@hoardodile/sdk-types 0.0.0

package/dist/manifest-Dk6_xyNy.d.ts

@@ -0,0 +1,204 @@
+import { z } from 'zod';
+
+/**
+ * Plugin manifest UUID (v4). Generated once when scaffolding a plugin
+ * (e.g. `crypto.randomUUID()`) and never reused across plugins — the
+ * server keys installed plugins by this id.
+ */
+declare const pluginManifestId: z.ZodString;
+type PluginManifestId = z.infer<typeof pluginManifestId>;
+/**
+ * Declared plugin capabilities. Each flag gates the corresponding API
+ * surface: a plugin without `danmaku` gets no danmaku methods and the
+ * host enforces the permission at the capability guard, so a manifest
+ * that does not declare a capability cannot call it.
+ */
+declare const pluginPermissions: z.ZodObject<{
+    sourceMeta: z.ZodDefault<z.ZodBoolean>;
+    searchMeta: z.ZodDefault<z.ZodBoolean>;
+    danmaku: z.ZodDefault<z.ZodBoolean>;
+    message: z.ZodDefault<z.ZodBoolean>;
+    imageHashes: z.ZodDefault<z.ZodBoolean>;
+    container: z.ZodDefault<z.ZodBoolean>;
+    download: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type PluginPermissions = z.infer<typeof pluginPermissions>;
+/**
+ * Label key → locale table: `{ "cover.open": { "en": "Open", "zh-CN": "打开" } }`.
+ * The host's template engine resolves `t('cover.open')` against the
+ * resource's locale from this map.
+ */
+declare const localeString: z.ZodRecord<z.ZodString, z.ZodString>;
+/** Icon reference: an asset path inside the plugin zip (`assets/icon.svg`). */
+declare const iconRef: z.ZodString;
+/**
+ * Corner template slots for one content kind. Templates are rendered by
+ * the host's template engine over the resource's file list; supported
+ * directives include `{{data.field}}`, `{{duration(ms)}}`, `{{inc(n)}}`
+ * and `{{t('key')}}`.
+ */
+declare const coverKindUi: z.ZodObject<{
+    tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Cover templates per content kind. A plugin declares the kinds it can
+ * produce; the host picks the block matching the resource's cover type
+ * (`image`/`video`/`audio`/`default`) and renders each corner as
+ * specified, or falls back to the default cover when no block matches.
+ */
+declare const coverKindUiMap: z.ZodObject<{
+    image: z.ZodOptional<z.ZodObject<{
+        tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    video: z.ZodOptional<z.ZodObject<{
+        tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    audio: z.ZodOptional<z.ZodObject<{
+        tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    default: z.ZodOptional<z.ZodObject<{
+        tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * A search facet kind: a named dimension with an icon, rendered as a
+ * facet group in the host's search UI. `key` becomes the facet key in
+ * the search metadata the plugin produces.
+ */
+declare const searchKind: z.ZodObject<{
+    key: z.ZodString;
+    label: z.ZodString;
+    icon: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type SearchKind = z.infer<typeof searchKind>;
+/**
+ * Manifest-declared UI preferences. These shape how the host app
+ * presents the plugin's iframe without the plugin shipping any host
+ * integration code.
+ */
+declare const pluginManifestUi: z.ZodObject<{
+    height: z.ZodOptional<z.ZodString>;
+    aspect: z.ZodOptional<z.ZodString>;
+    card: z.ZodOptional<z.ZodObject<{
+        image: z.ZodOptional<z.ZodObject<{
+            tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        video: z.ZodOptional<z.ZodObject<{
+            tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        audio: z.ZodOptional<z.ZodObject<{
+            tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        default: z.ZodOptional<z.ZodObject<{
+            tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    search: z.ZodOptional<z.ZodObject<{
+        kinds: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            label: z.ZodString;
+            icon: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    message: z.ZodOptional<z.ZodObject<{
+        anchor: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    inheritFont: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+type PluginManifestUi = z.infer<typeof pluginManifestUi>;
+type CoverKindUi = z.infer<typeof coverKindUi>;
+type CoverKindUiMap = z.infer<typeof coverKindUiMap>;
+/**
+ * The plugin manifest contract — the single schema validated everywhere
+ * via its parse: the server at install time, the build CLI, and the
+ * workbench. A manifest lives at the zip root of a built plugin next to
+ * `main.js` and `index.html`.
+ */
+declare const pluginManifest: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodString;
+    icon: z.ZodOptional<z.ZodString>;
+    version: z.ZodString;
+    permissions: z.ZodObject<{
+        sourceMeta: z.ZodDefault<z.ZodBoolean>;
+        searchMeta: z.ZodDefault<z.ZodBoolean>;
+        danmaku: z.ZodDefault<z.ZodBoolean>;
+        message: z.ZodDefault<z.ZodBoolean>;
+        imageHashes: z.ZodDefault<z.ZodBoolean>;
+        container: z.ZodDefault<z.ZodBoolean>;
+        download: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>;
+    i18n: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>;
+    ui: z.ZodOptional<z.ZodObject<{
+        height: z.ZodOptional<z.ZodString>;
+        aspect: z.ZodOptional<z.ZodString>;
+        card: z.ZodOptional<z.ZodObject<{
+            image: z.ZodOptional<z.ZodObject<{
+                tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+            video: z.ZodOptional<z.ZodObject<{
+                tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+            audio: z.ZodOptional<z.ZodObject<{
+                tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+            default: z.ZodOptional<z.ZodObject<{
+                tl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                bl: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                br: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        search: z.ZodOptional<z.ZodObject<{
+            kinds: z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                label: z.ZodString;
+                icon: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        message: z.ZodOptional<z.ZodObject<{
+            anchor: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        inheritFont: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type PluginManifest = z.infer<typeof pluginManifest>;
+
+export { type CoverKindUi as C, type PluginManifest as P, type SearchKind as S, type CoverKindUiMap as a, type PluginManifestId as b, type PluginManifestUi as c, type PluginPermissions as d, pluginManifestId as e, pluginManifestUi as f, pluginPermissions as g, iconRef as i, localeString as l, pluginManifest as p, searchKind as s };

