@jesscss/plugin-js 2.0.0-alpha.1 → 2.0.0-alpha.11

package/lib/index.cjs

@@ -0,0 +1,817 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let _jesscss_core = require("@jesscss/core");
+let node_fs = require("node:fs");
+node_fs = __toESM(node_fs);
+let node_net = require("node:net");
+node_net = __toESM(node_net);
+let node_path = require("node:path");
+node_path = __toESM(node_path);
+let node_url = require("node:url");
+let node_child_process = require("node:child_process");
+let _jesscss_core_value = require("@jesscss/core/value");
+//#region src/bridge.ts
+const isRecord = (value) => typeof value === "object" && value !== null;
+const isBridgeValue = (value) => isRecord(value) && value.__jessBridge === true && typeof value.kind === "string";
+const isValueObj = (value) => isRecord(value) && typeof value.type === "string" && typeof value.bytes === "string";
+const isDetached = (value) => isRecord(value) && value.type === "DetachedRuleset" && Array.isArray(value.rules);
+function encodeBridgeChildValue(value) {
+	const encoded = encodeBridgeValue(value);
+	if (isBridgeValue(encoded)) return encoded;
+	return {
+		__jessBridge: true,
+		kind: "scalar",
+		value: String(encoded)
+	};
+}
+function encodeFacadeValue(value) {
+	switch (value.type) {
+		case "Dimension": return typeof value.value === "number" ? {
+			__jessBridge: true,
+			kind: "dimension",
+			value: value.value,
+			unit: typeof value.unit === "string" ? value.unit : void 0
+		} : void 0;
+		case "Color": return Array.isArray(value.rgb) && value.rgb.length === 3 ? {
+			__jessBridge: true,
+			kind: "color",
+			rgb: [
+				value.rgb[0],
+				value.rgb[1],
+				value.rgb[2]
+			],
+			alpha: typeof value.alpha === "number" ? value.alpha : void 0
+		} : void 0;
+		case "Quoted": return typeof value.value === "string" ? {
+			__jessBridge: true,
+			kind: "quoted",
+			value: value.value,
+			quote: value.quote === "'" ? "'" : "\"",
+			escaped: value.escaped === true
+		} : void 0;
+		case "Anonymous":
+		case "Keyword": return typeof value.value === "string" ? {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.value
+		} : void 0;
+		case "Expression": return Array.isArray(value.value) ? {
+			__jessBridge: true,
+			kind: "expression",
+			items: value.value.map(encodeBridgeChildValue)
+		} : void 0;
+		case "Value": return Array.isArray(value.value) ? {
+			__jessBridge: true,
+			kind: "list",
+			items: value.value.map(encodeBridgeChildValue),
+			separator: value.separator === "/" || value.separator === ";" ? value.separator : ","
+		} : void 0;
+		case "Mixin": {
+			const ruleset = value.ruleset;
+			if (!isRecord(ruleset) || !Array.isArray(ruleset.rules)) return;
+			const rules = [];
+			for (const rule of ruleset.rules) {
+				if (!isRecord(rule)) continue;
+				if (rule.type === "Declaration" && typeof rule.name === "string") rules.push({
+					name: rule.name,
+					value: encodeBridgeChildValue(rule.value)
+				});
+			}
+			return {
+				__jessBridge: true,
+				kind: "mixin",
+				rules
+			};
+		}
+		default: return;
+	}
+}
+function encodeBridgeValue(value) {
+	if (Array.isArray(value)) return {
+		__jessBridge: true,
+		kind: "expression",
+		items: value.map(encodeBridgeChildValue)
+	};
+	if (isValueObj(value)) switch (value.type) {
+		case "Dimension": return {
+			__jessBridge: true,
+			kind: "dimension",
+			value: value.number,
+			unit: value.unit
+		};
+		case "Color": return {
+			__jessBridge: true,
+			kind: "color",
+			rgb: [
+				value.rgb[0],
+				value.rgb[1],
