@jchat/addon-sdk 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/testing.d.mts

@@ -0,0 +1,2 @@
+import { MockAddonContextResult, MockAddonServerContextOptions, createMockAddonServerContext } from "./index2.mjs";
+export { MockAddonContextResult, MockAddonServerContextOptions, createMockAddonServerContext };

package/dist/testing.mjs

@@ -0,0 +1,2 @@
+import { s as createMockAddonServerContext } from "./src.mjs";
+export { createMockAddonServerContext };

package/dist/types.d.mts

@@ -0,0 +1,12 @@
+import { ComponentType, SVGProps } from "react";
+import { icons } from "lucide-react";
+//#region ../icon/dist/types.d.mts
+//#region src/types.d.ts
+type IconComponent = ComponentType<SVGProps<SVGSVGElement>>;
+type LucideIconName = keyof typeof icons;
+type IconName = LucideIconName | "Youtube";
+declare const ICON_NAMES: readonly IconName[];
+type IconPack = Record<IconName, IconComponent>;
+//#endregion
+//#endregion
+export { IconPack as i, IconComponent as n, IconName as r, ICON_NAMES as t };

package/dist/ui.d.mts

@@ -0,0 +1,42 @@
+import { _ as AddonUser, d as AddonRequestUser } from "./contracts2.mjs";
+import React from "react";
+import { Can } from "@casl/react";
+export * from "@jchat/ui";
+//#region src/ui.d.ts
+export interface AddonCanProps {
+  /** The current user attempting the action */
+  actor?: (Partial<AddonRequestUser | AddonUser> & {
+    permissions?: string[];
+    isOwner?: boolean;
+  }) | null;
+  /** The owner ID of the target resource, if evaluating an ownership-restricted action */
+  ownerId?: string;
+  /** Permission required if actor is the resource owner (e.g. 'addon.pollwise.close.own') */
+  ownPermission?: string;
+  /** Permission required if actor is NOT the resource owner (e.g. 'addon.pollwise.close.any') */
+  anyPermission?: string;
+  /** Simple permission string when not evaluating ownership (e.g. 'addon.pollwise.create') */
+  permission?: string;
+  /** Fallback content rendered when permission is denied (defaults to null) */
+  fallback?: React.ReactNode;
+  /** Content rendered when access is granted */
+  children: React.ReactNode;
+}
+/**
+ * Declarative component for conditional UI rendering based on RBAC/ABAC permissions and resource
+ * ownership.
+ *
+ * @param actor The current user attempting the action
+ * @param ownerId The owner ID of the target resource, if evaluating an ownership-restricted action
+ * @param ownPermission Permission required if actor is the resource owner (e.g.
+ *   'addon.pollwise.close.own')
+ * @param anyPermission Permission required if actor is NOT the resource owner (e.g.
+ *   'addon.pollwise.close.any')
+ * @param permission Simple permission string when not evaluating ownership (e.g.
+ *   'addon.pollwise.create')
+ * @param fallback Fallback content rendered when permission is denied (defaults to null)
+ * @param children Content rendered when access is granted
+ */
+export declare function AddonCan({ actor, ownerId, ownPermission, anyPermission, permission, fallback, children }: AddonCanProps): React.ReactElement | null;
+//#endregion
+export { Can };

package/dist/ui.mjs

@@ -0,0 +1,33 @@
+import { _ as hasPermission } from "./src.mjs";
+import { Can } from "@casl/react";
+export * from "@jchat/ui";
+//#region src/ui.ts
+/**
+* Declarative component for conditional UI rendering based on RBAC/ABAC permissions and resource
+* ownership.
+*
+* @param actor The current user attempting the action
+* @param ownerId The owner ID of the target resource, if evaluating an ownership-restricted action
+* @param ownPermission Permission required if actor is the resource owner (e.g.
+*   'addon.pollwise.close.own')
+* @param anyPermission Permission required if actor is NOT the resource owner (e.g.
+*   'addon.pollwise.close.any')
+* @param permission Simple permission string when not evaluating ownership (e.g.
+*   'addon.pollwise.create')
+* @param fallback Fallback content rendered when permission is denied (defaults to null)
+* @param children Content rendered when access is granted
+*/
+function AddonCan({ actor, ownerId, ownPermission, anyPermission, permission, fallback = null, children }) {
+	if (!actor) return fallback;
+	const perms = actor.permissions ?? [];
+	if (actor.isOwner || hasPermission(perms, "*")) return children;
+	if (permission && !hasPermission(perms, permission)) return fallback;
+	if (ownPermission || anyPermission) {
+		if (Boolean(actor.id && ownerId && actor.id === ownerId) && ownPermission && hasPermission(perms, ownPermission)) return children;
+		if (anyPermission && hasPermission(perms, anyPermission)) return children;
+		return fallback;
+	}
+	return children;
+}
+//#endregion
+export { AddonCan, Can };