package/dist/media-exts.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Canonical media-type knowledge: the extension sets, the extension →
+ * MIME table and the MIME → media-kind mapping shared by content
+ * plugins, the runtime host's sniffer and the server's classification
+ * pipeline.
+ *
+ * Extensions are a **hint**, never the verdict: `ResourceAPI.sniff`
+ * reads the file's magic bytes and only falls back to the tables here
+ * when the content carries no recognizable signature (text formats).
+ * The sets below therefore answer "which extensions do we expect to
+ * decode", not "what is this file".
+ *
+ * Lower-case, with leading dot — match the output of
+ * `path.extname(name).toLowerCase()`.
+ *
+ * Adding a new extension here widens classification everywhere at
+ * once. Before adding, verify:
+ * - sharp can extract width/height (image)
+ * - ffprobe can read width/height/duration (video)
+ * - ffprobe can read the stream/format metadata (audio), and the
+ *   extension has an entry in `AUDIO_FFMPEG_INPUT_FORMAT`
+ * - the extension has an entry in {@link EXT_MIME}
+ * - the gallery plugin's transcode-required set reflects the format
+ *   (browser-renderable originals stay native; HEIC/TIFF need the
+ *   sharp preview pipeline)
+ */
+declare const IMAGE_EXTS: ReadonlySet<string>;
+declare const VIDEO_EXTS: ReadonlySet<string>;
+declare const AUDIO_EXTS: ReadonlySet<string>;
+/**
+ * Video containers ffmpeg can demux from a forward-only pipe (matroska,
+ * avi). ISO-BMFF files (.mp4/.mov/.m4v) keep their moov index at the end
+ * of the file, so a stream attempt on a zip-entry source is guaranteed to
+ * fail after burning a full probesize read — consumers (thumb pipeline,
+ * cover probing) send those straight to the materialized entry instead.
+ */
+declare const STREAMABLE_VIDEO_EXTS: ReadonlySet<string>;
+/**
+ * ffmpeg `-f` container name for piped audio bytes (no filename hint).
+ * `.opus` files are Ogg containers; `.m4a` is ISO-BMFF, demuxed by the
+ * mp4 demuxer.
+ */
+declare const AUDIO_FFMPEG_INPUT_FORMAT: Readonly<Record<string, string>>;
+/**
+ * ffmpeg `-f` container name keyed by **sniffed MIME type**, for piped
+ * sources that have no filename ffprobe could key off. Content-derived
+ * routing is what lets a mislabelled file still demux correctly, so
+ * this table — not the extension one — drives `ResourceAPI.probe`.
+ *
+ * Several spellings map to the same container because magic-byte
+ * matchers and IANA disagree on the canonical name (`audio/wav` vs
+ * `audio/x-wav`, `video/vnd.avi` vs `video/x-msvideo`).
+ */
+declare const MIME_FFMPEG_INPUT_FORMAT: Readonly<Record<string, string>>;
+/**
+ * The audio mirror of {@link STREAMABLE_VIDEO_EXTS}: containers whose
+ * headers lead the file, so ffmpeg/ffprobe can demux them from a
+ * forward-only pipe. `.m4a` is ISO-BMFF with a trailing moov index, so
+ * it must be probed from a materialized (seekable) entry.
+ */
+declare const STREAMABLE_AUDIO_EXTS: ReadonlySet<string>;
+/**
+ * Media families a file can belong to. `other` covers everything the
+ * media pipeline does not decode (text, documents, archives, ...) — it
+ * is a real answer, not a failure.
+ */
+declare const MEDIA_KINDS: readonly ["image", "video", "audio", "other"];
+type MediaKind = (typeof MEDIA_KINDS)[number];
+/**
+ * Extension → canonical MIME type. Used as the *fallback* branch of
+ * content sniffing: magic-byte detection covers binary media, while
+ * text-based formats (`.txt`, `.md`, `.csv`, subtitles, ...) carry no
+ * signature and can only be named by their extension.
+ */
+declare const EXT_MIME: Readonly<Record<string, string>>;
+/**
+ * Container MIME types whose top-level type does not describe the
+ * payload. Ogg and Matroska carry audio *or* video, and `application/*`
+ * says nothing either way — the values here are the common case, and
+ * `ResourceAPI.probe` overrides them with the stream layout ffprobe
+ * actually reports.
+ */
+declare const MIME_KIND_OVERRIDES: Readonly<Record<string, MediaKind>>;
+/**
+ * Media family of a MIME type: the override table first, then the
+ * top-level type. Never throws — unknown types are `other`.
+ */
+declare function mimeToKind(mime: string): MediaKind;
+/** Canonical MIME type for an extension (leading dot), or `undefined`. */
+declare function extToMime(ext: string): string | undefined;
+
+export { AUDIO_EXTS, AUDIO_FFMPEG_INPUT_FORMAT, EXT_MIME, IMAGE_EXTS, MEDIA_KINDS, MIME_FFMPEG_INPUT_FORMAT, MIME_KIND_OVERRIDES, type MediaKind, STREAMABLE_AUDIO_EXTS, STREAMABLE_VIDEO_EXTS, VIDEO_EXTS, extToMime, mimeToKind };

