muon-ui 0.8.0 → 0.9.0

package/dist/vite.mjs

@@ -1,14 +1,14 @@
 /*!
 * name: muon-ui
-* version: 0.8.0
+* version: 0.9.0
 * description: A multi-platform GUI application framework that uses CEF as its backend
 * author: Kouji Matsui (@kekyo@mi.kekyo.net)
 * license: MIT
 * repository.url: https://github.com/kekyo/muon-ui.git
-* git.commit.hash: 9bb6148e155dab16c4ca441073b144e21981b038
+* git.commit.hash: 3437b522a51d8772713b72722b109c5ff30fc711
 */
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
-import { constants, writeFileSync } from "node:fs";
+import { constants, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { access, chmod, copyFile, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createHash, randomBytes } from "node:crypto";
 import { tmpdir } from "node:os";
@@ -1293,8 +1293,10 @@ var encodeTaggedBytes = (tag, bytes) => Buffer.concat([
 	encodeVarUint(BigInt(bytes.length)),
 	Buffer.from(bytes)
 ]);
-var isJsonObject$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isJsonObject$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isPath = (path, first, second) => path.length === 2 && path[0] === first && path[1] === second;
+var isPluginSignaturePath = (path) => path.length === 3 && path[0] === "plugin" && path[1] === "plugins" && path[2] === "signature";
+var isPluginSaltPath = (path) => path.length === 3 && path[0] === "plugin" && path[1] === "plugins" && path[2] === "salt";
 var isHexString = (value) => value.length % 2 === 0 && /^[0-9a-fA-F]*$/.test(value);
 var decodeHexString = (value) => {
 	const bytes = Buffer.alloc(value.length / 2);
@@ -1304,6 +1306,8 @@ var decodeHexString = (value) => {
 var encodeKnownBinaryString = (path, value) => {
 	if (isPath(path, "asset", "signature")) return value.length === 40 && isHexString(value) ? decodeHexString(value) : void 0;
 	if (isPath(path, "asset", "salt")) return isHexString(value) ? decodeHexString(value) : void 0;
+	if (isPluginSignaturePath(path)) return value.length === 40 && isHexString(value) ? decodeHexString(value) : void 0;
+	if (isPluginSaltPath(path)) return isHexString(value) ? decodeHexString(value) : void 0;
 	if (isPath(path, "browser", "backgroundColor")) {
 		const hex = value.startsWith("#") ? value.slice(1) : value;
 		return hex.length === 6 && isHexString(hex) ? decodeHexString(hex) : void 0;
@@ -1326,7 +1330,7 @@ var encodeTlvValue = (value, path) => {
 		encodeVarUint(BigInt(value.length)),
 		...value.map((entry) => encodeTlvValue(entry, path))
 	]);
-	if (isJsonObject$4(value)) {
+	if (isJsonObject$5(value)) {
 		const entries = Object.entries(value);
 		return Buffer.concat([
 			Buffer.from([tlvObjectTag]),
@@ -1351,8 +1355,8 @@ var encodeMuonConfigTlv = (config) => encodeTlvValue(config, []);
 */
 var createMuonEmbeddedConfigSlot = (payload = void 0) => {
 	if (payload !== void 0 && payload.length > muonEmbeddedConfigPayloadCapacity) throw new Error(`Encoded muon config exceeds the embedded slot capacity: ${payload.length} > ${muonEmbeddedConfigPayloadCapacity}`);
-	const slot = createEmptySlot();
-	if (payload === void 0) return slot;
+	if (payload === void 0) return createEmptySlot();
+	const slot = randomBytes(muonEmbeddedConfigSlotSize);
 	Buffer.from(payload).copy(slot, 0);
 	return slot;
 };
@@ -1364,9 +1368,12 @@ var createMuonEmbeddedConfigSlot = (payload = void 0) => {
 */
 var createMuonBootstrapEmbeddedConfigSlot = (payload = void 0) => {
 	if (payload !== void 0 && payload.length > muonBootstrapEmbeddedConfigPayloadCapacity) throw new Error(`Encoded muon config exceeds the embedded bootstrap slot capacity: ${payload.length} > ${muonBootstrapEmbeddedConfigPayloadCapacity}`);
-	const slot = Buffer.alloc(muonBootstrapEmbeddedConfigSlotSize, 0);
-	muonBootstrapEmbeddedConfigEmptySlotMarker.copy(slot, 0);
-	if (payload === void 0) return slot;
+	if (payload === void 0) {
+		const slot = Buffer.alloc(muonBootstrapEmbeddedConfigSlotSize, 0);
+		muonBootstrapEmbeddedConfigEmptySlotMarker.copy(slot, 0);
+		return slot;
+	}
+	const slot = randomBytes(muonBootstrapEmbeddedConfigSlotSize);
 	Buffer.from(payload).copy(slot, 0);
 	return slot;
 };
@@ -1440,7 +1447,7 @@ var findMuonBootstrapEmbeddedConfigSlot = (content) => {
 	if (candidate === void 0) throw new Error("Embedded muon-bootstrap config slot was not found.");
 	return candidate;
 };
-var fileExists$4 = async (path) => {
+var fileExists$6 = async (path) => {
 	try {
 		return (await stat(path)).isFile();
 	} catch {
@@ -1456,10 +1463,10 @@ var resolveMuonConfigInputPath = async (configPath) => {
 			"muon.json"
 		]) {
 			const candidate = join(directory, fileName);
-			if (await fileExists$4(candidate)) return candidate;
+			if (await fileExists$6(candidate)) return candidate;
 		}
 	}
-	if (!await fileExists$4(configPath)) throw new Error(`muon config does not exist: ${configPath}`);
+	if (!await fileExists$6(configPath)) throw new Error(`muon config does not exist: ${configPath}`);
 	return configPath;
 };
 var readMuonConfigInput = async (configPath) => {
@@ -1662,6 +1669,20 @@ Object.fromEntries(allMuonTargets.map((target) => [targetDescriptors[target].cef
 */
 var getMuonTargetDescriptor = (target) => targetDescriptors[target];
 /**
+* Returns the runtime app identifier embedded for one target distribution.
+*
+* @param appId Base sanitized application identifier.
+* @param target Public Muon target.
+* @returns Target runtime application identifier.
+*
+* @remarks Windows targets append their public architecture name so 32-bit and
+* 64-bit packages do not share runtime state or installer identities.
+*/
+var getMuonTargetRuntimeAppId = (appId, target) => {
+	const descriptor = getMuonTargetDescriptor(target);
+	return descriptor.os === "windows" ? `${appId}.${descriptor.arch}` : appId;
+};
+/**
 * Normalizes a user supplied public Muon target.
 *
 * @param target Target value supplied by the user.
@@ -2110,6 +2131,68 @@ var createIco = (images) => {
 	return Buffer.concat([header, ...imageData]);
 };
 //#endregion
+//#region src/app-icon.ts
+/**
+* ZIP entry used for the generated static application icon asset.
+*/
+var appIconAssetEntryName = "main/.muon/app-icon.png";
+/**
+* Runtime asset URL injected as the generated initial title bar icon.
+*/
+var appIconAssetUrl = "asset://main/.muon/app-icon.png";
+/**
+* Creates a static application icon source from API or CLI options.
+*/
+var createAppIconOptionsSource = (iconPath, directory, label = "iconPath") => {
+	if (iconPath === void 0) return;
+	if (typeof iconPath !== "string") throw new Error(`${label} must be a string when present.`);
+	if (iconPath.trim() === "") return;
+	return {
+		iconPath: iconPath.trim(),
+		directory
+	};
+};
+/**
+* Reads the top-level `iconPath` from a Muon config object.
+*/
+var readConfigAppIconSource = (config, directory, label) => {
+	const value = config.iconPath;
+	if (value === void 0) return;
+	if (typeof value !== "string") throw new Error(`${label} iconPath must be a string when present.`);
+	return createAppIconOptionsSource(value, directory);
+};
+/**
+* Reads the top-level `iconPath` from project metadata.
+*/
+var readProjectAppIconSource = (projectJson, directory) => {
+	const value = projectJson.iconPath;
+	return typeof value === "string" ? createAppIconOptionsSource(value, directory) : void 0;
+};
+/**
+* Resolves and validates the first available static application icon source.
+*/
+var resolveMuonAppIconPath = async (sources) => {
+	for (const source of sources) {
+		const iconPath = resolveResourcePath$2(source.directory, source.iconPath);
+		await assertMuonAppIconPath(iconPath);
+		return iconPath;
+	}
+};
+var assertMuonAppIconPath = async (iconPath) => {
+	if (extname(iconPath).toLowerCase() !== ".png") throw new Error(`Muon app icon must be a .png file: ${iconPath}`);
+	if (!await fileExists$5(iconPath)) throw new Error(`Muon app icon does not exist: ${iconPath}`);
+	await createNormalizedIconPngData(await readFile(iconPath), iconPath, "Muon app icon");
+};
+var resolveResourcePath$2 = (directory, value) => isAbsolute(value) ? value : resolve(directory, value);
+var fileExists$5 = async (path) => {
+	try {
+		await access(path, constants.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+};
+//#endregion
 //#region src/windows-resource.ts
 var defaultLanguage = 1033;
 var defaultCodePage = 1200;
@@ -2135,13 +2218,22 @@ var mergeMuonWindowsResourceOptions = (primary, fallback) => {
 * Resolves Windows resource metadata from options, config files, and package metadata.
