@shinsou/plugin 0.0.0-stage → 0.1.0

package/dist/cli.js

@@ -0,0 +1,3096 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { createInterface } from "node:readline";
+import { parseArgs } from "node:util";
+import { existsSync as existsSync8 } from "node:fs";
+import { resolve as resolve3 } from "node:path";
+import qrcode from "qrcode-terminal";
+
+// src/core/build.ts
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join3 } from "node:path";
+import { build as esbuild } from "esbuild";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
+
+// src/core/bytes.ts
+var encoder = new TextEncoder();
+var strictDecoder = new TextDecoder("utf-8", { fatal: true });
+function utf8(text) {
+  if (hasLoneSurrogate(text)) throw new Error("String contains a lone UTF-16 surrogate");
+  return encoder.encode(text);
+}
+function decodeUtf8(bytes) {
+  return strictDecoder.decode(bytes);
+}
+function hasLoneSurrogate(text) {
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (c >= 55296 && c <= 56319) {
+      const next = text.charCodeAt(i + 1);
+      if (!(next >= 56320 && next <= 57343)) return true;
+      i++;
+    } else if (c >= 56320 && c <= 57343) {
+      return true;
+    }
+  }
+  return false;
+}
+function concatBytes(...parts) {
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
+}
+function toHex(bytes) {
+  let s = "";
+  for (const b of bytes) s += b.toString(16).padStart(2, "0");
+  return s;
+}
+function base64UrlEncode(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+function base64UrlDecodeCanonical(value2, expectedBytes) {
+  if (value2.length > 128 && expectedBytes !== void 0) throw new Error("Encoded signing material is too large");
+  if (!/^[A-Za-z0-9_-]*$/.test(value2)) throw new Error("Non-canonical base64url");
+  const bytes = new Uint8Array(Buffer.from(value2, "base64url"));
+  if (base64UrlEncode(bytes) !== value2) throw new Error("Non-canonical base64url");
+  if (expectedBytes !== void 0 && bytes.length !== expectedBytes) throw new Error("Invalid signing material size");
+  return bytes;
+}
+function bytesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+
+// src/core/crypto.ts
+import * as ed from "@noble/ed25519";
+import { sha256 as nobleSha256, sha512 } from "@noble/hashes/sha2.js";
+ed.hashes.sha512 = sha512;
+function sha256(data) {
+  return nobleSha256(data);
+}
+function sha256Hex(data) {
+  return toHex(sha256(data));
+}
+function publicKeyFromSeed(seed) {
+  if (seed.length !== 32) throw new Error("Ed25519 seed must be 32 bytes");
+  return ed.getPublicKey(seed);
+}
+function signEd25519(message, seed) {
+  return ed.sign(message, seed);
+}
+function verifyEd25519(signature, message, publicKey) {
+  try {
+    return ed.verify(signature, message, publicKey, { zip215: false });
+  } catch {
+    return false;
+  }
+}
+function randomSeed() {
+  return ed.utils.randomSecretKey();
+}
+function fingerprint(publicKey) {
+  return "sha256:" + base64UrlEncode(sha256(publicKey));
+}
+function displayFingerprint(publicKey) {
+  const hex = toHex(sha256(publicKey).subarray(0, 16)).toUpperCase();
+  return hex.match(/.{4}/g).join(" ");
+}
+
+// src/core/consistency.ts
+import { isDeepStrictEqual } from "node:util";
+import { Script } from "node:vm";
+
+// src/core/manifest.ts
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// src/core/canonical-json.ts
+var CanonicalJsonError = class extends Error {
+};
+function canonicalJson(value2) {
+  return write(value2, 0);
+}
+function write(value2, depth) {
+  if (depth > 256) throw new CanonicalJsonError("JSON nesting too deep");
+  if (value2 === null) return "null";
+  if (value2 === true) return "true";
+  if (value2 === false) return "false";
+  if (typeof value2 === "number") return writeNumber(value2);
+  if (typeof value2 === "string") return writeString(value2);
+  if (Array.isArray(value2)) return "[" + value2.map((v) => write(v, depth + 1)).join(",") + "]";
+  if (typeof value2 === "object") {
+    const keys = Object.keys(value2).sort();
+    return "{" + keys.map((k) => writeString(k) + ":" + write(value2[k], depth + 1)).join(",") + "}";
+  }
+  throw new CanonicalJsonError(`Unsupported JSON value of type ${typeof value2}`);
+}
+function writeNumber(n) {
+  if (!Number.isSafeInteger(n)) throw new CanonicalJsonError(`Only safe integers are canonical, got ${n}`);
+  if (Object.is(n, -0)) throw new CanonicalJsonError("Negative zero is not canonical");
+  return String(n);
+}
+function writeString(s) {
+  if (hasLoneSurrogate(s)) throw new CanonicalJsonError("String contains a lone surrogate");
+  let out = '"';
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    const c = s.charCodeAt(i);
+    switch (ch) {
+      case '"':
+        out += '\\"';
+        break;
+      case "\\":
+        out += "\\\\";
+        break;
+      case "\n":
+        out += "\\n";
+        break;
+      case "\r":
+        out += "\\r";
+        break;
+      case "	":
+        out += "\\t";
+        break;
+      case "\b":
+        out += "\\b";
+        break;
+      case "\f":
+        out += "\\f";
+        break;
+      default:
+        out += c < 32 ? "\\u" + c.toString(16).padStart(4, "0") : ch;
+    }
+  }
+  return out + '"';
+}
+function parseStrictJson(text) {
+  const p = new Parser(text);
+  p.ws();
+  const v = p.value(0);
+  p.ws();
+  if (p.i !== text.length) p.fail("trailing data");
+  return v;
+}
+var Parser = class {
+  constructor(s) {
+    this.s = s;
+  }
+  s;
+  i = 0;
+  fail(msg) {
+    throw new CanonicalJsonError(`Invalid JSON at offset ${this.i}: ${msg}`);
+  }
+  ws() {
+    while (this.i < this.s.length) {
+      const c = this.s[this.i];
+      if (c === " " || c === "	" || c === "\n" || c === "\r") this.i++;
+      else break;
+    }
+  }
+  value(depth) {
+    if (depth > 256) this.fail("nesting too deep");
+    const c = this.s[this.i];
+    if (c === "{") return this.object(depth);
+    if (c === "[") return this.array(depth);
+    if (c === '"') return this.string();
+    if (c === "-" || c >= "0" && c <= "9") return this.number();
+    if (this.s.startsWith("true", this.i)) {
+      this.i += 4;
+      return true;
+    }
+    if (this.s.startsWith("false", this.i)) {
+      this.i += 5;
+      return false;
+    }
+    if (this.s.startsWith("null", this.i)) {
+      this.i += 4;
+      return null;
+    }
+    return this.fail("unexpected character");
+  }
+  object(depth) {
+    this.i++;
+    const out = {};
+    const seen = /* @__PURE__ */ new Set();
+    this.ws();
+    if (this.s[this.i] === "}") {
+      this.i++;
+      return out;
+    }
+    for (; ; ) {
+      this.ws();
+      if (this.s[this.i] !== '"') this.fail("expected key");
+      const key = this.string();
+      if (seen.has(key)) this.fail(`duplicate key ${JSON.stringify(key)}`);
+      seen.add(key);
+      this.ws();
+      if (this.s[this.i] !== ":") this.fail("expected ':'");
+      this.i++;
+      this.ws();
+      const v = this.value(depth + 1);
+      Object.defineProperty(out, key, { value: v, enumerable: true, writable: true, configurable: true });
+      this.ws();
+      const c = this.s[this.i++];
+      if (c === "}") return out;
+      if (c !== ",") this.fail("expected ',' or '}'");
+    }
+  }
+  array(depth) {
+    this.i++;
+    const out = [];
+    this.ws();
+    if (this.s[this.i] === "]") {
+      this.i++;
+      return out;
+    }
+    for (; ; ) {
+      this.ws();
+      out.push(this.value(depth + 1));
+      this.ws();
+      const c = this.s[this.i++];
+      if (c === "]") return out;
+      if (c !== ",") this.fail("expected ',' or ']'");
+    }
+  }
+  string() {
+    this.i++;
+    let out = "";
+    for (; ; ) {
+      if (this.i >= this.s.length) this.fail("unterminated string");
+      const c = this.s[this.i++];
+      if (c === '"') return out;
+      if (c === "\\") {
+        const e = this.s[this.i++];
+        switch (e) {
+          case '"':
+            out += '"';
+            break;
+          case "\\":
+            out += "\\";
+            break;
+          case "/":
+            out += "/";
+            break;
+          case "b":
+            out += "\b";
+            break;
+          case "f":
+            out += "\f";
+            break;
+          case "n":
+            out += "\n";
+            break;
+          case "r":
+            out += "\r";
+            break;
+          case "t":
+            out += "	";
+            break;
+          case "u": {
+            const hex = this.s.slice(this.i, this.i + 4);
+            if (!/^[0-9a-fA-F]{4}$/.test(hex)) this.fail("bad \\u escape");
+            out += String.fromCharCode(parseInt(hex, 16));
+            this.i += 4;
+            break;
+          }
+          default:
+            this.fail("bad escape");
+        }
+      } else {
+        if (c.charCodeAt(0) < 32) this.fail("raw control character in string");
+        out += c;
+      }
+    }
+  }
+  number() {
+    const m = /^-?(0|[1-9][0-9]*)/.exec(this.s.slice(this.i));
+    if (!m) this.fail("bad number");
+    const text = m[0];
+    const next = this.s[this.i + text.length];
+    if (next === "." || next === "e" || next === "E") this.fail("only integers are allowed");
+    if (text === "-0") this.fail("negative zero is not allowed");
+    const n = Number(text);
+    if (!Number.isSafeInteger(n)) this.fail("integer outside \xB19007199254740991");
+    this.i += text.length;
+    return n;
+  }
+};
+
+// src/core/manifest.ts
+var MANIFEST_FILE = "shinsou.plugin.json";
+var INDEX_FORMAT = "shinsou-extension-v2";
+var SIDECAR_FORMAT = "shinsou-extension-sidecar-v2";
+var CONTENT_CONTRACT = "extension-content-v2";
+var CONTRACT_VERSION = 2;
+var EVENTS_PROTOCOL = "dev.shinsou.system";
+var CONTENT_KINDS = ["IMAGE_SEQUENCE", "PLAIN_TEXT", "EPUB_SPINE"];
+var CONTENT_TYPES = ["manga", "novel", "both"];
+var CAPABILITIES = [
+  "CATALOGUE",
+  "LATEST",
+  "BROWSE",
+  "METADATA",
+  "UNITS",
+  "CONTENT",
+  "SEARCH",
+  "PREFERENCES",
+  "LOGIN",
+  "FAVORITE"
+];
+var RUNTIME_PERMISSIONS = [
+  "EXECUTE_SCRIPT",
+  "NETWORK",
+  "COOKIE_STORAGE",
+  "CREDENTIAL_ACCESS",
+  "LOGIN_PROMPT",
+  "FAVORITE_MUTATION",
+  "BROWSER_CHALLENGE",
+  // ADR-0002 §5.1: reading cookie values (getCookie/getCookies also need COOKIE_STORAGE in the app).
+  "COOKIE_READ",
+  // Loading the source's browserImageOrigins in an isolated browser (macOS/iOS).
+  "BROWSER_IMAGES"
+];
+var HOST_PERMISSIONS = [
+  "REQUEST_LOGIN_UI",
+  "REQUEST_SOURCE_REFRESH",
+  "REQUEST_LOGOUT",
+  "REPORT_DIAGNOSTIC",
+  "REPORT_USER_MESSAGE",
+  "REQUEST_BROWSER_CHALLENGE"
+];
+var TIER_CEILING_HOST_PERMISSIONS = ["REPORT_USER_MESSAGE"];
+var EVENT_IDS = [
+  "command.auth.login.request",
+  "command.source.refresh.request",
+  "command.auth.logout.request",
+  "event.diagnostic.message.report"
+];
+var ManifestError = class extends Error {
+};
+function loadManifest(projectDir) {
+  const path = join(projectDir, MANIFEST_FILE);
+  let raw;
+  try {
+    raw = parseStrictJson(readFileSync(path, "utf8"));
+  } catch (err) {
+    throw new ManifestError(`${MANIFEST_FILE}: ${err.message}`);
+  }
+  return validateManifest(raw);
+}
+function validateManifest(raw) {
+  const errors = [];
+  const o = obj(raw, "manifest", errors);
+  const str = (v, label) => {
+    if (typeof v !== "string" || !v.trim()) errors.push(`${label} must be a non-empty string`);
+    return typeof v === "string" ? v : "";
+  };
+  const strList = (v, label, allowed) => {
+    if (v === void 0) return [];
+    if (!Array.isArray(v) || v.some((x) => typeof x !== "string")) {
+      errors.push(`${label} must be an array of strings`);
+      return [];
+    }
+    const list = v;
+    if (new Set(list).size !== list.length) errors.push(`${label} must not contain duplicates`);
+    if (allowed) {
+      for (const x of list) if (!allowed.includes(x)) errors.push(`${label}: unknown value ${x}`);
+    }
+    return list;
+  };
+  if (o.manifestVersion !== 1) errors.push("manifestVersion must be 1");
+  const packageId = str(o.packageId, "packageId");
+  if (packageId && !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(packageId)) {
+    errors.push("packageId must be lowercase [a-z0-9._-], 1\u2013128 characters, e.g. 'zh.example'");
+  }
+  const versionCode = o.versionCode;
+  if (typeof versionCode !== "number" || !Number.isInteger(versionCode) || versionCode < 0 || versionCode > 2147483647) {
+    errors.push("versionCode must be a non-negative 32-bit integer");
+  }
+  if (typeof o.nsfw !== "boolean") errors.push("nsfw must be a boolean");
+  const contentType = str(o.contentType, "contentType");
+  if (contentType && !CONTENT_TYPES.includes(contentType)) errors.push(`contentType must be one of ${CONTENT_TYPES.join(", ")}`);
+  const contentKinds = strList(o.contentKinds, "contentKinds", CONTENT_KINDS);
+  if (contentKinds.length === 0) errors.push("contentKinds must not be empty");
+  const events = obj(o.systemEvents ?? {}, "systemEvents", errors);
+  const repo = obj(o.repository, "repository", errors);
+  const sourcesRaw = Array.isArray(o.sources) ? o.sources : (errors.push("sources must be an array"), []);
+  if (sourcesRaw.length === 0) errors.push("sources must contain at least one source");
+  const sources = sourcesRaw.map((s, i) => {
+    const so = obj(s, `sources[${i}]`, errors);
+    const label = `sources[${i}]`;
+    const legacy = so.legacyLongId;
+    if (legacy !== void 0 && legacy !== null && typeof legacy !== "string") errors.push(`${label}.legacyLongId must be a string or null`);
+    const source = {
+      sourceId: str(so.sourceId, `${label}.sourceId`),
+      legacyLongId: typeof legacy === "string" ? legacy : null,
+      name: str(so.name, `${label}.name`),
+      lang: str(so.lang, `${label}.lang`),
+      baseUrl: str(so.baseUrl, `${label}.baseUrl`),
+      requestOrigins: strList(so.requestOrigins, `${label}.requestOrigins`),
+      credentialOrigins: strList(so.credentialOrigins, `${label}.credentialOrigins`),
+      contentOrigins: strList(so.contentOrigins, `${label}.contentOrigins`),
+      browserSessionOrigins: strList(so.browserSessionOrigins, `${label}.browserSessionOrigins`),
+      contentHostSuffixes: strList(so.contentHostSuffixes, `${label}.contentHostSuffixes`),
+      browserImageOrigins: strList(so.browserImageOrigins, `${label}.browserImageOrigins`)
+    };
+    if (so.contentType !== void 0) source.contentType = str(so.contentType, `${label}.contentType`);
+    if (so.contentKinds !== void 0) source.contentKinds = strList(so.contentKinds, `${label}.contentKinds`, CONTENT_KINDS);
+    return source;
+  });
+  const ids = sources.map((s) => s.sourceId);
+  if (new Set(ids).size !== ids.length) errors.push("sourceId values must be unique");
+  const manifest = {
+    manifestVersion: 1,
+    packageId,
+    name: str(o.name, "name"),
+    version: str(o.version, "version"),
+    versionCode: typeof versionCode === "number" ? versionCode : 0,
+    lang: str(o.lang, "lang"),
+    nsfw: o.nsfw === true,
+    contract: typeof o.contract === "string" ? o.contract : "shinsou",
+    runtime: typeof o.runtime === "string" ? o.runtime : "legacy-shinsou-adapter-v2",
+    contentType,
+    contentKinds,
+    capabilities: strList(o.capabilities, "capabilities", CAPABILITIES),
+    runtimePermissions: strList(o.runtimePermissions, "runtimePermissions", RUNTIME_PERMISSIONS),
+    requestedHostPermissions: strList(o.requestedHostPermissions, "requestedHostPermissions", HOST_PERMISSIONS),
+    systemEvents: {
+      required: strList(events.required, "systemEvents.required", EVENT_IDS),
+      optional: strList(events.optional, "systemEvents.optional", EVENT_IDS)
+    },
+    entry: str(o.entry, "entry"),
+    sources,
+    repository: {
+      name: str(repo.name, "repository.name"),
+      shortName: typeof repo.shortName === "string" ? repo.shortName : str(repo.name, "repository.name"),
+      website: str(repo.website, "repository.website"),
+      mirrors: strList(repo.mirrors, "repository.mirrors")
+    }
+  };
+  if (typeof o.description === "string") manifest.description = o.description;
+  if (o.test && typeof o.test === "object" && !Array.isArray(o.test)) {
+    const t = o.test;
+    manifest.test = {
+      cases: typeof t.cases === "string" ? t.cases : void 0,
+      fixtures: typeof t.fixtures === "string" ? t.fixtures : void 0
+    };
+  }
+  if (errors.length) throw new ManifestError(`${MANIFEST_FILE} is invalid:
+  - ${errors.join("\n  - ")}`);
+  return manifest;
+}
+function obj(v, label, errors) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) {
+    errors.push(`${label} must be an object`);
+    return {};
+  }
+  return v;
+}
+function scriptUrl(m) {
+  return `plugins/${m.packageId}.js`;
+}
+function sidecarUrl(m) {
