fluxplugin 1.0.0

package/dist/cli.js

@@ -0,0 +1,1635 @@
+#!/usr/bin/env node
+import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
+
+// src/cli/cli.ts
+import { parseArgs } from "node:util";
+import { promises as fs8 } from "node:fs";
+import path9 from "node:path";
+import crypto2 from "node:crypto";
+
+// src/core/schema.ts
+var ok = (value) => ({ ok: true, value });
+var fail = (path10, message) => ({ ok: false, issues: [{ path: path10, message }] });
+var join = (p, k) => p ? typeof k === "number" ? `${p}[${k}]` : `${p}.${k}` : String(k);
+function make(kind, parse, describe) {
+  const self = {
+    kind,
+    parse: (input, path10 = "") => parse(input, path10),
+    describe,
+    optional() {
+      return make(
+        kind,
+        (i, p) => i === void 0 ? ok(void 0) : parse(i, p),
+        () => ({ ...describe(), optional: true })
+      );
+    },
+    default(value) {
+      return make(
+        kind,
+        (i, p) => i === void 0 ? ok(value) : parse(i, p),
+        () => ({ ...describe(), default: value, optional: true })
+      );
+    }
+  };
+  return self;
+}
+var s = {
+  string(o = {}) {
+    return make(
+      "string",
+      (i, p) => {
+        if (typeof i !== "string") return fail(p, "expected string");
+        if (o.min !== void 0 && i.length < o.min) return fail(p, `must have at least ${o.min} characters`);
+        if (o.max !== void 0 && i.length > o.max) return fail(p, `must have at most ${o.max} characters`);
+        if (o.pattern && !o.pattern.test(i)) return fail(p, `does not match ${o.pattern}`);
+        return ok(i);
+      },
+      () => ({ type: "string", title: o.title, description: o.description, min: o.min, max: o.max })
+    );
+  },
+  number(o = {}) {
+    return make(
+      "number",
+      (i, p) => {
+        if (typeof i !== "number" || Number.isNaN(i)) return fail(p, "expected number");
+        if (o.int && !Number.isInteger(i)) return fail(p, "expected integer");
+        if (o.min !== void 0 && i < o.min) return fail(p, `must be >= ${o.min}`);
+        if (o.max !== void 0 && i > o.max) return fail(p, `must be <= ${o.max}`);
+        return ok(i);
+      },
+      () => ({ type: "number", title: o.title, description: o.description, min: o.min, max: o.max })
+    );
+  },
+  boolean(o = {}) {
+    return make(
+      "boolean",
+      (i, p) => typeof i === "boolean" ? ok(i) : fail(p, "expected boolean"),
+      () => ({ type: "boolean", ...o })
+    );
+  },
+  unknown() {
+    return make(
+      "unknown",
+      (i) => ok(i),
+      () => ({ type: "unknown" })
+    );
+  },
+  literal(v) {
+    return make(
+      "literal",
+      (i, p) => i === v ? ok(v) : fail(p, `expected ${JSON.stringify(v)}`),
+      () => ({ type: "literal", enum: [v] })
+    );
+  },
+  enum(values, o = {}) {
+    return make(
+      "enum",
+      (i, p) => typeof i === "string" && values.includes(i) ? ok(i) : fail(p, `expected one of ${values.join(", ")}`),
+      () => ({ type: "enum", enum: values, ...o })
+    );
+  },
+  array(item, o = {}) {
+    return make(
+      "array",
+      (i, p) => {
+        if (!Array.isArray(i)) return fail(p, "expected array");
+        if (o.min !== void 0 && i.length < o.min) return fail(p, `must have at least ${o.min} items`);
+        if (o.max !== void 0 && i.length > o.max) return fail(p, `must have at most ${o.max} items`);
+        const out = [];
+        const issues = [];
+        i.forEach((el, idx) => {
+          const r = item.parse(el, join(p, idx));
+          if (r.ok) out.push(r.value);
+          else issues.push(...r.issues);
+        });
+        return issues.length ? { ok: false, issues } : ok(out);
+      },
+      () => ({ type: "array", items: item.describe() })
+    );
+  },
+  record(value) {
+    return make(
+      "record",
+      (i, p) => {
+        if (typeof i !== "object" || i === null || Array.isArray(i)) return fail(p, "expected object");
+        const out = {};
+        const issues = [];
+        for (const [k, v] of Object.entries(i)) {
+          const r = value.parse(v, join(p, k));
+          if (r.ok) out[k] = r.value;
+          else issues.push(...r.issues);
+        }
+        return issues.length ? { ok: false, issues } : ok(out);
+      },
+      () => ({ type: "record", items: value.describe() })
+    );
+  },
+  object(shape, o = {}) {
+    return make(
+      "object",
+      (i, p) => {
+        if (typeof i !== "object" || i === null || Array.isArray(i)) return fail(p, "expected object");
+        const src = i;
+        const out = {};
+        const issues = [];
+        for (const [k, sch] of Object.entries(shape)) {
+          const r = sch.parse(src[k], join(p, k));
+          if (r.ok) {
+            if (r.value !== void 0) out[k] = r.value;
+          } else issues.push(...r.issues);
+        }
+        if (o.strict) {
+          for (const k of Object.keys(src)) if (!(k in shape)) issues.push({ path: join(p, k), message: "unknown property" });
+        }
+        return issues.length ? { ok: false, issues } : ok(out);
+      },
+      () => {
+        const properties = {};
+        const required = [];
+        for (const [k, sch] of Object.entries(shape)) {
+          const d = sch.describe();
+          properties[k] = d;
+          if (!d.optional) required.push(k);
+        }
+        return { type: "object", title: o.title, description: o.description, properties, required };
+      }
+    );
+  },
+  /** Accepts a value if any of the schemas matches. */
+  union(...options) {
+    return make(
+      "union",
+      (i, p) => {
+        for (const opt of options) {
+          const r = opt.parse(i, p);
+          if (r.ok) return r;
+        }
+        return fail(p, "does not match any allowed shape");
+      },
+      () => ({ type: "union" })
+    );
+  },
+  /** Escape hatch for values that cannot be validated structurally (functions, React components...). */
+  custom(check, message = "invalid value") {
+    return make(
+      "custom",
+      (i, p) => check(i) ? ok(i) : fail(p, message),
+      () => ({ type: "custom" })
+    );
+  },
+  fn() {
+    return s.custom((v) => typeof v === "function", "expected function");
+  }
+};
+
+// src/core/semver.ts
+var SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+function parseVersion(v) {
+  const m = SEMVER_RE.exec(v.trim());
+  if (!m) return null;
+  return {
+    major: Number(m[1]),
+    minor: Number(m[2]),
+    patch: Number(m[3]),
+    prerelease: m[4] ? m[4].split(".") : []
+  };
+}
+function isValidVersion(v) {
+  return parseVersion(v) !== null;
+}
+function cmpIdent(a, b) {
+  const an = /^\d+$/.test(a);
+  const bn = /^\d+$/.test(b);
+  if (an && bn) return Math.sign(Number(a) - Number(b));
+  if (an) return -1;
+  if (bn) return 1;
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function compareVersions(a, b) {
+  const x = parseVersion(a);
+  const y = parseVersion(b);
+  if (!x || !y) throw new Error(`Invalid version: ${!x ? a : b}`);
+  for (const k of ["major", "minor", "patch"]) {
+    if (x[k] !== y[k]) return x[k] < y[k] ? -1 : 1;
+  }
+  if (!x.prerelease.length && !y.prerelease.length) return 0;
+  if (!x.prerelease.length) return 1;
+  if (!y.prerelease.length) return -1;
+  const len = Math.max(x.prerelease.length, y.prerelease.length);
+  for (let i = 0; i < len; i++) {
+    const p = x.prerelease[i];
+    const q = y.prerelease[i];
+    if (p === void 0) return -1;
+    if (q === void 0) return 1;
+    const c = cmpIdent(p, q);
+    if (c !== 0) return c;
+  }
+  return 0;
+}
+function parsePartial(token) {
+  const m = /^v?(\d+|x|X|\*)(?:\.(\d+|x|X|\*))?(?:\.(\d+|x|X|\*))?(?:-([0-9A-Za-z.-]+))?$/.exec(token);
+  if (!m) return null;
+  const num = (x) => x === void 0 || /^[xX*]$/.test(x) ? void 0 : Number(x);
+  const major = num(m[1]);
+  if (major === void 0) return { major: -1 };
+  return { major, minor: num(m[2]), patch: num(m[3]), pre: m[4] };
+}
+var ver = (a, b, c, pre) => `${a}.${b}.${c}${pre ? `-${pre}` : ""}`;
+function expand(token) {
