@jeffusion/bungee-core 2.4.0 → 3.0.0

package/dist/master.js

@@ -4,25 +4,43 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: () => mod[key],
+        get: __accessProp.bind(mod, key),
         enumerable: true
       });
+  if (canCache)
+    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: (newValue) => all[name] = () => newValue
+      set: __exportSetter.bind(all, name)
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -566,7 +584,7 @@ var require_colors = __commonJS((exports, module) => {
   colors.stripColors = colors.strip = function(str) {
     return ("" + str).replace(/\x1B\[\d+m/g, "");
   };
-  var stylize = colors.stylize = function stylize(str, style) {
+  var stylize = colors.stylize = function stylize2(str, style) {
     if (!colors.enabled) {
       return str + "";
     }
@@ -584,8 +602,8 @@ var require_colors = __commonJS((exports, module) => {
     return str.replace(matchOperatorsRe, "\\$&");
   };
   function build(_styles) {
-    var builder = function builder() {
-      return applyStyle.apply(builder, arguments);
+    var builder = function builder2() {
+      return applyStyle.apply(builder2, arguments);
     };
     builder._styles = _styles;
     builder.__proto__ = proto;
@@ -604,7 +622,7 @@ var require_colors = __commonJS((exports, module) => {
     });
     return ret;
   }();
-  var proto = defineProps(function colors() {}, styles);
+  var proto = defineProps(function colors2() {}, styles);
   function applyStyle() {
     var args = Array.prototype.slice.call(arguments);
     var str = args.map(function(arg) {
@@ -663,7 +681,7 @@ var require_colors = __commonJS((exports, module) => {
     });
     return ret;
   }
-  var sequencer = function sequencer(map2, str) {
+  var sequencer = function sequencer2(map2, str) {
     var exploded = str.split("");
     exploded = exploded.map(map2);
     return exploded.join("");
@@ -3389,28 +3407,28 @@ var require_end_of_stream = __commonJS((exports, module) => {
     callback = once(callback || noop);
     var readable = opts.readable || opts.readable !== false && stream.readable;
     var writable = opts.writable || opts.writable !== false && stream.writable;
-    var onlegacyfinish = function onlegacyfinish() {
+    var onlegacyfinish = function onlegacyfinish2() {
       if (!stream.writable)
         onfinish();
     };
     var writableEnded = stream._writableState && stream._writableState.finished;
-    var onfinish = function onfinish() {
+    var onfinish = function onfinish2() {
       writable = false;
       writableEnded = true;
       if (!readable)
         callback.call(stream);
     };
     var readableEnded = stream._readableState && stream._readableState.endEmitted;
-    var onend = function onend() {
+    var onend = function onend2() {
       readable = false;
       readableEnded = true;
       if (!writable)
         callback.call(stream);
     };
-    var onerror = function onerror(err) {
+    var onerror = function onerror2(err) {
       callback.call(stream, err);
     };
-    var onclose = function onclose() {
+    var onclose = function onclose2() {
       var err;
       if (readable && !readableEnded) {
         if (!stream._readableState || !stream._readableState.ended)
@@ -3423,7 +3441,7 @@ var require_end_of_stream = __commonJS((exports, module) => {
         return callback.call(stream, err);
       }
     };
-    var onrequest = function onrequest() {
+    var onrequest = function onrequest2() {
       stream.req.on("finish", onfinish);
     };
     if (isRequest(stream)) {
@@ -3580,7 +3598,7 @@ var require_async_iterator = __commonJS((exports, module) => {
       });
     });
   }), _Object$setPrototypeO), AsyncIteratorPrototype);
-  var createReadableStreamAsyncIterator = function createReadableStreamAsyncIterator(stream) {
+  var createReadableStreamAsyncIterator = function createReadableStreamAsyncIterator2(stream) {
     var _Object$create;
     var iterator = Object.create(ReadableStreamAsyncIteratorPrototype, (_Object$create = {}, _defineProperty(_Object$create, kStream, {
       value: stream,
@@ -3769,7 +3787,7 @@ var require__stream_readable = __commonJS((exports, module) => {
   var Duplex;
   Readable.ReadableState = ReadableState;
   var EE = __require("events").EventEmitter;
