fluxplugin 1.0.0

package/dist/node/cli-api.js

@@ -0,0 +1,843 @@
+import {
+  JsonStateFile,
+  LocalRegistry,
+  PluginInstaller,
+  computeIntegrity,
+  copyDir,
+  createTarGz,
+  extractTarGz,
+  generateSigningKeyPair,
+  signManifest,
+  verifyPlugin
+} from "./chunks/chunk-BZ7NZF7I.js";
+import {
+  validateManifest
+} from "./chunks/chunk-XPLGAEBH.js";
+
+// src/cli/cli.ts
+import { parseArgs } from "node:util";
+import { promises as fs4 } from "node:fs";
+import path5 from "node:path";
+import crypto from "node:crypto";
+
+// src/cli/build.ts
+import { promises as fs } from "node:fs";
+import path2 from "node:path";
+import { build, context } from "esbuild";
+
+// src/cli/shared-modules.ts
+import path from "node:path";
+var SHARED_MODULES = ["react", "react/jsx-runtime", "react/jsx-dev-runtime", "react-dom", "react-dom/client", "fluxplugin", "fluxplugin/react", "fluxplugin/manager-ui"];
+function sharedModulesPlugin(shared = SHARED_MODULES) {
+  const set = new Set(shared);
+  return {
+    name: "flux-shared-modules",
+    setup(b) {
+      b.onResolve({ filter: /.*/ }, (args) => {
+        if (set.has(args.path)) return { path: args.path, namespace: "flux-shared" };
+        return void 0;
+      });
+      b.onLoad({ filter: /.*/, namespace: "flux-shared" }, (args) => ({
+        contents: `const m = globalThis.__FLUXPLUGIN_SHARED__ && globalThis.__FLUXPLUGIN_SHARED__[${JSON.stringify(args.path)}];
+if (!m) throw new Error("Shared module ${args.path} is not provided by the host application (see installSharedModules).");
+module.exports = m;`,
+        loader: "js",
+        resolveDir: path.resolve(".")
+      }));
+    }
+  };
+}
+
+// src/cli/build.ts
+var exists = (f) => fs.access(f).then(() => true, () => false);
+async function firstExisting(root, names) {
+  for (const n of names) if (await exists(path2.join(root, n))) return path2.join(root, n);
+}
+async function buildOptions(root) {
+  const raw = JSON.parse(await fs.readFile(path2.join(root, "plugin.json"), "utf8"));
+  const m = validateManifest(raw).manifest;
+  if (!m) throw new Error("invalid plugin.json (run `fluxplugin validate`)");
+  const out = [];
+  const common = { bundle: true, sourcemap: true, logLevel: "warning", plugins: [sharedModulesPlugin()], jsx: "automatic", loader: { ".module.css": "local-css" } };
+  if (m.main) {
+    const entry = await firstExisting(root, ["src/main.ts", "src/main.js"]);
+    if (!entry) throw new Error("manifest declares `main` but src/main.ts was not found");
+    out.push({ ...common, entryPoints: [entry], outfile: path2.join(root, m.main), platform: "node", format: "esm", target: "node20", external: ["node:*", "electron"] });
+  }
+  if (m.renderer) {
+    const entry = await firstExisting(root, ["src/renderer.tsx", "src/renderer.ts", "src/renderer.jsx", "src/renderer.js"]);
+    if (!entry) throw new Error("manifest declares `renderer` but src/renderer.tsx was not found");
+    out.push({ ...common, entryPoints: [entry], outfile: path2.join(root, m.renderer), platform: "browser", format: "esm", target: "chrome120" });
+  }
+  for (const css of m.styles ?? []) {
+    const entry = path2.join(root, "src/styles", path2.basename(css));
+    if (await exists(entry)) out.push({ ...common, plugins: [], entryPoints: [entry], outfile: path2.join(root, css) });
+  }
+  return out;
+}
+async function buildPlugin(root, watch = false, log2 = console.log) {
+  const opts = await buildOptions(root);
+  if (!watch) {
+    for (const o of opts) await build(o);
+    log2(`built ${opts.length} bundle(s) in ${root}`);
+    return async () => {
+    };
+  }
+  const ctxs = await Promise.all(opts.map((o) => context(o)));
+  await Promise.all(ctxs.map((c) => c.watch()));
+  log2(`watching ${root} (${ctxs.length} bundles)`);
+  return async () => void await Promise.all(ctxs.map((c) => c.dispose()));
+}
+
+// src/cli/host.ts
+import { spawn } from "node:child_process";
+import { promises as fs3 } from "node:fs";
+import { createRequire } from "node:module";
+import path4 from "node:path";
+import { build as build2, context as context2 } from "esbuild";
+
+// src/cli/config.ts
+import { promises as fs2 } from "node:fs";
+import path3 from "node:path";
+async function loadConfig(flags, cwd = process.cwd()) {
+  let file = {};
+  try {
+    file = JSON.parse(await fs2.readFile(path3.join(cwd, "fluxplugin.config.json"), "utf8"));
+  } catch {
+  }
+  return {