+				value.rgb[2]
+			],
+			alpha: value.alpha
+		};
+		case "Quoted": return {
+			__jessBridge: true,
+			kind: "quoted",
+			value: value.value,
+			quote: value.quote === "'" ? "'" : "\"",
+			escaped: value.escaped
+		};
+		case "List": return value.sep === "," || value.sep === "/" ? {
+			__jessBridge: true,
+			kind: "list",
+			items: value.value.map(encodeBridgeChildValue),
+			separator: value.sep
+		} : {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.bytes
+		};
+		case "Block": return {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.bytes
+		};
+		default: return {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.bytes
+		};
+	}
+	if (isDetached(value)) return {
+		__jessBridge: true,
+		kind: "mixin",
+		rules: value.rules.map((rule) => ({
+			name: rule.name,
+			value: encodeBridgeChildValue(rule.value)
+		}))
+	};
+	if (isRecord(value)) return encodeFacadeValue(value) ?? value;
+	return value;
+}
+function decodeValue(value) {
+	switch (value.kind) {
+		case "scalar": return typeof value.value === "number" ? (0, _jesscss_core_value.makeDimension)(value.value) : (0, _jesscss_core_value.sniffLiteral)(String(value.value));
+		case "dimension": return (0, _jesscss_core_value.makeDimension)(value.value, value.unit ?? "");
+		case "color": return (0, _jesscss_core_value.makeColorRgb)(value.rgb, value.alpha ?? 1, _jesscss_core_value.HEX);
+		case "quoted": return (0, _jesscss_core_value.makeQuoted)(value.value, value.quote ?? "\"", value.escaped === true);
+		case "anonymous": return (0, _jesscss_core_value.sniffLiteral)(value.value);
+		case "expression": return value.items.map(decodeValue);
+		case "list": return (0, _jesscss_core_value.makeList)(value.items.map(decodeValue), value.separator === ";" ? "," : value.separator);
+		case "mixin": return (0, _jesscss_core_value.makeKeyword)("");
+	}
+}
+function decodeMixin(value) {
+	const nil = {
+		type: "Nil",
+		value: ""
+	};
+	const mixin = {
+		type: "Mixin",
+		name: nil,
+		args: nil,
+		ruleset: { rules: value.rules.map((rule) => ({
+			type: "Declaration",
+			name: rule.name,
+			value: decodeValue(rule.value),
+			eval() {
+				return this;
+			}
+		})) },
+		eval() {
+			return mixin;
+		}
+	};
+	return mixin;
+}
+function decodeBridgeValue(value) {
+	if (!isBridgeValue(value)) return value;
+	return value.kind === "mixin" ? decodeMixin(value) : decodeValue(value);
+}
+function encodeBridgeArgs(args) {
+	return args.map(encodeBridgeValue);
+}
+//#endregion
+//#region src/index.ts
+/**
+* A failure raised BY a `@plugin` script (its own `throw`, or a shim member it
+* cannot use), as distinct from a value the engine simply could not compute.
+* The distinction is what lets the compiler report a plugin fault loudly and
+* attributably instead of preserving the call verbatim.
+*/
+var PluginFunctionError = class extends Error {
+	functionName;
+	pluginStack;
+	originalName;
+	constructor(functionName, reason, pluginStack, originalName = "Error") {
+		super(`Less @plugin function "${functionName}" threw: ${reason}`);
+		this.name = "PluginFunctionError";
+		this.functionName = functionName;
+		this.pluginStack = pluginStack;
+		this.originalName = originalName;
+	}
+};
+/**
+* Child-process stdio streams are typed as bare `Writable`/`Readable`, which do
+* not declare `unref`, but the underlying pipe sockets expose it at runtime.
+* The optional structural member lets any stream be passed without an unsafe
+* cast; the runtime `?.` guard covers streams that genuinely lack the method.
