, current), {
+          withFileTypes: true
+        }).catch(() => []);
+        for (const e of entries) {
+          if (e.name.startsWith(".")) continue;
+          if (e.name.includes(".uploading-")) continue;
+          const rel = prefix ? `${prefix}/${e.name}` : e.name;
+          if (e.isDirectory()) {
+            await collect(join(current, e.name), rel);
+          } else if (e.isFile()) {
+            out.push(rel);
+          }
+        }
+      }
+      await collect(".", "");
+      const manifest = await readOrderManifest(dir);
+      if (manifest !== void 0) {
+        const ordered = orderEntries(manifest, out);
+        if (ordered !== void 0) return ordered;
+      }
+      return naturalSort(out);
+    },
+    async readEntry(relPath) {
+      const safe = await resolvePath(relPath);
+      const handle = await open(safe, "r");
+      try {
+        return await handle.readFile();
+      } finally {
+        await handle.close();
+      }
+    },
+    async readEntrySlice(relPath, start, end) {
+      const safe = await resolvePath(relPath);
+      const handle = await open(safe, "r");
+      try {
+        const { size } = await handle.stat();
+        const clampedStart = Math.min(Math.max(0, start), size);
+        const clampedEnd = Math.min(Math.max(clampedStart, end), size);
+        const length = Math.max(0, clampedEnd - clampedStart);
+        if (length === 0) return Buffer.alloc(0);
+        const buf = Buffer.alloc(length);
+        await handle.read(buf, 0, length, clampedStart);
+        return buf;
+      } finally {
+        await handle.close();
+      }
+    },
+    async openEntryStream(relPath) {
+      const safe = await resolvePath(relPath);
+      const info = await stat(safe);
+      return {
+        stream: createReadStream(safe),
+        size: info.size,
+        mtimeMs: info.mtimeMs,
+        path: safe
+      };
+    },
+    async resolveByteRange(relPath) {
+      const safe = await resolvePath(relPath);
+      const info = await stat(safe).catch(() => void 0);
+      return info === void 0 ? void 0 : { size: info.size };
+    },
+    async resolveSeekablePath(relPath) {
+      const safe = await resolvePath(relPath);
+      const info = await stat(safe).catch(() => void 0);
+      return info?.isFile() === true ? safe : void 0;
+    }
+  };
+}
+function resolveSafeImportPath(dir, relPath) {
+  if (relPath.length === 0) {
+    throw new Error("path is empty");
+  }
+  if (relPath.includes("\0")) {
+    throw new Error("path contains null byte");
+  }
+  if (isAbsolute(relPath)) {
+    throw new Error("absolute paths are not allowed");
+  }
+  const normalized = normalize(relPath);
+  if (normalized.startsWith("..") || normalized === "..") {
+    throw new Error("path escapes import directory");
+  }
+  const root = resolve(dir);
+  const candidate = resolve(root, normalized);
+  if (candidate !== root && !candidate.startsWith(root + sep)) {
+    throw new Error("path escapes import directory");
+  }
+  return candidate;
+}
+
+// src/directory-api.ts
+function createDirectoryResourceAPI(dir, opts = {}) {
+  return createPluginResourceAPI({
+    view: createDirectoryContainer(dir),
+    maxReadFileBytes: opts.maxReadFileBytes ?? PLUGIN_READ_FILE_MAX_BYTES,
+    extractCacheDir: opts.extractCacheDir,
+    detectContext: opts.detectContext
+  });
+}
+
+// src/api.ts
+var DEFAULT_PLUGIN_EXTRACT_MAX_BYTES = 8 * 1024 * 1024 * 1024;
+var DEFAULT_PLUGIN_EXTRACT_MAX_ENTRIES = 2e5;
+function createPluginResourceAPI(deps) {
+  const view = createNestedAwareContainer(
+    deps.view,
+    deps.nestedCdCache,
+    deps.cacheScope,
+    deps.extractCacheDir
+  );
+  const maxReadFileBytes = deps.maxReadFileBytes ?? PLUGIN_READ_FILE_MAX_BYTES;
+  const extractor = deps.extractCacheDir === void 0 ? void 0 : createArchiveExtractor({
+    outer: {
+      sizeOf: (rel) => deps.view.resolveByteRange(rel).then((r) => r?.size),
+      readSlice: (rel, start, end) => deps.view.readEntrySlice(rel, start, end)
+    },
+    cacheDir: deps.extractCacheDir,
+    maxBytes: deps.maxExtractBytes ?? DEFAULT_PLUGIN_EXTRACT_MAX_BYTES,
+    maxEntries: deps.maxExtractEntries ?? DEFAULT_PLUGIN_EXTRACT_MAX_ENTRIES,
+    probeImage: deps.probeImage,
+    onProgress: deps.onExtractProgress,
+    nestedCdCache: deps.nestedCdCache
+  });
+  async function readFileScoped(path, range) {
+    if (range === void 0) {
+      const size2 = (await view.resolveByteRange(path))?.size;
+      if (size2 !== void 0) assertReadSize(path, size2, maxReadFileBytes);
+      const buf = await view.readEntry(path);
+      return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+    }
+    const start = Math.max(0, range.start ?? 0);
+    const size = (await view.resolveByteRange(path))?.size;
+    if (size === void 0) {
+      return toUint8Array(
+        await view.readEntrySlice(path, start, range.end ?? start)
+      );
+    }
+    const end = Math.min(range.end ?? size, size);
+    assertReadSize(path, Math.max(0, end - start), maxReadFileBytes);
+    return toUint8Array(await view.readEntrySlice(path, start, end));
+  }
+  async function listFileNamesScoped() {
+    return view.listEntries();
+  }
+  function cached(kind, path, compute) {
+    if (deps.probeCache === void 0 || deps.cacheScope === void 0) {
+      return compute();
+    }
+    return deps.probeCache.getOrCompute(
+      `${deps.cacheScope}:${kind}:${path}`,
+      compute
+    );
+  }
+  function sniffScoped(path) {
+    return cached("sniff", path, async () => {
+      const head = await view.readEntrySlice(path, 0, SNIFF_HEADER_BYTES).catch(() => void 0);
+      if (head === void 0) return void 0;
+      return sniffBytes(head, path);
+    });
+  }
+  async function probeImageEntry(path, type) {
+    const probeImage = deps.probeImage;
+    if (probeImage === void 0) {
+      return { kind: "unknown", reason: "unavailable" };
+    }
+    if (!isAnimatedCandidateExt(type.ext)) {
+      const head = await view.readEntrySlice(path, 0, PROBE_HEADER_BYTES);
+      if (head.length > 0) {
+        const probed = await probeImage(head, type.ext).catch(() => void 0);
+        if (probed !== void 0) return imageResult(type.mime, probed);
+      }
+    }
+    try {
+      const { stream } = await view.openEntryStream(path);
+      const probed = await probeImage(stream, type.ext);
+      if (probed !== void 0) return imageResult(type.mime, probed);
+    } catch (err) {
+      console.warn(
+        `[probe] path=${path} image probe threw: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    return { kind: "unknown", reason: "failed" };
+  }
+  async function probeAvEntry(path, type) {
+    const probeAv = deps.probeAv;
+    if (probeAv === void 0) {
+      return { kind: "unknown", reason: "unavailable" };
+    }
+    const inputFormat = MIME_FFMPEG_INPUT_FORMAT[type.mime];
+    if (inputFormat === void 0) {
+      return { kind: "unknown", reason: "unsupported" };
+    }
+    try {
+      const { stream } = await view.openEntryStream(path);
+      return await probeAv(stream, { mime: type.mime, inputFormat });
+    } catch {
+      return { kind: "unknown", reason: "failed" };
+    }
+  }
+  function probeScoped(path) {
+    return cached("probe", path, async () => {