+  token = token.trim();
+  if (token === "" || token === "*" || token === "x" || token === "X") return [{ op: ">=", version: "0.0.0" }];
+  const prefix = /^(\^|~|>=|<=|>|<|=)?\s*(.+)$/.exec(token);
+  if (!prefix) return null;
+  const sym = prefix[1] ?? "";
+  const p = parsePartial(prefix[2]);
+  if (!p) return null;
+  if (p.major === -1) return [{ op: ">=", version: "0.0.0" }];
+  const { major, minor, patch, pre } = p;
+  const lo = ver(major, minor ?? 0, patch ?? 0, pre);
+  switch (sym) {
+    case "^": {
+      let hi;
+      if (major > 0 || minor === void 0) hi = ver(major + 1, 0, 0);
+      else if (minor > 0 || patch === void 0) hi = ver(0, minor + 1, 0);
+      else hi = ver(0, 0, patch + 1);
+      return [
+        { op: ">=", version: lo },
+        { op: "<", version: hi }
+      ];
+    }
+    case "~": {
+      const hi = minor === void 0 ? ver(major + 1, 0, 0) : ver(major, minor + 1, 0);
+      return [
+        { op: ">=", version: lo },
+        { op: "<", version: hi }
+      ];
+    }
+    case ">=":
+      return [{ op: ">=", version: lo }];
+    case ">":
+      if (minor === void 0) return [{ op: ">=", version: ver(major + 1, 0, 0) }];
+      if (patch === void 0) return [{ op: ">=", version: ver(major, minor + 1, 0) }];
+      return [{ op: ">", version: lo }];
+    case "<=":
+      if (minor === void 0) return [{ op: "<", version: ver(major + 1, 0, 0) }];
+      if (patch === void 0) return [{ op: "<", version: ver(major, minor + 1, 0) }];
+      return [{ op: "<=", version: lo }];
+    case "<":
+      return [{ op: "<", version: lo }];
+    default: {
+      if (minor === void 0)
+        return [
+          { op: ">=", version: ver(major, 0, 0) },
+          { op: "<", version: ver(major + 1, 0, 0) }
+        ];
+      if (patch === void 0)
+        return [
+          { op: ">=", version: ver(major, minor, 0) },
+          { op: "<", version: ver(major, minor + 1, 0) }
+        ];
+      return [{ op: "=", version: lo }];
+    }
+  }
+}
+function tokenize(set) {
+  const raw = set.trim().split(/\s+/).filter(Boolean);
+  const out = [];
+  for (let i = 0; i < raw.length; i++) {
+    const t = raw[i];
+    if (/^(\^|~|>=|<=|>|<|=)$/.test(t) && raw[i + 1]) out.push(t + raw[++i]);
+    else out.push(t);
+  }
+  return out;
+}
+function isValidRange(range) {
+  try {
+    for (const set of range.split("||")) for (const tok of tokenize(set)) if (!expand(tok)) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+function satisfies(version, range) {
+  if (!isValidVersion(version)) return false;
+  const v = parseVersion(version);
+  for (const set of range.split("||")) {
+    const tokens = tokenize(set);
+    const comparators = [];
+    let valid = true;
+    for (const t of tokens.length ? tokens : ["*"]) {
+      const e = expand(t);
+      if (!e) {
+        valid = false;
+        break;
+      }
+      comparators.push(...e);
+    }
+    if (!valid) continue;
+    const allOk = comparators.every((c) => {
+      const r = compareVersions(version, c.version);
+      switch (c.op) {
+        case ">=":
+          return r >= 0;
+        case ">":
+          return r > 0;
+        case "<=":
+          return r <= 0;
+        case "<":
+          return r < 0;
+        case "=":
+          return r === 0;
+      }
+    });
+    const preOk = v.prerelease.length === 0 || comparators.some((c) => {
+      const cv = parseVersion(c.version);
+      return cv.prerelease.length > 0 && cv.major === v.major && cv.minor === v.minor && cv.patch === v.patch;
+    });
+    if (allOk && preOk) return true;
+  }
+  return false;
+}
+
+// src/core/manifest.ts
+var FRAMEWORK_VERSION = "1.0.0";
+var FRAMEWORK_ENGINE_KEY = "fluxplugin";
+var BUILTIN_PERMISSIONS = [
+  "filesystem.read",
+  "filesystem.write",
+  "network",
+  "database",
+  "ipc",
+  "window",
+  "notifications",
+  "storage",
+  "services",
+  "menus",
+  "commands",
+  "routes",
+  "ui",
+  "events",
+  "hooks",
+  "styles",
+  "clipboard",
+  "shell"
+];
+var ID_RE = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;
+var ACTIVATION_RE = /^(\*|onStartup|onCommand:.+|onRoute:.+|onEvent:.+|onService:.+|onSlot:.+|onIPC:.+)$/;
+var permissionSchema = s.custom(
+  (v) => typeof v === "string" && (BUILTIN_PERMISSIONS.includes(v) || /^x\.[a-z0-9.-]+$/.test(v)),
+  `unknown permission (built-ins: ${BUILTIN_PERMISSIONS.join(", ")}; custom ones must start with "x.")`
+);
+var versionRange = s.custom((v) => typeof v === "string" && isValidRange(v), "expected a valid semver range");
+var menuLocations = ["application", "context", "sidebar", "toolbar", "commandPalette", "tray", "settings"];
+var manifestSchema = s.object({
+  id: s.string({ pattern: ID_RE, min: 3, max: 128, description: "Unique reverse-DNS style identifier, lowercase" }),
+  name: s.string({ min: 1, max: 128 }),
+  version: s.custom((v) => typeof v === "string" && isValidVersion(v), "expected a valid semver version"),
+  description: s.string().optional(),
+  author: s.union(s.string(), s.object({ name: s.string(), email: s.string().optional(), url: s.string().optional() })).optional(),
+  homepage: s.string().optional(),
+  repository: s.union(s.string(), s.object({ type: s.string().optional(), url: s.string() })).optional(),
+  license: s.string().optional(),
+  icon: s.string().optional(),
+  /** Entry executed in the Electron main process. */
+  main: s.string().optional(),
+  /** Entry executed in the preload context (sandbox-compatible, no Node). */
+  preload: s.string().optional(),
+  /** ESM entry loaded by the renderer. */
+  renderer: s.string().optional(),
+  styles: s.array(s.string()).optional(),
+  tailwind: s.object({
+    /** Globs (relative to the plugin root) scanned by Tailwind so utility classes are never purged. */
+    content: s.array(s.string()).optional(),
+    safelist: s.array(s.string()).optional(),
+    /** Path of a pre-compiled CSS file produced by the plugin's own Tailwind build. */
+    precompiled: s.string().optional()
+  }).optional(),
+  activationEvents: s.array(s.string({ pattern: ACTIVATION_RE })).default([]),
+  deactivationEvents: s.array(s.string()).default([]),
+  permissions: s.array(permissionSchema).default([]),
+  dependencies: s.record(versionRange).default({}),
+  optionalDependencies: s.record(versionRange).default({}),
+  peerDependencies: s.record(versionRange).default({}),
+  engines: s.record(versionRange).default({}),
+  /** Static, declarative metadata mirrored by the code-level registrations (lets the host display plugins without activating them). */
+  contributes: s.object({
+    routes: s.array(s.object({ path: s.string(), title: s.string().optional(), icon: s.string().optional(), permission: permissionSchema.optional() })).optional(),
+    commands: s.array(s.object({ id: s.string(), title: s.string(), category: s.string().optional() })).optional(),
+    menus: s.array(s.object({ location: s.enum(menuLocations), id: s.string(), label: s.string(), command: s.string().optional() })).optional(),
+    services: s.array(s.string()).optional(),
+    ipc: s.array(s.string()).optional(),
+    hooks: s.array(s.string()).optional(),
+    slots: s.array(s.string()).optional(),
+    configuration: s.unknown().optional()
+  }).default({}),
+  /** Optional integrity hash (sha256-<hex>) of the main bundle. Verified before load when present. */
+  integrity: s.record(s.string({ pattern: /^sha256-[0-9a-f]{64}$/ })).optional(),
+  signature: s.object({ algorithm: s.literal("ed25519"), publicKey: s.string(), value: s.string() }).optional()
+});
+function validateManifest(raw, opts = {}) {
+  const r = manifestSchema.parse(raw);
+  if (!r.ok) return { ok: false, issues: r.issues, warnings: [] };
+  const manifest = r.value;
+  const issues = [];
+  const warnings = [];
+  const fw = opts.frameworkVersion ?? FRAMEWORK_VERSION;
+  const required = manifest.engines?.[FRAMEWORK_ENGINE_KEY];
+  if (required && !satisfies(fw, required)) {