+*/
+const unrefStream = (stream) => {
+	if (typeof stream === "object" && stream !== null && "unref" in stream && typeof stream.unref === "function") stream.unref();
+};
+const SCRIPT_EXTENSIONS = new Set([
+	".js",
+	".mjs",
+	".cjs",
+	".ts",
+	".mts",
+	".cts"
+]);
+const RUNTIME_MISSING_MESSAGE = [
+	"Deno runtime is required for @jesscss/plugin-js, but no usable Deno binary was found.",
+	"If using pnpm, approve build scripts for \"deno\" (pnpm approve-builds).",
+	"If using npm with ignored scripts, reinstall with lifecycle scripts enabled.",
+	"Or install native Deno and ensure \"deno\" is on PATH."
+].join("\n");
+const BOOT_TIMEOUT_MS = 8e3;
+const REQUEST_TIMEOUT_MS = 1e4;
+const IDLE_SHUTDOWN_MS = 5e3;
+/**
+* Environment variables that inject a Node.js debugger/inspector bootloader
+* into child processes (VS Code / Cursor "Auto Attach", `node --inspect`, etc.).
+*
+* These must never leak into the sandboxed Deno worker: the injected bootloader
+* tries to read the environment, the Jess Deno sandbox denies `env` permission,
+* and the worker never signals ready — producing a spurious
+* "Timed out waiting for Deno worker startup" failure. Deno does not use any of
+* these vars, so stripping them is safe.
+*/
+const DEBUG_ENV_KEY_RE = /^(NODE_OPTIONS|NODE_INSPECT|VSCODE_INSPECTOR_OPTIONS)/i;
+const DEBUG_ENV_VALUE_RE = /js-debug|bootloader/i;
+/**
+* Returns a copy of `env` with Node debugger/inspector-attach variables removed,
+* so a spawned Deno subprocess starts regardless of the parent's debug env.
+* The Deno permission sandbox is untouched; this only stops leaking the debugger
+* into it.
+*/
+const sanitizeSpawnEnv = (env = process.env) => {
+	const clean = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (DEBUG_ENV_KEY_RE.test(key)) continue;
+		if (typeof value === "string" && DEBUG_ENV_VALUE_RE.test(value)) continue;
+		clean[key] = value;
+	}
+	return clean;
+};
+const isPathInside = (candidatePath, rootPath) => {
+	const rel = node_path.relative(rootPath, candidatePath);
+	return rel === "" || !rel.startsWith("..") && !node_path.isAbsolute(rel);
+};
+const canonicalPath = (p) => {
+	try {
+		return node_fs.realpathSync.native(p);
+	} catch {
+		return p;
+	}
+};
+const normalizePermissionPath = (value) => {
+	if (!value) return null;
+	if (value.startsWith("file://")) try {
+		return (0, node_url.fileURLToPath)(value);
+	} catch {
+		return value;
+	}
+	return value;
+};
+const isFnsPath = (importPath) => {
+	const normalized = importPath.replace(/\\/g, "/");
+	const isFnsPackagePath = /(^|\/)(@jesscss\/fns|packages\/fns)(\/|$)/.test(normalized);
+	return normalized === "@jesscss/fns" || normalized.startsWith("@jesscss/fns/") || normalized === "#less" || normalized.startsWith("#less/") || normalized === "#sass" || normalized.startsWith("#sass/") || isFnsPackagePath;
+};
+const isJsonValue = (value) => {
+	try {
+		JSON.stringify(value);
+		return true;
+	} catch {
+		return false;
+	}
+};
+/**
+* Ceiling on resolve-and-replay rounds for a single call. Each round satisfies
+* exactly one fact, so this also bounds a pathological plugin that asks for an
+* unbounded number of distinct variables.
