fluxplugin 1.0.0

package/dist/browser/chunks/chunk-Q75AOCXD.js

@@ -0,0 +1,2544 @@
+// src/core/common.ts
+var toDisposable = (fn) => {
+  let done = false;
+  return {
+    dispose() {
+      if (done) return;
+      done = true;
+      fn();
+    }
+  };
+};
+var DisposableStore = class {
+  items = [];
+  disposed = false;
+  add(d) {
+    if (this.disposed) d.dispose();
+    else this.items.push(d);
+    return d;
+  }
+  get size() {
+    return this.items.length;
+  }
+  dispose() {
+    this.disposed = true;
+    const items = this.items.splice(0).reverse();
+    for (const d of items) {
+      try {
+        d.dispose();
+      } catch {
+      }
+    }
+  }
+  /** Re-arms the store so it can be reused after a deactivate/activate cycle. */
+  reset() {
+    this.dispose();
+    this.disposed = false;
+  }
+};
+var FrameworkError = class extends Error {
+  constructor(message, code, pluginId, options) {
+    super(message, options);
+    this.code = code;
+    this.pluginId = pluginId;
+    this.name = new.target.name;
+  }
+  code;
+  pluginId;
+};
+var PermissionDeniedError = class extends FrameworkError {
+  constructor(pluginId, permission, api) {
+    super(`Plugin "${pluginId}" is not allowed to use ${api} (missing permission "${permission}")`, "FLUX_PERMISSION_DENIED", pluginId);
+    this.permission = permission;
+  }
+  permission;
+};
+var LifecycleError = class extends FrameworkError {
+  constructor(pluginId, phase, message, cause) {
+    super(`[${pluginId}] ${phase}: ${message}`, "FLUX_LIFECYCLE", pluginId, { cause });
+    this.phase = phase;
+  }
+  phase;
+};
+var TimeoutError = class extends FrameworkError {
+  constructor(what, ms, pluginId) {
+    super(`${what} timed out after ${ms}ms`, "FLUX_TIMEOUT", pluginId);
+  }
+};
+var HookCancelledError = class extends FrameworkError {
+  constructor(operation, reason) {
+    super(`Operation "${operation}" was cancelled by a hook${reason ? `: ${reason}` : ""}`, "FLUX_HOOK_CANCELLED");
+    this.operation = operation;
+    this.reason = reason;
+  }
+  operation;
+  reason;
+};
+function withTimeout(p, ms, what, pluginId) {
+  if (!Number.isFinite(ms) || ms <= 0) return Promise.resolve(p);
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(() => reject(new TimeoutError(what, ms, pluginId)), ms);
+    Promise.resolve(p).then(
+      (v) => {
+        clearTimeout(t);
+        resolve(v);
+      },
+      (e) => {
+        clearTimeout(t);
+        reject(e);
+      }
+    );
+  });
+}
+var LogStore = class {
+  constructor(capacity = 2e3, sink) {
+    this.capacity = capacity;
+    this.sink = sink;
+  }
+  capacity;
+  sink;
+  entries = [];
+  listeners = /* @__PURE__ */ new Set();
+  write(entry) {
+    this.entries.push(entry);
+    if (this.entries.length > this.capacity) this.entries.splice(0, this.entries.length - this.capacity);
+    this.sink?.(entry);
+    for (const l of this.listeners) {
+      try {
+        l(entry);
+      } catch {
+      }
+    }
+  }
+  logger(source) {
+    const mk = (level) => (message, data) => this.write({ level, source, message, time: Date.now(), data });
+    return { debug: mk("debug"), info: mk("info"), warn: mk("warn"), error: mk("error") };
+  }
+  query(filter = {}) {
+    return this.entries.filter((e) => (!filter.source || e.source === filter.source) && (!filter.level || e.level === filter.level));
+  }
+  subscribe(l) {
+    this.listeners.add(l);
+    return toDisposable(() => this.listeners.delete(l));
+  }
+  clear(source) {
+    this.entries = source ? this.entries.filter((e) => e.source !== source) : [];
+  }
+};
+function errorMessage(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+
+// src/core/schema.ts
+var ValidationError = class extends Error {
+  constructor(issues, what = "value") {
+    super(`Invalid ${what}: ` + issues.map((i) => `${i.path || "<root>"}: ${i.message}`).join("; "));
+    this.issues = issues;
+    this.name = "ValidationError";
+  }
+  issues;
+};
+var ok = (value) => ({ ok: true, value });
+var fail = (path, message) => ({ ok: false, issues: [{ path, message }] });
+var join = (p, k) => p ? typeof k === "number" ? `${p}[${k}]` : `${p}.${k}` : String(k);
+function make(kind, parse, describe) {
+  const self = {
+    kind,
+    parse: (input, path = "") => parse(input, path),
+    describe,
+    optional() {
+      return make(
+        kind,
+        (i, p) => i === void 0 ? ok(void 0) : parse(i, p),
+        () => ({ ...describe(), optional: true })
+      );
+    },
+    default(value) {
+      return make(
+        kind,
+        (i, p) => i === void 0 ? ok(value) : parse(i, p),
+        () => ({ ...describe(), default: value, optional: true })
+      );
+    }
+  };
+  return self;
+}
+var s = {
+  string(o = {}) {
+    return make(
+      "string",
+      (i, p) => {
+        if (typeof i !== "string") return fail(p, "expected string");
+        if (o.min !== void 0 && i.length < o.min) return fail(p, `must have at least ${o.min} characters`);
+        if (o.max !== void 0 && i.length > o.max) return fail(p, `must have at most ${o.max} characters`);
+        if (o.pattern && !o.pattern.test(i)) return fail(p, `does not match ${o.pattern}`);
+        return ok(i);
+      },
+      () => ({ type: "string", title: o.title, description: o.description, min: o.min, max: o.max })
+    );
+  },
+  number(o = {}) {
+    return make(
+      "number",
+      (i, p) => {
+        if (typeof i !== "number" || Number.isNaN(i)) return fail(p, "expected number");
+        if (o.int && !Number.isInteger(i)) return fail(p, "expected integer");
+        if (o.min !== void 0 && i < o.min) return fail(p, `must be >= ${o.min}`);
+        if (o.max !== void 0 && i > o.max) return fail(p, `must be <= ${o.max}`);
+        return ok(i);
+      },
+      () => ({ type: "number", title: o.title, description: o.description, min: o.min, max: o.max })
+    );
+  },
+  boolean(o = {}) {
+    return make(
+      "boolean",
+      (i, p) => typeof i === "boolean" ? ok(i) : fail(p, "expected boolean"),
+      () => ({ type: "boolean", ...o })
+    );
+  },
+  unknown() {
+    return make(
+      "unknown",
+      (i) => ok(i),
+      () => ({ type: "unknown" })
+    );
+  },
+  literal(v) {
+    return make(
+      "literal",
+      (i, p) => i === v ? ok(v) : fail(p, `expected ${JSON.stringify(v)}`),
+      () => ({ type: "literal", enum: [v] })
+    );
+  },
+  enum(values, o = {}) {
+    return make(
+      "enum",
+      (i, p) => typeof i === "string" && values.includes(i) ? ok(i) : fail(p, `expected one of ${values.join(", ")}`),
+      () => ({ type: "enum", enum: values, ...o })
+    );
+  },
+  array(item, o = {}) {
+    return make(
+      "array",
+      (i, p) => {
+        if (!Array.isArray(i)) return fail(p, "expected array");
+        if (o.min !== void 0 && i.length < o.min) return fail(p, `must have at least ${o.min} items`);
+        if (o.max !== void 0 && i.length > o.max) return fail(p, `must have at most ${o.max} items`);
+        const out = [];
+        const issues = [];
+        i.forEach((el, idx) => {
+          const r = item.parse(el, join(p, idx));
+          if (r.ok) out.push(r.value);
+          else issues.push(...r.issues);
+        });
+        return issues.length ? { ok: false, issues } : ok(out);
+      },
+      () => ({ type: "array", items: item.describe() })
+    );
+  },
+  record(value) {
+    return make(
+      "record",
+      (i, p) => {
+        if (typeof i !== "object" || i === null || Array.isArray(i)) return fail(p, "expected object");
+        const out = {};
+        const issues = [];
+        for (const [k, v] of Object.entries(i)) {
+          const r = value.parse(v, join(p, k));
+          if (r.ok) out[k] = r.value;
+          else issues.push(...r.issues);
+        }
+        return issues.length ? { ok: false, issues } : ok(out);
+      },
+      () => ({ type: "record", items: value.describe() })
+    );
+  },
+  object(shape, o = {}) {
+    return make(
+      "object",
+      (i, p) => {
+        if (typeof i !== "object" || i === null || Array.isArray(i)) return fail(p, "expected object");
+        const src = i;
+        const out = {};
+        const issues = [];
+        for (const [k, sch] of Object.entries(shape)) {
+          const r = sch.parse(src[k], join(p, k));
+          if (r.ok) {
+            if (r.value !== void 0) out[k] = r.value;
+          } else issues.push(...r.issues);
+        }
+        if (o.strict) {
+          for (const k of Object.keys(src)) if (!(k in shape)) issues.push({ path: join(p, k), message: "unknown property" });
+        }
+        return issues.length ? { ok: false, issues } : ok(out);
+      },
+      () => {
+        const properties = {};
+        const required = [];
+        for (const [k, sch] of Object.entries(shape)) {
+          const d = sch.describe();
+          properties[k] = d;
+          if (!d.optional) required.push(k);
+        }
+        return { type: "object", title: o.title, description: o.description, properties, required };
+      }
+    );
+  },
+  /** Accepts a value if any of the schemas matches. */
+  union(...options) {
+    return make(
+      "union",
+      (i, p) => {
+        for (const opt of options) {
+          const r = opt.parse(i, p);
+          if (r.ok) return r;
+        }
+        return fail(p, "does not match any allowed shape");
+      },
+      () => ({ type: "union" })
+    );
+  },
+  /** Escape hatch for values that cannot be validated structurally (functions, React components...). */
+  custom(check, message = "invalid value") {
+    return make(
+      "custom",
+      (i, p) => check(i) ? ok(i) : fail(p, message),
+      () => ({ type: "custom" })
+    );
+  },
+  fn() {
+    return s.custom((v) => typeof v === "function", "expected function");
+  }
+};
+function parseOrThrow(schema, input, what) {
+  const r = schema.parse(input);
+  if (!r.ok) throw new ValidationError(r.issues, what);
+  return r.value;
+}
+
+// src/core/semver.ts
+var SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+function parseVersion(v) {
+  const m = SEMVER_RE.exec(v.trim());
+  if (!m) return null;
+  return {
+    major: Number(m[1]),
+    minor: Number(m[2]),
+    patch: Number(m[3]),
+    prerelease: m[4] ? m[4].split(".") : []
+  };
+}
+function isValidVersion(v) {
+  return parseVersion(v) !== null;
+}
+function cmpIdent(a, b) {
+  const an = /^\d+$/.test(a);
+  const bn = /^\d+$/.test(b);
+  if (an && bn) return Math.sign(Number(a) - Number(b));
+  if (an) return -1;
+  if (bn) return 1;
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function compareVersions(a, b) {
+  const x = parseVersion(a);
+  const y = parseVersion(b);
+  if (!x || !y) throw new Error(`Invalid version: ${!x ? a : b}`);
+  for (const k of ["major", "minor", "patch"]) {
+    if (x[k] !== y[k]) return x[k] < y[k] ? -1 : 1;
+  }
+  if (!x.prerelease.length && !y.prerelease.length) return 0;
+  if (!x.prerelease.length) return 1;
+  if (!y.prerelease.length) return -1;
+  const len = Math.max(x.prerelease.length, y.prerelease.length);
+  for (let i = 0; i < len; i++) {
+    const p = x.prerelease[i];
+    const q = y.prerelease[i];
+    if (p === void 0) return -1;
+    if (q === void 0) return 1;
+    const c = cmpIdent(p, q);
+    if (c !== 0) return c;
+  }
+  return 0;
+}
+function parsePartial(token) {
+  const m = /^v?(\d+|x|X|\*)(?:\.(\d+|x|X|\*))?(?:\.(\d+|x|X|\*))?(?:-([0-9A-Za-z.-]+))?$/.exec(token);
