fluxplugin 1.0.3 → 1.0.4

package/dist/cli.js

@@ -24,14 +24,14 @@ __export(tailwind_exports, {
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
-import path7 from "node:path";
+import path9 from "node:path";
 function resolveTailwindCli(startDirs) {
   for (const dir of startDirs) {
     try {
-      const pj = createRequire(path7.join(dir, "package.json")).resolve("@tailwindcss/cli/package.json");
+      const pj = createRequire(path9.join(dir, "package.json")).resolve("@tailwindcss/cli/package.json");
       const pkg2 = JSON.parse(readFileSync(pj, "utf8"));
       const rel = typeof pkg2.bin === "string" ? pkg2.bin : Object.values(pkg2.bin ?? {})[0];
-      if (rel) return path7.join(path7.dirname(pj), rel);
+      if (rel) return path9.join(path9.dirname(pj), rel);
     } catch {
     }
   }
@@ -44,13 +44,13 @@ function compileTailwind(opts, log2 = console.log) {
   if (!opts.watch) {
     const r = spawnSync(process.execPath, args, { cwd: opts.cwd, encoding: "utf8" });
     if (r.status !== 0) throw new Error(`tailwind failed: ${(r.stderr || r.stdout || "").trim().split("\n").slice(-3).join(" ")}`);
-    log2(`tailwind \u2192 ${path7.relative(opts.cwd, opts.output)}`);
+    log2(`tailwind \u2192 ${path9.relative(opts.cwd, opts.output)}`);
     return () => {
     };
   }
   const child = spawn(process.execPath, [...args, "--watch=always"], { cwd: opts.cwd, stdio: ["ignore", "ignore", "pipe"] });
   child.stderr?.on("data", (d) => /error/i.test(String(d)) && log2("tailwind: " + String(d).trim()));
-  log2(`tailwind watching ${path7.relative(opts.cwd, opts.input)}`);
+  log2(`tailwind watching ${path9.relative(opts.cwd, opts.input)}`);
   return () => void child.kill();
 }
 var init_tailwind = __esm({
@@ -61,17 +61,231 @@ var init_tailwind = __esm({
 
 // src/cli/cli.ts
 import { parseArgs } from "node:util";
-import { promises as fs11 } from "node:fs";
-import path14 from "node:path";
+import { promises as fs13 } from "node:fs";
+import path17 from "node:path";
+
+// src/core/index.ts
+var core_exports = {};
+__export(core_exports, {
+  BUILTIN_PERMISSIONS: () => BUILTIN_PERMISSIONS,
+  CHANNELS: () => CHANNELS,
+  CommandRegistry: () => CommandRegistry,
+  DisposableStore: () => DisposableStore,
+  EventBus: () => EventBus,
+  ExtensionPointRegistry: () => ExtensionPointRegistry,
+  FRAMEWORK_ENGINE_KEY: () => FRAMEWORK_ENGINE_KEY,
+  FRAMEWORK_VERSION: () => FRAMEWORK_VERSION,
+  FrameworkError: () => FrameworkError,
+  HookCancelledError: () => HookCancelledError,
+  HookSystem: () => HookSystem,
+  IpcError: () => IpcError,
+  IpcRegistry: () => IpcRegistry,
+  LifecycleError: () => LifecycleError,
+  LogStore: () => LogStore,
+  MGMT: () => MGMT,
+  MemoryStorageBackend: () => MemoryStorageBackend,
+  MenuRegistry: () => MenuRegistry,
+  NotificationCenter: () => NotificationCenter,
+  PermissionDeniedError: () => PermissionDeniedError,
+  PermissionManager: () => PermissionManager,
+  PluginManager: () => PluginManager,
+  PreloadRegistry: () => PreloadRegistry,
+  Registry: () => Registry,
+  RouteRegistry: () => RouteRegistry,
+  ServiceRegistry: () => ServiceRegistry,
+  SlotRegistry: () => SlotRegistry,
+  StyleRegistry: () => StyleRegistry,
+  TimeoutError: () => TimeoutError,
+  ValidationError: () => ValidationError,
+  activationOrderFor: () => activationOrderFor,
+  buildDependencyGraph: () => buildDependencyGraph,
+  compareVersions: () => compareVersions,
+  createPluginConfig: () => createPluginConfig,
+  createPluginState: () => createPluginState,
+  createPluginStorage: () => createPluginStorage,
+  defineCommand: () => defineCommand,
+  defineComponent: () => defineComponent,
+  defineEvent: () => defineEvent,
+  defineHook: () => defineHook,
+  defineIPC: () => defineIPC,
+  defineIpcContract: () => defineIpcContract,
+  defineMenu: () => defineMenu,
+  definePlugin: () => definePlugin,
+  defineRoute: () => defineRoute,
+  defineService: () => defineService,
+  dependentsOf: () => dependentsOf,
+  describeIssue: () => describeIssue,
+  errorMessage: () => errorMessage,
+  hasPluginApi: () => hasPluginApi,
+  isValidRange: () => isValidRange,
+  isValidVersion: () => isValidVersion,
+  manifestSchema: () => manifestSchema,
+  matchesPattern: () => matchesPattern,
+  menuLocations: () => menuLocations,
+  normalizePath: () => normalizePath,
+  parseOrThrow: () => parseOrThrow,
+  parseVersion: () => parseVersion,
+  parseVideo: () => parseVideo,
+  pluginApi: () => pluginApi,
+  preloadMember: () => preloadMember,
+  routePatternMatches: () => routePatternMatches,
+  s: () => s,
+  satisfies: () => satisfies,
+  scopeCss: () => scopeCss,
+  serializeError: () => serializeError,
+  toDisposable: () => toDisposable,
+  validateManifest: () => validateManifest,
+  videoEmbedUrl: () => videoEmbedUrl,
+  withTimeout: () => withTimeout
+});
+
+// src/core/common.ts
+var toDisposable = (fn) => {
+  let done = false;
+  return {
+    dispose() {
+      if (done) return;
+      done = true;
+      fn();
+    }
+  };
+};
+var DisposableStore = class {
+  items = [];
+  disposed = false;
+  add(d) {
+    if (this.disposed) d.dispose();
+    else this.items.push(d);
+    return d;
+  }
+  get size() {
+    return this.items.length;
+  }
+  dispose() {
+    this.disposed = true;
+    const items = this.items.splice(0).reverse();
+    for (const d of items) {
+      try {
+        d.dispose();
+      } catch {
+      }
+    }
+  }
+  /** Re-arms the store so it can be reused after a deactivate/activate cycle. */
+  reset() {
+    this.dispose();
+    this.disposed = false;
+  }
+};
+var FrameworkError = class extends Error {
+  constructor(message, code, pluginId, options) {
+    super(message, options);
+    this.code = code;
+    this.pluginId = pluginId;
+    this.name = new.target.name;
+  }
+  code;
+  pluginId;
+};
+var PermissionDeniedError = class extends FrameworkError {
+  constructor(pluginId, permission, api) {
+    super(`Plugin "${pluginId}" is not allowed to use ${api} (missing permission "${permission}")`, "FLUX_PERMISSION_DENIED", pluginId);
+    this.permission = permission;
+  }
+  permission;
+};
+var LifecycleError = class extends FrameworkError {
+  constructor(pluginId, phase, message, cause) {
+    super(`[${pluginId}] ${phase}: ${message}`, "FLUX_LIFECYCLE", pluginId, { cause });
+    this.phase = phase;
+  }
+  phase;
+};
+var TimeoutError = class extends FrameworkError {
+  constructor(what, ms, pluginId) {
+    super(`${what} timed out after ${ms}ms`, "FLUX_TIMEOUT", pluginId);
+  }
+};
+var HookCancelledError = class extends FrameworkError {
+  constructor(operation, reason) {
+    super(`Operation "${operation}" was cancelled by a hook${reason ? `: ${reason}` : ""}`, "FLUX_HOOK_CANCELLED");
+    this.operation = operation;
+    this.reason = reason;
+  }
+  operation;
+  reason;
+};
+function withTimeout(p, ms, what, pluginId) {
+  if (!Number.isFinite(ms) || ms <= 0) return Promise.resolve(p);
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(() => reject(new TimeoutError(what, ms, pluginId)), ms);
+    Promise.resolve(p).then(
+      (v) => {
+        clearTimeout(t);
+        resolve(v);
+      },
+      (e) => {
+        clearTimeout(t);
+        reject(e);
+      }
+    );
+  });
+}
+var LogStore = class {
+  constructor(capacity = 2e3, sink) {
+    this.capacity = capacity;
+    this.sink = sink;
+  }
+  capacity;
+  sink;
+  entries = [];
+  listeners = /* @__PURE__ */ new Set();
+  write(entry) {
+    this.entries.push(entry);
+    if (this.entries.length > this.capacity) this.entries.splice(0, this.entries.length - this.capacity);
+    this.sink?.(entry);
+    for (const l of this.listeners) {
+      try {
+        l(entry);
+      } catch {
+      }
+    }
+  }
+  logger(source) {
+    const mk = (level) => (message, data) => this.write({ level, source, message, time: Date.now(), data });
+    return { debug: mk("debug"), info: mk("info"), warn: mk("warn"), error: mk("error") };
+  }
+  query(filter = {}) {
+    return this.entries.filter((e) => (!filter.source || e.source === filter.source) && (!filter.level || e.level === filter.level));
+  }
+  subscribe(l) {
+    this.listeners.add(l);
+    return toDisposable(() => this.listeners.delete(l));
+  }
+  clear(source) {
+    this.entries = source ? this.entries.filter((e) => e.source !== source) : [];
+  }
+};
+function errorMessage(e) {
+  return e instanceof Error ? e.message : String(e);
+}
 
 // src/core/schema.ts
+var ValidationError = class extends Error {
+  constructor(issues, what = "value") {
+    super(`Invalid ${what}: ` + issues.map((i) => `${i.path || "<root>"}: ${i.message}`).join("; "));
+    this.issues = issues;
+    this.name = "ValidationError";
+  }
+  issues;
+};
 var ok = (value) => ({ ok: true, value });
-var fail = (path15, message) => ({ ok: false, issues: [{ path: path15, message }] });
+var fail = (path18, message) => ({ ok: false, issues: [{ path: path18, message }] });
 var join = (p, k) => p ? typeof k === "number" ? `${p}[${k}]` : `${p}.${k}` : String(k);
 function make(kind, parse, describe) {
   const self = {
     kind,
-    parse: (input, path15 = "") => parse(input, path15),
+    parse: (input, path18 = "") => parse(input, path18),
     describe,
     optional() {
       return make(
@@ -238,6 +452,11 @@ var s = {
     return s.custom((v) => typeof v === "function", "expected function");
   }
 };
+function parseOrThrow(schema, input, what) {
+  const r = schema.parse(input);
+  if (!r.ok) throw new ValidationError(r.issues, what);
+  return r.value;
+}
 