+    pluginsDir: path3.resolve(cwd, flags.dir ?? file.pluginsDir ?? "plugins"),
+    dataDir: path3.resolve(cwd, flags.data ?? file.dataDir ?? ".flux-data")
+  };
+}
+
+// src/cli/host.ts
+var exists2 = (f) => fs3.access(f).then(() => true, () => false);
+async function isHostProject(cwd) {
+  return await exists2(path4.join(cwd, "fluxplugin.config.json")) || await exists2(path4.join(cwd, "src/renderer.tsx")) && await exists2(path4.join(cwd, "src/framework.ts"));
+}
+var nodeBanner = { js: "import { createRequire as __r } from 'node:module'; const require = __r(import.meta.url);" };
+function hostBuilds(cwd, outDir, dev) {
+  const common = { absWorkingDir: cwd, bundle: true, sourcemap: dev, logLevel: "warning", jsx: "automatic", define: { "process.env.NODE_ENV": JSON.stringify(dev ? "development" : "production") } };
+  const entry = (f) => path4.join(cwd, "src", f);
+  return [
+    { ...common, entryPoints: [entry("renderer.tsx")], outfile: path4.join(outDir, "renderer.js"), platform: "browser", format: "esm", target: "chrome120" },
+    { ...common, entryPoints: [entry("main.ts")], outfile: path4.join(outDir, "main.cjs"), platform: "node", format: "cjs", target: "node20", external: ["electron"] },
+    { ...common, entryPoints: [entry("preload.ts")], outfile: path4.join(outDir, "preload.cjs"), platform: "node", format: "cjs", target: "node20", external: ["electron"] },
+    { ...common, entryPoints: [entry("web.ts")], outfile: path4.join(outDir, "web.mjs"), platform: "node", format: "esm", target: "node20", external: ["electron"], banner: nodeBanner }
+  ];
+}
+async function pluginDirs(cwd, pluginsDir) {
+  const names = await fs3.readdir(pluginsDir).catch(() => []);
+  const out = [];
+  for (const n of names.sort()) if (await exists2(path4.join(pluginsDir, n, "plugin.json"))) out.push(path4.join(pluginsDir, n));
+  void cwd;
+  return out;
+}
+async function buildHost(cwd, opts = {}) {
+  const log2 = opts.log ?? console.log;
+  const cfgFile = JSON.parse(await fs3.readFile(path4.join(cwd, "fluxplugin.config.json"), "utf8").catch(() => "{}"));
+  const cfg = await loadConfig({}, cwd);
+  const outDir = path4.resolve(cwd, cfgFile.outDir ?? "dist");
+  await fs3.mkdir(outDir, { recursive: true });
+  await fs3.copyFile(path4.join(cwd, "src/index.html"), path4.join(outDir, "index.html"));
+  const disposers = [];
+  const opts2 = hostBuilds(cwd, outDir, !!opts.watch);
+  if (opts.watch) {
+    const ctxs = await Promise.all(opts2.map((o) => context2(o)));
+    await Promise.all(ctxs.map((c) => c.watch()));
+    disposers.push(async () => void await Promise.all(ctxs.map((c) => c.dispose())));
+  } else for (const o of opts2) await build2(o);
+  for (const dir of await pluginDirs(cwd, cfg.pluginsDir)) {
+    try {
+      disposers.push(await buildPlugin(dir, !!opts.watch, log2));
+    } catch (e) {
+      log2(`! plugin ${path4.basename(dir)} not built: ${e.message}`);
+    }
+  }
+  log2(`host built \u2192 ${path4.relative(cwd, outDir) || "."}`);
+  return async () => void await Promise.all(disposers.map((d) => d()));
+}
+function electronBinary(cwd) {
+  try {
+    const p = createRequire(path4.join(cwd, "package.json"))("electron");
+    return typeof p === "string" ? p : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function startApp(cwd, opts = {}) {
+  const bin = opts.web ? void 0 : electronBinary(cwd);
+  const env = { ...process.env, FLUXPLUGIN_PROJECT: cwd, ...opts.dev ? { FLUXPLUGIN_DEV: "1" } : {}, ...opts.port ? { PORT: String(opts.port) } : {} };
+  if (bin) return { child: spawn(bin, [path4.join(cwd, "dist/main.cjs")], { cwd, env, stdio: "inherit" }), mode: "electron" };
+  return { child: spawn(process.execPath, [path4.join(cwd, "dist/web.mjs")], { cwd, env, stdio: "inherit" }), mode: "web" };
+}
+
+// src/cli/templates.ts
+var pkg = (v) => JSON.stringify(
+  {
+    name: v.id,
+    version: "1.0.0",
+    private: true,
+    type: "module",
+    scripts: { dev: "fluxplugin dev", build: "fluxplugin build", package: "fluxplugin package", validate: "fluxplugin validate" },
+    devDependencies: { fluxplugin: "^1.0.0", "@types/react": "^19.0.0", react: "^19.0.0", typescript: "^5.6.0" }
+  },
+  null,
+  2
+);
+var tsconfig = `{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "lib": ["ES2022", "DOM"]
+  },
+  "include": ["src"]
+}
+`;
+var styles = (v) => `/* Styles are loaded when the plugin activates and removed when it is disabled. */
+.${v.slug}-card {