+  if (!m) return null;
+  const num = (x) => x === void 0 || /^[xX*]$/.test(x) ? void 0 : Number(x);
+  const major = num(m[1]);
+  if (major === void 0) return { major: -1 };
+  return { major, minor: num(m[2]), patch: num(m[3]), pre: m[4] };
+}
+var ver = (a, b, c, pre) => `${a}.${b}.${c}${pre ? `-${pre}` : ""}`;
+function expand(token) {
+  token = token.trim();
+  if (token === "" || token === "*" || token === "x" || token === "X") return [{ op: ">=", version: "0.0.0" }];
+  const prefix = /^(\^|~|>=|<=|>|<|=)?\s*(.+)$/.exec(token);
+  if (!prefix) return null;
+  const sym = prefix[1] ?? "";
+  const p = parsePartial(prefix[2]);
+  if (!p) return null;
+  if (p.major === -1) return [{ op: ">=", version: "0.0.0" }];
+  const { major, minor, patch, pre } = p;
+  const lo = ver(major, minor ?? 0, patch ?? 0, pre);
+  switch (sym) {
+    case "^": {
+      let hi;
+      if (major > 0 || minor === void 0) hi = ver(major + 1, 0, 0);
+      else if (minor > 0 || patch === void 0) hi = ver(0, minor + 1, 0);
+      else hi = ver(0, 0, patch + 1);
+      return [
+        { op: ">=", version: lo },
+        { op: "<", version: hi }
+      ];
+    }
+    case "~": {
+      const hi = minor === void 0 ? ver(major + 1, 0, 0) : ver(major, minor + 1, 0);
+      return [
+        { op: ">=", version: lo },
+        { op: "<", version: hi }
+      ];
+    }
+    case ">=":
+      return [{ op: ">=", version: lo }];
+    case ">":
+      if (minor === void 0) return [{ op: ">=", version: ver(major + 1, 0, 0) }];
+      if (patch === void 0) return [{ op: ">=", version: ver(major, minor + 1, 0) }];
+      return [{ op: ">", version: lo }];
+    case "<=":
+      if (minor === void 0) return [{ op: "<", version: ver(major + 1, 0, 0) }];
+      if (patch === void 0) return [{ op: "<", version: ver(major, minor + 1, 0) }];
+      return [{ op: "<=", version: lo }];
+    case "<":
+      return [{ op: "<", version: lo }];
+    default: {
+      if (minor === void 0)
+        return [
+          { op: ">=", version: ver(major, 0, 0) },
+          { op: "<", version: ver(major + 1, 0, 0) }
+        ];
+      if (patch === void 0)
+        return [
+          { op: ">=", version: ver(major, minor, 0) },
+          { op: "<", version: ver(major, minor + 1, 0) }
+        ];
+      return [{ op: "=", version: lo }];
+    }
+  }
+}
+function tokenize(set) {
+  const raw = set.trim().split(/\s+/).filter(Boolean);
+  const out = [];
+  for (let i = 0; i < raw.length; i++) {
+    const t = raw[i];
+    if (/^(\^|~|>=|<=|>|<|=)$/.test(t) && raw[i + 1]) out.push(t + raw[++i]);
+    else out.push(t);
+  }
+  return out;
+}
+function isValidRange(range) {
+  try {
+    for (const set of range.split("||")) for (const tok of tokenize(set)) if (!expand(tok)) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+function satisfies(version, range) {
+  if (!isValidVersion(version)) return false;
+  const v = parseVersion(version);
+  for (const set of range.split("||")) {
+    const tokens = tokenize(set);
+    const comparators = [];
+    let valid = true;
+    for (const t of tokens.length ? tokens : ["*"]) {
+      const e = expand(t);
+      if (!e) {
+        valid = false;
+        break;
+      }
+      comparators.push(...e);
+    }
+    if (!valid) continue;
+    const allOk = comparators.every((c) => {
+      const r = compareVersions(version, c.version);
+      switch (c.op) {
+        case ">=":
+          return r >= 0;
+        case ">":
+          return r > 0;
+        case "<=":
+          return r <= 0;
+        case "<":
+          return r < 0;
+        case "=":
+          return r === 0;
+      }
+    });
+    const preOk = v.prerelease.length === 0 || comparators.some((c) => {
+      const cv = parseVersion(c.version);
+      return cv.prerelease.length > 0 && cv.major === v.major && cv.minor === v.minor && cv.patch === v.patch;
+    });
+    if (allOk && preOk) return true;
+  }
+  return false;
+}
+
+// src/core/manifest.ts
+var FRAMEWORK_VERSION = "1.0.0";
+var FRAMEWORK_ENGINE_KEY = "fluxplugin";
+var BUILTIN_PERMISSIONS = [
+  "filesystem.read",
+  "filesystem.write",
+  "network",
+  "database",
+  "ipc",
+  "window",
+  "notifications",
+  "storage",
+  "services",
+  "menus",
+  "commands",
+  "routes",
+  "ui",
+  "events",
+  "hooks",
+  "styles",
+  "clipboard",
+  "shell"
+];
+var ID_RE = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;
+var ACTIVATION_RE = /^(\*|onStartup|onCommand:.+|onRoute:.+|onEvent:.+|onService:.+|onSlot:.+|onIPC:.+)$/;
+var permissionSchema = s.custom(
+  (v) => typeof v === "string" && (BUILTIN_PERMISSIONS.includes(v) || /^x\.[a-z0-9.-]+$/.test(v)),
+  `unknown permission (built-ins: ${BUILTIN_PERMISSIONS.join(", ")}; custom ones must start with "x.")`
+);
+var versionRange = s.custom((v) => typeof v === "string" && isValidRange(v), "expected a valid semver range");
+var menuLocations = ["application", "context", "sidebar", "toolbar", "commandPalette", "tray", "settings"];
+var manifestSchema = s.object({
+  id: s.string({ pattern: ID_RE, min: 3, max: 128, description: "Unique reverse-DNS style identifier, lowercase" }),
+  name: s.string({ min: 1, max: 128 }),
+  version: s.custom((v) => typeof v === "string" && isValidVersion(v), "expected a valid semver version"),
+  description: s.string().optional(),
+  author: s.union(s.string(), s.object({ name: s.string(), email: s.string().optional(), url: s.string().optional() })).optional(),
+  homepage: s.string().optional(),
+  repository: s.union(s.string(), s.object({ type: s.string().optional(), url: s.string() })).optional(),
+  license: s.string().optional(),
+  icon: s.string().optional(),
+  /** Entry executed in the Electron main process. */
+  main: s.string().optional(),
+  /** Entry executed in the preload context (sandbox-compatible, no Node). */
+  preload: s.string().optional(),
+  /** ESM entry loaded by the renderer. */
+  renderer: s.string().optional(),
+  styles: s.array(s.string()).optional(),
+  tailwind: s.object({
+    /** Globs (relative to the plugin root) scanned by Tailwind so utility classes are never purged. */
+    content: s.array(s.string()).optional(),
+    safelist: s.array(s.string()).optional(),
+    /** Path of a pre-compiled CSS file produced by the plugin's own Tailwind build. */
+    precompiled: s.string().optional()
+  }).optional(),
+  activationEvents: s.array(s.string({ pattern: ACTIVATION_RE })).default([]),
+  deactivationEvents: s.array(s.string()).default([]),
+  permissions: s.array(permissionSchema).default([]),
+  dependencies: s.record(versionRange).default({}),
+  optionalDependencies: s.record(versionRange).default({}),
+  peerDependencies: s.record(versionRange).default({}),
+  engines: s.record(versionRange).default({}),
+  /** Static, declarative metadata mirrored by the code-level registrations (lets the host display plugins without activating them). */
+  contributes: s.object({
+    routes: s.array(s.object({ path: s.string(), title: s.string().optional(), icon: s.string().optional(), permission: permissionSchema.optional() })).optional(),
+    commands: s.array(s.object({ id: s.string(), title: s.string(), category: s.string().optional() })).optional(),
+    menus: s.array(s.object({ location: s.enum(menuLocations), id: s.string(), label: s.string(), command: s.string().optional() })).optional(),
+    services: s.array(s.string()).optional(),
+    ipc: s.array(s.string()).optional(),
+    hooks: s.array(s.string()).optional(),
+    slots: s.array(s.string()).optional(),
+    configuration: s.unknown().optional()
+  }).default({}),
+  /** Optional integrity hash (sha256-<hex>) of the main bundle. Verified before load when present. */
+  integrity: s.record(s.string({ pattern: /^sha256-[0-9a-f]{64}$/ })).optional(),
+  signature: s.object({ algorithm: s.literal("ed25519"), publicKey: s.string(), value: s.string() }).optional()
+});
+function validateManifest(raw, opts = {}) {
+  const r = manifestSchema.parse(raw);
+  if (!r.ok) return { ok: false, issues: r.issues, warnings: [] };
+  const manifest = r.value;
+  const issues = [];
+  const warnings = [];
+  const fw = opts.frameworkVersion ?? FRAMEWORK_VERSION;
+  const required = manifest.engines?.[FRAMEWORK_ENGINE_KEY];
+  if (required && !satisfies(fw, required)) {
+    issues.push({ path: `engines.${FRAMEWORK_ENGINE_KEY}`, message: `requires framework ${required}, running ${fw}` });
+  }
+  if (!manifest.main && !manifest.renderer && !manifest.preload) {
+    issues.push({ path: "", message: "at least one of main, preload or renderer entry is required" });
+  }
+  if (!required) warnings.push(`engines.${FRAMEWORK_ENGINE_KEY} is not declared; compatibility cannot be verified`);
+  for (const dep of Object.keys(manifest.dependencies ?? {})) {
+    if (dep === manifest.id) issues.push({ path: `dependencies.${dep}`, message: "a plugin cannot depend on itself" });
+  }
+  return { ok: issues.length === 0, manifest: issues.length ? void 0 : manifest, issues, warnings };
+}
+
+// src/core/events.ts
+function matchesPattern(pattern, name) {
+  if (pattern === "*" || pattern === "**") return true;
+  if (pattern === name) return true;
+  if (!pattern.includes("*")) return false;
+  const p = pattern.split(".");
+  const n = name.split(".");
+  for (let i = 0; i < p.length; i++) {
+    const seg = p[i];
+    if (seg === "*") {
+      if (i === p.length - 1) return n.length > i;
+      if (n[i] === void 0) return false;
+      continue;
+    }
+    if (n[i] !== seg) return false;
+  }
+  return p.length === n.length;
+}
+var EventBus = class {
+  constructor(onError = () => {
+  }) {
+    this.onError = onError;
+  }
+  onError;
+  entries = [];
+  seq = 0;
+  on(pattern, listener, opts = {}) {
+    const entry = {
+      pattern,
+      segments: pattern.split("."),
+      listener,
+      priority: opts.priority ?? 0,
+      once: opts.once ?? false,
+      seq: this.seq++
+    };
+    this.entries.push(entry);
+    return toDisposable(() => {
+      const i = this.entries.indexOf(entry);
+      if (i >= 0) this.entries.splice(i, 1);
+    });
+  }
+  once(pattern, listener, opts = {}) {
+    return this.on(pattern, listener, { ...opts, once: true });
+  }
+  off(pattern, listener) {
+    this.entries = this.entries.filter((e) => !(e.pattern === pattern && e.listener === listener));
+  }
+  listenerCount(pattern) {
+    return pattern ? this.entries.filter((e) => e.pattern === pattern).length : this.entries.length;
+  }
+  removeAll() {
+    this.entries = [];
+  }
+  matching(name) {
+    return this.entries.filter((e) => matchesPattern(e.pattern, name)).sort((a, b) => b.priority - a.priority || a.seq - b.seq);
+  }
+  emit(name, payload, source) {
+    const ctx = this.makeCtx(name, payload, source);
+    const result = { cancelled: false, errors: [], delivered: 0 };
+    for (const entry of this.matching(name)) {
+      if (ctx.cancelled) break;
+      if (entry.once) this.removeEntry(entry);
+      try {
+        const r = entry.listener(payload, ctx);
+        result.delivered++;
+        if (r && typeof r.then === "function") {
+          r.catch((e) => this.fail(e, name, entry.pattern, result));
+        }
+      } catch (e) {
+        this.fail(e, name, entry.pattern, result);
+      }
+    }
+    result.cancelled = ctx.cancelled;
+    return result;
+  }
+  async emitAsync(name, payload, source) {
