@jesscss/plugin-js 2.0.0-alpha.5 → 2.0.0-alpha.7

package/lib/index.js

@@ -1,442 +1,557 @@
-import { AbstractPlugin } from '@jesscss/core';
-import * as fs from 'node:fs';
-import * as net from 'node:net';
-import * as path from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { spawn, spawnSync } from 'node:child_process';
+import { AbstractPlugin, Any, Color, ColorFormat, Declaration, Dimension, List, Quoted, Rules, Sequence } from "@jesscss/core";
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawn, spawnSync } from "node:child_process";
+//#region src/bridge.ts
+const isBridgeValue = (value) => typeof value === "object" && value !== null && value.__jessBridge === true && typeof value.kind === "string";
+const colorFormatFromString = (value) => {
+	if (!value) return;
+	if (value in ColorFormat) return ColorFormat[value];
+	if (Object.values(ColorFormat).includes(value)) return value;
+};
+function encodeBridgeChildValue(value) {
+	const encoded = encodeBridgeValue(value);
+	if (isBridgeValue(encoded)) return encoded;
+	return {
+		__jessBridge: true,
+		kind: "scalar",
+		value: typeof encoded === "string" || typeof encoded === "number" || typeof encoded === "boolean" ? encoded : String(encoded)
+	};
+}
+function encodeBridgeValue(value) {
+	if (value instanceof Dimension) return {
+		__jessBridge: true,
+		kind: "dimension",
+		value: value.number,
+		unit: value.unit
+	};
+	if (value instanceof Color) return {
+		__jessBridge: true,
+		kind: "color",
+		rgb: value.rgb,
+		alpha: value.alpha,
+		format: value.options.format === void 0 ? void 0 : ColorFormat[value.options.format]
+	};
+	if (value instanceof Quoted) return {
+		__jessBridge: true,
+		kind: "quoted",
+		value: String(value.value),
+		quote: value.quote,
+		escaped: value.escaped
+	};
+	if (value instanceof Any) return {
+		__jessBridge: true,
+		kind: value.role === "keyword" ? "keyword" : "anonymous",
+		value: value.value
+	};
+	if (value instanceof List) return {
+		__jessBridge: true,
+		kind: "list",
+		items: value.value.map(encodeBridgeChildValue),
+		separator: value.options.sep
+	};
+	if (value instanceof Sequence) return {
+		__jessBridge: true,
+		kind: "sequence",
+		items: value.value.map(encodeBridgeChildValue)
+	};
+	if (value instanceof Rules) {
+		const rules = [];
+		for (const rule of value.rules ?? []) if (rule instanceof Declaration && typeof rule.name === "string") rules.push({
+			name: rule.name,
+			value: encodeBridgeChildValue(rule.value)
+		});
+		return {
+			__jessBridge: true,
+			kind: "detached",
+			rules
+		};
+	}
+	return value;
+}
+function decodeBridgeValue(value) {
+	if (!isBridgeValue(value)) return value;
+	switch (value.kind) {
+		case "scalar": return new Any(String(value.value));
+		case "dimension": return new Dimension({
+			number: value.value,
+			unit: value.unit
+		});
+		case "color": return new Color({
+			rgb: value.rgb,
+			alpha: value.alpha
+		}, { format: colorFormatFromString(value.format) });
+		case "quoted": return new Quoted(value.value, {
+			quote: value.quote,
+			escaped: value.escaped
+		});
+		case "keyword": return new Any(value.value, { role: "keyword" });
+		case "anonymous": return new Any(value.value);
+		case "list": return new List(value.items.map((item) => decodeBridgeValue(item)), { sep: value.separator });
+		case "sequence": return new Sequence(value.items.map((item) => decodeBridgeValue(item)));
+	}
+}
+function encodeBridgeArgs(args) {
+	return args.map(encodeBridgeValue);
+}
+//#endregion
+//#region src/index.ts
 const SCRIPT_EXTENSIONS = new Set([
-    '.js',
-    '.mjs',
-    '.cjs',
-    '.ts',
-    '.mts',
-    '.cts'
+	".js",
+	".mjs",
+	".cjs",
+	".ts",
+	".mts",
+	".cts"
 ]);
 const RUNTIME_MISSING_MESSAGE = [
-    'Deno runtime is required for @jesscss/plugin-js, but no usable Deno binary was found.',
-    'If using pnpm, approve build scripts for "deno" (pnpm approve-builds).',
-    'If using npm with ignored scripts, reinstall with lifecycle scripts enabled.',
-    'Or install native Deno and ensure "deno" is on PATH.'