+      const type = await sniffScoped(path);
+      if (type === void 0) {
+        return { kind: "unknown", reason: "unsupported" };
+      }
+      switch (type.kind) {
+        case "image":
+          return probeImageEntry(path, type);
+        case "video":
+        case "audio":
+          return probeAvEntry(path, type);
+        default:
+          return { kind: "other", mime: type.mime };
+      }
+    });
+  }
+  async function statFileScoped(path) {
+    const range = await view.resolveByteRange(path);
+    if (range === void 0) return void 0;
+    return { sizeBytes: range.size };
+  }
+  async function statFilesScoped(paths) {
+    return Promise.all(paths.map(statFileScoped));
+  }
+  async function hashBytesScoped(path, algo) {
+    const { stream } = await view.openEntryStream(path);
+    return hashStream(stream, algo);
+  }
+  async function computeImageHashesScoped(path, kinds) {
+    const type = await sniffScoped(path);
+    if (type?.kind !== "image") return void 0;
+    const result = {};
+    if (kinds.includes("sha256")) {
+      const { stream } = await view.openEntryStream(path);
+      result.sha256 = await hashStream(stream, "sha256");
+    }
+    const perceptual = kinds.filter(
+      (kind) => PERCEPTUAL_HASH_KINDS.includes(kind)
+    );
+    if (perceptual.length > 0) {
+      const { stream } = await view.openEntryStream(path);
+      const gray = await decodeGrayGrid(stream);
+      if (gray !== void 0 && grayStddev(gray) >= MIN_PERCEPTUAL_STDDEV) {
+        if (perceptual.includes("dhash")) result.dhash = computeDHash(gray);
+        if (perceptual.includes("phash")) result.phash = computePHash(gray);
+      } else if (result.sha256 === void 0) {
+        return void 0;
+      }
+    }
+    return result;
+  }
+  async function decodeGrayGrid(stream) {
+    try {
+      const instance = await sharpFromReadable(stream, { pages: 1 });
+      const { data } = await instance.resize(PHASH_GRID, PHASH_GRID, { fit: "fill" }).grayscale().raw().toBuffer({ resolveWithObject: true });
+      return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+    } catch {
+      return void 0;
+    }
+  }
+  return {
+    // No-ops: the sandbox host is the plugin log sink — it alone knows
+    // which plugin emitted the line (see dispatchLog in sandbox/host.ts).
+    logInfo() {
+    },
+    logWarn() {
+    },
+    logError() {
+    },
+    // The payload is opaque to this factory (hosts pass `unknown`);
+    // the schema generic only types it for schema-aware consumers.
+    context: { detect: deps.detectContext },
+    listFileNames: listFileNamesScoped,
+    readFile: readFileScoped,
+    statFile: statFileScoped,
+    statFiles: statFilesScoped,
+    sniff: sniffScoped,
+    probe: probeScoped,
+    hashBytes: hashBytesScoped,
+    computeImageHashes: computeImageHashesScoped,
+    listContainer: (filename) => listContainerScoped(filename, extractor),
+    extractArchive: (filename) => extractArchiveScoped(filename, extractor),
+    // The plugin vault is a sandbox-level capability: the sandbox host
+    // intercepts these method names and routes them to the wired
+    // plugin-asset service with the owning plugin id (see
+    // sandbox/host.ts). In-process hosts (directory API, contract
+    // fixtures, dev runner) have no consent channel, so the methods
+    // answer UNAVAILABLE — exactly like the CLI and the workbench.
+    download: async () => {
+      throw pluginAssetError(
+        "UNAVAILABLE",
+        "download() \u2014 this host has no plugin asset service; only the app server host can download into the plugin vault"
+      );
+    },
+    statAsset: async () => {
+      throw unavailableAsset("statAsset");
+    },
+    readAsset: async () => {
+      throw unavailableAsset("readAsset");
+    },
+    deleteAsset: async () => {
+      throw unavailableAsset("deleteAsset");
+    }
+  };
+}
+function unavailableAsset(method) {
+  return pluginAssetError(
+    "UNAVAILABLE",
+    `${method}() \u2014 this host has no plugin asset vault; only the app server host manages vault files`
+  );
+}
+async function listContainerScoped(filename, extractor) {
+  if (extractor === void 0) {
+    throw new Error(
+      `listContainer("${filename}") \u2014 this host has no container support; only the archive-backed server host lists containers`
+    );
+  }
+  const entries = await extractor.list(filename);
+  if (entries === void 0) {
+    throw new Error(
+      `listContainer("${filename}") \u2014 not a supported archive (zip/tar/7z/rar/xz), or no 7-Zip binary for non-zip formats`
+    );
+  }
+  return { entries: entries.map(bareContainerEntry) };
+}
+function bareContainerEntry(entry) {
+  return {
+    path: entry.name,
+    sizeBytes: entry.sizeBytes,
+    kind: fileTypeFromName(entry.name)?.kind ?? "other"
+  };
+}
+async function extractArchiveScoped(filename, extractor) {
+  if (extractor === void 0) {
+    throw new Error(
+      `extractArchive("${filename}") \u2014 this host has no extraction cache; only the archive-backed server host materializes containers`
+    );
+  }
+  return extractor.extract(filename);
+}
+function imageResult(mime, probed) {
+  return {
+    kind: "image",
+    mime,
+    width: probed.width,
+    height: probed.height,
+    animated: probed.animated
+  };
+}
+function assertReadSize(path, sizeBytes, max) {
+  if (sizeBytes > max) {
+    throw new Error(
+      `readFile("${path}") requests ${sizeBytes} bytes, exceeding the per-call limit of ${max} bytes \u2014 pass a byte range or use readFileChunks()`
+    );
+  }
+}
+function toUint8Array(buf) {
+  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+}
+function createCapabilityGuard() {
+  function check(manifest, capability) {
+    return manifest.permissions[capability] === true;
+  }
+  function require2(manifest, capability) {
+    if (!check(manifest, capability)) {
+      throw new Error(
+        `${capability} permission denied for plugin ${manifest.id}`
+      );
+    }
+  }
+  function filter(entries, capability) {
+    return entries.filter((e) => check(e.manifest, capability));
+  }
+  return { check, require: require2, filter };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+async function runPluginHook(opts) {
+  const mod = await import(pathToFileURL(opts.mainPath).href);
+  if (!isRecord(mod) || !isRecord(mod.default)) {
+    throw new Error(
+      `Plugin at ${opts.mainPath} must default-export a plugin definition`
+    );
+  }
+  const hook = mod.default[opts.hook];
+  if (typeof hook !== "function") {
+    throw new Error(
+      `Plugin at ${opts.mainPath} has no "${opts.hook}" hook (expected a function on the default export)`
+    );
+  }
+  let detectContext;
+  if (opts.hook !== "detect" && typeof mod.default.detect === "function") {
+    try {
+      const detected = await mod.default.detect(
+        createDirectoryResourceAPI(opts.dir, {
+          extractCacheDir: opts.extractCacheDir
+        })
+      );
+      if (isRecord(detected) && detected.ok === true) {
+        const { ok: _ok, ...payload } = detected;
+        if (Object.keys(payload).length > 0) detectContext = payload;
+      }
+    } catch {
+    }
+  }
+  const api = createDirectoryResourceAPI(opts.dir, {
+    extractCacheDir: opts.extractCacheDir,
