muon-ui 0.7.0 → 0.9.0

package/dist/vite.mjs

@@ -1,20 +1,21 @@
 /*!
 * name: muon-ui
-* version: 0.7.0
+* version: 0.9.0
 * description: A multi-platform GUI application framework that uses CEF as its backend
 * author: Kouji Matsui (@kekyo@mi.kekyo.net)
 * license: MIT
 * repository.url: https://github.com/kekyo/muon-ui.git
-* git.commit.hash: fe80718aaa617c0c0ea5c816bbe38d22bf2e8402
+* git.commit.hash: 3437b522a51d8772713b72722b109c5ff30fc711
 */
-import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
-import { constants, writeFileSync } from "node:fs";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
+import { constants, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { access, chmod, copyFile, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createHash, randomBytes } from "node:crypto";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import __screwUpDefaultImportModule0 from "adm-zip";
 import { spawn } from "node:child_process";
+import * as __screwUpDefaultImportModule0$1 from "sharp";
 //#region \0rolldown/runtime.js
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 //#endregion
@@ -1292,8 +1293,10 @@ var encodeTaggedBytes = (tag, bytes) => Buffer.concat([
 	encodeVarUint(BigInt(bytes.length)),
 	Buffer.from(bytes)
 ]);
-var isJsonObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isJsonObject$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPath = (path, first, second) => path.length === 2 && path[0] === first && path[1] === second;
+var isPluginSignaturePath = (path) => path.length === 3 && path[0] === "plugin" && path[1] === "plugins" && path[2] === "signature";
+var isPluginSaltPath = (path) => path.length === 3 && path[0] === "plugin" && path[1] === "plugins" && path[2] === "salt";
 var isHexString = (value) => value.length % 2 === 0 && /^[0-9a-fA-F]*$/.test(value);
 var decodeHexString = (value) => {
 	const bytes = Buffer.alloc(value.length / 2);
@@ -1303,6 +1306,8 @@ var decodeHexString = (value) => {
 var encodeKnownBinaryString = (path, value) => {
 	if (isPath(path, "asset", "signature")) return value.length === 40 && isHexString(value) ? decodeHexString(value) : void 0;
 	if (isPath(path, "asset", "salt")) return isHexString(value) ? decodeHexString(value) : void 0;
+	if (isPluginSignaturePath(path)) return value.length === 40 && isHexString(value) ? decodeHexString(value) : void 0;
+	if (isPluginSaltPath(path)) return isHexString(value) ? decodeHexString(value) : void 0;
 	if (isPath(path, "browser", "backgroundColor")) {
 		const hex = value.startsWith("#") ? value.slice(1) : value;
 		return hex.length === 6 && isHexString(hex) ? decodeHexString(hex) : void 0;
@@ -1325,7 +1330,7 @@ var encodeTlvValue = (value, path) => {
 		encodeVarUint(BigInt(value.length)),
 		...value.map((entry) => encodeTlvValue(entry, path))
 	]);
-	if (isJsonObject$2(value)) {
+	if (isJsonObject$5(value)) {
 		const entries = Object.entries(value);
 		return Buffer.concat([
 			Buffer.from([tlvObjectTag]),
@@ -1350,8 +1355,8 @@ var encodeMuonConfigTlv = (config) => encodeTlvValue(config, []);
 */
 var createMuonEmbeddedConfigSlot = (payload = void 0) => {
 	if (payload !== void 0 && payload.length > muonEmbeddedConfigPayloadCapacity) throw new Error(`Encoded muon config exceeds the embedded slot capacity: ${payload.length} > ${muonEmbeddedConfigPayloadCapacity}`);
-	const slot = createEmptySlot();
-	if (payload === void 0) return slot;
+	if (payload === void 0) return createEmptySlot();
+	const slot = randomBytes(muonEmbeddedConfigSlotSize);
 	Buffer.from(payload).copy(slot, 0);
 	return slot;
 };
@@ -1363,9 +1368,12 @@ var createMuonEmbeddedConfigSlot = (payload = void 0) => {
 */
 var createMuonBootstrapEmbeddedConfigSlot = (payload = void 0) => {
 	if (payload !== void 0 && payload.length > muonBootstrapEmbeddedConfigPayloadCapacity) throw new Error(`Encoded muon config exceeds the embedded bootstrap slot capacity: ${payload.length} > ${muonBootstrapEmbeddedConfigPayloadCapacity}`);
-	const slot = Buffer.alloc(muonBootstrapEmbeddedConfigSlotSize, 0);
-	muonBootstrapEmbeddedConfigEmptySlotMarker.copy(slot, 0);
-	if (payload === void 0) return slot;
+	if (payload === void 0) {
+		const slot = Buffer.alloc(muonBootstrapEmbeddedConfigSlotSize, 0);
+		muonBootstrapEmbeddedConfigEmptySlotMarker.copy(slot, 0);
+		return slot;
+	}
+	const slot = randomBytes(muonBootstrapEmbeddedConfigSlotSize);
 	Buffer.from(payload).copy(slot, 0);
 	return slot;
 };
@@ -1439,7 +1447,7 @@ var findMuonBootstrapEmbeddedConfigSlot = (content) => {
 	if (candidate === void 0) throw new Error("Embedded muon-bootstrap config slot was not found.");
 	return candidate;
 };
-var fileExists$2 = async (path) => {
+var fileExists$6 = async (path) => {
 	try {
 		return (await stat(path)).isFile();
 	} catch {
@@ -1455,10 +1463,10 @@ var resolveMuonConfigInputPath = async (configPath) => {
 			"muon.json"
 		]) {
 			const candidate = join(directory, fileName);
-			if (await fileExists$2(candidate)) return candidate;
+			if (await fileExists$6(candidate)) return candidate;
 		}
 	}
-	if (!await fileExists$2(configPath)) throw new Error(`muon config does not exist: ${configPath}`);
+	if (!await fileExists$6(configPath)) throw new Error(`muon config does not exist: ${configPath}`);
 	return configPath;
 };
 var readMuonConfigInput = async (configPath) => {
@@ -1571,7 +1579,7 @@ var targetDescriptors = {
 		cefTarget: "linux64",
 		os: "linux",
 		arch: "amd64",
-		distributionDirectoryName: "dist-muon-linux-amd64",
+		distributionDirectoryName: "dist-muon/linux-amd64",
 		runtimeExecutableName: "muon-core",
 		bootstrapExecutableName: "muon-bootstrap",
 		launcherExtension: "",
@@ -1586,7 +1594,7 @@ var targetDescriptors = {
 		cefTarget: "linuxarm",
 		os: "linux",
 		arch: "armhf",
-		distributionDirectoryName: "dist-muon-linux-armhf",
+		distributionDirectoryName: "dist-muon/linux-armhf",
 		runtimeExecutableName: "muon-core",
 		bootstrapExecutableName: "muon-bootstrap",
 		launcherExtension: "",
@@ -1601,7 +1609,7 @@ var targetDescriptors = {
 		cefTarget: "linuxarm64",
 		os: "linux",
 		arch: "arm64",
-		distributionDirectoryName: "dist-muon-linux-arm64",
+		distributionDirectoryName: "dist-muon/linux-arm64",
 		runtimeExecutableName: "muon-core",
 		bootstrapExecutableName: "muon-bootstrap",
 		launcherExtension: "",
@@ -1616,7 +1624,7 @@ var targetDescriptors = {
 		cefTarget: "windows32",
 		os: "windows",
 		arch: "i686",
-		distributionDirectoryName: "dist-muon-windows-i686",
+		distributionDirectoryName: "dist-muon/windows-i686",
 		runtimeExecutableName: "muon-core.exe",
 		bootstrapExecutableName: "muon-bootstrap.exe",
 		launcherExtension: ".exe",
@@ -1636,7 +1644,7 @@ var targetDescriptors = {
 		cefTarget: "windows64",
 		os: "windows",
 		arch: "amd64",
-		distributionDirectoryName: "dist-muon-windows-amd64",
+		distributionDirectoryName: "dist-muon/windows-amd64",
 		runtimeExecutableName: "muon-core.exe",
 		bootstrapExecutableName: "muon-bootstrap.exe",
 		launcherExtension: ".exe",
@@ -1661,6 +1669,20 @@ Object.fromEntries(allMuonTargets.map((target) => [targetDescriptors[target].cef
 */
 var getMuonTargetDescriptor = (target) => targetDescriptors[target];
 /**
+* Returns the runtime app identifier embedded for one target distribution.
+*
+* @param appId Base sanitized application identifier.
+* @param target Public Muon target.
+* @returns Target runtime application identifier.
+*
+* @remarks Windows targets append their public architecture name so 32-bit and
+* 64-bit packages do not share runtime state or installer identities.
+*/
+var getMuonTargetRuntimeAppId = (appId, target) => {
+	const descriptor = getMuonTargetDescriptor(target);
+	return descriptor.os === "windows" ? `${appId}.${descriptor.arch}` : appId;
+};
+/**
 * Normalizes a user supplied public Muon target.
 *
 * @param target Target value supplied by the user.
@@ -1707,8 +1729,8 @@ var getDefaultMuonPrepareTarget = (platform, architecture) => {
 		throw new Error(`Unsupported Muon prepare target: platform=${platform}, arch=${architecture}`);
 	}
 };
-var getPrepareExecutableName = (platform) => platform === "win32" ? "muon-prepare.exe" : "muon-prepare";
-var moduleDirectory$2 = typeof __dirname === "string" ? __dirname : dirname(fileURLToPath(import.meta.url));
+var getBuilderExecutableName = (platform) => platform === "win32" ? "muon-builder.exe" : "muon-builder";
+var moduleDirectory$4 = typeof __dirname === "string" ? __dirname : dirname(fileURLToPath(import.meta.url));
 var canExecute = async (path) => {
 	try {
 		await access(path, constants.X_OK);
@@ -1717,12 +1739,12 @@ var canExecute = async (path) => {
 		return false;
 	}
 };
-var resolveMuonPrepareExecutable = async (options) => {
-	const explicit = options.prepareExecutablePath ?? options.environment.MUON_PREPARE_PATH;
+var resolveMuonBuilderExecutable = async (options) => {
+	const explicit = options.prepareExecutablePath ?? options.environment.MUON_BUILDER_PATH;
 	if (explicit !== void 0 && explicit !== "") return explicit;
-	const executableName = getPrepareExecutableName(process.platform);
+	const executableName = getBuilderExecutableName(process.platform);
 	const target = getDefaultMuonPrepareTarget(process.platform, process.arch);
-	const candidates = [join(moduleDirectory$2, "native", target, executableName), join(moduleDirectory$2, "..", "dist", "native", target, executableName)];
+	const candidates = [join(moduleDirectory$4, "native", target, executableName), join(moduleDirectory$4, "..", "dist", "native", target, executableName)];
 	for (const candidate of candidates) if (await canExecute(candidate)) return candidate;
 	return candidates[0] ?? executableName;
 };
@@ -1741,14 +1763,100 @@ var createMuonPrepareArguments = (options) => {
 	if (options.quiet) args.push("--quiet");
 	return args;
 };
-/**
-* Invokes the native muon-prepare executable and returns the prepared runtime.
-*
-* @param options Native prepare invocation options.
-* @returns Prepared runtime location.
