web-extend-plugin-vue2 0.2.1 → 0.2.2

package/dist/index.cjs

@@ -65,115 +65,490 @@ const defaultWebExtendPluginRuntime = {
   bridgeAllowedPathPrefixes: ['/api/']
 };
 
-function getDefaultExportFromCjs (x) {
-	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
-}
-
-var re = {exports: {}};
+/**
+ * 不依赖 `import.meta`，兼容 Webpack 4/5、Vue CLI、Vite、Rspack 等宿主。
+ * - Webpack / Vue CLI：依赖构建时注入的 `process.env`（如 `VUE_APP_*`、`DefinePlugin` 注入的 `VITE_*`）。
+ * - Vite：在入口调用 `setWebExtendPluginEnv(import.meta.env)`，或 `installWebExtendPluginVue2(..., { env: import.meta.env })`。
+ * - 也可在入口前设置 `globalThis.__WEP_ENV__ = import.meta.env`（与 setWebExtendPluginEnv 二选一即可）。
+ *
+ * @module bundled-env
+ */
 
-var constants;
-var hasRequiredConstants;
+/** @type {Record<string, unknown> | null} */
+let _explicitEnv = null;
 
-function requireConstants () {
-	if (hasRequiredConstants) return constants;
-	hasRequiredConstants = 1;
+/**
+ * 显式注入与 `import.meta.env` 同形态的对象（推荐 Vite 宿主在入口调用一次）。
+ * @param {Record<string, unknown> | null | undefined} env
+ */
+function setWebExtendPluginEnv(env) {
+  _explicitEnv = env && typeof env === 'object' ? env : null;
+}
 
-	// Note: this is the semver.org version of the spec that it implements
-	// Not necessarily the package version of this code.
-	const SEMVER_SPEC_VERSION = '2.0.0';
+/**
+ * @returns {Record<string, unknown> | null}
+ */
+function getInjectedEnvObject() {
+  if (_explicitEnv) {
+    return _explicitEnv
+  }
+  try {
+    const g = typeof globalThis !== 'undefined' ? globalThis : undefined;
+    if (g && g.__WEP_ENV__ && typeof g.__WEP_ENV__ === 'object') {
+      return g.__WEP_ENV__
+    }
+  } catch (_) {}
+  return null
+}
 
-	const MAX_LENGTH = 256;
-	const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER ||
-	/* istanbul ignore next */ 9007199254740991;
+/**
+ * 从注入环境读取字符串配置键（`VITE_*` / `PLUGIN_*` 等）。
+ * @param {string} key
+ * @returns {string|undefined}
+ */
+function readInjectedEnvKey(key) {
+  const o = getInjectedEnvObject();
+  if (!o || !(key in o)) {
+    return undefined
+  }
+  const v = o[key];
+  if (v === undefined || v === '') {
+    return undefined
+  }
+  return String(v)
+}
 
-	// Max safe segment length for coercion.
-	const MAX_SAFE_COMPONENT_LENGTH = 16;
+/**
+ * @returns {boolean}
+ */
+function readInjectedEnvDev() {
+  const o = getInjectedEnvObject();
+  return !!(o && o.DEV === true)
+}
 
-	// Max safe length for a build identifier. The max length minus 6 characters for
-	// the shortest version with a build 0.0.0+BUILD.
-	const MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6;
+/**
+ * 从注入环境与 `process.env` 解析 VITE_/PLUGIN_ 键。
+ * @module runtime/env-resolve
+ */
 
-	const RELEASE_TYPES = [
-	  'major',
-	  'premajor',
-	  'minor',
-	  'preminor',
-	  'patch',
-	  'prepatch',
-	  'prerelease',
-	];
+/**
+ * @param {string} key
+ * @returns {string|undefined}
+ */
+function readProcessEnv(key) {
+  try {
+    if (typeof process !== 'undefined' && process.env && key in process.env) {
+      const v = process.env[key];
+      if (v !== undefined && v !== '') {
+        return String(v)
+      }
+    }
+  } catch (_) {}
+  return undefined
+}
 
-	constants = {
-	  MAX_LENGTH,
-	  MAX_SAFE_COMPONENT_LENGTH,
-	  MAX_SAFE_BUILD_LENGTH,
-	  MAX_SAFE_INTEGER,
-	  RELEASE_TYPES,
-	  SEMVER_SPEC_VERSION,
-	  FLAG_INCLUDE_PRERELEASE: 0b001,
-	  FLAG_LOOSE: 0b010,
-	};
-	return constants;
+/**
+ * @param {string} viteStyleKey
+ * @returns {string|null}
+ */
+function viteKeyToPluginAlternate(viteStyleKey) {
+  if (typeof viteStyleKey !== 'string' || !viteStyleKey.startsWith('VITE_')) {
+    return null
+  }
+  return `PLUGIN_${viteStyleKey.slice(5)}`
 }
 
-var debug_1;
-var hasRequiredDebug;
+/**
+ * @param {string} key
+ * @param {string} [fallback='']
+ */
+function resolveBundledEnv(key, fallback = '') {
+  const alt = viteKeyToPluginAlternate(key);
+  const inj = readInjectedEnvKey(key);
+  const fromInjected =
+    inj === undefined || inj === null ? (alt ? readInjectedEnvKey(alt) : undefined) : inj;
+  const proc = readProcessEnv(key);
+  const fromProcess =
+    proc === undefined || proc === null ? (alt ? readProcessEnv(alt) : undefined) : proc;
+  const first = fromInjected === undefined || fromInjected === null ? fromProcess : fromInjected;
+  return first === undefined || first === null ? fallback : first
+}
 
-function requireDebug () {
-	if (hasRequiredDebug) return debug_1;
-	hasRequiredDebug = 1;
+/**
+ * @returns {boolean}
+ */
+function resolveBundledIsDev() {
+  try {
+    if (readInjectedEnvDev()) {
+      return true
+    }
+  } catch (_) {}
+  try {
+    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV === 'development') {
+      return true
+    }
+  } catch (_) {}
+  return false
+}
 
-	const debug = (
-	  typeof process === 'object' &&
-	  process.env &&
-	  process.env.NODE_DEBUG &&
-	  /\bsemver\b/i.test(process.env.NODE_DEBUG)
-	) ? (...args) => console.error('SEMVER', ...args)
-	  : () => {};
+/**
+ * 路径与脚本主机名校验工具。
+ * @module runtime/path-host-utils
+ */
 
-	debug_1 = debug;
-	return debug_1;
+/**
+ * @param {string} p
+ */
+function ensureLeadingPath(p) {
+  const t = String(p || '').trim();
+  if (!t) {
+    return '/'
+  }
+  return t.startsWith('/') ? t : `/${t}`
 }
 
-var hasRequiredRe;
+/**
+ * @param {string} hostname
+ */
+function normalizeHost(hostname) {
+  if (!hostname) {
+    return ''
+  }
+  const h = hostname.toLowerCase();
+  if (h.startsWith('[') && h.endsWith(']')) {
+    return h.slice(1, -1)
+  }
+  return h
+}
 
-function requireRe () {
-	if (hasRequiredRe) return re.exports;
-	hasRequiredRe = 1;
-	(function (module, exports$1) {
+/**
+ * @param {string[]} hostnames
+ * @returns {Set<string>}
+ */
+function buildAllowedScriptHostsSet(hostnames) {
+  const s = new Set();
+  for (const h of hostnames) {
+    const n = normalizeHost(h);
+    if (n) {
+      s.add(n);
+    }
+  }
+  return s
+}
 
-		const {
-		  MAX_SAFE_COMPONENT_LENGTH,
-		  MAX_SAFE_BUILD_LENGTH,
-		  MAX_LENGTH,
-		} = requireConstants();
-		const debug = requireDebug();
-		exports$1 = module.exports = {};
+/**
+ * @param {string} url
+ * @param {Set<string>} hostSet
+ */
+function isScriptHostAllowed(url, hostSet) {
+  if (typeof window === 'undefined') {
+    return false
+  }
+  try {
+    const u = new URL(url, window.location.origin);
+    const h = normalizeHost(u.hostname);
+    return hostSet.has(h)
+  } catch {
+    return false
+  }
+}
 
