fluxplugin 1.0.3 → 1.0.4

package/dist/node/chunks/{chunk-EVX2O65A.js → chunk-SDCGUBEW.js}

@@ -63,6 +63,7 @@ __export(core_exports, {
   normalizePath: () => normalizePath,
   parseOrThrow: () => parseOrThrow,
   parseVersion: () => parseVersion,
+  parseVideo: () => parseVideo,
   pluginApi: () => pluginApi,
   preloadMember: () => preloadMember,
   routePatternMatches: () => routePatternMatches,
@@ -610,7 +611,7 @@ var manifestSchema = s.object({
   /** Detailed description as Markdown (default: ./README.md). Rendered safely: no raw HTML. */
   readme: s.string().optional(),
   /** Explanation video (https URL; YouTube and Vimeo are embedded, other hosts become a link). */
-  video: s.string({ pattern: /^https:\/\/\S+$/ }).optional(),
+  video: s.string({ pattern: /^(https:\/\/\S+|\.\/\S+)$/ }).optional(),
   categories: s.array(s.string()).default([]),
   keywords: s.array(s.string()).default([]),
   /** Extra links: docs, support, changelog, funding... */
@@ -671,24 +672,33 @@ function validateManifest(raw, opts = {}) {
   }
   return { ok: issues.length === 0, manifest: issues.length ? void 0 : manifest, issues, warnings };
 }
-function videoEmbedUrl(url) {
+var MEDIA_EXT = /\.(mp4|m4v|webm|ogv|ogg|mov)(\?.*)?$/i;
+function parseVideo(url) {
   if (!url) return void 0;
+  if (url.startsWith("./")) return MEDIA_EXT.test(url) ? { kind: "html5", url, src: url } : void 0;
   let u;
   try {
     u = new URL(url);
   } catch {
     return void 0;
   }
+  if (u.protocol !== "https:") return void 0;
+  if (MEDIA_EXT.test(u.pathname)) return { kind: "html5", url, src: url };
   const host = u.hostname.replace(/^www\./, "");
+  const last = u.pathname.split("/").filter(Boolean).pop() ?? "";
   let id;
   if (host === "youtu.be") id = u.pathname.slice(1);
-  else if (host === "youtube.com" || host === "m.youtube.com") id = u.searchParams.get("v") ?? (/^\/(embed|shorts)\//.test(u.pathname) ? u.pathname.split("/")[2] : void 0);
-  if (id && /^[\w-]{6,20}$/.test(id)) return `https://www.youtube-nocookie.com/embed/${id}`;
-  if (host === "vimeo.com" || host === "player.vimeo.com") {
-    const vid = u.pathname.split("/").filter(Boolean).pop();
-    if (vid && /^\d+$/.test(vid)) return `https://player.vimeo.com/video/${vid}`;
-  }
-  return void 0;
+  else if (host === "youtube.com" || host === "m.youtube.com" || host === "youtube-nocookie.com") id = u.searchParams.get("v") ?? (/^\/(embed|shorts|live)\//.test(u.pathname) ? u.pathname.split("/")[2] : void 0);
+  if (id && /^[\w-]{6,20}$/.test(id)) return { kind: "youtube", url, embedUrl: `https://www.youtube-nocookie.com/embed/${id}` };
+  if ((host === "vimeo.com" || host === "player.vimeo.com") && /^\d+$/.test(last)) return { kind: "vimeo", url, embedUrl: `https://player.vimeo.com/video/${last}` };
+  if (host === "dailymotion.com" && /^\/(embed\/)?video\//.test(u.pathname) && /^\w+$/.test(last)) return { kind: "dailymotion", url, embedUrl: `https://www.dailymotion.com/embed/video/${last}` };
+  if (host === "dai.ly" && /^\w+$/.test(last)) return { kind: "dailymotion", url, embedUrl: `https://www.dailymotion.com/embed/video/${last}` };
+  if (host === "loom.com" && /^\/(share|embed)\//.test(u.pathname) && /^[\w-]+$/.test(last)) return { kind: "loom", url, embedUrl: `https://www.loom.com/embed/${last}` };
+  if (host === "streamable.com" && /^\w+$/.test(last)) return { kind: "streamable", url, embedUrl: `https://streamable.com/e/${last}` };
+  return { kind: "link", url };
+}
+function videoEmbedUrl(url) {
+  return parseVideo(url)?.embedUrl;
 }
 
 // src/core/events.ts
@@ -1121,6 +1131,32 @@ var MenuRegistry = class extends Registry {
   register(item, owner) {
     return this.add(`${item.location}:${item.id}`, item, owner);
   }
+  /**
+   * Hierarchical view of a location: items that name a `parent`, plus the parent's own `children`, are nested under it
+   * (sorted by order). Unknown parents fall back to top level, so a missing plugin never hides its siblings.