-  var EElistenerCount = function EElistenerCount(emitter, type) {
+  var EElistenerCount = function EElistenerCount2(emitter, type) {
     return emitter.listeners(type).length;
   };
   var Stream = __require("stream");
@@ -3786,7 +3804,7 @@ var require__stream_readable = __commonJS((exports, module) => {
   if (debugUtil && debugUtil.debuglog) {
     debug = debugUtil.debuglog("stream");
   } else {
-    debug = function debug() {};
+    debug = function debug2() {};
   }
   var BufferList = require_buffer_list();
   var destroyImpl = require_destroy();
@@ -4732,7 +4750,7 @@ var require__stream_writable = __commonJS((exports, module) => {
       }
     });
   } else {
-    realHasInstance = function realHasInstance(object) {
+    realHasInstance = function realHasInstance2(object) {
       return object instanceof this;
     };
   }
@@ -5110,7 +5128,7 @@ var require_modern = __commonJS((exports, module) => {
   var util = __require("util");
   var Writable = require__stream_writable();
   var { LEVEL } = require_triple_beam();
-  var TransportStream = module.exports = function TransportStream(options = {}) {
+  var TransportStream = module.exports = function TransportStream2(options = {}) {
     Writable.call(this, { objectMode: true, highWaterMark: options.highWaterMark });
     this.format = options.format;
     this.level = options.level;
@@ -5221,7 +5239,7 @@ var require_legacy = __commonJS((exports, module) => {
   var util = __require("util");
   var { LEVEL } = require_triple_beam();
   var TransportStream = require_modern();
-  var LegacyTransportStream = module.exports = function LegacyTransportStream(options = {}) {
+  var LegacyTransportStream = module.exports = function LegacyTransportStream2(options = {}) {
     TransportStream.call(this, options);
     if (!options.transport || typeof options.transport.log !== "function") {
       throw new Error("Invalid transport, must be an object with a log method.");
@@ -7739,7 +7757,7 @@ var require_index_cjs = __commonJS((exports, module) => {
   function getDefaultExportFromCjs(x) {
     return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x["default"] : x;
   }
-  var textHex = function hex(str) {
+  var textHex = function hex2(str) {
     for (var i = 0, hash = 0;i < str.length; hash = str.charCodeAt(i++) + ((hash << 5) - hash))
       ;
     var color = Math.floor(Math.abs(Math.sin(hash) * 1e4 % 1 * 16777216)).toString(16);
@@ -14448,7 +14466,7 @@ var require_FileStreamRotator = __commonJS((exports, module) => {
       return fullPath;
     }, "");
   };
-  var BubbleEvents = function BubbleEvents(emitter, proxy) {
+  var BubbleEvents = function BubbleEvents2(emitter, proxy) {
     emitter.on("close", function() {
       proxy.emit("close");
     });
@@ -15159,16 +15177,26 @@ var require_main = __commonJS((exports, module) => {
 // src/logger.ts
 import path from "path";
 import fs from "fs";
-function createLogMethod(level) {
+function createLogMethod(level, defaultMeta = {}) {
   return function(objOrMsg, msg) {
     if (typeof objOrMsg === "string") {
-      winstonLogger.log(level, objOrMsg);
+      winstonLogger.log(level, objOrMsg, defaultMeta);
     } else {
       const message = msg || "";
-      winstonLogger.log(level, message, objOrMsg);
+      winstonLogger.log(level, message, { ...defaultMeta, ...objOrMsg });
     }
   };
 }
+function createLogger(defaultMeta = {}) {
+  return {
+    info: createLogMethod("info", defaultMeta),
+    warn: createLogMethod("warn", defaultMeta),
+    error: createLogMethod("error", defaultMeta),
+    debug: createLogMethod("debug", defaultMeta),
+    fatal: createLogMethod("error", defaultMeta),
+    child: (bindings) => createLogger({ ...defaultMeta, ...bindings })
+  };
+}
 var import_winston, import_winston_daily_rotate_file, import_dotenv, logsDir, logLevel, isDevelopment = true, isMaster, pinoStyleConsoleFormat, transports, winstonLogger, logger;
 var init_logger = __esm(() => {
   import_winston = __toESM(require_winston(), 1);
@@ -15216,13 +15244,7 @@ var init_logger = __esm(() => {
     level: logLevel,
     transports
   });
-  logger = {
-    info: createLogMethod("info"),
-    warn: createLogMethod("warn"),
-    error: createLogMethod("error"),
-    debug: createLogMethod("debug"),