-		// The actual regexps go on exports.re
-		const re = exports$1.re = [];
-		const safeRe = exports$1.safeRe = [];
-		const src = exports$1.src = [];
-		const safeSrc = exports$1.safeSrc = [];
-		const t = exports$1.t = {};
-		let R = 0;
+/**
+ * 合并用户、环境与默认配置得到运行时选项。
+ * @module runtime/resolve-runtime-options
+ */
 
-		const LETTERDASHNUMBER = '[a-zA-Z0-9-]';
 
-		// Replace some greedy regex tokens to prevent regex dos issues. These regex are
-		// used internally via the safeRe object since all inputs in this library get
-		// normalized first to trim and collapse all extra whitespace. The original
-		// regexes are exported for userland consumption and lower level usage. A
-		// future breaking change could export the safer regex only with a note that
-		// all input should have extra whitespace removed.
-		const safeRegexReplacements = [
-		  ['\\s', 1],
-		  ['\\d', MAX_LENGTH],
-		  [LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH],
-		];
+const DEF = defaultWebExtendPluginRuntime;
 
-		const makeSafeRegex = (value) => {
-		  for (const [token, max] of safeRegexReplacements) {
+/**
+ * @param {string|undefined} userVal
+ * @param {string} envKey
+ * @param {RequestCredentials} fallback
+ */
+function resolveManifestCredentials(userVal, envKey, fallback) {
+  if (userVal !== undefined && userVal !== '') {
+    const s = String(userVal);
+    if (s === 'include' || s === 'omit' || s === 'same-origin') {
+      return s
+    }
+  }
+  const e = resolveBundledEnv(envKey, '');
+  if (e === 'include' || e === 'omit' || e === 'same-origin') {
+    return e
+  }
+  return fallback
+}
+
+/**
+ * @param {number|undefined} userVal
+ * @param {string} envKey
+ * @param {number} fallback
+ */
+function resolvePositiveInt(userVal, envKey, fallback) {
+  if (typeof userVal === 'number' && Number.isFinite(userVal) && userVal > 0) {
+    return Math.floor(userVal)
+  }
+  const raw = resolveBundledEnv(envKey, '');
+  const n = raw ? parseInt(raw, 10) : NaN;
+  if (Number.isFinite(n) && n > 0) {
+    return n
+  }
+  return fallback
+}
+
+/**
+ * 合并用户、环境变量与 `defaultWebExtendPluginRuntime`，得到完整运行时选项（宿主可只传需要覆盖的字段）。
+ * @param {WebExtendPluginRuntimeOptions} [user]
+ * @returns {object}
+ */
+function resolveRuntimeOptions$1(user = {}) {
+  const manifestBaseRaw =
+    user.manifestBase !== undefined && user.manifestBase !== ''
+      ? String(user.manifestBase)
+      : resolveBundledEnv('VITE_FRONTEND_PLUGIN_BASE', DEF.manifestBase) || DEF.manifestBase;
+
+  const manifestListPath = ensureLeadingPath(
+    user.manifestListPath !== undefined && user.manifestListPath !== ''
+      ? user.manifestListPath
+      : resolveBundledEnv('VITE_WEB_PLUGIN_MANIFEST_PATH', DEF.manifestListPath)
+  );
+
+  const defaultImplicitDevPluginIds = Array.isArray(user.defaultImplicitDevPluginIds)
+    ? user.defaultImplicitDevPluginIds.map(String).filter(Boolean)
+    : (() => {
+        const e = resolveBundledEnv('VITE_WEB_PLUGIN_IMPLICIT_DEV_IDS', '');
+        if (e) {
+          return e
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean)
+        }
+        return [...DEF.defaultImplicitDevPluginIds]
+      })();
+
+  const allowedScriptHosts =
+    Array.isArray(user.allowedScriptHosts) && user.allowedScriptHosts.length > 0
+      ? user.allowedScriptHosts.map((h) => normalizeHost(String(h))).filter(Boolean)
+      : (() => {
+          const e = resolveBundledEnv('VITE_WEB_PLUGIN_ALLOWED_SCRIPT_HOSTS', '');
+          if (e) {
+            return e
+              .split(',')
+              .map((s) => normalizeHost(s.trim()))
+              .filter(Boolean)
+          }
+          return [...DEF.allowedScriptHosts]
+        })();
+
+  const bridgeAllowedPathPrefixes =
+    Array.isArray(user.bridgeAllowedPathPrefixes) && user.bridgeAllowedPathPrefixes.length > 0
+      ? user.bridgeAllowedPathPrefixes.map((p) => ensureLeadingPath(p)).filter(Boolean)
+      : (() => {
+          const e = resolveBundledEnv('VITE_WEB_PLUGIN_BRIDGE_PREFIXES', '');
+          if (e) {
+            return e
+              .split(',')
+              .map((s) => ensureLeadingPath(s.trim()))
+              .filter(Boolean)
+          }
+          return [...DEF.bridgeAllowedPathPrefixes]
+        })();
+
+  return {
+    manifestBase: manifestBaseRaw.replace(/\/$/, '') || DEF.manifestBase.replace(/\/$/, ''),
+    manifestListPath,
+    manifestFetchCredentials: resolveManifestCredentials(
+      user.manifestFetchCredentials,
+      'VITE_WEB_PLUGIN_MANIFEST_CREDENTIALS',
+      DEF.manifestFetchCredentials
+    ),
+    isDev: user.isDev !== undefined ? user.isDev : resolveBundledIsDev(),
+    webPluginDevOrigin:
+      user.webPluginDevOrigin !== undefined ? user.webPluginDevOrigin : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_ORIGIN', ''),
+    webPluginDevIds:
+      user.webPluginDevIds !== undefined ? user.webPluginDevIds : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_IDS', ''),
+    webPluginDevMapJson:
+      user.webPluginDevMapJson !== undefined
+        ? user.webPluginDevMapJson
+        : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_MAP', ''),
+    webPluginDevEntryPath: ensureLeadingPath(
+      user.webPluginDevEntryPath !== undefined && user.webPluginDevEntryPath !== ''
+        ? user.webPluginDevEntryPath
+        : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_ENTRY', DEF.webPluginDevEntryPath)
+    ),
+    devPingPath: ensureLeadingPath(
+      user.devPingPath !== undefined && user.devPingPath !== ''
+        ? user.devPingPath
+        : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_PING_PATH', DEF.devPingPath)
+    ),
+    devReloadSsePath: ensureLeadingPath(
+      user.devReloadSsePath !== undefined && user.devReloadSsePath !== ''
+        ? user.devReloadSsePath
+        : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_SSE_PATH', DEF.devReloadSsePath)
+    ),
+    devPingTimeoutMs: resolvePositiveInt(user.devPingTimeoutMs, 'VITE_WEB_PLUGIN_DEV_PING_TIMEOUT_MS', DEF.devPingTimeoutMs),
+    defaultImplicitDevPluginIds,
+    allowedScriptHosts,
+    bridgeAllowedPathPrefixes,
+    bootstrapSummary: user.bootstrapSummary,
+    ...(typeof user.fetchManifest === 'function' ? { fetchManifest: user.fetchManifest } : {})
+  }
+}
+
+/**
+ * 默认清单 HTTP 拉取（未配置 `fetchManifest` 时）。
+ * @module runtime/default-fetch-manifest
+ */
+
+/**
+ * @typedef {object} FetchWebPluginManifestContext
+ * @property {string} manifestUrl
+ * @property {RequestCredentials} credentials
+ */
+
+/**
+ * @typedef {object} FetchWebPluginManifestResult
+ * @property {boolean} ok
+ * @property {number} [status]
+ * @property {{ hostPluginApiVersion?: string, plugins?: object[] }|null} [data]
+ * @property {unknown} [error]
+ */
+
+/**
+ * @callback FetchWebPluginManifestFn
+ * @param {FetchWebPluginManifestContext} ctx
+ * @returns {Promise<FetchWebPluginManifestResult>}
+ */
+
+/**
+ * 默认清单请求（未配置 `fetchManifest` 时）。
+ * @param {FetchWebPluginManifestContext} ctx
+ * @returns {Promise<FetchWebPluginManifestResult>}
+ */
+async function defaultFetchWebPluginManifest$1(ctx) {
+  const { manifestUrl, credentials } = ctx;
+  try {
+    const res = await fetch(manifestUrl, { credentials });
+    if (!res.ok) {
+      return { ok: false, status: res.status, data: null }
+    }
+    const data = await res.json();
+    return { ok: true, data }
+  } catch (e) {
+    return { ok: false, error: e, data: null }