package/dist/vite.d.mts

@@ -1,14 +1,44 @@
-import { t as AddonManifest } from "./contracts.mjs";
+import { l as AddonManifest } from "./contracts2.mjs";
 import { Plugin } from "vite";
 //#region src/vite.d.ts
 /**
- * Vite plugin to configure Jchat addon manifest generation, bundle backend scripts, copy
- * migrations, declarative seed data, and zip production build artifacts.
+ * Vite plugin for building JChat sandboxed addon extensions.
+ *
+ * Configures automatic manifest generation (`manifest.json`), bundles server-side API scripts
+ * (`src/api.ts`), embeds scoped Tailwind CSS into the frontend bundle, packages database migrations
+ * and seed files, copies documentation (`README.md`), signs database-bearing addon manifests, and
+ * zips production build artifacts.
+ *
+ * @example
+ *   ;```ts
+ *   import { jchatAddon } from "@jchat/addon-sdk/vite"
+ *   import manifest from "./src/manifest"
+ *   import { defineConfig } from "vite"
+ *
+ *   export default defineConfig({
+ *     plugins: [jchatAddon({ manifest })]
+ *   })
+ *   ```
+ *
+ * @param options - Configuration options for the JChat addon Vite plugin.
+ * @returns A Vite {@link Plugin} instance configured for addon compilation.
  */
-declare function jchatAddon(options: JchatAddonPluginOptions): Plugin;
-interface JchatAddonPluginOptions {
+export declare function jchatAddon(options: JchatAddonPluginOptions): Plugin;
+/** Configuration options for the {@link jchatAddon} Vite plugin. */
+export interface JchatAddonPluginOptions {
+  /** The base manifest specification for the addon. */
   manifest: AddonManifest;
+  /** Explicitly declare development mode to permit unsigned database-bearing builds. */
+  development?: boolean;
+  /**
+   * Whether to package the build output into a `.zip` archive upon build completion. Defaults to
+   * `true` during production builds and `false` during development builds.
+   */
   zip?: boolean;
+  /**
+   * Optional RSA private key string used to cryptographically sign database-bearing addons. If
+   * omitted, falls back to the `JCHAT_ADDON_SIGNING_PRIVATE_KEY` environment variable.
+   */
   signingPrivateKey?: string;
   /**
    * Embed Tailwind CSS output into the JS bundle and scope it to the addon's DOM container.
@@ -16,11 +46,35 @@ interface JchatAddonPluginOptions {
    */
   css?: boolean;
 }
-declare function createAddonServerBuildArguments(entryPath: string, outputPath: string, developmentBuild: boolean): string[];
-declare function signAddonManifest(manifest: AddonManifest, files: readonly {
+/**
+ * Generates CLI argument parameters for bundling server-side Elysia API scripts (`src/api.ts`) via
+ * Bun.
+ *
+ * @param entryPath - Absolute file path to the server entry script (`src/api.ts`).
+ * @param outputPath - Absolute destination file path for the bundled output (`build/api.js`).
+ * @param developmentBuild - Indicates whether to enable external sourcemaps or minification.
+ * @returns Array of command line arguments for running `bun build`.
+ */
+export declare function createAddonServerBuildArguments(entryPath: string, outputPath: string, developmentBuild: boolean): string[];
+/**
+ * Cryptographically signs an addon manifest using RSA-SHA256 over all archive file contents.
+ *
+ * @param manifest - Unsigned or base addon manifest.
+ * @param files - List of archive file paths and raw contents to digest.
+ * @param privateKey - RSA private key in PEM format.
+ * @returns Updated {@link AddonManifest} containing an RSA signature block.
+ */
+export declare function signAddonManifest(manifest: AddonManifest, files: readonly {
   path: string;
   contents: Buffer;
 }[], privateKey: string): AddonManifest;
-declare function requireAddonSigningKey(signingPrivateKey: string | undefined, developmentBuild: boolean): string | undefined;
-//#endregion
-export { JchatAddonPluginOptions, createAddonServerBuildArguments, jchatAddon, requireAddonSigningKey, signAddonManifest };
+/**
+ * Resolves the required RSA signing key for database-bearing addons.
+ *
+ * @param signingPrivateKey - Provided signing key or undefined.
+ * @param developmentBuild - Whether the current build is targeting development mode.
+ * @returns Resolved signing key string or undefined (in dev builds).
+ * @throws {@link Error} If building a database-bearing addon in production without a signing key.
+ */
+export declare function requireAddonSigningKey(signingPrivateKey: string | undefined, developmentBuild: boolean): string | undefined;
+//#endregion

