@jesscss/plugin-js 2.0.0-alpha.1 → 2.0.0-alpha.11

package/lib/index.js

@@ -1,442 +1,783 @@
-import { AbstractPlugin } from '@jesscss/core';
-import * as fs from 'node:fs';
-import * as net from 'node:net';
-import * as path from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { spawn, spawnSync } from 'node:child_process';
+import { AbstractPlugin } from "@jesscss/core";
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawn, spawnSync } from "node:child_process";
+import { HEX, makeColorRgb, makeDimension, makeKeyword, makeList, makeQuoted, sniffLiteral } from "@jesscss/core/value";
+//#region src/bridge.ts
+const isRecord = (value) => typeof value === "object" && value !== null;
+const isBridgeValue = (value) => isRecord(value) && value.__jessBridge === true && typeof value.kind === "string";
+const isValueObj = (value) => isRecord(value) && typeof value.type === "string" && typeof value.bytes === "string";
+const isDetached = (value) => isRecord(value) && value.type === "DetachedRuleset" && Array.isArray(value.rules);
+function encodeBridgeChildValue(value) {
+	const encoded = encodeBridgeValue(value);
+	if (isBridgeValue(encoded)) return encoded;
+	return {
+		__jessBridge: true,
+		kind: "scalar",
+		value: String(encoded)
+	};
+}
+function encodeFacadeValue(value) {
+	switch (value.type) {
+		case "Dimension": return typeof value.value === "number" ? {
+			__jessBridge: true,
+			kind: "dimension",
+			value: value.value,
+			unit: typeof value.unit === "string" ? value.unit : void 0
+		} : void 0;
+		case "Color": return Array.isArray(value.rgb) && value.rgb.length === 3 ? {
+			__jessBridge: true,
+			kind: "color",
+			rgb: [
+				value.rgb[0],
+				value.rgb[1],
+				value.rgb[2]
+			],
+			alpha: typeof value.alpha === "number" ? value.alpha : void 0
+		} : void 0;
+		case "Quoted": return typeof value.value === "string" ? {
+			__jessBridge: true,
+			kind: "quoted",
+			value: value.value,
+			quote: value.quote === "'" ? "'" : "\"",
+			escaped: value.escaped === true
+		} : void 0;
+		case "Anonymous":
+		case "Keyword": return typeof value.value === "string" ? {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.value
+		} : void 0;
+		case "Expression": return Array.isArray(value.value) ? {
+			__jessBridge: true,
+			kind: "expression",
+			items: value.value.map(encodeBridgeChildValue)
+		} : void 0;
+		case "Value": return Array.isArray(value.value) ? {
+			__jessBridge: true,
+			kind: "list",
+			items: value.value.map(encodeBridgeChildValue),
+			separator: value.separator === "/" || value.separator === ";" ? value.separator : ","
+		} : void 0;
+		case "Mixin": {
+			const ruleset = value.ruleset;
+			if (!isRecord(ruleset) || !Array.isArray(ruleset.rules)) return;
+			const rules = [];
+			for (const rule of ruleset.rules) {
+				if (!isRecord(rule)) continue;
+				if (rule.type === "Declaration" && typeof rule.name === "string") rules.push({
+					name: rule.name,
+					value: encodeBridgeChildValue(rule.value)
+				});
+			}
+			return {
+				__jessBridge: true,
+				kind: "mixin",
+				rules
+			};
+		}
+		default: return;
+	}
+}
+function encodeBridgeValue(value) {
+	if (Array.isArray(value)) return {
+		__jessBridge: true,
+		kind: "expression",
+		items: value.map(encodeBridgeChildValue)
+	};
+	if (isValueObj(value)) switch (value.type) {
+		case "Dimension": return {
+			__jessBridge: true,
+			kind: "dimension",
+			value: value.number,
+			unit: value.unit
+		};
+		case "Color": return {
+			__jessBridge: true,
+			kind: "color",
+			rgb: [
+				value.rgb[0],
+				value.rgb[1],
+				value.rgb[2]
+			],
+			alpha: value.alpha
+		};
+		case "Quoted": return {
+			__jessBridge: true,
+			kind: "quoted",
+			value: value.value,
+			quote: value.quote === "'" ? "'" : "\"",
+			escaped: value.escaped
+		};
+		case "List": return value.sep === "," || value.sep === "/" ? {
+			__jessBridge: true,
+			kind: "list",
+			items: value.value.map(encodeBridgeChildValue),
+			separator: value.sep
+		} : {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.bytes
+		};
+		case "Block": return {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.bytes
+		};
+		default: return {
+			__jessBridge: true,
+			kind: "anonymous",
+			value: value.bytes
+		};
+	}
+	if (isDetached(value)) return {
+		__jessBridge: true,
+		kind: "mixin",
+		rules: value.rules.map((rule) => ({
+			name: rule.name,
+			value: encodeBridgeChildValue(rule.value)
+		}))
+	};
+	if (isRecord(value)) return encodeFacadeValue(value) ?? value;
+	return value;
+}
+function decodeValue(value) {
+	switch (value.kind) {
+		case "scalar": return typeof value.value === "number" ? makeDimension(value.value) : sniffLiteral(String(value.value));
+		case "dimension": return makeDimension(value.value, value.unit ?? "");
+		case "color": return makeColorRgb(value.rgb, value.alpha ?? 1, HEX);
+		case "quoted": return makeQuoted(value.value, value.quote ?? "\"", value.escaped === true);
+		case "anonymous": return sniffLiteral(value.value);
+		case "expression": return value.items.map(decodeValue);
+		case "list": return makeList(value.items.map(decodeValue), value.separator === ";" ? "," : value.separator);
+		case "mixin": return makeKeyword("");
+	}
+}
+function decodeMixin(value) {
+	const nil = {
+		type: "Nil",
+		value: ""
+	};
+	const mixin = {
+		type: "Mixin",
+		name: nil,
+		args: nil,
+		ruleset: { rules: value.rules.map((rule) => ({
+			type: "Declaration",
+			name: rule.name,
+			value: decodeValue(rule.value),
+			eval() {
+				return this;
+			}
+		})) },
+		eval() {
+			return mixin;
+		}
+	};
+	return mixin;
+}
+function decodeBridgeValue(value) {
+	if (!isBridgeValue(value)) return value;
+	return value.kind === "mixin" ? decodeMixin(value) : decodeValue(value);
+}
+function encodeBridgeArgs(args) {
+	return args.map(encodeBridgeValue);
+}
+//#endregion
+//#region src/index.ts
+/**
+* A failure raised BY a `@plugin` script (its own `throw`, or a shim member it
+* cannot use), as distinct from a value the engine simply could not compute.