-    fatal: createLogMethod("error")
-  };
+  logger = createLogger();
 });
 
 // src/logger/access-log-writer.ts
@@ -15233,6 +15255,7 @@ import fs2 from "fs";
 class AccessLogWriter {
   db;
   writeQueue = [];
+  pendingRespBodyIdUpdates = new Map;
   isProcessing = false;
   flushInterval = null;
   constructor(dbPath) {
@@ -15246,6 +15269,10 @@ class AccessLogWriter {
     this.startFlushInterval();
   }
   write(entry) {
+    const pendingRespBodyId = this.pendingRespBodyIdUpdates.get(entry.requestId);
+    if (pendingRespBodyId) {
+      entry.respBodyId = pendingRespBodyId;
+    }
     this.writeQueue.push(entry);
     if (this.writeQueue.length >= 100) {
       this.flush().catch((err) => {
@@ -15276,12 +15303,19 @@ class AccessLogWriter {
       let insertedCount = 0;
       let ignoredCount = 0;
       for (const entry of batch) {
+        const pendingRespBodyId = this.pendingRespBodyIdUpdates.get(entry.requestId);
+        if (pendingRespBodyId) {
+          entry.respBodyId = pendingRespBodyId;
+        }
         const result = insert.run(entry.requestId, entry.timestamp, entry.method, entry.path, entry.query || null, entry.status, entry.duration, entry.routePath || null, entry.upstream || null, entry.transformer || null, entry.processingSteps ? JSON.stringify(entry.processingSteps) : null, entry.authSuccess !== undefined ? entry.authSuccess ? 1 : 0 : 1, entry.authLevel || null, entry.errorMessage || null, entry.reqBodyId || null, entry.respBodyId || null, entry.reqHeaderId || null, entry.respHeaderId || null, entry.originalReqHeaderId || null, entry.originalReqBodyId || null, entry.transformedPath || null, entry.status < 400 ? 1 : 0, Math.floor(entry.timestamp / 1000), entry.isFailoverAttempt ? 1 : 0, entry.parentRequestId || null, entry.attemptNumber || null, entry.attemptUpstream || null, entry.requestType || "final");
         if (result.changes > 0) {
           insertedCount++;
         } else {
           ignoredCount++;
         }
+        if (pendingRespBodyId) {
+          this.pendingRespBodyIdUpdates.delete(entry.requestId);
+        }
       }
       this.db.run("COMMIT");
       transactionStarted = false;
@@ -15322,6 +15356,29 @@ class AccessLogWriter {
   getDatabase() {
     return this.db;
   }
+  updateResponseBodyId(requestId, respBodyId) {
+    if (!requestId || !respBodyId) {
+      return;
+    }
+    this.pendingRespBodyIdUpdates.set(requestId, respBodyId);
+    for (const entry of this.writeQueue) {
+      if (entry.requestId === requestId) {
+        entry.respBodyId = respBodyId;
+      }
+    }
+    try {
+      const result = this.db.prepare("UPDATE access_logs SET resp_body_id = ? WHERE request_id = ?").run(respBodyId, requestId);
+      if (result.changes > 0) {
+        this.pendingRespBodyIdUpdates.delete(requestId);
+      }
+    } catch (error) {
+      console.error("Failed to update response body id for streamed log:", {
+        requestId,
+        respBodyId,
+        error
+      });
+    }
+  }
 }
 var dbPath, accessLogWriter;
 var init_access_log_writer = __esm(() => {
@@ -15777,6 +15834,58 @@ var init_001_initial_schema_with_failover = __esm(() => {
   };
 });
 
+// src/migrations/versions/002_add_plugin_storage.ts
+var migration2;
+var init_002_add_plugin_storage = __esm(() => {
+  migration2 = {
+    version: "002",
+    name: "add_plugin_storage",
+    up: (db) => {
+      db.run(`
+      CREATE TABLE IF NOT EXISTS plugin_storage (
+        plugin_name TEXT NOT NULL,
+        key TEXT NOT NULL,
+        value TEXT NOT NULL,
+        ttl INTEGER, -- \u8FC7\u671F\u65F6\u95F4\u6233\uFF08\u79D2\uFF09\uFF0CNULL \u8868\u793A\u6C38\u4E0D\u8FC7\u671F
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (plugin_name, key)
+      )
+    `);
+      db.run(`
+      CREATE INDEX IF NOT EXISTS idx_plugin_storage_ttl
+      ON plugin_storage(ttl)
+      WHERE ttl IS NOT NULL
+    `);
+    }
+  };
+});
+
+// src/migrations/versions/003_add_plugin_registry.ts
+var migration3;
+var init_003_add_plugin_registry = __esm(() => {
+  migration3 = {
+    version: "003",
+    name: "add_plugin_registry",
+    up: (db) => {
+      db.run(`
+      CREATE TABLE IF NOT EXISTS plugin_registry (
+        name TEXT PRIMARY KEY,
+        version TEXT NOT NULL,