+  }
+}
+
+function getDefaultExportFromCjs (x) {
+	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
+}
+
+var re = {exports: {}};
+
+var constants;
+var hasRequiredConstants;
+
+function requireConstants () {
+	if (hasRequiredConstants) return constants;
+	hasRequiredConstants = 1;
+
+	// Note: this is the semver.org version of the spec that it implements
+	// Not necessarily the package version of this code.
+	const SEMVER_SPEC_VERSION = '2.0.0';
+
+	const MAX_LENGTH = 256;
+	const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER ||
+	/* istanbul ignore next */ 9007199254740991;
+
+	// Max safe segment length for coercion.
+	const MAX_SAFE_COMPONENT_LENGTH = 16;
+
+	// Max safe length for a build identifier. The max length minus 6 characters for
+	// the shortest version with a build 0.0.0+BUILD.
+	const MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6;
+
+	const RELEASE_TYPES = [
+	  'major',
+	  'premajor',
+	  'minor',
+	  'preminor',
+	  'patch',
+	  'prepatch',
+	  'prerelease',
+	];
+
+	constants = {
+	  MAX_LENGTH,
+	  MAX_SAFE_COMPONENT_LENGTH,
+	  MAX_SAFE_BUILD_LENGTH,
+	  MAX_SAFE_INTEGER,
+	  RELEASE_TYPES,
+	  SEMVER_SPEC_VERSION,
+	  FLAG_INCLUDE_PRERELEASE: 0b001,
+	  FLAG_LOOSE: 0b010,
+	};
+	return constants;
+}
+
+var debug_1;
+var hasRequiredDebug;
+
+function requireDebug () {
+	if (hasRequiredDebug) return debug_1;
+	hasRequiredDebug = 1;
+
+	const debug = (
+	  typeof process === 'object' &&
+	  process.env &&
+	  process.env.NODE_DEBUG &&
+	  /\bsemver\b/i.test(process.env.NODE_DEBUG)
+	) ? (...args) => console.error('SEMVER', ...args)
+	  : () => {};
+
+	debug_1 = debug;
+	return debug_1;
+}
+
+var hasRequiredRe;
+
+function requireRe () {
+	if (hasRequiredRe) return re.exports;
+	hasRequiredRe = 1;
+	(function (module, exports$1) {
+
+		const {
+		  MAX_SAFE_COMPONENT_LENGTH,
+		  MAX_SAFE_BUILD_LENGTH,
+		  MAX_LENGTH,
+		} = requireConstants();
+		const debug = requireDebug();
+		exports$1 = module.exports = {};
+
+		// The actual regexps go on exports.re
+		const re = exports$1.re = [];
+		const safeRe = exports$1.safeRe = [];
+		const src = exports$1.src = [];
+		const safeSrc = exports$1.safeSrc = [];
+		const t = exports$1.t = {};
+		let R = 0;
+
+		const LETTERDASHNUMBER = '[a-zA-Z0-9-]';
+
+		// Replace some greedy regex tokens to prevent regex dos issues. These regex are
+		// used internally via the safeRe object since all inputs in this library get
+		// normalized first to trim and collapse all extra whitespace. The original
+		// regexes are exported for userland consumption and lower level usage. A
+		// future breaking change could export the safer regex only with a note that
+		// all input should have extra whitespace removed.
+		const safeRegexReplacements = [
+		  ['\\s', 1],
+		  ['\\d', MAX_LENGTH],
+		  [LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH],
+		];
+
+		const makeSafeRegex = (value) => {
+		  for (const [token, max] of safeRegexReplacements) {
 		    value = value
 		      .split(`${token}*`).join(`${token}{0,${max}}`)
 		      .split(`${token}+`).join(`${token}{1,${max}}`);
@@ -2778,395 +3153,31 @@ function requireSemver () {
 	  SemVer,
 	  re: internalRe.re,
 	  src: internalRe.src,
-	  tokens: internalRe.t,
-	  SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
-	  RELEASE_TYPES: constants.RELEASE_TYPES,
-	  compareIdentifiers: identifiers.compareIdentifiers,
-	  rcompareIdentifiers: identifiers.rcompareIdentifiers,
-	};
-	return semver$1;
-}
-
-var semverExports = requireSemver();
-var semver = /*@__PURE__*/getDefaultExportFromCjs(semverExports);
-
-/**
- * 不依赖 `import.meta`，兼容 Webpack 4/5、Vue CLI、Vite、Rspack 等宿主。
- * - Webpack / Vue CLI：依赖构建时注入的 `process.env`（如 `VUE_APP_*`、`DefinePlugin` 注入的 `VITE_*`）。
- * - Vite：在入口调用 `setWebExtendPluginEnv(import.meta.env)`，或 `installWebExtendPluginVue2(..., { env: import.meta.env })`。
- * - 也可在入口前设置 `globalThis.__WEP_ENV__ = import.meta.env`（与 setWebExtendPluginEnv 二选一即可）。
- *
- * @module bundled-env
- */
-
-/** @type {Record<string, unknown> | null} */
-let _explicitEnv = null;
-
-/**
- * 显式注入与 `import.meta.env` 同形态的对象（推荐 Vite 宿主在入口调用一次）。
- * @param {Record<string, unknown> | null | undefined} env
- */
-function setWebExtendPluginEnv(env) {
-  _explicitEnv = env && typeof env === 'object' ? env : null;
-}
-
-/**
- * @returns {Record<string, unknown> | null}
- */
-function getInjectedEnvObject() {
-  if (_explicitEnv) {
-    return _explicitEnv
-  }
-  try {
-    const g = typeof globalThis !== 'undefined' ? globalThis : undefined;
-    if (g && g.__WEP_ENV__ && typeof g.__WEP_ENV__ === 'object') {
-      return g.__WEP_ENV__
-    }
-  } catch (_) {}
-  return null
-}
-
-/**
- * 从注入环境读取字符串配置键（`VITE_*` / `PLUGIN_*` 等）。
- * @param {string} key
- * @returns {string|undefined}
- */
-function readInjectedEnvKey(key) {
-  const o = getInjectedEnvObject();
-  if (!o || !(key in o)) {
-    return undefined
-  }
-  const v = o[key];
-  if (v === undefined || v === '') {
-    return undefined
-  }
-  return String(v)
-}
-
-/**
- * @returns {boolean}
- */
-function readInjectedEnvDev() {
-  const o = getInjectedEnvObject();
-  return !!(o && o.DEV === true)
-}
-
-/**
- * 与 `plugin-web-starter`（WebPluginsResponse）返回的 `hostPluginApiVersion` 保持一致，用于契约校验。
- * @type {string}
- */
-const HOST_PLUGIN_API_VERSION = '1.0.0';
-
-/**
- * 宿主侧插件引导：拉取清单、dev 映射、加载入口脚本、调用 activator。
- * 路径与白名单等默认值见 `defaultWebExtendPluginRuntime`，可通过 `resolveRuntimeOptions` / 环境变量覆盖。
- *
- * **Webpack 宿主**：用 `DefinePlugin` 注入 `process.env.VITE_*` 或 **`PLUGIN_*`**（等价键），或 `resolveRuntimeOptions` 显式传参。
- * **Vite 宿主**：入口调用 `setWebExtendPluginEnv(import.meta.env)`，或 `installWebExtendPluginVue2(..., { env: import.meta.env })`。
- *
- * @module PluginRuntime
- */
-
-const DEF = defaultWebExtendPluginRuntime;
-
-/**
- * @typedef {object} WebExtendPluginRuntimeOptions
- * @property {string} [manifestBase] 清单服务 URL 前缀
- * @property {string} [manifestListPath] 清单接口路径（以 `/` 开头），拼在 manifestBase 后
- * @property {RequestCredentials} [manifestFetchCredentials] 清单 fetch 的 credentials
- * @property {boolean} [isDev] 开发模式
- * @property {string} [webPluginDevOrigin] 插件 dev origin
- * @property {string} [webPluginDevIds] 逗号分隔 id，隐式 dev 映射
- * @property {string} [webPluginDevMapJson] 显式 dev 映射 JSON
- * @property {string} [webPluginDevEntryPath] 隐式 dev 入口路径（相对插件 dev origin）
- * @property {string} [devPingPath] dev 存活探测路径
- * @property {string} [devReloadSsePath] dev 热更新 SSE 路径
- * @property {number} [devPingTimeoutMs] 探测超时
- * @property {string[]} [defaultImplicitDevPluginIds] 无 `webPluginDevIds`/env 时用于隐式 dev 的 id；包内默认 `[]`
- * @property {string[]} [allowedScriptHosts] 允许加载脚本的主机名
- * @property {string[]} [bridgeAllowedPathPrefixes] bridge.request 白名单前缀
- * @property {boolean} [bootstrapSummary] bootstrap 结束是否打印摘要
- */
-
-/**
- * 从 Webpack `DefinePlugin` 等注入的 `process.env` 读取。
- * @param {string} key
- * @returns {string|undefined}
- */
-function readProcessEnv(key) {
-  try {
-    if (typeof process !== 'undefined' && process.env && key in process.env) {
-      const v = process.env[key];
-      if (v !== undefined && v !== '') {
-        return String(v)
-      }
-    }
-  } catch (_) {}
-  return undefined
-}
-
-/**
- * `VITE_*` 的并列命名：同值可读 `PLUGIN_*`（`VITE_WEB_PLUGIN_X` → `PLUGIN_WEB_PLUGIN_X`）。
- * Vite 需在 `defineConfig({ envPrefix: ['VITE_', 'PLUGIN_'] })` 中暴露 `PLUGIN_`；Webpack 用 DefinePlugin 注入即可。
