webloom-framework 0.3.0 → 0.4.1

package/dist/chunk-HJKPKWI7.js

@@ -0,0 +1,4024 @@
+// src/contracts/capability.ts
+function assertIdentity(input) {
+  if (typeof input.id !== "string" || input.id.trim() === "") {
+    throw new TypeError("Capability id must be a non-empty string");
+  }
+  if (typeof input.version !== "string" || input.version.trim() === "") {
+    throw new TypeError(`Capability "${input.id}" version must be a non-empty string`);
+  }
+}
+function assertParser(value, label) {
+  if (!value || typeof value !== "object" || typeof value.parse !== "function") {
+    throw new TypeError(`${label} must expose parse(value)`);
+  }
+}
+function defineCapability(options) {
+  assertIdentity(options);
+  if (options.kind === "rpc") {
+    assertParser(options.request, "RPC request parser");
+    assertParser(options.response, "RPC response parser");
+  }
+  if (options.kind === "stream") {
+    assertParser(options.request, "stream request parser");
+    assertParser(options.item, "stream item parser");
+  }
+  return Object.freeze({ ...options });
+}
+function capabilityDescriptor(capability) {
+  assertCapability(capability);
+  return Object.freeze({
+    kind: capability.kind,
+    id: capability.id,
+    version: capability.version
+  });
+}
+function capabilityKey(capability) {
+  return `${capability.kind}\0${capability.id}\0${capability.version}`;
+}
+function isCapabilityDescriptor(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return (candidate.kind === "local" || candidate.kind === "rpc" || candidate.kind === "stream") && typeof candidate.id === "string" && candidate.id.trim() !== "" && typeof candidate.version === "string" && candidate.version.trim() !== "";
+}
+function isCapability(value) {
+  if (!isCapabilityDescriptor(value)) return false;
+  if (value.kind === "local") return true;
+  if (value.kind === "rpc") {
+    const candidate2 = value;
+    return !!candidate2.request && typeof candidate2.request === "object" && typeof candidate2.request.parse === "function" && !!candidate2.response && typeof candidate2.response === "object" && typeof candidate2.response.parse === "function";
+  }
+  const candidate = value;
+  return !!candidate.request && typeof candidate.request === "object" && typeof candidate.request.parse === "function" && !!candidate.item && typeof candidate.item === "object" && typeof candidate.item.parse === "function";
+}
+function assertCapability(value) {
+  if (!isCapability(value)) throw new TypeError("Invalid WebLoom capability definition");
+}
+
+// src/contracts/lifecycle.ts
+var LifecycleScopeRevokedError = class extends Error {
+  code = "lifecycle.scope_revoked";
+  constructor(message2 = "Lifecycle scope has been revoked") {
+    super(message2);
+    this.name = "LifecycleScopeRevokedError";
+  }
+};
+var PermissionLeaseRevokedError = class extends Error {
+  code = "permission.lease_revoked";
+  constructor(message2 = "Permission lease has been revoked") {
+    super(message2);
+    this.name = "PermissionLeaseRevokedError";
+  }
+};
+var PermissionDeniedError = class extends Error {
+  code = "permission.denied";
+  permission;
+  constructor(permission, message2 = `Permission denied: ${permission}`) {
+    super(message2);
+    this.name = "PermissionDeniedError";
+    this.permission = permission;
+  }
+};
+var WebLoomError = class extends Error {
+  code;
+  phase;
+  context;
+  details;
+  constructor(code, message2, phase2 = "execute", context, details) {
+    super(message2);
+    this.name = "WebLoomError";
+    this.code = code;
+    this.phase = phase2;
+    this.context = context ? Object.freeze({ ...context }) : void 0;
+    this.details = details ? Object.freeze({ ...details }) : void 0;
+  }
+};
+var UpgradeGateRejectedError = class extends Error {
+  code = "upgrade.gate_rejected";
+  reason;
+  constructor(reason, message2 = `Upgrade gate rejected operation: ${reason}`) {
+    super(message2);
+    this.name = "UpgradeGateRejectedError";
+    this.reason = reason;
+  }
+};
+var SCOPED_TASK_SCHEDULER_CAPABILITY = "runtime.task-scheduler";
+var LIFECYCLE_ERROR_TEXT = Object.freeze({
+  "lifecycle.scope_revoked": "\u8FD0\u884C\u5B9E\u4F8B\u5DF2\u505C\u6B62",
+  "permission.denied": "\u63D2\u4EF6\u6CA1\u6709\u83B7\u5F97\u8BE5\u64CD\u4F5C\u7684\u6743\u9650",
+  "permission.lease_revoked": "\u6388\u6743\u79DF\u7EA6\u5DF2\u64A4\u9500",
+  "lifecycle.cleanup_failed": "\u8D44\u6E90\u6E05\u7406\u5931\u8D25\uFF0C\u7B49\u5F85\u91CD\u8BD5",
+  "lifecycle.cleanup_timeout": "\u8D44\u6E90\u6E05\u7406\u8D85\u65F6\uFF0C\u4ECD\u5728\u540E\u53F0\u6392\u7A7A",
+  "upgrade.gate_rejected": "\u7248\u672C\u63A5\u7BA1\u95E8\u7981\u672A\u901A\u8FC7"
+});
+function lifecycleErrorText(code) {
+  return LIFECYCLE_ERROR_TEXT[code] ?? "\u751F\u547D\u5468\u671F\u64CD\u4F5C\u672A\u5B8C\u6210";
+}
+
+// src/contracts/resource.ts
+var RESOURCE_OWNER = /* @__PURE__ */ Symbol("webloom.resource.owner");
+var RESOURCE_REGISTRY = defineCapability({
+  kind: "local",
+  id: "webloom.resource.registry",
+  version: "1"
+});
+
+// src/transport/dto.ts
+var DEFAULT_DTO_LIMITS = Object.freeze({
+  maxDepth: 32,
+  maxNodes: 1e4,
+  maxEdges: 2e4,
+  maxBudgetBytes: 16 * 1024 * 1024,
+  maxStringLength: 1048576,
+  maxFieldNameLength: 256
+});
+var ATTRIBUTES_DTO_LIMITS = Object.freeze({
+  maxDepth: 8,
+  maxNodes: 256,
+  maxEdges: 1024,
+  maxBudgetBytes: 16 * 1024,
+  maxStringLength: 2048,
+  maxFieldNameLength: 128
+});
+var DEFAULT_RUNTIME_LIMITS = Object.freeze({
+  maxPeers: 32,
+  maxPendingCallsPerPeer: 64,
+  maxPendingCallsPerRuntime: 512,
+  maxActiveStreamsPerPeer: 16,
+  maxActiveStreamsPerRuntime: 128,
+  maxExecutionSlotsPerPeer: 64,
+  maxExecutionSlotsPerRuntime: 512,
+  maxMessageBudgetBytes: DEFAULT_DTO_LIMITS.maxBudgetBytes,
+  maxRetainedPayloadBytesPerPeer: 64 * 1024 * 1024,
+  maxRetainedPayloadBytesPerRuntime: 256 * 1024 * 1024,
+  maxSnapshotUnits: 512,
+  maxSnapshotServices: 1024,
+  maxDtoDepth: DEFAULT_DTO_LIMITS.maxDepth,
+  maxDtoNodes: DEFAULT_DTO_LIMITS.maxNodes,
+  maxDtoEdges: DEFAULT_DTO_LIMITS.maxEdges,
+  maxTransferEntries: 64,
+  maxTransfers: 32,
+  maxMessagePorts: 8,
+  maxStreamCredit: 256
+});
+function createRuntimeBudget(limits) {
+  const waiters = /* @__PURE__ */ new Set();
+  const budget = {
+    limits: normalizeRuntimeLimits(limits),
+    pendingCalls: 0,
+    activeStreams: 0,
+    executionSlots: 0,
+    retainedPayloadBytes: 0,
+    registerExecutionWaiter(waiter) {
+      if (typeof waiter !== "function") throw new TypeError("Runtime execution waiter must be a function");
+      waiters.add(waiter);
+      let registered = true;
+      return () => {
+        if (!registered) return;
+        registered = false;
+        waiters.delete(waiter);
+      };
+    },
+    releaseExecutionSlot() {
+      budget.executionSlots = Math.max(0, budget.executionSlots - 1);
+      const waiter = waiters.values().next().value;
+      if (waiter === void 0) return;
+      waiters.delete(waiter);
+      queueMicrotask(() => {
+        try {
+          waiter();
+        } catch {
+        }
+      });
+    }
+  };
+  return budget;
+}
+function normalizeRuntimeLimits(input) {
+  const result = { ...DEFAULT_RUNTIME_LIMITS, ...input ?? {} };
+  for (const [key, value] of Object.entries(result)) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw new TypeError(`Runtime limit ${key} must be a finite positive integer`);
+    }
+    const defaultValue = DEFAULT_RUNTIME_LIMITS[key];
+    if (value > defaultValue) throw new TypeError(`Runtime limit ${key} cannot exceed the v4 default budget`);
+  }
+  if (result.maxMessagePorts > result.maxTransfers) throw new TypeError("maxMessagePorts cannot exceed maxTransfers");
+  if (result.maxTransferEntries < result.maxTransfers) throw new TypeError("maxTransferEntries cannot be less than maxTransfers");
+  if (result.maxStreamCredit > 256) throw new TypeError("maxStreamCredit cannot exceed 256");
+  return Object.freeze(result);
+}
+function isObject(value) {
+  return value !== null && typeof value === "object";
+}
+function isMessagePort(value) {
+  if (!isObject(value)) return false;
+  try {
+    if (Object.prototype.toString.call(value) === "[object MessagePort]") return true;
+    const candidate = value;
+    return typeof candidate.postMessage === "function" && typeof candidate.start === "function" && typeof candidate.close === "function" && typeof candidate.addEventListener === "function" && typeof candidate.removeEventListener === "function";
+  } catch {
+    return false;
+  }
+}
+function isArrayBuffer(value) {
+  if (!isObject(value)) return false;
+  try {
+    return Object.prototype.toString.call(value) === "[object ArrayBuffer]";
+  } catch {
+    return false;
+  }
+}
+function isSharedArrayBuffer(value) {
+  if (!isObject(value)) return false;
+  try {
+    return Object.prototype.toString.call(value) === "[object SharedArrayBuffer]";
+  } catch {
+    return false;
+  }
+}
+function isBlob(value) {
+  if (!isObject(value)) return false;
+  try {
+    const tag = Object.prototype.toString.call(value);
+    return tag === "[object Blob]" || tag === "[object File]";
+  } catch {
+    return false;
+  }
+}
+function isDate(value) {
+  if (!isObject(value)) return false;
+  try {
+    return Object.prototype.toString.call(value) === "[object Date]";
+  } catch {
+    return false;
+  }
+}
+function isSupportedTransfer(value) {
+  return isArrayBuffer(value) || isMessagePort(value);
+}
+function ownKeys(value) {
+  try {
+    return Reflect.ownKeys(value);
+  } catch {
+    throw new Error("DTO property inspection failed");
+  }
+}
+function rejectCustomKeys(value) {
+  for (const key of ownKeys(value)) throw new Error(`Unsupported custom property ${String(key)}`);
+}
+function descriptorValue(value, key, label) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  if (!descriptor || !descriptor.enumerable || !("value" in descriptor)) throw new Error(`${label} must contain enumerable data properties`);
+  return descriptor.value;
+}
+function arrayIndex(key) {
+  if (!/^(?:0|[1-9][0-9]*)$/.test(key)) return void 0;
+  const index = Number(key);
+  return Number.isSafeInteger(index) && index >= 0 ? index : void 0;
+}
+function isTypedArray(value) {
+  try {
+    return ArrayBuffer.isView(value) && Object.prototype.toString.call(value) !== "[object DataView]";
+  } catch {