 // src/core/semver.ts
 var SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
@@ -454,7 +673,7 @@ var manifestSchema = s.object({
   /** Detailed description as Markdown (default: ./README.md). Rendered safely: no raw HTML. */
   readme: s.string().optional(),
   /** Explanation video (https URL; YouTube and Vimeo are embedded, other hosts become a link). */
-  video: s.string({ pattern: /^https:\/\/\S+$/ }).optional(),
+  video: s.string({ pattern: /^(https:\/\/\S+|\.\/\S+)$/ }).optional(),
   categories: s.array(s.string()).default([]),
   keywords: s.array(s.string()).default([]),
   /** Extra links: docs, support, changelog, funding... */
@@ -509,13 +728,2039 @@ function validateManifest(raw, opts = {}) {
   if (!manifest.main && !manifest.renderer && !manifest.preload) {
     issues.push({ path: "", message: "at least one of main, preload or renderer entry is required" });
   }
-  if (!required) warnings.push(`engines.${FRAMEWORK_ENGINE_KEY} is not declared; compatibility cannot be verified`);
-  for (const dep of Object.keys(manifest.dependencies ?? {})) {
-    if (dep === manifest.id) issues.push({ path: `dependencies.${dep}`, message: "a plugin cannot depend on itself" });
+  if (!required) warnings.push(`engines.${FRAMEWORK_ENGINE_KEY} is not declared; compatibility cannot be verified`);
+  for (const dep of Object.keys(manifest.dependencies ?? {})) {
+    if (dep === manifest.id) issues.push({ path: `dependencies.${dep}`, message: "a plugin cannot depend on itself" });
+  }
+  return { ok: issues.length === 0, manifest: issues.length ? void 0 : manifest, issues, warnings };
+}
+var MEDIA_EXT = /\.(mp4|m4v|webm|ogv|ogg|mov)(\?.*)?$/i;
+function parseVideo(url) {
+  if (!url) return void 0;
+  if (url.startsWith("./")) return MEDIA_EXT.test(url) ? { kind: "html5", url, src: url } : void 0;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return void 0;
+  }
+  if (u.protocol !== "https:") return void 0;
+  if (MEDIA_EXT.test(u.pathname)) return { kind: "html5", url, src: url };
+  const host = u.hostname.replace(/^www\./, "");
+  const last = u.pathname.split("/").filter(Boolean).pop() ?? "";
+  let id;
+  if (host === "youtu.be") id = u.pathname.slice(1);
+  else if (host === "youtube.com" || host === "m.youtube.com" || host === "youtube-nocookie.com") id = u.searchParams.get("v") ?? (/^\/(embed|shorts|live)\//.test(u.pathname) ? u.pathname.split("/")[2] : void 0);
+  if (id && /^[\w-]{6,20}$/.test(id)) return { kind: "youtube", url, embedUrl: `https://www.youtube-nocookie.com/embed/${id}` };
+  if ((host === "vimeo.com" || host === "player.vimeo.com") && /^\d+$/.test(last)) return { kind: "vimeo", url, embedUrl: `https://player.vimeo.com/video/${last}` };
+  if (host === "dailymotion.com" && /^\/(embed\/)?video\//.test(u.pathname) && /^\w+$/.test(last)) return { kind: "dailymotion", url, embedUrl: `https://www.dailymotion.com/embed/video/${last}` };
+  if (host === "dai.ly" && /^\w+$/.test(last)) return { kind: "dailymotion", url, embedUrl: `https://www.dailymotion.com/embed/video/${last}` };
+  if (host === "loom.com" && /^\/(share|embed)\//.test(u.pathname) && /^[\w-]+$/.test(last)) return { kind: "loom", url, embedUrl: `https://www.loom.com/embed/${last}` };
+  if (host === "streamable.com" && /^\w+$/.test(last)) return { kind: "streamable", url, embedUrl: `https://streamable.com/e/${last}` };
+  return { kind: "link", url };
+}
+function videoEmbedUrl(url) {
+  return parseVideo(url)?.embedUrl;
+}
+
+// src/core/events.ts
+function matchesPattern(pattern, name) {
+  if (pattern === "*" || pattern === "**") return true;
+  if (pattern === name) return true;
+  if (!pattern.includes("*")) return false;
+  const p = pattern.split(".");
+  const n = name.split(".");
+  for (let i = 0; i < p.length; i++) {
+    const seg = p[i];
+    if (seg === "*") {
+      if (i === p.length - 1) return n.length > i;
+      if (n[i] === void 0) return false;
+      continue;
+    }
+    if (n[i] !== seg) return false;
+  }
+  return p.length === n.length;
+}
+var EventBus = class {
+  constructor(onError = () => {
+  }) {
+    this.onError = onError;
+  }
+  onError;
+  entries = [];
+  seq = 0;
+  on(pattern, listener, opts = {}) {
+    const entry = {
+      pattern,
+      segments: pattern.split("."),
+      listener,
+      priority: opts.priority ?? 0,
+      once: opts.once ?? false,
+      seq: this.seq++
+    };
+    this.entries.push(entry);
+    return toDisposable(() => {
+      const i = this.entries.indexOf(entry);
+      if (i >= 0) this.entries.splice(i, 1);
+    });
+  }
+  once(pattern, listener, opts = {}) {
+    return this.on(pattern, listener, { ...opts, once: true });
+  }
+  off(pattern, listener) {
+    this.entries = this.entries.filter((e) => !(e.pattern === pattern && e.listener === listener));
+  }
+  listenerCount(pattern) {
+    return pattern ? this.entries.filter((e) => e.pattern === pattern).length : this.entries.length;
+  }
+  removeAll() {
+    this.entries = [];
+  }
+  matching(name) {
+    return this.entries.filter((e) => matchesPattern(e.pattern, name)).sort((a, b) => b.priority - a.priority || a.seq - b.seq);
+  }
+  emit(name, payload, source) {
+    const ctx = this.makeCtx(name, payload, source);
+    const result = { cancelled: false, errors: [], delivered: 0 };
+    for (const entry of this.matching(name)) {
+      if (ctx.cancelled) break;
+      if (entry.once) this.removeEntry(entry);
+      try {
+        const r = entry.listener(payload, ctx);
+        result.delivered++;
+        if (r && typeof r.then === "function") {
+          r.catch((e) => this.fail(e, name, entry.pattern, result));
+        }
+      } catch (e) {
+        this.fail(e, name, entry.pattern, result);
+      }
+    }
+    result.cancelled = ctx.cancelled;
+    return result;
+  }
+  async emitAsync(name, payload, source) {
+    const ctx = this.makeCtx(name, payload, source);
+    const result = { cancelled: false, errors: [], delivered: 0 };
+    for (const entry of this.matching(name)) {
+      if (ctx.cancelled) break;
+      if (entry.once) this.removeEntry(entry);
+      try {
+        await entry.listener(payload, ctx);
+        result.delivered++;
+      } catch (e) {
+        this.fail(e, name, entry.pattern, result);
+      }
+    }
+    result.cancelled = ctx.cancelled;
+    return result;
+  }
+  waitFor(pattern, timeoutMs = 0) {
+    return new Promise((resolve, reject) => {
+      const sub = this.once(pattern, (p) => {
+        if (t) clearTimeout(t);
+        resolve(p);
+      });
+      const t = timeoutMs > 0 ? setTimeout(() => (sub.dispose(), reject(new Error(`waitFor("${pattern}") timed out`))), timeoutMs) : void 0;
+    });
+  }
+  removeEntry(e) {
+    const i = this.entries.indexOf(e);
+    if (i >= 0) this.entries.splice(i, 1);
+  }
+  fail(e, name, pattern, result) {
+    result.errors.push(e);
+    try {
+      this.onError(e, name, pattern);
+    } catch {
+    }
+  }
+  makeCtx(name, payload, source) {
+    const ctx = {
+      name,
+      payload,
+      source,
+      cancelled: false,
+      cancel() {
+        ctx.cancelled = true;
+      }
+    };
+    return ctx;
+  }
+};
+
+// src/core/hooks.ts
+var KINDS = ["before", "after", "around", "transform", "validate", "filter"];
+function split(name) {
+  const i = name.indexOf(".");
+  const kind = i > 0 ? name.slice(0, i) : "";
+  if (!KINDS.includes(kind) || i === name.length - 1) {
+    throw new Error(`Invalid hook name "${name}": expected "<${KINDS.join("|")}>.<operation>"`);
+  }
+  return { kind, operation: name.slice(i + 1) };
+}
+var HookSystem = class {
+  constructor(onError = () => {
+  }) {
+    this.onError = onError;
+  }
+  onError;
+  entries = [];
+  seq = 0;
+  use(name, handler, opts = {}) {
+    const { kind, operation } = split(name);
+    const entry = { kind, operation, handler, priority: opts.priority ?? 0, seq: this.seq++, owner: opts.owner };
+    this.entries.push(entry);
+    return toDisposable(() => {
+      const i = this.entries.indexOf(entry);
+      if (i >= 0) this.entries.splice(i, 1);
+    });
+  }
+  count(kind, operation) {
+    return this.entries.filter((e) => (!kind || e.kind === kind) && (!operation || e.operation === operation)).length;
+  }
+  list() {
+    return this.entries.map(({ kind, operation, priority, owner }) => ({ kind, operation, priority, owner }));
+  }
+  get(kind, operation) {
+    return this.entries.filter((e) => e.kind === kind && e.operation === operation).sort((a, b) => b.priority - a.priority || a.seq - b.seq);
+  }
+  async run(operation, input, exec) {
+    const ctx = {
+      operation,
+      input,
+      result: void 0,
+      cancelled: false,
+      cancelReason: void 0,
+      data: /* @__PURE__ */ new Map(),
+      cancel(reason) {
+        ctx.cancelled = true;
+        ctx.cancelReason = reason;
+      }
+    };
+    const guard = () => {
+      if (ctx.cancelled) throw new HookCancelledError(operation, ctx.cancelReason);
+    };
+    for (const kind of ["validate", "before"]) {
+      for (const h of this.get(kind, operation)) {
+        await h.handler(ctx);
+        guard();
+      }
+    }
+    const arounds = this.get("around", operation);
+    const core = async () => ctx.result = await exec(ctx.input, ctx);
+    const composed = arounds.reduceRight(
+      (next, h) => async () => {
+        guard();
+        const r = await h.handler(ctx, next);
+        if (r !== void 0) ctx.result = r;
+        return ctx.result;
+      },
+      core
+    );
+    await composed();
+    guard();
+    for (const h of this.get("transform", operation)) {
+      const r = await h.handler(ctx);
+      if (r !== void 0) ctx.result = r;
+    }
+    for (const h of this.get("after", operation)) {
+      try {
+        await h.handler(ctx);
+      } catch (e) {
+        this.onError(e, `after.${operation}`, h.owner);
+      }
+    }
+    return ctx.result;
+  }
+  /** Runs `filter.<name>` handlers as a value pipeline. A failing filter is skipped and reported. */
+  async filter(name, value, extra) {
+    let current = value;
+    for (const h of this.get("filter", name)) {
+      try {
+        const r = await h.handler(current, extra);
+        if (r !== void 0) current = r;
+      } catch (e) {
+        this.onError(e, `filter.${name}`, h.owner);
+      }
+    }
+    return current;
+  }
+  /** Synchronous variant for render-time filters (async filters are ignored with a reported error). */
+  filterSync(name, value, extra) {
+    let current = value;
+    for (const h of this.get("filter", name)) {
+      try {
+        const r = h.handler(current, extra);
+        if (r && typeof r.then === "function") throw new Error("async filter used in filterSync()");
+        if (r !== void 0) current = r;
+      } catch (e) {
+        this.onError(e, `filter.${name}`, h.owner);
+      }
+    }
+    return current;
+  }
+  removeByOwner(owner) {
+    this.entries = this.entries.filter((e) => e.owner !== owner);
+  }
+};
+
+// src/core/permissions.ts
+var PermissionManager = class {
+  constructor(opts = {}) {
+    this.opts = opts;
+    this.autoGrant = opts.autoGrant ?? true;
+    for (const [id, perms] of Object.entries(opts.approved ?? {})) this.granted.set(id, new Set(perms));
+  }
+  opts;
+  declared = /* @__PURE__ */ new Map();
+  granted = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  autoGrant;
+  /** Restores grants persisted from a previous session (call before `declare`). */
+  restore(approved) {
+    for (const [id, perms] of Object.entries(approved)) this.granted.set(id, new Set(perms));
+  }
+  /** Registers a plugin's requested permissions (called when its manifest is loaded). */
+  declare(pluginId, permissions) {
+    const set = new Set(permissions);
+    this.declared.set(pluginId, set);
+    const granted = this.granted.get(pluginId) ?? /* @__PURE__ */ new Set();
+    if (this.autoGrant) for (const p of set) granted.add(p);
+    for (const p of [...granted]) if (!set.has(p)) granted.delete(p);
+    this.granted.set(pluginId, granted);
+    this.notify(pluginId);
+  }
+  forget(pluginId) {
+    this.declared.delete(pluginId);
+    this.granted.delete(pluginId);
+  }
+  has(pluginId, permission) {
+    return this.granted.get(pluginId)?.has(permission) ?? false;
+  }
+  hasAll(pluginId, permissions) {
+    return permissions.every((p) => this.has(pluginId, p));
+  }
+  assert(pluginId, permission, api = permission) {
+    if (!this.has(pluginId, permission)) throw new PermissionDeniedError(pluginId, permission, api);
+  }
+  grant(pluginId, permission) {
+    if (!this.declared.get(pluginId)?.has(permission)) {
+      throw new Error(`Plugin "${pluginId}" did not declare permission "${permission}"`);
+    }
+    const set = this.granted.get(pluginId) ?? /* @__PURE__ */ new Set();
+    set.add(permission);
+    this.granted.set(pluginId, set);
+    this.notify(pluginId);
+  }
+  grantAll(pluginId) {
+    for (const p of this.declared.get(pluginId) ?? []) this.grant(pluginId, p);
+  }
+  revoke(pluginId, permission) {
+    this.granted.get(pluginId)?.delete(permission);
+    this.notify(pluginId);
+  }
+  snapshot(pluginId) {
+    const declared = [...this.declared.get(pluginId) ?? []];
+    const granted = [...this.granted.get(pluginId) ?? []];
+    return { declared, granted, denied: declared.filter((p) => !granted.includes(p)) };
+  }
+  onChange(l) {
+    this.listeners.add(l);
+    return toDisposable(() => this.listeners.delete(l));
+  }
+  notify(pluginId) {
+    this.opts.onChange?.(pluginId, this.snapshot(pluginId));
+    for (const l of this.listeners) l(pluginId);
+  }
+};
+
+// src/core/registry.ts
+var Registry = class {
+  constructor(kind) {
+    this.kind = kind;
+  }
+  kind;
+  table = /* @__PURE__ */ new Map();
+  subscribers = /* @__PURE__ */ new Set();
+  _version = 0;
+  get version() {
+    return this._version;
+  }
+  add(key, item, owner) {
+    if (this.table.has(key)) {
+      const existing = this.table.get(key);
+      throw new FrameworkError(
+        `${this.kind} "${key}" is already registered${existing.owner ? ` by "${existing.owner}"` : ""}`,
+        "FLUX_DUPLICATE",
+        owner
+      );
+    }
+    const entry = { item, owner };
+    this.table.set(key, entry);
+    this.changed();
+    return toDisposable(() => {
+      if (this.table.get(key) === entry) {
+        this.table.delete(key);
+        this.changed();
+      }
+    });
+  }
+  has(key) {
+    return this.table.has(key);
+  }
+  get(key) {
+    return this.table.get(key)?.item;
+  }
+  ownerOf(key) {
+    return this.table.get(key)?.owner;
+  }
+  list() {
+    return [...this.table.values()].map((e) => e.item);
+  }
+  listByOwner(owner) {
+    return [...this.table.values()].filter((e) => e.owner === owner).map((e) => e.item);
+  }
+  unregisterByOwner(owner) {
+    let n = 0;
+    for (const [k, e] of this.table) {
+      if (e.owner === owner) {
+        this.table.delete(k);
+        n++;
+      }
+    }
+    if (n) this.changed();
+    return n;
+  }
+  clear() {
+    this.table.clear();
+    this.changed();
+  }
+  /** Subscribes to any change. Returns an unsubscribe function compatible with `useSyncExternalStore`. */
+  subscribe = (listener) => {
+    this.subscribers.add(listener);
+    return () => void this.subscribers.delete(listener);
+  };
+  changed() {
+    this._version++;
+    for (const l of [...this.subscribers]) {
+      try {
+        l();
+      } catch {
+      }
+    }
+  }
+};
+var CommandRegistry = class extends Registry {
+  /** Set by the plugin manager: activates plugins that declared `onCommand:<id>` before execution. */
+  beforeExecute;
+  /** Observer used for diagnostics / hooks. */
+  onExecuted;
+  constructor() {
+    super("Command");
+  }
+  register(command, owner) {
+    return this.add(command.id, command, owner);
+  }
+  async execute(id, ...args) {
+    if (!this.has(id)) await this.beforeExecute?.(id);
+    const cmd = this.get(id);
+    if (!cmd) throw new FrameworkError(`Unknown command "${id}"`, "FLUX_UNKNOWN_COMMAND");
+    if (cmd.when && !cmd.when()) throw new FrameworkError(`Command "${id}" is not available right now`, "FLUX_COMMAND_DISABLED");
+    try {
+      const r = await cmd.execute(...args);
+      this.onExecuted?.(id);
+      return r;
+    } catch (e) {
+      this.onExecuted?.(id, e);
+      throw e;
+    }
+  }
+  /** Commands sorted for display in a palette. */
+  palette(query = "") {
+    const q = query.trim().toLowerCase();
+    return this.list().filter((c) => (!c.when || c.when()) && (!q || `${c.category ?? ""} ${c.title} ${c.id}`.toLowerCase().includes(q))).sort((a, b) => (a.category ?? "").localeCompare(b.category ?? "") || a.title.localeCompare(b.title));
+  }
+  /** Finds the command bound to a keyboard shortcut. */
+  byKeybinding(binding) {
+    const norm = (b) => b.toLowerCase().replace(/\s+/g, "").split("+").sort().join("+");
+    return this.list().find((c) => c.keybinding && norm(c.keybinding) === norm(binding));
+  }
+};
+var MenuRegistry = class extends Registry {
+  constructor() {
+    super("Menu item");
+  }
+  register(item, owner) {
+    return this.add(`${item.location}:${item.id}`, item, owner);
+  }
+  /**
+   * Hierarchical view of a location: items that name a `parent`, plus the parent's own `children`, are nested under it
+   * (sorted by order). Unknown parents fall back to top level, so a missing plugin never hides its siblings.
+   */
+  tree(location) {
+    const flat = this.items(location);
+    const byId = new Map(flat.map((i) => [i.id, i]));
+    const toNode = (i) => ({ ...i, children: [...i.children ?? []] });
+    const nodes = new Map(flat.map((i) => [i.id, toNode(i)]));
+    const roots = [];
+    for (const i of flat) {
+      const n = nodes.get(i.id);
+      const parent = i.parent && i.parent !== i.id ? nodes.get(i.parent) : void 0;
+      if (parent && byId.has(i.parent)) parent.children.push(n);
+      else roots.push(n);
+    }
+    const sort = (list) => {
+      list.sort((a, b) => (a.order ?? 100) - (b.order ?? 100) || a.label.localeCompare(b.label));
+      for (const n of list) {
+        if (n.children?.length) sort(n.children);
+        else delete n.children;
+      }
+    };
+    sort(roots);
+    return roots;
+  }
+  items(location) {
+    return this.list().filter((m) => m.location === location && (!m.when || m.when())).sort((a, b) => (a.group ?? "").localeCompare(b.group ?? "") || (a.order ?? 100) - (b.order ?? 100) || a.label.localeCompare(b.label));
+  }
+};
+var ServiceRegistry = class extends Registry {
+  /** Set by the plugin manager: activates plugins declaring `onService:<name>` on first lookup. */
+  beforeResolve;
+  constructor() {
+    super("Service");
+  }
+  register(name, implementation, owner) {
+    return this.add(name, { id: name, implementation }, owner);
+  }
+  /** Synchronous lookup — returns undefined when the providing plugin is not active. */
+  resolve(name) {
+    return this.get(name)?.implementation;
+  }
+  /** Looks a service up, activating its provider lazily if necessary. */
+  async resolveAsync(name) {
+    if (!this.has(name)) await this.beforeResolve?.(name);
+    const s2 = this.get(name);
+    if (!s2) throw new FrameworkError(`Service "${name}" is not available`, "FLUX_UNKNOWN_SERVICE");
+    return s2.implementation;
+  }
+};
+
+// src/core/routes.ts
+function normalizePath(path18) {
+  const clean = "/" + path18.split("?")[0].split("#")[0].split("/").filter(Boolean).join("/");
+  return clean;
+}
+function toSegments(fullPath) {
+  return fullPath.split("/").filter(Boolean).map((s2) => s2 === "*" ? { type: "splat" } : s2.startsWith(":") ? { type: "param", name: s2.slice(1) } : { type: "static", value: s2 });
+}
+function scoreOf(segs) {
+  return segs.reduce((n, s2) => n + (s2.type === "static" ? 100 : s2.type === "param" ? 10 : 1), segs.length);
+}
+function joinPaths(base, child) {
+  if (child.startsWith("/")) return normalizePath(child);
+  return normalizePath(`${base}/${child}`);
+}
+var RouteRegistry = class extends Registry {
+  /** Host-provided values handed to guards (e.g. `{ isAuthenticated: true }`). */
+  guardContext = {};
+  /** Set by the plugin manager to lazily activate plugins declaring `onRoute:<path>`. */
+  beforeResolve;
+  /** Called for every route with `meta.menu`: lets the manager create sidebar entries automatically. */
+  onRouteRegistered;
+  layouts = /* @__PURE__ */ new Map();
+  constructor() {
+    super("Route");
+  }
+  registerLayout(id, component) {
+    if (this.layouts.has(id)) throw new FrameworkError(`Layout "${id}" is already registered`, "FLUX_DUPLICATE");
+    this.layouts.set(id, component);
+    this.bump();
+    return toDisposable(() => {
+      this.layouts.delete(id);
+      this.bump();
+    });
+  }
+  getLayout(id) {
+    return this.layouts.get(id);
+  }
+  bump() {
+    this.changed();
+  }
+  /** Registers a route (and its children). Returns one disposable removing all of them. */
+  register(def, owner) {
+    const disposables = [];
+    const walk2 = (d, parent) => {
+      if (!d.component && !d.lazy && !d.children?.length) {
+        throw new FrameworkError(`Route "${d.path}" needs a component, a lazy loader or children`, "FLUX_INVALID_ROUTE", owner);
+      }
+      const fullPath = parent ? joinPaths(parent.fullPath, d.path) : normalizePath(d.path);
+      const segments = toSegments(fullPath);
+      const resolved = {
+        fullPath,
+        definition: d,
+        owner,
+        parents: parent ? [...parent.parents, parent] : [],
+        segments,
+        score: scoreOf(segments)
+      };
+      disposables.push(this.add(`${owner ?? ""}|${fullPath}`, resolved, owner));
+      const extra = this.onRouteRegistered?.(resolved, owner);
+      if (extra) disposables.push(extra);
+      for (const child of d.children ?? []) walk2(child, resolved);
+    };
+    try {
+      walk2(def, void 0);
+    } catch (e) {
+      for (const d of disposables.reverse()) d.dispose();
+      throw e;
+    }
+    return toDisposable(() => {
+      for (const d of disposables.reverse()) d.dispose();
+    });
+  }
+  /** Finds the best route for a concrete pathname. */
+  match(pathname) {
+    const target = normalizePath(pathname).split("/").filter(Boolean).map((s2) => {
+      try {
+        return decodeURIComponent(s2);
+      } catch {
+        return s2;
+      }
+    });
+    let best;
+    for (const route of this.list()) {
+      const def = route.definition;
+      if (!def.component && !def.lazy) continue;
+      const params = {};
+      let ok2 = true;
+      const segs = route.segments;
+      for (let i = 0; i < segs.length; i++) {
+        const seg = segs[i];
+        if (seg.type === "splat") {
+          params["*"] = target.slice(i).join("/");
+          if (target.length < i) ok2 = false;
+          break;
+        }
+        const t = target[i];
+        if (t === void 0) {
+          ok2 = false;
+          break;
+        }
+        if (seg.type === "static" && seg.value !== t) {
+          ok2 = false;
+          break;
+        }
+        if (seg.type === "param") params[seg.name] = t;
+        if (i === segs.length - 1 && target.length > segs.length) ok2 = false;
+      }
+      if (ok2 && segs.length === 0 && target.length > 0) ok2 = false;
+      if (!ok2) continue;
+      if (!best || route.score > best.route.score) best = { route, params, chain: [...route.parents, route] };
+    }
+    return best;
+  }
+  /** Same as `match` but first lets lazily-activated plugins register their routes. */
+  async matchAsync(pathname) {
+    const first = this.match(pathname);
+    if (first) return first;
+    await this.beforeResolve?.(normalizePath(pathname));
+    return this.match(pathname);
+  }
+  /** Evaluates `access`, then every guard from the root layout down to the route itself. */
+  async checkGuards(m, pathname) {
+    for (const r of m.chain) {
+      const base = { path: normalizePath(pathname), params: m.params, route: m.route, host: this.guardContext };
+      if (r.definition.access === "protected" && !this.guardContext["isAuthenticated"]) {
+        return { allow: false, redirect: this.guardContext["loginPath"] ?? "/login", reason: "authentication required" };
+      }
+      for (const g of r.definition.guards ?? []) {
+        let res;
+        try {
+          res = await g(base);
+        } catch (e) {
+          return { allow: false, reason: `guard threw: ${e instanceof Error ? e.message : String(e)}` };
+        }
+        if (typeof res === "string") return { allow: false, redirect: res, reason: "redirected by guard" };
+        if (res === false) return { allow: false, reason: "blocked by guard" };
+      }
+    }
+    return { allow: true };
+  }
+  breadcrumbs(m) {
+    const out = [];
+    for (const r of m.chain) {
+      const b = r.definition.meta?.breadcrumb ?? r.definition.meta?.title;
+      if (!b) continue;
+      const label = typeof b === "function" ? b(m.params) : b;
+      const path18 = r.fullPath.replace(/:([A-Za-z0-9_]+)/g, (_, k) => encodeURIComponent(m.params[k] ?? `:${k}`));
+      out.push({ label, path: path18 });
+    }
+    return out;
+  }
+};
+
+// src/core/slots.ts
+var SlotRegistry = class extends Registry {
+  counter = 0;
+  /** Set by the plugin manager to activate plugins declaring `onSlot:<name>`. */
+  onSlotRendered;
+  declared = /* @__PURE__ */ new Set();
+  constructor() {
+    super("Slot contribution");
+  }
+  /** Hosts may declare their slots so typos in plugins are caught early. Declaring is optional. */
+  declareSlot(name) {
+    this.declared.add(name);
+  }
+  declaredSlots() {
+    return [...this.declared];
+  }
+  register(c, owner, opts = {}) {
+    if (opts.strict && this.declared.size > 0 && !this.declared.has(c.slot)) {
+      throw new FrameworkError(`Unknown UI slot "${c.slot}"`, "FLUX_UNKNOWN_SLOT", owner);
+    }
+    const id = c.id ?? `${owner ?? "anon"}#${c.slot}#${this.counter++}`;
+    const entry = { id, slot: c.slot, component: c.component, mode: c.mode ?? "append", priority: c.priority ?? 0, props: c.props, owner, when: c.when };
+    return this.add(`${c.slot}::${id}`, entry, owner);
+  }
+  resolve(slot, props = {}) {
+    this.onSlotRendered?.(slot);
+    const all = this.list().filter((c) => c.slot === slot && (!c.when || safe(() => c.when(props)))).sort((a, b) => b.priority - a.priority);
+    const pick2 = (mode) => all.filter((c) => c.mode === mode);
+    return {
+      before: [...pick2("prepend"), ...pick2("before")],
+      replacement: pick2("replace")[0],
+      after: [...pick2("after"), ...pick2("append")]
+    };
+  }
+  /** Slots that currently have at least one contribution. */
+  activeSlots() {
+    return [...new Set(this.list().map((c) => c.slot))];
+  }
+};
+function safe(fn) {
+  try {
+    return fn();
+  } catch {
+    return false;
+  }
+}
+var ExtensionPointRegistry = class extends Registry {
+  points = /* @__PURE__ */ new Map();
+  counter = 0;
+  constructor() {
+    super("Extension point contribution");
+  }
+  declare(def) {
+    if (this.points.has(def.name)) throw new FrameworkError(`Extension point "${def.name}" is already declared`, "FLUX_DUPLICATE");
+    this.points.set(def.name, def);
+    return {
+      dispose: () => {
+        this.points.delete(def.name);
+      }
+    };
+  }
+  definition(name) {
+    return this.points.get(name);
+  }
+  declaredPoints() {
+    return [...this.points.values()];
+  }
+  contribute(point, value, owner, priority = 0) {
+    const def = this.points.get(point);
+    if (!def) throw new FrameworkError(`Unknown extension point "${point}"`, "FLUX_UNKNOWN_EXTENSION_POINT", owner);
+    for (const [key, v] of Object.entries(value)) {
+      if (!(key in def.contributions)) {
+        throw new FrameworkError(`Extension point "${point}" does not accept "${key}" (allowed: ${Object.keys(def.contributions).join(", ")})`, "FLUX_INVALID_CONTRIBUTION", owner);
+      }
+      const schema = def.contributions[key];
+      if (schema) {
+        for (const item of Array.isArray(v) ? v : [v]) {
+          const r = schema.parse(item, `${point}.${key}`);
+          if (!r.ok) throw new FrameworkError(`Invalid contribution to "${point}.${key}": ${r.issues.map((i) => i.message).join("; ")}`, "FLUX_INVALID_CONTRIBUTION", owner);
+        }
+      }
+    }
+    return this.add(`${point}::${owner ?? "anon"}::${this.counter++}`, { point, priority, value }, owner);
+  }
+  /** Merged, priority-ordered items contributed under `key` of `point`. */
+  items(point, key) {
+    return this.list().filter((c) => c.point === point && key in c.value).sort((a, b) => b.priority - a.priority).flatMap((c) => {
+      const v = c.value[key];
+      return Array.isArray(v) ? v : [v];
+    });
+  }
+};
+
+// src/core/styles.ts
+var StyleRegistry = class extends Registry {
+  n = 0;
+  constructor() {
+    super("Style");
+  }
+  register(input, owner) {
+    if (!input.css && !input.href) throw new Error("style needs `css` or `href`");
+    const id = input.id ?? `style-${this.n++}`;
+    const entry = { id, css: input.css, href: input.href, priority: input.priority ?? 100, scoped: input.scoped ?? false, owner };
+    return this.add(`${owner}::${id}`, entry, owner);
+  }
+  /** Entries in cascade order. */
+  ordered() {
+    return this.list().map((e, i) => ({ e, i })).sort((a, b) => a.e.priority - b.e.priority || a.i - b.i).map((x) => x.e);
+  }
+};
+function scopeCss(css, pluginId) {
+  return `@scope ([data-fluxplugin="${pluginId.replace(/"/g, "")}"]) {
+${css}
+}`;
+}
+
+// src/core/ipc.ts
+function defineIpcContract(c) {
+  return Object.freeze({ ...c });
+}
+function defineIPC(def) {
+  const contract = Object.freeze({
+    name: def.name,
+    input: def.input,
+    output: def.output,
+    permission: def.permission
+  });
+  return { ...contract, handler: def.handler, contract };
+}
+var RESERVED = /^flux\./;
+var IpcError = class extends FrameworkError {
+  constructor(message, code, channel) {
+    super(message, code);
+    this.channel = channel;
+  }
+  channel;
+};
+function serializeError(e) {
+  if (e instanceof ValidationError) return { code: "FLUX_VALIDATION", message: e.message, issues: e.issues };
+  if (e instanceof FrameworkError) return { code: e.code, message: e.message };
+  return { code: "FLUX_HANDLER_ERROR", message: errorMessage(e) };
+}
+var IpcRegistry = class extends Registry {
+  oneWay = /* @__PURE__ */ new Map();
+  transport;
+  /** Hook for the manager: ensures the owner plugin is active (`onIPC:<name>`) and checks caller permissions. */
+  beforeInvoke;
+  /** Permission check provided by the manager. */
+  assertCallerPermission;
+  /** Observer used for diagnostics. */
+  onCall;
+  constructor() {
+    super("IPC handler");
+  }
+  setTransport(t) {
+    this.transport = t;
+  }
+  handle(a, handler, owner, opts = {}) {
+    const c = typeof a === "string" ? { name: a, ...opts } : a;
+    if (RESERVED.test(c.name) && owner !== "host") {
+      throw new FrameworkError(`IPC names starting with "flux." are reserved for the framework`, "FLUX_RESERVED", owner);
+    }
+    return this.add(c.name, { name: c.name, handler, input: c.input, output: c.output, permission: c.permission, owner }, owner);
+  }
+  /** Registers a full `IpcDefinition` (contract + handler). */
+  register(def, owner) {
+    return this.handle(def.contract, def.handler, owner);
+  }
+  /** Dispatches a call: validate input → permission → handler → validate output. */
+  async invoke(name, input, opts = {}) {
+    if (!this.has(name)) await this.beforeInvoke?.(name, opts);
+    const entry = this.table.get(name)?.item;
+    if (!entry) throw new IpcError(`No handler registered for "${name}"`, "FLUX_NO_HANDLER", name);
+    const caller = opts.caller ?? "host";
+    const started = Date.now();
+    try {
+      if (entry.permission && caller !== "host") this.assertCallerPermission?.(caller, entry.permission, name);
+      let value = input;
+      if (entry.input) {
+        const r = entry.input.parse(input);
+        if (!r.ok) throw new ValidationError(r.issues, `input of "${name}"`);
+        value = r.value;
+      }
+      const out = await entry.handler(value, { pluginId: entry.owner, caller, senderId: opts.senderId });
+      if (entry.output) {
+        const r = entry.output.parse(out);
+        if (!r.ok) throw new ValidationError(r.issues, `output of "${name}"`);
+        this.onCall?.({ name, owner: entry.owner, caller, ms: Date.now() - started });
+        return r.value;
+      }
+      this.onCall?.({ name, owner: entry.owner, caller, ms: Date.now() - started });
+      return out;
+    } catch (e) {
+      this.onCall?.({ name, owner: entry.owner, caller, ms: Date.now() - started, error: e });
+      throw e;
+    }
+  }
+  /** Fire-and-forget messages from renderer/other plugins to main (`ipc.on`). */
+  on(name, fn, owner) {
+    let set = this.oneWay.get(name);
+    if (!set) this.oneWay.set(name, set = /* @__PURE__ */ new Set());
+    const entry = { fn, owner };
+    set.add(entry);
+    return toDisposable(() => set.delete(entry));
+  }
+  /** Delivers a one-way message to main-side listeners. */
+  dispatch(name, payload, opts = {}) {
+    const set = this.oneWay.get(name);
+    if (!set) return 0;
+    let n = 0;
+    for (const l of [...set]) {
+      try {
+        l.fn(payload, { pluginId: l.owner, caller: opts.caller ?? "host", senderId: opts.senderId });
+        n++;
+      } catch {
+      }
+    }
+    return n;
+  }
+  /** Main → renderer push. */
+  send(channel, payload, target) {
+    this.transport?.broadcast(channel, payload, target);
+  }
+  removeListenersByOwner(owner) {
+    for (const set of this.oneWay.values()) for (const l of [...set]) if (l.owner === owner) set.delete(l);
+  }
+};
+var preloadMember = {
+  invoke: (channel) => ({ kind: "invoke", channel }),
+  send: (channel) => ({ kind: "send", channel }),
+  event: (channel) => ({ kind: "event", channel })
+};
+var NAMESPACE_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var FORBIDDEN_NS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype", "flux", "__fluxplugin"]);
+var PreloadRegistry = class extends Registry {
+  constructor() {
+    super("Preload API");
+  }
+  expose(namespace, members, owner) {
+    if (!NAMESPACE_RE.test(namespace) || FORBIDDEN_NS.has(namespace)) {
+      throw new FrameworkError(`Invalid preload namespace "${namespace}"`, "FLUX_INVALID_NAMESPACE", owner);
+    }
+    const spec = {};
+    for (const [key, m] of Object.entries(members)) {
+      if (!NAMESPACE_RE.test(key) || FORBIDDEN_NS.has(key)) {
+        throw new FrameworkError(`Invalid preload member "${namespace}.${key}"`, "FLUX_INVALID_NAMESPACE", owner);
+      }
+      spec[key] = typeof m === "string" ? { kind: "invoke", channel: m } : m;
+    }
+    return this.add(namespace, { id: namespace, namespace, spec, owner }, owner);
+  }
+  /** JSON-serializable manifest sent to the preload bridge. */
+  manifest() {
+    const out = {};
+    for (const e of this.list()) out[e.namespace] = e.spec;
+    return out;
+  }
+};
+
+// src/core/storage.ts
+var MemoryStorageBackend = class {
+  data = /* @__PURE__ */ new Map();
+  async read(ns) {
+    return structuredClone(this.data.get(ns) ?? {});
+  }
+  async write(ns, data) {
+    this.data.set(ns, structuredClone(data));
+  }
+  async remove(ns) {
+    this.data.delete(ns);
+  }
+};
+var CONFIG_KEY = "__fluxplugin_config__";
+function createPluginStorage(backend2, namespace) {
+  let queue = Promise.resolve();
+  const exclusive = (fn) => {
+    const run2 = queue.then(fn, fn);
+    queue = run2.catch(() => void 0);
+    return run2;
+  };
+  const guard = (key) => {
+    if (typeof key !== "string" || key.length === 0) throw new Error("Storage key must be a non-empty string");
+    if (key === CONFIG_KEY || key === "__proto__") throw new Error(`Storage key "${key}" is reserved`);
+  };
+  return {
+    async get(key, fallback) {
+      guard(key);
+      const data = await exclusive(() => backend2.read(namespace));
+      return Object.prototype.hasOwnProperty.call(data, key) ? structuredClone(data[key]) : fallback;
+    },
+    async set(key, value) {
+      guard(key);
+      await exclusive(async () => {
+        const data = await backend2.read(namespace);
+        data[key] = structuredClone(value);
+        await backend2.write(namespace, data);
+      });
+    },
+    async delete(key) {
+      guard(key);
+      await exclusive(async () => {
+        const data = await backend2.read(namespace);
+        delete data[key];
+        await backend2.write(namespace, data);
+      });
+    },
+    async keys() {
+      const data = await exclusive(() => backend2.read(namespace));
+      return Object.keys(data).filter((k) => k !== CONFIG_KEY);
+    },
+    async clear() {
+      await exclusive(async () => {
+        const data = await backend2.read(namespace);
+        await backend2.write(namespace, CONFIG_KEY in data ? { [CONFIG_KEY]: data[CONFIG_KEY] } : {});
+      });
+    }
+  };
+}
+function createPluginConfig(backend2, namespace, def, onChanged) {
+  const version = def.version ?? 1;
+  const listeners = /* @__PURE__ */ new Set();
+  let queue = Promise.resolve();
+  const exclusive = (fn) => {
+    const run2 = queue.then(fn, fn);
+    queue = run2.catch(() => void 0);
+    return run2;
+  };
+  const defaults = () => {
+    const r = def.schema.parse({});
+    if (!r.ok) throw new ValidationError(r.issues, `default configuration of "${namespace}" (every field needs a default or to be optional)`);
+    return r.value;
+  };
+  const load = async () => {
+    const data = await backend2.read(namespace);
+    const stored = data[CONFIG_KEY];
+    if (!stored) return defaults();
+    let values = stored.values ?? {};
+    if (stored.version < version && def.migrate) values = def.migrate(values, stored.version);
+    const r = def.schema.parse(values);
+    if (r.ok) return r.value;
+    return defaults();
+  };
+  const save = async (values) => {
+    const data = await backend2.read(namespace);
+    data[CONFIG_KEY] = { version, values };
+    await backend2.write(namespace, data);
+  };
+  const emit = (next, prev) => {
+    onChanged?.(next, prev);
+    for (const l of [...listeners]) {
+      try {
+        l(next, prev);
+      } catch {
+      }
+    }
+  };
+  return {
+    get: () => exclusive(load),
+    set: (patch) => exclusive(async () => {
+      const prev = await load();
+      const r = def.schema.parse({ ...prev, ...patch });
+      if (!r.ok) throw new ValidationError(r.issues, `configuration of "${namespace}"`);
+      await save(r.value);
+      emit(r.value, prev);
+      return r.value;
+    }),
+    reset: () => exclusive(async () => {
+      const prev = await load();
+      const next = defaults();
+      await save(next);
+      emit(next, prev);
+      return next;
+    }),
+    onChange(l) {
+      listeners.add(l);
+      return toDisposable(() => listeners.delete(l));
+    },
+    describe: () => def.schema.describe()
+  };
+}
+function createPluginState() {
+  const data = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Set();
+  const notify = (k, v) => {
+    for (const l of [...listeners]) {
+      if (l.key !== void 0 && l.key !== k) continue;
+      try {
+        l.fn(k, v);
+      } catch {
+      }
+    }
+  };
+  return {
+    get: ((key, fallback) => data.has(key) ? data.get(key) : fallback),
+    set(key, value) {
+      if (Object.is(data.get(key), value) && data.has(key)) return;
+      data.set(key, value);
+      notify(key, value);
+    },
+    delete(key) {
+      if (data.delete(key)) notify(key, void 0);
+    },
+    subscribe(fn, key) {
+      const l = { fn, key };
+      listeners.add(l);
+      return toDisposable(() => listeners.delete(l));
+    },
+    snapshot: () => Object.fromEntries(data)
+  };
+}
+
+// src/core/deps.ts
+function buildDependencyGraph(manifests) {
+  const map = /* @__PURE__ */ new Map();
+  for (const m of manifests) map.set(m.id, m);
+  const issues = [];
+  const edges = /* @__PURE__ */ new Map();
+  const blocked = /* @__PURE__ */ new Set();
+  for (const m of map.values()) {
+    const out = [];
+    for (const kind of ["dependencies", "peerDependencies"]) {
+      for (const [dep, range] of Object.entries(m[kind] ?? {})) {
+        const target = map.get(dep);
+        if (!target) {
+          issues.push({ type: "missing", plugin: m.id, dependency: dep, range, kind });
+          blocked.add(m.id);
+          continue;
+        }
+        if (!satisfies(target.version, range)) {
+          issues.push({ type: "version", plugin: m.id, dependency: dep, range, found: target.version });
+          blocked.add(m.id);
+          continue;
+        }
+        out.push(dep);
+      }
+    }
+    for (const [dep, range] of Object.entries(m.optionalDependencies ?? {})) {
+      const target = map.get(dep);
+      if (target && satisfies(target.version, range)) out.push(dep);
+    }
+    edges.set(m.id, out);
+  }
+  const state = /* @__PURE__ */ new Map();
+  const order = [];
+  const stack = [];
+  const visit = (id) => {
+    const st = state.get(id) ?? 0;
+    if (st === 2) return;
+    if (st === 1) {
+      const path18 = [...stack.slice(stack.indexOf(id)), id];
+      issues.push({ type: "cycle", plugin: id, path: path18 });
+      for (const p of path18) blocked.add(p);
+      return;
+    }
+    state.set(id, 1);
+    stack.push(id);
+    for (const dep of edges.get(id) ?? []) visit(dep);
+    stack.pop();
+    state.set(id, 2);
+    order.push(id);
+  };
+  for (const id of [...map.keys()].sort()) visit(id);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const [id, deps] of edges) {
+      if (!blocked.has(id) && deps.some((d) => blocked.has(d))) {
+        blocked.add(id);
+        changed = true;
+      }
+    }
+  }
+  return { manifests: map, edges, issues, blocked, order: order.filter((id) => !blocked.has(id)) };
+}
+function activationOrderFor(graph, id) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const walk2 = (n) => {
+    if (seen.has(n)) return;
+    seen.add(n);
+    for (const d of graph.edges.get(n) ?? []) walk2(d);
+    out.push(n);
+  };
+  walk2(id);
+  return out;
+}
+function dependentsOf(graph, id) {
+  const reverse = /* @__PURE__ */ new Map();
+  for (const [p, deps] of graph.edges) for (const d of deps) (reverse.get(d) ?? reverse.set(d, []).get(d)).push(p);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set([id]);
+  const walk2 = (n) => {
+    for (const p of reverse.get(n) ?? []) {
+      if (seen.has(p)) continue;
+      seen.add(p);
+      walk2(p);
+      out.push(p);
+    }
+  };
+  walk2(id);
+  return out;
+}
+function describeIssue(i) {
+  switch (i.type) {
+    case "missing":
+      return `${i.plugin} requires "${i.dependency}" (${i.range}) which is not installed`;
+    case "version":
+      return `${i.plugin} requires "${i.dependency}" ${i.range} but ${i.found} is installed`;
+    case "cycle":
+      return `dependency cycle: ${i.path.join(" \u2192 ")}`;
+  }
+}
+
+// src/core/plugin.ts
+function definePlugin(def) {
+  return def;
+}
+var defineRoute = (r) => r;
+var defineCommand = (c) => c;
+var defineService = (name, impl) => ({ name, implementation: impl });
+var defineHook = (name, handler, priority) => ({ name, handler, priority });
+var defineEvent = (name, handler, opts = {}) => ({ name, handler, ...opts });
+var defineComponent = (c) => c;
+var defineMenu = (m) => m;
+
+// src/core/notifications.ts
+var NotificationCenter = class {
+  constructor(capacity = 200) {
+    this.capacity = capacity;
+  }
+  capacity;
+  items = [];
+  listeners = /* @__PURE__ */ new Set();
+  pushListeners = /* @__PURE__ */ new Set();
+  seq = 0;
+  version = 0;
+  push(input, owner = "host") {
+    const id = input.id ?? `${owner}#${Date.now().toString(36)}-${this.seq++}`;
+    this.items = this.items.filter((n) => n.id !== id);
+    const item = {
+      id,
+      title: input.title,
+      body: input.body,
+      level: input.level ?? "info",
+      actions: input.actions ?? [],
+      timeoutMs: input.timeoutMs ?? 5e3,
+      owner,
+      time: Date.now(),
+      read: false
+    };
+    this.items.unshift(item);
+    if (this.items.length > this.capacity) this.items.length = this.capacity;
+    this.changed();
+    for (const l of [...this.pushListeners]) l(item);
+    return { id, dismiss: () => this.dismiss(id) };
+  }
+  list() {
+    return this.items;
+  }
+  get unread() {
+    return this.items.filter((n) => !n.read).length;
+  }
+  markRead(id) {
+    for (const n of this.items) if (!id || n.id === id) n.read = true;
+    this.changed();
+  }
+  dismiss(id) {
+    this.items = this.items.filter((n) => n.id !== id);
+    this.changed();
+  }
+  clear() {
+    this.items = [];
+    this.changed();
+  }
+  subscribe = (l) => {
+    this.listeners.add(l);
+    return () => void this.listeners.delete(l);
+  };
+  /** Called for every new notification (toast host, native bridges, main→renderer forwarding). */
+  onPush(l) {
+    this.pushListeners.add(l);
+    return toDisposable(() => this.pushListeners.delete(l));
+  }
+  changed() {
+    this.version++;
+    for (const l of [...this.listeners]) l();
+  }
+};
+
+// src/core/manager.ts
+var DEFAULT_TIMEOUTS = { load: 15e3, initialize: 1e4, activate: 15e3, ready: 1e4, deactivate: 1e4, unload: 1e4 };
+var PluginManager = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.runtime = opts.runtime;
+    this.logs = opts.logs ?? new LogStore();
+    this.log = this.logs.logger("core");
+    this.storageBackend = opts.storage ?? new MemoryStorageBackend();
+    this.permissions = opts.permissions ?? new PermissionManager();
+    this.timeouts = { ...DEFAULT_TIMEOUTS, ...opts.timeouts };
+    this.events = new EventBus((e, name, pattern) => this.log.error(`event listener for "${pattern}" failed on "${name}": ${errorMessage(e)}`));
+    this.hooks = new HookSystem((e, name, owner) => this.logs.logger(owner ?? "core").error(`hook "${name}" failed: ${errorMessage(e)}`));
+    this.wireLazyActivation();
+    this.permissions.onChange(() => this.changed());
+  }
+  opts;
+  runtime;
+  logs;
+  permissions;
+  events;
+  hooks;
+  commands = new CommandRegistry();
+  menus = new MenuRegistry();
+  routes = new RouteRegistry();
+  services = new ServiceRegistry();
+  slots = new SlotRegistry();
+  extensionPoints = new ExtensionPointRegistry();
+  ipc = new IpcRegistry();
+  preload = new PreloadRegistry();
+  styles = new StyleRegistry();
+  notifications = new NotificationCenter();
+  storageBackend;
+  records = /* @__PURE__ */ new Map();
+  states = /* @__PURE__ */ new Map();
+  hostApis = /* @__PURE__ */ new Map();
+  timeouts;
+  log;
+  listeners = /* @__PURE__ */ new Set();
+  _version = 0;
+  disposedFlag = false;
+  /* ------------------------------------------------------------- observers */
+  get version() {
+    return this._version;
+  }
+  subscribe = (l) => {
+    this.listeners.add(l);
+    return () => void this.listeners.delete(l);
+  };
+  changed() {
+    this._version++;
+    for (const l of [...this.listeners]) {
+      try {
+        l();
+      } catch {
+      }
+    }
+  }
+  /* ------------------------------------------------------------ host APIs */
+  /** Exposes a controlled capability to plugins (`context.host.api(name)`), optionally gated by a permission. */
+  provide(name, factory, permission) {
+    if (this.hostApis.has(name)) throw new FrameworkError(`Host API "${name}" already provided`, "FLUX_DUPLICATE");
+    this.hostApis.set(name, { factory, permission });
+    return toDisposable(() => this.hostApis.delete(name));
+  }
+  /* --------------------------------------------------- discovery / validate */
+  /** Persisted state (disabled plugins) must be loaded before registering sources. */
+  async init() {
+    const disabled = await this.opts.stateStore?.load() ?? [];
+    this.persistedDisabled = new Set(disabled);
+  }
+  persistedDisabled = /* @__PURE__ */ new Set();
+  /**
+   * Discovers + validates one plugin. Invalid plugins are recorded in the `error` state (so the UI can show why)
+   * and never throw — one broken plugin must not stop the others.
+   */
+  register(source) {
+    const v = validateManifest(source.manifest, { frameworkVersion: this.opts.frameworkVersion ?? FRAMEWORK_VERSION });
+    const raw = source.manifest;
+    const id = v.manifest?.id ?? (typeof raw?.id === "string" ? raw.id : `invalid-${this.records.size}`);
+    if (this.records.has(id)) {
+      this.log.warn(`plugin "${id}" is already registered; ignoring duplicate from ${source.origin ?? "unknown origin"}`);
+      return this.info(id);
+    }
+    const manifest = v.manifest ?? {
+      id,
+      name: typeof raw?.name === "string" ? raw.name : id,
+      version: typeof raw?.version === "string" ? raw.version : "0.0.0",
+      activationEvents: [],
+      deactivationEvents: [],
+      permissions: [],
+      dependencies: {},
+      optionalDependencies: {},
+      peerDependencies: {},
+      engines: {},
+      contributes: {},
+      screenshots: [],
+      categories: [],
+      keywords: [],
+      links: {}
+    };
+    const rec = {
+      id,
+      manifest,
+      source,
+      state: v.ok ? "validated" : "error",
+      enabled: !this.persistedDisabled.has(id),
+      store: new DisposableStore(),
+      deactivators: [],
+      lazy: [],
+      crashes: [],
+      warnings: v.warnings
+    };
+    if (!v.ok) {
+      rec.error = { message: v.issues.map((i) => `${i.path || "<root>"}: ${i.message}`).join("; "), phase: "validate", time: Date.now() };
+      this.logs.logger(id).error(`manifest validation failed: ${rec.error.message}`);
+    } else {
+      this.permissions.declare(id, manifest.permissions);
+      if (!rec.enabled) rec.state = "disabled";
+    }
+    this.records.set(id, rec);
+    if (v.ok && rec.enabled) this.installLazyProxies(rec);
+    this.log.info(`discovered ${id}@${manifest.version} (${rec.state})`);
+    this.events.emit("plugin.registered", { id }, "core");
+    this.changed();
+    return this.info(id);
+  }
+  async unregister(id) {
+    const rec = this.records.get(id);
+    if (!rec) return;
+    await this.deactivate(id).catch(() => void 0);
+    await this.unload(id).catch(() => void 0);
+    for (const d of rec.lazy.splice(0)) d.dispose();
+    this.permissions.forget(id);
+    this.records.delete(id);
+    this.events.emit("plugin.unregistered", { id }, "core");
+    this.changed();
+  }
+  /* ----------------------------------------------------------- inspection */
+  has(id) {
+    return this.records.has(id);
+  }
+  list() {
+    return [...this.records.keys()].sort().map((id) => this.info(id));
+  }
+  info(id) {
+    const rec = this.mustGet(id);
+    const m = rec.manifest;
+    const graph = this.graph();
+    const author = typeof m.author === "string" ? m.author : m.author?.name;
+    return {
+      id,
+      name: m.name,
+      version: m.version,
+      description: m.description,
+      author,
+      state: rec.state,
+      enabled: rec.enabled,
+      runtime: this.runtime,
+      permissions: this.permissions.snapshot(id),
+      dependencies: { ...m.dependencies, ...m.peerDependencies, ...m.optionalDependencies },
+      dependents: dependentsOf(graph, id),
+      activationEvents: m.activationEvents ?? [],
+      contributes: m.contributes ?? {},
+      error: rec.error,
+      crashes: rec.crashes.length,
+      hasConfig: !!rec.definition?.config,
+      root: rec.source.root,
+      origin: rec.source.origin,
+      warnings: rec.warnings
+    };
+  }
+  /** Reactive per-plugin state store (same instance as `ctx.state`). Survives reloads. */
+  stateOf(id) {
+    let s2 = this.states.get(id);
+    if (!s2) this.states.set(id, s2 = createPluginState());
+    return s2;
+  }
+  /** Validated manifest (or the best-effort one for plugins rejected at validation). */
+  manifest(id) {
+    return this.mustGet(id).manifest;
+  }
+  getConfig(id) {
+    return this.records.get(id)?.config;
+  }
+  /** Active plugin's context (for hosts and tests). */
+  contextOf(id) {
+    return this.records.get(id)?.context;
+  }
+  diagnostics(id) {
+    const owned = (r) => r.listByOwner(id).length;
+    return {
+      info: this.info(id),
+      logs: this.logs.query({ source: id }),
+      contributions: {
+        commands: owned(this.commands),
+        menus: owned(this.menus),
+        routes: owned(this.routes),
+        services: owned(this.services),
+        slots: owned(this.slots),
+        extensions: owned(this.extensionPoints),
+        ipc: owned(this.ipc),
+        preload: owned(this.preload),
+        styles: owned(this.styles)
+      }
+    };
+  }
+  mustGet(id) {
+    const r = this.records.get(id);
+    if (!r) throw new FrameworkError(`Unknown plugin "${id}"`, "FLUX_UNKNOWN_PLUGIN");
+    return r;
+  }
+  graph() {
+    return buildDependencyGraph([...this.records.values()].filter((r) => r.state !== "error" || r.error?.phase !== "validate").map((r) => r.manifest));
+  }
+  /* ------------------------------------------------------------ activation */
+  /** Activates every plugin that wants to start with the application (`onStartup`, `*`, or no activation events). */
+  async startup() {
+    const graph = this.graph();
+    for (const issue of graph.issues) this.log.warn(describeIssue(issue));
+    const ids = graph.order.filter((id) => {
+      const r = this.records.get(id);
+      const ev = r.manifest.activationEvents ?? [];
+      return r.enabled && (ev.length === 0 || ev.includes("onStartup") || ev.includes("*"));
+    });
+    for (const id of ids) await this.activate(id).catch(() => void 0);
+  }
+  /** Activates `id` and, first, everything it depends on. Rejects with a `LifecycleError` on failure. */
+  async activate(id) {
+    const rec = this.mustGet(id);
+    if (!rec.enabled) throw new LifecycleError(id, "activate", "plugin is disabled");
+    if (rec.state === "error" && rec.error?.phase === "validate") throw new LifecycleError(id, "validate", rec.error.message);
+    const graph = this.graph();
+    if (graph.blocked.has(id)) {
+      const reasons = graph.issues.filter((i) => i.plugin === id || i.type === "cycle" && i.path.includes(id)).map(describeIssue);
+      throw new LifecycleError(id, "activate", reasons.join("; ") || "a dependency cannot be activated");
+    }
+    await this.ensureReady(id, graph, []);
+  }
+  async ensureReady(id, graph, chain) {
+    const rec = this.mustGet(id);
+    if (rec.state === "ready") return;
+    if (rec.inflight) return rec.inflight;
+    if (!rec.enabled) throw new LifecycleError(id, "activate", "plugin is disabled");
+    if (chain.includes(id)) throw new LifecycleError(id, "activate", `dependency cycle: ${[...chain, id].join(" \u2192 ")}`);
+    const optional = new Set(Object.keys(rec.manifest.optionalDependencies ?? {}).filter((d) => !(d in (rec.manifest.dependencies ?? {})) && !(d in (rec.manifest.peerDependencies ?? {}))));
+    const run2 = (async () => {
+      for (const dep of graph.edges.get(id) ?? []) {
+        try {
+          await this.ensureReady(dep, graph, [...chain, id]);
+        } catch (e) {
+          if (optional.has(dep)) {
+            this.logs.logger(id).warn(`optional dependency "${dep}" could not be activated: ${errorMessage(e)}`);
+            continue;
+          }
+          const err = new LifecycleError(id, "activate", `required dependency "${dep}" failed: ${errorMessage(e)}`, e);
+          await this.fail(rec, "activate", err, false);
+          throw err;
+        }
+      }
+      await this.bringUp(rec);
+    })();
+    rec.inflight = run2;
+    try {
+      await run2;
+    } finally {
+      rec.inflight = void 0;
+    }
+  }
+  async phase(rec, phase, fn) {
+    try {
+      return await withTimeout(Promise.resolve().then(fn), this.timeouts[phase], `${phase} of "${rec.id}"`, rec.id);
+    } catch (e) {
+      if (e instanceof LifecycleError) throw e;
+      throw new LifecycleError(rec.id, phase, errorMessage(e), e);
+    }
+  }
+  setState(rec, state) {
+    rec.state = state;
+    this.events.emit("plugin.state", { id: rec.id, state }, "core");
+    this.changed();
+  }
+  async bringUp(rec) {
+    let phase = "load";
+    try {
+      if (!rec.definition) {
+        const def2 = await this.phase(rec, "load", () => rec.source.load());
+        if (!def2 || typeof def2 !== "object") throw new Error("entry did not export a plugin definition (use definePlugin)");
+        if (def2.id && def2.id !== rec.id) throw new Error(`plugin id mismatch: manifest "${rec.id}" vs entry "${def2.id}"`);
+        rec.definition = def2;
+        rec.context = this.createContext(rec);
+        this.setState(rec, "loaded");
+        await this.phase(rec, "load", () => def2.onLoad?.(rec.context));
+      }
+      const def = rec.definition;
+      const ctx = rec.context;
+      phase = "initialize";
+      this.setState(rec, "initialized");
+      await this.phase(rec, "initialize", () => def.onInitialize?.(ctx));
+      phase = "activate";
+      this.removeLazyProxies(rec);
+      await this.phase(rec, "activate", async () => {
+        await this.applyDeclarative(rec);
+        await (def.onActivate ?? def.activate)?.(ctx);
+      });
+      this.setState(rec, "activated");
+      phase = "ready";
+      await this.phase(rec, "ready", () => def.onReady?.(ctx));
+      rec.error = void 0;
+      this.setState(rec, "ready");
+      this.logs.logger(rec.id).info("ready");
+      this.events.emit("plugin.ready", { id: rec.id }, "core");
+    } catch (e) {
+      await this.fail(rec, phase, e, true);
+      throw e;
+    }
+  }
+  /** Records a failure, tears down everything the plugin registered and auto-disables repeat offenders. */
+  async fail(rec, phase, e, cleanup) {
+    const message = errorMessage(e);
+    this.logs.logger(rec.id).error(`${phase} failed: ${message}`, e instanceof Error ? e.stack : void 0);
+    if (cleanup) this.teardown(rec);
+    rec.error = { message, phase, time: Date.now() };
+    const now = Date.now();
+    const windowMs = this.opts.crashWindowMs ?? 6e4;
+    rec.crashes = [...rec.crashes.filter((t) => now - t < windowMs), now];
+    this.events.emit("plugin.error", { id: rec.id, phase, message }, "core");
+    if (rec.crashes.length >= (this.opts.maxCrashes ?? 3)) {
+      rec.enabled = false;
+      this.logs.logger(rec.id).warn(`disabled automatically after ${rec.crashes.length} failures`);
+      await this.persistDisabled();
+      this.setState(rec, "disabled");
+      this.events.emit("plugin.autodisabled", { id: rec.id }, "core");
+    } else {
+      this.setState(rec, "error");
+    }
+    if (rec.enabled) this.installLazyProxies(rec);
+  }
+  /** Disposes every contribution of a plugin (store + owner-based sweep as a safety net). */
+  teardown(rec) {
+    rec.store.dispose();
+    rec.store = new DisposableStore();
+    rec.deactivators = [];
+    this.sweep(rec.id);
+  }
+  sweep(owner) {
+    this.commands.unregisterByOwner(owner);
+    this.menus.unregisterByOwner(owner);
+    this.routes.unregisterByOwner(owner);
+    this.services.unregisterByOwner(owner);
+    this.slots.unregisterByOwner(owner);
+    this.extensionPoints.unregisterByOwner(owner);
+    this.ipc.unregisterByOwner(owner);
+    this.ipc.removeListenersByOwner(owner);
+    this.preload.unregisterByOwner(owner);
+    this.styles.unregisterByOwner(owner);
+    this.hooks.removeByOwner(owner);
+  }
+  /* ---------------------------------------------------------- deactivation */
+  /** Deactivates `id` after deactivating every active plugin that depends on it. Never throws for plugin errors. */
+  async deactivate(id) {
+    const rec = this.mustGet(id);
+    const graph = this.graph();
+    for (const dep of dependentsOf(graph, id)) {
+      const d = this.records.get(dep);
+      if (d && (d.state === "ready" || d.state === "activated" || d.state === "initialized" || d.state === "loaded")) await this.deactivateOne(d);
+    }
+    if (rec.inflight) await rec.inflight.catch(() => void 0);
+    await this.deactivateOne(rec);
+  }
+  async deactivateOne(rec) {
+    if (!["ready", "activated", "initialized", "loaded", "error"].includes(rec.state)) return;
+    const log2 = this.logs.logger(rec.id);
+    const def = rec.definition;
+    const ctx = rec.context;
+    if (def && ctx && rec.state !== "error") {
+      try {
+        await this.phase(rec, "deactivate", () => (def.onDeactivate ?? def.deactivate)?.(ctx));
+      } catch (e) {
+        log2.error(`deactivate hook failed: ${errorMessage(e)}`);
+      }
+    }
+    for (const fn of [...rec.deactivators].reverse()) {
+      try {
+        await fn();
+      } catch (e) {
+        log2.error(`cleanup failed: ${errorMessage(e)}`);
+      }
+    }
+    this.teardown(rec);
+    this.setState(rec, "deactivated");
+    if (rec.enabled) this.installLazyProxies(rec);
+    this.events.emit("plugin.deactivated", { id: rec.id }, "core");
+  }
+  async unload(id) {
+    const rec = this.mustGet(id);
+    if (rec.state === "ready" || rec.state === "activated") await this.deactivate(id);
+    const def = rec.definition;
+    const ctx = rec.context;
+    if (def && ctx) {
+      try {
+        await this.phase(rec, "unload", () => def.onUnload?.(ctx));
+      } catch (e) {
+        this.logs.logger(id).error(`unload hook failed: ${errorMessage(e)}`);
+      }
+    }
+    rec.definition = void 0;
+    rec.context = void 0;
+    rec.config = void 0;
+    if (rec.state !== "disabled" && !(rec.state === "error" && rec.error?.phase === "validate")) this.setState(rec, "unloaded");
+  }
+  async disable(id) {
+    const rec = this.mustGet(id);
+    await this.deactivate(id);
+    await this.unload(id);
+    rec.enabled = false;
+    for (const d of rec.lazy.splice(0)) d.dispose();
+    await this.persistDisabled();
+    this.setState(rec, "disabled");
+  }
+  async enable(id, opts = {}) {
+    const rec = this.mustGet(id);
+    rec.enabled = true;
+    rec.crashes = [];
+    rec.error = void 0;
+    await this.persistDisabled();
+    this.setState(rec, "validated");
+    this.installLazyProxies(rec);
+    if (opts.activate ?? true) await this.activate(id);
+  }
+  /** Development hot reload: deactivate → unload → load a fresh module → activate (if it was active). */
+  async reload(id) {
+    const rec = this.mustGet(id);
+    const wasActive = rec.state === "ready" || rec.state === "error" && rec.error?.phase !== "validate";
+    await this.deactivate(id);
+    await this.unload(id);
+    rec.error = void 0;
+    if (rec.enabled && rec.state !== "disabled") this.setState(rec, "validated");
+    this.events.emit("plugin.reloading", { id }, "core");
+    if (wasActive || rec.manifest.activationEvents?.includes("onStartup")) await this.activate(id);
+    this.events.emit("plugin.reloaded", { id }, "core");
+  }
+  async persistDisabled() {
+    const ids = [...this.records.values()].filter((r) => !r.enabled).map((r) => r.id);
+    this.persistedDisabled = new Set(ids);
+    try {
+      await this.opts.stateStore?.save(ids);
+    } catch (e) {
+      this.log.error(`could not persist plugin state: ${errorMessage(e)}`);
+    }
+  }
+  async dispose() {
+    this.disposedFlag = true;
+    const graph = this.graph();
+    for (const id of [...graph.order].reverse()) await this.deactivate(id).catch(() => void 0);
+    for (const id of this.records.keys()) await this.unload(id).catch(() => void 0);
+    this.events.removeAll();
+  }
+  /* ------------------------------------------------- lazy activation events */
+  /** Activates plugins whose manifest lists `event` (or `*`). Used internally and by hosts for custom events. */
+  async trigger(event) {
+    if (this.disposedFlag) return;
+    const targets = [...this.records.values()].filter((r) => {
+      if (!r.enabled || r.state === "ready" || r.state === "error" || r.state === "disabled") return false;
+      if (r.inflight) return true;
+      return (r.manifest.activationEvents ?? []).some((e) => e === event || this.eventMatches(e, event));
+    });
+    await Promise.all(targets.map((r) => this.activate(r.id).catch(() => void 0)));
+  }
+  eventMatches(declared, event) {
+    const [kd, ...rd] = declared.split(":");
+    const [ke, ...re] = event.split(":");
+    if (kd !== ke) return false;
+    const pd = rd.join(":");
+    const pe = re.join(":");
+    if (kd === "onRoute") return routePatternMatches(pd, pe);
+    return matchesPattern(pd, pe);
+  }
+  wireLazyActivation() {
+    this.commands.beforeExecute = (id) => this.trigger(`onCommand:${id}`);
+    this.services.beforeResolve = (name) => this.trigger(`onService:${name}`);
+    this.routes.beforeResolve = (path18) => this.trigger(`onRoute:${path18}`);
+    this.slots.onSlotRendered = (slot) => void this.trigger(`onSlot:${slot}`);
+    this.ipc.beforeInvoke = (name) => this.trigger(`onIPC:${name}`);
+    this.ipc.assertCallerPermission = (caller, permission, channel) => this.permissions.assert(caller, permission, `IPC "${channel}"`);
+    this.events.on("**", (_p, ctx) => {
+      if (!ctx.name.startsWith("plugin.")) void this.trigger(`onEvent:${ctx.name}`);
+    }, { priority: 1e3 });
+    this.routes.onRouteRegistered = (route, owner) => {
+      const menu = route.definition.meta?.menu;
+      if (!menu || !owner) return;
+      const meta = route.definition.meta;
+      return this.menus.register(
+        {
+          id: `route:${route.fullPath}`,
+          location: menu.location ?? "sidebar",
+          label: menu.label ?? meta.title ?? route.fullPath,
+          icon: menu.icon ?? meta.icon,
+          path: route.fullPath,
+          order: menu.order,
+          group: menu.group,
+          parent: menu.parent
+        },
+        owner
+      );
+    };
+  }
+  /**
+   * Before a plugin is active, its statically declared commands/menus (manifest `contributes`) are visible
+   * as lightweight proxies: using one activates the plugin on demand. Replaced by the real registrations on activate.
+   */
+  installLazyProxies(rec) {
+    if (rec.lazy.length) return;
+    const c = rec.manifest.contributes ?? {};
+    const owner = rec.id;
+    for (const cmd of c.commands ?? []) {
+      if (this.commands.has(cmd.id)) continue;
+      rec.lazy.push(
+        this.commands.register(
+          {
+            id: cmd.id,
+            title: cmd.title,
+            category: cmd.category,
+            execute: async (...args) => {
+              await this.activate(owner);
+              return this.commands.execute(cmd.id, ...args);
+            }
+          },
+          `${owner}#lazy`
+        )
+      );
+    }
+    for (const m of c.menus ?? []) {
+      if (this.menus.has(`${m.location}:${m.id}`)) continue;
+      rec.lazy.push(this.menus.register({ id: m.id, location: m.location, label: m.label, command: m.command }, `${owner}#lazy`));
+    }
+  }
+  removeLazyProxies(rec) {
+    for (const d of rec.lazy.splice(0)) d.dispose();
+  }
+  /* ------------------------------------------------- declarative contributions */
+  async applyDeclarative(rec) {
+    const def = rec.definition;
+    const ctx = rec.context;
+    const renderer = this.runtime === "renderer";
+    const main = this.runtime === "main";
+    for (const [id, component] of Object.entries(def.layouts ?? {})) if (renderer) ctx.routes.registerLayout(id, component);
+    if (renderer) for (const r of def.routes ?? []) ctx.routes.register(r);
+    for (const c of def.commands ?? []) ctx.commands.register(c);
+    for (const m of def.menus ?? []) ctx.menus.register(m);
+    for (const h of def.hooks ?? []) ctx.hooks.use(h.name, h.handler, { priority: h.priority });
+    const services = typeof def.services === "function" ? def.services(ctx) : def.services;
+    for (const [name, impl] of Object.entries(services ?? {})) ctx.services.register(name, impl);
+    if (main) for (const i of def.ipc ?? []) ctx.ipc.define(i);
+    for (const e of def.events ?? []) ctx.events.on(e.name, e.handler, { priority: e.priority, once: e.once });
+    if (renderer) for (const c of def.components ?? []) ctx.ui.register(c);
+    if (renderer) {
+      for (const x of def.extensions ?? []) {
+        try {
+          ctx.ui.extend(x.point, { ...x.contribution, priority: x.priority });
+        } catch (e) {
+          ctx.logger.warn(`extension "${x.point}" skipped: ${errorMessage(e)}`);
+        }
+      }
+    }
+    if (renderer) for (const st of def.styles ?? []) ctx.styles.add(typeof st === "string" ? { css: st } : st);
+    if (main) for (const [ns, members] of Object.entries(def.preload ?? {})) ctx.preload.expose(ns, members);
+  }
+  /* ------------------------------------------------------------- context */
+  createContext(rec) {
+    const id = rec.id;
+    const store = () => rec.store;
+    const track = (d) => store().add(d);
+    const need = (permission, api) => this.permissions.assert(id, permission, api);
+    const logger = this.logs.logger(id);
+    const renderer = this.runtime === "renderer";
+    const bridge = this.opts.ipcBridge;
+    const def = rec.definition;
+    const configDef = def.config ?? { schema: s.object({}) };
+    const config = createPluginConfig(this.storageBackend, id, configDef, (next, prev) => {
+      this.events.emit("plugin.config.changed", { id, next, prev }, id);
+      this.changed();
+    });
+    rec.config = def.config ? config : void 0;
+    const storage = createPluginStorage(this.storageBackend, id);
+    const unsupported = (what) => {
+      throw new FrameworkError(`${what} is not available in the ${this.runtime} process`, "FLUX_UNSUPPORTED_RUNTIME", id);
+    };
+    const ctx = {
+      pluginId: id,
+      manifest: rec.manifest,
+      runtime: this.runtime,
+      root: rec.source.root,
+      logger,
+      config,
+      storage,
+      state: this.stateOf(id),
+      events: {
+        on: (pattern, listener, opts) => (need("events", "events.on"), track(this.events.on(pattern, listener, opts))),
+        once: (pattern, listener, opts) => (need("events", "events.once"), track(this.events.once(pattern, listener, opts))),
+        emit: (name, payload, opts) => {
+          need("events", "events.emit");
+          const r = this.events.emit(name, payload, id);
+          if (opts?.broadcast) this.opts.onBroadcastEvent?.(name, payload, id);
+          return r;
+        },
+        emitAsync: (name, payload) => (need("events", "events.emitAsync"), this.events.emitAsync(name, payload, id))
+      },
+      commands: {
+        register: (c) => (need("commands", "commands.register"), track(this.commands.register(c, id))),
+        execute: (cid, ...args) => (need("commands", "commands.execute"), this.commands.execute(cid, ...args)),
+        list: () => this.commands.list()
+      },
+      routes: {
+        register: (r) => {
+          need("routes", "routes.register");
+          if (r.permission) need(r.permission, `route "${r.path}"`);
+          return track(this.routes.register(r, id));
+        },
+        registerLayout: (lid, component) => (need("routes", "routes.registerLayout"), track(this.routes.registerLayout(lid, component)))
+      },
+      menus: { register: (m) => (need("menus", "menus.register"), track(this.menus.register(m, id))) },
+      ui: {
+        register: (c) => (need("ui", "ui.register"), track(this.slots.register(c, id, { strict: this.opts.strictSlots }))),
+        extend: (point, contribution) => {
+          need("ui", "ui.extend");
+          const { mode, component, priority, ...data } = contribution;
+          const parts = [];
+          try {
+            if (component !== void 0) parts.push(this.slots.register({ slot: point, component, mode: mode ?? "append", priority }, id));
+            if (Object.keys(data).length) parts.push(this.extensionPoints.contribute(point, data, id, priority ?? 0));
+          } catch (e) {
+            for (const p of parts) p.dispose();
+            throw e;
+          }
+          return track(toDisposable(() => parts.forEach((p) => p.dispose())));
+        }
+      },
+      ipc: {
+        handle: ((a, handler, opts) => {
+          need("ipc", "ipc.handle");
+          if (renderer) return unsupported("ipc.handle");
+          return track(typeof a === "string" ? this.ipc.handle(a, handler, id, opts) : this.ipc.handle(a, handler, id));
+        }),
+        define: (d) => {
+          need("ipc", "ipc.define");
+          if (renderer) return unsupported("ipc.define");
+          return track(this.ipc.register(d, id));
+        },
+        on: (name, handler) => {
+          need("ipc", "ipc.on");
+          if (renderer) return track(bridge ? bridge.on(name, (p) => handler(p, { pluginId: id, caller: "host" })) : toDisposable(() => {
+          }));
+          return track(this.ipc.on(name, handler, id));
+        },
+        send: (channel, payload) => {
+          need("ipc", "ipc.send");
+          if (renderer) bridge?.send(channel, payload, id);
+          else this.ipc.send(channel, payload);
+        },
+        invoke: ((a, input) => {
+          need("ipc", "ipc.invoke");
+          const name = typeof a === "string" ? a : a.name;
+          return renderer && bridge ? bridge.invoke(name, input, id) : this.ipc.invoke(name, input, { caller: id });
+        })
+      },
+      preload: {
+        expose: (ns, members) => {
+          need("ipc", "preload.expose");
+          if (renderer) return unsupported("preload.expose");
+          return track(this.preload.expose(ns, members, id));
+        }
+      },
+      services: {
+        register: (name, impl) => (need("services", "services.register"), track(this.services.register(name, impl, id))),
+        get: (name) => (need("services", "services.get"), this.services.resolve(name)),
+        getAsync: (name) => (need("services", "services.getAsync"), this.services.resolveAsync(name))
+      },
+      hooks: {
+        use: (name, handler, opts) => (need("hooks", "hooks.use"), track(this.hooks.use(name, handler, { ...opts, owner: id }))),
+        run: (op, input, exec) => (need("hooks", "hooks.run"), this.hooks.run(op, input, exec)),
+        filter: (name, value, extra) => (need("hooks", "hooks.filter"), this.hooks.filter(name, value, extra))
+      },
+      notifications: { push: (n) => (need("notifications", "notifications.push"), this.notifications.push(n, id)) },
+      styles: { add: (st) => (need("styles", "styles.add"), track(this.styles.register(st, id))) },
+      host: {
+        has: (name) => this.hostApis.has(name),
+        api: (name) => {
+          const p = this.hostApis.get(name);
+          if (!p) throw new FrameworkError(`Host API "${name}" is not provided by this application`, "FLUX_UNKNOWN_HOST_API", id);
+          if (p.permission) need(p.permission, `host API "${name}"`);
+          return p.factory({ pluginId: id, root: rec.source.root, manifest: rec.manifest });
+        }
+      },
+      permissions: {
+        has: (p) => this.permissions.has(id, p),
+        assert: (p) => this.permissions.assert(id, p),
+        list: () => this.permissions.snapshot(id)
+      },
+      lifecycle: {
+        get state() {
+          return rec.state;
+        },
+        onDeactivate: (fn) => void rec.deactivators.push(fn),
+        subscriptions: { add: (d) => track(d) }
+      }
+    };
+    return ctx;
+  }
+};
+function routePatternMatches(pattern, path18) {
+  const p = normalizePath(pattern).split("/").filter(Boolean);
+  const t = normalizePath(path18).split("/").filter(Boolean);
+  for (let i = 0; i < p.length; i++) {
+    const seg = p[i];
+    if (seg === "*") return true;
+    if (t[i] === void 0) return false;
+    if (seg.startsWith(":")) continue;
+    if (seg !== t[i]) return false;
   }
-  return { ok: issues.length === 0, manifest: issues.length ? void 0 : manifest, issues, warnings };
+  return p.length === t.length;
+}
+
+// src/core/protocol.ts
+var CHANNELS = {
+  invoke: "flux:invoke",
+  send: "flux:send",
+  event: "flux:event",
+  bootstrap: "flux:bootstrap"
+};
+var MGMT = {
+  list: "flux.plugins.list",
+  enable: "flux.plugins.enable",
+  disable: "flux.plugins.disable",
+  reload: "flux.plugins.reload",
+  grant: "flux.plugins.grant",
+  revoke: "flux.plugins.revoke",
+  uninstall: "flux.plugins.uninstall",
+  install: "flux.plugins.install",
+  update: "flux.plugins.update",
+  rollback: "flux.plugins.rollback",
+  search: "flux.plugins.search",
+  updates: "flux.plugins.updates",
+  configGet: "flux.plugins.config.get",
+  configSet: "flux.plugins.config.set",
+  configReset: "flux.plugins.config.reset",
+  configSchema: "flux.plugins.config.schema",
+  logs: "flux.plugins.logs",
+  diagnostics: "flux.plugins.diagnostics",
+  details: "flux.plugins.details",
+  changed: "flux.plugins.changed"
+};
+
+// src/core/api.ts
+function pluginApi(namespace) {
+  const root = globalThis.plugins;
+  const api = root?.[namespace];
+  if (!api) throw new Error(`window.plugins.${namespace} is not available (plugin disabled, permission missing, or not exposed)`);
+  return api;
+}
+function hasPluginApi(namespace) {
+  return !!globalThis.plugins?.[namespace];
 }
 