- * @param {string} viteStyleKey 以 `VITE_` 开头的键名
- * @returns {string|null}
- */
-function viteKeyToPluginAlternate(viteStyleKey) {
-  if (typeof viteStyleKey !== 'string' || !viteStyleKey.startsWith('VITE_')) {
-    return null
-  }
-  return `PLUGIN_${viteStyleKey.slice(5)}`
-}
-
-/**
- * 先读注入环境（`setWebExtendPluginEnv` / `__WEP_ENV__`）中的 `VITE_*` 与并列 `PLUGIN_*`，再读 `process.env`，最后 `fallback`。
- * @param {string} key 仍以 `VITE_*` 为逻辑名（与文档一致）
- * @param {string} [fallback='']
- */
-function resolveBundledEnv(key, fallback = '') {
-  const alt = viteKeyToPluginAlternate(key);
-  const inj = readInjectedEnvKey(key);
-  const fromInjected =
-    inj === undefined || inj === null ? (alt ? readInjectedEnvKey(alt) : undefined) : inj;
-  const proc = readProcessEnv(key);
-  const fromProcess =
-    proc === undefined || proc === null ? (alt ? readProcessEnv(alt) : undefined) : proc;
-  const first = fromInjected === undefined || fromInjected === null ? fromProcess : fromInjected;
-  return first === undefined || first === null ? fallback : first
-}
-
-/**
- * @returns {boolean}
- */
-function resolveBundledIsDev() {
-  try {
-    if (readInjectedEnvDev()) {
-      return true
-    }
-  } catch (_) {}
-  try {
-    if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV === 'development') {
-      return true
-    }
-  } catch (_) {}
-  return false
-}
-
-/**
- * @param {string} p
- */
-function ensureLeadingPath(p) {
-  const t = String(p || '').trim();
-  if (!t) {
-    return '/'
-  }
-  return t.startsWith('/') ? t : `/${t}`
-}
-
-/**
- * 解析 `include` | `omit` | `same-origin`，非法时回退默认值。
- * @param {string|undefined} userVal
- * @param {string} envKey
- * @param {RequestCredentials} fallback
- */
-function resolveManifestCredentials(userVal, envKey, fallback) {
-  if (userVal !== undefined && userVal !== '') {
-    const s = String(userVal);
-    if (s === 'include' || s === 'omit' || s === 'same-origin') {
-      return s
-    }
-  }
-  const e = resolveBundledEnv(envKey, '');
-  if (e === 'include' || e === 'omit' || e === 'same-origin') {
-    return e
-  }
-  return fallback
-}
-
-/**
- * @param {number|undefined} userVal
- * @param {string} envKey
- * @param {number} fallback
- */
-function resolvePositiveInt(userVal, envKey, fallback) {
-  if (typeof userVal === 'number' && Number.isFinite(userVal) && userVal > 0) {
-    return Math.floor(userVal)
-  }
-  const raw = resolveBundledEnv(envKey, '');
-  const n = raw ? parseInt(raw, 10) : NaN;
-  if (Number.isFinite(n) && n > 0) {
-    return n
-  }
-  return fallback
-}
-
-/**
- * 合并用户、环境变量与 `defaultWebExtendPluginRuntime`，得到完整运行时选项（宿主可只传需要覆盖的字段）。
- * @param {WebExtendPluginRuntimeOptions} [user]
- * @returns {object}
- */
-function resolveRuntimeOptions(user = {}) {
-  const manifestBaseRaw =
-    user.manifestBase !== undefined && user.manifestBase !== ''
-      ? String(user.manifestBase)
-      : resolveBundledEnv('VITE_FRONTEND_PLUGIN_BASE', DEF.manifestBase) || DEF.manifestBase;
-
-  const manifestListPath = ensureLeadingPath(
-    user.manifestListPath !== undefined && user.manifestListPath !== ''
-      ? user.manifestListPath
-      : resolveBundledEnv('VITE_WEB_PLUGIN_MANIFEST_PATH', DEF.manifestListPath)
-  );
-
-  const defaultImplicitDevPluginIds =
-    Array.isArray(user.defaultImplicitDevPluginIds)
-      ? user.defaultImplicitDevPluginIds.map(String).filter(Boolean)
-      : (() => {
-          const e = resolveBundledEnv('VITE_WEB_PLUGIN_IMPLICIT_DEV_IDS', '');
-          if (e) {
-            return e
-              .split(',')
-              .map((s) => s.trim())
-              .filter(Boolean)
-          }
-          return [...DEF.defaultImplicitDevPluginIds]
-        })();
-
-  const allowedScriptHosts =
-    Array.isArray(user.allowedScriptHosts) && user.allowedScriptHosts.length > 0
-      ? user.allowedScriptHosts.map((h) => normalizeHost(String(h))).filter(Boolean)
-      : (() => {
-          const e = resolveBundledEnv('VITE_WEB_PLUGIN_ALLOWED_SCRIPT_HOSTS', '');
-          if (e) {
-            return e
-              .split(',')
-              .map((s) => normalizeHost(s.trim()))
-              .filter(Boolean)
-          }
-          return [...DEF.allowedScriptHosts]
-        })();
-
-  const bridgeAllowedPathPrefixes =
-    Array.isArray(user.bridgeAllowedPathPrefixes) && user.bridgeAllowedPathPrefixes.length > 0
-      ? user.bridgeAllowedPathPrefixes.map((p) => ensureLeadingPath(p)).filter(Boolean)
-      : (() => {
-          const e = resolveBundledEnv('VITE_WEB_PLUGIN_BRIDGE_PREFIXES', '');
-          if (e) {
-            return e
-              .split(',')
-              .map((s) => ensureLeadingPath(s.trim()))
-              .filter(Boolean)
-          }
-          return [...DEF.bridgeAllowedPathPrefixes]
-        })();
-
-  return {
-    manifestBase: manifestBaseRaw.replace(/\/$/, '') || DEF.manifestBase.replace(/\/$/, ''),
-    manifestListPath,
-    manifestFetchCredentials: resolveManifestCredentials(
-      user.manifestFetchCredentials,
-      'VITE_WEB_PLUGIN_MANIFEST_CREDENTIALS',
-      DEF.manifestFetchCredentials
-    ),
-    isDev: user.isDev !== undefined ? user.isDev : resolveBundledIsDev(),
-    webPluginDevOrigin:
-      user.webPluginDevOrigin !== undefined ? user.webPluginDevOrigin : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_ORIGIN', ''),
-    webPluginDevIds:
-      user.webPluginDevIds !== undefined ? user.webPluginDevIds : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_IDS', ''),
-    webPluginDevMapJson:
-      user.webPluginDevMapJson !== undefined
-        ? user.webPluginDevMapJson
-        : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_MAP', ''),
-    webPluginDevEntryPath: ensureLeadingPath(
-      user.webPluginDevEntryPath !== undefined && user.webPluginDevEntryPath !== ''
-        ? user.webPluginDevEntryPath
-        : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_ENTRY', DEF.webPluginDevEntryPath)
-    ),
-    devPingPath: ensureLeadingPath(
-      user.devPingPath !== undefined && user.devPingPath !== ''
-        ? user.devPingPath
-        : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_PING_PATH', DEF.devPingPath)
-    ),
-    devReloadSsePath: ensureLeadingPath(
-      user.devReloadSsePath !== undefined && user.devReloadSsePath !== ''
-        ? user.devReloadSsePath
-        : resolveBundledEnv('VITE_WEB_PLUGIN_DEV_SSE_PATH', DEF.devReloadSsePath)
-    ),
-    devPingTimeoutMs: resolvePositiveInt(user.devPingTimeoutMs, 'VITE_WEB_PLUGIN_DEV_PING_TIMEOUT_MS', DEF.devPingTimeoutMs),
-    defaultImplicitDevPluginIds,
-    allowedScriptHosts,
-    bridgeAllowedPathPrefixes,
-    bootstrapSummary: user.bootstrapSummary
-  }
-}
-
-/**
- * @param {ReturnType<typeof resolveRuntimeOptions>} opts
- */
-function shouldShowBootstrapSummary(opts) {
-  if (opts.bootstrapSummary === true) {
-    return true
-  }
-  if (opts.bootstrapSummary === false) {
-    return false
-  }
-  const env = resolveBundledEnv('VITE_PLUGINS_BOOTSTRAP_SUMMARY', '');
-  if (env === '0' || env === 'false') {
-    return false
-  }
-  if (env === '1' || env === 'true') {
-    return true
-  }
-  return resolveBundledIsDev()
+	  tokens: internalRe.t,
+	  SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
+	  RELEASE_TYPES: constants.RELEASE_TYPES,
+	  compareIdentifiers: identifiers.compareIdentifiers,
+	  rcompareIdentifiers: identifiers.rcompareIdentifiers,
+	};
+	return semver$1;
 }
 