+  border: 1px solid var(--flux-border, #e2e8f0);
+  border-radius: 12px;
+  padding: 16px;
+}
+`;
+function basic(v) {
+  return {
+    "plugin.json": JSON.stringify(
+      {
+        id: v.id,
+        name: v.name,
+        version: "1.0.0",
+        description: `${v.name} plugin`,
+        author: "Your name",
+        main: "./dist/main.mjs",
+        renderer: "./dist/renderer.js",
+        styles: ["./dist/index.css"],
+        activationEvents: [`onCommand:${v.slug}.hello`],
+        permissions: ["commands", "routes", "menus", "ui", "styles", "events"],
+        engines: { "fluxplugin": "^1.0.0" },
+        contributes: { commands: [{ id: `${v.slug}.hello`, title: `${v.name}: Say hello` }] }
+      },
+      null,
+      2
+    ),
+    "package.json": pkg(v),
+    "tsconfig.json": tsconfig,
+    "src/main.ts": `import { definePlugin } from "fluxplugin";
+
+export default definePlugin({
+  onActivate(ctx) {
+    ctx.logger.info("${v.name} (main) activated");
+  },
+});
+`,
+    "src/renderer.tsx": `import { definePlugin } from "fluxplugin";
+
+function ${v.Pascal}Page() {
+  return (
+    <div className="${v.slug}-card">
+      <h1>${v.name}</h1>
+      <p>Your first plugin page. Edit <code>src/renderer.tsx</code> and save.</p>
+    </div>
+  );
+}
+
+export default definePlugin({
+  routes: [
+    {
+      path: "/${v.slug}",
+      component: ${v.Pascal}Page,
+      meta: { title: "${v.name}", menu: { label: "${v.name}" } },
+    },
+  ],
+  commands: [
+    {
+      id: "${v.slug}.hello",
+      title: "${v.name}: Say hello",
+      execute: () => console.log("Hello from ${v.name}!"),
+    },
+  ],
+});
+`,
+    "src/styles/index.css": styles(v),
+    "README.md": `# ${v.name}
+
+Created with \`fluxplugin create\`.
+
+\`\`\`bash
+pnpm install
+pnpm dev       # rebuild on change (the host hot-reloads it)
+pnpm build
+pnpm package   # produces ${v.id}-1.0.0.tgz
+\`\`\`
+`
+  };
+}
+function dashboard(v) {
+  const files = basic(v);
+  const m = JSON.parse(files["plugin.json"]);
+  m.activationEvents = ["onStartup"];
+  m.contributes = {};
+  m.permissions = ["commands", "routes", "menus", "ui", "styles"];
+  files["plugin.json"] = JSON.stringify(m, null, 2);
+  files["src/renderer.tsx"] = `import { definePlugin } from "fluxplugin";
+import { usePluginState } from "fluxplugin/react";
+
+function ${v.Pascal}Widget() {
+  const [n, setN] = usePluginState("${v.id}", "clicks", 0);
+  return (
+    <div className="${v.slug}-card" data-testid="${v.slug}-widget">
+      <strong>${v.name}</strong>
+      <p>A widget injected into the host's <code>dashboard.after</code> slot.</p>
+      <button onClick={() => setN((c) => c + 1)}>Clicked {n} times</button>
+    </div>
+  );
+}
+
+function ${v.Pascal}Page() {
+  return <div className="${v.slug}-card"><h1>${v.name}</h1><p>Registered at runtime by a plugin.</p></div>;
+}
+
+export default definePlugin({
+  routes: [{ path: "/${v.slug}", lazy: async () => ({ default: ${v.Pascal}Page }), meta: { title: "${v.name}", breadcrumb: "${v.name}", menu: { label: "${v.name}" } } }],
+  components: [{ slot: "dashboard.after", component: ${v.Pascal}Widget, priority: 10 }],
+  // Data contribution to the host's "dashboard" extension point (validated by the host's schema).
+  extensions: [{ point: "dashboard", contribution: { toolbar: [{ id: "${v.slug}-hello", label: "${v.name}: hello", command: "${v.slug}.hello" }] } }],
+  commands: [{ id: "${v.slug}.hello", title: "${v.name}: say hello", category: "${v.name}", execute: () => console.log("Hello from ${v.name}!") }],
+});
+`;
+  return files;
+}
+function backend(v) {
+  const files = basic(v);
+  const m = JSON.parse(files["plugin.json"]);
+  m.activationEvents = [];
+  m.permissions = ["ipc", "services", "events", "commands", "routes", "menus", "ui", "styles", "storage"];
+  m.contributes = {};
+  files["plugin.json"] = JSON.stringify(m, null, 2);
+  files["src/main.ts"] = `import { definePlugin, defineIPC, s } from "fluxplugin";
+
+const Input = s.object({ name: s.string({ min: 1 }) });
+const Output = s.object({ message: s.string(), at: s.number() });
+
+export const hello = defineIPC({
+  name: "${v.slug}.hello",
+  input: Input,
+  output: Output,
+  handler: async ({ name }, ctx) => ({ message: \`Hello \${name} from \${ctx.pluginId}\`, at: Date.now() }),
+});
+
+export default definePlugin({
+  ipc: [hello],
+  // Exposed to the renderer as window.plugins.${v.slug}.hello(...)