package/dist/vite.mjs

@@ -1,11 +1,28 @@
-import fs from "node:fs";
-import path from "node:path";
-import { execFileSync } from "node:child_process";
 import crypto from "node:crypto";
+import path from "node:path";
+import fs from "node:fs";
 //#region src/vite.ts
 /**
-* Vite plugin to configure Jchat addon manifest generation, bundle backend scripts, copy
-* migrations, declarative seed data, and zip production build artifacts.
+* Vite plugin for building JChat sandboxed addon extensions.
+*
+* Configures automatic manifest generation (`manifest.json`), bundles server-side API scripts
+* (`src/api.ts`), embeds scoped Tailwind CSS into the frontend bundle, packages database migrations
+* and seed files, copies documentation (`README.md`), signs database-bearing addon manifests, and
+* zips production build artifacts.
+*
+* @example
+*   ;```ts
+*   import { jchatAddon } from "@jchat/addon-sdk/vite"
+*   import manifest from "./src/manifest"
+*   import { defineConfig } from "vite"
+*
+*   export default defineConfig({
+*     plugins: [jchatAddon({ manifest })]
+*   })
+*   ```
+*
+* @param options - Configuration options for the JChat addon Vite plugin.
+* @returns A Vite {@link Plugin} instance configured for addon compilation.
 */
 function jchatAddon(options) {
 	const { manifest: manifestData } = options;
@@ -15,10 +32,45 @@ function jchatAddon(options) {
 		name: "jchat-addon",
 		apply: "build",
 		config(_, env) {
-			return { define: { "process.env.NODE_ENV": JSON.stringify(env.mode || "production") } };
+			const rootDir = process.cwd();
+			const uiEntry = path.resolve(rootDir, "src/ui.tsx");
+			const hasUi = fs.existsSync(uiEntry);
+			return {
+				define: {
+					global: "window",
+					"process.env.NODE_ENV": JSON.stringify(env.mode || "production")
+				},
+				build: {
+					outDir: "build",
+					emptyOutDir: true,
+					minify: env.mode === "production",
+					...hasUi ? {
+						lib: {
+							entry: uiEntry,
+							name: manifestData.id,
+							formats: ["es"],
+							fileName: () => "ui.[hash].js"
+						},
+						rolldownOptions: {
+							external: [
+								"react",
+								"react-dom",
+								"react/jsx-runtime",
+								"react/jsx-dev-runtime",
+								"@tanstack/react-query",
+								"@jchat/addon-sdk",
+								"@jchat/addon-sdk/state",
+								"@jchat/addon-sdk/ui",
+								"@jchat/addon-sdk/icon"
+							],
+							output: { format: "esm" }
+						}
+					} : {}
+				}
+			};
 		},
 		configResolved(config) {
-			developmentBuild = config.mode === "development";
+			developmentBuild = options.development ?? (config.mode === "development" || Bun.env.JCHAT_ADDON_DEV === "true" || Bun.env.NODE_ENV === "development");
 			if (shouldZip === void 0) shouldZip = config.mode === "production";
 		},
 		async writeBundle() {
@@ -30,7 +82,7 @@ function jchatAddon(options) {
 			if (!fs.existsSync(buildDir)) return;
 			const bundleFile = fs.readdirSync(buildDir).find((f) => f.includes("ui") && f.endsWith(".js"));
 			if (!bundleFile) return;
-			if (options.css !== false) embedCssIntoBundle(buildDir, manifestData.id);
+			if (options.css !== false) embedCssIntoBundle(buildDir);
 			let manifest = {
 				...manifestData,
 				version: pkg.version,
@@ -41,9 +93,13 @@ function jchatAddon(options) {
 				}
 			};
 			const serverSrcPath = path.resolve(rootDir, "src/api.ts");
-			const hasServer = fs.existsSync(serverSrcPath);
+			const hasServer = await Bun.file(serverSrcPath).exists();