+  return `sidecars/${m.packageId}.json`;
+}
+function eventDeclaration(m) {
+  return {
+    protocol: EVENTS_PROTOCOL,
+    minVersion: 1,
+    maxVersion: 1,
+    required: [...m.systemEvents.required],
+    optional: [...m.systemEvents.optional]
+  };
+}
+function executableMetadata(m) {
+  return {
+    contractVersion: CONTRACT_VERSION,
+    contentContract: CONTENT_CONTRACT,
+    packageId: m.packageId,
+    contentType: m.contentType,
+    contentKinds: [...m.contentKinds],
+    systemEvents: eventDeclaration(m),
+    requestedHostPermissions: [...m.requestedHostPermissions]
+  };
+}
+function originFields(s) {
+  const out = {
+    requestOrigins: [...s.requestOrigins],
+    credentialOrigins: [...s.credentialOrigins],
+    contentOrigins: [...s.contentOrigins],
+    browserSessionOrigins: [...s.browserSessionOrigins]
+  };
+  if (s.contentHostSuffixes.length) out.contentHostSuffixes = [...s.contentHostSuffixes];
+  if (s.browserImageOrigins.length) out.browserImageOrigins = [...s.browserImageOrigins];
+  return out;
+}
+function indexEntry(m, artifact) {
+  const entry = {
+    id: m.packageId,
+    name: m.name,
+    version: m.version,
+    versionCode: m.versionCode,
+    lang: m.lang,
+    nsfw: m.nsfw,
+    contract: m.contract,
+    runtime: m.runtime,
+    contentType: m.contentType,
+    contentKinds: [...m.contentKinds],
+    scriptUrl: scriptUrl(m),
+    sidecarUrl: sidecarUrl(m),
+    sha256: artifact.sha256,
+    byteSize: artifact.byteSize,
+    capabilities: [...m.capabilities],
+    runtimePermissions: [...m.runtimePermissions],
+    requestedHostPermissions: [...m.requestedHostPermissions],
+    systemEvents: eventDeclaration(m),
+    sources: m.sources.map((s) => {
+      const src = {
+        sourceId: s.sourceId,
+        legacyLongId: s.legacyLongId,
+        name: s.name,
+        lang: s.lang,
+        baseUrl: s.baseUrl
+      };
+      if (s.contentType) src.contentType = s.contentType;
+      src.contentKinds = [...s.contentKinds ?? m.contentKinds];
+      return { ...src, ...originFields(s) };
+    })
+  };
+  if (m.description) entry.description = m.description;
+  return entry;
+}
+function indexDocument(m, entries) {
+  return {
+    format: INDEX_FORMAT,
+    contractVersion: CONTRACT_VERSION,
+    contentContract: CONTENT_CONTRACT,
+    contentContractVersion: CONTRACT_VERSION,
+    repository: { name: m.repository.name, source: "index.json" },
+    systemEvents: {
+      protocol: EVENTS_PROTOCOL,
+      minVersion: 1,
+      maxVersion: 1,
+      knownPermissions: HOST_PERMISSIONS.filter((p) => !TIER_CEILING_HOST_PERMISSIONS.includes(p))
+    },
+    packages: entries
+  };
+}
+function sidecarDocument(m, artifact) {
+  return {
+    format: SIDECAR_FORMAT,
+    contractVersion: CONTRACT_VERSION,
+    packageId: m.packageId,
+    name: m.name,
+    version: m.version,
+    versionCode: m.versionCode,
+    contract: m.contract,
+    runtime: m.runtime,
+    lang: m.lang,
+    nsfw: m.nsfw,
+    installable: true,
+    artifact: { scriptUrl: scriptUrl(m), sha256: artifact.sha256, byteSize: artifact.byteSize },
+    content: { contract: CONTENT_CONTRACT, contractVersion: CONTRACT_VERSION, type: m.contentType, kinds: [...m.contentKinds] },
+    capabilities: [...m.capabilities],
+    systemEvents: eventDeclaration(m),
+    requestedHostPermissions: [...m.requestedHostPermissions],
+    runtimePermissions: [...m.runtimePermissions],
+    sources: m.sources.map((s) => {
+      const src = {
+        sourceKey: { contractVersion: CONTRACT_VERSION, packageId: m.packageId, sourceId: s.sourceId, legacyLongId: s.legacyLongId },
+        sourceId: s.sourceId,
+        name: s.name,
+        lang: s.lang,
+        baseUrl: s.baseUrl
+      };
+      if (s.contentType) src.contentType = s.contentType;
+      return {
+        ...src,
+        capabilities: [...m.capabilities],
+        contentKinds: [...s.contentKinds ?? m.contentKinds],
+        systemEvents: eventDeclaration(m),
+        requestedHostPermissions: [...m.requestedHostPermissions],
+        runtimePermissions: [...m.runtimePermissions],
+        ...originFields(s)
+      };
+    })
+  };
+}
+function repoMetaDocument(m, signingKeyFingerprint) {
+  return {
+    meta: {
+      name: m.repository.name,
+      shortName: m.repository.shortName,
+      website: m.repository.website,
+      signingKeyFingerprint
+    }
+  };
+}
+function defaultSourceId(digest) {
+  let v = 0n;
+  for (let i = 0; i < 8; i++) v = v << 8n | BigInt(digest[i]);
+  return String(v & 0x7fffffffffffffffn);
+}
+
+// src/core/consistency.ts
+var EXECUTABLE_DECLARATION = /var __shinsouExtensionV2 = (\{[^\n]+\});/;
+function readExecutableMetadata(scriptText) {
+  const m = EXECUTABLE_DECLARATION.exec(scriptText);
+  if (!m) return null;
+  try {
+    return JSON.parse(m[1]);
+  } catch {
+    return null;
+  }
+}
+function checkPackageConsistency(args) {
+  const problems = [];
+  const expect = (cond, msg) => {
+    if (!cond) problems.push(msg);
+  };
+  const same = (a, b, msg) => expect(isDeepStrictEqual(a, b), msg);
+  const { index, pkg, sidecar, scriptBytes } = args;
+  const id = String(pkg.id);
+  expect(index.format === INDEX_FORMAT, "unexpected repository index format");
+  expect(index.contractVersion === 2, "unexpected v2 contract version");
+  expect(index.contentContract === CONTENT_CONTRACT, "unexpected v2 content contract");
+  expect(pkg.contractVersion === void 0 || pkg.contractVersion === 2, `${id} contract version`);
+  expect(typeof pkg.id === "string" && pkg.id.length > 0, "package id");
+  expect(!("hostPermissions" in pkg), `${id} must not self-grant host permissions`);
+  noTraversal(pkg.scriptUrl, `${id} scriptUrl`, expect);
+  noTraversal(pkg.sidecarUrl, `${id} sidecarUrl`, expect);
+  expect(String(pkg.scriptUrl).startsWith("plugins/"), `${id} scriptUrl must be under plugins`);
+  expect(String(pkg.sidecarUrl).startsWith("sidecars/"), `${id} sidecarUrl must be under sidecars`);
+  const kinds = pkg.contentKinds;
+  expect(Array.isArray(kinds) && kinds.length > 0, `${id} content kinds`);
+  for (const k of kinds ?? []) expect(CONTENT_KINDS.includes(k), `${id} unknown content kind ${k}`);
+  checkEvents(pkg.systemEvents, `${id} package events`, expect);
+  checkList(pkg.requestedHostPermissions, HOST_PERMISSIONS, `${id} requestedHostPermissions`, expect);
+  checkList(pkg.runtimePermissions, RUNTIME_PERMISSIONS, `${id} runtimePermissions`, expect);
+  const sources = pkg.sources ?? [];
+  for (const s of sources) checkBrowserSessionOrigins(s.browserSessionOrigins ?? [], `${id} source browserSessionOrigins`, expect);
+  expect(scriptBytes.length === pkg.byteSize, `${id} index byteSize mismatch`);
+  expect(sha256Hex(scriptBytes) === pkg.sha256, `${id} index sha256 mismatch`);
+  let scriptText = "";
+  try {
+    scriptText = decodeUtf8(scriptBytes);
+    new Script(scriptText, { filename: String(pkg.scriptUrl) });
+  } catch (err) {
+    problems.push(`${id} script does not parse as a classic script: ${err.message}`);
+  }
+  expect(scriptText.includes("source.v2 = __shinsouExtensionV2"), `${id} missing v2 metadata export`);
+  const meta = readExecutableMetadata(scriptText);
+  expect(meta, `${id} missing executable v2 declaration`);
+  if (meta) {
+    expect(meta.contractVersion === 2, `${id} executable contract version`);
+    expect(meta.contentContract === CONTENT_CONTRACT, `${id} executable content contract`);
+    expect(meta.packageId === pkg.id, `${id} executable package identity`);
+    same(meta.contentType, pkg.contentType, `${id} executable content type`);
+    same(meta.contentKinds, pkg.contentKinds, `${id} executable content kinds`);
+    same(meta.systemEvents, pkg.systemEvents, `${id} executable event declaration`);
+    same(meta.requestedHostPermissions, pkg.requestedHostPermissions, `${id} executable requested permissions`);
+  }
+  expect(sidecar.format === SIDECAR_FORMAT, `${id} sidecar format`);
+  expect(sidecar.contractVersion === 2, `${id} sidecar contract version`);
+  expect(sidecar.packageId === pkg.id, `${id} sidecar package identity`);
+  expect(sidecar.version === pkg.version && sidecar.versionCode === pkg.versionCode, `${id} sidecar version identity`);
+  expect(sidecar.runtime === void 0 || sidecar.runtime === pkg.runtime, `${id} sidecar runtime binding`);
+  expect(!("hostPermissions" in sidecar), `${id} sidecar must not self-grant host permissions`);
+  const artifact = sidecar.artifact ?? {};
+  expect(artifact.scriptUrl === pkg.scriptUrl, `${id} sidecar artifact binding`);
+  expect(artifact.sha256 === pkg.sha256 && artifact.byteSize === pkg.byteSize, `${id} sidecar artifact metadata`);
+  const content = sidecar.content ?? {};
+  expect(content.contract === CONTENT_CONTRACT && content.contractVersion === 2, `${id} sidecar content contract`);
+  expect(content.type === pkg.contentType, `${id} sidecar content type`);
+  same(content.kinds, pkg.contentKinds, `${id} sidecar content kinds`);
+  same(sidecar.capabilities, pkg.capabilities, `${id} sidecar capabilities`);
+  checkEvents(sidecar.systemEvents, `${id} sidecar events`, expect);
+  same(sidecar.systemEvents, pkg.systemEvents, `${id} sidecar package events`);
+  same(sidecar.requestedHostPermissions, pkg.requestedHostPermissions, `${id} sidecar requested permissions`);
+  same(sidecar.runtimePermissions, pkg.runtimePermissions, `${id} sidecar runtime permissions`);
+  const sidecarSources = sidecar.sources ?? [];
+  expect(sidecarSources.length === sources.length, `${id} sidecar source count`);
+  for (const s of sources) {
+    const match = sidecarSources.find((e) => e.sourceId === s.sourceId);
+    if (!match) {
+      problems.push(`${id} sidecar is missing source ${String(s.sourceId)}`);
+      continue;
+    }
+    const key = match.sourceKey ?? {};
+    expect(key.packageId === pkg.id && key.sourceId === s.sourceId && key.contractVersion === 2, `${id} sourceKey binding`);
+    expect(key.legacyLongId === s.legacyLongId, `${id} sourceKey legacyLongId`);
+    for (const field of ["name", "lang", "baseUrl", "requestOrigins", "credentialOrigins", "contentOrigins", "browserSessionOrigins", "browserImageOrigins", "contentHostSuffixes"]) {
+      same(match[field] ?? null, s[field] ?? null, `${id} source ${String(s.sourceId)} ${field} binding`);
+    }
+    expect("contentKinds" in match, `${id} sidecar source contentKinds must be explicit`);
+    same(match.contentKinds, s.contentKinds ?? pkg.contentKinds, `${id} source contentKinds binding`);
+    same(match.capabilities, pkg.capabilities, `${id} source capabilities binding`);
+    same(match.systemEvents, pkg.systemEvents, `${id} source events binding`);
+    same(match.requestedHostPermissions, pkg.requestedHostPermissions, `${id} source requested permissions binding`);
+    same(match.runtimePermissions, pkg.runtimePermissions, `${id} source runtime permissions binding`);
+  }
+  const events = pkg.systemEvents ?? {};
+  const declared = [...events.required ?? [], ...events.optional ?? []];
+  if (declared.includes("command.auth.login.request")) {
+    expect(/bridge\.(?:system\.)?requestLogin\s*\(/.test(scriptText), `${id} declares login but never asks the app to show it (bridge.requestLogin)`);
+  }
+  const caps = pkg.capabilities ?? [];
+  if (/supportsLogin\s*:\s*true/.test(scriptText)) expect(caps.includes("LOGIN"), `${id} script supports login but LOGIN capability is not declared`);
+  if (caps.includes("LOGIN")) expect(/supportsLogin\s*:\s*true/.test(scriptText), `${id} declares LOGIN but the script does not set supportsLogin: true`);
+  return problems;
+}
+function noTraversal(value2, label, expect) {
+  expect(typeof value2 === "string" && value2.length > 0, `${label} must be a non-empty string`);
+  expect(typeof value2 === "string" && !value2.split("/").includes(".."), `${label} must not traverse outside the repository root`);
+}
+function checkEvents(events, label, expect) {
+  const e = events ?? {};
+  expect(e.protocol === EVENTS_PROTOCOL, `${label} protocol`);
+  expect(e.minVersion === 1 && e.maxVersion === 1, `${label} version range`);
+  expect(Array.isArray(e.required) && Array.isArray(e.optional), `${label} event arrays`);
+  const required = new Set(e.required ?? []);
+  const optional = new Set(e.optional ?? []);
+  for (const id of required) expect(EVENT_IDS.includes(id), `${label} unknown required event ${id}`);
+  for (const id of optional) expect(EVENT_IDS.includes(id), `${label} unknown optional event ${id}`);
+  for (const id of required) expect(!optional.has(id), `${label} event is both required and optional: ${id}`);
+}
+function checkList(list, allowed, label, expect) {
+  expect(Array.isArray(list), `${label} must be an array`);
+  for (const p of list ?? []) expect(allowed.includes(p), `${label} contains unknown permission ${p}`);
+}
+function checkBrowserSessionOrigins(origins, label, expect) {
+  expect(Array.isArray(origins), `${label} must be an array`);
+  const list = origins ?? [];
+  expect(list.length <= 4, `${label} must remain bounded`);
+  for (const origin2 of list) {
+    try {
+      const parsed = new URL(origin2);
+      expect(parsed.protocol === "https:", `${label} must use HTTPS`);
+      expect(parsed.origin === origin2 && parsed.pathname === "/", `${label} must contain exact origins only`);
+    } catch {
+      expect(false, `${label} contains an invalid origin ${origin2}`);
+    }
+  }
+}
+
+// src/core/state.ts
+import { existsSync, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+var STATE_FORMAT = "shinsou-plugin-state-v1";
+function statePath(projectDir) {
+  return join2(projectDir, ".shinsou", "state.json");
+}
+function emptyState() {
+  return {
+    format: STATE_FORMAT,
+    publisherId: null,
+    currentKey: null,
+    retiredKeys: [],
+    rotationSequence: 0,
+    keyRevoked: false,
+    revokedArtifacts: [],
+    documents: {}
+  };
+}
+function loadState(projectDir) {
+  const path = statePath(projectDir);
+  if (!existsSync(path)) return emptyState();
+  const s = JSON.parse(readFileSync2(path, "utf8"));
+  if (s.format !== STATE_FORMAT) throw new Error(`${path}: unsupported state format`);
+  return { ...emptyState(), ...s };
+}
+function saveState(projectDir, state) {
+  const path = statePath(projectDir);
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = path + ".tmp";
+  writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
+  renameSync(tmp, path);
+}
+function nextSequence(state, documentId, payload) {
+  const digest = sha256Hex(utf8(canonicalJson(payload)));
+  const current = state.documents[documentId];
+  if (current && current.payloadSha256 === digest) return current.sequence;
+  const sequence = current ? current.sequence + 1 : 1;
+  state.documents[documentId] = { sequence, payloadSha256: digest };
+  return sequence;
+}
+
+// src/core/build.ts
+var DEFAULT_OUT_DIR = "build/repo";
+var MAX_SCRIPT_BYTES = 2 * 1024 * 1024;
+var BuildError = class extends Error {
+};
+async function bundleEntry(projectDir, manifest) {
+  const result = await esbuild({
+    absWorkingDir: projectDir,
+    entryPoints: [manifest.entry],
+    bundle: true,
+    write: false,
+    // ESM output without exports is a plain top-level script: `var source = {...}` stays global.
+    format: "esm",
+    // Nothing is "used" from the host's point of view; keep every top-level declaration.
+    treeShaking: false,
+    platform: "neutral",
+    target: "es2020",
+    charset: "utf8",
+    legalComments: "inline",
+    logLevel: "silent",
+    mainFields: ["module", "main"]
+  }).catch((err) => {
+    const msgs = (err.errors ?? []).map((e) => `${e.location ? `${e.location.file}:${e.location.line}: ` : ""}${e.text}`);
+    throw new BuildError(`esbuild failed:
+  ${msgs.join("\n  ") || String(err)}`);
+  });
+  const code = result.outputFiles[0].text;
+  if (/^\s*export\s/m.test(code) || /^\s*import\s/m.test(code)) {
+    throw new BuildError(
+      `${manifest.entry} must not export anything: declare \`var source = {...}\` (or \`var sources = [...]\`) at top level instead`
+    );
+  }
+  if (!/^(?:var\s+sources?\b|globalThis\.sources?\s*=)/m.test(code)) {
+    throw new BuildError(
+      `${manifest.entry} must declare \`var source = {...}\` (or \`var sources = [...]\`) at top level; let/const do not become globals and the host looks the source up on the global object`
+    );
+  }
+  return code;
+}
+function assembleScript(manifest, bundled) {
+  const generated = executableMetadata(manifest);
+  const existing = readExecutableMetadata(bundled);
+  if (existing) {
+    if (!isDeepStrictEqual2(existing, generated)) {
+      throw new BuildError(
+        `The script's own __shinsouExtensionV2 declaration disagrees with shinsou.plugin.json.