-*/
-var runMuonPrepare = async (options) => {
-	const child = spawn(await resolveMuonPrepareExecutable(options), createMuonPrepareArguments(options), {
+var spinnerFrames = [
+	"-",
+	"\\",
+	"|",
+	"/"
+];
+var spinnerIntervalMilliseconds = 100;
+var terminalLineStart = "\r";
+var terminalClearLine = "\x1B[K";
+var isMuonPrepareStatusLine = (line) => {
+	const trimmed = line.trimEnd();
+	return trimmed.endsWith("...") || trimmed === "Failed to prepare CEF." || trimmed.startsWith("Downloading CEF binary:");
+};
+var shouldKeepMuonPrepareStatusAfterLine = (line) => line.startsWith("Muon files copied to staging:");
+var createPlainStderrForwarder = () => ({
+	write: (chunk) => {
+		process.stderr.write(chunk);
+	},
+	flush: () => {}
+});
+var createSpinnerStderrForwarder = () => {
+	let pending = "";
+	let activeStatus = void 0;
+	let frameIndex = 0;
+	let timer = void 0;
+	const writeRaw = (chunk) => {
+		process.stderr.write(chunk);
+	};
+	const stopTimer = () => {
+		if (timer !== void 0) {
+			clearInterval(timer);
+			timer = void 0;
+		}
+	};
+	const renderStatus = () => {
+		if (activeStatus === void 0) return;
+		writeRaw(`${terminalLineStart}${spinnerFrames[frameIndex] ?? spinnerFrames[0]} ${activeStatus}${terminalClearLine}`);
+		frameIndex = (frameIndex + 1) % spinnerFrames.length;
+	};
+	const ensureTimer = () => {
+		if (timer === void 0) timer = setInterval(renderStatus, spinnerIntervalMilliseconds);
+	};
+	const finishStatus = () => {
+		if (activeStatus === void 0) return;
+		const status = activeStatus;
+		activeStatus = void 0;
+		stopTimer();
+		frameIndex = 0;
+		writeRaw(`${terminalLineStart}${status}${terminalClearLine}\n`);
+	};
+	const startStatus = (status) => {
+		if (activeStatus !== void 0 && activeStatus !== status) finishStatus();
+		activeStatus = status;
+		renderStatus();
+		ensureTimer();
+	};
+	const writeLine = (line) => {
+		const text = line.replace(/\r?\n$/, "");
+		if (isMuonPrepareStatusLine(text)) {
+			startStatus(text.trimEnd());
+			return;
+		}
+		if (activeStatus !== void 0 && shouldKeepMuonPrepareStatusAfterLine(text)) {
+			writeRaw(`${terminalLineStart}${terminalClearLine}${line.endsWith("\n") ? line : `${line}\n`}`);
+			renderStatus();
+			return;
+		}
+		finishStatus();
+		writeRaw(line);
+	};
+	return {
+		write: (chunk) => {
+			pending += chunk;
+			for (;;) {
+				const newlineIndex = pending.indexOf("\n");
+				if (newlineIndex < 0) break;
+				const line = pending.slice(0, newlineIndex + 1);
+				pending = pending.slice(newlineIndex + 1);
+				writeLine(line);
+			}
+		},
+		flush: () => {
+			if (pending.length > 0) {
+				const line = pending;
+				pending = "";
+				writeLine(line);
+			}
+			finishStatus();
+		}
+	};
+};
+var createMuonPrepareStderrForwarder = () => process.stderr.isTTY === true ? createSpinnerStderrForwarder() : createPlainStderrForwarder();
+var runMuonPrepareCommand = async (options) => {
+	const child = spawn(await resolveMuonBuilderExecutable(options), [...options.args], {
 		cwd: options.cwd,
 		env: options.environment,
 		stdio: [
@@ -1761,22 +1869,46 @@ var runMuonPrepare = async (options) => {
 	let stderr = "";
 	child.stdout.setEncoding("utf8");
 	child.stderr.setEncoding("utf8");
+	const stderrForwarder = options.quiet ? void 0 : createMuonPrepareStderrForwarder();
 	child.stdout.on("data", (chunk) => {
 		stdout += chunk;
 	});
 	child.stderr.on("data", (chunk) => {
 		stderr += chunk;
-		if (!options.quiet) process.stderr.write(chunk);
+		stderrForwarder?.write(chunk);
 	});
-	const exitCode = await new Promise((resolvePromise, reject) => {
-		child.on("error", reject);
-		child.on("close", (code) => {
-			resolvePromise(code ?? 1);
-		});
+	const exitCode = await (async () => {
+		try {
+			return await new Promise((resolvePromise, reject) => {
+				child.on("error", reject);
+				child.on("close", (code) => {
+					resolvePromise(code ?? 1);
+				});
+			});
+		} finally {
+			stderrForwarder?.flush();
+		}
+	})();
+	if (exitCode !== 0) throw new Error(`muon-builder failed with exit code ${exitCode}.\n${stderr.trim()}`);
+	return stdout;
+};
+/**
+* Invokes the native muon-builder executable and returns the prepared runtime.
+*
+* @param options Native prepare invocation options.
+* @returns Prepared runtime location.
+*/
+var runMuonPrepare = async (options) => {
+	const args = createMuonPrepareArguments(options);
+	const stdout = await runMuonPrepareCommand({
+		prepareExecutablePath: options.prepareExecutablePath,
+		environment: options.environment,
+		cwd: options.cwd,
+		quiet: options.quiet,
+		args
 	});
-	if (exitCode !== 0) throw new Error(`muon-prepare failed with exit code ${exitCode}.\n${stderr.trim()}`);
 	const result = JSON.parse(stdout);
-	if (result.stagePath !== void 0 && typeof result.stagePath !== "string" || typeof result.muonPath !== "string" || typeof result.cefPath !== "string" || typeof result.cacheHit !== "boolean") throw new Error(`muon-prepare returned invalid JSON: ${stdout}`);
+	if (result.stagePath !== void 0 && typeof result.stagePath !== "string" || typeof result.muonPath !== "string" || typeof result.cefPath !== "string" || typeof result.cacheHit !== "boolean") throw new Error(`muon-builder returned invalid JSON: ${stdout}`);
 	return {
 		...result.stagePath === void 0 ? {} : { stagePath: result.stagePath },
 		muonPath: result.muonPath,
@@ -1784,6 +1916,776 @@ var runMuonPrepare = async (options) => {
 		cacheHit: result.cacheHit
 	};
 };
+/**
+* Invokes the native muon-builder executable to write Windows PE resources.
+*
+* @param options Resource update invocation options.
+*/
+var runMuonPrepareResourceUpdate = async (options) => {
+	await runMuonPrepareCommand({
+		prepareExecutablePath: options.prepareExecutablePath,
+		environment: options.environment,
+		cwd: options.cwd,
+		quiet: options.quiet,
+		args: [
+			"resource",
+			"--input",
+			options.inputPath,
+			"--updates-json",
+			options.updatesJsonPath,
+			"--output",
+			options.outputPath,
+			...options.quiet ? ["--quiet"] : []
+		]
+	});
+};
+//#endregion
+//#region src/windows-icon.ts
+var sharp = __resolveDefaultExport$1(__screwUpDefaultImportModule0$1, true);
+globalThis.__screwUpIsInCJS_27e672935538 = false;
+function __resolveDefaultExport$1(module, isESM) {
+	const __isInCJS = typeof globalThis !== "undefined" && globalThis.__screwUpIsInCJS_27e672935538 === true;
+	const maybe = module;
+	const hasDefault = !!(maybe && typeof maybe === "object" && "default" in maybe);
+	const unwrapNamespaceDefault = (value) => {
+		if (!value || typeof value !== "object") return value;
+		const inner = value;
+		if ((inner.__esModule === true || typeof Symbol !== "undefined" && inner[Symbol.toStringTag] === "Module") && "default" in inner) return inner.default;
+		return value;
+	};
+	const resolvedDefault = hasDefault ? unwrapNamespaceDefault(maybe.default) : void 0;
+	if (__isInCJS) return hasDefault ? resolvedDefault ?? module : module;
+	if (isESM) {
+		if (hasDefault) return resolvedDefault;
+		throw new Error("Default export not found.");
+	}
+	return hasDefault ? resolvedDefault ?? module : module;
+}
+var normalizedIconSize = 256;
+var windowsIconDibSizes = [
+	16,
+	24,
+	32,
+	48,
+	64,
+	128
+];
+var pngSignature = Buffer.from([
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10
+]);
+/**
+* Creates a normalized square PNG icon image.
+*
+* @param pngData Source PNG bytes.
+* @param source Diagnostic source label used in errors.
+* @param label User-facing diagnostic label.
+* @returns PNG bytes normalized to the Muon base icon size.
+* @remarks Non-square images are fitted into transparent padding without
+* stretching. The normalized PNG is the source for all platform-specific icon
+* derivatives.
+*/
+var createNormalizedIconPngData = async (pngData, source, label) => {
+	await assertPngData(pngData, source, label);
+	try {
+		return await sharp(pngData).resize(normalizedIconSize, normalizedIconSize, {
+			fit: "contain",
+			background: {
+				r: 0,
+				g: 0,
+				b: 0,
+				alpha: 0
+			}
+		}).ensureAlpha().png().toBuffer();
+	} catch {
+		throw new Error(`${label} must be a valid PNG: ${source}`);
+	}
+};
+/**
+* Creates a normalized square PNG icon image for Windows resources.
+*
+* @param pngData Source PNG bytes.
+* @param source Diagnostic source label used in errors.
+* @returns PNG bytes normalized to the Muon base icon size.
+*/
+var createNormalizedMuonIconPngData = async (pngData, source) => await createNormalizedIconPngData(pngData, source, "Windows resource icon");
+/**
+* Creates a Windows ICO file from PNG bytes.
+*
+* @param pngData Source PNG bytes.
+* @param source Diagnostic source label used in errors.
+* @returns ICO file bytes containing 16, 24, 32, 48, 64, 128, and 256 pixel images.
+* @remarks The 256px entry is PNG-compressed. Smaller entries are 32-bit DIB
+* images, matching the common Windows ICO layout recommended by Microsoft.
+*/
+var createWindowsIconBufferFromPngData = async (pngData, source) => {
+	const normalizedPng = await createNormalizedMuonIconPngData(pngData, source);
+	const images = [];
+	for (const size of windowsIconDibSizes) {
+		const rawImage = await resizePngToRawRgba(normalizedPng, size, source);
+		images.push({
+			data: createDibIconImage(rawImage),
+			size,
+			bitCount: 32
+		});
+	}
+	images.push({
+		data: normalizedPng,
+		size: normalizedIconSize,
+		bitCount: 32
+	});
+	return createIco(images);
+};
+/**
+* Creates a Windows ICO file from a PNG file.
+*
+* @param sourcePath Source PNG file path.
+* @param outputPath Output ICO file path.
+* @returns Promise resolved when the ICO file has been written.
+*/
+var createWindowsIconFromPngFile = async (sourcePath, outputPath) => {
+	const icon = await createWindowsIconBufferFromPngData(await readFile(sourcePath), sourcePath);
+	await mkdir(dirname(outputPath), { recursive: true });
+	await writeFile(outputPath, icon);
+};
+var assertPngData = async (data, source, label) => {
+	if (data.length === 0) throw new Error(`${label} PNG must not be empty: ${source}`);
+	if (!data.subarray(0, pngSignature.length).equals(pngSignature)) throw new Error(`${label} must be a valid PNG: ${source}`);
+	try {
+		if ((await sharp(data).metadata()).format !== "png") throw new Error();
+	} catch {
+		throw new Error(`${label} must be a valid PNG: ${source}`);
+	}
+};
+var resizePngToRawRgba = async (pngData, size, source) => {
+	try {
+		const { data, info } = await sharp(pngData).resize(size, size, {
+			fit: "fill",
+			kernel: "lanczos3"
+		}).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+		if (info.width !== size || info.height !== size || info.channels !== 4) throw new Error();
+		return {
+			data,
+			width: info.width,
+			height: info.height
+		};
+	} catch {
+		throw new Error(`Failed to resize Windows resource icon PNG: ${source}`);
+	}
+};
+var createDibIconImage = (image) => {
+	const pixelBytes = image.width * image.height * 4;
+	const maskBytes = Math.ceil(image.width / 32) * 4 * image.height;
+	const output = Buffer.alloc(40 + pixelBytes + maskBytes);
+	output.writeUInt32LE(40, 0);
+	output.writeInt32LE(image.width, 4);
+	output.writeInt32LE(image.height * 2, 8);
+	output.writeUInt16LE(1, 12);
+	output.writeUInt16LE(32, 14);
+	output.writeUInt32LE(0, 16);
+	output.writeUInt32LE(pixelBytes + maskBytes, 20);
+	output.writeInt32LE(0, 24);
+	output.writeInt32LE(0, 28);
+	output.writeUInt32LE(0, 32);
+	output.writeUInt32LE(0, 36);
+	for (let y = 0; y < image.height; y += 1) {
+		const sourceY = image.height - 1 - y;
+		for (let x = 0; x < image.width; x += 1) {
+			const sourceOffset = (sourceY * image.width + x) * 4;
+			const outputOffset = 40 + (y * image.width + x) * 4;
+			output[outputOffset] = image.data[sourceOffset + 2];
+			output[outputOffset + 1] = image.data[sourceOffset + 1];
+			output[outputOffset + 2] = image.data[sourceOffset];
+			output[outputOffset + 3] = image.data[sourceOffset + 3];
+		}
+	}
+	return output;
+};
+var createIco = (images) => {
+	const directorySize = 6 + images.length * 16;
+	let imageOffset = directorySize;
+	const header = Buffer.alloc(directorySize);
+	header.writeUInt16LE(0, 0);
+	header.writeUInt16LE(1, 2);
+	header.writeUInt16LE(images.length, 4);
+	const imageData = [];
+	images.forEach((image, index) => {
+		const entryOffset = 6 + index * 16;
+		header[entryOffset] = image.size === 256 ? 0 : image.size;
+		header[entryOffset + 1] = image.size === 256 ? 0 : image.size;
+		header[entryOffset + 2] = 0;
+		header[entryOffset + 3] = 0;
+		header.writeUInt16LE(1, entryOffset + 4);
+		header.writeUInt16LE(image.bitCount, entryOffset + 6);
+		header.writeUInt32LE(image.data.length, entryOffset + 8);
+		header.writeUInt32LE(imageOffset, entryOffset + 12);
+		imageOffset += image.data.length;
+		imageData.push(image.data);
+	});
+	return Buffer.concat([header, ...imageData]);
+};
+//#endregion
+//#region src/app-icon.ts
+/**
+* ZIP entry used for the generated static application icon asset.