 			if (hasServer) {
-				execFileSync("bun", createAddonServerBuildArguments(serverSrcPath, path.resolve(buildDir, "api.js"), developmentBuild), { stdio: "inherit" });
+				Bun.spawnSync(["bun", ...createAddonServerBuildArguments(serverSrcPath, path.resolve(buildDir, "api.js"), developmentBuild)], { stdio: [
+					"inherit",
+					"inherit",
+					"inherit"
+				] });
 				manifest = {
 					...manifest,
 					server: {
@@ -59,14 +115,17 @@ function jchatAddon(options) {
 			});
 			for (const relativePath of databaseFiles) {
 				if (path.isAbsolute(relativePath) || relativePath.includes("\\") || relativePath.split("/").includes("..")) throw new Error(`Unsafe addon database file path: ${relativePath}`);
-				const source = path.resolve(rootDir, relativePath);
-				if (!fs.existsSync(source) || !fs.statSync(source).isFile()) throw new Error(`Missing addon database file: ${relativePath}`);
 				const destination = path.resolve(buildDir, relativePath);
 				fs.mkdirSync(path.dirname(destination), { recursive: true });
-				fs.copyFileSync(source, destination);
 			}
+			await Promise.all(databaseFiles.map(async (relativePath) => {
+				const source = path.resolve(rootDir, relativePath);
+				if (!await Bun.file(source).exists() || !fs.statSync(source).isFile()) throw new Error(`Missing addon database file: ${relativePath}`);
+				const destination = path.resolve(buildDir, relativePath);
+				return Bun.write(destination, Bun.file(source));
+			}));
 			if (manifest.server?.migrations?.length || manifest.server?.seeds?.length) {
-				const signingPrivateKey = requireAddonSigningKey(options.signingPrivateKey ?? process.env.JCHAT_ADDON_SIGNING_PRIVATE_KEY, developmentBuild);
+				const signingPrivateKey = requireAddonSigningKey(options.signingPrivateKey ?? Bun.env.JCHAT_ADDON_SIGNING_PRIVATE_KEY, developmentBuild);
 				if (signingPrivateKey) {
 					const archivePaths = [
 						"manifest.json",
@@ -75,36 +134,57 @@ function jchatAddon(options) {
 						...manifest.server?.seeds ?? []
 					];
 					if (hasServer) archivePaths.push("api.js");
-					manifest = signAddonManifest(manifest, archivePaths.map((file) => ({
+					const resolvedFiles = await Promise.all(archivePaths.map(async (file) => ({
 						path: file,
-						contents: file === "manifest.json" ? Buffer.from("") : fs.readFileSync(path.resolve(buildDir, file))
-					})), signingPrivateKey);
+						contents: file === "manifest.json" ? Buffer.from("") : Buffer.from(await Bun.file(path.resolve(buildDir, file)).arrayBuffer())
+					})));
+					manifest = signAddonManifest(manifest, resolvedFiles, signingPrivateKey);
 				}
 			}
+			const readmeSource = path.resolve(rootDir, "README.md");
+			if (await Bun.file(readmeSource).exists()) await Bun.write(path.resolve(buildDir, "README.md"), Bun.file(readmeSource));
+			const vendorLicensesContent = await generateAddonVendorLicenses(rootDir, manifest.name);
+			await Bun.write(path.resolve(buildDir, "vendor-licenses.txt"), vendorLicensesContent);
 			const manifestJson = JSON.stringify(manifest, null, 2);
-			fs.writeFileSync(path.resolve(buildDir, "manifest.json"), manifestJson);
+			await Bun.write(path.resolve(buildDir, "manifest.json"), manifestJson);
 			if (shouldZip) {
 				const zipName = `${manifest.id}-${pkg.version}.zip`;
 				const filesToZip = ["manifest.json", bundleFile];
-				if (fs.existsSync(path.resolve(buildDir, "api.js"))) filesToZip.push("api.js");