+    return false;
+  }
+}
+function assertFixedBuffer(value) {
+  if (isSharedArrayBuffer(value)) throw new Error("SharedArrayBuffer is not supported");
+  try {
+    if (value.resizable === true) throw new Error("Resizable ArrayBuffer is not supported");
+    ArrayBuffer.prototype.slice.call(value, 0, 0);
+    const length = value.byteLength;
+    if (!Number.isSafeInteger(length) || length < 0) throw new Error("Invalid ArrayBuffer length");
+    rejectCustomKeys(value);
+    return length;
+  } catch (error2) {
+    if (error2 instanceof Error && error2.message.includes("not supported")) throw error2;
+    throw new Error("Detached or invalid ArrayBuffer");
+  }
+}
+function assertNoCustomViewProperties(value, length) {
+  for (const key of ownKeys(value)) {
+    if (typeof key !== "string") throw new Error("TypedArray symbols are not supported");
+    const index = arrayIndex(key);
+    if (index === void 0 || index >= length) throw new Error("TypedArray has unsupported custom properties");
+    descriptorValue(value, key, "TypedArray");
+  }
+}
+function error(code, message2, phase2 = "validate") {
+  throw new WebLoomError(code, message2, phase2 ?? "validate");
+}
+function validateDto(value, options = {}) {
+  const limits = { ...DEFAULT_DTO_LIMITS, ...options.limits ?? {} };
+  const transferables = options.transferables ?? /* @__PURE__ */ new Set();
+  const messagePorts = [];
+  const reachableTransferables = [];
+  const seen = /* @__PURE__ */ new Map();
+  const active = /* @__PURE__ */ new Set();
+  let nodes = 0;
+  let edges = 0;
+  let budgetBytes = 0;
+  const charge = (amount) => {
+    if (!Number.isSafeInteger(amount) || amount < 0 || budgetBytes > limits.maxBudgetBytes - amount) error("resource_limit_exceeded", "DTO budget exceeded", options.phase);
+    budgetBytes += amount;
+  };
+  const addEdge = () => {
+    edges += 1;
+    if (edges > limits.maxEdges) error("resource_limit_exceeded", "DTO edge limit exceeded", options.phase);
+    charge(16);
+  };
+  const addNode = () => {
+    nodes += 1;
+    if (nodes > limits.maxNodes) error("resource_limit_exceeded", "DTO node limit exceeded", options.phase);
+    charge(32);
+  };
+  const child = (childValue, depth) => {
+    addEdge();
+    return walk(childValue, depth);
+  };
+  const walk = (current, depth) => {
+    if (depth > limits.maxDepth) error("resource_limit_exceeded", "DTO depth limit exceeded", options.phase);
+    if (current === null || current === void 0) {
+      charge(8);
+      return 0;
+    }
+    switch (typeof current) {
+      case "boolean":
+        charge(8);
+        return 0;
+      case "string":
+        if (current.length > limits.maxStringLength) error("resource_limit_exceeded", "DTO string limit exceeded", options.phase);
+        charge(current.length * 2);
+        return 0;
+      case "number":
+        if (!Number.isFinite(current)) error("invalid_message", "DTO number must be finite", options.phase);
+        charge(8);
+        return 0;
+      case "bigint":
+        if (current < -(2n ** 63n) || current > 2n ** 63n - 1n) error("invalid_message", "DTO bigint must fit signed 64-bit", options.phase);
+        charge(8);
+        return 0;
+      case "function":
+      case "symbol":
+        error("invalid_message", "Unsupported DTO value", options.phase);
+    }
+    if (!isObject(current)) error("invalid_message", "Unsupported DTO value", options.phase);
+    if (active.has(current)) error("invalid_message", "DTO cycles are not supported", options.phase);
+    const known = seen.get(current);
+    if (known !== void 0) {
+      if (depth + known > limits.maxDepth) error("resource_limit_exceeded", "DTO depth limit exceeded", options.phase);
+      return known;
+    }
+    addNode();
+    active.add(current);
+    let subtreeDepth = 0;
+    try {
+      if (isMessagePort(current)) {
+        if (!options.allowUnlistedMessagePorts && !transferables.has(current)) error("invalid_message", "MessagePort was not declared by the capability", options.phase);
+        messagePorts.push(current);
+        reachableTransferables.push(current);
+      } else if (isSharedArrayBuffer(current)) {
+        error("invalid_message", "SharedArrayBuffer is not supported", options.phase);
+      } else if (isArrayBuffer(current)) {
+        reachableTransferables.push(current);
+        charge(assertFixedBuffer(current));
+      } else if (ArrayBuffer.isView(current)) {
+        const view = current;
+        if (isSharedArrayBuffer(view.buffer)) error("invalid_message", "SharedArrayBuffer is not supported", options.phase);
+        if (!isArrayBuffer(view.buffer)) error("invalid_message", "Unsupported view backing buffer", options.phase);
+        const byteLength = assertFixedBuffer(view.buffer);
+        if (!Number.isSafeInteger(view.byteLength) || !Number.isSafeInteger(view.byteOffset) || view.byteLength < 0 || view.byteOffset < 0 || view.byteOffset + view.byteLength > byteLength) error("invalid_message", "Invalid buffer view", options.phase);
+        if (isTypedArray(current)) {
+          const length = current.length;
+          if (!Number.isSafeInteger(length) || length < 0) error("invalid_message", "Invalid TypedArray length", options.phase);
+          assertNoCustomViewProperties(current, length);
+        } else rejectCustomKeys(current);
+        reachableTransferables.push(view.buffer);
+        subtreeDepth = Math.max(subtreeDepth, 1 + child(view.buffer, depth + 1));
+        charge(32);
+      } else if (isDate(current)) {
+        rejectCustomKeys(current);
+        if (!Number.isFinite(current.getTime())) error("invalid_message", "Invalid Date", options.phase);
+        charge(16);
+      } else if (isBlob(current)) {
+        rejectCustomKeys(current);
+        const size = current.size;
+        const type = current.type;
+        if (!Number.isSafeInteger(size) || size < 0 || type.length > limits.maxStringLength) error("resource_limit_exceeded", "Blob metadata exceeds DTO budget", options.phase);
+        charge(size + type.length * 2);
+        if (Object.prototype.toString.call(current) === "[object File]") {
+          const name = current.name;
+          if (name.length > limits.maxStringLength) error("resource_limit_exceeded", "File name exceeds DTO budget", options.phase);
+          charge(name.length * 2);
+        }
+      } else if (Array.isArray(current)) {
+        const keys = ownKeys(current);
+        if (keys.some((key) => typeof key !== "string")) error("invalid_message", "Array symbols are not supported", options.phase);
+        const names = keys;
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(current, "length");
+        const length = lengthDescriptor?.value;
+        if (!lengthDescriptor || !Number.isSafeInteger(length) || length < 0 || names.length !== length + 1 || !names.includes("length")) error("invalid_message", "Arrays must be dense DTO arrays", options.phase);
+        for (let index = 0; index < length; index += 1) {
+          const name = String(index);
+          if (!names.includes(name)) error("invalid_message", "Arrays must be dense DTO arrays", options.phase);
+          const valueAtIndex = descriptorValue(current, name, "Array");
+          subtreeDepth = Math.max(subtreeDepth, 1 + child(valueAtIndex, depth + 1));
+        }
+      } else {
+        let prototype;
+        try {
+          prototype = Object.getPrototypeOf(current);
+        } catch {
+          error("invalid_message", "DTO prototype inspection failed", options.phase);
+        }
+        if (prototype !== Object.prototype && prototype !== null) error("invalid_message", "DTO records must use Object.prototype or null prototype", options.phase);
+        const keys = ownKeys(current);
+        for (const key of keys) {
+          if (typeof key !== "string") error("invalid_message", "DTO symbols are not supported", options.phase);
+          if (key.length > limits.maxFieldNameLength) error("resource_limit_exceeded", "DTO field name limit exceeded", options.phase);
+          charge(key.length * 2);
+          subtreeDepth = Math.max(subtreeDepth, 1 + child(descriptorValue(current, key, "Record"), depth + 1));
+        }
+      }
+    } finally {
+      active.delete(current);
+    }
+    seen.set(current, subtreeDepth);
+    return subtreeDepth;
+  };
+  walk(value, 0);
+  return Object.freeze({ nodes, edges, budgetBytes, messagePorts: Object.freeze(messagePorts), reachableTransferables: Object.freeze(reachableTransferables) });
+}
+function validateTransferListWithStats(value, transfer, options = {}) {
+  const limits = normalizeRuntimeLimits(options.limits);
+  if (transfer === void 0) {
+    const stats2 = validateDto(value, {
+      limits: {
+        maxDepth: limits.maxDtoDepth,
+        maxNodes: limits.maxDtoNodes,
+        maxEdges: limits.maxDtoEdges,
+        maxBudgetBytes: limits.maxMessageBudgetBytes
+      },
+      transferables: /* @__PURE__ */ new Set(),
+      phase: options.phase ?? "validate"
+    });
+    return { transfer: Object.freeze([]), stats: stats2 };
+  }
+  if (!Array.isArray(transfer) || transfer.length > limits.maxTransferEntries) {
+    throw new WebLoomError("transfer_invalid", "Capability transfer list exceeds its bounded entry limit", options.phase ?? "validate");
+  }
+  const result = [];
+  const seen = /* @__PURE__ */ new Set();
+  let ports = 0;
+  for (const item of transfer) {
+    if (!isSupportedTransfer(item)) throw new WebLoomError("transfer_invalid", "Capability transfer extractor returned an unsupported resource", options.phase ?? "validate");
+    if (seen.has(item)) continue;
+    seen.add(item);
+    result.push(item);
+    if (isMessagePort(item)) ports += 1;
+    if (result.length > limits.maxTransfers || ports > limits.maxMessagePorts) throw new WebLoomError("transfer_invalid", "Capability transfer list exceeds its bounded resource limit", options.phase ?? "validate");
+  }
+  const stats = validateDto(value, {
+    limits: {
+      maxDepth: limits.maxDtoDepth,
+      maxNodes: limits.maxDtoNodes,
+      maxEdges: limits.maxDtoEdges,
+      maxBudgetBytes: limits.maxMessageBudgetBytes
+    },
+    // MessagePort presence is checked below so a missing declaration is
+    // reported as a transfer-contract error, while the walker still validates
+    // the complete DTO graph and preserves the actual port identity set.