package/dist/media-exts.js

@@ -0,0 +1,160 @@
+// src/media-exts.ts
+var IMAGE_EXTS = /* @__PURE__ */ new Set([
+  ".jpg",
+  ".jpeg",
+  ".png",
+  ".webp",
+  ".gif",
+  ".bmp",
+  ".avif",
+  ".heic",
+  ".heif",
+  ".tif",
+  ".tiff",
+  ".svg",
+  ".jp2",
+  ".j2k",
+  ".jpx"
+]);
+var VIDEO_EXTS = /* @__PURE__ */ new Set([
+  ".mp4",
+  ".webm",
+  ".mov",
+  ".mkv",
+  ".m4v",
+  ".avi",
+  ".3gp"
+]);
+var AUDIO_EXTS = /* @__PURE__ */ new Set([
+  ".mp3",
+  ".flac",
+  ".ogg",
+  ".m4a",
+  ".wav",
+  ".opus",
+  ".aac"
+]);
+var STREAMABLE_VIDEO_EXTS = /* @__PURE__ */ new Set([
+  ".webm",
+  ".mkv",
+  ".avi"
+]);
+var AUDIO_FFMPEG_INPUT_FORMAT = {
+  ".mp3": "mp3",
+  ".flac": "flac",
+  ".ogg": "ogg",
+  ".opus": "ogg",
+  ".wav": "wav",
+  ".m4a": "mp4",
+  ".aac": "aac"
+};
+var MIME_FFMPEG_INPUT_FORMAT = {
+  "video/mp4": "mp4",
+  "video/quicktime": "mov",
+  "video/webm": "webm",
+  "video/x-matroska": "matroska",
+  "video/matroska": "matroska",
+  "video/vnd.avi": "avi",
+  "video/x-msvideo": "avi",
+  "video/avi": "avi",
+  "video/ogg": "ogg",
+  "audio/mpeg": "mp3",
+  "audio/mp3": "mp3",
+  "audio/flac": "flac",
+  "audio/x-flac": "flac",
+  "audio/ogg": "ogg",
+  "audio/opus": "ogg",
+  "audio/vorbis": "ogg",
+  "audio/wav": "wav",
+  "audio/x-wav": "wav",
+  "audio/vnd.wave": "wav",
+  "audio/wave": "wav",
+  "audio/mp4": "mp4",
+  "audio/x-m4a": "mp4",
+  "audio/aac": "aac",
+  "video/3gpp": "mp4",
+  "application/ogg": "ogg",
+  "application/x-matroska": "matroska",
+  "application/mp4": "mp4"
+};
+var STREAMABLE_AUDIO_EXTS = /* @__PURE__ */ new Set([
+  ".mp3",
+  ".flac",
+  ".ogg",
+  ".opus",
+  ".wav",
+  ".aac"
+]);
+var MEDIA_KINDS = ["image", "video", "audio", "other"];
+var EXT_MIME = {
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".png": "image/png",
+  ".webp": "image/webp",
+  ".gif": "image/gif",
+  ".bmp": "image/bmp",
+  ".avif": "image/avif",
+  ".heic": "image/heic",
+  ".heif": "image/heif",
+  ".tif": "image/tiff",
+  ".tiff": "image/tiff",
+  ".jp2": "image/jp2",
+  ".j2k": "image/jp2",
+  ".jpx": "image/jp2",
+  ".mp4": "video/mp4",
+  ".m4v": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime",
+  ".mkv": "video/x-matroska",
+  ".avi": "video/vnd.avi",
+  ".3gp": "video/3gpp",
+  ".mp3": "audio/mpeg",
+  ".flac": "audio/flac",
+  ".ogg": "audio/ogg",
+  ".opus": "audio/opus",
+  ".m4a": "audio/mp4",
+  ".wav": "audio/wav",
+  ".aac": "audio/aac",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".csv": "text/csv",
+  ".json": "application/json",
+  ".xml": "text/xml",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".svg": "image/svg+xml",
+  ".srt": "application/x-subrip",
+  ".vtt": "text/vtt",
+  ".ass": "text/x-ssa",
+  ".epub": "application/epub+zip",
+  ".pdf": "application/pdf",
+  ".zip": "application/zip",
+  ".cbz": "application/vnd.comicbook+zip",
+  ".cbr": "application/vnd.comicbook-rar",
+  ".rar": "application/vnd.rar",
+  ".7z": "application/x-7z-compressed",
+  ".cb7": "application/x-7z-compressed",
+  ".tar": "application/x-tar",
+  ".cbt": "application/x-tar"
+};
+var MIME_KIND_OVERRIDES = {
+  "application/ogg": "audio",
+  "application/x-matroska": "video",
+  "application/mp4": "video"
+};
+function mimeToKind(mime) {
+  const normalized = mime.toLowerCase();
+  const override = MIME_KIND_OVERRIDES[normalized];
+  if (override !== void 0) return override;
+  if (normalized.startsWith("image/")) return "image";
+  if (normalized.startsWith("video/")) return "video";
+  if (normalized.startsWith("audio/")) return "audio";
+  return "other";
+}
+function extToMime(ext) {
+  return EXT_MIME[ext.toLowerCase()];
+}
+
+export { AUDIO_EXTS, AUDIO_FFMPEG_INPUT_FORMAT, EXT_MIME, IMAGE_EXTS, MEDIA_KINDS, MIME_FFMPEG_INPUT_FORMAT, MIME_KIND_OVERRIDES, STREAMABLE_AUDIO_EXTS, STREAMABLE_VIDEO_EXTS, VIDEO_EXTS, extToMime, mimeToKind };
+//# sourceMappingURL=media-exts.js.map
+//# sourceMappingURL=media-exts.js.map