+  script:   ${JSON.stringify(existing)}
+  manifest: ${JSON.stringify(generated)}
+Remove the declaration from the source; build generates it.`
+      );
+    }
+  }
+  const header = `/* ${manifest.packageId} ${manifest.version} (${manifest.versionCode}) \u2014 built by @shinsou/plugin from shinsou.plugin.json */
+` + (existing ? "" : `var __shinsouExtensionV2 = ${JSON.stringify(generated)};
+`);
+  const hasExport = bundled.includes("source.v2 = __shinsouExtensionV2");
+  const footer = hasExport ? "" : '\n// Bounded, host-audited v2 metadata (generated).\nif (typeof source === "object" && source) {\n  source.v2 = __shinsouExtensionV2;\n}\nif (typeof sources === "object" && sources) {\n  (Array.isArray(sources) ? sources : Object.keys(sources).map(function (k) { return sources[k]; }))\n    .forEach(function (s) { if (s && typeof s === "object") s.v2 = __shinsouExtensionV2; });\n}\n';
+  return header + bundled.replace(/\s*$/, "\n") + footer;
+}
+async function buildProject(projectDir, opts = {}) {
+  const manifest = loadManifest(projectDir);
+  const bundledCode = await bundleEntry(projectDir, manifest);
+  const script = assembleScript(manifest, bundledCode);
+  const scriptBytes = utf8(script);
+  if (scriptBytes.length > MAX_SCRIPT_BYTES) {
+    throw new BuildError(`Script is ${scriptBytes.length} bytes; the limit is ${MAX_SCRIPT_BYTES} (2 MiB)`);
+  }
+  const artifact = { sha256: sha256Hex(scriptBytes), byteSize: scriptBytes.length };
+  const pkg = indexEntry(manifest, artifact);
+  const index = indexDocument(manifest, [pkg]);
+  const sidecar = sidecarDocument(manifest, artifact);
+  const state = loadState(projectDir);
+  const repoMeta = repoMetaDocument(manifest, state.currentKey?.fingerprint ?? "");
+  const files = {
+    [scriptUrl(manifest)]: scriptBytes,
+    [sidecarUrl(manifest)]: JSON.stringify(sidecar, null, 2) + "\n",
+    "index.json": JSON.stringify(index, null, 2) + "\n",
+    "repo.json": JSON.stringify(repoMeta, null, 2) + "\n"
+  };
+  const reIndex = JSON.parse(files["index.json"]);
+  const reSidecar = JSON.parse(files[sidecarUrl(manifest)]);
+  const rePkg = reIndex.packages.find((p) => p.id === manifest.packageId);
+  const problems = checkPackageConsistency({ index: reIndex, pkg: rePkg, sidecar: reSidecar, scriptBytes });
+  if (problems.length) throw new BuildError(`Script metadata / index / sidecar disagree:
+  - ${problems.join("\n  - ")}`);
+  const outDir = join3(projectDir, opts.outDir ?? DEFAULT_OUT_DIR);
+  if (opts.write !== false) {
+    for (const [rel, content] of Object.entries(files)) {
+      const target = join3(outDir, rel);
+      mkdirSync2(dirname2(target), { recursive: true });
+      writeFileSync2(target, content);
+    }
+  }
+  return { manifest, script, scriptBytes, bundledCode, ...artifact, index, pkg, sidecar, repoMeta, outDir, files };
+}
+
+// src/core/keystore.ts
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join4 } from "node:path";
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { scrypt } from "@noble/hashes/scrypt.js";
+import { randomBytes } from "@noble/hashes/utils.js";
+var KEY_FORMAT = "shinsou-plugin-key-v1";
+var KEY_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+var DEFAULT_SCRYPT = { N: 2 ** 17, r: 8, p: 1 };
+function configHome() {
+  return process.env.SHINSOU_PLUGIN_HOME ?? join4(process.env.XDG_CONFIG_HOME ?? join4(homedir(), ".config"), "shinsou-plugin");
+}
+function keyPath(name) {
+  if (!KEY_NAME.test(name)) throw new Error(`Invalid key name '${name}' (letters, digits, . _ -; up to 64)`);
+  return join4(configHome(), "keys", `${name}.json`);
+}
+function aad(fp) {
+  return utf8(`${KEY_FORMAT}:${fp}`);
+}
+function createKeyFile(args) {
+  const seed = args.seed ?? randomSeed();
+  const pk = publicKeyFromSeed(seed);
+  const fp = fingerprint(pk);
+  const file = {
+    format: KEY_FORMAT,
+    name: args.name,
+    algorithm: "Ed25519",
+    publicKey: base64UrlEncode(pk),
+    fingerprint: fp,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (args.passphrase) {
+    const params = args.scryptParams ?? DEFAULT_SCRYPT;
+    const salt = randomBytes(16);
+    const nonce = randomBytes(24);
+    const key = scrypt(utf8(args.passphrase.normalize("NFC")), salt, { N: params.N, r: params.r, p: params.p, dkLen: 32 });
+    const ciphertext = xchacha20poly1305(key, nonce, aad(fp)).encrypt(seed);
+    file.encryption = {
+      kdf: "scrypt",
+      ...params,
+      salt: base64UrlEncode(salt),
+      cipher: "xchacha20poly1305",
+      nonce: base64UrlEncode(nonce),
+      ciphertext: base64UrlEncode(ciphertext)
+    };
+  } else {
+    file.seed = base64UrlEncode(seed);
+  }
+  return file;
+}
+function saveKeyFile(file, { overwrite = false } = {}) {
+  const path = keyPath(file.name);
+  if (existsSync2(path) && !overwrite) throw new Error(`Key '${file.name}' already exists at ${path}`);
+  const dir = join4(configHome(), "keys");
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+  writeFileSync3(path, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+  chmodSync(path, 384);
+  return path;
+}
+function readKeyFile(name) {
+  const envKey = process.env.SHINSOU_PLUGIN_KEY;
+  if (envKey) {
+    const file2 = JSON.parse(envKey);
+    if (file2.format !== KEY_FORMAT) throw new Error("SHINSOU_PLUGIN_KEY is not a shinsou-plugin key file");
+    if (file2.name === name) return file2;
+  }
+  const path = keyPath(name);
+  if (!existsSync2(path)) throw new Error(`Key '${name}' not found (${path}). Run: shinsou-plugin keygen --name ${name}`);
+  const file = JSON.parse(readFileSync3(path, "utf8"));
+  if (file.format !== KEY_FORMAT) throw new Error(`${path} is not a shinsou-plugin key file`);
+  return file;
+}
+function unlockKeyFile(file, passphrase) {
+  let seed;
+  if (file.encryption) {
+    if (!passphrase) throw new Error(`Key '${file.name}' is encrypted: a passphrase is required`);
+    const e = file.encryption;
+    if (e.kdf !== "scrypt" || e.cipher !== "xchacha20poly1305") throw new Error("Unsupported key encryption");
+    const key = scrypt(utf8(passphrase.normalize("NFC")), base64UrlDecodeCanonical(e.salt), { N: e.N, r: e.r, p: e.p, dkLen: 32 });
+    try {
+      seed = xchacha20poly1305(key, base64UrlDecodeCanonical(e.nonce), aad(file.fingerprint)).decrypt(base64UrlDecodeCanonical(e.ciphertext));
+    } catch {
+      throw new Error(`Wrong passphrase for key '${file.name}'`);
+    }
+  } else if (file.seed) {
+    seed = base64UrlDecodeCanonical(file.seed, 32);
+  } else {
+    throw new Error(`Key file '${file.name}' has no seed`);
+  }
+  const pk = publicKeyFromSeed(seed);
+  if (fingerprint(pk) !== file.fingerprint || base64UrlEncode(pk) !== file.publicKey) {
+    throw new Error(`Key file '${file.name}' is corrupt: seed does not match its public key`);
+  }
+  return { name: file.name, seed, publicKey: file.publicKey, fingerprint: file.fingerprint };
+}
+function describeKey(file) {
+  return { fingerprint: file.fingerprint, display: displayFingerprint(base64UrlDecodeCanonical(file.publicKey, 32)) };
+}
+
+// src/core/lint.ts
+import { isIP } from "node:net";
+
+// src/core/names.ts
+var BLOCKED_TERMS = [
+  "official",
+  "offical",
+  "oficial",
+  "officiel",
+  "offiziell",
+  "\u5B98\u65B9",
+  "\u5B98\u7DB2",
+  "\u5B98\u7F51",
+  "\u516C\u5F0F"
+  // Japanese 「公式」 = official
+];
+var DISCLAIMERS = ["unofficial", "unoffical", "nonofficial", "\u975E\u5B98\u65B9", "\u975E\u516C\u5F0F"];
+var LOOKALIKES = { "0": "o", "1": "i", "!": "i", "|": "i", "$": "s", "3": "e", "@": "a" };
+function normalizeForNameCheck(value2) {
+  let s = value2.normalize("NFKC").normalize("NFKD").replace(new RegExp("\\p{M}", "gu"), "");
+  s = s.toLowerCase();
+  s = s.replace(/[\u200b-\u200f\u2060\ufeff\u00ad]/g, "");
+  s = s.replace(/[\s_\-.\u00b7\u30fb\uff65]+/g, "");
+  return [...s].map((c) => LOOKALIKES[c] ?? c).join("");
+}
+function misleadingTerm(value2) {
+  let n = normalizeForNameCheck(value2);
+  for (const d of DISCLAIMERS) n = n.split(normalizeForNameCheck(d)).join(" ");
+  for (const term of BLOCKED_TERMS) {
+    if (n.includes(normalizeForNameCheck(term))) return term;
+  }
+  if (/of+i?ci?al/.test(n)) return "official";
+  return null;
+}
+
+// src/core/psl.ts
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import { join as join5 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { domainToASCII } from "node:url";
+function dataDir() {
+  const here = fileURLToPath(new URL(".", import.meta.url));
+  for (const candidate of [join5(here, "..", "data"), join5(here, "..", "..", "data")]) {
+    if (existsSync3(join5(candidate, "public_suffix_list.dat"))) return candidate;
+  }
+  throw new Error("data/public_suffix_list.dat not found next to the CLI");
+}
+var cached;
+function parsePublicSuffixList(text) {
+  const normal = /* @__PURE__ */ new Set();
+  const wildcards = /* @__PURE__ */ new Set();
+  const exceptions = /* @__PURE__ */ new Set();
+  for (const line of text.split(/\r?\n/)) {
+    const rule = line.split(/[ \t]/)[0].trim();
+    if (!rule || rule.startsWith("//")) continue;
+    const prefix = rule.startsWith("!") ? "!" : rule.startsWith("*.") ? "*." : "";
+    const ascii = domainToASCII(rule.slice(prefix.length)).toLowerCase();
+    if (!/^[a-z0-9.-]+$/.test(ascii)) throw new Error(`Unexpected public suffix rule '${rule}'`);
+    if (prefix === "!") exceptions.add(ascii);
+    else if (prefix === "*.") wildcards.add(ascii);
+    else normal.add(ascii);
+  }
+  if (normal.size + wildcards.size + exceptions.size < 5e3) throw new Error("Public Suffix List looks truncated");
+  return { normal, wildcards, exceptions };
+}
+function rules() {
+  return cached ??= parsePublicSuffixList(readFileSync4(join5(dataDir(), "public_suffix_list.dat"), "utf8"));
+}
+function normalizedLabels(host) {
+  const n = host.trim().replace(/\.+$/, "").toLowerCase();
+  if (!n || n.length > 253 || !/^[a-z0-9.-]+$/.test(n)) return null;
+  const labels = n.split(".");
+  if (labels.some((l) => !l || l.length > 63)) return null;
+  return labels;
+}
+function publicSuffixOf(host) {
+  const labels = normalizedLabels(host);
+  if (!labels) return null;
+  const r = rules();
+  for (let start = 0; start < labels.length; start++) {
+    const candidate = labels.slice(start).join(".");
+    if (r.exceptions.has(candidate)) return labels.slice(start + 1).join(".");
+    if (r.normal.has(candidate)) return candidate;
+    if (start + 1 < labels.length && r.wildcards.has(labels.slice(start + 1).join("."))) return candidate;
+  }
+  return labels[labels.length - 1];
+}
+function registrableDomain(host) {
+  const labels = normalizedLabels(host);
+  const suffix = publicSuffixOf(host);
+  if (!labels || !suffix) return null;
+  const suffixLabels = suffix.split(".").length;
+  if (labels.length <= suffixLabels) return null;
+  return labels.slice(labels.length - suffixLabels - 1).join(".");
+}
+
+// src/core/lint.ts
+var BRIDGE_OPS = {
+  httpGet: { runtime: ["NETWORK"] },
+  httpGetWithHeaders: { runtime: ["NETWORK"] },
+  httpGetResponse: { runtime: ["NETWORK"] },
+  httpPost: { runtime: ["NETWORK"] },
+  httpPostResponse: { runtime: ["NETWORK"] },
+  httpPostBatch: { runtime: ["NETWORK"] },
+  "net.fetch": { runtime: ["NETWORK"] },
+  browserSessionRequest: { runtime: ["BROWSER_CHALLENGE"] },
+  getCredentialUsername: { runtime: ["CREDENTIAL_ACCESS"] },
+  hasCredential: { runtime: ["CREDENTIAL_ACCESS"] },
+  getCredentialPassword: { runtime: ["CREDENTIAL_ACCESS"] },
+  setCredential: { runtime: ["CREDENTIAL_ACCESS"] },
+  clearCredential: { runtime: ["CREDENTIAL_ACCESS"] },
+  getCookie: { runtime: ["COOKIE_STORAGE", "COOKIE_READ"] },
+  getCookies: { runtime: ["COOKIE_STORAGE", "COOKIE_READ"] },
+  setCookie: { runtime: ["COOKIE_STORAGE"] },
+  deleteCookie: { runtime: ["COOKIE_STORAGE"] },
+  clearCookies: { runtime: ["COOKIE_STORAGE"] },
+  requestLogin: { runtime: ["LOGIN_PROMPT"], host: ["REQUEST_LOGIN_UI"] },
+  "system.requestLogin": { host: ["REQUEST_LOGIN_UI"], events: ["command.auth.login.request"] },
+  "system.requestRefresh": { host: ["REQUEST_SOURCE_REFRESH"], events: ["command.source.refresh.request"] },
+  "system.requestLogout": { host: ["REQUEST_LOGOUT"], events: ["command.auth.logout.request"] },
+  "system.reportMessage": { host: ["REPORT_DIAGNOSTIC"], events: ["event.diagnostic.message.report"] },
+  "system.submit": {},
+  requestHostEvent: {},
+  getHostEventContext: {},
+  getHostEventCapabilities: {},
+  getPreference: {},
+  setPreference: {},
+  log: {},
+  parseHtml: {},
+  domRelease: {},
+  domReleaseAll: {}
+};
+var EVENT_HOST_PERMISSION = {
+  "command.auth.login.request": "REQUEST_LOGIN_UI",
+  "command.source.refresh.request": "REQUEST_SOURCE_REFRESH",
+  "command.auth.logout.request": "REQUEST_LOGOUT",
+  "event.diagnostic.message.report": "REPORT_DIAGNOSTIC"
+};
+var CAPABILITY_HOOKS = {
+  CATALOGUE: "getPopularManga",
+  LATEST: "getLatestUpdates",
+  SEARCH: "getSearchManga",
+  METADATA: "getMangaDetails",
+  UNITS: "getChapterList",
+  CONTENT: "getPageList"
+};
+function usedBridgeOps(code) {
+  const ops = /* @__PURE__ */ new Set();
+  for (const m of code.matchAll(/\bbridge\s*\.\s*(system|net)\s*\.\s*([A-Za-z_$][\w$]*)\s*\(/g)) ops.add(`${m[1]}.${m[2]}`);
+  for (const m of code.matchAll(/\bbridge\s*\.\s*([A-Za-z_$][\w$]*)\s*\(/g)) ops.add(m[1]);
+  return ops;
+}
+function lintBuild(result) {
+  const report = { errors: [], warnings: [] };
+  const err = (rule, message) => report.errors.push({ rule, message });
+  const warn = (rule, message) => report.warnings.push({ rule, message });
+  const m = result.manifest;
+  const code = result.bundledCode;
+  const names = [
+    ["packageId", m.packageId],
+    ["name", m.name],
+    ["repository.name", m.repository.name],
+    ["repository.shortName", m.repository.shortName],
+    ...m.sources.flatMap((s, i) => [[`sources[${i}].name`, s.name], [`sources[${i}].sourceId`, s.sourceId]])
+  ];
+  for (const [field, value2] of names) {
+    const term = misleadingTerm(value2);
+    if (term) err("misleading-name", `${field} "${value2}" contains the misleading word "${term}": Shinsou has no official plugins`);
+  }
+  if (result.byteSize > MAX_SCRIPT_BYTES) err("script-size", `script is ${result.byteSize} bytes (limit 2 MiB)`);
+  if (!m.runtimePermissions.includes("EXECUTE_SCRIPT")) err("permissions", "runtimePermissions must include EXECUTE_SCRIPT");
+  const ops = usedBridgeOps(code);
+  const neededRuntime = /* @__PURE__ */ new Set(["EXECUTE_SCRIPT"]);
+  const neededHost = /* @__PURE__ */ new Set();
+  const declaredEvents = /* @__PURE__ */ new Set([...m.systemEvents.required, ...m.systemEvents.optional]);
+  for (const op of ops) {
+    const rule = BRIDGE_OPS[op];
+    if (!rule) {
+      err("bridge-op", `bridge.${op}() is not a bridge operation the sandbox provides (it would fail with UNKNOWN_OPERATION)`);
+      continue;
+    }
+    for (const p of rule.runtime ?? []) {
+      neededRuntime.add(p);
+      if (!m.runtimePermissions.includes(p)) err("bridge-permission", `bridge.${op}() requires runtime permission ${p}`);
+    }
+    for (const p of rule.host ?? []) {
+      neededHost.add(p);
+      if (!m.requestedHostPermissions.includes(p)) err("bridge-permission", `bridge.${op}() requires host permission ${p}`);
+    }
+    for (const e of rule.events ?? []) {
+      if (!declaredEvents.has(e)) err("bridge-permission", `bridge.${op}() requires systemEvents to declare ${e}`);
+    }
+    if (op === "system.submit" || op === "requestHostEvent") {
+      warn("bridge-dynamic", `bridge.${op}() submits arbitrary events: make sure systemEvents and requestedHostPermissions cover them`);
+    }
+  }
+  if (/\bbridge\s*\[/.test(code)) warn("bridge-dynamic", "bridge[...] dynamic access cannot be checked statically");
+  for (const p of m.runtimePermissions) {
+    if (!neededRuntime.has(p) && p !== "FAVORITE_MUTATION") warn("least-privilege", `runtime permission ${p} is declared but no bridge call needs it`);
+  }
+  for (const e of declaredEvents) {
+    const p = EVENT_HOST_PERMISSION[e];
+    if (p && !m.requestedHostPermissions.includes(p)) err("events", `systemEvents declares ${e}, which needs host permission ${p}`);
+  }
+  const usedHost = /* @__PURE__ */ new Set([...neededHost, ...[...declaredEvents].map((e) => EVENT_HOST_PERMISSION[e]).filter(Boolean)]);
+  for (const p of m.requestedHostPermissions) {
+    if (TIER_CEILING_HOST_PERMISSIONS.includes(p)) err("tier-ceiling", `${p} is never granted to third-party packages (ADR-0002 \xA76.2)`);
+    else if (!usedHost.has(p)) warn("least-privilege", `host permission ${p} is declared but nothing uses it`);
+  }
+  for (const cap of m.capabilities) {
+    const hook = CAPABILITY_HOOKS[cap];
+    const found = (h) => new RegExp(`\\b${h}\\b`).test(code);
+    if (hook && !found(hook) && !(cap === "CONTENT" && found("getChapterText"))) warn("capabilities", `capability ${cap} is declared but no ${hook} hook was found`);
+  }
+  if (m.capabilities.includes("LOGIN") && !m.runtimePermissions.includes("CREDENTIAL_ACCESS")) {
+    warn("capabilities", "LOGIN normally needs CREDENTIAL_ACCESS to store the account");
+  }
+  for (const [i, s] of m.sources.entries()) {
+    const kinds = s.contentKinds ?? m.contentKinds;
+    if (kinds.includes("PLAIN_TEXT") && !/\bgetChapterText\b/.test(code)) {
+      warn("capabilities", `sources[${i}] serves PLAIN_TEXT but no getChapterText hook was found (the app reads chapter text from getChapterText(chapter), which returns a string)`);
+    }
+  }
+  for (const [i, s] of m.sources.entries()) lintSource(m, s, `sources[${i}]`, code, err, warn);
+  lintUrlLiterals(m, code, warn);
+  return report;
+}
+function lintSource(m, s, label, code, err, warn) {
+  const isLong = (v) => /^-?\d{1,19}$/.test(v) && BigInt(v) <= 0x7fffffffffffffffn && BigInt(v) >= -0x8000000000000000n;
+  if (/^\d{1,19}$/.test(s.sourceId)) {
+    if (!isLong(s.sourceId)) err("source-id", `${label}.sourceId must fit a 64-bit integer (the app stores it as a Long)`);
+    if (s.legacyLongId !== null && s.legacyLongId !== s.sourceId) warn("source-id", `${label}.legacyLongId differs from sourceId`);
+  } else if (/^[a-z0-9][a-z0-9._-]{0,127}$/.test(s.sourceId)) {
+    if (s.legacyLongId === null || !isLong(s.legacyLongId)) {
+      err("source-id", `${label}.sourceId "${s.sourceId}" is not numeric, so legacyLongId must be a 64-bit integer string`);
+    }
+  } else {
+    err("source-id", `${label}.sourceId must be a decimal 64-bit integer or a lowercase dotted id such as zh.example`);
+  }
+  for (const field of ["requestOrigins", "credentialOrigins", "contentOrigins", "browserSessionOrigins"]) {
+    for (const origin2 of s[field]) {
+      const problem = exactHttpsOriginProblem(origin2);
+      if (problem) err("origin", `${label}.${field}: ${origin2} ${problem}`);
+    }
+  }
+  const base = exactHttpsOriginProblem(safeOrigin(s.baseUrl) ?? s.baseUrl);
+  if (base) err("origin", `${label}.baseUrl ${s.baseUrl} ${base}`);
+  const baseOrigin = safeOrigin(s.baseUrl);
+  if (m.runtimePermissions.includes("NETWORK") && s.requestOrigins.length === 0) {
+    err("origin", `${label}.requestOrigins is empty: the app denies every request of a v2 source without declared origins`);
+  }
+  if (baseOrigin && s.requestOrigins.length && !s.requestOrigins.includes(baseOrigin) && !s.contentOrigins.includes(baseOrigin)) {
+    warn("origin", `${label}.baseUrl origin ${baseOrigin} is neither a request nor a content origin`);
+  }
+  if (s.requestOrigins.length && !m.runtimePermissions.includes("NETWORK")) {
+    warn("origin", `${label}.requestOrigins is declared but NETWORK is not requested`);
+  }
+  for (const o of s.credentialOrigins) {
+    if (!s.requestOrigins.includes(o)) err("origin", `${label}.credentialOrigins ${o} must also be a request origin`);
+  }
+  if (s.browserSessionOrigins.length > 4) err("origin", `${label}.browserSessionOrigins allows at most 4 origins`);
+  if (s.browserSessionOrigins.length && !m.runtimePermissions.includes("BROWSER_CHALLENGE")) {
+    err("origin", `${label}.browserSessionOrigins needs runtime permission BROWSER_CHALLENGE`);
+  }
+  if (/\bbridge\s*\.\s*browserSessionRequest\s*\(/.test(code) && s.browserSessionOrigins.length === 0) {
+    err("origin", `${label}: browserSessionRequest is used but browserSessionOrigins is empty`);
+  }
+  for (const suffix of s.contentHostSuffixes) {
+    const problem = contentHostSuffixProblem(suffix);
+    if (problem) err("content-host-suffix", `${label}.contentHostSuffixes ${suffix}: ${problem}`);
+  }
+  if (s.contentHostSuffixes.length > MAX_CONTENT_HOST_SUFFIXES) {