+   */
+  tree(location) {
+    const flat = this.items(location);
+    const byId = new Map(flat.map((i) => [i.id, i]));
+    const toNode = (i) => ({ ...i, children: [...i.children ?? []] });
+    const nodes = new Map(flat.map((i) => [i.id, toNode(i)]));
+    const roots = [];
+    for (const i of flat) {
+      const n = nodes.get(i.id);
+      const parent = i.parent && i.parent !== i.id ? nodes.get(i.parent) : void 0;
+      if (parent && byId.has(i.parent)) parent.children.push(n);
+      else roots.push(n);
+    }
+    const sort = (list) => {
+      list.sort((a, b) => (a.order ?? 100) - (b.order ?? 100) || a.label.localeCompare(b.label));
+      for (const n of list) {
+        if (n.children?.length) sort(n.children);
+        else delete n.children;
+      }
+    };
+    sort(roots);
+    return roots;
+  }
   items(location) {
     return this.list().filter((m) => m.location === location && (!m.when || m.when())).sort((a, b) => (a.group ?? "").localeCompare(b.group ?? "") || (a.order ?? 100) - (b.order ?? 100) || a.label.localeCompare(b.label));
   }
@@ -2387,10 +2423,11 @@ var PluginManager = class {
           id: `route:${route.fullPath}`,
           location: menu.location ?? "sidebar",
           label: menu.label ?? meta.title ?? route.fullPath,
-          icon: meta.icon,
+          icon: menu.icon ?? meta.icon,
           path: route.fullPath,
           order: menu.order,
-          group: menu.group
+          group: menu.group,
+          parent: menu.parent
         },
         owner
       );
@@ -2678,6 +2715,7 @@ export {
   menuLocations,
   manifestSchema,
   validateManifest,
+  parseVideo,
   videoEmbedUrl,
   matchesPattern,
   EventBus,

package/dist/node/chunks/{chunk-C7VWZZOX.js → chunk-ZLA5XUXN.js}

@@ -8,10 +8,10 @@ import {
   compareVersions,
   core_exports,
   errorMessage,
+  parseVideo,
   serializeError,
-  validateManifest,
-  videoEmbedUrl
-} from "./chunk-EVX2O65A.js";
+  validateManifest
+} from "./chunk-SDCGUBEW.js";
 
 // src/main/framework.ts
 import { promises as fsp, watch } from "node:fs";
@@ -398,20 +398,80 @@ async function copyDir(src, dest) {
   }
 }
 function entriesFromIndex(index, baseUrl, source, query = "") {
+  const list = Array.isArray(index) ? index : index?.plugins ?? [];
   const q = query.toLowerCase();
-  return (index.plugins ?? []).filter((p) => p && typeof p.id === "string" && typeof p.version === "string" && typeof p.url === "string").filter((p) => !q || `${p.id} ${p.name ?? ""} ${p.description ?? ""}`.toLowerCase().includes(q)).map((p) => ({
-    id: p.id,
-    name: p.name ?? p.id,
-    version: p.version,
-    description: p.description,
-    author: p.author,
-    permissions: p.permissions ?? [],
-    location: new URL(p.url, baseUrl).href,
-    source,
-    sha256: p.sha256,
-    homepage: p.homepage,
-    icon: p.icon
-  }));
+  const abs = (u) => {
+    if (!u) return void 0;
+    try {
+      return new URL(u, baseUrl).href;
+    } catch {
+      return void 0;
+    }
+  };
+  const out = [];
+  for (const p of list) {
+    if (!p || typeof p.id !== "string" || typeof p.version !== "string") continue;
+    const isFolder = typeof p.folder === "string" && Array.isArray(p.files);
+    if (typeof p.url !== "string" && !isFolder) continue;