+// src/main/framework.ts
+import { promises as fsp, watch } from "node:fs";
+import path7 from "node:path";
+
+// src/main/discover.ts
+import { promises as fs2 } from "node:fs";
+import path2 from "node:path";
+import { pathToFileURL } from "node:url";
+
 // src/main/security.ts
 import crypto from "node:crypto";
 import { promises as fs } from "node:fs";
@@ -606,16 +2851,113 @@ async function verifyPlugin(root, raw, manifest, opts = {}) {
 
 // src/main/discover.ts
 var MANIFEST_FILE = "plugin.json";
+var counter = 0;
+async function importFresh(file) {
+  const url = pathToFileURL(file).href + `?flux=${Date.now()}.${counter++}`;
+  const mod = await import(
+    /* @vite-ignore */
+    url
+  );
+  return mod.default ?? mod;
+}
+function toDefinition(x, entry) {
+  const def = x && typeof x === "object" && "default" in x ? x.default : x;
+  if (!def || typeof def !== "object") throw new Error(`"${entry}" must default-export definePlugin({...})`);
+  return def;
+}
+async function readPluginDir(root, opts = {}) {
+  const abs = path2.resolve(root);
+  let raw;
+  try {
+    raw = JSON.parse(await fs2.readFile(path2.join(abs, MANIFEST_FILE), "utf8"));
+  } catch (e) {
+    raw = { id: `invalid.${path2.basename(abs)}`.toLowerCase().replace(/[^a-z0-9.-]/g, "-") };
+    return {
+      root: abs,
+      manifest: raw,
+      problem: `cannot read ${MANIFEST_FILE}: ${e.message}`,
+      source: { manifest: raw, root: abs, origin: `dir:${abs}`, load: async () => ({}) }
+    };
+  }
+  let problem;
+  const v = validateManifest(raw);
+  if (v.manifest) {
+    try {
+      await verifyPlugin(abs, raw, v.manifest, opts);
+    } catch (e) {
+      problem = e instanceof IntegrityError ? e.message : `verification failed: ${e.message}`;
+    }
+  }
+  const mainRel = v.manifest?.main;
+  const load = opts.loadEntry ?? importFresh;
+  const source = {
+    manifest: raw,
+    root: abs,
+    origin: `dir:${abs}`,
+    load: async () => {
+      if (problem) throw new IntegrityError(problem);
+      if (!mainRel) return {};
+      const file = path2.resolve(abs, mainRel);
+      if (!file.startsWith(abs + path2.sep)) throw new IntegrityError(`main entry escapes plugin directory`);
+      return toDefinition(await load(file), mainRel);
+    }
+  };
+  return { root: abs, manifest: raw, source, problem };
+}
+async function discoverPlugins(dir, opts = {}) {
+  let entries = [];
+  try {
+    entries = (await fs2.readdir(dir, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules").map((e) => e.name);
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
+    throw e;
+  }
+  const out = [];
+  for (const name of entries.sort()) {
+    const root = path2.join(dir, name);
+    try {
+      await fs2.access(path2.join(root, MANIFEST_FILE));
+    } catch {
+      continue;
+    }
+    out.push(await readPluginDir(root, opts));
+  }
+  return out;
+}
 
 // src/main/fs-storage.ts
-import { promises as fs2 } from "node:fs";
-import path2 from "node:path";
+import { promises as fs3 } from "node:fs";
+import path3 from "node:path";
+var safe2 = (ns) => ns.replace(/[^a-zA-Z0-9._-]/g, "_");
 async function atomicWrite(file, data) {
-  await fs2.mkdir(path2.dirname(file), { recursive: true });
+  await fs3.mkdir(path3.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
-  await fs2.writeFile(tmp, data, "utf8");
-  await fs2.rename(tmp, file);
+  await fs3.writeFile(tmp, data, "utf8");
+  await fs3.rename(tmp, file);
 }
+var FsStorageBackend = class {
+  constructor(dir) {
+    this.dir = dir;
+  }
+  dir;
+  file(ns) {
+    return path3.join(this.dir, `${safe2(ns)}.json`);
+  }
+  async read(ns) {
+    try {
+      return JSON.parse(await fs3.readFile(this.file(ns), "utf8"));
+    } catch (e) {
+      if (e.code === "ENOENT") return {};
+      throw e;
+    }
+  }
+  async write(ns, data) {
+    await atomicWrite(this.file(ns), JSON.stringify(data));
+  }
+  async remove(ns) {
+    await fs3.rm(this.file(ns), { force: true });
+  }
+};
 var JsonStateFile = class {
   constructor(file) {
     this.file = file;
@@ -624,7 +2966,7 @@ var JsonStateFile = class {
   queue = Promise.resolve();
   async readAll() {
     try {
-      const j = JSON.parse(await fs2.readFile(this.file, "utf8"));
+      const j = JSON.parse(await fs3.readFile(this.file, "utf8"));
       return { disabled: Array.isArray(j.disabled) ? j.disabled : [], approved: j.approved && typeof j.approved === "object" ? j.approved : {} };
     } catch {
       return { disabled: [], approved: {} };
@@ -647,13 +2989,13 @@ var JsonStateFile = class {
 };
 
 // src/main/registry.ts
-import { promises as fs4 } from "node:fs";
-import path4 from "node:path";
+import { promises as fs5 } from "node:fs";
+import path5 from "node:path";
 import crypto2 from "node:crypto";
 
 // src/main/tar.ts
-import { promises as fs3 } from "node:fs";
-import path3 from "node:path";
+import { promises as fs4 } from "node:fs";
+import path4 from "node:path";
 import zlib from "node:zlib";
 import { promisify } from "node:util";
 var gzip = promisify(zlib.gzip);
@@ -679,9 +3021,9 @@ function header(name, size, mode, type) {
 }
 async function walk(dir, base = "") {
   const out = [];
-  for (const e of (await fs3.readdir(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+  for (const e of (await fs4.readdir(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
     if (e.name === "node_modules" || e.name === ".git") continue;
-    const abs = path3.join(dir, e.name);
+    const abs = path4.join(dir, e.name);
     const rel = base ? `${base}/${e.name}` : e.name;
     if (e.isDirectory()) {
       out.push({ rel, abs, dir: true });
@@ -696,7 +3038,7 @@ async function createTarGz(dir, prefix = "package") {
     const name = `${prefix}/${f.rel}${f.dir ? "/" : ""}`;
     if (f.dir) chunks.push(header(name, 0, 493, "5"));
     else {
-      const data = await fs3.readFile(f.abs);
+      const data = await fs4.readFile(f.abs);
       chunks.push(header(name, data.length, 420, "0"), data, Buffer.alloc((BLOCK - data.length % BLOCK) % BLOCK));
     }
   }
@@ -721,26 +3063,26 @@ async function readTarGz(buf) {
   return entries;
 }
 async function extractTarGz(buf, dest) {
-  const root = path3.resolve(dest);
-  await fs3.mkdir(root, { recursive: true });
+  const root = path4.resolve(dest);
+  await fs4.mkdir(root, { recursive: true });
   for (const e of await readTarGz(buf)) {
     const parts = e.name.split("/").filter(Boolean);
     parts.shift();
     if (!parts.length) continue;
-    if (parts.some((p) => p === ".." || p.includes("\0")) || path3.isAbsolute(e.name)) throw new Error(`unsafe path in archive: ${e.name}`);
-    const target = path3.resolve(root, ...parts);
-    if (target !== root && !target.startsWith(root + path3.sep)) throw new Error(`unsafe path in archive: ${e.name}`);
-    if (e.type === "dir") await fs3.mkdir(target, { recursive: true });
+    if (parts.some((p) => p === ".." || p.includes("\0")) || path4.isAbsolute(e.name)) throw new Error(`unsafe path in archive: ${e.name}`);
+    const target = path4.resolve(root, ...parts);
+    if (target !== root && !target.startsWith(root + path4.sep)) throw new Error(`unsafe path in archive: ${e.name}`);
+    if (e.type === "dir") await fs4.mkdir(target, { recursive: true });
     else {
-      await fs3.mkdir(path3.dirname(target), { recursive: true });
-      await fs3.writeFile(target, e.data);
+      await fs4.mkdir(path4.dirname(target), { recursive: true });
+      await fs4.writeFile(target, e.data);
     }
   }
 }
 