+  preload: { ${v.slug}: { hello: "${v.slug}.hello" } },
+  services: { "${v.slug}": { now: () => Date.now() } },
+});
+`;
+  files["src/renderer.tsx"] = `import { definePlugin } from "fluxplugin";
+import { usePluginIPC } from "fluxplugin/react";
+
+function ${v.Pascal}Page() {
+  const { data, call, loading, error } = usePluginIPC<{ name: string }, { message: string }>("${v.slug}.hello", { caller: "${v.id}" });
+  return (
+    <div className="${v.slug}-card">
+      <button disabled={loading} onClick={() => void call({ name: "world" })}>Call main process</button>
+      {data && <p>{data.message}</p>}
+      {error && <p role="alert">{error.message}</p>}
+    </div>
+  );
+}
+
+export default definePlugin({
+  routes: [{ path: "/${v.slug}", component: ${v.Pascal}Page, meta: { title: "${v.name}", menu: { label: "${v.name}" } } }],
+});
+`;
+  return files;
+}
+var TEMPLATES = { basic, dashboard, backend };
+function varsFromName(name) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "my-plugin";
+  const id = slug.includes(".") ? slug : `com.example.${slug}`;
+  const short = slug.split(".").pop();
+  const Pascal = short.split(/[^a-z0-9]+/i).filter(Boolean).map((p) => p[0].toUpperCase() + p.slice(1)).join("");
+  return { id, name: short.split("-").map((p) => p[0].toUpperCase() + p.slice(1)).join(" "), slug: short.replace(/-/g, "_"), Pascal };
+}
+
+// src/cli/host-templates.ts
+function hostFiles(v, withSample = true) {
+  const files = {
+    "package.json": JSON.stringify(
+      {
+        name: v.name,
+        version: "0.1.0",
+        private: true,
+        type: "module",
+        main: "dist/main.cjs",
+        scripts: {
+          dev: "fluxplugin dev",
+          "dev:web": "fluxplugin dev --web",
+          build: "fluxplugin build",
+          start: "fluxplugin start",
+          "plugin:new": "fluxplugin plugin new",
+          typecheck: "tsc --noEmit"
+        },
+        dependencies: { fluxplugin: v.fluxSpec, react: "^19.0.0", "react-dom": "^19.0.0" },
+        devDependencies: { electron: "^33.0.0", typescript: "~5.9.3", "@types/node": "^22.10.0", "@types/react": "^19.0.0", "@types/react-dom": "^19.0.0" }
+      },
+      null,
+      2
+    ),
+    "fluxplugin.config.json": JSON.stringify({ pluginsDir: "plugins", outDir: "dist" }, null, 2),
+    "tsconfig.json": JSON.stringify(
+      { compilerOptions: { target: "ES2022", module: "ESNext", moduleResolution: "Bundler", jsx: "react-jsx", strict: true, noEmit: true, skipLibCheck: true, lib: ["ES2022", "DOM", "DOM.Iterable"], types: ["node"] }, include: ["src"] },
+      null,
+      2
+    ),
+    ".gitignore": "node_modules\ndist\n.flux-data\n*.tgz\n",
+    "src/index.html": `<!doctype html>
+<html><head><meta charset="utf-8"><title>${v.name}</title>
+<meta http-equiv="Content-Security-Policy" content="default-src 'self' fluxplugin:; script-src 'self' fluxplugin:; style-src 'self' 'unsafe-inline' fluxplugin:; connect-src 'self'; img-src 'self' data:">
+<style>body{margin:0;font:14px system-ui}</style></head>
+<body><div id="root"></div><script type="module" src="./renderer.js"></script></body></html>
+`,
+    "src/framework.ts": `import { MainFramework } from "fluxplugin/main";
+import { s } from "fluxplugin";
+
+/** Shared by Electron (main.ts) and browser mode (web.ts). Put host-side setup here. */
+export function createFramework(opts: { pluginDirs: string[]; dataDir: string; dev?: boolean; assetUrl?: (id: string, rel: string) => string }) {
+  const fw = new MainFramework({
+    pluginDirs: opts.pluginDirs,
+    dataDir: opts.dataDir,
+    hotReload: opts.dev,
+    assetUrl: opts.assetUrl,
+    requireApproval: false, // set true to make users approve each plugin's permissions
+    allowedRendererChannels: ["host.item.create"],
+  });
+
+  // A host operation wrapped in the hook pipeline: plugins can validate, normalize or veto it
+  // (before./transform./after.item.create) without changing this file.
+  fw.manager.ipc.handle(
+    "host.item.create",
+    (input: { name: string }) =>
+      fw.manager.hooks.run("item.create", input, (i) => {
+        const item = { id: Math.random().toString(36).slice(2, 8), name: i.name };
+        fw.manager.events.emit("item.created", item, "host");
+        return item as Record<string, unknown>;
+      }),
+    "host",
+    { input: s.object({ name: s.string() }) },
+  );
+  return fw;
+}
+`,
+    "src/main.ts": `// Electron main process.