+    allowUnlistedMessagePorts: true,
+    transferables: new Set(result),
+    phase: options.phase ?? "validate"
+  });
+  const reachable = new Set(stats.reachableTransferables);
+  if (result.some((item) => !reachable.has(item))) throw new WebLoomError("transfer_invalid", "Capability transfer resource is not reachable from its payload", options.phase ?? "validate");
+  const declared = new Set(result);
+  if (stats.messagePorts.some((port) => !declared.has(port))) throw new WebLoomError("transfer_invalid", "Capability payload contains a MessagePort missing from its transfer declaration", options.phase ?? "validate");
+  return { transfer: Object.freeze(result), stats };
+}
+function validateTransferList(value, transfer, options = {}) {
+  return validateTransferListWithStats(value, transfer, options).transfer;
+}
+function createReceivePortLedger(ports, options = {}) {
+  const limits = normalizeRuntimeLimits(options.limits);
+  const source = Array.isArray(ports) ? ports : [];
+  let invalid = ports !== void 0 && !Array.isArray(ports);
+  invalid = invalid || source.length > limits.maxTransferEntries;
+  const unique = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const port of source) {
+    if (!isMessagePort(port) || seen.has(port)) invalid = true;
+    else {
+      seen.add(port);
+      unique.push(port);
+    }
+  }
+  if (unique.length > limits.maxMessagePorts) invalid = true;
+  let handedOff = false;
+  let closed = false;
+  const close = () => {
+    if (closed || handedOff) return;
+    closed = true;
+    for (const port of unique) {
+      try {
+        port.close();
+      } catch {
+      }
+    }
+  };
+  if (invalid) close();
+  return {
+    ports: Object.freeze(unique),
+    valid: !invalid,
+    handoff() {
+      if (!closed) handedOff = true;
+    },
+    closeUndelivered: close
+  };
+}
+function assertReceivedPortSet(ledger, expected, options = {}) {
+  const expectedPorts = expected.filter(isMessagePort);
+  const actual = new Set(ledger.ports);
+  const wanted = new Set(expectedPorts);
+  if (actual.size !== wanted.size || [...actual].some((port) => !wanted.has(port))) {
+    ledger.closeUndelivered();
+    throw new WebLoomError("transfer_invalid", "Received MessagePort set does not match the capability transfer declaration", options.phase ?? "receive");
+  }
+}
+function validateRawDto(value, limits, phase2 = "receive") {
+  const normalized = normalizeRuntimeLimits(limits);
+  return validateDto(value, {
+    limits: { maxDepth: normalized.maxDtoDepth, maxNodes: normalized.maxDtoNodes, maxEdges: normalized.maxDtoEdges, maxBudgetBytes: normalized.maxMessageBudgetBytes },
+    allowUnlistedMessagePorts: true,
+    phase: phase2
+  });
+}
+function cloneAttributeValue(value, seen) {
+  if (value === null || typeof value !== "object") return value;
+  const existing = seen.get(value);
+  if (existing !== void 0) return existing;
+  if (Array.isArray(value)) {
+    const result2 = [];
+    seen.set(value, result2);
+    const length = Object.getOwnPropertyDescriptor(value, "length")?.value ?? 0;
+    for (let index = 0; index < length; index += 1) {
+      const child = Object.getOwnPropertyDescriptor(value, String(index))?.value;
+      result2.push(cloneAttributeValue(child, seen));
+    }
+    return result2;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) throw new Error("Capability attributes must contain only records and arrays");
+  const result = Object.create(prototype);
+  seen.set(value, result);
+  for (const key of Object.keys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor)) throw new Error("Capability attributes must contain data properties");
+    result[key] = cloneAttributeValue(descriptor.value, seen);
+  }
+  return result;
+}
+function cloneFrozenAttributes(value) {
+  const source = value ?? {};
+  try {
+    const stats = validateDto(source, { limits: ATTRIBUTES_DTO_LIMITS, phase: "validate" });
+    if (stats.messagePorts.length > 0 || stats.reachableTransferables.length > 0) throw new Error("Capability attributes cannot contain transferable resources");
+    if (!source || typeof source !== "object" || Array.isArray(source)) throw new Error("Capability attributes must be a finite record");
+    const clone = cloneAttributeValue(source, /* @__PURE__ */ new Map());
+    const clonedStats = validateDto(clone, { limits: ATTRIBUTES_DTO_LIMITS, phase: "validate" });
+    if (!clone || typeof clone !== "object" || Array.isArray(clone) || clonedStats.messagePorts.length > 0 || clonedStats.reachableTransferables.length > 0) throw new Error("Capability attributes must be a finite record");
+    const freeze = (current, seen) => {
+      if (!current || typeof current !== "object" || seen.has(current)) return;
+      seen.add(current);
+      if (Array.isArray(current)) for (const item of current) freeze(item, seen);
+      else for (const key of Object.keys(current)) freeze(current[key], seen);
+      Object.freeze(current);
+    };
+    freeze(clone, /* @__PURE__ */ new Set());
+    return clone;
+  } catch (error2) {
+    if (error2 instanceof WebLoomError) throw error2;
+    throw new WebLoomError("invalid_message", "Capability attributes are not a finite cloneable record", "validate");
+  }
+}
+
+// src/runtime/runtimeProtocol.ts
+var RUNTIME_PROTOCOL_VERSION = "webloom.runtime.v1";
+var RUNTIME_SNAPSHOT_TYPE = `${RUNTIME_PROTOCOL_VERSION}.snapshot`;
+var RUNTIME_ERROR_TYPE = `${RUNTIME_PROTOCOL_VERSION}.runtime-error`;
+var RUNTIME_CALL_TYPE = `${RUNTIME_PROTOCOL_VERSION}.call`;
+var RUNTIME_RESULT_TYPE = `${RUNTIME_PROTOCOL_VERSION}.result`;
+var RUNTIME_ERROR_MESSAGE_TYPE = `${RUNTIME_PROTOCOL_VERSION}.error`;
+var RUNTIME_CANCEL_TYPE = `${RUNTIME_PROTOCOL_VERSION}.cancel`;
+var RUNTIME_NEXT_TYPE = `${RUNTIME_PROTOCOL_VERSION}.next`;
+var RUNTIME_CREDIT_TYPE = `${RUNTIME_PROTOCOL_VERSION}.credit`;
+function record(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function text(value) {
+  return typeof value === "string" && value.length > 0;
+}
+var MAX_CALL_ID_LENGTH = 128;
+var MAX_ID_LENGTH = 256;
+var MAX_VERSION_LENGTH = 64;
+var MAX_ERROR_MESSAGE_LENGTH = 1024;
+var MAX_SNAPSHOT_UNITS = 512;
+var MAX_SNAPSHOT_SERVICES = 1024;
+function boundedText(value, maximum) {
+  return text(value) && value.length <= maximum;
+}
+function phase(value) {
+  return value === "validate" || value === "wait" || value === "dispatch" || value === "execute" || value === "receive" || value === "dispose";
+}
+function validDetails(value) {
+  if (value === void 0) return true;
+  if (!record(value)) return false;
+  try {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) return false;
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key !== "string") return false;
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor?.enumerable || !("value" in descriptor)) return false;
+    }
+  } catch {
+    return false;
+  }
+  let budget = 0;
+  for (const [key, child] of Object.entries(value)) {
+    if (key.length > 128) return false;
+    if (typeof child === "string") {
+      if (child.length > 1024) return false;
+      budget += key.length * 2 + child.length * 2;
+    } else if (typeof child === "number") {
+      if (!Number.isFinite(child)) return false;
+      budget += key.length * 2 + 8;
+    } else if (typeof child === "boolean" || child === null) budget += key.length * 2 + 8;
+    else return false;
+    if (budget > 4 * 1024) return false;
+  }
+  return true;
+}
+function validIdentity(message2) {
+  return boundedText(message2.protocolVersion, MAX_VERSION_LENGTH) && message2.protocolVersion === RUNTIME_PROTOCOL_VERSION;
+}
+function validServiceIdentity(message2) {
+  return boundedText(message2.callId, MAX_CALL_ID_LENGTH) && boundedText(message2.serviceInstanceId, MAX_ID_LENGTH);
+}
+function validateSnapshot(value) {
+  if (value.type !== RUNTIME_SNAPSHOT_TYPE || !validIdentity(value) || !boundedText(value.runtimeId, MAX_ID_LENGTH) || !boundedText(value.runtimeInstanceId, MAX_ID_LENGTH) || value.runtimeKind !== "window-main" && value.runtimeKind !== "shared-worker" || !Number.isSafeInteger(value.revision) || value.revision < 0 || !["starting", "ready", "stopping", "failed", "disposed"].includes(String(value.state)) || !Array.isArray(value.units) || !Array.isArray(value.services) || value.units.length > MAX_SNAPSHOT_UNITS || value.services.length > MAX_SNAPSHOT_SERVICES) return false;
+  if (value.state !== "ready" && value.services.length !== 0) return false;
+  const unitKeys = /* @__PURE__ */ new Set();
+  for (const unit of value.units) {
+    if (!record(unit) || !boundedText(unit.pluginId, MAX_ID_LENGTH) || !boundedText(unit.unitId, MAX_ID_LENGTH) || unit.runtime !== value.runtimeKind || !["registered", "starting", "stopping", "enabled", "disabled", "blocked", "error-disabled", "cleanup-pending", "unknown"].includes(String(unit.state))) return false;
+    if (unit.instanceId !== void 0 && !boundedText(unit.instanceId, MAX_ID_LENGTH)) return false;
+    const key = `${unit.pluginId}\0${unit.unitId}`;
+    if (unitKeys.has(key)) return false;
+    unitKeys.add(key);
+  }
+  const serviceKeys = /* @__PURE__ */ new Set();
+  for (const item of value.services) {
+    if (!record(item) || item.kind !== "rpc" && item.kind !== "stream" || !boundedText(item.capabilityId, MAX_ID_LENGTH) || !boundedText(item.contractVersion, MAX_VERSION_LENGTH) || !boundedText(item.serviceInstanceId, MAX_ID_LENGTH) || !record(item.attributes) || Array.isArray(item.attributes)) return false;
+    try {
+      const stats = validateDto(item.attributes, { limits: ATTRIBUTES_DTO_LIMITS, phase: "validate" });
+      if (stats.messagePorts.length > 0 || stats.reachableTransferables.length > 0) return false;
+    } catch {
+      return false;
+    }
+    if (item.grantId !== void 0 && !boundedText(item.grantId, MAX_ID_LENGTH)) return false;
+    if (item.authorizationRevision !== void 0 && (!Number.isSafeInteger(item.authorizationRevision) || item.authorizationRevision < 0)) return false;
+    const key = `${item.kind}\0${item.capabilityId}\0${item.contractVersion}`;
+    if (serviceKeys.has(key)) return false;
+    serviceKeys.add(key);
+  }
+  return true;
+}
+function validateMessage(value) {
+  if (!record(value) || !text(value.type) || !validIdentity(value)) return false;
+  if (value.type === RUNTIME_SNAPSHOT_TYPE) return validateSnapshot(value);
+  if (value.type === RUNTIME_ERROR_TYPE) return boundedText(value.code, MAX_ID_LENGTH) && boundedText(value.message, MAX_ERROR_MESSAGE_LENGTH) && phase(value.phase) && (value.pluginId === void 0 || boundedText(value.pluginId, MAX_ID_LENGTH)) && (value.unitId === void 0 || boundedText(value.unitId, MAX_ID_LENGTH));
+  if (value.type === RUNTIME_CALL_TYPE) return validServiceIdentity(value) && boundedText(value.capabilityId, MAX_ID_LENGTH) && boundedText(value.contractVersion, MAX_VERSION_LENGTH) && Object.hasOwn(value, "request") && validPayload(value.request) && (value.mode === "unary" || value.mode === "stream") && typeof value.timeoutMs === "number" && Number.isFinite(value.timeoutMs) && value.timeoutMs > 0 && value.timeoutMs <= 3e5 && (value.operationId === void 0 || boundedText(value.operationId, MAX_ID_LENGTH)) && (value.grantId === void 0 || boundedText(value.grantId, MAX_ID_LENGTH)) && (value.mode !== "stream" ? !Object.hasOwn(value, "initialCredit") : Number.isSafeInteger(value.initialCredit) && value.initialCredit >= 1 && value.initialCredit <= 256);
+  if (value.type === RUNTIME_RESULT_TYPE) return validServiceIdentity(value) && ((!Object.hasOwn(value, "result") || validPayload(value.result)) && (value.streamReady === true && !Object.hasOwn(value, "result") && !Object.hasOwn(value, "done") || value.done === true && !Object.hasOwn(value, "result") && !Object.hasOwn(value, "streamReady") || Object.hasOwn(value, "result") && !Object.hasOwn(value, "done") && !Object.hasOwn(value, "streamReady")));
+  if (value.type === RUNTIME_ERROR_MESSAGE_TYPE) return validServiceIdentity(value) && record(value.error) && boundedText(value.error.code, MAX_ID_LENGTH) && boundedText(value.error.message, MAX_ERROR_MESSAGE_LENGTH) && phase(value.error.phase) && validDetails(value.error.details);
+  if (value.type === RUNTIME_CANCEL_TYPE) return validServiceIdentity(value);
+  if (value.type === RUNTIME_NEXT_TYPE) return validServiceIdentity(value) && Object.hasOwn(value, "item") && validPayload(value.item) && Number.isSafeInteger(value.sequence) && value.sequence >= 1;
+  if (value.type === RUNTIME_CREDIT_TYPE) return validServiceIdentity(value) && Number.isSafeInteger(value.count) && value.count >= 1 && value.count <= 256;
+  return false;
+}
+function validPayload(value) {
+  try {
+    validateDto(value, { allowUnlistedMessagePorts: true, phase: "validate" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createRuntimeMessageCodec() {
+  return {
+    encode(message2) {
+      if (!validateMessage(message2)) throw new WebLoomError("invalid_snapshot", "Invalid WebLoom runtime message", "validate");
+      return message2;
+    },
+    decode(value) {
+      if (!record(value) || value.protocolVersion !== RUNTIME_PROTOCOL_VERSION) throw new WebLoomError("protocol_mismatch", "Unsupported WebLoom runtime protocol", "validate");
+      if (!validateMessage(value)) throw new WebLoomError("invalid_snapshot", "Invalid WebLoom runtime message", "validate");
+      return value;
+    }
+  };
+}
+function isRuntimeSnapshot(value) {
+  return value.type === RUNTIME_SNAPSHOT_TYPE;
+}
+
+// src/host/capabilityRegistry.ts
+function cloneReference(reference) {
+  return Object.freeze({
+    ...reference,