 // src/main/registry.ts
 async function readPluginManifest(dir) {
-  const raw = JSON.parse(await fs4.readFile(path4.join(dir, MANIFEST_FILE), "utf8"));
+  const raw = JSON.parse(await fs5.readFile(path5.join(dir, MANIFEST_FILE), "utf8"));
   const v = validateManifest(raw);
   if (!v.manifest) throw new Error(`invalid manifest: ${v.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
   return { raw, manifest: v.manifest };
@@ -761,65 +3103,125 @@ var RUNTIME_FILES = /^(plugin\.json|readme(\.[a-z]+)?|license(\.[a-z]+)?|changel
 var SOURCE_FILE = /\.(tsx?|jsx|map|scss|sass|less)$/i;
 async function copyPluginRuntime(src, dest) {
   const copied = [];
-  const manifest = JSON.parse(await fs4.readFile(path4.join(src, MANIFEST_FILE), "utf8"));
+  const manifest = JSON.parse(await fs5.readFile(path5.join(src, MANIFEST_FILE), "utf8"));
   const referenced = new Set(
-    [manifest["main"], manifest["preload"], manifest["renderer"], manifest["icon"], manifest["banner"], manifest["readme"], ...manifest["styles"] ?? [], ...manifest["screenshots"] ?? []].filter((x) => typeof x === "string").map((x) => path4.normalize(x).replace(/^(\.\/|\.\\)/, ""))
+    [manifest["main"], manifest["preload"], manifest["renderer"], manifest["icon"], manifest["banner"], manifest["readme"], ...manifest["styles"] ?? [], ...manifest["screenshots"] ?? []].filter((x) => typeof x === "string").map((x) => path5.normalize(x).replace(/^(\.\/|\.\\)/, ""))
   );
   const walk2 = async (rel) => {
-    for (const e of await fs4.readdir(path4.join(src, rel), { withFileTypes: true })) {
-      const r = rel ? path4.join(rel, e.name) : e.name;
+    for (const e of await fs5.readdir(path5.join(src, rel), { withFileTypes: true })) {
+      const r = rel ? path5.join(rel, e.name) : e.name;
       if (e.isDirectory()) {
         if (rel === "" ? RUNTIME_DIRS.has(e.name) : true) await walk2(r);
       } else if (e.isFile()) {
-        const top = r.split(path4.sep)[0];
+        const top = r.split(path5.sep)[0];
         const ok2 = referenced.has(r) || (rel === "" ? RUNTIME_FILES.test(e.name) : RUNTIME_DIRS.has(top) && !SOURCE_FILE.test(e.name));
         if (!ok2 || SOURCE_FILE.test(e.name) && !referenced.has(r)) continue;
-        await fs4.mkdir(path4.dirname(path4.join(dest, r)), { recursive: true });
-        await fs4.copyFile(path4.join(src, r), path4.join(dest, r));
-        copied.push(r.split(path4.sep).join("/"));
+        await fs5.mkdir(path5.dirname(path5.join(dest, r)), { recursive: true });
+        await fs5.copyFile(path5.join(src, r), path5.join(dest, r));
+        copied.push(r.split(path5.sep).join("/"));
       }
     }
   };
-  await fs4.mkdir(dest, { recursive: true });
+  await fs5.mkdir(dest, { recursive: true });
   await walk2("");
   return copied;
 }
 async function copyDir(src, dest) {
-  await fs4.mkdir(dest, { recursive: true });
-  for (const e of await fs4.readdir(src, { withFileTypes: true })) {
+  await fs5.mkdir(dest, { recursive: true });
+  for (const e of await fs5.readdir(src, { withFileTypes: true })) {
     if (e.name === "node_modules" || e.name === ".git") continue;
-    const s2 = path4.join(src, e.name);
-    const d = path4.join(dest, e.name);
+    const s2 = path5.join(src, e.name);
+    const d = path5.join(dest, e.name);
     if (e.isDirectory()) await copyDir(s2, d);
-    else if (e.isFile()) await fs4.copyFile(s2, d);
+    else if (e.isFile()) await fs5.copyFile(s2, d);
   }
 }
 function entriesFromIndex(index, baseUrl, source, query = "") {
+  const list = Array.isArray(index) ? index : index?.plugins ?? [];
   const q = query.toLowerCase();
-  return (index.plugins ?? []).filter((p) => p && typeof p.id === "string" && typeof p.version === "string" && typeof p.url === "string").filter((p) => !q || `${p.id} ${p.name ?? ""} ${p.description ?? ""}`.toLowerCase().includes(q)).map((p) => ({
-    id: p.id,
-    name: p.name ?? p.id,
-    version: p.version,
-    description: p.description,
-    author: p.author,
-    permissions: p.permissions ?? [],
-    location: new URL(p.url, baseUrl).href,
-    source,
-    sha256: p.sha256,
-    homepage: p.homepage,
-    icon: p.icon
-  }));
+  const abs = (u) => {
+    if (!u) return void 0;
+    try {
+      return new URL(u, baseUrl).href;
+    } catch {
+      return void 0;
+    }
+  };
+  const out = [];
+  for (const p of list) {
+    if (!p || typeof p.id !== "string" || typeof p.version !== "string") continue;
+    const isFolder = typeof p.folder === "string" && Array.isArray(p.files);
+    if (typeof p.url !== "string" && !isFolder) continue;
+    if (q && !`${p.id} ${p.name ?? ""} ${p.description ?? ""} ${(p.keywords ?? []).join(" ")}`.toLowerCase().includes(q)) continue;
+    const folderUrl = isFolder ? abs(p.folder.endsWith("/") ? p.folder : p.folder + "/") : void 0;
+    const location = isFolder ? folderUrl : abs(p.url);
+    if (!location) continue;
+    out.push({
+      id: p.id,
+      name: p.name ?? p.id,
+      version: p.version,
+      description: p.description,
+      author: p.author,
+      permissions: p.permissions ?? [],
+      location,
+      source,
+      sha256: p.sha256,
+      homepage: p.homepage,
+      license: p.license,
+      iconUrl: abs(p.icon),
+      bannerUrl: abs(p.banner),
+      screenshots: (p.screenshots ?? []).map((s2) => abs(s2)).filter((s2) => !!s2),
+      video: p.video ? p.video.startsWith("./") && folderUrl ? abs(new URL(p.video, folderUrl).href) : abs(p.video) : void 0,
+      categories: p.categories,
+      keywords: p.keywords,
+      links: p.links,
+      readme: p.readme,
+      folder: isFolder || void 0,
+      files: isFolder ? p.files : void 0,
+      hashes: p.hashes
+    });
+  }
+  return out;
+}
+var SAFE_FILE = /^[\w@+.,() \-]+(\/[\w@+.,() \-]+)*$/;
+async function downloadFolder(entry, dest, get) {
+  const base = entry.location.endsWith("/") ? entry.location : entry.location + "/";
+  const files = entry.files ?? [];
+  if (!files.includes("plugin.json")) throw new Error("catalog entry does not list plugin.json");
+  if (files.length > 800) throw new Error("catalog entry lists too many files");
+  if (!entry.hashes) throw new Error("catalog entry has no file hashes; refusing to install an unverifiable folder (run `fluxplugin store build`)");
+  const root = path5.resolve(dest);
+  await fs5.mkdir(root, { recursive: true });
+  let total = 0;
+  const queue = [...files];
+  const worker = async () => {
+    for (let f = queue.shift(); f !== void 0; f = queue.shift()) {
+      if (!SAFE_FILE.test(f) || f.split("/").some((s2) => s2 === ".." || s2 === ".")) throw new Error(`unsafe file path in catalog: ${f}`);
+      const expected = entry.hashes[f];
+      if (!expected || !/^[0-9a-f]{64}$/.test(expected)) throw new Error(`no sha256 for ${f} in the catalog`);
+      const res = await get(base + f.split("/").map(encodeURIComponent).join("/"));
+      const buf = Buffer.from(await res.arrayBuffer());
+      total += buf.length;
+      if (total > 100 * 1024 * 1024) throw new Error("plugin is too large");
+      if (crypto2.createHash("sha256").update(buf).digest("hex") !== expected) throw new Error(`${f} does not match the catalog checksum`);
+      const target = path5.resolve(root, f);
+      if (!target.startsWith(root + path5.sep)) throw new Error(`unsafe file path in catalog: ${f}`);
+      await fs5.mkdir(path5.dirname(target), { recursive: true });
+      await fs5.writeFile(target, buf);
+    }
+  };
+  await Promise.all(Array.from({ length: 6 }, worker));
 }
 async function pruneNonRuntime(dir) {
   const removed = [];
   const walk2 = async (rel) => {
-    for (const e of await fs4.readdir(path4.join(dir, rel), { withFileTypes: true })) {
-      const r = rel ? path4.join(rel, e.name) : e.name;
-      const abs = path4.join(dir, r);
+    for (const e of await fs5.readdir(path5.join(dir, rel), { withFileTypes: true })) {
+      const r = rel ? path5.join(rel, e.name) : e.name;
+      const abs = path5.join(dir, r);
       if (e.isDirectory()) {
-        if (e.name === "node_modules" || rel === "" && (e.name === "src" || e.name === ".git")) await fs4.rm(abs, { recursive: true, force: true }), removed.push(r + "/");
+        if (e.name === "node_modules" || rel === "" && (e.name === "src" || e.name === ".git")) await fs5.rm(abs, { recursive: true, force: true }), removed.push(r + "/");
         else await walk2(r);
-      } else if (/\.(map|tsx?|scss|sass|less)$/i.test(e.name) && !/\.d\.ts$/i.test(e.name)) await fs4.rm(abs, { force: true }), removed.push(r);
+      } else if (/\.(map|tsx?|scss|sass|less)$/i.test(e.name) && !/\.d\.ts$/i.test(e.name)) await fs5.rm(abs, { force: true }), removed.push(r);
     }
   };
   await walk2("");
@@ -837,12 +3239,12 @@ var LocalRegistry = class {
     const out = [];
     let names = [];
     try {
-      names = await fs4.readdir(this.dir);
+      names = await fs5.readdir(this.dir);
     } catch {
       return [];
     }
     for (const n of names.sort()) {
-      const root = path4.join(this.dir, n);
+      const root = path5.join(this.dir, n);
       try {
         const { manifest } = await readPluginManifest(root);
         if (!q || `${manifest.id} ${manifest.name} ${manifest.description ?? ""}`.toLowerCase().includes(q)) out.push(toEntry(manifest, root, this.name));
@@ -857,23 +3259,39 @@ var LocalRegistry = class {
   }
 };
 var HttpRegistry = class {
-  constructor(baseUrl, fetchImpl = fetch) {
+  constructor(baseUrl, fetchImpl = fetch, headers = {}, direct = false) {
     this.baseUrl = baseUrl;
     this.fetchImpl = fetchImpl;
+    this.headers = headers;
+    this.direct = direct;
     this.name = `http:${baseUrl}`;
   }
   baseUrl;
   fetchImpl;
+  headers;
+  direct;
   name;
+  /** Direct link (".json" file, or `direct: true` for an API endpoint) or a folder that contains index.json. */
+  get catalogUrl() {
+    if (this.direct || new URL(this.baseUrl).pathname.toLowerCase().endsWith(".json")) return this.baseUrl;
+    return new URL("index.json", this.baseUrl.endsWith("/") ? this.baseUrl : this.baseUrl + "/").href;
+  }
+  get(url) {
+    return this.fetchImpl(url, { headers: { accept: "application/json, application/octet-stream", ...this.headers } }).then((r) => {
+      if (!r.ok) throw new Error(`store responded ${r.status} for ${new URL(url).pathname}`);
+      return r;
+    });
+  }
   async search(query = "") {
-    const base = this.baseUrl.endsWith("/") ? this.baseUrl : this.baseUrl + "/";
-    const res = await this.fetchImpl(new URL("index.json", base));
-    if (!res.ok) throw new Error(`store responded ${res.status}`);
-    return entriesFromIndex(await res.json(), base, this.name, query);
+    const url = this.catalogUrl;
+    return entriesFromIndex(await (await this.get(url)).json(), url, this.name, query);
   }
   async fetch(entry, dest) {
-    const res = await this.fetchImpl(entry.location);
-    if (!res.ok) throw new Error(`download failed: ${res.status}`);
+    if (entry.folder) {
+      await downloadFolder(entry, dest, (u) => this.get(u));
+      return (await readPluginManifest(dest)).manifest;
+    }
+    const res = await this.get(entry.location);
     const buf = Buffer.from(await res.arrayBuffer());
     if (entry.sha256 && crypto2.createHash("sha256").update(buf).digest("hex") !== entry.sha256.replace(/^sha256-/, "")) {
       throw new Error("downloaded archive does not match the registry checksum");
@@ -900,23 +3318,23 @@ var PluginInstaller = class {
   }
   async installed() {
     const out = [];
-    for (const n of await fs4.readdir(this.pluginsDir).catch(() => [])) {
+    for (const n of await fs5.readdir(this.pluginsDir).catch(() => [])) {
       try {
-        out.push((await readPluginManifest(path4.join(this.pluginsDir, n))).manifest);
+        out.push((await readPluginManifest(path5.join(this.pluginsDir, n))).manifest);
       } catch {
       }
     }
     return out;
   }
   dirOf(id) {
-    return path4.join(this.pluginsDir, id.replace(/[^a-z0-9.-]/gi, "_"));
+    return path5.join(this.pluginsDir, id.replace(/[^a-z0-9.-]/gi, "_"));
   }
   /** Installs (or updates) `entry`. The plugin directory is replaced atomically from a staging directory. */
   async install(entry) {
     const registry = this.registries.find((r) => r.name === entry.source);
     if (!registry) throw new Error(`unknown registry "${entry.source}"`);
-    const stage = path4.join(this.backupDir, ".staging", `${entry.id}-${Date.now()}`);
-    await fs4.mkdir(path4.dirname(stage), { recursive: true });
+    const stage = path5.join(this.backupDir, ".staging", `${entry.id}-${Date.now()}`);
+    await fs5.mkdir(path5.dirname(stage), { recursive: true });
     try {
       const manifest = await registry.fetch(entry, stage);
       await pruneNonRuntime(stage);
@@ -925,31 +3343,31 @@ var PluginInstaller = class {
       let previousVersion;
       try {
         previousVersion = (await readPluginManifest(target)).manifest.version;
-        const bk = path4.join(this.backupDir, entry.id, previousVersion);
-        await fs4.rm(bk, { recursive: true, force: true });
-        await fs4.mkdir(path4.dirname(bk), { recursive: true });
-        await fs4.rename(target, bk);
+        const bk = path5.join(this.backupDir, entry.id, previousVersion);
+        await fs5.rm(bk, { recursive: true, force: true });
+        await fs5.mkdir(path5.dirname(bk), { recursive: true });
+        await fs5.rename(target, bk);
       } catch (e) {
         if (e.code && e.code !== "ENOENT") throw e;
       }
-      await fs4.mkdir(path4.dirname(target), { recursive: true });
-      await fs4.rename(stage, target);
+      await fs5.mkdir(path5.dirname(target), { recursive: true });
+      await fs5.rename(stage, target);
       return { id: entry.id, version: manifest.version, previousVersion };
     } finally {
-      await fs4.rm(stage, { recursive: true, force: true });
+      await fs5.rm(stage, { recursive: true, force: true });
     }
   }
   /** Removes the plugin directory (backups are kept so the user can still roll back/reinstall). */
   async uninstall(id) {
     const dir = this.dirOf(id);
     const { manifest } = await readPluginManifest(dir);
-    const bk = path4.join(this.backupDir, id, manifest.version);
-    await fs4.rm(bk, { recursive: true, force: true });
-    await fs4.mkdir(path4.dirname(bk), { recursive: true });
-    await fs4.rename(dir, bk);
+    const bk = path5.join(this.backupDir, id, manifest.version);
+    await fs5.rm(bk, { recursive: true, force: true });
+    await fs5.mkdir(path5.dirname(bk), { recursive: true });
+    await fs5.rename(dir, bk);
   }
   async versions(id) {
-    const names = await fs4.readdir(path4.join(this.backupDir, id)).catch(() => []);
+    const names = await fs5.readdir(path5.join(this.backupDir, id)).catch(() => []);
     return names.sort(compareVersions);
   }
   /** Restores the newest backup (or `version`) and keeps the replaced version as a backup. */
@@ -961,13 +3379,13 @@ var PluginInstaller = class {
     let current;
     try {
       current = (await readPluginManifest(dir)).manifest.version;
-      const bk = path4.join(this.backupDir, id, current);
-      await fs4.rm(bk, { recursive: true, force: true });
-      await fs4.rename(dir, bk);
+      const bk = path5.join(this.backupDir, id, current);
+      await fs5.rm(bk, { recursive: true, force: true });
+      await fs5.rename(dir, bk);
     } catch (e) {
       if (e.code && e.code !== "ENOENT") throw e;
     }
-    await fs4.rename(path4.join(this.backupDir, id, target), dir);
+    await fs5.rename(path5.join(this.backupDir, id, target), dir);
     return { id, version: target, previousVersion: current };
   }
   /** Entries from registries that are newer than what is installed. */
@@ -978,7 +3396,7 @@ var PluginInstaller = class {
 };
 
 // src/main/stores.ts
-import path5 from "node:path";
+import path6 from "node:path";
 
 // src/main/github-registry.ts
 import crypto3 from "node:crypto";
@@ -1059,6 +3477,10 @@ var GitHubRegistry = class {
     return out.sort((a, b) => (b.stars ?? 0) - (a.stars ?? 0) || a.id.localeCompare(b.id));
   }
   async fetch(entry, dest) {
+    if (entry.folder) {
+      await downloadFolder(entry, dest, (u) => this.get(u, "application/octet-stream"));
+      return (await readPluginManifest(dest)).manifest;
+    }
     const res = await this.get(entry.location, "application/octet-stream");
     const len = Number(res.headers.get("content-length") ?? 0);
     if (len > MAX_PACKAGE_BYTES) throw new Error("package is too large");
@@ -1081,22 +3503,301 @@ function createRegistries(specs = [DEFAULT_STORE], opts = {}) {
       case "github":
         return new GitHubRegistry({ ...s2, token, fetchImpl: opts.fetchImpl });
       case "http":
-        return new HttpRegistry(s2.url, opts.fetchImpl);
+      case "json":
+        return new HttpRegistry(s2.url, opts.fetchImpl, s2.headers, s2.type === "json");
       case "local":
-        return new LocalRegistry(path5.resolve(opts.baseDir ?? process.cwd(), s2.path));
+        return new LocalRegistry(path6.resolve(opts.baseDir ?? process.cwd(), s2.path));
       default:
         throw new Error(`unknown store type: ${JSON.stringify(s2)}`);
     }
   });
 }
 
+// src/main/framework.ts
+var MainFramework = class {
+  constructor(options) {
+    this.options = options;
+    this.logs = new LogStore(5e3);
+    this.state = new JsonStateFile(path7.join(options.dataDir, "plugins-state.json"));
+    this.permissions = new PermissionManager({
+      autoGrant: !options.requireApproval,
+      onChange: (id, snap) => void this.state.update((s2) => ({ approved: { ...s2.approved, [id]: snap.granted } })).catch(() => void 0)
+    });
+    this.manager = new PluginManager({
+      runtime: "main",
+      storage: new FsStorageBackend(path7.join(options.dataDir, "storage")),
+      permissions: this.permissions,
+      logs: this.logs,
+      frameworkVersion: options.frameworkVersion,
+      stateStore: {
+        load: async () => (await this.state.readAll()).disabled,
+        save: (ids) => this.state.update({ disabled: ids })
+      },
+      onBroadcastEvent: (name, payload) => this.broadcast("flux.event." + name, payload),
+      ...options.manager
+    });
+    this.manager.ipc.setTransport({ broadcast: (c, p, t) => this.broadcast(c, p, t) });
+    this.installer = new PluginInstaller(options.installDir ?? options.pluginDirs[0], path7.join(options.dataDir, "backups"), options.registries ?? createRegistries(options.stores));
+    this.manager.subscribe(() => {
+      this.revision++;
+      this.broadcast(MGMT.changed, { revision: this.revision });
+    });
+    this.manager.notifications.onPush((n) => this.broadcast("flux.notification", n));
+    this.registerManagementApi();
+  }
+  options;
+  manager;
+  logs;
+  installer;
+  permissions;
+  state;
+  broadcastListeners = /* @__PURE__ */ new Set();
+  watchers = [];
+  revision = 0;
+  reloadTimers = /* @__PURE__ */ new Map();
+  started = false;
+  /* --------------------------------------------------------- start / stop */
+  async start() {
+    if (this.started) return;
+    this.started = true;
+    const approved = (await this.state.readAll()).approved;
+    const g = globalThis;
+    g.__FLUXPLUGIN_SHARED__ = { ...g.__FLUXPLUGIN_SHARED__ ?? {}, "fluxplugin": core_exports };
+    this.permissions.restore(approved);
+    await this.manager.init();
+    await this.scan();
+    await this.manager.startup();
+    if (this.options.hotReload) this.watch();
+  }
+  discoverOpts() {
+    return { trustedKeys: this.options.trustedKeys, requireSignature: this.options.requireSignature, ...this.options.discover };
+  }
+  /** (Re)scans the plugin directories and registers plugins that are new. */
+  async scan() {
+    for (const dir of this.options.pluginDirs) {
+      for (const p of await discoverPlugins(dir, this.discoverOpts())) {
+        const id = typeof p.manifest["id"] === "string" ? p.manifest["id"] : "";
+        if (id && this.manager.has(id)) continue;
+        const info = this.manager.register(p.source);
+        if (p.problem) this.logs.logger(info.id).error(p.problem);
+      }
+    }
+  }
+  async stop() {
+    for (const w of this.watchers) w.close();
+    this.watchers = [];
+    for (const t of this.reloadTimers.values()) clearTimeout(t);
+    await this.manager.dispose();
+    await this.state.flush();
+  }
+  /** Watches plugin directories and reloads the affected plugin (debounced). */
+  watch() {
+    for (const dir of this.options.pluginDirs) {
+      try {
+        const w = watch(dir, { recursive: true }, (_evt, filename) => {
+          if (!filename) return;
+          const parts = String(filename).split(path7.sep);
+          if (parts.includes("node_modules") || parts.includes("src")) return;
+          const folder = parts[0];
+          clearTimeout(this.reloadTimers.get(folder));
+          this.reloadTimers.set(
+            folder,
+            setTimeout(() => void this.hotReloadFolder(path7.join(dir, folder)), 150)
+          );
+        });
+        this.watchers.push(w);
+      } catch (e) {
+        this.logs.logger("core").warn(`hot reload disabled for ${dir}: ${errorMessage(e)}`);
+      }
+    }
+  }
+  async hotReloadFolder(root) {
+    try {
+      const p = await readPluginDir(root, this.discoverOpts());
+      const id = String(p.manifest["id"] ?? "");
+      if (!id) return;
+      if (!this.manager.has(id)) {
+        this.manager.register(p.source);
+        await this.manager.activate(id).catch(() => void 0);
+      } else {
+        await this.manager.unregister(id);
+        this.manager.register(p.source);
+        await this.manager.activate(id).catch(() => void 0);
+      }
+      this.logs.logger(id).info("hot reloaded");
+      this.broadcast("flux.event.plugin.hotreload", { id });
+    } catch (e) {
+      this.logs.logger("core").error(`hot reload failed for ${root}: ${errorMessage(e)}`);
+    }
+  }
+  /* ----------------------------------------------------------- broadcasting */
+  onBroadcast(l) {
+    this.broadcastListeners.add(l);
+    return () => void this.broadcastListeners.delete(l);
+  }
+  broadcast(channel, payload, target) {
+    for (const l of [...this.broadcastListeners]) {
+      try {
+        l(channel, payload, target);
+      } catch {
+      }
+    }
+  }
+  /* ---------------------------------------------------------------- bootstrap */
+  bootstrap() {
+    const assetUrl = this.options.assetUrl ?? ((id, rel) => `fluxplugin://${id}/${rel.replace(/^\.\//, "")}`);
+    const plugins = this.manager.list().map((info) => {
+      const m = this.manager.manifest(info.id);
+      const rejected = info.state === "error" && info.error?.phase === "validate";
+      return {
+        id: info.id,
+        manifest: m,
+        enabled: info.enabled && !rejected,
+        rendererUrl: m.renderer && !rejected ? assetUrl(info.id, m.renderer) : void 0,
+        styleUrls: (m.styles ?? []).map((s2) => assetUrl(info.id, s2)),
+        granted: info.permissions.granted,
+        state: info.state
+      };
+    });
+    return { frameworkVersion: this.options.frameworkVersion ?? FRAMEWORK_VERSION, plugins, preload: this.manager.preload.manifest(), revision: this.revision };
+  }
+  /* --------------------------------------------------- renderer-facing IPC */
+  exposedChannels(kind) {
+    const out = new Set(this.options.allowedRendererChannels ?? []);
+    for (const e of this.manager.preload.list()) for (const m of Object.values(e.spec)) if (m.kind === kind) out.add(m.channel);
+    return out;
+  }
+  /**
+   * Handles an invoke coming from a renderer. Policy: the renderer may only call channels that a plugin explicitly
+   * exposed through `preload.expose`, channels the host allow-listed, and (optionally) `flux.plugins.*`.
+   */
+  async handleInvoke(req, senderId) {
+    try {
+      if (!req || typeof req.channel !== "string") throw new Error("malformed request");
+      const ch = req.channel;
+      const mgmt = ch.startsWith("flux.plugins.");
+      if (mgmt) {
+        if (this.options.allowManagement === false) throw new Error(`management API is disabled`);
+      } else if (!this.exposedChannels("invoke").has(ch)) {
+        throw new Error(`channel "${ch}" is not exposed to renderers`);
+      }
+      const caller = typeof req.caller === "string" && this.manager.has(req.caller) ? req.caller : "host";
+      if (caller !== "host") this.permissions.assert(caller, "ipc", `invoke("${ch}")`);
+      const value = await this.manager.ipc.invoke(ch, req.input, { caller, senderId });
+      return { ok: true, value };
+    } catch (e) {
+      return { ok: false, error: serializeError(e) };
+    }
+  }
+  handleSend(channel, payload, caller, senderId) {
+    if (typeof channel !== "string" || !this.exposedChannels("send").has(channel)) return;
+    const who = typeof caller === "string" && this.manager.has(caller) ? caller : "host";
+    if (who !== "host" && !this.permissions.has(who, "ipc")) return;
+    this.manager.ipc.dispatch(channel, payload, { caller: who, senderId });
+  }
+  /* -------------------------------------------------------- management API */
+  registerManagementApi() {
+    const ipc = this.manager.ipc;
+    const h = (name, fn) => ipc.handle(name, (i) => fn(i), "host");
+    const list = () => this.manager.list();
+    h(MGMT.list, () => list());
+    h(MGMT.enable, async ({ id }) => (await this.manager.enable(id).catch((e) => this.logs.logger(id).error(errorMessage(e))), list()));
+    h(MGMT.disable, async ({ id }) => (await this.manager.disable(id), list()));
+    h(MGMT.reload, async ({ id }) => (await this.manager.reload(id), list()));
+    h(MGMT.grant, ({ id, permission }) => (this.permissions.grant(id, permission), this.manager.info(id)));
+    h(MGMT.revoke, ({ id, permission }) => (this.permissions.revoke(id, permission), this.manager.info(id)));
+    h(MGMT.configGet, async ({ id }) => this.requireConfig(id).get());
+    h(MGMT.configSet, async ({ id, patch }) => this.requireConfig(id).set(patch));
+    h(MGMT.configReset, async ({ id }) => this.requireConfig(id).reset());
+    h(MGMT.configSchema, ({ id }) => this.manager.getConfig(id)?.describe() ?? null);
+    h(MGMT.logs, ({ id }) => this.logs.query(id ? { source: id } : {}).slice(-200));
+    h(MGMT.diagnostics, ({ id }) => this.manager.diagnostics(id));
+    h(MGMT.details, ({ id }) => this.details(id));
+    h(MGMT.search, async ({ query }) => {
+      const installed = new Map(this.manager.list().map((p) => [p.id, p.version]));
+      return (await this.installer.search(query)).map((e) => ({ ...e, installedVersion: installed.get(e.id) }));
+    });
+    h(MGMT.updates, async () => (await this.installer.updates()).map((e) => ({ ...e, installedVersion: this.manager.has(e.id) ? this.manager.info(e.id).version : void 0 })));
+    h(MGMT.install, async ({ entry }) => this.installAndLoad(entry));
+    h(MGMT.update, async ({ entry }) => this.installAndLoad(entry));
+    h(MGMT.uninstall, async ({ id }) => {
+      await this.manager.unregister(id);
+      await this.installer.uninstall(id);
+      return list();
+    });
+    h(MGMT.rollback, async ({ id, version }) => {
+      await this.manager.unregister(id);
+      const r = await this.installer.rollback(id, version);
+      await this.scan();
+      await this.manager.activate(id).catch(() => void 0);
+      return r;
+    });
+  }
+  /** Store-page data for one plugin: icon, banner, screenshots, video and the README (Markdown). */
+  async details(id) {
+    const m = this.manager.manifest(id);
+    const root = this.manager.info(id).root;
+    const url = this.options.assetUrl ?? ((pid, rel) => `fluxplugin://${pid}/${rel.replace(/^\.\//, "")}`);
+    let readme3;
+    if (root) {
+      const file = path7.resolve(root, m.readme ?? "README.md");
+      if (file.startsWith(path7.resolve(root) + path7.sep)) {
+        try {
+          const st = await fsp.stat(file);
+          if (st.size <= 2e5) readme3 = await fsp.readFile(file, "utf8");
+        } catch {
+        }
+      }
+    }
+    const author = typeof m.author === "string" ? m.author : m.author?.name;
+    const repository = typeof m.repository === "string" ? m.repository : m.repository?.url;
+    return {
+      id,
+      name: m.name,
+      version: m.version,
+      description: m.description,
+      author,
+      license: m.license,
+      homepage: m.homepage,
+      repository,
+      categories: m.categories ?? [],
+      keywords: m.keywords ?? [],
+      links: m.links ?? {},
+      iconUrl: m.icon ? url(id, m.icon) : void 0,
+      bannerUrl: m.banner ? url(id, m.banner) : void 0,
+      screenshotUrls: (m.screenshots ?? []).map((s2) => url(id, s2)),
+      video: (() => {
+        const v = parseVideo(m.video);
+        return v?.kind === "html5" && v.src?.startsWith("./") ? { ...v, src: url(id, v.src) } : v;
+      })(),
+      readme: readme3,
+      assetBase: url(id, "./")
+    };
+  }
+  requireConfig(id) {
+    const c = this.manager.getConfig(id);
+    if (!c) throw new Error(`plugin "${id}" has no configuration (activate it first)`);
+    return c;
+  }
+  async installAndLoad(entry) {
+    const wasActive = this.manager.has(entry.id) && this.manager.info(entry.id).state === "ready";
+    if (this.manager.has(entry.id)) await this.manager.unregister(entry.id);
+    const r = await this.installer.install(entry);
+    await this.scan();
+    if (this.manager.has(entry.id) && (wasActive || !r.previousVersion)) await this.manager.activate(entry.id).catch(() => void 0);
+    return r;
+  }
+  /** Channels used by transports. */
+  static channels = CHANNELS;
+};
+
 // src/cli/build.ts
-import { promises as fs5 } from "node:fs";
-import path8 from "node:path";
+import { existsSync as existsSync2, promises as fs6, watch as fsWatch } from "node:fs";
+import path10 from "node:path";
 import { build, context } from "esbuild";
 
 // src/cli/shared-modules.ts
-import path6 from "node:path";
+import path8 from "node:path";
 var SHARED_MODULES = ["react", "react/jsx-runtime", "react/jsx-dev-runtime", "react-dom", "react-dom/client", "fluxplugin", "fluxplugin/react", "fluxplugin/manager-ui"];
 function sharedModulesPlugin(shared = SHARED_MODULES) {
   const set = new Set(shared);
@@ -1112,7 +3813,7 @@ function sharedModulesPlugin(shared = SHARED_MODULES) {
 if (!m) throw new Error("Shared module ${args.path} is not provided by the host application (see installSharedModules).");
 module.exports = m;`,
         loader: "js",
-        resolveDir: path6.resolve(".")
+        resolveDir: path8.resolve(".")
       }));
     }
   };
@@ -1120,12 +3821,12 @@ module.exports = m;`,
 
 // src/cli/build.ts
 init_tailwind();
-var exists = (f) => fs5.access(f).then(() => true, () => false);
+var exists = (f) => fs6.access(f).then(() => true, () => false);
 async function firstExisting(root, names) {
-  for (const n of names) if (await exists(path8.join(root, n))) return path8.join(root, n);
+  for (const n of names) if (await exists(path10.join(root, n))) return path10.join(root, n);
 }
 async function buildOptions(root, dev = false) {
-  const raw = JSON.parse(await fs5.readFile(path8.join(root, "plugin.json"), "utf8"));
+  const raw = JSON.parse(await fs6.readFile(path10.join(root, "plugin.json"), "utf8"));
   const m = validateManifest(raw).manifest;
   if (!m) throw new Error("invalid plugin.json (run `fluxplugin validate`)");
   const out = [];
@@ -1136,75 +3837,138 @@ async function buildOptions(root, dev = false) {
     logLevel: "warning",
     plugins: [sharedModulesPlugin()],
     jsx: "automatic",
-    loader: { ".module.css": "local-css" }
+    loader: {
+      ".module.css": "local-css",
+      // Images and fonts imported by the plugin (or its libraries) are inlined, so dist/ stays self-contained.
+      ".png": "dataurl",
+      ".jpg": "dataurl",
+      ".jpeg": "dataurl",
+      ".gif": "dataurl",
+      ".webp": "dataurl",
+      ".svg": "dataurl",
+      ".woff": "dataurl",
+      ".woff2": "dataurl",
+      ".ttf": "dataurl"
+    }
   };
   if (m.main) {
     const entry = await firstExisting(root, ["src/main.ts", "src/main.js"]);
     if (!entry) throw new Error("manifest declares `main` but src/main.ts was not found");
-    out.push({ ...common, entryPoints: [entry], outfile: path8.join(root, m.main), platform: "node", format: "esm", target: "node20", external: ["node:*", "electron"] });
+    out.push({ ...common, entryPoints: [entry], outfile: path10.join(root, m.main), platform: "node", format: "esm", target: "node20", external: ["node:*", "electron"] });
   }
   if (m.renderer) {
     const entry = await firstExisting(root, ["src/renderer.tsx", "src/renderer.ts", "src/renderer.jsx", "src/renderer.js"]);
     if (!entry) throw new Error("manifest declares `renderer` but src/renderer.tsx was not found");
-    out.push({ ...common, entryPoints: [entry], outfile: path8.join(root, m.renderer), platform: "browser", format: "esm", target: "chrome120" });
+    out.push({ ...common, entryPoints: [entry], outfile: path10.join(root, m.renderer), platform: "browser", format: "esm", target: "chrome120" });
   }
   for (const css of m.styles ?? []) {
-    if (path8.basename(css) === "tailwind.css") continue;
-    const entry = path8.join(root, "src/styles", path8.basename(css));
-    if (await exists(entry)) out.push({ ...common, plugins: [], entryPoints: [entry], outfile: path8.join(root, css) });
+    if (path10.basename(css) === "tailwind.css") continue;
+    const entry = path10.join(root, "src/styles", path10.basename(css));
+    if (await exists(entry)) out.push({ ...common, plugins: [], entryPoints: [entry], outfile: path10.join(root, css) });
   }
   return out;
 }
-async function buildPlugin(root, watch = false, log2 = console.log) {
-  const opts = await buildOptions(root, watch);
-  const twIn = path8.join(root, "src/styles/tailwind.css");
-  const stopTw = await exists(twIn) ? compileTailwind({ cwd: root, input: twIn, output: path8.join(root, "dist/tailwind.css"), watch, searchFrom: [process.cwd(), path8.dirname(path8.dirname(root))] }, log2) : () => {
+async function buildPlugin(root, watch2 = false, log2 = console.log) {
+  const opts = await buildOptions(root, watch2);
+  const twIn = path10.join(root, "src/styles/tailwind.css");
+  const stopTw = await exists(twIn) ? compileTailwind({ cwd: root, input: twIn, output: path10.join(root, "dist/tailwind.css"), watch: watch2, searchFrom: [process.cwd(), path10.dirname(path10.dirname(root))] }, log2) : () => {
   };
-  if (!watch) {
+  if (!watch2) {
     for (const o of opts) await build(o);
+    await ensureRendererCss(root);
+    await hintMissingDeps(root, log2);
     log2(`built ${opts.length} bundle(s) in ${root}`);
     return async () => stopTw();
   }
   const ctxs = await Promise.all(opts.map((o) => context(o)));
+  await Promise.all(ctxs.map((c) => c.rebuild()));
+  await ensureRendererCss(root);
   await Promise.all(ctxs.map((c) => c.watch()));
   log2(`watching ${root} (${ctxs.length} bundles)`);
   return async () => (stopTw(), void await Promise.all(ctxs.map((c) => c.dispose())));
 }
+async function ensureRendererCss(root) {
+  if (!await exists(path10.join(root, "dist/renderer.css"))) return;
+  const file = path10.join(root, "plugin.json");
+  const raw = JSON.parse(await fs6.readFile(file, "utf8"));
+  const styles2 = raw.styles ?? [];
+  if (styles2.some((s2) => s2.replace(/^\.\//, "") === "dist/renderer.css")) return;
+  raw.styles = [...styles2, "./dist/renderer.css"];
+  await fs6.writeFile(file, JSON.stringify(raw, null, 2));
+}
+async function hintMissingDeps(root, log2) {
+  try {
+    const pkg2 = JSON.parse(await fs6.readFile(path10.join(root, "package.json"), "utf8"));
+    if (Object.keys(pkg2.dependencies ?? {}).length && !await exists(path10.join(root, "node_modules"))) log2(`! ${path10.basename(root)} lists dependencies but has no node_modules: run "npm install" in ${root}`);
+  } catch {
+  }
+}
+async function linkPluginToHost(root, hostDir, log2 = console.log) {
+  const manifest = JSON.parse(await fs6.readFile(path10.join(root, "plugin.json"), "utf8"));
+  const target = path10.join(path10.resolve(hostDir), "plugins", manifest.id);
+  const sync = async () => {
+    try {
+      const copied = await copyPluginRuntime(root, target);
+      const keep = new Set(copied);
+      const walk2 = async (rel) => {
+        for (const e of await fs6.readdir(path10.join(target, rel), { withFileTypes: true })) {
+          const r = rel ? `${rel}/${e.name}` : e.name;
+          if (e.isDirectory()) await walk2(r);
+          else if (!keep.has(r)) await fs6.rm(path10.join(target, r), { force: true });
+        }
+      };
+      await walk2("");
+      log2(`\u21AA synced ${copied.length} files to ${path10.relative(process.cwd(), target) || target}`);
+    } catch (e) {
+      log2(`! sync failed: ${e.message}`);
+    }
+  };
+  await sync();
+  let timer;
+  const watchers = [path10.join(root, "dist"), path10.join(root, "assets"), root].filter((d) => existsSync2(d)).map(
+    (d) => fsWatch(d, { recursive: d !== root }, (_e, name) => {
+      if (d === root && name !== "plugin.json" && name !== "README.md") return;
+      clearTimeout(timer);
+      timer = setTimeout(() => void sync(), 250);
+    })
+  );
+  return () => watchers.forEach((w) => w.close());
+}
 