-].join('\n');
-const BOOT_TIMEOUT_MS = 8000;
-const REQUEST_TIMEOUT_MS = 10_000;
+	"Deno runtime is required for @jesscss/plugin-js, but no usable Deno binary was found.",
+	"If using pnpm, approve build scripts for \"deno\" (pnpm approve-builds).",
+	"If using npm with ignored scripts, reinstall with lifecycle scripts enabled.",
+	"Or install native Deno and ensure \"deno\" is on PATH."
+].join("\n");
+const BOOT_TIMEOUT_MS = 8e3;
+const REQUEST_TIMEOUT_MS = 1e4;
+const IDLE_SHUTDOWN_MS = 5e3;
 const isPathInside = (candidatePath, rootPath) => {
-    const rel = path.relative(rootPath, candidatePath);
-    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+	const rel = path.relative(rootPath, candidatePath);
+	return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
 };
 const canonicalPath = (p) => {
-    try {
-        return fs.realpathSync.native(p);
-    }
-    catch {
-        return p;
-    }
+	try {
+		return fs.realpathSync.native(p);
+	} catch {
+		return p;
+	}
 };
 const normalizePermissionPath = (value) => {
-    if (!value) {
-        return null;
-    }
-    if (value.startsWith('file://')) {
-        try {
-            return fileURLToPath(value);
-        }
-        catch {
-            return value;
-        }
-    }
-    return value;
+	if (!value) return null;
+	if (value.startsWith("file://")) try {
+		return fileURLToPath(value);
+	} catch {
+		return value;
+	}
+	return value;
 };
 const isFnsPath = (importPath) => {
-    const normalized = importPath.replace(/\\/g, '/');
-    const isFnsPackagePath = /(^|\/)(@jesscss\/fns|packages\/fns)(\/|$)/.test(normalized);
-    return (normalized === '@jesscss/fns'
-        || normalized.startsWith('@jesscss/fns/')
-        || normalized === '#less'
-        || normalized.startsWith('#less/')
-        || normalized === '#sass'
-        || normalized.startsWith('#sass/')
-        || isFnsPackagePath);
+	const normalized = importPath.replace(/\\/g, "/");
+	const isFnsPackagePath = /(^|\/)(@jesscss\/fns|packages\/fns)(\/|$)/.test(normalized);
+	return normalized === "@jesscss/fns" || normalized.startsWith("@jesscss/fns/") || normalized === "#less" || normalized.startsWith("#less/") || normalized === "#sass" || normalized.startsWith("#sass/") || isFnsPackagePath;
 };
 const isJsonValue = (value) => {
-    try {
-        JSON.stringify(value);
-        return true;
-    }
-    catch {
-        return false;
-    }
+	try {
+		JSON.stringify(value);
+		return true;
+	} catch {
+		return false;
+	}
+};
+var JsPlugin = class JsPlugin extends AbstractPlugin {
+	static cleanupRegistered = false;
+	static liveInstances = /* @__PURE__ */ new Set();
+	name = "js";
+	supportedExtensions = Array.from(SCRIPT_EXTENSIONS);
+	runtimeState = { status: "idle" };
+	shuttingDown = false;
+	brokerServer;
+	brokerSocketPath;
+	worker;
+	workerBuffer = "";
+	nextRequestId = 1;
+	pending = /* @__PURE__ */ new Map();
+	idleTimer;
+	constructor(opts = {}) {
+		super();
+		this.opts = opts;
+		JsPlugin.liveInstances.add(this);
+		JsPlugin.registerProcessCleanup();
+	}
+	prewarm() {
+		return this.ensureRuntime().catch(() => void 0);
+	}
+	static registerProcessCleanup() {
+		if (JsPlugin.cleanupRegistered) return;
+		JsPlugin.cleanupRegistered = true;
+		const cleanup = () => {
+			for (const instance of JsPlugin.liveInstances) try {
+				instance.dispose();
+			} catch {}
+		};
+		process.once("beforeExit", cleanup);
+		process.once("exit", cleanup);
+	}
+	clearIdleTimer() {
+		if (this.idleTimer) {
+			clearTimeout(this.idleTimer);
+			this.idleTimer = void 0;
+		}
+	}
+	scheduleIdleShutdown() {
+		this.clearIdleTimer();