+* The distinction is what lets the compiler report a plugin fault loudly and
+* attributably instead of preserving the call verbatim.
+*/
+var PluginFunctionError = class extends Error {
+	functionName;
+	pluginStack;
+	originalName;
+	constructor(functionName, reason, pluginStack, originalName = "Error") {
+		super(`Less @plugin function "${functionName}" threw: ${reason}`);
+		this.name = "PluginFunctionError";
+		this.functionName = functionName;
+		this.pluginStack = pluginStack;
+		this.originalName = originalName;
+	}
+};
+/**
+* Child-process stdio streams are typed as bare `Writable`/`Readable`, which do
+* not declare `unref`, but the underlying pipe sockets expose it at runtime.
+* The optional structural member lets any stream be passed without an unsafe
+* cast; the runtime `?.` guard covers streams that genuinely lack the method.
+*/
+const unrefStream = (stream) => {
+	if (typeof stream === "object" && stream !== null && "unref" in stream && typeof stream.unref === "function") stream.unref();
+};
 const SCRIPT_EXTENSIONS = new Set([
-    '.js',
-    '.mjs',
-    '.cjs',
-    '.ts',
-    '.mts',
-    '.cts'
+	".js",
+	".mjs",
+	".cjs",
+	".ts",
+	".mts",
+	".cts"
 ]);
 const RUNTIME_MISSING_MESSAGE = [
-    'Deno runtime is required for @jesscss/plugin-js, but no usable Deno binary was found.',
-    'If using pnpm, approve build scripts for "deno" (pnpm approve-builds).',
-    'If using npm with ignored scripts, reinstall with lifecycle scripts enabled.',
-    'Or install native Deno and ensure "deno" is on PATH.'
-].join('\n');
-const BOOT_TIMEOUT_MS = 8000;
-const REQUEST_TIMEOUT_MS = 10_000;
+	"Deno runtime is required for @jesscss/plugin-js, but no usable Deno binary was found.",
+	"If using pnpm, approve build scripts for \"deno\" (pnpm approve-builds).",
+	"If using npm with ignored scripts, reinstall with lifecycle scripts enabled.",
+	"Or install native Deno and ensure \"deno\" is on PATH."
+].join("\n");
+const BOOT_TIMEOUT_MS = 8e3;
+const REQUEST_TIMEOUT_MS = 1e4;
+const IDLE_SHUTDOWN_MS = 5e3;
+/**
+* Environment variables that inject a Node.js debugger/inspector bootloader
+* into child processes (VS Code / Cursor "Auto Attach", `node --inspect`, etc.).
+*
+* These must never leak into the sandboxed Deno worker: the injected bootloader
+* tries to read the environment, the Jess Deno sandbox denies `env` permission,
+* and the worker never signals ready — producing a spurious
+* "Timed out waiting for Deno worker startup" failure. Deno does not use any of
+* these vars, so stripping them is safe.
+*/
+const DEBUG_ENV_KEY_RE = /^(NODE_OPTIONS|NODE_INSPECT|VSCODE_INSPECTOR_OPTIONS)/i;
+const DEBUG_ENV_VALUE_RE = /js-debug|bootloader/i;
+/**
+* Returns a copy of `env` with Node debugger/inspector-attach variables removed,
+* so a spawned Deno subprocess starts regardless of the parent's debug env.
+* The Deno permission sandbox is untouched; this only stops leaking the debugger
+* into it.