 // src/cli/host.ts
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync2, promises as fs7, statSync } from "node:fs";
+import { existsSync as existsSync3, promises as fs8, statSync } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import path10 from "node:path";
+import path12 from "node:path";
 import { build as build2, context as context2 } from "esbuild";
 init_tailwind();
 
 // src/cli/config.ts
-import { promises as fs6 } from "node:fs";
-import path9 from "node:path";
+import { promises as fs7 } from "node:fs";
+import path11 from "node:path";
 async function loadConfig(flags, cwd = process.cwd()) {
   let file = {};
   try {
-    file = JSON.parse(await fs6.readFile(path9.join(cwd, "fluxplugin.config.json"), "utf8"));
+    file = JSON.parse(await fs7.readFile(path11.join(cwd, "fluxplugin.config.json"), "utf8"));
   } catch {
   }
   return {
-    pluginsDir: path9.resolve(cwd, flags.dir ?? file.pluginsDir ?? "plugins"),
-    dataDir: path9.resolve(cwd, flags.data ?? file.dataDir ?? ".flux-data"),
+    pluginsDir: path11.resolve(cwd, flags.dir ?? file.pluginsDir ?? "plugins"),
+    dataDir: path11.resolve(cwd, flags.data ?? file.dataDir ?? ".flux-data"),
     stores: Array.isArray(file.stores) && file.stores.length ? file.stores : [DEFAULT_STORE]
   };
 }
 
 // src/cli/host.ts
-var exists2 = (f) => fs7.access(f).then(() => true, () => false);
+var exists2 = (f) => fs8.access(f).then(() => true, () => false);
 async function isHostProject(cwd) {
-  if (await exists2(path10.join(cwd, "fluxplugin.config.json"))) return true;
-  return await exists2(path10.join(cwd, "src/app/renderer/index.tsx")) || await exists2(path10.join(cwd, "src/renderer.tsx"));
+  if (await exists2(path12.join(cwd, "fluxplugin.config.json"))) return true;
+  return await exists2(path12.join(cwd, "src/app/renderer/index.tsx")) || await exists2(path12.join(cwd, "src/renderer.tsx"));
 }
 var nodeBanner = { js: "import { createRequire as __r } from 'node:module'; const require = __r(import.meta.url);" };
 var pick = (cwd, ...rels) => {
-  for (const r of rels) if (existsSync2(path10.join(cwd, r))) return path10.join(cwd, r);
-  return path10.join(cwd, rels[0]);
+  for (const r of rels) if (existsSync3(path12.join(cwd, r))) return path12.join(cwd, r);
+  return path12.join(cwd, rels[0]);
 };
 function hostBuilds(cwd, outDir, dev) {
   const common = { absWorkingDir: cwd, bundle: true, sourcemap: dev, logLevel: "warning", jsx: "automatic", define: { "process.env.NODE_ENV": JSON.stringify(dev ? "development" : "production") } };
@@ -1213,30 +3977,30 @@ function hostBuilds(cwd, outDir, dev) {
   const preload = pick(cwd, "src/app/preload/index.ts", "src/preload.ts");
   const web = pick(cwd, "src/app/main/web.ts", "src/web.ts");
   return [
-    { ...common, entryPoints: [renderer], outfile: path10.join(outDir, "renderer.js"), platform: "browser", format: "esm", target: "chrome120" },
-    { ...common, entryPoints: [main], outfile: path10.join(outDir, "main.cjs"), platform: "node", format: "cjs", target: "node20", external: ["electron"] },
-    { ...common, entryPoints: [preload], outfile: path10.join(outDir, "preload.cjs"), platform: "node", format: "cjs", target: "node20", external: ["electron"] },
-    { ...common, entryPoints: [web], outfile: path10.join(outDir, "web.mjs"), platform: "node", format: "esm", target: "node20", external: ["electron"], banner: nodeBanner }
+    { ...common, entryPoints: [renderer], outfile: path12.join(outDir, "renderer.js"), platform: "browser", format: "esm", target: "chrome120" },
+    { ...common, entryPoints: [main], outfile: path12.join(outDir, "main.cjs"), platform: "node", format: "cjs", target: "node20", external: ["electron"] },
+    { ...common, entryPoints: [preload], outfile: path12.join(outDir, "preload.cjs"), platform: "node", format: "cjs", target: "node20", external: ["electron"] },
+    { ...common, entryPoints: [web], outfile: path12.join(outDir, "web.mjs"), platform: "node", format: "esm", target: "node20", external: ["electron"], banner: nodeBanner }
   ];
 }
 async function pluginDirs(cwd, pluginsDir) {
-  const names = await fs7.readdir(pluginsDir).catch(() => []);
+  const names = await fs8.readdir(pluginsDir).catch(() => []);
   const out = [];
-  for (const n of names.sort()) if (await exists2(path10.join(pluginsDir, n, "plugin.json"))) out.push(path10.join(pluginsDir, n));
+  for (const n of names.sort()) if (await exists2(path12.join(pluginsDir, n, "plugin.json"))) out.push(path12.join(pluginsDir, n));
   void cwd;
   return out;
 }
 async function buildHost(cwd, opts = {}) {
   const log2 = opts.log ?? console.log;
-  const cfgFile = JSON.parse(await fs7.readFile(path10.join(cwd, "fluxplugin.config.json"), "utf8").catch(() => "{}"));
+  const cfgFile = JSON.parse(await fs8.readFile(path12.join(cwd, "fluxplugin.config.json"), "utf8").catch(() => "{}"));
   const cfg = await loadConfig({}, cwd);
-  const outDir = path10.resolve(cwd, cfgFile.outDir ?? "dist");
-  await fs7.mkdir(outDir, { recursive: true });
-  await fs7.copyFile(pick(cwd, "src/app/renderer/index.html", "src/index.html"), path10.join(outDir, "index.html"));
+  const outDir = path12.resolve(cwd, cfgFile.outDir ?? "dist");
+  await fs8.mkdir(outDir, { recursive: true });
+  await fs8.copyFile(pick(cwd, "src/app/renderer/index.html", "src/index.html"), path12.join(outDir, "index.html"));
   const disposers = [];
-  const twIn = path10.join(cwd, "src/app/renderer/styles/tailwind.css");
+  const twIn = path12.join(cwd, "src/app/renderer/styles/tailwind.css");
   if (await exists2(twIn)) {
-    const stop = compileTailwind({ cwd, input: twIn, output: path10.join(outDir, "tailwind.css"), watch: opts.watch }, log2);
+    const stop = compileTailwind({ cwd, input: twIn, output: path12.join(outDir, "tailwind.css"), watch: opts.watch }, log2);
     disposers.push(async () => stop());
   }
   const opts2 = hostBuilds(cwd, outDir, !!opts.watch);
@@ -1250,16 +4014,16 @@ async function buildHost(cwd, opts = {}) {
     try {
       disposers.push(await buildPlugin(dir, !!opts.watch, log2));
     } catch (e) {
-      log2(`! plugin ${path10.basename(dir)} not built: ${e.message}`);
+      log2(`! plugin ${path12.basename(dir)} not built: ${e.message}`);
     }
   }
-  log2(`host built \u2192 ${path10.relative(cwd, outDir) || "."}`);
+  log2(`host built \u2192 ${path12.relative(cwd, outDir) || "."}`);
   return async () => void await Promise.all(disposers.map((d) => d()));
 }
 function electronBinary(cwd) {
   try {
-    const p = createRequire2(path10.join(cwd, "package.json"))("electron");
-    if (typeof p === "string" && existsSync2(p)) return { bin: p };
+    const p = createRequire2(path12.join(cwd, "package.json"))("electron");
+    if (typeof p === "string" && existsSync3(p)) return { bin: p };
     return { error: "the Electron binary was not found" };
   } catch (e) {
     return { error: e.message.split("\n")[0] };
@@ -1270,12 +4034,12 @@ function ensureElectron(cwd, log2 = console.log) {
   if (first.bin) return first;
   let pkgDir;
   try {
-    pkgDir = path10.dirname(createRequire2(path10.join(cwd, "package.json")).resolve("electron/package.json"));
+    pkgDir = path12.dirname(createRequire2(path12.join(cwd, "package.json")).resolve("electron/package.json"));
   } catch {
     return { error: "Electron is not installed in this project" };
   }
-  const installJs = path10.join(pkgDir, "install.js");
-  if (!existsSync2(installJs)) return first;
+  const installJs = path12.join(pkgDir, "install.js");
+  if (!existsSync3(installJs)) return first;
   log2("Electron's binary is missing (your package manager blocked its install script) \u2192 downloading it now\u2026");
   const r = spawnSync2(process.execPath, [installJs], { cwd: pkgDir, stdio: "inherit" });
   if (r.status !== 0) return { error: "the Electron download failed (network or proxy?). Retry, or set ELECTRON_MIRROR" };
@@ -1285,7 +4049,7 @@ function needsNoSandbox(bin) {
   if (process.platform !== "linux") return false;
   if (process.getuid?.() === 0) return true;
   try {
-    const st = statSync(path10.join(path10.dirname(bin), "chrome-sandbox"));
+    const st = statSync(path12.join(path12.dirname(bin), "chrome-sandbox"));
     return !(st.uid === 0 && (st.mode & 2048) !== 0);
   } catch {
     return false;
@@ -1294,12 +4058,12 @@ function needsNoSandbox(bin) {
 function startApp(cwd, opts = {}) {
   const log2 = opts.log ?? console.log;
   const env = { ...process.env, FLUXPLUGIN_PROJECT: cwd, ...opts.dev ? { FLUXPLUGIN_DEV: "1" } : {}, ...opts.port ? { PORT: String(opts.port) } : {} };
-  if (opts.web) return { child: spawn2(process.execPath, [path10.join(cwd, "dist/web.mjs")], { cwd, env, stdio: "inherit" }), mode: "web" };
+  if (opts.web) return { child: spawn2(process.execPath, [path12.join(cwd, "dist/web.mjs")], { cwd, env, stdio: "inherit" }), mode: "web" };
   const { bin, error } = ensureElectron(cwd, log2);
   if (!bin) throw new Error(`cannot start Electron: ${error}.
   Try:  npm install -D electron   then   fluxplugin doctor
   Or run in a browser:  fluxplugin ${opts.dev ? "dev" : "start"} --web`);
-  const args = [...process.env["FLUXPLUGIN_ELECTRON_ARGS"]?.split(" ").filter(Boolean) ?? [], path10.join(cwd, "dist/main.cjs")];
+  const args = [...process.env["FLUXPLUGIN_ELECTRON_ARGS"]?.split(" ").filter(Boolean) ?? [], path12.join(cwd, "dist/main.cjs")];
   if (needsNoSandbox(bin)) {
     args.unshift("--no-sandbox");
     log2("! Linux: Electron's sandbox helper is not configured (or you run as root) \u2192 starting with --no-sandbox.\n  To fix permanently: sudo chown root node_modules/electron/dist/chrome-sandbox && sudo chmod 4755 node_modules/electron/dist/chrome-sandbox");
@@ -1314,10 +4078,398 @@ function startApp(cwd, opts = {}) {
 