-/**
- * @param {string} hostname
- */
-function normalizeHost(hostname) {
-  if (!hostname) {
-    return ''
-  }
-  const h = hostname.toLowerCase();
-  if (h.startsWith('[') && h.endsWith(']')) {
-    return h.slice(1, -1)
-  }
-  return h
-}
+var semverExports = requireSemver();
+var semver = /*@__PURE__*/getDefaultExportFromCjs(semverExports);
 
-/**
- * @param {string[]} hostnames
- * @returns {Set<string>}
- */
-function buildAllowedScriptHostsSet(hostnames) {
-  const s = new Set();
-  for (const h of hostnames) {
-    const n = normalizeHost(h);
-    if (n) {
-      s.add(n);
-    }
-  }
-  return s
-}
+/**
+ * 与 `plugin-web-starter`（WebPluginsResponse）返回的 `hostPluginApiVersion` 保持一致，用于契约校验。
+ * @type {string}
+ */
+const HOST_PLUGIN_API_VERSION = '1.0.0';
 
 /**
- * @param {string} url
- * @param {Set<string>} hostSet
+ * 开发模式插件 URL 映射（显式 JSON + 隐式 dev 探测）。
+ * @module runtime/dev-map
  */
-function isScriptHostAllowed(url, hostSet) {
-  if (typeof window === 'undefined') {
-    return false
-  }
-  try {
-    const u = new URL(url, window.location.origin);
-    const h = normalizeHost(u.hostname);
-    return hostSet.has(h)
-  } catch {
-    return false
-  }
-}
 
 /**
- * @param {ReturnType<typeof resolveRuntimeOptions>} opts
+ * @param {{ isDev: boolean, webPluginDevMapJson?: string|null }} opts
  */
 function parseWebPluginDevMapExplicit(opts) {
   if (!opts.isDev) {
@@ -3186,7 +3197,24 @@ function parseWebPluginDevMapExplicit(opts) {
 }
 
 /**
- * @param {ReturnType<typeof resolveRuntimeOptions>} opts
+ * @param {Record<string, string>} implicit
+ * @param {Record<string, string>|null} explicit
+ */
+function mergeDevMaps(implicit, explicit) {
+  const i = implicit && typeof implicit === 'object' ? implicit : {};
+  const e = explicit && typeof explicit === 'object' ? explicit : {};
+  return { ...i, ...e }
+}
+
+/**
+ * @param {object} opts
+ * @param {boolean} opts.isDev
+ * @param {string|undefined|null} opts.webPluginDevOrigin
+ * @param {string|undefined|null} opts.webPluginDevIds
+ * @param {string[]} opts.defaultImplicitDevPluginIds
+ * @param {string} opts.devPingPath
+ * @param {number} opts.devPingTimeoutMs
+ * @param {string} opts.webPluginDevEntryPath
  * @param {Set<string>} hostSet
  */
 async function buildImplicitWebPluginDevMap(opts, hostSet) {
@@ -3258,14 +3286,9 @@ async function buildImplicitWebPluginDevMap(opts, hostSet) {
 }
 
 /**
- * @param {Record<string, string>} implicit
- * @param {Record<string, string>|null} explicit
+ * 开发模式下插件热更新 SSE（按 dev 映射中的 origin 连接）。
+ * @module runtime/dev-reload-sse
  */
-function mergeDevMaps(implicit, explicit) {
-  const i = implicit && typeof implicit === 'object' ? implicit : {};
-  const e = explicit && typeof explicit === 'object' ? explicit : {};
-  return { ...i, ...e }
-}
 
 /** @type {Map<string, EventSource>} */
 const pluginDevEventSources = new Map();
@@ -3362,8 +3385,17 @@ function startPluginDevSseForMap(devMap, isDev, hostSet, ssePath) {
   }
 }
 
+/**
+ * 动态加载脚本（去重与并发合并）。
+ * @module runtime/load-script
+ */
+
 const loadScriptMemo = new Map();
 
+/**
+ * @param {string} src
+ * @returns {Promise<void>}
+ */
 function loadScript(src) {
   if (typeof document === 'undefined') {
     return Promise.reject(new Error('loadScript: no document'))
@@ -3407,6 +3439,31 @@ function loadScript(src) {
   return p
 }
 