+*/
+const sanitizeSpawnEnv = (env = process.env) => {
+	const clean = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (DEBUG_ENV_KEY_RE.test(key)) continue;
+		if (typeof value === "string" && DEBUG_ENV_VALUE_RE.test(value)) continue;
+		clean[key] = value;
+	}
+	return clean;
+};
 const isPathInside = (candidatePath, rootPath) => {
-    const rel = path.relative(rootPath, candidatePath);
-    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+	const rel = path.relative(rootPath, candidatePath);
+	return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
 };
 const canonicalPath = (p) => {
-    try {
-        return fs.realpathSync.native(p);
-    }
-    catch {
-        return p;
-    }
+	try {
+		return fs.realpathSync.native(p);
+	} catch {
+		return p;
+	}
 };
 const normalizePermissionPath = (value) => {
-    if (!value) {
-        return null;
-    }
-    if (value.startsWith('file://')) {
-        try {
-            return fileURLToPath(value);
-        }
-        catch {
-            return value;
-        }
-    }
-    return value;
+	if (!value) return null;
+	if (value.startsWith("file://")) try {
+		return fileURLToPath(value);
+	} catch {
+		return value;
+	}
+	return value;
 };
 const isFnsPath = (importPath) => {
-    const normalized = importPath.replace(/\\/g, '/');
-    const isFnsPackagePath = /(^|\/)(@jesscss\/fns|packages\/fns)(\/|$)/.test(normalized);
-    return (normalized === '@jesscss/fns'
-        || normalized.startsWith('@jesscss/fns/')
-        || normalized === '#less'
-        || normalized.startsWith('#less/')
-        || normalized === '#sass'
-        || normalized.startsWith('#sass/')
-        || isFnsPackagePath);
+	const normalized = importPath.replace(/\\/g, "/");
+	const isFnsPackagePath = /(^|\/)(@jesscss\/fns|packages\/fns)(\/|$)/.test(normalized);
+	return normalized === "@jesscss/fns" || normalized.startsWith("@jesscss/fns/") || normalized === "#less" || normalized.startsWith("#less/") || normalized === "#sass" || normalized.startsWith("#sass/") || isFnsPackagePath;
 };
 const isJsonValue = (value) => {
-    try {
-        JSON.stringify(value);
-        return true;
-    }
-    catch {
-        return false;
-    }
+	try {
+		JSON.stringify(value);
+		return true;
+	} catch {
+		return false;
+	}
 };
-export class JsPlugin extends AbstractPlugin {
-    opts;
-    name = 'js';
-    supportedExtensions = Array.from(SCRIPT_EXTENSIONS);
-    runtimeState = { status: 'idle' };
-    brokerServer;
-    brokerSocketPath;
-    worker;
-    workerBuffer = '';
-    nextRequestId = 1;
-    pending = new Map();
-    constructor(opts = {}) {
-        super();
-        this.opts = opts;
-    }
-    prewarm() {
-        return this.ensureRuntime().catch(() => undefined);
-    }
-    ensureRuntimeAvailable() {
-        const denoCommand = this.opts.denoCommand ?? 'deno';
-        const result = spawnSync(denoCommand, ['--version'], {
-            stdio: 'ignore'
-        });
-        if (result.status !== 0) {
-            throw new Error(RUNTIME_MISSING_MESSAGE);
-        }
-    }
-    ensureRuntime() {
-        if (this.runtimeState.status === 'ready') {
-            return Promise.resolve();
-        }
-        if (this.runtimeState.status === 'initializing') {
-            return this.runtimeState.promise;
-        }
-        if (this.runtimeState.status === 'failed') {
-            return Promise.reject(this.runtimeState.error);
-        }
-        const promise = this.startRuntime().then(() => {
-            this.runtimeState = { status: 'ready' };
-        }, (err) => {
-            this.runtimeState = { status: 'failed', error: err };
-            throw err;
-        });
-        this.runtimeState = { status: 'initializing', promise };
-        return promise;
-    }
-    createBrokerPath() {
-        if (process.platform === 'win32') {
-            const rand = `${process.pid}-${Date.now()}-${Math.floor(Math.random() * 10000)}`;
-            return `\\\\.\\pipe\\jess-deno-broker-${rand}`;
-        }
-        // macOS temp dir paths can exceed unix socket limits. Keep this short.
-        const rand = Math.floor(Math.random() * 10000);
-        return `/tmp/jd-${process.pid}-${Date.now()}-${rand}.sock`;
-    }
-    isReadAllowed(value) {
-        const normalized = normalizePermissionPath(value);
-        if (!normalized) {
-            return false;
-        }
-        const requestedPath = canonicalPath(path.resolve(normalized));
-        const jsReadRoot = this.opts.jsReadRoot ? canonicalPath(path.resolve(this.opts.jsReadRoot)) : undefined;
-        if (jsReadRoot && isPathInside(requestedPath, jsReadRoot)) {
-            return true;
-        }
-        return requestedPath.includes(`${path.sep}node_modules${path.sep}`);
-    }
-    isNetAllowed(value) {
-        if (!this.opts.allowHttp) {
-            return false;
-        }
-        const allowHosts = this.opts.allowNetHosts ?? [];
-        if (allowHosts.length === 0) {
-            return true;
-        }
-        if (!value) {
-            return false;
-        }
-        const host = value.split(':')[0] ?? value;
-        return allowHosts.includes(host);
-    }
-    handleBrokerRequest(request) {
-        const deny = (reason) => ({
-            id: request.id,
-            result: 'deny',
-            reason
-        });
-        switch (request.permission) {
-            case 'read':
-                return this.isReadAllowed(request.value)
-                    ? { id: request.id, result: 'allow' }
-                    : deny('Read access denied by Jess policy.');
-            case 'net':
-                return this.isNetAllowed(request.value)
-                    ? { id: request.id, result: 'allow' }
-                    : deny('Network access denied by Jess policy.');
-            case 'env':
-            case 'run':
-            case 'ffi':
-            case 'sys':
-            case 'write':
-                return deny(`${request.permission} permission denied by Jess policy.`);
-            default:
-                return deny(`Permission "${request.permission}" denied by Jess policy.`);
-        }
-    }
-    async startBroker() {
-        const socketPath = this.createBrokerPath();
-        if (process.platform !== 'win32' && fs.existsSync(socketPath)) {
-            fs.unlinkSync(socketPath);
-        }
-        const server = net.createServer((socket) => {
-            let buf = '';
-            socket.setEncoding('utf8');
-            socket.on('data', (chunk) => {
-                buf += chunk;
-                let idx = buf.indexOf('\n');
-                while (idx >= 0) {
-                    const line = buf.slice(0, idx).trim();
-                    buf = buf.slice(idx + 1);
-                    idx = buf.indexOf('\n');
-                    if (!line) {
-                        continue;
-                    }
-                    let req;
-                    try {
-                        req = JSON.parse(line);
-                    }
-                    catch {
-                        socket.write(JSON.stringify({
-                            id: -1,
-                            result: 'deny',
-                            reason: 'Malformed permission request.'