 */
 var resolveMuonWindowsResource = async (input) => {
-	const projectJson = await readProjectJson(input.root);
-	const sources = [
+	const projectJson = await readProjectJson$1(input.root);
+	const windowsSources = [
 		createOptionsSource$1(input.options, input.root, "windowsResource"),
 		readConfigWindowsResourceSource(input.muonConfig, input.muonConfigDirectory, "muon.json"),
+		readConfigWindowsResourceSource(projectJson, input.root, "project.json")
+	].filter((source) => source !== void 0);
+	const sources = [
+		...windowsSources,
 		createProjectSource(projectJson, input.root),
 		createPackageSource(input.packageJson, input.root)
 	].filter((source) => source !== void 0);
+	const appIconSources = [
+		createAppIconOptionsSource(input.appIconPath, input.root),
+		readConfigAppIconSource(input.muonConfig, input.muonConfigDirectory, "muon.json"),
+		readProjectAppIconSource(projectJson, input.root)
+	].filter((source) => source !== void 0);
 	const productName = resolveStringField$1(sources, "productName", input.defaults.productName);
 	const fileDescription = resolveStringField$1(sources, "fileDescription", input.defaults.fileDescription);
 	const companyName = resolveStringField$1(sources, "companyName", input.defaults.companyName);
@@ -2151,7 +2243,7 @@ var resolveMuonWindowsResource = async (input) => {
 	const codePage = resolveNumericField(sources, "codePage", defaultCodePage);
 	const fixedVersion = normalizeWindowsVersion(version);
 	return {
-		iconPath: await resolveIconPath$1(sources, await resolveDefaultWindowsIcon(input.packageDirectory)),
+		iconPath: await resolveWindowsIconPath(windowsSources, appIconSources, await resolveDefaultWindowsIcon(input.packageDirectory)),
 		productName,
 		fileDescription,
 		companyName,
@@ -2167,7 +2259,7 @@ var resolveMuonWindowsResource = async (input) => {
 */
 var stripBuildOnlyWindowsResourceConfig = (sourceConfig) => {
 	const sourceWindows = sourceConfig.windows;
-	if (!isJsonObject$3(sourceWindows)) return sourceConfig;
+	if (!isJsonObject$4(sourceWindows)) return sourceConfig;
 	const windowsConfig = {};
 	for (const [key, value] of Object.entries(sourceWindows)) if (key !== "resource") windowsConfig[key] = value;
 	const output = {};
@@ -2188,15 +2280,24 @@ var isWindowsPeExecutable = async (path) => {
 * Applies resolved resource metadata to a Windows PE executable in place.
 */
 var updateWindowsPeResources = async (input) => {
+	return await updateWindowsPeResourceFile(input, createEngraverUpdate);
+};
+/**
+* Applies only resolved icon metadata to a Windows PE executable in place.
+*/
+var updateWindowsPeIconResource = async (input) => {
+	return await updateWindowsPeResourceFile(input, createEngraverIconUpdate);
+};
+var updateWindowsPeResourceFile = async (input, createUpdate) => {
 	if (!await isWindowsPeExecutable(input.executablePath)) return false;
 	const mode = (await stat(input.executablePath)).mode & 511;
 	const tempDirectory = await mkdtemp(join(tmpdir(), "muon-windows-resource-"));
 	const updatesJsonPath = join(tempDirectory, "updates.json");
 	const outputPath = join(tempDirectory, "output.exe");
-	const iconPath = input.resource.iconPath === void 0 ? void 0 : join(tempDirectory, "icon.ico");
+	const iconPath = join(tempDirectory, "icon.ico");
 	try {
-		if (input.resource.iconPath !== void 0 && iconPath !== void 0) await createWindowsIconFromPngFile(input.resource.iconPath, iconPath);
-		await writeFile(updatesJsonPath, `${JSON.stringify(createEngraverUpdate(input.resource, iconPath), null, 2)}\n`);
+		await createWindowsIconFromPngFile(input.resource.iconPath, iconPath);
+		await writeFile(updatesJsonPath, `${JSON.stringify(createUpdate(input.resource, iconPath), null, 2)}\n`);
 		await runMuonPrepareResourceUpdate({
 			inputPath: input.executablePath,
 			updatesJsonPath,
@@ -2237,21 +2338,23 @@ var createEngraverUpdate = (resource, iconPath) => {
 			},
 			strings
 		},
-		icons: iconPath === void 0 ? [] : [{
-			id: 1,
-			language: resource.language,
-			path: iconPath
-		}]
+		icons: createEngraverIcons(resource, iconPath)
 	};
 };
-var readProjectJson = async (root) => {
+var createEngraverIconUpdate = (resource, iconPath) => ({ icons: createEngraverIcons(resource, iconPath) });
+var createEngraverIcons = (resource, iconPath) => [{
+	id: 1,
+	language: resource.language,
+	path: iconPath
+}];
+var readProjectJson$1 = async (root) => {
 	const projectJsonPath = join(root, "project.json");
-	if (!await fileExists$3(projectJsonPath)) return {};
-	return await readJsonObjectFile$1(projectJsonPath, "project.json");
+	if (!await fileExists$4(projectJsonPath)) return {};
+	return await readJsonObjectFile$3(projectJsonPath, "project.json");
 };
-var readJsonObjectFile$1 = async (filePath, label) => {
+var readJsonObjectFile$3 = async (filePath, label) => {
 	const parsed = (0, import_dist.parse)(await readFile(filePath, "utf8"));
-	if (!isJsonObject$3(parsed)) throw new Error(`${label} must contain a JSON object: ${filePath}`);
+	if (!isJsonObject$4(parsed)) throw new Error(`${label} must contain a JSON object: ${filePath}`);
 	return parsed;
 };
 var createOptionsSource$1 = (options, directory, label) => {
@@ -2264,14 +2367,13 @@ var createOptionsSource$1 = (options, directory, label) => {
 var readConfigWindowsResourceSource = (config, directory, label) => {
 	const windows = config.windows;
 	if (windows === void 0) return;
-	if (!isJsonObject$3(windows)) throw new Error(`${label} windows must be an object when present.`);
+	if (!isJsonObject$4(windows)) throw new Error(`${label} windows must be an object when present.`);
 	const resource = windows.resource;
 	if (resource === void 0) return;
 	return createOptionsSource$1(validateWindowsResourceOptions(resource, `${label} windows.resource`), directory, `${label} windows.resource`);
 };
 var createProjectSource = (projectJson, directory) => {
 	const topLevel = {};
-	copyStringField(projectJson, "iconPath", topLevel, "iconPath");
 	copyStringField(projectJson, "productName", topLevel, "productName");
 	copyStringField(projectJson, "name", topLevel, "productName");
 	copyStringField(projectJson, "fileDescription", topLevel, "fileDescription");
@@ -2306,7 +2408,7 @@ var copyStringField = (source, sourceKey, target, targetKey) => {
 	if (typeof value === "string" && value.trim() !== "") target[targetKey] = value.trim();
 };
 var validateWindowsResourceOptions = (value, label) => {
-	if (!isJsonObject$3(value)) throw new Error(`${label} must be an object.`);
+	if (!isJsonObject$4(value)) throw new Error(`${label} must be an object.`);
 	const output = {};
 	copyOptionalStringResourceField(value, "iconPath", output);
 	copyOptionalStringResourceField(value, "productName", output);
@@ -2347,33 +2449,35 @@ var resolveNumericField = (sources, field, fallback) => {
 	}
 	return fallback;
 };
-var resolveIconPath$1 = async (sources, defaultIconPath) => {
-	for (const source of sources) {
+var resolveWindowsIconPath = async (windowsSources, appIconSources, defaultIconPath) => {
+	for (const source of windowsSources) {
 		const value = source.options.iconPath;
 		if (value !== void 0 && value.trim() !== "") {
 			const iconPath = resolveResourcePath$1(source.directory, value);
-			await assertIconPath$1(iconPath, true);
+			await assertIconPath$1(iconPath);
 			return iconPath;
 		}
 	}
-	if (defaultIconPath !== void 0 && await fileExists$3(defaultIconPath)) {
-		await assertIconPath$1(defaultIconPath, false);
-		return defaultIconPath;
-	}
+	const appIconPath = await resolveMuonAppIconPath(appIconSources);
+	if (appIconPath !== void 0) return appIconPath;
+	await assertIconPath$1(defaultIconPath);
+	return defaultIconPath;
 };
-var assertIconPath$1 = async (iconPath, required) => {
+var assertIconPath$1 = async (iconPath) => {
 	if (extname(iconPath).toLowerCase() !== ".png") throw new Error(`Windows resource icon must be a .png file: ${iconPath}`);
-	if (required && !await fileExists$3(iconPath)) throw new Error(`Windows resource icon does not exist: ${iconPath}`);
-	if (await fileExists$3(iconPath)) await createNormalizedMuonIconPngData(await readFile(iconPath), iconPath);
+	if (!await fileExists$4(iconPath)) throw new Error(`Windows resource icon does not exist: ${iconPath}`);
+	await createNormalizedMuonIconPngData(await readFile(iconPath), iconPath);
 };
 var resolveDefaultWindowsIcon = async (packageDirectory) => {
+	const sourceIconPath = join(moduleDirectory$3, "..", "..", "images", "muon-256.png");
 	const candidates = [
-		join(resolve(packageDirectory), "native", "muon-bootstrap.png"),
-		join(moduleDirectory$3, "native", "muon-bootstrap.png"),
-		join(moduleDirectory$3, "..", "dist", "native", "muon-bootstrap.png"),
-		join(moduleDirectory$3, "..", "..", "images", "muon-bootstrap-256.png")
+		join(resolve(packageDirectory), "native", "muon-256.png"),
+		join(moduleDirectory$3, "native", "muon-256.png"),
+		join(moduleDirectory$3, "..", "dist", "native", "muon-256.png"),
+		sourceIconPath
 	];
-	for (const candidate of candidates) if (await fileExists$3(candidate)) return candidate;
+	for (const candidate of candidates) if (await fileExists$4(candidate)) return candidate;
+	return sourceIconPath;
 };
 var resolveResourcePath$1 = (directory, path) => {
 	return isAbsolute(path) ? path : resolve(directory, path);
@@ -2393,12 +2497,12 @@ var normalizeWindowsVersion = (version) => {
 };
 var stringifyAuthor = (value) => {
 	if (typeof value === "string" && value.trim() !== "") return value.trim();
-	if (!isJsonObject$3(value) || typeof value.name !== "string") return;
+	if (!isJsonObject$4(value) || typeof value.name !== "string") return;
 	const name = value.name.trim();
 	if (name === "") return;
 	return value.email === void 0 || typeof value.email !== "string" ? name : `${name} <${value.email}>`;
 };
-var fileExists$3 = async (path) => {
+var fileExists$4 = async (path) => {
 	try {
 		await access(path, constants.F_OK);
 		return true;
@@ -2406,7 +2510,7 @@ var fileExists$3 = async (path) => {
 		return false;
 	}
 };
-var isJsonObject$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isJsonObject$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 //#endregion
 //#region src/linux-desktop.ts
 var defaultIconFileName = "muon-desktop-icon.png";
@@ -2417,14 +2521,20 @@ var moduleDirectory$2 = typeof __dirname === "string" ? __dirname : dirname(file
 * package metadata.