+/**
+ * 拉取清单、合并 dev 映射、加载入口并执行 activator。
+ * @module runtime/bootstrap-plugins
+ */
+
+/**
+ * @param {import('./resolve-runtime-options.js').WebExtendPluginRuntimeOptions|object} opts
+ */
+function shouldShowBootstrapSummary(opts) {
+  if (opts.bootstrapSummary === true) {
+    return true
+  }
+  if (opts.bootstrapSummary === false) {
+    return false
+  }
+  const env = resolveBundledEnv('VITE_PLUGINS_BOOTSTRAP_SUMMARY', '');
+  if (env === '0' || env === 'false') {
+    return false
+  }
+  if (env === '1' || env === 'true') {
+    return true
+  }
+  return resolveBundledIsDev()
+}
+
 /**
  * @param {{ id: string }} p
  * @param {string} [entryUrl]
@@ -3445,29 +3502,30 @@ async function loadPluginEntry(p, entryUrl, devMap, hostSet) {
 /**
  * @param {import('vue-router').default} router
  * @param {(pluginId: string, router: import('vue-router').default, hostKit?: { bridgeAllowedPathPrefixes: string[] }) => object} createHostApiFactory
- *        始终传入三个参数；单参工厂 `(id) => createHostApi(id, router)` 仍可用，后两个实参被忽略。
- * @param {WebExtendPluginRuntimeOptions} [runtimeOptions]
+ * @param {import('./resolve-runtime-options.js').WebExtendPluginRuntimeOptions} [runtimeOptions]
  */
-async function bootstrapPlugins(router, createHostApiFactory, runtimeOptions) {
+async function bootstrapPlugins$1(router, createHostApiFactory, runtimeOptions) {
   if (typeof window === 'undefined') {
     console.warn('[plugins] bootstrapPlugins skipped: requires browser (window)');
     return
   }
-  const opts = resolveRuntimeOptions(runtimeOptions || {});
+  const opts = resolveRuntimeOptions$1(runtimeOptions || {});
   const base = String(opts.manifestBase).replace(/\/$/, '');
   const manifestUrl = `${base}${opts.manifestListPath}`;
   const hostSet = buildAllowedScriptHostsSet(opts.allowedScriptHosts);
   const explicit = parseWebPluginDevMapExplicit(opts);
 
+  const manifestCtx = {
+    manifestUrl,
+    credentials: opts.manifestFetchCredentials
+  };
   const [manifestResult, implicit] = await Promise.all([
     (async () => {
       try {
-        const res = await fetch(manifestUrl, { credentials: opts.manifestFetchCredentials });
-        if (!res.ok) {
-          return { ok: false, status: res.status, data: null }
+        if (typeof opts.fetchManifest === 'function') {
+          return await opts.fetchManifest(manifestCtx)
         }
-        const data = await res.json();
-        return { ok: true, data }
+        return await defaultFetchWebPluginManifest$1(manifestCtx)
       } catch (e) {
         return { ok: false, error: e, data: null }
       }
@@ -3571,6 +3629,240 @@ async function bootstrapPlugins(router, createHostApiFactory, runtimeOptions) {
   }
 }
 
+/**
+ * 宿主侧插件引导：拉取清单、dev 映射、加载入口脚本、调用 activator。
+ * 实现已拆至 `src/runtime/` 下各模块；本文件保留模块说明与对外类型约定，并 re-export 稳定 API。
+ *
+ * **Webpack 宿主**：用 `DefinePlugin` 注入 `process.env.VITE_*` 或 **`PLUGIN_*`**（等价键），或 `resolveRuntimeOptions` 显式传参。
+ * **Vite 宿主**：入口调用 `setWebExtendPluginEnv(import.meta.env)`，或 `installWebExtendPluginVue2(..., { env: import.meta.env })`。
+ *
+ * @module PluginRuntime
+ */
+
+var pluginRuntime = /*#__PURE__*/Object.freeze({
+  __proto__: null,
+  bootstrapPlugins: bootstrapPlugins$1,
+  defaultFetchWebPluginManifest: defaultFetchWebPluginManifest$1,
+  resolveRuntimeOptions: resolveRuntimeOptions$1
+});
+
+/**
+ * 清单拉取函数的组合工具：缓存、埋点等以**中间件**形式扩展，不侵入 `bootstrapPlugins` 核心逻辑，
+ * 符合第三方依赖「可组合、可替换」约定。契约与 `PluginRuntime` 中 `fetchManifest` 一致。
+ *
+ * @module runtime/manifest-fetch-composer
+ */
+
+/**
+ * @typedef {object} FetchWebPluginManifestContext
+ * @property {string} manifestUrl
+ * @property {RequestCredentials} credentials
+ */
+
+/**
+ * @typedef {object} FetchWebPluginManifestResult
+ * @property {boolean} ok
+ * @property {number} [status]
+ * @property {{ hostPluginApiVersion?: string, plugins?: object[] }|null} [data]
+ * @property {unknown} [error]
+ */
+
+/**
+ * @callback FetchWebPluginManifestFn
+ * @param {FetchWebPluginManifestContext} ctx
+ * @returns {Promise<FetchWebPluginManifestResult>}
+ */
+
+/**
+ * 将内层 `fetchManifest` 包装为带缓存的版本。等价于
+ * `composeManifestFetch(inner, manifestFetchCacheMiddleware(options))`。
+ *
+ * @param {FetchWebPluginManifestFn} inner 内层实现（如预设生成的 `fetchManifest` 或 `defaultFetchWebPluginManifest`）
+ * @param {ManifestFetchCacheOptions} [options]
+ * @returns {FetchWebPluginManifestFn}
+ */
+function wrapManifestFetchWithCache$1(inner, options = {}) {
+  return composeManifestFetch$1(inner, manifestFetchCacheMiddleware$1(options))
+}
+
+/**
+ * @typedef {object} ManifestFetchCacheOptions
+ * @property {number} [ttlMs] 缓存时长（毫秒）。`<= 0` 或未传时**不缓存**（直接透传 `inner`）。
+ * @property {'memory'|'session'|'local'} [storage='memory'] `session`/`local` 依赖 `JSON.stringify`，仅适合可序列化的 `data`。
+ * @property {string} [storageKeyPrefix='wep.manifestFetch.v1'] Web Storage 键前缀（仅 storage 非 memory 时生效）。
+ * @property {(ctx: FetchWebPluginManifestContext) => string} [cacheKey] 默认 `manifestUrl + '\0' + credentials`。
+ * @property {(result: FetchWebPluginManifestResult) => boolean} [shouldCache] 默认：`ok === true` 且 `data` 非空。
+ * @property {number} [maxEntries=50] 仅 `memory`：超过条数时淘汰最久未读条目。
+ * @property {() => number} [now] 测试注入时间戳。
+ */
+
+/**
+ * 清单拉取**中间件工厂**：`next` 为内层 `fetchManifest`。
+ *
+ * @param {ManifestFetchCacheOptions} options
+ * @returns {(next: FetchWebPluginManifestFn) => FetchWebPluginManifestFn}
+ */
+function manifestFetchCacheMiddleware$1(options = {}) {
+  const ttlMs = typeof options.ttlMs === 'number' && Number.isFinite(options.ttlMs) ? options.ttlMs : 0;
+  if (ttlMs <= 0) {
+    return (next) => next
+  }
+
+  const storage = options.storage || 'memory';
+  const prefix = options.storageKeyPrefix || 'wep.manifestFetch.v1';
+  const maxEntries = typeof options.maxEntries === 'number' && options.maxEntries > 0 ? options.maxEntries : 50;
+  const getNow = typeof options.now === 'function' ? options.now : () => Date.now();
+  const cacheKeyFn =
+    typeof options.cacheKey === 'function'
+      ? options.cacheKey
+      : (ctx) => `${String(ctx.manifestUrl)}\0${String(ctx.credentials)}`;
+
+  const shouldCache =
+    typeof options.shouldCache === 'function'
+      ? options.shouldCache
+      : (r) => !!(r && r.ok === true && r.data != null);
+
+  /** @type {Map<string, { expiresAt: number, result: FetchWebPluginManifestResult, lastRead: number }>} */
+  const memory = new Map();
+
+  function cloneResult(r) {
+    try {
+      if (typeof structuredClone === 'function') {
+        return structuredClone(r)
+      }
+    } catch (_) {}
+    try {
+      return JSON.parse(JSON.stringify(r))
+    } catch (_) {
+      return { ...r, data: r.data }
+    }
+  }
+
+  function touchMemory(key) {
+    const e = memory.get(key);
+    if (e) {
+      e.lastRead = getNow();
+    }
+  }
+
+  function pruneMemory() {
+    if (memory.size <= maxEntries) {
+      return
+    }
+    const entries = [...memory.entries()].sort((a, b) => a[1].lastRead - b[1].lastRead);
+    const drop = memory.size - maxEntries;
+    for (let i = 0; i < drop; i++) {
+      memory.delete(entries[i][0]);
+    }
+  }
+
+  function readWebStorage(store, key) {
+    try {
+      const raw = store.getItem(key);
+      if (!raw) {
+        return null
+      }
+      const o = JSON.parse(raw);
+      if (!o || typeof o !== 'object') {
+        return null
+      }
+      const exp = o.expiresAt;
+      const res = o.result;
+      if (typeof exp !== 'number' || getNow() > exp) {
+        store.removeItem(key);
+        return null
+      }
+      return /** @type {FetchWebPluginManifestResult} */ (res)
+    } catch (_) {
+      return null
+    }
+  }
+
+  function writeWebStorage(store, key, result, expiresAt) {
+    try {
+      store.setItem(key, JSON.stringify({ expiresAt, result }));
+    } catch (_) {
+      /* Quota / 不可序列化 */
+    }
+  }
+
+  return (next) => {
+    return async (ctx) => {
+      const key = cacheKeyFn(ctx);
+      const now = getNow();
+
+      if (storage === 'memory') {
+        const hit = memory.get(key);
+        if (hit && hit.expiresAt > now) {
+          touchMemory(key);
+          return cloneResult(hit.result)
+        }
+      } else if (storage === 'session' && typeof sessionStorage !== 'undefined') {
+        const sk = `${prefix}:${key}`;
+        const hit = readWebStorage(sessionStorage, sk);
+        if (hit) {
+          return cloneResult(hit)
+        }
+      } else if (storage === 'local' && typeof localStorage !== 'undefined') {
+        const sk = `${prefix}:${key}`;
+        const hit = readWebStorage(localStorage, sk);
+        if (hit) {
+          return cloneResult(hit)
+        }
+      }
+
+      const result = await next(ctx);
+
+      if (!shouldCache(result)) {
+        return result
+      }
+
+      const expiresAt = now + ttlMs;
+      const frozen = cloneResult(result);
+
+      if (storage === 'memory') {
+        memory.set(key, { expiresAt, result: frozen, lastRead: now });
+        pruneMemory();
+      } else if (storage === 'session' && typeof sessionStorage !== 'undefined') {
+        writeWebStorage(sessionStorage, `${prefix}:${key}`, frozen, expiresAt);
+      } else if (storage === 'local' && typeof localStorage !== 'undefined') {
+        writeWebStorage(localStorage, `${prefix}:${key}`, frozen, expiresAt);
+      }
+
+      return result
+    }
+  }
+}
+
+/**
+ * 自右向左组合中间件（与 Koa/Redux 习惯一致：`compose(f,g,h)(inner)` = f(g(h(inner))))。
+ *
+ * @param {FetchWebPluginManifestFn} inner 最内层拉取实现
+ * @param {...function(FetchWebPluginManifestFn): FetchWebPluginManifestFn} middlewares 每个元素签名 `(next) => async (ctx) => result`
+ * @returns {FetchWebPluginManifestFn}
+ */
+function composeManifestFetch$1(inner, ...middlewares) {
+  if (typeof inner !== 'function') {
+    throw new Error('[web-extend-plugin-vue2] composeManifestFetch 需要 inner 为函数')
+  }
+  let f = inner;
+  for (let i = middlewares.length - 1; i >= 0; i--) {
+    const mw = middlewares[i];
+    if (typeof mw !== 'function') {
+      throw new Error('[web-extend-plugin-vue2] composeManifestFetch 中间件须为函数')
+    }
+    f = mw(f);
+  }
+  return f
+}
+
+var manifestComposer = /*#__PURE__*/Object.freeze({
+  __proto__: null,
+  composeManifestFetch: composeManifestFetch$1,
+  manifestFetchCacheMiddleware: manifestFetchCacheMiddleware$1,
+  wrapManifestFetchWithCache: wrapManifestFetchWithCache$1
+});
+
 /**
  * 插件通过宿主访问后端的受控通道：仅允许配置的前缀路径，默认 `/api/`；强制默认 `same-origin` 携带 Cookie。
  * 前缀列表由 `createRequestBridge({ allowedPathPrefixes })` 传入，与 `defaultWebExtendPluginRuntime.bridgeAllowedPathPrefixes` 对齐。
@@ -3578,17 +3870,6 @@ async function bootstrapPlugins(router, createHostApiFactory, runtimeOptions) {
  * @module bridge
  */
 