+    issues.push({ path: `engines.${FRAMEWORK_ENGINE_KEY}`, message: `requires framework ${required}, running ${fw}` });
+  }
+  if (!manifest.main && !manifest.renderer && !manifest.preload) {
+    issues.push({ path: "", message: "at least one of main, preload or renderer entry is required" });
+  }
+  if (!required) warnings.push(`engines.${FRAMEWORK_ENGINE_KEY} is not declared; compatibility cannot be verified`);
+  for (const dep of Object.keys(manifest.dependencies ?? {})) {
+    if (dep === manifest.id) issues.push({ path: `dependencies.${dep}`, message: "a plugin cannot depend on itself" });
+  }
+  return { ok: issues.length === 0, manifest: issues.length ? void 0 : manifest, issues, warnings };
+}
+
+// src/main/security.ts
+import crypto from "node:crypto";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+var IntegrityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IntegrityError";
+  }
+};
+var sha256File = async (file) => "sha256-" + crypto.createHash("sha256").update(await fs.readFile(file)).digest("hex");
+function canonicalJson(v) {
+  if (Array.isArray(v)) return `[${v.map(canonicalJson).join(",")}]`;
+  if (v && typeof v === "object") {
+    const o = v;
+    return `{${Object.keys(o).filter((k) => o[k] !== void 0).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(v);
+}
+function resolveInside(root, rel) {
+  const abs = path.resolve(root, rel);
+  if (abs !== root && !abs.startsWith(path.resolve(root) + path.sep)) throw new IntegrityError(`path escapes plugin directory: ${rel}`);
+  return abs;
+}
+async function computeIntegrity(root, manifest) {
+  const files = [manifest.main, manifest.preload, manifest.renderer, ...manifest.styles ?? []].filter((f) => !!f);
+  const out = {};
+  for (const f of files) {
+    const rel = f.replace(/^\.\//, "");
+    try {
+      out[rel] = await sha256File(resolveInside(root, rel));
+    } catch {
+    }
+  }
+  return out;
+}
+function generateSigningKeyPair() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  return {
+    publicKey: publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+    privateKey: privateKey.export({ type: "pkcs8", format: "der" }).toString("base64")
+  };
+}
+var signedPayload = (m) => {
+  const { signature: _s, ...rest } = m;
+  return canonicalJson(rest);
+};
+function signManifest(manifest, privateKeyB64) {
+  const key = crypto.createPrivateKey({ key: Buffer.from(privateKeyB64, "base64"), format: "der", type: "pkcs8" });
+  const pub = crypto.createPublicKey(key).export({ type: "spki", format: "der" }).toString("base64");
+  const value = crypto.sign(null, Buffer.from(signedPayload(manifest)), key).toString("base64");
+  return { ...manifest, signature: { algorithm: "ed25519", publicKey: pub, value } };
+}
+async function verifyPlugin(root, raw, manifest, opts = {}) {
+  const warnings = [];
+  if (opts.verifyIntegrity !== false && manifest.integrity) {
+    for (const [rel, expected] of Object.entries(manifest.integrity)) {
+      let actual;
+      try {
+        actual = await sha256File(resolveInside(root, rel));
+      } catch {
+        throw new IntegrityError(`integrity: file "${rel}" is missing`);
+      }
+      if (actual !== expected) throw new IntegrityError(`integrity: "${rel}" does not match its recorded hash (file was modified)`);
+    }
+  } else if (opts.verifyIntegrity !== false && opts.requireSignature) {
+    throw new IntegrityError("integrity hashes are required but missing");
+  }
+  const sig = manifest.signature;
+  if (sig) {
+    let ok2 = false;
+    try {
+      const pub = crypto.createPublicKey({ key: Buffer.from(sig.publicKey, "base64"), format: "der", type: "spki" });
+      ok2 = crypto.verify(null, Buffer.from(signedPayload(raw)), pub, Buffer.from(sig.value, "base64"));
+    } catch {
+      ok2 = false;
+    }
+    if (!ok2) throw new IntegrityError("signature is invalid");
+    if (opts.trustedKeys && !opts.trustedKeys.includes(sig.publicKey)) {
+      if (opts.requireSignature) throw new IntegrityError("signed by an untrusted key");
+      warnings.push("signed by an untrusted key");
+    }
+  } else if (opts.requireSignature) {
+    throw new IntegrityError("plugin is not signed");
+  }
+  return warnings;
+}
+
+// src/main/discover.ts
+var MANIFEST_FILE = "plugin.json";
+
+// src/main/fs-storage.ts
+import { promises as fs2 } from "node:fs";
+import path2 from "node:path";
+async function atomicWrite(file, data) {
+  await fs2.mkdir(path2.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  await fs2.writeFile(tmp, data, "utf8");
+  await fs2.rename(tmp, file);
+}
+var JsonStateFile = class {
+  constructor(file) {
+    this.file = file;
+  }
+  file;
+  queue = Promise.resolve();
+  async readAll() {
+    try {
+      const j = JSON.parse(await fs2.readFile(this.file, "utf8"));
+      return { disabled: Array.isArray(j.disabled) ? j.disabled : [], approved: j.approved && typeof j.approved === "object" ? j.approved : {} };
+    } catch {
+      return { disabled: [], approved: {} };
+    }
+  }
+  /** Merges `patch(current)` into the file. Concurrent calls run one after the other. */
+  update(patch) {
+    const run2 = this.queue.then(async () => {
+      const cur = await this.readAll();
+      const p = typeof patch === "function" ? patch(cur) : patch;
+      await atomicWrite(this.file, JSON.stringify({ ...cur, ...p }, null, 2));
+    });
+    this.queue = run2.catch(() => void 0);
+    return run2;
+  }
+  /** Resolves once every queued write has hit the disk. */
+  async flush() {
+    await this.queue;
+  }
+};
+
+// src/main/registry.ts
+import { promises as fs4 } from "node:fs";
+import path4 from "node:path";
+
+// src/main/tar.ts
+import { promises as fs3 } from "node:fs";
+import path3 from "node:path";
+import zlib from "node:zlib";
+import { promisify } from "node:util";
+var gzip = promisify(zlib.gzip);
+var gunzip = promisify(zlib.gunzip);
+var BLOCK = 512;
+function header(name, size, mode, type) {
+  const h = Buffer.alloc(BLOCK);
+  if (Buffer.byteLength(name) > 100) throw new Error(`path too long for tar: ${name}`);
+  h.write(name, 0, "utf8");
+  h.write(mode.toString(8).padStart(7, "0") + "\0", 100);
+  h.write("0000000\0", 108);
+  h.write("0000000\0", 116);
+  h.write(size.toString(8).padStart(11, "0") + "\0", 124);
+  h.write("00000000000\0", 136);
+  h.write("        ", 148);
+  h.write(type, 156);
+  h.write("ustar\0", 257);
+  h.write("00", 263);
+  let sum = 0;
+  for (const b of h) sum += b;
+  h.write(sum.toString(8).padStart(6, "0") + "\0 ", 148);
+  return h;
+}
+async function walk(dir, base = "") {
+  const out = [];
+  for (const e of (await fs3.readdir(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+    if (e.name === "node_modules" || e.name === ".git") continue;
+    const abs = path3.join(dir, e.name);
+    const rel = base ? `${base}/${e.name}` : e.name;
+    if (e.isDirectory()) {
+      out.push({ rel, abs, dir: true });
+      out.push(...await walk(abs, rel));
+    } else if (e.isFile()) out.push({ rel, abs, dir: false });
+  }
+  return out;
+}
+async function createTarGz(dir, prefix = "package") {
+  const chunks = [];
+  for (const f of await walk(dir)) {
+    const name = `${prefix}/${f.rel}${f.dir ? "/" : ""}`;
+    if (f.dir) chunks.push(header(name, 0, 493, "5"));
+    else {
+      const data = await fs3.readFile(f.abs);
+      chunks.push(header(name, data.length, 420, "0"), data, Buffer.alloc((BLOCK - data.length % BLOCK) % BLOCK));
+    }
+  }
+  chunks.push(Buffer.alloc(BLOCK * 2));
+  return gzip(Buffer.concat(chunks));
+}
+async function readTarGz(buf) {
+  const tar = await gunzip(buf);
+  const entries = [];
+  let off = 0;
+  while (off + BLOCK <= tar.length) {
+    const h = tar.subarray(off, off + BLOCK);
+    if (h.every((b) => b === 0)) break;
+    const name = h.toString("utf8", 0, 100).replace(/\0.*$/, "");
+    const size = parseInt(h.toString("utf8", 124, 135).replace(/\0.*$/, "").trim() || "0", 8);
+    const type = String.fromCharCode(h[156] ?? 48);
+    off += BLOCK;