+    attributes: Object.freeze({ ...reference.attributes })
+  });
+}
+function createCapabilityRegistry() {
+  const entries = /* @__PURE__ */ new Map();
+  const requireCapability = (capability) => {
+    const entry = entries.get(capabilityKey(capability));
+    if (!entry) throw new Error(`Capability "${capability.id}" version "${capability.version}" is not available`);
+    return entry;
+  };
+  return {
+    provide(capability, value, ownerId = "host", scope) {
+      if (capability.kind !== "local") throw new TypeError(`Capability "${capability.id}" is not local`);
+      const key = capabilityKey(capability);
+      if (entries.has(key)) throw new Error(`Capability "${capability.id}" version "${capability.version}" is already provided`);
+      const reference = cloneReference({
+        kind: "rpc",
+        capabilityId: capability.id,
+        contractVersion: capability.version,
+        runtime: "window-main",
+        runtimeInstanceId: "local",
+        serviceInstanceId: `local:${ownerId}:${capability.id}:${capability.version}`,
+        attributes: {}
+      });
+      entries.set(key, { capability, ownerId, value, scope, reference });
+    },
+    handle(capability, handler, ownerId, scope, reference, peerDependencies) {
+      if (capability.kind !== "rpc") throw new TypeError(`Capability "${capability.id}" is not an RPC capability`);
+      const key = capabilityKey(capability);
+      if (entries.has(key)) throw new Error(`Capability "${capability.id}" version "${capability.version}" is already handled`);
+      entries.set(key, {
+        capability,
+        ownerId,
+        handler,
+        scope,
+        ...peerDependencies ? { peerDependencies: Object.freeze([...peerDependencies]) } : {},
+        reference: cloneReference({ ...reference, kind: "rpc" })
+      });
+    },
+    stream(capability, handler, ownerId, scope, reference, peerDependencies) {
+      if (capability.kind !== "stream") throw new TypeError(`Capability "${capability.id}" is not a stream capability`);
+      const key = capabilityKey(capability);
+      if (entries.has(key)) throw new Error(`Capability "${capability.id}" version "${capability.version}" is already handled`);
+      entries.set(key, {
+        capability,
+        ownerId,
+        handler,
+        scope,
+        ...peerDependencies ? { peerDependencies: Object.freeze([...peerDependencies]) } : {},
+        reference: cloneReference({ ...reference, kind: "stream" })
+      });
+    },
+    revoke(capability, ownerId) {
+      const key = capabilityKey(capability);
+      const entry = entries.get(key);
+      if (!entry) return;
+      if (ownerId !== void 0 && entry.ownerId !== ownerId) return;
+      entries.delete(key);
+    },
+    get(capability) {
+      const entry = requireCapability(capability);
+      if (capability.kind !== "local" || entry.value === void 0) {
+        throw new Error(`Capability "${capability.id}" is not a local value`);
+      }
+      return entry.value;
+    },
+    registration: (capability) => entries.get(capabilityKey(capability)),
+    has: (capability) => entries.has(capabilityKey(capability)),
+    require: requireCapability,
+    descriptors: () => Object.freeze([...entries.values()].map((entry) => capabilityDescriptor(entry.capability))),
+    registrations: () => Object.freeze([...entries.values()]),
+    async invoke(capability, request, call) {
+      const entry = requireCapability(capability);
+      if (capability.kind !== "rpc" || typeof entry.handler !== "function") {
+        throw new Error(`Capability "${capability.id}" is not an RPC handler`);
+      }
+      return await invokeCapabilityHandler(entry, request, call);
+    },
+    async openStream(capability, request, call) {
+      const entry = requireCapability(capability);
+      if (capability.kind !== "stream" || typeof entry.handler !== "function") {
+        throw new Error(`Capability "${capability.id}" is not a stream handler`);
+      }
+      return await invokeCapabilityHandler(entry, request, call);
+    }
+  };
+}
+function invokeCapabilityHandler(registration, request, context) {
+  if (registration.capability.kind === "rpc") {
+    const capability = registration.capability;
+    const handler = registration.handler;
+    if (!handler) throw new Error(`Capability "${registration.capability.id}" has no RPC handler`);
+    let parsed;
+    try {
+      parsed = capability.request.parse(request);
+    } catch (error2) {
+      throw new WebLoomError("request_validation_failed", error2 instanceof Error ? error2.message : String(error2), "validate", { capabilityId: capability.id });
+    }
+    return handler(parsed, context);
+  }
+  if (registration.capability.kind === "stream") {
+    const capability = registration.capability;
+    const handler = registration.handler;
+    if (!handler) throw new Error(`Capability "${registration.capability.id}" has no stream handler`);
+    let parsed;
+    try {
+      parsed = capability.request.parse(request);
+    } catch (error2) {
+      throw new WebLoomError("request_validation_failed", error2 instanceof Error ? error2.message : String(error2), "validate", { capabilityId: capability.id });
+    }
+    return handler(parsed, context);
+  }
+  throw new Error(`Capability "${registration.capability.id}" cannot be invoked remotely`);
+}
+
+// src/host/pluginGraph.ts
+function unitCandidates(manifest, runtime) {
+  const units = [...manifest.units ?? []];
+  if (units.length === 0) {
+    return [{ id: manifest.id, ...runtime !== void 0 ? { runtime } : {} }];
+  }
+  if (runtime === void 0) return units;
+  return units.filter((unit) => unit.runtime === void 0 || unit.runtime === runtime);
+}
+function selectRuntimeUnit(manifest, runtime) {
+  const units = unitCandidates(manifest, runtime);
+  if (units.length !== 1) return void 0;
+  const unit = units[0];
+  if (!unit) return void 0;
+  const selectedRuntime = unit.runtime ?? runtime ?? "window-main";
+  if (selectedRuntime === void 0) return void 0;
+  return { ...unit, runtime: selectedRuntime };
+}
+function dependenciesOfManifest(manifest, runtime) {
+  const unit = selectRuntimeUnit(manifest, runtime);
+  return (unit?.dependencies ?? []).filter((dependency) => dependency.source !== "peer");
+}
+function providesOfManifest(manifest, runtime) {
+  const unit = selectRuntimeUnit(manifest, runtime);
+  return unit?.provides ?? [];
+}
+function descriptorKey(value) {
+  return capabilityKey(value);
+}
+function keysForBuiltin(value) {
+  const result = /* @__PURE__ */ new Set();
+  for (const item of value ?? []) result.add(typeof item === "string" ? item : descriptorKey(item));
+  return result;
+}
+function freezeRecord(record2) {
+  for (const value of Object.values(record2)) if (Array.isArray(value)) Object.freeze(value);
+  return Object.freeze(record2);
+}
+function capabilityLabel(capability) {
+  return `${capability.kind}:${capability.id}@${capability.version}`;
+}
+function collectUnits(manifests, runtime) {
+  const result = /* @__PURE__ */ new Map();
+  for (const manifest of manifests) {
+    for (const unit of unitCandidates(manifest, runtime)) {
+      const selectedRuntime = unit.runtime ?? runtime;
+      if (!selectedRuntime) continue;
+      result.set(`${manifest.id}\0${unit.id}`, {
+        pluginId: manifest.id,
+        unitId: unit.id,
+        runtime: selectedRuntime,
+        dependencies: Object.freeze([...unit.dependencies ?? []].filter((item) => item.source !== "peer").map((item) => item.capability)),
+        provides: Object.freeze([...unit.provides ?? []])
+      });
+    }
+  }
+  return result;
+}
+function buildPluginGraph(manifests, options = {}) {
+  const dependencies = {};
+  const optionalDependencies = {};
+  const provides = {};
+  const providers = {};
+  const reverse = {};
+  const unitMap = collectUnits(manifests, options.runtime);
+  const enabled = options.enabledPluginIds ?? /* @__PURE__ */ new Set();
+  for (const manifest of manifests) {
+    const deps = [...dependenciesOfManifest(manifest, options.runtime)];
+    dependencies[manifest.id] = Object.freeze(deps.filter((item) => !item.optional).map((item) => item.capability));
+    optionalDependencies[manifest.id] = Object.freeze(deps.filter((item) => item.optional).map((item) => item.capability));
+    const offered = [...providesOfManifest(manifest, options.runtime)];
+    provides[manifest.id] = Object.freeze(offered);
+    for (const capability of offered) (providers[descriptorKey(capability)] ??= []).push(manifest.id);
+  }
+  for (const manifest of manifests) {
+    const deps = [...dependenciesOfManifest(manifest, options.runtime) ?? []];
+    for (const dependency of deps) {
+      if (dependency.optional) continue;
+      for (const providerId of providers[descriptorKey(dependency.capability)] ?? []) {
+        (reverse[providerId] ??= []).push({
+          pluginId: manifest.id,
+          enabled: enabled.has(manifest.id),
+          capabilities: Object.freeze([dependency.capability])
+        });
+      }
+    }
+  }
+  const cycles = [];
+  const byId = new Map(manifests.map((manifest) => [manifest.id, manifest]));
+  const visiting = [];
+  const visited = /* @__PURE__ */ new Set();
+  const visit = (pluginId) => {
+    const start = visiting.indexOf(pluginId);
+    if (start >= 0) {
+      cycles.push(Object.freeze([...visiting.slice(start), pluginId]));
+      return;
+    }
+    if (visited.has(pluginId)) return;
+    const manifest = byId.get(pluginId);
+    if (!manifest) return;
+    visiting.push(pluginId);
+    for (const dependency of dependenciesOfManifest(manifest, options.runtime)) {
+      if (dependency.optional) continue;
+      for (const providerId of providers[descriptorKey(dependency.capability)] ?? []) visit(providerId);
+    }
+    visiting.pop();
+    visited.add(pluginId);
+  };
+  for (const manifest of manifests) visit(manifest.id);
+  const reverseFrozen = {};
+  for (const [pluginId, values] of Object.entries(reverse)) reverseFrozen[pluginId] = Object.freeze(values);
+  const providerFrozen = {};
+  for (const [key, values] of Object.entries(providers)) providerFrozen[key] = Object.freeze(values);
+  const units = {};
+  for (const [key, value] of unitMap) units[key] = value;
+  return Object.freeze({
+    plugins: Object.freeze(manifests.map((manifest) => manifest.id)),
+    dependencies: freezeRecord(dependencies),
+    optionalDependencies: freezeRecord(optionalDependencies),
+    provides: freezeRecord(provides),
+    reverse: freezeRecord(reverseFrozen),
+    providers: freezeRecord(providerFrozen),
+    cycles: Object.freeze(cycles),
+    units: Object.freeze(units)
+  });
+}
+function validatePluginGraph(manifests, options = {}) {
+  const ids = /* @__PURE__ */ new Set();
+  const providerRuntime = /* @__PURE__ */ new Map();
+  for (const manifest of manifests) {
+    if (!manifest || typeof manifest.id !== "string" || manifest.id.trim() === "") throw new TypeError("Plugin id must be a non-empty string");
+    if (ids.has(manifest.id)) throw new Error(`Plugin "${manifest.id}" is duplicated`);
+    ids.add(manifest.id);
+    if (typeof manifest.name !== "string" || manifest.name.trim() === "") throw new TypeError(`Plugin "${manifest.id}" name must be a non-empty string`);
+    if (manifest.startup !== "required" && manifest.startup !== "optional") throw new TypeError(`Plugin "${manifest.id}" startup must be required or optional`);
+    if (typeof manifest.defaultEnabled !== "boolean" || typeof manifest.canDisable !== "boolean") throw new TypeError(`Plugin "${manifest.id}" startup policy is incomplete`);
+    if (manifest.startup === "required" && (!manifest.defaultEnabled || manifest.canDisable)) throw new TypeError(`Plugin "${manifest.id}" required startup policy is inconsistent`);
+    const unitIds = /* @__PURE__ */ new Set();
+    for (const unit of manifest.units ?? []) {
+      if (!unit || typeof unit.id !== "string" || unit.id.trim() === "" || unitIds.has(unit.id)) throw new TypeError(`Plugin "${manifest.id}" has a duplicate or empty unit id`);
+      unitIds.add(unit.id);
+      if (unit.runtime !== void 0 && unit.runtime !== "window-main" && unit.runtime !== "shared-worker") throw new TypeError(`Plugin "${manifest.id}" unit "${unit.id}" has an invalid Runtime`);
+      const seenProvides = /* @__PURE__ */ new Set();
+      for (const capability of unit.provides ?? []) {
+        if (!isCapabilityDescriptor(capability)) throw new TypeError(`Plugin "${manifest.id}" has an invalid capability descriptor`);
+        const key = descriptorKey(capability);
+        if (seenProvides.has(key)) throw new Error(`Plugin "${manifest.id}" provides ${capabilityLabel(capability)} more than once`);
+        seenProvides.add(key);
+        const previousRuntime = providerRuntime.get(key);
+        if (providerRuntime.has(key) && previousRuntime === unit.runtime) throw new Error(`Capability ${capabilityLabel(capability)} has ambiguous providers`);
+        if (!providerRuntime.has(key)) providerRuntime.set(key, unit.runtime);
+      }
+      for (const dependency of unit.dependencies ?? []) {
+        if (!dependency || !isCapabilityDescriptor(dependency.capability)) throw new TypeError(`Plugin "${manifest.id}" has an invalid dependency descriptor`);
+        if (dependency.source !== void 0 && dependency.source !== "peer") throw new TypeError(`Plugin "${manifest.id}" has an invalid dependency source`);
+        if (dependency.source === "peer" && dependency.sourceRuntime !== void 0) throw new TypeError(`Plugin "${manifest.id}" peer dependency cannot declare sourceRuntime`);