-                        }) + '\n');
-                        continue;
-                    }
-                    const response = this.handleBrokerRequest(req);
-                    socket.write(`${JSON.stringify(response)}\n`);
-                }
-            });
-        });
-        await new Promise((resolve, reject) => {
-            server.once('error', reject);
-            server.listen(socketPath, () => resolve());
-        });
-        this.brokerServer = server;
-        this.brokerSocketPath = socketPath;
-        return socketPath;
-    }
-    startWorker(socketPath) {
-        const denoCommand = this.opts.denoCommand ?? 'deno';
-        const moduleDir = path.dirname(fileURLToPath(import.meta.url));
-        const compiledWorkerPath = path.join(moduleDir, 'runtime-worker.js');
-        const sourceWorkerPath = path.join(moduleDir, 'runtime-worker.ts');
-        const workerScriptPath = fs.existsSync(compiledWorkerPath)
-            ? compiledWorkerPath
-            : sourceWorkerPath;
-        const child = spawn(denoCommand, ['run', '--no-prompt', workerScriptPath], {
-            stdio: ['pipe', 'pipe', 'pipe'],
-            env: {
-                ...process.env,
-                DENO_PERMISSION_BROKER_PATH: socketPath
-            }
-        });
-        this.worker = child;
-        child.stdout.setEncoding('utf8');
-        child.stderr.setEncoding('utf8');
-        child.stdout.on('data', chunk => this.onWorkerStdout(chunk));
-        child.on('exit', () => {
-            const err = new Error('Deno worker exited unexpectedly.');
-            this.rejectAllPending(err);
-            if (this.runtimeState.status !== 'failed') {
-                this.runtimeState = { status: 'failed', error: err };
-            }
-        });
-        return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                reject(new Error('Timed out waiting for Deno worker startup.'));
-            }, BOOT_TIMEOUT_MS);
-            const onData = (chunk) => {
-                this.workerBuffer += chunk;
-                let idx = this.workerBuffer.indexOf('\n');
-                while (idx >= 0) {
-                    const line = this.workerBuffer.slice(0, idx).trim();
-                    this.workerBuffer = this.workerBuffer.slice(idx + 1);
-                    idx = this.workerBuffer.indexOf('\n');
-                    if (!line) {
-                        continue;
-                    }
-                    try {
-                        const parsed = JSON.parse(line);
-                        if (parsed.type === 'ready') {
-                            clearTimeout(timer);
-                            child.stdout.off('data', onData);
-                            resolve();
-                            return;
-                        }
-                    }
-                    catch {
-                        // ignore until ready payload appears
-                    }
-                }
-            };
-            child.stdout.on('data', onData);
-            child.once('error', (err) => {
-                clearTimeout(timer);
-                child.stdout.off('data', onData);
-                reject(err);
-            });
-        });
-    }
-    async startRuntime() {
-        this.ensureRuntimeAvailable();
-        const socketPath = await this.startBroker();
-        try {
-            await this.startWorker(socketPath);
-        }
-        catch (err) {
-            this.shutdown();
-            throw err instanceof Error ? err : new Error(String(err));
-        }
-    }
-    onWorkerStdout(chunk) {
-        this.workerBuffer += chunk;
-        let idx = this.workerBuffer.indexOf('\n');
-        while (idx >= 0) {
-            const line = this.workerBuffer.slice(0, idx).trim();
-            this.workerBuffer = this.workerBuffer.slice(idx + 1);
-            idx = this.workerBuffer.indexOf('\n');
-            if (!line) {
-                continue;
-            }
-            let parsed;
-            try {
-                parsed = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            if (!parsed || typeof parsed.id !== 'number') {
-                continue;
-            }
-            const pending = this.pending.get(parsed.id);
-            if (!pending) {
-                continue;
-            }
-            this.pending.delete(parsed.id);
-            clearTimeout(pending.timeout);
-            pending.resolve(parsed);
-        }
-    }
-    rejectAllPending(err) {
-        for (const pending of this.pending.values()) {
-            clearTimeout(pending.timeout);
-            pending.reject(err);
-        }
-        this.pending.clear();
-    }
-    async callWorker(request) {
-        await this.ensureRuntime();
-        if (!this.worker || !this.worker.stdin.writable) {
-            throw new Error('Deno worker is not available.');
-        }
-        const id = this.nextRequestId++;
-        const payload = { ...request, id };
-        return await new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-                this.pending.delete(id);
-                reject(new Error('Timed out waiting for Deno worker response.'));
-            }, REQUEST_TIMEOUT_MS);
-            this.pending.set(id, { resolve, reject, timeout });
-            this.worker.stdin.write(`${JSON.stringify(payload)}\n`);
-        });
-    }
-    shutdown() {
-        if (this.worker && !this.worker.killed) {
-            this.worker.kill();
-        }
-        this.worker = undefined;
-        if (this.brokerServer) {
-            this.brokerServer.close();
-            this.brokerServer = undefined;
-        }
-        if (this.brokerSocketPath && process.platform !== 'win32') {
-            try {
-                if (fs.existsSync(this.brokerSocketPath)) {
-                    fs.unlinkSync(this.brokerSocketPath);
-                }
-            }
-            catch {
-                // ignore
-            }
-        }
-        this.brokerSocketPath = undefined;
-    }
-    dispose() {
-        this.shutdown();
-        this.runtimeState = { status: 'idle' };
-    }
-    assertAllowedPath(absoluteFilePath) {
-        const resolvedPath = path.resolve(absoluteFilePath);
-        const jsReadRoot = this.opts.jsReadRoot ? path.resolve(this.opts.jsReadRoot) : undefined;
-        if (!jsReadRoot) {
-            return;
-        }
-        if (isPathInside(resolvedPath, jsReadRoot)) {
-            return;
-        }
-        // pnpm layouts may resolve package files outside project root.