 // src/cli/host-files.generated.ts
 var HOST_APP_FILES = {
-  "src/app/main/framework.ts": 'import { MainFramework, type StoreSpec } from "fluxplugin/main";\nimport config from "../../../fluxplugin.config.json"; // bundled into the app at build time\nimport { CHANNELS } from "../shared/constants";\nimport { registerOperations } from "./operations";\n\nexport interface FrameworkOptions {\n  pluginDirs: string[];\n  dataDir: string;\n  dev?: boolean;\n  assetUrl?: (id: string, rel: string) => string;\n}\n\n/** Creates the plugin framework. Shared by the Electron entry (index.ts) and the browser entry (web.ts). */\nexport function createFramework(opts: FrameworkOptions): MainFramework {\n  const fw = new MainFramework({\n    pluginDirs: opts.pluginDirs,\n    dataDir: opts.dataDir,\n    hotReload: opts.dev,\n    assetUrl: opts.assetUrl,\n    // Where "Plugins \u2192 Available" looks. Default: GitHub (every repo that published with `fluxplugin publish`).\n    // Edit "stores" in fluxplugin.config.json to add your own store (github catalog, http, local) \u2014 see docs/STORE.md.\n    stores: config.stores as StoreSpec[],\n    requireApproval: false, // true \u2192 users must approve each plugin\'s permissions\n    allowedRendererChannels: [CHANNELS.createItem, CHANNELS.setTitleBarOverlay],\n  });\n  registerOperations(fw);\n  return fw;\n}\n',
-  "src/app/main/index.ts": '// Electron entry (main process). Keep it thin: wiring only, logic lives in the other files of this folder.\nimport { app, ipcMain, Menu, protocol, webContents } from "electron";\nimport path from "node:path";\nimport { PLUGIN_SCHEME, attachElectron, registerPluginProtocol } from "fluxplugin/main";\nimport { APP_NAME } from "../shared/constants";\nimport { createFramework } from "./framework";\nimport { pluginDirs, projectRoot } from "./paths";\nimport { createMainWindow } from "./window";\nimport { registerWindowApi } from "./window-api";\n\n// Own data folder per app. In dev Electron is started as `electron dist/main.cjs` and would otherwise be called "Electron",\n// sharing plugin state (enabled/disabled, permissions, settings) with every other app run that way.\napp.setName(APP_NAME);\n\nprotocol.registerSchemesAsPrivileged([PLUGIN_SCHEME]); // must run before the app is ready\n\napp.whenReady().then(async () => {\n  const dev = !!process.env["FLUXPLUGIN_DEV"];\n  // The menu bar is drawn by the renderer (<TitleBar />). Windows/Linux: no native menu. macOS keeps a minimal one\n  // so the system shortcuts (copy/paste/quit/hide) keep working.\n  Menu.setApplicationMenu(process.platform === "darwin" ? Menu.buildFromTemplate([{ role: "appMenu" }, { role: "editMenu" }, { role: "windowMenu" }]) : null);\n\n  const fw = createFramework({\n    pluginDirs: pluginDirs(projectRoot(__dirname), app.getPath("userData")),\n    dataDir: path.join(app.getPath("userData"), "plugins-data"),\n    dev,\n  });\n  registerPluginProtocol(fw, protocol);\n  attachElectron(fw, { ipcMain: ipcMain as never, webContents: webContents as never });\n  await fw.start();\n\n  const win = createMainWindow(__dirname);\n  registerWindowApi(fw, win);\n  if (dev) win.webContents.on("before-input-event", (_e, input) => input.key === "F12" && input.type === "keyDown" && win.webContents.toggleDevTools());\n  app.on("before-quit", () => void fw.stop());\n});\n\napp.on("window-all-closed", () => app.quit());\n',
+  "electron-builder.yml": '# Produces the installer/executable: `npm run dist` (current OS) or `npm run dist -- --win --mac --linux`.\nappId: com.example.__APP_ID__\nproductName: __APP_NAME__\ndirectories:\n  output: release\nfiles:\n  - dist/**/*\n  - package.json\n  - "!**/*.map"\n# Plugins are copied by `fluxplugin dist` into .flux-build/plugins with runtime files only (no src, no .ts, no sourcemaps).\nextraResources:\n  - from: .flux-build/plugins\n    to: plugins\nasar: true\nwin:\n  target: [nsis]\nnsis:\n  oneClick: false\n  allowToChangeInstallationDirectory: true\n  # Plugins the user installed live in the app\'s data folder; this removes them with the app when it is uninstalled.\n  deleteAppDataOnUninstall: true\nmac:\n  target: [dmg, zip]\n  category: public.app-category.productivity\nlinux:\n  target: [AppImage, deb]\n  category: Utility\n',
+  "plugins/appearance/README.md": "# Appearance\n\nMake the app yours. This plugin adds an **Appearance** page to *Settings* and four extra themes.\n\n## What you can change\n\n- **Mode** \u2014 System, Light or Dark.\n- **Theme** \u2014 Midnight, Sunset, Forest or high-contrast Graphite.\n- **Accent color** \u2014 seven colors, or the theme's own.\n- **Text** \u2014 font family, any font installed on your computer, size and line spacing.\n- **Layout** \u2014 compact or comfortable spacing, corner roundness, translucency and reduced motion.\n\n> [!TIP]\n> Type the name of any font installed on your computer in *Your own font*. If it is missing, the next font in the list is used.\n\n## How it works\n\n| Setting | Stored as |\n| --- | --- |\n| Theme and mode | the app's theme variables |\n| Fonts, size, spacing | CSS variables on the page |\n\nYour choices are saved on this device and apply to every plugin, because plugins use the same variables.\n\n## For developers\n\nPlugins can add their own **themes** and **fonts** to the same lists \u2014 see the `theme` and `font` extension points in the documentation.\n",
+  "plugins/appearance/assets/icon.svg": '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96"><rect width="96" height="96" rx="22" fill="hsl(280 72% 50%)"/><text x="48" y="64" font-family="system-ui,sans-serif" font-size="52" font-weight="700" text-anchor="middle" fill="#fff">A</text></svg>\n',
+  "plugins/appearance/plugin.json": '{\n  "id": "com.fluxplugin.appearance",\n  "name": "Appearance",\n  "version": "1.0.0",\n  "description": "Themes, accent colors, fonts, text size, density and more \\u2014 everything about how the app looks.",\n  "author": "fluxplugin",\n  "license": "MIT",\n  "icon": "./assets/icon.svg",\n  "readme": "./README.md",\n  "categories": [\n    "Personalization"\n  ],\n  "keywords": [\n    "theme",\n    "font",\n    "accent",\n    "dark mode"\n  ],\n  "links": {},\n  "renderer": "./dist/renderer.js",\n  "activationEvents": [\n    "onStartup"\n  ],\n  "permissions": [\n    "ui"\n  ],\n  "engines": {\n    "fluxplugin": "^1.0.0"\n  }\n}',
+  "plugins/appearance/src/renderer.tsx": `import { definePlugin } from "fluxplugin";
+import { Button, Group, Row, Segmented, Switch, useAppearance, useT, useTheme, type ThemeMode } from "fluxplugin/react";
+import { useState } from "react";
+
+const ACCENTS = ["#007aff", "#34c759", "#ff9f0a", "#af52de", "#ff375f", "#5ac8fa", "#8e8e93"];
+
+function AppearanceSection() {
+  const t = useT();
+  const { mode, setMode, themeId, setThemeId, themes } = useTheme();
+  const { appearance: a, setAppearance, resetAppearance, fonts } = useAppearance();
+  const [custom, setCustom] = useState(a.customFont);
+  return (
+    <>
+      <Group title={t("appearance.mode", "Mode")}>
+        <Row title={t("appearance.mode", "Mode")} right={
+          <Segmented<ThemeMode> value={(themeId ? "" : mode) as ThemeMode} onChange={setMode} label="Mode"
+            options={[{ value: "system", label: t("theme.system", "System") }, { value: "light", label: t("theme.light", "Light") }, { value: "dark", label: t("theme.dark", "Dark") }]} />} />
+      </Group>
+
+      <Group title={t("appearance.theme", "Theme")}>
+        <div style={{ display: "flex", gap: 12, flexWrap: "wrap", padding: 14 }}>
+          {[{ id: "", label: t("appearance.themeDefault", "Default"), tokens: { "--flux-bg": "#ffffff", "--flux-surface": "#f5f5f7", "--flux-accent": "#007aff" } }, ...themes].map((th) => (
+            <button key={th.id || "default"} type="button" className="flux-theme-card" data-on={(themeId ?? "") === th.id || undefined} data-testid={"theme-" + (th.id || "default")} onClick={() => (th.id ? setThemeId(th.id) : setMode(mode))}>
+              <span className="flux-theme-prev" style={{ display: "flex" }}>
+                <i style={{ flex: 2, background: th.tokens["--flux-bg"] }} /><i style={{ flex: 1, background: th.tokens["--flux-surface"] }} /><i style={{ flex: 1, background: th.tokens["--flux-accent"] }} />
+              </span>
+              <span className="cap">{th.label}</span>
+            </button>
+          ))}
+        </div>
+      </Group>
+
+      <Group title={t("appearance.accent", "Accent color")}>
+        <div className="flux-swatches" style={{ padding: 14 }}>
+          <button type="button" className="flux-swatch" title={t("appearance.accentDefault", "Theme default")} style={{ background: "conic-gradient(#ff3b30,#ff9f0a,#34c759,#0a84ff,#af52de,#ff3b30)" }} data-on={!a.accent || undefined} onClick={() => setAppearance({ accent: undefined })} />
+          {ACCENTS.map((c) => <button key={c} type="button" aria-label={c} className="flux-swatch" style={{ background: c }} data-on={a.accent === c || undefined} data-testid={"accent-" + c.slice(1)} onClick={() => setAppearance({ accent: c })} />)}
+        </div>
+      </Group>
+
+      <Group title={t("appearance.text", "Text")}>
+        <Row title={t("appearance.font", "Font")} right={
+          <select className="flux-select" value={a.fontId} data-testid="font-select" onChange={(e) => setAppearance({ fontId: e.target.value })}>{fonts.map((f) => <option key={f.id} value={f.id}>{f.label}</option>)}</select>} />
+        <Row title={t("appearance.customFont", "Your own font")} subtitle={t("appearance.customFontHint", "Any font installed on your computer")} right={
+          <input className="flux-input" style={{ width: 170 }} placeholder="e.g. Avenir Next" value={custom} data-testid="custom-font" onChange={(e) => setCustom(e.target.value)} onBlur={() => setAppearance({ customFont: custom })} onKeyDown={(e) => e.key === "Enter" && setAppearance({ customFont: custom })} />} />
+        <Row title={t("appearance.fontSize", "Text size")} right={<><input className="flux-range" type="range" min={12} max={20} step={1} value={a.fontSize} data-testid="font-size" onChange={(e) => setAppearance({ fontSize: Number(e.target.value) })} /><span style={{ width: 34, textAlign: "right" }}>{a.fontSize}px</span></>} />
+        <Row title={t("appearance.lineHeight", "Line spacing")} right={<input className="flux-range" type="range" min={1.2} max={2} step={0.05} value={a.lineHeight} onChange={(e) => setAppearance({ lineHeight: Number(e.target.value) })} />} />
+        <div style={{ padding: "4px 14px 14px" }}><p style={{ margin: 0 }}>{t("appearance.preview", "The quick brown fox jumps over the lazy dog.")}</p></div>
+      </Group>
+
+      <Group title={t("appearance.layout", "Layout")}>
+        <Row title={t("appearance.density", "Spacing")} right={
+          <Segmented value={a.density} onChange={(density) => setAppearance({ density })} label="Spacing" options={[{ value: "comfortable", label: t("appearance.comfortable", "Comfortable") }, { value: "compact", label: t("appearance.compact", "Compact") }]} />} />
+        <Row title={t("appearance.radius", "Corners")} right={
+          <Segmented value={a.radius} onChange={(radius) => setAppearance({ radius })} label="Corners" options={[{ value: "sharp", label: t("appearance.sharp", "Sharp") }, { value: "default", label: t("appearance.default", "Default") }, { value: "round", label: t("appearance.round", "Round") }]} />} />
+        <Row title={t("appearance.translucency", "Translucency")} right={<Switch checked={a.translucency} onChange={(translucency) => setAppearance({ translucency })} label="Translucency" />} />
+        <Row title={t("appearance.motion", "Reduce motion")} right={<Switch checked={a.reduceMotion} onChange={(reduceMotion) => setAppearance({ reduceMotion })} label="Reduce motion" />} />
+      </Group>
+      <Button variant="destructive" onClick={() => (resetAppearance(), setCustom(""))}>{t("appearance.reset", "Reset appearance")}</Button>
+    </>
+  );
+}
+
+export default definePlugin({
+  extensions: [
+    { point: "settings", contribution: { sections: [{ id: "appearance", title: "Appearance", icon: "palette", order: 10, component: AppearanceSection }] } },
+    { point: "theme", contribution: { themes: [
+      { id: "midnight", label: "Midnight", dark: true, tokens: { "--flux-bg": "#0b1020", "--flux-surface": "#111936", "--flux-surface-2": "#1a2447", "--flux-fg": "#e6ebff", "--flux-muted": "#8f9bc7", "--flux-border": "rgba(150,170,255,.18)", "--flux-accent": "#7c9cff", "--flux-material": "rgba(17,25,54,.72)" } },
+      { id: "sunset", label: "Sunset", tokens: { "--flux-bg": "#fff8f1", "--flux-surface": "#ffefe0", "--flux-surface-2": "#ffe0c7", "--flux-fg": "#3b1f12", "--flux-muted": "#9a6b53", "--flux-border": "rgba(120,60,20,.16)", "--flux-accent": "#ff6a3d", "--flux-material": "rgba(255,239,224,.8)" } },
+      { id: "forest", label: "Forest", dark: true, tokens: { "--flux-bg": "#0f1a14", "--flux-surface": "#162720", "--flux-surface-2": "#1f3a2e", "--flux-fg": "#e4f3ea", "--flux-muted": "#8fb3a0", "--flux-border": "rgba(150,230,190,.16)", "--flux-accent": "#34d399", "--flux-material": "rgba(22,39,32,.74)" } },
+      { id: "graphite", label: "Graphite (high contrast)", tokens: { "--flux-bg": "#ffffff", "--flux-surface": "#f0f0f0", "--flux-surface-2": "#dcdcdc", "--flux-fg": "#000000", "--flux-muted": "#3a3a3a", "--flux-border": "#000000", "--flux-accent": "#0040dd", "--flux-material": "rgba(240,240,240,.95)" } },
+    ] } },
+    { point: "font", contribution: { fonts: [
+      { id: "editorial", label: "Editorial", stack: '"Iowan Old Style", "Palatino Linotype", Palatino, Georgia, serif' },
+      { id: "geometric", label: "Geometric", stack: '"Avenir Next", Avenir, "Century Gothic", Futura, "Trebuchet MS", sans-serif' },
+      { id: "readable", label: "Easy reading", stack: '"Atkinson Hyperlegible", Verdana, Tahoma, sans-serif' },
+    ] } },
+  ],
+});
+`,
+  "plugins/language/README.md": "# Language\n\nChoose the language of the whole interface: menus, search, notifications, settings and the plugin manager.\n\n## Languages included\n\n| Language | Code |\n| --- | --- |\n| English | `en` |\n| Fran\xE7ais | `fr` |\n| Espa\xF1ol | `es` |\n| Deutsch | `de` |\n\nOpen **Settings \u2192 Language** and pick one. The change is instant and remembered.\n\n## Add your own language\n\n1. Copy `src/messages.ts` and translate the values.\n2. Add the language to the list in `src/renderer.tsx`.\n3. Build with `fluxplugin build`.\n\n> [!NOTE]\n> Any plugin can ship translations \u2014 the app merges them. Missing words fall back to English, so a partial translation is fine.\n\n## Right-to-left languages\n\nSet `rtl: true` on a language (Arabic, Hebrew\u2026) and the whole interface mirrors automatically.\n",
+  "plugins/language/assets/icon.svg": '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96"><rect width="96" height="96" rx="22" fill="hsl(205 72% 50%)"/><text x="48" y="64" font-family="system-ui,sans-serif" font-size="52" font-weight="700" text-anchor="middle" fill="#fff">L</text></svg>\n',
+  "plugins/language/plugin.json": '{\n  "id": "com.fluxplugin.language",\n  "name": "Language",\n  "version": "1.0.0",\n  "description": "Use the app in English, French, Spanish or German \\u2014 and add your own language.",\n  "author": "fluxplugin",\n  "license": "MIT",\n  "icon": "./assets/icon.svg",\n  "readme": "./README.md",\n  "categories": [\n    "Personalization"\n  ],\n  "keywords": [\n    "language",\n    "translation",\n    "i18n",\n    "fran\\u00e7ais",\n    "espa\\u00f1ol",\n    "deutsch"\n  ],\n  "links": {},\n  "renderer": "./dist/renderer.js",\n  "activationEvents": [\n    "onStartup"\n  ],\n  "permissions": [\n    "ui"\n  ],\n  "engines": {\n    "fluxplugin": "^1.0.0"\n  }\n}',
+  "plugins/language/src/messages.ts": `/** Translations. Keys are the ones the app and its plugins pass to useT(); English is the built-in fallback. */
+export const messages: Record<string, Record<string, string>> = {
+  "fr": {
+    "menu.dashboard": "Tableau de bord",
+    "menu.plugins": "Extensions",
+    "menu.settings": "R\xE9glages",
+    "theme.toggle": "Changer d'apparence",
+    "theme.system": "Syst\xE8me",
+    "theme.light": "Clair",
+    "theme.dark": "Sombre",
+    "search.placeholder": "Rechercher commandes, pages\u2026",
+    "search.label": "Rechercher",
+    "search.commands": "Commandes",
+    "search.pages": "Pages",
+    "search.noResults": "Aucun r\xE9sultat",
+    "notifications.title": "Notifications",
+    "notifications.clear": "Tout effacer",
+    "notifications.empty": "Tout est \xE0 jour",
+    "palette.placeholder": "Saisir une commande\u2026",
+    "palette.empty": "Aucune commande correspondante",
+    "sidebar.expand": "D\xE9velopper la barre lat\xE9rale",
+    "sidebar.collapse": "R\xE9duire la barre lat\xE9rale",
+    "settings.title": "R\xE9glages",
+    "settings.empty": "Aucun r\xE9glage",
+    "settings.general": "G\xE9n\xE9ral",
+    "settings.shortcuts": "Raccourcis",
+    "settings.appearance": "Apparence",
+    "settings.language": "Langue",
+    "settings.about": "\xC0 propos",
+    "settings.app": "Application",
+    "settings.plugins": "Extensions",
+    "settings.engine": "Moteur",
+    "settings.sidebar": "Barre lat\xE9rale",
+    "settings.sidebarHint": "R\xE9duit la barre lat\xE9rale en ic\xF4nes. Raccourci : Ctrl/Cmd+B.",
+    "settings.compactSidebar": "Barre lat\xE9rale compacte",
+    "plugins.title": "Extensions",
+    "plugins.installed": "Install\xE9es",
+    "plugins.discover": "D\xE9couvrir",
+    "plugins.updates": "Mises \xE0 jour",
+    "plugins.search": "Rechercher des extensions",
+    "plugins.none": "Aucune extension install\xE9e",
+    "plugins.searching": "Recherche dans les catalogues\u2026",
+    "plugins.upToDate": "Tout est \xE0 jour.",
+    "plugins.storeEmpty": "Aucune extension trouv\xE9e dans vos catalogues.",
+    "plugins.installedTag": "Install\xE9e",
+    "plugins.get": "Obtenir",
+    "plugins.update": "Mettre \xE0 jour",
+    "plugins.open": "Ouvrir",
+    "plugins.back": "Extensions",
+    "plugins.notFound": "Cette extension n'est pas install\xE9e.",
+    "plugins.enable": "Activer",
+    "plugins.enabled": "Activ\xE9e",
+    "plugins.disabled": "D\xE9sactiv\xE9e",
+    "plugins.reload": "Recharger",
+    "plugins.uninstall": "D\xE9sinstaller",
+    "plugins.video": "Vid\xE9o",
+    "plugins.about": "\xC0 propos",
+    "plugins.permissions": "Autorisations",
+    "plugins.permissionsFooter": "Une extension n'obtient que ce qu'elle d\xE9clare. Les acc\xE8s sensibles sont signal\xE9s.",
+    "plugins.noPermissions": "Aucun acc\xE8s particulier",
+    "plugins.sensitive": "Sensible",
+    "plugins.information": "Informations",
+    "plugins.developer": "D\xE9veloppeur",
+    "plugins.version": "Version",
+    "plugins.license": "Licence",
+    "plugins.dependencies": "N\xE9cessite",
+    "plugins.keywords": "Mots-cl\xE9s",
+    "plugins.settings": "R\xE9glages",
+    "plugins.saved": "Enregistr\xE9",
+    "plugins.reset": "R\xE9tablir les valeurs par d\xE9faut",
+    "plugins.logs": "Journal",
+    "plugins.noLogs": "Aucun journal",
+    "plugins.installedVersion": "Install\xE9e : {v}",
+    "state.ready": "Active",
+    "state.error": "Erreur",
+    "state.disabled": "D\xE9sactiv\xE9e",
+    "appearance.mode": "Mode",
+    "appearance.theme": "Th\xE8me",
+    "appearance.themeDefault": "Par d\xE9faut",
+    "appearance.accent": "Couleur d'accentuation",
+    "appearance.accentDefault": "Selon le th\xE8me",
+    "appearance.text": "Texte",
+    "appearance.font": "Police",
+    "appearance.customFont": "Votre propre police",
+    "appearance.customFontHint": "Toute police install\xE9e sur votre ordinateur",
+    "appearance.fontSize": "Taille du texte",
+    "appearance.lineHeight": "Interligne",
+    "appearance.preview": "Portez ce vieux whisky au juge blond qui fume.",
+    "appearance.layout": "Disposition",
+    "appearance.density": "Espacement",
+    "appearance.comfortable": "Confortable",
+    "appearance.compact": "Compact",
+    "appearance.radius": "Coins",
+    "appearance.sharp": "Droits",
+    "appearance.default": "Par d\xE9faut",
+    "appearance.round": "Arrondis",
+    "appearance.translucency": "Transparence",
+    "appearance.motion": "R\xE9duire les animations",
+    "appearance.reset": "R\xE9initialiser l'apparence",
+    "language.follow": "Suivre la langue du syst\xE8me"
+  },
+  "es": {
+    "menu.dashboard": "Panel",
+    "menu.plugins": "Extensiones",
+    "menu.settings": "Ajustes",
+    "theme.toggle": "Cambiar apariencia",
+    "theme.system": "Sistema",
+    "theme.light": "Claro",
+    "theme.dark": "Oscuro",
+    "search.placeholder": "Buscar comandos, p\xE1ginas\u2026",
+    "search.label": "Buscar",
+    "search.commands": "Comandos",
+    "search.pages": "P\xE1ginas",
+    "search.noResults": "Sin resultados",
+    "notifications.title": "Notificaciones",
+    "notifications.clear": "Borrar todo",
+    "notifications.empty": "Todo al d\xEDa",
+    "palette.placeholder": "Escribe un comando\u2026",
+    "palette.empty": "Ning\xFAn comando coincide",
+    "sidebar.expand": "Expandir barra lateral",
+    "sidebar.collapse": "Contraer barra lateral",
+    "settings.title": "Ajustes",
+    "settings.empty": "Sin ajustes",
+    "settings.general": "General",
+    "settings.shortcuts": "Atajos",
+    "settings.appearance": "Apariencia",
+    "settings.language": "Idioma",
+    "settings.about": "Acerca de",
+    "settings.app": "Aplicaci\xF3n",
+    "settings.plugins": "Extensiones",
+    "settings.engine": "Motor",
+    "settings.sidebar": "Barra lateral",
+    "settings.sidebarHint": "Reduce la barra lateral a iconos. Atajo: Ctrl/Cmd+B.",
+    "settings.compactSidebar": "Barra lateral compacta",
+    "plugins.title": "Extensiones",
+    "plugins.installed": "Instaladas",
+    "plugins.discover": "Descubrir",
+    "plugins.updates": "Actualizaciones",
+    "plugins.search": "Buscar extensiones",
+    "plugins.none": "No hay extensiones instaladas",
+    "plugins.searching": "Buscando en los cat\xE1logos\u2026",
+    "plugins.upToDate": "Todo est\xE1 actualizado.",
+    "plugins.storeEmpty": "No se encontraron extensiones en tus cat\xE1logos.",
+    "plugins.installedTag": "Instalada",
+    "plugins.get": "Obtener",
+    "plugins.update": "Actualizar",
+    "plugins.open": "Abrir",
+    "plugins.back": "Extensiones",
+    "plugins.notFound": "Esta extensi\xF3n no est\xE1 instalada.",
+    "plugins.enable": "Activar",
+    "plugins.enabled": "Activada",
+    "plugins.disabled": "Desactivada",
+    "plugins.reload": "Recargar",
+    "plugins.uninstall": "Desinstalar",
+    "plugins.video": "V\xEDdeo",
+    "plugins.about": "Descripci\xF3n",
+    "plugins.permissions": "Permisos",
+    "plugins.permissionsFooter": "Las extensiones solo obtienen lo que declaran. Los accesos sensibles se destacan.",
+    "plugins.noPermissions": "Sin accesos especiales",
+    "plugins.sensitive": "Sensible",
+    "plugins.information": "Informaci\xF3n",
+    "plugins.developer": "Desarrollador",
+    "plugins.version": "Versi\xF3n",
+    "plugins.license": "Licencia",
+    "plugins.dependencies": "Requiere",
+    "plugins.keywords": "Palabras clave",
+    "plugins.settings": "Ajustes",
+    "plugins.saved": "Guardado",
+    "plugins.reset": "Restablecer valores",
+    "plugins.logs": "Registro",
+    "plugins.noLogs": "Sin registros",
+    "plugins.installedVersion": "Instalada: {v}",
+    "state.ready": "Activa",
+    "state.error": "Error",
+    "state.disabled": "Desactivada",
+    "appearance.mode": "Modo",
+    "appearance.theme": "Tema",
+    "appearance.themeDefault": "Predeterminado",
+    "appearance.accent": "Color de \xE9nfasis",
+    "appearance.accentDefault": "Seg\xFAn el tema",
+    "appearance.text": "Texto",
+    "appearance.font": "Fuente",
+    "appearance.customFont": "Tu propia fuente",
+    "appearance.customFontHint": "Cualquier fuente instalada en tu equipo",
+    "appearance.fontSize": "Tama\xF1o del texto",
+    "appearance.lineHeight": "Interlineado",
+    "appearance.preview": "El veloz murci\xE9lago hind\xFA com\xEDa feliz cardillo y kiwi.",
+    "appearance.layout": "Disposici\xF3n",
+    "appearance.density": "Espaciado",
+    "appearance.comfortable": "C\xF3modo",
+    "appearance.compact": "Compacto",
+    "appearance.radius": "Esquinas",
+    "appearance.sharp": "Rectas",
+    "appearance.default": "Predeterminadas",
+    "appearance.round": "Redondeadas",
+    "appearance.translucency": "Transparencia",
+    "appearance.motion": "Reducir movimiento",
+    "appearance.reset": "Restablecer apariencia",
+    "language.follow": "Seguir el idioma del sistema"
+  },
+  "de": {
+    "menu.dashboard": "\xDCbersicht",
+    "menu.plugins": "Erweiterungen",
+    "menu.settings": "Einstellungen",
+    "theme.toggle": "Darstellung wechseln",
+    "theme.system": "System",
+    "theme.light": "Hell",
+    "theme.dark": "Dunkel",
+    "search.placeholder": "Befehle, Seiten suchen\u2026",
+    "search.label": "Suchen",
+    "search.commands": "Befehle",
+    "search.pages": "Seiten",
+    "search.noResults": "Keine Ergebnisse",
+    "notifications.title": "Mitteilungen",
+    "notifications.clear": "Alle l\xF6schen",
+    "notifications.empty": "Alles erledigt",
+    "palette.placeholder": "Befehl eingeben\u2026",
+    "palette.empty": "Kein passender Befehl",
+    "sidebar.expand": "Seitenleiste erweitern",
+    "sidebar.collapse": "Seitenleiste einklappen",
+    "settings.title": "Einstellungen",
+    "settings.empty": "Keine Einstellungen",
+    "settings.general": "Allgemein",
+    "settings.shortcuts": "Tastenk\xFCrzel",
+    "settings.appearance": "Darstellung",
+    "settings.language": "Sprache",
+    "settings.about": "Info",
+    "settings.app": "Anwendung",
+    "settings.plugins": "Erweiterungen",
+    "settings.engine": "Engine",
+    "settings.sidebar": "Seitenleiste",
+    "settings.sidebarHint": "Reduziert die Seitenleiste auf Symbole. K\xFCrzel: Strg/Cmd+B.",
+    "settings.compactSidebar": "Kompakte Seitenleiste",
+    "plugins.title": "Erweiterungen",
+    "plugins.installed": "Installiert",
+    "plugins.discover": "Entdecken",
+    "plugins.updates": "Updates",
+    "plugins.search": "Erweiterungen suchen",
+    "plugins.none": "Keine Erweiterungen installiert",
+    "plugins.searching": "Kataloge werden durchsucht\u2026",
+    "plugins.upToDate": "Alles ist aktuell.",
+    "plugins.storeEmpty": "Keine Erweiterungen in Ihren Katalogen gefunden.",
+    "plugins.installedTag": "Installiert",
+    "plugins.get": "Laden",
+    "plugins.update": "Aktualisieren",
+    "plugins.open": "\xD6ffnen",
+    "plugins.back": "Erweiterungen",
+    "plugins.notFound": "Diese Erweiterung ist nicht installiert.",
+    "plugins.enable": "Aktivieren",
+    "plugins.enabled": "Aktiviert",
+    "plugins.disabled": "Deaktiviert",
+    "plugins.reload": "Neu laden",
+    "plugins.uninstall": "Deinstallieren",
+    "plugins.video": "Video",
+    "plugins.about": "Beschreibung",
+    "plugins.permissions": "Berechtigungen",
+    "plugins.permissionsFooter": "Erweiterungen erhalten nur, was sie angeben. Sensible Zugriffe sind markiert.",
+    "plugins.noPermissions": "Keine besonderen Zugriffe",
+    "plugins.sensitive": "Sensibel",
+    "plugins.information": "Informationen",
+    "plugins.developer": "Entwickler",
+    "plugins.version": "Version",
+    "plugins.license": "Lizenz",
+    "plugins.dependencies": "Ben\xF6tigt",
+    "plugins.keywords": "Stichw\xF6rter",
+    "plugins.settings": "Einstellungen",
+    "plugins.saved": "Gespeichert",
+    "plugins.reset": "Auf Standard zur\xFCcksetzen",
+    "plugins.logs": "Protokoll",
+    "plugins.noLogs": "Kein Protokoll",
+    "plugins.installedVersion": "Installiert: {v}",
+    "state.ready": "Aktiv",
+    "state.error": "Fehler",
+    "state.disabled": "Deaktiviert",
+    "appearance.mode": "Modus",
+    "appearance.theme": "Thema",
+    "appearance.themeDefault": "Standard",
+    "appearance.accent": "Akzentfarbe",
+    "appearance.accentDefault": "Vom Thema",
+    "appearance.text": "Text",
+    "appearance.font": "Schrift",
+    "appearance.customFont": "Eigene Schrift",
+    "appearance.customFontHint": "Jede auf Ihrem Computer installierte Schrift",
+    "appearance.fontSize": "Textgr\xF6\xDFe",
+    "appearance.lineHeight": "Zeilenabstand",
+    "appearance.preview": "Zw\xF6lf Boxk\xE4mpfer jagen Viktor quer \xFCber den gro\xDFen Sylter Deich.",
+    "appearance.layout": "Layout",
+    "appearance.density": "Abst\xE4nde",
+    "appearance.comfortable": "Komfortabel",
+    "appearance.compact": "Kompakt",
+    "appearance.radius": "Ecken",
+    "appearance.sharp": "Eckig",
+    "appearance.default": "Standard",
+    "appearance.round": "Rund",
+    "appearance.translucency": "Transparenz",
+    "appearance.motion": "Bewegung reduzieren",
+    "appearance.reset": "Darstellung zur\xFCcksetzen",
+    "language.follow": "Systemsprache verwenden"
+  }
+};
+`,
+  "plugins/language/src/renderer.tsx": 'import { definePlugin } from "fluxplugin";\nimport { Group, Icon, Row, useI18n } from "fluxplugin/react";\nimport { messages } from "./messages";\n\n// To add a language: translate src/messages.ts, then add it here.\nconst languages = [\n  { code: "fr", label: "French", nativeLabel: "Fran\xE7ais" },\n  { code: "es", label: "Spanish", nativeLabel: "Espa\xF1ol" },\n  { code: "de", label: "German", nativeLabel: "Deutsch" },\n];\n\nfunction LanguageSection() {\n  const { locale, setLocale, languages: all, t } = useI18n();\n  return (\n    <>\n      <Group title={t("settings.language", "Language")}>\n        {all.map((l) => (\n          <Row key={l.code} data-testid={"lang-" + l.code} title={l.nativeLabel ?? l.label} subtitle={l.label} onClick={() => setLocale(l.code)} right={locale === l.code ? <Icon name="check" size={18} /> : undefined} />\n        ))}\n      </Group>\n      <Group>\n        <Row title={t("language.follow", "Follow the system language")} onClick={() => setLocale(navigator.language)} />\n      </Group>\n    </>\n  );\n}\n\nexport default definePlugin({\n  extensions: [\n    { point: "settings", contribution: { sections: [{ id: "language", title: "Language", icon: "language", order: 20, component: LanguageSection }] } },\n    { point: "i18n", contribution: { languages } },\n    ...Object.entries(messages).map(([locale, m]) => ({ point: "i18n", contribution: { messages: [{ locale, messages: m }] } })),\n  ],\n});\n',
+  "src/app/main/framework.ts": 'import { MainFramework, type StoreSpec } from "fluxplugin/main";\nimport config from "../../../fluxplugin.config.json"; // bundled into the app at build time\nimport { CHANNELS } from "../shared/constants";\nimport { registerOperations } from "./operations";\n\nexport interface FrameworkOptions {\n  pluginDirs: string[];\n  /** Where "Get" installs plugins (default: the last of pluginDirs). */\n  installDir?: string;\n  dataDir: string;\n  dev?: boolean;\n  assetUrl?: (id: string, rel: string) => string;\n}\n\n/** Creates the plugin framework. Shared by the Electron entry (index.ts) and the browser entry (web.ts). */\nexport function createFramework(opts: FrameworkOptions): MainFramework {\n  const fw = new MainFramework({\n    pluginDirs: opts.pluginDirs,\n    installDir: opts.installDir ?? opts.pluginDirs[opts.pluginDirs.length - 1],\n    dataDir: opts.dataDir,\n    hotReload: opts.dev,\n    assetUrl: opts.assetUrl,\n    // Where "Plugins \u2192 Available" looks. Default: GitHub (every repo that published with `fluxplugin publish`).\n    // Edit "stores" in fluxplugin.config.json to add your own store (github catalog, http, local) \u2014 see docs/STORE.md.\n    stores: config.stores as StoreSpec[],\n    requireApproval: false, // true \u2192 users must approve each plugin\'s permissions\n    allowedRendererChannels: [CHANNELS.createItem, CHANNELS.setTitleBarOverlay],\n  });\n  registerOperations(fw);\n  return fw;\n}\n',
+  "src/app/main/index.ts": '// Electron entry (main process). Keep it thin: wiring only, logic lives in the other files of this folder.\nimport { app, ipcMain, Menu, protocol, webContents } from "electron";\nimport path from "node:path";\nimport { PLUGIN_SCHEME, attachElectron, registerPluginProtocol } from "fluxplugin/main";\nimport { APP_NAME } from "../shared/constants";\nimport { createFramework } from "./framework";\nimport { pluginPaths, projectRoot } from "./paths";\nimport { createMainWindow } from "./window";\nimport { registerWindowApi } from "./window-api";\n\n// Own data folder per app. In dev Electron is started as `electron dist/main.cjs` and would otherwise be called "Electron",\n// sharing plugin state (enabled/disabled, permissions, settings) with every other app run that way.\napp.setName(APP_NAME);\n\nprotocol.registerSchemesAsPrivileged([PLUGIN_SCHEME]); // must run before the app is ready\n\napp.whenReady().then(async () => {\n  const dev = !!process.env["FLUXPLUGIN_DEV"];\n  // The menu bar is drawn by the renderer (<TitleBar />). Windows/Linux: no native menu. macOS keeps a minimal one\n  // so the system shortcuts (copy/paste/quit/hide) keep working.\n  Menu.setApplicationMenu(process.platform === "darwin" ? Menu.buildFromTemplate([{ role: "appMenu" }, { role: "editMenu" }, { role: "windowMenu" }]) : null);\n\n  const paths = pluginPaths(projectRoot(__dirname), app.getPath("userData"), app.isPackaged, process.resourcesPath);\n  const fw = createFramework({\n    pluginDirs: [paths.bundled, paths.user],\n    installDir: paths.user,\n    dataDir: path.join(app.getPath("userData"), "plugins-data"),\n    dev,\n  });\n  registerPluginProtocol(fw, protocol);\n  attachElectron(fw, { ipcMain: ipcMain as never, webContents: webContents as never });\n  await fw.start();\n\n  const win = createMainWindow(__dirname);\n  registerWindowApi(fw, win);\n  if (dev) win.webContents.on("before-input-event", (_e, input) => input.key === "F12" && input.type === "keyDown" && win.webContents.toggleDevTools());\n  app.on("before-quit", () => void fw.stop());\n});\n\napp.on("window-all-closed", () => app.quit());\n',
   "src/app/main/operations.ts": 'import { s } from "fluxplugin";\nimport type { MainFramework } from "fluxplugin/main";\nimport { CHANNELS, OPERATIONS } from "../shared/constants";\nimport type { Item } from "../shared/types";\n\n/**\n * Host operations. Each one runs through the hook pipeline, so plugins can validate, normalize or veto it\n * (before.item.create, transform.item.create, ...) without touching this file.\n */\nexport function registerOperations(fw: MainFramework): void {\n  fw.manager.ipc.handle(\n    CHANNELS.createItem,\n    (input: { name: string }) =>\n      fw.manager.hooks.run(OPERATIONS.createItem, input, (i) => {\n        const item: Item = { id: Math.random().toString(36).slice(2, 8), name: i.name };\n        fw.manager.events.emit("item.created", item, "host");\n        return item as unknown as Record<string, unknown>;\n      }),\n    "host",\n    { input: s.object({ name: s.string() }) },\n  );\n}\n',
-  "src/app/main/paths.ts": 'import path from "node:path";\n\n/** Project root: set by `fluxplugin dev|start`; falls back to the folder above dist/ (packaged app). */\nexport function projectRoot(distDir: string): string {\n  return process.env["FLUXPLUGIN_PROJECT"] ?? path.resolve(distDir, "..");\n}\n\n/** Plugins bundled with the app (read-only) and plugins installed by the user (writable). */\nexport function pluginDirs(root: string, userData: string): string[] {\n  return [path.join(root, "plugins"), path.join(userData, "plugins")];\n}\n',
+  "src/app/main/paths.ts": 'import path from "node:path";\n\n/** Project root: set by `fluxplugin dev|start`; falls back to the folder above dist/ (packaged app). */\nexport function projectRoot(distDir: string): string {\n  return process.env["FLUXPLUGIN_PROJECT"] ?? path.resolve(distDir, "..");\n}\n\nexport interface PluginPaths {\n  /** Plugins shipped with the app: <project>/plugins in dev, <resources>/plugins in the packaged app (read-only). */\n  bundled: string;\n  /** Plugins installed by the user (writable): inside the app\'s data folder, removed with it when the app is uninstalled. */\n  user: string;\n}\n\nexport function pluginPaths(root: string, userData: string, packaged: boolean, resourcesPath: string): PluginPaths {\n  return { bundled: packaged ? path.join(resourcesPath, "plugins") : path.join(root, "plugins"), user: path.join(userData, "plugins") };\n}\n',
   "src/app/main/web.ts": '// Browser entry: `fluxplugin dev --web` (no Electron needed).\nimport path from "node:path";\nimport { serveWeb } from "fluxplugin/main";\nimport { APP_NAME } from "../shared/constants";\nimport { createFramework } from "./framework";\n\nconst root = process.env["FLUXPLUGIN_PROJECT"] ?? process.cwd();\nconst fw = createFramework({\n  pluginDirs: [path.join(root, "plugins")],\n  dataDir: path.join(root, ".flux-data"),\n  dev: true,\n  assetUrl: (id, rel) => "/@plugins/" + id + "/" + rel.replace("./", ""),\n});\nawait fw.start();\nconst srv = await serveWeb(fw, { distDir: path.join(root, "dist"), port: Number(process.env["PORT"] ?? 5173) });\nconsole.log(APP_NAME + " -> http://127.0.0.1:" + srv.port);\n',
   "src/app/main/window-api.ts": 'import type { BrowserWindow } from "electron";\nimport { s } from "fluxplugin";\nimport type { MainFramework } from "fluxplugin/main";\nimport { CHANNELS, TITLEBAR_HEIGHT } from "../shared/constants";\n\n/** Host operations that need the BrowserWindow. Add your own (maximize, always-on-top, \u2026) the same way. */\nexport function registerWindowApi(fw: MainFramework, win: BrowserWindow): void {\n  fw.manager.ipc.handle(\n    CHANNELS.setTitleBarOverlay,\n    (i: { color: string; symbolColor: string }) => {\n      // Only Windows/Linux have the native-controls overlay; on macOS the traffic lights need no colouring.\n      if (process.platform !== "darwin" && !win.isDestroyed()) {\n        try {\n          win.setTitleBarOverlay({ color: i.color, symbolColor: i.symbolColor, height: TITLEBAR_HEIGHT });\n        } catch {\n          /* colour not parseable: keep the previous one */\n        }\n      }\n      return true;\n    },\n    "host",\n    { input: s.object({ color: s.string(), symbolColor: s.string() }) },\n  );\n}\n',
   "src/app/main/window.ts": `import { BrowserWindow, shell } from "electron";
@@ -1359,7 +4511,7 @@ export function createMainWindow(distDir: string): BrowserWindow {
 `,
   "src/app/preload/index.ts": 'import { contextBridge, ipcRenderer } from "electron";\nimport { exposeFluxBridge } from "fluxplugin/preload";\n\n// The only thing renderer code receives from the preload: window.__fluxplugin\nexposeFluxBridge(contextBridge, ipcRenderer);\n',
   "src/app/renderer/App.tsx": 'import type { FluxBridge } from "fluxplugin";\nimport type { RendererFramework } from "fluxplugin/react";\nimport { AppProviders } from "./providers/AppProviders";\nimport { AppShell } from "./shell/AppShell";\n\nexport function App({ framework, bridge }: { framework: RendererFramework; bridge: FluxBridge }) {\n  return (\n    <AppProviders framework={framework} bridge={bridge}>\n      <AppShell />\n    </AppProviders>\n  );\n}\n',
-  "src/app/renderer/bootstrap.ts": 'import React from "react";\nimport * as jsxRuntime from "react/jsx-runtime";\nimport * as ReactDOMClient from "react-dom/client";\nimport * as flux from "fluxplugin";\nimport * as fluxReact from "fluxplugin/react";\nimport type { FluxBridge } from "fluxplugin";\nimport { RendererFramework, createHttpBridge, declareHostPoints, installSharedModules } from "fluxplugin/react";\nimport { declareExtensionPoints } from "./extension-points";\nimport { registerHostMenus } from "./menus";\nimport { registerHostRoutes } from "./routes";\n\n/**\n * Infrastructure layer: connects to the main process, shares singletons with plugin bundles,\n * declares what plugins may extend, registers the host\'s own routes, then starts the plugins.\n */\nexport async function bootstrap(): Promise<{ framework: RendererFramework; bridge: FluxBridge }> {\n  // One copy of React and of the runtime: plugin bundles import these from globalThis.\n  installSharedModules({\n    react: React,\n    "react/jsx-runtime": jsxRuntime,\n    "react/jsx-dev-runtime": jsxRuntime,\n    "react-dom/client": ReactDOMClient,\n    fluxplugin: flux,\n    "fluxplugin/react": fluxReact,\n  });\n\n  // Electron: the preload bridge. Browser mode: HTTP bridge to `fluxplugin dev --web`.\n  const bridge: FluxBridge = (window as unknown as { __fluxplugin?: FluxBridge }).__fluxplugin ?? createHttpBridge();\n  const framework = new RendererFramework({ bridge });\n\n  declareHostPoints(framework); // built-in "theme" and "titlebar" (search providers) extension points\n  declareExtensionPoints(framework); // BEFORE plugins start\n  registerHostRoutes(framework);\n  registerHostMenus(framework);\n  await framework.start();\n  return { framework, bridge };\n}\n',
+  "src/app/renderer/bootstrap.ts": 'import React from "react";\nimport * as jsxRuntime from "react/jsx-runtime";\nimport * as ReactDOMClient from "react-dom/client";\nimport * as flux from "fluxplugin";\nimport * as fluxReact from "fluxplugin/react";\nimport type { FluxBridge } from "fluxplugin";\nimport { RendererFramework, createHttpBridge, createStaticBridge, declareHostPoints, installSharedModules } from "fluxplugin/react";\nimport { declareExtensionPoints } from "./extension-points";\nimport { registerHostMenus } from "./menus";\nimport { registerHostSettings } from "./settings";\nimport { registerHostRoutes } from "./routes";\n\n/**\n * Infrastructure layer: connects to the main process, shares singletons with plugin bundles,\n * declares what plugins may extend, registers the host\'s own routes, then starts the plugins.\n */\nexport async function bootstrap(): Promise<{ framework: RendererFramework; bridge: FluxBridge }> {\n  // One copy of React and of the runtime: plugin bundles import these from globalThis.\n  installSharedModules({\n    react: React,\n    "react/jsx-runtime": jsxRuntime,\n    "react/jsx-dev-runtime": jsxRuntime,\n    "react-dom/client": ReactDOMClient,\n    fluxplugin: flux,\n    "fluxplugin/react": fluxReact,\n  });\n\n  const bridge = await pickBridge();\n  const framework = new RendererFramework({ bridge });\n\n  declareHostPoints(framework); // built-in "theme" and "titlebar" (search providers) extension points\n  declareExtensionPoints(framework); // BEFORE plugins start\n  registerHostRoutes(framework);\n  registerHostMenus(framework);\n  registerHostSettings(framework);\n  await framework.start();\n  return { framework, bridge };\n}\n\n/** Electron: the preload bridge. Browser dev mode: HTTP bridge to `fluxplugin dev --web`. Static website export: bootstrap.json only. */\nasync function pickBridge(): Promise<FluxBridge> {\n  const injected = (window as unknown as { __fluxplugin?: FluxBridge }).__fluxplugin;\n  if (injected) return injected;\n  try {\n    const r = await fetch("/flux/bootstrap");\n    if (r.ok && (r.headers.get("content-type") ?? "").includes("json")) return createHttpBridge();\n  } catch {\n    /* no server behind this page */\n  }\n  return createStaticBridge("./bootstrap.json");\n}\n',
   "src/app/renderer/extension-points.ts": 'import { s } from "fluxplugin";\nimport type { RendererFramework } from "fluxplugin/react";\nimport { EXTENSION_POINTS } from "../shared/constants";\n\n/** Declare what plugins may contribute. Contributions are validated against these schemas. */\nexport function declareExtensionPoints(framework: RendererFramework): void {\n  framework.manager.extensionPoints.declare({\n    name: EXTENSION_POINTS.dashboard,\n    contributions: {\n      toolbar: s.object({ id: s.string(), label: s.string(), command: s.string().optional() }),\n    },\n  });\n}\n',
   "src/app/renderer/hooks/useCreateItem.ts": 'import { useState } from "react";\nimport { useBridge } from "../providers/AppProviders";\nimport { itemsApi } from "../services/items";\n\n/** Calls the host operation (which plugins may rewrite or veto through hooks) and exposes the outcome. */\nexport function useCreateItem() {\n  const bridge = useBridge();\n  const [result, setResult] = useState("");\n  const create = async (name: string) => {\n    try {\n      setResult(JSON.stringify(await itemsApi.create(bridge, name)));\n    } catch (e) {\n      setResult("blocked: " + (e as Error).message);\n    }\n  };\n  return { create, result };\n}\n',
   "src/app/renderer/index.html": `<!doctype html>
@@ -1367,7 +4519,7 @@ export function createMainWindow(distDir: string): BrowserWindow {
   <head>
     <meta charset="utf-8" />
     <title>__APP_NAME__</title>
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self' fluxplugin:; script-src 'self' fluxplugin:; style-src 'self' 'unsafe-inline' fluxplugin:; connect-src 'self'; img-src 'self' data: fluxplugin:; frame-src https://www.youtube-nocookie.com https://player.vimeo.com" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self' fluxplugin:; script-src 'self' fluxplugin:; style-src 'self' 'unsafe-inline' fluxplugin:; font-src 'self' data: https: fluxplugin:; connect-src 'self'; img-src 'self' data: blob: https: http: file: fluxplugin:; media-src 'self' blob: data: https: file: fluxplugin:; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.loom.com https://streamable.com" />
     <link rel="stylesheet" href="./renderer.css" />
   </head>
   <body>
@@ -1389,14 +4541,18 @@ export function registerHostMenus(framework: RendererFramework): void {
   commands.register({ id: "host.reload", title: "Reload window", category: "View", keybinding: "Mod+R", execute: () => location.reload() }, "host");
   commands.register({ id: "host.goHome", title: "Go to dashboard", category: "Go", execute: () => (location.hash = "#/") }, "host");
   commands.register({ id: "host.goPlugins", title: "Manage plugins", category: "Go", execute: () => (location.hash = "#/plugins") }, "host");
+  commands.register({ id: "host.sidebar", title: "Toggle sidebar", category: "View", keybinding: "Mod+B", execute: () => window.dispatchEvent(new Event("flux:toggle-sidebar")) }, "host");
+  commands.register({ id: "host.goSettings", title: "Settings", category: "Go", keybinding: "Mod+,", execute: () => (location.hash = "#/settings") }, "host");
   commands.register({ id: "host.docs", title: "Documentation", category: "Help", execute: () => void window.open("https://www.npmjs.com/package/fluxplugin", "_blank") }, "host");
 
   menus.register({ id: "app.go", location: "application", label: "Go", order: 10, children: [
     { id: "app.go.home", label: "Dashboard", command: "host.goHome" },
     { id: "app.go.plugins", label: "Plugins", command: "host.goPlugins" },
+    { id: "app.go.settings", label: "Settings", command: "host.goSettings" },
   ] }, "host");
   menus.register({ id: "app.view", location: "application", label: "View", order: 20, children: [
     { id: "app.view.palette", label: "Command palette", command: "host.palette" },
+    { id: "app.view.sidebar", label: "Toggle sidebar", command: "host.sidebar" },
     { id: "app.view.sep", label: "", separator: true },
     { id: "app.view.reload", label: "Reload", command: "host.reload" },
   ] }, "host");
@@ -1404,23 +4560,28 @@ export function registerHostMenus(framework: RendererFramework): void {
 }
 `,
   "src/app/renderer/pages/DashboardPage.tsx": 'import { PluginSlot, useExtensionItems, usePluginFramework } from "fluxplugin/react";\nimport { EXTENSION_POINTS, SLOTS } from "../../shared/constants";\nimport type { ToolbarAction } from "../../shared/types";\nimport { useCreateItem } from "../hooks/useCreateItem";\n\nexport function DashboardPage() {\n  const framework = usePluginFramework();\n  const actions = useExtensionItems<ToolbarAction>(EXTENSION_POINTS.dashboard, "toolbar");\n  const { create, result } = useCreateItem();\n  return (\n    <div>\n      <h2>Dashboard</h2>\n      <PluginSlot name={SLOTS.dashboardBefore} />\n      <p className="hint">These buttons are contributed by plugins through a host-declared extension point.</p>\n      <div className="row" data-testid="toolbar">\n        {actions.map((a) => (\n          <button key={a.id} className="btn" onClick={() => a.command && void framework.manager.commands.execute(a.command)}>\n            {a.label}\n          </button>\n        ))}\n      </div>\n      <div className="row">\n        <button className="btn" onClick={() => void create("  Ada  ")}>Create item \u201C  Ada  \u201D (plugin hooks may rewrite it)</button>\n        <button className="btn" onClick={() => void create("   ")}>Create empty item (a plugin may veto)</button>\n      </div>\n      <div className="row">\n        <button className="btn" data-testid="notify" onClick={() => framework.manager.notifications.push({ title: "Hello from the host", body: "Plugins can do this too.", level: "success" })}>Show a notification</button>\n      </div>\n      <pre data-testid="hook-result" className="hint">{result}</pre>\n      <PluginSlot name={SLOTS.dashboardAfter} />\n    </div>\n  );\n}\n',
-  "src/app/renderer/pages/PluginsPage.tsx": 'import { PluginManagerUI } from "fluxplugin/manager-ui";\n\n/** Ready-made plugin manager (enable/disable, permissions, settings, logs, install). Replace with your own UI if you like. */\nexport function PluginsPage() {\n  return <PluginManagerUI />;\n}\n',
-  "src/app/renderer/providers/AppProviders.tsx": 'import { createContext, useCallback, useContext, type ReactNode } from "react";\nimport type { FluxBridge } from "fluxplugin";\nimport { PluginProvider, StyleHost, ThemeProvider, ToastHost, baseCss, type RendererFramework } from "fluxplugin/react";\nimport { setTitleBarOverlay } from "../services/window";\n\nconst BridgeContext = createContext<FluxBridge | null>(null);\n\n/** Gives pages access to the main-process bridge without importing globals. */\nexport function useBridge(): FluxBridge {\n  const b = useContext(BridgeContext);\n  if (!b) throw new Error("useBridge must be used inside <AppProviders>");\n  return b;\n}\n\nexport function AppProviders({ framework, bridge, children }: { framework: RendererFramework; bridge: FluxBridge; children: ReactNode }) {\n  // Keep the native window buttons in sync with the theme (light / dark / plugin themes).\n  const onResolved = useCallback((r: { surface: string; fg: string }) => r.surface && setTitleBarOverlay(bridge, r.surface, r.fg), [bridge]);\n  return (\n    <PluginProvider framework={framework}>\n      <BridgeContext.Provider value={bridge}>\n        <style>{baseCss}</style>\n        <StyleHost />\n        <ThemeProvider onResolved={onResolved}>\n          {children}\n          <ToastHost />\n        </ThemeProvider>\n      </BridgeContext.Provider>\n    </PluginProvider>\n  );\n}\n',
-  "src/app/renderer/routes.ts": `import type { RendererFramework } from "fluxplugin/react";
+  "src/app/renderer/providers/AppProviders.tsx": 'import { createContext, useCallback, useContext, type ReactNode } from "react";\nimport type { FluxBridge } from "fluxplugin";\nimport { I18nProvider, PluginProvider, SidebarProvider, StyleHost, ThemeProvider, ToastHost, baseCss, type RendererFramework } from "fluxplugin/react";\nimport { setTitleBarOverlay } from "../services/window";\n\nconst BridgeContext = createContext<FluxBridge | null>(null);\n\n/** Gives pages access to the main-process bridge without importing globals. */\nexport function useBridge(): FluxBridge {\n  const b = useContext(BridgeContext);\n  if (!b) throw new Error("useBridge must be used inside <AppProviders>");\n  return b;\n}\n\nexport function AppProviders({ framework, bridge, children }: { framework: RendererFramework; bridge: FluxBridge; children: ReactNode }) {\n  // Keep the native window buttons in sync with the theme (light / dark / plugin themes).\n  const onResolved = useCallback((r: { surface: string; fg: string }) => r.surface && setTitleBarOverlay(bridge, r.surface, r.fg), [bridge]);\n  return (\n    <PluginProvider framework={framework}>\n      <BridgeContext.Provider value={bridge}>\n        <style>{baseCss}</style>\n        <StyleHost />\n        <I18nProvider>\n          <ThemeProvider onResolved={onResolved}>\n            <SidebarProvider>\n              {children}\n              <ToastHost />\n            </SidebarProvider>\n          </ThemeProvider>\n        </I18nProvider>\n      </BridgeContext.Provider>\n    </PluginProvider>\n  );\n}\n',
+  "src/app/renderer/routes.ts": `import { SettingsPage, type RendererFramework } from "fluxplugin/react";
+import { registerPluginManagerRoutes } from "fluxplugin/manager-ui";
 import { DashboardPage } from "./pages/DashboardPage";
-import { PluginsPage } from "./pages/PluginsPage";
 