-/**
- * @param {string} p
- */
-function ensureLeadingSlash(p) {
-  const t = String(p || '').trim();
-  if (!t) {
-    return '/'
-  }
-  return t.startsWith('/') ? t : `/${t}`
-}
-
 /**
  * @param {{ allowedPathPrefixes?: string[] }} [config]
  */
@@ -3597,7 +3878,7 @@ function createRequestBridge(config = {}) {
     Array.isArray(config.allowedPathPrefixes) && config.allowedPathPrefixes.length > 0
       ? config.allowedPathPrefixes
       : defaultWebExtendPluginRuntime.bridgeAllowedPathPrefixes;
-  const allowedPathPrefixes = raw.map((p) => ensureLeadingSlash(p));
+  const allowedPathPrefixes = raw.map((p) => ensureLeadingPath(p));
 
   return {
     /**
@@ -4018,19 +4299,234 @@ function installWebExtendPluginVue2(Vue, router, options) {
   if (Vue && ExtensionPoint) {
     Vue.component('ExtensionPoint', ExtensionPoint);
   }
-  const runtime = resolveRuntimeOptions(runtimeUser);
-  return bootstrapPlugins(router, (id, r, kit) => createHostApi(id, r, kit), runtime)
+  const runtime = resolveRuntimeOptions$1(runtimeUser);
+  return bootstrapPlugins$1(router, (id, r, kit) => createHostApi(id, r, kit), runtime)
+}
+
+/**
+ * 预设：Vue CLI + 统一 axios（如若依 `utils/request`）。
+ * 对外以 {@link presetVueCliAxios} 聚合；亦保留具名函数便于 tree-shaking。
+ *
+ * @module presets/vue-cli-axios
+ */
+
+/**
+ * @typedef {object} VueCliAxiosInstallPresetDeps
+ * @property {(config: { url: string, method?: string, [key: string]: unknown }) => Promise<unknown>} request 宿主 axios 封装（已含 baseURL、Token 等）
+ */
+
+/**
+ * 将 `manifestBase + manifestListPath` 转为相对 `VUE_APP_BASE_API` 的路径（供 axios baseURL 拼接）。
+ * @param {string} manifestUrl
+ * @param {string} [apiBase]
+ */
+function manifestPathForVueCliApiBase(manifestUrl, apiBase) {
+  const base = String(
+    apiBase !== undefined
+      ? apiBase
+      : (typeof process !== 'undefined' && process.env && process.env.VUE_APP_BASE_API) || ''
+  ).replace(/\/$/, '');
+  if (typeof window === 'undefined') {
+    return '/api/frontend-plugins'
+  }
+  const u = new URL(manifestUrl, window.location.origin);
+  let path = u.pathname + u.search;
+  if (base && path.startsWith(base)) {
+    path = path.slice(base.length) || '/';
+  }
+  return path
+}
+
+/**
+ * 兼容裸清单 JSON 与常见 `{ code, data: { plugins } }` 包装。
+ * @param {unknown} body
+ * @returns {object|null}
+ */
+function unwrapTableStyleManifestBody(body) {
+  if (!body || typeof body !== 'object') {
+    return null
+  }
+  const o = /** @type {Record<string, unknown>} */ (body);
+  if (Array.isArray(o.plugins)) {
+    return o
+  }
+  const d = o.data;
+  if (d && typeof d === 'object') {
+    const inner = /** @type {Record<string, unknown>} */ (d);
+    if (Array.isArray(inner.plugins)) {
+      return inner
+    }
+    if ('plugins' in inner) {
+      return inner
+    }
+  }
+  return d !== undefined && d !== null && typeof d === 'object' ? /** @type {object} */ (d) : o
+}
+
+function bridgePrefixesFromVueCliEnv() {
+  const base = (
+    typeof process !== 'undefined' && process.env && process.env.VUE_APP_BASE_API
+      ? String(process.env.VUE_APP_BASE_API)
+      : ''
+  ).replace(/\/$/, '');
+  const raw = [base ? `${base}/` : '', '/api/', '/dev-api/'].filter(Boolean);
+  return [...new Set(raw)]
+}
+
+/**
+ * 生成可直接传给 `installWebExtendPluginVue2` 的 options（含 fetchManifest、manifestBase、bridge 前缀）。
+ * @param {VueCliAxiosInstallPresetDeps} deps
+ * @param {Record<string, unknown>} [extra] 合并覆盖，如 `manifestListPath`、`env` 等
+ * @returns {Record<string, unknown>}
+ */
+function createVueCliAxiosInstallOptions(deps, extra = {}) {
+  const { request } = deps;
+  if (typeof request !== 'function') {
+    throw new Error('[web-extend-plugin-vue2] createVueCliAxiosInstallOptions({ request }) 需要宿主 request 函数')
+  }
+  const envBase = (
+    typeof process !== 'undefined' && process.env && process.env.VUE_APP_BASE_API
+      ? String(process.env.VUE_APP_BASE_API)
+      : ''
+  ).replace(/\/$/, '');
+  const userBase =
+    extra.manifestBase !== undefined && String(extra.manifestBase).trim() !== ''
+      ? String(extra.manifestBase).replace(/\/$/, '')
+      : '';
+  const stripBase = userBase || envBase;
+
+  const fetchManifest = async (ctx) => {
+    try {
+      const url = manifestPathForVueCliApiBase(ctx.manifestUrl, stripBase);
+      const body = await request({
+        url,
+        method: 'get'
+      });
+      const data = unwrapTableStyleManifestBody(body);
+      if (!data || typeof data !== 'object') {
+        return {
+          ok: false,
+          error: new Error('[web-plugin] 清单响应格式无效'),
+          data: null
+        }
+      }
+      return { ok: true, data }
+    } catch (e) {
+      return { ok: false, error: e, data: null }
+    }
+  };
+
+  const opts = {
+    manifestBase: stripBase || undefined,
+    bridgeAllowedPathPrefixes: bridgePrefixesFromVueCliEnv(),
+    fetchManifest,
+    ...extra
+  };
+
+  const listPath =
+    typeof process !== 'undefined' && process.env && process.env.VUE_APP_WEB_PLUGIN_MANIFEST_PATH;
+  if (listPath && opts.manifestListPath === undefined && extra.manifestListPath === undefined) {
+    opts.manifestListPath = String(listPath);
+  }
+
+  return opts
 }
 
