fluxplugin 1.0.0

package/dist/node/chunks/chunk-BZ7NZF7I.js

@@ -0,0 +1,990 @@
+import {
+  CHANNELS,
+  FRAMEWORK_VERSION,
+  LogStore,
+  MGMT,
+  PermissionManager,
+  PluginManager,
+  compareVersions,
+  core_exports,
+  errorMessage,
+  serializeError,
+  validateManifest
+} from "./chunk-XPLGAEBH.js";
+
+// src/main/framework.ts
+import { watch } from "node:fs";
+import path6 from "node:path";
+
+// src/main/discover.ts
+import { promises as fs2 } from "node:fs";
+import path2 from "node:path";
+import { pathToFileURL } from "node:url";
+
+// src/main/security.ts
+import crypto from "node:crypto";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+var IntegrityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IntegrityError";
+  }
+};
+var sha256File = async (file) => "sha256-" + crypto.createHash("sha256").update(await fs.readFile(file)).digest("hex");
+function canonicalJson(v) {
+  if (Array.isArray(v)) return `[${v.map(canonicalJson).join(",")}]`;
+  if (v && typeof v === "object") {
+    const o = v;
+    return `{${Object.keys(o).filter((k) => o[k] !== void 0).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(v);
+}
+function resolveInside(root, rel) {
+  const abs = path.resolve(root, rel);
+  if (abs !== root && !abs.startsWith(path.resolve(root) + path.sep)) throw new IntegrityError(`path escapes plugin directory: ${rel}`);
+  return abs;
+}
+async function computeIntegrity(root, manifest) {
+  const files = [manifest.main, manifest.preload, manifest.renderer, ...manifest.styles ?? []].filter((f) => !!f);
+  const out = {};
+  for (const f of files) {
+    const rel = f.replace(/^\.\//, "");
+    try {
+      out[rel] = await sha256File(resolveInside(root, rel));
+    } catch {
+    }
+  }
+  return out;
+}
+function generateSigningKeyPair() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  return {
+    publicKey: publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+    privateKey: privateKey.export({ type: "pkcs8", format: "der" }).toString("base64")
+  };
+}
+var signedPayload = (m) => {
+  const { signature: _s, ...rest } = m;
+  return canonicalJson(rest);
+};
+function signManifest(manifest, privateKeyB64) {
+  const key = crypto.createPrivateKey({ key: Buffer.from(privateKeyB64, "base64"), format: "der", type: "pkcs8" });
+  const pub = crypto.createPublicKey(key).export({ type: "spki", format: "der" }).toString("base64");
+  const value = crypto.sign(null, Buffer.from(signedPayload(manifest)), key).toString("base64");
+  return { ...manifest, signature: { algorithm: "ed25519", publicKey: pub, value } };
+}
+async function verifyPlugin(root, raw, manifest, opts = {}) {
+  const warnings = [];
+  if (opts.verifyIntegrity !== false && manifest.integrity) {
+    for (const [rel, expected] of Object.entries(manifest.integrity)) {
+      let actual;
+      try {
+        actual = await sha256File(resolveInside(root, rel));
+      } catch {
+        throw new IntegrityError(`integrity: file "${rel}" is missing`);
+      }
+      if (actual !== expected) throw new IntegrityError(`integrity: "${rel}" does not match its recorded hash (file was modified)`);
+    }
+  } else if (opts.verifyIntegrity !== false && opts.requireSignature) {
+    throw new IntegrityError("integrity hashes are required but missing");
+  }
+  const sig = manifest.signature;
+  if (sig) {
+    let ok = false;
+    try {
+      const pub = crypto.createPublicKey({ key: Buffer.from(sig.publicKey, "base64"), format: "der", type: "spki" });
+      ok = crypto.verify(null, Buffer.from(signedPayload(raw)), pub, Buffer.from(sig.value, "base64"));
+    } catch {
+      ok = false;
+    }
+    if (!ok) throw new IntegrityError("signature is invalid");
+    if (opts.trustedKeys && !opts.trustedKeys.includes(sig.publicKey)) {
+      if (opts.requireSignature) throw new IntegrityError("signed by an untrusted key");
+      warnings.push("signed by an untrusted key");
+    }
+  } else if (opts.requireSignature) {
+    throw new IntegrityError("plugin is not signed");
+  }
+  return warnings;
+}
+
+// src/main/discover.ts
+var MANIFEST_FILE = "plugin.json";
+var counter = 0;
+async function importFresh(file) {
+  const url = pathToFileURL(file).href + `?flux=${Date.now()}.${counter++}`;
+  const mod = await import(
+    /* @vite-ignore */
+    url
+  );
+  return mod.default ?? mod;
+}
+function toDefinition(x, entry) {
+  const def = x && typeof x === "object" && "default" in x ? x.default : x;
+  if (!def || typeof def !== "object") throw new Error(`"${entry}" must default-export definePlugin({...})`);
+  return def;
+}
+async function readPluginDir(root, opts = {}) {
+  const abs = path2.resolve(root);