+    err("content-host-suffix", `${label}.contentHostSuffixes allows at most ${MAX_CONTENT_HOST_SUFFIXES} entries`);
+  }
+  if (s.browserImageOrigins.length > 4) err("origin", `${label}.browserImageOrigins allows at most 4 origins`);
+  for (const origin2 of s.browserImageOrigins) {
+    const problem = exactHttpsOriginProblem(origin2);
+    if (problem) err("origin", `${label}.browserImageOrigins: ${origin2} ${problem}`);
+    else if (/:\d+$/.test(origin2)) err("origin", `${label}.browserImageOrigins: ${origin2} must use the default port 443`);
+    if (!s.contentOrigins.includes(origin2)) err("origin", `${label}.browserImageOrigins ${origin2} must also be a content origin`);
+  }
+  if (s.browserImageOrigins.length && !m.runtimePermissions.includes("BROWSER_IMAGES")) {
+    err("origin", `${label}.browserImageOrigins needs runtime permission BROWSER_IMAGES`);
+  }
+  if (/\bsetFavorite\s*[:=(]/.test(code) && !m.runtimePermissions.includes("FAVORITE_MUTATION")) {
+    warn("permission", `${label}: setFavorite is defined but FAVORITE_MUTATION is not requested, so the app will refuse it`);
+  }
+}
+function lintUrlLiterals(m, code, warn) {
+  const allowed = new Set(m.sources.flatMap((s) => [...s.requestOrigins, ...s.contentOrigins, ...s.browserSessionOrigins]));
+  const seen = /* @__PURE__ */ new Set();
+  for (const match of code.matchAll(/\bhttps?:\/\/[A-Za-z0-9.-]+(?::\d+)?/g)) {
+    const origin2 = safeOrigin(match[0]);
+    if (!origin2 || seen.has(origin2)) continue;
+    seen.add(origin2);
+    if (origin2.startsWith("http:")) warn("origin", `script contains a plain-HTTP URL (${origin2}); third-party packages may only use HTTPS`);
+    else if (!allowed.has(origin2)) warn("origin", `script mentions ${origin2}, which is not a declared request/content origin`);
+  }
+}
+function safeOrigin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function exactHttpsOriginProblem(origin2) {
+  let u;
+  try {
+    u = new URL(origin2);
+  } catch {
+    return "is not a valid URL";
+  }
+  if (u.protocol !== "https:") return "must use HTTPS";
+  if (u.origin !== origin2) return `must be an exact origin (expected ${u.origin})`;
+  const host = u.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (isIP(host)) return "must not be an IP address";
+  if (host === "localhost" || /\.(localhost|local|internal|lan|home|test|invalid|example)$/.test(host) || !host.includes(".")) {
+    return "must be a public host name (private, loopback and LAN hosts are never granted)";
+  }
+  return null;
+}
+var CONTENT_HOST_SUFFIX_HIGH_PORTS = ":1024-65535";
+var MAX_CONTENT_HOST_SUFFIXES = 8;
+function contentHostSuffixProblem(declared) {
+  const s = declared.endsWith(CONTENT_HOST_SUFFIX_HIGH_PORTS) ? declared.slice(0, -CONTENT_HOST_SUFFIX_HIGH_PORTS.length) : declared;
+  if (s !== s.toLowerCase()) return "must be lower-case";
+  if (s.startsWith(".") || s.startsWith("*")) return "write the bare suffix (example.com), without a leading dot or wildcard";
+  if (s.endsWith(".")) return "must not end with a dot";
+  if (s.length > 253 || !/^[a-z0-9.-]+$/.test(s)) {
+    return `must be lower-case ASCII host name characters; the only allowed port suffix is ${CONTENT_HOST_SUFFIX_HIGH_PORTS}`;
+  }
+  const labels = s.split(".");
+  if (labels.length < 2 || labels.some((l) => !l || l.length > 63 || l.startsWith("-") || l.endsWith("-"))) {
+    return "is not a valid host name with at least two labels";
+  }
+  if (/^\d+$/.test(labels[labels.length - 1]) || isIP(s)) return "must not be an IP address";
+  if (registrableDomain(s) === null) return "is a public suffix; it must be at least a registrable domain (e.g. cdn.example.com)";
+  return null;
+}
+
+// src/core/publish.ts
+import { copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3, join as join6, resolve } from "node:path";
+
+// src/core/envelope.ts
+var ENVELOPE_FORMAT = "shinsou-signed-envelope-v1";
+var SIGNATURE_DOMAIN = "dev.shinsou.repository.signature.v1\0";
+var DOCUMENT_IDS = {
+  repo: "repo.json",
+  index: "index.json",
+  legacyIndex: "index.min.json",
+  rotation: "publisher-key-rotation.json",
+  revocations: "publisher-revocations.json",
+  keyRevoked: "publisher-key-revoked.json"
+};
+var ENVELOPE_FIELDS = ["format", "algorithm", "keyFingerprint", "publicKey", "payloadType", "sequence", "payload", "signature"];
+var TrustError = class extends Error {
+  constructor(category, message) {
+    super(`${category}: ${message}`);
+    this.category = category;
+  }
+  category;
+};
+function normalizeRepositoryUrl(value2, { allowHttp = false } = {}) {
+  const trimmed = value2.trim().replace(/\/+$/, "");
+  if (trimmed.includes("?") || trimmed.includes("#")) throw new Error(`Repository URL must not have a query or fragment: ${value2}`);
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new Error(`Invalid repository URL: ${value2}`);
+  }
+  if (parsed.protocol !== "https:" && !(allowHttp && parsed.protocol === "http:")) {
+    throw new Error(`Repository URL must use HTTPS: ${value2}`);
+  }
+  if (parsed.username || parsed.password) throw new Error(`Repository URL must not contain credentials: ${value2}`);
+  const path = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/+$/, "");
+  if (path.split("/").some((s) => s === "." || s === "..")) throw new Error(`Repository URL must not contain dot segments: ${value2}`);
+  return parsed.origin + path;
+}
+function signingMessage(args) {
+  if (!Number.isSafeInteger(args.sequence) || args.sequence < 0) throw new Error("Repository sequence must be non-negative");
+  if (!args.documentId.trim() || args.documentId.length > 512) throw new Error("Invalid repository document id");
+  const statement = {
+    algorithm: "Ed25519",
+    documentId: args.documentId,
+    format: ENVELOPE_FORMAT,
+    keyFingerprint: args.keyFingerprint,
+    payload: args.payload,
+    payloadType: args.payloadType,
+    repository: args.repository,
+    sequence: args.sequence
+  };
+  return concatBytes(utf8(SIGNATURE_DOMAIN), utf8(canonicalJson(statement)));
+}
+function signEnvelope(args) {
+  const publicKey = publicKeyFromSeed(args.seed);
+  const keyFingerprint = fingerprint(publicKey);
+  if (args.payloadType === "repository-meta") {
+    const advertised = metaFingerprint(args.payload);
+    if (advertised !== keyFingerprint) {
+      throw new Error("repo.json meta.signingKeyFingerprint must equal the signing key fingerprint");
+    }
+  }
+  const message = signingMessage({ ...args, keyFingerprint });
+  return {
+    format: ENVELOPE_FORMAT,
+    algorithm: "Ed25519",
+    keyFingerprint,
+    publicKey: base64UrlEncode(publicKey),
+    payloadType: args.payloadType,
+    sequence: args.sequence,
+    payload: args.payload,
+    signature: base64UrlEncode(signEd25519(message, args.seed))
+  };
+}
+function metaFingerprint(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+  const meta = payload.meta;
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) return void 0;
+  const fp = meta.signingKeyFingerprint;
+  return typeof fp === "string" ? fp : void 0;
+}
+function verifyEnvelope(args) {
+  const env = args.envelope;
+  const malformed = (msg) => {
+    throw new TrustError("Malformed", msg);
+  };
+  if (!env || typeof env !== "object" || Array.isArray(env)) return malformed("Envelope is not an object");
+  const e = env;
+  const keys = Object.keys(e);
+  if (keys.length !== ENVELOPE_FIELDS.length || !ENVELOPE_FIELDS.every((k) => keys.includes(k))) {
+    malformed("Unknown or missing signed-envelope field");
+  }
+  const str = (k) => {
+    const v = e[k];
+    if (typeof v !== "string" || !v.trim()) malformed(`Missing '${k}'`);
+    return v;
+  };
+  if (str("format") !== ENVELOPE_FORMAT) malformed("Unexpected envelope format");
+  if (str("algorithm") !== "Ed25519") malformed("Unexpected algorithm");
+  if (str("payloadType") !== args.payloadType) malformed("Unexpected payload type");
+  const sequence = e.sequence;
+  if (typeof sequence !== "number" || !Number.isSafeInteger(sequence)) malformed("Missing signed-envelope sequence");
+  if (sequence < 0) malformed("Repository sequence must be non-negative");
+  let wirePublicKey, wireSignature, pinnedPublicKey;
+  try {
+    wirePublicKey = base64UrlDecodeCanonical(str("publicKey"), 32);
+    wireSignature = base64UrlDecodeCanonical(str("signature"), 64);
+    pinnedPublicKey = base64UrlDecodeCanonical(args.pinned.publicKey, 32);
+  } catch (err) {
+    if (err instanceof TrustError) throw err;
+    return malformed(err.message);
+  }
+  const wireFingerprint = str("keyFingerprint");
+  const calculated = fingerprint(pinnedPublicKey);
+  if (args.pinned.fingerprint !== calculated || wireFingerprint !== calculated || !bytesEqual(wirePublicKey, pinnedPublicKey)) {
+    throw new TrustError("KeySubstitution", "Repository signing key does not match its pinned trust root");
+  }
+  const payload = e.payload;
+  if (args.payloadType === "repository-meta" && metaFingerprint(payload) !== wireFingerprint) {
+    malformed("Repository metadata signing fingerprint does not match the authenticated key");
+  }
+  let message;
+  try {
+    message = signingMessage({
+      repository: args.repository,
+      payloadType: args.payloadType,
+      documentId: args.documentId,
+      sequence,
+      keyFingerprint: wireFingerprint,
+      payload
+    });
+  } catch (err) {
+    return malformed(err.message);
+  }
+  if (!verifyEd25519(wireSignature, message, pinnedPublicKey)) {
+    throw new TrustError("InvalidSignature", "Invalid repository author signature");
+  }
+  return { payload, sequence };
+}
+
+// src/core/publisher.ts
+var ROTATION_DOMAIN = "dev.shinsou.publisher.rotation.v1\0";
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var MAX_REVOKED_ARTIFACTS = 4096;
+var DEFAULT_REVOCATIONS_TTL_SECONDS = 30 * 24 * 60 * 60;
+function rotationStatement(args) {
+  if (!Number.isSafeInteger(args.effectiveSequence) || args.effectiveSequence < 0) {
+    throw new Error("effectiveSequence must be a non-negative integer");
+  }
+  const body = {
+    effectiveSequence: args.effectiveSequence,
+    newKeyFingerprint: args.newKeyFingerprint,
+    newPublicKey: args.newPublicKey,
+    oldKeyFingerprint: args.oldKeyFingerprint,
+    publisherId: args.publisherId
+  };
+  return concatBytes(utf8(ROTATION_DOMAIN), utf8(canonicalJson(body)));
+}
+function rotationPayload(args) {
+  const newPublicKeyBytes = publicKeyFromSeed(args.newSeed);
+  const newPublicKey = base64UrlEncode(newPublicKeyBytes);
+  const newKeyFingerprint = fingerprint(newPublicKeyBytes);
+  const statement = rotationStatement({
+    publisherId: args.publisherId,
+    oldKeyFingerprint: args.oldKeyFingerprint,
+    newPublicKey,
+    newKeyFingerprint,
+    effectiveSequence: args.effectiveSequence
+  });
+  return {
+    publisherId: args.publisherId,
+    newPublicKey,
+    newKeyFingerprint,
+    effectiveSequence: args.effectiveSequence,
+    newKeySignature: base64UrlEncode(signEd25519(statement, args.newSeed))
+  };
+}
+function revocationsPayload(args) {
+  const artifacts = [...new Set(args.revokedArtifacts)];
+  for (const a of artifacts) if (!SHA256_HEX.test(a)) throw new Error(`Revoked artifact must be lowercase SHA-256 hex: ${a}`);
+  if (artifacts.length > MAX_REVOKED_ARTIFACTS) throw new Error(`At most ${MAX_REVOKED_ARTIFACTS} revoked artifacts`);
+  if (!Number.isSafeInteger(args.expiresAt) || args.expiresAt <= 0) throw new Error("expiresAt must be Unix seconds");
+  return { publisherId: args.publisherId, revokedArtifacts: artifacts, expiresAt: args.expiresAt };
+}
+function keyRevokedPayload(args) {
+  return { publisherId: args.publisherId, revokedKeyFingerprint: args.revokedKeyFingerprint };
+}
+
+// src/core/publish.ts
+var DEFAULT_PUBLIC_DIR = "public";
+function mirrorSlug(normalizedUrl) {
+  return normalizedUrl.replace(/^https:\/\//, "").replace(/[^A-Za-z0-9.-]+/g, "_");
+}
+function resolveMirrors(projectDir, mirrors) {
+  const list = mirrors?.length ? mirrors : loadManifest(projectDir).repository.mirrors;
+  if (!list.length) throw new Error("No mirror URL: pass --mirror <https://\u2026> or set repository.mirrors in shinsou.plugin.json");
+  return [...new Set(list.map((m) => normalizeRepositoryUrl(m)))];
+}
+function requireSigningKey(state, key) {
+  if (!state.publisherId || !state.currentKey) {
+    state.publisherId = key.fingerprint;
+    state.currentKey = { name: key.name, publicKey: key.publicKey, fingerprint: key.fingerprint };
+    return;
+  }
+  if (state.keyRevoked) throw new Error("The publisher key was revoked; publish under a new key (users must trust it again)");
+  if (state.currentKey.fingerprint !== key.fingerprint) {
+    const retired = state.retiredKeys.some((k) => k.fingerprint === key.fingerprint);
+    throw new Error(
+      `${key.name} (${key.fingerprint}) is ${retired ? "a retired key" : "not this repository's key"}; the current key is '${state.currentKey.name}' (${state.currentKey.fingerprint}). Use 'rotate' to change keys.`
+    );
+  }
+}
+function revocationsDoc(state, opts) {
+  const previous = state.documents[DOCUMENT_IDS.revocations];
+  const half = Math.floor(opts.ttlSeconds / 2);
+  const keep = !opts.refresh && previous?.expiresAt !== void 0 && previous.expiresAt - opts.now > half;
+  const expiresAt = keep ? previous.expiresAt : opts.now + opts.ttlSeconds;
+  return {
+    documentId: DOCUMENT_IDS.revocations,
+    payloadType: "publisher-revocations",
+    payload: revocationsPayload({ publisherId: state.publisherId, revokedArtifacts: state.revokedArtifacts, expiresAt })
+  };
+}
+function signDocs(args) {
+  if (args.flat && args.mirrors.length !== 1) throw new Error("--flat needs exactly one mirror");
+  const sequences = args.docs.map((d) => nextSequence(args.state, d.documentId, d.payload));
+  const outputs = [];
+  for (const mirror of args.mirrors) {
+    const dir = args.flat ? args.outDir : join6(args.outDir, mirrorSlug(mirror));
+    const documents = [];
+    args.docs.forEach((d, i) => {
+      const envelope = signEnvelope({
+        seed: args.key.seed,
+        repository: mirror,
+        payloadType: d.payloadType,
+        documentId: d.documentId,
+        sequence: sequences[i],
+        payload: d.payload
+      });
+      verifyEnvelope({
+        envelope,
+        repository: mirror,
+        payloadType: d.payloadType,
+        documentId: d.documentId,
+        pinned: { publicKey: args.key.publicKey, fingerprint: args.key.fingerprint }
+      });
+      const target = join6(dir, d.documentId);
+      mkdirSync4(dirname3(target), { recursive: true });
+      writeFileSync4(target, JSON.stringify(envelope, null, 2) + "\n");
+      documents.push({ documentId: d.documentId, sequence: sequences[i] });
+    });
+    for (const [rel, from] of Object.entries(args.copy ?? {})) {
+      const target = join6(dir, rel);
+      mkdirSync4(dirname3(target), { recursive: true });
+      copyFileSync(from, target);
+    }
+    outputs.push({ mirror, dir, documents });
+  }
+  if (args.docs.some((d) => d.documentId === DOCUMENT_IDS.revocations)) {
+    const rev = args.docs.find((d) => d.documentId === DOCUMENT_IDS.revocations).payload;
+    args.state.documents[DOCUMENT_IDS.revocations].expiresAt = rev.expiresAt;
+  }
+  return outputs;
+}
+async function signRepository(args) {
+  const state = loadState(args.projectDir);
+  requireSigningKey(state, args.key);
+  saveState(args.projectDir, state);
+  const built = await buildProject(args.projectDir);
+  const mirrors = resolveMirrors(args.projectDir, args.mirrors);
+  const m = built.manifest;
+  const docs = [
+    { documentId: DOCUMENT_IDS.repo, payloadType: "repository-meta", payload: repoMetaDocument(m, args.key.fingerprint) },
+    { documentId: DOCUMENT_IDS.index, payloadType: "repository-index", payload: built.index },
+    { documentId: sidecarUrl(m), payloadType: "plugin-sidecar", payload: built.sidecar },
+    revocationsDoc(state, { refresh: false, ttlSeconds: args.ttlSeconds ?? DEFAULT_REVOCATIONS_TTL_SECONDS, now: args.now ?? nowSeconds() })
+  ];
+  const outputs = signDocs({
+    state,
+    key: args.key,
+    mirrors,
+    docs,
+    outDir: resolve(args.projectDir, args.outDir ?? DEFAULT_PUBLIC_DIR),
+    copy: { [scriptUrl(m)]: join6(built.outDir, scriptUrl(m)) }
+  });
+  saveState(args.projectDir, state);
+  return outputs;
+}
+function refreshRevocations(args) {
+  const state = loadState(args.projectDir);
+  if (!state.publisherId) throw new Error("Nothing signed yet: run 'shinsou-plugin sign' first");
+  requireSigningKey(state, args.key);
+  if (args.onlyIfDue && !(args.add ?? []).length) {
+    const expiresAt = state.documents[DOCUMENT_IDS.revocations]?.expiresAt;
+    const ttl = args.ttlSeconds ?? DEFAULT_REVOCATIONS_TTL_SECONDS;
+    if (expiresAt !== void 0 && expiresAt - (args.now ?? nowSeconds()) > Math.floor(ttl / 2)) return [];
+  }
+  for (const raw of args.add ?? []) {
+    const digest = raw.toLowerCase().replace(/^sha256:/, "");
+    if (!SHA256_HEX.test(digest)) throw new Error(`Not a SHA-256 hex digest: ${raw}`);
+    if (!state.revokedArtifacts.includes(digest)) state.revokedArtifacts.push(digest);
+  }
+  const outputs = signDocs({
+    state,
+    key: args.key,
+    mirrors: resolveMirrors(args.projectDir, args.mirrors),
+    docs: [revocationsDoc(state, { refresh: true, ttlSeconds: args.ttlSeconds ?? DEFAULT_REVOCATIONS_TTL_SECONDS, now: args.now ?? nowSeconds() })],
+    outDir: resolve(args.projectDir, args.outDir ?? DEFAULT_PUBLIC_DIR),
+    flat: args.flat
+  });
+  saveState(args.projectDir, state);
+  return outputs;
+}
+async function rotateKey(args) {
+  const state = loadState(args.projectDir);
+  if (!state.publisherId || !state.currentKey) throw new Error("Nothing signed yet: run 'shinsou-plugin sign' first");
+  requireSigningKey(state, args.oldKey);
+  if (args.newKey.fingerprint === args.oldKey.fingerprint) throw new Error("The new key is the current key");
+  if (state.retiredKeys.some((k) => k.fingerprint === args.newKey.fingerprint)) throw new Error("The new key was already retired");
+  const effectiveSequence = state.rotationSequence + 1;
+  const payload = rotationPayload({
+    publisherId: state.publisherId,
+    oldKeyFingerprint: args.oldKey.fingerprint,
+    newSeed: args.newKey.seed,
+    effectiveSequence
+  });
+  const mirrors = resolveMirrors(args.projectDir, args.mirrors);
+  const outDir = join6(args.projectDir, args.outDir ?? DEFAULT_PUBLIC_DIR);
+  const rotation = signDocs({
+    state,
+    key: args.oldKey,
+    mirrors,
+    docs: [{ documentId: DOCUMENT_IDS.rotation, payloadType: "publisher-key-rotation", payload }],
+    outDir
+  });
+  state.retiredKeys.push({ ...state.currentKey, retiredAt: (/* @__PURE__ */ new Date()).toISOString() });
+  state.currentKey = { name: args.newKey.name, publicKey: args.newKey.publicKey, fingerprint: args.newKey.fingerprint };
+  state.rotationSequence = effectiveSequence;
+  saveState(args.projectDir, state);
+  const resigned = await signRepository({ projectDir: args.projectDir, key: args.newKey, mirrors, outDir: args.outDir, now: args.now });
+  return { rotation, resigned, effectiveSequence };
+}
+function revokeKey(args) {
+  const state = loadState(args.projectDir);
+  if (!state.publisherId) throw new Error("Nothing signed yet");
+  const isCurrent = state.currentKey?.fingerprint === args.key.fingerprint;
+  const isRetired = state.retiredKeys.some((k) => k.fingerprint === args.key.fingerprint);
+  if (!isCurrent && !isRetired) throw new Error(`${args.key.name} is not a key of this publisher`);
+  const outputs = signDocs({
+    state,
+    key: args.key,
+    mirrors: resolveMirrors(args.projectDir, args.mirrors),
+    docs: [
+      {
+        documentId: DOCUMENT_IDS.keyRevoked,
+        payloadType: "publisher-key-revoked",
+        payload: keyRevokedPayload({ publisherId: state.publisherId, revokedKeyFingerprint: args.key.fingerprint })
+      }
+    ],
+    outDir: resolve(args.projectDir, args.outDir ?? DEFAULT_PUBLIC_DIR)
+  });
+  if (isCurrent) state.keyRevoked = true;
+  saveState(args.projectDir, state);
+  return outputs;
+}
+function nowSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+async function signExistingRepository(args) {
+  if (!args.mirrors.length) throw new Error("No mirror URL: pass --mirror <https://\u2026> (the URL users add, without index.json)");
+  const mirrors = [...new Set(args.mirrors.map((m) => normalizeRepositoryUrl(m)))];
+  const readJson = (rel) => {
+    const path = join6(args.repoDir, rel);
+    if (!existsSync4(path)) throw new Error(`${rel} is missing`);
+    const value2 = JSON.parse(readFileSync5(path, "utf8"));