 */
 var resolveMuonLinuxDesktop = async (input) => {
+	const projectJson = await readProjectJson(input.root);
 	const sources = [createOptionsSource(input.options, input.root, "linuxDesktop"), readConfigLinuxDesktopSource(input.muonConfig, input.muonConfigDirectory, "muon.json")].filter((source) => source !== void 0);
+	const appIconSources = [
+		createAppIconOptionsSource(input.appIconPath, input.root),
+		readConfigAppIconSource(input.muonConfig, input.muonConfigDirectory, "muon.json"),
+		readProjectAppIconSource(projectJson, input.root)
+	].filter((source) => source !== void 0);
 	return {
 		desktopId: sanitizeDesktopId(resolveStringField(sources, "desktopId", input.defaults.desktopId)),
 		name: resolveStringField(sources, "name", input.defaults.name),
 		comment: resolveStringField(sources, "comment", input.defaults.comment),
 		categories: resolveCategories(sources, input.defaults.categories),
 		startupNotify: resolveBooleanField(sources, "startupNotify", input.defaults.startupNotify),
-		iconPath: await resolveIconPath(sources, await resolveDefaultLinuxDesktopIcon(input.packageDirectory)),
+		iconPath: await resolveLinuxIconPath(sources, appIconSources, await resolveDefaultLinuxDesktopIcon(input.packageDirectory)),
 		iconFileName: defaultIconFileName,
 		configFileName: defaultDesktopConfigFileName
 	};
@@ -2434,7 +2544,7 @@ var resolveMuonLinuxDesktop = async (input) => {
 */
 var stripBuildOnlyLinuxDesktopConfig = (sourceConfig) => {
 	const sourceLinux = sourceConfig.linux;
-	if (!isJsonObject$2(sourceLinux)) return sourceConfig;
+	if (!isJsonObject$3(sourceLinux)) return sourceConfig;
 	const linuxConfig = {};
 	for (const [key, value] of Object.entries(sourceLinux)) if (key !== "desktop") linuxConfig[key] = value;
 	const output = {};
@@ -2457,6 +2567,16 @@ var writeLinuxDesktopDistributionFiles = async (outputPath, desktop) => {
 		iconFileName: desktop.iconFileName
 	}, void 0, 2)}\n`);
 };
+var readJsonObjectFile$2 = async (filePath, label) => {
+	const parsed = (0, import_dist.parse)(await readFile(filePath, "utf8"));
+	if (!isJsonObject$3(parsed)) throw new Error(`${label} must contain a JSON object: ${filePath}`);
+	return parsed;
+};
+var readProjectJson = async (root) => {
+	const projectJsonPath = join(root, "project.json");
+	if (!await fileExists$3(projectJsonPath)) return {};
+	return await readJsonObjectFile$2(projectJsonPath, "project.json");
+};
 var createOptionsSource = (options, directory, label) => {
 	if (options === void 0) return;
 	return {
@@ -2467,13 +2587,13 @@ var createOptionsSource = (options, directory, label) => {
 var readConfigLinuxDesktopSource = (config, directory, label) => {
 	const linux = config.linux;
 	if (linux === void 0) return;
-	if (!isJsonObject$2(linux)) throw new Error(`${label} linux must be an object when present.`);
+	if (!isJsonObject$3(linux)) throw new Error(`${label} linux must be an object when present.`);
 	const desktop = linux.desktop;
 	if (desktop === void 0) return;
 	return createOptionsSource(validateLinuxDesktopOptions(desktop, `${label} linux.desktop`), directory, `${label} linux.desktop`);
 };
 var validateLinuxDesktopOptions = (value, label) => {
-	if (!isJsonObject$2(value)) throw new Error(`${label} must be an object.`);
+	if (!isJsonObject$3(value)) throw new Error(`${label} must be an object.`);
 	const output = {};
 	copyOptionalStringDesktopField(value, "desktopId", output);
 	copyOptionalStringDesktopField(value, "name", output);
@@ -2519,7 +2639,7 @@ var resolveBooleanField = (sources, field, fallback) => {
 	}
 	return fallback;
 };
-var resolveIconPath = async (sources, defaultIconPath) => {
+var resolveLinuxIconPath = async (sources, appIconSources, defaultIconPath) => {
 	for (const source of sources) {
 		const value = source.options.iconPath;
 		if (value !== void 0 && value.trim() !== "") {
@@ -2528,7 +2648,9 @@ var resolveIconPath = async (sources, defaultIconPath) => {
 			return iconPath;
 		}
 	}
-	if (defaultIconPath !== void 0 && await fileExists$2(defaultIconPath)) {
+	const appIconPath = await resolveMuonAppIconPath(appIconSources);
+	if (appIconPath !== void 0) return appIconPath;
+	if (defaultIconPath !== void 0 && await fileExists$3(defaultIconPath)) {
 		await assertIconPath(defaultIconPath, false);
 		return defaultIconPath;
 	}
@@ -2536,17 +2658,17 @@ var resolveIconPath = async (sources, defaultIconPath) => {
 };
 var assertIconPath = async (iconPath, required) => {
 	if (extname(iconPath).toLowerCase() !== ".png") throw new Error(`Linux desktop icon must be a .png file: ${iconPath}`);
-	if (required && !await fileExists$2(iconPath)) throw new Error(`Linux desktop icon does not exist: ${iconPath}`);
-	if (await fileExists$2(iconPath)) await createNormalizedIconPngData(await readFile(iconPath), iconPath, "Linux desktop icon");
+	if (required && !await fileExists$3(iconPath)) throw new Error(`Linux desktop icon does not exist: ${iconPath}`);
+	if (await fileExists$3(iconPath)) await createNormalizedIconPngData(await readFile(iconPath), iconPath, "Linux desktop icon");
 };
 var resolveDefaultLinuxDesktopIcon = async (packageDirectory) => {
 	const candidates = [
-		join(resolve(packageDirectory), "native", "muon-bootstrap.png"),
-		join(moduleDirectory$2, "native", "muon-bootstrap.png"),
-		join(moduleDirectory$2, "..", "dist", "native", "muon-bootstrap.png"),
-		join(moduleDirectory$2, "..", "..", "images", "muon-bootstrap-256.png")
+		join(resolve(packageDirectory), "native", "muon-256.png"),
+		join(moduleDirectory$2, "native", "muon-256.png"),
+		join(moduleDirectory$2, "..", "dist", "native", "muon-256.png"),
+		join(moduleDirectory$2, "..", "..", "images", "muon-256.png")
 	];
-	for (const candidate of candidates) if (await fileExists$2(candidate)) return candidate;
+	for (const candidate of candidates) if (await fileExists$3(candidate)) return candidate;
 };
 var sanitizeDesktopId = (value) => {
 	const sanitized = value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[.-]+/g, "").replace(/[.-]+$/g, "");
@@ -2555,7 +2677,7 @@ var sanitizeDesktopId = (value) => {
 var resolveResourcePath = (directory, path) => {
 	return isAbsolute(path) ? path : resolve(directory, path);
 };
-var fileExists$2 = async (path) => {
+var fileExists$3 = async (path) => {
 	try {
 		await access(path, constants.F_OK);
 		return true;
@@ -2563,7 +2685,7 @@ var fileExists$2 = async (path) => {
 		return false;
 	}
 };
-var isJsonObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isJsonObject$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 //#endregion
 //#region src/build.ts
 var AdmZip = __resolveDefaultExport(__screwUpDefaultImportModule0, false);
@@ -2586,7 +2708,7 @@ function __resolveDefaultExport(module, isESM) {
 	}
 	return hasDefault ? resolvedDefault ?? module : module;
 }
-var defaultConfigFileNames = [
+var defaultConfigFileNames$1 = [
 	"muon.json5",
 	"muon.jsonc",
 	"muon.json"
@@ -2623,14 +2745,21 @@ var buildMuonApp = async (options = {}) => {
 	const appName = resolveAppName(packageJson, options.appName);
 	const appId = resolveAppId(packageJson, options.appId);
 	const buildConfig = await readBuildConfig(root, options.configPath);
-	const assetInput = resolveAssetInput(root, options.assetSourcePath, options.assetPrefix, buildConfig);
+	const sourceConfig = applyRuntimePluginConfig(buildConfig.config, options.runtimePluginConfig ?? { mode: "simple" });
+	assertNoUserInitialTitleBarIcon(sourceConfig);
+	const resolvedBuildConfig = {
+		...buildConfig,
+		config: sourceConfig
+	};
+	const assetInput = resolveAssetInput(root, options.assetSourcePath, options.assetPrefix, resolvedBuildConfig);
 	const windowsResource = await resolveMuonWindowsResource({
 		root,
 		packageDirectory,
 		packageJson,