+  let raw;
+  try {
+    raw = JSON.parse(await fs2.readFile(path2.join(abs, MANIFEST_FILE), "utf8"));
+  } catch (e) {
+    raw = { id: `invalid.${path2.basename(abs)}`.toLowerCase().replace(/[^a-z0-9.-]/g, "-") };
+    return {
+      root: abs,
+      manifest: raw,
+      problem: `cannot read ${MANIFEST_FILE}: ${e.message}`,
+      source: { manifest: raw, root: abs, origin: `dir:${abs}`, load: async () => ({}) }
+    };
+  }
+  let problem;
+  const v = validateManifest(raw);
+  if (v.manifest) {
+    try {
+      await verifyPlugin(abs, raw, v.manifest, opts);
+    } catch (e) {
+      problem = e instanceof IntegrityError ? e.message : `verification failed: ${e.message}`;
+    }
+  }
+  const mainRel = v.manifest?.main;
+  const load = opts.loadEntry ?? importFresh;
+  const source = {
+    manifest: raw,
+    root: abs,
+    origin: `dir:${abs}`,
+    load: async () => {
+      if (problem) throw new IntegrityError(problem);
+      if (!mainRel) return {};
+      const file = path2.resolve(abs, mainRel);
+      if (!file.startsWith(abs + path2.sep)) throw new IntegrityError(`main entry escapes plugin directory`);
+      return toDefinition(await load(file), mainRel);
+    }
+  };
+  return { root: abs, manifest: raw, source, problem };
+}
+async function discoverPlugins(dir, opts = {}) {
+  let entries = [];
+  try {
+    entries = (await fs2.readdir(dir, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules").map((e) => e.name);
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
+    throw e;
+  }
+  const out = [];
+  for (const name of entries.sort()) {
+    const root = path2.join(dir, name);
+    try {
+      await fs2.access(path2.join(root, MANIFEST_FILE));
+    } catch {
+      continue;
+    }
+    out.push(await readPluginDir(root, opts));
+  }
+  return out;
+}
+
+// src/main/fs-storage.ts
+import { promises as fs3 } from "node:fs";
+import path3 from "node:path";
+var safe = (ns) => ns.replace(/[^a-zA-Z0-9._-]/g, "_");
+async function atomicWrite(file, data) {
+  await fs3.mkdir(path3.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  await fs3.writeFile(tmp, data, "utf8");
+  await fs3.rename(tmp, file);
+}
+var FsStorageBackend = class {
+  constructor(dir) {
+    this.dir = dir;
+  }
+  dir;
+  file(ns) {
+    return path3.join(this.dir, `${safe(ns)}.json`);
+  }
+  async read(ns) {
+    try {
+      return JSON.parse(await fs3.readFile(this.file(ns), "utf8"));
+    } catch (e) {
+      if (e.code === "ENOENT") return {};
+      throw e;
+    }
+  }
+  async write(ns, data) {
+    await atomicWrite(this.file(ns), JSON.stringify(data));
+  }
+  async remove(ns) {
+    await fs3.rm(this.file(ns), { force: true });
+  }
+};
+var JsonStateFile = class {
+  constructor(file) {
+    this.file = file;
+  }
+  file;
+  queue = Promise.resolve();
+  async readAll() {
+    try {
+      const j = JSON.parse(await fs3.readFile(this.file, "utf8"));
+      return { disabled: Array.isArray(j.disabled) ? j.disabled : [], approved: j.approved && typeof j.approved === "object" ? j.approved : {} };
+    } catch {
+      return { disabled: [], approved: {} };
+    }
+  }
+  /** Merges `patch(current)` into the file. Concurrent calls run one after the other. */
+  update(patch) {
+    const run = this.queue.then(async () => {
+      const cur = await this.readAll();
+      const p = typeof patch === "function" ? patch(cur) : patch;
+      await atomicWrite(this.file, JSON.stringify({ ...cur, ...p }, null, 2));
+    });
+    this.queue = run.catch(() => void 0);
+    return run;
+  }
+  /** Resolves once every queued write has hit the disk. */
+  async flush() {
+    await this.queue;
+  }
+};
+
+// src/main/registry.ts
+import { promises as fs5 } from "node:fs";
+import path5 from "node:path";
+import crypto2 from "node:crypto";
+
+// src/main/tar.ts
+import { promises as fs4 } from "node:fs";
+import path4 from "node:path";
+import zlib from "node:zlib";
+import { promisify } from "node:util";
+var gzip = promisify(zlib.gzip);
+var gunzip = promisify(zlib.gunzip);
+var BLOCK = 512;
+function header(name, size, mode, type) {
+  const h = Buffer.alloc(BLOCK);
+  if (Buffer.byteLength(name) > 100) throw new Error(`path too long for tar: ${name}`);
+  h.write(name, 0, "utf8");
+  h.write(mode.toString(8).padStart(7, "0") + "\0", 100);
+  h.write("0000000\0", 108);
+  h.write("0000000\0", 116);
+  h.write(size.toString(8).padStart(11, "0") + "\0", 124);
+  h.write("00000000000\0", 136);
+  h.write("        ", 148);
+  h.write(type, 156);
+  h.write("ustar\0", 257);
+  h.write("00", 263);
+  let sum = 0;
+  for (const b of h) sum += b;
+  h.write(sum.toString(8).padStart(6, "0") + "\0 ", 148);