+		if (this.pending.size > 0 || this.runtimeState.status !== "ready") return;
+		this.idleTimer = setTimeout(() => {
+			this.shutdown();
+			this.runtimeState = { status: "idle" };
+		}, IDLE_SHUTDOWN_MS);
+		this.idleTimer.unref?.();
+	}
+	ensureRuntimeAvailable() {
+		if (spawnSync(this.opts.denoCommand ?? "deno", ["--version"], { stdio: "ignore" }).status !== 0) throw new Error(RUNTIME_MISSING_MESSAGE);
+	}
+	ensureRuntime() {
+		if (this.runtimeState.status === "ready") {
+			this.clearIdleTimer();
+			return Promise.resolve();
+		}
+		if (this.runtimeState.status === "initializing") return this.runtimeState.promise;
+		if (this.runtimeState.status === "failed") return Promise.reject(this.runtimeState.error);
+		if (this.runtimeState.status === "disposed") return Promise.reject(/* @__PURE__ */ new Error("Deno worker has been disposed."));
+		const promise = this.startRuntime().then(() => {
+			this.runtimeState = { status: "ready" };
+			this.scheduleIdleShutdown();
+		}, (err) => {
+			this.runtimeState = {
+				status: "failed",
+				error: err
+			};
+			throw err;
+		});
+		this.runtimeState = {
+			status: "initializing",
+			promise
+		};
+		return promise;
+	}
+	createBrokerPath() {
+		if (process.platform === "win32") return `\\\\.\\pipe\\jess-deno-broker-${`${process.pid}-${Date.now()}-${Math.floor(Math.random() * 1e4)}`}`;
+		const rand = Math.floor(Math.random() * 1e4);
+		return `/tmp/jd-${process.pid}-${Date.now()}-${rand}.sock`;
+	}
+	isReadAllowed(value) {
+		const normalized = normalizePermissionPath(value);
+		if (!normalized) return false;
+		const requestedPath = canonicalPath(path.resolve(normalized));
+		const jsReadRoot = this.opts.jsReadRoot ? canonicalPath(path.resolve(this.opts.jsReadRoot)) : void 0;
+		if (jsReadRoot && isPathInside(requestedPath, jsReadRoot)) return true;
+		return requestedPath.includes(`${path.sep}node_modules${path.sep}`);
+	}
+	isNetAllowed(value) {
+		if (!this.opts.allowHttp) return false;
+		const allowHosts = this.opts.allowNetHosts ?? [];
+		if (allowHosts.length === 0) return true;
+		if (!value) return false;
+		const host = value.split(":")[0] ?? value;
+		return allowHosts.includes(host);
+	}
+	handleBrokerRequest(request) {
+		const deny = (reason) => ({
+			id: request.id,
+			result: "deny",
+			reason
+		});
+		switch (request.permission) {
+			case "read": return this.isReadAllowed(request.value) ? {
+				id: request.id,
+				result: "allow"
+			} : deny("Read access denied by Jess policy.");
+			case "net": return this.isNetAllowed(request.value) ? {
+				id: request.id,
+				result: "allow"
+			} : deny("Network access denied by Jess policy.");
+			case "env":
+			case "run":
+			case "ffi":
+			case "sys":
+			case "write": return deny(`${request.permission} permission denied by Jess policy.`);
+			default: return deny(`Permission "${request.permission}" denied by Jess policy.`);
+		}
+	}
+	async startBroker() {
+		const socketPath = this.createBrokerPath();
+		if (process.platform !== "win32" && fs.existsSync(socketPath)) fs.unlinkSync(socketPath);
+		const server = net.createServer((socket) => {
+			socket.unref();
+			let buf = "";
+			socket.setEncoding("utf8");
+			socket.on("data", (chunk) => {
+				buf += chunk;
+				let idx = buf.indexOf("\n");
+				while (idx >= 0) {
+					const line = buf.slice(0, idx).trim();
+					buf = buf.slice(idx + 1);
+					idx = buf.indexOf("\n");
+					if (!line) continue;
+					let req;
+					try {
+						req = JSON.parse(line);
+					} catch {
+						socket.write(JSON.stringify({
+							id: -1,
+							result: "deny",
+							reason: "Malformed permission request."