+    if (type === "0" || type === "\0") entries.push({ name, type: "file", data: Buffer.from(tar.subarray(off, off + size)) });
+    else if (type === "5") entries.push({ name, type: "dir", data: Buffer.alloc(0) });
+    off += Math.ceil(size / BLOCK) * BLOCK;
+  }
+  return entries;
+}
+async function extractTarGz(buf, dest) {
+  const root = path3.resolve(dest);
+  await fs3.mkdir(root, { recursive: true });
+  for (const e of await readTarGz(buf)) {
+    const parts = e.name.split("/").filter(Boolean);
+    parts.shift();
+    if (!parts.length) continue;
+    if (parts.some((p) => p === ".." || p.includes("\0")) || path3.isAbsolute(e.name)) throw new Error(`unsafe path in archive: ${e.name}`);
+    const target = path3.resolve(root, ...parts);
+    if (target !== root && !target.startsWith(root + path3.sep)) throw new Error(`unsafe path in archive: ${e.name}`);
+    if (e.type === "dir") await fs3.mkdir(target, { recursive: true });
+    else {
+      await fs3.mkdir(path3.dirname(target), { recursive: true });
+      await fs3.writeFile(target, e.data);
+    }
+  }
+}
+
+// src/main/registry.ts
+async function readManifest(dir) {
+  const raw = JSON.parse(await fs4.readFile(path4.join(dir, MANIFEST_FILE), "utf8"));
+  const v = validateManifest(raw);
+  if (!v.manifest) throw new Error(`invalid manifest: ${v.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+  return { raw, manifest: v.manifest };
+}
+var toEntry = (m, location, source, sha256) => ({
+  id: m.id,
+  name: m.name,
+  version: m.version,
+  description: m.description,
+  author: typeof m.author === "string" ? m.author : m.author?.name,
+  permissions: m.permissions ?? [],
+  location,
+  source,
+  sha256
+});
+async function copyDir(src, dest) {
+  await fs4.mkdir(dest, { recursive: true });
+  for (const e of await fs4.readdir(src, { withFileTypes: true })) {
+    if (e.name === "node_modules" || e.name === ".git") continue;
+    const s2 = path4.join(src, e.name);
+    const d = path4.join(dest, e.name);
+    if (e.isDirectory()) await copyDir(s2, d);
+    else if (e.isFile()) await fs4.copyFile(s2, d);
+  }
+}
+var LocalRegistry = class {
+  constructor(dir, name = `local:${dir}`) {
+    this.dir = dir;
+    this.name = name;
+  }
+  dir;
+  name;
+  async search(query = "") {
+    const q = query.toLowerCase();
+    const out = [];
+    let names = [];
+    try {
+      names = await fs4.readdir(this.dir);
+    } catch {
+      return [];
+    }
+    for (const n of names.sort()) {
+      const root = path4.join(this.dir, n);
+      try {
+        const { manifest } = await readManifest(root);
+        if (!q || `${manifest.id} ${manifest.name} ${manifest.description ?? ""}`.toLowerCase().includes(q)) out.push(toEntry(manifest, root, this.name));
+      } catch {
+      }
+    }
+    return out;
+  }
+  async fetch(entry, dest) {
+    await copyDir(entry.location, dest);
+    return (await readManifest(dest)).manifest;
+  }
+};
+var PluginInstaller = class {
+  constructor(pluginsDir, backupDir, registries = []) {
+    this.pluginsDir = pluginsDir;
+    this.backupDir = backupDir;
+    this.registries = registries;
+  }
+  pluginsDir;
+  backupDir;
+  registries;
+  addRegistry(r) {
+    this.registries.push(r);
+  }
+  async search(query) {
+    const all = await Promise.allSettled(this.registries.map((r) => r.search(query)));
+    return all.flatMap((r) => r.status === "fulfilled" ? r.value : []);
+  }
+  async installed() {
+    const out = [];
+    for (const n of await fs4.readdir(this.pluginsDir).catch(() => [])) {
+      try {
+        out.push((await readManifest(path4.join(this.pluginsDir, n))).manifest);
+      } catch {
+      }
+    }
+    return out;
+  }
+  dirOf(id) {
+    return path4.join(this.pluginsDir, id.replace(/[^a-z0-9.-]/gi, "_"));
+  }
+  /** Installs (or updates) `entry`. The plugin directory is replaced atomically from a staging directory. */
+  async install(entry) {
+    const registry = this.registries.find((r) => r.name === entry.source);
+    if (!registry) throw new Error(`unknown registry "${entry.source}"`);
+    const stage = path4.join(this.backupDir, ".staging", `${entry.id}-${Date.now()}`);
+    await fs4.mkdir(path4.dirname(stage), { recursive: true });
+    try {
+      const manifest = await registry.fetch(entry, stage);
+      if (manifest.id !== entry.id) throw new Error(`registry entry "${entry.id}" contains plugin "${manifest.id}"`);
+      const target = this.dirOf(entry.id);
+      let previousVersion;
+      try {
+        previousVersion = (await readManifest(target)).manifest.version;
+        const bk = path4.join(this.backupDir, entry.id, previousVersion);
+        await fs4.rm(bk, { recursive: true, force: true });
+        await fs4.mkdir(path4.dirname(bk), { recursive: true });
+        await fs4.rename(target, bk);
+      } catch (e) {
+        if (e.code && e.code !== "ENOENT") throw e;
+      }
+      await fs4.mkdir(path4.dirname(target), { recursive: true });
+      await fs4.rename(stage, target);
+      return { id: entry.id, version: manifest.version, previousVersion };
+    } finally {
+      await fs4.rm(stage, { recursive: true, force: true });
+    }
+  }
+  /** Removes the plugin directory (backups are kept so the user can still roll back/reinstall). */
+  async uninstall(id) {
+    const dir = this.dirOf(id);
+    const { manifest } = await readManifest(dir);
+    const bk = path4.join(this.backupDir, id, manifest.version);
+    await fs4.rm(bk, { recursive: true, force: true });
+    await fs4.mkdir(path4.dirname(bk), { recursive: true });
+    await fs4.rename(dir, bk);
+  }
+  async versions(id) {
+    const names = await fs4.readdir(path4.join(this.backupDir, id)).catch(() => []);
+    return names.sort(compareVersions);
+  }
+  /** Restores the newest backup (or `version`) and keeps the replaced version as a backup. */
+  async rollback(id, version) {
+    const versions = await this.versions(id);
+    const target = version ?? versions[versions.length - 1];
+    if (!target || !versions.includes(target)) throw new Error(`no backup available for "${id}"${version ? ` @ ${version}` : ""}`);
+    const dir = this.dirOf(id);
+    let current;
+    try {
+      current = (await readManifest(dir)).manifest.version;
+      const bk = path4.join(this.backupDir, id, current);
+      await fs4.rm(bk, { recursive: true, force: true });
+      await fs4.rename(dir, bk);
+    } catch (e) {
+      if (e.code && e.code !== "ENOENT") throw e;
+    }
+    await fs4.rename(path4.join(this.backupDir, id, target), dir);
+    return { id, version: target, previousVersion: current };
+  }
+  /** Entries from registries that are newer than what is installed. */
+  async updates() {
+    const installed = new Map((await this.installed()).map((m) => [m.id, m.version]));
+    return (await this.search()).filter((e) => installed.has(e.id) && compareVersions(e.version, installed.get(e.id)) > 0);
+  }
+};
+
+// src/cli/build.ts
+import { promises as fs5 } from "node:fs";
+import path6 from "node:path";
+import { build, context } from "esbuild";
+
+// src/cli/shared-modules.ts
+import path5 from "node:path";
+var SHARED_MODULES = ["react", "react/jsx-runtime", "react/jsx-dev-runtime", "react-dom", "react-dom/client", "fluxplugin", "fluxplugin/react", "fluxplugin/manager-ui"];
+function sharedModulesPlugin(shared = SHARED_MODULES) {
+  const set = new Set(shared);
+  return {
+    name: "flux-shared-modules",
+    setup(b) {
+      b.onResolve({ filter: /.*/ }, (args) => {
+        if (set.has(args.path)) return { path: args.path, namespace: "flux-shared" };
+        return void 0;
+      });
+      b.onLoad({ filter: /.*/, namespace: "flux-shared" }, (args) => ({
+        contents: `const m = globalThis.__FLUXPLUGIN_SHARED__ && globalThis.__FLUXPLUGIN_SHARED__[${JSON.stringify(args.path)}];
+if (!m) throw new Error("Shared module ${args.path} is not provided by the host application (see installSharedModules).");
+module.exports = m;`,
+        loader: "js",
+        resolveDir: path5.resolve(".")