 /** The host's own pages (owner "host"). Plugins add theirs at runtime through the same registry. */
 export function registerHostRoutes(framework: RendererFramework): void {
-  framework.manager.routes.register({ path: "/", component: DashboardPage, meta: { title: "Dashboard" } }, "host");
-  framework.manager.routes.register({ path: "/plugins", component: PluginsPage, meta: { title: "Plugins", breadcrumb: "Plugins" } }, "host");
+  const routes = framework.manager.routes;
+  routes.register({ path: "/", component: DashboardPage, meta: { title: "Dashboard" } }, "host");
+  // Plugin manager: list \u2192 /plugins/:id (installed) \u2192 /plugins/store/:id (store listing). Each opens in its own screen.
+  registerPluginManagerRoutes(framework);
+  // Settings: sections come from the host and from plugins (Appearance, Language\u2026).
+  routes.register({ path: "/settings", component: SettingsPage, meta: { title: "Settings", breadcrumb: "Settings" } }, "host");
+  routes.register({ path: "/settings/:section", component: SettingsPage, meta: { breadcrumb: (p) => p["section"] ?? "" } }, "host");
 }
 `,
   "src/app/renderer/services/items.ts": 'import type { FluxBridge } from "fluxplugin";\nimport { CHANNELS } from "../../shared/constants";\nimport type { Item } from "../../shared/types";\n\n/** Service layer: the only place that knows the IPC channel names. UI code calls these functions. */\nexport const itemsApi = {\n  create: (bridge: FluxBridge, name: string) => bridge.invoke(CHANNELS.createItem, { name }) as Promise<Item>,\n};\n',
   "src/app/renderer/services/window.ts": 'import type { FluxBridge } from "fluxplugin";\nimport { CHANNELS } from "../../shared/constants";\n\n/** Colours the native window buttons (Windows/Linux). A no-op error in browser mode is ignored on purpose. */\nexport function setTitleBarOverlay(bridge: FluxBridge, color: string, symbolColor: string): void {\n  void bridge.invoke(CHANNELS.setTitleBarOverlay, { color, symbolColor }).catch(() => undefined);\n}\n',
-  "src/app/renderer/shell/AppShell.tsx": 'import { Breadcrumbs, CommandPalette, PluginRoutes, PluginSlot, TitleBar, useKeybindings } from "fluxplugin/react";\nimport { APP_NAME, SLOTS } from "../../shared/constants";\nimport { Sidebar } from "./Sidebar";\n\n/** Whole window: custom title bar (menus, search, theme, notifications) \u2192 sidebar + routed content. */\nexport function AppShell() {\n  useKeybindings(); // runs commands bound to keyboard shortcuts (Mod+Shift+R, ...)\n  return (\n    <div className="app">\n      <TitleBar title={APP_NAME} logo={<PluginSlot name={SLOTS.brandBadges} />} searchPlaceholder="Search commands, pages\u2026" />\n      <div className="body">\n        <Sidebar />\n        <main className="main">\n          <Breadcrumbs />\n          <PluginRoutes />\n        </main>\n      </div>\n      <CommandPalette />\n    </div>\n  );\n}\n',
-  "src/app/renderer/shell/Sidebar.tsx": 'import { Link, useMenu } from "fluxplugin/react";\n\nexport function Sidebar() {\n  const { items, run } = useMenu("sidebar"); // entries added by plugins (routes with meta.menu, or menus.register)\n  return (\n    <aside className="side">\n      <Link to="/">Dashboard</Link>\n      {items.map((i) => (\n        <a key={i.id} href={"#" + i.path} onClick={(e) => (e.preventDefault(), run(i))}>\n          {i.label}\n        </a>\n      ))}\n      <Link to="/plugins">Plugins</Link>\n      <p className="hint">Ctrl/Cmd+K: commands</p>\n    </aside>\n  );\n}\n',
-  "src/app/renderer/styles/app.css": "body { margin: 0; font: 14px system-ui; background: var(--flux-bg); color: var(--flux-fg); }\n.app { display: grid; grid-template-rows: var(--flux-titlebar-h, 40px) 1fr; min-height: 100vh; }\n.body { display: grid; grid-template-columns: 220px 1fr; min-height: 0; }\n.side { border-right: 1px solid var(--flux-border); padding: 16px; background: var(--flux-surface); }\n.side a { display: block; padding: 7px 10px; border-radius: 8px; color: inherit; text-decoration: none; margin: 2px 0; }\n.side a[data-active] { background: var(--flux-accent); color: #fff; }\n.main { padding: 24px; max-width: 860px; overflow: auto; }\n.row { display: flex; gap: 8px; margin: 12px 0; flex-wrap: wrap; }\n.btn { border: 1px solid var(--flux-border); background: var(--flux-bg); color: inherit; border-radius: 8px; padding: 6px 12px; cursor: pointer; }\n.hint { color: var(--flux-muted); font-size: 12px; }\n",
+  "src/app/renderer/settings/index.tsx": 'import type { ComponentType } from "react";\nimport { Group, Row, Switch, useSidebar, useT, usePluginFramework, usePlugins, formatShortcut, useOS, type RendererFramework } from "fluxplugin/react";\nimport { APP_NAME } from "../../shared/constants";\n\nfunction GeneralSection() {\n  const t = useT();\n  const { collapsed, setCollapsed } = useSidebar();\n  const plugins = usePlugins();\n  return (\n    <>\n      <Group title={t("settings.about", "About")}>\n        <Row title={t("settings.app", "Application")} right={APP_NAME} />\n        <Row title={t("settings.plugins", "Plugins")} right={`${plugins.filter((p) => p.state === "ready").length} / ${plugins.length}`} />\n        <Row title={t("settings.engine", "Engine")} right={navigator.userAgent.match(/(Electron|Chrome|Firefox|Safari)\\/[\\d.]+/)?.[0] ?? "\u2014"} />\n      </Group>\n      <Group title={t("settings.sidebar", "Sidebar")} footer={t("settings.sidebarHint", "Collapse the sidebar to icons. Shortcut: Ctrl/Cmd+B.")}>\n        <Row title={t("settings.compactSidebar", "Compact sidebar")} right={<Switch checked={collapsed} onChange={setCollapsed} label="Compact sidebar" />} />\n      </Group>\n    </>\n  );\n}\n\nfunction ShortcutsSection() {\n  const fw = usePluginFramework();\n  const os = useOS();\n  const t = useT();\n  const cmds = fw.manager.commands.list().filter((c) => c.keybinding);\n  return (\n    <Group title={t("settings.shortcuts", "Keyboard shortcuts")}>\n      {cmds.length === 0 && <Row title="\u2014" />}\n      {cmds.map((c) => <Row key={c.id} title={c.title} subtitle={c.category} right={<kbd>{formatShortcut(c.keybinding!, os)}</kbd>} />)}\n    </Group>\n  );\n}\n\n/** Host settings sections. Plugins contribute theirs to the same "settings" extension point. */\nexport function registerHostSettings(framework: RendererFramework): void {\n  framework.manager.extensionPoints.contribute(\n    "settings",\n    { sections: [\n      { id: "general", title: "General", icon: "settings", order: 0, component: GeneralSection as ComponentType },\n      { id: "shortcuts", title: "Shortcuts", icon: "command", order: 90, component: ShortcutsSection as ComponentType },\n    ] },\n    "host",\n  );\n}\n',
+  "src/app/renderer/shell/AppShell.tsx": 'import { Breadcrumbs, CommandPalette, PluginRoutes, PluginSlot, TitleBar, useKeybindings } from "fluxplugin/react";\nimport { APP_NAME, SLOTS } from "../../shared/constants";\nimport { Sidebar } from "./Sidebar";\n\n/** App shell with a fixed sidebar and independently scrollable content. */\nexport function AppShell() {\n  useKeybindings();\n\n  return (\n    <div className="app">\n      {/* Title bar */}\n      <header className="app-titlebar">\n        <TitleBar title={APP_NAME} logo={<PluginSlot name={SLOTS.brandBadges} />} searchPlaceholder="Search commands, pages\u2026" />\n      </header>\n\n      {/* Application body */}\n      <div className="body">\n        {/* Fixed sidebar: never scrolls with the main content (collapses to an icon rail) */}\n        <aside className="app-side">\n          <Sidebar />\n        </aside>\n\n        {/* Only this area scrolls */}\n        <main className="main">\n          <div className="main-inner">\n            <Breadcrumbs />\n            <PluginRoutes />\n          </div>\n        </main>\n      </div>\n\n      {/* Command palette */}\n      <CommandPalette />\n    </div>\n  );\n}\n',
+  "src/app/renderer/shell/Sidebar.tsx": 'import { SidebarNav, type SidebarEntry } from "fluxplugin/react";\n\n// Host entries. Plugins add theirs between the two groups (routes with meta.menu, or menus.register({ location: "sidebar" })),\n// including sub-menus: `meta.menu.parent` or `children`. Labels are translated through `menu.<id>`.\nconst top: SidebarEntry[] = [{ id: "dashboard", label: "Dashboard", path: "/", icon: "home" }];\nconst bottom: SidebarEntry[] = [\n  { id: "plugins", label: "Plugins", path: "/plugins", icon: "plug" },\n  { id: "settings", label: "Settings", path: "/settings", icon: "settings" },\n];\n\nexport function Sidebar() {\n  return <SidebarNav top={top} bottom={bottom} footer={<span>Ctrl/Cmd+K: commands</span>} />;\n}\n',
+  "src/app/renderer/styles/app.css": "body { margin: 0; }\n.app { display: grid; height: 100vh; grid-template-rows: 40px minmax(0, 1fr); overflow: hidden; }\n.app-titlebar { z-index: 50; min-width: 0; }\n.body { display: grid; min-height: 0; min-width: 0; grid-template-columns: var(--flux-sidebar-w, 232px) minmax(0, 1fr); overflow: hidden; transition: grid-template-columns .18s ease; }\n.app-side { height: 100%; min-height: 0; overflow: hidden; }\n.main { min-height: 0; min-width: 0; overflow-y: auto; overflow-x: hidden; padding: 24px 28px; }\n.main-inner { max-width: 900px; margin: 0 auto; }\n.row { display: flex; gap: 8px; margin: 12px 0; flex-wrap: wrap; }\n.btn { border: 1px solid var(--flux-border); background: var(--flux-bg); color: inherit; border-radius: 8px; padding: 6px 14px; cursor: pointer; font-weight: 500; }\n.btn:hover { background: var(--flux-surface); }\n.hint { color: var(--flux-muted); font-size: .86em; }\n",
   "src/app/shared/constants.ts": '/** Names shared by the main process and the renderer. No imports here: this layer depends on nothing. */\nexport const APP_NAME = "__APP_NAME__";\n\n/** Height of the custom title bar in px (must match --flux-titlebar-h in CSS). */\nexport const TITLEBAR_HEIGHT = 40;\n\n/** IPC channels the host exposes to the renderer (also allow-listed in main/framework.ts). */\nexport const CHANNELS = {\n  createItem: "host.item.create",\n  /** Colours the native window buttons (Windows/Linux overlay) to match the current theme. */\n  setTitleBarOverlay: "host.window.setTitleBarOverlay",\n} as const;\n\n/** Declarative extension points the host offers to plugins (see renderer/extension-points.ts).\n *  The built-in "theme" and "titlebar" points are declared by declareHostPoints(). */\nexport const EXTENSION_POINTS = {\n  dashboard: "dashboard",\n} as const;\n\n/** UI slots where plugins can inject components (see <PluginSlot name=... />). */\nexport const SLOTS = {\n  brandBadges: "header.badges",\n  titlebarLeft: "titlebar.left",\n  titlebarRight: "titlebar.right",\n  dashboardBefore: "dashboard.before",\n  dashboardAfter: "dashboard.after",\n} as const;\n\n/** Hook pipeline operations plugins can intercept: before./after./transform./validate.<operation>. */\nexport const OPERATIONS = {\n  createItem: "item.create",\n} as const;\n',
   "src/app/shared/types.ts": 'export interface Item {\n  id: string;\n  name: string;\n}\n\n/** Shape of a contribution to the "dashboard" extension point (validated in renderer/extension-points.ts). */\nexport interface ToolbarAction {\n  id: string;\n  label: string;\n  command?: string;\n}\n'
 };
@@ -1430,7 +4591,7 @@ var HOST_TAILWIND_FILES = {
   <head>
     <meta charset="utf-8" />
     <title>__APP_NAME__</title>
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self' fluxplugin:; script-src 'self' fluxplugin:; style-src 'self' 'unsafe-inline' fluxplugin:; connect-src 'self'; img-src 'self' data: fluxplugin:; frame-src https://www.youtube-nocookie.com https://player.vimeo.com" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self' fluxplugin:; script-src 'self' fluxplugin:; style-src 'self' 'unsafe-inline' fluxplugin:; font-src 'self' data: https: fluxplugin:; connect-src 'self'; img-src 'self' data: blob: https: http: file: fluxplugin:; media-src 'self' blob: data: https: file: fluxplugin:; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.loom.com https://streamable.com" />
     <link rel="stylesheet" href="./renderer.css" />
     <link rel="stylesheet" href="./tailwind.css" />
   </head>
@@ -1441,9 +4602,8 @@ var HOST_TAILWIND_FILES = {
 </html>
 `,
   "src/app/renderer/pages/DashboardPage.tsx": 'import { PluginSlot, useExtensionItems, usePluginFramework } from "fluxplugin/react";\nimport { EXTENSION_POINTS, SLOTS } from "../../shared/constants";\nimport type { ToolbarAction } from "../../shared/types";\nimport { useCreateItem } from "../hooks/useCreateItem";\n\nexport function DashboardPage() {\n  const framework = usePluginFramework();\n  const actions = useExtensionItems<ToolbarAction>(EXTENSION_POINTS.dashboard, "toolbar");\n  const { create, result } = useCreateItem();\n  return (\n    <div>\n      <h2>Dashboard</h2>\n      <PluginSlot name={SLOTS.dashboardBefore} />\n      <p className="text-xs text-muted">These buttons are contributed by plugins through a host-declared extension point.</p>\n      <div className="my-3 flex flex-wrap gap-2" data-testid="toolbar">\n        {actions.map((a) => (\n          <button key={a.id} className="cursor-pointer rounded-lg border border-border bg-bg px-3 py-1.5 hover:bg-surface" onClick={() => a.command && void framework.manager.commands.execute(a.command)}>\n            {a.label}\n          </button>\n        ))}\n      </div>\n      <div className="my-3 flex flex-wrap gap-2">\n        <button className="cursor-pointer rounded-lg border border-border bg-bg px-3 py-1.5 hover:bg-surface" onClick={() => void create("  Ada  ")}>Create item \u201C  Ada  \u201D (plugin hooks may rewrite it)</button>\n        <button className="cursor-pointer rounded-lg border border-border bg-bg px-3 py-1.5 hover:bg-surface" onClick={() => void create("   ")}>Create empty item (a plugin may veto)</button>\n      </div>\n      <div className="my-3 flex flex-wrap gap-2">\n        <button className="cursor-pointer rounded-lg border border-border bg-bg px-3 py-1.5 hover:bg-surface" data-testid="notify" onClick={() => framework.manager.notifications.push({ title: "Hello from the host", body: "Plugins can do this too.", level: "success" })}>Show a notification</button>\n      </div>\n      <pre data-testid="hook-result" className="text-xs text-muted">{result}</pre>\n      <PluginSlot name={SLOTS.dashboardAfter} />\n    </div>\n  );\n}\n',
-  "src/app/renderer/shell/AppShell.tsx": 'import {\n  Breadcrumbs,\n  CommandPalette,\n  PluginRoutes,\n  PluginSlot,\n  TitleBar,\n  useKeybindings,\n} from "fluxplugin/react";\n\nimport { APP_NAME, SLOTS } from "../../shared/constants";\nimport { Sidebar } from "./Sidebar";\n\n/** App shell with a fixed sidebar and independently scrollable content. */\nexport function AppShell() {\n  useKeybindings();\n\n  return (\n    <div className="app grid h-screen grid-rows-[40px_minmax(0,1fr)] overflow-hidden">\n      {/* Title bar */}\n      <header className="z-50 min-w-0">\n        <TitleBar\n          title={APP_NAME}\n          logo={<PluginSlot name={SLOTS.brandBadges} />}\n          searchPlaceholder="Search commands, pages\u2026"\n        />\n      </header>\n\n      {/* Application body */}\n      <div className="body grid min-h-0 min-w-0 grid-cols-[220px_minmax(0,1fr)] overflow-hidden">\n        {/* Fixed sidebar: never scrolls with the main content */}\n        <aside className="h-full min-h-0 overflow-hidden border-r border-transparent">\n          <Sidebar />\n        </aside>\n\n        {/* Only this area scrolls */}\n        <main className="main min-h-0 min-w-0 overflow-y-auto overflow-x-hidden p-6">\n          <div className="mx-auto max-w-3xl">\n            <Breadcrumbs />\n\n            <PluginRoutes />\n          </div>\n        </main>\n      </div>\n\n      {/* Command palette */}\n      <CommandPalette />\n    </div>\n  );\n}\n',
-  "src/app/renderer/shell/Sidebar.tsx": 'import { Link, useMenu } from "fluxplugin/react";\nimport { useEffect, useState } from "react";\n\nconst link =\n  "block rounded-lg px-2.5 py-1.5 no-underline text-fg data-[active]:bg-accent data-[active]:text-white";\n\nexport function Sidebar() {\n  const { items, run } = useMenu("sidebar");\n  const [activePath, setActivePath] = useState(() => {\n    const hash = window.location.hash.slice(1);\n    return hash || window.location.pathname;\n  });\n\n  useEffect(() => {\n    const updateActivePath = () => {\n      setActivePath(window.location.hash.slice(1) || window.location.pathname);\n    };\n\n    window.addEventListener("hashchange", updateActivePath);\n    window.addEventListener("popstate", updateActivePath);\n\n    return () => {\n      window.removeEventListener("hashchange", updateActivePath);\n      window.removeEventListener("popstate", updateActivePath);\n    };\n  }, []);\n\n  const isActive = (path: string) => {\n    const normalize = (value: string) =>\n      value.replace(/^#/, "").replace(/\\/+$/, "") || "/";\n\n    return normalize(activePath) === normalize(path);\n  };\n\n  return (\n    <aside className="side h-full overflow-hidden border-r border-border bg-surface p-4">\n      <nav className="flex flex-col gap-1">\n        <Link\n          to="/"\n          data-active={isActive("/") ? "" : undefined}\n          aria-current={isActive("/") ? "page" : undefined}\n          className={link}\n        >\n          Dashboard\n        </Link>\n\n        {items.map((i) => (\n          <a\n            key={i.id}\n            className={link}\n            data-active={isActive(i.path!) ? "" : undefined}\n            aria-current={isActive(i.path!) ? "page" : undefined}\n            href={"#" + i.path}\n            onClick={(e) => {\n              e.preventDefault();\n              setActivePath(i.path!);\n              run(i);\n            }}\n          >\n            {i.label}\n          </a>\n        ))}\n\n        <Link\n          to="/plugins"\n          data-active={isActive("/plugins") ? "" : undefined}\n          aria-current={isActive("/plugins") ? "page" : undefined}\n          className={link}\n        >\n          Plugins\n        </Link>\n      </nav>\n\n      <p className="mt-3 text-xs text-muted">Ctrl/Cmd+K: commands</p>\n    </aside>\n  );\n}\n',
-  "src/app/renderer/styles/app.css": "body { margin: 0; font: 14px system-ui; background: var(--flux-bg); color: var(--flux-fg); }\n",
+  "src/app/renderer/shell/AppShell.tsx": 'import {\n  Breadcrumbs,\n  CommandPalette,\n  PluginRoutes,\n  PluginSlot,\n  TitleBar,\n  useKeybindings,\n} from "fluxplugin/react";\n\nimport { APP_NAME, SLOTS } from "../../shared/constants";\nimport { Sidebar } from "./Sidebar";\n\n/** App shell with a fixed sidebar and independently scrollable content. */\nexport function AppShell() {\n  useKeybindings();\n\n  return (\n    <div className="app grid h-screen grid-rows-[40px_minmax(0,1fr)] overflow-hidden">\n      {/* Title bar */}\n      <header className="z-50 min-w-0">\n        <TitleBar\n          title={APP_NAME}\n          logo={<PluginSlot name={SLOTS.brandBadges} />}\n          searchPlaceholder="Search commands, pages..."\n        />\n      </header>\n\n      {/* Application body (the sidebar width follows --flux-sidebar-w: it collapses to an icon rail) */}\n      <div className="body grid min-h-0 min-w-0 grid-cols-[var(--flux-sidebar-w,232px)_minmax(0,1fr)] overflow-hidden transition-[grid-template-columns] duration-200">\n        {/* Fixed sidebar: never scrolls with the main content */}\n        <aside className="h-full min-h-0 overflow-hidden border-r border-transparent">\n          <Sidebar />\n        </aside>\n\n        {/* Only this area scrolls */}\n        <main className="main min-h-0 min-w-0 overflow-y-auto overflow-x-hidden p-6">\n          <div className="mx-auto max-w-3xl">\n            <Breadcrumbs />\n\n            <PluginRoutes />\n          </div>\n        </main>\n      </div>\n\n      {/* Command palette */}\n      <CommandPalette />\n    </div>\n  );\n}\n',
+  "src/app/renderer/styles/app.css": "body { margin: 0; }\n",
   "src/app/renderer/styles/tailwind.css": '/* Tailwind v4, compiled by `fluxplugin dev|build` to dist/tailwind.css.\n   Colors come from the theme variables, so Tailwind utilities follow light / dark / plugin themes automatically:\n   use bg-surface, text-fg, border-border, text-muted, bg-accent \u2026 */\n@import "tailwindcss";\n\n/* Plugins are shipped as built JS: scan their dist so the classes they use are generated. Plugins that users install later\n   should ship their own precompiled CSS (fluxplugin plugin new my-plugin --tailwindcss). */\n@source "../../../../plugins/*/dist";\n\n@custom-variant dark (&:where([data-theme=dark], [data-theme=dark] *));\n\n@theme inline {\n  --color-bg: var(--flux-bg);\n  --color-fg: var(--flux-fg);\n  --color-surface: var(--flux-surface);\n  --color-border: var(--flux-border);\n  --color-accent: var(--flux-accent);\n  --color-muted: var(--flux-muted);\n}\n'
 };
 
@@ -1454,7 +4614,16 @@ var pkg = (v) => JSON.stringify(
     version: "1.0.0",
     private: true,
     type: "module",
-    scripts: { dev: "fluxplugin dev", build: "fluxplugin build", package: "fluxplugin package", validate: "fluxplugin validate", release: "fluxplugin publish" },
+    scripts: {
+      dev: "fluxplugin dev",
+      "dev:host": "fluxplugin dev --host ../my-app   # run it inside your app while you work (edit the path)",
+      build: "fluxplugin build",
+      package: "fluxplugin package",
+      validate: "fluxplugin validate",
+      release: "fluxplugin publish"
+    },
+    // Add any library here (react-markdown, chart.js, a UI kit…): it is bundled into dist/, the host app does not need it.
+    dependencies: {},
     devDependencies: { fluxplugin: "^1.0.0", "@types/react": "^19.0.0", react: "^19.0.0", typescript: "^5.6.0" }
   },
   null,
@@ -1722,6 +4891,28 @@ function withTailwind(files, v) {
   files["src/renderer.tsx"] = files["src/renderer.tsx"].split(`className="${v.slug}-card"`).join('className="rounded-xl border border-border bg-surface p-4"');
   return files;
 }
+function standaloneExtras(v) {
+  return {
+    ".gitignore": "node_modules\ndist\n*.tgz\n.DS_Store\n",
+    "CONTRIBUTING.md": `# Developing ${v.name}
+
+This is a normal React + TypeScript project. It has its own \`package.json\` and its own libraries.
+
+\`\`\`bash
+npm install                       # your libraries + fluxplugin tooling
+npm install chart.js              # add anything you need: it is bundled into dist/, the app never needs it
+npm run dev                       # rebuilds on save
+npm run dev:host                  # same, and copies the result into a host app (edit the path) which hot-reloads it
+npm run build                     # dist/ \u2014 this is all that ships (no src/, no .ts, no sourcemaps)
+npm run package                   # ${v.id}-1.0.0.tgz
+npm run release                   # publish to the plugin store (GitHub)
+\`\`\`
+
+**Shared with the host** (never bundled twice): \`react\`, \`react-dom\`, \`fluxplugin\`, \`fluxplugin/react\`. Everything else you import is yours.
+CSS imported in the renderer (including from libraries) is emitted as \`dist/renderer.css\` and loaded automatically; images and fonts are inlined.
+`
+  };
+}
 
 // src/cli/host-templates.ts
 function hostFiles(v, withSample = true) {
@@ -1733,16 +4924,21 @@ function hostFiles(v, withSample = true) {
         private: true,
         type: "module",
         main: "dist/main.cjs",
+        description: `${v.name} \u2014 built with fluxplugin`,
+        author: "Your name",
         scripts: {
           dev: "fluxplugin dev",
           "dev:web": "fluxplugin dev --web",
           build: "fluxplugin build",
           start: "fluxplugin start",
+          dist: "fluxplugin dist",
+          "export:web": "fluxplugin export",
+          "plugins:package": "fluxplugin package --all",
           "plugin:new": "fluxplugin plugin new",
           typecheck: "tsc --noEmit"
         },
         dependencies: { fluxplugin: v.fluxSpec, react: "^19.0.0", "react-dom": "^19.0.0" },
-        devDependencies: { electron: v.electron ?? "^44.5.1", typescript: "~5.9.3", "@types/node": "^22.10.0", "@types/react": "^19.0.0", "@types/react-dom": "^19.0.0", ...v.tailwind ? { tailwindcss: "^4.0.0", "@tailwindcss/cli": "^4.0.0" } : {} },
+        devDependencies: { electron: v.electron ?? "^44.5.1", "electron-builder": "^26.0.0", typescript: "~5.9.3", "@types/node": "^22.10.0", "@types/react": "^19.0.0", "@types/react-dom": "^19.0.0", ...v.tailwind ? { tailwindcss: "^4.0.0", "@tailwindcss/cli": "^4.0.0" } : {} },
         // npm 11.16+/12 and pnpm 10 block dependency install scripts unless allowed; Electron needs its postinstall to download the binary.
         allowScripts: { electron: true, esbuild: true },
         pnpm: { onlyBuiltDependencies: ["electron", "esbuild"] }
@@ -1751,7 +4947,7 @@ function hostFiles(v, withSample = true) {
       2
     ),
     // "stores" is used by the CLI (fluxplugin search/install) AND by your app (Plugins → Available). Add your own store here.
-    "fluxplugin.config.json": JSON.stringify({ pluginsDir: "plugins", outDir: "dist", stores: [{ type: "github", topic: "fluxplugin-plugin" }] }, null, 2),
+    "fluxplugin.config.json": JSON.stringify({ pluginsDir: "plugins", outDir: "dist", stores: v.stores ?? [{ type: "github", topic: "fluxplugin-plugin" }] }, null, 2),
     "tsconfig.json": JSON.stringify(
       { compilerOptions: { target: "ES2022", module: "ESNext", moduleResolution: "Bundler", jsx: "react-jsx", strict: true, noEmit: true, skipLibCheck: true, resolveJsonModule: true, lib: ["ES2022", "DOM", "DOM.Iterable"], types: ["node"] }, include: ["src"] },
       null,
@@ -1760,7 +4956,7 @@ function hostFiles(v, withSample = true) {
     ".gitignore": "node_modules\ndist\n.flux-data\n*.tgz\n",
     "README.md": readme2(v.name)
   };
-  for (const [rel, content] of Object.entries(HOST_APP_FILES)) files[rel] = content.split("__APP_NAME__").join(v.name);
+  for (const [rel, content] of Object.entries(HOST_APP_FILES)) files[rel] = content.split("__APP_NAME__").join(v.name).split("__APP_ID__").join(v.name.replace(/[^a-z0-9]/gi, ""));
   if (v.tailwind) for (const [rel, content] of Object.entries(HOST_TAILWIND_FILES)) files[rel] = content.split("__APP_NAME__").join(v.name);
   if (withSample) {
     const sample = TEMPLATES.dashboard(varsFromName("hello"));
@@ -1803,29 +4999,29 @@ plugins/       plugins loaded at startup (users can also install .tgz from the P
 
 // src/cli/package.ts
 import crypto4 from "node:crypto";
-import { promises as fs8 } from "node:fs";
+import { promises as fs9 } from "node:fs";
 import os from "node:os";
-import path11 from "node:path";
+import path13 from "node:path";
 async function packagePlugin(root, opts = {}) {
   const log2 = opts.log ?? console.log;
   await buildPlugin(root, false, log2);
-  let raw = JSON.parse(await fs8.readFile(path11.join(root, "plugin.json"), "utf8"));
+  let raw = JSON.parse(await fs9.readFile(path13.join(root, "plugin.json"), "utf8"));
   const v = validateManifest(raw);
   if (!v.manifest) throw new Error("invalid plugin.json: " + v.issues.map((i) => `${i.path}: ${i.message}`).join("; "));
   const m = v.manifest;
   raw["integrity"] = await computeIntegrity(root, m);
-  if (opts.signKey) raw = signManifest(raw, (await fs8.readFile(opts.signKey, "utf8")).trim());
-  const stage = await fs8.mkdtemp(path11.join(os.tmpdir(), "flux-pack-"));
+  if (opts.signKey) raw = signManifest(raw, (await fs9.readFile(opts.signKey, "utf8")).trim());
+  const stage = await fs9.mkdtemp(path13.join(os.tmpdir(), "flux-pack-"));
   try {
     const shipped = await copyPluginRuntime(root, stage);
-    await fs8.writeFile(path11.join(stage, "plugin.json"), JSON.stringify(raw, null, 2));
+    await fs9.writeFile(path13.join(stage, "plugin.json"), JSON.stringify(raw, null, 2));
     const bad = shipped.filter((f) => /\.(map|tsx?)$/i.test(f) || f.startsWith("src/"));
     if (bad.length) throw new Error(`refusing to package sources/sourcemaps: ${bad.join(", ")}`);
     const buf = await createTarGz(stage);
-    const out = path11.resolve(opts.out ?? ".");
-    await fs8.mkdir(out, { recursive: true });
-    const file = path11.join(out, `${m.id}-${m.version}.tgz`);
-    await fs8.writeFile(file, buf);
+    const out = path13.resolve(opts.out ?? ".");
+    await fs9.mkdir(out, { recursive: true });
+    const file = path13.join(out, `${m.id}-${m.version}.tgz`);
+    await fs9.writeFile(file, buf);
     const sha256 = crypto4.createHash("sha256").update(buf).digest("hex");
     const descriptor = {
       id: m.id,
@@ -1834,23 +5030,23 @@ async function packagePlugin(root, opts = {}) {
       description: m.description,
       author: typeof m.author === "string" ? m.author : m.author?.name,
       permissions: m.permissions ?? [],
-      file: path11.basename(file),
+      file: path13.basename(file),
       sha256
     };
-    const descriptorFile = path11.join(out, `${m.id}-${m.version}.fluxplugin.json`);
-    await fs8.writeFile(descriptorFile, JSON.stringify(descriptor, null, 2));
-    log2(`packaged ${path11.relative(process.cwd(), file) || file}  (${shipped.length} files: ${shipped.filter((x) => x !== "plugin.json").slice(0, 6).join(", ")}${shipped.length > 7 ? ", \u2026" : ""})
+    const descriptorFile = path13.join(out, `${m.id}-${m.version}.fluxplugin.json`);
+    await fs9.writeFile(descriptorFile, JSON.stringify(descriptor, null, 2));
+    log2(`packaged ${path13.relative(process.cwd(), file) || file}  (${shipped.length} files: ${shipped.filter((x) => x !== "plugin.json").slice(0, 6).join(", ")}${shipped.length > 7 ? ", \u2026" : ""})
   sha256 ${sha256}${opts.signKey ? "\n  signed" : ""}`);
     return { file, descriptorFile, sha256, manifest: m, shipped, signed: !!opts.signKey };
   } finally {
-    await fs8.rm(stage, { recursive: true, force: true });
+    await fs9.rm(stage, { recursive: true, force: true });
   }
 }
 
 // src/cli/publish.ts
-import { promises as fs9 } from "node:fs";
+import { promises as fs10 } from "node:fs";
 import os2 from "node:os";
-import path12 from "node:path";
+import path14 from "node:path";
 function parseGitHubRepo(input) {
   if (!input) return void 0;
   const m = /^(?:https?:\/\/github\.com\/|git@github\.com:|github:)?([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(input.trim());
@@ -1858,7 +5054,7 @@ function parseGitHubRepo(input) {
 }
 async function publishPlugin(root, o = {}) {
   const log2 = o.log ?? console.log;
-  const manifest = JSON.parse(await fs9.readFile(path12.join(root, "plugin.json"), "utf8"));
+  const manifest = JSON.parse(await fs10.readFile(path14.join(root, "plugin.json"), "utf8"));
   const repo = parseGitHubRepo(o.repo) ?? parseGitHubRepo(typeof manifest["repository"] === "string" ? manifest["repository"] : manifest["repository"]?.url);
   if (!repo || /YOUR_NAME/i.test(JSON.stringify(manifest["repository"] ?? ""))) {
     throw new Error('no GitHub repository: set "repository": "https://github.com/<you>/<repo>" in plugin.json (or pass --repo owner/name)');
@@ -1869,15 +5065,15 @@ async function publishPlugin(root, o = {}) {
   if (!manifest["license"]) problems.push('"license" is missing');
   if (problems.length) throw new Error("not ready for the store: " + problems.join("; "));
   for (const rec of ["screenshots", "video", "banner"]) if (!manifest[rec] || Array.isArray(manifest[rec]) && !manifest[rec].length) log2(`  tip: add "${rec}" to plugin.json for a better store page`);
-  const out = await fs9.mkdtemp(path12.join(os2.tmpdir(), "flux-publish-"));
+  const out = await fs10.mkdtemp(path14.join(os2.tmpdir(), "flux-publish-"));
   try {
     const pkg2 = await packagePlugin(root, { out, signKey: o.signKey, log: log2 });
     const tag = `v${pkg2.manifest.version}`;
     if (o.dryRun) {
       log2(`
 [dry run] would create release ${tag} in github.com/${repo} with:
-  - ${path12.basename(pkg2.file)}
-  - ${path12.basename(pkg2.descriptorFile)}
+  - ${path14.basename(pkg2.file)}
+  - ${path14.basename(pkg2.descriptorFile)}
   and add the topic "${o.topic ?? DEFAULT_TOPIC}"`);
       return { repo, version: pkg2.manifest.version, id: pkg2.manifest.id };
     }
@@ -1910,8 +5106,8 @@ Install: \`fluxplugin install ${pkg2.manifest.id}\` or from the Plugins page of
     if (rel.status >= 300) throw new Error(`could not create the release (${rel.status}): ${rel.json?.message ?? "unknown error"}`);
     const upload = String(rel.json.upload_url).replace(/\{\?[^}]*\}$/, "");
     for (const [file, type] of [[pkg2.file, "application/gzip"], [pkg2.descriptorFile, "application/json"]]) {
-      const up = await gh("POST", `${upload}?name=${encodeURIComponent(path12.basename(file))}`, void 0, { "content-type": type }, new Uint8Array(await fs9.readFile(file)));
-      if (up.status >= 300) throw new Error(`upload of ${path12.basename(file)} failed (${up.status}): ${up.json?.message ?? ""}`);
+      const up = await gh("POST", `${upload}?name=${encodeURIComponent(path14.basename(file))}`, void 0, { "content-type": type }, new Uint8Array(await fs10.readFile(file)));
+      if (up.status >= 300) throw new Error(`upload of ${path14.basename(file)} failed (${up.status}): ${up.json?.message ?? ""}`);
     }
     const topics = await gh("GET", `${api}/repos/${repo}/topics`);
     const names = topics.json?.names ?? [];
@@ -1927,21 +5123,21 @@ Install: \`fluxplugin install ${pkg2.manifest.id}\` or from the Plugins page of
   (new GitHub topics can take a few minutes to show up in search)`);
     return { release: rel.json.html_url, repo, version: pkg2.manifest.version, id: pkg2.manifest.id };
   } finally {
-    await fs9.rm(out, { recursive: true, force: true });
+    await fs10.rm(out, { recursive: true, force: true });
   }
 }
 
 // src/cli/store.ts
 import crypto5 from "node:crypto";
-import { promises as fs10 } from "node:fs";
-import path13 from "node:path";
+import { promises as fs11 } from "node:fs";
+import path15 from "node:path";
 var INDEX = "index.json";
 async function storeInit(dir) {
-  await fs10.mkdir(dir, { recursive: true });
-  const idx = path13.join(dir, INDEX);
-  if (await fs10.stat(idx).catch(() => null)) throw new Error(`${idx} already exists`);
-  await fs10.writeFile(idx, JSON.stringify({ plugins: [] }, null, 2));
-  await fs10.writeFile(path13.join(dir, "README.md"), `# My plugin store
+  await fs11.mkdir(dir, { recursive: true });
+  const idx = path15.join(dir, INDEX);
+  if (await fs11.stat(idx).catch(() => null)) throw new Error(`${idx} already exists`);
+  await fs11.writeFile(idx, JSON.stringify({ plugins: [] }, null, 2));
+  await fs11.writeFile(path15.join(dir, "README.md"), `# My plugin store
 
 A store is a folder with \`index.json\` and the plugin packages (\`.tgz\`).
 