+    if (value2 && typeof value2 === "object" && "signature" in value2 && "payload" in value2) {
+      throw new Error(`${rel} is already a signed envelope; sign the unsigned source files`);
+    }
+    return value2;
+  };
+  const relPath = (value2, what) => {
+    const rel = String(value2 ?? "");
+    if (!rel || rel.startsWith("/") || rel.includes("\\") || rel.split("/").some((p) => p === ".." || p === "")) {
+      throw new Error(`${what} '${rel}' is not a safe relative path`);
+    }
+    return rel;
+  };
+  const repo = readJson(DOCUMENT_IDS.repo);
+  const meta = repo.meta ?? {};
+  for (const field of ["name", "shortName", "website"]) {
+    if (typeof meta[field] !== "string" || !meta[field].length) throw new Error(`repo.json meta.${field} is missing`);
+  }
+  const index = readJson(DOCUMENT_IDS.index);
+  if (index.format !== INDEX_FORMAT) throw new Error(`index.json format must be ${INDEX_FORMAT}`);
+  const packages = index.packages ?? [];
+  if (!Array.isArray(packages) || packages.length === 0) throw new Error("index.json has no packages");
+  const problems = [];
+  const named = (value2, what) => {
+    const term = misleadingTerm(String(value2 ?? ""));
+    if (term) problems.push(`${what} '${String(value2)}' uses the misleading term '${term}'`);
+  };
+  named(meta.name, "repository name");
+  named(meta.shortName, "repository shortName");
+  const docs = [];
+  const copy = {};
+  const ids = [];
+  const unchecked = [];
+  for (const pkg of packages) {
+    const id = String(pkg.id);
+    ids.push(id);
+    named(pkg.name, `${id} name`);
+    for (const source of pkg.sources ?? []) named(source.name, `${id} source name`);
+    const script = relPath(pkg.scriptUrl, `${id} scriptUrl`);
+    const scriptFile = join6(args.repoDir, script);
+    if (!existsSync4(scriptFile)) {
+      problems.push(`${id}: ${script} is missing`);
+      continue;
+    }
+    const scriptBytes = new Uint8Array(readFileSync5(scriptFile));
+    if (sha256Hex(scriptBytes) !== pkg.sha256) problems.push(`${id}: ${script} does not match its sha256 in index.json`);
+    if (scriptBytes.length !== pkg.byteSize) problems.push(`${id}: ${script} is ${scriptBytes.length} bytes, index.json says ${String(pkg.byteSize)}`);
+    copy[script] = scriptFile;
+    if (pkg.sidecarUrl === void 0) {
+      if (pkg.contract === "shinsou") problems.push(`${id}: a Shinsou package needs a sidecarUrl`);
+      unchecked.push(id);
+      continue;
+    }
+    const sidecarRel = relPath(pkg.sidecarUrl, `${id} sidecarUrl`);
+    const sidecar = readJson(sidecarRel);
+    if (pkg.contract === "shinsou") {
+      for (const p of checkPackageConsistency({ index, pkg, sidecar, scriptBytes })) problems.push(p);
+    } else {
+      unchecked.push(id);
+    }
+    docs.push({ documentId: sidecarRel, payloadType: "plugin-sidecar", payload: sidecar });
+  }
+  if (new Set(ids).size !== ids.length) problems.push("index.json lists a package id more than once");
+  if (problems.length) throw new Error(`Repository cannot be signed:
+  - ${problems.join("\n  - ")}`);
+  const state = loadState(args.repoDir);
+  requireSigningKey(state, args.key);
+  const repoMeta = {
+    ...repo,
+    meta: { name: meta.name, shortName: meta.shortName, website: meta.website, signingKeyFingerprint: args.key.fingerprint }
+  };
+  const outputs = signDocs({
+    state,
+    key: args.key,
+    mirrors,
+    docs: [
+      { documentId: DOCUMENT_IDS.repo, payloadType: "repository-meta", payload: repoMeta },
+      { documentId: DOCUMENT_IDS.index, payloadType: "repository-index", payload: index },
+      ...docs,
+      revocationsDoc(state, { refresh: false, ttlSeconds: args.ttlSeconds ?? DEFAULT_REVOCATIONS_TTL_SECONDS, now: args.now ?? nowSeconds() })
+    ],
+    outDir: resolve(args.repoDir, args.outDir ?? "signed"),
+    copy,
+    flat: args.flat
+  });
+  saveState(args.repoDir, state);
+  return { outputs, packages: ids, unchecked };
+}
+
+// src/commands/init.ts
+import { cpSync, existsSync as existsSync5, mkdirSync as mkdirSync5, readdirSync, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { basename, join as join7, resolve as resolve2 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var TEMPLATES = ["manga", "novel", "mixed", "async"];
+function templatesDir() {
+  const here = fileURLToPath2(new URL(".", import.meta.url));
+  for (const candidate of [join7(here, "..", "templates"), join7(here, "..", "..", "templates")]) {
+    if (existsSync5(join7(candidate, "manga"))) return candidate;
+  }
+  throw new Error("templates directory not found next to the CLI");
+}
+function initProject(args) {
+  const dir = resolve2(args.dir);
+  if (!TEMPLATES.includes(args.template)) throw new Error(`Unknown template '${args.template}' (manga | novel | mixed | async)`);
+  mkdirSync5(dir, { recursive: true });
+  if (existsSync5(join7(dir, MANIFEST_FILE))) throw new Error(`${join7(dir, MANIFEST_FILE)} already exists`);
+  const leftovers = readdirSync(dir).filter((n) => !n.startsWith("."));
+  if (leftovers.includes("src") || leftovers.includes("test")) throw new Error(`${dir} already has src/ or test/; use an empty directory`);
+  const lang = args.lang ?? "zh";
+  const slug = basename(dir).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "plugin";
+  const packageId = args.packageId ?? `${lang}.${slug.replace(/-/g, "")}`;
+  const name = args.name ?? slug;
+  const sourceId = defaultSourceId(sha256(utf8(`${packageId}/${lang}/1`)));
+  const t = templatesDir();
+  cpSync(join7(t, args.template), dir, { recursive: true });
+  const mangaSourceId = sourceId;
+  const novelSourceId = defaultSourceId(sha256(utf8(`${packageId}/${lang}/2`)));
+  if (args.template === "mixed") {
+    for (const file of ["src/index.js", "test/cases.json"]) {
+      const path = join7(dir, file);
+      writeFileSync5(
+        path,
+        readFileSync6(path, "utf8").replaceAll("__MANGA_SOURCE_ID__", mangaSourceId).replaceAll("__NOVEL_SOURCE_ID__", novelSourceId)
+      );
+    }
+  }
+  cpSync(join7(t, "common", ".github"), join7(dir, ".github"), { recursive: true });
+  cpSync(join7(t, "common", "gitignore"), join7(dir, ".gitignore"));
+  const profile = {
+    manga: {
+      contentType: "manga",
+      contentKinds: ["IMAGE_SEQUENCE"],
+      capabilities: ["CATALOGUE", "LATEST", "BROWSE", "METADATA", "UNITS", "CONTENT", "SEARCH"],
+      baseUrl: "https://example.com",
+      requestOrigins: ["https://example.com"],
+      contentOrigins: ["https://example.com"]
+    },
+    novel: {
+      contentType: "novel",
+      contentKinds: ["PLAIN_TEXT"],
+      capabilities: ["CATALOGUE", "LATEST", "BROWSE", "METADATA", "UNITS", "CONTENT", "SEARCH"],
+      baseUrl: "https://example.com",
+      requestOrigins: ["https://example.com"],
+      contentOrigins: []
+    },
+    mixed: {
+      contentType: "both",
+      contentKinds: ["IMAGE_SEQUENCE", "PLAIN_TEXT"],
+      capabilities: ["CATALOGUE", "LATEST", "BROWSE", "METADATA", "UNITS", "CONTENT", "SEARCH"],
+      baseUrl: "https://example.com",
+      requestOrigins: ["https://example.com"],
+      contentOrigins: ["https://example.com"]
+    },
+    async: {
+      contentType: "manga",
+      contentKinds: ["IMAGE_SEQUENCE"],
+      capabilities: ["CATALOGUE", "BROWSE", "METADATA", "UNITS", "CONTENT", "SEARCH"],
+      baseUrl: "https://example.com",
+      requestOrigins: ["https://api.example.com"],
+      contentOrigins: ["https://example.com", "https://cdn.example.com"]
+    }
+  }[args.template];
+  const sourceFor = (id, sourceName, p, extra = {}) => ({
+    sourceId: id,
+    legacyLongId: null,
+    name: sourceName,
+    lang,
+    baseUrl: p.baseUrl,
+    ...extra,
+    requestOrigins: p.requestOrigins,
+    credentialOrigins: [],
+    contentOrigins: p.contentOrigins,
+    browserSessionOrigins: [],
+    contentHostSuffixes: []
+  });
+  const sources = args.template === "mixed" ? [
+    sourceFor(mangaSourceId, name, profile, { contentType: "manga", contentKinds: ["IMAGE_SEQUENCE"] }),
+    sourceFor(
+      novelSourceId,
+      `${name} Novel`,
+      { baseUrl: "https://novel.example.com", requestOrigins: ["https://novel.example.com"], contentOrigins: [] },
+      { contentType: "novel", contentKinds: ["PLAIN_TEXT"] }
+    )
+  ] : [sourceFor(sourceId, name, profile)];
+  const manifest = {
+    manifestVersion: 1,
+    packageId,
+    name,
+    version: "0.1.0",
+    versionCode: 1,
+    lang,
+    nsfw: false,
+    contract: "shinsou",
+    runtime: "legacy-shinsou-adapter-v2",
+    contentType: profile.contentType,
+    contentKinds: profile.contentKinds,
+    capabilities: profile.capabilities,
+    runtimePermissions: ["EXECUTE_SCRIPT", "NETWORK"],
+    requestedHostPermissions: [],
+    systemEvents: { required: [], optional: [] },
+    entry: "src/index.js",
+    sources,
+    repository: {
+      name: "My Shinsou Plugins",
+      shortName: "My Plugins",
+      website: "https://github.com/you/your-plugins",
+      mirrors: ["https://you.github.io/your-plugins"]
+    },
+    test: { cases: "test/cases.json", fixtures: "test/fixtures" }
+  };
+  writeFileSync5(join7(dir, MANIFEST_FILE), JSON.stringify(manifest, null, 2) + "\n");
+  if (!existsSync5(join7(dir, "package.json"))) {
+    const pkg = {
+      name: slug,
+      private: true,
+      type: "module",
+      scripts: {
+        build: "shinsou-plugin build",
+        lint: "shinsou-plugin lint",
+        test: "shinsou-plugin test",
+        dev: "shinsou-plugin serve",
+        sign: "shinsou-plugin sign"
+      },
+      devDependencies: { "@shinsou/plugin": `^${args.cliVersion}` }
+    };
+    writeFileSync5(join7(dir, "package.json"), JSON.stringify(pkg, null, 2) + "\n");
+  }
+  return [MANIFEST_FILE, "package.json", "src/", "test/", ".github/workflows/shinsou-refresh.yml", ".gitignore"];
+}
+
+// src/commands/serve.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7, statSync, watch } from "node:fs";
+import { createServer } from "node:http";
+import { isIP as isIP2 } from "node:net";
+import { networkInterfaces } from "node:os";
+import { join as join8, normalize, relative, sep } from "node:path";
+function isPrivateIPv4(ip) {
+  const p = ip.split(".").map(Number);
+  if (p.length !== 4 || p.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return false;
+  return p[0] === 10 || p[0] === 172 && p[1] >= 16 && p[1] <= 31 || p[0] === 192 && p[1] === 168 || p[0] === 169 && p[1] === 254;
+}
+function localLanAddresses() {
+  return Object.values(networkInterfaces()).flat().filter((i) => !!i && i.family === "IPv4" && !i.internal && isPrivateIPv4(i.address)).map((i) => i.address);
+}
+function resolveServeHost(host) {
+  if (host === "127.0.0.1" || host === "localhost") return "127.0.0.1";
+  if (host === "::1") return "::1";
+  if (host === "lan") {
+    const lan = localLanAddresses();
+    if (!lan.length) throw new Error("\u627E\u4E0D\u5230\u5340\u57DF\u7DB2\u8DEF IPv4 \u4F4D\u5740\uFF1B\u8ACB\u6539\u7528 --host <IP>");
+    return lan[0];
+  }
+  if (isIP2(host) !== 4 || !isPrivateIPv4(host)) {
+    throw new Error(`--host \u53EA\u63A5\u53D7 127.0.0.1\u3001::1 \u6216\u672C\u6A5F\u7684\u79C1\u6709\u5340\u57DF\u7DB2\u8DEF IPv4 \u4F4D\u5740\uFF0810/8\u3001172.16/12\u3001192.168/16\uFF09\uFF0C\u6536\u5230 ${host}`);
+  }
+  if (!localLanAddresses().includes(host)) throw new Error(`${host} \u4E0D\u662F\u9019\u53F0\u96FB\u8166\u7684\u7DB2\u8DEF\u4ECB\u9762\u4F4D\u5740`);
+  return host;
+}
+function devRepositoryLink(baseUrl) {
+  return `shinsou://add-dev-repository?url=${encodeURIComponent(baseUrl)}`;
+}
+var CONTENT_TYPES2 = {
+  ".json": "application/json; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".png": "image/png",
+  ".webp": "image/webp"
+};
+async function serveProject(args) {
+  const log = args.onEvent ?? ((m) => console.log(m));
+  const host = resolveServeHost(args.host);
+  const root = join8(args.projectDir, DEFAULT_OUT_DIR);
+  let revision = 0;
+  let last = null;
+  let lastError = null;
+  const rebuild = async () => {
+    try {
+      last = await buildProject(args.projectDir);
+      revision++;
+      lastError = null;
+      log(`[build #${revision}] ${last.manifest.packageId} ${last.manifest.version} sha256=${last.sha256.slice(0, 12)}\u2026 ${last.byteSize} bytes`);
+    } catch (err) {
+      lastError = err.message;
+      log(`[build \u5931\u6557\uFF0C\u7E7C\u7E8C\u63D0\u4F9B\u4E0A\u4E00\u500B\u7248\u672C] ${lastError}`);
+    }
+  };
+  await rebuild();
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://dev.invalid");
+    res.setHeader("Cache-Control", "no-store");
+    if (url.pathname === "/__shinsou-dev/status") {
+      res.setHeader("Content-Type", "application/json; charset=utf-8");
+      res.end(JSON.stringify({ revision, ok: lastError === null, error: lastError, sha256: last?.sha256 ?? null, packageId: last?.manifest.packageId ?? null }));
+      return;
+    }
+    let rel;
+    try {
+      rel = normalize(decodeURIComponent(url.pathname)).replace(/^[/\\]+/, "");
+    } catch {
+      res.statusCode = 400;
+      res.end();
+      return;
+    }
+    const file = join8(root, rel || "index.json");
+    const inside = relative(root, file);
+    if (inside.startsWith("..") || inside.split(sep).includes("..") || !existsSync6(file) || !statSync(file).isFile()) {
+      res.statusCode = 404;
+      res.end("not found");
+      return;
+    }
+    const ext = file.slice(file.lastIndexOf("."));
+    res.setHeader("Content-Type", CONTENT_TYPES2[ext] ?? "application/octet-stream");
+    res.end(readFileSync7(file));
+    log(`${req.method} ${url.pathname}`);
+  });
+  await new Promise((resolveListen, reject) => {
+    server.once("error", reject);
+    server.listen(args.port, host, () => resolveListen());
+  });
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : args.port;
+  const baseUrl = `http://${host.includes(":") ? `[${host}]` : host}:${port}`;
+  let watcher = null;
+  if (args.watchFiles !== false) {
+    let timer = null;
+    const ignored = /^(build|public|node_modules|\.git|\.shinsou)([/\\]|$)/;
+    watcher = watch(args.projectDir, { recursive: true }, (_event, filename) => {
+      if (!filename || ignored.test(String(filename))) return;
+      if (timer) clearTimeout(timer);
+      timer = setTimeout(() => void rebuild(), 150);
+    });
+  }
+  return {
+    server,
+    baseUrl,
+    link: devRepositoryLink(baseUrl),
+    close: () => new Promise((r) => {
+      watcher?.close();
+      server.close(() => r());
+    })
+  };
+}
+
+// src/runner/harness.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync as readdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join9 } from "node:path";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
+
+// src/core/sandbox-protocol.ts
+var MAX_FRAME_BYTES = 1 << 20;
+var CHUNK_PAYLOAD_BYTES = MAX_FRAME_BYTES - 16;
+var ERROR_CODES = {
+  SCRIPT_ERROR: 1,
+  LIMIT_MEMORY: 2,
+  LIMIT_STACK: 3,
+  LIMIT_TIME: 4,
+  LIMIT_BRIDGE: 5,
+  LIMIT_RESULT: 6,
+  CANCELLED: 7,
+  NO_SUCH_HOOK: 8,
+  PROMISE_STALLED: 9,
+  INTERNAL: 10,
+  BAD_ARGUMENT: 11,
+  UNSUPPORTED_PROTOCOL: 32,
+  PERMISSION_DENIED: 33,
+  UNKNOWN_OPERATION: 34,
+  HOST_FAILURE: 35,
+  NETWORK_FAILED: 36,
+  REVOKED: 37
+};
+var KNOWN_ERROR_CODES = new Set(Object.values(ERROR_CODES));
+var DEFAULT_FIELD_LIMITS = {
+  maxScriptBytes: 8 << 20,
+  maxMethodBytes: 256,
+  maxJsonBytes: 4 << 20,
+  maxLogBytes: 16 * 1024
+};
+
+// src/runner/fixture-host.ts
+var CREDENTIAL_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
+  "set-cookie",
+  "set-cookie2",
+  "cookie",
+  "authorization",
+  "proxy-authorization",
+  "www-authenticate",
+  "proxy-authenticate"
+]);
+function fixtureKey(method, url, body = "") {
+  return `${method.toUpperCase()} ${url}${method.toUpperCase() === "GET" ? "" : `
+${body}`}`;
+}
+var FixtureBridgeHost = class {
+  constructor(manifest, source, fixtures, opts = {}) {
+    this.manifest = manifest;
+    this.source = source;
+    for (const f of fixtures) this.fixtures.set(fixtureKey(f.request.method, f.request.url, f.request.body ?? ""), f);
+    for (const [k, v] of Object.entries(opts.preferences ?? {})) this.prefs.set(k, v);
+    this.credential = opts.credential ?? null;
+  }
+  manifest;
+  source;
+  events = [];
+  misses = [];
+  logs = [];
+  fixtures = /* @__PURE__ */ new Map();
+  prefs = /* @__PURE__ */ new Map();
+  cookies = /* @__PURE__ */ new Map();
+  credential;
+  log(message) {
+    this.logs.push(message);
+  }
+  call(op, argsJson) {
+    let args;
+    try {
+      args = JSON.parse(argsJson);
+      if (!Array.isArray(args)) return fail(ERROR_CODES.BAD_ARGUMENT);
+    } catch {
+      return fail(ERROR_CODES.BAD_ARGUMENT);
+    }
+    const s = (i) => typeof args[i] === "string" ? args[i] : args[i] == null ? "" : String(args[i]);
+    const map = (i) => args[i] && typeof args[i] === "object" ? args[i] : {};
+    switch (op) {
+      case "httpGet":
+      case "httpGetWithHeaders":
+      case "httpGetResponse": {
+        const r = this.http(op, "GET", s(0), "", map(1));
+        if (!r.ok) return r;
+        return value(op === "httpGetResponse" ? { status: r.response.status, body: r.response.body } : r.response.body);
+      }
+      case "httpPost":
+      case "httpPostResponse": {
+        const r = this.http(op, "POST", s(0), s(1), map(2));
+        if (!r.ok) return r;
+        return value(op === "httpPostResponse" ? { status: r.response.status, body: r.response.body } : r.response.body);
+      }
+      case "httpPostBatch": {
+        const urls = Array.isArray(args[0]) ? args[0] : [];
+        const bodies = Array.isArray(args[1]) ? args[1] : [];
+        const out = [];
+        for (let i = 0; i < urls.length; i++) {
+          const r = this.http(op, "POST", String(urls[i]), String(bodies[i] ?? ""), map(2));
+          if (!r.ok && r.code === ERROR_CODES.PERMISSION_DENIED) return r;
+          out.push(r.ok ? r.response.body : null);
+        }
+        return value(JSON.stringify(out));
+      }
+      case "browserSessionRequest": {
+        if (!this.has("BROWSER_CHALLENGE")) return this.deny(op, "BROWSER_CHALLENGE not declared");
+        const target = origin(s(0));
+        if (!target || !this.source.browserSessionOrigins.includes(target)) return this.deny(op, `${s(0)} is not a browserSessionOrigin`);
+        const r = this.http(op, s(1) || "GET", s(0), s(2), map(3), true);
+        return r.ok ? value({ status: r.response.status, body: r.response.body }) : r;
+      }
+      case "getPreference":
+        return value(this.prefs.has(s(0)) ? this.prefs.get(s(0)) : null);
+      case "setPreference":
+        this.prefs.set(s(0), s(1));
+        return value(null);
+      case "getCredentialUsername":
+        return this.has("CREDENTIAL_ACCESS") ? value(this.credential?.username ?? null) : this.deny(op, "CREDENTIAL_ACCESS not declared");
+      case "hasCredential":
+        return this.has("CREDENTIAL_ACCESS") ? value(!!this.credential?.username) : this.deny(op, "CREDENTIAL_ACCESS not declared");
+      case "getCredentialPassword":
+      case "setCredential":
+      case "clearCredential":
+        return this.deny(op, "credential secrets are only available during a host-started login");
+      case "getCookie":
+      case "getCookies":
+        return this.has("COOKIE_STORAGE") && this.has("COOKIE_READ") ? value(op === "getCookie" ? this.cookies.get(s(0)) ?? null : Object.fromEntries(this.cookies)) : this.deny(op, "COOKIE_STORAGE and COOKIE_READ are both required");
+      case "setCookie":
+        if (!this.has("COOKIE_STORAGE")) return this.deny(op, "COOKIE_STORAGE not declared");
+        this.cookies.set(s(0), s(1));
+        return value(true);
+      case "deleteCookie":
+        if (!this.has("COOKIE_STORAGE")) return this.deny(op, "COOKIE_STORAGE not declared");
+        this.cookies.delete(s(0));
+        return value(null);
+      case "clearCookies":
+        if (!this.has("COOKIE_STORAGE")) return this.deny(op, "COOKIE_STORAGE not declared");
+        this.cookies.clear();
+        return value(null);
+      case "requestLogin":
+        return value(false);
+      case "requestHostEvent":
+        return value(JSON.stringify({ messageId: "", disposition: "UNSUPPORTED" }));
+      case "getHostEventContext":
+        return value(null);
+      case "getHostEventCapabilities":
+        return value({ enabled: false, protocol: "dev.shinsou.system", version: null, grantedCapabilities: [], hardLimits: null });
+      case "log":
+        this.logs.push(s(0));
+        return value(null);
+      // DOM bookkeeping calls made by the bootstrap's in-sandbox parser.