+				if (await Bun.file(path.resolve(buildDir, "api.js")).exists()) filesToZip.push("api.js");
+				if (await Bun.file(path.resolve(buildDir, "README.md")).exists()) filesToZip.push("README.md");
+				if (await Bun.file(path.resolve(buildDir, "vendor-licenses.txt")).exists()) filesToZip.push("vendor-licenses.txt");
 				const migrationsDest = path.resolve(buildDir, "migrations");
 				if (fs.existsSync(migrationsDest)) filesToZip.push("migrations");
 				const seedsDest = path.resolve(buildDir, "seeds");
 				if (fs.existsSync(seedsDest)) filesToZip.push("seeds");
-				execFileSync("tar", [
+				Bun.spawnSync([
+					"tar",
 					"-a",
 					"-cf",
 					zipName,
 					...filesToZip
 				], {
 					cwd: buildDir,
-					stdio: "inherit"
+					stdio: [
+						"inherit",
+						"inherit",
+						"inherit"
+					]
 				});
 				console.log(`Build Complete: ${manifest.id} v${pkg.version} → ${zipName}`);
 			}
 		}
 	};
 }
+/**
+* Generates CLI argument parameters for bundling server-side Elysia API scripts (`src/api.ts`) via
+* Bun.
+*
+* @param entryPath - Absolute file path to the server entry script (`src/api.ts`).
+* @param outputPath - Absolute destination file path for the bundled output (`build/api.js`).
+* @param developmentBuild - Indicates whether to enable external sourcemaps or minification.
+* @returns Array of command line arguments for running `bun build`.
+*/
 function createAddonServerBuildArguments(entryPath, outputPath, developmentBuild) {
 	return [
 		"build",
@@ -112,9 +192,17 @@ function createAddonServerBuildArguments(entryPath, outputPath, developmentBuild
 		"--target=bun",
 		"--format=esm",
 		`--outfile=${outputPath}`,
-		developmentBuild ? "--sourcemap=external" : "--minify"
+		developmentBuild ? "--sourcemap=inline" : "--minify"
 	];
 }
+/**
+* Cryptographically signs an addon manifest using RSA-SHA256 over all archive file contents.
+*
+* @param manifest - Unsigned or base addon manifest.
+* @param files - List of archive file paths and raw contents to digest.
+* @param privateKey - RSA private key in PEM format.
+* @returns Updated {@link AddonManifest} containing an RSA signature block.
+*/
 function signAddonManifest(manifest, files, privateKey) {
 	if (!manifest.publisher?.id) throw new Error("Signed addons require manifest.publisher.id");
 	const unsigned = {
@@ -126,28 +214,37 @@ function signAddonManifest(manifest, files, privateKey) {
 		}
 	};
 	const hash = crypto.createHash("sha256");
-	for (const file of [...files].sort((a, b) => a.path.localeCompare(b.path))) {
+	for (const file of [...files].toSorted((a, b) => a.path.localeCompare(b.path))) {
 		hash.update(file.path);
 		hash.update("\0");
 		hash.update(file.path === "manifest.json" ? stableStringify(unsigned) : file.contents);
 		hash.update("\0");
 	}
 	const digest = hash.digest("hex");
+	const normalizedKey = privateKey.replace(/\\n/g, "\n").trim();
 	return {
 		...unsigned,
 		signature: {
 			algorithm: "rsa-sha256",
 			digest,
-			value: crypto.sign("sha256", Buffer.from(digest), privateKey).toString("base64url")
+			value: crypto.sign("sha256", Buffer.from(digest), normalizedKey).toString("base64url")
 		}
 	};
 }
+/**
+* Resolves the required RSA signing key for database-bearing addons.
+*
+* @param signingPrivateKey - Provided signing key or undefined.
+* @param developmentBuild - Whether the current build is targeting development mode.
+* @returns Resolved signing key string or undefined (in dev builds).