+import { app, BrowserWindow, ipcMain, protocol, webContents } from "electron";
+import path from "node:path";
+import { PLUGIN_SCHEME, attachElectron, registerPluginProtocol } from "fluxplugin/main";
+import { createFramework } from "./framework.js";
+
+protocol.registerSchemesAsPrivileged([PLUGIN_SCHEME]); // must run before app is ready
+
+app.whenReady().then(async () => {
+  const dev = !!process.env["FLUXPLUGIN_DEV"];
+  const root = process.env["FLUXPLUGIN_PROJECT"] ?? path.resolve(__dirname, "..");
+  const fw = createFramework({
+    pluginDirs: [path.join(root, "plugins"), path.join(app.getPath("userData"), "plugins")], // bundled + user-installed
+    dataDir: path.join(app.getPath("userData"), "plugins-data"),
+    dev,
+  });
+  registerPluginProtocol(fw, protocol);
+  attachElectron(fw, { ipcMain: ipcMain as never, webContents: webContents as never });
+  await fw.start();
+
+  const win = new BrowserWindow({
+    width: 1100,
+    height: 760,
+    webPreferences: { preload: path.join(__dirname, "preload.cjs"), contextIsolation: true, sandbox: true, nodeIntegration: false },
+  });
+  win.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
+  win.webContents.on("will-navigate", (e) => e.preventDefault());
+  await win.loadFile(path.join(__dirname, "index.html"));
+  app.on("before-quit", () => void fw.stop());
+});
+app.on("window-all-closed", () => app.quit());
+`,
+    "src/preload.ts": `import { contextBridge, ipcRenderer } from "electron";
+import { exposeFluxBridge } from "fluxplugin/preload";
+
+exposeFluxBridge(contextBridge, ipcRenderer); // the only thing renderer code receives: window.__fluxplugin
+`,
+    "src/web.ts": `// Browser mode (no Electron): \`fluxplugin dev --web\`.
+import path from "node:path";
+import { serveWeb } from "fluxplugin/main";
+import { createFramework } from "./framework.js";
+
+const root = process.env["FLUXPLUGIN_PROJECT"] ?? process.cwd();
+const fw = createFramework({
+  pluginDirs: [path.join(root, "plugins")],
+  dataDir: path.join(root, ".flux-data"),
+  dev: true,
+  assetUrl: (id, rel) => \`/@plugins/\${id}/\${rel.replace(/^\\.\\//, "")}\`,
+});
+await fw.start();
+const srv = await serveWeb(fw, { distDir: path.join(root, "dist"), port: Number(process.env["PORT"] ?? 5173) });
+console.log(\`${v.name} \u2192 http://127.0.0.1:\${srv.port}\`);
+`,
+    "src/renderer.tsx": renderer(v.name),
+    "README.md": `# ${v.name}
+
+Created with [fluxplugin](https://www.npmjs.com/package/fluxplugin).
+
+\`\`\`bash
+npm install
+npm run dev:web      # in a browser, no Electron needed
+npm run dev          # in Electron (hot reload for plugins)
+npm run build && npm start
+npm run plugin:new my-plugin -- -t backend    # scaffold a plugin in ./plugins
+\`\`\`
+
+* \`src/renderer.tsx\` \u2014 your React UI. \`<PluginSlot name="\u2026"/>\` and extension points are where plugins plug in.
+* \`src/framework.ts\` \u2014 host-side setup (permissions policy, host operations exposed to plugins, hooks).
+* \`plugins/\` \u2014 plugins loaded at startup; users can also install \`.tgz\` plugins from the Plugins page.
+`
+  };
+  if (withSample) {
+    const sample = TEMPLATES.dashboard(varsFromName("hello"));
+    for (const [rel, content] of Object.entries(sample)) {
+      if (rel === "package.json" || rel === "tsconfig.json" || rel === "README.md") continue;
+      files[`plugins/hello/${rel}`] = content;
+    }
+  }
+  return files;
+}
+var renderer = (app) => `import React from "react";
+import { createRoot } from "react-dom/client";
+import * as jsxRuntime from "react/jsx-runtime";
+import * as ReactDOMClient from "react-dom/client";
+import * as flux from "fluxplugin";
+import * as fluxReact from "fluxplugin/react";
+import { s, type FluxBridge } from "fluxplugin";
+import {
+  Breadcrumbs, CommandPalette, Link, PluginProvider, PluginRoutes, PluginSlot, RendererFramework, StyleHost,
+  baseCss, createHttpBridge, installSharedModules, useExtensionItems, useKeybindings, useMenu,
+} from "fluxplugin/react";
+import { PluginManagerUI } from "fluxplugin/manager-ui";
+
+// One copy of React and of the runtime, shared with plugin bundles (they import these from globalThis).
+installSharedModules({
+  react: React, "react/jsx-runtime": jsxRuntime, "react/jsx-dev-runtime": jsxRuntime, "react-dom/client": ReactDOMClient,
+  fluxplugin: flux, "fluxplugin/react": fluxReact,
+});
+
+// Electron: the preload bridge. Browser mode: HTTP bridge to \`fluxplugin dev --web\`.
+const bridge: FluxBridge = (window as unknown as { __fluxplugin?: FluxBridge }).__fluxplugin ?? createHttpBridge();
+const framework = new RendererFramework({ bridge });
+
+// Declare extension points BEFORE plugins start. Plugins contribute validated data to them.