+        if (dependency.source !== "peer" && dependency.sourceRuntime !== "window-main" && dependency.sourceRuntime !== "shared-worker") throw new TypeError(`Plugin "${manifest.id}" has an invalid dependency Runtime`);
+        if (dependency.source === "peer" && dependency.capability.kind === "local") {
+          throw new TypeError(`Plugin "${manifest.id}" cannot depend on local capability "${dependency.capability.id}" through a peer`);
+        }
+        if (dependency.source !== "peer" && dependency.capability.kind === "local" && dependency.sourceRuntime !== (unit.runtime ?? options.runtime)) {
+          throw new TypeError(`Plugin "${manifest.id}" cannot depend on local capability "${dependency.capability.id}" from another Runtime`);
+        }
+      }
+    }
+  }
+  const graph = buildPluginGraph(manifests, options);
+  if (graph.cycles.length > 0) throw new Error(`Plugin dependency cycle: ${graph.cycles[0]?.join(" -> ") ?? "unknown"}`);
+  const builtin = keysForBuiltin(options.builtinCapabilities);
+  for (const manifest of manifests) {
+    for (const dependency of dependenciesOfManifest(manifest, options.runtime)) {
+      const key = descriptorKey(dependency.capability);
+      const providerCount = graph.providers[key]?.length ?? 0;
+      const external = options.externalRuntimeDependencies === true && dependency.sourceRuntime !== options.runtime;
+      if (providerCount === 0 && !builtin.has(key) && !external && !dependency.optional && options.allowMissingDependencies !== true) throw new Error(`Plugin "${manifest.id}" requires missing capability ${capabilityLabel(dependency.capability)}`);
+      if (providerCount > 1 && !external) throw new Error(`Capability ${capabilityLabel(dependency.capability)} has ambiguous providers`);
+    }
+  }
+}
+function reverseDependentsOf(graph, pluginId, enabledPluginIds) {
+  return (graph.reverse[pluginId] ?? []).filter((item) => enabledPluginIds === void 0 || enabledPluginIds.has(item.pluginId));
+}
+
+// src/lifecycle/resourceScope.ts
+function makeId(prefix) {
+  try {
+    if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+      return `${prefix}:${crypto.randomUUID()}`;
+    }
+  } catch {
+  }
+  return `${prefix}:${Date.now().toString(36)}:${Math.random().toString(36).slice(2)}`;
+}
+function errorMessage(error2) {
+  if (error2 instanceof Error) return error2.message;
+  return typeof error2 === "string" ? error2 : String(error2);
+}
+function isPositiveFiniteNumber(value) {
+  return value !== void 0 && Number.isFinite(value) && value >= 0;
+}
+function cloneScopeAttributes(value) {
+  let clone;
+  try {
+    const structuredCloneFn = globalThis.structuredClone;
+    clone = structuredCloneFn ? structuredCloneFn(value ?? {}) : { ...value ?? {} };
+  } catch {
+    throw new TypeError("Lifecycle scope attributes must be structured-cloneable");
+  }
+  if (!clone || typeof clone !== "object" || Array.isArray(clone)) throw new TypeError("Lifecycle scope attributes must be a record");
+  const freeze = (current, seen) => {
+    if (!current || typeof current !== "object" || seen.has(current)) return;
+    seen.add(current);
+    if (Array.isArray(current)) for (const item of current) freeze(item, seen);
+    else for (const item of Object.values(current)) freeze(item, seen);
+    Object.freeze(current);
+  };
+  freeze(clone, /* @__PURE__ */ new Set());
+  return clone;
+}
+function createLifecycleScope(options) {
+  const metadata = options.metadata;
+  const identity = {
+    scopeId: options.scopeId ?? makeId(`scope:${options.kind}`),
+    instanceId: options.instanceId ?? makeId("instance"),
+    kind: options.kind,
+    ...metadata,
+    attributes: cloneScopeAttributes(metadata?.attributes)
+  };
+  const controller = new AbortController();
+  const revokeListeners = /* @__PURE__ */ new Set();
+  const entries = /* @__PURE__ */ new Map();
+  const usedIds = /* @__PURE__ */ new Set();
+  let currentState = "active";
+  let revokeReason = "scope revoked";
+  let disposalPromise;
+  let refreshPublishedDisposeResult;
+  const disposeResultNotifier = options.onDisposeResult;
+  const notifyChange = (scope) => {
+    try {
+      options.onChange?.(scope);
+    } catch {
+    }
+  };
+  const publicScope = {};
+  function uniqueResourceId(resourceId) {
+    const base = resourceId && resourceId.length > 0 ? resourceId : makeId("resource");
+    if (!usedIds.has(base)) {
+      usedIds.add(base);
+      return base;
+    }
+    let index = 2;
+    while (usedIds.has(`${base}#${index}`)) index += 1;
+    const unique = `${base}#${index}`;
+    usedIds.add(unique);
+    return unique;
+  }
+  function assertActive() {
+    if (currentState !== "active") {
+      throw new LifecycleScopeRevokedError(
+        `Lifecycle scope "${identity.scopeId}" is ${currentState}`
+      );
+    }
+  }
+  function addEntry(resourceId, cleanup, state, removeOnFailure = false, phase2 = "before-teardown") {
+    assertActive();
+    const entry = {
+      resourceId: uniqueResourceId(resourceId),
+      state,
+      cleanup,
+      phase: phase2,
+      cleanupStarted: false,
+      cleanupFinished: false,
+      removeOnFailure
+    };
+    entries.set(entry.resourceId, entry);
+    notifyChange(publicScope);
+    return entry;
+  }
+  function releaseEntry(entry, reason) {
+    if (entry.cleanupPromise) return entry.cleanupPromise;
+    entry.cleanupStarted = true;
+    entry.cleanupPromise = Promise.resolve().then(() => entry.cleanup(reason)).then(() => {
+      entry.cleanupFinished = true;
+      if (!entry.lateReleaseFailed) {
+        entry.state = "released";
+        entry.error = void 0;
+      }
+      notifyChange(publicScope);
+    }).catch((error2) => {
+      entry.cleanupFinished = true;
+      entry.state = "pending";
+      entry.error = errorMessage(error2);
+      notifyChange(publicScope);
+      throw error2;
+    });
+    entry.cleanupPromise.catch(() => void 0);
+    return entry.cleanupPromise;
+  }
+  function track(resource, release, resourceId) {
+    if (currentState !== "active") {
+      void Promise.resolve().then(() => release(resource, revokeReason)).catch(() => void 0);
+      throw new LifecycleScopeRevokedError();
+    }
+    let released = false;
+    addEntry(
+      resourceId,
+      async (reason) => {
+        if (released) return;
+        released = true;
+        await release(resource, reason);
+      },
+      "active"
+    );
+    return resource;
+  }
+  function acquire(resourceId, create, release) {
+    assertActive();
+    let resource;
+    let hasResource = false;
+    let released = false;
+    let resolveAcquisition;
+    let rejectAcquisition;
+    let acquisitionSettled = false;
+    const acquisitionDone = new Promise((resolve, reject) => {
+      resolveAcquisition = () => {
+        if (acquisitionSettled) return;
+        acquisitionSettled = true;
+        resolve();
+      };
+      rejectAcquisition = (error2) => {
+        if (acquisitionSettled) return;
+        acquisitionSettled = true;
+        reject(error2);
+      };
+    });
+    acquisitionDone.catch(() => void 0);
+    const entry = addEntry(
+      resourceId,
+      async (reason) => {
+        await acquisitionDone;
+        if (!hasResource || released) return;
+        released = true;
+        await release(resource, reason);
+      },
+      "acquiring",
+      true,
+      "before-teardown"
+    );
+    entry.acquisitionDone = acquisitionDone;
+    return Promise.resolve().then(() => create(controller.signal)).then(async (created) => {
+      resource = created;
+      hasResource = true;
+      if (currentState !== "active" || controller.signal.aborted || entry.cleanupStarted) {
+        if (!released) {
+          released = true;
+          try {
+            await release(created, revokeReason);
+          } catch (error2) {
+            entry.lateReleaseFailed = true;
+            entry.state = "pending";
+            entry.error = errorMessage(error2);
+            notifyChange(publicScope);
+            rejectAcquisition(error2);
+            throw error2;
+          }
+        }
+        entry.state = "released";
+        resolveAcquisition();
+        notifyChange(publicScope);
+        throw new LifecycleScopeRevokedError(
+          `Resource "${entry.resourceId}" completed after scope revoke`
+        );
+      }
+      entry.state = "active";
+      entry.removeOnFailure = false;
+      resolveAcquisition();
+      notifyChange(publicScope);
+      return created;
+    }).catch((error2) => {
+      if (!hasResource) {
+        resolveAcquisition();
+        entries.delete(entry.resourceId);
+        usedIds.delete(entry.resourceId);
+      }
+      throw error2;
+    });
+  }
+  function onDispose(cleanup, resourceId, phase2 = "before-teardown") {
+    if (currentState !== "active") {
+      void Promise.resolve().then(() => cleanup(revokeReason)).catch(() => void 0);
+      return () => void 0;
+    }
+    const entry = addEntry(resourceId, cleanup, "active", false, phase2);
+    return () => {
+      if (entry.cleanupStarted || entry.cleanupFinished) return;
+      entries.delete(entry.resourceId);
+      usedIds.delete(entry.resourceId);
+      notifyChange(publicScope);
+    };
+  }
+  function onRevoke(listener) {
+    if (currentState === "active") {
+      revokeListeners.add(listener);
+      return () => revokeListeners.delete(listener);
+    }
+    try {
+      listener(revokeReason);
+    } catch {
+    }
+    return () => void 0;
+  }
+  function revoke(reason = "scope revoked") {
+    if (currentState !== "active") return;
+    revokeReason = reason;
+    currentState = "stopping";
+    try {
+      controller.abort(new LifecycleScopeRevokedError(reason));
+    } catch {
+      controller.abort();
+    }
+    for (const listener of [...revokeListeners]) {
+      try {
+        listener(reason);
+      } catch {
+      }
+    }
+    notifyChange(publicScope);
+  }
+  async function runEntry(entry, reason, timeoutMs, issues, onLateSuccess, onLateFailure) {
+    if (entry.cleanupFinished && entry.state === "released") return "released";
+    const cleanup = releaseEntry(entry, reason);
+    if (!isPositiveFiniteNumber(timeoutMs)) {
+      try {
+        await cleanup;
+        return entry.state === "released" ? "released" : "pending";
+      } catch (error2) {
+        issues.push({
+          resourceId: entry.resourceId,
+          code: "lifecycle.cleanup_failed",
+          message: errorMessage(error2)
+        });
+        return "pending";
+      }
+    }
+    let timeoutHandle;
+    const timeout = new Promise((resolve) => {
+      timeoutHandle = setTimeout(() => resolve("timeout"), timeoutMs);
+    });
+    const result = await Promise.race([
+      cleanup.then(() => "released", (error2) => ({ error: error2 })),
+      timeout
+    ]);
+    if (timeoutHandle) clearTimeout(timeoutHandle);
+    if (result === "timeout") {
+      entry.state = "pending";
+      issues.push({
+        resourceId: entry.resourceId,
+        code: "lifecycle.cleanup_timeout",
+        message: `Cleanup timed out after ${timeoutMs}ms`
+      });
+      void cleanup.then(
+        () => {
+          try {
+            onLateSuccess?.(entry);
+          } catch {
+          }
+        },
+        (error2) => {
+          try {
+            onLateFailure?.(entry, error2);
+          } catch {
+          }
+        }
+      );
+      return "pending";
+    }
+    if (result === "released") return "released";
+    entry.state = "pending";
+    issues.push({
+      resourceId: entry.resourceId,
+      code: "lifecycle.cleanup_failed",
+      message: errorMessage(result.error)
+    });
+    return "pending";
+  }
+  async function dispose(options2 = {}) {
+    if (disposalPromise) return disposalPromise;
+    revoke(options2.reason ?? "scope disposed");
+    const reason = options2.reason ?? revokeReason;
+    const entriesToRelease = [...entries.values()].reverse();
+    disposalPromise = (async () => {
+      const errors = [];
+      const pending = /* @__PURE__ */ new Set();
+      const lateReleased = /* @__PURE__ */ new Set();
+      let released = 0;
+      let attempted = 0;
+      let resultSnapshot;
+      let resultPublished = false;
+      const publishDisposeResult = () => {
+        if (!resultPublished || !resultSnapshot) return;
+        try {
+          disposeResultNotifier?.(resultSnapshot);
+        } catch {
+        }
+      };
+      const rebuildResultSnapshot = () => {
+        if (!resultSnapshot) return;
+        const mergedPending = new Set(pending);
+        const mergedErrors = [...errors];
+        let mergedAttempted = attempted;
+        let mergedReleased = released;
+        for (const childEntry of entries.values()) {
+          const childScope = childEntry.childScope;
+          const childResult = childEntry.childResult;
+          if (!childScope || !childResult) continue;
+          const prefix = `child:${childScope.identity.scopeId}:`;
+          mergedAttempted += childResult.attempted;
+          mergedReleased += childResult.released;
+          for (const resourceId of childResult.pending) {
+            mergedPending.add(`${prefix}${resourceId}`);
+          }
+          for (const issue of childResult.errors) {
+            mergedErrors.push({
+              ...issue,
+              resourceId: `${prefix}${issue.resourceId}`
+            });
+          }
+        }
+        resultSnapshot.attempted = mergedAttempted;
+        resultSnapshot.released = mergedReleased;
+        resultSnapshot.pending = [...mergedPending];
+        resultSnapshot.errors = mergedErrors;