+    if (q && !`${p.id} ${p.name ?? ""} ${p.description ?? ""} ${(p.keywords ?? []).join(" ")}`.toLowerCase().includes(q)) continue;
+    const folderUrl = isFolder ? abs(p.folder.endsWith("/") ? p.folder : p.folder + "/") : void 0;
+    const location = isFolder ? folderUrl : abs(p.url);
+    if (!location) continue;
+    out.push({
+      id: p.id,
+      name: p.name ?? p.id,
+      version: p.version,
+      description: p.description,
+      author: p.author,
+      permissions: p.permissions ?? [],
+      location,
+      source,
+      sha256: p.sha256,
+      homepage: p.homepage,
+      license: p.license,
+      iconUrl: abs(p.icon),
+      bannerUrl: abs(p.banner),
+      screenshots: (p.screenshots ?? []).map((s) => abs(s)).filter((s) => !!s),
+      video: p.video ? p.video.startsWith("./") && folderUrl ? abs(new URL(p.video, folderUrl).href) : abs(p.video) : void 0,
+      categories: p.categories,
+      keywords: p.keywords,
+      links: p.links,
+      readme: p.readme,
+      folder: isFolder || void 0,
+      files: isFolder ? p.files : void 0,
+      hashes: p.hashes
+    });
+  }
+  return out;
+}
+var SAFE_FILE = /^[\w@+.,() \-]+(\/[\w@+.,() \-]+)*$/;
+async function downloadFolder(entry, dest, get) {
+  const base = entry.location.endsWith("/") ? entry.location : entry.location + "/";
+  const files = entry.files ?? [];
+  if (!files.includes("plugin.json")) throw new Error("catalog entry does not list plugin.json");
+  if (files.length > 800) throw new Error("catalog entry lists too many files");
+  if (!entry.hashes) throw new Error("catalog entry has no file hashes; refusing to install an unverifiable folder (run `fluxplugin store build`)");
+  const root = path5.resolve(dest);
+  await fs5.mkdir(root, { recursive: true });
+  let total = 0;
+  const queue = [...files];
+  const worker = async () => {
+    for (let f = queue.shift(); f !== void 0; f = queue.shift()) {
+      if (!SAFE_FILE.test(f) || f.split("/").some((s) => s === ".." || s === ".")) throw new Error(`unsafe file path in catalog: ${f}`);
+      const expected = entry.hashes[f];
+      if (!expected || !/^[0-9a-f]{64}$/.test(expected)) throw new Error(`no sha256 for ${f} in the catalog`);
+      const res = await get(base + f.split("/").map(encodeURIComponent).join("/"));
+      const buf = Buffer.from(await res.arrayBuffer());
+      total += buf.length;
+      if (total > 100 * 1024 * 1024) throw new Error("plugin is too large");
+      if (crypto2.createHash("sha256").update(buf).digest("hex") !== expected) throw new Error(`${f} does not match the catalog checksum`);
+      const target = path5.resolve(root, f);
+      if (!target.startsWith(root + path5.sep)) throw new Error(`unsafe file path in catalog: ${f}`);
+      await fs5.mkdir(path5.dirname(target), { recursive: true });
+      await fs5.writeFile(target, buf);
+    }
+  };
+  await Promise.all(Array.from({ length: 6 }, worker));
 }
 async function pruneNonRuntime(dir) {
   const removed = [];
@@ -460,23 +520,39 @@ var LocalRegistry = class {
   }
 };
 var HttpRegistry = class {
-  constructor(baseUrl, fetchImpl = fetch) {
+  constructor(baseUrl, fetchImpl = fetch, headers = {}, direct = false) {
     this.baseUrl = baseUrl;
     this.fetchImpl = fetchImpl;
+    this.headers = headers;
+    this.direct = direct;
     this.name = `http:${baseUrl}`;
   }
   baseUrl;
   fetchImpl;
+  headers;