+      }));
+    }
+  };
+}
+
+// src/cli/build.ts
+var exists = (f) => fs5.access(f).then(() => true, () => false);
+async function firstExisting(root, names) {
+  for (const n of names) if (await exists(path6.join(root, n))) return path6.join(root, n);
+}
+async function buildOptions(root) {
+  const raw = JSON.parse(await fs5.readFile(path6.join(root, "plugin.json"), "utf8"));
+  const m = validateManifest(raw).manifest;
+  if (!m) throw new Error("invalid plugin.json (run `fluxplugin validate`)");
+  const out = [];
+  const common = { bundle: true, sourcemap: true, logLevel: "warning", plugins: [sharedModulesPlugin()], jsx: "automatic", loader: { ".module.css": "local-css" } };
+  if (m.main) {
+    const entry = await firstExisting(root, ["src/main.ts", "src/main.js"]);
+    if (!entry) throw new Error("manifest declares `main` but src/main.ts was not found");
+    out.push({ ...common, entryPoints: [entry], outfile: path6.join(root, m.main), platform: "node", format: "esm", target: "node20", external: ["node:*", "electron"] });
+  }
+  if (m.renderer) {
+    const entry = await firstExisting(root, ["src/renderer.tsx", "src/renderer.ts", "src/renderer.jsx", "src/renderer.js"]);
+    if (!entry) throw new Error("manifest declares `renderer` but src/renderer.tsx was not found");
+    out.push({ ...common, entryPoints: [entry], outfile: path6.join(root, m.renderer), platform: "browser", format: "esm", target: "chrome120" });
+  }
+  for (const css of m.styles ?? []) {
+    const entry = path6.join(root, "src/styles", path6.basename(css));
+    if (await exists(entry)) out.push({ ...common, plugins: [], entryPoints: [entry], outfile: path6.join(root, css) });
+  }
+  return out;
+}
+async function buildPlugin(root, watch = false, log2 = console.log) {
+  const opts = await buildOptions(root);
+  if (!watch) {
+    for (const o of opts) await build(o);
+    log2(`built ${opts.length} bundle(s) in ${root}`);
+    return async () => {
+    };
+  }
+  const ctxs = await Promise.all(opts.map((o) => context(o)));
+  await Promise.all(ctxs.map((c) => c.watch()));
+  log2(`watching ${root} (${ctxs.length} bundles)`);
+  return async () => void await Promise.all(ctxs.map((c) => c.dispose()));
+}
+
+// src/cli/host.ts
+import { spawn } from "node:child_process";
+import { promises as fs7 } from "node:fs";
+import { createRequire } from "node:module";
+import path8 from "node:path";
+import { build as build2, context as context2 } from "esbuild";
+
+// src/cli/config.ts
+import { promises as fs6 } from "node:fs";
+import path7 from "node:path";
+async function loadConfig(flags, cwd = process.cwd()) {
+  let file = {};
+  try {
+    file = JSON.parse(await fs6.readFile(path7.join(cwd, "fluxplugin.config.json"), "utf8"));
+  } catch {
+  }
+  return {
+    pluginsDir: path7.resolve(cwd, flags.dir ?? file.pluginsDir ?? "plugins"),
+    dataDir: path7.resolve(cwd, flags.data ?? file.dataDir ?? ".flux-data")
+  };
+}
+
+// src/cli/host.ts
+var exists2 = (f) => fs7.access(f).then(() => true, () => false);
+async function isHostProject(cwd) {
+  return await exists2(path8.join(cwd, "fluxplugin.config.json")) || await exists2(path8.join(cwd, "src/renderer.tsx")) && await exists2(path8.join(cwd, "src/framework.ts"));
+}
+var nodeBanner = { js: "import { createRequire as __r } from 'node:module'; const require = __r(import.meta.url);" };
+function hostBuilds(cwd, outDir, dev) {
+  const common = { absWorkingDir: cwd, bundle: true, sourcemap: dev, logLevel: "warning", jsx: "automatic", define: { "process.env.NODE_ENV": JSON.stringify(dev ? "development" : "production") } };
+  const entry = (f) => path8.join(cwd, "src", f);
+  return [
+    { ...common, entryPoints: [entry("renderer.tsx")], outfile: path8.join(outDir, "renderer.js"), platform: "browser", format: "esm", target: "chrome120" },
+    { ...common, entryPoints: [entry("main.ts")], outfile: path8.join(outDir, "main.cjs"), platform: "node", format: "cjs", target: "node20", external: ["electron"] },
+    { ...common, entryPoints: [entry("preload.ts")], outfile: path8.join(outDir, "preload.cjs"), platform: "node", format: "cjs", target: "node20", external: ["electron"] },
+    { ...common, entryPoints: [entry("web.ts")], outfile: path8.join(outDir, "web.mjs"), platform: "node", format: "esm", target: "node20", external: ["electron"], banner: nodeBanner }
+  ];
+}
+async function pluginDirs(cwd, pluginsDir) {
+  const names = await fs7.readdir(pluginsDir).catch(() => []);
+  const out = [];
+  for (const n of names.sort()) if (await exists2(path8.join(pluginsDir, n, "plugin.json"))) out.push(path8.join(pluginsDir, n));
+  void cwd;
+  return out;
+}
+async function buildHost(cwd, opts = {}) {
+  const log2 = opts.log ?? console.log;
+  const cfgFile = JSON.parse(await fs7.readFile(path8.join(cwd, "fluxplugin.config.json"), "utf8").catch(() => "{}"));
+  const cfg = await loadConfig({}, cwd);
+  const outDir = path8.resolve(cwd, cfgFile.outDir ?? "dist");
+  await fs7.mkdir(outDir, { recursive: true });
+  await fs7.copyFile(path8.join(cwd, "src/index.html"), path8.join(outDir, "index.html"));
+  const disposers = [];
+  const opts2 = hostBuilds(cwd, outDir, !!opts.watch);
+  if (opts.watch) {
+    const ctxs = await Promise.all(opts2.map((o) => context2(o)));
+    await Promise.all(ctxs.map((c) => c.watch()));
+    disposers.push(async () => void await Promise.all(ctxs.map((c) => c.dispose())));
+  } else for (const o of opts2) await build2(o);
+  for (const dir of await pluginDirs(cwd, cfg.pluginsDir)) {
+    try {
+      disposers.push(await buildPlugin(dir, !!opts.watch, log2));
+    } catch (e) {
+      log2(`! plugin ${path8.basename(dir)} not built: ${e.message}`);
+    }
+  }
+  log2(`host built \u2192 ${path8.relative(cwd, outDir) || "."}`);
+  return async () => void await Promise.all(disposers.map((d) => d()));
+}
+function electronBinary(cwd) {
+  try {
+    const p = createRequire(path8.join(cwd, "package.json"))("electron");
+    return typeof p === "string" ? p : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function startApp(cwd, opts = {}) {
+  const bin = opts.web ? void 0 : electronBinary(cwd);
+  const env = { ...process.env, FLUXPLUGIN_PROJECT: cwd, ...opts.dev ? { FLUXPLUGIN_DEV: "1" } : {}, ...opts.port ? { PORT: String(opts.port) } : {} };
+  if (bin) return { child: spawn(bin, [path8.join(cwd, "dist/main.cjs")], { cwd, env, stdio: "inherit" }), mode: "electron" };
+  return { child: spawn(process.execPath, [path8.join(cwd, "dist/web.mjs")], { cwd, env, stdio: "inherit" }), mode: "web" };
+}
+
+// src/cli/templates.ts
+var pkg = (v) => JSON.stringify(
+  {
+    name: v.id,
+    version: "1.0.0",
+    private: true,
+    type: "module",
+    scripts: { dev: "fluxplugin dev", build: "fluxplugin build", package: "fluxplugin package", validate: "fluxplugin validate" },
+    devDependencies: { fluxplugin: "^1.0.0", "@types/react": "^19.0.0", react: "^19.0.0", typescript: "^5.6.0" }
+  },
+  null,
+  2
+);
+var tsconfig = `{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "lib": ["ES2022", "DOM"]
+  },
+  "include": ["src"]
+}
+`;
+var styles = (v) => `/* Styles are loaded when the plugin activates and removed when it is disabled. */
+.${v.slug}-card {
+  border: 1px solid var(--flux-border, #e2e8f0);
+  border-radius: 12px;
+  padding: 16px;
+}
+`;
+function basic(v) {
+  return {
+    "plugin.json": JSON.stringify(
+      {
+        id: v.id,
+        name: v.name,
+        version: "1.0.0",
+        description: `${v.name} plugin`,
+        author: "Your name",
+        main: "./dist/main.mjs",
+        renderer: "./dist/renderer.js",
+        styles: ["./dist/index.css"],
+        activationEvents: [`onCommand:${v.slug}.hello`],
+        permissions: ["commands", "routes", "menus", "ui", "styles", "events"],
+        engines: { "fluxplugin": "^1.0.0" },
+        contributes: { commands: [{ id: `${v.slug}.hello`, title: `${v.name}: Say hello` }] }
+      },
+      null,
+      2
+    ),
+    "package.json": pkg(v),
+    "tsconfig.json": tsconfig,
+    "src/main.ts": `import { definePlugin } from "fluxplugin";
+
+export default definePlugin({
+  onActivate(ctx) {
+    ctx.logger.info("${v.name} (main) activated");
+  },
+});
+`,
+    "src/renderer.tsx": `import { definePlugin } from "fluxplugin";
+
+function ${v.Pascal}Page() {
+  return (
+    <div className="${v.slug}-card">
+      <h1>${v.name}</h1>
+      <p>Your first plugin page. Edit <code>src/renderer.tsx</code> and save.</p>
+    </div>
+  );
+}
+
+export default definePlugin({
+  routes: [
+    {
+      path: "/${v.slug}",
+      component: ${v.Pascal}Page,
+      meta: { title: "${v.name}", menu: { label: "${v.name}" } },
+    },
+  ],
+  commands: [
+    {
+      id: "${v.slug}.hello",
+      title: "${v.name}: Say hello",
+      execute: () => console.log("Hello from ${v.name}!"),
+    },
+  ],
+});
+`,
+    "src/styles/index.css": styles(v),
+    "README.md": `# ${v.name}
+
+Created with \`fluxplugin create\`.
+
+\`\`\`bash
+pnpm install
+pnpm dev       # rebuild on change (the host hot-reloads it)
+pnpm build
+pnpm package   # produces ${v.id}-1.0.0.tgz
+\`\`\`
+`
+  };
+}
+function dashboard(v) {
+  const files = basic(v);
+  const m = JSON.parse(files["plugin.json"]);
+  m.activationEvents = ["onStartup"];
+  m.contributes = {};
+  m.permissions = ["commands", "routes", "menus", "ui", "styles"];
+  files["plugin.json"] = JSON.stringify(m, null, 2);
+  files["src/renderer.tsx"] = `import { definePlugin } from "fluxplugin";
+import { usePluginState } from "fluxplugin/react";
+
+function ${v.Pascal}Widget() {
+  const [n, setN] = usePluginState("${v.id}", "clicks", 0);
+  return (
+    <div className="${v.slug}-card" data-testid="${v.slug}-widget">
+      <strong>${v.name}</strong>
+      <p>A widget injected into the host's <code>dashboard.after</code> slot.</p>
+      <button onClick={() => setN((c) => c + 1)}>Clicked {n} times</button>
+    </div>
+  );
+}
+
+function ${v.Pascal}Page() {
+  return <div className="${v.slug}-card"><h1>${v.name}</h1><p>Registered at runtime by a plugin.</p></div>;
+}
+
+export default definePlugin({
+  routes: [{ path: "/${v.slug}", lazy: async () => ({ default: ${v.Pascal}Page }), meta: { title: "${v.name}", breadcrumb: "${v.name}", menu: { label: "${v.name}" } } }],
+  components: [{ slot: "dashboard.after", component: ${v.Pascal}Widget, priority: 10 }],
+  // Data contribution to the host's "dashboard" extension point (validated by the host's schema).