package/dist/media-exts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/media-exts.ts"],"names":[],"mappings":";AA0BO,IAAM,UAAA,uBAAsC,GAAA,CAAI;AAAA,EACtD,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACD,CAAC;AAEM,IAAM,UAAA,uBAAsC,GAAA,CAAI;AAAA,EACtD,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACD,CAAC;AAEM,IAAM,UAAA,uBAAsC,GAAA,CAAI;AAAA,EACtD,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA;AACD,CAAC;AASM,IAAM,qBAAA,uBAAiD,GAAA,CAAI;AAAA,EACjE,OAAA;AAAA,EACA,MAAA;AAAA,EACA;AACD,CAAC;AAOM,IAAM,yBAAA,GAA8D;AAAA,EAC1E,MAAA,EAAQ,KAAA;AAAA,EACR,OAAA,EAAS,MAAA;AAAA,EACT,MAAA,EAAQ,KAAA;AAAA,EACR,OAAA,EAAS,KAAA;AAAA,EACT,MAAA,EAAQ,KAAA;AAAA,EACR,MAAA,EAAQ,KAAA;AAAA,EACR,MAAA,EAAQ;AACT;AAYO,IAAM,wBAAA,GAA6D;AAAA,EACzE,WAAA,EAAa,KAAA;AAAA,EACb,iBAAA,EAAmB,KAAA;AAAA,EACnB,YAAA,EAAc,MAAA;AAAA,EACd,kBAAA,EAAoB,UAAA;AAAA,EACpB,gBAAA,EAAkB,UAAA;AAAA,EAClB,eAAA,EAAiB,KAAA;AAAA,EACjB,iBAAA,EAAmB,KAAA;AAAA,EACnB,WAAA,EAAa,KAAA;AAAA,EACb,WAAA,EAAa,KAAA;AAAA,EACb,YAAA,EAAc,KAAA;AAAA,EACd,WAAA,EAAa,KAAA;AAAA,EACb,YAAA,EAAc,MAAA;AAAA,EACd,cAAA,EAAgB,MAAA;AAAA,EAChB,WAAA,EAAa,KAAA;AAAA,EACb,YAAA,EAAc,KAAA;AAAA,EACd,cAAA,EAAgB,KAAA;AAAA,EAChB,WAAA,EAAa,KAAA;AAAA,EACb,aAAA,EAAe,KAAA;AAAA,EACf,gBAAA,EAAkB,KAAA;AAAA,EAClB,YAAA,EAAc,KAAA;AAAA,EACd,WAAA,EAAa,KAAA;AAAA,EACb,aAAA,EAAe,KAAA;AAAA,EACf,WAAA,EAAa,KAAA;AAAA,EACb,YAAA,EAAc,KAAA;AAAA,EACd,iBAAA,EAAmB,KAAA;AAAA,EACnB,wBAAA,EAA0B,UAAA;AAAA,EAC1B,iBAAA,EAAmB;AACpB;AAQO,IAAM,qBAAA,uBAAiD,GAAA,CAAI;AAAA,EACjE,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA;AACD,CAAC;AAOM,IAAM,WAAA,GAAc,CAAC,OAAA,EAAS,OAAA,EAAS,SAAS,OAAO;AAUvD,IAAM,QAAA,GAA6C;AAAA,EACzD,MAAA,EAAQ,YAAA;AAAA,EACR,OAAA,EAAS,YAAA;AAAA,EACT,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS,YAAA;AAAA,EACT,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS,YAAA;AAAA,EACT,OAAA,EAAS,YAAA;AAAA,EACT,OAAA,EAAS,YAAA;AAAA,EACT,MAAA,EAAQ,YAAA;AAAA,EACR,OAAA,EAAS,YAAA;AAAA,EACT,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS,YAAA;AAAA,EACT,MAAA,EAAQ,iBAAA;AAAA,EACR,MAAA,EAAQ,kBAAA;AAAA,EACR,MAAA,EAAQ,eAAA;AAAA,EACR,MAAA,EAAQ,YAAA;AAAA,EACR,MAAA,EAAQ,YAAA;AAAA,EACR,OAAA,EAAS,YAAA;AAAA,EACT,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS,YAAA;AAAA,EACT,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,YAAA;AAAA,EACR,KAAA,EAAO,eAAA;AAAA,EACP,MAAA,EAAQ,UAAA;AAAA,EACR,OAAA,EAAS,kBAAA;AAAA,EACT,MAAA,EAAQ,UAAA;AAAA,EACR,OAAA,EAAS,WAAA;AAAA,EACT,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,eAAA;AAAA,EACR,MAAA,EAAQ,sBAAA;AAAA,EACR,MAAA,EAAQ,UAAA;AAAA,EACR,MAAA,EAAQ,YAAA;AAAA,EACR,OAAA,EAAS,sBAAA;AAAA,EACT,MAAA,EAAQ,iBAAA;AAAA,EACR,MAAA,EAAQ,iBAAA;AAAA,EACR,MAAA,EAAQ,+BAAA;AAAA,EACR,MAAA,EAAQ,+BAAA;AAAA,EACR,MAAA,EAAQ,qBAAA;AAAA,EACR,KAAA,EAAO,6BAAA;AAAA,EACP,MAAA,EAAQ,6BAAA;AAAA,EACR,MAAA,EAAQ,mBAAA;AAAA,EACR,MAAA,EAAQ;AACT;AASO,IAAM,mBAAA,GAA2D;AAAA,EACvE,iBAAA,EAAmB,OAAA;AAAA,EACnB,wBAAA,EAA0B,OAAA;AAAA,EAC1B,iBAAA,EAAmB;AACpB;AAMO,SAAS,WAAW,IAAA,EAAyB;AACnD,EAAA,MAAM,UAAA,GAAa,KAAK,WAAA,EAAY;AACpC,EAAA,MAAM,QAAA,GAAW,oBAAoB,UAAU,CAAA;AAC/C,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,OAAA;AAC5C,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,OAAA;AAC5C,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,OAAA;AAC5C,EAAA,OAAO,OAAA;AACR;AAGO,SAAS,UAAU,GAAA,EAAiC;AAC1D,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,CAAA;AAClC","file":"media-exts.js","sourcesContent":["/**\n * Canonical media-type knowledge: the extension sets, the extension →\n * MIME table and the MIME → media-kind mapping shared by content\n * plugins, the runtime host's sniffer and the server's classification\n * pipeline.\n *\n * Extensions are a **hint**, never the verdict: `ResourceAPI.sniff`\n * reads the file's magic bytes and only falls back to the tables here\n * when the content carries no recognizable signature (text formats).\n * The sets below therefore answer \"which extensions do we expect to\n * decode\", not \"what is this file\".\n *\n * Lower-case, with leading dot — match the output of\n * `path.extname(name).toLowerCase()`.\n *\n * Adding a new extension here widens classification everywhere at\n * once. Before adding, verify:\n * - sharp can extract width/height (image)\n * - ffprobe can read width/height/duration (video)\n * - ffprobe can read the stream/format metadata (audio), and the\n *   extension has an entry in `AUDIO_FFMPEG_INPUT_FORMAT`\n * - the extension has an entry in {@link EXT_MIME}\n * - the gallery plugin's transcode-required set reflects the format\n *   (browser-renderable originals stay native; HEIC/TIFF need the\n *   sharp preview pipeline)\n */\nexport const IMAGE_EXTS: ReadonlySet<string> = new Set([\n\t\".jpg\",\n\t\".jpeg\",\n\t\".png\",\n\t\".webp\",\n\t\".gif\",\n\t\".bmp\",\n\t\".avif\",\n\t\".heic\",\n\t\".heif\",\n\t\".tif\",\n\t\".tiff\",\n\t\".svg\",\n\t\".jp2\",\n\t\".j2k\",\n\t\".jpx\",\n])\n\nexport const VIDEO_EXTS: ReadonlySet<string> = new Set([\n\t\".mp4\",\n\t\".webm\",\n\t\".mov\",\n\t\".mkv\",\n\t\".m4v\",\n\t\".avi\",\n\t\".3gp\",\n])\n\nexport const AUDIO_EXTS: ReadonlySet<string> = new Set([\n\t\".mp3\",\n\t\".flac\",\n\t\".ogg\",\n\t\".m4a\",\n\t\".wav\",\n\t\".opus\",\n\t\".aac\",\n])\n\n/**\n * Video containers ffmpeg can demux from a forward-only pipe (matroska,\n * avi). ISO-BMFF files (.mp4/.mov/.m4v) keep their moov index at the end\n * of the file, so a stream attempt on a zip-entry source is guaranteed to\n * fail after burning a full probesize read — consumers (thumb pipeline,\n * cover probing) send those straight to the materialized entry instead.\n */\nexport const STREAMABLE_VIDEO_EXTS: ReadonlySet<string> = new Set([\n\t\".webm\",\n\t\".mkv\",\n\t\".avi\",\n])\n\n/**\n * ffmpeg `-f` container name for piped audio bytes (no filename hint).