+  direct;
   name;
+  /** Direct link (".json" file, or `direct: true` for an API endpoint) or a folder that contains index.json. */
+  get catalogUrl() {
+    if (this.direct || new URL(this.baseUrl).pathname.toLowerCase().endsWith(".json")) return this.baseUrl;
+    return new URL("index.json", this.baseUrl.endsWith("/") ? this.baseUrl : this.baseUrl + "/").href;
+  }
+  get(url) {
+    return this.fetchImpl(url, { headers: { accept: "application/json, application/octet-stream", ...this.headers } }).then((r) => {
+      if (!r.ok) throw new Error(`store responded ${r.status} for ${new URL(url).pathname}`);
+      return r;
+    });
+  }
   async search(query = "") {
-    const base = this.baseUrl.endsWith("/") ? this.baseUrl : this.baseUrl + "/";
-    const res = await this.fetchImpl(new URL("index.json", base));
-    if (!res.ok) throw new Error(`store responded ${res.status}`);
-    return entriesFromIndex(await res.json(), base, this.name, query);
+    const url = this.catalogUrl;
+    return entriesFromIndex(await (await this.get(url)).json(), url, this.name, query);
   }
   async fetch(entry, dest) {
-    const res = await this.fetchImpl(entry.location);
-    if (!res.ok) throw new Error(`download failed: ${res.status}`);
+    if (entry.folder) {
+      await downloadFolder(entry, dest, (u) => this.get(u));
+      return (await readPluginManifest(dest)).manifest;
+    }
+    const res = await this.get(entry.location);
     const buf = Buffer.from(await res.arrayBuffer());
     if (entry.sha256 && crypto2.createHash("sha256").update(buf).digest("hex") !== entry.sha256.replace(/^sha256-/, "")) {
       throw new Error("downloaded archive does not match the registry checksum");
@@ -662,6 +738,10 @@ var GitHubRegistry = class {
     return out.sort((a, b) => (b.stars ?? 0) - (a.stars ?? 0) || a.id.localeCompare(b.id));
   }
   async fetch(entry, dest) {
+    if (entry.folder) {
+      await downloadFolder(entry, dest, (u) => this.get(u, "application/octet-stream"));
+      return (await readPluginManifest(dest)).manifest;
+    }
     const res = await this.get(entry.location, "application/octet-stream");
     const len = Number(res.headers.get("content-length") ?? 0);
     if (len > MAX_PACKAGE_BYTES) throw new Error("package is too large");
@@ -684,7 +764,8 @@ function createRegistries(specs = [DEFAULT_STORE], opts = {}) {
       case "github":
         return new GitHubRegistry({ ...s, token, fetchImpl: opts.fetchImpl });
       case "http":
-        return new HttpRegistry(s.url, opts.fetchImpl);
+      case "json":
+        return new HttpRegistry(s.url, opts.fetchImpl, s.headers, s.type === "json");
       case "local":
         return new LocalRegistry(path6.resolve(opts.baseDir ?? process.cwd(), s.path));
       default:
@@ -893,8 +974,11 @@ var MainFramework = class {
     h(MGMT.logs, ({ id }) => this.logs.query(id ? { source: id } : {}).slice(-200));
     h(MGMT.diagnostics, ({ id }) => this.manager.diagnostics(id));
     h(MGMT.details, ({ id }) => this.details(id));
-    h(MGMT.search, ({ query }) => this.installer.search(query));
-    h(MGMT.updates, () => this.installer.updates());
+    h(MGMT.search, async ({ query }) => {
+      const installed = new Map(this.manager.list().map((p) => [p.id, p.version]));