+* @throws {@link Error} If building a database-bearing addon in production without a signing key.
+*/
 function requireAddonSigningKey(signingPrivateKey, developmentBuild) {
 	if (signingPrivateKey) return signingPrivateKey;
 	if (developmentBuild) return void 0;
 	throw new Error("Database-bearing addon builds require JCHAT_ADDON_SIGNING_PRIVATE_KEY");
 }
-function embedCssIntoBundle(buildDir, addonId) {
+function embedCssIntoBundle(buildDir) {
 	const files = fs.readdirSync(buildDir);
 	const cssFile = files.find((f) => f.endsWith(".css"));
 	const jsFile = files.find((f) => f.includes("ui") && f.endsWith(".js"));
@@ -158,34 +255,131 @@ function embedCssIntoBundle(buildDir, addonId) {
 	const js = fs.readFileSync(jsPath, "utf-8");
 	if (css.length < 10) css = "";
 	else {
+		css = stripLayer(css, "properties");
+		css = stripLayer(css, "base");
 		css = css.replace(/:root\s*\{[^}]+\}/g, "");
+		css = css.replace(/:root:not\([^)]+\)\s*\{[^}]+\}/g, "");
 		css = css.replace(/\.dark\s*\{[^}]+\}/g, "");
 		css = css.replace(/\[data-theme=[^\]]+\]\s*\{[^}]+\}/g, "");
 		css = css.replace(/\.dark\s*\[data-theme=[^\]]+\]\s*\{[^}]+\}/g, "");
-		css = `@scope (#addon-${addonId}) {\n*, ::before, ::after { border-color: var(--border); }\n${css}\n}`;
+		css = css.replace(/\.font-(?:lato|playfair|dancing|poppins|jetbrains|quicksand|roboto-serif|audiowide|special-elite|press-start|grenze|righteous|creepster|vast-shadow|syncopate|lobster)\s*\{[^}]+\}/g, "");
+		css = css.replace(/--font-(?:lato|playfair|dancing|poppins|jetbrains|quicksand|roboto-serif|audiowide|special-elite|press-start|grenze|righteous|creepster|vast-shadow|syncopate|lobster):[^;]+;/g, "");
+		css = css.replace(/[^{}]*\[data-color[^{}]*\{[^}]+\}/g, "");
+		css = css.replace(/@property\s+--tw-[^{]+\{[^}]+\}/g, "");
+		css = css.replace(/\.loader-dots\s*\{[^}]+\}/g, "");
+		css = css.replace(/\.loader-dots\s+span[^{]*\{[^}]+\}/g, "");
+		css = css.replace(/@keyframes\s+wave-dots\s*\{[\s\S]*?\n\}/g, "");
+		css = css.replace(/@keyframes\s+gradient-border\s*\{[\s\S]*?\n\}/g, "");
+		css = css.replace(/\.animate-gradient(?:-border|-text)?\s*\{[^}]+\}/g, "");
+		css = css.replace(/\.me\s*\{[^}]+\}/g, "");
+		css = css.replace(/\.user-border\s*\{[^}]+\}/g, "");
+		css = css.replace(/\.scrollbar-hide[^{]*\{[^}]+\}/g, "");
+		css = css.replace(/@layer\s+components(?:\s*\{[^}]*\}|;)/g, "");
+		css = minifyCss(css);
 	}
-	const injection = `
+	if (css.trim().length > 0) {
+		const injection = `
 (function() {
-  if (typeof document !== 'undefined' && ${JSON.stringify(css)}.length > 0) {
-    const style = document.createElement('style');
-    style.type = 'text/css';
-    style.textContent = ${JSON.stringify(css)};
-    document.head.appendChild(style);
+  if (typeof document !== 'undefined') {
+    var s = document.createElement('style');
+    s.type = 'text/css';
+    s.textContent = ${JSON.stringify(css)};
+    document.head.appendChild(s);
   }
 })();
 `;
-	fs.writeFileSync(jsPath, injection + js);
+		fs.writeFileSync(jsPath, injection + js);
+	}
 	try {
 		fs.unlinkSync(cssPath);
 	} catch {}
 }
+function stripLayer(css, layerName) {
+	const regex = new RegExp(`@layer\\s+${layerName}\\s*\\{`);
+	let match = regex.exec(css);
+	while (match) {
+		const startIdx = match.index;
+		const openBraceIdx = startIdx + match[0].length - 1;
+		let braceCount = 1;
+		let endIdx = -1;
+		for (let i = openBraceIdx + 1; i < css.length; i++) if (css[i] === "{") braceCount++;
+		else if (css[i] === "}") {
+			braceCount--;