+    const ctx = this.makeCtx(name, payload, source);
+    const result = { cancelled: false, errors: [], delivered: 0 };
+    for (const entry of this.matching(name)) {
+      if (ctx.cancelled) break;
+      if (entry.once) this.removeEntry(entry);
+      try {
+        await entry.listener(payload, ctx);
+        result.delivered++;
+      } catch (e) {
+        this.fail(e, name, entry.pattern, result);
+      }
+    }
+    result.cancelled = ctx.cancelled;
+    return result;
+  }
+  waitFor(pattern, timeoutMs = 0) {
+    return new Promise((resolve, reject) => {
+      const sub = this.once(pattern, (p) => {
+        if (t) clearTimeout(t);
+        resolve(p);
+      });
+      const t = timeoutMs > 0 ? setTimeout(() => (sub.dispose(), reject(new Error(`waitFor("${pattern}") timed out`))), timeoutMs) : void 0;
+    });
+  }
+  removeEntry(e) {
+    const i = this.entries.indexOf(e);
+    if (i >= 0) this.entries.splice(i, 1);
+  }
+  fail(e, name, pattern, result) {
+    result.errors.push(e);
+    try {
+      this.onError(e, name, pattern);
+    } catch {
+    }
+  }
+  makeCtx(name, payload, source) {
+    const ctx = {
+      name,
+      payload,
+      source,
+      cancelled: false,
+      cancel() {
+        ctx.cancelled = true;
+      }
+    };
+    return ctx;
+  }
+};
+
+// src/core/hooks.ts
+var KINDS = ["before", "after", "around", "transform", "validate", "filter"];
+function split(name) {
+  const i = name.indexOf(".");
+  const kind = i > 0 ? name.slice(0, i) : "";
+  if (!KINDS.includes(kind) || i === name.length - 1) {
+    throw new Error(`Invalid hook name "${name}": expected "<${KINDS.join("|")}>.<operation>"`);
+  }
+  return { kind, operation: name.slice(i + 1) };
+}
+var HookSystem = class {
+  constructor(onError = () => {
+  }) {
+    this.onError = onError;
+  }
+  onError;
+  entries = [];
+  seq = 0;
+  use(name, handler, opts = {}) {
+    const { kind, operation } = split(name);
+    const entry = { kind, operation, handler, priority: opts.priority ?? 0, seq: this.seq++, owner: opts.owner };
+    this.entries.push(entry);
+    return toDisposable(() => {
+      const i = this.entries.indexOf(entry);
+      if (i >= 0) this.entries.splice(i, 1);
+    });
+  }
+  count(kind, operation) {
+    return this.entries.filter((e) => (!kind || e.kind === kind) && (!operation || e.operation === operation)).length;
+  }
+  list() {
+    return this.entries.map(({ kind, operation, priority, owner }) => ({ kind, operation, priority, owner }));
+  }
+  get(kind, operation) {
+    return this.entries.filter((e) => e.kind === kind && e.operation === operation).sort((a, b) => b.priority - a.priority || a.seq - b.seq);
+  }
+  async run(operation, input, exec) {
+    const ctx = {
+      operation,
+      input,
+      result: void 0,
+      cancelled: false,
+      cancelReason: void 0,
+      data: /* @__PURE__ */ new Map(),
+      cancel(reason) {
+        ctx.cancelled = true;
+        ctx.cancelReason = reason;
+      }
+    };
+    const guard = () => {
+      if (ctx.cancelled) throw new HookCancelledError(operation, ctx.cancelReason);
+    };
+    for (const kind of ["validate", "before"]) {
+      for (const h of this.get(kind, operation)) {
+        await h.handler(ctx);
+        guard();
+      }
+    }
+    const arounds = this.get("around", operation);
+    const core = async () => ctx.result = await exec(ctx.input, ctx);
+    const composed = arounds.reduceRight(
+      (next, h) => async () => {
+        guard();
+        const r = await h.handler(ctx, next);
+        if (r !== void 0) ctx.result = r;
+        return ctx.result;
+      },
+      core
+    );
+    await composed();
+    guard();
+    for (const h of this.get("transform", operation)) {
+      const r = await h.handler(ctx);
+      if (r !== void 0) ctx.result = r;
+    }
+    for (const h of this.get("after", operation)) {
+      try {
+        await h.handler(ctx);
+      } catch (e) {
+        this.onError(e, `after.${operation}`, h.owner);
+      }
+    }
+    return ctx.result;
+  }
+  /** Runs `filter.<name>` handlers as a value pipeline. A failing filter is skipped and reported. */
+  async filter(name, value, extra) {
+    let current = value;
+    for (const h of this.get("filter", name)) {
+      try {
+        const r = await h.handler(current, extra);
+        if (r !== void 0) current = r;
+      } catch (e) {
+        this.onError(e, `filter.${name}`, h.owner);
+      }
+    }
+    return current;
+  }
+  /** Synchronous variant for render-time filters (async filters are ignored with a reported error). */
+  filterSync(name, value, extra) {
+    let current = value;
+    for (const h of this.get("filter", name)) {
+      try {
+        const r = h.handler(current, extra);
+        if (r && typeof r.then === "function") throw new Error("async filter used in filterSync()");
+        if (r !== void 0) current = r;
+      } catch (e) {
+        this.onError(e, `filter.${name}`, h.owner);
+      }
+    }
+    return current;
+  }
+  removeByOwner(owner) {
+    this.entries = this.entries.filter((e) => e.owner !== owner);
+  }
+};
+
+// src/core/permissions.ts
+var PermissionManager = class {
+  constructor(opts = {}) {
+    this.opts = opts;
+    this.autoGrant = opts.autoGrant ?? true;
+    for (const [id, perms] of Object.entries(opts.approved ?? {})) this.granted.set(id, new Set(perms));
+  }
+  opts;
+  declared = /* @__PURE__ */ new Map();
+  granted = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  autoGrant;
+  /** Restores grants persisted from a previous session (call before `declare`). */
+  restore(approved) {
+    for (const [id, perms] of Object.entries(approved)) this.granted.set(id, new Set(perms));
+  }
+  /** Registers a plugin's requested permissions (called when its manifest is loaded). */
+  declare(pluginId, permissions) {
+    const set = new Set(permissions);
+    this.declared.set(pluginId, set);
+    const granted = this.granted.get(pluginId) ?? /* @__PURE__ */ new Set();
+    if (this.autoGrant) for (const p of set) granted.add(p);
+    for (const p of [...granted]) if (!set.has(p)) granted.delete(p);
+    this.granted.set(pluginId, granted);
+    this.notify(pluginId);
+  }
+  forget(pluginId) {
+    this.declared.delete(pluginId);
+    this.granted.delete(pluginId);
+  }
+  has(pluginId, permission) {
+    return this.granted.get(pluginId)?.has(permission) ?? false;
+  }
+  hasAll(pluginId, permissions) {
+    return permissions.every((p) => this.has(pluginId, p));
+  }
+  assert(pluginId, permission, api = permission) {
+    if (!this.has(pluginId, permission)) throw new PermissionDeniedError(pluginId, permission, api);
+  }
+  grant(pluginId, permission) {
+    if (!this.declared.get(pluginId)?.has(permission)) {
+      throw new Error(`Plugin "${pluginId}" did not declare permission "${permission}"`);
+    }
+    const set = this.granted.get(pluginId) ?? /* @__PURE__ */ new Set();
+    set.add(permission);
+    this.granted.set(pluginId, set);
+    this.notify(pluginId);
+  }
+  grantAll(pluginId) {
+    for (const p of this.declared.get(pluginId) ?? []) this.grant(pluginId, p);
+  }
+  revoke(pluginId, permission) {
+    this.granted.get(pluginId)?.delete(permission);
+    this.notify(pluginId);
+  }
+  snapshot(pluginId) {
+    const declared = [...this.declared.get(pluginId) ?? []];
+    const granted = [...this.granted.get(pluginId) ?? []];
+    return { declared, granted, denied: declared.filter((p) => !granted.includes(p)) };
+  }
+  onChange(l) {
+    this.listeners.add(l);
+    return toDisposable(() => this.listeners.delete(l));
+  }
+  notify(pluginId) {
+    this.opts.onChange?.(pluginId, this.snapshot(pluginId));
+    for (const l of this.listeners) l(pluginId);
+  }
+};
+
+// src/core/registry.ts
+var Registry = class {
+  constructor(kind) {
+    this.kind = kind;
+  }
+  kind;
+  table = /* @__PURE__ */ new Map();
+  subscribers = /* @__PURE__ */ new Set();
+  _version = 0;
+  get version() {
+    return this._version;
+  }
+  add(key, item, owner) {
+    if (this.table.has(key)) {
+      const existing = this.table.get(key);
+      throw new FrameworkError(
+        `${this.kind} "${key}" is already registered${existing.owner ? ` by "${existing.owner}"` : ""}`,
+        "FLUX_DUPLICATE",
+        owner
+      );
+    }
+    const entry = { item, owner };
+    this.table.set(key, entry);
+    this.changed();
+    return toDisposable(() => {
+      if (this.table.get(key) === entry) {
+        this.table.delete(key);
+        this.changed();
+      }
+    });
+  }
+  has(key) {
+    return this.table.has(key);
+  }
+  get(key) {
+    return this.table.get(key)?.item;
+  }
+  ownerOf(key) {
+    return this.table.get(key)?.owner;
+  }
+  list() {
+    return [...this.table.values()].map((e) => e.item);
+  }
+  listByOwner(owner) {
+    return [...this.table.values()].filter((e) => e.owner === owner).map((e) => e.item);
+  }
+  unregisterByOwner(owner) {
+    let n = 0;
+    for (const [k, e] of this.table) {
+      if (e.owner === owner) {
+        this.table.delete(k);
+        n++;
+      }
+    }
+    if (n) this.changed();
+    return n;
+  }
+  clear() {
+    this.table.clear();
+    this.changed();
+  }
+  /** Subscribes to any change. Returns an unsubscribe function compatible with `useSyncExternalStore`. */
+  subscribe = (listener) => {
+    this.subscribers.add(listener);
+    return () => void this.subscribers.delete(listener);
+  };
+  changed() {
+    this._version++;
+    for (const l of [...this.subscribers]) {
+      try {
+        l();
+      } catch {
+      }
+    }
+  }
+};
+var CommandRegistry = class extends Registry {
+  /** Set by the plugin manager: activates plugins that declared `onCommand:<id>` before execution. */
+  beforeExecute;
+  /** Observer used for diagnostics / hooks. */
+  onExecuted;
+  constructor() {
+    super("Command");
+  }
+  register(command, owner) {
+    return this.add(command.id, command, owner);
+  }
+  async execute(id, ...args) {
+    if (!this.has(id)) await this.beforeExecute?.(id);
+    const cmd = this.get(id);
+    if (!cmd) throw new FrameworkError(`Unknown command "${id}"`, "FLUX_UNKNOWN_COMMAND");
+    if (cmd.when && !cmd.when()) throw new FrameworkError(`Command "${id}" is not available right now`, "FLUX_COMMAND_DISABLED");
+    try {
+      const r = await cmd.execute(...args);
+      this.onExecuted?.(id);
+      return r;
+    } catch (e) {
+      this.onExecuted?.(id, e);
+      throw e;
+    }
+  }
+  /** Commands sorted for display in a palette. */
+  palette(query = "") {
+    const q = query.trim().toLowerCase();
+    return this.list().filter((c) => (!c.when || c.when()) && (!q || `${c.category ?? ""} ${c.title} ${c.id}`.toLowerCase().includes(q))).sort((a, b) => (a.category ?? "").localeCompare(b.category ?? "") || a.title.localeCompare(b.title));
+  }
+  /** Finds the command bound to a keyboard shortcut. */
+  byKeybinding(binding) {
+    const norm = (b) => b.toLowerCase().replace(/\s+/g, "").split("+").sort().join("+");
+    return this.list().find((c) => c.keybinding && norm(c.keybinding) === norm(binding));
+  }
+};
+var MenuRegistry = class extends Registry {
+  constructor() {
+    super("Menu item");
+  }
+  register(item, owner) {
+    return this.add(`${item.location}:${item.id}`, item, owner);
+  }
+  items(location) {