+						}) + "\n");
+						continue;
+					}
+					const response = this.handleBrokerRequest(req);
+					socket.write(`${JSON.stringify(response)}\n`);
+				}
+			});
+		});
+		await new Promise((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(socketPath, () => resolve());
+		});
+		server.unref();
+		this.brokerServer = server;
+		this.brokerSocketPath = socketPath;
+		return socketPath;
+	}
+	startWorker(socketPath) {
+		const denoCommand = this.opts.denoCommand ?? "deno";
+		const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+		const compiledWorkerPath = path.join(moduleDir, "runtime-worker.js");
+		const sourceWorkerPath = path.join(moduleDir, "runtime-worker.ts");
+		const child = spawn(denoCommand, [
+			"run",
+			"--no-prompt",
+			fs.existsSync(compiledWorkerPath) ? compiledWorkerPath : sourceWorkerPath,
+			`--runtime-api=${this.opts.runtimeApi ?? "module"}`
+		], {
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...process.env,
+				DENO_PERMISSION_BROKER_PATH: socketPath
+			}
+		});
+		this.worker = child;
+		child.unref();
+		child.stdin.unref?.();
+		child.stdout.unref?.();
+		child.stderr.unref?.();
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => this.onWorkerStdout(chunk));
+		child.on("exit", () => {
+			this.worker = void 0;
+			if (this.shuttingDown) {
+				this.shuttingDown = false;
+				return;
+			}
+			const err = /* @__PURE__ */ new Error("Deno worker exited unexpectedly.");
+			this.rejectAllPending(err);
+			if (this.runtimeState.status !== "failed") this.runtimeState = {
+				status: "failed",
+				error: err
+			};
+		});
+		return new Promise((resolve, reject) => {
+			let stderrText = "";
+			const timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(stderrText.trim() ? `Timed out waiting for Deno worker startup.\n${stderrText.trim()}` : "Timed out waiting for Deno worker startup."));
+			}, BOOT_TIMEOUT_MS);
+			const onStderr = (chunk) => {
+				stderrText += chunk;
+			};
+			const onData = (chunk) => {
+				this.workerBuffer += chunk;
+				let idx = this.workerBuffer.indexOf("\n");
+				while (idx >= 0) {
+					const line = this.workerBuffer.slice(0, idx).trim();
+					this.workerBuffer = this.workerBuffer.slice(idx + 1);
+					idx = this.workerBuffer.indexOf("\n");
+					if (!line) continue;
+					try {
+						if (JSON.parse(line).type === "ready") {
+							clearTimeout(timer);
+							child.stdout.off("data", onData);
+							child.stderr.off("data", onStderr);
+							resolve();
+							return;
+						}
+					} catch {}
+				}
+			};
+			child.stdout.on("data", onData);
+			child.stderr.on("data", onStderr);
+			child.once("error", (err) => {
+				clearTimeout(timer);
+				child.stdout.off("data", onData);
+				child.stderr.off("data", onStderr);
+				reject(err);
+			});
+		});
+	}
+	async startRuntime() {
+		this.ensureRuntimeAvailable();
+		const socketPath = await this.startBroker();
+		try {
+			await this.startWorker(socketPath);
+		} catch (err) {
+			this.shutdown();
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+	}
+	onWorkerStdout(chunk) {
+		this.workerBuffer += chunk;
+		let idx = this.workerBuffer.indexOf("\n");
+		while (idx >= 0) {
+			const line = this.workerBuffer.slice(0, idx).trim();
+			this.workerBuffer = this.workerBuffer.slice(idx + 1);
+			idx = this.workerBuffer.indexOf("\n");
+			if (!line) continue;
+			let parsed;
+			try {
+				parsed = JSON.parse(line);
+			} catch {
+				continue;
+			}
+			if (!parsed || typeof parsed.id !== "number") continue;
+			const pending = this.pending.get(parsed.id);
+			if (!pending) continue;
+			this.pending.delete(parsed.id);
+			clearTimeout(pending.timeout);