+			if (braceCount === 0) {
+				endIdx = i;
+				break;
+			}
+		}
+		if (endIdx === -1) break;
+		css = css.slice(0, startIdx) + css.slice(endIdx + 1);
+		match = regex.exec(css);
+	}
+	return css;
+}
+function minifyCss(css) {
+	return css.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\s+/g, " ").replace(/\s*([{};:,>])\s*/g, "$1").replace(/;}/g, "}").trim();
+}
+function sortValue(child) {
+	if (Array.isArray(child)) return child.map(sortValue);
+	if (child && typeof child === "object") return Object.fromEntries(Object.entries(child).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, nested]) => [key, sortValue(nested)]));
+	return child;
+}
 function stableStringify(value) {
-	const sortValue = (child) => {
-		if (Array.isArray(child)) return child.map(sortValue);
-		if (child && typeof child === "object") return Object.fromEntries(Object.entries(child).sort(([left], [right]) => left.localeCompare(right)).map(([key, nested]) => [key, sortValue(nested)]));
-		return child;
-	};
 	return JSON.stringify(sortValue(value));
 }
+async function generateAddonVendorLicenses(addonDir, addonName) {
+	const title = addonName ? `${addonName} Addon` : "JChat Addon";
+	try {
+		const proc = Bun.spawn([
+			"bun",
+			"pm",
+			"licenses",
+			"--json",
+			"--prod"
+		], {
+			cwd: addonDir,
+			stdout: "pipe",
+			stderr: "pipe"
+		});
+		const output = await new Response(proc.stdout).text();
+		await proc.exited;
+		const data = JSON.parse(output);
+		const lines = [
+			"================================================================================",
+			`${title} - Third-Party Vendor Licenses & Open Source Attribution`,
+			"================================================================================",
+			"This distribution incorporates open-source libraries and software components.",
+			"Their licenses and attributions are listed below.",
+			"================================================================================",
+			""
+		];
+		let totalPackages = 0;
+		const sortedCategories = Object.keys(data).toSorted((a, b) => a.localeCompare(b));
+		for (const licenseCategory of sortedCategories) {
+			const packages = data[licenseCategory];
+			if (!packages || packages.length === 0) continue;
+			lines.push(`\n## License: ${licenseCategory} (${packages.length} packages)\n`);
+			for (const pkg of packages) {
+				totalPackages++;
+				lines.push(`- Package:     ${pkg.name}@${pkg.versions.join(", ")}`);
+				if (pkg.description) lines.push(`  Description: ${pkg.description}`);
+				if (pkg.author) lines.push(`  Author:      ${pkg.author}`);
+				if (pkg.homepage) lines.push(`  Homepage:    ${pkg.homepage}`);
+			}
+		}
+		lines.splice(5, 0, `Total Open-Source Dependencies: ${totalPackages}\n`);
+		return lines.join("\n") + "\n";
+	} catch {
+		return [
+			"================================================================================",
+			`${title} - Third-Party Vendor Licenses & Open Source Attribution`,
+			"================================================================================",
+			"This distribution incorporates open-source libraries and software components.",
+			"See individual package.json files and dependencies for specific license details.",
+			"================================================================================",
+			""
+		].join("\n");
+	}
+}
 //#endregion
 export { createAddonServerBuildArguments, jchatAddon, requireAddonSigningKey, signAddonManifest };