+*/
+const MAX_FACT_ROUNDS = 64;
+const EMPTY_PLUGIN_CALL_CAPABILITIES = {};
+function normalizePluginCallArgs(args) {
+	if (args === void 0) return [];
+	return Array.isArray(args) ? args : [args];
+}
+var JsPlugin = class JsPlugin extends _jesscss_core.AbstractPlugin {
+	static cleanupRegistered = false;
+	static liveInstances = /* @__PURE__ */ new Set();
+	name = "js";
+	supportedExtensions = Array.from(SCRIPT_EXTENSIONS);
+	runtimeState = { status: "idle" };
+	shuttingDown = false;
+	brokerServer;
+	brokerSocketPath;
+	worker;
+	workerBuffer = "";
+	nextRequestId = 1;
+	pending = /* @__PURE__ */ new Map();
+	idleTimer;
+	/**
+	* Variable names each legacy plugin function has been observed to read,
+	* keyed by module+options+function. Prefetching them turns the steady-state
+	* call into a single round trip instead of one round trip per read.
+	*/
+	factMemo = /* @__PURE__ */ new Map();
+	constructor(opts = {}) {
+		super();
+		this.opts = opts;
+		JsPlugin.liveInstances.add(this);
+		JsPlugin.registerProcessCleanup();
+	}
+	prewarm() {
+		return this.ensureRuntime().catch(() => void 0);
+	}
+	static registerProcessCleanup() {
+		if (JsPlugin.cleanupRegistered) return;
+		JsPlugin.cleanupRegistered = true;
+		const cleanup = () => {
+			for (const instance of JsPlugin.liveInstances) try {
+				instance.dispose();
+			} catch {}
+		};
+		process.once("beforeExit", cleanup);
+		process.once("exit", cleanup);
+	}
+	clearIdleTimer() {
+		if (this.idleTimer) {
+			clearTimeout(this.idleTimer);
+			this.idleTimer = void 0;
+		}
+	}
+	scheduleIdleShutdown() {
+		this.clearIdleTimer();
+		if (this.pending.size > 0 || this.runtimeState.status !== "ready") return;
+		this.idleTimer = setTimeout(() => {
+			this.shutdown();
+			this.runtimeState = { status: "idle" };
+		}, IDLE_SHUTDOWN_MS);
+		this.idleTimer.unref?.();
+	}
+	ensureRuntimeAvailable() {
+		if ((0, node_child_process.spawnSync)(this.opts.denoCommand ?? "deno", ["--version"], {
+			stdio: "ignore",
+			env: sanitizeSpawnEnv(process.env)
+		}).status !== 0) throw new Error(RUNTIME_MISSING_MESSAGE);
+	}
+	ensureRuntime() {
+		if (this.runtimeState.status === "ready") {
+			this.clearIdleTimer();
+			return Promise.resolve();
+		}
+		if (this.runtimeState.status === "initializing") return this.runtimeState.promise;
+		if (this.runtimeState.status === "failed") return Promise.reject(this.runtimeState.error);
+		if (this.runtimeState.status === "disposed") return Promise.reject(/* @__PURE__ */ new Error("Deno worker has been disposed."));
+		const promise = this.startRuntime().then(() => {
+			this.runtimeState = { status: "ready" };
+			this.scheduleIdleShutdown();
+		}, (err) => {
+			this.runtimeState = {
+				status: "failed",
+				error: err
+			};
+			throw err;
+		});
+		this.runtimeState = {
+			status: "initializing",
+			promise
+		};
+		return promise;
+	}
+	createBrokerPath() {
+		if (process.platform === "win32") return `\\\\.\\pipe\\jess-deno-broker-${`${process.pid}-${Date.now()}-${Math.floor(Math.random() * 1e4)}`}`;
+		const rand = Math.floor(Math.random() * 1e4);
+		return `/tmp/jd-${process.pid}-${Date.now()}-${rand}.sock`;
+	}
+	isReadAllowed(value) {
+		const normalized = normalizePermissionPath(value);
+		if (!normalized) return false;
+		const requestedPath = canonicalPath(node_path.resolve(normalized));
+		const jsReadRoot = this.opts.jsReadRoot ? canonicalPath(node_path.resolve(this.opts.jsReadRoot)) : void 0;
+		if (jsReadRoot && isPathInside(requestedPath, jsReadRoot)) return true;