\n * `.opus` files are Ogg containers; `.m4a` is ISO-BMFF, demuxed by the\n * mp4 demuxer.\n */\nexport const AUDIO_FFMPEG_INPUT_FORMAT: Readonly<Record<string, string>> = {\n\t\".mp3\": \"mp3\",\n\t\".flac\": \"flac\",\n\t\".ogg\": \"ogg\",\n\t\".opus\": \"ogg\",\n\t\".wav\": \"wav\",\n\t\".m4a\": \"mp4\",\n\t\".aac\": \"aac\",\n}\n\n/**\n * ffmpeg `-f` container name keyed by **sniffed MIME type**, for piped\n * sources that have no filename ffprobe could key off. Content-derived\n * routing is what lets a mislabelled file still demux correctly, so\n * this table — not the extension one — drives `ResourceAPI.probe`.\n *\n * Several spellings map to the same container because magic-byte\n * matchers and IANA disagree on the canonical name (`audio/wav` vs\n * `audio/x-wav`, `video/vnd.avi` vs `video/x-msvideo`).\n */\nexport const MIME_FFMPEG_INPUT_FORMAT: Readonly<Record<string, string>> = {\n\t\"video/mp4\": \"mp4\",\n\t\"video/quicktime\": \"mov\",\n\t\"video/webm\": \"webm\",\n\t\"video/x-matroska\": \"matroska\",\n\t\"video/matroska\": \"matroska\",\n\t\"video/vnd.avi\": \"avi\",\n\t\"video/x-msvideo\": \"avi\",\n\t\"video/avi\": \"avi\",\n\t\"video/ogg\": \"ogg\",\n\t\"audio/mpeg\": \"mp3\",\n\t\"audio/mp3\": \"mp3\",\n\t\"audio/flac\": \"flac\",\n\t\"audio/x-flac\": \"flac\",\n\t\"audio/ogg\": \"ogg\",\n\t\"audio/opus\": \"ogg\",\n\t\"audio/vorbis\": \"ogg\",\n\t\"audio/wav\": \"wav\",\n\t\"audio/x-wav\": \"wav\",\n\t\"audio/vnd.wave\": \"wav\",\n\t\"audio/wave\": \"wav\",\n\t\"audio/mp4\": \"mp4\",\n\t\"audio/x-m4a\": \"mp4\",\n\t\"audio/aac\": \"aac\",\n\t\"video/3gpp\": \"mp4\",\n\t\"application/ogg\": \"ogg\",\n\t\"application/x-matroska\": \"matroska\",\n\t\"application/mp4\": \"mp4\",\n}\n\n/**\n * The audio mirror of {@link STREAMABLE_VIDEO_EXTS}: containers whose\n * headers lead the file, so ffmpeg/ffprobe can demux them from a\n * forward-only pipe. `.m4a` is ISO-BMFF with a trailing moov index, so\n * it must be probed from a materialized (seekable) entry.\n */\nexport const STREAMABLE_AUDIO_EXTS: ReadonlySet<string> = new Set([\n\t\".mp3\",\n\t\".flac\",\n\t\".ogg\",\n\t\".opus\",\n\t\".wav\",\n\t\".aac\",\n])\n\n/**\n * Media families a file can belong to. `other` covers everything the\n * media pipeline does not decode (text, documents, archives, ...) — it\n * is a real answer, not a failure.\n */\nexport const MEDIA_KINDS = [\"image\", \"video\", \"audio\", \"other\"] as const\n\nexport type MediaKind = (typeof MEDIA_KINDS)[number]\n\n/**\n * Extension → canonical MIME type. Used as the *fallback* branch of\n * content sniffing: magic-byte detection covers binary media, while\n * text-based formats (`.txt`, `.md`, `.csv`, subtitles, ...) carry no\n * signature and can only be named by their extension.\n */\nexport const EXT_MIME: Readonly<Record<string, string>> = {\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".png\": \"image/png\",\n\t\".webp\": \"image/webp\",\n\t\".gif\": \"image/gif\",\n\t\".bmp\": \"image/bmp\",\n\t\".avif\": \"image/avif\",\n\t\".heic\": \"image/heic\",\n\t\".heif\": \"image/heif\",\n\t\".tif\": \"image/tiff\",\n\t\".tiff\": \"image/tiff\",\n\t\".jp2\": \"image/jp2\",\n\t\".j2k\": \"image/jp2\",\n\t\".jpx\": \"image/jp2\",\n\t\".mp4\": \"video/mp4\",\n\t\".m4v\": \"video/mp4\",\n\t\".webm\": \"video/webm\",\n\t\".mov\": \"video/quicktime\",\n\t\".mkv\": \"video/x-matroska\",\n\t\".avi\": \"video/vnd.avi\",\n\t\".3gp\": \"video/3gpp\",\n\t\".mp3\": \"audio/mpeg\",\n\t\".flac\": \"audio/flac\",\n\t\".ogg\": \"audio/ogg\",\n\t\".opus\": \"audio/opus\",\n\t\".m4a\": \"audio/mp4\",\n\t\".wav\": \"audio/wav\",\n\t\".aac\": \"audio/aac\",\n\t\".txt\": \"text/plain\",\n\t\".md\": \"text/markdown\",\n\t\".csv\": \"text/csv\",\n\t\".json\": \"application/json\",\n\t\".xml\": \"text/xml\",\n\t\".html\": \"text/html\",\n\t\".htm\": \"text/html\",\n\t\".svg\": \"image/svg+xml\",\n\t\".srt\": \"application/x-subrip\",\n\t\".vtt\": \"text/vtt\",\n\t\".ass\": \"text/x-ssa\",\n\t\".epub\": \"application/epub+zip\",\n\t\".pdf\": \"application/pdf\",\n\t\".zip\": \"application/zip\",\n\t\".cbz\": \"application/vnd.comicbook+zip\",\n\t\".cbr\": \"application/vnd.comicbook-rar\",\n\t\".rar\": \"application/vnd.rar\",\n\t\".7z\": \"application/x-7z-compressed\",\n\t\".cb7\": \"application/x-7z-compressed\",\n\t\".tar\": \"application/x-tar\",\n\t\".cbt\": \"application/x-tar\",\n}\n\n/**\n * Container MIME types whose top-level type does not describe the\n * payload. Ogg and Matroska carry audio *or* video, and `application/*`\n * says nothing either way — the values here are the common case, and\n * `ResourceAPI.probe` overrides them with the stream layout ffprobe\n * actually reports.\n */\nexport const MIME_KIND_OVERRIDES: Readonly<Record<string, MediaKind>> = {\n\t\"application/ogg\": \"audio\",\n\t\"application/x-matroska\": \"video\",\n\t\"application/mp4\": \"video\",\n}\n\n/**\n * Media family of a MIME type: the override table first, then the\n * top-level type. Never throws — unknown types are `other`.\n */\nexport function mimeToKind(mime: string): MediaKind {\n\tconst normalized = mime.toLowerCase()\n\tconst override = MIME_KIND_OVERRIDES[normalized]\n\tif (override !== undefined) return override\n\tif (normalized.startsWith(\"image/\")) return \"image\"\n\tif (normalized.startsWith(\"video/\")) return \"video\"\n\tif (normalized.startsWith(\"audio/\")) return \"audio\"\n\treturn \"other\"\n}\n\n/** Canonical MIME type for an extension (leading dot), or `undefined`. */\nexport function extToMime(ext: string): string | undefined {\n\treturn EXT_MIME[ext.toLowerCase()]\n}\n"]}