-		muonConfig: buildConfig.config,
+		muonConfig: sourceConfig,
 		muonConfigDirectory: buildConfig.directory,
 		options: options.windowsResource,
+		appIconPath: options.iconPath,
 		defaults: {
 			productName: appName,
 			fileDescription: appName,
@@ -2642,9 +2771,10 @@ var buildMuonApp = async (options = {}) => {
 	const linuxDesktop = await resolveMuonLinuxDesktop({
 		root,
 		packageDirectory,
-		muonConfig: buildConfig.config,
+		muonConfig: sourceConfig,
 		muonConfigDirectory: buildConfig.directory,
 		options: options.linuxDesktop,
+		appIconPath: options.iconPath,
 		defaults: {
 			desktopId: appId,
 			name: resolveLinuxDesktopDefaultName(packageJson, appName),
@@ -2664,7 +2794,7 @@ var buildMuonApp = async (options = {}) => {
 			appId,
 			target,
 			assetInput,
-			sourceConfig: buildConfig.config,
+			sourceConfig,
 			windowsResource,
 			linuxDesktop,
 			salt
@@ -2701,8 +2831,8 @@ var normalizeZipPrefix = (prefix) => {
 };
 var readPackageJson = async (root) => {
 	const packageJsonPath = join(root, "package.json");
-	if (!await fileExists$1(packageJsonPath)) return {};
-	return await readJsonObjectFile(packageJsonPath, "package.json");
+	if (!await fileExists$2(packageJsonPath)) return {};
+	return await readJsonObjectFile$1(packageJsonPath, "package.json");
 };
 var resolvePackageName = (packageJson) => {
 	return typeof packageJson.name === "string" ? packageJson.name : defaultAppName;
@@ -2733,14 +2863,27 @@ var readBuildConfig = async (root, configPath) => {
 		directory: root
 	};
 	return {
-		config: await readJsonObjectFile(resolvedConfigPath, "Muon config file"),
+		config: await readJsonObjectFile$1(resolvedConfigPath, "Muon config file"),
 		directory: dirname(resolvedConfigPath)
 	};
 };
+var applyRuntimePluginConfig = (sourceConfig, runtimePluginConfig) => {
+	if (runtimePluginConfig === void 0) return sourceConfig;
+	const sourcePlugin = sourceConfig.plugin;
+	if (sourcePlugin !== void 0 && !isJsonObject$2(sourcePlugin)) throw new Error("muon.json plugin must be an object when runtime plugin config is applied.");
+	const plugin = sourcePlugin ?? {};
+	return {
+		...sourceConfig,
+		plugin: {
+			...plugin,
+			...runtimePluginConfig
+		}
+	};
+};
 var readConfigAssetSourcePath = (sourceConfig) => {
 	const sourceAsset = sourceConfig.asset;
 	if (sourceAsset === void 0) return;
-	if (!isJsonObject$1(sourceAsset)) throw new Error("muon.json asset must be an object when present.");
+	if (!isJsonObject$2(sourceAsset)) throw new Error("muon.json asset must be an object when present.");
 	const sourceAssetPath = sourceAsset.sourcePath;
 	if (sourceAssetPath === void 0) return;
 	if (typeof sourceAssetPath !== "string") throw new Error("muon.json asset.sourcePath must be a string when present.");
@@ -2749,28 +2892,28 @@ var readConfigAssetSourcePath = (sourceConfig) => {
 var resolveConfigPath = async (root, configPath) => {
 	if (configPath !== void 0) {
 		const resolvedPath = resolve(root, configPath);
-		if (await fileExists$1(resolvedPath)) return resolvedPath;
+		if (await fileExists$2(resolvedPath)) return resolvedPath;
 		throw new Error(`Muon config file does not exist: ${resolvedPath}`);
 	}
-	for (const fileName of defaultConfigFileNames) {
+	for (const fileName of defaultConfigFileNames$1) {
 		const candidatePath = join(root, fileName);
-		if (await fileExists$1(candidatePath)) return candidatePath;
+		if (await fileExists$2(candidatePath)) return candidatePath;
 	}
 };
-var readJsonObjectFile = async (filePath, label) => {
+var readJsonObjectFile$1 = async (filePath, label) => {
 	let content;
 	try {
 		content = await readFile(filePath, "utf8");
 	} catch (error) {
-		throw new Error(`${label} could not be read: ${filePath}: ${getErrorMessage$1(error)}`);
+		throw new Error(`${label} could not be read: ${filePath}: ${getErrorMessage$3(error)}`);
 	}
 	let parsed;
 	try {
 		parsed = (0, import_dist.parse)(content);
 	} catch (error) {
-		throw new Error(`${label} could not be parsed: ${filePath}: ${getErrorMessage$1(error)}`);
+		throw new Error(`${label} could not be parsed: ${filePath}: ${getErrorMessage$3(error)}`);
 	}
-	if (!isJsonObject$1(parsed)) throw new Error(`${label} must contain a JSON object: ${filePath}`);
+	if (!isJsonObject$2(parsed)) throw new Error(`${label} must contain a JSON object: ${filePath}`);
 	return parsed;
 };
 var buildMuonTarget = async (input) => {
@@ -2780,6 +2923,8 @@ var buildMuonTarget = async (input) => {
 	const outputPath = join(input.outputRoot, descriptor.distributionDirectoryName);
 	const launcherPath = join(outputPath, getLauncherFileName(input.appName, descriptor));
 	const assetZipPath = join(outputPath, "assets.zip");
+	const runtimeAppId = getMuonTargetRuntimeAppId(input.appId, input.target);
+	const appIconPath = descriptor.os === "windows" ? input.windowsResource.iconPath : input.linuxDesktop.iconPath;
 	await verifyTargetInputs({
 		sourceRuntimePath,
 		sourceBootstrapPath,
@@ -2798,8 +2943,11 @@ var buildMuonTarget = async (input) => {
 	await chmod(join(outputPath, descriptor.runtimeExecutableName), executableMode);
 	await copyFile(sourceBootstrapPath, launcherPath);
 	await chmod(launcherPath, executableMode);
-	const asset = await writeAssetArchive(input.assetInput, assetZipPath, input.salt);
-	const embeddedConfig = createEmbeddedConfig(input.sourceConfig, asset, input.appId, input.linuxDesktop.desktopId);
+	const asset = await writeAssetArchive(input.assetInput, assetZipPath, input.salt, [{
+		name: appIconAssetEntryName,
+		data: await readFile(appIconPath)
+	}]);
+	const embeddedConfig = createEmbeddedConfig(input.sourceConfig, asset, runtimeAppId, input.linuxDesktop.desktopId, appIconAssetUrl);
 	await withTemporaryConfig(embeddedConfig, async (configPath) => {
 		await embedMuonConfigInRuntime({
 			runtimePath: outputPath,
@@ -2812,19 +2960,27 @@ var buildMuonTarget = async (input) => {
 			outputPath: void 0
 		});
 	});
-	if (descriptor.os === "windows") await updateWindowsPeResources({
-		executablePath: launcherPath,
-		resource: input.windowsResource,
-		environment: process.env,
-		cwd: input.root
-	});
-	else if (descriptor.os === "linux") await writeLinuxDesktopDistributionFiles(outputPath, input.linuxDesktop);
+	if (descriptor.os === "windows") {
+		await updateWindowsPeIconResource({
+			executablePath: join(outputPath, descriptor.runtimeExecutableName),
+			resource: input.windowsResource,
+			environment: process.env,
+			cwd: input.root
+		});
+		await updateWindowsPeResources({
+			executablePath: launcherPath,
+			resource: input.windowsResource,
+			environment: process.env,
+			cwd: input.root
+		});
+	} else if (descriptor.os === "linux") await writeLinuxDesktopDistributionFiles(outputPath, input.linuxDesktop);
 	return {
 		target: input.target,
 		distributionDirectoryName: descriptor.distributionDirectoryName,
 		outputPath,
 		launcherPath,
 		asset,
+		runtimeAppId,
 		embeddedConfig,
 		...descriptor.os === "linux" ? { linuxDesktop: input.linuxDesktop } : {}
 	};
@@ -2847,10 +3003,10 @@ var copyRuntimeFiles = async (sourceRuntimePath, outputPath, descriptor) => {
 	}
 	await copyFile(join(sourceRuntimePath, muonLicenseFileName), join(outputPath, muonLicenseFileName));
 };
-var writeAssetArchive = async (input, outputPath, salt) => {
+var writeAssetArchive = async (input, outputPath, salt, extraEntries) => {
 	const sourceStats = await statOrUndefined(input.sourcePath);
 	if (sourceStats === void 0) throw new Error(`Muon asset source does not exist: ${input.sourcePath}`);
-	const archive = sourceStats.isDirectory() ? await createAssetArchiveFromDirectory(input) : sourceStats.isFile() ? await readFile(input.sourcePath) : void 0;