+		return requestedPath.includes(`${node_path.sep}node_modules${node_path.sep}`);
+	}
+	isNetAllowed(value) {
+		if (!this.opts.allowHttp) return false;
+		const allowHosts = this.opts.allowNetHosts ?? [];
+		if (allowHosts.length === 0) return true;
+		if (!value) return false;
+		const host = value.split(":")[0] ?? value;
+		return allowHosts.includes(host);
+	}
+	handleBrokerRequest(request) {
+		const deny = (reason) => ({
+			id: request.id,
+			result: "deny",
+			reason
+		});
+		switch (request.permission) {
+			case "read": return this.isReadAllowed(request.value) ? {
+				id: request.id,
+				result: "allow"
+			} : deny("Read access denied by Jess policy.");
+			case "net": return this.isNetAllowed(request.value) ? {
+				id: request.id,
+				result: "allow"
+			} : deny("Network access denied by Jess policy.");
+			case "env":
+			case "run":
+			case "ffi":
+			case "sys":
+			case "write": return deny(`${request.permission} permission denied by Jess policy.`);
+			default: return deny(`Permission "${request.permission}" denied by Jess policy.`);
+		}
+	}
+	async startBroker() {
+		const socketPath = this.createBrokerPath();
+		if (process.platform !== "win32" && node_fs.existsSync(socketPath)) node_fs.unlinkSync(socketPath);
+		const server = node_net.createServer((socket) => {
+			socket.unref();
+			let buf = "";
+			socket.setEncoding("utf8");
+			socket.on("data", (chunk) => {
+				buf += chunk;
+				let idx = buf.indexOf("\n");
+				while (idx >= 0) {
+					const line = buf.slice(0, idx).trim();
+					buf = buf.slice(idx + 1);
+					idx = buf.indexOf("\n");
+					if (!line) continue;
+					let req;
+					try {
+						req = JSON.parse(line);
+					} catch {
+						socket.write(JSON.stringify({
+							id: -1,
+							result: "deny",
+							reason: "Malformed permission request."
+						}) + "\n");
+						continue;
+					}
+					const response = this.handleBrokerRequest(req);
+					socket.write(`${JSON.stringify(response)}\n`);
+				}
+			});
+		});
+		await new Promise((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(socketPath, () => resolve());
+		});
+		server.unref();
+		this.brokerServer = server;
+		this.brokerSocketPath = socketPath;
+		return socketPath;
+	}
+	startWorker(socketPath) {
+		const denoCommand = this.opts.denoCommand ?? "deno";
+		const moduleDir = node_path.dirname((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
+		const compiledWorkerPath = node_path.join(moduleDir, "runtime-worker.js");
+		const sourceWorkerPath = node_path.join(moduleDir, "runtime-worker.ts");
+		const child = (0, node_child_process.spawn)(denoCommand, [
+			"run",
+			"--no-prompt",
+			node_fs.existsSync(compiledWorkerPath) ? compiledWorkerPath : sourceWorkerPath,
+			`--runtime-api=${this.opts.runtimeApi ?? "module"}`
+		], {
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...sanitizeSpawnEnv(process.env),
+				DENO_PERMISSION_BROKER_PATH: socketPath
+			}
+		});
+		this.worker = child;
+		child.unref();
+		unrefStream(child.stdin);
+		unrefStream(child.stdout);
+		unrefStream(child.stderr);
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => this.onWorkerStdout(chunk));
+		child.on("exit", () => {
+			this.worker = void 0;
+			if (this.shuttingDown) {
+				this.shuttingDown = false;
+				return;
+			}
+			const err = /* @__PURE__ */ new Error("Deno worker exited unexpectedly.");
+			this.rejectAllPending(err);
+			if (this.runtimeState.status !== "failed") this.runtimeState = {
+				status: "failed",
+				error: err
+			};
+		});