-        if (resolvedPath.includes(`${path.sep}node_modules${path.sep}`)) {
-            return;
-        }
-        throw new Error(`Script path "${resolvedPath}" is outside jsReadRoot "${jsReadRoot}"`);
-    }
-    async import(absoluteFilePath) {
-        const ext = path.extname(absoluteFilePath);
-        if (!SCRIPT_EXTENSIONS.has(ext)) {
-            throw new Error(`Plugin "${this.name}" cannot import "${absoluteFilePath}"`);
-        }
-        if (!isFnsPath(absoluteFilePath)) {
-            this.assertAllowedPath(absoluteFilePath);
-            await this.ensureRuntime();
-            const modulePath = path.resolve(absoluteFilePath);
-            const loadResult = await this.callWorker({ type: 'load', modulePath });
-            if (!loadResult.ok) {
-                throw new Error(loadResult.error);
-            }
-            const moduleObject = {};
-            const exported = loadResult.exports ?? [];
-            for (const item of exported) {
-                if (item.kind === 'function') {
-                    moduleObject[item.name] = async (...args) => {
-                        const invokeResult = await this.callWorker({
-                            type: 'invoke',
-                            modulePath,
-                            exportName: item.name,
-                            args
-                        });
-                        if (!invokeResult.ok) {
-                            throw new Error(invokeResult.error);
-                        }
-                        return invokeResult.value;
-                    };
-                }
-                else {
-                    moduleObject[item.name] = item.value;
-                }
-            }
-            return moduleObject;
-        }
-        const modulePath = pathToFileURL(path.resolve(absoluteFilePath)).href;
-        const module = await import(modulePath);
-        const safeModule = {};
-        for (const [key, value] of Object.entries(module)) {
-            if (typeof value === 'function' || isJsonValue(value)) {
-                safeModule[key] = value;
-            }
-        }
-        return safeModule;
-    }
-}
 /**
- * Global flag set when @jesscss/plugin-js is loaded.
- * less-compat checks this before running @plugin scripts (scripts must be run when plugin-js/Deno is present).
- */
-export const JESS_PLUGIN_JS_GLOBAL = '__JESS_PLUGIN_JS_AVAILABLE__';
-if (typeof globalThis !== 'undefined') {
-    globalThis[JESS_PLUGIN_JS_GLOBAL] = true;
+* Ceiling on resolve-and-replay rounds for a single call. Each round satisfies
+* exactly one fact, so this also bounds a pathological plugin that asks for an
+* unbounded number of distinct variables.
+*/
+const MAX_FACT_ROUNDS = 64;
+const EMPTY_PLUGIN_CALL_CAPABILITIES = {};
+function normalizePluginCallArgs(args) {
+	if (args === void 0) return [];
+	return Array.isArray(args) ? args : [args];
 }
+var JsPlugin = class JsPlugin extends AbstractPlugin {
+	static cleanupRegistered = false;
+	static liveInstances = /* @__PURE__ */ new Set();
+	name = "js";
+	supportedExtensions = Array.from(SCRIPT_EXTENSIONS);
+	runtimeState = { status: "idle" };
+	shuttingDown = false;
+	brokerServer;
+	brokerSocketPath;
+	worker;
+	workerBuffer = "";
+	nextRequestId = 1;
+	pending = /* @__PURE__ */ new Map();
+	idleTimer;
+	/**
+	* Variable names each legacy plugin function has been observed to read,
+	* keyed by module+options+function. Prefetching them turns the steady-state
+	* call into a single round trip instead of one round trip per read.