+  extensions: [{ point: "dashboard", contribution: { toolbar: [{ id: "${v.slug}-hello", label: "${v.name}: hello", command: "${v.slug}.hello" }] } }],
+  commands: [{ id: "${v.slug}.hello", title: "${v.name}: say hello", category: "${v.name}", execute: () => console.log("Hello from ${v.name}!") }],
+});
+`;
+  return files;
+}
+function backend(v) {
+  const files = basic(v);
+  const m = JSON.parse(files["plugin.json"]);
+  m.activationEvents = [];
+  m.permissions = ["ipc", "services", "events", "commands", "routes", "menus", "ui", "styles", "storage"];
+  m.contributes = {};
+  files["plugin.json"] = JSON.stringify(m, null, 2);
+  files["src/main.ts"] = `import { definePlugin, defineIPC, s } from "fluxplugin";
+
+const Input = s.object({ name: s.string({ min: 1 }) });
+const Output = s.object({ message: s.string(), at: s.number() });
+
+export const hello = defineIPC({
+  name: "${v.slug}.hello",
+  input: Input,
+  output: Output,
+  handler: async ({ name }, ctx) => ({ message: \`Hello \${name} from \${ctx.pluginId}\`, at: Date.now() }),
+});
+
+export default definePlugin({
+  ipc: [hello],
+  // Exposed to the renderer as window.plugins.${v.slug}.hello(...)
+  preload: { ${v.slug}: { hello: "${v.slug}.hello" } },
+  services: { "${v.slug}": { now: () => Date.now() } },
+});
+`;
+  files["src/renderer.tsx"] = `import { definePlugin } from "fluxplugin";
+import { usePluginIPC } from "fluxplugin/react";
+
+function ${v.Pascal}Page() {
+  const { data, call, loading, error } = usePluginIPC<{ name: string }, { message: string }>("${v.slug}.hello", { caller: "${v.id}" });
+  return (
+    <div className="${v.slug}-card">
+      <button disabled={loading} onClick={() => void call({ name: "world" })}>Call main process</button>
+      {data && <p>{data.message}</p>}
+      {error && <p role="alert">{error.message}</p>}
+    </div>
+  );
+}
+
+export default definePlugin({
+  routes: [{ path: "/${v.slug}", component: ${v.Pascal}Page, meta: { title: "${v.name}", menu: { label: "${v.name}" } } }],
+});
+`;
+  return files;
+}
+var TEMPLATES = { basic, dashboard, backend };
+function varsFromName(name) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "my-plugin";
+  const id = slug.includes(".") ? slug : `com.example.${slug}`;
+  const short = slug.split(".").pop();
+  const Pascal = short.split(/[^a-z0-9]+/i).filter(Boolean).map((p) => p[0].toUpperCase() + p.slice(1)).join("");
+  return { id, name: short.split("-").map((p) => p[0].toUpperCase() + p.slice(1)).join(" "), slug: short.replace(/-/g, "_"), Pascal };
+}
+
+// src/cli/host-templates.ts
+function hostFiles(v, withSample = true) {
+  const files = {
+    "package.json": JSON.stringify(
+      {
+        name: v.name,
+        version: "0.1.0",
+        private: true,
+        type: "module",
+        main: "dist/main.cjs",
+        scripts: {
+          dev: "fluxplugin dev",
+          "dev:web": "fluxplugin dev --web",
+          build: "fluxplugin build",
+          start: "fluxplugin start",
+          "plugin:new": "fluxplugin plugin new",
+          typecheck: "tsc --noEmit"
+        },
+        dependencies: { fluxplugin: v.fluxSpec, react: "^19.0.0", "react-dom": "^19.0.0" },
+        devDependencies: { electron: "^33.0.0", typescript: "~5.9.3", "@types/node": "^22.10.0", "@types/react": "^19.0.0", "@types/react-dom": "^19.0.0" }
+      },
+      null,
+      2
+    ),
+    "fluxplugin.config.json": JSON.stringify({ pluginsDir: "plugins", outDir: "dist" }, null, 2),
+    "tsconfig.json": JSON.stringify(
+      { compilerOptions: { target: "ES2022", module: "ESNext", moduleResolution: "Bundler", jsx: "react-jsx", strict: true, noEmit: true, skipLibCheck: true, lib: ["ES2022", "DOM", "DOM.Iterable"], types: ["node"] }, include: ["src"] },
+      null,
+      2
+    ),
+    ".gitignore": "node_modules\ndist\n.flux-data\n*.tgz\n",
+    "src/index.html": `<!doctype html>
+<html><head><meta charset="utf-8"><title>${v.name}</title>
+<meta http-equiv="Content-Security-Policy" content="default-src 'self' fluxplugin:; script-src 'self' fluxplugin:; style-src 'self' 'unsafe-inline' fluxplugin:; connect-src 'self'; img-src 'self' data:">
+<style>body{margin:0;font:14px system-ui}</style></head>
+<body><div id="root"></div><script type="module" src="./renderer.js"></script></body></html>
+`,
+    "src/framework.ts": `import { MainFramework } from "fluxplugin/main";
+import { s } from "fluxplugin";
+
+/** Shared by Electron (main.ts) and browser mode (web.ts). Put host-side setup here. */
+export function createFramework(opts: { pluginDirs: string[]; dataDir: string; dev?: boolean; assetUrl?: (id: string, rel: string) => string }) {
+  const fw = new MainFramework({
+    pluginDirs: opts.pluginDirs,
+    dataDir: opts.dataDir,
+    hotReload: opts.dev,
+    assetUrl: opts.assetUrl,
+    requireApproval: false, // set true to make users approve each plugin's permissions
+    allowedRendererChannels: ["host.item.create"],
+  });
+
+  // A host operation wrapped in the hook pipeline: plugins can validate, normalize or veto it
+  // (before./transform./after.item.create) without changing this file.
+  fw.manager.ipc.handle(
+    "host.item.create",
+    (input: { name: string }) =>
+      fw.manager.hooks.run("item.create", input, (i) => {
+        const item = { id: Math.random().toString(36).slice(2, 8), name: i.name };
+        fw.manager.events.emit("item.created", item, "host");
+        return item as Record<string, unknown>;
+      }),
+    "host",
+    { input: s.object({ name: s.string() }) },
+  );
+  return fw;
+}
+`,
+    "src/main.ts": `// Electron main process.
+import { app, BrowserWindow, ipcMain, protocol, webContents } from "electron";
+import path from "node:path";
+import { PLUGIN_SCHEME, attachElectron, registerPluginProtocol } from "fluxplugin/main";
+import { createFramework } from "./framework.js";
+
+protocol.registerSchemesAsPrivileged([PLUGIN_SCHEME]); // must run before app is ready
+
+app.whenReady().then(async () => {
+  const dev = !!process.env["FLUXPLUGIN_DEV"];
+  const root = process.env["FLUXPLUGIN_PROJECT"] ?? path.resolve(__dirname, "..");
+  const fw = createFramework({
+    pluginDirs: [path.join(root, "plugins"), path.join(app.getPath("userData"), "plugins")], // bundled + user-installed
+    dataDir: path.join(app.getPath("userData"), "plugins-data"),
+    dev,
+  });
+  registerPluginProtocol(fw, protocol);
+  attachElectron(fw, { ipcMain: ipcMain as never, webContents: webContents as never });
+  await fw.start();
+
+  const win = new BrowserWindow({
+    width: 1100,
+    height: 760,
+    webPreferences: { preload: path.join(__dirname, "preload.cjs"), contextIsolation: true, sandbox: true, nodeIntegration: false },
+  });
+  win.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
+  win.webContents.on("will-navigate", (e) => e.preventDefault());
+  await win.loadFile(path.join(__dirname, "index.html"));
+  app.on("before-quit", () => void fw.stop());
+});
+app.on("window-all-closed", () => app.quit());
+`,
+    "src/preload.ts": `import { contextBridge, ipcRenderer } from "electron";
+import { exposeFluxBridge } from "fluxplugin/preload";
+
+exposeFluxBridge(contextBridge, ipcRenderer); // the only thing renderer code receives: window.__fluxplugin
+`,
+    "src/web.ts": `// Browser mode (no Electron): \`fluxplugin dev --web\`.