+/**
+ * Vue CLI + axios 预设的**对外聚合入口**（与具名导出函数等价，便于按需查阅与扩展多预设）。
+ * @type {Readonly<{ id: string, description: string, createInstallOptions: typeof createVueCliAxiosInstallOptions, manifestPathForApiBase: typeof manifestPathForVueCliApiBase, unwrapManifestBody: typeof unwrapTableStyleManifestBody }>}
+ */
+const presetVueCliAxios = Object.freeze({
+  id: 'vue-cli-axios',
+  description: 'Vue CLI + 统一 axios 实例（如若依 utils/request），清单走宿主 request',
+  createInstallOptions: createVueCliAxiosInstallOptions,
+  manifestPathForApiBase: manifestPathForVueCliApiBase,
+  unwrapManifestBody: unwrapTableStyleManifestBody
+});
+
+/**
+ * 稳定对外 API：具名导出 + {@link WebExtendPluginVue2} 聚合对象。
+ * 语义化版本内保持本文件导出的符号与聚合结构兼容。
+ *
+ * `PluginRuntime` 与 `manifest-fetch-composer` 通过 namespace 绑定到 `WebExtendPluginVue2.runtime`，避免具名导出与聚合对象重复列举。
+ *
+ * @module public
+ */
+
+
+const {
+  bootstrapPlugins,
+  defaultFetchWebPluginManifest,
+  resolveRuntimeOptions
+} = pluginRuntime;
+
+const {
+  composeManifestFetch,
+  manifestFetchCacheMiddleware,
+  wrapManifestFetchWithCache
+} = manifestComposer;
+
+/**
+ * 根命名空间：宿主可通过 `WebExtendPluginVue2.presets.vueCliAxios` 等路径发现能力，避免仅依赖散落的具名导出。
+ * @type {Readonly<{
+ *   install: typeof installWebExtendPluginVue2,
+ *   runtime: Readonly<{ bootstrapPlugins: typeof pluginRuntime.bootstrapPlugins, resolveRuntimeOptions: typeof pluginRuntime.resolveRuntimeOptions, defaultFetchWebPluginManifest: typeof pluginRuntime.defaultFetchWebPluginManifest, composeManifestFetch: typeof manifestComposer.composeManifestFetch, manifestFetchCacheMiddleware: typeof manifestComposer.manifestFetchCacheMiddleware, wrapManifestFetchWithCache: typeof manifestComposer.wrapManifestFetchWithCache }>,
+ *   host: Readonly<{ createHostApi: typeof createHostApi, disposeWebPlugin: typeof disposeWebPlugin, createRequestBridge: typeof createRequestBridge, registries: typeof registries }>,
+ *   config: Readonly<{ defaultWebExtendPluginRuntime: typeof defaultWebExtendPluginRuntime, setWebExtendPluginEnv: typeof setWebExtendPluginEnv }>,
+ *   constants: Readonly<{ HOST_PLUGIN_API_VERSION: typeof HOST_PLUGIN_API_VERSION }>,
+ *   components: Readonly<{ ExtensionPoint: typeof ExtensionPoint }>,
+ *   presets: Readonly<{ vueCliAxios: typeof presetVueCliAxios }>
+ * }>}
+ */
+const WebExtendPluginVue2 = Object.freeze({
+  install: installWebExtendPluginVue2,
+  runtime: Object.freeze({
+    bootstrapPlugins: bootstrapPlugins$1,
+    resolveRuntimeOptions: resolveRuntimeOptions$1,
+    defaultFetchWebPluginManifest: defaultFetchWebPluginManifest$1,
+    composeManifestFetch: composeManifestFetch$1,
+    manifestFetchCacheMiddleware: manifestFetchCacheMiddleware$1,
+    wrapManifestFetchWithCache: wrapManifestFetchWithCache$1
+  }),
+  host: Object.freeze({
+    createHostApi,
+    disposeWebPlugin,
+    createRequestBridge,
+    registries
+  }),
+  config: Object.freeze({
+    defaultWebExtendPluginRuntime,
+    setWebExtendPluginEnv
+  }),
+  constants: Object.freeze({
+    HOST_PLUGIN_API_VERSION
+  }),
+  components: Object.freeze({
+    ExtensionPoint
+  }),
+  presets: Object.freeze({
+    vueCliAxios: presetVueCliAxios
+  })
+});
+
 exports.ExtensionPoint = ExtensionPoint;
 exports.HOST_PLUGIN_API_VERSION = HOST_PLUGIN_API_VERSION;
+exports.WebExtendPluginVue2 = WebExtendPluginVue2;
 exports.bootstrapPlugins = bootstrapPlugins;
+exports.composeManifestFetch = composeManifestFetch;
 exports.createHostApi = createHostApi;
 exports.createRequestBridge = createRequestBridge;
+exports.createVueCliAxiosInstallOptions = createVueCliAxiosInstallOptions;
+exports.defaultFetchWebPluginManifest = defaultFetchWebPluginManifest;
 exports.defaultWebExtendPluginRuntime = defaultWebExtendPluginRuntime;
 exports.disposeWebPlugin = disposeWebPlugin;
 exports.installWebExtendPluginVue2 = installWebExtendPluginVue2;
+exports.manifestFetchCacheMiddleware = manifestFetchCacheMiddleware;
+exports.manifestPathForVueCliApiBase = manifestPathForVueCliApiBase;
+exports.presetVueCliAxios = presetVueCliAxios;
 exports.registries = registries;
 exports.resolveRuntimeOptions = resolveRuntimeOptions;
 exports.setWebExtendPluginEnv = setWebExtendPluginEnv;
+exports.unwrapTableStyleManifestBody = unwrapTableStyleManifestBody;
+exports.wrapManifestFetchWithCache = wrapManifestFetchWithCache;
 //# sourceMappingURL=index.cjs.map