+    detectContext
+  });
+  const started = performance.now();
+  const result = await hook(api);
+  return { result, durationMs: performance.now() - started };
+}
+var DEFAULT_PLUGIN_PINNED = true;
+var DEFAULT_PLUGIN_PRIORITY = 100;
+function createPluginDiscovery(deps) {
+  let firstLoad = true;
+  async function discover() {
+    const found = [];
+    const seen = /* @__PURE__ */ new Set();
+    if (deps.builtinDir !== void 0) {
+      const builtin = discoverBuiltin(deps.builtinDir, firstLoad);
+      if (builtin !== void 0) {
+        found.push(builtin);
+        seen.add(builtin.id);
+      }
+    }
+    firstLoad = false;
+    const dev = discoverDevPlugins(
+      deps.devPluginDirs,
+      deps.settings,
+      deps.disableDevPlugins ?? false
+    );
+    for (const plugin of dev) {
+      if (seen.has(plugin.id)) {
+        const index = found.findIndex((f) => f.id === plugin.id);
+        if (index !== -1 && found[index]?.source === "dev") {
+          found[index] = plugin;
+          console.warn(
+            `[plugin-discovery] dev plugin ${plugin.id} (${plugin.manifest.name ?? plugin.id}) overrides an earlier dev dir entry`
+          );
+        } else {
+          console.warn(
+            `[plugin-discovery] skipping dev plugin ${plugin.id}: id is reserved by the builtin plugin`
+          );
+        }
+        continue;
+      }
+      found.push(plugin);
+      seen.add(plugin.id);
+    }
+    const disk = discoverDiskPlugins(deps.pluginsDir, deps.settings);
+    for (const plugin of disk) {
+      if (seen.has(plugin.id)) {
+        console.warn(
+          `[plugin-discovery] skipping disk plugin ${plugin.id}: id already registered (builtin or dev plugin)`
+        );
+        continue;
+      }
+      found.push(plugin);
+      seen.add(plugin.id);
+    }
+    const missing = discoverMissingPlugins(deps.settings, seen);
+    return { found, missing };
+  }
+  return { discover };
+}
+function discoverBuiltin(builtinDir, failFast) {
+  const resolved = resolve(builtinDir);
+  const manifest = parseManifest(resolved, "builtin");
+  if (manifest === void 0) {
+    const message = `Builtin plugin not found or invalid at ${resolved}. Set BUILTIN_PATH env to a valid plugin directory.`;
+    if (failFast) {
+      throw new Error(message);
+    }
+    console.error(`[plugin-discovery] ${message}`);
+    return void 0;
+  }
+  return {
+    id: manifest.id,
+    manifest,
+    diskPath: resolved,
+    source: "builtin",
+    enabled: true,
+    priority: Number.MAX_SAFE_INTEGER,
+    pinned: DEFAULT_PLUGIN_PINNED,
+    color: ""
+  };
+}
+function discoverDevPlugins(devPluginDirs, settings, disableDevPlugins) {
+  if (disableDevPlugins) {
+    console.info("[plugin-discovery] dev plugins disabled by configuration");
+    return [];
+  }
+  if (devPluginDirs === void 0 || devPluginDirs.length === 0) return [];
+  const results = [];
+  for (const dir of devPluginDirs) {
+    const resolved = resolve(dir);
+    const manifest = parseManifest(resolved, "dev");
+    if (manifest === void 0) continue;
+    const row = settings.get(manifest.id);
+    results.push({
+      id: manifest.id,
+      manifest,
+      diskPath: resolved,
+      source: "dev",
+      enabled: true,
+      priority: row?.priority ?? DEFAULT_PLUGIN_PRIORITY,
+      pinned: row?.pinned ?? DEFAULT_PLUGIN_PINNED,
+      color: row?.color ?? ""
+    });
+  }
+  return results;
+}
+function discoverDiskPlugins(pluginsDir, settings) {
+  if (!existsSync(pluginsDir)) return [];
+  const dirents = readdirSync(pluginsDir, { withFileTypes: true });
+  if (dirents.length === 0) return [];
+  const results = [];
+  for (const dirent of dirents) {
+    if (!dirent.isDirectory()) continue;
+    const dirPath = join(pluginsDir, dirent.name);
+    const manifest = parseManifest(dirPath, dirent.name);
+    if (manifest === void 0) continue;
+    const row = settings.get(manifest.id);
+    const enabled = row?.enabled ?? true;
+    const priority = row?.priority ?? DEFAULT_PLUGIN_PRIORITY;
+    const pinned = row?.pinned ?? DEFAULT_PLUGIN_PINNED;
+    const color = row?.color ?? "";
+    results.push({
+      id: manifest.id,
+      manifest,
+      diskPath: dirPath,
+      source: "disk",
+      enabled,
+      priority,
+      pinned,
+      color
+    });
+  }
+  return results;
+}
+function discoverMissingPlugins(settings, loadedIds) {
+  const results = [];
+  for (const row of settings.all()) {
+    if (loadedIds.has(row.id)) continue;
+    let manifest;
+    try {
+      manifest = JSON.parse(row.manifest);
+    } catch {
+      continue;
+    }
+    results.push({
+      id: row.id,
+      manifest,
+      enabled: row.enabled,
+      priority: row.priority,
+      pinned: row.pinned,
+      color: row.color
+    });
+  }
+  return results;
+}
+function parseManifest(dirPath, dirName) {
+  const manifestPath = join(dirPath, "manifest.json");
+  if (!existsSync(manifestPath)) {
+    console.warn(`[plugin-discovery] skipping ${dirName}: no manifest.json`);
+    return void 0;
+  }
+  let raw;
+  try {
+    raw = readFileSync(manifestPath, "utf-8");
+  } catch {
+    console.warn(
+      `[plugin-discovery] skipping ${dirName}: cannot read manifest.json`
+    );
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    console.warn(
+      `[plugin-discovery] skipping ${dirName}: manifest is not valid JSON`
+    );
+    return void 0;
+  }
+  const result = pluginManifest.safeParse(parsed);
+  if (!result.success) {
+    console.warn(
+      `[plugin-discovery] skipping ${dirName}: invalid manifest`,
+      result.error
+    );
+    return void 0;
+  }
+  return result.data;
+}
+
+// src/hooks.ts
+var MAX_IMAGE_HASHES_PER_RESOURCE = 2e3;
+async function runDetectors(entries, api, action) {
+  for (const entry of entries) {
+    const result = await invokeHook(entry, entry.plugin.detect, api, action);
+    if (result?.ok) return entry.id;
+  }
+  return void 0;
+}
+async function invokeHook(entry, hook, api, action, level = "error") {
+  if (hook === void 0) return void 0;
+  try {
+    return await hook(api);
+  } catch (err) {
+    const log = level === "warn" ? console.warn : console.error;
+    log(hookFailureText(action, entry.id, err));
+    return void 0;
+  }
+}
+function errorText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function hookFailureText(action, pluginId, err) {
+  return `[plugin-hooks] ${action} failed for plugin ${pluginId}: ${errorText(err)}`;
+}
+function createPluginHooks(deps) {
+  const { getRegistry } = deps;
+  const guard = createCapabilityGuard();
+  function defaultPluginId() {
+    const builtin = getRegistry().getBuiltin();
+    if (builtin === void 0) {
+      throw new Error(
+        "No builtin plugin in registry \u2014 cannot determine default plugin"
+      );
+    }
+    return builtin.id;
+  }
+  function getEffectiveEntry(resPluginId) {
+    if (resPluginId !== null) {
+      const entry = getRegistry().getById(resPluginId);
+      if (entry?.enabled === true && !entry.missing) {
+        return entry;
+      }
+    }
+    const builtin = getRegistry().getBuiltin();
+    if (builtin === void 0) {
+      throw new Error(
+        "No builtin plugin in registry \u2014 cannot determine effective plugin"
+      );
+    }