+  return h;
+}
+async function walk(dir, base = "") {
+  const out = [];
+  for (const e of (await fs4.readdir(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+    if (e.name === "node_modules" || e.name === ".git") continue;
+    const abs = path4.join(dir, e.name);
+    const rel = base ? `${base}/${e.name}` : e.name;
+    if (e.isDirectory()) {
+      out.push({ rel, abs, dir: true });
+      out.push(...await walk(abs, rel));
+    } else if (e.isFile()) out.push({ rel, abs, dir: false });
+  }
+  return out;
+}
+async function createTarGz(dir, prefix = "package") {
+  const chunks = [];
+  for (const f of await walk(dir)) {
+    const name = `${prefix}/${f.rel}${f.dir ? "/" : ""}`;
+    if (f.dir) chunks.push(header(name, 0, 493, "5"));
+    else {
+      const data = await fs4.readFile(f.abs);
+      chunks.push(header(name, data.length, 420, "0"), data, Buffer.alloc((BLOCK - data.length % BLOCK) % BLOCK));
+    }
+  }
+  chunks.push(Buffer.alloc(BLOCK * 2));
+  return gzip(Buffer.concat(chunks));
+}
+async function readTarGz(buf) {
+  const tar = await gunzip(buf);
+  const entries = [];
+  let off = 0;
+  while (off + BLOCK <= tar.length) {
+    const h = tar.subarray(off, off + BLOCK);
+    if (h.every((b) => b === 0)) break;
+    const name = h.toString("utf8", 0, 100).replace(/\0.*$/, "");
+    const size = parseInt(h.toString("utf8", 124, 135).replace(/\0.*$/, "").trim() || "0", 8);
+    const type = String.fromCharCode(h[156] ?? 48);
+    off += BLOCK;
+    if (type === "0" || type === "\0") entries.push({ name, type: "file", data: Buffer.from(tar.subarray(off, off + size)) });
+    else if (type === "5") entries.push({ name, type: "dir", data: Buffer.alloc(0) });
+    off += Math.ceil(size / BLOCK) * BLOCK;
+  }
+  return entries;
+}
+async function extractTarGz(buf, dest) {
+  const root = path4.resolve(dest);
+  await fs4.mkdir(root, { recursive: true });
+  for (const e of await readTarGz(buf)) {
+    const parts = e.name.split("/").filter(Boolean);
+    parts.shift();
+    if (!parts.length) continue;
+    if (parts.some((p) => p === ".." || p.includes("\0")) || path4.isAbsolute(e.name)) throw new Error(`unsafe path in archive: ${e.name}`);
+    const target = path4.resolve(root, ...parts);
+    if (target !== root && !target.startsWith(root + path4.sep)) throw new Error(`unsafe path in archive: ${e.name}`);
+    if (e.type === "dir") await fs4.mkdir(target, { recursive: true });
+    else {
+      await fs4.mkdir(path4.dirname(target), { recursive: true });
+      await fs4.writeFile(target, e.data);
+    }
+  }
+}
+
+// src/main/registry.ts
+async function readManifest(dir) {
+  const raw = JSON.parse(await fs5.readFile(path5.join(dir, MANIFEST_FILE), "utf8"));
+  const v = validateManifest(raw);
+  if (!v.manifest) throw new Error(`invalid manifest: ${v.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+  return { raw, manifest: v.manifest };
+}
+var toEntry = (m, location, source, sha256) => ({
+  id: m.id,
+  name: m.name,
+  version: m.version,
+  description: m.description,
+  author: typeof m.author === "string" ? m.author : m.author?.name,
+  permissions: m.permissions ?? [],
+  location,
+  source,
+  sha256
+});
+async function copyDir(src, dest) {
+  await fs5.mkdir(dest, { recursive: true });
+  for (const e of await fs5.readdir(src, { withFileTypes: true })) {
+    if (e.name === "node_modules" || e.name === ".git") continue;
+    const s = path5.join(src, e.name);
+    const d = path5.join(dest, e.name);
+    if (e.isDirectory()) await copyDir(s, d);
+    else if (e.isFile()) await fs5.copyFile(s, d);
+  }
+}
+var LocalRegistry = class {
+  constructor(dir, name = `local:${dir}`) {
+    this.dir = dir;
+    this.name = name;
+  }
+  dir;
+  name;
+  async search(query = "") {
+    const q = query.toLowerCase();
+    const out = [];
+    let names = [];
+    try {
+      names = await fs5.readdir(this.dir);
+    } catch {
+      return [];
+    }
+    for (const n of names.sort()) {
+      const root = path5.join(this.dir, n);
+      try {
+        const { manifest } = await readManifest(root);
+        if (!q || `${manifest.id} ${manifest.name} ${manifest.description ?? ""}`.toLowerCase().includes(q)) out.push(toEntry(manifest, root, this.name));
+      } catch {
+      }
+    }
+    return out;
+  }
+  async fetch(entry, dest) {
+    await copyDir(entry.location, dest);
+    return (await readManifest(dest)).manifest;
+  }
+};
+var HttpRegistry = class {
+  constructor(baseUrl, fetchImpl = fetch) {
+    this.baseUrl = baseUrl;
+    this.fetchImpl = fetchImpl;
+    this.name = `http:${baseUrl}`;
+  }
+  baseUrl;
+  fetchImpl;
+  name;
+  async search(query = "") {