+	*/
+	factMemo = /* @__PURE__ */ new Map();
+	constructor(opts = {}) {
+		super();
+		this.opts = opts;
+		JsPlugin.liveInstances.add(this);
+		JsPlugin.registerProcessCleanup();
+	}
+	prewarm() {
+		return this.ensureRuntime().catch(() => void 0);
+	}
+	static registerProcessCleanup() {
+		if (JsPlugin.cleanupRegistered) return;
+		JsPlugin.cleanupRegistered = true;
+		const cleanup = () => {
+			for (const instance of JsPlugin.liveInstances) try {
+				instance.dispose();
+			} catch {}
+		};
+		process.once("beforeExit", cleanup);
+		process.once("exit", cleanup);
+	}
+	clearIdleTimer() {
+		if (this.idleTimer) {
+			clearTimeout(this.idleTimer);
+			this.idleTimer = void 0;
+		}
+	}
+	scheduleIdleShutdown() {
+		this.clearIdleTimer();
+		if (this.pending.size > 0 || this.runtimeState.status !== "ready") return;
+		this.idleTimer = setTimeout(() => {
+			this.shutdown();
+			this.runtimeState = { status: "idle" };
+		}, IDLE_SHUTDOWN_MS);
+		this.idleTimer.unref?.();
+	}
+	ensureRuntimeAvailable() {
+		if (spawnSync(this.opts.denoCommand ?? "deno", ["--version"], {
+			stdio: "ignore",
+			env: sanitizeSpawnEnv(process.env)
+		}).status !== 0) throw new Error(RUNTIME_MISSING_MESSAGE);
+	}
+	ensureRuntime() {
+		if (this.runtimeState.status === "ready") {
+			this.clearIdleTimer();
+			return Promise.resolve();
+		}
+		if (this.runtimeState.status === "initializing") return this.runtimeState.promise;
+		if (this.runtimeState.status === "failed") return Promise.reject(this.runtimeState.error);
+		if (this.runtimeState.status === "disposed") return Promise.reject(/* @__PURE__ */ new Error("Deno worker has been disposed."));
+		const promise = this.startRuntime().then(() => {
+			this.runtimeState = { status: "ready" };
+			this.scheduleIdleShutdown();
+		}, (err) => {
+			this.runtimeState = {
+				status: "failed",
+				error: err
+			};
+			throw err;
+		});
+		this.runtimeState = {
+			status: "initializing",
+			promise
+		};
+		return promise;
+	}
+	createBrokerPath() {
+		if (process.platform === "win32") return `\\\\.\\pipe\\jess-deno-broker-${`${process.pid}-${Date.now()}-${Math.floor(Math.random() * 1e4)}`}`;
+		const rand = Math.floor(Math.random() * 1e4);
+		return `/tmp/jd-${process.pid}-${Date.now()}-${rand}.sock`;
+	}
+	isReadAllowed(value) {
+		const normalized = normalizePermissionPath(value);
+		if (!normalized) return false;
+		const requestedPath = canonicalPath(path.resolve(normalized));
+		const jsReadRoot = this.opts.jsReadRoot ? canonicalPath(path.resolve(this.opts.jsReadRoot)) : void 0;
+		if (jsReadRoot && isPathInside(requestedPath, jsReadRoot)) return true;
+		return requestedPath.includes(`${path.sep}node_modules${path.sep}`);
+	}
+	isNetAllowed(value) {
+		if (!this.opts.allowHttp) return false;
+		const allowHosts = this.opts.allowNetHosts ?? [];
+		if (allowHosts.length === 0) return true;
+		if (!value) return false;
+		const host = value.split(":")[0] ?? value;
+		return allowHosts.includes(host);
+	}
+	handleBrokerRequest(request) {
+		const deny = (reason) => ({
+			id: request.id,
+			result: "deny",
+			reason
+		});
+		switch (request.permission) {
+			case "read": return this.isReadAllowed(request.value) ? {
+				id: request.id,
+				result: "allow"
+			} : deny("Read access denied by Jess policy.");
+			case "net": return this.isNetAllowed(request.value) ? {
+				id: request.id,
+				result: "allow"
+			} : deny("Network access denied by Jess policy.");
+			case "env":
+			case "run":
+			case "ffi":
+			case "sys":
+			case "write": return deny(`${request.permission} permission denied by Jess policy.`);
+			default: return deny(`Permission "${request.permission}" denied by Jess policy.`);
+		}
+	}
+	async startBroker() {
+		const socketPath = this.createBrokerPath();
+		if (process.platform !== "win32" && fs.existsSync(socketPath)) fs.unlinkSync(socketPath);
+		const server = net.createServer((socket) => {
+			socket.unref();
+			let buf = "";
+			socket.setEncoding("utf8");
+			socket.on("data", (chunk) => {
+				buf += chunk;
+				let idx = buf.indexOf("\n");
+				while (idx >= 0) {
+					const line = buf.slice(0, idx).trim();
+					buf = buf.slice(idx + 1);
+					idx = buf.indexOf("\n");
+					if (!line) continue;
+					let req;
+					try {
+						req = JSON.parse(line);
+					} catch {
+						socket.write(JSON.stringify({
+							id: -1,
+							result: "deny",
+							reason: "Malformed permission request."
+						}) + "\n");
+						continue;
+					}
+					const response = this.handleBrokerRequest(req);
+					socket.write(`${JSON.stringify(response)}\n`);
+				}
+			});
+		});
+		await new Promise((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(socketPath, () => resolve());
+		});
+		server.unref();
+		this.brokerServer = server;
+		this.brokerSocketPath = socketPath;
+		return socketPath;
+	}
+	startWorker(socketPath) {
+		const denoCommand = this.opts.denoCommand ?? "deno";
+		const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+		const compiledWorkerPath = path.join(moduleDir, "runtime-worker.js");
+		const sourceWorkerPath = path.join(moduleDir, "runtime-worker.ts");
+		const child = spawn(denoCommand, [
+			"run",
+			"--no-prompt",
+			fs.existsSync(compiledWorkerPath) ? compiledWorkerPath : sourceWorkerPath,
+			`--runtime-api=${this.opts.runtimeApi ?? "module"}`
+		], {
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...sanitizeSpawnEnv(process.env),
+				DENO_PERMISSION_BROKER_PATH: socketPath
+			}
+		});
+		this.worker = child;
+		child.unref();
+		unrefStream(child.stdin);
+		unrefStream(child.stdout);
+		unrefStream(child.stderr);
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => this.onWorkerStdout(chunk));
+		child.on("exit", () => {
+			this.worker = void 0;
+			if (this.shuttingDown) {