+framework.manager.extensionPoints.declare({
+  name: "dashboard",
+  contributions: { toolbar: s.object({ id: s.string(), label: s.string(), command: s.string().optional() }) },
+});
+
+const css = baseCss + \`
+body{background:var(--flux-bg);color:var(--flux-fg)}
+.app{display:grid;grid-template-columns:220px 1fr;min-height:100vh}
+.side{border-right:1px solid var(--flux-border);padding:16px;background:var(--flux-surface)}
+.side a{display:block;padding:7px 10px;border-radius:8px;color:inherit;text-decoration:none;margin:2px 0}
+.side a[data-active]{background:var(--flux-accent);color:#fff}.side h1{font-size:16px;margin:0 0 14px}
+.main{padding:24px;max-width:860px}.row{display:flex;gap:8px;margin:12px 0}
+.btn{border:1px solid var(--flux-border);background:var(--flux-bg);color:inherit;border-radius:8px;padding:6px 12px;cursor:pointer}
+.hint{color:var(--flux-muted);font-size:12px}\`;
+
+function Dashboard() {
+  const tools = useExtensionItems<{ id: string; label: string; command?: string }>("dashboard", "toolbar");
+  const [out, setOut] = React.useState("");
+  const create = async (name: string) => {
+    try { setOut(JSON.stringify(await bridge.invoke("host.item.create", { name }))); }
+    catch (e) { setOut("blocked: " + (e as Error).message); }
+  };
+  return (
+    <div>
+      <h2>Dashboard</h2>
+      <PluginSlot name="dashboard.before" />
+      <p className="hint">These buttons are contributed by plugins through a host-declared extension point.</p>
+      <div className="row" data-testid="toolbar">
+        {tools.map((t) => <button key={t.id} className="btn" onClick={() => t.command && void framework.manager.commands.execute(t.command)}>{t.label}</button>)}
+      </div>
+      <div className="row">
+        <button className="btn" onClick={() => void create("  Ada  ")}>Create item \u201C  Ada  \u201D (plugin hooks may rewrite it)</button>
+        <button className="btn" onClick={() => void create("   ")}>Create empty item (a plugin may veto)</button>
+      </div>
+      <pre data-testid="hook-result" className="hint">{out}</pre>
+      <PluginSlot name="dashboard.after" />
+    </div>
+  );
+}
+
+function Shell() {
+  useKeybindings();
+  const { items, run } = useMenu("sidebar");
+  return (
+    <div className="app">
+      <aside className="side">
+        <h1>${"${APP}"} <PluginSlot name="header.badges" /></h1>
+        <Link to="/">Dashboard</Link>
+        {items.map((i) => <a key={i.id} href={"#" + i.path} onClick={(e) => { e.preventDefault(); run(i); }}>{i.label}</a>)}
+        <Link to="/plugins">Plugins</Link>
+        <p className="hint">Ctrl/Cmd+K: commands</p>
+      </aside>
+      <main className="main"><Breadcrumbs /><PluginRoutes /></main>
+      <CommandPalette />
+    </div>
+  );
+}
+
+framework.manager.routes.register({ path: "/", component: Dashboard, meta: { title: "Dashboard" } }, "host");
+framework.manager.routes.register({ path: "/plugins", component: PluginManagerUI, meta: { title: "Plugins", breadcrumb: "Plugins" } }, "host");
+
+await framework.start();
+(window as unknown as Record<string, unknown>)["__framework"] = framework;
+createRoot(document.getElementById("root")!).render(
+  <PluginProvider framework={framework}><style>{css}</style><StyleHost /><Shell /></PluginProvider>,
+);
+`.replace("${APP}", app);
+
+// src/cli/cli.ts
+var HELP = `fluxplugin <command>
+
+  init [dir]                      create a new app (Electron + React) that supports plugins
+  dev [--web]                     run your app with plugin hot reload (Electron, or a browser with --web)
+  build                           bundle your app (in an app folder) or a plugin (in a plugin folder)
+  start [--web]                   run the built app
+  plugin new <name> [-t basic|dashboard|backend]   scaffold a plugin (alias: create)
+  validate [dir]                  check a plugin manifest, entries and integrity
+  package [dir] [--out d] [--sign-key file]   build + integrity (+ signature) + .tgz
+  install <dir|.tgz> [--dir plugins]   uninstall <id>   enable <id>   disable <id>   list
+  keygen [--out name]    create an ed25519 signing key pair
+  tailwind [--dir plugins] [--out file]   generate @source lines for Tailwind v4`;
+var log = (...a) => console.log(...a);
+async function readManifest(root) {
+  return JSON.parse(await fs4.readFile(path5.join(root, "plugin.json"), "utf8"));
+}
+async function run(argv) {
+  const { values: f, positionals: pos } = parseArgs({
+    args: argv,
+    allowPositionals: true,