+    return builtin;
+  }
+  async function detectFirstMatch(api) {
+    const matched = await runDetectors(
+      getRegistry().getEnabled(),
+      api,
+      "detect"
+    );
+    if (matched !== void 0) return matched;
+    const builtin = getRegistry().getBuiltin();
+    throw new Error(
+      `No plugin matched resource. Builtin plugin ${builtin?.id ?? "unknown"} should have matched but did not.`
+    );
+  }
+  async function revalidate(api, currentPluginId) {
+    const registry = getRegistry();
+    const builtin = registry.getBuiltin();
+    if (builtin === void 0) {
+      throw new Error("No builtin plugin available for fallback");
+    }
+    const enabled = registry.getEnabled();
+    const startIndex = enabled.findIndex((e) => e.id === currentPluginId);
+    if (startIndex < 0) {
+      return builtin.id;
+    }
+    const matched = await runDetectors(
+      enabled.slice(startIndex),
+      api,
+      "revalidate detect"
+    );
+    return matched ?? builtin.id;
+  }
+  async function detectForPlugin(api, pluginId) {
+    const entry = getRegistry().getById(pluginId);
+    if (entry === void 0) {
+      return { ok: false, reasons: [`unknown plugin: ${pluginId}`] };
+    }
+    const result = await invokeHook(
+      entry,
+      entry.plugin.detect,
+      api,
+      "detectForPlugin"
+    );
+    if (result === void 0) {
+      return { ok: false, reasons: ["detect threw an exception"] };
+    }
+    if (result.ok) return { ok: true };
+    return { ok: false, reasons: result.reasons.slice() };
+  }
+  async function detectForImportDir(api) {
+    const fallback = defaultPluginId();
+    const detectors = getRegistry().getEnabled().filter((e) => !e.builtin).sort((a, b) => a.priority - b.priority);
+    const matched = await runDetectors(detectors, api, "import detect");
+    return matched ?? fallback;
+  }
+  async function buildFileList(api, pluginId) {
+    const entry = getRegistry().getById(pluginId);
+    if (entry === void 0) return void 0;
+    const pluginResult = await invokeHook(
+      entry,
+      entry.plugin.listFiles,
+      api,
+      "listFiles"
+    );
+    if (pluginResult === void 0) return void 0;
+    for (const item of pluginResult) {
+      if (typeof item === "string") continue;
+      if (typeof item === "object" && item !== null && !Array.isArray(item)) {
+        for (const value of Object.values(item)) {
+          if (value === void 0) continue;
+          const t = typeof value;
+          if (t === "string" || t === "number" || t === "boolean") continue;
+          throw new Error(
+            `Plugin ${String(pluginId)} returned an invalid file list item value type: ${t}`
+          );
+        }
+        continue;
+      }
+      throw new Error(
+        `Plugin ${String(pluginId)} returned an invalid file list item`
+      );
+    }
+    return pluginResult;
+  }
+  async function resolveLocalCoverSource(api, pluginId) {
+    const entry = getRegistry().getById(pluginId);
+    if (entry === void 0) return void 0;
+    return invokeHook(entry, entry.plugin.coverLocal, api, "coverLocal", "warn");
+  }
+  async function runMetaHooks(api, pluginId) {
+    const entry = getRegistry().getById(pluginId);
+    if (entry === void 0) return {};
+    const { manifest, plugin } = entry;
+    const results = {};
+    async function runMetaHook(name) {
+      const hook = plugin[name];
+      if (!guard.check(manifest, name) || hook === void 0) return;
+      try {
+        results[name] = { value: await hook(api) };
+      } catch (err) {
+        console.error(hookFailureText(name, pluginId, err));
+      }
+    }
+    await runMetaHook("sourceMeta");
+    await runMetaHook("searchMeta");
+    return results;
+  }
+  function entrySupportsImageHashes(entry) {
+    return guard.check(entry.manifest, "imageHashes") && entry.plugin.imageHashes !== void 0;
+  }
+  function supportsImageHashes(pluginId) {
+    const entry = getRegistry().getById(pluginId);
+    return entry !== void 0 && entrySupportsImageHashes(entry);
+  }
+  async function runImageHashes(api, pluginId) {
+    const entry = getRegistry().getById(pluginId);
+    if (entry === void 0 || !entrySupportsImageHashes(entry))
+      return void 0;
+    return sanitizeImageHashes(
+      await invokeHook(entry, entry.plugin.imageHashes, api, "imageHashes"),
+      pluginId
+    );
+  }
+  return {
+    defaultPluginId,
+    getEffectiveEntry,
+    detectFirstMatch,
+    revalidate,
+    detectForPlugin,
+    detectForImportDir,
+    buildFileList,
+    resolveLocalCoverSource,
+    runMetaHooks,
+    supportsImageHashes,
+    runImageHashes
+  };
+}
+var HEX_VALUE = /^[0-9a-f]+$/;
+function sanitizeImageHashes(value, pluginId) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const hashes = value.hashes;
+  if (!Array.isArray(hashes)) return void 0;
+  const valid = [];
+  for (const item of hashes) {
+    if (typeof item !== "object" || item === null) continue;
+    const { scope, type, value: hex, bits } = item;
+    if (typeof scope === "string" && scope.length > 0 && typeof type === "string" && type.length > 0 && typeof hex === "string" && HEX_VALUE.test(hex)) {
+      valid.push({
+        scope,
+        type,
+        value: hex,
+        bits: typeof bits === "number" && Number.isInteger(bits) && bits > 0 ? bits : hex.length * 4
+      });
+    }
+  }
+  if (valid.length > MAX_IMAGE_HASHES_PER_RESOURCE) {
+    console.warn(
+      `[plugin-hooks] imageHashes for plugin ${pluginId} produced ${valid.length} entries \u2014 capped at ${MAX_IMAGE_HASHES_PER_RESOURCE}`
+    );
+    valid.length = MAX_IMAGE_HASHES_PER_RESOURCE;
+  }
+  return { hashes: valid };
+}
+
+// src/sandbox/call-timers.ts
+function createCallTimers(opts) {
+  function armWatchdog(call, onExpire) {
+    if (call.watchdog !== void 0) clearTimeout(call.watchdog);
+    call.watchdog = setTimeout(onExpire, opts.watchdogMs);
+    call.watchdog.unref();
+  }
+  function armHardTimer(call, onExpire) {
+    if (call.hardTimer !== void 0) clearTimeout(call.hardTimer);
+    call.hardTimer = setTimeout(onExpire, opts.hardTimeoutMs);
+    call.hardTimer.unref();
+  }
+  function pauseWatchdog(call) {
+    if (call.watchdog === void 0) return;
+    clearTimeout(call.watchdog);
+    call.watchdog = void 0;
+  }
+  function clearCallTimers(call) {
+    if (call.watchdog !== void 0) clearTimeout(call.watchdog);
+    if (call.hardTimer !== void 0) clearTimeout(call.hardTimer);
+  }
+  return { armWatchdog, armHardTimer, pauseWatchdog, clearCallTimers };
+}
+var API_METHOD_NAMES = [
+  "logInfo",
+  "logWarn",
+  "logError",
+  "listFileNames",
+  "readFile",
+  "statFile",
+  "statFiles",
+  "sniff",
+  "probe",
+  "hashBytes",
+  "computeImageHashes",
+  "listContainer",
+  "extractArchive",
+  "download",
+  "statAsset",
+  "readAsset",
+  "deleteAsset"
+];
+var LOG_METHOD_NAMES = /* @__PURE__ */ new Set([
+  "logInfo",
+  "logWarn",
+  "logError"
+]);
+function serializeError(err) {
+  if (err instanceof Error) {
+    return {
+      name: err.name,
+      message: err.message,
+      stack: err.stack,
+      // The vocabulary errors carry their code in `name`; the wire
+      // keeps an explicit `code` field so the receiving side never
+      // re-parses or re-derives it.