+import path from "node:path";
+import { serveWeb } from "fluxplugin/main";
+import { createFramework } from "./framework.js";
+
+const root = process.env["FLUXPLUGIN_PROJECT"] ?? process.cwd();
+const fw = createFramework({
+  pluginDirs: [path.join(root, "plugins")],
+  dataDir: path.join(root, ".flux-data"),
+  dev: true,
+  assetUrl: (id, rel) => \`/@plugins/\${id}/\${rel.replace(/^\\.\\//, "")}\`,
+});
+await fw.start();
+const srv = await serveWeb(fw, { distDir: path.join(root, "dist"), port: Number(process.env["PORT"] ?? 5173) });
+console.log(\`${v.name} \u2192 http://127.0.0.1:\${srv.port}\`);
+`,
+    "src/renderer.tsx": renderer(v.name),
+    "README.md": `# ${v.name}
+
+Created with [fluxplugin](https://www.npmjs.com/package/fluxplugin).
+
+\`\`\`bash
+npm install
+npm run dev:web      # in a browser, no Electron needed
+npm run dev          # in Electron (hot reload for plugins)
+npm run build && npm start
+npm run plugin:new my-plugin -- -t backend    # scaffold a plugin in ./plugins
+\`\`\`
+
+* \`src/renderer.tsx\` \u2014 your React UI. \`<PluginSlot name="\u2026"/>\` and extension points are where plugins plug in.
+* \`src/framework.ts\` \u2014 host-side setup (permissions policy, host operations exposed to plugins, hooks).
+* \`plugins/\` \u2014 plugins loaded at startup; users can also install \`.tgz\` plugins from the Plugins page.
+`
+  };
+  if (withSample) {
+    const sample = TEMPLATES.dashboard(varsFromName("hello"));
+    for (const [rel, content] of Object.entries(sample)) {
+      if (rel === "package.json" || rel === "tsconfig.json" || rel === "README.md") continue;
+      files[`plugins/hello/${rel}`] = content;
+    }
+  }
+  return files;
+}
+var renderer = (app) => `import React from "react";
+import { createRoot } from "react-dom/client";
+import * as jsxRuntime from "react/jsx-runtime";
+import * as ReactDOMClient from "react-dom/client";
+import * as flux from "fluxplugin";
+import * as fluxReact from "fluxplugin/react";
+import { s, type FluxBridge } from "fluxplugin";
+import {
+  Breadcrumbs, CommandPalette, Link, PluginProvider, PluginRoutes, PluginSlot, RendererFramework, StyleHost,
+  baseCss, createHttpBridge, installSharedModules, useExtensionItems, useKeybindings, useMenu,
+} from "fluxplugin/react";
+import { PluginManagerUI } from "fluxplugin/manager-ui";
+
+// One copy of React and of the runtime, shared with plugin bundles (they import these from globalThis).
+installSharedModules({
+  react: React, "react/jsx-runtime": jsxRuntime, "react/jsx-dev-runtime": jsxRuntime, "react-dom/client": ReactDOMClient,
+  fluxplugin: flux, "fluxplugin/react": fluxReact,
+});
+
+// Electron: the preload bridge. Browser mode: HTTP bridge to \`fluxplugin dev --web\`.
+const bridge: FluxBridge = (window as unknown as { __fluxplugin?: FluxBridge }).__fluxplugin ?? createHttpBridge();
+const framework = new RendererFramework({ bridge });
+
+// Declare extension points BEFORE plugins start. Plugins contribute validated data to them.
+framework.manager.extensionPoints.declare({
+  name: "dashboard",
+  contributions: { toolbar: s.object({ id: s.string(), label: s.string(), command: s.string().optional() }) },
+});
+
+const css = baseCss + \`
+body{background:var(--flux-bg);color:var(--flux-fg)}
+.app{display:grid;grid-template-columns:220px 1fr;min-height:100vh}
+.side{border-right:1px solid var(--flux-border);padding:16px;background:var(--flux-surface)}
+.side a{display:block;padding:7px 10px;border-radius:8px;color:inherit;text-decoration:none;margin:2px 0}
+.side a[data-active]{background:var(--flux-accent);color:#fff}.side h1{font-size:16px;margin:0 0 14px}
+.main{padding:24px;max-width:860px}.row{display:flex;gap:8px;margin:12px 0}
+.btn{border:1px solid var(--flux-border);background:var(--flux-bg);color:inherit;border-radius:8px;padding:6px 12px;cursor:pointer}
+.hint{color:var(--flux-muted);font-size:12px}\`;
+
+function Dashboard() {
+  const tools = useExtensionItems<{ id: string; label: string; command?: string }>("dashboard", "toolbar");
+  const [out, setOut] = React.useState("");
+  const create = async (name: string) => {
+    try { setOut(JSON.stringify(await bridge.invoke("host.item.create", { name }))); }
+    catch (e) { setOut("blocked: " + (e as Error).message); }
+  };
+  return (
+    <div>
+      <h2>Dashboard</h2>
+      <PluginSlot name="dashboard.before" />
+      <p className="hint">These buttons are contributed by plugins through a host-declared extension point.</p>
+      <div className="row" data-testid="toolbar">
+        {tools.map((t) => <button key={t.id} className="btn" onClick={() => t.command && void framework.manager.commands.execute(t.command)}>{t.label}</button>)}
+      </div>
+      <div className="row">
+        <button className="btn" onClick={() => void create("  Ada  ")}>Create item \u201C  Ada  \u201D (plugin hooks may rewrite it)</button>
+        <button className="btn" onClick={() => void create("   ")}>Create empty item (a plugin may veto)</button>
+      </div>
+      <pre data-testid="hook-result" className="hint">{out}</pre>
+      <PluginSlot name="dashboard.after" />
+    </div>
+  );
+}
+
+function Shell() {
+  useKeybindings();
+  const { items, run } = useMenu("sidebar");
+  return (
+    <div className="app">
+      <aside className="side">
+        <h1>${"${APP}"} <PluginSlot name="header.badges" /></h1>
+        <Link to="/">Dashboard</Link>
+        {items.map((i) => <a key={i.id} href={"#" + i.path} onClick={(e) => { e.preventDefault(); run(i); }}>{i.label}</a>)}
+        <Link to="/plugins">Plugins</Link>
+        <p className="hint">Ctrl/Cmd+K: commands</p>
+      </aside>
+      <main className="main"><Breadcrumbs /><PluginRoutes /></main>
+      <CommandPalette />
+    </div>
+  );
+}
+
+framework.manager.routes.register({ path: "/", component: Dashboard, meta: { title: "Dashboard" } }, "host");
+framework.manager.routes.register({ path: "/plugins", component: PluginManagerUI, meta: { title: "Plugins", breadcrumb: "Plugins" } }, "host");
+
+await framework.start();
+(window as unknown as Record<string, unknown>)["__framework"] = framework;
+createRoot(document.getElementById("root")!).render(
+  <PluginProvider framework={framework}><style>{css}</style><StyleHost /><Shell /></PluginProvider>,
+);
+`.replace("${APP}", app);
+
+// src/cli/cli.ts
+var HELP = `fluxplugin <command>
+
+  init [dir]                      create a new app (Electron + React) that supports plugins
+  dev [--web]                     run your app with plugin hot reload (Electron, or a browser with --web)
+  build                           bundle your app (in an app folder) or a plugin (in a plugin folder)
+  start [--web]                   run the built app
+  plugin new <name> [-t basic|dashboard|backend]   scaffold a plugin (alias: create)
+  validate [dir]                  check a plugin manifest, entries and integrity
+  package [dir] [--out d] [--sign-key file]   build + integrity (+ signature) + .tgz
+  install <dir|.tgz> [--dir plugins]   uninstall <id>   enable <id>   disable <id>   list
+  keygen [--out name]    create an ed25519 signing key pair
+  tailwind [--dir plugins] [--out file]   generate @source lines for Tailwind v4`;
+var log = (...a) => console.log(...a);
+async function readManifest2(root) {
+  return JSON.parse(await fs8.readFile(path9.join(root, "plugin.json"), "utf8"));
+}
+async function run(argv) {
+  const { values: f, positionals: pos } = parseArgs({
+    args: argv,
+    allowPositionals: true,
+    options: { template: { type: "string", short: "t" }, out: { type: "string" }, dir: { type: "string" }, data: { type: "string" }, "sign-key": { type: "string" }, help: { type: "boolean", short: "h" }, web: { type: "boolean" }, port: { type: "string" }, name: { type: "string" }, "no-sample": { type: "boolean" } }
+  });
+  let [cmd, arg] = pos;
+  if (cmd === "plugin") {
+    const sub = pos[1];
+    if (sub !== "new") throw new Error("usage: fluxplugin plugin new <name>");
+    cmd = "create";
+    arg = pos[2];
+  }
+  if (!cmd || f.help) return log(HELP), cmd ? 0 : 1;
+  const root = path9.resolve(arg ?? ".");
+  try {
+    switch (cmd) {
+      case "init": {
+        const target = path9.resolve(arg ?? ".");
+        const entries = await fs8.readdir(target).catch(() => []);
+        if (entries.length) throw new Error(`${target} is not empty`);