+			pending.resolve(parsed);
+			if (this.pending.size === 0) this.scheduleIdleShutdown();
+		}
+	}
+	rejectAllPending(err) {
+		for (const pending of this.pending.values()) {
+			clearTimeout(pending.timeout);
+			pending.reject(err);
+		}
+		this.pending.clear();
+	}
+	async callWorker(request) {
+		await this.ensureRuntime();
+		this.clearIdleTimer();
+		if (!this.worker || !this.worker.stdin.writable) throw new Error("Deno worker is not available.");
+		const id = this.nextRequestId++;
+		const payload = {
+			...request,
+			id
+		};
+		return await new Promise((resolve, reject) => {
+			const timeout = setTimeout(() => {
+				this.pending.delete(id);
+				reject(/* @__PURE__ */ new Error("Timed out waiting for Deno worker response."));
+			}, REQUEST_TIMEOUT_MS);
+			this.pending.set(id, {
+				resolve,
+				reject,
+				timeout
+			});
+			this.worker.stdin.write(`${JSON.stringify(payload)}\n`);
+		});
+	}
+	shutdown() {
+		this.clearIdleTimer();
+		if (this.worker && !this.worker.killed) {
+			this.shuttingDown = true;
+			this.worker.stdin.destroy();
+			this.worker.stdout.destroy();
+			this.worker.stderr.destroy();
+			this.worker.kill();
+		}
+		this.worker = void 0;
+		if (this.brokerServer) {
+			this.brokerServer.close();
+			this.brokerServer = void 0;
+		}
+		if (this.brokerSocketPath && process.platform !== "win32") try {
+			if (fs.existsSync(this.brokerSocketPath)) fs.unlinkSync(this.brokerSocketPath);
+		} catch {}
+		this.brokerSocketPath = void 0;
+	}
+	dispose() {
+		this.shutdown();
+		JsPlugin.liveInstances.delete(this);
+		this.runtimeState = { status: "disposed" };
+	}
+	assertAllowedPath(absoluteFilePath) {
+		const resolvedPath = path.resolve(absoluteFilePath);
+		const jsReadRoot = this.opts.jsReadRoot ? path.resolve(this.opts.jsReadRoot) : void 0;
+		if (!jsReadRoot) return;
+		if (isPathInside(resolvedPath, jsReadRoot)) return;
+		if (resolvedPath.includes(`${path.sep}node_modules${path.sep}`)) return;
+		throw new Error(`Script path "${resolvedPath}" is outside jsReadRoot "${jsReadRoot}"`);
+	}
+	async import(absoluteFilePath) {
+		const ext = path.extname(absoluteFilePath);
+		if (!SCRIPT_EXTENSIONS.has(ext)) throw new Error(`Plugin "${this.name}" cannot import "${absoluteFilePath}"`);
+		if (!isFnsPath(absoluteFilePath)) {
+			this.assertAllowedPath(absoluteFilePath);
+			await this.ensureRuntime();
+			const modulePath = path.resolve(absoluteFilePath);
+			const loadResult = await this.callWorker({
+				type: "load",
+				modulePath
+			});
+			if (!loadResult.ok) throw new Error(loadResult.error);
+			const moduleObject = {};
+			const exported = loadResult.exports ?? [];
+			for (const item of exported) if (item.kind === "function") moduleObject[item.name] = async (...args) => {
+				const invokeResult = await this.callWorker({
+					type: "invoke",
+					modulePath,
+					exportName: item.name,
+					args: encodeBridgeArgs(args)
+				});
+				if (!invokeResult.ok) throw new Error(invokeResult.error);
+				return decodeBridgeValue(invokeResult.value);
+			};
+			else moduleObject[item.name] = item.value;
+			return moduleObject;
+		}
+		const module = await import(pathToFileURL(path.resolve(absoluteFilePath)).href);
+		const safeModule = {};
+		for (const [key, value] of Object.entries(module)) if (typeof value === "function" || isJsonValue(value)) safeModule[key] = value;
+		return safeModule;
+	}
+	/**
+	* Loads a legacy Less `@plugin` wrapper file in Deno Less-compat mode.
+	*
+	* @deprecated Less `@plugin` is deprecated. Prefer `@-from` for
+	* ESM-style script imports or `@-use` for Sass-module-style namespace imports.