+    const res = await this.fetchImpl(new URL("index.json", this.baseUrl.endsWith("/") ? this.baseUrl : this.baseUrl + "/"));
+    if (!res.ok) throw new Error(`registry responded ${res.status}`);
+    const j = await res.json();
+    const q = query.toLowerCase();
+    return (j.plugins ?? []).filter((p) => !q || `${p["id"]} ${p["name"]} ${p["description"] ?? ""}`.toLowerCase().includes(q)).map((p) => ({
+      id: String(p["id"]),
+      name: String(p["name"] ?? p["id"]),
+      version: String(p["version"]),
+      description: p["description"],
+      author: p["author"],
+      permissions: p["permissions"] ?? [],
+      location: new URL(String(p["url"]), this.baseUrl).href,
+      source: this.name,
+      sha256: p["sha256"]
+    }));
+  }
+  async fetch(entry, dest) {
+    const res = await this.fetchImpl(entry.location);
+    if (!res.ok) throw new Error(`download failed: ${res.status}`);
+    const buf = Buffer.from(await res.arrayBuffer());
+    if (entry.sha256 && crypto2.createHash("sha256").update(buf).digest("hex") !== entry.sha256.replace(/^sha256-/, "")) {
+      throw new Error("downloaded archive does not match the registry checksum");
+    }
+    await extractTarGz(buf, dest);
+    return (await readManifest(dest)).manifest;
+  }
+};
+var PluginInstaller = class {
+  constructor(pluginsDir, backupDir, registries = []) {
+    this.pluginsDir = pluginsDir;
+    this.backupDir = backupDir;
+    this.registries = registries;
+  }
+  pluginsDir;
+  backupDir;
+  registries;
+  addRegistry(r) {
+    this.registries.push(r);
+  }
+  async search(query) {
+    const all = await Promise.allSettled(this.registries.map((r) => r.search(query)));
+    return all.flatMap((r) => r.status === "fulfilled" ? r.value : []);
+  }
+  async installed() {
+    const out = [];
+    for (const n of await fs5.readdir(this.pluginsDir).catch(() => [])) {
+      try {
+        out.push((await readManifest(path5.join(this.pluginsDir, n))).manifest);
+      } catch {
+      }
+    }
+    return out;
+  }
+  dirOf(id) {
+    return path5.join(this.pluginsDir, id.replace(/[^a-z0-9.-]/gi, "_"));
+  }
+  /** Installs (or updates) `entry`. The plugin directory is replaced atomically from a staging directory. */
+  async install(entry) {
+    const registry = this.registries.find((r) => r.name === entry.source);
+    if (!registry) throw new Error(`unknown registry "${entry.source}"`);
+    const stage = path5.join(this.backupDir, ".staging", `${entry.id}-${Date.now()}`);
+    await fs5.mkdir(path5.dirname(stage), { recursive: true });
+    try {
+      const manifest = await registry.fetch(entry, stage);
+      if (manifest.id !== entry.id) throw new Error(`registry entry "${entry.id}" contains plugin "${manifest.id}"`);
+      const target = this.dirOf(entry.id);
+      let previousVersion;
+      try {
+        previousVersion = (await readManifest(target)).manifest.version;
+        const bk = path5.join(this.backupDir, entry.id, previousVersion);
+        await fs5.rm(bk, { recursive: true, force: true });
+        await fs5.mkdir(path5.dirname(bk), { recursive: true });
+        await fs5.rename(target, bk);
+      } catch (e) {
+        if (e.code && e.code !== "ENOENT") throw e;
+      }
+      await fs5.mkdir(path5.dirname(target), { recursive: true });
+      await fs5.rename(stage, target);
+      return { id: entry.id, version: manifest.version, previousVersion };
+    } finally {
+      await fs5.rm(stage, { recursive: true, force: true });
+    }
+  }
+  /** Removes the plugin directory (backups are kept so the user can still roll back/reinstall). */
+  async uninstall(id) {
+    const dir = this.dirOf(id);
+    const { manifest } = await readManifest(dir);
+    const bk = path5.join(this.backupDir, id, manifest.version);
+    await fs5.rm(bk, { recursive: true, force: true });
+    await fs5.mkdir(path5.dirname(bk), { recursive: true });
+    await fs5.rename(dir, bk);
+  }
+  async versions(id) {
+    const names = await fs5.readdir(path5.join(this.backupDir, id)).catch(() => []);
+    return names.sort(compareVersions);
+  }
+  /** Restores the newest backup (or `version`) and keeps the replaced version as a backup. */
+  async rollback(id, version) {
+    const versions = await this.versions(id);
+    const target = version ?? versions[versions.length - 1];
+    if (!target || !versions.includes(target)) throw new Error(`no backup available for "${id}"${version ? ` @ ${version}` : ""}`);
+    const dir = this.dirOf(id);
+    let current;
+    try {
+      current = (await readManifest(dir)).manifest.version;
+      const bk = path5.join(this.backupDir, id, current);