+      code: isAssetErrorName(err.name) ? err.name : void 0
+    };
+  }
+  return { name: "Error", message: String(err) };
+}
+function deserializeError(err) {
+  const e = new Error(err.message);
+  e.name = err.code ?? err.name;
+  if (err.stack !== void 0) e.stack = err.stack;
+  return e;
+}
+function isAssetErrorName(name) {
+  return PLUGIN_ASSET_ERROR_NAMES.includes(name);
+}
+
+// src/sandbox/sandboxed-plugin.ts
+function createSandboxedPlugin(hooks, invoke) {
+  const definition = {};
+  for (const hook of hooks) {
+    definition[hook] = async (api) => invoke(hook, api);
+  }
+  if (definition.detect === void 0) {
+    definition.detect = async () => ({
+      ok: false,
+      reasons: ["plugin does not implement detect()"]
+    });
+  }
+  return definePlugin(definition);
+}
+
+// src/sandbox/host.ts
+var PLUGIN_WATCHDOG_TIMEOUT_MS = 6e4;
+var PLUGIN_HOOK_HARD_TIMEOUT_MS = 30 * 6e4;
+var PLUGIN_WORKER_MAX_OLD_SPACE_MB = 512;
+var PLUGIN_MAX_RESULT_BYTES = 256 * 1024 * 1024;
+var PLUGIN_MAX_LOGS_PER_HOOK = 1e3;
+var PLUGIN_MAX_API_CALLS_PER_HOOK = 1e5;
+var ASSET_METHODS = /* @__PURE__ */ new Set([
+  "download",
+  "statAsset",
+  "readAsset",
+  "deleteAsset"
+]);
+var PLUGIN_WORKER_MAX_RESPAWNS = 3;
+var PLUGIN_WORKER_RESPAWN_WINDOW_MS = 6e4;
+var DEFAULT_SANDBOX_CONFIG = {
+  watchdogMs: PLUGIN_WATCHDOG_TIMEOUT_MS,
+  hardTimeoutMs: PLUGIN_HOOK_HARD_TIMEOUT_MS,
+  maxOldSpaceMb: PLUGIN_WORKER_MAX_OLD_SPACE_MB,
+  maxRespawns: PLUGIN_WORKER_MAX_RESPAWNS,
+  respawnWindowMs: PLUGIN_WORKER_RESPAWN_WINDOW_MS,
+  maxResultBytes: PLUGIN_MAX_RESULT_BYTES,
+  maxLogsPerHook: PLUGIN_MAX_LOGS_PER_HOOK,
+  maxApiCallsPerHook: PLUGIN_MAX_API_CALLS_PER_HOOK
+};
+var PERMISSION_FLAG_CANDIDATES = ["--permission", "--experimental-permission"];
+var permissionFlagPromise;
+async function resolvePermissionFlag() {
+  permissionFlagPromise ??= probePermissionFlag();
+  return permissionFlagPromise;
+}
+async function probePermissionFlag() {
+  for (const flag of PERMISSION_FLAG_CANDIDATES) {
+    if (await acceptsFlag(flag)) return flag;
+  }
+  return void 0;
+}
+function acceptsFlag(flag) {
+  return new Promise((resolveProbe) => {
+    const probe = spawn(
+      process.execPath,
+      [flag, `--allow-fs-read=${tmpdir()}`, "-e", "process.exit(0)"],
+      { stdio: "ignore", timeout: 1e4 }
+    );
+    probe.on("exit", (code) => resolveProbe(code === 0));
+    probe.on("error", () => resolveProbe(false));
+  });
+}
+function createPluginSandbox(config = DEFAULT_SANDBOX_CONFIG) {
+  const states = /* @__PURE__ */ new Map();
+  let nextCallId = 1;
+  const timers = createCallTimers({
+    watchdogMs: config.watchdogMs,
+    hardTimeoutMs: config.hardTimeoutMs
+  });
+  async function loadPlugin(opts) {
+    const previous = states.get(opts.id);
+    const state = {
+      id: opts.id,
+      mainPath: opts.mainPath,
+      permissions: opts.permissions,
+      child: void 0,
+      hooks: void 0,
+      loading: void 0,
+      loadWaiter: void 0,
+      pending: /* @__PURE__ */ new Map(),
+      respawnTimes: [],
+      degraded: false,
+      disposed: false
+    };
+    states.set(opts.id, state);
+    try {
+      await ensureLoaded(state);
+    } catch (err) {
+      console.error(`[plugin-sandbox] ${opts.id}: failed to load main.js`, err);
+      state.disposed = true;
+      if (states.get(opts.id) !== state) return void 0;
+      if (previous !== void 0) {
+        previous.disposed = false;
+        states.set(opts.id, previous);
+        return createSandboxedPlugin(
+          previous.hooks ?? ["detect"],
+          (hook, api) => invoke(previous, hook, api)
+        );
+      }
+      states.delete(opts.id);
+      return void 0;
+    }
+    if (previous !== void 0) {
+      previous.disposed = true;
+      await teardownChild(previous);
+    }
+    if (!opts.eager) {
+      void teardownChild(state);
+    }
+    return createSandboxedPlugin(
+      state.hooks ?? ["detect"],
+      (hook, api) => invoke(state, hook, api)
+    );
+  }
+  function unloadPlugin(id) {
+    const state = states.get(id);
+    if (state === void 0) return;
+    teardownChild(state);
+    state.respawnTimes = [];
+    state.degraded = false;
+  }
+  async function disposeAll() {
+    const tasks = [];
+    for (const state of states.values()) {
+      state.disposed = true;
+      tasks.push(teardownChild(state));
+    }
+    states.clear();
+    await Promise.all(tasks);
+  }
+  async function disposeExcept(keepIds) {
+    const tasks = [];
+    for (const [id, state] of states) {
+      if (keepIds.has(id)) continue;
+      state.disposed = true;
+      states.delete(id);
+      tasks.push(teardownChild(state));
+    }
+    await Promise.all(tasks);
+  }
+  function syncRef(state) {
+    const child = state.child;
+    if (child === void 0) return;
+    if (state.loading !== void 0 || state.loadWaiter !== void 0 || state.pending.size > 0) {
+      child.ref();
+    } else {
+      child.unref();
+    }
+  }
+  function ensureLoaded(state) {
+    if (state.child !== void 0) return Promise.resolve();
+    state.loading ??= spawnAndLoad(state).finally(() => {
+      state.loading = void 0;
+    });
+    return state.loading;
+  }
+  async function spawnAndLoad(state) {
+    const now = Date.now();
+    state.respawnTimes = state.respawnTimes.filter(
+      (t) => now - t < config.respawnWindowMs
+    );
+    if (state.respawnTimes.length >= config.maxRespawns) {
+      state.degraded = true;
+      throw new Error(
+        `plugin ${state.id} unavailable: sandbox respawned ${config.maxRespawns} times within ${config.respawnWindowMs}ms`
+      );
+    }
+    state.respawnTimes.push(now);
+    const permissionFlag = config.permissionFlag ?? await resolvePermissionFlag();
+    if (permissionFlag === void 0) {
+      throw new Error(
+        `plugin ${state.id} unavailable: this Node build has no permission-model flag (tried ${PERMISSION_FLAG_CANDIDATES.map((f) => `"${f}"`).join(", ")}); refusing to run plugin code unsandboxed`
+      );
+    }
+    const entryPath = fileURLToPath(resolveWorkerEntryUrl());
+    const pluginDir = dirname(state.mainPath);
+    const realEntryPath = realPathOrResolve(entryPath);
+    const realPluginDir = realPathOrResolve(pluginDir);