+        const name = (f.name ?? path9.basename(target)).toLowerCase().replace(/[^a-z0-9-_.]+/g, "-");
+        const files = hostFiles({ name, fluxSpec: process.env["FLUXPLUGIN_SPEC"] ?? `^${await ownVersion()}` }, !f["no-sample"]);
+        for (const [rel2, content] of Object.entries(files)) {
+          await fs8.mkdir(path9.dirname(path9.join(target, rel2)), { recursive: true });
+          await fs8.writeFile(path9.join(target, rel2), content);
+        }
+        const rel = path9.relative(process.cwd(), target) || ".";
+        log(`\u2714 created ${name} in ${target}
+
+Next steps:
+  ${rel === "." ? "" : `cd ${rel}
+  `}npm install
+  npm run dev:web     # browser mode (no Electron needed)
+  npm run dev         # Electron
+
+Add a plugin:  npm run plugin:new my-plugin -- -t backend`);
+        return 0;
+      }
+      case "create": {
+        if (!arg) throw new Error("usage: fluxplugin plugin new <name> [-t basic|dashboard|backend]");
+        const tpl = f.template ?? "basic";
+        if (!(tpl in TEMPLATES)) throw new Error(`unknown template "${tpl}"`);
+        const base = await isHostProject(process.cwd()) && !path9.isAbsolute(arg) && !arg.includes("/") ? path9.join((await loadConfig({}, process.cwd())).pluginsDir, arg) : path9.resolve(arg);
+        if (await fs8.stat(base).catch(() => null)) throw new Error(`${base} already exists`);
+        const files = TEMPLATES[tpl](varsFromName(path9.basename(base)));
+        for (const [rel, content] of Object.entries(files)) {
+          await fs8.mkdir(path9.dirname(path9.join(base, rel)), { recursive: true });
+          await fs8.writeFile(path9.join(base, rel), content);
+        }
+        log(`\u2714 created ${tpl} plugin in ${base}
+  next: fluxplugin build ${path9.relative(process.cwd(), base)}`);
+        return 0;
+      }
+      case "build": {
+        if (!arg && await isHostProject(process.cwd())) {
+          await buildHost(process.cwd());
+          return 0;
+        }
+        await buildPlugin(root);
+        return 0;
+      }
+      case "dev": {
+        const cwd = process.cwd();
+        if (arg || !await isHostProject(cwd)) {
+          await buildPlugin(root, true);
+          await new Promise(() => {
+          });
+        }
+        const dispose = await buildHost(cwd, { watch: true });
+        const { child, mode } = startApp(cwd, { web: f.web, dev: true, port: f.port ? Number(f.port) : void 0 });
+        log(`running in ${mode} mode \u2014 edit a plugin and it reloads; Ctrl+C to stop`);
+        const stop = () => {
+          child.kill();
+          void dispose().finally(() => process.exit(0));
+        };
+        process.on("SIGINT", stop);
+        process.on("SIGTERM", stop);
+        return await new Promise((r) => child.on("exit", (c) => r(c ?? 0)));
+      }
+      case "start": {
+        const cwd = process.cwd();
+        if (!await fs8.stat(path9.join(cwd, "dist/index.html")).catch(() => null)) throw new Error("nothing built yet: run `fluxplugin build` first");
+        const { child } = startApp(cwd, { web: f.web, port: f.port ? Number(f.port) : void 0 });
+        return await new Promise((r) => child.on("exit", (c) => r(c ?? 0)));
+      }
+      case "validate":
+        return validate(root);
+      case "package":
+        return pack(root, f.out, f["sign-key"]);
+      case "keygen": {
+        const k = generateSigningKeyPair();
+        const base = f.out ?? "flux-signing";
+        await fs8.writeFile(`${base}.private.key`, k.privateKey, { mode: 384 });
+        await fs8.writeFile(`${base}.public.key`, k.publicKey);
+        log(`wrote ${base}.private.key (keep secret) and ${base}.public.key (distribute to hosts as a trusted key)`);
+        return 0;
+      }
+      case "tailwind": {
+        const cfg = await loadConfig(f);
+        const names = (await fs8.readdir(cfg.pluginsDir).catch(() => [])).sort();
+        const lines = names.map((n) => `@source "${path9.join(cfg.pluginsDir, n, "src").replace(/\\/g, "/")}";`);
+        const css = `/* generated by fluxplugin tailwind */
+${lines.join("\n")}
+`;
+        if (f.out) await fs8.writeFile(f.out, css);
+        else log(css);
+        return 0;
+      }
+      case "install":
+      case "uninstall":
+      case "enable":
+      case "disable":
+      case "list":
+        return manage(cmd, arg, f);
+      default:
+        log(HELP);
+        return 1;
+    }
+  } catch (e) {
+    console.error(`error: ${e.message}`);
+    return 1;
+  }
+}
+async function validate(root) {
+  const raw = await readManifest2(root);
+  const v = validateManifest(raw);
+  let bad = !v.ok;
+  v.issues.forEach((i) => log(`\u2716 ${i.path || "<root>"}: ${i.message}`));
+  v.warnings.forEach((w) => log(`! ${w}`));
+  if (v.manifest) {
+    for (const rel of [v.manifest.main, v.manifest.renderer, ...v.manifest.styles ?? []].filter(Boolean))
+      if (!await fs8.stat(path9.join(root, rel)).catch(() => null)) log(`\u2716 missing file ${rel} (run build)`), bad = true;
+    try {
+      await verifyPlugin(root, raw, v.manifest);
+    } catch (e) {
+      log(`\u2716 ${e.message}`);
+      bad = true;
+    }
+  }
+  log(bad ? "invalid" : `\u2714 ${v.manifest?.id}@${v.manifest?.version} is valid`);
+  return bad ? 1 : 0;
+}
+async function pack(root, out = ".", keyFile) {
+  await buildPlugin(root);
+  let raw = await readManifest2(root);
+  const m = validateManifest(raw).manifest;
+  if (!m) throw new Error("invalid manifest");
+  raw["integrity"] = await computeIntegrity(root, m);
+  if (keyFile) raw = signManifest(raw, (await fs8.readFile(keyFile, "utf8")).trim());
+  const stage = await fs8.mkdtemp(path9.join((await import("node:os")).tmpdir(), "flux-pack-"));
+  await copyDir(root, stage);
+  await fs8.rm(path9.join(stage, "src"), { recursive: true, force: true });
+  await fs8.writeFile(path9.join(stage, "plugin.json"), JSON.stringify(raw, null, 2));
+  const buf = await createTarGz(stage);
+  await fs8.rm(stage, { recursive: true, force: true });
+  await fs8.mkdir(out, { recursive: true });
+  const file = path9.join(out, `${m.id}-${m.version}.tgz`);
+  await fs8.writeFile(file, buf);
+  log(`packaged ${file}
+  sha256 ${crypto2.createHash("sha256").update(buf).digest("hex")}${keyFile ? "\n  signed" : ""}`);
+  return 0;
+}
+async function manage(cmd, arg, f) {
+  const cfg = await loadConfig(f);
+  const state = new JsonStateFile(path9.join(cfg.dataDir, "plugins-state.json"));
+  const inst = new PluginInstaller(cfg.pluginsDir, path9.join(cfg.dataDir, "backups"));
+  if (cmd === "list") {
+    const { disabled } = await state.readAll();
+    for (const m of await inst.installed()) log(`${disabled.includes(m.id) ? "\u25CB" : "\u25CF"} ${m.id}@${m.version}  ${m.name}`);
+    return 0;
+  }
+  if (!arg) throw new Error(`usage: ${cmd} <${cmd === "install" ? "dir|.tgz" : "id"}>`);
+  if (cmd === "install") {
+    const tmp = path9.join(cfg.dataDir, ".install", String(Date.now()));
+    if (arg.endsWith(".tgz")) await extractTarGz(await fs8.readFile(arg), tmp);
+    else await copyDir(path9.resolve(arg), tmp);
+    const v = validateManifest(await readManifest2(tmp));
+    if (!v.manifest) throw new Error("invalid plugin: " + v.issues.map((i) => i.message).join("; "));
+    const reg = new LocalRegistry(path9.dirname(tmp), "cli");
+    inst.addRegistry(reg);
+    const [entry] = (await reg.search(v.manifest.id)).filter((e) => e.id === v.manifest.id);
+    const r = await inst.install({ ...entry, location: tmp });
+    await fs8.rm(tmp, { recursive: true, force: true });
+    log(`installed ${r.id}@${r.version}${r.previousVersion ? ` (was ${r.previousVersion}; rollback available)` : ""}`);
+  } else if (cmd === "uninstall") {
+    await inst.uninstall(arg);
+    log(`uninstalled ${arg}`);
+  } else {
+    await state.update((s2) => ({ disabled: cmd === "disable" ? [.../* @__PURE__ */ new Set([...s2.disabled, arg])] : s2.disabled.filter((x) => x !== arg) }));
+    log(`${cmd}d ${arg}`);
+  }
+  return 0;
+}
+async function ownVersion() {
+  for (const rel of ["../package.json", "../../package.json"]) {
+    try {
+      const j = JSON.parse(await fs8.readFile(new URL(rel, import.meta.url), "utf8"));
+      if (j.name === "fluxplugin" && j.version) return j.version;
+    } catch {
+    }
+  }
+  return "1.0.0";
+}
+
+// src/cli/bin.ts
+process.exit(await run(process.argv.slice(2)));