@@ -1957,7 +5153,7 @@ Host this folder anywhere that serves static files:
 `);
 }
 async function storeAdd(pkgFile, dir, baseUrl) {
-  const buf = await fs10.readFile(pkgFile);
+  const buf = await fs11.readFile(pkgFile);
   const entries = await readTarGz(buf);
   const pj = entries.find((e) => e.type === "file" && /^[^/]+\/plugin\.json$/.test(e.name));
   if (!pj) throw new Error("not a fluxplugin package (no plugin.json)");
@@ -1967,17 +5163,147 @@ async function storeAdd(pkgFile, dir, baseUrl) {
   if (bad.length) throw new Error(`the package contains sources/sourcemaps (${bad[0].name}); rebuild it with "fluxplugin package"`);
   const m = v.manifest;
   const sha256 = crypto5.createHash("sha256").update(buf).digest("hex");
-  await fs10.mkdir(dir, { recursive: true });
-  const fileName = path13.basename(pkgFile);
-  if (path13.resolve(pkgFile) !== path13.resolve(dir, fileName)) await fs10.copyFile(pkgFile, path13.join(dir, fileName));
-  const idxFile = path13.join(dir, INDEX);
-  const idx = JSON.parse(await fs10.readFile(idxFile, "utf8").catch(() => '{"plugins":[]}'));
+  await fs11.mkdir(dir, { recursive: true });
+  const fileName = path15.basename(pkgFile);
+  if (path15.resolve(pkgFile) !== path15.resolve(dir, fileName)) await fs11.copyFile(pkgFile, path15.join(dir, fileName));
+  const idxFile = path15.join(dir, INDEX);
+  const idx = JSON.parse(await fs11.readFile(idxFile, "utf8").catch(() => '{"plugins":[]}'));
   const url = baseUrl ? new URL(fileName, baseUrl.endsWith("/") ? baseUrl : baseUrl + "/").href : fileName;
   const entry = { id: m.id, name: m.name, version: m.version, description: m.description, author: typeof m.author === "string" ? m.author : m.author?.name, permissions: m.permissions ?? [], url, sha256, homepage: m.homepage };
   idx.plugins = [...idx.plugins.filter((p) => !(p.id === m.id && p.version === m.version)), entry].sort((a, b) => a.id.localeCompare(b.id) || a.version.localeCompare(b.version, void 0, { numeric: true }));
-  await fs10.writeFile(idxFile, JSON.stringify(idx, null, 2));
+  await fs11.writeFile(idxFile, JSON.stringify(idx, null, 2));
   return { id: m.id, version: m.version, sha256 };
 }
+async function storeBuild(dir, opts = {}) {
+  const log2 = opts.log ?? console.log;
+  const root = path15.resolve(dir);
+  const pluginsRel = opts.pluginsDir ?? (await fs11.stat(path15.join(root, "plugins")).catch(() => null) ? "plugins" : ".");
+  const base = path15.join(root, pluginsRel);
+  const out = path15.resolve(opts.out ?? path15.join(root, INDEX));
+  const plugins = [];
+  const tmpRoot = await fs11.mkdtemp(path15.join((await import("node:os")).tmpdir(), "flux-store-"));
+  try {
+    for (const name of (await fs11.readdir(base)).sort()) {
+      const folder = path15.join(base, name);
+      let raw;
+      try {
+        raw = JSON.parse(await fs11.readFile(path15.join(folder, "plugin.json"), "utf8"));
+      } catch {
+        continue;
+      }
+      const v = validateManifest(raw);
+      if (!v.manifest) {
+        log2(`! skipped ${name}: ${v.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+        continue;
+      }
+      const m = v.manifest;
+      const stage = path15.join(tmpRoot, name);
+      const files = (await copyPluginRuntime(folder, stage)).sort();
+      const hashes = {};
+      for (const f of files) hashes[f] = crypto5.createHash("sha256").update(await fs11.readFile(path15.join(stage, f))).digest("hex");
+      const rel = (p) => p ? p.replace(/^\.\//, "") : void 0;
+      const relFolder = path15.relative(root, folder).split(path15.sep).join("/") + "/";
+      const readme3 = await fs11.readFile(path15.join(folder, rel(m.readme) ?? "README.md"), "utf8").then((s2) => s2.slice(0, 2e4), () => void 0);
+      plugins.push({
+        id: m.id,
+        name: m.name,
+        version: m.version,
+        description: m.description,
+        author: typeof m.author === "string" ? m.author : m.author?.name,
+        permissions: m.permissions ?? [],
+        folder: relFolder,
+        files,
+        hashes,
+        homepage: m.homepage,
+        license: m.license,
+        icon: m.icon ? relFolder + rel(m.icon) : void 0,
+        banner: m.banner ? relFolder + rel(m.banner) : void 0,
+        screenshots: (m.screenshots ?? []).map((s2) => relFolder + rel(s2)),
+        video: m.video?.startsWith("./") ? relFolder + rel(m.video) : m.video,
+        categories: m.categories,
+        keywords: m.keywords,
+        links: m.links,
+        readme: readme3
+      });
+      log2(`  ${m.id}@${m.version}  (${files.length} files)`);
+    }
+  } finally {
+    await fs11.rm(tmpRoot, { recursive: true, force: true });
+  }
+  await fs11.writeFile(out, JSON.stringify({ plugins }, null, 2));
+  return { count: plugins.length, file: out };
+}
+
+// src/cli/dist.ts
+import { spawn as spawn3 } from "node:child_process";
+import { existsSync as existsSync4, promises as fs12 } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+import path16 from "node:path";
+async function pluginFolders(dir) {
+  const out = [];
+  for (const n of (await fs12.readdir(dir).catch(() => [])).sort()) if (existsSync4(path16.join(dir, n, "plugin.json"))) out.push(path16.join(dir, n));
+  return out;
+}
+async function stagePlugins(cwd, outDir, log2 = console.log) {
+  const cfg = await loadConfig({}, cwd);
+  await fs12.rm(outDir, { recursive: true, force: true });
+  const dirs = await pluginFolders(cfg.pluginsDir);
+  for (const d of dirs) {
+    const files = await copyPluginRuntime(d, path16.join(outDir, path16.basename(d)));
+    log2(`  ${path16.basename(d)}: ${files.length} runtime files`);
+  }
+  await fs12.mkdir(outDir, { recursive: true });
+  return dirs.length;
+}
+async function distApp(cwd, opts = {}) {
+  const log2 = opts.log ?? console.log;
+  log2("1/3 building the app\u2026");
+  await buildHost(cwd, { log: log2 });
+  log2("2/3 staging plugins (runtime files only)\u2026");
+  const n = await stagePlugins(cwd, path16.join(cwd, ".flux-build/plugins"), log2);
+  log2(`3/3 packaging (${n} plugin(s) bundled)\u2026`);
+  let cli;
+  try {
+    const pj = createRequire3(path16.join(cwd, "package.json")).resolve("electron-builder/package.json");
+    const bin = JSON.parse(await fs12.readFile(pj, "utf8")).bin;
+    cli = path16.join(path16.dirname(pj), typeof bin === "string" ? bin : bin?.["electron-builder"] ?? "cli.js");
+  } catch {
+    throw new Error('electron-builder is not installed: run "npm install -D electron-builder"');
+  }
+  const args = [cli, "--config", existsSync4(path16.join(cwd, "electron-builder.yml")) ? "electron-builder.yml" : "package.json"];
+  if (opts.dir) args.push("--dir");
+  for (const t of ["win", "mac", "linux"]) if (opts[t]) args.push(`--${t}`);
+  return await new Promise((resolve) => {
+    const child = spawn3(process.execPath, args, { cwd, stdio: "inherit", env: { ...process.env, CSC_IDENTITY_AUTO_DISCOVERY: process.env["CSC_IDENTITY_AUTO_DISCOVERY"] ?? "false" } });
+    child.on("exit", (c) => resolve(c ?? 1));
+  });
+}
+async function exportWebsite(cwd, outDir, log2 = console.log) {
+  await buildHost(cwd, { log: log2 });
+  const out = path16.resolve(outDir);
+  await fs12.rm(out, { recursive: true, force: true });
+  await fs12.mkdir(out, { recursive: true });
+  for (const f of ["index.html", "renderer.js", "renderer.css", "tailwind.css"]) if (existsSync4(path16.join(cwd, "dist", f))) await fs12.copyFile(path16.join(cwd, "dist", f), path16.join(out, f));
+  const cfg = await loadConfig({}, cwd);
+  let count = 0;
+  for (const d of await pluginFolders(cfg.pluginsDir)) {
+    const id = JSON.parse(await fs12.readFile(path16.join(d, "plugin.json"), "utf8")).id;
+    await copyPluginRuntime(d, path16.join(out, "plugins", id));
+    count++;
+  }
+  const tmp = await fs12.mkdtemp(path16.join((await import("node:os")).tmpdir(), "flux-export-"));
+  try {
+    const fw = new MainFramework({ pluginDirs: [path16.join(out, "plugins")], dataDir: tmp, assetUrl: (id, rel) => `./plugins/${id}/${rel.replace(/^\.\//, "")}` });
+    await fw.manager.init();
+    await fw.scan();
+    await fs12.writeFile(path16.join(out, "bootstrap.json"), JSON.stringify(fw.bootstrap(), null, 2));
+  } finally {
+    await fs12.rm(tmp, { recursive: true, force: true });
+  }
+  await fs12.writeFile(path16.join(out, "README.txt"), "Static export. Serve this folder over HTTP(S) (e.g. `npx serve .`); opening index.html from disk will not work.\nOnly the browser side runs here: plugins that need main-process code are listed but their IPC calls fail.\n");
+  log2(`exported ${count} plugin(s) \u2192 ${out}`);
+  return { plugins: count, out };
+}
 
 // src/cli/cli.ts
 var HELP = `fluxplugin <command>
@@ -1987,26 +5313,31 @@ var HELP = `fluxplugin <command>
   dev [--web]                     run your app with plugin hot reload (Electron, or a browser with --web)
   build                           bundle your app (in an app folder) or a plugin (in a plugin folder)
   start [--web]                   run the built app
-  plugin new <name> [-t basic|dashboard|backend] [--tailwindcss]   scaffold a plugin (alias: create)
+  dist [--win|--mac|--linux] [--unpacked]   build the app into an installer/executable (electron-builder)
+  export [--out website]          extract the app as a static website
+  plugin new <name> [-t basic|dashboard|backend] [--tailwindcss] [--standalone]   scaffold a plugin (its own project when outside an app)
+  dev --host <app>                (in a plugin project) rebuild on save and sync into a host app that hot-reloads it
   validate [dir]                  check a plugin manifest, entries and integrity
   publish [dir] [--repo o/r] [--dry-run]   publish a plugin to the store (GitHub release + topic)
   search [query]                  search the configured stores
   install <id[@version]|dir|.tgz> install a plugin from a store, a folder or a package
   store init <dir>                create your own store (index.json) \u2014 host it anywhere
   store add <pkg.tgz> [--dir d] [--base-url url]   add a package to your store
+  store build [dir] [--out index.json]            build the catalog JSON from plugin folders (repo layout)
+  package --all [--out release/plugins]           package every plugin of the app
   package [dir] [--out d] [--sign-key file]   build + integrity (+ signature) + .tgz
   install <dir|.tgz> [--dir plugins]   uninstall <id>   enable <id>   disable <id>   list
   keygen [--out name]    create an ed25519 signing key pair
   tailwind [--dir plugins] [--out file]   generate @source lines for Tailwind v4`;
 var log = (...a) => console.log(...a);
 async function readManifest(root) {
-  return JSON.parse(await fs11.readFile(path14.join(root, "plugin.json"), "utf8"));
+  return JSON.parse(await fs13.readFile(path17.join(root, "plugin.json"), "utf8"));
 }
 async function run(argv) {
   const { values: f, positionals: pos } = parseArgs({
     args: argv,
     allowPositionals: true,
-    options: { template: { type: "string", short: "t" }, out: { type: "string" }, dir: { type: "string" }, data: { type: "string" }, "sign-key": { type: "string" }, help: { type: "boolean", short: "h" }, web: { type: "boolean" }, port: { type: "string" }, name: { type: "string" }, "no-sample": { type: "boolean" }, tailwindcss: { type: "boolean" }, repo: { type: "string" }, token: { type: "string" }, "dry-run": { type: "boolean" }, "base-url": { type: "string" } }
+    options: { template: { type: "string", short: "t" }, out: { type: "string" }, dir: { type: "string" }, data: { type: "string" }, "sign-key": { type: "string" }, help: { type: "boolean", short: "h" }, web: { type: "boolean" }, port: { type: "string" }, name: { type: "string" }, "no-sample": { type: "boolean" }, tailwindcss: { type: "boolean" }, repo: { type: "string" }, token: { type: "string" }, "dry-run": { type: "boolean" }, "base-url": { type: "string" }, all: { type: "boolean" }, win: { type: "boolean" }, mac: { type: "boolean" }, linux: { type: "boolean" }, unpacked: { type: "boolean" }, store: { type: "string" }, host: { type: "string" }, standalone: { type: "boolean" } }
   });
   let [cmd, arg] = pos;
   if (cmd === "store") {
@@ -2020,20 +5351,20 @@ async function run(argv) {
     arg = pos[2];
   }
   if (!cmd || f.help) return log(HELP), cmd ? 0 : 1;
-  const root = path14.resolve(arg ?? ".");
+  const root = path17.resolve(arg ?? ".");
   try {
     switch (cmd) {
       case "init": {
-        const target = path14.resolve(arg ?? ".");
-        const entries = await fs11.readdir(target).catch(() => []);
+        const target = path17.resolve(arg ?? ".");
+        const entries = await fs13.readdir(target).catch(() => []);
         if (entries.length) throw new Error(`${target} is not empty`);
-        const name = (f.name ?? path14.basename(target)).toLowerCase().replace(/[^a-z0-9-_.]+/g, "-");
-        const files = hostFiles({ name, fluxSpec: process.env["FLUXPLUGIN_SPEC"] ?? `^${await ownVersion()}`, electron: await latestElectron(), tailwind: !!f.tailwindcss }, !f["no-sample"]);
+        const name = (f.name ?? path17.basename(target)).toLowerCase().replace(/[^a-z0-9-_.]+/g, "-");
+        const files = hostFiles({ name, fluxSpec: process.env["FLUXPLUGIN_SPEC"] ?? `^${await ownVersion()}`, electron: await latestElectron(), tailwind: !!f.tailwindcss, stores: parseStoreSpec(f.store) }, !f["no-sample"]);
         for (const [rel2, content] of Object.entries(files)) {
-          await fs11.mkdir(path14.dirname(path14.join(target, rel2)), { recursive: true });
-          await fs11.writeFile(path14.join(target, rel2), content);
+          await fs13.mkdir(path17.dirname(path17.join(target, rel2)), { recursive: true });
+          await fs13.writeFile(path17.join(target, rel2), content);
         }
-        const rel = path14.relative(process.cwd(), target) || ".";
+        const rel = path17.relative(process.cwd(), target) || ".";
         log(`\u2714 created ${name} in ${target}
 
 Next steps:
@@ -2049,17 +5380,19 @@ Add a plugin:  npm run plugin:new my-plugin -- -t backend`);
         if (!arg) throw new Error("usage: fluxplugin plugin new <name> [-t basic|dashboard|backend]");
         const tpl = f.template ?? "basic";
         if (!(tpl in TEMPLATES)) throw new Error(`unknown template "${tpl}"`);
-        const base = await isHostProject(process.cwd()) && !path14.isAbsolute(arg) && !arg.includes("/") ? path14.join((await loadConfig({}, process.cwd())).pluginsDir, arg) : path14.resolve(arg);
-        if (await fs11.stat(base).catch(() => null)) throw new Error(`${base} already exists`);
-        const vars = varsFromName(path14.basename(base));
+        const inHost = await isHostProject(process.cwd());
+        const standalone = !!f.standalone || !inHost;
+        const base = inHost && !f.standalone && !path17.isAbsolute(arg) && !arg.includes("/") && !arg.includes("\\") ? path17.join((await loadConfig({}, process.cwd())).pluginsDir, arg) : path17.resolve(arg);
+        if (await fs13.stat(base).catch(() => null)) throw new Error(`${base} already exists`);
+        const vars = varsFromName(path17.basename(base));
         let files = TEMPLATES[tpl](vars);
         if (f.tailwindcss) files = withTailwind(files, vars);
+        if (standalone) files = { ...files, ...standaloneExtras(vars) };
         for (const [rel, content] of Object.entries(files)) {
-          await fs11.mkdir(path14.dirname(path14.join(base, rel)), { recursive: true });
-          await fs11.writeFile(path14.join(base, rel), content);
+          await fs13.mkdir(path17.dirname(path17.join(base, rel)), { recursive: true });
+          await fs13.writeFile(path17.join(base, rel), content);
         }
-        log(`\u2714 created ${tpl} plugin in ${base}
-  next: fluxplugin build ${path14.relative(process.cwd(), base)}`);
+        log(`\u2714 created ${tpl} plugin in ${base}${standalone ? "\n\n  cd " + path17.relative(process.cwd(), base) + "\n  npm install\n  npm run dev:host    # run it inside your app while you work (edit the path in package.json)" : "\n  next: fluxplugin build " + path17.relative(process.cwd(), base)}`);
         return 0;
       }
       case "build": {
@@ -2074,6 +5407,7 @@ Add a plugin:  npm run plugin:new my-plugin -- -t backend`);
         const cwd = process.cwd();
         if (arg || !await isHostProject(cwd)) {
           await buildPlugin(root, true);
+          if (f.host) await linkPluginToHost(root, path17.resolve(f.host));
           await new Promise(() => {
           });
         }
@@ -2091,7 +5425,7 @@ Add a plugin:  npm run plugin:new my-plugin -- -t backend`);
       }
       case "start": {
         const cwd = process.cwd();
-        if (!await fs11.stat(path14.join(cwd, "dist/index.html")).catch(() => null)) throw new Error("nothing built yet: run `fluxplugin build` first");
+        if (!await fs13.stat(path17.join(cwd, "dist/index.html")).catch(() => null)) throw new Error("nothing built yet: run `fluxplugin build` first");
         const { child } = startApp(cwd, { web: f.web, port: f.port ? Number(f.port) : void 0 });
         return await new Promise((r) => child.on("exit", (c) => r(c ?? 0)));
       }
@@ -2099,8 +5433,32 @@ Add a plugin:  npm run plugin:new my-plugin -- -t backend`);
         return await doctor(process.cwd());
       case "validate":
         return await validate(root);
-      case "package":
-        return await packagePlugin(root, { out: f.out, signKey: f["sign-key"] }), 0;
+      case "package": {
+        if (f.all) {
+          const cfg = await loadConfig(f);
+          let n = 0;
+          for (const d of (await fs13.readdir(cfg.pluginsDir).catch(() => [])).sort()) {
+            if (!await fs13.stat(path17.join(cfg.pluginsDir, d, "plugin.json")).catch(() => null)) continue;
+            await packagePlugin(path17.join(cfg.pluginsDir, d), { out: f.out ?? "release/plugins", signKey: f["sign-key"] });
+            n++;
+          }
+          log(`\u2714 packaged ${n} plugin(s) in ${f.out ?? "release/plugins"}`);
+          return 0;
+        }
+        await packagePlugin(root, { out: f.out, signKey: f["sign-key"] });
+        return 0;
+      }
+      case "dist":
+        return await distApp(process.cwd(), { win: f.win, mac: f.mac, linux: f.linux, dir: f.unpacked });
+      case "export":
+        await exportWebsite(process.cwd(), f.out ?? "website");
+        return 0;
+      case "store:build": {
+        const r = await storeBuild(path17.resolve(arg ?? "."), { out: f.out });
+        log(`\u2714 catalog with ${r.count} plugin(s) written to ${r.file}
+  commit it with the plugin folders; point a store at the repo: { "type": "github", "repo": "owner/name" }`);
+        return 0;
+      }
       case "publish":
         await publishPlugin(root, { repo: f.repo, token: f.token, signKey: f["sign-key"], dryRun: f["dry-run"] });
         return 0;
@@ -2117,31 +5475,31 @@ Add a plugin:  npm run plugin:new my-plugin -- -t backend`);
         return 0;
       }
       case "store:init":
-        await storeInit(path14.resolve(arg ?? "store"));
-        log(`\u2714 store created in ${path14.resolve(arg ?? "store")} (see its README.md)`);
+        await storeInit(path17.resolve(arg ?? "store"));
+        log(`\u2714 store created in ${path17.resolve(arg ?? "store")} (see its README.md)`);
         return 0;
       case "store:add": {
         if (!arg) throw new Error("usage: store add <package.tgz> [--dir store] [--base-url https://\u2026]");
-        const r = await storeAdd(path14.resolve(arg), path14.resolve(f.dir ?? "store"), f["base-url"]);
-        log(`\u2714 added ${r.id}@${r.version} to ${path14.resolve(f.dir ?? "store")}/index.json`);
+        const r = await storeAdd(path17.resolve(arg), path17.resolve(f.dir ?? "store"), f["base-url"]);
+        log(`\u2714 added ${r.id}@${r.version} to ${path17.resolve(f.dir ?? "store")}/index.json`);
         return 0;
       }
       case "keygen": {
         const k = generateSigningKeyPair();
         const base = f.out ?? "flux-signing";
-        await fs11.writeFile(`${base}.private.key`, k.privateKey, { mode: 384 });
-        await fs11.writeFile(`${base}.public.key`, k.publicKey);
+        await fs13.writeFile(`${base}.private.key`, k.privateKey, { mode: 384 });
+        await fs13.writeFile(`${base}.public.key`, k.publicKey);
         log(`wrote ${base}.private.key (keep secret) and ${base}.public.key (distribute to hosts as a trusted key)`);
         return 0;
       }
       case "tailwind": {
         const cfg = await loadConfig(f);
-        const names = (await fs11.readdir(cfg.pluginsDir).catch(() => [])).sort();
-        const lines = names.map((n) => `@source "${path14.join(cfg.pluginsDir, n, "src").replace(/\\/g, "/")}";`);
+        const names = (await fs13.readdir(cfg.pluginsDir).catch(() => [])).sort();
+        const lines = names.map((n) => `@source "${path17.join(cfg.pluginsDir, n, "src").replace(/\\/g, "/")}";`);
         const css = `/* generated by fluxplugin tailwind */
 ${lines.join("\n")}
 `;
-        if (f.out) await fs11.writeFile(f.out, css);
+        if (f.out) await fs13.writeFile(f.out, css);
         else log(css);
         return 0;
       }
@@ -2168,7 +5526,7 @@ async function validate(root) {
   v.warnings.forEach((w) => log(`! ${w}`));
   if (v.manifest) {
     for (const rel of [v.manifest.main, v.manifest.renderer, ...v.manifest.styles ?? []].filter(Boolean))
-      if (!await fs11.stat(path14.join(root, rel)).catch(() => null)) log(`\u2716 missing file ${rel} (run build)`), bad = true;
+      if (!await fs13.stat(path17.join(root, rel)).catch(() => null)) log(`\u2716 missing file ${rel} (run build)`), bad = true;
     try {
       await verifyPlugin(root, raw, v.manifest);
     } catch (e) {
@@ -2181,17 +5539,17 @@ async function validate(root) {
 }
 async function manage(cmd, arg, f) {
   const cfg = await loadConfig(f);
-  const state = new JsonStateFile(path14.join(cfg.dataDir, "plugins-state.json"));
-  const inst = new PluginInstaller(cfg.pluginsDir, path14.join(cfg.dataDir, "backups"));
+  const state = new JsonStateFile(path17.join(cfg.dataDir, "plugins-state.json"));
+  const inst = new PluginInstaller(cfg.pluginsDir, path17.join(cfg.dataDir, "backups"));
   if (cmd === "list") {
     const { disabled } = await state.readAll();
     for (const m of await inst.installed()) log(`${disabled.includes(m.id) ? "\u25CB" : "\u25CF"} ${m.id}@${m.version}  ${m.name}`);
     return 0;
   }
   if (!arg) throw new Error(`usage: ${cmd} <${cmd === "install" ? "dir|.tgz" : "id"}>`);
-  if (cmd === "install" && arg && !arg.endsWith(".tgz") && !await fs11.stat(arg).catch(() => null)) {
+  if (cmd === "install" && arg && !arg.endsWith(".tgz") && !await fs13.stat(arg).catch(() => null)) {
     const [id, version] = arg.split("@");
-    const store = new PluginInstaller(cfg.pluginsDir, path14.join(cfg.dataDir, "backups"), createRegistries(cfg.stores));
+    const store = new PluginInstaller(cfg.pluginsDir, path17.join(cfg.dataDir, "backups"), createRegistries(cfg.stores));
     const found = (await store.search(id)).filter((e) => e.id === id && (!version || e.version === version));
     if (!found.length) throw new Error(`"${arg}" was not found in your stores (${cfg.stores.map((s2) => s2.type).join(", ")}). Try: fluxplugin search ${id}`);
     const best = found.sort((a, b) => b.version.localeCompare(a.version, void 0, { numeric: true }))[0];
@@ -2201,16 +5559,16 @@ async function manage(cmd, arg, f) {
     return 0;
   }
   if (cmd === "install") {
-    const tmp = path14.join(cfg.dataDir, ".install", String(Date.now()));
-    if (arg.endsWith(".tgz")) await extractTarGz(await fs11.readFile(arg), tmp);
-    else await copyDir(path14.resolve(arg), tmp);
+    const tmp = path17.join(cfg.dataDir, ".install", String(Date.now()));
+    if (arg.endsWith(".tgz")) await extractTarGz(await fs13.readFile(arg), tmp);
+    else await copyDir(path17.resolve(arg), tmp);
     const v = validateManifest(await readManifest(tmp));
     if (!v.manifest) throw new Error("invalid plugin: " + v.issues.map((i) => i.message).join("; "));
-    const reg = new LocalRegistry(path14.dirname(tmp), "cli");
+    const reg = new LocalRegistry(path17.dirname(tmp), "cli");
     inst.addRegistry(reg);
     const [entry] = (await reg.search(v.manifest.id)).filter((e) => e.id === v.manifest.id);
     const r = await inst.install({ ...entry, location: tmp });
-    await fs11.rm(tmp, { recursive: true, force: true });
+    await fs13.rm(tmp, { recursive: true, force: true });
     log(`installed ${r.id}@${r.version}${r.previousVersion ? ` (was ${r.previousVersion}; rollback available)` : ""}`);
   } else if (cmd === "uninstall") {
     await inst.uninstall(arg);
@@ -2224,7 +5582,7 @@ async function manage(cmd, arg, f) {
 async function ownVersion() {
   for (const rel of ["../package.json", "../../package.json"]) {
     try {
-      const j = JSON.parse(await fs11.readFile(new URL(rel, import.meta.url), "utf8"));
+      const j = JSON.parse(await fs13.readFile(new URL(rel, import.meta.url), "utf8"));
       if (j.name === "fluxplugin" && j.version) return j.version;
     } catch {
     }
@@ -2250,23 +5608,30 @@ async function doctor(cwd) {
     return bad ? 1 : 0;
   }
   const e = ensureElectron(cwd, log);
-  e.bin ? ok2(`Electron binary: ${path14.relative(cwd, e.bin) || e.bin}`) : ko(`Electron: ${e.error}
+  e.bin ? ok2(`Electron binary: ${path17.relative(cwd, e.bin) || e.bin}`) : ko(`Electron: ${e.error}
     fix: npm install -D electron`);
   try {
     (await import("esbuild")).version ? ok2("esbuild") : ko("esbuild");
   } catch {
     ko("esbuild is not available");
   }
-  const hasTw = await fs11.stat(path14.join(cwd, "src/app/renderer/styles/tailwind.css")).then(() => true, () => false);
+  const hasTw = await fs13.stat(path17.join(cwd, "src/app/renderer/styles/tailwind.css")).then(() => true, () => false);
   if (hasTw) {
     const { resolveTailwindCli: resolveTailwindCli2 } = await Promise.resolve().then(() => (init_tailwind(), tailwind_exports));
     resolveTailwindCli2([cwd]) ? ok2("Tailwind CLI") : ko("Tailwind CLI missing: npm install -D tailwindcss @tailwindcss/cli");
   }
-  const pkg2 = JSON.parse(await fs11.readFile(path14.join(cwd, "package.json"), "utf8").catch(() => "{}"));
+  const pkg2 = JSON.parse(await fs13.readFile(path17.join(cwd, "package.json"), "utf8").catch(() => "{}"));
   if (!pkg2.allowScripts?.["electron"]) log(`! package.json has no "allowScripts": {"electron": true}. npm 12 blocks Electron's postinstall without it (fluxplugin downloads the binary for you, but add it for clean installs).`);
   log(bad ? "\nSome checks failed." : "\nAll good.");
   return bad ? 1 : 0;
 }
+function parseStoreSpec(spec) {
+  if (!spec) return void 0;
+  const gh = /^github:([\w.-]+\/[\w.-]+)$/.exec(spec);
+  if (gh) return [{ type: "github", repo: gh[1] }];
+  if (/^https:\/\/\S+$/.test(spec)) return [spec.toLowerCase().split("?")[0].endsWith(".json") ? { type: "json", url: spec } : { type: "http", url: spec }];
+  throw new Error('--store must be "github:owner/repo" or an https URL (a .json link, or a folder URL ending with /)');
+}
 
 // src/cli/bin.ts
 process.exit(await run(process.argv.slice(2)));