+    const realMainPath = realPathOrResolve(state.mainPath);
+    const fsReadGrants = [`${realPluginDir}${sep}`, realEntryPath];
+    const assetVaultDir = typeof config.assetVaultDir === "function" ? config.assetVaultDir(state.id) : config.assetVaultDir;
+    const realVaultDir = assetVaultDir === void 0 ? void 0 : realPathOrResolve(assetVaultDir);
+    if (realVaultDir !== void 0) {
+      fsReadGrants.push(`${realVaultDir}${sep}`);
+    }
+    const child = fork(
+      realEntryPath,
+      [realPluginDir, realEntryPath, realVaultDir].filter(
+        (v) => v !== void 0
+      ),
+      {
+        execArgv: [
+          permissionFlag,
+          ...fsReadGrants.map((p) => `--allow-fs-read=${p}`),
+          `--max-old-space-size=${config.maxOldSpaceMb}`
+        ],
+        serialization: "advanced",
+        // Child stderr is inherited (self-check failures must surface);
+        // plugin console output is dropped — logs flow over the RPC.
+        stdio: ["ignore", "ignore", "inherit", "ipc"],
+        env: {
+          ...process.env,
+          HOARDODILE_PLUGIN_MAX_RESULT_BYTES: String(config.maxResultBytes),
+          HOARDODILE_PLUGIN_MAX_LOGS_PER_HOOK: String(config.maxLogsPerHook),
+          HOARDODILE_PLUGIN_MAX_API_CALLS_PER_HOOK: String(
+            config.maxApiCallsPerHook
+          )
+        }
+      }
+    );
+    child.unref();
+    state.child = child;
+    syncRef(state);
+    child.on(
+      "message",
+      (msg) => handleMessage(state, child, msg)
+    );
+    child.on("error", (err) => failChild(state, child, asError(err)));
+    child.on("exit", (code) => {
+      if (state.child === child) {
+        failChild(
+          state,
+          child,
+          new Error(`plugin ${state.id} worker exited (code ${code})`)
+        );
+      }
+    });
+    const loaded = new Promise((resolveLoaded, reject) => {
+      state.loadWaiter = { resolve: resolveLoaded, reject };
+    });
+    try {
+      child.send({ type: "load", mainPath: realMainPath });
+    } catch (err) {
+      await teardownChild(state, asError(err));
+      throw err;
+    }
+    try {
+      await loaded;
+    } catch (err) {
+      await teardownChild(state);
+      throw err;
+    } finally {
+      state.loadWaiter = void 0;
+    }
+    syncRef(state);
+  }
+  function teardownChild(state, err) {
+    const child = state.child;
+    state.child = void 0;
+    state.loading = void 0;
+    const stopErr = err ?? new Error(`plugin ${state.id} worker stopped`);
+    state.loadWaiter?.reject(stopErr);
+    state.loadWaiter = void 0;
+    rejectAllPending(state, stopErr);
+    if (child === void 0) return Promise.resolve();
+    child.kill();
+    return Promise.resolve();
+  }
+  function failChild(state, child, err) {
+    if (state.child !== child) return;
+    void teardownChild(state, err);
+  }
+  function rejectAllPending(state, err) {
+    for (const call of state.pending.values()) {
+      timers.clearCallTimers(call);
+      call.reject(err);
+    }
+    state.pending.clear();
+  }
+  async function invoke(state, hook, api) {
+    if (state.disposed) {
+      throw new Error(`plugin ${state.id} sandbox disposed`);
+    }
+    if (state.degraded) {
+      const now = Date.now();
+      state.respawnTimes = state.respawnTimes.filter(
+        (t) => now - t < config.respawnWindowMs
+      );
+      if (state.respawnTimes.length === 0) {
+        state.degraded = false;
+      } else {
+        throw new Error(
+          `plugin ${state.id} unavailable: sandbox crashed repeatedly`
+        );
+      }
+    }
+    await ensureLoaded(state);
+    const child = state.child;
+    if (child === void 0) {
+      throw new Error(`plugin ${state.id} sandbox unavailable`);
+    }
+    const callId = nextCallId++;
+    return new Promise((resolveCall, reject) => {
+      const call = {
+        api,
+        resolve: resolveCall,
+        reject,
+        apiInFlight: 0
+      };
+      state.pending.set(callId, call);
+      syncRef(state);
+      timers.armWatchdog(
+        call,
+        failCall(
+          state,
+          child,
+          callId,
+          `hung: no activity for ${config.watchdogMs}ms`
+        )
+      );
+      timers.armHardTimer(
+        call,
+        failCall(
+          state,
+          child,
+          callId,
+          `exceeded hard timeout ${config.hardTimeoutMs}ms`
+        )
+      );
+      try {
+        child.send({
+          type: "invoke",
+          callId,
+          hook
+        });
+      } catch (err) {
+        state.pending.delete(callId);
+        syncRef(state);
+        timers.clearCallTimers(call);
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+  }
+  function failCall(state, child, callId, reason) {
+    return () => failChild(
+      state,
+      child,
+      new Error(`plugin ${state.id} ${reason} (call ${callId})`)
+    );
+  }
+  function handleMessage(state, child, msg) {
+    if (state.child !== child) return;
+    if (msg === null || typeof msg !== "object") return;
+    switch (msg.type) {
+      case "loaded": {
+        const waiter = state.loadWaiter;
+        state.loadWaiter = void 0;
+        if (msg.ok) {
+          state.hooks = msg.hooks ?? ["detect"];
+          waiter?.resolve();
+        } else {
+          waiter?.reject(
+            deserializeError(
+              msg.error ?? { name: "Error", message: "plugin load failed" }
+            )
+          );
+        }
+        return;
+      }
+      case "result": {
+        const call = state.pending.get(msg.callId);
+        if (call === void 0) return;
+        state.pending.delete(msg.callId);
+        syncRef(state);
+        timers.clearCallTimers(call);
+        if (msg.ok) {
+          call.resolve(msg.value);
+        } else {
+          call.reject(
+            deserializeError(
+              msg.error ?? { name: "Error", message: "hook failed" }
+            )
+          );
+        }
+        return;
+      }
+      case "api": {
+        const call = state.pending.get(msg.callId);
+        if (call === void 0) return;
+        call.apiInFlight += 1;
+        timers.pauseWatchdog(call);
+        void dispatchApi(
+          child,
+          state,
+          msg.callId,
+          msg.apiCallId,
+          call,