package/dist/plugin-asset-limits.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Plugin asset runtime limits — the constants shared by the host, the
+ * SDK validators and the tooling. Backed by the `./plugin-asset-limits`
+ * subpath (plugin-facing constants never export from the root entry).
+ */
+/** Max length of a vault-relative `dest` (a plugin path is bounded, not arbitrary). */
+declare const PLUGIN_ASSET_DEST_MAX_LENGTH = 256;
+/** Max length of the optional human `reason` shown in the consent dialog. */
+declare const PLUGIN_ASSET_REASON_MAX_LENGTH = 200;
+/** Expected shape of an SRI-style sha256 pin: 64 lowercase hex characters. */
+declare const PLUGIN_ASSET_SHA256_PATTERN: RegExp;
+/** The machine-readable asset error names, in contract order. */
+declare const PLUGIN_ASSET_ERROR_NAMES: readonly ["DENIED", "UNAVAILABLE", "POLICY"];
+type PluginAssetErrorName = (typeof PLUGIN_ASSET_ERROR_NAMES)[number];
+
+export { PLUGIN_ASSET_DEST_MAX_LENGTH, PLUGIN_ASSET_ERROR_NAMES, PLUGIN_ASSET_REASON_MAX_LENGTH, PLUGIN_ASSET_SHA256_PATTERN, type PluginAssetErrorName };