+      await fs5.rm(bk, { recursive: true, force: true });
+      await fs5.rename(dir, bk);
+    } catch (e) {
+      if (e.code && e.code !== "ENOENT") throw e;
+    }
+    await fs5.rename(path5.join(this.backupDir, id, target), dir);
+    return { id, version: target, previousVersion: current };
+  }
+  /** Entries from registries that are newer than what is installed. */
+  async updates() {
+    const installed = new Map((await this.installed()).map((m) => [m.id, m.version]));
+    return (await this.search()).filter((e) => installed.has(e.id) && compareVersions(e.version, installed.get(e.id)) > 0);
+  }
+};
+
+// src/main/framework.ts
+var MainFramework = class {
+  constructor(options) {
+    this.options = options;
+    this.logs = new LogStore(5e3);
+    this.state = new JsonStateFile(path6.join(options.dataDir, "plugins-state.json"));
+    this.permissions = new PermissionManager({
+      autoGrant: !options.requireApproval,
+      onChange: (id, snap) => void this.state.update((s) => ({ approved: { ...s.approved, [id]: snap.granted } })).catch(() => void 0)
+    });
+    this.manager = new PluginManager({
+      runtime: "main",
+      storage: new FsStorageBackend(path6.join(options.dataDir, "storage")),
+      permissions: this.permissions,
+      logs: this.logs,
+      frameworkVersion: options.frameworkVersion,
+      stateStore: {
+        load: async () => (await this.state.readAll()).disabled,
+        save: (ids) => this.state.update({ disabled: ids })
+      },
+      onBroadcastEvent: (name, payload) => this.broadcast("flux.event." + name, payload),
+      ...options.manager
+    });
+    this.manager.ipc.setTransport({ broadcast: (c, p, t) => this.broadcast(c, p, t) });
+    this.installer = new PluginInstaller(options.installDir ?? options.pluginDirs[0], path6.join(options.dataDir, "backups"), options.registries ?? []);
+    this.manager.subscribe(() => {
+      this.revision++;
+      this.broadcast(MGMT.changed, { revision: this.revision });
+    });
+    this.registerManagementApi();
+  }
+  options;
+  manager;
+  logs;
+  installer;
+  permissions;
+  state;
+  broadcastListeners = /* @__PURE__ */ new Set();
+  watchers = [];
+  revision = 0;
+  reloadTimers = /* @__PURE__ */ new Map();
+  started = false;
+  /* --------------------------------------------------------- start / stop */
+  async start() {
+    if (this.started) return;
+    this.started = true;
+    const approved = (await this.state.readAll()).approved;
+    const g = globalThis;
+    g.__FLUXPLUGIN_SHARED__ = { ...g.__FLUXPLUGIN_SHARED__ ?? {}, "fluxplugin": core_exports };
+    this.permissions.restore(approved);
+    await this.manager.init();
+    await this.scan();
+    await this.manager.startup();
+    if (this.options.hotReload) this.watch();
+  }
+  discoverOpts() {
+    return { trustedKeys: this.options.trustedKeys, requireSignature: this.options.requireSignature, ...this.options.discover };
+  }
+  /** (Re)scans the plugin directories and registers plugins that are new. */
+  async scan() {
+    for (const dir of this.options.pluginDirs) {
+      for (const p of await discoverPlugins(dir, this.discoverOpts())) {
+        const id = typeof p.manifest["id"] === "string" ? p.manifest["id"] : "";
+        if (id && this.manager.has(id)) continue;
+        const info = this.manager.register(p.source);
+        if (p.problem) this.logs.logger(info.id).error(p.problem);
+      }
+    }
+  }
+  async stop() {
+    for (const w of this.watchers) w.close();
+    this.watchers = [];
+    for (const t of this.reloadTimers.values()) clearTimeout(t);
+    await this.manager.dispose();
+    await this.state.flush();
+  }
+  /** Watches plugin directories and reloads the affected plugin (debounced). */
+  watch() {
+    for (const dir of this.options.pluginDirs) {
+      try {
+        const w = watch(dir, { recursive: true }, (_evt, filename) => {
+          if (!filename) return;
+          const parts = String(filename).split(path6.sep);
+          if (parts.includes("node_modules") || parts.includes("src")) return;
+          const folder = parts[0];
+          clearTimeout(this.reloadTimers.get(folder));
+          this.reloadTimers.set(
+            folder,
+            setTimeout(() => void this.hotReloadFolder(path6.join(dir, folder)), 150)
+          );
+        });
+        this.watchers.push(w);
+      } catch (e) {
+        this.logs.logger("core").warn(`hot reload disabled for ${dir}: ${errorMessage(e)}`);
+      }
+    }
+  }
+  async hotReloadFolder(root) {
+    try {
+      const p = await readPluginDir(root, this.discoverOpts());
+      const id = String(p.manifest["id"] ?? "");
+      if (!id) return;