+          msg.method,
+          msg.args
+        );
+        return;
+      }
+      case "log": {
+        const call = state.pending.get(msg.callId);
+        if (call === void 0) return;
+        if (call.apiInFlight === 0) {
+          timers.armWatchdog(
+            call,
+            failCall(
+              state,
+              child,
+              msg.callId,
+              `hung: no activity for ${config.watchdogMs}ms`
+            )
+          );
+        }
+        dispatchLog(state.id, msg.method, msg.args);
+        return;
+      }
+    }
+  }
+  async function dispatchApi(child, state, callId, apiCallId, call, method, args) {
+    const respond = (ok, value, error) => {
+      if (state.child !== child) return;
+      try {
+        child.send({ type: "apiResult", apiCallId, ok, value, error });
+      } catch {
+      }
+    };
+    try {
+      if (!isApiMethod(method) || LOG_METHOD_NAMES.has(method)) {
+        respond(false, void 0, {
+          name: "Error",
+          message: `unknown API method: ${String(method)}`
+        });
+        return;
+      }
+      const capability = CAPABILITY_BY_METHOD.get(method);
+      if (capability !== void 0 && state.permissions?.[capability] !== true) {
+        respond(false, void 0, {
+          name: "POLICY",
+          code: "POLICY",
+          message: `${capability} permission denied for plugin ${state.id} \u2014 declare "${capability}": true in the manifest to use ${method}()`
+        });
+        return;
+      }
+      if (ASSET_METHODS.has(method)) {
+        const handler = config.pluginAssets;
+        if (handler === void 0) {
+          respond(false, void 0, {
+            name: "UNAVAILABLE",
+            code: "UNAVAILABLE",
+            message: `${method}() is unavailable on this host \u2014 plugin asset downloads need the app server runtime`
+          });
+          return;
+        }
+        if (method === "download") {
+          respond(
+            true,
+            await handler.download(state.id, args[0])
+          );
+        } else if (method === "statAsset") {
+          respond(true, await handler.statAsset(state.id, args[0]));
+        } else if (method === "readAsset") {
+          respond(true, await handler.readAsset(state.id, args[0]));
+        } else {
+          respond(true, await handler.deleteAsset(state.id, args[0]));
+        }
+        return;
+      }
+      const fn = call.api[method];
+      respond(true, await fn(...args));
+    } catch (err) {
+      respond(false, void 0, serializeError(err));
+    } finally {
+      call.apiInFlight -= 1;
+      if (call.apiInFlight === 0 && state.pending.get(callId) === call) {
+        timers.armWatchdog(
+          call,
+          failCall(
+            state,
+            child,
+            callId,
+            `hung: no activity for ${config.watchdogMs}ms`
+          )
+        );
+      }
+    }
+  }
+  function dispatchLog(pluginId, method, args) {
+    const message = typeof args[0] === "string" ? args[0] : String(args[0]);
+    const data = isPlainRecord(args[1]) ? args[1] : void 0;
+    const line = `[plugin:${pluginId}] ${message}`;
+    const extra = data === void 0 ? [] : [data];
+    try {
+      if (method === "logInfo") console.log(line, ...extra);
+      else if (method === "logWarn") console.warn(line, ...extra);
+      else console.error(line, ...extra);
+    } catch {
+    }
+  }
+  return { loadPlugin, unloadPlugin, disposeExcept, disposeAll };
+}
+function isApiMethod(name) {
+  return typeof name === "string" && API_METHOD_NAMES.includes(name);
+}
+function asError(value) {
+  return value instanceof Error ? value : new Error(String(value));
+}
+function realPathOrResolve(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(path);
+  }
+}
+function resolveWorkerEntryUrl() {
+  try {
+    if (typeof import.meta.resolve === "function") {
+      return import.meta.resolve("@hoardodile/host/worker-entry");
+    }
+  } catch {
+  }
+  return workerEntryUrlFromModule(import.meta.url);
+}
+function workerEntryUrlFromModule(moduleUrl) {
+  const distIdx = moduleUrl.lastIndexOf("/dist/");
+  if (distIdx >= 0) {
+    const distRoot = moduleUrl.slice(0, distIdx + "/dist/".length);
+    return new URL("chunks/worker-entry.mjs", distRoot).href;
+  }
+  return new URL("worker-entry.mjs", moduleUrl).href;
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var VAULT_DIR_NAME = "vault";
+function seedPlugins(pluginsDir, seedPluginDirs) {
+  if (seedPluginDirs === void 0 || seedPluginDirs.length === 0) {
+    return;
+  }
+  for (const dir of seedPluginDirs) {
+    try {
+      copyPluginDir(dir, pluginsDir);
+    } catch (err) {
+      console.warn(
+        `[plugin-loader] failed to seed plugin dir ${dir}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+}
+function copyPluginDir(srcDir, pluginsDir) {
+  const id = readManifestId(srcDir);
+  if (id === void 0) return false;
+  const dstDir = join(pluginsDir, id);
+  if (existsSync(dstDir) && treesMatch(srcDir, dstDir)) {
+    return true;
+  }
+  if (existsSync(dstDir)) {
+    const vaultDir = join(dstDir, VAULT_DIR_NAME);
+    const stashDir = join(pluginsDir, `.vault-${id}-${Date.now()}`);
+    const hasVault = existsSync(vaultDir);
+    if (hasVault) {
+      renameSync(vaultDir, stashDir);
+    }
+    rmSync(dstDir, { recursive: true, force: true });
+    mkdirSync(dstDir, { recursive: true });
+    for (const f of readdirSync(srcDir)) {
+      if (f === VAULT_DIR_NAME) continue;
+      cpSync(join(srcDir, f), join(dstDir, f), { recursive: true });
+    }
+    if (existsSync(stashDir)) {
+      renameSync(stashDir, join(dstDir, VAULT_DIR_NAME));
+    }
+    return true;
+  }
+  mkdirSync(dstDir, { recursive: true });
+  for (const f of readdirSync(srcDir)) {
+    if (f === VAULT_DIR_NAME) continue;
+    cpSync(join(srcDir, f), join(dstDir, f), { recursive: true });
+  }
+  return true;
+}
+function readManifestId(dir) {
+  const manifestPath = join(dir, "manifest.json");
+  if (!existsSync(manifestPath)) return void 0;
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+  } catch {
+    return void 0;
+  }
+  if (typeof manifest.id !== "string" || manifest.id.length === 0) {
+    return void 0;
+  }
+  return manifest.id;