+	const archive = sourceStats.isDirectory() ? await createAssetArchiveFromDirectory(input, extraEntries) : sourceStats.isFile() ? await createAssetArchiveFromZipFile(input.sourcePath, extraEntries) : void 0;
 	if (archive === void 0) throw new Error(`Muon asset source is not a directory or file: ${input.sourcePath}`);
 	await writeFile(outputPath, archive);
 	return {
@@ -2860,10 +3016,30 @@ var writeAssetArchive = async (input, outputPath, salt) => {
 		entryCount: sourceStats.isDirectory() ? readZipEntryCount(archive, outputPath) : readZipEntryCount(archive, input.sourcePath)
 	};
 };
-var createAssetArchiveFromDirectory = async (input) => {
+var createAssetArchiveFromDirectory = async (input, extraEntries) => {
 	const entries = await collectZipEntries(input.sourcePath, input.prefix);
 	if (entries.length === 0) throw new Error(`Muon asset source has no files: ${input.sourcePath}`);
-	return createZipArchive(entries);
+	return createZipArchive(appendZipEntries(entries, extraEntries));
+};
+var createAssetArchiveFromZipFile = async (sourcePath, extraEntries) => {
+	const zip = new AdmZip(await readFile(sourcePath));
+	for (const entry of extraEntries) {
+		assertSafeZipEntryName(entry.name);
+		if (zip.getEntry(entry.name) !== null) throw new Error(`Muon app icon asset entry already exists: ${entry.name}`);
+		zip.addFile(entry.name, entry.data);
+	}
+	return zip.toBuffer();
+};
+var appendZipEntries = (entries, extraEntries) => {
+	const output = [...entries];
+	const names = new Set(entries.map((entry) => entry.name));
+	for (const entry of extraEntries) {
+		assertSafeZipEntryName(entry.name);
+		if (names.has(entry.name)) throw new Error(`Muon app icon asset entry already exists: ${entry.name}`);
+		names.add(entry.name);
+		output.push(entry);
+	}
+	return output;
 };
 var readZipEntryCount = (archive, sourcePath) => {
 	const endSignature = 101010256;
@@ -2901,13 +3077,20 @@ var createZipArchive = (entries) => {
 	for (const entry of entries) zip.addFile(entry.name, entry.data);
 	return zip.toBuffer();
 };
-var createEmbeddedConfig = (sourceConfig, asset, appId, desktopId) => {
+var createEmbeddedConfig = (sourceConfig, asset, appId, desktopId, initialTitleBarIcon) => {
 	const sourceAsset = sourceConfig.asset;
-	if (sourceAsset !== void 0 && !isJsonObject$1(sourceAsset)) throw new Error("muon.json asset must be an object when present.");
+	if (sourceAsset !== void 0 && !isJsonObject$2(sourceAsset)) throw new Error("muon.json asset must be an object when present.");
 	const sourceBootstrap = sourceConfig.bootstrap;
-	if (sourceBootstrap !== void 0 && !isJsonObject$1(sourceBootstrap)) throw new Error("muon.json bootstrap must be an object when present.");
+	if (sourceBootstrap !== void 0 && !isJsonObject$2(sourceBootstrap)) throw new Error("muon.json bootstrap must be an object when present.");
+	const runtimeConfig = stripBuildOnlyAppIconConfig(stripBuildOnlyLinuxDesktopConfig(stripBuildOnlyWindowsResourceConfig(sourceConfig)));
+	const sourceBrowser = runtimeConfig.browser;
+	if (sourceBrowser !== void 0 && !isJsonObject$2(sourceBrowser)) throw new Error("muon.json browser must be an object when present.");
 	return {
-		...stripBuildOnlyLinuxDesktopConfig(stripBuildOnlyWindowsResourceConfig(sourceConfig)),
+		...runtimeConfig,
+		browser: {
+			...sourceBrowser ?? {},
+			initialTitleBarIcon
+		},
 		asset: {
 			...sourceAsset ?? {},
 			sourcePath: appConfigSourcePath,
@@ -2921,6 +3104,17 @@ var createEmbeddedConfig = (sourceConfig, asset, appId, desktopId) => {
 		}
 	};
 };
+var assertNoUserInitialTitleBarIcon = (sourceConfig) => {
+	const sourceBrowser = sourceConfig.browser;
+	if (sourceBrowser === void 0) return;
+	if (!isJsonObject$2(sourceBrowser)) throw new Error("muon.json browser must be an object when present.");
+	if (sourceBrowser.initialTitleBarIcon !== void 0) throw new Error("muon.json browser.initialTitleBarIcon is generated by muon build; use top-level iconPath instead.");
+};
+var stripBuildOnlyAppIconConfig = (sourceConfig) => {
+	const output = {};
+	for (const [key, value] of Object.entries(sourceConfig)) if (key !== "iconPath") output[key] = value;
+	return output;
+};
 var withTemporaryConfig = async (config, callback) => {
 	const tempDirectory = await mkdtemp(join(tmpdir(), "muon-build-config-"));
 	const configPath = join(tempDirectory, "muon.json");
@@ -2949,7 +3143,7 @@ var statOrUndefined = async (path) => {
 		return;
 	}
 };
-var fileExists$1 = async (path) => {
+var fileExists$2 = async (path) => {
 	try {
 		await access(path, constants.F_OK);
 		return true;
@@ -2957,10 +3151,415 @@ var fileExists$1 = async (path) => {
 		return false;
 	}
 };
-var isJsonObject$1 = (value) => {
+var isJsonObject$2 = (value) => {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 };
-var getErrorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
+var getErrorMessage$3 = (error) => error instanceof Error ? error.message : String(error);
+//#endregion
+//#region src/capability.ts
+var virtualModulePrefix = "\0muon-capability:";
+var moduleNamePattern = /^[A-Za-z_$][A-Za-z0-9_$]*:[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)*$/u;
+var jsIdentifierPattern = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
+var normalizePath = (path) => (path.split("?")[0] ?? "").replaceAll("\\", "/");
+var hashCapabilityRule = (index, rule) => `cap-${createHash("sha1").update(JSON.stringify({
+	index,
+	pluginName: rule.pluginName,
+	sources: [...rule.sources ?? []],
+	packages: [...rule.packages ?? []],
+	allow: [...rule.allow]
+})).digest("hex").slice(0, 16)}`;
+var parseCapabilitySpecifier = (source) => {
+	if (!moduleNamePattern.test(source)) return;
+	const separator = source.indexOf(":");
+	return {
+		moduleName: source,
+		namespace: `${source.slice(0, separator)}.${source.slice(separator + 1)}`
+	};
+};
+var escapeRegExp = (source) => source.replace(/[\\^$+?.()|[\]{}]/gu, "\\$&");
+var globToRegExp = (glob, separator) => {
+	let source = "^";
+	for (let index = 0; index < glob.length; index += 1) {
+		const current = glob[index] ?? "";
+		const next = glob[index + 1];
+		if (current === "*" && next === "*") {
+			source += ".*";
+			index += 1;
+			continue;
+		}
+		if (current === "*") {
+			source += `[^${escapeRegExp(separator)}]*`;
+			continue;
+		}
+		source += escapeRegExp(current);
+	}
+	source += "$";
+	return new RegExp(source, "u");
+};
+var isGlobMatch = (glob, value, separator) => globToRegExp(glob, separator).test(value);
+var toRootRelativeImporter = (root, importer) => normalizePath(relative(root, importer));
+var readPackageName = (packageJsonPath) => {
+	try {
+		const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && typeof parsed.name === "string" ? parsed.name : void 0;
+	} catch {
+		return;
+	}
+};
+var getImporterPackageName = (root, importer) => {
+	const normalizedRoot = normalizePath(root);
+	const rootPackageJsonPath = join(root, "package.json");
+	let directory = dirname(normalizePath(importer));
+	for (;;) {
+		const packageJsonPath = join(directory, "package.json");
+		if (packageJsonPath !== rootPackageJsonPath && existsSync(packageJsonPath)) return readPackageName(packageJsonPath);
+		if (normalizePath(directory) === normalizedRoot) return;
+		const parent = dirname(directory);
+		if (parent === directory) return;
+		directory = parent;
+	}
+};
+var matchesCapabilityRuleImporter = (rule, root, importer) => {
+	const relativeImporter = toRootRelativeImporter(root, importer);
+	if (rule.sources?.some((pattern) => isGlobMatch(normalizePath(pattern), relativeImporter, "/")) ?? false) return true;
+	const packageName = getImporterPackageName(root, importer);
+	return packageName === void 0 ? false : rule.packages?.includes(packageName) ?? false;
+};
+var hasNamespaceFunctionAllow = (namespace, allow) => allow.some((entry) => {