+*/
+var appIconAssetEntryName = "main/.muon/app-icon.png";
+/**
+* Runtime asset URL injected as the generated initial title bar icon.
+*/
+var appIconAssetUrl = "asset://main/.muon/app-icon.png";
+/**
+* Creates a static application icon source from API or CLI options.
+*/
+var createAppIconOptionsSource = (iconPath, directory, label = "iconPath") => {
+	if (iconPath === void 0) return;
+	if (typeof iconPath !== "string") throw new Error(`${label} must be a string when present.`);
+	if (iconPath.trim() === "") return;
+	return {
+		iconPath: iconPath.trim(),
+		directory
+	};
+};
+/**
+* Reads the top-level `iconPath` from a Muon config object.
+*/
+var readConfigAppIconSource = (config, directory, label) => {
+	const value = config.iconPath;
+	if (value === void 0) return;
+	if (typeof value !== "string") throw new Error(`${label} iconPath must be a string when present.`);
+	return createAppIconOptionsSource(value, directory);
+};
+/**
+* Reads the top-level `iconPath` from project metadata.
+*/
+var readProjectAppIconSource = (projectJson, directory) => {
+	const value = projectJson.iconPath;
+	return typeof value === "string" ? createAppIconOptionsSource(value, directory) : void 0;
+};
+/**
+* Resolves and validates the first available static application icon source.
+*/
+var resolveMuonAppIconPath = async (sources) => {
+	for (const source of sources) {
+		const iconPath = resolveResourcePath$2(source.directory, source.iconPath);
+		await assertMuonAppIconPath(iconPath);
+		return iconPath;
+	}
+};
+var assertMuonAppIconPath = async (iconPath) => {
+	if (extname(iconPath).toLowerCase() !== ".png") throw new Error(`Muon app icon must be a .png file: ${iconPath}`);
+	if (!await fileExists$5(iconPath)) throw new Error(`Muon app icon does not exist: ${iconPath}`);
+	await createNormalizedIconPngData(await readFile(iconPath), iconPath, "Muon app icon");
+};
+var resolveResourcePath$2 = (directory, value) => isAbsolute(value) ? value : resolve(directory, value);
+var fileExists$5 = async (path) => {
+	try {
+		await access(path, constants.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+};
+//#endregion
+//#region src/windows-resource.ts
+var defaultLanguage = 1033;
+var defaultCodePage = 1200;
+var moduleDirectory$3 = typeof __dirname === "string" ? __dirname : dirname(fileURLToPath(import.meta.url));
+/**
+* Merges Windows resource options while preserving field-level fallback.
+*/
+var mergeMuonWindowsResourceOptions = (primary, fallback) => {
+	if (primary === void 0) return fallback;
+	if (fallback === void 0) return primary;
+	const merged = { ...fallback };
+	if (primary.iconPath !== void 0) merged.iconPath = primary.iconPath;
+	if (primary.productName !== void 0) merged.productName = primary.productName;
+	if (primary.fileDescription !== void 0) merged.fileDescription = primary.fileDescription;
+	if (primary.companyName !== void 0) merged.companyName = primary.companyName;
+	if (primary.version !== void 0) merged.version = primary.version;
+	if (primary.copyright !== void 0) merged.copyright = primary.copyright;
+	if (primary.language !== void 0) merged.language = primary.language;
+	if (primary.codePage !== void 0) merged.codePage = primary.codePage;
+	return merged;
+};
+/**
+* Resolves Windows resource metadata from options, config files, and package metadata.
+*/
+var resolveMuonWindowsResource = async (input) => {
+	const projectJson = await readProjectJson$1(input.root);
+	const windowsSources = [
+		createOptionsSource$1(input.options, input.root, "windowsResource"),
+		readConfigWindowsResourceSource(input.muonConfig, input.muonConfigDirectory, "muon.json"),
+		readConfigWindowsResourceSource(projectJson, input.root, "project.json")
+	].filter((source) => source !== void 0);
+	const sources = [
+		...windowsSources,
+		createProjectSource(projectJson, input.root),
+		createPackageSource(input.packageJson, input.root)
+	].filter((source) => source !== void 0);
+	const appIconSources = [
+		createAppIconOptionsSource(input.appIconPath, input.root),
+		readConfigAppIconSource(input.muonConfig, input.muonConfigDirectory, "muon.json"),
+		readProjectAppIconSource(projectJson, input.root)
+	].filter((source) => source !== void 0);
+	const productName = resolveStringField$1(sources, "productName", input.defaults.productName);
+	const fileDescription = resolveStringField$1(sources, "fileDescription", input.defaults.fileDescription);
+	const companyName = resolveStringField$1(sources, "companyName", input.defaults.companyName);
+	const version = resolveStringField$1(sources, "version", input.defaults.version);
+	const copyright = resolveOptionalStringField(sources, "copyright", input.defaults.copyright);
+	const language = resolveNumericField(sources, "language", defaultLanguage);
+	const codePage = resolveNumericField(sources, "codePage", defaultCodePage);
+	const fixedVersion = normalizeWindowsVersion(version);
+	return {
+		iconPath: await resolveWindowsIconPath(windowsSources, appIconSources, await resolveDefaultWindowsIcon(input.packageDirectory)),
+		productName,
+		fileDescription,
+		companyName,
+		version,
+		fixedVersion,
+		copyright,
+		language,
+		codePage
+	};
+};
+/**
+* Removes build-only Windows resource settings from runtime config.
+*/
+var stripBuildOnlyWindowsResourceConfig = (sourceConfig) => {
+	const sourceWindows = sourceConfig.windows;
+	if (!isJsonObject$4(sourceWindows)) return sourceConfig;
+	const windowsConfig = {};
+	for (const [key, value] of Object.entries(sourceWindows)) if (key !== "resource") windowsConfig[key] = value;
+	const output = {};
+	for (const [key, value] of Object.entries(sourceConfig)) if (key !== "windows") output[key] = value;
+	if (Object.keys(windowsConfig).length > 0) output.windows = windowsConfig;
+	return output;
+};
+/**
+* Returns true when the file has a Windows PE header.
+*/
+var isWindowsPeExecutable = async (path) => {
+	const content = await readFile(path);
+	if (content.length < 64 || content.toString("ascii", 0, 2) !== "MZ") return false;
+	const peOffset = content.readUInt32LE(60);
+	return peOffset + 4 <= content.length && content.toString("ascii", peOffset, peOffset + 4) === "PE\0\0";
+};
+/**
+* Applies resolved resource metadata to a Windows PE executable in place.
+*/
+var updateWindowsPeResources = async (input) => {
+	return await updateWindowsPeResourceFile(input, createEngraverUpdate);
+};
+/**
+* Applies only resolved icon metadata to a Windows PE executable in place.
+*/
+var updateWindowsPeIconResource = async (input) => {
+	return await updateWindowsPeResourceFile(input, createEngraverIconUpdate);
+};
+var updateWindowsPeResourceFile = async (input, createUpdate) => {
+	if (!await isWindowsPeExecutable(input.executablePath)) return false;
+	const mode = (await stat(input.executablePath)).mode & 511;
+	const tempDirectory = await mkdtemp(join(tmpdir(), "muon-windows-resource-"));
+	const updatesJsonPath = join(tempDirectory, "updates.json");
+	const outputPath = join(tempDirectory, "output.exe");
+	const iconPath = join(tempDirectory, "icon.ico");
+	try {
+		await createWindowsIconFromPngFile(input.resource.iconPath, iconPath);
+		await writeFile(updatesJsonPath, `${JSON.stringify(createUpdate(input.resource, iconPath), null, 2)}\n`);
+		await runMuonPrepareResourceUpdate({
+			inputPath: input.executablePath,
+			updatesJsonPath,
+			outputPath,
+			quiet: true,
+			prepareExecutablePath: void 0,
+			environment: input.environment,
+			cwd: input.cwd
+		});
+		await copyFile(outputPath, input.executablePath);
+		await chmod(input.executablePath, mode === 0 ? 493 : mode);
+		return true;
+	} finally {
+		await rm(tempDirectory, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+var createEngraverUpdate = (resource, iconPath) => {
+	const strings = {
+		CompanyName: resource.companyName,
+		FileDescription: resource.fileDescription,
+		FileVersion: resource.version,
+		ProductName: resource.productName,
+		ProductVersion: resource.version
+	};
+	if (resource.copyright !== void 0) strings.LegalCopyright = resource.copyright;
+	return {
+		version: {
+			language: resource.language,
+			codePage: resource.codePage,
+			fixed: {
+				fileVersion: resource.fixedVersion,
+				productVersion: resource.fixedVersion,
+				fileOS: "windows32",
+				fileType: "app"
+			},
+			strings
+		},
+		icons: createEngraverIcons(resource, iconPath)
+	};
+};
+var createEngraverIconUpdate = (resource, iconPath) => ({ icons: createEngraverIcons(resource, iconPath) });
+var createEngraverIcons = (resource, iconPath) => [{
+	id: 1,
+	language: resource.language,
+	path: iconPath
+}];
+var readProjectJson$1 = async (root) => {
+	const projectJsonPath = join(root, "project.json");
+	if (!await fileExists$4(projectJsonPath)) return {};
+	return await readJsonObjectFile$3(projectJsonPath, "project.json");
+};
+var readJsonObjectFile$3 = async (filePath, label) => {
+	const parsed = (0, import_dist.parse)(await readFile(filePath, "utf8"));
+	if (!isJsonObject$4(parsed)) throw new Error(`${label} must contain a JSON object: ${filePath}`);
+	return parsed;
+};
+var createOptionsSource$1 = (options, directory, label) => {
+	if (options === void 0) return;
+	return {
+		options: validateWindowsResourceOptions(options, label),
+		directory
+	};
+};
+var readConfigWindowsResourceSource = (config, directory, label) => {
+	const windows = config.windows;
+	if (windows === void 0) return;
+	if (!isJsonObject$4(windows)) throw new Error(`${label} windows must be an object when present.`);
+	const resource = windows.resource;
+	if (resource === void 0) return;
+	return createOptionsSource$1(validateWindowsResourceOptions(resource, `${label} windows.resource`), directory, `${label} windows.resource`);
+};
+var createProjectSource = (projectJson, directory) => {
+	const topLevel = {};
+	copyStringField(projectJson, "productName", topLevel, "productName");
+	copyStringField(projectJson, "name", topLevel, "productName");
+	copyStringField(projectJson, "fileDescription", topLevel, "fileDescription");
+	copyStringField(projectJson, "description", topLevel, "fileDescription");
+	copyStringField(projectJson, "companyName", topLevel, "companyName");
+	copyStringField(projectJson, "version", topLevel, "version");
+	copyStringField(projectJson, "copyright", topLevel, "copyright");
+	const author = stringifyAuthor(projectJson.author);
+	if (author !== void 0 && topLevel.companyName === void 0) topLevel.companyName = author;
+	const options = mergeMuonWindowsResourceOptions(readConfigWindowsResourceSource(projectJson, directory, "project.json")?.options, topLevel);
+	if (options === void 0 || Object.keys(options).length === 0) return;
+	return {
+		options,
+		directory
+	};
+};
+var createPackageSource = (packageJson, directory) => {
+	const options = {};
+	copyStringField(packageJson, "name", options, "productName");
+	copyStringField(packageJson, "description", options, "fileDescription");
+	copyStringField(packageJson, "version", options, "version");
+	copyStringField(packageJson, "copyright", options, "copyright");
+	const author = stringifyAuthor(packageJson.author);