+	*/
+	async importLessPlugin(absoluteFilePath) {
+		const ext = path.extname(absoluteFilePath);
+		if (!SCRIPT_EXTENSIONS.has(ext)) throw new Error(`Plugin "${this.name}" cannot import Less plugin "${absoluteFilePath}"`);
+		this.assertAllowedPath(absoluteFilePath);
+		await this.ensureRuntime();
+		const modulePath = path.resolve(absoluteFilePath);
+		const loadResult = await this.callWorker({
+			type: "loadLessPlugin",
+			modulePath
+		});
+		if (!loadResult.ok) throw new Error(loadResult.error);
+		const functions = {};
+		for (const functionName of loadResult.functions ?? []) functions[functionName] = async (...args) => {
+			const invokeResult = await this.callWorker({
+				type: "invokeLessPluginFunction",
+				modulePath,
+				functionName,
+				args: encodeBridgeArgs(args)
+			});
+			if (!invokeResult.ok) throw new Error(invokeResult.error);
+			return decodeBridgeValue(invokeResult.value);
+		};
+		return { functions };
+	}
 };
-export class JsPlugin extends AbstractPlugin {
-    opts;
-    name = 'js';
-    supportedExtensions = Array.from(SCRIPT_EXTENSIONS);
-    runtimeState = { status: 'idle' };
-    brokerServer;
-    brokerSocketPath;
-    worker;
-    workerBuffer = '';
-    nextRequestId = 1;
-    pending = new Map();
-    constructor(opts = {}) {
-        super();
-        this.opts = opts;
-    }
-    prewarm() {
-        return this.ensureRuntime().catch(() => undefined);
-    }
-    ensureRuntimeAvailable() {
-        const denoCommand = this.opts.denoCommand ?? 'deno';
-        const result = spawnSync(denoCommand, ['--version'], {
-            stdio: 'ignore'
-        });
-        if (result.status !== 0) {
-            throw new Error(RUNTIME_MISSING_MESSAGE);
-        }
-    }
-    ensureRuntime() {
-        if (this.runtimeState.status === 'ready') {
-            return Promise.resolve();
-        }
-        if (this.runtimeState.status === 'initializing') {
-            return this.runtimeState.promise;
-        }
-        if (this.runtimeState.status === 'failed') {
-            return Promise.reject(this.runtimeState.error);
-        }
-        const promise = this.startRuntime().then(() => {
-            this.runtimeState = { status: 'ready' };
-        }, (err) => {
-            this.runtimeState = { status: 'failed', error: err };
-            throw err;
-        });
-        this.runtimeState = { status: 'initializing', promise };
-        return promise;
-    }
-    createBrokerPath() {
-        if (process.platform === 'win32') {
-            const rand = `${process.pid}-${Date.now()}-${Math.floor(Math.random() * 10000)}`;
-            return `\\\\.\\pipe\\jess-deno-broker-${rand}`;
-        }
-        // macOS temp dir paths can exceed unix socket limits. Keep this short.
-        const rand = Math.floor(Math.random() * 10000);
-        return `/tmp/jd-${process.pid}-${Date.now()}-${rand}.sock`;
-    }
-    isReadAllowed(value) {
-        const normalized = normalizePermissionPath(value);
-        if (!normalized) {
-            return false;
-        }
-        const requestedPath = canonicalPath(path.resolve(normalized));
-        const jsReadRoot = this.opts.jsReadRoot ? canonicalPath(path.resolve(this.opts.jsReadRoot)) : undefined;
-        if (jsReadRoot && isPathInside(requestedPath, jsReadRoot)) {
-            return true;
-        }
-        return requestedPath.includes(`${path.sep}node_modules${path.sep}`);
-    }
-    isNetAllowed(value) {
-        if (!this.opts.allowHttp) {
-            return false;
-        }
-        const allowHosts = this.opts.allowNetHosts ?? [];
-        if (allowHosts.length === 0) {
-            return true;
-        }
-        if (!value) {
-            return false;
-        }
-        const host = value.split(':')[0] ?? value;
-        return allowHosts.includes(host);
-    }
-    handleBrokerRequest(request) {
-        const deny = (reason) => ({
-            id: request.id,
-            result: 'deny',
-            reason
-        });
-        switch (request.permission) {
-            case 'read':
-                return this.isReadAllowed(request.value)
-                    ? { id: request.id, result: 'allow' }
-                    : deny('Read access denied by Jess policy.');
-            case 'net':
-                return this.isNetAllowed(request.value)
-                    ? { id: request.id, result: 'allow' }
-                    : deny('Network access denied by Jess policy.');
-            case 'env':
-            case 'run':
-            case 'ffi':
-            case 'sys':
-            case 'write':
-                return deny(`${request.permission} permission denied by Jess policy.`);
-            default:
-                return deny(`Permission "${request.permission}" denied by Jess policy.`);
-        }
-    }
-    async startBroker() {
-        const socketPath = this.createBrokerPath();
-        if (process.platform !== 'win32' && fs.existsSync(socketPath)) {
-            fs.unlinkSync(socketPath);
-        }
-        const server = net.createServer((socket) => {
-            let buf = '';
-            socket.setEncoding('utf8');
-            socket.on('data', (chunk) => {
-                buf += chunk;
-                let idx = buf.indexOf('\n');
-                while (idx >= 0) {
-                    const line = buf.slice(0, idx).trim();
-                    buf = buf.slice(idx + 1);
-                    idx = buf.indexOf('\n');
-                    if (!line) {
-                        continue;
-                    }
-                    let req;
-                    try {
-                        req = JSON.parse(line);
-                    }
-                    catch {
-                        socket.write(JSON.stringify({
-                            id: -1,
-                            result: 'deny',
-                            reason: 'Malformed permission request.'