+      if (!this.manager.has(id)) {
+        this.manager.register(p.source);
+        await this.manager.activate(id).catch(() => void 0);
+      } else {
+        await this.manager.unregister(id);
+        this.manager.register(p.source);
+        await this.manager.activate(id).catch(() => void 0);
+      }
+      this.logs.logger(id).info("hot reloaded");
+      this.broadcast("flux.event.plugin.hotreload", { id });
+    } catch (e) {
+      this.logs.logger("core").error(`hot reload failed for ${root}: ${errorMessage(e)}`);
+    }
+  }
+  /* ----------------------------------------------------------- broadcasting */
+  onBroadcast(l) {
+    this.broadcastListeners.add(l);
+    return () => void this.broadcastListeners.delete(l);
+  }
+  broadcast(channel, payload, target) {
+    for (const l of [...this.broadcastListeners]) {
+      try {
+        l(channel, payload, target);
+      } catch {
+      }
+    }
+  }
+  /* ---------------------------------------------------------------- bootstrap */
+  bootstrap() {
+    const assetUrl = this.options.assetUrl ?? ((id, rel) => `fluxplugin://${id}/${rel.replace(/^\.\//, "")}`);
+    const plugins = this.manager.list().map((info) => {
+      const m = this.manager.manifest(info.id);
+      const rejected = info.state === "error" && info.error?.phase === "validate";
+      return {
+        id: info.id,
+        manifest: m,
+        enabled: info.enabled && !rejected,
+        rendererUrl: m.renderer && !rejected ? assetUrl(info.id, m.renderer) : void 0,
+        styleUrls: (m.styles ?? []).map((s) => assetUrl(info.id, s)),
+        granted: info.permissions.granted,
+        state: info.state
+      };
+    });
+    return { frameworkVersion: this.options.frameworkVersion ?? FRAMEWORK_VERSION, plugins, preload: this.manager.preload.manifest(), revision: this.revision };
+  }
+  /* --------------------------------------------------- renderer-facing IPC */
+  exposedChannels(kind) {
+    const out = new Set(this.options.allowedRendererChannels ?? []);
+    for (const e of this.manager.preload.list()) for (const m of Object.values(e.spec)) if (m.kind === kind) out.add(m.channel);
+    return out;
+  }
+  /**
+   * Handles an invoke coming from a renderer. Policy: the renderer may only call channels that a plugin explicitly
+   * exposed through `preload.expose`, channels the host allow-listed, and (optionally) `flux.plugins.*`.
+   */
+  async handleInvoke(req, senderId) {
+    try {
+      if (!req || typeof req.channel !== "string") throw new Error("malformed request");
+      const ch = req.channel;
+      const mgmt = ch.startsWith("flux.plugins.");
+      if (mgmt) {
+        if (this.options.allowManagement === false) throw new Error(`management API is disabled`);
+      } else if (!this.exposedChannels("invoke").has(ch)) {
+        throw new Error(`channel "${ch}" is not exposed to renderers`);
+      }
+      const caller = typeof req.caller === "string" && this.manager.has(req.caller) ? req.caller : "host";
+      if (caller !== "host") this.permissions.assert(caller, "ipc", `invoke("${ch}")`);
+      const value = await this.manager.ipc.invoke(ch, req.input, { caller, senderId });
+      return { ok: true, value };
+    } catch (e) {
+      return { ok: false, error: serializeError(e) };
+    }
+  }
+  handleSend(channel, payload, caller, senderId) {
+    if (typeof channel !== "string" || !this.exposedChannels("send").has(channel)) return;
+    const who = typeof caller === "string" && this.manager.has(caller) ? caller : "host";
+    if (who !== "host" && !this.permissions.has(who, "ipc")) return;
+    this.manager.ipc.dispatch(channel, payload, { caller: who, senderId });
+  }
+  /* -------------------------------------------------------- management API */
+  registerManagementApi() {
+    const ipc = this.manager.ipc;
+    const h = (name, fn) => ipc.handle(name, (i) => fn(i), "host");
+    const list = () => this.manager.list();
+    h(MGMT.list, () => list());
+    h(MGMT.enable, async ({ id }) => (await this.manager.enable(id).catch((e) => this.logs.logger(id).error(errorMessage(e))), list()));
+    h(MGMT.disable, async ({ id }) => (await this.manager.disable(id), list()));
+    h(MGMT.reload, async ({ id }) => (await this.manager.reload(id), list()));
+    h(MGMT.grant, ({ id, permission }) => (this.permissions.grant(id, permission), this.manager.info(id)));
+    h(MGMT.revoke, ({ id, permission }) => (this.permissions.revoke(id, permission), this.manager.info(id)));
+    h(MGMT.configGet, async ({ id }) => this.requireConfig(id).get());
+    h(MGMT.configSet, async ({ id, patch }) => this.requireConfig(id).set(patch));