+    return this.list().filter((m) => m.location === location && (!m.when || m.when())).sort((a, b) => (a.group ?? "").localeCompare(b.group ?? "") || (a.order ?? 100) - (b.order ?? 100) || a.label.localeCompare(b.label));
+  }
+};
+var ServiceRegistry = class extends Registry {
+  /** Set by the plugin manager: activates plugins declaring `onService:<name>` on first lookup. */
+  beforeResolve;
+  constructor() {
+    super("Service");
+  }
+  register(name, implementation, owner) {
+    return this.add(name, { id: name, implementation }, owner);
+  }
+  /** Synchronous lookup — returns undefined when the providing plugin is not active. */
+  resolve(name) {
+    return this.get(name)?.implementation;
+  }
+  /** Looks a service up, activating its provider lazily if necessary. */
+  async resolveAsync(name) {
+    if (!this.has(name)) await this.beforeResolve?.(name);
+    const s2 = this.get(name);
+    if (!s2) throw new FrameworkError(`Service "${name}" is not available`, "FLUX_UNKNOWN_SERVICE");
+    return s2.implementation;
+  }
+};
+
+// src/core/routes.ts
+function normalizePath(path) {
+  const clean = "/" + path.split("?")[0].split("#")[0].split("/").filter(Boolean).join("/");
+  return clean;
+}
+function toSegments(fullPath) {
+  return fullPath.split("/").filter(Boolean).map((s2) => s2 === "*" ? { type: "splat" } : s2.startsWith(":") ? { type: "param", name: s2.slice(1) } : { type: "static", value: s2 });
+}
+function scoreOf(segs) {
+  return segs.reduce((n, s2) => n + (s2.type === "static" ? 100 : s2.type === "param" ? 10 : 1), segs.length);
+}
+function joinPaths(base, child) {
+  if (child.startsWith("/")) return normalizePath(child);
+  return normalizePath(`${base}/${child}`);
+}
+var RouteRegistry = class extends Registry {
+  /** Host-provided values handed to guards (e.g. `{ isAuthenticated: true }`). */
+  guardContext = {};
+  /** Set by the plugin manager to lazily activate plugins declaring `onRoute:<path>`. */
+  beforeResolve;
+  /** Called for every route with `meta.menu`: lets the manager create sidebar entries automatically. */
+  onRouteRegistered;
+  layouts = /* @__PURE__ */ new Map();
+  constructor() {
+    super("Route");
+  }
+  registerLayout(id, component) {
+    if (this.layouts.has(id)) throw new FrameworkError(`Layout "${id}" is already registered`, "FLUX_DUPLICATE");
+    this.layouts.set(id, component);
+    this.bump();
+    return toDisposable(() => {
+      this.layouts.delete(id);
+      this.bump();
+    });
+  }
+  getLayout(id) {
+    return this.layouts.get(id);
+  }
+  bump() {
+    this.changed();
+  }
+  /** Registers a route (and its children). Returns one disposable removing all of them. */
+  register(def, owner) {
+    const disposables = [];
+    const walk = (d, parent) => {
+      if (!d.component && !d.lazy && !d.children?.length) {
+        throw new FrameworkError(`Route "${d.path}" needs a component, a lazy loader or children`, "FLUX_INVALID_ROUTE", owner);
+      }
+      const fullPath = parent ? joinPaths(parent.fullPath, d.path) : normalizePath(d.path);
+      const segments = toSegments(fullPath);
+      const resolved = {
+        fullPath,
+        definition: d,
+        owner,
+        parents: parent ? [...parent.parents, parent] : [],
+        segments,
+        score: scoreOf(segments)
+      };
+      disposables.push(this.add(`${owner ?? ""}|${fullPath}`, resolved, owner));
+      const extra = this.onRouteRegistered?.(resolved, owner);
+      if (extra) disposables.push(extra);
+      for (const child of d.children ?? []) walk(child, resolved);
+    };
+    try {
+      walk(def, void 0);
+    } catch (e) {
+      for (const d of disposables.reverse()) d.dispose();
+      throw e;
+    }
+    return toDisposable(() => {
+      for (const d of disposables.reverse()) d.dispose();
+    });
+  }
+  /** Finds the best route for a concrete pathname. */
+  match(pathname) {
+    const target = normalizePath(pathname).split("/").filter(Boolean).map((s2) => {
+      try {
+        return decodeURIComponent(s2);
+      } catch {
+        return s2;
+      }
+    });
+    let best;
+    for (const route of this.list()) {
+      const def = route.definition;
+      if (!def.component && !def.lazy) continue;
+      const params = {};
+      let ok2 = true;
+      const segs = route.segments;
+      for (let i = 0; i < segs.length; i++) {
+        const seg = segs[i];
+        if (seg.type === "splat") {
+          params["*"] = target.slice(i).join("/");
+          if (target.length < i) ok2 = false;
+          break;
+        }
+        const t = target[i];
+        if (t === void 0) {
+          ok2 = false;
+          break;
+        }
+        if (seg.type === "static" && seg.value !== t) {
+          ok2 = false;
+          break;
+        }
+        if (seg.type === "param") params[seg.name] = t;
+        if (i === segs.length - 1 && target.length > segs.length) ok2 = false;
+      }
+      if (ok2 && segs.length === 0 && target.length > 0) ok2 = false;
+      if (!ok2) continue;
+      if (!best || route.score > best.route.score) best = { route, params, chain: [...route.parents, route] };
+    }
+    return best;
+  }
+  /** Same as `match` but first lets lazily-activated plugins register their routes. */
+  async matchAsync(pathname) {
+    const first = this.match(pathname);
+    if (first) return first;
+    await this.beforeResolve?.(normalizePath(pathname));
+    return this.match(pathname);
+  }
+  /** Evaluates `access`, then every guard from the root layout down to the route itself. */
+  async checkGuards(m, pathname) {
+    for (const r of m.chain) {
+      const base = { path: normalizePath(pathname), params: m.params, route: m.route, host: this.guardContext };
+      if (r.definition.access === "protected" && !this.guardContext["isAuthenticated"]) {
+        return { allow: false, redirect: this.guardContext["loginPath"] ?? "/login", reason: "authentication required" };
+      }
+      for (const g of r.definition.guards ?? []) {
+        let res;
+        try {
+          res = await g(base);
+        } catch (e) {
+          return { allow: false, reason: `guard threw: ${e instanceof Error ? e.message : String(e)}` };
+        }
+        if (typeof res === "string") return { allow: false, redirect: res, reason: "redirected by guard" };
+        if (res === false) return { allow: false, reason: "blocked by guard" };
+      }
+    }
+    return { allow: true };
+  }
+  breadcrumbs(m) {
+    const out = [];
+    for (const r of m.chain) {
+      const b = r.definition.meta?.breadcrumb ?? r.definition.meta?.title;
+      if (!b) continue;
+      const label = typeof b === "function" ? b(m.params) : b;
+      const path = r.fullPath.replace(/:([A-Za-z0-9_]+)/g, (_, k) => encodeURIComponent(m.params[k] ?? `:${k}`));
+      out.push({ label, path });
+    }
+    return out;
+  }
+};
+
+// src/core/slots.ts
+var SlotRegistry = class extends Registry {
+  counter = 0;
+  /** Set by the plugin manager to activate plugins declaring `onSlot:<name>`. */
+  onSlotRendered;
+  declared = /* @__PURE__ */ new Set();
+  constructor() {
+    super("Slot contribution");
+  }
+  /** Hosts may declare their slots so typos in plugins are caught early. Declaring is optional. */
+  declareSlot(name) {
+    this.declared.add(name);
+  }
+  declaredSlots() {
+    return [...this.declared];
+  }
+  register(c, owner, opts = {}) {
+    if (opts.strict && this.declared.size > 0 && !this.declared.has(c.slot)) {
+      throw new FrameworkError(`Unknown UI slot "${c.slot}"`, "FLUX_UNKNOWN_SLOT", owner);
+    }
+    const id = c.id ?? `${owner ?? "anon"}#${c.slot}#${this.counter++}`;
+    const entry = { id, slot: c.slot, component: c.component, mode: c.mode ?? "append", priority: c.priority ?? 0, props: c.props, owner, when: c.when };
+    return this.add(`${c.slot}::${id}`, entry, owner);
+  }
+  resolve(slot, props = {}) {
+    this.onSlotRendered?.(slot);
+    const all = this.list().filter((c) => c.slot === slot && (!c.when || safe(() => c.when(props)))).sort((a, b) => b.priority - a.priority);
+    const pick = (mode) => all.filter((c) => c.mode === mode);
+    return {
+      before: [...pick("prepend"), ...pick("before")],
+      replacement: pick("replace")[0],
+      after: [...pick("after"), ...pick("append")]
+    };
+  }
+  /** Slots that currently have at least one contribution. */
+  activeSlots() {
+    return [...new Set(this.list().map((c) => c.slot))];
+  }
+};
+function safe(fn) {
+  try {
+    return fn();
+  } catch {
+    return false;
+  }
+}
+var ExtensionPointRegistry = class extends Registry {
+  points = /* @__PURE__ */ new Map();
+  counter = 0;
+  constructor() {
+    super("Extension point contribution");
+  }
+  declare(def) {
+    if (this.points.has(def.name)) throw new FrameworkError(`Extension point "${def.name}" is already declared`, "FLUX_DUPLICATE");
+    this.points.set(def.name, def);
+    return {
+      dispose: () => {
+        this.points.delete(def.name);
+      }
+    };
+  }
+  definition(name) {
+    return this.points.get(name);
+  }
+  declaredPoints() {
+    return [...this.points.values()];
+  }
+  contribute(point, value, owner, priority = 0) {
+    const def = this.points.get(point);
+    if (!def) throw new FrameworkError(`Unknown extension point "${point}"`, "FLUX_UNKNOWN_EXTENSION_POINT", owner);
+    for (const [key, v] of Object.entries(value)) {
+      if (!(key in def.contributions)) {
+        throw new FrameworkError(`Extension point "${point}" does not accept "${key}" (allowed: ${Object.keys(def.contributions).join(", ")})`, "FLUX_INVALID_CONTRIBUTION", owner);
+      }
+      const schema = def.contributions[key];
+      if (schema) {
+        for (const item of Array.isArray(v) ? v : [v]) {
+          const r = schema.parse(item, `${point}.${key}`);
+          if (!r.ok) throw new FrameworkError(`Invalid contribution to "${point}.${key}": ${r.issues.map((i) => i.message).join("; ")}`, "FLUX_INVALID_CONTRIBUTION", owner);
+        }
+      }
+    }
+    return this.add(`${point}::${owner ?? "anon"}::${this.counter++}`, { point, priority, value }, owner);
+  }
+  /** Merged, priority-ordered items contributed under `key` of `point`. */
+  items(point, key) {
+    return this.list().filter((c) => c.point === point && key in c.value).sort((a, b) => b.priority - a.priority).flatMap((c) => {
+      const v = c.value[key];
+      return Array.isArray(v) ? v : [v];
+    });
+  }
+};
+
+// src/core/styles.ts
+var StyleRegistry = class extends Registry {
+  n = 0;
+  constructor() {
+    super("Style");
+  }
+  register(input, owner) {
+    if (!input.css && !input.href) throw new Error("style needs `css` or `href`");
+    const id = input.id ?? `style-${this.n++}`;
+    const entry = { id, css: input.css, href: input.href, priority: input.priority ?? 100, scoped: input.scoped ?? false, owner };
+    return this.add(`${owner}::${id}`, entry, owner);
+  }
+  /** Entries in cascade order. */
+  ordered() {
+    return this.list().map((e, i) => ({ e, i })).sort((a, b) => a.e.priority - b.e.priority || a.i - b.i).map((x) => x.e);
+  }
+};
+function scopeCss(css, pluginId) {
+  return `@scope ([data-fluxplugin="${pluginId.replace(/"/g, "")}"]) {
+${css}
+}`;
+}
+
+// src/core/ipc.ts
+function defineIpcContract(c) {
+  return Object.freeze({ ...c });
+}
+function defineIPC(def) {
+  const contract = Object.freeze({
+    name: def.name,
+    input: def.input,
+    output: def.output,
+    permission: def.permission
+  });