+        description TEXT,
+        path TEXT,
+        enabled INTEGER NOT NULL DEFAULT 0,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      )
+    `);
+      db.run(`
+      CREATE INDEX IF NOT EXISTS idx_plugin_registry_enabled
+      ON plugin_registry(enabled)
+    `);
+    }
+  };
+});
+
 // src/migrations/migration-manager.ts
 import { Database as Database2 } from "bun:sqlite";
 import fs5 from "fs";
@@ -15805,11 +15914,11 @@ class MigrationManager {
       logger.info({ count: pending.length, migrations: pending.map((m) => m.name) }, "Executing pending migrations");
       this.db.run("BEGIN TRANSACTION");
       try {
-        for (const migration2 of pending) {
-          logger.debug({ migration: migration2.name }, "Applying migration");
-          migration2.up(this.db);
-          this.recordMigration(migration2);
-          logger.info({ migration: migration2.name }, "Migration applied successfully");
+        for (const migration4 of pending) {
+          logger.debug({ migration: migration4.name }, "Applying migration");
+          migration4.up(this.db);
+          this.recordMigration(migration4);
+          logger.info({ migration: migration4.name }, "Migration applied successfully");
         }
         this.db.run("COMMIT");
         logger.info("All migrations completed successfully");
@@ -15859,12 +15968,12 @@ class MigrationManager {
     const appliedVersions = new Set(applied.map((r) => r.version));
     return migrations.filter((m) => !appliedVersions.has(m.version));
   }
-  recordMigration(migration2) {
+  recordMigration(migration4) {
     if (!this.db) {
       throw new Error("Database not initialized");
     }
     const stmt = this.db.prepare("INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)");
-    stmt.run(migration2.version, migration2.name, Date.now());
+    stmt.run(migration4.version, migration4.name, Date.now());
   }
   async attemptAutoRecovery(error) {
     const errorMessage = error.message.toLowerCase();
@@ -15927,9 +16036,13 @@ var init_migration_manager = __esm(() => {
 var migrations;
 var init_migrations = __esm(() => {
   init_001_initial_schema_with_failover();
+  init_002_add_plugin_storage();
+  init_003_add_plugin_registry();
   init_migration_manager();
   migrations = [
-    migration
+    migration,
+    migration2,
+    migration3
   ];
 });
 
@@ -16087,17 +16200,339 @@ var init_config = __esm(() => {
   init_logger();
 });
 
+// src/plugin-storage-cleanup.ts
+class PluginStorageCleanupService {
+  db;
+  config;
+  timer = null;
+  running = false;
+  stats = {
+    totalRuns: 0,
+    totalDeleted: 0,
+    lastRunTime: 0,
+    lastDeletedCount: 0,
+    lastDuration: 0
+  };
+  constructor(db, config) {
+    this.db = db;
+    this.config = { ...DEFAULT_CONFIG3, ...config };
+    logger.info({ config: this.config }, "PluginStorageCleanupService initialized");
+  }
+  start() {
+    if (!this.config.enabled) {
+      logger.info("PluginStorageCleanupService is disabled");
+      return;
+    }
+    if (this.timer) {
+      logger.warn("PluginStorageCleanupService already started");
+      return;
+    }
+    logger.info({ interval: this.config.interval }, "Starting PluginStorageCleanupService");
+    this.cleanup().catch((err) => {
+      logger.error({ error: err }, "Initial cleanup failed");
+    });
+    this.timer = setInterval(() => {
+      this.cleanup().catch((err) => {
+        logger.error({ error: err }, "Scheduled cleanup failed");
+      });
+    }, this.config.interval);
+  }
+  stop() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+      logger.info("PluginStorageCleanupService stopped");
+    }
+  }
+  async cleanup() {
+    if (this.running) {
+      logger.warn("Cleanup already running, skipping");
+      return 0;
+    }
+    this.running = true;
+    const startTime = Date.now();
+    let totalDeleted = 0;
+    try {
+      logger.info("Starting plugin storage cleanup");
+      const now = Math.floor(Date.now() / 1000);
+      let batchCount = 0;
+      let hasMore = true;
+      while (hasMore && batchCount < 10) {
+        const deleteStmt = this.db.prepare(`
+          DELETE FROM plugin_storage
+          WHERE rowid IN (
+            SELECT rowid FROM plugin_storage
+            WHERE ttl IS NOT NULL AND ttl < ?