+    h(MGMT.configReset, async ({ id }) => this.requireConfig(id).reset());
+    h(MGMT.configSchema, ({ id }) => this.manager.getConfig(id)?.describe() ?? null);
+    h(MGMT.logs, ({ id }) => this.logs.query(id ? { source: id } : {}).slice(-200));
+    h(MGMT.diagnostics, ({ id }) => this.manager.diagnostics(id));
+    h(MGMT.search, ({ query }) => this.installer.search(query));
+    h(MGMT.updates, () => this.installer.updates());
+    h(MGMT.install, async ({ entry }) => this.installAndLoad(entry));
+    h(MGMT.update, async ({ entry }) => this.installAndLoad(entry));
+    h(MGMT.uninstall, async ({ id }) => {
+      await this.manager.unregister(id);
+      await this.installer.uninstall(id);
+      return list();
+    });
+    h(MGMT.rollback, async ({ id, version }) => {
+      await this.manager.unregister(id);
+      const r = await this.installer.rollback(id, version);
+      await this.scan();
+      await this.manager.activate(id).catch(() => void 0);
+      return r;
+    });
+  }
+  requireConfig(id) {
+    const c = this.manager.getConfig(id);
+    if (!c) throw new Error(`plugin "${id}" has no configuration (activate it first)`);
+    return c;
+  }
+  async installAndLoad(entry) {
+    const wasActive = this.manager.has(entry.id) && this.manager.info(entry.id).state === "ready";
+    if (this.manager.has(entry.id)) await this.manager.unregister(entry.id);
+    const r = await this.installer.install(entry);
+    await this.scan();
+    if (this.manager.has(entry.id) && (wasActive || !r.previousVersion)) await this.manager.activate(entry.id).catch(() => void 0);
+    return r;
+  }
+  /** Channels used by transports. */
+  static channels = CHANNELS;
+};
+
+// src/main/adapters.ts
+import http from "node:http";
+import path7 from "node:path";
+import { promises as fs6 } from "node:fs";
+function attachElectron(fw, electron) {
+  const { ipcMain, webContents } = electron;
+  ipcMain.handle(CHANNELS.invoke, (e, req) => fw.handleInvoke(req, e.sender.id));
+  ipcMain.handle(CHANNELS.bootstrap, () => fw.bootstrap());
+  const onSend = (e, msg) => fw.handleSend(msg?.channel, msg?.payload, msg?.caller, e.sender.id);
+  ipcMain.on(CHANNELS.send, onSend);
+  const off = fw.onBroadcast((channel, payload, target) => {
+    for (const wc of webContents.getAllWebContents()) {
+      if (wc.isDestroyed()) continue;
+      if (target !== void 0 && wc.id !== target) continue;
+      wc.send(CHANNELS.event, { channel, payload });
+    }
+  });
+  return () => {
+    ipcMain.removeHandler(CHANNELS.invoke);
+    ipcMain.removeHandler(CHANNELS.bootstrap);
+    ipcMain.removeListener(CHANNELS.send, onSend);
+    off();
+  };
+}
+var PLUGIN_SCHEME = {
+  scheme: "fluxplugin",
+  privileges: { standard: true, secure: true, supportFetchAPI: true, corsEnabled: true, stream: true }
+};
+var MIME = {
+  ".js": "text/javascript",
+  ".mjs": "text/javascript",
+  ".css": "text/css",
+  ".json": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".woff2": "font/woff2",
+  ".map": "application/json"
+};
+async function resolvePluginAsset(fw, url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return null;
+  }
+  const id = decodeURIComponent(u.hostname);
+  if (!fw.manager.has(id)) return null;
+  const root = fw.manager.info(id).root;
+  if (!root) return null;
+  const rel = decodeURIComponent(u.pathname).replace(/^\/+/, "");
+  const file = path7.resolve(root, rel);
+  if (!file.startsWith(path7.resolve(root) + path7.sep)) return null;
+  const m = fw.manager.manifest(id);
+  const main = m.main ? path7.resolve(root, m.main) : void 0;
+  if (file === main || path7.basename(file) === "plugin.json") return null;
+  const ext = path7.extname(file).toLowerCase();
+  if (!(ext in MIME)) return null;
+  try {
+    await fs6.access(file);
+  } catch {
+    return null;
+  }
+  return { file, mime: MIME[ext] };
+}
+function registerPluginProtocol(fw, protocol) {
+  protocol.handle(PLUGIN_SCHEME.scheme, async (req) => {
+    const r = await resolvePluginAsset(fw, req.url);
+    if (!r) return new Response("Not found", { status: 404 });
+    return new Response(await fs6.readFile(r.file), { headers: { "content-type": r.mime, "access-control-allow-origin": "*" } });
+  });
+}
+function attachHttp(fw, opts = {}) {
+  const prefix = opts.assetPrefix ?? "/@plugins";
+  const clients = /* @__PURE__ */ new Set();
+  const off = fw.onBroadcast((channel, payload) => {
+    const data = `data: ${JSON.stringify({ channel, payload })}
+
+`;
+    for (const c of clients) c.write(data);
+  });
+  const readJson = (req) => new Promise((resolve, reject) => {
+    let s = "";
+    req.on("data", (d) => {
+      s += d;
+      if (s.length > 5e6) reject(new Error("body too large"));