package/dist/plugin-asset-limits.js

@@ -0,0 +1,13 @@
+// src/plugin-asset-limits.ts
+var PLUGIN_ASSET_DEST_MAX_LENGTH = 256;
+var PLUGIN_ASSET_REASON_MAX_LENGTH = 200;
+var PLUGIN_ASSET_SHA256_PATTERN = /^[0-9a-f]{64}$/;
+var PLUGIN_ASSET_ERROR_NAMES = [
+  "DENIED",
+  "UNAVAILABLE",
+  "POLICY"
+];
+
+export { PLUGIN_ASSET_DEST_MAX_LENGTH, PLUGIN_ASSET_ERROR_NAMES, PLUGIN_ASSET_REASON_MAX_LENGTH, PLUGIN_ASSET_SHA256_PATTERN };
+//# sourceMappingURL=plugin-asset-limits.js.map
+//# sourceMappingURL=plugin-asset-limits.js.map

package/dist/plugin-asset-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/plugin-asset-limits.ts"],"names":[],"mappings":";AAOO,IAAM,4BAAA,GAA+B;AAGrC,IAAM,8BAAA,GAAiC;AAGvC,IAAM,2BAAA,GAA8B;AAGpC,IAAM,wBAAA,GAA2B;AAAA,EACvC,QAAA;AAAA,EACA,aAAA;AAAA,EACA;AACD","file":"plugin-asset-limits.js","sourcesContent":["/**\n * Plugin asset runtime limits — the constants shared by the host, the\n * SDK validators and the tooling. Backed by the `./plugin-asset-limits`\n * subpath (plugin-facing constants never export from the root entry).\n */\n\n/** Max length of a vault-relative `dest` (a plugin path is bounded, not arbitrary). */\nexport const PLUGIN_ASSET_DEST_MAX_LENGTH = 256\n\n/** Max length of the optional human `reason` shown in the consent dialog. */\nexport const PLUGIN_ASSET_REASON_MAX_LENGTH = 200\n\n/** Expected shape of an SRI-style sha256 pin: 64 lowercase hex characters. */\nexport const PLUGIN_ASSET_SHA256_PATTERN = /^[0-9a-f]{64}$/\n\n/** The machine-readable asset error names, in contract order. */\nexport const PLUGIN_ASSET_ERROR_NAMES = [\n\t\"DENIED\",\n\t\"UNAVAILABLE\",\n\t\"POLICY\",\n] as const\n\nexport type PluginAssetErrorName = (typeof PLUGIN_ASSET_ERROR_NAMES)[number]\n"]}

package/dist/plugin-capabilities.d.ts

@@ -0,0 +1,64 @@
+import { d as PluginPermissions } from './manifest-Dk6_xyNy.js';
+import 'zod';
+
+/**
+ * The single permission→capability declaration: every manifest
+ * permission key, what it gates, and which runtime layers enforce it.
+ * Consumers read this table instead of hand-mirrored sets — a new
+ * permission is declared once here, and the compile-time coverage
+ * checks below make a missing declaration impossible.
+ *
+ * This module is pure TypeScript (no zod): it is type-driven off
+ * {@link PluginPermissions} and consumed by the host sandbox, the
+ * server domain and the tooling. Plugin bundles never import it.
+ */
+
+type PluginCapabilityGate = {
+    /** One-line contract description (mirrors the manifest schema docs). */
+    readonly description: string;
+    /**
+     * ResourceAPI method names gated at the sandbox RPC boundary. Absent
+     * means the permission is enforced at the host/service layer only
+     * (meta hooks, web routes).
+     */
+    readonly sandboxMethods?: readonly string[];
+};
+/**
+ * The capability gates, keyed by the manifest permission key. The
+ * `satisfies` below fails to compile when a permission is declared on
+ * the manifest but missing here; the AssertTrue checks at the bottom
+ * cover the reverse direction.
+ */
+declare const PLUGIN_CAPABILITY_GATES: {
+    readonly sourceMeta: {
+        readonly description: "Read/write the resource's source metadata (sourceMeta hook).";
+    };
+    readonly searchMeta: {
+        readonly description: "Produce and store search metadata facets (searchMeta hook).";
+    };
+    readonly danmaku: {
+        readonly description: "Create/list danmaku for resources this plugin renders.";
+    };
+    readonly message: {
+        readonly description: "Create/list messages for resources this plugin renders.";
+    };
+    readonly imageHashes: {
+        readonly description: "Produce content hashes for duplicate detection / image similarity.";
+    };
+    readonly container: {
+        readonly description: "List and extract archive (zip/tar/7z/…) entries; the only API surface with a write side effect.";
+        readonly sandboxMethods: readonly ["listContainer", "extractArchive"];
+    };
+    readonly download: {
+        readonly description: "The plugin asset vault: user-consented downloads into the plugin's own vault/ plus the vault read/delete methods; denied by default and per-download by the user.";
+        readonly sandboxMethods: readonly ["download", "statAsset", "readAsset", "deleteAsset"];
+    };
+};
+type PluginCapabilityKey = keyof typeof PLUGIN_CAPABILITY_GATES;
+type AssertTrue<T extends true> = T;
+type _ManifestKeysCovered = AssertTrue<keyof PluginPermissions extends keyof typeof PLUGIN_CAPABILITY_GATES ? true : false>;
+type _TableKeysCovered = AssertTrue<keyof typeof PLUGIN_CAPABILITY_GATES extends keyof PluginPermissions ? true : false>;
+/** Sandbox API method → capability key, derived once from the table. */
+declare const CAPABILITY_BY_METHOD: ReadonlyMap<string, PluginCapabilityKey>;
+
+export { CAPABILITY_BY_METHOD, PLUGIN_CAPABILITY_GATES, type PluginCapabilityGate, type PluginCapabilityKey, type _ManifestKeysCovered, type _TableKeysCovered };

package/dist/plugin-capabilities.js

@@ -0,0 +1,37 @@
+// src/plugin-capabilities.ts
+var PLUGIN_CAPABILITY_GATES = {
+  sourceMeta: {
+    description: "Read/write the resource's source metadata (sourceMeta hook)."
+  },
+  searchMeta: {
+    description: "Produce and store search metadata facets (searchMeta hook)."
+  },
+  danmaku: {
+    description: "Create/list danmaku for resources this plugin renders."
+  },
+  message: {
+    description: "Create/list messages for resources this plugin renders."
+  },
+  imageHashes: {
+    description: "Produce content hashes for duplicate detection / image similarity."
+  },
+  container: {
+    description: "List and extract archive (zip/tar/7z/\u2026) entries; the only API surface with a write side effect.",
+    sandboxMethods: ["listContainer", "extractArchive"]
+  },
+  download: {
+    description: "The plugin asset vault: user-consented downloads into the plugin's own vault/ plus the vault read/delete methods; denied by default and per-download by the user.",
+    sandboxMethods: ["download", "statAsset", "readAsset", "deleteAsset"]
+  }
+};
+var CAPABILITY_BY_METHOD = new Map(
+  Object.entries(PLUGIN_CAPABILITY_GATES).flatMap(
+    ([capability, gate]) => (gate.sandboxMethods ?? []).map(
+      (method) => [method, capability]
+    )
+  )
+);
+
+export { CAPABILITY_BY_METHOD, PLUGIN_CAPABILITY_GATES };
+//# sourceMappingURL=plugin-capabilities.js.map
+//# sourceMappingURL=plugin-capabilities.js.map