+				this.shuttingDown = false;
+				return;
+			}
+			const err = /* @__PURE__ */ new Error("Deno worker exited unexpectedly.");
+			this.rejectAllPending(err);
+			if (this.runtimeState.status !== "failed") this.runtimeState = {
+				status: "failed",
+				error: err
+			};
+		});
+		return new Promise((resolve, reject) => {
+			let stderrText = "";
+			const timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(stderrText.trim() ? `Timed out waiting for Deno worker startup.\n${stderrText.trim()}` : "Timed out waiting for Deno worker startup."));
+			}, BOOT_TIMEOUT_MS);
+			const onStderr = (chunk) => {
+				stderrText += chunk;
+			};
+			const onData = (chunk) => {
+				this.workerBuffer += chunk;
+				let idx = this.workerBuffer.indexOf("\n");
+				while (idx >= 0) {
+					const line = this.workerBuffer.slice(0, idx).trim();
+					this.workerBuffer = this.workerBuffer.slice(idx + 1);
+					idx = this.workerBuffer.indexOf("\n");
+					if (!line) continue;
+					try {
+						if (JSON.parse(line).type === "ready") {
+							clearTimeout(timer);
+							child.stdout.off("data", onData);
+							child.stderr.off("data", onStderr);
+							resolve();
+							return;
+						}
+					} catch {}
+				}
+			};
+			child.stdout.on("data", onData);
+			child.stderr.on("data", onStderr);
+			child.once("error", (err) => {
+				clearTimeout(timer);
+				child.stdout.off("data", onData);
+				child.stderr.off("data", onStderr);
+				reject(err);
+			});
+		});
+	}
+	async startRuntime() {
+		this.ensureRuntimeAvailable();
+		const socketPath = await this.startBroker();
+		try {
+			await this.startWorker(socketPath);
+		} catch (err) {
+			this.shutdown();
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+	}
+	onWorkerStdout(chunk) {
+		this.workerBuffer += chunk;
+		let idx = this.workerBuffer.indexOf("\n");
+		while (idx >= 0) {
+			const line = this.workerBuffer.slice(0, idx).trim();
+			this.workerBuffer = this.workerBuffer.slice(idx + 1);
+			idx = this.workerBuffer.indexOf("\n");
+			if (!line) continue;
+			let parsed;
+			try {
+				parsed = JSON.parse(line);
+			} catch {
+				continue;
+			}
+			if (!parsed || typeof parsed.id !== "number") continue;
+			const pending = this.pending.get(parsed.id);
+			if (!pending) continue;
+			this.pending.delete(parsed.id);
+			clearTimeout(pending.timeout);
+			pending.resolve(parsed);
+			if (this.pending.size === 0) this.scheduleIdleShutdown();
+		}
+	}
+	rejectAllPending(err) {
+		for (const pending of this.pending.values()) {
+			clearTimeout(pending.timeout);
+			pending.reject(err);
+		}
+		this.pending.clear();
+	}
+	async callWorker(request) {
+		await this.ensureRuntime();
+		this.clearIdleTimer();
+		if (!this.worker?.stdin.writable) throw new Error("Deno worker is not available.");
+		const id = this.nextRequestId++;
+		const payload = {
+			...request,
+			id
+		};
+		return await new Promise((resolve, reject) => {
+			const timeout = setTimeout(() => {
+				this.pending.delete(id);
+				reject(/* @__PURE__ */ new Error("Timed out waiting for Deno worker response."));
+			}, REQUEST_TIMEOUT_MS);
+			this.pending.set(id, {
+				resolve,
+				reject,
+				timeout
+			});
+			this.worker.stdin.write(`${JSON.stringify(payload)}\n`);
+		});
+	}
+	shutdown() {
+		this.clearIdleTimer();
+		if (this.worker && !this.worker.killed) {
+			this.shuttingDown = true;
+			this.worker.stdin.destroy();
+			this.worker.stdout.destroy();
+			this.worker.stderr.destroy();
+			this.worker.kill();
+		}
+		this.worker = void 0;
+		if (this.brokerServer) {
+			this.brokerServer.close();
+			this.brokerServer = void 0;
+		}
+		if (this.brokerSocketPath && process.platform !== "win32") try {
+			if (fs.existsSync(this.brokerSocketPath)) fs.unlinkSync(this.brokerSocketPath);
+		} catch {}
+		this.brokerSocketPath = void 0;
+	}
+	dispose() {
+		this.shutdown();
+		JsPlugin.liveInstances.delete(this);
+		this.runtimeState = { status: "disposed" };
+	}
+	assertAllowedPath(absoluteFilePath) {
+		const resolvedPath = path.resolve(absoluteFilePath);
+		const jsReadRoot = this.opts.jsReadRoot ? path.resolve(this.opts.jsReadRoot) : void 0;
+		if (!jsReadRoot) return;
+		if (isPathInside(resolvedPath, jsReadRoot)) return;
+		if (resolvedPath.includes(`${path.sep}node_modules${path.sep}`)) return;
+		throw new Error(`Script path "${resolvedPath}" is outside jsReadRoot "${jsReadRoot}"`);
+	}
+	async import(absoluteFilePath) {
+		const ext = path.extname(absoluteFilePath);
+		if (!SCRIPT_EXTENSIONS.has(ext)) throw new Error(`Plugin "${this.name}" cannot import "${absoluteFilePath}"`);
+		if (!isFnsPath(absoluteFilePath)) {
+			this.assertAllowedPath(absoluteFilePath);
+			await this.ensureRuntime();
+			const modulePath = path.resolve(absoluteFilePath);
+			const loadResult = await this.callWorker({
+				type: "load",
+				modulePath
+			});
+			if (!loadResult.ok) throw new Error(loadResult.error);
+			const moduleObject = {};
+			const exported = loadResult.exports ?? [];
+			for (const item of exported) if (item.kind === "function") moduleObject[item.name] = async (...args) => {
+				const invokeResult = await this.callWorker({
+					type: "invoke",
+					modulePath,
+					exportName: item.name,
+					args: encodeBridgeArgs(args)
+				});
+				if (!invokeResult.ok) throw new Error(invokeResult.error);
+				return decodeBridgeValue(invokeResult.value);
+			};
+			else moduleObject[item.name] = item.value;
+			return moduleObject;
+		}
+		const module = await import(pathToFileURL(path.resolve(absoluteFilePath)).href);
+		const safeModule = {};
+		for (const [key, value] of Object.entries(module)) if (typeof value === "function" || isJsonValue(value)) safeModule[key] = value;
+		return safeModule;
+	}
+	/**
+	* Loads a legacy Less `@plugin` wrapper file in Deno Less-compat mode.