+            LIMIT ?
+          )
+        `);
+        const result = deleteStmt.run(now, this.config.batchSize);
+        const deleted = result.changes;
+        totalDeleted += deleted;
+        batchCount++;
+        logger.debug({ batch: batchCount, deleted, totalDeleted }, "Cleanup batch completed");
+        hasMore = deleted >= this.config.batchSize;
+        if (hasMore) {
+          await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+      }
+      if (this.config.vacuumAfterCleanup && totalDeleted > 0) {
+        logger.info("Running VACUUM after cleanup");
+        this.db.run("VACUUM");
+      }
+      const duration = Date.now() - startTime;
+      this.stats.totalRuns++;
+      this.stats.totalDeleted += totalDeleted;
+      this.stats.lastRunTime = startTime;
+      this.stats.lastDeletedCount = totalDeleted;
+      this.stats.lastDuration = duration;
+      logger.info({
+        deleted: totalDeleted,
+        duration,
+        batches: batchCount
+      }, "Plugin storage cleanup completed");
+      return totalDeleted;
+    } catch (error) {
+      logger.error({ error }, "Plugin storage cleanup failed");
+      throw error;
+    } finally {
+      this.running = false;
+    }
+  }
+  getStats() {
+    return {
+      ...this.stats,
+      running: this.running,
+      enabled: this.config.enabled
+    };
+  }
+  resetStats() {
+    this.stats = {
+      totalRuns: 0,
+      totalDeleted: 0,
+      lastRunTime: 0,
+      lastDeletedCount: 0,
+      lastDuration: 0
+    };
+  }
+  async getExpiredCount() {
+    const now = Math.floor(Date.now() / 1000);
+    const stmt = this.db.prepare(`
+      SELECT COUNT(*) as count FROM plugin_storage
+      WHERE ttl IS NOT NULL AND ttl < ?
+    `);
+    const result = stmt.get(now);
+    return result.count;
+  }
+  async getStorageStats() {
+    const now = Math.floor(Date.now() / 1000);
+    const totalEntriesStmt = this.db.prepare(`
+      SELECT COUNT(*) as count FROM plugin_storage
+    `);
+    const totalEntries = totalEntriesStmt.get().count;
+    const totalWithTTLStmt = this.db.prepare(`
+      SELECT COUNT(*) as count FROM plugin_storage
+      WHERE ttl IS NOT NULL
+    `);
+    const totalWithTTL = totalWithTTLStmt.get().count;
+    const totalExpiredStmt = this.db.prepare(`
+      SELECT COUNT(*) as count FROM plugin_storage
+      WHERE ttl IS NOT NULL AND ttl < ?