+  return { ...contract, handler: def.handler, contract };
+}
+var RESERVED = /^flux\./;
+var IpcError = class extends FrameworkError {
+  constructor(message, code, channel) {
+    super(message, code);
+    this.channel = channel;
+  }
+  channel;
+};
+function serializeError(e) {
+  if (e instanceof ValidationError) return { code: "FLUX_VALIDATION", message: e.message, issues: e.issues };
+  if (e instanceof FrameworkError) return { code: e.code, message: e.message };
+  return { code: "FLUX_HANDLER_ERROR", message: errorMessage(e) };
+}
+var IpcRegistry = class extends Registry {
+  oneWay = /* @__PURE__ */ new Map();
+  transport;
+  /** Hook for the manager: ensures the owner plugin is active (`onIPC:<name>`) and checks caller permissions. */
+  beforeInvoke;
+  /** Permission check provided by the manager. */
+  assertCallerPermission;
+  /** Observer used for diagnostics. */
+  onCall;
+  constructor() {
+    super("IPC handler");
+  }
+  setTransport(t) {
+    this.transport = t;
+  }
+  handle(a, handler, owner, opts = {}) {
+    const c = typeof a === "string" ? { name: a, ...opts } : a;
+    if (RESERVED.test(c.name) && owner !== "host") {
+      throw new FrameworkError(`IPC names starting with "flux." are reserved for the framework`, "FLUX_RESERVED", owner);
+    }
+    return this.add(c.name, { name: c.name, handler, input: c.input, output: c.output, permission: c.permission, owner }, owner);
+  }
+  /** Registers a full `IpcDefinition` (contract + handler). */
+  register(def, owner) {
+    return this.handle(def.contract, def.handler, owner);
+  }
+  /** Dispatches a call: validate input → permission → handler → validate output. */
+  async invoke(name, input, opts = {}) {
+    if (!this.has(name)) await this.beforeInvoke?.(name, opts);
+    const entry = this.table.get(name)?.item;
+    if (!entry) throw new IpcError(`No handler registered for "${name}"`, "FLUX_NO_HANDLER", name);
+    const caller = opts.caller ?? "host";
+    const started = Date.now();
+    try {
+      if (entry.permission && caller !== "host") this.assertCallerPermission?.(caller, entry.permission, name);
+      let value = input;
+      if (entry.input) {
+        const r = entry.input.parse(input);
+        if (!r.ok) throw new ValidationError(r.issues, `input of "${name}"`);
+        value = r.value;
+      }
+      const out = await entry.handler(value, { pluginId: entry.owner, caller, senderId: opts.senderId });
+      if (entry.output) {
+        const r = entry.output.parse(out);
+        if (!r.ok) throw new ValidationError(r.issues, `output of "${name}"`);
+        this.onCall?.({ name, owner: entry.owner, caller, ms: Date.now() - started });
+        return r.value;
+      }
+      this.onCall?.({ name, owner: entry.owner, caller, ms: Date.now() - started });
+      return out;
+    } catch (e) {
+      this.onCall?.({ name, owner: entry.owner, caller, ms: Date.now() - started, error: e });
+      throw e;
+    }
+  }
+  /** Fire-and-forget messages from renderer/other plugins to main (`ipc.on`). */
+  on(name, fn, owner) {
+    let set = this.oneWay.get(name);
+    if (!set) this.oneWay.set(name, set = /* @__PURE__ */ new Set());
+    const entry = { fn, owner };
+    set.add(entry);
+    return toDisposable(() => set.delete(entry));
+  }
+  /** Delivers a one-way message to main-side listeners. */
+  dispatch(name, payload, opts = {}) {
+    const set = this.oneWay.get(name);
+    if (!set) return 0;
+    let n = 0;
+    for (const l of [...set]) {
+      try {
+        l.fn(payload, { pluginId: l.owner, caller: opts.caller ?? "host", senderId: opts.senderId });
+        n++;
+      } catch {
+      }
+    }
+    return n;
+  }
+  /** Main → renderer push. */
+  send(channel, payload, target) {
+    this.transport?.broadcast(channel, payload, target);
+  }
+  removeListenersByOwner(owner) {
+    for (const set of this.oneWay.values()) for (const l of [...set]) if (l.owner === owner) set.delete(l);
+  }
+};
+var preloadMember = {
+  invoke: (channel) => ({ kind: "invoke", channel }),
+  send: (channel) => ({ kind: "send", channel }),
+  event: (channel) => ({ kind: "event", channel })
+};
+var NAMESPACE_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var FORBIDDEN_NS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype", "flux", "__fluxplugin"]);
+var PreloadRegistry = class extends Registry {
+  constructor() {
+    super("Preload API");
+  }
+  expose(namespace, members, owner) {
+    if (!NAMESPACE_RE.test(namespace) || FORBIDDEN_NS.has(namespace)) {
+      throw new FrameworkError(`Invalid preload namespace "${namespace}"`, "FLUX_INVALID_NAMESPACE", owner);
+    }
+    const spec = {};
+    for (const [key, m] of Object.entries(members)) {
+      if (!NAMESPACE_RE.test(key) || FORBIDDEN_NS.has(key)) {
+        throw new FrameworkError(`Invalid preload member "${namespace}.${key}"`, "FLUX_INVALID_NAMESPACE", owner);
+      }
+      spec[key] = typeof m === "string" ? { kind: "invoke", channel: m } : m;
+    }
+    return this.add(namespace, { id: namespace, namespace, spec, owner }, owner);
+  }
+  /** JSON-serializable manifest sent to the preload bridge. */
+  manifest() {
+    const out = {};
+    for (const e of this.list()) out[e.namespace] = e.spec;
+    return out;
+  }
+};
+
+// src/core/storage.ts
+var MemoryStorageBackend = class {
+  data = /* @__PURE__ */ new Map();
+  async read(ns) {
+    return structuredClone(this.data.get(ns) ?? {});
+  }
+  async write(ns, data) {
+    this.data.set(ns, structuredClone(data));
+  }
+  async remove(ns) {
+    this.data.delete(ns);
+  }
+};
+var CONFIG_KEY = "__fluxplugin_config__";
+function createPluginStorage(backend, namespace) {
+  let queue = Promise.resolve();
+  const exclusive = (fn) => {
+    const run = queue.then(fn, fn);
+    queue = run.catch(() => void 0);
+    return run;
+  };
+  const guard = (key) => {
+    if (typeof key !== "string" || key.length === 0) throw new Error("Storage key must be a non-empty string");
+    if (key === CONFIG_KEY || key === "__proto__") throw new Error(`Storage key "${key}" is reserved`);
+  };
+  return {
+    async get(key, fallback) {
+      guard(key);
+      const data = await exclusive(() => backend.read(namespace));
+      return Object.prototype.hasOwnProperty.call(data, key) ? structuredClone(data[key]) : fallback;
+    },
+    async set(key, value) {
+      guard(key);
+      await exclusive(async () => {
+        const data = await backend.read(namespace);
+        data[key] = structuredClone(value);
+        await backend.write(namespace, data);
+      });
+    },
+    async delete(key) {
+      guard(key);
+      await exclusive(async () => {
+        const data = await backend.read(namespace);
+        delete data[key];
+        await backend.write(namespace, data);
+      });
+    },
+    async keys() {
+      const data = await exclusive(() => backend.read(namespace));
+      return Object.keys(data).filter((k) => k !== CONFIG_KEY);
+    },
+    async clear() {
+      await exclusive(async () => {
+        const data = await backend.read(namespace);
+        await backend.write(namespace, CONFIG_KEY in data ? { [CONFIG_KEY]: data[CONFIG_KEY] } : {});
+      });
+    }
+  };
+}
+function createPluginConfig(backend, namespace, def, onChanged) {
+  const version = def.version ?? 1;
+  const listeners = /* @__PURE__ */ new Set();
+  let queue = Promise.resolve();
+  const exclusive = (fn) => {
+    const run = queue.then(fn, fn);
+    queue = run.catch(() => void 0);
+    return run;
+  };
+  const defaults = () => {
+    const r = def.schema.parse({});
+    if (!r.ok) throw new ValidationError(r.issues, `default configuration of "${namespace}" (every field needs a default or to be optional)`);
+    return r.value;
+  };
+  const load = async () => {
+    const data = await backend.read(namespace);
+    const stored = data[CONFIG_KEY];
+    if (!stored) return defaults();
+    let values = stored.values ?? {};
+    if (stored.version < version && def.migrate) values = def.migrate(values, stored.version);
+    const r = def.schema.parse(values);
+    if (r.ok) return r.value;
+    return defaults();
+  };
+  const save = async (values) => {
+    const data = await backend.read(namespace);
+    data[CONFIG_KEY] = { version, values };
+    await backend.write(namespace, data);
+  };
+  const emit = (next, prev) => {
+    onChanged?.(next, prev);
+    for (const l of [...listeners]) {
+      try {
+        l(next, prev);
+      } catch {
+      }
+    }
+  };
+  return {
+    get: () => exclusive(load),
+    set: (patch) => exclusive(async () => {
+      const prev = await load();
+      const r = def.schema.parse({ ...prev, ...patch });
+      if (!r.ok) throw new ValidationError(r.issues, `configuration of "${namespace}"`);
+      await save(r.value);
+      emit(r.value, prev);
+      return r.value;
+    }),
+    reset: () => exclusive(async () => {
+      const prev = await load();
+      const next = defaults();
+      await save(next);
+      emit(next, prev);
+      return next;
+    }),
+    onChange(l) {
+      listeners.add(l);
+      return toDisposable(() => listeners.delete(l));
+    },
+    describe: () => def.schema.describe()
+  };
+}
+function createPluginState() {
+  const data = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Set();
+  const notify = (k, v) => {
+    for (const l of [...listeners]) {
+      if (l.key !== void 0 && l.key !== k) continue;
+      try {
+        l.fn(k, v);
+      } catch {
+      }
+    }
+  };
+  return {
+    get: ((key, fallback) => data.has(key) ? data.get(key) : fallback),
+    set(key, value) {
+      if (Object.is(data.get(key), value) && data.has(key)) return;
+      data.set(key, value);
+      notify(key, value);
+    },
+    delete(key) {
+      if (data.delete(key)) notify(key, void 0);
+    },
+    subscribe(fn, key) {
+      const l = { fn, key };
+      listeners.add(l);
+      return toDisposable(() => listeners.delete(l));
+    },
+    snapshot: () => Object.fromEntries(data)
+  };
+}
+
+// src/core/deps.ts
+function buildDependencyGraph(manifests) {
+  const map = /* @__PURE__ */ new Map();
+  for (const m of manifests) map.set(m.id, m);
+  const issues = [];
+  const edges = /* @__PURE__ */ new Map();
+  const blocked = /* @__PURE__ */ new Set();
+  for (const m of map.values()) {
+    const out = [];
+    for (const kind of ["dependencies", "peerDependencies"]) {
+      for (const [dep, range] of Object.entries(m[kind] ?? {})) {
+        const target = map.get(dep);
+        if (!target) {
+          issues.push({ type: "missing", plugin: m.id, dependency: dep, range, kind });
+          blocked.add(m.id);
+          continue;
+        }
+        if (!satisfies(target.version, range)) {
+          issues.push({ type: "version", plugin: m.id, dependency: dep, range, found: target.version });
+          blocked.add(m.id);
+          continue;
+        }
+        out.push(dep);
+      }
+    }
+    for (const [dep, range] of Object.entries(m.optionalDependencies ?? {})) {
+      const target = map.get(dep);
+      if (target && satisfies(target.version, range)) out.push(dep);
+    }
+    edges.set(m.id, out);
+  }
+  const state = /* @__PURE__ */ new Map();
+  const order = [];
+  const stack = [];
+  const visit = (id) => {
+    const st = state.get(id) ?? 0;
+    if (st === 2) return;
+    if (st === 1) {
+      const path = [...stack.slice(stack.indexOf(id)), id];