+	if (author !== void 0) options.companyName = author;
+	return Object.keys(options).length === 0 ? void 0 : {
+		options,
+		directory
+	};
+};
+var copyStringField = (source, sourceKey, target, targetKey) => {
+	const value = source[sourceKey];
+	if (typeof value === "string" && value.trim() !== "") target[targetKey] = value.trim();
+};
+var validateWindowsResourceOptions = (value, label) => {
+	if (!isJsonObject$4(value)) throw new Error(`${label} must be an object.`);
+	const output = {};
+	copyOptionalStringResourceField(value, "iconPath", output);
+	copyOptionalStringResourceField(value, "productName", output);
+	copyOptionalStringResourceField(value, "fileDescription", output);
+	copyOptionalStringResourceField(value, "companyName", output);
+	copyOptionalStringResourceField(value, "version", output);
+	copyOptionalStringResourceField(value, "copyright", output);
+	copyOptionalNumberResourceField(value, "language", output, label);
+	copyOptionalNumberResourceField(value, "codePage", output, label);
+	return output;
+};
+var copyOptionalStringResourceField = (source, key, target) => {
+	const value = source[key];
+	if (value === void 0) return;
+	if (typeof value !== "string") throw new Error(`${key} must be a string when present.`);
+	if (value.trim() !== "") target[key] = value.trim();
+};
+var copyOptionalNumberResourceField = (source, key, target, label) => {
+	const value = source[key];
+	if (value === void 0) return;
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 65535) throw new Error(`${label} ${key} must be an integer from 0 to 65535.`);
+	target[key] = value;
+};
+var resolveStringField$1 = (sources, field, fallback) => {
+	return resolveOptionalStringField(sources, field, fallback) ?? fallback;
+};
+var resolveOptionalStringField = (sources, field, fallback) => {
+	for (const source of sources) {
+		const value = source.options[field];
+		if (value !== void 0 && value.trim() !== "") return value.trim();
+	}
+	return fallback;
+};
+var resolveNumericField = (sources, field, fallback) => {
+	for (const source of sources) {
+		const value = source.options[field];
+		if (value !== void 0) return value;
+	}
+	return fallback;
+};
+var resolveWindowsIconPath = async (windowsSources, appIconSources, defaultIconPath) => {
+	for (const source of windowsSources) {
+		const value = source.options.iconPath;
+		if (value !== void 0 && value.trim() !== "") {
+			const iconPath = resolveResourcePath$1(source.directory, value);
+			await assertIconPath$1(iconPath);
+			return iconPath;
+		}
+	}
+	const appIconPath = await resolveMuonAppIconPath(appIconSources);
+	if (appIconPath !== void 0) return appIconPath;
+	await assertIconPath$1(defaultIconPath);
+	return defaultIconPath;
+};
+var assertIconPath$1 = async (iconPath) => {
+	if (extname(iconPath).toLowerCase() !== ".png") throw new Error(`Windows resource icon must be a .png file: ${iconPath}`);
+	if (!await fileExists$4(iconPath)) throw new Error(`Windows resource icon does not exist: ${iconPath}`);
+	await createNormalizedMuonIconPngData(await readFile(iconPath), iconPath);
+};
+var resolveDefaultWindowsIcon = async (packageDirectory) => {
+	const sourceIconPath = join(moduleDirectory$3, "..", "..", "images", "muon-256.png");
+	const candidates = [
+		join(resolve(packageDirectory), "native", "muon-256.png"),
+		join(moduleDirectory$3, "native", "muon-256.png"),
+		join(moduleDirectory$3, "..", "dist", "native", "muon-256.png"),
+		sourceIconPath
+	];
+	for (const candidate of candidates) if (await fileExists$4(candidate)) return candidate;
+	return sourceIconPath;
+};
+var resolveResourcePath$1 = (directory, path) => {
+	return isAbsolute(path) ? path : resolve(directory, path);
+};
+var normalizeWindowsVersion = (version) => {
+	const normalized = version.trim();
+	const match = /^(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:\.(\d+))?(?:$|[-+])/.exec(normalized);
+	if (match === null) throw new Error(`Windows resource version must start with numeric parts: ${version}`);
+	const values = [
+		match[1],
+		match[2],
+		match[3],
+		match[4]
+	].map((value) => value === void 0 ? 0 : Number.parseInt(value, 10));
+	for (const value of values) if (!Number.isInteger(value) || value < 0 || value > 65535) throw new Error(`Windows resource version part must be from 0 to 65535: ${version}`);
+	return values.join(".");
+};
+var stringifyAuthor = (value) => {
+	if (typeof value === "string" && value.trim() !== "") return value.trim();
+	if (!isJsonObject$4(value) || typeof value.name !== "string") return;
+	const name = value.name.trim();
+	if (name === "") return;
+	return value.email === void 0 || typeof value.email !== "string" ? name : `${name} <${value.email}>`;
+};
+var fileExists$4 = async (path) => {
+	try {
+		await access(path, constants.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+};
+var isJsonObject$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+//#endregion
+//#region src/linux-desktop.ts
+var defaultIconFileName = "muon-desktop-icon.png";
+var defaultDesktopConfigFileName = "muon-desktop.json";
+var moduleDirectory$2 = typeof __dirname === "string" ? __dirname : dirname(fileURLToPath(import.meta.url));
+/**
+* Resolves Linux desktop integration metadata from options, config files, and
+* package metadata.
+*/
+var resolveMuonLinuxDesktop = async (input) => {
+	const projectJson = await readProjectJson(input.root);
+	const sources = [createOptionsSource(input.options, input.root, "linuxDesktop"), readConfigLinuxDesktopSource(input.muonConfig, input.muonConfigDirectory, "muon.json")].filter((source) => source !== void 0);
+	const appIconSources = [
+		createAppIconOptionsSource(input.appIconPath, input.root),
+		readConfigAppIconSource(input.muonConfig, input.muonConfigDirectory, "muon.json"),
+		readProjectAppIconSource(projectJson, input.root)
+	].filter((source) => source !== void 0);
+	return {
+		desktopId: sanitizeDesktopId(resolveStringField(sources, "desktopId", input.defaults.desktopId)),
+		name: resolveStringField(sources, "name", input.defaults.name),
+		comment: resolveStringField(sources, "comment", input.defaults.comment),
+		categories: resolveCategories(sources, input.defaults.categories),
+		startupNotify: resolveBooleanField(sources, "startupNotify", input.defaults.startupNotify),
+		iconPath: await resolveLinuxIconPath(sources, appIconSources, await resolveDefaultLinuxDesktopIcon(input.packageDirectory)),
+		iconFileName: defaultIconFileName,
+		configFileName: defaultDesktopConfigFileName
+	};
+};
+/**
+* Removes build-only Linux desktop settings from runtime config.
+*/
+var stripBuildOnlyLinuxDesktopConfig = (sourceConfig) => {
+	const sourceLinux = sourceConfig.linux;
+	if (!isJsonObject$3(sourceLinux)) return sourceConfig;
+	const linuxConfig = {};
+	for (const [key, value] of Object.entries(sourceLinux)) if (key !== "desktop") linuxConfig[key] = value;
+	const output = {};
+	for (const [key, value] of Object.entries(sourceConfig)) if (key !== "linux") output[key] = value;
+	if (Object.keys(linuxConfig).length > 0) output.linux = linuxConfig;
+	return output;
+};
+/**
+* Writes normalized Linux desktop sidecar files into a target distribution.
+*/
+var writeLinuxDesktopDistributionFiles = async (outputPath, desktop) => {
+	const iconData = await createNormalizedIconPngData(await readFile(desktop.iconPath), desktop.iconPath, "Linux desktop icon");
+	await writeFile(join(outputPath, desktop.iconFileName), iconData);
+	await writeFile(join(outputPath, desktop.configFileName), `${JSON.stringify({
+		desktopId: desktop.desktopId,
+		name: desktop.name,
+		comment: desktop.comment,
+		categories: desktop.categories,
+		startupNotify: desktop.startupNotify,
+		iconFileName: desktop.iconFileName
+	}, void 0, 2)}\n`);
+};
+var readJsonObjectFile$2 = async (filePath, label) => {
+	const parsed = (0, import_dist.parse)(await readFile(filePath, "utf8"));
+	if (!isJsonObject$3(parsed)) throw new Error(`${label} must contain a JSON object: ${filePath}`);
+	return parsed;
+};
+var readProjectJson = async (root) => {
+	const projectJsonPath = join(root, "project.json");
+	if (!await fileExists$3(projectJsonPath)) return {};
+	return await readJsonObjectFile$2(projectJsonPath, "project.json");
+};
+var createOptionsSource = (options, directory, label) => {
+	if (options === void 0) return;
+	return {
+		options: validateLinuxDesktopOptions(options, label),
+		directory
+	};
+};
+var readConfigLinuxDesktopSource = (config, directory, label) => {
+	const linux = config.linux;
+	if (linux === void 0) return;
+	if (!isJsonObject$3(linux)) throw new Error(`${label} linux must be an object when present.`);
+	const desktop = linux.desktop;
+	if (desktop === void 0) return;
+	return createOptionsSource(validateLinuxDesktopOptions(desktop, `${label} linux.desktop`), directory, `${label} linux.desktop`);
+};
+var validateLinuxDesktopOptions = (value, label) => {
+	if (!isJsonObject$3(value)) throw new Error(`${label} must be an object.`);
+	const output = {};
+	copyOptionalStringDesktopField(value, "desktopId", output);
+	copyOptionalStringDesktopField(value, "name", output);
+	copyOptionalStringDesktopField(value, "comment", output);
+	copyOptionalStringDesktopField(value, "iconPath", output);
+	copyOptionalCategoriesField(value, output, label);
+	copyOptionalBooleanDesktopField(value, "startupNotify", output, label);
+	return output;
+};
+var copyOptionalStringDesktopField = (source, key, target) => {
+	const value = source[key];
+	if (value === void 0) return;
+	if (typeof value !== "string") throw new Error(`${key} must be a string when present.`);
+	if (value.trim() !== "") target[key] = value.trim();
+};
+var copyOptionalCategoriesField = (source, target, label) => {
+	const value = source.categories;
+	if (value === void 0) return;
+	if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string" && entry.trim() !== "" && !entry.includes(";") && !entry.includes("\n") && !entry.includes("\r"))) throw new Error(`${label} categories must be a string array without semicolons when present.`);
+	target.categories = value.map((entry) => entry.trim());
+};
+var copyOptionalBooleanDesktopField = (source, key, target, label) => {
+	const value = source[key];
+	if (value === void 0) return;
+	if (typeof value !== "boolean") throw new Error(`${label} ${key} must be a boolean when present.`);
+	target[key] = value;
+};
+var resolveStringField = (sources, field, fallback) => {
+	for (const source of sources) {
+		const value = source.options[field];
+		if (value !== void 0 && value.trim() !== "") return value.trim();
+	}
+	return fallback;
+};
+var resolveCategories = (sources, fallback) => {
+	for (const source of sources) if (source.options.categories !== void 0) return source.options.categories;
+	return fallback;
+};
+var resolveBooleanField = (sources, field, fallback) => {
+	for (const source of sources) {
+		const value = source.options[field];
+		if (value !== void 0) return value;
+	}
+	return fallback;
+};
+var resolveLinuxIconPath = async (sources, appIconSources, defaultIconPath) => {
+	for (const source of sources) {