+      case "domParse":
+        return value({ maxNodes: 2e5, maxDepth: 512 });
+      case "domSelect":
+      case "domParsed":
+      case "domDepth":
+      case "domRelease":
+      case "domReleaseAll":
+        return value(null);
+      default:
+        this.events.push({ kind: "unknown-op", op, detail: "not a sandbox bridge operation" });
+        return fail(ERROR_CODES.UNKNOWN_OPERATION);
+    }
+  }
+  async callAsync(op, argsJson) {
+    if (op !== "net.fetch") return fail(ERROR_CODES.UNKNOWN_OPERATION);
+    let args;
+    try {
+      args = JSON.parse(argsJson);
+    } catch {
+      return fail(ERROR_CODES.BAD_ARGUMENT);
+    }
+    const options = args[1] && typeof args[1] === "object" ? args[1] : {};
+    const method = (options.method ?? "GET").toUpperCase();
+    if (method !== "GET" && method !== "POST") return fail(ERROR_CODES.BAD_ARGUMENT);
+    if (method === "GET" && options.body) return fail(ERROR_CODES.BAD_ARGUMENT);
+    const r = this.http(op, method, String(args[0]), options.body ?? "", options.headers ?? {});
+    if (!r.ok) return r;
+    const headers = Object.fromEntries(
+      Object.entries(r.response.headers ?? {}).filter(([k]) => !CREDENTIAL_RESPONSE_HEADERS.has(k.toLowerCase())).map(([k, v]) => [k.toLowerCase(), v])
+    );
+    return value({ status: r.response.status, headers, body: r.response.body });
+  }
+  has(permission) {
+    return this.manifest.runtimePermissions.includes(permission);
+  }
+  deny(op, detail) {
+    this.events.push({ kind: "denied", op, detail });
+    return fail(ERROR_CODES.PERMISSION_DENIED);
+  }
+  http(op, method, url, body, headers, browserSession = false) {
+    if (!this.has("NETWORK")) return this.deny(op, "NETWORK not declared");
+    const o = origin(url);
+    if (!o || !o.startsWith("https:")) return this.deny(op, `${url} is not an HTTPS URL`);
+    if (!browserSession && !this.source.requestOrigins.includes(o)) {
+      return this.deny(op, `${o} is not in requestOrigins`);
+    }
+    const f = this.fixtures.get(fixtureKey(method, url, body));
+    if (!f) {
+      this.events.push({ kind: "missing-fixture", op, detail: `${method} ${url}` });
+      this.misses.push({ method: method.toUpperCase(), url, body, headers });
+      return { ok: false, code: ERROR_CODES.NETWORK_FAILED };
+    }
+    return { ok: true, response: f.response };
+  }
+};
+function origin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function value(v) {
+  return { ok: true, json: v === null || v === void 0 ? null : JSON.stringify(v) };
+}
+function fail(code) {
+  return { ok: false, code };
+}
+
+// src/runner/quickjs.ts
+import { getQuickJS, shouldInterruptAfterDeadline } from "quickjs-emscripten";
+
+// src/runner/legacy-bootstrap.ts
+var LEGACY_BOOTSTRAP = `(function(global){
+  'use strict';
+  function nativeCall(method,args){
+    var encoded=__shinsouBridge(String(method),JSON.stringify(args||[]));
+    try{
+      var value=JSON.parse(String(encoded));
+      if(value&&value.__shinsouResourceLimit){var limitError=new Error(String(value.error||'Plugin resource limit exceeded'));limitError.__shinsouResourceLimit=true;throw limitError;}
+      return value;
+    }catch(e){if(e&&e.__shinsouResourceLimit)throw e;return null;}
+  }
+  global.bridge={
+    httpGet:function(url){return nativeCall('httpGet',[String(url)]);},
+    httpGetWithHeaders:function(url,headers){return nativeCall('httpGetWithHeaders',[String(url),headers||{}]);},
+    httpGetResponse:function(url,headers){return nativeCall('httpGetResponse',[String(url),headers||{}]);},
+    httpPost:function(url,body,headers){return nativeCall('httpPost',[String(url),String(body||''),headers||{}]);},
+    httpPostResponse:function(url,body,headers){return nativeCall('httpPostResponse',[String(url),String(body||''),headers||{}]);},
+    httpPostBatch:function(urls,bodies,headers){return nativeCall('httpPostBatch',[urls||[],bodies||[],headers||{}]);},
+    browserSessionRequest:function(url,method,body,headers){return nativeCall('browserSessionRequest',[String(url),String(method||'GET'),String(body||''),headers||{}]);},
+    log:function(sourceOrMessage,message){nativeCall('log',[String(message===undefined?sourceOrMessage:message)]);},
+    getPreference:function(key){return nativeCall('getPreference',[String(key)]);},
+    setPreference:function(key,value){nativeCall('setPreference',[String(key),String(value)]);},
+    getCredentialUsername:function(){return nativeCall('getCredentialUsername',[]);},
+    getCredentialPassword:function(){return nativeCall('getCredentialPassword',[]);},
+    setCredential:function(username,password){nativeCall('setCredential',[String(username),String(password)]);},
+    clearCredential:function(){nativeCall('clearCredential',[]);},
+    hasCredential:function(){return !!nativeCall('hasCredential',[]);},
+    requestLogin:function(reason){return !!nativeCall('requestLogin',reason==null?[]:[String(reason)]);},
+    requestHostEvent:function(envelope){
+      var value=nativeCall('requestHostEvent',[String(envelope)]);
+      if(typeof value==='string'){try{return JSON.parse(value);}catch(e){return null;}}
+      return value;
+    },
+    getHostEventContext:function(){return nativeCall('getHostEventContext',[]);},
+    getHostEventCapabilities:function(){return nativeCall('getHostEventCapabilities',[])||{enabled:false};},
+    getCookie:function(name,url){return nativeCall('getCookie',[String(name),String(url)]);},
+    getCookies:function(url){return nativeCall('getCookies',[String(url)])||{};},
+    setCookie:function(name,value,domain,path,seconds){return !!nativeCall('setCookie',[String(name),String(value),String(domain),String(path||'/'),Number(seconds||0)]);},
+    deleteCookie:function(name,domain){nativeCall('deleteCookie',[String(name),String(domain)]);},
+    clearCookies:function(){nativeCall('clearCookies',[]);},
+    domRelease:function(id){nativeCall('domRelease',[Number(id||0)]);},
+    // JSC owns DOM objects through GC; this legacy hint must not reset invocation quotas.
+    domReleaseAll:function(){nativeCall('domReleaseAll',[]);},
+    parseHtml:function(html,selector){var doc=parseHtml(String(html),'');return doc.select(String(selector)).map(function(e){return{text:e.text(),html:e.html(),outerHtml:e.outerHtml(),attr_href:e.attr('href'),attr_src:e.attr('src'),tagName:e.tagName()};});}
+  };
+  bridge.system={
+    submit:function(name,kind,payload,options){
+      options=options||{};
+      var envelope={protocol:'dev.shinsou.system',version:1,kind:String(kind),name:String(name),
+        id:String(options.id||('event-'+Date.now())),payloadVersion:1,payload:payload||{}};
+      if(options.idempotencyKey!=null)envelope.idempotencyKey=String(options.idempotencyKey);
+      if(options.contextRef!=null)envelope.contextRef=String(options.contextRef);
+      return bridge.requestHostEvent(JSON.stringify(envelope));
+    },
+    requestLogin:function(reason){return this.submit('auth.login.request','command',{reasonCode:null,fallbackMessage:reason==null?null:String(reason)});},
+    requestRefresh:function(scope,contextRef){scope=String(scope||'SELF');if(scope==='ACTIVE_CONTEXT'&&contextRef==null)contextRef=bridge.getHostEventContext();return this.submit('source.refresh.request','command',{scope:scope,reasonCode:null},{contextRef:contextRef});},
+    requestLogout:function(reason){return this.submit('auth.logout.request','command',{reasonCode:null,fallbackMessage:reason==null?null:String(reason)});},
+    reportMessage:function(message){return this.submit('diagnostic.message.report','event',message||{});}
+  };
+  global.console={log:bridge.log,error:bridge.log,warn:bridge.log,info:bridge.log};
+
+  function decodeEntities(value){
+    var named={amp:'&',lt:'<',gt:'>',quot:'"',apos:"'",nbsp:' '};
+    return String(value||'').replace(/&(#x[0-9a-f]+|#[0-9]+|amp|lt|gt|quot|apos|nbsp);/gi,function(all,key){
+      var lower=key.toLowerCase();
+      if(lower.charAt(0)==='#'){
+        var hex=lower.charAt(1)==='x';var n=parseInt(lower.substring(hex?2:1),hex?16:10);
+        return isNaN(n)?all:String.fromCharCode(n);
+      }
+      return named[lower]||all;
+    });
+  }
+  function escapeText(value){return String(value).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');}
+  function escapeAttr(value){return escapeText(value).replace(/"/g,'&quot;');}
+  function TextNode(text,parent,raw){this.value=text;this._parent=parent||null;this.raw=!!raw;}
+  TextNode.prototype.outerHtml=function(){return this.raw?this.value:escapeText(this.value);};
+
+  function Element(tag,attrs,parent,baseUri,document){
+    this._tag=String(tag||'').toLowerCase();this._attrs=attrs||{};this._parent=parent||null;
+    this._children=[];this._baseUri=baseUri||'';this._document=document||this;
+  }
+  function Document(baseUri){Element.call(this,'#document',{},null,baseUri||'',this);}
+  Document.prototype=Object.create(Element.prototype);Document.prototype.constructor=Document;
+  var voidTags={area:1,base:1,br:1,col:1,embed:1,hr:1,img:1,input:1,link:1,meta:1,param:1,source:1,track:1,wbr:1,'amp-img':1};
+
+  Element.prototype.tagName=function(){return this._tag==='#document'?'#root':this._tag;};
+  Element.prototype.attr=function(name){name=String(name).toLowerCase();return Object.prototype.hasOwnProperty.call(this._attrs,name)?String(this._attrs[name]):'';};
+  Element.prototype.hasAttr=function(name){return Object.prototype.hasOwnProperty.call(this._attrs,String(name).toLowerCase());};
+  Element.prototype.id=function(){return this.attr('id');};
+  Element.prototype.className=function(){return this.attr('class');};
+  Element.prototype.children=function(){return new Elements(this._children.filter(function(n){return n instanceof Element;}));};
+  Element.prototype.parent=function(){return this._parent instanceof Element?this._parent:null;};
+  Element.prototype.nextElementSibling=function(){var p=this.parent();if(!p)return null;var a=p.children()._arr,i=a.indexOf(this);return i>=0&&i+1<a.length?a[i+1]:null;};
+  Element.prototype.previousElementSibling=function(){var p=this.parent();if(!p)return null;var a=p.children()._arr,i=a.indexOf(this);return i>0?a[i-1]:null;};
+  Element.prototype.remove=function(){if(!this._parent)return;var i=this._parent._children.indexOf(this);if(i>=0)this._parent._children.splice(i,1);this._parent=null;};
+  // JavaScriptCore object liveness is GC-managed. The host resets accounting only at a new
+  // invocation boundary; a script-visible reset would let still-live DOM objects bypass quota.
+  Element.prototype.release=function(){};
+  Element.prototype.ownText=function(){return normalizeText(this._children.filter(function(n){return n instanceof TextNode;}).map(function(n){return n.value;}).join(' '));};
+  Element.prototype.text=function(){var out=[];(function visit(node){node._children.forEach(function(child){if(child instanceof TextNode)out.push(child.value);else visit(child);});})(this);return normalizeText(out.join(' '));};
+  Element.prototype.html=function(){return this._children.map(function(n){return n.outerHtml();}).join('');};
+  Element.prototype.outerHtml=function(){
+    if(this._tag==='#document')return this.html();
+    var attrs='';for(var key in this._attrs)if(Object.prototype.hasOwnProperty.call(this._attrs,key))attrs+=' '+key+'="'+escapeAttr(this._attrs[key])+'"';
+    return '<'+this._tag+attrs+'>'+(voidTags[this._tag]?'':this.html()+'</'+this._tag+'>');
+  };
+  Element.prototype.absUrl=function(name){return resolveUrl(this._baseUri,this.attr(name));};
+  Element.prototype.select=function(selector){selector=String(selector);var result=querySelectorAll(this,selector);nativeCall('domSelect',[selector,result.length]);return result;};
+  Element.prototype.selectFirst=function(selector){var values=this.select(selector);return values.length?values[0]:null;};
+  Element.prototype.getElementsByTag=function(tag){return this.select(String(tag));};
+  Element.prototype.getElementsByClass=function(name){return this.select('.'+String(name));};
+  Element.prototype.getElementById=function(id){return this.selectFirst('#'+String(id));};
+  Element.prototype.toString=function(){return this.outerHtml();};
+
+  function Elements(values){this._arr=values||[];this.length=this._arr.length;for(var i=0;i<this.length;i++)this[i]=this._arr[i];}
+  Elements.prototype.get=function(i){return i>=0&&i<this.length?this._arr[i]:null;};
+  Elements.prototype.first=function(){return this.get(0);};Elements.prototype.last=function(){return this.get(this.length-1);};
+  Elements.prototype.size=function(){return this.length;};Elements.prototype.isEmpty=function(){return this.length===0;};
+  Elements.prototype.forEach=function(fn){for(var i=0;i<this.length;i++)fn(this._arr[i],i);};
+  Elements.prototype.map=function(fn){var out=[];for(var i=0;i<this.length;i++)out.push(fn(this._arr[i],i));return out;};
+  Elements.prototype.filter=function(fn){var out=[];for(var i=0;i<this.length;i++)if(fn(this._arr[i],i))out.push(this._arr[i]);return new Elements(out);};
+  Elements.prototype.text=function(){return normalizeText(this.map(function(e){return e.text();}).join(' '));};
+  Elements.prototype.attr=function(name){return this.length?this._arr[0].attr(name):'';};
+  Elements.prototype.hasAttr=function(name){return this.length?this._arr[0].hasAttr(name):false;};
+  Elements.prototype.html=function(){return this.length?this._arr[0].html():'';};
+  Elements.prototype.select=function(selector){var out=[];this.forEach(function(e){e.select(selector).forEach(function(x){if(out.indexOf(x)<0)out.push(x);});});return new Elements(out);};
+  Elements.prototype.eachAttr=function(name){return this.map(function(e){return e.attr(name);});};Elements.prototype.eachText=function(){return this.map(function(e){return e.text();});};
+  Elements.prototype.releaseAll=function(){};
+
+  function normalizeText(value){return String(value||'').replace(/\\s+/g,' ').trim();}
+  function resolveUrl(base,value){
+    value=String(value||'');base=String(base||'');if(!value)return '';
+    if(/^[a-z][a-z0-9+.-]*:/i.test(value))return value;
+    var scheme=(base.match(/^([a-z][a-z0-9+.-]*):/i)||[])[1]||'https';
+    if(value.substring(0,2)==='//')return scheme+':'+value;
+    var origin=(base.match(/^([a-z][a-z0-9+.-]*:\\/\\/[^\\/]+)/i)||[])[1]||'';
+    if(value.charAt(0)==='/')return origin+value;
+    var clean=base.split('#')[0].split('?')[0],slash=clean.lastIndexOf('/');
+    return (slash>=scheme.length+3?clean.substring(0,slash+1):clean.replace(/\\/?/,'/'))+value;
+  }
+  function parseAttributes(raw){
+    var attrs={},re=/([^\\s=\\/]+)(?:\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s"'=<>\`]+)))?/g,m;
+    while((m=re.exec(raw)))attrs[String(m[1]).toLowerCase()]=decodeEntities(m[2]!==undefined?m[2]:(m[3]!==undefined?m[3]:(m[4]!==undefined?m[4]:'')));
+    return attrs;
+  }
+  function parseHtml(html,baseUri){
+    html=String(html||'');var quota=nativeCall('domParse',[html])||{},maxNodes=Number(quota.maxNodes||0),maxDepth=Number(quota.maxDepth||0),nodeCount=1;
+    function reserveNode(){nodeCount++;if(nodeCount>maxNodes){nativeCall('domParsed',[nodeCount]);throw new Error('Plugin DOM handle limit exceeded');}}
+    var doc=new Document(baseUri||''),stack=[doc],i=0;
+    while(i<html.length){
+      var parent=stack[stack.length-1];
+      if(parent._tag==='script'||parent._tag==='style'){
+        var closeToken='</'+parent._tag,closeAt=html.toLowerCase().indexOf(closeToken,i);
+        if(closeAt<0){reserveNode();parent._children.push(new TextNode(html.substring(i),parent,true));stack.pop();break;}
+        reserveNode();parent._children.push(new TextNode(html.substring(i,closeAt),parent,true));
+        var closeEnd=findTagEnd(html,closeAt+1);
+        stack.pop();i=closeEnd<0?html.length:closeEnd+1;continue;
+      }
+      var open=html.indexOf('<',i);
+      if(open<0){reserveNode();parent._children.push(new TextNode(decodeEntities(html.substring(i)),parent,false));break;}
+      if(open>i){reserveNode();parent._children.push(new TextNode(decodeEntities(html.substring(i,open)),parent,false));}
+      if(html.substring(open,open+4)==='<!--'){var endComment=html.indexOf('-->',open+4);i=endComment<0?html.length:endComment+3;continue;}
+      var end=findTagEnd(html,open+1);if(end<0){reserveNode();parent._children.push(new TextNode(decodeEntities(html.substring(open)),parent,false));break;}
+      var raw=html.substring(open+1,end).trim();i=end+1;if(!raw||raw.charAt(0)==='!'||raw.charAt(0)==='?')continue;
+      if(raw.charAt(0)==='/'){
+        var closing=raw.substring(1).trim().split(/\\s+/)[0].toLowerCase();
+        for(var s=stack.length-1;s>0;s--)if(stack[s]._tag===closing){stack.length=s;break;}
+        continue;
+      }
+      var selfClosing=/\\/\\s*$/.test(raw);if(selfClosing)raw=raw.replace(/\\/\\s*$/,'');
+      var match=raw.match(/^([^\\s]+)/);if(!match)continue;var tag=match[1].toLowerCase();
+      reserveNode();var element=new Element(tag,parseAttributes(raw.substring(match[0].length)),parent,baseUri||'',doc);
+      parent._children.push(element);if(!selfClosing&&!voidTags[tag]){if(stack.length>=maxDepth){nativeCall('domDepth',[stack.length+1]);throw new Error('Plugin DOM depth limit exceeded');}stack.push(element);}
+    }
+    nativeCall('domParsed',[nodeCount]);
+    return doc;
+  }
+  function findTagEnd(html,start){var quote='';for(var i=start;i<html.length;i++){var c=html.charAt(i);if(quote){if(c===quote)quote='';}else if(c==='"'||c==="'")quote=c;else if(c==='>')return i;}return -1;}
+
+  function splitTopLevel(value,separator){
+    var out=[],start=0,round=0,square=0,quote='';
+    for(var i=0;i<value.length;i++){var c=value.charAt(i);if(quote){if(c===quote&&value.charAt(i-1)!=='\\\\')quote='';continue;}if(c==='"'||c==="'"){quote=c;continue;}if(c==='(')round++;else if(c===')')round--;else if(c==='[')square++;else if(c===']')square--;else if(c===separator&&round===0&&square===0){out.push(value.substring(start,i));start=i+1;}}
+    out.push(value.substring(start));return out;
+  }
+  function selectorSteps(selector){
+    selector=selector.trim();var out=[],buf='',pending='desc',round=0,square=0,quote='';
+    function push(){var value=buf.trim();if(value){out.push({combinator:pending,simple:value});buf='';pending='desc';}}
+    for(var i=0;i<selector.length;i++){var c=selector.charAt(i);if(quote){buf+=c;if(c===quote&&selector.charAt(i-1)!=='\\\\')quote='';continue;}if(c==='"'||c==="'"){quote=c;buf+=c;continue;}if(c==='('){round++;buf+=c;continue;}if(c===')'){round--;buf+=c;continue;}if(c==='['){square++;buf+=c;continue;}if(c===']'){square--;buf+=c;continue;}
+      if(round===0&&square===0&&(c==='>'||c==='+')){push();pending=c==='>'?'child':'adjacent';continue;}
+      if(round===0&&square===0&&/\\s/.test(c)){if(buf.trim())push();continue;}buf+=c;
+    }push();return out;
+  }
+  function descendants(element){var out=[];(function walk(node){node._children.forEach(function(child){if(child instanceof Element){out.push(child);walk(child);}});})(element);return out;}
+  function candidates(element,combinator){if(combinator==='child')return element.children()._arr;if(combinator==='adjacent'){var n=element.nextElementSibling();return n?[n]:[];}return descendants(element);}
+  function querySelectorAll(root,selector){
+    var result=[];splitTopLevel(String(selector),',').forEach(function(group){var steps=selectorSteps(group),current=[root];steps.forEach(function(step){var next=[];current.forEach(function(node){candidates(node,step.combinator).forEach(function(candidate){if(matchesSimple(candidate,step.simple)&&next.indexOf(candidate)<0)next.push(candidate);});});current=next;});current.forEach(function(e){if(result.indexOf(e)<0)result.push(e);});});return new Elements(result);
+  }
+  function readBalanced(value,start,open,close){var depth=0,quote='';for(var i=start;i<value.length;i++){var c=value.charAt(i);if(quote){if(c===quote&&value.charAt(i-1)!=='\\\\')quote='';continue;}if(c==='"'||c==="'"){quote=c;continue;}if(c===open)depth++;else if(c===close){depth--;if(depth===0)return i;}}return value.length-1;}
+  function stripQuotes(value){value=String(value||'').trim();if((value.charAt(0)==='"'&&value.charAt(value.length-1)==='"')||(value.charAt(0)==="'"&&value.charAt(value.length-1)==="'"))return value.substring(1,value.length-1);return value;}
+  function matchesAttribute(element,body){
+    var m=body.match(/^\\s*([^\\s~|^*!=\\x24]+)\\s*(?:(\\^=|\\*=|\\x24=|~=|\\|=|=)\\s*(?:"([^"]*)"|'([^']*)'|([^\\s]+)))?\\s*$/);if(!m)return false;
+    var name=m[1].toLowerCase(),op=m[2],expected=m[3]!==undefined?m[3]:(m[4]!==undefined?m[4]:(m[5]!==undefined?m[5]:''));
+    if(!element.hasAttr(name))return false;if(!op)return true;var actual=element.attr(name);
+    if(op==='=')return actual===expected;if(op==='^=')return actual.indexOf(expected)===0;if(op==='*=')return actual.indexOf(expected)>=0;if(op.charCodeAt(0)===36)return actual.lastIndexOf(expected)===actual.length-expected.length;if(op==='~=')return actual.split(/\\s+/).indexOf(expected)>=0;if(op==='|=')return actual===expected||actual.indexOf(expected+'-')===0;return false;
+  }
+  function rootOf(element){var current=element;while(current._parent)current=current._parent;return current;}
+  function matchesComplex(element,selector){
+    return splitTopLevel(String(selector),',').some(function(group){
+      var steps=selectorSteps(group);
+      if(steps.length===1)return matchesSimple(element,steps[0].simple);
+      return querySelectorAll(rootOf(element),group)._arr.indexOf(element)>=0;
+    });
+  }
+  function matchesSimple(element,simple){
+    var i=0,tag=simple.substring(i).match(/^[a-zA-Z*][a-zA-Z0-9_-]*/);if(tag){if(tag[0]!=='*'&&element._tag!==tag[0].toLowerCase())return false;i+=tag[0].length;}
+    while(i<simple.length){var c=simple.charAt(i);
+      if(c==='#'||c==='.'){var m=simple.substring(i+1).match(/^[a-zA-Z0-9_-]+/);if(!m)return false;var value=m[0];if(c==='#'&&element.id()!==value)return false;if(c==='.'&&element.className().split(/\\s+/).indexOf(value)<0)return false;i+=value.length+1;continue;}
+      if(c==='['){var end=readBalanced(simple,i,'[',']');if(!matchesAttribute(element,simple.substring(i+1,end)))return false;i=end+1;continue;}
+      if(c===':'){var nm=simple.substring(i+1).match(/^[a-zA-Z-]+/);if(!nm)return false;var name=nm[0].toLowerCase();i+=name.length+1;var arg=null;if(simple.charAt(i)==='('){var endp=readBalanced(simple,i,'(',')');arg=simple.substring(i+1,endp);i=endp+1;}
+        var siblings=element.parent()?element.parent().children()._arr:[element],position=siblings.indexOf(element)+1;
+        if(name==='contains'&&element.text().indexOf(stripQuotes(arg))<0)return false;
+        // Internal predicate checks do not expose handles to the plugin.