+	*
+	* @deprecated Less `@plugin` is deprecated. Prefer `@-from` for
+	* ESM-style script imports or `@-use` for Sass-module-style namespace imports.
+	*/
+	async importLessPlugin(absoluteFilePath, options = null) {
+		const ext = path.extname(absoluteFilePath);
+		if (!SCRIPT_EXTENSIONS.has(ext)) throw new Error(`Plugin "${this.name}" cannot import Less plugin "${absoluteFilePath}"`);
+		this.assertAllowedPath(absoluteFilePath);
+		await this.ensureRuntime();
+		const modulePath = path.resolve(absoluteFilePath);
+		const loadResult = await this.callWorker({
+			type: "loadLessPlugin",
+			modulePath,
+			options
+		});
+		if (!loadResult.ok) throw new PluginFunctionError(path.basename(modulePath), loadResult.error ?? "an unknown sandbox failure", loadResult.stack);
+		const functions = {};
+		for (const functionName of loadResult.functions ?? []) functions[functionName] = (args, capabilities) => this.invokePluginFunction(modulePath, options, functionName, normalizePluginCallArgs(args), capabilities ?? EMPTY_PLUGIN_CALL_CAPABILITIES);
+		return { functions };
+	}
+	/**
+	* Runs one legacy `@plugin` function, resolving the scope/built-in facts its
+	* body reads. The sandbox reports one unmet fact at a time; the host answers
+	* it from the LIVE call-site capabilities and replays. The names a function
+	* asked for are remembered per function, so steady-state calls ship the facts
+	* up front and complete in a single round trip.
+	*/
+	invokePluginFunction(modulePath, options, functionName, args, capabilities) {
+		const memoKey = `${modulePath} ${options ?? ""} ${functionName}`;
+		const known = this.factMemo.get(memoKey) ?? /* @__PURE__ */ new Set();
+		const facts = {
+			vars: {},
+			calls: {},
+			fileInfo: capabilities.currentFileInfo ?? null
+		};
+		for (const name of known) facts.vars[name] = this.resolveVariableFact(name, capabilities);
+		const request = {
+			type: "invokeLessPluginFunction",
+			modulePath,
+			options,
+			functionName,
+			args: encodeBridgeArgs([...args]),
+			facts
+		};
+		/**
+		* Folds one reply. Returns the decoded value, or `undefined` to signal that
+		* `facts` has been extended and the call must be replayed.
+		*/
+		const settle = (result) => {
+			for (const record of result.logs ?? []) capabilities.log?.(record);
+			if (result.ok) {
+				if (result.important) capabilities.markImportant?.();
+				return { value: decodeBridgeValue(result.value) };
+			}
+			if (!result.need) throw new PluginFunctionError(functionName, result.error ?? "an unknown sandbox failure", result.stack, result.errorName);
+			if (result.need.kind === "variable") {
+				const name = result.need.name;
+				facts.vars[name] = this.resolveVariableFact(name, capabilities);
+				known.add(name);
+				this.factMemo.set(memoKey, known);
+				return;
+			}
+			facts.calls[result.need.key] = this.resolveCallFact(result.need, capabilities);
+		};
+		const exhausted = () => new PluginFunctionError(functionName, `resolving its scope reads did not settle after ${MAX_FACT_ROUNDS} rounds.`);
+		const replay = async () => {
+			for (let round = 0; round <= MAX_FACT_ROUNDS; round++) {
+				const settled = settle(await this.callWorker(request));
+				if (settled) return settled.value;
+			}
+			throw exhausted();
+		};
+		return replay();
+	}
+	resolveVariableFact(name, capabilities) {
+		const hit = capabilities.lookupVariable?.(name);
+		if (!hit) return null;
+		return {
+			value: encodeBridgeValue(hit.value),
+			important: hit.important === true
+		};
+	}
+	resolveCallFact(need, capabilities) {
+		const decoded = need.args.map(decodeBridgeValue);
+		const answer = capabilities.callFunction?.(need.name, decoded);
+		return answer === void 0 ? null : encodeBridgeValue(answer);
+	}
+	/** Context-facing executable-plugin capability used by the direct AST path. */
+	async importPlugin(absoluteFilePath, options = null) {
+		return this.importLessPlugin(absoluteFilePath, options);
+	}
+};
+/**
+* Global flag set when @jesscss/plugin-js is loaded.
+* less-compat checks this before running @plugin scripts (scripts must be run when plugin-js/Deno is present).
+*/
+const JESS_PLUGIN_JS_GLOBAL = "__JESS_PLUGIN_JS_AVAILABLE__";
+if (typeof globalThis !== "undefined") globalThis[JESS_PLUGIN_JS_GLOBAL] = true;
 const jsPlugin = ((opts) => {
-    return new JsPlugin(opts);
+	return new JsPlugin(opts);
 });
-export default jsPlugin;
-//# sourceMappingURL=index.js.map
+//#endregion
+export { JESS_PLUGIN_JS_GLOBAL, JsPlugin, PluginFunctionError, jsPlugin as default, sanitizeSpawnEnv };