+		const value = source.options.iconPath;
+		if (value !== void 0 && value.trim() !== "") {
+			const iconPath = resolveResourcePath(source.directory, value);
+			await assertIconPath(iconPath, true);
+			return iconPath;
+		}
+	}
+	const appIconPath = await resolveMuonAppIconPath(appIconSources);
+	if (appIconPath !== void 0) return appIconPath;
+	if (defaultIconPath !== void 0 && await fileExists$3(defaultIconPath)) {
+		await assertIconPath(defaultIconPath, false);
+		return defaultIconPath;
+	}
+	throw new Error("Linux desktop icon does not exist.");
+};
+var assertIconPath = async (iconPath, required) => {
+	if (extname(iconPath).toLowerCase() !== ".png") throw new Error(`Linux desktop icon must be a .png file: ${iconPath}`);
+	if (required && !await fileExists$3(iconPath)) throw new Error(`Linux desktop icon does not exist: ${iconPath}`);
+	if (await fileExists$3(iconPath)) await createNormalizedIconPngData(await readFile(iconPath), iconPath, "Linux desktop icon");
+};
+var resolveDefaultLinuxDesktopIcon = async (packageDirectory) => {
+	const candidates = [
+		join(resolve(packageDirectory), "native", "muon-256.png"),
+		join(moduleDirectory$2, "native", "muon-256.png"),
+		join(moduleDirectory$2, "..", "dist", "native", "muon-256.png"),
+		join(moduleDirectory$2, "..", "..", "images", "muon-256.png")
+	];
+	for (const candidate of candidates) if (await fileExists$3(candidate)) return candidate;
+};
+var sanitizeDesktopId = (value) => {
+	const sanitized = value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[.-]+/g, "").replace(/[.-]+$/g, "");
+	return sanitized.length > 0 ? sanitized : "muon-app";
+};
+var resolveResourcePath = (directory, path) => {
+	return isAbsolute(path) ? path : resolve(directory, path);
+};
+var fileExists$3 = async (path) => {
+	try {
+		await access(path, constants.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+};
+var isJsonObject$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 //#endregion
 //#region src/build.ts
 var AdmZip = __resolveDefaultExport(__screwUpDefaultImportModule0, false);
@@ -1806,7 +2708,7 @@ function __resolveDefaultExport(module, isESM) {
 	}
 	return hasDefault ? resolvedDefault ?? module : module;
 }
-var defaultConfigFileNames = [
+var defaultConfigFileNames$1 = [
 	"muon.json5",
 	"muon.jsonc",
 	"muon.json"
@@ -1843,18 +2745,58 @@ var buildMuonApp = async (options = {}) => {
 	const appName = resolveAppName(packageJson, options.appName);
 	const appId = resolveAppId(packageJson, options.appId);
 	const buildConfig = await readBuildConfig(root, options.configPath);
-	const assetInput = resolveAssetInput(root, options.assetSourcePath, options.assetPrefix, buildConfig);
+	const sourceConfig = applyRuntimePluginConfig(buildConfig.config, options.runtimePluginConfig ?? { mode: "simple" });
+	assertNoUserInitialTitleBarIcon(sourceConfig);
+	const resolvedBuildConfig = {
+		...buildConfig,
+		config: sourceConfig
+	};
+	const assetInput = resolveAssetInput(root, options.assetSourcePath, options.assetPrefix, resolvedBuildConfig);
+	const windowsResource = await resolveMuonWindowsResource({
+		root,
+		packageDirectory,
+		packageJson,
+		muonConfig: sourceConfig,
+		muonConfigDirectory: buildConfig.directory,
+		options: options.windowsResource,
+		appIconPath: options.iconPath,
+		defaults: {
+			productName: appName,
+			fileDescription: appName,
+			companyName: "Unknown",
+			version: "0.0.0",
+			copyright: void 0
+		}
+	});
+	const linuxDesktop = await resolveMuonLinuxDesktop({
+		root,
+		packageDirectory,
+		muonConfig: sourceConfig,
+		muonConfigDirectory: buildConfig.directory,
+		options: options.linuxDesktop,
+		appIconPath: options.iconPath,
+		defaults: {
+			desktopId: appId,
+			name: resolveLinuxDesktopDefaultName(packageJson, appName),
+			comment: resolvePackageDescription(packageJson),
+			categories: ["Utility"],
+			startupNotify: true
+		}
+	});
 	const salt = Buffer.from(options.assetSalt ?? randomBytes(assetSaltByteLength));
 	const results = [];
 	for (const target of targets) {
 		const result = await buildMuonTarget({
 			packageDirectory,
+			root,
 			outputRoot,
 			appName,
 			appId,
 			target,
 			assetInput,
-			sourceConfig: buildConfig.config,
+			sourceConfig,
+			windowsResource,
+			linuxDesktop,
 			salt
 		});
 		results.push(result);
@@ -1889,8 +2831,8 @@ var normalizeZipPrefix = (prefix) => {
 };
 var readPackageJson = async (root) => {
 	const packageJsonPath = join(root, "package.json");
-	if (!await fileExists$1(packageJsonPath)) return {};
-	return await readJsonObjectFile(packageJsonPath, "package.json");
+	if (!await fileExists$2(packageJsonPath)) return {};
+	return await readJsonObjectFile$1(packageJsonPath, "package.json");
 };
 var resolvePackageName = (packageJson) => {
 	return typeof packageJson.name === "string" ? packageJson.name : defaultAppName;
@@ -1912,6 +2854,8 @@ var sanitizeAppId = (value) => {
 	const sanitized = (value.startsWith("@") ? value.slice(1) : value).trim().toLowerCase().replace("/", ".").replace(/[^a-z0-9._-]+/g, ".").replace(/^[.]+/g, "").replace(/[.]+$/g, "");
 	return sanitized.length > 0 ? sanitized : defaultAppId;
 };
+var resolveLinuxDesktopDefaultName = (packageJson, appName) => typeof packageJson.name === "string" && packageJson.name.trim() !== "" ? packageJson.name.trim() : appName;
+var resolvePackageDescription = (packageJson) => typeof packageJson.description === "string" ? packageJson.description.trim() : "";
 var readBuildConfig = async (root, configPath) => {
 	const resolvedConfigPath = await resolveConfigPath(root, configPath);
 	if (resolvedConfigPath === void 0) return {
@@ -1919,14 +2863,27 @@ var readBuildConfig = async (root, configPath) => {
 		directory: root
 	};
 	return {
-		config: await readJsonObjectFile(resolvedConfigPath, "Muon config file"),
+		config: await readJsonObjectFile$1(resolvedConfigPath, "Muon config file"),
 		directory: dirname(resolvedConfigPath)
 	};
 };
+var applyRuntimePluginConfig = (sourceConfig, runtimePluginConfig) => {
+	if (runtimePluginConfig === void 0) return sourceConfig;
+	const sourcePlugin = sourceConfig.plugin;
+	if (sourcePlugin !== void 0 && !isJsonObject$2(sourcePlugin)) throw new Error("muon.json plugin must be an object when runtime plugin config is applied.");
+	const plugin = sourcePlugin ?? {};
+	return {
+		...sourceConfig,
+		plugin: {
+			...plugin,
+			...runtimePluginConfig
+		}
+	};
+};
 var readConfigAssetSourcePath = (sourceConfig) => {
 	const sourceAsset = sourceConfig.asset;
 	if (sourceAsset === void 0) return;
-	if (!isJsonObject$1(sourceAsset)) throw new Error("muon.json asset must be an object when present.");
+	if (!isJsonObject$2(sourceAsset)) throw new Error("muon.json asset must be an object when present.");
 	const sourceAssetPath = sourceAsset.sourcePath;
 	if (sourceAssetPath === void 0) return;
 	if (typeof sourceAssetPath !== "string") throw new Error("muon.json asset.sourcePath must be a string when present.");
@@ -1935,28 +2892,28 @@ var readConfigAssetSourcePath = (sourceConfig) => {
 var resolveConfigPath = async (root, configPath) => {
 	if (configPath !== void 0) {
 		const resolvedPath = resolve(root, configPath);
-		if (await fileExists$1(resolvedPath)) return resolvedPath;
+		if (await fileExists$2(resolvedPath)) return resolvedPath;
 		throw new Error(`Muon config file does not exist: ${resolvedPath}`);
 	}
-	for (const fileName of defaultConfigFileNames) {
+	for (const fileName of defaultConfigFileNames$1) {
 		const candidatePath = join(root, fileName);
-		if (await fileExists$1(candidatePath)) return candidatePath;
+		if (await fileExists$2(candidatePath)) return candidatePath;
 	}
 };
-var readJsonObjectFile = async (filePath, label) => {
+var readJsonObjectFile$1 = async (filePath, label) => {
 	let content;
 	try {
 		content = await readFile(filePath, "utf8");
 	} catch (error) {
-		throw new Error(`${label} could not be read: ${filePath}: ${getErrorMessage$1(error)}`);
+		throw new Error(`${label} could not be read: ${filePath}: ${getErrorMessage$3(error)}`);
 	}
 	let parsed;
 	try {
 		parsed = (0, import_dist.parse)(content);
 	} catch (error) {
-		throw new Error(`${label} could not be parsed: ${filePath}: ${getErrorMessage$1(error)}`);
+		throw new Error(`${label} could not be parsed: ${filePath}: ${getErrorMessage$3(error)}`);
 	}
-	if (!isJsonObject$1(parsed)) throw new Error(`${label} must contain a JSON object: ${filePath}`);
+	if (!isJsonObject$2(parsed)) throw new Error(`${label} must contain a JSON object: ${filePath}`);
 	return parsed;
 };
 var buildMuonTarget = async (input) => {
@@ -1966,6 +2923,8 @@ var buildMuonTarget = async (input) => {
 	const outputPath = join(input.outputRoot, descriptor.distributionDirectoryName);
 	const launcherPath = join(outputPath, getLauncherFileName(input.appName, descriptor));
 	const assetZipPath = join(outputPath, "assets.zip");
+	const runtimeAppId = getMuonTargetRuntimeAppId(input.appId, input.target);
+	const appIconPath = descriptor.os === "windows" ? input.windowsResource.iconPath : input.linuxDesktop.iconPath;
 	await verifyTargetInputs({
 		sourceRuntimePath,
 		sourceBootstrapPath,
@@ -1984,8 +2943,11 @@ var buildMuonTarget = async (input) => {
 	await chmod(join(outputPath, descriptor.runtimeExecutableName), executableMode);
 	await copyFile(sourceBootstrapPath, launcherPath);
 	await chmod(launcherPath, executableMode);
-	const asset = await writeAssetArchive(input.assetInput, assetZipPath, input.salt);
-	const embeddedConfig = createEmbeddedConfig(input.sourceConfig, asset, input.appId);
+	const asset = await writeAssetArchive(input.assetInput, assetZipPath, input.salt, [{
+		name: appIconAssetEntryName,
+		data: await readFile(appIconPath)
+	}]);
+	const embeddedConfig = createEmbeddedConfig(input.sourceConfig, asset, runtimeAppId, input.linuxDesktop.desktopId, appIconAssetUrl);
 	await withTemporaryConfig(embeddedConfig, async (configPath) => {
 		await embedMuonConfigInRuntime({
 			runtimePath: outputPath,
@@ -1998,13 +2960,29 @@ var buildMuonTarget = async (input) => {
 			outputPath: void 0
 		});
 	});
+	if (descriptor.os === "windows") {
+		await updateWindowsPeIconResource({
+			executablePath: join(outputPath, descriptor.runtimeExecutableName),
+			resource: input.windowsResource,
+			environment: process.env,
+			cwd: input.root
+		});
+		await updateWindowsPeResources({
+			executablePath: launcherPath,
+			resource: input.windowsResource,
+			environment: process.env,
+			cwd: input.root
+		});
+	} else if (descriptor.os === "linux") await writeLinuxDesktopDistributionFiles(outputPath, input.linuxDesktop);
 	return {
 		target: input.target,
 		distributionDirectoryName: descriptor.distributionDirectoryName,
 		outputPath,
 		launcherPath,
 		asset,
-		embeddedConfig
+		runtimeAppId,
+		embeddedConfig,
+		...descriptor.os === "linux" ? { linuxDesktop: input.linuxDesktop } : {}
 	};
 };
 var verifyTargetInputs = async (input) => {
@@ -2025,10 +3003,10 @@ var copyRuntimeFiles = async (sourceRuntimePath, outputPath, descriptor) => {
 	}
 	await copyFile(join(sourceRuntimePath, muonLicenseFileName), join(outputPath, muonLicenseFileName));