+    `);
+    const totalExpired = totalExpiredStmt.get(now).count;
+    const totalPluginsStmt = this.db.prepare(`
+      SELECT COUNT(DISTINCT plugin_name) as count FROM plugin_storage
+    `);
+    const totalPlugins = totalPluginsStmt.get().count;
+    return {
+      totalEntries,
+      totalWithTTL,
+      totalExpired,
+      totalPlugins
+    };
+  }
+}
+var DEFAULT_CONFIG3;
+var init_plugin_storage_cleanup = __esm(() => {
+  init_logger();
+  DEFAULT_CONFIG3 = {
+    enabled: true,
+    interval: 3600000,
+    batchSize: 1000,
+    vacuumAfterCleanup: false
+  };
+});
+
+// src/plugin-permissions.ts
+class PluginPermissionManager {
+  permissions = new Map;
+  registerPlugin(pluginName, metadata) {
+    const permissions = new Set;
+    permissions.add("storage" /* STORAGE */);
+    if (metadata.permissions && Array.isArray(metadata.permissions)) {
+      for (const perm of metadata.permissions) {
+        if (perm === "network")
+          permissions.add("network" /* NETWORK */);
+        else if (perm === "filesystem")
+          permissions.add("filesystem" /* FILESYSTEM */);
+        else if (perm === "storage")
+          permissions.add("storage" /* STORAGE */);
+        else if (perm === "ui:modals")
+          permissions.add("ui:modals" /* UI_MODALS */);
+        else if (perm === "ui:popups")
+          permissions.add("ui:popups" /* UI_POPUPS */);
+        else if (perm === "ui:forms")
+          permissions.add("ui:forms" /* UI_FORMS */);
+        else if (perm === "ui:navigation")
+          permissions.add("ui:navigation" /* UI_NAVIGATION */);
+        else if (perm === "api:routes")
+          permissions.add("api:routes" /* API_ROUTES */);
+        else if (perm === "api:plugins")
+          permissions.add("api:plugins" /* API_PLUGINS */);
+        else if (perm === "api:logs")
+          permissions.add("api:logs" /* API_LOGS */);
+      }
+    }
+    if (metadata.capabilities) {
+      const { network, filesystem, database } = metadata.capabilities;
+      if (network)
+        permissions.add("network" /* NETWORK */);
+      if (filesystem)
+        permissions.add("filesystem" /* FILESYSTEM */);
+      if (database)
+        permissions.add("database" /* DATABASE */);
+    }
+    if (metadata.contributes) {
+      if (metadata.contributes.navigation?.length) {
+        permissions.add("ui:navigation" /* UI_NAVIGATION */);
+      }
+      if (metadata.contributes.commands?.length) {
+        permissions.add("api:routes" /* API_ROUTES */);
+      }
+    }
+    if (metadata.contributes?.navigation || metadata.contributes?.widgets) {
+      permissions.add("ui:forms" /* UI_FORMS */);
+      permissions.add("ui:modals" /* UI_MODALS */);
+    }
+    this.permissions.set(pluginName, permissions);
+    logger.debug({ pluginName, permissions: Array.from(permissions) }, "Registered plugin permissions");
+  }
+  hasPermission(pluginName, permission) {
+    const perms = this.permissions.get(pluginName);
+    if (!perms) {
+      logger.warn({ pluginName, permission }, "Plugin not registered in permission manager");
+      return false;
+    }
+    return perms.has(permission);
+  }
+  hasPermissions(pluginName, requiredPermissions) {
+    return requiredPermissions.every((perm) => this.hasPermission(pluginName, perm));
+  }
+  getPermissions(pluginName) {
+    return this.permissions.get(pluginName) || new Set;
+  }
+  getSandboxAttributes(pluginName) {
+    const perms = this.permissions.get(pluginName);
+    if (!perms) {
+      return "allow-scripts";
+    }
+    const sandboxAttrs = new Set([
+      "allow-scripts",
+      "allow-same-origin"
+    ]);
+    for (const perm of perms) {
+      const sandboxAttr = PERMISSION_TO_SANDBOX[perm];
+      if (sandboxAttr) {
+        sandboxAttr.split(" ").forEach((attr) => sandboxAttrs.add(attr));
+      }
+    }
+    return Array.from(sandboxAttrs).join(" ");
+  }
+  getCSP(pluginName) {
+    const perms = this.permissions.get(pluginName);
+    if (!perms) {
+      return "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'";