+      return (await this.installer.search(query)).map((e) => ({ ...e, installedVersion: installed.get(e.id) }));
+    });
+    h(MGMT.updates, async () => (await this.installer.updates()).map((e) => ({ ...e, installedVersion: this.manager.has(e.id) ? this.manager.info(e.id).version : void 0 })));
     h(MGMT.install, async ({ entry }) => this.installAndLoad(entry));
     h(MGMT.update, async ({ entry }) => this.installAndLoad(entry));
     h(MGMT.uninstall, async ({ id }) => {
@@ -943,8 +1027,12 @@ var MainFramework = class {
       iconUrl: m.icon ? url(id, m.icon) : void 0,
       bannerUrl: m.banner ? url(id, m.banner) : void 0,
       screenshotUrls: (m.screenshots ?? []).map((s) => url(id, s)),
-      video: m.video ? { url: m.video, embedUrl: videoEmbedUrl(m.video) } : void 0,
-      readme
+      video: (() => {
+        const v = parseVideo(m.video);
+        return v?.kind === "html5" && v.src?.startsWith("./") ? { ...v, src: url(id, v.src) } : v;
+      })(),
+      readme,
+      assetBase: url(id, "./")
     };
   }
   requireConfig(id) {
@@ -967,7 +1055,54 @@ var MainFramework = class {
 // src/main/adapters.ts
 import http from "node:http";
 import path8 from "node:path";
+import { promises as fs7 } from "node:fs";
+
+// src/main/assets.ts
 import { promises as fs6 } from "node:fs";
+var MIME = {
+  ".js": "text/javascript",
+  ".mjs": "text/javascript",
+  ".css": "text/css",
+  ".json": "application/json",
+  ".map": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".webp": "image/webp",
+  ".gif": "image/gif",
+  ".avif": "image/avif",
+  ".ico": "image/x-icon",
+  ".woff2": "font/woff2",
+  ".mp4": "video/mp4",
+  ".m4v": "video/mp4",
+  ".webm": "video/webm",
+  ".ogv": "video/ogg",
+  ".ogg": "video/ogg",
+  ".mov": "video/quicktime",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav"
+};
+async function readAsset(file, mime, range) {
+  const { size } = await fs6.stat(file);
+  const base = { "content-type": mime, "accept-ranges": "bytes", "access-control-allow-origin": "*", "cache-control": "no-store" };
+  const m = range ? /^bytes=(\d*)-(\d*)$/.exec(range.trim()) : null;
+  if (!m || m[1] === "" && m[2] === "") return { status: 200, headers: { ...base, "content-length": String(size) }, body: await fs6.readFile(file) };
+  let start = m[1] === "" ? Math.max(0, size - Number(m[2])) : Number(m[1]);
+  let end = m[1] === "" || m[2] === "" ? size - 1 : Math.min(Number(m[2]), size - 1);
+  if (start > end || start >= size) return { status: 416, headers: { ...base, "content-range": `bytes */${size}` }, body: Buffer.alloc(0) };
+  const fh = await fs6.open(file, "r");
+  try {
+    const len = end - start + 1;
+    const body = Buffer.alloc(len);
+    await fh.read(body, 0, len, start);
+    return { status: 206, headers: { ...base, "content-range": `bytes ${start}-${end}/${size}`, "content-length": String(len) }, body };
+  } finally {
+    await fh.close();
+  }
+}
+
+// src/main/adapters.ts
 function attachElectron(fw, electron) {
   const { ipcMain, webContents } = electron;
   ipcMain.handle(CHANNELS.invoke, (e, req) => fw.handleInvoke(req, e.sender.id));
@@ -992,22 +1127,6 @@ var PLUGIN_SCHEME = {
   scheme: "fluxplugin",
   privileges: { standard: true, secure: true, supportFetchAPI: true, corsEnabled: true, stream: true }
 };
-var MIME = {
-  ".js": "text/javascript",
-  ".mjs": "text/javascript",