+		return new Promise((resolve, reject) => {
+			let stderrText = "";
+			const timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(stderrText.trim() ? `Timed out waiting for Deno worker startup.\n${stderrText.trim()}` : "Timed out waiting for Deno worker startup."));
+			}, BOOT_TIMEOUT_MS);
+			const onStderr = (chunk) => {
+				stderrText += chunk;
+			};
+			const onData = (chunk) => {
+				this.workerBuffer += chunk;
+				let idx = this.workerBuffer.indexOf("\n");
+				while (idx >= 0) {
+					const line = this.workerBuffer.slice(0, idx).trim();
+					this.workerBuffer = this.workerBuffer.slice(idx + 1);
+					idx = this.workerBuffer.indexOf("\n");
+					if (!line) continue;
+					try {
+						if (JSON.parse(line).type === "ready") {
+							clearTimeout(timer);
+							child.stdout.off("data", onData);
+							child.stderr.off("data", onStderr);
+							resolve();
+							return;
+						}
+					} catch {}
+				}
+			};
+			child.stdout.on("data", onData);
+			child.stderr.on("data", onStderr);
+			child.once("error", (err) => {
+				clearTimeout(timer);
+				child.stdout.off("data", onData);
+				child.stderr.off("data", onStderr);
+				reject(err);
+			});
+		});
+	}
+	async startRuntime() {
+		this.ensureRuntimeAvailable();
+		const socketPath = await this.startBroker();
+		try {
+			await this.startWorker(socketPath);
+		} catch (err) {
+			this.shutdown();
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+	}
+	onWorkerStdout(chunk) {
+		this.workerBuffer += chunk;
+		let idx = this.workerBuffer.indexOf("\n");
+		while (idx >= 0) {
+			const line = this.workerBuffer.slice(0, idx).trim();
+			this.workerBuffer = this.workerBuffer.slice(idx + 1);
+			idx = this.workerBuffer.indexOf("\n");
+			if (!line) continue;
+			let parsed;
+			try {
+				parsed = JSON.parse(line);
+			} catch {
+				continue;
+			}
+			if (!parsed || typeof parsed.id !== "number") continue;
+			const pending = this.pending.get(parsed.id);
+			if (!pending) continue;
+			this.pending.delete(parsed.id);
+			clearTimeout(pending.timeout);
+			pending.resolve(parsed);
+			if (this.pending.size === 0) this.scheduleIdleShutdown();
+		}
+	}
+	rejectAllPending(err) {
+		for (const pending of this.pending.values()) {
+			clearTimeout(pending.timeout);
+			pending.reject(err);
+		}
+		this.pending.clear();
+	}
+	async callWorker(request) {
+		await this.ensureRuntime();
+		this.clearIdleTimer();
+		if (!this.worker?.stdin.writable) throw new Error("Deno worker is not available.");
+		const id = this.nextRequestId++;
+		const payload = {
+			...request,
+			id
+		};
+		return await new Promise((resolve, reject) => {
+			const timeout = setTimeout(() => {
+				this.pending.delete(id);
+				reject(/* @__PURE__ */ new Error("Timed out waiting for Deno worker response."));
+			}, REQUEST_TIMEOUT_MS);
+			this.pending.set(id, {
+				resolve,
+				reject,
+				timeout
+			});
+			this.worker.stdin.write(`${JSON.stringify(payload)}\n`);
+		});
+	}
+	shutdown() {
+		this.clearIdleTimer();
+		if (this.worker && !this.worker.killed) {
+			this.shuttingDown = true;
+			this.worker.stdin.destroy();
+			this.worker.stdout.destroy();
+			this.worker.stderr.destroy();
+			this.worker.kill();
+		}
+		this.worker = void 0;
+		if (this.brokerServer) {
+			this.brokerServer.close();
+			this.brokerServer = void 0;
+		}
+		if (this.brokerSocketPath && process.platform !== "win32") try {
+			if (node_fs.existsSync(this.brokerSocketPath)) node_fs.unlinkSync(this.brokerSocketPath);
+		} catch {}