+        else if(name==='has'&&querySelectorAll(element,arg||'').isEmpty())return false;
+        else if(name==='not'&&matchesComplex(element,arg||''))return false;
+        else if(name==='first-child'&&position!==1)return false;
+        else if(name==='last-child'&&position!==siblings.length)return false;
+        else if(name==='nth-child'){var wanted=stripQuotes(arg);if(wanted==='odd'&&position%2!==1)return false;else if(wanted==='even'&&position%2!==0)return false;else if(wanted!=='odd'&&wanted!=='even'&&position!==parseInt(wanted,10))return false;}
+        continue;
+      }
+      i++;
+    }
+    return true;
+  }
+
+  global.Jsoup={parse:function(html,baseUri){return parseHtml(String(html),baseUri?String(baseUri):'');}};
+  global.fetchAndParse=function(url,baseUri){var html=bridge.httpGet(String(url));return !html||html.error?null:Jsoup.parse(html,baseUri||url);};
+  global.SManga={create:function(){return{url:'',title:'',author:null,artist:null,description:null,genre:null,status:0,thumbnailUrl:null,initialized:false};},UNKNOWN:0,ONGOING:1,COMPLETED:2,LICENSED:3,PUBLISHING_FINISHED:4,CANCELLED:5,ON_HIATUS:6};
+  global.SChapter={create:function(){return{url:'',name:'',scanlator:null,dateUpload:0,chapterNumber:-1};}};
+  global.Page=function(index,url,imageUrl){this.index=index||0;this.url=url||'';this.imageUrl=imageUrl||null;};
+  global.MangasPage=function(mangas,hasNextPage){this.mangas=mangas||[];this.hasNextPage=!!hasNextPage;};
+  if(!String.prototype.substringAfter)String.prototype.substringAfter=function(d){var i=this.indexOf(d);return i>=0?this.substring(i+d.length):String(this);};
+  if(!String.prototype.substringBefore)String.prototype.substringBefore=function(d){var i=this.indexOf(d);return i>=0?this.substring(0,i):String(this);};
+  if(!String.prototype.substringAfterLast)String.prototype.substringAfterLast=function(d){var i=this.lastIndexOf(d);return i>=0?this.substring(i+d.length):String(this);};
+  if(!String.prototype.substringBeforeLast)String.prototype.substringBeforeLast=function(d){var i=this.lastIndexOf(d);return i>=0?this.substring(0,i):String(this);};
+  global.setUrlWithoutDomain=function(object,url){var match=String(url).match(/^https?:\\/\\/[^\\/]+(\\/[^#]*)/i);object.url=match?match[1]:String(url);};
+  global.__shinsouSelectSource=function(requestedId){
+    if(requestedId!==null&&requestedId!==undefined&&typeof global.sources==='object'&&global.sources){
+      var requested=String(requestedId),matches=[];
+      Object.keys(global.sources).forEach(function(key){
+        var candidate=global.sources[key];
+        if(!candidate||typeof candidate!=='object')return;
+        var candidateId=candidate.id!==undefined?candidate.id:(candidate.sourceId!==undefined?candidate.sourceId:key);
+        if(String(candidateId)===requested)matches.push(candidate);
+      });
+      if(matches.length!==1)throw new Error('Plugin does not export exactly one source '+requested);
+      global.source=matches[0];
+    }
+    if(typeof global.source!=='object'||!global.source)throw new Error('Plugin does not export source');
+    if(requestedId!==null&&requestedId!==undefined){
+      global.source.id=String(requestedId);
+      if(global.__shinsouRequestedSourceName!==undefined)global.source.name=global.__shinsouRequestedSourceName;
+      if(global.__shinsouRequestedSourceLang!==undefined)global.source.lang=global.__shinsouRequestedSourceLang;
+      if(global.__shinsouRequestedSourceBaseUrl!==undefined)global.source.baseUrl=global.__shinsouRequestedSourceBaseUrl;
+    }
+    return true;
+  };
+  global.__shinsouMetadata=function(){if(typeof source!=='object'||!source)throw new Error('Plugin does not export source');return JSON.stringify({baseUrl:source.baseUrl||'',supportsLatest:!!source.supportsLatest,supportsLogin:!!source.supportsLogin,supportsFavorites:!!source.supportsFavorites,headers:source.headers||{},webChallengeUrl:source.webChallengeUrl||null,webChallengeLocalStorageKeys:Array.isArray(source.webChallengeLocalStorageKeys)?source.webChallengeLocalStorageKeys:[],requiredWebChallengeLocalStorageKeys:Array.isArray(source.requiredWebChallengeLocalStorageKeys)?source.requiredWebChallengeLocalStorageKeys:[]});};
+  global.__shinsouPreferences=function(){if(typeof source!=='object'||!source)return '[]';var values=typeof source.getPreferenceDefinitions==='function'?source.getPreferenceDefinitions():(source.preferences||[]);return JSON.stringify(values||[]);};
+  global.__shinsouInvoke=function(method,argsJson){if(typeof source!=='object'||!source||typeof source[method]!=='function')throw new Error('Plugin has no function '+method);var result=source[method].apply(source,JSON.parse(argsJson||'[]'));return JSON.stringify(result===undefined?null:result);};
+})(this);`;
+
+// src/runner/sandbox.ts
+var DEFAULT_ENGINE_LIMITS = {
+  heapBytes: 64 << 20,
+  stackBytes: 1 << 20,
+  invokeTimeoutMs: 3e4
+};
+
+// src/runner/quickjs.ts
+var CLI_BOOTSTRAP = `
+(function(global){
+  'use strict';
+  bridge.net = {
+    fetch: function(url, options){
+      return __shinsouBridgeAsync('net.fetch', JSON.stringify([String(url), options || {}])).then(function(text){ return JSON.parse(text); });
+    }
+  };
+  global.__cliInvoke = function(method, argsJson){
+    if (typeof source !== 'object' || !source || typeof source[method] !== 'function') throw new Error('Plugin has no function ' + method);
+    return Promise.resolve(source[method].apply(source, JSON.parse(argsJson || '[]'))).then(function(v){
+      return JSON.stringify(v === undefined ? null : v);
+    });
+  };
+})(this);
+`;
+var QuickJsEngine = class {
+  name = "quickjs-emscripten";
+  async create(args) {
+    const QuickJS = await getQuickJS();
+    const limits = args.limits ?? DEFAULT_ENGINE_LIMITS;
+    const runtime = QuickJS.newRuntime();
+    runtime.setMemoryLimit(limits.heapBytes);
+    runtime.setMaxStackSize(limits.stackBytes);
+    const ctx = runtime.newContext();
+    const host = args.host;
+    const bridgeFn = ctx.newFunction("__shinsouBridge", (opH, argsH) => {
+      const outcome = host.call(ctx.getString(opH), ctx.getString(argsH));
+      return ctx.newString(outcome.ok ? outcome.json ?? "null" : "null");
+    });
+    ctx.setProp(ctx.global, "__shinsouBridge", bridgeFn);
+    bridgeFn.dispose();
+    const asyncFn = ctx.newFunction("__shinsouBridgeAsync", (opH, argsH) => {
+      const deferred = ctx.newPromise();
+      host.callAsync(ctx.getString(opH), ctx.getString(argsH)).then(
+        (outcome) => {
+          if (!ctx.alive) return;
+          if (outcome.ok) {
+            const s = ctx.newString(outcome.json ?? "null");
+            deferred.resolve(s);
+            s.dispose();
+          } else {
+            const e = ctx.newError(`bridge error ${outcome.code}`);
+            deferred.reject(e);
+            e.dispose();
+          }
+          runtime.executePendingJobs();
+        },
+        () => {
+          if (!ctx.alive) return;
+          const e = ctx.newError("bridge host failure");
+          deferred.reject(e);
+          e.dispose();
+          runtime.executePendingJobs();
+        }
+      );
+      return deferred.handle;
+    });
+    ctx.setProp(ctx.global, "__shinsouBridgeAsync", asyncFn);
+    asyncFn.dispose();
+    const evalOrThrow = (code, filename) => {
+      runtime.setInterruptHandler(shouldInterruptAfterDeadline(Date.now() + limits.invokeTimeoutMs));
+      const r = ctx.evalCode(code, filename);
+      if (r.error) {
+        const message = describe(ctx, r.error);
+        r.error.dispose();
+        throw new Error(`${filename}: ${message}`);
+      }
+      r.value.dispose();
+    };
+    try {
+      evalOrThrow(LEGACY_BOOTSTRAP, "bootstrap.js");
+      evalOrThrow(CLI_BOOTSTRAP, "cli-bootstrap.js");
+      evalOrThrow(args.script, "plugin.js");
+      evalOrThrow(`__shinsouSelectSource(${JSON.stringify(args.sourceId)})`, "select-source.js");
+    } catch (err) {
+      ctx.dispose();
+      runtime.dispose();
+      throw err;
+    }
+    return {
+      async invoke(method, argsJson) {
+        const deadline = Date.now() + limits.invokeTimeoutMs;
+        runtime.setInterruptHandler(shouldInterruptAfterDeadline(deadline));
+        const fn = ctx.getProp(ctx.global, "__cliInvoke");
+        const m = ctx.newString(method);
+        const a = ctx.newString(argsJson);
+        const r = ctx.callFunction(fn, ctx.undefined, m, a);
+        fn.dispose();
+        m.dispose();
+        a.dispose();
+        if (r.error) {
+          const error = describe(ctx, r.error);
+          r.error.dispose();
+          return { ok: false, error };
+        }
+        const promise = r.value;
+        const settled = ctx.resolvePromise(promise);
+        promise.dispose();
+        let done = false;
+        settled.finally(() => done = true);
+        while (!done) {
+          const jobs = runtime.executePendingJobs();
+          if (jobs.error) {
+            const error = describe(ctx, jobs.error);
+            jobs.error.dispose();
+            return { ok: false, error };
+          }
+          if (Date.now() > deadline) return { ok: false, error: "invocation timed out", limit: "TIME" };
+          await new Promise((resolve4) => setImmediate(resolve4));
+        }
+        const result = await settled;
+        if (result.error) {
+          const error = describe(ctx, result.error);
+          result.error.dispose();
+          return { ok: false, error };
+        }
+        const valueJson = ctx.getString(result.value);
+        result.value.dispose();
+        return { ok: true, valueJson };
+      },
+      dispose() {
+        ctx.dispose();
+        runtime.dispose();
+      }
+    };
+  }
+};
+function describe(ctx, handle) {
+  const v = ctx.dump(handle);
+  if (v && typeof v === "object") {
+    const e = v;
+    return [e.name && e.message ? `${e.name}: ${e.message}` : e.message ?? JSON.stringify(v), e.stack].filter(Boolean).join("\n");
+  }
+  return String(v);
+}
+
+// src/runner/harness.ts
+var DEFAULT_CASES = "test/cases.json";
+var DEFAULT_FIXTURES = "test/fixtures";
+function loadFixtures(dir) {
+  if (!existsSync7(dir)) return [];
+  const out = [];
+  for (const name of readdirSync2(dir).filter((n) => n.endsWith(".json")).sort()) {
+    const data = JSON.parse(readFileSync8(join9(dir, name), "utf8"));
+    out.push(...Array.isArray(data) ? data : data.entries ?? []);
+  }
+  return out;
+}
+async function runTests(args) {
+  const { projectDir, manifest } = args;
+  const casesPath = join9(projectDir, manifest.test?.cases ?? DEFAULT_CASES);
+  const fixturesDir = join9(projectDir, manifest.test?.fixtures ?? DEFAULT_FIXTURES);
+  if (!existsSync7(casesPath)) throw new Error(`No test cases: ${casesPath}`);
+  const cases = JSON.parse(readFileSync8(casesPath, "utf8")).filter((c) => !args.only || c.name.includes(args.only));
+  const engine = args.engine ?? new QuickJsEngine();
+  const results = [];
+  for (const c of cases) {
+    const source = manifest.sources.find((s) => s.sourceId === (c.sourceId ?? manifest.sources[0].sourceId));
+    if (!source) {
+      results.push({ name: c.name, ok: false, problems: [`unknown sourceId ${c.sourceId}`], events: [], logs: [] });
+      continue;
+    }
+    let result;
+    for (let round = 0; round < 20; round++) {
+      const fixtures = loadFixtures(fixturesDir);
+      const host = new FixtureBridgeHost(manifest, source, fixtures, { preferences: c.preferences, credential: c.credential });
+      const problems = [];
+      let value2;
+      try {
+        const instance = await engine.create({ script: args.script, sourceId: source.sourceId, host });
+        try {
+          const out = await instance.invoke(c.hook, JSON.stringify(c.args ?? []));
+          if (out.ok) value2 = JSON.parse(out.valueJson);
+          else problems.push(`hook threw: ${out.error}`);
+        } finally {
+          instance.dispose();
+        }
+      } catch (err) {
+        problems.push(`script failed to load: ${err.message}`);
+      }
+      if (args.record && host.misses.length) {
+        await recordMisses(fixturesDir, c.name, host.misses, args.fetchImpl ?? fetch);
+        continue;
+      }
+      for (const e of host.events) if (e.kind !== "log") problems.push(`${e.kind}: bridge.${e.op} \u2014 ${e.detail}`);
+      if (problems.length === 0) problems.push(...checkExpectations(projectDir, c, value2, !!args.update));
+      result = { name: c.name, ok: problems.length === 0, problems, events: host.events, logs: host.logs, value: value2 };
+      break;
+    }
+    results.push(result ?? { name: c.name, ok: false, problems: ["recording did not converge after 20 rounds"], events: [], logs: [] });
+  }
+  return results;
+}
+async function recordMisses(dir, caseName, misses, fetchImpl) {
+  mkdirSync6(dir, { recursive: true });
+  const file = join9(dir, `${caseName.replace(/[^\w.-]+/g, "_")}.json`);
+  const existing = existsSync7(file) ? JSON.parse(readFileSync8(file, "utf8")) : [];
+  const keys = new Set(existing.map((f) => fixtureKey(f.request.method, f.request.url, f.request.body ?? "")));
+  for (const miss of misses) {
+    const key = fixtureKey(miss.method, miss.url, miss.body);
+    if (keys.has(key)) continue;
+    keys.add(key);
+    const res = await fetchImpl(miss.url, {
+      method: miss.method,
+      headers: miss.headers,
+      body: miss.method === "GET" ? void 0 : miss.body,
+      redirect: "follow"
+    });
+    const headers = {};
+    res.headers.forEach((v, k) => {
+      if (!["set-cookie", "authorization", "cookie"].includes(k)) headers[k] = v;
+    });
+    existing.push({
+      request: { method: miss.method, url: miss.url, ...miss.method === "GET" ? {} : { body: miss.body } },
+      response: { status: res.status, headers, body: await res.text() }
+    });
+  }
+  writeFileSync6(file, JSON.stringify(existing, null, 2) + "\n");
+}
+function at(value2, path) {
+  if (!path) return value2;
+  return path.split(".").reduce((v, k) => v && typeof v === "object" ? v[k] : void 0, value2);
+}
+var MAX_CHAPTER_TEXT_BYTES = 4 * 1024 * 1024;
+function chapterTextProblems(result) {
+  const text = typeof result === "string" ? result : result && typeof result === "object" ? result.text : void 0;
+  if (typeof text !== "string") return ["getChapterText must return a string (or { text }); the app ignores anything else"];
+  if (text.length === 0) return ["getChapterText returned an empty string (the app treats it as no text)"];
+  if (Buffer.byteLength(text, "utf8") > MAX_CHAPTER_TEXT_BYTES) return ["getChapterText result exceeds the 4 MiB result limit"];
+  return [];
+}
+function checkExpectations(projectDir, c, result, update) {
+  const problems = [];
+  if (c.hook === "getChapterText") problems.push(...chapterTextProblems(result));
+  const e = c.expect;
+  if (!e) return problems;
+  const v = at(result, e.path);
+  const label = e.path ? `result.${e.path}` : "result";
+  if (e.notEmpty && (v === null || v === void 0 || v === "" || Array.isArray(v) && v.length === 0)) problems.push(`${label} is empty`);
+  if (e.minItems !== void 0) {
+    if (!Array.isArray(v)) problems.push(`${label} is not an array`);
+    else if (v.length < e.minItems) problems.push(`${label} has ${v.length} items, expected at least ${e.minItems}`);
+  }
+  if ("equals" in e && !isDeepStrictEqual3(v, e.equals)) problems.push(`${label} = ${JSON.stringify(v)}, expected ${JSON.stringify(e.equals)}`);
+  if (e.contains !== void 0 && !(typeof v === "string" ? v : JSON.stringify(v) ?? "").includes(e.contains)) {
+    problems.push(`${label} does not contain ${JSON.stringify(e.contains)}`);