-  ".css": "text/css",
-  ".json": "application/json",
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".webp": "image/webp",
-  ".gif": "image/gif",
-  ".avif": "image/avif",
-  ".ico": "image/x-icon",
-  ".woff2": "font/woff2",
-  ".map": "application/json"
-};
 async function resolvePluginAsset(fw, url) {
   let u;
   try {
@@ -1028,7 +1147,7 @@ async function resolvePluginAsset(fw, url) {
   const ext = path8.extname(file).toLowerCase();
   if (!(ext in MIME)) return null;
   try {
-    await fs6.access(file);
+    await fs7.access(file);
   } catch {
     return null;
   }
@@ -1038,7 +1157,8 @@ function registerPluginProtocol(fw, protocol) {
   protocol.handle(PLUGIN_SCHEME.scheme, async (req) => {
     const r = await resolvePluginAsset(fw, req.url);
     if (!r) return new Response("Not found", { status: 404 });
-    return new Response(await fs6.readFile(r.file), { headers: { "content-type": r.mime, "access-control-allow-origin": "*" } });
+    const a = await readAsset(r.file, r.mime, req.headers?.get("range"));
+    return new Response(new Uint8Array(a.body), { status: a.status, headers: a.headers });
   });
 }
 function attachHttp(fw, opts = {}) {
@@ -1091,8 +1211,9 @@ function attachHttp(fw, opts = {}) {
         const id = decodeURIComponent(rest.slice(0, slash));
         const r = await resolvePluginAsset(fw, `fluxplugin://${encodeURIComponent(id)}/${rest.slice(slash + 1)}`);
         if (!r) return json(res, 404, { error: "not found" });
-        res.writeHead(200, { "content-type": r.mime, "cache-control": "no-store" });
-        return res.end(await fs6.readFile(r.file));
+        const a = await readAsset(r.file, r.mime, req.headers.range);
+        res.writeHead(a.status, a.headers);
+        return res.end(a.body);
       }
       if (opts.fallback && await opts.fallback(req, res)) return;
       json(res, 404, { error: "not found" });
@@ -1142,8 +1263,8 @@ function createLoopbackBridge(fw) {
 
 // src/main/serve-web.ts
 import path9 from "node:path";
-import { promises as fs7 } from "node:fs";
-var TYPES = { ".html": "text/html", ".js": "text/javascript", ".mjs": "text/javascript", ".css": "text/css", ".map": "application/json", ".svg": "image/svg+xml", ".png": "image/png" };
+import { promises as fs8 } from "node:fs";
+var TYPES = { ".html": "text/html", ".js": "text/javascript", ".mjs": "text/javascript", ".css": "text/css", ".map": "application/json", ".svg": "image/svg+xml", ".png": "image/png", ".json": "application/json", ".jpg": "image/jpeg", ".webp": "image/webp" };
 function serveWeb(fw, opts) {
   const dist = path9.resolve(opts.distDir);
   return attachHttp(fw, {
@@ -1156,7 +1277,7 @@ function serveWeb(fw, opts) {
       if (!type || !file.startsWith(dist + path9.sep)) return false;
       try {
         res.writeHead(200, { "content-type": type, "cache-control": "no-store" });
-        res.end(await fs7.readFile(file));
+        res.end(await fs8.readFile(file));
         return true;
       } catch {
         return false;
@@ -1186,6 +1307,7 @@ export {
   copyPluginRuntime,
   copyDir,
   entriesFromIndex,
+  downloadFolder,
   pruneNonRuntime,
   LocalRegistry,
   HttpRegistry,
@@ -1195,6 +1317,8 @@ export {
   DEFAULT_STORE,
   createRegistries,
   MainFramework,
+  MIME,
+  readAsset,
   attachElectron,
   PLUGIN_SCHEME,
   resolvePluginAsset,