 };
-var writeAssetArchive = async (input, outputPath, salt) => {
+var writeAssetArchive = async (input, outputPath, salt, extraEntries) => {
 	const sourceStats = await statOrUndefined(input.sourcePath);
 	if (sourceStats === void 0) throw new Error(`Muon asset source does not exist: ${input.sourcePath}`);
-	const archive = sourceStats.isDirectory() ? await createAssetArchiveFromDirectory(input) : sourceStats.isFile() ? await readFile(input.sourcePath) : void 0;
+	const archive = sourceStats.isDirectory() ? await createAssetArchiveFromDirectory(input, extraEntries) : sourceStats.isFile() ? await createAssetArchiveFromZipFile(input.sourcePath, extraEntries) : void 0;
 	if (archive === void 0) throw new Error(`Muon asset source is not a directory or file: ${input.sourcePath}`);
 	await writeFile(outputPath, archive);
 	return {
@@ -2038,10 +3016,30 @@ var writeAssetArchive = async (input, outputPath, salt) => {
 		entryCount: sourceStats.isDirectory() ? readZipEntryCount(archive, outputPath) : readZipEntryCount(archive, input.sourcePath)
 	};
 };
-var createAssetArchiveFromDirectory = async (input) => {
+var createAssetArchiveFromDirectory = async (input, extraEntries) => {
 	const entries = await collectZipEntries(input.sourcePath, input.prefix);
 	if (entries.length === 0) throw new Error(`Muon asset source has no files: ${input.sourcePath}`);
-	return createZipArchive(entries);
+	return createZipArchive(appendZipEntries(entries, extraEntries));
+};
+var createAssetArchiveFromZipFile = async (sourcePath, extraEntries) => {
+	const zip = new AdmZip(await readFile(sourcePath));
+	for (const entry of extraEntries) {
+		assertSafeZipEntryName(entry.name);
+		if (zip.getEntry(entry.name) !== null) throw new Error(`Muon app icon asset entry already exists: ${entry.name}`);
+		zip.addFile(entry.name, entry.data);
+	}
+	return zip.toBuffer();
+};
+var appendZipEntries = (entries, extraEntries) => {
+	const output = [...entries];
+	const names = new Set(entries.map((entry) => entry.name));
+	for (const entry of extraEntries) {
+		assertSafeZipEntryName(entry.name);
+		if (names.has(entry.name)) throw new Error(`Muon app icon asset entry already exists: ${entry.name}`);
+		names.add(entry.name);
+		output.push(entry);
+	}
+	return output;
 };
 var readZipEntryCount = (archive, sourcePath) => {
 	const endSignature = 101010256;
@@ -2079,13 +3077,20 @@ var createZipArchive = (entries) => {
 	for (const entry of entries) zip.addFile(entry.name, entry.data);
 	return zip.toBuffer();
 };
-var createEmbeddedConfig = (sourceConfig, asset, appId) => {
+var createEmbeddedConfig = (sourceConfig, asset, appId, desktopId, initialTitleBarIcon) => {
 	const sourceAsset = sourceConfig.asset;
-	if (sourceAsset !== void 0 && !isJsonObject$1(sourceAsset)) throw new Error("muon.json asset must be an object when present.");
+	if (sourceAsset !== void 0 && !isJsonObject$2(sourceAsset)) throw new Error("muon.json asset must be an object when present.");
 	const sourceBootstrap = sourceConfig.bootstrap;
-	if (sourceBootstrap !== void 0 && !isJsonObject$1(sourceBootstrap)) throw new Error("muon.json bootstrap must be an object when present.");
+	if (sourceBootstrap !== void 0 && !isJsonObject$2(sourceBootstrap)) throw new Error("muon.json bootstrap must be an object when present.");
+	const runtimeConfig = stripBuildOnlyAppIconConfig(stripBuildOnlyLinuxDesktopConfig(stripBuildOnlyWindowsResourceConfig(sourceConfig)));
+	const sourceBrowser = runtimeConfig.browser;
+	if (sourceBrowser !== void 0 && !isJsonObject$2(sourceBrowser)) throw new Error("muon.json browser must be an object when present.");
 	return {
-		...sourceConfig,
+		...runtimeConfig,
+		browser: {
+			...sourceBrowser ?? {},
+			initialTitleBarIcon
+		},
 		asset: {
 			...sourceAsset ?? {},
 			sourcePath: appConfigSourcePath,
@@ -2094,10 +3099,22 @@ var createEmbeddedConfig = (sourceConfig, asset, appId) => {
 		},
 		bootstrap: {
 			...sourceBootstrap ?? {},
-			appId
+			appId,
+			desktopId
 		}
 	};
 };
+var assertNoUserInitialTitleBarIcon = (sourceConfig) => {
+	const sourceBrowser = sourceConfig.browser;
+	if (sourceBrowser === void 0) return;
+	if (!isJsonObject$2(sourceBrowser)) throw new Error("muon.json browser must be an object when present.");
+	if (sourceBrowser.initialTitleBarIcon !== void 0) throw new Error("muon.json browser.initialTitleBarIcon is generated by muon build; use top-level iconPath instead.");
+};
+var stripBuildOnlyAppIconConfig = (sourceConfig) => {
+	const output = {};
+	for (const [key, value] of Object.entries(sourceConfig)) if (key !== "iconPath") output[key] = value;
+	return output;
+};
 var withTemporaryConfig = async (config, callback) => {
 	const tempDirectory = await mkdtemp(join(tmpdir(), "muon-build-config-"));
 	const configPath = join(tempDirectory, "muon.json");
@@ -2126,7 +3143,7 @@ var statOrUndefined = async (path) => {
 		return;
 	}
 };
-var fileExists$1 = async (path) => {
+var fileExists$2 = async (path) => {
 	try {
 		await access(path, constants.F_OK);
 		return true;
@@ -2134,15 +3151,420 @@ var fileExists$1 = async (path) => {
 		return false;
 	}
 };
-var isJsonObject$1 = (value) => {
+var isJsonObject$2 = (value) => {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 };
-var getErrorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
+var getErrorMessage$3 = (error) => error instanceof Error ? error.message : String(error);
+//#endregion
+//#region src/capability.ts
+var virtualModulePrefix = "\0muon-capability:";
+var moduleNamePattern = /^[A-Za-z_$][A-Za-z0-9_$]*:[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)*$/u;
+var jsIdentifierPattern = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
+var normalizePath = (path) => (path.split("?")[0] ?? "").replaceAll("\\", "/");
+var hashCapabilityRule = (index, rule) => `cap-${createHash("sha1").update(JSON.stringify({
+	index,
+	pluginName: rule.pluginName,
+	sources: [...rule.sources ?? []],
+	packages: [...rule.packages ?? []],
+	allow: [...rule.allow]
+})).digest("hex").slice(0, 16)}`;
+var parseCapabilitySpecifier = (source) => {
+	if (!moduleNamePattern.test(source)) return;
+	const separator = source.indexOf(":");
+	return {
+		moduleName: source,
+		namespace: `${source.slice(0, separator)}.${source.slice(separator + 1)}`
+	};
+};
+var escapeRegExp = (source) => source.replace(/[\\^$+?.()|[\]{}]/gu, "\\$&");
+var globToRegExp = (glob, separator) => {
+	let source = "^";
+	for (let index = 0; index < glob.length; index += 1) {
+		const current = glob[index] ?? "";
+		const next = glob[index + 1];
+		if (current === "*" && next === "*") {
+			source += ".*";
+			index += 1;
+			continue;
+		}
+		if (current === "*") {
+			source += `[^${escapeRegExp(separator)}]*`;
+			continue;
+		}
+		source += escapeRegExp(current);
+	}
+	source += "$";
+	return new RegExp(source, "u");
+};
+var isGlobMatch = (glob, value, separator) => globToRegExp(glob, separator).test(value);
+var toRootRelativeImporter = (root, importer) => normalizePath(relative(root, importer));
+var readPackageName = (packageJsonPath) => {
+	try {
+		const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && typeof parsed.name === "string" ? parsed.name : void 0;
+	} catch {
+		return;
+	}
+};
+var getImporterPackageName = (root, importer) => {
+	const normalizedRoot = normalizePath(root);
+	const rootPackageJsonPath = join(root, "package.json");
+	let directory = dirname(normalizePath(importer));
+	for (;;) {
+		const packageJsonPath = join(directory, "package.json");
+		if (packageJsonPath !== rootPackageJsonPath && existsSync(packageJsonPath)) return readPackageName(packageJsonPath);
+		if (normalizePath(directory) === normalizedRoot) return;
+		const parent = dirname(directory);
+		if (parent === directory) return;
+		directory = parent;
+	}
+};
+var matchesCapabilityRuleImporter = (rule, root, importer) => {
+	const relativeImporter = toRootRelativeImporter(root, importer);
+	if (rule.sources?.some((pattern) => isGlobMatch(normalizePath(pattern), relativeImporter, "/")) ?? false) return true;
+	const packageName = getImporterPackageName(root, importer);
+	return packageName === void 0 ? false : rule.packages?.includes(packageName) ?? false;
+};
+var hasNamespaceFunctionAllow = (namespace, allow) => allow.some((entry) => {
+	if (entry.startsWith(`${namespace}.`)) return true;
+	return isGlobMatch(entry, `${namespace}.placeholder`, ".");
+});
+var getExactExportName = (namespace, functionPath) => {
+	const prefix = `${namespace}.`;
+	if (!functionPath.startsWith(prefix)) return;
+	const name = functionPath.slice(prefix.length);
+	if (!jsIdentifierPattern.test(name)) return;
+	return name;
+};
+var getExportedFunctions = (namespace, allow) => allow.flatMap((functionPath) => {
+	const exportName = getExactExportName(namespace, functionPath);
+	return exportName === void 0 ? [] : [[exportName, functionPath]];
+});
+var createRuleRuntimeEntry = (rule, index) => ({
+	id: hashCapabilityRule(index, rule),
+	allow: [...rule.allow]
+});
+var validateCapabilityRule = (rule) => {
+	if ((rule.sources === void 0 || rule.sources.length === 0) && (rule.packages === void 0 || rule.packages.length === 0)) throw new Error("Muon capability import rule requires sources or packages.");
+};
+var createModuleVirtualId = (rule) => `${virtualModulePrefix}${rule.index}:${rule.moduleName}`;
+var parseModuleVirtualId = (id) => {
+	if (!id.startsWith(virtualModulePrefix)) return;
+	const payload = id.slice(17);
+	const separator = payload.indexOf(":");
+	if (separator <= 0) return;
+	const index = Number.parseInt(payload.slice(0, separator), 10);
+	if (!Number.isInteger(index) || index < 0) return;
+	return {
+		index,
+		moduleName: payload.slice(separator + 1)
+	};
+};
+var createExecutorSpawnExport = (capabilityId, functionPath) => `export const spawn = async (options = {}) => {
+  const source = await __muonCall(${JSON.stringify(capabilityId)}, ${JSON.stringify(functionPath)}, [JSON.stringify(options ?? {})]);
+  return JSON.parse(source);
+};`;
+var createGenericFunctionExport = (exportName, capabilityId, functionPath) => `export const ${exportName} = async (...args) =>
+  await __muonCall(${JSON.stringify(capabilityId)}, ${JSON.stringify(functionPath)}, args);`;
+var createModuleSource = (rule) => {
+	const exportedFunctions = getExportedFunctions(rule.namespace, rule.rule.allow);
+	if (exportedFunctions.length === 0) throw new Error(`Muon capability import has no exact function exports: ${rule.moduleName}`);
+	return `const __muonCall = globalThis.__muon_plugin_call;
+if (typeof __muonCall !== "function") {
+  throw new Error("Muon plugin capability bridge is not available.");
+}
+
+${exportedFunctions.map(([exportName, functionPath]) => rule.namespace === "muon.executor" && exportName === "spawn" ? createExecutorSpawnExport(rule.id, functionPath) : createGenericFunctionExport(exportName, rule.id, functionPath)).join("\n\n")}
+`;
+};
+/**
+* Creates a capability virtual module resolver for a bundler adapter.
+*
+* @param root Bundler project root.
+* @param options Capability import options.