+	if (entry.startsWith(`${namespace}.`)) return true;
+	return isGlobMatch(entry, `${namespace}.placeholder`, ".");
+});
+var getExactExportName = (namespace, functionPath) => {
+	const prefix = `${namespace}.`;
+	if (!functionPath.startsWith(prefix)) return;
+	const name = functionPath.slice(prefix.length);
+	if (!jsIdentifierPattern.test(name)) return;
+	return name;
+};
+var getExportedFunctions = (namespace, allow) => allow.flatMap((functionPath) => {
+	const exportName = getExactExportName(namespace, functionPath);
+	return exportName === void 0 ? [] : [[exportName, functionPath]];
+});
+var createRuleRuntimeEntry = (rule, index) => ({
+	id: hashCapabilityRule(index, rule),
+	allow: [...rule.allow]
+});
+var validateCapabilityRule = (rule) => {
+	if ((rule.sources === void 0 || rule.sources.length === 0) && (rule.packages === void 0 || rule.packages.length === 0)) throw new Error("Muon capability import rule requires sources or packages.");
+};
+var createModuleVirtualId = (rule) => `${virtualModulePrefix}${rule.index}:${rule.moduleName}`;
+var parseModuleVirtualId = (id) => {
+	if (!id.startsWith(virtualModulePrefix)) return;
+	const payload = id.slice(17);
+	const separator = payload.indexOf(":");
+	if (separator <= 0) return;
+	const index = Number.parseInt(payload.slice(0, separator), 10);
+	if (!Number.isInteger(index) || index < 0) return;
+	return {
+		index,
+		moduleName: payload.slice(separator + 1)
+	};
+};
+var createExecutorSpawnExport = (capabilityId, functionPath) => `export const spawn = async (options = {}) => {
+  const source = await __muonCall(${JSON.stringify(capabilityId)}, ${JSON.stringify(functionPath)}, [JSON.stringify(options ?? {})]);
+  return JSON.parse(source);
+};`;
+var createGenericFunctionExport = (exportName, capabilityId, functionPath) => `export const ${exportName} = async (...args) =>
+  await __muonCall(${JSON.stringify(capabilityId)}, ${JSON.stringify(functionPath)}, args);`;
+var createModuleSource = (rule) => {
+	const exportedFunctions = getExportedFunctions(rule.namespace, rule.rule.allow);
+	if (exportedFunctions.length === 0) throw new Error(`Muon capability import has no exact function exports: ${rule.moduleName}`);
+	return `const __muonCall = globalThis.__muon_plugin_call;
+if (typeof __muonCall !== "function") {
+  throw new Error("Muon plugin capability bridge is not available.");
+}
+
+${exportedFunctions.map(([exportName, functionPath]) => rule.namespace === "muon.executor" && exportName === "spawn" ? createExecutorSpawnExport(rule.id, functionPath) : createGenericFunctionExport(exportName, rule.id, functionPath)).join("\n\n")}
+`;
+};
+/**
+* Creates a capability virtual module resolver for a bundler adapter.
+*
+* @param root Bundler project root.
+* @param options Capability import options.
+*/
+var createMuonCapabilityModuleResolver = (root, options) => {
+	const rules = [...options?.imports ?? []];
+	for (const rule of rules) validateCapabilityRule(rule);
+	const runtimeEntries = rules.map((rule, index) => createRuleRuntimeEntry(rule, index));
+	const resolveRule = (source, importer) => {
+		const parsed = parseCapabilitySpecifier(source);
+		if (parsed === void 0) return;
+		if (!rules.some((rule) => hasNamespaceFunctionAllow(parsed.namespace, rule.allow))) return;
+		if (importer === void 0) throw new Error(`Muon capability import is not allowed without an importer: ${source}`);
+		const relativeImporter = toRootRelativeImporter(root, importer);
+		for (let index = 0; index < rules.length; index += 1) {
+			const rule = rules[index];
+			if (rule === void 0 || !matchesCapabilityRuleImporter(rule, root, importer) || !hasNamespaceFunctionAllow(parsed.namespace, rule.allow)) continue;
+			return {
+				index,
+				id: runtimeEntries[index]?.id ?? hashCapabilityRule(index, rule),
+				rule,
+				namespace: parsed.namespace,
+				moduleName: parsed.moduleName
+			};
+		}
+		throw new Error(`Muon capability import is not allowed: ${source} from ${relativeImporter}`);
+	};
+	return {
+		resolveId: (source, importer) => {
+			const rule = resolveRule(source, importer);
+			return rule === void 0 ? void 0 : { id: createModuleVirtualId(rule) };
+		},
+		load: (id) => {
+			const parsed = parseModuleVirtualId(id);
+			if (parsed === void 0) return;
+			const source = parseCapabilitySpecifier(parsed.moduleName);
+			const rule = rules[parsed.index];
+			const runtimeEntry = runtimeEntries[parsed.index];
+			if (source === void 0 || rule === void 0 || runtimeEntry === void 0) return;
+			return createModuleSource({
+				index: parsed.index,
+				id: runtimeEntry.id,
+				rule,
+				namespace: source.namespace,
+				moduleName: source.moduleName
+			});
+		},
+		getRuntimePluginConfig: () => ({
+			mode: "validate",
+			capabilities: runtimeEntries
+		})
+	};
+};
+//#endregion
+//#region src/plugin-access.ts
+var defaultConfigFileNames = [
+	"muon.json5",
+	"muon.jsonc",
+	"muon.json"
+];
+var defaultPluginPages = ["asset://main/**"];
+var isJsonObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
+var isSha1HexString = (value) => value.length === 40 && /^[0-9a-fA-F]+$/.test(value);
+var isHexByteString = (value) => value.length % 2 === 0 && /^[0-9a-fA-F]*$/.test(value);
+var getErrorMessage$2 = (error) => error instanceof Error ? error.message : String(error);
+var fileExists$1 = async (path) => {
+	try {
+		await access(path, constants.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+};
+var resolveMuonConfigPath = async (root, configPath) => {
+	if (configPath !== void 0) {
+		const resolvedPath = resolve(root, configPath);
+		if (await fileExists$1(resolvedPath)) return resolvedPath;
+		throw new Error(`Muon config file does not exist: ${resolvedPath}`);
+	}
+	for (const fileName of defaultConfigFileNames) {
+		const candidatePath = join(root, fileName);
+		if (await fileExists$1(candidatePath)) return candidatePath;
+	}
+};
+var readJsonObjectFile = async (path, label) => {
+	let content;
+	try {
+		content = await readFile(path, "utf8");
+	} catch (error) {
+		throw new Error(`${label} could not be read: ${path}: ${getErrorMessage$2(error)}`);
+	}
+	let parsed;
+	try {
+		parsed = (0, import_dist.parse)(content);
+	} catch (error) {
+		throw new Error(`${label} could not be parsed: ${path}: ${getErrorMessage$2(error)}`);
+	}
+	if (!isJsonObject$1(parsed)) throw new Error(`${label} must contain a JSON object: ${path}`);
+	return parsed;
+};
+var readOptionalStringArray = (object, key, configPath) => {
+	const value = object[key];
+	if (value === void 0) return;
+	if (!isStringArray(value)) throw new Error(`muon.json ${configPath} must be an array of strings.`);
+	return value;
+};
+var readPluginAccessImportOptions = (value, configPath) => {
+	if (!isJsonObject$1(value)) throw new Error(`muon.json ${configPath} must be an object.`);
+	const sources = readOptionalStringArray(value, "sources", `${configPath}.sources`);
+	const packages = readOptionalStringArray(value, "packages", `${configPath}.packages`);
+	const allow = readOptionalStringArray(value, "allow", `${configPath}.allow`);
+	const options = {};
+	if (sources !== void 0) options.sources = sources;
+	if (packages !== void 0) options.packages = packages;
+	if (allow !== void 0) options.allow = allow;
+	return options;
+};
+var readPluginAccessEntryOptions = (value, index) => {
+	const configPath = `plugin.plugins[${index}]`;
+	if (!isJsonObject$1(value)) throw new Error(`muon.json ${configPath} must be an object.`);
+	if (typeof value.name !== "string") throw new Error(`muon.json ${configPath}.name must be a string.`);
+	if (value.signature !== void 0) {
+		if (typeof value.signature !== "string") throw new Error(`muon.json ${configPath}.signature must be a string.`);