+      issues.push({ type: "cycle", plugin: id, path });
+      for (const p of path) blocked.add(p);
+      return;
+    }
+    state.set(id, 1);
+    stack.push(id);
+    for (const dep of edges.get(id) ?? []) visit(dep);
+    stack.pop();
+    state.set(id, 2);
+    order.push(id);
+  };
+  for (const id of [...map.keys()].sort()) visit(id);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const [id, deps] of edges) {
+      if (!blocked.has(id) && deps.some((d) => blocked.has(d))) {
+        blocked.add(id);
+        changed = true;
+      }
+    }
+  }
+  return { manifests: map, edges, issues, blocked, order: order.filter((id) => !blocked.has(id)) };
+}
+function activationOrderFor(graph, id) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const walk = (n) => {
+    if (seen.has(n)) return;
+    seen.add(n);
+    for (const d of graph.edges.get(n) ?? []) walk(d);
+    out.push(n);
+  };
+  walk(id);
+  return out;
+}
+function dependentsOf(graph, id) {
+  const reverse = /* @__PURE__ */ new Map();
+  for (const [p, deps] of graph.edges) for (const d of deps) (reverse.get(d) ?? reverse.set(d, []).get(d)).push(p);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set([id]);
+  const walk = (n) => {
+    for (const p of reverse.get(n) ?? []) {
+      if (seen.has(p)) continue;
+      seen.add(p);
+      walk(p);
+      out.push(p);
+    }
+  };
+  walk(id);
+  return out;
+}
+function describeIssue(i) {
+  switch (i.type) {
+    case "missing":
+      return `${i.plugin} requires "${i.dependency}" (${i.range}) which is not installed`;
+    case "version":
+      return `${i.plugin} requires "${i.dependency}" ${i.range} but ${i.found} is installed`;
+    case "cycle":
+      return `dependency cycle: ${i.path.join(" \u2192 ")}`;
+  }
+}
+
+// src/core/plugin.ts
+function definePlugin(def) {
+  return def;
+}
+var defineRoute = (r) => r;
+var defineCommand = (c) => c;
+var defineService = (name, impl) => ({ name, implementation: impl });
+var defineHook = (name, handler, priority) => ({ name, handler, priority });
+var defineEvent = (name, handler, opts = {}) => ({ name, handler, ...opts });
+var defineComponent = (c) => c;
+var defineMenu = (m) => m;
+
+// src/core/manager.ts
+var DEFAULT_TIMEOUTS = { load: 15e3, initialize: 1e4, activate: 15e3, ready: 1e4, deactivate: 1e4, unload: 1e4 };
+var PluginManager = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.runtime = opts.runtime;
+    this.logs = opts.logs ?? new LogStore();
+    this.log = this.logs.logger("core");
+    this.storageBackend = opts.storage ?? new MemoryStorageBackend();
+    this.permissions = opts.permissions ?? new PermissionManager();
+    this.timeouts = { ...DEFAULT_TIMEOUTS, ...opts.timeouts };
+    this.events = new EventBus((e, name, pattern) => this.log.error(`event listener for "${pattern}" failed on "${name}": ${errorMessage(e)}`));
+    this.hooks = new HookSystem((e, name, owner) => this.logs.logger(owner ?? "core").error(`hook "${name}" failed: ${errorMessage(e)}`));
+    this.wireLazyActivation();
+    this.permissions.onChange(() => this.changed());
+  }
+  opts;
+  runtime;
+  logs;
+  permissions;
+  events;
+  hooks;
+  commands = new CommandRegistry();
+  menus = new MenuRegistry();
+  routes = new RouteRegistry();
+  services = new ServiceRegistry();
+  slots = new SlotRegistry();
+  extensionPoints = new ExtensionPointRegistry();
+  ipc = new IpcRegistry();
+  preload = new PreloadRegistry();
+  styles = new StyleRegistry();
+  storageBackend;
+  records = /* @__PURE__ */ new Map();
+  states = /* @__PURE__ */ new Map();
+  hostApis = /* @__PURE__ */ new Map();
+  timeouts;
+  log;
+  listeners = /* @__PURE__ */ new Set();
+  _version = 0;
+  disposedFlag = false;
+  /* ------------------------------------------------------------- observers */
+  get version() {
+    return this._version;
+  }
+  subscribe = (l) => {
+    this.listeners.add(l);
+    return () => void this.listeners.delete(l);
+  };
+  changed() {
+    this._version++;
+    for (const l of [...this.listeners]) {
+      try {
+        l();
+      } catch {
+      }
+    }
+  }
+  /* ------------------------------------------------------------ host APIs */
+  /** Exposes a controlled capability to plugins (`context.host.api(name)`), optionally gated by a permission. */
+  provide(name, factory, permission) {
+    if (this.hostApis.has(name)) throw new FrameworkError(`Host API "${name}" already provided`, "FLUX_DUPLICATE");
+    this.hostApis.set(name, { factory, permission });
+    return toDisposable(() => this.hostApis.delete(name));
+  }
+  /* --------------------------------------------------- discovery / validate */
+  /** Persisted state (disabled plugins) must be loaded before registering sources. */
+  async init() {
+    const disabled = await this.opts.stateStore?.load() ?? [];
+    this.persistedDisabled = new Set(disabled);
+  }
+  persistedDisabled = /* @__PURE__ */ new Set();
+  /**
+   * Discovers + validates one plugin. Invalid plugins are recorded in the `error` state (so the UI can show why)
+   * and never throw — one broken plugin must not stop the others.
+   */
+  register(source) {
+    const v = validateManifest(source.manifest, { frameworkVersion: this.opts.frameworkVersion ?? FRAMEWORK_VERSION });
+    const raw = source.manifest;
+    const id = v.manifest?.id ?? (typeof raw?.id === "string" ? raw.id : `invalid-${this.records.size}`);
+    if (this.records.has(id)) {
+      this.log.warn(`plugin "${id}" is already registered; ignoring duplicate from ${source.origin ?? "unknown origin"}`);
+      return this.info(id);
+    }
+    const manifest = v.manifest ?? {
+      id,
+      name: typeof raw?.name === "string" ? raw.name : id,
+      version: typeof raw?.version === "string" ? raw.version : "0.0.0",
+      activationEvents: [],
+      deactivationEvents: [],
+      permissions: [],
+      dependencies: {},
+      optionalDependencies: {},
+      peerDependencies: {},
+      engines: {},
+      contributes: {}
+    };
+    const rec = {
+      id,
+      manifest,
+      source,
+      state: v.ok ? "validated" : "error",
+      enabled: !this.persistedDisabled.has(id),
+      store: new DisposableStore(),
+      deactivators: [],
+      lazy: [],
+      crashes: [],
+      warnings: v.warnings
+    };
+    if (!v.ok) {
+      rec.error = { message: v.issues.map((i) => `${i.path || "<root>"}: ${i.message}`).join("; "), phase: "validate", time: Date.now() };
+      this.logs.logger(id).error(`manifest validation failed: ${rec.error.message}`);
+    } else {
+      this.permissions.declare(id, manifest.permissions);
+      if (!rec.enabled) rec.state = "disabled";
+    }
+    this.records.set(id, rec);
+    if (v.ok && rec.enabled) this.installLazyProxies(rec);
+    this.log.info(`discovered ${id}@${manifest.version} (${rec.state})`);
+    this.events.emit("plugin.registered", { id }, "core");
+    this.changed();
+    return this.info(id);
+  }
+  async unregister(id) {
+    const rec = this.records.get(id);
+    if (!rec) return;
+    await this.deactivate(id).catch(() => void 0);
+    await this.unload(id).catch(() => void 0);
+    for (const d of rec.lazy.splice(0)) d.dispose();
+    this.permissions.forget(id);
+    this.records.delete(id);
+    this.events.emit("plugin.unregistered", { id }, "core");
+    this.changed();
+  }
+  /* ----------------------------------------------------------- inspection */
+  has(id) {
+    return this.records.has(id);
+  }
+  list() {
+    return [...this.records.keys()].sort().map((id) => this.info(id));
+  }
+  info(id) {
+    const rec = this.mustGet(id);
+    const m = rec.manifest;
+    const graph = this.graph();
+    const author = typeof m.author === "string" ? m.author : m.author?.name;
+    return {
+      id,
+      name: m.name,
+      version: m.version,
+      description: m.description,
+      author,
+      state: rec.state,
+      enabled: rec.enabled,
+      runtime: this.runtime,
+      permissions: this.permissions.snapshot(id),
+      dependencies: { ...m.dependencies, ...m.peerDependencies, ...m.optionalDependencies },
+      dependents: dependentsOf(graph, id),
+      activationEvents: m.activationEvents ?? [],
+      contributes: m.contributes ?? {},
+      error: rec.error,
+      crashes: rec.crashes.length,
+      hasConfig: !!rec.definition?.config,
+      root: rec.source.root,
+      origin: rec.source.origin,
+      warnings: rec.warnings
+    };
+  }
+  /** Reactive per-plugin state store (same instance as `ctx.state`). Survives reloads. */
+  stateOf(id) {
+    let s2 = this.states.get(id);
+    if (!s2) this.states.set(id, s2 = createPluginState());
+    return s2;
+  }
+  /** Validated manifest (or the best-effort one for plugins rejected at validation). */
+  manifest(id) {
+    return this.mustGet(id).manifest;
+  }
+  getConfig(id) {
+    return this.records.get(id)?.config;
+  }
+  /** Active plugin's context (for hosts and tests). */
+  contextOf(id) {
+    return this.records.get(id)?.context;
+  }
+  diagnostics(id) {
+    const owned = (r) => r.listByOwner(id).length;
+    return {
+      info: this.info(id),
+      logs: this.logs.query({ source: id }),
+      contributions: {
+        commands: owned(this.commands),
+        menus: owned(this.menus),
+        routes: owned(this.routes),
+        services: owned(this.services),
+        slots: owned(this.slots),
+        extensions: owned(this.extensionPoints),
+        ipc: owned(this.ipc),
+        preload: owned(this.preload),
+        styles: owned(this.styles)
+      }
+    };
+  }
+  mustGet(id) {
+    const r = this.records.get(id);
+    if (!r) throw new FrameworkError(`Unknown plugin "${id}"`, "FLUX_UNKNOWN_PLUGIN");
+    return r;
+  }
+  graph() {
+    return buildDependencyGraph([...this.records.values()].filter((r) => r.state !== "error" || r.error?.phase !== "validate").map((r) => r.manifest));
+  }
+  /* ------------------------------------------------------------ activation */
+  /** Activates every plugin that wants to start with the application (`onStartup`, `*`, or no activation events). */
+  async startup() {
+    const graph = this.graph();
+    for (const issue of graph.issues) this.log.warn(describeIssue(issue));
+    const ids = graph.order.filter((id) => {
+      const r = this.records.get(id);
+      const ev = r.manifest.activationEvents ?? [];
+      return r.enabled && (ev.length === 0 || ev.includes("onStartup") || ev.includes("*"));
+    });
+    for (const id of ids) await this.activate(id).catch(() => void 0);
+  }
+  /** Activates `id` and, first, everything it depends on. Rejects with a `LifecycleError` on failure. */
+  async activate(id) {
+    const rec = this.mustGet(id);
+    if (!rec.enabled) throw new LifecycleError(id, "activate", "plugin is disabled");
+    if (rec.state === "error" && rec.error?.phase === "validate") throw new LifecycleError(id, "validate", rec.error.message);
+    const graph = this.graph();
+    if (graph.blocked.has(id)) {
+      const reasons = graph.issues.filter((i) => i.plugin === id || i.type === "cycle" && i.path.includes(id)).map(describeIssue);
+      throw new LifecycleError(id, "activate", reasons.join("; ") || "a dependency cannot be activated");
+    }
+    await this.ensureReady(id, graph, []);
+  }
+  async ensureReady(id, graph, chain) {
+    const rec = this.mustGet(id);
+    if (rec.state === "ready") return;