-                        }) + '\n');
-                        continue;
-                    }
-                    const response = this.handleBrokerRequest(req);
-                    socket.write(`${JSON.stringify(response)}\n`);
-                }
-            });
-        });
-        await new Promise((resolve, reject) => {
-            server.once('error', reject);
-            server.listen(socketPath, () => resolve());
-        });
-        this.brokerServer = server;
-        this.brokerSocketPath = socketPath;
-        return socketPath;
-    }
-    startWorker(socketPath) {
-        const denoCommand = this.opts.denoCommand ?? 'deno';
-        const moduleDir = path.dirname(fileURLToPath(import.meta.url));
-        const compiledWorkerPath = path.join(moduleDir, 'runtime-worker.js');
-        const sourceWorkerPath = path.join(moduleDir, 'runtime-worker.ts');
-        const workerScriptPath = fs.existsSync(compiledWorkerPath)
-            ? compiledWorkerPath
-            : sourceWorkerPath;
-        const child = spawn(denoCommand, ['run', '--no-prompt', workerScriptPath], {
-            stdio: ['pipe', 'pipe', 'pipe'],
-            env: {
-                ...process.env,
-                DENO_PERMISSION_BROKER_PATH: socketPath
-            }
-        });
-        this.worker = child;
-        child.stdout.setEncoding('utf8');
-        child.stderr.setEncoding('utf8');
-        child.stdout.on('data', chunk => this.onWorkerStdout(chunk));
-        child.on('exit', () => {
-            const err = new Error('Deno worker exited unexpectedly.');
-            this.rejectAllPending(err);
-            if (this.runtimeState.status !== 'failed') {
-                this.runtimeState = { status: 'failed', error: err };
-            }
-        });
-        return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                reject(new Error('Timed out waiting for Deno worker startup.'));
-            }, BOOT_TIMEOUT_MS);
-            const onData = (chunk) => {
-                this.workerBuffer += chunk;
-                let idx = this.workerBuffer.indexOf('\n');
-                while (idx >= 0) {
-                    const line = this.workerBuffer.slice(0, idx).trim();
-                    this.workerBuffer = this.workerBuffer.slice(idx + 1);
-                    idx = this.workerBuffer.indexOf('\n');
-                    if (!line) {
-                        continue;
-                    }
-                    try {
-                        const parsed = JSON.parse(line);
-                        if (parsed.type === 'ready') {
-                            clearTimeout(timer);
-                            child.stdout.off('data', onData);
-                            resolve();
-                            return;
-                        }
-                    }
-                    catch {
-                        // ignore until ready payload appears
-                    }
-                }
-            };
-            child.stdout.on('data', onData);
-            child.once('error', (err) => {
-                clearTimeout(timer);
-                child.stdout.off('data', onData);
-                reject(err);
-            });
-        });
-    }
-    async startRuntime() {
-        this.ensureRuntimeAvailable();
-        const socketPath = await this.startBroker();
-        try {
-            await this.startWorker(socketPath);
-        }
-        catch (err) {
-            this.shutdown();
-            throw err instanceof Error ? err : new Error(String(err));
-        }
-    }
-    onWorkerStdout(chunk) {
-        this.workerBuffer += chunk;
-        let idx = this.workerBuffer.indexOf('\n');
-        while (idx >= 0) {
-            const line = this.workerBuffer.slice(0, idx).trim();
-            this.workerBuffer = this.workerBuffer.slice(idx + 1);
-            idx = this.workerBuffer.indexOf('\n');
-            if (!line) {
-                continue;
-            }
-            let parsed;
-            try {
-                parsed = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            if (!parsed || typeof parsed.id !== 'number') {
-                continue;
-            }
-            const pending = this.pending.get(parsed.id);
-            if (!pending) {
-                continue;
-            }
-            this.pending.delete(parsed.id);
-            clearTimeout(pending.timeout);
-            pending.resolve(parsed);
-        }
-    }
-    rejectAllPending(err) {
-        for (const pending of this.pending.values()) {
-            clearTimeout(pending.timeout);
-            pending.reject(err);
-        }
-        this.pending.clear();
-    }
-    async callWorker(request) {
-        await this.ensureRuntime();
-        if (!this.worker || !this.worker.stdin.writable) {