+    });
+    req.on("end", () => {
+      try {
+        resolve(s ? JSON.parse(s) : {});
+      } catch (e) {
+        reject(e);
+      }
+    });
+  });
+  const json = (res, code, body) => {
+    res.writeHead(code, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+  };
+  const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    try {
+      if (url.pathname === "/flux/bootstrap") return json(res, 200, fw.bootstrap());
+      if (url.pathname === "/flux/invoke" && req.method === "POST") return json(res, 200, await fw.handleInvoke(await readJson(req), "http"));
+      if (url.pathname === "/flux/send" && req.method === "POST") {
+        const m = await readJson(req);
+        fw.handleSend(m.channel, m.payload, m.caller, "http");
+        return json(res, 200, { ok: true });
+      }
+      if (url.pathname === "/flux/events") {
+        res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
+        res.write(": connected\n\n");
+        clients.add(res);
+        req.on("close", () => clients.delete(res));
+        return;
+      }
+      if (url.pathname.startsWith(prefix + "/")) {
+        const rest = url.pathname.slice(prefix.length + 1);
+        const slash = rest.indexOf("/");
+        const id = decodeURIComponent(rest.slice(0, slash));
+        const r = await resolvePluginAsset(fw, `fluxplugin://${encodeURIComponent(id)}/${rest.slice(slash + 1)}`);
+        if (!r) return json(res, 404, { error: "not found" });
+        res.writeHead(200, { "content-type": r.mime, "cache-control": "no-store" });
+        return res.end(await fs6.readFile(r.file));
+      }
+      if (opts.fallback && await opts.fallback(req, res)) return;
+      json(res, 404, { error: "not found" });
+    } catch (e) {
+      json(res, 500, { error: e.message });
+    }
+  });
+  return new Promise((resolve) => {
+    server.listen(opts.port ?? 0, opts.host ?? "127.0.0.1", () => {
+      const port = server.address().port;
+      resolve({
+        server,
+        port,
+        close: () => new Promise((r) => {
+          off();
+          for (const c of clients) c.end();
+          server.close(() => r());
+        })
+      });
+    });
+  });
+}
+function createLoopbackBridge(fw) {
+  const clone = (v) => v === void 0 ? v : JSON.parse(JSON.stringify(v));
+  const listeners = /* @__PURE__ */ new Map();
+  fw.onBroadcast((channel, payload) => {
+    for (const l of [...listeners.get(channel) ?? []]) l(clone(payload));
+  });
+  return {
+    async invoke(channel, input, caller) {
+      const res = await fw.handleInvoke({ channel, input: clone(input), caller }, "loopback");
+      if (!res.ok) throw Object.assign(new Error(res.error.message), { code: res.error.code, payload: res.error });
+      return clone(res.value);
+    },
+    send: (channel, payload, caller) => fw.handleSend(channel, clone(payload), caller, "loopback"),
+    on(channel, l) {
+      let set = listeners.get(channel);
+      if (!set) listeners.set(channel, set = /* @__PURE__ */ new Set());
+      set.add(l);
+      return () => void set.delete(l);
+    },
+    async bootstrap() {
+      return clone(fw.bootstrap());
+    }
+  };
+}
+
+// src/main/serve-web.ts
+import path8 from "node:path";
+import { promises as fs7 } from "node:fs";
+var TYPES = { ".html": "text/html", ".js": "text/javascript", ".mjs": "text/javascript", ".css": "text/css", ".map": "application/json", ".svg": "image/svg+xml", ".png": "image/png" };
+function serveWeb(fw, opts) {
+  const dist = path8.resolve(opts.distDir);
+  return attachHttp(fw, {
+    port: opts.port ?? 5173,
+    host: opts.host,
+    fallback: async (req, res) => {
+      const rel = !req.url || req.url === "/" ? "index.html" : decodeURIComponent(req.url.split("?")[0]).replace(/^\/+/, "");
+      const file = path8.resolve(dist, rel);
+      const type = TYPES[path8.extname(file)];
+      if (!type || !file.startsWith(dist + path8.sep)) return false;
+      try {
+        res.writeHead(200, { "content-type": type, "cache-control": "no-store" });
+        res.end(await fs7.readFile(file));
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  });
+}
+
+export {
+  IntegrityError,
+  sha256File,
+  canonicalJson,
+  computeIntegrity,
+  generateSigningKeyPair,
+  signManifest,
+  verifyPlugin,
+  MANIFEST_FILE,
+  importFresh,
+  readPluginDir,
+  discoverPlugins,
+  FsStorageBackend,
+  JsonStateFile,
+  createTarGz,
+  readTarGz,
+  extractTarGz,
+  copyDir,
+  LocalRegistry,
+  HttpRegistry,
+  PluginInstaller,
+  MainFramework,
+  attachElectron,
+  PLUGIN_SCHEME,
+  resolvePluginAsset,
+  registerPluginProtocol,
+  attachHttp,
+  createLoopbackBridge,
+  serveWeb
+};