+*/
+var createMuonCapabilityModuleResolver = (root, options) => {
+	const rules = [...options?.imports ?? []];
+	for (const rule of rules) validateCapabilityRule(rule);
+	const runtimeEntries = rules.map((rule, index) => createRuleRuntimeEntry(rule, index));
+	const resolveRule = (source, importer) => {
+		const parsed = parseCapabilitySpecifier(source);
+		if (parsed === void 0) return;
+		if (!rules.some((rule) => hasNamespaceFunctionAllow(parsed.namespace, rule.allow))) return;
+		if (importer === void 0) throw new Error(`Muon capability import is not allowed without an importer: ${source}`);
+		const relativeImporter = toRootRelativeImporter(root, importer);
+		for (let index = 0; index < rules.length; index += 1) {
+			const rule = rules[index];
+			if (rule === void 0 || !matchesCapabilityRuleImporter(rule, root, importer) || !hasNamespaceFunctionAllow(parsed.namespace, rule.allow)) continue;
+			return {
+				index,
+				id: runtimeEntries[index]?.id ?? hashCapabilityRule(index, rule),
+				rule,
+				namespace: parsed.namespace,
+				moduleName: parsed.moduleName
+			};
+		}
+		throw new Error(`Muon capability import is not allowed: ${source} from ${relativeImporter}`);
+	};
+	return {
+		resolveId: (source, importer) => {
+			const rule = resolveRule(source, importer);
+			return rule === void 0 ? void 0 : { id: createModuleVirtualId(rule) };
+		},
+		load: (id) => {
+			const parsed = parseModuleVirtualId(id);
+			if (parsed === void 0) return;
+			const source = parseCapabilitySpecifier(parsed.moduleName);
+			const rule = rules[parsed.index];
+			const runtimeEntry = runtimeEntries[parsed.index];
+			if (source === void 0 || rule === void 0 || runtimeEntry === void 0) return;
+			return createModuleSource({
+				index: parsed.index,
+				id: runtimeEntry.id,
+				rule,
+				namespace: source.namespace,
+				moduleName: source.moduleName
+			});
+		},
+		getRuntimePluginConfig: () => ({
+			mode: "validate",
+			capabilities: runtimeEntries
+		})
+	};
+};
+//#endregion
+//#region src/plugin-access.ts
+var defaultConfigFileNames = [
+	"muon.json5",
+	"muon.jsonc",
+	"muon.json"
+];
+var defaultPluginPages = ["asset://main/**"];
+var isJsonObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
+var isSha1HexString = (value) => value.length === 40 && /^[0-9a-fA-F]+$/.test(value);
+var isHexByteString = (value) => value.length % 2 === 0 && /^[0-9a-fA-F]*$/.test(value);
+var getErrorMessage$2 = (error) => error instanceof Error ? error.message : String(error);
+var fileExists$1 = async (path) => {
+	try {
+		await access(path, constants.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+};
+var resolveMuonConfigPath = async (root, configPath) => {
+	if (configPath !== void 0) {
+		const resolvedPath = resolve(root, configPath);
+		if (await fileExists$1(resolvedPath)) return resolvedPath;
+		throw new Error(`Muon config file does not exist: ${resolvedPath}`);
+	}
+	for (const fileName of defaultConfigFileNames) {
+		const candidatePath = join(root, fileName);
+		if (await fileExists$1(candidatePath)) return candidatePath;
+	}
+};
+var readJsonObjectFile = async (path, label) => {
+	let content;
+	try {
+		content = await readFile(path, "utf8");
+	} catch (error) {
+		throw new Error(`${label} could not be read: ${path}: ${getErrorMessage$2(error)}`);
+	}
+	let parsed;
+	try {
+		parsed = (0, import_dist.parse)(content);
+	} catch (error) {
+		throw new Error(`${label} could not be parsed: ${path}: ${getErrorMessage$2(error)}`);
+	}
+	if (!isJsonObject$1(parsed)) throw new Error(`${label} must contain a JSON object: ${path}`);
+	return parsed;
+};
+var readOptionalStringArray = (object, key, configPath) => {
+	const value = object[key];
+	if (value === void 0) return;
+	if (!isStringArray(value)) throw new Error(`muon.json ${configPath} must be an array of strings.`);
+	return value;
+};
+var readPluginAccessImportOptions = (value, configPath) => {
+	if (!isJsonObject$1(value)) throw new Error(`muon.json ${configPath} must be an object.`);
+	const sources = readOptionalStringArray(value, "sources", `${configPath}.sources`);
+	const packages = readOptionalStringArray(value, "packages", `${configPath}.packages`);
+	const allow = readOptionalStringArray(value, "allow", `${configPath}.allow`);
+	const options = {};
+	if (sources !== void 0) options.sources = sources;
+	if (packages !== void 0) options.packages = packages;
+	if (allow !== void 0) options.allow = allow;
+	return options;
+};
+var readPluginAccessEntryOptions = (value, index) => {
+	const configPath = `plugin.plugins[${index}]`;
+	if (!isJsonObject$1(value)) throw new Error(`muon.json ${configPath} must be an object.`);
+	if (typeof value.name !== "string") throw new Error(`muon.json ${configPath}.name must be a string.`);
+	if (value.signature !== void 0) {
+		if (typeof value.signature !== "string") throw new Error(`muon.json ${configPath}.signature must be a string.`);
+		if (!isSha1HexString(value.signature)) throw new Error(`muon.json ${configPath}.signature must be a 40-character SHA-1 hex string.`);
+	}
+	if (value.salt !== void 0) {
+		if (typeof value.salt !== "string") throw new Error(`muon.json ${configPath}.salt must be a string.`);
+		if (!isHexByteString(value.salt)) throw new Error(`muon.json ${configPath}.salt must be a hexadecimal byte string.`);
+	}
+	const allow = readOptionalStringArray(value, "allow", `${configPath}.allow`);
+	const rawImports = value.imports;
+	if (rawImports !== void 0 && !Array.isArray(rawImports)) throw new Error(`muon.json ${configPath}.imports must be an array.`);
+	const imports = rawImports === void 0 ? void 0 : rawImports.map((entry, importIndex) => readPluginAccessImportOptions(entry, `${configPath}.imports[${importIndex}]`));
+	const options = { name: value.name };
+	if (value.signature !== void 0) options.signature = value.signature;
+	if (value.salt !== void 0) options.salt = value.salt;
+	if (allow !== void 0) options.allow = allow;
+	if (imports !== void 0) options.imports = imports;
+	return options;
+};
+var readPluginAccessOptions = (config) => {
+	const browser = config.browser;
+	if (isJsonObject$1(browser) && browser.plugin !== void 0) throw new Error("muon.json browser.plugin is no longer supported; use plugin.mode and plugin.pages instead.");
+	const plugin = config.plugin;
+	if (plugin === void 0) return {};
+	if (!isJsonObject$1(plugin)) throw new Error("muon.json plugin must be an object.");
+	const options = {};
+	if (plugin.path !== void 0) {
+		if (typeof plugin.path !== "string") throw new Error("muon.json plugin.path must be a string.");
+		if (plugin.path.length === 0) throw new Error("muon.json plugin.path must not be empty.");
+		options.path = plugin.path;
+	}
+	if (plugin.mode !== void 0) {
+		if (typeof plugin.mode !== "string") throw new Error("muon.json plugin.mode must be a string.");
+		if (plugin.mode.length === 0) throw new Error("muon.json plugin.mode must not be empty.");
+		if (plugin.mode !== "simple" && plugin.mode !== "validate") throw new Error("muon.json plugin.mode has unknown value.");
+		options.mode = plugin.mode;
+	}
+	const pages = readOptionalStringArray(plugin, "pages", "plugin.pages");
+	if (pages !== void 0) options.pages = pages;
+	const rawPlugins = plugin.plugins;
+	if (rawPlugins !== void 0) {
+		if (!Array.isArray(rawPlugins)) throw new Error("muon.json plugin.plugins must be an array.");
+		options.plugins = rawPlugins.map((entry, index) => readPluginAccessEntryOptions(entry, index));
+	}
+	return options;
+};
+var hasImportSourceSelector = (entry) => entry.sources !== void 0 && entry.sources.length > 0 || entry.packages !== void 0 && entry.packages.length > 0;
+var validatePluginAccessOptions = (resolved) => {
+	for (const [pluginIndex, plugin] of resolved.plugins.entries()) {
+		const pluginPath = `plugin.plugins[${pluginIndex}]`;
+		if (plugin.name === "internal" && plugin.signature !== void 0) throw new Error(`muon.json ${pluginPath}.signature is not supported for internal plugins.`);
+		if (plugin.name === "internal" && plugin.salt !== void 0) throw new Error(`muon.json ${pluginPath}.salt is not supported for internal plugins.`);
+		if (plugin.signature !== void 0 && plugin.salt === void 0) throw new Error(`muon.json ${pluginPath}.signature requires ${pluginPath}.salt.`);
+		if (resolved.mode === "validate") {
+			if (plugin.allow !== void 0) throw new Error(`muon.json ${pluginPath}.allow is only supported in simple mode; use ${pluginPath}.imports[].allow in validate mode.`);
+			if (plugin.imports === void 0) throw new Error(`muon.json ${pluginPath}.imports is required in validate mode.`);
+			if (plugin.imports.length === 0) throw new Error(`muon.json ${pluginPath}.imports must not be empty in validate mode.`);
+			for (const [importIndex, entry] of plugin.imports.entries()) {
+				const importPath = `${pluginPath}.imports[${importIndex}]`;
+				if (!hasImportSourceSelector(entry)) throw new Error(`muon.json ${importPath} requires sources or packages.`);
+				if (entry.allow === void 0) throw new Error(`muon.json ${importPath}.allow is required in validate mode.`);
+				if (entry.allow.length === 0) throw new Error(`muon.json ${importPath}.allow must not be empty in validate mode.`);
+			}
+			continue;
+		}
+		if (plugin.allow === void 0) throw new Error(`muon.json ${pluginPath}.allow is required in simple mode.`);
+		if (plugin.imports !== void 0) throw new Error(`muon.json ${pluginPath}.imports is only supported in validate mode.`);
+	}
+	return resolved;
+};
+var getValidateImportAllow = (entry, pluginIndex, importIndex) => {
+	if (entry.allow === void 0 || entry.allow.length === 0) throw new Error(`muon.json plugin.plugins[${pluginIndex}].imports[${importIndex}].allow is required in validate mode.`);
+	return entry.allow;
+};
+var getSimplePluginAllow = (plugin, pluginIndex) => {
+	if (plugin.allow === void 0) throw new Error(`muon.json plugin.plugins[${pluginIndex}].allow is required in simple mode.`);
+	return plugin.allow;
+};
+var toCapabilityImports = (plugins) => plugins.flatMap((plugin, pluginIndex) => (plugin.imports ?? []).map((entry, importIndex) => {
+	if (!hasImportSourceSelector(entry)) throw new Error(`muon.json plugin.plugins[${pluginIndex}].imports[${importIndex}] requires sources or packages.`);
+	const rule = {
+		allow: getValidateImportAllow(entry, pluginIndex, importIndex),
+		pluginName: plugin.name
+	};
+	if (entry.sources !== void 0) rule.sources = entry.sources;
+	if (entry.packages !== void 0) rule.packages = entry.packages;
+	return rule;
+}));
+var toValidateRuntimePluginEntries = (plugins) => plugins.map((plugin, pluginIndex) => {
+	const allow = [];
+	const seenAllow = /* @__PURE__ */ new Set();
+	for (const [importIndex, entry] of (plugin.imports ?? []).entries()) for (const functionPath of getValidateImportAllow(entry, pluginIndex, importIndex)) if (!seenAllow.has(functionPath)) {
+		seenAllow.add(functionPath);
+		allow.push(functionPath);
+	}
+	return {
+		name: plugin.name,
+		...plugin.signature === void 0 ? {} : { signature: plugin.signature },
+		...plugin.salt === void 0 ? {} : { salt: plugin.salt },
+		allow
+	};
+});
+var toSimpleRuntimePluginEntries = (plugins) => plugins.map((plugin, pluginIndex) => ({
+	name: plugin.name,
+	...plugin.signature === void 0 ? {} : { signature: plugin.signature },
+	...plugin.salt === void 0 ? {} : { salt: plugin.salt },
+	allow: [...getSimplePluginAllow(plugin, pluginIndex)]
+}));
+var shouldOverlayRuntimePlugins = (resolved, override) => override !== false && (override?.plugins !== void 0 || resolved.mode === "validate" && resolved.plugins.length > 0);
+var toRuntimePluginEntries = (resolved) => resolved.mode === "validate" ? toValidateRuntimePluginEntries(resolved.plugins) : toSimpleRuntimePluginEntries(resolved.plugins);
+var mergePluginAccessOptions = (base, override) => ({
+	...override?.path === void 0 ? {} : { path: override.path },
+	mode: override?.mode ?? base.mode ?? "validate",
+	pages: override?.pages ?? base.pages ?? defaultPluginPages,
+	plugins: override?.plugins ?? base.plugins ?? []
+});
+var createRuntimeOverlay = (root, resolved, override) => {
+	if (override === false) return {};
+	const path = override?.path !== void 0 ? resolve(root, override.path) : void 0;
+	const plugins = shouldOverlayRuntimePlugins(resolved, override) ? toRuntimePluginEntries(resolved) : void 0;
+	return {
+		pages: resolved.pages,
+		...path === void 0 ? {} : { path },
+		...plugins === void 0 ? {} : { plugins }
+	};
+};
+/**
+* Resolves public plugin access config from muon.json and Vite overrides.