+        resultSnapshot.cleanupIncomplete = mergedPending.size > 0 || mergedErrors.length > 0;
+      };
+      const projectChildResult = (entry, childResult, lateResourceId, lateError) => {
+        if (!entry.childScope) return;
+        const previous = entry.childResult;
+        entry.childResult = childResult;
+        entry.state = childResult.cleanupIncomplete ? "pending" : "released";
+        entry.error = childResult.cleanupIncomplete ? childResult.errors[0]?.message ?? "Child scope cleanup is still pending" : void 0;
+        rebuildResultSnapshot();
+        publishDisposeResult();
+        if (lateResourceId && resultSnapshot) {
+          const resourceId = `child:${entry.childScope.identity.scopeId}:${lateResourceId}`;
+          try {
+            if (lateError !== void 0) options2.onLateFailure?.(resourceId, lateError, resultSnapshot);
+            else options2.onLateSuccess?.(resourceId, resultSnapshot);
+          } catch {
+          }
+        } else if (previous?.cleanupIncomplete && !childResult.cleanupIncomplete && resultSnapshot) {
+          try {
+            options2.onLateSuccess?.(`child:${entry.childScope.identity.scopeId}`, resultSnapshot);
+          } catch {
+          }
+        }
+        notifyChange(publicScope);
+      };
+      refreshPublishedDisposeResult = () => {
+        if (!resultPublished || !resultSnapshot) return;
+        rebuildResultSnapshot();
+        publishDisposeResult();
+      };
+      const onLateFailure = (entry, error2) => {
+        entry.state = "pending";
+        entry.error = errorMessage(error2);
+        if (!errors.some((issue) => issue.resourceId === entry.resourceId && issue.code === "lifecycle.cleanup_failed")) {
+          errors.push({
+            resourceId: entry.resourceId,
+            code: "lifecycle.cleanup_failed",
+            message: errorMessage(error2)
+          });
+        }
+        pending.add(entry.resourceId);
+        if (resultSnapshot) {
+          rebuildResultSnapshot();
+        }
+        publishDisposeResult();
+        try {
+          options2.onLateFailure?.(entry.resourceId, error2, resultSnapshot);
+        } catch {
+        }
+        notifyChange(publicScope);
+      };
+      const onLateSuccess = (entry) => {
+        if (lateReleased.has(entry.resourceId)) return;
+        lateReleased.add(entry.resourceId);
+        pending.delete(entry.resourceId);
+        released += 1;
+        for (let index = errors.length - 1; index >= 0; index -= 1) {
+          const issue = errors[index];
+          if (issue?.resourceId === entry.resourceId && issue.code === "lifecycle.cleanup_timeout") {
+            errors.splice(index, 1);
+          }
+        }
+        if (resultSnapshot) {
+          rebuildResultSnapshot();
+        }
+        publishDisposeResult();
+        try {
+          options2.onLateSuccess?.(entry.resourceId, resultSnapshot);
+        } catch {
+        }
+        notifyChange(publicScope);
+      };
+      const releasePhase = async (phase2) => {
+        for (const entry of entriesToRelease.filter((item) => item.phase === phase2)) {
+          if (entry.childScope) {
+            entry.cleanupStarted = true;
+            try {
+              const childResult = await entry.childScope.dispose({
+                reason,
+                timeoutMs: options2.timeoutMs,
+                onLateSuccess: (resourceId, result2) => {
+                  if (result2) projectChildResult(entry, result2, resourceId);
+                },
+                onLateFailure: (resourceId, error2, result2) => {
+                  if (result2) projectChildResult(entry, result2, resourceId, error2);
+                }
+              });
+              entry.cleanupFinished = true;
+              projectChildResult(entry, childResult);
+            } catch (error2) {
+              entry.cleanupFinished = true;
+              entry.state = "pending";
+              entry.error = errorMessage(error2);
+              pending.add(entry.resourceId);
+              errors.push({
+                resourceId: entry.resourceId,
+                code: "lifecycle.cleanup_failed",
+                message: errorMessage(error2)
+              });
+              notifyChange(publicScope);
+            }
+            continue;
+          }
+          attempted += 1;
+          const result = await runEntry(entry, reason, options2.timeoutMs, errors, onLateSuccess, onLateFailure);
+          if (result === "released") released += 1;
+          else if (!lateReleased.has(entry.resourceId)) pending.add(entry.resourceId);
+        }
+      };
+      await releasePhase("before-teardown");
+      if (options2.teardown) {
+        const teardownEntry = {
+          resourceId: "scope:teardown",
+          state: "active",
+          cleanup: options2.teardown,
+          phase: "before-teardown",
+          cleanupStarted: false,
+          cleanupFinished: false,
+          removeOnFailure: false
+        };
+        attempted += 1;
+        const result = await runEntry(teardownEntry, reason, options2.timeoutMs, errors, onLateSuccess, onLateFailure);
+        if (result === "released") released += 1;
+        else if (!lateReleased.has(teardownEntry.resourceId)) pending.add(teardownEntry.resourceId);
+      }
+      await releasePhase("after-teardown");
+      currentState = "stopped";
+      notifyChange(publicScope);
+      resultSnapshot = {
+        scopeId: identity.scopeId,
+        state: "stopped",
+        attempted,
+        released,
+        pending: [...pending],
+        errors,
+        cleanupIncomplete: pending.size > 0 || errors.length > 0
+      };
+      rebuildResultSnapshot();
+      resultPublished = true;
+      publishDisposeResult();
+      return resultSnapshot;
+    })();
+    return disposalPromise;
+  }
+  function resources() {
+    return [...entries.values()].map((entry) => ({
+      resourceId: entry.resourceId,
+      state: entry.state,
+      ...entry.error ? { error: entry.error } : {}
+    }));
+  }
+  function child(kind, metadata2 = {}) {
+    assertActive();
+    let childEntry;
+    const childScope = createLifecycleScope({
+      kind,
+      metadata: {
+        ...metadata2,
+        parentScopeId: identity.scopeId
+      },
+      // 父作用域的 Host 订阅者也必须看到子作用域资源的状态变化。
+      onChange: () => notifyChange(publicScope),
+      // 只有子作用域已经生成最终结果后，父级才允许更新/删除登记。
+      onDisposeResult: (result) => {
+        const entry2 = childEntry;
+        if (!entry2) return;
+        entry2.childResult = result;
+        entry2.state = result.cleanupIncomplete ? "pending" : "released";
+        entry2.error = result.cleanupIncomplete ? result.errors[0]?.message ?? "Child scope cleanup is still pending" : void 0;
+        refreshPublishedDisposeResult?.();
+        if (!result.cleanupIncomplete && !disposalPromise && !entry2.cleanupStarted) {
+          entries.delete(entry2.resourceId);
+          usedIds.delete(entry2.resourceId);
+        }
+        notifyChange(publicScope);
+      }
+    });
+    const removeRevoke = onRevoke((reason) => childScope.revoke(reason));
+    const entry = addEntry(`child:${childScope.identity.scopeId}`, async () => void 0, "active");
+    childEntry = entry;
+    entry.childScope = childScope;
+    childScope.onDispose(() => {
+      removeRevoke();
+    }, `parent-link:${identity.scopeId}`);
+    return childScope;
+  }
+  function listen(target, event, listener, options2) {
+    assertActive();
+    if (!target || typeof target.addEventListener !== "function" || typeof target.removeEventListener !== "function") {
+      throw new TypeError("Lifecycle scope listen target must be an EventTarget");
+    }
+    let active = true;
+    target.addEventListener(event, listener, options2);
+    let removeRevoke;
+    const release = () => {
+      if (!active) return;
+      active = false;
+      target.removeEventListener(event, listener, options2);
+      removeRevoke?.();
+    };
+    removeRevoke = onRevoke(release);
+    if (!active) release();
+    return release;
+  }
+  function interval(callback, milliseconds) {
+    assertActive();
+    if (typeof callback !== "function") throw new TypeError("Lifecycle scope interval callback must be a function");
+    if (!Number.isFinite(milliseconds) || milliseconds < 0) throw new TypeError("Lifecycle scope interval milliseconds must be a finite non-negative number");
+    const handle = setInterval(callback, milliseconds);
+    let active = true;
+    let removeRevoke;
+    const release = () => {
+      if (!active) return;
+      active = false;
+      clearInterval(handle);
+      removeRevoke?.();
+    };
+    removeRevoke = onRevoke(release);
+    if (!active) release();
+    return release;
+  }
+  function subscribe(subscribeFn, listener) {
+    assertActive();
+    if (typeof subscribeFn !== "function" || typeof listener !== "function") {
+      throw new TypeError("Lifecycle scope subscribe requires functions");
+    }
+    let active = true;
+    let unsubscribe;
+    let removeRevoke;
+    const release = () => {
+      if (!active) return;
+      active = false;
+      removeRevoke?.();
+      unsubscribe?.();
+    };
+    removeRevoke = onRevoke(release);
+    try {
+      const candidate = subscribeFn(listener);
+      if (typeof candidate !== "function") throw new TypeError("Lifecycle subscribe function must return an unsubscribe function");
+      unsubscribe = candidate;
+      if (!active) unsubscribe();
+    } catch (error2) {
+      release();
+      throw error2;
+    }
+    return release;
+  }
+  Object.assign(publicScope, {
+    identity,
+    signal: controller.signal,
+    onRevoke,
+    onDispose,
+    track,
+    acquire,
+    child,
+    revoke,
+    dispose,
+    assertActive,
+    resources,
+    listen,
+    interval,
+    subscribe
+  });
+  Object.defineProperty(publicScope, "state", {
+    enumerable: true,
+    configurable: false,
+    get: () => currentState
+  });
+  return publicScope;
+}
+var createResourceScope = createLifecycleScope;
+
+// src/lifecycle/permissionLease.ts
+function uniquePermissions(permissions) {
+  return [...new Set(permissions ?? [])];
+}
+function sameBindingValue(actual, expected) {
+  return expected === void 0 || actual === expected;
+}
+function sameAttributes(actual, expected) {
+  if (expected === void 0) return true;
+  return Object.keys(expected).every((key) => Object.is(actual[key], expected[key]));
+}
+function normalizedRevision(value, name) {
+  if (value === void 0) return void 0;
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${name} must be a non-negative safe integer`);
+  return value;
+}
+function createPermissionLease(options) {
+  const binding = {
+    ...options.identity,
+    requested: Object.freeze(uniquePermissions(options.requested)),
+    approved: Object.freeze(uniquePermissions(options.approved)),
+    ...options.sessionConstraints ? { sessionConstraints: Object.freeze(uniquePermissions(options.sessionConstraints)) } : {},
+    ...options.policyRevision !== void 0 ? { policyRevision: normalizedRevision(options.policyRevision, "policyRevision") } : {},
+    ...options.grantRevision !== void 0 ? { grantRevision: normalizedRevision(options.grantRevision, "grantRevision") } : {},
+    ...options.grantId !== void 0 ? { grantId: options.grantId } : {}
+  };
+  Object.freeze(binding);
+  const granted = new Set(
+    binding.requested.filter(
+      (permission) => binding.approved.includes(permission) && (binding.sessionConstraints === void 0 || binding.sessionConstraints.includes(permission))
+    )
+  );
+  let revoked = false;
+  let revokeReason = "permission lease revoked";
+  const lease = {
+    binding,
+    get revoked() {
+      return revoked || options.scope !== void 0 && options.scope.state !== "active";
+    },
+    has(permission) {
+      return !lease.revoked && granted.has(permission);
+    },
+    assert(permission) {
+      if (lease.revoked) {
+        throw new PermissionLeaseRevokedError(revokeReason);
+      }
+      if (!granted.has(permission)) {
+        throw new PermissionDeniedError(permission);
+      }
+    },
+    assertBinding(expected) {
+      if (!sameBindingValue(binding.pluginId, expected.pluginId) || !sameBindingValue(binding.instanceId, expected.instanceId) || !sameAttributes(binding.attributes, expected.attributes) || !sameBindingValue(binding.policyRevision, expected.policyRevision) || !sameBindingValue(binding.grantRevision, expected.grantRevision) || !sameBindingValue(binding.grantId, expected.grantId)) {
+        throw new PermissionLeaseRevokedError("Permission lease identity does not match");
+      }
+      if (lease.revoked) throw new PermissionLeaseRevokedError(revokeReason);
+    },
+    revoke(reason = "permission lease revoked") {
+      if (revoked) return;
+      revoked = true;
+      revokeReason = reason;
+    }
+  };
+  if (options.scope) {
+    options.scope.onRevoke((reason) => lease.revoke(reason));
+    options.scope.onDispose((reason) => lease.revoke(reason), "permission-lease");
+  }
+  return lease;
+}
+
+// src/lifecycle/taskScheduler.ts
+function errorMessage2(error2) {
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+function createScopedTaskScheduler(scope, options = {}) {
+  const tasks = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Set();
+  let disposed = false;
+  const notify = () => {
+    const value = [...tasks.values()].map((task) => ({
+      id: task.definition.id,
+      pluginId: task.definition.pluginId ?? scope.identity.pluginId ?? "unknown",
+      label: task.definition.label,
+      state: task.state,
+      ...task.error ? { error: task.error } : {},