+    options: { template: { type: "string", short: "t" }, out: { type: "string" }, dir: { type: "string" }, data: { type: "string" }, "sign-key": { type: "string" }, help: { type: "boolean", short: "h" }, web: { type: "boolean" }, port: { type: "string" }, name: { type: "string" }, "no-sample": { type: "boolean" } }
+  });
+  let [cmd, arg] = pos;
+  if (cmd === "plugin") {
+    const sub = pos[1];
+    if (sub !== "new") throw new Error("usage: fluxplugin plugin new <name>");
+    cmd = "create";
+    arg = pos[2];
+  }
+  if (!cmd || f.help) return log(HELP), cmd ? 0 : 1;
+  const root = path5.resolve(arg ?? ".");
+  try {
+    switch (cmd) {
+      case "init": {
+        const target = path5.resolve(arg ?? ".");
+        const entries = await fs4.readdir(target).catch(() => []);
+        if (entries.length) throw new Error(`${target} is not empty`);
+        const name = (f.name ?? path5.basename(target)).toLowerCase().replace(/[^a-z0-9-_.]+/g, "-");
+        const files = hostFiles({ name, fluxSpec: process.env["FLUXPLUGIN_SPEC"] ?? `^${await ownVersion()}` }, !f["no-sample"]);
+        for (const [rel2, content] of Object.entries(files)) {
+          await fs4.mkdir(path5.dirname(path5.join(target, rel2)), { recursive: true });
+          await fs4.writeFile(path5.join(target, rel2), content);
+        }
+        const rel = path5.relative(process.cwd(), target) || ".";
+        log(`\u2714 created ${name} in ${target}
+
+Next steps:
+  ${rel === "." ? "" : `cd ${rel}
+  `}npm install
+  npm run dev:web     # browser mode (no Electron needed)
+  npm run dev         # Electron
+
+Add a plugin:  npm run plugin:new my-plugin -- -t backend`);
+        return 0;
+      }
+      case "create": {
+        if (!arg) throw new Error("usage: fluxplugin plugin new <name> [-t basic|dashboard|backend]");
+        const tpl = f.template ?? "basic";
+        if (!(tpl in TEMPLATES)) throw new Error(`unknown template "${tpl}"`);
+        const base = await isHostProject(process.cwd()) && !path5.isAbsolute(arg) && !arg.includes("/") ? path5.join((await loadConfig({}, process.cwd())).pluginsDir, arg) : path5.resolve(arg);
+        if (await fs4.stat(base).catch(() => null)) throw new Error(`${base} already exists`);
+        const files = TEMPLATES[tpl](varsFromName(path5.basename(base)));
+        for (const [rel, content] of Object.entries(files)) {
+          await fs4.mkdir(path5.dirname(path5.join(base, rel)), { recursive: true });
+          await fs4.writeFile(path5.join(base, rel), content);
+        }
+        log(`\u2714 created ${tpl} plugin in ${base}
+  next: fluxplugin build ${path5.relative(process.cwd(), base)}`);
+        return 0;
+      }
+      case "build": {
+        if (!arg && await isHostProject(process.cwd())) {
+          await buildHost(process.cwd());
+          return 0;
+        }
+        await buildPlugin(root);
+        return 0;
+      }
+      case "dev": {
+        const cwd = process.cwd();
+        if (arg || !await isHostProject(cwd)) {
+          await buildPlugin(root, true);
+          await new Promise(() => {
+          });
+        }
+        const dispose = await buildHost(cwd, { watch: true });
+        const { child, mode } = startApp(cwd, { web: f.web, dev: true, port: f.port ? Number(f.port) : void 0 });
+        log(`running in ${mode} mode \u2014 edit a plugin and it reloads; Ctrl+C to stop`);
+        const stop = () => {
+          child.kill();
+          void dispose().finally(() => process.exit(0));
+        };
+        process.on("SIGINT", stop);
+        process.on("SIGTERM", stop);
+        return await new Promise((r) => child.on("exit", (c) => r(c ?? 0)));
+      }
+      case "start": {
+        const cwd = process.cwd();
+        if (!await fs4.stat(path5.join(cwd, "dist/index.html")).catch(() => null)) throw new Error("nothing built yet: run `fluxplugin build` first");
+        const { child } = startApp(cwd, { web: f.web, port: f.port ? Number(f.port) : void 0 });
+        return await new Promise((r) => child.on("exit", (c) => r(c ?? 0)));
+      }
+      case "validate":
+        return validate(root);
+      case "package":
+        return pack(root, f.out, f["sign-key"]);
+      case "keygen": {
+        const k = generateSigningKeyPair();
+        const base = f.out ?? "flux-signing";
+        await fs4.writeFile(`${base}.private.key`, k.privateKey, { mode: 384 });
+        await fs4.writeFile(`${base}.public.key`, k.publicKey);
+        log(`wrote ${base}.private.key (keep secret) and ${base}.public.key (distribute to hosts as a trusted key)`);
+        return 0;
+      }
+      case "tailwind": {
+        const cfg = await loadConfig(f);
+        const names = (await fs4.readdir(cfg.pluginsDir).catch(() => [])).sort();