+}
+function treesMatch(a, b) {
+  const left = fingerprintTree(a);
+  const right = fingerprintTree(b);
+  if (left.size !== right.size) return false;
+  for (const [path, fingerprint] of left) {
+    if (right.get(path) !== fingerprint) return false;
+  }
+  return true;
+}
+function fingerprintTree(root) {
+  const out = /* @__PURE__ */ new Map();
+  if (!existsSync(root)) return out;
+  walkFiles(root, "", out);
+  return out;
+}
+function walkFiles(absDir, relDir, out) {
+  const entries = readdirSync(absDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (relDir.length === 0 && entry.name === VAULT_DIR_NAME) continue;
+    const rel = relDir.length === 0 ? entry.name : `${relDir}/${entry.name}`;
+    const abs = join(absDir, entry.name);
+    if (entry.isDirectory()) {
+      walkFiles(abs, rel, out);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const st = statSync(abs);
+    const hash = createHash("sha256").update(readFileSync(abs)).digest("hex");
+    out.set(rel.replaceAll("\\", "/"), `${st.size}:${hash}`);
+  }
+}
+
+// src/loader.ts
+function createPluginLoader(deps) {
+  let registry;
+  let chain = Promise.resolve();
+  const discovery = createPluginDiscovery(deps);
+  const sandbox = deps.sandbox ?? createPluginSandbox();
+  const activation = createPluginActivation({ sandbox });
+  function loadAll() {
+    const run = chain.then(doLoadAll);
+    chain = run.catch(() => {
+    });
+    return run;
+  }
+  async function doLoadAll() {
+    const seedStart = performance.now();
+    seedPlugins(deps.pluginsDir, deps.seedPluginDirs);
+    deps.onTiming?.("seed", Math.round(performance.now() - seedStart));
+    const discoverStart = performance.now();
+    const { found, missing } = await discovery.discover();
+    deps.onTiming?.("discover", Math.round(performance.now() - discoverStart));
+    const activateStart = performance.now();
+    const activated = await activation.activateAll(found);
+    deps.onTiming?.("activate", Math.round(performance.now() - activateStart));
+    const failing = activation.createFailingEntries(missing);
+    const entries = [...activated, ...failing];
+    entries.sort((a, b) => a.priority - b.priority);
+    const next = buildRegistry(entries);
+    await sandbox.disposeExcept(new Set(next.getAll().map((e) => e.id)));
+    registry = next;
+    return registry;
+  }
+  async function rescan() {
+    return loadAll();
+  }
+  function getRegistry() {
+    if (registry === void 0) {
+      throw new Error("Plugin registry not initialised \u2014 call loadAll() first");
+    }
+    return registry;
+  }
+  return { loadAll, rescan, getRegistry };
+}
+function buildRegistry(entries) {
+  const byId = /* @__PURE__ */ new Map();
+  const deduped = [];
+  for (const entry of entries) {
+    const existing = byId.get(entry.id);
+    if (existing !== void 0) {
+      console.warn(
+        `[plugin-loader] skipping ${entry.id}: UUID conflicts with already registered plugin (${existing.manifest.name ?? existing.id}), keeping first`
+      );
+      continue;
+    }
+    byId.set(entry.id, entry);
+    deduped.push(entry);
+  }
+  let sortedEntries = deduped;
+  return {
+    getAll() {
+      return sortedEntries;
+    },
+    getEnabled() {
+      return sortedEntries.filter((e) => e.enabled);
+    },
+    getById(id) {
+      return byId.get(id);
+    },
+    getBuiltin() {
+      return sortedEntries.find((e) => e.builtin);
+    },
+    getForResource(resPluginId) {
+      const entry = byId.get(resPluginId);
+      if (entry === void 0 || !entry.enabled) return void 0;
+      return entry;
+    },
+    updateEntry(id, patch) {
+      const index = sortedEntries.findIndex((e) => e.id === id);
+      if (index === -1) return;
+      const old = sortedEntries[index];
+      if (old === void 0) return;
+      const updated = {
+        id: old.id,
+        manifest: old.manifest,
+        plugin: old.plugin,
+        diskPath: old.diskPath,
+        enabled: patch.enabled ?? old.enabled,
+        priority: patch.priority ?? old.priority,
+        pinned: patch.pinned ?? old.pinned,
+        color: patch.color ?? old.color,
+        missing: patch.missing ?? old.missing,
+        builtin: old.builtin,
+        dev: old.dev
+      };
+      sortedEntries = [
+        ...sortedEntries.slice(0, index),
+        updated,
+        ...sortedEntries.slice(index + 1)
+      ];
+      sortedEntries.sort((a, b) => a.priority - b.priority);
+      byId.set(id, updated);
+    }
+  };
+}
+
+// src/probe-cache.ts
+var PLUGIN_PROBE_CACHE_MAX_ENTRIES = 512;
+function createProbeCache(maxEntries = PLUGIN_PROBE_CACHE_MAX_ENTRIES) {
+  const cells = /* @__PURE__ */ new Map();
+  return {
+    getOrCompute(key, compute) {
+      const existing = cells.get(key);
+      if (existing !== void 0) {
+        cells.delete(key);
+        cells.set(key, existing);
+        return existing;
+      }
+      const promise = compute();
+      cells.set(key, promise);
+      promise.catch(() => {
+        if (cells.get(key) === promise) cells.delete(key);
+      });
+      if (cells.size > maxEntries) {
+        const oldest = cells.keys().next().value;
+        if (oldest !== void 0) cells.delete(oldest);
+      }
+      return promise;
+    }
+  };
+}
+
+export { DEFAULT_PLUGIN_EXTRACT_MAX_BYTES, DEFAULT_PLUGIN_EXTRACT_MAX_ENTRIES, DEFAULT_SANDBOX_CONFIG, DomainError, MIN_PERCEPTUAL_STDDEV, PERCEPTUAL_HASH_KINDS, PHASH_GRID, PLUGIN_HOOK_HARD_TIMEOUT_MS, PLUGIN_MAX_API_CALLS_PER_HOOK, PLUGIN_MAX_LOGS_PER_HOOK, PLUGIN_MAX_RESULT_BYTES, PLUGIN_PROBE_CACHE_MAX_ENTRIES, PLUGIN_WATCHDOG_TIMEOUT_MS, PLUGIN_WORKER_MAX_OLD_SPACE_MB, PLUGIN_WORKER_MAX_RESPAWNS, PLUGIN_WORKER_RESPAWN_WINDOW_MS, buildRegistry, computeDHash, computePHash, conflict, createCapabilityGuard, createDirectoryContainer, createDirectoryResourceAPI, createDirectoryResourceAPI as createImportResourceAPI, createNestedAwareContainer, createNestedCdCache, createPluginActivation, createPluginDiscovery, createPluginHooks, createPluginLoader, createPluginResourceAPI, createPluginSandbox, createProbeCache, grayStddev, invalid, listZipEntries, materializeFile, notFound, parseManifest, resolveSafeImportPath, runPluginHook, seedPlugins };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map