+      ...task.lastCompletedAt ? { lastCompletedAt: task.lastCompletedAt } : {},
+      ...task.nextRunAt ? { nextRunAt: task.nextRunAt } : {}
+    }));
+    for (const listener of [...listeners]) {
+      try {
+        listener(value);
+      } catch {
+      }
+    }
+  };
+  const clearTimer = (task) => {
+    if (task.timer !== void 0) {
+      clearTimeout(task.timer);
+      task.timer = void 0;
+    }
+    task.nextRunAt = void 0;
+  };
+  const schedule = (task) => {
+    clearTimer(task);
+    const intervalMs = task.definition.intervalMs;
+    if (!task.active || disposed || intervalMs === void 0) {
+      notify();
+      return;
+    }
+    if (!Number.isFinite(intervalMs) || intervalMs < 0) {
+      task.error = "\u4EFB\u52A1 intervalMs \u5FC5\u987B\u662F\u975E\u8D1F\u6709\u9650\u6570";
+      task.state = "failed";
+      notify();
+      return;
+    }
+    const dueAt = Date.now() + intervalMs;
+    task.nextRunAt = new Date(dueAt).toISOString();
+    task.timer = setTimeout(() => {
+      task.timer = void 0;
+      task.nextRunAt = void 0;
+      void runTask(task, "interval");
+    }, intervalMs);
+    notify();
+  };
+  const runTask = async (task, reason) => {
+    if (!task.active || disposed || scope.state !== "active") return;
+    if (task.runPromise) {
+      task.rerunRequested = true;
+      return task.runPromise;
+    }
+    task.state = "queued";
+    task.error = void 0;
+    notify();
+    const run = (async () => {
+      let requestScope;
+      let controller;
+      let abortFromScope;
+      try {
+        requestScope = scope.child("request");
+        controller = new AbortController();
+        task.controller = controller;
+        abortFromScope = () => controller?.abort(scope.signal.reason);
+        if (scope.signal.aborted) abortFromScope();
+        else scope.signal.addEventListener("abort", abortFromScope, { once: true });
+        task.state = "running";
+        notify();
+        await task.definition.run({ signal: controller.signal, reason });
+        if (!controller.signal.aborted && !requestScope.signal.aborted) {
+          task.state = "idle";
+          task.error = void 0;
+          task.lastCompletedAt = (/* @__PURE__ */ new Date()).toISOString();
+        } else {
+          task.state = "idle";
+        }
+      } catch (error2) {
+        task.state = "failed";
+        task.error = controller?.signal.aborted ? void 0 : errorMessage2(error2);
+      } finally {
+        if (abortFromScope) scope.signal.removeEventListener("abort", abortFromScope);
+        task.controller = void 0;
+        if (requestScope) {
+          await requestScope.dispose({ reason: `task ${task.definition.id} finished` });
+        }
+        if (task.active && !disposed && scope.state === "active") schedule(task);
+        else clearTimer(task);
+        notify();
+      }
+    })();
+    task.runPromise = run;
+    try {
+      await run;
+    } finally {
+      task.runPromise = void 0;
+      notify();
+      if (task.rerunRequested && task.active && !disposed && scope.state === "active") {
+        task.rerunRequested = false;
+        queueMicrotask(() => {
+          void runTask(task, "coalesced");
+        });
+      }
+    }
+  };
+  const releaseTask = async (task, reason) => {
+    if (!task.active) return;
+    task.active = false;
+    task.rerunRequested = false;
+    clearTimer(task);
+    task.controller?.abort(reason);
+    if (task.runPromise) await task.runPromise;
+    tasks.delete(task.definition.id);
+    notify();
+  };
+  const scheduler = {
+    register(definition) {
+      scope.assertActive();
+      if (!definition.id || tasks.has(definition.id)) {
+        throw new Error(`Scoped task id "${definition.id}" is already registered or empty`);
+      }
+      const task = {
+        definition: { ...definition },
+        state: "idle",
+        rerunRequested: false,
+        active: true
+      };
+      tasks.set(definition.id, task);
+      const removeScopeCleanup = scope.onDispose(
+        (reason) => releaseTask(task, reason),
+        `task:${definition.id}`
+      );
+      const unregister = () => {
+        if (!task.active) return;
+        removeScopeCleanup();
+        void releaseTask(task, "task unregistered");
+      };
+      schedule(task);
+      if (options.runOnRegister) void runTask(task, "initial");
+      return unregister;
+    },
+    async runNow(id, reason = "manual") {
+      const task = tasks.get(id);
+      if (!task) throw new Error(`Scoped task "${id}" is not registered`);
+      await runTask(task, reason);
+    },
+    async cancel(id) {
+      const task = tasks.get(id);
+      if (!task) return;
+      task.rerunRequested = false;
+      task.controller?.abort("task canceled");
+      if (task.runPromise) await task.runPromise;
+    },
+    snapshot() {
+      return [...tasks.values()].map((task) => ({
+        id: task.definition.id,
+        pluginId: task.definition.pluginId ?? scope.identity.pluginId ?? "unknown",
+        label: task.definition.label,
+        state: task.state,
+        ...task.error ? { error: task.error } : {},
+        ...task.lastCompletedAt ? { lastCompletedAt: task.lastCompletedAt } : {},
+        ...task.nextRunAt ? { nextRunAt: task.nextRunAt } : {}
+      }));
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      listener(scheduler.snapshot());
+      return () => listeners.delete(listener);
+    },
+    async dispose() {
+      if (disposed) return;
+      disposed = true;
+      for (const task of [...tasks.values()]) {
+        task.controller?.abort("task scheduler disposed");
+        clearTimer(task);
+      }
+      await Promise.all([...tasks.values()].map((task) => releaseTask(task, "task scheduler disposed")));
+      listeners.clear();
+    }
+  };
+  return scheduler;
+}
+
+// src/messaging/messageBus.ts
+function makeMessageId() {
+  if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
+    return crypto.randomUUID();
+  }
+  return `m_${Date.now().toString(36)}_${Math.floor(Math.random() * 1e9).toString(36)}`;
+}
+function errorMessage3(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  return String(err);
+}
+var MAX_HANDLER_CONCURRENCY = 128;
+function waitForHandler(result, signal) {
+  if (signal.aborted) {
+    return Promise.reject(signal.reason ?? new Error("aborted"));
+  }
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      reject(signal.reason ?? new Error("aborted"));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    result.then(resolve, reject).finally(() => {
+      signal.removeEventListener("abort", onAbort);
+    });
+  });
+}
+function createMessageBus() {
+  const subscriptions = /* @__PURE__ */ new Map();
+  const routedHandlers = /* @__PURE__ */ new Map();
+  const mailboxes = /* @__PURE__ */ new Map();
+  const targetHandlerCount = /* @__PURE__ */ new Map();
+  const targetConcurrency = /* @__PURE__ */ new Map();
+  const snapshotListeners = /* @__PURE__ */ new Set();
+  let total = 0;
+  let completed = 0;
+  let failed = 0;
+  let canceled = 0;
+  let inFlight = 0;
+  let lastError;
+  const pumping = /* @__PURE__ */ new Set();
+  function emitSnapshot() {
+    const snap = snapshot();
+    for (const l of snapshotListeners) l(snap);
+  }
+  function snapshot() {
+    const byTarget = {};
+    let queued = 0;
+    for (const [target, queue] of mailboxes.entries()) {
+      byTarget[target] = queue.length;
+      queued += queue.length;
+    }
+    return {
+      total,
+      queued,
+      inFlight,
+      completed,
+      failed,
+      canceled,
+      lastError,
+      byTarget
+    };
+  }
+  function makeMessage(type, mode, payload, options) {
+    return {
+      id: options.messageId ?? makeMessageId(),
+      type,
+      mode,
+      payload,
+      target: options.target,
+      priority: options.priority,
+      timeoutMs: options.timeoutMs,
+      causationId: options.causationId,
+      createdAt: Date.now()
+    };
+  }
+  function publishInternal(message2) {
+    total += 1;
+    const routed = routedHandlers.get(message2.type);
+    if (routed && !routed.target) {
+      try {
+        const result = routed.handler(message2);
+        if (result && typeof result.then === "function") {
+          result.catch((err) => {
+            failed += 1;
+            lastError = errorMessage3(err);
+            emitSnapshot();
+          });
+        }
+      } catch (err) {
+        failed += 1;
+        lastError = errorMessage3(err);
+      }
+    }
+    const bucket = subscriptions.get(message2.type);
+    if (bucket) {
+      for (const sub of [...bucket]) {
+        try {
+          sub.handler(message2.payload);
+        } catch (err) {
+          failed += 1;
+          lastError = errorMessage3(err);
+        }
+      }
+    }
+    emitSnapshot();
+    return message2.id;
+  }
+  function settleEntry(entry, state, value) {
+    if (entry.settled) return;
+    entry.settled = true;
+    const wasRunning = entry.state === "running";
+    entry.state = state;
+    entry.cleanup();
+    if (state === "completed") {
+      completed += 1;
+    } else if (state === "failed") {
+      failed += 1;
+      lastError = errorMessage3(value);
+    } else {
+      canceled += 1;
+      lastError = errorMessage3(value ?? entry.signal.reason);
+    }
+    if (wasRunning) inFlight -= 1;
+    emitSnapshot();
+    try {
+      entry.onSettled?.();
+    } catch (err) {
+      lastError = errorMessage3(err);
+    }
+    if (entry.mode === "request") {
+      if (state === "completed") entry.resolve(value);
+      else entry.reject(value);
+    }
+  }
+  function enqueueMessage(message2, mode, signal, onSettled) {
+    total += 1;
+    const target = message2.target;
+    if (!target) {
+      failed += 1;
+      lastError = `MessageBus.${mode === "request" ? "request" : "dispatch"} requires a target`;
+      emitSnapshot();
+      try {
+        onSettled?.();
+      } catch {
+      }
+      return mode === "request" ? Promise.reject(new Error(lastError)) : message2.id;
+    }
+    const handler = routedHandlers.get(message2.type);
+    if (!handler || handler.target !== target) {
+      failed += 1;
+      lastError = `No handler registered for type "${message2.type}" at target "${target}"`;
+      emitSnapshot();
+      try {
+        onSettled?.();
+      } catch {
+      }
+      return mode === "request" ? Promise.reject(new Error(lastError)) : message2.id;
+    }
+    if (signal?.aborted) {
+      canceled += 1;
+      lastError = errorMessage3(signal.reason ?? new Error("aborted"));
+      emitSnapshot();
+      try {
+        onSettled?.();
+      } catch {
+      }
+      return mode === "request" ? Promise.reject(signal.reason ?? new Error("aborted")) : message2.id;
+    }
+    const ctl = new AbortController();
+    let timeoutHandle;
+    const onUpstreamAbort = () => {
+      ctl.abort(signal?.reason ?? new Error("aborted"));
+    };
+    if (signal) {
+      signal.addEventListener("abort", onUpstreamAbort, { once: true });
+    }
+    if (typeof message2.timeoutMs === "number" && message2.timeoutMs > 0) {
+      timeoutHandle = setTimeout(() => {
+        ctl.abort(new Error("MessageBus.request timeout"));
+      }, message2.timeoutMs);
+    }
+    const stamped = { ...message2, signal: ctl.signal };
+    const mailbox = mailboxes.get(target) ?? [];
+    mailboxes.set(target, mailbox);
+    return new Promise((resolve, reject) => {
+      const entry = {
+        message: stamped,
+        signal: ctl.signal,
+        mode,
+        state: "queued",
+        settled: false,
+        resolve: (v) => resolve(v),
+        reject: (e) => reject(e),
+        onSettled,
+        cleanup: () => {
+          if (timeoutHandle) clearTimeout(timeoutHandle);
+          if (signal) signal.removeEventListener("abort", onUpstreamAbort);
+          ctl.signal.removeEventListener("abort", onAbort);
+        }
+      };
+      function onAbort() {
+        if (entry.state === "queued") {
+          const idx = mailbox.indexOf(entry);
+          if (idx >= 0) {
+            mailbox.splice(idx, 1);
+          }
+        }
+        settleEntry(entry, "canceled", ctl.signal.reason ?? new Error("aborted"));
+      }
+      ctl.signal.addEventListener("abort", onAbort, { once: true });
+      mailbox.push(entry);
+      emitSnapshot();
+      schedulePump(target);
+    });
+  }
+  function schedulePump(target) {
+    if (pumping.has(target)) return;
+    const mailbox = mailboxes.get(target);
+    if (!mailbox || mailbox.length === 0) return;
+    pumping.add(target);
+    if (typeof queueMicrotask === "function") {
+      queueMicrotask(() => {
+        void runPump(target);
+      });
+    } else {
+      Promise.resolve().then(() => {
+        void runPump(target);
+      });
+    }
+  }
+  async function runPump(target) {
+    const concurrency = targetConcurrency.get(target) ?? 1;
+    const workers = [];
+    for (let i = 0; i < concurrency; i += 1) {
+      workers.push(workerLoop(target));
+    }
+    try {
+      await Promise.all(workers);
+    } finally {
+      pumping.delete(target);
+      const mailbox = mailboxes.get(target);
+      if (mailbox && mailbox.length > 0) {
+        schedulePump(target);
+      }
+      emitSnapshot();
+    }
+  }
+  async function workerLoop(target, workerId) {
+    while (true) {
+      const entry = pickBestEntry(target);
+      if (!entry) return;
+      await processEntry(target, entry);
+    }
+  }
+  function pickBestEntry(target) {
+    const mailbox = mailboxes.get(target);
+    if (!mailbox || mailbox.length === 0) return void 0;