+        const lines = names.map((n) => `@source "${path5.join(cfg.pluginsDir, n, "src").replace(/\\/g, "/")}";`);
+        const css = `/* generated by fluxplugin tailwind */
+${lines.join("\n")}
+`;
+        if (f.out) await fs4.writeFile(f.out, css);
+        else log(css);
+        return 0;
+      }
+      case "install":
+      case "uninstall":
+      case "enable":
+      case "disable":
+      case "list":
+        return manage(cmd, arg, f);
+      default:
+        log(HELP);
+        return 1;
+    }
+  } catch (e) {
+    console.error(`error: ${e.message}`);
+    return 1;
+  }
+}
+async function validate(root) {
+  const raw = await readManifest(root);
+  const v = validateManifest(raw);
+  let bad = !v.ok;
+  v.issues.forEach((i) => log(`\u2716 ${i.path || "<root>"}: ${i.message}`));
+  v.warnings.forEach((w) => log(`! ${w}`));
+  if (v.manifest) {
+    for (const rel of [v.manifest.main, v.manifest.renderer, ...v.manifest.styles ?? []].filter(Boolean))
+      if (!await fs4.stat(path5.join(root, rel)).catch(() => null)) log(`\u2716 missing file ${rel} (run build)`), bad = true;
+    try {
+      await verifyPlugin(root, raw, v.manifest);
+    } catch (e) {
+      log(`\u2716 ${e.message}`);
+      bad = true;
+    }
+  }
+  log(bad ? "invalid" : `\u2714 ${v.manifest?.id}@${v.manifest?.version} is valid`);
+  return bad ? 1 : 0;
+}
+async function pack(root, out = ".", keyFile) {
+  await buildPlugin(root);
+  let raw = await readManifest(root);
+  const m = validateManifest(raw).manifest;
+  if (!m) throw new Error("invalid manifest");
+  raw["integrity"] = await computeIntegrity(root, m);
+  if (keyFile) raw = signManifest(raw, (await fs4.readFile(keyFile, "utf8")).trim());
+  const stage = await fs4.mkdtemp(path5.join((await import("node:os")).tmpdir(), "flux-pack-"));
+  await copyDir(root, stage);
+  await fs4.rm(path5.join(stage, "src"), { recursive: true, force: true });
+  await fs4.writeFile(path5.join(stage, "plugin.json"), JSON.stringify(raw, null, 2));
+  const buf = await createTarGz(stage);
+  await fs4.rm(stage, { recursive: true, force: true });
+  await fs4.mkdir(out, { recursive: true });
+  const file = path5.join(out, `${m.id}-${m.version}.tgz`);
+  await fs4.writeFile(file, buf);
+  log(`packaged ${file}
+  sha256 ${crypto.createHash("sha256").update(buf).digest("hex")}${keyFile ? "\n  signed" : ""}`);
+  return 0;
+}
+async function manage(cmd, arg, f) {
+  const cfg = await loadConfig(f);
+  const state = new JsonStateFile(path5.join(cfg.dataDir, "plugins-state.json"));
+  const inst = new PluginInstaller(cfg.pluginsDir, path5.join(cfg.dataDir, "backups"));
+  if (cmd === "list") {
+    const { disabled } = await state.readAll();
+    for (const m of await inst.installed()) log(`${disabled.includes(m.id) ? "\u25CB" : "\u25CF"} ${m.id}@${m.version}  ${m.name}`);
+    return 0;
+  }
+  if (!arg) throw new Error(`usage: ${cmd} <${cmd === "install" ? "dir|.tgz" : "id"}>`);
+  if (cmd === "install") {
+    const tmp = path5.join(cfg.dataDir, ".install", String(Date.now()));
+    if (arg.endsWith(".tgz")) await extractTarGz(await fs4.readFile(arg), tmp);
+    else await copyDir(path5.resolve(arg), tmp);
+    const v = validateManifest(await readManifest(tmp));
+    if (!v.manifest) throw new Error("invalid plugin: " + v.issues.map((i) => i.message).join("; "));
+    const reg = new LocalRegistry(path5.dirname(tmp), "cli");
+    inst.addRegistry(reg);
+    const [entry] = (await reg.search(v.manifest.id)).filter((e) => e.id === v.manifest.id);
+    const r = await inst.install({ ...entry, location: tmp });
+    await fs4.rm(tmp, { recursive: true, force: true });
+    log(`installed ${r.id}@${r.version}${r.previousVersion ? ` (was ${r.previousVersion}; rollback available)` : ""}`);
+  } else if (cmd === "uninstall") {
+    await inst.uninstall(arg);
+    log(`uninstalled ${arg}`);
+  } else {
+    await state.update((s) => ({ disabled: cmd === "disable" ? [.../* @__PURE__ */ new Set([...s.disabled, arg])] : s.disabled.filter((x) => x !== arg) }));
+    log(`${cmd}d ${arg}`);
+  }
+  return 0;
+}
+async function ownVersion() {
+  for (const rel of ["../package.json", "../../package.json"]) {
+    try {
+      const j = JSON.parse(await fs4.readFile(new URL(rel, import.meta.url), "utf8"));
+      if (j.name === "fluxplugin" && j.version) return j.version;
+    } catch {
+    }
+  }
+  return "1.0.0";
+}
+export {
+  SHARED_MODULES,
+  TEMPLATES,
+  buildHost,
+  buildPlugin,
+  hostFiles,
+  isHostProject,
+  run,
+  sharedModulesPlugin,
+  startApp,
+  varsFromName
+};