+		if (!isSha1HexString(value.signature)) throw new Error(`muon.json ${configPath}.signature must be a 40-character SHA-1 hex string.`);
+	}
+	if (value.salt !== void 0) {
+		if (typeof value.salt !== "string") throw new Error(`muon.json ${configPath}.salt must be a string.`);
+		if (!isHexByteString(value.salt)) throw new Error(`muon.json ${configPath}.salt must be a hexadecimal byte string.`);
+	}
+	const allow = readOptionalStringArray(value, "allow", `${configPath}.allow`);
+	const rawImports = value.imports;
+	if (rawImports !== void 0 && !Array.isArray(rawImports)) throw new Error(`muon.json ${configPath}.imports must be an array.`);
+	const imports = rawImports === void 0 ? void 0 : rawImports.map((entry, importIndex) => readPluginAccessImportOptions(entry, `${configPath}.imports[${importIndex}]`));
+	const options = { name: value.name };
+	if (value.signature !== void 0) options.signature = value.signature;
+	if (value.salt !== void 0) options.salt = value.salt;
+	if (allow !== void 0) options.allow = allow;
+	if (imports !== void 0) options.imports = imports;
+	return options;
+};
+var readPluginAccessOptions = (config) => {
+	const browser = config.browser;
+	if (isJsonObject$1(browser) && browser.plugin !== void 0) throw new Error("muon.json browser.plugin is no longer supported; use plugin.mode and plugin.pages instead.");
+	const plugin = config.plugin;
+	if (plugin === void 0) return {};
+	if (!isJsonObject$1(plugin)) throw new Error("muon.json plugin must be an object.");
+	const options = {};
+	if (plugin.path !== void 0) {
+		if (typeof plugin.path !== "string") throw new Error("muon.json plugin.path must be a string.");
+		if (plugin.path.length === 0) throw new Error("muon.json plugin.path must not be empty.");
+		options.path = plugin.path;
+	}
+	if (plugin.mode !== void 0) {
+		if (typeof plugin.mode !== "string") throw new Error("muon.json plugin.mode must be a string.");
+		if (plugin.mode.length === 0) throw new Error("muon.json plugin.mode must not be empty.");
+		if (plugin.mode !== "simple" && plugin.mode !== "validate") throw new Error("muon.json plugin.mode has unknown value.");
+		options.mode = plugin.mode;
+	}
+	const pages = readOptionalStringArray(plugin, "pages", "plugin.pages");
+	if (pages !== void 0) options.pages = pages;
+	const rawPlugins = plugin.plugins;
+	if (rawPlugins !== void 0) {
+		if (!Array.isArray(rawPlugins)) throw new Error("muon.json plugin.plugins must be an array.");
+		options.plugins = rawPlugins.map((entry, index) => readPluginAccessEntryOptions(entry, index));
+	}
+	return options;
+};
+var hasImportSourceSelector = (entry) => entry.sources !== void 0 && entry.sources.length > 0 || entry.packages !== void 0 && entry.packages.length > 0;
+var validatePluginAccessOptions = (resolved) => {
+	for (const [pluginIndex, plugin] of resolved.plugins.entries()) {
+		const pluginPath = `plugin.plugins[${pluginIndex}]`;
+		if (plugin.name === "internal" && plugin.signature !== void 0) throw new Error(`muon.json ${pluginPath}.signature is not supported for internal plugins.`);
+		if (plugin.name === "internal" && plugin.salt !== void 0) throw new Error(`muon.json ${pluginPath}.salt is not supported for internal plugins.`);
+		if (plugin.signature !== void 0 && plugin.salt === void 0) throw new Error(`muon.json ${pluginPath}.signature requires ${pluginPath}.salt.`);
+		if (resolved.mode === "validate") {
+			if (plugin.allow !== void 0) throw new Error(`muon.json ${pluginPath}.allow is only supported in simple mode; use ${pluginPath}.imports[].allow in validate mode.`);
+			if (plugin.imports === void 0) throw new Error(`muon.json ${pluginPath}.imports is required in validate mode.`);
+			if (plugin.imports.length === 0) throw new Error(`muon.json ${pluginPath}.imports must not be empty in validate mode.`);
+			for (const [importIndex, entry] of plugin.imports.entries()) {
+				const importPath = `${pluginPath}.imports[${importIndex}]`;
+				if (!hasImportSourceSelector(entry)) throw new Error(`muon.json ${importPath} requires sources or packages.`);
+				if (entry.allow === void 0) throw new Error(`muon.json ${importPath}.allow is required in validate mode.`);
+				if (entry.allow.length === 0) throw new Error(`muon.json ${importPath}.allow must not be empty in validate mode.`);
+			}
+			continue;
+		}
+		if (plugin.allow === void 0) throw new Error(`muon.json ${pluginPath}.allow is required in simple mode.`);
+		if (plugin.imports !== void 0) throw new Error(`muon.json ${pluginPath}.imports is only supported in validate mode.`);
+	}
+	return resolved;
+};
+var getValidateImportAllow = (entry, pluginIndex, importIndex) => {
+	if (entry.allow === void 0 || entry.allow.length === 0) throw new Error(`muon.json plugin.plugins[${pluginIndex}].imports[${importIndex}].allow is required in validate mode.`);
+	return entry.allow;
+};
+var getSimplePluginAllow = (plugin, pluginIndex) => {
+	if (plugin.allow === void 0) throw new Error(`muon.json plugin.plugins[${pluginIndex}].allow is required in simple mode.`);
+	return plugin.allow;
+};
+var toCapabilityImports = (plugins) => plugins.flatMap((plugin, pluginIndex) => (plugin.imports ?? []).map((entry, importIndex) => {
+	if (!hasImportSourceSelector(entry)) throw new Error(`muon.json plugin.plugins[${pluginIndex}].imports[${importIndex}] requires sources or packages.`);
+	const rule = {
+		allow: getValidateImportAllow(entry, pluginIndex, importIndex),
+		pluginName: plugin.name
+	};
+	if (entry.sources !== void 0) rule.sources = entry.sources;
+	if (entry.packages !== void 0) rule.packages = entry.packages;
+	return rule;
+}));
+var toValidateRuntimePluginEntries = (plugins) => plugins.map((plugin, pluginIndex) => {
+	const allow = [];
+	const seenAllow = /* @__PURE__ */ new Set();
+	for (const [importIndex, entry] of (plugin.imports ?? []).entries()) for (const functionPath of getValidateImportAllow(entry, pluginIndex, importIndex)) if (!seenAllow.has(functionPath)) {
+		seenAllow.add(functionPath);
+		allow.push(functionPath);
+	}
+	return {
+		name: plugin.name,
+		...plugin.signature === void 0 ? {} : { signature: plugin.signature },
+		...plugin.salt === void 0 ? {} : { salt: plugin.salt },
+		allow
+	};
+});
+var toSimpleRuntimePluginEntries = (plugins) => plugins.map((plugin, pluginIndex) => ({
+	name: plugin.name,
+	...plugin.signature === void 0 ? {} : { signature: plugin.signature },
+	...plugin.salt === void 0 ? {} : { salt: plugin.salt },
+	allow: [...getSimplePluginAllow(plugin, pluginIndex)]
+}));
+var shouldOverlayRuntimePlugins = (resolved, override) => override !== false && (override?.plugins !== void 0 || resolved.mode === "validate" && resolved.plugins.length > 0);
+var toRuntimePluginEntries = (resolved) => resolved.mode === "validate" ? toValidateRuntimePluginEntries(resolved.plugins) : toSimpleRuntimePluginEntries(resolved.plugins);
+var mergePluginAccessOptions = (base, override) => ({
+	...override?.path === void 0 ? {} : { path: override.path },
+	mode: override?.mode ?? base.mode ?? "validate",
+	pages: override?.pages ?? base.pages ?? defaultPluginPages,
+	plugins: override?.plugins ?? base.plugins ?? []
+});
+var createRuntimeOverlay = (root, resolved, override) => {
+	if (override === false) return {};
+	const path = override?.path !== void 0 ? resolve(root, override.path) : void 0;
+	const plugins = shouldOverlayRuntimePlugins(resolved, override) ? toRuntimePluginEntries(resolved) : void 0;
+	return {
+		pages: resolved.pages,
+		...path === void 0 ? {} : { path },
+		...plugins === void 0 ? {} : { plugins }
+	};
+};
+/**
+* Resolves public plugin access config from muon.json and Vite overrides.
+*
+* @param input Resolution inputs.
+* @returns Effective plugin access config for bundler integrations.