+    if (rec.inflight) return rec.inflight;
+    if (!rec.enabled) throw new LifecycleError(id, "activate", "plugin is disabled");
+    if (chain.includes(id)) throw new LifecycleError(id, "activate", `dependency cycle: ${[...chain, id].join(" \u2192 ")}`);
+    const optional = new Set(Object.keys(rec.manifest.optionalDependencies ?? {}).filter((d) => !(d in (rec.manifest.dependencies ?? {})) && !(d in (rec.manifest.peerDependencies ?? {}))));
+    const run = (async () => {
+      for (const dep of graph.edges.get(id) ?? []) {
+        try {
+          await this.ensureReady(dep, graph, [...chain, id]);
+        } catch (e) {
+          if (optional.has(dep)) {
+            this.logs.logger(id).warn(`optional dependency "${dep}" could not be activated: ${errorMessage(e)}`);
+            continue;
+          }
+          const err = new LifecycleError(id, "activate", `required dependency "${dep}" failed: ${errorMessage(e)}`, e);
+          await this.fail(rec, "activate", err, false);
+          throw err;
+        }
+      }
+      await this.bringUp(rec);
+    })();
+    rec.inflight = run;
+    try {
+      await run;
+    } finally {
+      rec.inflight = void 0;
+    }
+  }
+  async phase(rec, phase, fn) {
+    try {
+      return await withTimeout(Promise.resolve().then(fn), this.timeouts[phase], `${phase} of "${rec.id}"`, rec.id);
+    } catch (e) {
+      if (e instanceof LifecycleError) throw e;
+      throw new LifecycleError(rec.id, phase, errorMessage(e), e);
+    }
+  }
+  setState(rec, state) {
+    rec.state = state;
+    this.events.emit("plugin.state", { id: rec.id, state }, "core");
+    this.changed();
+  }
+  async bringUp(rec) {
+    let phase = "load";
+    try {
+      if (!rec.definition) {
+        const def2 = await this.phase(rec, "load", () => rec.source.load());
+        if (!def2 || typeof def2 !== "object") throw new Error("entry did not export a plugin definition (use definePlugin)");
+        if (def2.id && def2.id !== rec.id) throw new Error(`plugin id mismatch: manifest "${rec.id}" vs entry "${def2.id}"`);
+        rec.definition = def2;
+        rec.context = this.createContext(rec);
+        this.setState(rec, "loaded");
+        await this.phase(rec, "load", () => def2.onLoad?.(rec.context));
+      }
+      const def = rec.definition;
+      const ctx = rec.context;
+      phase = "initialize";
+      this.setState(rec, "initialized");
+      await this.phase(rec, "initialize", () => def.onInitialize?.(ctx));
+      phase = "activate";
+      this.removeLazyProxies(rec);
+      await this.phase(rec, "activate", async () => {
+        await this.applyDeclarative(rec);
+        await (def.onActivate ?? def.activate)?.(ctx);
+      });
+      this.setState(rec, "activated");
+      phase = "ready";
+      await this.phase(rec, "ready", () => def.onReady?.(ctx));
+      rec.error = void 0;
+      this.setState(rec, "ready");
+      this.logs.logger(rec.id).info("ready");
+      this.events.emit("plugin.ready", { id: rec.id }, "core");
+    } catch (e) {
+      await this.fail(rec, phase, e, true);
+      throw e;
+    }
+  }
+  /** Records a failure, tears down everything the plugin registered and auto-disables repeat offenders. */
+  async fail(rec, phase, e, cleanup) {
+    const message = errorMessage(e);
+    this.logs.logger(rec.id).error(`${phase} failed: ${message}`, e instanceof Error ? e.stack : void 0);
+    if (cleanup) this.teardown(rec);
+    rec.error = { message, phase, time: Date.now() };
+    const now = Date.now();
+    const windowMs = this.opts.crashWindowMs ?? 6e4;
+    rec.crashes = [...rec.crashes.filter((t) => now - t < windowMs), now];
+    this.events.emit("plugin.error", { id: rec.id, phase, message }, "core");
+    if (rec.crashes.length >= (this.opts.maxCrashes ?? 3)) {
+      rec.enabled = false;
+      this.logs.logger(rec.id).warn(`disabled automatically after ${rec.crashes.length} failures`);
+      await this.persistDisabled();
+      this.setState(rec, "disabled");
+      this.events.emit("plugin.autodisabled", { id: rec.id }, "core");
+    } else {
+      this.setState(rec, "error");
+    }
+    if (rec.enabled) this.installLazyProxies(rec);
+  }
+  /** Disposes every contribution of a plugin (store + owner-based sweep as a safety net). */
+  teardown(rec) {
+    rec.store.dispose();
+    rec.store = new DisposableStore();
+    rec.deactivators = [];
+    this.sweep(rec.id);
+  }
+  sweep(owner) {
+    this.commands.unregisterByOwner(owner);
+    this.menus.unregisterByOwner(owner);
+    this.routes.unregisterByOwner(owner);
+    this.services.unregisterByOwner(owner);
+    this.slots.unregisterByOwner(owner);
+    this.extensionPoints.unregisterByOwner(owner);
+    this.ipc.unregisterByOwner(owner);
+    this.ipc.removeListenersByOwner(owner);
+    this.preload.unregisterByOwner(owner);
+    this.styles.unregisterByOwner(owner);
+    this.hooks.removeByOwner(owner);
+  }
+  /* ---------------------------------------------------------- deactivation */
+  /** Deactivates `id` after deactivating every active plugin that depends on it. Never throws for plugin errors. */
+  async deactivate(id) {
+    const rec = this.mustGet(id);
+    const graph = this.graph();
+    for (const dep of dependentsOf(graph, id)) {
+      const d = this.records.get(dep);
+      if (d && (d.state === "ready" || d.state === "activated" || d.state === "initialized" || d.state === "loaded")) await this.deactivateOne(d);
+    }
+    if (rec.inflight) await rec.inflight.catch(() => void 0);
+    await this.deactivateOne(rec);
+  }
+  async deactivateOne(rec) {
+    if (!["ready", "activated", "initialized", "loaded", "error"].includes(rec.state)) return;
+    const log = this.logs.logger(rec.id);
+    const def = rec.definition;
+    const ctx = rec.context;
+    if (def && ctx && rec.state !== "error") {
+      try {
+        await this.phase(rec, "deactivate", () => (def.onDeactivate ?? def.deactivate)?.(ctx));
+      } catch (e) {
+        log.error(`deactivate hook failed: ${errorMessage(e)}`);
+      }
+    }
+    for (const fn of [...rec.deactivators].reverse()) {
+      try {
+        await fn();
+      } catch (e) {
+        log.error(`cleanup failed: ${errorMessage(e)}`);
+      }
+    }
+    this.teardown(rec);
+    this.setState(rec, "deactivated");
+    if (rec.enabled) this.installLazyProxies(rec);
+    this.events.emit("plugin.deactivated", { id: rec.id }, "core");
+  }
+  async unload(id) {
+    const rec = this.mustGet(id);
+    if (rec.state === "ready" || rec.state === "activated") await this.deactivate(id);
+    const def = rec.definition;
+    const ctx = rec.context;
+    if (def && ctx) {
+      try {
+        await this.phase(rec, "unload", () => def.onUnload?.(ctx));
+      } catch (e) {
+        this.logs.logger(id).error(`unload hook failed: ${errorMessage(e)}`);
+      }
+    }
+    rec.definition = void 0;
+    rec.context = void 0;
+    rec.config = void 0;
+    if (rec.state !== "disabled" && !(rec.state === "error" && rec.error?.phase === "validate")) this.setState(rec, "unloaded");
+  }
+  async disable(id) {
+    const rec = this.mustGet(id);
+    await this.deactivate(id);
+    await this.unload(id);
+    rec.enabled = false;
+    for (const d of rec.lazy.splice(0)) d.dispose();
+    await this.persistDisabled();
+    this.setState(rec, "disabled");
+  }
+  async enable(id, opts = {}) {
+    const rec = this.mustGet(id);
+    rec.enabled = true;
+    rec.crashes = [];
+    rec.error = void 0;
+    await this.persistDisabled();
+    this.setState(rec, "validated");
+    this.installLazyProxies(rec);
+    if (opts.activate ?? true) await this.activate(id);
+  }
+  /** Development hot reload: deactivate → unload → load a fresh module → activate (if it was active). */
+  async reload(id) {
+    const rec = this.mustGet(id);
+    const wasActive = rec.state === "ready" || rec.state === "error" && rec.error?.phase !== "validate";
+    await this.deactivate(id);
+    await this.unload(id);
+    rec.error = void 0;
+    if (rec.enabled && rec.state !== "disabled") this.setState(rec, "validated");
+    this.events.emit("plugin.reloading", { id }, "core");
+    if (wasActive || rec.manifest.activationEvents?.includes("onStartup")) await this.activate(id);
+    this.events.emit("plugin.reloaded", { id }, "core");
+  }
+  async persistDisabled() {
+    const ids = [...this.records.values()].filter((r) => !r.enabled).map((r) => r.id);
+    this.persistedDisabled = new Set(ids);
+    try {
+      await this.opts.stateStore?.save(ids);
+    } catch (e) {
+      this.log.error(`could not persist plugin state: ${errorMessage(e)}`);
+    }
+  }
+  async dispose() {
+    this.disposedFlag = true;
+    const graph = this.graph();
+    for (const id of [...graph.order].reverse()) await this.deactivate(id).catch(() => void 0);
+    for (const id of this.records.keys()) await this.unload(id).catch(() => void 0);
+    this.events.removeAll();
+  }
+  /* ------------------------------------------------- lazy activation events */
+  /** Activates plugins whose manifest lists `event` (or `*`). Used internally and by hosts for custom events. */
+  async trigger(event) {
+    if (this.disposedFlag) return;
+    const targets = [...this.records.values()].filter((r) => {
+      if (!r.enabled || r.state === "ready" || r.state === "error" || r.state === "disabled") return false;
+      if (r.inflight) return true;
+      return (r.manifest.activationEvents ?? []).some((e) => e === event || this.eventMatches(e, event));
+    });
+    await Promise.all(targets.map((r) => this.activate(r.id).catch(() => void 0)));
+  }
+  eventMatches(declared, event) {
+    const [kd, ...rd] = declared.split(":");
+    const [ke, ...re] = event.split(":");
+    if (kd !== ke) return false;
+    const pd = rd.join(":");
+    const pe = re.join(":");
+    if (kd === "onRoute") return routePatternMatches(pd, pe);
+    return matchesPattern(pd, pe);
+  }
+  wireLazyActivation() {
+    this.commands.beforeExecute = (id) => this.trigger(`onCommand:${id}`);
+    this.services.beforeResolve = (name) => this.trigger(`onService:${name}`);
+    this.routes.beforeResolve = (path) => this.trigger(`onRoute:${path}`);
+    this.slots.onSlotRendered = (slot) => void this.trigger(`onSlot:${slot}`);
+    this.ipc.beforeInvoke = (name) => this.trigger(`onIPC:${name}`);
+    this.ipc.assertCallerPermission = (caller, permission, channel) => this.permissions.assert(caller, permission, `IPC "${channel}"`);
+    this.events.on("**", (_p, ctx) => {
+      if (!ctx.name.startsWith("plugin.")) void this.trigger(`onEvent:${ctx.name}`);
+    }, { priority: 1e3 });
+    this.routes.onRouteRegistered = (route, owner) => {
+      const menu = route.definition.meta?.menu;
+      if (!menu || !owner) return;
+      const meta = route.definition.meta;
+      return this.menus.register(
+        {
+          id: `route:${route.fullPath}`,
+          location: menu.location ?? "sidebar",
+          label: menu.label ?? meta.title ?? route.fullPath,
+          icon: meta.icon,
+          path: route.fullPath,
+          order: menu.order,
+          group: menu.group
+        },
+        owner
+      );
+    };
+  }
+  /**
+   * Before a plugin is active, its statically declared commands/menus (manifest `contributes`) are visible
+   * as lightweight proxies: using one activates the plugin on demand. Replaced by the real registrations on activate.