+		this.brokerSocketPath = void 0;
+	}
+	dispose() {
+		this.shutdown();
+		JsPlugin.liveInstances.delete(this);
+		this.runtimeState = { status: "disposed" };
+	}
+	assertAllowedPath(absoluteFilePath) {
+		const resolvedPath = node_path.resolve(absoluteFilePath);
+		const jsReadRoot = this.opts.jsReadRoot ? node_path.resolve(this.opts.jsReadRoot) : void 0;
+		if (!jsReadRoot) return;
+		if (isPathInside(resolvedPath, jsReadRoot)) return;
+		if (resolvedPath.includes(`${node_path.sep}node_modules${node_path.sep}`)) return;
+		throw new Error(`Script path "${resolvedPath}" is outside jsReadRoot "${jsReadRoot}"`);
+	}
+	async import(absoluteFilePath) {
+		const ext = node_path.extname(absoluteFilePath);
+		if (!SCRIPT_EXTENSIONS.has(ext)) throw new Error(`Plugin "${this.name}" cannot import "${absoluteFilePath}"`);
+		if (!isFnsPath(absoluteFilePath)) {
+			this.assertAllowedPath(absoluteFilePath);
+			await this.ensureRuntime();
+			const modulePath = node_path.resolve(absoluteFilePath);
+			const loadResult = await this.callWorker({
+				type: "load",
+				modulePath
+			});
+			if (!loadResult.ok) throw new Error(loadResult.error);
+			const moduleObject = {};
+			const exported = loadResult.exports ?? [];
+			for (const item of exported) if (item.kind === "function") moduleObject[item.name] = async (...args) => {
+				const invokeResult = await this.callWorker({
+					type: "invoke",
+					modulePath,
+					exportName: item.name,
+					args: encodeBridgeArgs(args)
+				});
+				if (!invokeResult.ok) throw new Error(invokeResult.error);
+				return decodeBridgeValue(invokeResult.value);
+			};
+			else moduleObject[item.name] = item.value;
+			return moduleObject;
+		}
+		const module = await import((0, node_url.pathToFileURL)(node_path.resolve(absoluteFilePath)).href);
+		const safeModule = {};
+		for (const [key, value] of Object.entries(module)) if (typeof value === "function" || isJsonValue(value)) safeModule[key] = value;
+		return safeModule;
+	}
+	/**
+	* Loads a legacy Less `@plugin` wrapper file in Deno Less-compat mode.
+	*
+	* @deprecated Less `@plugin` is deprecated. Prefer `@-from` for
+	* ESM-style script imports or `@-use` for Sass-module-style namespace imports.
+	*/
+	async importLessPlugin(absoluteFilePath, options = null) {
+		const ext = node_path.extname(absoluteFilePath);
+		if (!SCRIPT_EXTENSIONS.has(ext)) throw new Error(`Plugin "${this.name}" cannot import Less plugin "${absoluteFilePath}"`);
+		this.assertAllowedPath(absoluteFilePath);
+		await this.ensureRuntime();
+		const modulePath = node_path.resolve(absoluteFilePath);
+		const loadResult = await this.callWorker({
+			type: "loadLessPlugin",
+			modulePath,
+			options
+		});
+		if (!loadResult.ok) throw new PluginFunctionError(node_path.basename(modulePath), loadResult.error ?? "an unknown sandbox failure", loadResult.stack);
+		const functions = {};
+		for (const functionName of loadResult.functions ?? []) functions[functionName] = (args, capabilities) => this.invokePluginFunction(modulePath, options, functionName, normalizePluginCallArgs(args), capabilities ?? EMPTY_PLUGIN_CALL_CAPABILITIES);
+		return { functions };
+	}
+	/**
+	* Runs one legacy `@plugin` function, resolving the scope/built-in facts its
+	* body reads. The sandbox reports one unmet fact at a time; the host answers
+	* it from the LIVE call-site capabilities and replays. The names a function
+	* asked for are remembered per function, so steady-state calls ship the facts
+	* up front and complete in a single round trip.