+  }
+  for (const [k, want] of Object.entries(e.matches ?? {})) {
+    const got = at(v, k);
+    if (!isDeepStrictEqual3(got, want)) problems.push(`${label}.${k} = ${JSON.stringify(got)}, expected ${JSON.stringify(want)}`);
+  }
+  if (e.snapshot) {
+    const dir = join9(projectDir, "test", "snapshots");
+    const file = join9(dir, `${c.name.replace(/[^\w.-]+/g, "_")}.json`);
+    if (update || !existsSync7(file)) {
+      mkdirSync6(dir, { recursive: true });
+      writeFileSync6(file, JSON.stringify(result, null, 2) + "\n");
+    } else if (!isDeepStrictEqual3(JSON.parse(readFileSync8(file, "utf8")), result)) {
+      problems.push(`result differs from snapshot ${file} (run with --update to accept)`);
+    }
+  }
+  return problems;
+}
+
+// src/cli.ts
+import { cpSync as cpSync2, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join10 } from "node:path";
+var VERSION = true ? "0.1.0" : "0.0.0-dev";
+var HELP = `shinsou-plugin ${VERSION} \u2014 Shinsou X \u5957\u4EF6\u4F5C\u8005\u5DE5\u5177
+
+\u7528\u6CD5\uFF1Ashinsou-plugin <\u6307\u4EE4> [\u9078\u9805]
+
+  keygen [--name <\u540D\u7A31>] [--passphrase]     \u7522\u751F Ed25519 \u767C\u4F48\u8005\u91D1\u9470
+  fingerprint [--key <\u540D\u7A31>]                \u986F\u793A\u91D1\u9470\u6307\u7D0B
+  init [\u76EE\u9304] [--template manga|novel|mixed|async] [--id <packageId>] [--name <\u540D\u7A31>] [--lang <\u8A9E\u8A00>]
+  build                                     \u6253\u5305\u8173\u672C\u4E26\u7522\u751F index.json \u8207 sidecar
+  lint                                      \u6B0A\u9650\u3001origin\u3001\u540D\u7A31\u8207\u5927\u5C0F\u6AA2\u67E5
+  test [--record] [--update] [--only <\u540D\u7A31>] \u4EE5\u9304\u88FD\u7684 HTTP fixture \u57F7\u884C hook
+  serve [--host 127.0.0.1|lan|<\u5340\u7DB2 IP>] [--port <\u57E0>]   \u958B\u767C\u8005\u7528\u672A\u7C3D\u7AE0\u5132\u5B58\u5EAB\uFF08\u5373\u6642\u91CD\u5EFA\uFF09
+  sign [--key <\u540D\u7A31>] [--mirror <URL>]... [--out <\u76EE\u9304>]  \u7C3D\u7F72 repo/index/sidecar/\u64A4\u56DE\u6E05\u55AE
+  sign-repo --mirror <URL>... [--key <\u540D\u7A31>] [--out <\u76EE\u9304>] [--flat]  \u7C3D\u7F72\u65E2\u6709\u7684\u591A\u5957\u4EF6\u5132\u5B58\u5EAB\uFF08repo.json/index.json/sidecars\uFF09
+  refresh [--key <\u540D\u7A31>] [--mirror <URL>]... [--if-due] [--flat]  \u91CD\u7C3D\u64A4\u56DE\u6E05\u55AE\uFF08\u5EF6\u9577 expiresAt\uFF1B--if-due \u53EA\u5728\u5269\u4E0D\u5230\u4E00\u534A\u6548\u671F\u6642\u91CD\u7C3D\uFF09
+  revoke <sha256>... [--key <\u540D\u7A31>]                       \u64A4\u56DE\u5DF2\u767C\u4F48\u7684\u7248\u672C
+  rotate --to <\u65B0\u91D1\u9470> [--key <\u820A\u91D1\u9470>]                    \u91D1\u9470\u8F2A\u66FF\uFF08\u96D9\u7C3D\uFF09\u4E26\u4EE5\u65B0\u91D1\u9470\u91CD\u7C3D
+  revoke-key [--key <\u540D\u7A31>]                               \u91D1\u9470\u81EA\u6211\u64A4\u92B7
+  ci-template                                             \u5BEB\u5165\u5B9A\u671F refresh \u7684 GitHub Actions
+
+\u5171\u540C\u9078\u9805\uFF1A--dir <\u5C08\u6848\u76EE\u9304>\uFF08\u9810\u8A2D\u76EE\u524D\u76EE\u9304\uFF09\u3001--days <\u64A4\u56DE\u6E05\u55AE\u6709\u6548\u5929\u6578\uFF0C\u9810\u8A2D 30>
+\u74B0\u5883\u8B8A\u6578\uFF1ASHINSOU_PLUGIN_PASSPHRASE\u3001SHINSOU_PLUGIN_NEW_PASSPHRASE\u3001SHINSOU_PLUGIN_KEY\uFF08CI \u7528\u91D1\u9470 JSON\uFF09\u3001
+          SHINSOU_PLUGIN_HOME\uFF08\u91D1\u9470\u76EE\u9304\uFF0C\u9810\u8A2D ~/.config/shinsou-plugin\uFF09`;
+async function prompt(question, hidden) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true });
+  if (hidden) {
+    const r = rl;
+    r._writeToOutput = (s) => {
+      if (s.includes(question)) r.output.write(s);
+    };
+  }
+  return new Promise(
+    (done) => rl.question(question, (answer) => {
+      rl.close();
+      if (hidden) process.stderr.write("\n");
+      done(answer);
+    })
+  );
+}
+async function passphraseFor(name, envName = "SHINSOU_PLUGIN_PASSPHRASE") {
+  if (process.env[envName]) return process.env[envName];
+  if (!process.stdin.isTTY) return void 0;
+  return prompt(`\u91D1\u9470 '${name}' \u7684\u5BC6\u8A9E\uFF1A`, true);
+}
+async function loadKey(name, envName) {
+  const file = readKeyFile(name);
+  return unlockKeyFile(file, file.encryption ? await passphraseFor(name, envName) : void 0);
+}
+function defaultKeyName(dir, given) {
+  return given ?? loadState(dir).currentKey?.name ?? "default";
+}
+function printSigned(outputs) {
+  for (const o of outputs) {
+    console.log(`\u2713 ${o.mirror}`);
+    console.log(`  \u2192 ${o.dir}`);
+    for (const d of o.documents) console.log(`    ${d.documentId}  sequence=${d.sequence}`);
+  }
+}
+async function main(argv) {
+  const [command, ...rest] = argv;
+  if (!command || command === "help" || command === "--help" || command === "-h") {
+    console.log(HELP);
+    return 0;
+  }
+  if (command === "--version" || command === "-v") {
+    console.log(VERSION);
+    return 0;
+  }
+  const { values, positionals } = parseArgs({
+    args: rest,
+    allowPositionals: true,
+    options: {
+      dir: { type: "string" },
+      name: { type: "string" },
+      key: { type: "string" },
+      to: { type: "string" },
+      template: { type: "string" },
+      id: { type: "string" },
+      lang: { type: "string" },
+      passphrase: { type: "boolean" },
+      mirror: { type: "string", multiple: true },
+      out: { type: "string" },
+      days: { type: "string" },
+      host: { type: "string" },
+      port: { type: "string" },
+      record: { type: "boolean" },
+      update: { type: "boolean" },
+      only: { type: "string" },
+      force: { type: "boolean" },
+      flat: { type: "boolean" },
+      "if-due": { type: "boolean" }
+    }
+  });
+  const dir = resolve3(values.dir ?? (command === "init" ? positionals[0] ?? "." : "."));
+  const ttlSeconds = values.days ? Math.round(Number(values.days) * 86400) : void 0;
+  if (ttlSeconds !== void 0 && (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0)) throw new Error("--days \u5FC5\u9808\u662F\u6B63\u6578");
+  switch (command) {
+    case "keygen": {
+      const name = values.name ?? "default";
+      if (existsSync8(keyPath(name)) && !values.force) throw new Error(`\u91D1\u9470 '${name}' \u5DF2\u5B58\u5728\uFF08${keyPath(name)}\uFF09\uFF1B\u8981\u8986\u5BEB\u8ACB\u52A0 --force\uFF0C\u4F46\u820A\u91D1\u9470\u7C3D\u904E\u7684\u5132\u5B58\u5EAB\u5C07\u7121\u6CD5\u518D\u66F4\u65B0`);
+      let passphrase = process.env.SHINSOU_PLUGIN_PASSPHRASE;
+      if (!passphrase && process.stdin.isTTY) {
+        passphrase = await prompt(values.passphrase ? "\u8A2D\u5B9A\u5BC6\u8A9E\uFF1A" : "\u8A2D\u5B9A\u5BC6\u8A9E\uFF08\u7559\u7A7A\u5247\u4E0D\u52A0\u5BC6\uFF09\uFF1A", true);
+        if (passphrase) {
+          const again = await prompt("\u518D\u8F38\u5165\u4E00\u6B21\uFF1A", true);
+          if (again !== passphrase) throw new Error("\u5169\u6B21\u8F38\u5165\u7684\u5BC6\u8A9E\u4E0D\u540C");
+        }
+      }
+      if (values.passphrase && !passphrase) throw new Error("--passphrase \u9700\u8981\u5BC6\u8A9E\uFF08\u4E92\u52D5\u8F38\u5165\u6216 SHINSOU_PLUGIN_PASSPHRASE\uFF09");
+      const file = createKeyFile({ name, passphrase: passphrase || void 0 });
+      const path = saveKeyFile(file, { overwrite: !!values.force });
+      const fp = describeKey(file);
+      console.log(`\u5DF2\u7522\u751F\u91D1\u9470 '${name}'${file.encryption ? "\uFF08\u4EE5\u5BC6\u8A9E\u52A0\u5BC6\uFF09" : "\uFF08\u672A\u52A0\u5BC6\uFF09"}\uFF1A${path}`);
+      console.log(`\u5B8C\u6574\u6307\u7D0B\uFF1A${fp.fingerprint}`);
+      console.log(`\u986F\u793A\u6307\u7D0B\uFF1A${fp.display}`);
+      console.log("\u8ACB\u5099\u4EFD\u9019\u500B\u6A94\u6848\uFF1B\u907A\u5931\u79C1\u9470\u5F8C\u53EA\u80FD\u8ACB\u4F7F\u7528\u8005\u624B\u52D5\u6539\u4FE1\u4EFB\u65B0\u91D1\u9470\u3002");
+      return 0;
+    }
+    case "fingerprint": {
+      const file = readKeyFile(defaultKeyName(dir, values.key));
+      const fp = describeKey(file);
+      console.log(`${file.name}
+\u5B8C\u6574\u6307\u7D0B\uFF1A${fp.fingerprint}
+\u986F\u793A\u6307\u7D0B\uFF1A${fp.display}
+\u516C\u9470\uFF1A${file.publicKey}`);
+      return 0;
+    }
+    case "init": {
+      const template = values.template ?? "manga";
+      if (!TEMPLATES.includes(template)) throw new Error(`--template \u5FC5\u9808\u662F ${TEMPLATES.join(" | ")}`);
+      const files = initProject({ dir, template, packageId: values.id, name: values.name, lang: values.lang, cliVersion: VERSION });
+      console.log(`\u5DF2\u5728 ${dir} \u5EFA\u7ACB ${template} \u5957\u4EF6\u5C08\u6848\uFF1A
+  ${files.join("\n  ")}`);
+      console.log("\u4E0B\u4E00\u6B65\uFF1A\u7DE8\u8F2F shinsou.plugin.json\uFF08\u5957\u4EF6 ID\u3001\u540D\u7A31\u3001origin\u3001repository.mirrors\uFF09\uFF0C\u7136\u5F8C\u57F7\u884C shinsou-plugin build && shinsou-plugin test");
+      return 0;
+    }
+    case "build": {
+      const r = await buildProject(dir);
+      console.log(`\u2713 ${r.manifest.packageId} ${r.manifest.version} (${r.manifest.versionCode})`);
+      console.log(`  sha256 ${r.sha256}
+  ${r.byteSize} bytes
+  \u2192 ${r.outDir}`);
+      return 0;
+    }
+    case "lint": {
+      const r = await buildProject(dir, { write: false });
+      const report = lintBuild(r);
+      for (const w of report.warnings) console.log(`\u26A0 [${w.rule}] ${w.message}`);
+      for (const e of report.errors) console.log(`\u2716 [${e.rule}] ${e.message}`);
+      console.log(report.errors.length ? `lint \u5931\u6557\uFF1A${report.errors.length} \u500B\u932F\u8AA4\u3001${report.warnings.length} \u500B\u8B66\u544A` : `lint \u901A\u904E\uFF08${report.warnings.length} \u500B\u8B66\u544A\uFF09`);
+      return report.errors.length ? 1 : 0;
+    }
+    case "test": {
+      const r = await buildProject(dir);
+      const results = await runTests({ projectDir: dir, manifest: r.manifest, script: r.script, record: values.record, update: values.update, only: values.only });
+      for (const res of results) {
+        console.log(`${res.ok ? "\u2713" : "\u2716"} ${res.name}`);
+        for (const p of res.problems) console.log(`    ${p}`);
+        if (!res.ok) for (const l of res.logs.slice(-10)) console.log(`    log: ${l}`);
+      }
+      const failed = results.filter((x) => !x.ok).length;
+      console.log(failed ? `${failed}/${results.length} \u500B\u6E2C\u8A66\u5931\u6557` : `${results.length} \u500B\u6E2C\u8A66\u5168\u90E8\u901A\u904E`);
+      return failed ? 1 : 0;
+    }
+    case "serve": {
+      const s = await serveProject({ projectDir: dir, host: values.host ?? "127.0.0.1", port: Number(values.port ?? 8787) });
+      console.log(`
+\u958B\u767C\u8005\u5132\u5B58\u5EAB\uFF08\u672A\u7C3D\u7AE0\uFF0C\u53EA\u80FD\u5728 App \u7684\u300C\u5957\u4EF6\u958B\u767C\u8005\u6A21\u5F0F\u300D\u8F09\u5165\uFF09\uFF1A${s.baseUrl}`);
+      console.log(`\u52A0\u5165\u9023\u7D50\uFF1A${s.link}
+`);
+      qrcode.generate(s.link, { small: true });
+      console.log("\u4FEE\u6539\u6A94\u6848\u6703\u81EA\u52D5\u91CD\u5EFA\uFF1B\u6309 Ctrl+C \u7D50\u675F\u3002");
+      await new Promise(() => {
+      });
+      return 0;
+    }
+    case "sign": {
+      const key = await loadKey(defaultKeyName(dir, values.key));
+      printSigned(await signRepository({ projectDir: dir, key, mirrors: values.mirror, outDir: values.out, ttlSeconds }));
+      console.log("\u628A\u6BCF\u500B\u93E1\u50CF\u76EE\u9304\u7684\u5167\u5BB9\u539F\u6A23\u4E0A\u50B3\u5230\u5C0D\u61C9\u7684\u7DB2\u5740\u5373\u53EF\uFF1B.shinsou/state.json \u5FC5\u9808\u4E00\u8D77\u63D0\u4EA4\u3002");
+      return 0;
+    }
+    case "sign-repo": {
+      const key = await loadKey(defaultKeyName(dir, values.key));
+      const r = await signExistingRepository({ repoDir: dir, key, mirrors: values.mirror ?? [], outDir: values.out, ttlSeconds, flat: values.flat });
+      printSigned(r.outputs);
+      console.log(`\u5DF2\u7C3D\u7F72 ${r.packages.length} \u500B\u5957\u4EF6\u3002`);
+      if (r.unchecked.length) console.log(`\u53EA\u6838\u5C0D\u4E86 SHA-256\uFF08\u975E Shinsou \u5951\u7D04\uFF0CApp \u6703\u7565\u904E\uFF09\uFF1A${r.unchecked.join("\u3001")}`);
+      console.log("\u628A\u93E1\u50CF\u76EE\u9304\u7684\u5167\u5BB9\u653E\u5230\u8A72\u7DB2\u5740\u7684\u6839\u76EE\u9304\u5373\u53EF\uFF1B.shinsou/state.json \u5FC5\u9808\u4E00\u8D77\u63D0\u4EA4\uFF08\u5E8F\u865F\u8207\u64A4\u56DE\u6E05\u55AE\uFF09\u3002");
+      return 0;
+    }
+    case "refresh": {
+      const key = await loadKey(defaultKeyName(dir, values.key));
+      const signed = refreshRevocations({ projectDir: dir, key, mirrors: values.mirror, outDir: values.out, ttlSeconds, flat: values.flat, onlyIfDue: values["if-due"] });
+      if (!signed.length) console.log("\u64A4\u56DE\u6E05\u55AE\u9084\u5728\u6709\u6548\u671F\u7684\u524D\u534A\uFF0C\u4E0D\u9700\u8981\u91CD\u7C3D\u3002");
+      printSigned(signed);
+      return 0;
+    }
+    case "revoke": {
+      if (!positionals.length) throw new Error("\u7528\u6CD5\uFF1Ashinsou-plugin revoke <sha256>...");
+      const key = await loadKey(defaultKeyName(dir, values.key));
+      printSigned(refreshRevocations({ projectDir: dir, key, mirrors: values.mirror, outDir: values.out, ttlSeconds, add: positionals }));
+      console.log("\u5DF2\u64A4\u56DE\uFF1BApp \u4E0B\u6B21\u53D6\u5F97\u64A4\u56DE\u6E05\u55AE\u6642\u6703\u505C\u7528\u9019\u4E9B\u7248\u672C\u3002");
+      return 0;
+    }
+    case "rotate": {
+      if (!values.to) throw new Error("\u7528\u6CD5\uFF1Ashinsou-plugin rotate --to <\u65B0\u91D1\u9470\u540D\u7A31> [--key <\u820A\u91D1\u9470\u540D\u7A31>]");
+      const oldKey = await loadKey(defaultKeyName(dir, values.key));
+      const newKey = await loadKey(values.to, "SHINSOU_PLUGIN_NEW_PASSPHRASE");
+      const r = await rotateKey({ projectDir: dir, oldKey, newKey, mirrors: values.mirror, outDir: values.out });
+      console.log(`\u8F2A\u66FF\u8072\u660E\uFF08effectiveSequence=${r.effectiveSequence}\uFF0C\u820A\u91D1\u9470\u7C3D envelope\u3001\u65B0\u91D1\u9470\u7C3D newKeySignature\uFF09\uFF1A`);
+      printSigned(r.rotation);
+      console.log("\u5DF2\u7528\u65B0\u91D1\u9470\u91CD\u7C3D\uFF1A");
+      printSigned(r.resigned);
+      const fp = describeKey(newKey);
+      console.log(`\u65B0\u6307\u7D0B\uFF1A${fp.fingerprint}\uFF08${fp.display}\uFF09\u3002publisher-key-rotation.json \u8ACB\u9577\u671F\u4FDD\u7559\u5728\u5132\u5B58\u5EAB\u4E2D\u3002`);
+      return 0;
+    }
+    case "revoke-key": {
+      const name = defaultKeyName(dir, values.key);
+      const key = await loadKey(name);
+      printSigned(revokeKey({ projectDir: dir, key, mirrors: values.mirror, outDir: values.out }));
+      console.log(`\u91D1\u9470 '${name}' \u5DF2\u81EA\u6211\u64A4\u92B7\u3002\u82E5\u662F\u76EE\u524D\u91D1\u9470\uFF0C\u4F7F\u7528\u8005\u5FC5\u9808\u91CD\u65B0\u4FE1\u4EFB\u4F60\u7684\u65B0\u91D1\u9470\u3002`);
+      return 0;
+    }
+    case "ci-template": {
+      const target = join10(dir, ".github", "workflows");
+      mkdirSync7(target, { recursive: true });
+      cpSync2(join10(templatesDir(), "common", ".github", "workflows", "shinsou-refresh.yml"), join10(target, "shinsou-refresh.yml"));
+      console.log(`\u5DF2\u5BEB\u5165 ${join10(target, "shinsou-refresh.yml")}\uFF1B\u8ACB\u5728 GitHub \u8A2D\u5B9A SHINSOU_PLUGIN_KEY\uFF08\u8207 SHINSOU_PLUGIN_PASSPHRASE\uFF09secrets\u3002`);
+      return 0;
+    }
+    default:
+      console.error(`\u672A\u77E5\u6307\u4EE4\uFF1A${command}
+
+${HELP}`);
+      return 2;
+  }
+}
+main(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (err) => {
+    console.error(`\u932F\u8AA4\uFF1A${err.message}`);
+    process.exit(1);
+  }
+);