-            throw new Error('Deno worker is not available.');
-        }
-        const id = this.nextRequestId++;
-        const payload = { ...request, id };
-        return await new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-                this.pending.delete(id);
-                reject(new Error('Timed out waiting for Deno worker response.'));
-            }, REQUEST_TIMEOUT_MS);
-            this.pending.set(id, { resolve, reject, timeout });
-            this.worker.stdin.write(`${JSON.stringify(payload)}\n`);
-        });
-    }
-    shutdown() {
-        if (this.worker && !this.worker.killed) {
-            this.worker.kill();
-        }
-        this.worker = undefined;
-        if (this.brokerServer) {
-            this.brokerServer.close();
-            this.brokerServer = undefined;
-        }
-        if (this.brokerSocketPath && process.platform !== 'win32') {
-            try {
-                if (fs.existsSync(this.brokerSocketPath)) {
-                    fs.unlinkSync(this.brokerSocketPath);
-                }
-            }
-            catch {
-                // ignore
-            }
-        }
-        this.brokerSocketPath = undefined;
-    }
-    dispose() {
-        this.shutdown();
-        this.runtimeState = { status: 'idle' };
-    }
-    assertAllowedPath(absoluteFilePath) {
-        const resolvedPath = path.resolve(absoluteFilePath);
-        const jsReadRoot = this.opts.jsReadRoot ? path.resolve(this.opts.jsReadRoot) : undefined;
-        if (!jsReadRoot) {
-            return;
-        }
-        if (isPathInside(resolvedPath, jsReadRoot)) {
-            return;
-        }
-        // pnpm layouts may resolve package files outside project root.
-        if (resolvedPath.includes(`${path.sep}node_modules${path.sep}`)) {
-            return;
-        }
-        throw new Error(`Script path "${resolvedPath}" is outside jsReadRoot "${jsReadRoot}"`);
-    }
-    async import(absoluteFilePath) {
-        const ext = path.extname(absoluteFilePath);
-        if (!SCRIPT_EXTENSIONS.has(ext)) {
-            throw new Error(`Plugin "${this.name}" cannot import "${absoluteFilePath}"`);
-        }
-        if (!isFnsPath(absoluteFilePath)) {
-            this.assertAllowedPath(absoluteFilePath);
-            await this.ensureRuntime();
-            const modulePath = path.resolve(absoluteFilePath);
-            const loadResult = await this.callWorker({ type: 'load', modulePath });
-            if (!loadResult.ok) {
-                throw new Error(loadResult.error);
-            }
-            const moduleObject = {};
-            const exported = loadResult.exports ?? [];
-            for (const item of exported) {
-                if (item.kind === 'function') {
-                    moduleObject[item.name] = async (...args) => {
-                        const invokeResult = await this.callWorker({
-                            type: 'invoke',
-                            modulePath,
-                            exportName: item.name,
-                            args
-                        });
-                        if (!invokeResult.ok) {
-                            throw new Error(invokeResult.error);
-                        }
-                        return invokeResult.value;
-                    };
-                }
-                else {
-                    moduleObject[item.name] = item.value;
-                }
-            }
-            return moduleObject;
-        }
-        const modulePath = pathToFileURL(path.resolve(absoluteFilePath)).href;
-        const module = await import(modulePath);
-        const safeModule = {};
-        for (const [key, value] of Object.entries(module)) {
-            if (typeof value === 'function' || isJsonValue(value)) {
-                safeModule[key] = value;
-            }
-        }
-        return safeModule;
-    }
-}
 /**
- * Global flag set when @jesscss/plugin-js is loaded.
- * less-compat checks this before running @plugin scripts (scripts must be run when plugin-js/Deno is present).
- */
-export const JESS_PLUGIN_JS_GLOBAL = '__JESS_PLUGIN_JS_AVAILABLE__';
-if (typeof globalThis !== 'undefined') {
-    globalThis[JESS_PLUGIN_JS_GLOBAL] = true;
-}
+* Global flag set when @jesscss/plugin-js is loaded.
+* less-compat checks this before running @plugin scripts (scripts must be run when plugin-js/Deno is present).
+*/
+const JESS_PLUGIN_JS_GLOBAL = "__JESS_PLUGIN_JS_AVAILABLE__";
+if (typeof globalThis !== "undefined") globalThis[JESS_PLUGIN_JS_GLOBAL] = true;
 const jsPlugin = ((opts) => {
-    return new JsPlugin(opts);
+	return new JsPlugin(opts);
 });
-export default jsPlugin;
-//# sourceMappingURL=index.js.map
+//#endregion
+export { JESS_PLUGIN_JS_GLOBAL, JsPlugin, jsPlugin as default };