package/dist/plugin-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/plugin-capabilities.ts"],"names":[],"mappings":";AA8BO,IAAM,uBAAA,GAA0B;AAAA,EACtC,UAAA,EAAY;AAAA,IACX,WAAA,EAAa;AAAA,GACd;AAAA,EACA,UAAA,EAAY;AAAA,IACX,WAAA,EAAa;AAAA,GACd;AAAA,EACA,OAAA,EAAS;AAAA,IACR,WAAA,EAAa;AAAA,GACd;AAAA,EACA,OAAA,EAAS;AAAA,IACR,WAAA,EAAa;AAAA,GACd;AAAA,EACA,WAAA,EAAa;AAAA,IACZ,WAAA,EACC;AAAA,GACF;AAAA,EACA,SAAA,EAAW;AAAA,IACV,WAAA,EACC,sGAAA;AAAA,IACD,cAAA,EAAgB,CAAC,eAAA,EAAiB,gBAAgB;AAAA,GACnD;AAAA,EACA,QAAA,EAAU;AAAA,IACT,WAAA,EACC,mKAAA;AAAA,IACD,cAAA,EAAgB,CAAC,UAAA,EAAY,WAAA,EAAa,aAAa,aAAa;AAAA;AAEtE;AAqBO,IAAM,uBACZ,IAAI,GAAA;AAAA,EAEF,MAAA,CAAO,OAAA,CAAQ,uBAAuB,CAAA,CAIrC,OAAA;AAAA,IAAQ,CAAC,CAAC,UAAA,EAAY,IAAI,OAC1B,IAAA,CAAK,cAAA,IAAkB,EAAC,EAAG,GAAA;AAAA,MAC3B,CAAC,MAAA,KAAW,CAAC,MAAA,EAAQ,UAAU;AAAA;AAChC;AAEF","file":"plugin-capabilities.js","sourcesContent":["/**\n * The single permission→capability declaration: every manifest\n * permission key, what it gates, and which runtime layers enforce it.\n * Consumers read this table instead of hand-mirrored sets — a new\n * permission is declared once here, and the compile-time coverage\n * checks below make a missing declaration impossible.\n *\n * This module is pure TypeScript (no zod): it is type-driven off\n * {@link PluginPermissions} and consumed by the host sandbox, the\n * server domain and the tooling. Plugin bundles never import it.\n */\nimport type { PluginPermissions } from \"./manifest.ts\"\n\nexport type PluginCapabilityGate = {\n\t/** One-line contract description (mirrors the manifest schema docs). */\n\treadonly description: string\n\t/**\n\t * ResourceAPI method names gated at the sandbox RPC boundary. Absent\n\t * means the permission is enforced at the host/service layer only\n\t * (meta hooks, web routes).\n\t */\n\treadonly sandboxMethods?: readonly string[]\n}\n\n/**\n * The capability gates, keyed by the manifest permission key. The\n * `satisfies` below fails to compile when a permission is declared on\n * the manifest but missing here; the AssertTrue checks at the bottom\n * cover the reverse direction.\n */\nexport const PLUGIN_CAPABILITY_GATES = {\n\tsourceMeta: {\n\t\tdescription: \"Read/write the resource's source metadata (sourceMeta hook).\",\n\t},\n\tsearchMeta: {\n\t\tdescription: \"Produce and store search metadata facets (searchMeta hook).\",\n\t},\n\tdanmaku: {\n\t\tdescription: \"Create/list danmaku for resources this plugin renders.\",\n\t},\n\tmessage: {\n\t\tdescription: \"Create/list messages for resources this plugin renders.\",\n\t},\n\timageHashes: {\n\t\tdescription:\n\t\t\t\"Produce content hashes for duplicate detection / image similarity.\",\n\t},\n\tcontainer: {\n\t\tdescription:\n\t\t\t\"List and extract archive (zip/tar/7z/…) entries; the only API surface with a write side effect.\",\n\t\tsandboxMethods: [\"listContainer\", \"extractArchive\"],\n\t},\n\tdownload: {\n\t\tdescription:\n\t\t\t\"The plugin asset vault: user-consented downloads into the plugin's own vault/ plus the vault read/delete methods; denied by default and per-download by the user.\",\n\t\tsandboxMethods: [\"download\", \"statAsset\", \"readAsset\", \"deleteAsset\"],\n\t},\n} as const satisfies Record<keyof PluginPermissions, PluginCapabilityGate>\n\nexport type PluginCapabilityKey = keyof typeof PLUGIN_CAPABILITY_GATES\n\n// -- compile-time coverage --------------------------------------------------\n// Every manifest permission key is declared here and nothing more — the\n// two assertions fail the build on either drift. Exported only so\n// noUnusedLocals keeps them alive — never import.\ntype AssertTrue<T extends true> = T\nexport type _ManifestKeysCovered = AssertTrue<\n\tkeyof PluginPermissions extends keyof typeof PLUGIN_CAPABILITY_GATES\n\t\t? true\n\t\t: false\n>\nexport type _TableKeysCovered = AssertTrue<\n\tkeyof typeof PLUGIN_CAPABILITY_GATES extends keyof PluginPermissions\n\t\t? true\n\t\t: false\n>\n\n/** Sandbox API method → capability key, derived once from the table. */\nexport const CAPABILITY_BY_METHOD: ReadonlyMap<string, PluginCapabilityKey> =\n\tnew Map(\n\t\t(\n\t\t\tObject.entries(PLUGIN_CAPABILITY_GATES) as [\n\t\t\t\tPluginCapabilityKey,\n\t\t\t\tPluginCapabilityGate,\n\t\t\t][]\n\t\t).flatMap(([capability, gate]) =>\n\t\t\t(gate.sandboxMethods ?? []).map(\n\t\t\t\t(method) => [method, capability] as [string, PluginCapabilityKey],\n\t\t\t),\n\t\t),\n\t)\n"]}