+    }
+    const cspDirectives = [];
+    cspDirectives.push("default-src 'self'");
+    cspDirectives.push("script-src 'self' 'unsafe-inline' 'unsafe-eval'");
+    cspDirectives.push("style-src 'self' 'unsafe-inline'");
+    cspDirectives.push("font-src 'self' data:");
+    cspDirectives.push("img-src 'self' data: blob:");
+    if (perms.has("network" /* NETWORK */)) {
+      cspDirectives.push("connect-src 'self' https: wss:");
+    } else {
+      cspDirectives.push("connect-src 'self'");
+    }
+    cspDirectives.push("frame-ancestors 'self'");
+    cspDirectives.push("object-src 'none'");
+    cspDirectives.push("base-uri 'self'");
+    return cspDirectives.join("; ");
+  }
+  canAccessAPI(pluginName, apiPath) {
+    const apiPermissionMap = {
+      "/api/plugins": "api:plugins" /* API_PLUGINS */,
+      "/api/routes": "api:routes" /* API_ROUTES */,
+      "/api/logs": "api:logs" /* API_LOGS */
+    };
+    for (const [prefix, permission] of Object.entries(apiPermissionMap)) {
+      if (apiPath.startsWith(prefix)) {
+        return this.hasPermission(pluginName, permission);
+      }
+    }
+    return true;
+  }
+  unregisterPlugin(pluginName) {
+    this.permissions.delete(pluginName);
+    logger.debug({ pluginName }, "Unregistered plugin permissions");
+  }
+  clear() {
+    this.permissions.clear();
+  }
+  getStats() {
+    return {
+      totalPlugins: this.permissions.size,
+      plugins: Array.from(this.permissions.keys())
+    };
+  }
+}
+function initializePermissionManager() {
+  if (!globalPermissionManager) {
+    globalPermissionManager = new PluginPermissionManager;
+    logger.info("Plugin permission manager initialized");
+  }
+  return globalPermissionManager;
+}
+function getPermissionManager() {
+  if (!globalPermissionManager) {
+    throw new Error("PermissionManager not initialized. Call initializePermissionManager() first.");
+  }
+  return globalPermissionManager;
+}
+var PERMISSION_TO_SANDBOX, globalPermissionManager = null;
+var init_plugin_permissions = __esm(() => {
+  init_logger();
+  PERMISSION_TO_SANDBOX = {
+    ["ui:modals" /* UI_MODALS */]: "allow-modals",
+    ["ui:popups" /* UI_POPUPS */]: "allow-popups allow-popups-to-escape-sandbox",
+    ["ui:forms" /* UI_FORMS */]: "allow-forms",
+    ["ui:navigation" /* UI_NAVIGATION */]: "allow-top-navigation-by-user-activation"
+  };
+});
+
 // src/master.ts
 var exports_master = {};
 import path7 from "path";
 import { spawn } from "child_process";
 import fs7 from "fs";
+import { Database as Database3 } from "bun:sqlite";
 
 class Master {
   workers = new Map;
   config;
   isReloading = false;
   reloadTimeout = null;
+  pluginStorageCleanupService = null;
   constructor() {
     this.loadAndStart();
     this.watchConfig();
@@ -16125,6 +16560,16 @@ class Master {
       } else {
         logger.info("Database migrations completed successfully");
       }
+      const db = new Database3(dbPath2);
+      this.pluginStorageCleanupService = new PluginStorageCleanupService(db, {
+        enabled: true,
+        interval: 3600000,
+        batchSize: 1000,
+        vacuumAfterCleanup: false
+      });
+      this.pluginStorageCleanupService.start();
+      initializePermissionManager();
+      logger.info("Plugin permission manager initialized");
       await this.startWorkers();
     } catch (error) {
       logger.error({ error }, "Failed to load or parse config.json");
@@ -16332,6 +16777,9 @@ class Master {
     await Promise.all(shutdownPromises);
     this.workers.clear();
     logCleanupService.stop();
+    if (this.pluginStorageCleanupService) {
+      this.pluginStorageCleanupService.stop();
+    }
   }
 }
 var import_dotenv2, CONFIG_PATH, WORKER_COUNT, PORT;
@@ -16340,6 +16788,8 @@ var init_master = __esm(() => {
   init_log_cleanup();
   init_migrations();
   init_config();
+  init_plugin_storage_cleanup();
+  init_plugin_permissions();
   import_dotenv2 = __toESM(require_main(), 1);
   import_dotenv2.default.config();
   CONFIG_PATH = process.env.CONFIG_PATH || path7.resolve(process.cwd(), "config.json");