+*
+* @param input Resolution inputs.
+* @returns Effective plugin access config for bundler integrations.
+*/
+var resolveMuonPluginAccessOptions = async ({ root, configPath, pluginAccess, onConfigReadError }) => {
+	const resolvedConfigPath = await resolveMuonConfigPath(root, configPath);
+	let base = {};
+	if (resolvedConfigPath !== void 0) try {
+		base = readPluginAccessOptions(await readJsonObjectFile(resolvedConfigPath, "Muon config file"));
+	} catch (error) {
+		if (onConfigReadError === void 0) throw error;
+		onConfigReadError(error);
+	}
+	if (pluginAccess === false) {
+		const resolved = validatePluginAccessOptions(mergePluginAccessOptions(base, { mode: "simple" }));
+		return {
+			mode: "simple",
+			pages: resolved.pages,
+			capabilityOptions: { imports: [] },
+			runtimeOverlay: createRuntimeOverlay(root, resolved, pluginAccess)
+		};
+	}
+	const resolved = validatePluginAccessOptions(mergePluginAccessOptions(base, pluginAccess));
+	const capabilityOptions = { imports: resolved.mode === "validate" ? toCapabilityImports(resolved.plugins) : [] };
+	return {
+		mode: resolved.mode,
+		pages: resolved.pages,
+		capabilityOptions,
+		runtimeOverlay: createRuntimeOverlay(root, resolved, pluginAccess)
+	};
+};
 //#endregion
 //#region src/gitignore.ts
 var muonGitignoreEntries = [
 	".muon/",
-	"dist-muon-*/",
+	"dist-muon/",
 	"artifacts/"
 ];
 var muonGitignoreEntryAliases = {
@@ -2152,11 +3574,13 @@ var muonGitignoreEntryAliases = {
 		".muon",
 		"/.muon"
 	],
-	"dist-muon-*/": [
-		"dist-muon-*/",
-		"/dist-muon-*/",
-		"dist-muon-*",
-		"/dist-muon-*"
+	"dist-muon/": [
+		"dist-muon/",
+		"/dist-muon/",
+		"dist-muon",
+		"/dist-muon",
+		"dist-muon/*",
+		"/dist-muon/*"
 	],
 	"artifacts/": [
 		"artifacts/",
@@ -2299,7 +3723,7 @@ var getWebSocketOrigin = (startUrl) => {
 	else if (url.protocol === "http:") url.protocol = "ws:";
 	return url.origin;
 };
-var createMuonOverrideConfig = (startUrl, enableDebugger) => {
+var createMuonOverrideConfig = (startUrl, enableDebugger, runtimePluginConfig) => {
 	const origin = new URL(startUrl).origin;
 	return {
 		...enableDebugger ? { cdp: { enable: true } } : {},
@@ -2308,19 +3732,22 @@ var createMuonOverrideConfig = (startUrl, enableDebugger) => {
 			...enableDebugger ? { keybind: {
 				devtools: "f12",
 				recycle: "ctrl+f12"
-			} } : {},
-			plugin: { allow: [`${origin}/**`] }
+			} } : {}
+		},
+		plugin: {
+			...runtimePluginConfig,
+			pages: [`${origin}/**`]
 		},
 		network: { allow: [`${origin}/**`, `${getWebSocketOrigin(startUrl)}/**`] }
 	};
 };
-var writeMuonOverrideConfig = (server, overrideConfigPath, enableDebugger) => {
+var writeMuonOverrideConfig = (server, overrideConfigPath, pluginOptions, getRuntimePluginConfig) => {
 	const startUrl = getBaseUrl(server);
 	if (startUrl === void 0) {
 		server.config.logger.warn("Muon Vite plugin could not resolve a Vite URL.");
 		return false;
 	}
-	writeFileSync(overrideConfigPath, `${JSON.stringify(createMuonOverrideConfig(startUrl, enableDebugger), null, 2)}\n`);
+	writeFileSync(overrideConfigPath, `${JSON.stringify(createMuonOverrideConfig(startUrl, pluginOptions.enableDebugger !== false, getRuntimePluginConfig()), null, 2)}\n`);
 	return true;
 };
 var createRuntimePaths = async (server, stagePath, platform, projectConfigPath) => {
@@ -2342,7 +3769,7 @@ var fileExists = async (path) => {
 	}
 };
 var isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var getErrorMessage = (error) => error instanceof Error ? error.message : String(error);
+var getErrorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
 var resolveProjectConfigPath = async (server) => {
 	for (const fileName of defaultProjectConfigFileNames) {
 		const candidatePath = join(server.config.root, fileName);
@@ -2351,7 +3778,7 @@ var resolveProjectConfigPath = async (server) => {
 			if (!isJsonObject((0, import_dist.parse)(await readFile(candidatePath, "utf8")))) throw new Error("muon config root must be an object");
 			return candidatePath;
 		} catch (error) {
-			server.config.logger.warn(`Muon project config will be ignored because it could not be read or parsed: ${candidatePath}: ${getErrorMessage(error)}`);
+			server.config.logger.warn(`Muon project config will be ignored because it could not be read or parsed: ${candidatePath}: ${getErrorMessage$1(error)}`);
 			return;
 		}
 	}
@@ -2379,11 +3806,11 @@ var launchMuon = (paths, platform, server) => {
 		windowsHide: false
 	});
 	child.once("error", (error) => {
-		server.config.logger.warn(`Muon startup failed: ${getErrorMessage(error)}`);
+		server.config.logger.warn(`Muon startup failed: ${getErrorMessage$1(error)}`);
 	});
 	child.unref();
 };
-var startMuonViteBrowserBridge = async ({ server, pluginOptions, platform, architecture, environment }) => {
+var startMuonViteBrowserBridge = async ({ server, pluginOptions, getRuntimePluginConfig, platform, architecture, environment }) => {
 	await ensureMuonGitignoreEntry(server.config.root);
 	if (pluginOptions.open === false || server.httpServer === null) return;
 	const target = getDefaultMuonPrepareTarget(platform, architecture);
@@ -2403,7 +3830,7 @@ var startMuonViteBrowserBridge = async ({ server, pluginOptions, platform, archi
 		environment,
 		cwd: server.config.root
 	});
-	if (preparedRuntime.stagePath === void 0) throw new Error("muon-prepare did not return a staged runtime path.");
+	if (preparedRuntime.stagePath === void 0) throw new Error("muon-builder did not return a staged runtime path.");
 	const paths = await createRuntimePaths(server, preparedRuntime.stagePath, platform, await resolveProjectConfigPath(server));
 	await writeLaunchScript(paths, platform);
 	let cleanupPromise = void 0;
@@ -2429,7 +3856,7 @@ var startMuonViteBrowserBridge = async ({ server, pluginOptions, platform, archi
 		cleanup();
 	});
 	server.httpServer.once("listening", () => {
-		if (writeMuonOverrideConfig(server, paths.overrideConfigPath, pluginOptions.enableDebugger !== false)) launchMuon(paths, platform, server);
+		if (writeMuonOverrideConfig(server, paths.overrideConfigPath, pluginOptions, getRuntimePluginConfig)) launchMuon(paths, platform, server);
 	});
 };
 //#endregion
@@ -2456,28 +3883,43 @@ var attachMuonVitePluginOptions = (plugin, options) => {
 };
 //#endregion
 //#region src/vite.ts
-var suppressViteMuonBuildEnvironmentKey = "MUON_SUPPRESS_VITE_MUON_BUILD";
+var getErrorMessage = (error) => error instanceof Error ? error.message : String(error);
 /**
 * Creates a Vite plugin that launches Muon during Vite dev startup.
 *
 * @param options Muon plugin options used for development startup and build.
 * @returns Vite plugin instance.
+* @defaultValue `options` defaults to `{}`.
 */
 var muon = (options = {}) => {
 	let resolvedConfig = void 0;
+	let capabilityResolver = void 0;
+	let resolvedPluginAccess = void 0;
 	return attachMuonVitePluginOptions({
 		name: "muon",
 		config: (config) => {
 			if (config.server?.watch === null) return null;
 			return { server: { watch: createMuonWatchOptions(config.server?.watch) } };
 		},
-		configResolved: (config) => {
+		configResolved: async (config) => {
 			resolvedConfig = config;
+			resolvedPluginAccess = await resolveMuonPluginAccessOptions({
+				root: config.root,
+				configPath: resolveMuonConfigPathForViteCommand(config, options),
+				pluginAccess: options.pluginAccess,
+				...config.command === "serve" ? { onConfigReadError: (error) => {
+					config.logger.warn(`Muon project config will be ignored because it could not be read or parsed: ${getErrorMessage(error)}`);
+				} } : {}
+			});
+			capabilityResolver = resolvedPluginAccess.mode === "validate" ? createMuonCapabilityModuleResolver(config.root, resolvedPluginAccess.capabilityOptions) : void 0;
 		},
+		resolveId: (source, importer) => capabilityResolver?.resolveId(source, importer)?.id,
+		load: (id) => capabilityResolver?.load(id),
 		configureServer: async (server) => {
 			await startMuonViteBrowserBridge({
 				server,
 				pluginOptions: options,
+				getRuntimePluginConfig: () => resolveMuonRuntimePluginConfig(capabilityResolver, resolvedPluginAccess),
 				platform: process.platform,
 				architecture: process.arch,
 				environment: process.env
@@ -2485,10 +3927,10 @@ var muon = (options = {}) => {
 		},
 		closeBundle: async () => {
 			if (resolvedConfig === void 0 || resolvedConfig.command !== "build") return;
-			if (process.env[suppressViteMuonBuildEnvironmentKey] === "1") return;
+			if (process.env["MUON_SUPPRESS_VITE_MUON_BUILD"] === "1") return;
 			if (options.build === false) return;
 			const buildOptions = typeof options.build === "object" ? options.build : {};
-			await buildMuonApp(createMuonBuildOptions(resolvedConfig, buildOptions));
+			await buildMuonApp(createMuonBuildOptions(resolvedConfig, buildOptions, resolveMuonRuntimePluginConfig(capabilityResolver, resolvedPluginAccess)));
 		}
 	}, options);
 };
@@ -2505,7 +3947,7 @@ var createMuonWatchOptions = (watch) => ({
 	...watch ?? {},
 	ignored: mergeMuonWatchIgnored(watch?.ignored)
 });
-var createMuonBuildOptions = (config, buildOptions) => {
+var createMuonBuildOptions = (config, buildOptions, runtimePluginConfig) => {
 	const outDir = isAbsolute(config.build.outDir) ? config.build.outDir : resolve(config.root, config.build.outDir);
 	const options = {
 		root: config.root,
@@ -2518,10 +3960,28 @@ var createMuonBuildOptions = (config, buildOptions) => {
 	if (buildOptions.appId !== void 0) options.appId = buildOptions.appId;
 	if (buildOptions.outputRoot !== void 0) options.outputRoot = buildOptions.outputRoot;
 	if (buildOptions.configPath !== void 0) options.configPath = buildOptions.configPath;
+	if (buildOptions.iconPath !== void 0) options.iconPath = buildOptions.iconPath;
+	if (buildOptions.windowsResource !== void 0) options.windowsResource = buildOptions.windowsResource;
+	if (buildOptions.linuxDesktop !== void 0) options.linuxDesktop = buildOptions.linuxDesktop;
 	if (buildOptions.packageDirectory !== void 0) options.packageDirectory = buildOptions.packageDirectory;
 	if (buildOptions.assetSalt !== void 0) options.assetSalt = buildOptions.assetSalt;
+	options.runtimePluginConfig = runtimePluginConfig;
 	return options;
 };
+var resolveMuonConfigPathForViteCommand = (config, options) => {
+	if (config.command !== "build" || typeof options.build !== "object") return;
+	return options.build.configPath;
+};
+var resolveMuonRuntimePluginConfig = (capabilityResolver, pluginAccess) => pluginAccess?.mode === "simple" ? {
+	mode: "simple",
+	...pluginAccess.runtimeOverlay
+} : {
+	...capabilityResolver?.getRuntimePluginConfig() ?? {
+		mode: "validate",
+		capabilities: []
+	},
+	...pluginAccess?.runtimeOverlay ?? {}
+};
 //#endregion
 export { muon as default };