+*/
+var resolveMuonPluginAccessOptions = async ({ root, configPath, pluginAccess, onConfigReadError }) => {
+	const resolvedConfigPath = await resolveMuonConfigPath(root, configPath);
+	let base = {};
+	if (resolvedConfigPath !== void 0) try {
+		base = readPluginAccessOptions(await readJsonObjectFile(resolvedConfigPath, "Muon config file"));
+	} catch (error) {
+		if (onConfigReadError === void 0) throw error;
+		onConfigReadError(error);
+	}
+	if (pluginAccess === false) {
+		const resolved = validatePluginAccessOptions(mergePluginAccessOptions(base, { mode: "simple" }));
+		return {
+			mode: "simple",
+			pages: resolved.pages,
+			capabilityOptions: { imports: [] },
+			runtimeOverlay: createRuntimeOverlay(root, resolved, pluginAccess)
+		};
+	}
+	const resolved = validatePluginAccessOptions(mergePluginAccessOptions(base, pluginAccess));
+	const capabilityOptions = { imports: resolved.mode === "validate" ? toCapabilityImports(resolved.plugins) : [] };
+	return {
+		mode: resolved.mode,
+		pages: resolved.pages,
+		capabilityOptions,
+		runtimeOverlay: createRuntimeOverlay(root, resolved, pluginAccess)
+	};
+};
 //#endregion
 //#region src/gitignore.ts
 var muonGitignoreEntries = [
@@ -3124,7 +3723,7 @@ var getWebSocketOrigin = (startUrl) => {
 	else if (url.protocol === "http:") url.protocol = "ws:";
 	return url.origin;
 };
-var createMuonOverrideConfig = (startUrl, enableDebugger) => {
+var createMuonOverrideConfig = (startUrl, enableDebugger, runtimePluginConfig) => {
 	const origin = new URL(startUrl).origin;
 	return {
 		...enableDebugger ? { cdp: { enable: true } } : {},
@@ -3133,19 +3732,22 @@ var createMuonOverrideConfig = (startUrl, enableDebugger) => {
 			...enableDebugger ? { keybind: {
 				devtools: "f12",
 				recycle: "ctrl+f12"
-			} } : {},
-			plugin: { allow: [`${origin}/**`] }
+			} } : {}
+		},
+		plugin: {
+			...runtimePluginConfig,
+			pages: [`${origin}/**`]
 		},
 		network: { allow: [`${origin}/**`, `${getWebSocketOrigin(startUrl)}/**`] }
 	};
 };
-var writeMuonOverrideConfig = (server, overrideConfigPath, enableDebugger) => {
+var writeMuonOverrideConfig = (server, overrideConfigPath, pluginOptions, getRuntimePluginConfig) => {
 	const startUrl = getBaseUrl(server);
 	if (startUrl === void 0) {
 		server.config.logger.warn("Muon Vite plugin could not resolve a Vite URL.");
 		return false;
 	}
-	writeFileSync(overrideConfigPath, `${JSON.stringify(createMuonOverrideConfig(startUrl, enableDebugger), null, 2)}\n`);
+	writeFileSync(overrideConfigPath, `${JSON.stringify(createMuonOverrideConfig(startUrl, pluginOptions.enableDebugger !== false, getRuntimePluginConfig()), null, 2)}\n`);
 	return true;
 };
 var createRuntimePaths = async (server, stagePath, platform, projectConfigPath) => {
@@ -3167,7 +3769,7 @@ var fileExists = async (path) => {
 	}
 };
 var isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var getErrorMessage = (error) => error instanceof Error ? error.message : String(error);
+var getErrorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
 var resolveProjectConfigPath = async (server) => {
 	for (const fileName of defaultProjectConfigFileNames) {
 		const candidatePath = join(server.config.root, fileName);
@@ -3176,7 +3778,7 @@ var resolveProjectConfigPath = async (server) => {
 			if (!isJsonObject((0, import_dist.parse)(await readFile(candidatePath, "utf8")))) throw new Error("muon config root must be an object");
 			return candidatePath;
 		} catch (error) {
-			server.config.logger.warn(`Muon project config will be ignored because it could not be read or parsed: ${candidatePath}: ${getErrorMessage(error)}`);
+			server.config.logger.warn(`Muon project config will be ignored because it could not be read or parsed: ${candidatePath}: ${getErrorMessage$1(error)}`);
 			return;
 		}
 	}
@@ -3204,11 +3806,11 @@ var launchMuon = (paths, platform, server) => {
 		windowsHide: false
 	});
 	child.once("error", (error) => {
-		server.config.logger.warn(`Muon startup failed: ${getErrorMessage(error)}`);
+		server.config.logger.warn(`Muon startup failed: ${getErrorMessage$1(error)}`);
 	});
 	child.unref();
 };
-var startMuonViteBrowserBridge = async ({ server, pluginOptions, platform, architecture, environment }) => {
+var startMuonViteBrowserBridge = async ({ server, pluginOptions, getRuntimePluginConfig, platform, architecture, environment }) => {
 	await ensureMuonGitignoreEntry(server.config.root);
 	if (pluginOptions.open === false || server.httpServer === null) return;
 	const target = getDefaultMuonPrepareTarget(platform, architecture);
@@ -3254,7 +3856,7 @@ var startMuonViteBrowserBridge = async ({ server, pluginOptions, platform, archi
 		cleanup();
 	});
 	server.httpServer.once("listening", () => {
-		if (writeMuonOverrideConfig(server, paths.overrideConfigPath, pluginOptions.enableDebugger !== false)) launchMuon(paths, platform, server);
+		if (writeMuonOverrideConfig(server, paths.overrideConfigPath, pluginOptions, getRuntimePluginConfig)) launchMuon(paths, platform, server);
 	});
 };
 //#endregion
@@ -3281,6 +3883,7 @@ var attachMuonVitePluginOptions = (plugin, options) => {
 };
 //#endregion
 //#region src/vite.ts
+var getErrorMessage = (error) => error instanceof Error ? error.message : String(error);
 /**
 * Creates a Vite plugin that launches Muon during Vite dev startup.
 *
@@ -3290,19 +3893,33 @@ var attachMuonVitePluginOptions = (plugin, options) => {
 */
 var muon = (options = {}) => {
 	let resolvedConfig = void 0;
+	let capabilityResolver = void 0;
+	let resolvedPluginAccess = void 0;
 	return attachMuonVitePluginOptions({
 		name: "muon",
 		config: (config) => {
 			if (config.server?.watch === null) return null;
 			return { server: { watch: createMuonWatchOptions(config.server?.watch) } };
 		},
-		configResolved: (config) => {
+		configResolved: async (config) => {
 			resolvedConfig = config;
+			resolvedPluginAccess = await resolveMuonPluginAccessOptions({
+				root: config.root,
+				configPath: resolveMuonConfigPathForViteCommand(config, options),
+				pluginAccess: options.pluginAccess,
+				...config.command === "serve" ? { onConfigReadError: (error) => {
+					config.logger.warn(`Muon project config will be ignored because it could not be read or parsed: ${getErrorMessage(error)}`);
+				} } : {}
+			});
+			capabilityResolver = resolvedPluginAccess.mode === "validate" ? createMuonCapabilityModuleResolver(config.root, resolvedPluginAccess.capabilityOptions) : void 0;
 		},
+		resolveId: (source, importer) => capabilityResolver?.resolveId(source, importer)?.id,
+		load: (id) => capabilityResolver?.load(id),
 		configureServer: async (server) => {
 			await startMuonViteBrowserBridge({
 				server,
 				pluginOptions: options,
+				getRuntimePluginConfig: () => resolveMuonRuntimePluginConfig(capabilityResolver, resolvedPluginAccess),
 				platform: process.platform,
 				architecture: process.arch,
 				environment: process.env
@@ -3313,7 +3930,7 @@ var muon = (options = {}) => {
 			if (process.env["MUON_SUPPRESS_VITE_MUON_BUILD"] === "1") return;
 			if (options.build === false) return;
 			const buildOptions = typeof options.build === "object" ? options.build : {};
-			await buildMuonApp(createMuonBuildOptions(resolvedConfig, buildOptions));
+			await buildMuonApp(createMuonBuildOptions(resolvedConfig, buildOptions, resolveMuonRuntimePluginConfig(capabilityResolver, resolvedPluginAccess)));
 		}
 	}, options);
 };
@@ -3330,7 +3947,7 @@ var createMuonWatchOptions = (watch) => ({
 	...watch ?? {},
 	ignored: mergeMuonWatchIgnored(watch?.ignored)
 });
-var createMuonBuildOptions = (config, buildOptions) => {
+var createMuonBuildOptions = (config, buildOptions, runtimePluginConfig) => {
 	const outDir = isAbsolute(config.build.outDir) ? config.build.outDir : resolve(config.root, config.build.outDir);
 	const options = {
 		root: config.root,
@@ -3343,12 +3960,28 @@ var createMuonBuildOptions = (config, buildOptions) => {
 	if (buildOptions.appId !== void 0) options.appId = buildOptions.appId;
 	if (buildOptions.outputRoot !== void 0) options.outputRoot = buildOptions.outputRoot;
 	if (buildOptions.configPath !== void 0) options.configPath = buildOptions.configPath;
+	if (buildOptions.iconPath !== void 0) options.iconPath = buildOptions.iconPath;
 	if (buildOptions.windowsResource !== void 0) options.windowsResource = buildOptions.windowsResource;
 	if (buildOptions.linuxDesktop !== void 0) options.linuxDesktop = buildOptions.linuxDesktop;
 	if (buildOptions.packageDirectory !== void 0) options.packageDirectory = buildOptions.packageDirectory;
 	if (buildOptions.assetSalt !== void 0) options.assetSalt = buildOptions.assetSalt;
+	options.runtimePluginConfig = runtimePluginConfig;
 	return options;
 };
+var resolveMuonConfigPathForViteCommand = (config, options) => {
+	if (config.command !== "build" || typeof options.build !== "object") return;
+	return options.build.configPath;
+};
+var resolveMuonRuntimePluginConfig = (capabilityResolver, pluginAccess) => pluginAccess?.mode === "simple" ? {
+	mode: "simple",
+	...pluginAccess.runtimeOverlay
+} : {
+	...capabilityResolver?.getRuntimePluginConfig() ?? {
+		mode: "validate",
+		capabilities: []
+	},
+	...pluginAccess?.runtimeOverlay ?? {}
+};
 //#endregion
 export { muon as default };