+	*/
+	invokePluginFunction(modulePath, options, functionName, args, capabilities) {
+		const memoKey = `${modulePath} ${options ?? ""} ${functionName}`;
+		const known = this.factMemo.get(memoKey) ?? /* @__PURE__ */ new Set();
+		const facts = {
+			vars: {},
+			calls: {},
+			fileInfo: capabilities.currentFileInfo ?? null
+		};
+		for (const name of known) facts.vars[name] = this.resolveVariableFact(name, capabilities);
+		const request = {
+			type: "invokeLessPluginFunction",
+			modulePath,
+			options,
+			functionName,
+			args: encodeBridgeArgs([...args]),
+			facts
+		};
+		/**
+		* Folds one reply. Returns the decoded value, or `undefined` to signal that
+		* `facts` has been extended and the call must be replayed.
+		*/
+		const settle = (result) => {
+			for (const record of result.logs ?? []) capabilities.log?.(record);
+			if (result.ok) {
+				if (result.important) capabilities.markImportant?.();
+				return { value: decodeBridgeValue(result.value) };
+			}
+			if (!result.need) throw new PluginFunctionError(functionName, result.error ?? "an unknown sandbox failure", result.stack, result.errorName);
+			if (result.need.kind === "variable") {
+				const name = result.need.name;
+				facts.vars[name] = this.resolveVariableFact(name, capabilities);
+				known.add(name);
+				this.factMemo.set(memoKey, known);
+				return;
+			}
+			facts.calls[result.need.key] = this.resolveCallFact(result.need, capabilities);
+		};
+		const exhausted = () => new PluginFunctionError(functionName, `resolving its scope reads did not settle after ${MAX_FACT_ROUNDS} rounds.`);
+		const replay = async () => {
+			for (let round = 0; round <= MAX_FACT_ROUNDS; round++) {
+				const settled = settle(await this.callWorker(request));
+				if (settled) return settled.value;
+			}
+			throw exhausted();
+		};
+		return replay();
+	}
+	resolveVariableFact(name, capabilities) {
+		const hit = capabilities.lookupVariable?.(name);
+		if (!hit) return null;
+		return {
+			value: encodeBridgeValue(hit.value),
+			important: hit.important === true
+		};
+	}
+	resolveCallFact(need, capabilities) {
+		const decoded = need.args.map(decodeBridgeValue);
+		const answer = capabilities.callFunction?.(need.name, decoded);
+		return answer === void 0 ? null : encodeBridgeValue(answer);
+	}
+	/** Context-facing executable-plugin capability used by the direct AST path. */
+	async importPlugin(absoluteFilePath, options = null) {
+		return this.importLessPlugin(absoluteFilePath, options);
+	}
+};
+/**
+* Global flag set when @jesscss/plugin-js is loaded.
+* less-compat checks this before running @plugin scripts (scripts must be run when plugin-js/Deno is present).
+*/
+const JESS_PLUGIN_JS_GLOBAL = "__JESS_PLUGIN_JS_AVAILABLE__";
+if (typeof globalThis !== "undefined") globalThis[JESS_PLUGIN_JS_GLOBAL] = true;
+const jsPlugin = ((opts) => {
+	return new JsPlugin(opts);
+});
+//#endregion
+exports.JESS_PLUGIN_JS_GLOBAL = JESS_PLUGIN_JS_GLOBAL;
+exports.JsPlugin = JsPlugin;
+exports.PluginFunctionError = PluginFunctionError;
+exports.__toESM = __toESM;
+exports.default = jsPlugin;
+exports.sanitizeSpawnEnv = sanitizeSpawnEnv;