+   */
+  installLazyProxies(rec) {
+    if (rec.lazy.length) return;
+    const c = rec.manifest.contributes ?? {};
+    const owner = rec.id;
+    for (const cmd of c.commands ?? []) {
+      if (this.commands.has(cmd.id)) continue;
+      rec.lazy.push(
+        this.commands.register(
+          {
+            id: cmd.id,
+            title: cmd.title,
+            category: cmd.category,
+            execute: async (...args) => {
+              await this.activate(owner);
+              return this.commands.execute(cmd.id, ...args);
+            }
+          },
+          `${owner}#lazy`
+        )
+      );
+    }
+    for (const m of c.menus ?? []) {
+      if (this.menus.has(`${m.location}:${m.id}`)) continue;
+      rec.lazy.push(this.menus.register({ id: m.id, location: m.location, label: m.label, command: m.command }, `${owner}#lazy`));
+    }
+  }
+  removeLazyProxies(rec) {
+    for (const d of rec.lazy.splice(0)) d.dispose();
+  }
+  /* ------------------------------------------------- declarative contributions */
+  async applyDeclarative(rec) {
+    const def = rec.definition;
+    const ctx = rec.context;
+    const renderer = this.runtime === "renderer";
+    const main = this.runtime === "main";
+    for (const [id, component] of Object.entries(def.layouts ?? {})) if (renderer) ctx.routes.registerLayout(id, component);
+    if (renderer) for (const r of def.routes ?? []) ctx.routes.register(r);
+    for (const c of def.commands ?? []) ctx.commands.register(c);
+    for (const m of def.menus ?? []) ctx.menus.register(m);
+    for (const h of def.hooks ?? []) ctx.hooks.use(h.name, h.handler, { priority: h.priority });
+    const services = typeof def.services === "function" ? def.services(ctx) : def.services;
+    for (const [name, impl] of Object.entries(services ?? {})) ctx.services.register(name, impl);
+    if (main) for (const i of def.ipc ?? []) ctx.ipc.define(i);
+    for (const e of def.events ?? []) ctx.events.on(e.name, e.handler, { priority: e.priority, once: e.once });
+    if (renderer) for (const c of def.components ?? []) ctx.ui.register(c);
+    if (renderer) {
+      for (const x of def.extensions ?? []) {
+        try {
+          ctx.ui.extend(x.point, { ...x.contribution, priority: x.priority });
+        } catch (e) {
+          ctx.logger.warn(`extension "${x.point}" skipped: ${errorMessage(e)}`);
+        }
+      }
+    }
+    if (renderer) for (const st of def.styles ?? []) ctx.styles.add(typeof st === "string" ? { css: st } : st);
+    if (main) for (const [ns, members] of Object.entries(def.preload ?? {})) ctx.preload.expose(ns, members);
+  }
+  /* ------------------------------------------------------------- context */
+  createContext(rec) {
+    const id = rec.id;
+    const store = () => rec.store;
+    const track = (d) => store().add(d);
+    const need = (permission, api) => this.permissions.assert(id, permission, api);
+    const logger = this.logs.logger(id);
+    const renderer = this.runtime === "renderer";
+    const bridge = this.opts.ipcBridge;
+    const def = rec.definition;
+    const configDef = def.config ?? { schema: s.object({}) };
+    const config = createPluginConfig(this.storageBackend, id, configDef, (next, prev) => {
+      this.events.emit("plugin.config.changed", { id, next, prev }, id);
+      this.changed();
+    });
+    rec.config = def.config ? config : void 0;
+    const storage = createPluginStorage(this.storageBackend, id);
+    const unsupported = (what) => {
+      throw new FrameworkError(`${what} is not available in the ${this.runtime} process`, "FLUX_UNSUPPORTED_RUNTIME", id);
+    };
+    const ctx = {
+      pluginId: id,
+      manifest: rec.manifest,
+      runtime: this.runtime,
+      root: rec.source.root,
+      logger,
+      config,
+      storage,
+      state: this.stateOf(id),
+      events: {
+        on: (pattern, listener, opts) => (need("events", "events.on"), track(this.events.on(pattern, listener, opts))),
+        once: (pattern, listener, opts) => (need("events", "events.once"), track(this.events.once(pattern, listener, opts))),
+        emit: (name, payload, opts) => {
+          need("events", "events.emit");
+          const r = this.events.emit(name, payload, id);
+          if (opts?.broadcast) this.opts.onBroadcastEvent?.(name, payload, id);
+          return r;
+        },
+        emitAsync: (name, payload) => (need("events", "events.emitAsync"), this.events.emitAsync(name, payload, id))
+      },
+      commands: {
+        register: (c) => (need("commands", "commands.register"), track(this.commands.register(c, id))),
+        execute: (cid, ...args) => (need("commands", "commands.execute"), this.commands.execute(cid, ...args)),
+        list: () => this.commands.list()
+      },
+      routes: {
+        register: (r) => {
+          need("routes", "routes.register");
+          if (r.permission) need(r.permission, `route "${r.path}"`);
+          return track(this.routes.register(r, id));
+        },
+        registerLayout: (lid, component) => (need("routes", "routes.registerLayout"), track(this.routes.registerLayout(lid, component)))
+      },
+      menus: { register: (m) => (need("menus", "menus.register"), track(this.menus.register(m, id))) },
+      ui: {
+        register: (c) => (need("ui", "ui.register"), track(this.slots.register(c, id, { strict: this.opts.strictSlots }))),
+        extend: (point, contribution) => {
+          need("ui", "ui.extend");
+          const { mode, component, priority, ...data } = contribution;
+          const parts = [];
+          try {
+            if (component !== void 0) parts.push(this.slots.register({ slot: point, component, mode: mode ?? "append", priority }, id));
+            if (Object.keys(data).length) parts.push(this.extensionPoints.contribute(point, data, id, priority ?? 0));
+          } catch (e) {
+            for (const p of parts) p.dispose();
+            throw e;
+          }
+          return track(toDisposable(() => parts.forEach((p) => p.dispose())));
+        }
+      },
+      ipc: {
+        handle: ((a, handler, opts) => {
+          need("ipc", "ipc.handle");
+          if (renderer) return unsupported("ipc.handle");
+          return track(typeof a === "string" ? this.ipc.handle(a, handler, id, opts) : this.ipc.handle(a, handler, id));
+        }),
+        define: (d) => {
+          need("ipc", "ipc.define");
+          if (renderer) return unsupported("ipc.define");
+          return track(this.ipc.register(d, id));
+        },
+        on: (name, handler) => {
+          need("ipc", "ipc.on");
+          if (renderer) return track(bridge ? bridge.on(name, (p) => handler(p, { pluginId: id, caller: "host" })) : toDisposable(() => {
+          }));
+          return track(this.ipc.on(name, handler, id));
+        },
+        send: (channel, payload) => {
+          need("ipc", "ipc.send");
+          if (renderer) bridge?.send(channel, payload, id);
+          else this.ipc.send(channel, payload);
+        },
+        invoke: ((a, input) => {
+          need("ipc", "ipc.invoke");
+          const name = typeof a === "string" ? a : a.name;
+          return renderer && bridge ? bridge.invoke(name, input, id) : this.ipc.invoke(name, input, { caller: id });
+        })
+      },
+      preload: {
+        expose: (ns, members) => {
+          need("ipc", "preload.expose");
+          if (renderer) return unsupported("preload.expose");
+          return track(this.preload.expose(ns, members, id));
+        }
+      },
+      services: {
+        register: (name, impl) => (need("services", "services.register"), track(this.services.register(name, impl, id))),
+        get: (name) => (need("services", "services.get"), this.services.resolve(name)),
+        getAsync: (name) => (need("services", "services.getAsync"), this.services.resolveAsync(name))
+      },
+      hooks: {
+        use: (name, handler, opts) => (need("hooks", "hooks.use"), track(this.hooks.use(name, handler, { ...opts, owner: id }))),
+        run: (op, input, exec) => (need("hooks", "hooks.run"), this.hooks.run(op, input, exec)),
+        filter: (name, value, extra) => (need("hooks", "hooks.filter"), this.hooks.filter(name, value, extra))
+      },
+      styles: { add: (st) => (need("styles", "styles.add"), track(this.styles.register(st, id))) },
+      host: {
+        has: (name) => this.hostApis.has(name),
+        api: (name) => {
+          const p = this.hostApis.get(name);
+          if (!p) throw new FrameworkError(`Host API "${name}" is not provided by this application`, "FLUX_UNKNOWN_HOST_API", id);
+          if (p.permission) need(p.permission, `host API "${name}"`);
+          return p.factory({ pluginId: id, root: rec.source.root, manifest: rec.manifest });
+        }
+      },
+      permissions: {
+        has: (p) => this.permissions.has(id, p),
+        assert: (p) => this.permissions.assert(id, p),
+        list: () => this.permissions.snapshot(id)
+      },
+      lifecycle: {
+        get state() {
+          return rec.state;
+        },
+        onDeactivate: (fn) => void rec.deactivators.push(fn),
+        subscriptions: { add: (d) => track(d) }
+      }
+    };
+    return ctx;
+  }
+};
+function routePatternMatches(pattern, path) {
+  const p = normalizePath(pattern).split("/").filter(Boolean);
+  const t = normalizePath(path).split("/").filter(Boolean);
+  for (let i = 0; i < p.length; i++) {
+    const seg = p[i];
+    if (seg === "*") return true;
+    if (t[i] === void 0) return false;
+    if (seg.startsWith(":")) continue;
+    if (seg !== t[i]) return false;
+  }
+  return p.length === t.length;
+}
+
+// src/core/protocol.ts
+var CHANNELS = {
+  invoke: "flux:invoke",
+  send: "flux:send",
+  event: "flux:event",
+  bootstrap: "flux:bootstrap"
+};
+var MGMT = {
+  list: "flux.plugins.list",
+  enable: "flux.plugins.enable",
+  disable: "flux.plugins.disable",
+  reload: "flux.plugins.reload",
+  grant: "flux.plugins.grant",
+  revoke: "flux.plugins.revoke",
+  uninstall: "flux.plugins.uninstall",
+  install: "flux.plugins.install",
+  update: "flux.plugins.update",
+  rollback: "flux.plugins.rollback",
+  search: "flux.plugins.search",
+  updates: "flux.plugins.updates",
+  configGet: "flux.plugins.config.get",
+  configSet: "flux.plugins.config.set",
+  configReset: "flux.plugins.config.reset",
+  configSchema: "flux.plugins.config.schema",
+  logs: "flux.plugins.logs",
+  diagnostics: "flux.plugins.diagnostics",
+  changed: "flux.plugins.changed"
+};
+
+// src/core/api.ts
+function pluginApi(namespace) {
+  const root = globalThis.plugins;
+  const api = root?.[namespace];
+  if (!api) throw new Error(`window.plugins.${namespace} is not available (plugin disabled, permission missing, or not exposed)`);
+  return api;
+}
+function hasPluginApi(namespace) {
+  return !!globalThis.plugins?.[namespace];
+}
+
+export {
+  toDisposable,
+  DisposableStore,
+  FrameworkError,
+  PermissionDeniedError,
+  LifecycleError,
+  TimeoutError,
+  HookCancelledError,
+  withTimeout,
+  LogStore,
+  errorMessage,
+  ValidationError,
+  s,
+  parseOrThrow,
+  parseVersion,
+  isValidVersion,
+  compareVersions,
+  isValidRange,
+  satisfies,
+  FRAMEWORK_VERSION,
+  FRAMEWORK_ENGINE_KEY,
+  BUILTIN_PERMISSIONS,
+  menuLocations,
+  manifestSchema,
+  validateManifest,
+  matchesPattern,
+  EventBus,
+  HookSystem,
+  PermissionManager,
+  Registry,
+  CommandRegistry,
+  MenuRegistry,
+  ServiceRegistry,
+  normalizePath,
+  RouteRegistry,
+  SlotRegistry,
+  ExtensionPointRegistry,
+  StyleRegistry,
+  scopeCss,
+  defineIpcContract,
+  defineIPC,
+  IpcError,
+  serializeError,
+  IpcRegistry,
+  preloadMember,
+  PreloadRegistry,
+  MemoryStorageBackend,
+  createPluginStorage,
+  createPluginConfig,
+  createPluginState,
+  buildDependencyGraph,
+  activationOrderFor,
+  dependentsOf,
+  describeIssue,
+  definePlugin,
+  defineRoute,
+  defineCommand,
+  defineService,
+  defineHook,
+  defineEvent,
+  defineComponent,
+  defineMenu,
+  PluginManager,
+  routePatternMatches,
+  CHANNELS,
+  MGMT,
+  pluginApi,
+  hasPluginApi
+};