+    let bestIdx = -1;
+    let bestEntry;
+    for (let i = 0; i < mailbox.length; i += 1) {
+      const cur = mailbox[i];
+      if (cur.settled) continue;
+      if (!bestEntry) {
+        bestEntry = cur;
+        bestIdx = i;
+        continue;
+      }
+      const bestPriority = bestEntry.message.priority ?? 0;
+      const curPriority = cur.message.priority ?? 0;
+      if (curPriority > bestPriority || curPriority === bestPriority && cur.message.createdAt < bestEntry.message.createdAt) {
+        bestEntry = cur;
+        bestIdx = i;
+      }
+    }
+    if (bestEntry && bestIdx >= 0) {
+      mailbox.splice(bestIdx, 1);
+    }
+    return bestEntry;
+  }
+  async function processEntry(target, entry) {
+    if (entry.settled) return;
+    entry.state = "running";
+    inFlight += 1;
+    emitSnapshot();
+    const handler = routedHandlers.get(entry.message.type);
+    if (!handler) {
+      settleEntry(entry, "failed", new Error(`No handler for type "${entry.message.type}"`));
+      return;
+    }
+    try {
+      const result = handler.handler(entry.message);
+      if (result && typeof result.then === "function") {
+        const v = await waitForHandler(
+          result,
+          entry.signal
+        );
+        if (entry.signal.aborted) {
+          settleEntry(entry, "canceled", entry.signal.reason);
+        } else {
+          settleEntry(entry, "completed", v);
+        }
+      } else {
+        if (entry.signal.aborted) {
+          settleEntry(entry, "canceled", entry.signal.reason);
+        } else {
+          settleEntry(entry, "completed", result);
+        }
+      }
+    } catch (err) {
+      if (entry.signal.aborted) {
+        settleEntry(entry, "canceled", entry.signal.reason ?? err);
+      } else {
+        settleEntry(entry, "failed", err);
+      }
+    }
+  }
+  const bus = {
+    publish(type, payload, options) {
+      const message2 = makeMessage(type, "event", payload, {
+        causationId: options?.causationId,
+        messageId: options?.messageId
+      });
+      return publishInternal(message2);
+    },
+    subscribe(type, handler) {
+      const record2 = { type, handler };
+      let bucket = subscriptions.get(type);
+      if (!bucket) {
+        bucket = /* @__PURE__ */ new Set();
+        subscriptions.set(type, bucket);
+      }
+      bucket.add(record2);
+      return () => {
+        bucket?.delete(record2);
+      };
+    },
+    dispatch(type, payload, options) {
+      const message2 = makeMessage(type, "command", payload, {
+        target: options.target,
+        priority: options.priority,
+        timeoutMs: options.timeoutMs,
+        causationId: options.causationId,
+        messageId: options.messageId
+      });
+      const result = enqueueMessage(message2, "command", options.signal, options.onSettled);
+      if (typeof result === "string") return result;
+      return message2.id;
+    },
+    request(type, payload, options) {
+      const message2 = makeMessage(type, "request", payload, {
+        target: options.target,
+        priority: options.priority,
+        timeoutMs: options.timeoutMs,
+        causationId: options.causationId,
+        messageId: options.messageId
+      });
+      const result = enqueueMessage(message2, "request", options.signal, options.onSettled);
+      if (typeof result === "string") {
+        return Promise.reject(new Error("MessageBus.request returned a string id unexpectedly"));
+      }
+      return result;
+    },
+    handle(type, handler, options) {
+      const concurrency = options?.concurrency ?? 1;
+      if (!Number.isFinite(concurrency) || !Number.isInteger(concurrency) || concurrency <= 0) {
+        throw new Error("Handler concurrency must be a positive integer");
+      }
+      if (concurrency > MAX_HANDLER_CONCURRENCY) {
+        throw new Error(
+          `Handler concurrency must not exceed ${MAX_HANDLER_CONCURRENCY}`
+        );
+      }
+      const record2 = {
+        type,
+        target: options?.target ?? "",
+        priority: options?.priority ?? 0,
+        concurrency,
+        handler
+      };
+      if (routedHandlers.has(type)) {
+        throw new Error(`Handler for "${type}" is already registered`);
+      }
+      if (record2.target) {
+        const existing = targetConcurrency.get(record2.target);
+        if (existing !== void 0 && existing !== concurrency) {
+          throw new Error(`Conflicting concurrency for target "${record2.target}"`);
+        }
+        targetConcurrency.set(record2.target, concurrency);
+        targetHandlerCount.set(record2.target, (targetHandlerCount.get(record2.target) ?? 0) + 1);
+        if (!mailboxes.has(record2.target)) {
+          mailboxes.set(record2.target, []);
+        }
+        schedulePump(record2.target);
+      }
+      routedHandlers.set(type, record2);
+      return () => {
+        if (routedHandlers.get(type) === record2) {
+          routedHandlers.delete(type);
+          if (record2.target) {
+            const count = (targetHandlerCount.get(record2.target) ?? 1) - 1;
+            if (count <= 0) {
+              targetHandlerCount.delete(record2.target);
+              targetConcurrency.delete(record2.target);
+            } else {
+              targetHandlerCount.set(record2.target, count);
+            }
+          }
+        }
+      };
+    },
+    snapshot,
+    onSnapshot(handler) {
+      snapshotListeners.add(handler);
+      handler(snapshot());
+      return () => snapshotListeners.delete(handler);
+    }
+  };
+  return bus;
+}
+
+// src/resources/resourceRegistry.ts
+function createResourceRegistry() {
+  const definitions = /* @__PURE__ */ new Map();
+  function registerOwned(ownerId, definition) {
+    if (definitions.has(definition.id)) {
+      throw new Error(
+        `Resource definition "${definition.id}" is already registered`
+      );
+    }
+    const owned = Object.assign({}, definition);
+    Object.defineProperty(owned, RESOURCE_OWNER, {
+      value: ownerId,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+    definitions.set(definition.id, owned);
+  }
+  return {
+    _registerOwned: registerOwned,
+    register(definition) {
+      registerOwned("", definition);
+    },
+    unregister(id) {
+      definitions.delete(id);
+    },
+    get(id) {
+      return definitions.get(id);
+    },
+    /** 获取所有已注册的资源定义 id（用于 ownership 快照） */
+    _ids() {
+      return Array.from(definitions.keys());
+    }
+  };
+}
+function registerOwnedResource(registry, ownerId, definition) {
+  const internal = registry;
+  if (!internal._registerOwned) {
+    registry.register(definition);
+    return;
+  }
+  internal._registerOwned(ownerId, definition);
+}
+
+// src/resources/resourceStore.ts
+function createContext(ownerId, getCapability, getAttributes) {
+  return {
+    getCapability,
+    attributes: getAttributes(ownerId),
+    ownerId
+  };
+}
+function recordKey(definitionId, key) {
+  return `${definitionId}::${key.join("::")}`;
+}
+function defaultEquals(a, b) {
+  return Object.is(a, b);
+}
+function createResourceStore(registry, getCapability, getAttributes = () => ({})) {
+  const records = /* @__PURE__ */ new Map();
+  const microtaskQueue = /* @__PURE__ */ new Map();
+  const contextSubscribers = /* @__PURE__ */ new Set();
+  let microtaskScheduled = false;
+  const notify = (record2) => {
+    for (const subscriber of [...record2.subscribers]) {
+      try {
+        subscriber();
+      } catch {
+      }
+    }
+  };
+  const notifyContext = () => {
+    for (const subscriber of [...contextSubscribers]) {
+      try {
+        subscriber();
+      } catch {
+      }
+    }
+  };
+  const cleanupRecord = (record2) => {
+    record2.abortController?.abort();
+    record2.providerUnsubscribe?.();
+    record2.providerUnsubscribe = null;
+  };
+  const contextFor = (definition) => createContext(
+    definition[RESOURCE_OWNER] ?? "__unowned__",
+    getCapability,
+    getAttributes
+  );
+  const getOrCreateRecord = (definition, args) => {
+    const context = contextFor(definition);
+    const key = definition.key(args, context);
+    const keyString = recordKey(definition.id, key);
+    const current = records.get(keyString);
+    if (current) {
+      if (definition.subscribe && !current.providerUnsubscribe) {
+        current.providerUnsubscribe = definition.subscribe(args, context, () => {
+          scheduleInvalidation(definition.id, args);
+        });
+      }
+      return current;
+    }
+    const record2 = {
+      snapshot: { key, status: "pending", data: void 0, revision: 0 },
+      inFlight: null,
+      abortController: null,
+      subscribers: /* @__PURE__ */ new Set(),
+      invalidationScheduled: false,
+      loadRevision: 0,
+      owner: definition[RESOURCE_OWNER] ?? "__unowned__",
+      providerUnsubscribe: null
+    };
+    records.set(keyString, record2);
+    if (definition.subscribe) {
+      record2.providerUnsubscribe = definition.subscribe(args, context, () => {
+        scheduleInvalidation(definition.id, args);
+      });
+    }
+    return record2;
+  };
+  const loadResource = (definition, args, record2) => {
+    record2.abortController?.abort();
+    const context = contextFor(definition);
+    const key = definition.key(args, context);
+    if (record2.snapshot.key.join("::") !== key.join("::")) return;
+    const abortController = new AbortController();
+    const loadRevision = ++record2.loadRevision;
+    record2.abortController = abortController;
+    try {
+      record2.inFlight = Promise.resolve(definition.load(args, context, abortController.signal));
+    } catch (error2) {
+      record2.inFlight = Promise.reject(error2);
+    }
+    record2.snapshot = { ...record2.snapshot, status: "pending", revision: record2.snapshot.revision + 1 };
+    notify(record2);
+    record2.inFlight.then((data) => {
+      if (abortController.signal.aborted || record2.loadRevision !== loadRevision) return;
+      if (record2.snapshot.key.join("::") !== key.join("::")) return;
+      const equals = definition.equals ?? defaultEquals;
+      const changed = !equals(record2.snapshot.data, data);
+      record2.snapshot = {
+        key,
+        status: "ready",
+        data,
+        revision: changed ? record2.snapshot.revision + 1 : record2.snapshot.revision
+      };
+      record2.inFlight = null;
+      record2.abortController = null;
+      if (changed) notify(record2);
+    }).catch((error2) => {
+      if (abortController.signal.aborted || record2.loadRevision !== loadRevision) return;
+      const blocked = error2 instanceof Error && error2.message === "blocked";
+      const errorValue = error2 instanceof Error ? error2 : new Error(String(error2));
+      record2.snapshot = blocked ? { ...record2.snapshot, status: "blocked", revision: record2.snapshot.revision + 1 } : {
+        ...record2.snapshot,
+        status: record2.snapshot.data === void 0 ? "error" : "stale",
+        error: {
+          code: typeof errorValue.code === "string" ? String(errorValue.code) : "resource.load_failed",
+          message: errorValue.message
+        },
+        revision: record2.snapshot.revision + 1
+      };
+      record2.inFlight = null;
+      record2.abortController = null;
+      notify(record2);
+    });
+  };
+  const invalidateNow = (definitionId, args) => {
+    const definition = registry.get(definitionId);
+    if (!definition) return;
+    const context = contextFor(definition);
+    const key = definition.key(args, context);
+    const record2 = records.get(recordKey(definitionId, key));
+    if (!record2) return;
+    record2.snapshot = { ...record2.snapshot, status: "stale", revision: record2.snapshot.revision + 1 };
+    notify(record2);
+    loadResource(definition, args, record2);
+  };
+  const flushInvalidations = () => {
+    const queue = [...microtaskQueue.values()];
+    microtaskQueue.clear();
+    microtaskScheduled = false;
+    for (const item of queue) invalidateNow(item.definitionId, item.args);
+  };
+  const scheduleInvalidation = (definitionId, args) => {
+    const definition = registry.get(definitionId);
+    if (!definition) return;
+    if (definition.invalidation === "immediate") {
+      invalidateNow(definitionId, args);
+      return;
+    }
+    const key = recordKey(definitionId, definition.key(args, contextFor(definition)));
+    if (microtaskQueue.has(key)) return;
+    microtaskQueue.set(key, { definitionId, args });
+    if (!microtaskScheduled) {
+      microtaskScheduled = true;
+      queueMicrotask(flushInvalidations);
+    }
+  };
+  const refreshRuntimeBindings = () => {
+    for (const record2 of records.values()) cleanupRecord(record2);
+    records.clear();
+    notifyContext();
+  };
+  return {
+    ensure(definitionId, args) {
+      const definition = registry.get(definitionId);
+      if (!definition) throw new Error(`Resource definition "${definitionId}" not found`);
+      const record2 = getOrCreateRecord(definition, args);
+      if (!record2.inFlight && record2.snapshot.status === "pending") loadResource(definition, args, record2);
+      return record2.snapshot;
+    },
+    subscribe(definitionId, args, callback) {
+      const definition = registry.get(definitionId);
+      if (!definition) return () => void 0;
+      let record2 = getOrCreateRecord(definition, args);
+      record2.subscribers.add(callback);
+      const removeContext = definition.scope === "context" ? (() => {
+        const listener = () => {
+          record2.subscribers.delete(callback);
+          record2 = getOrCreateRecord(definition, args);
+          record2.subscribers.add(callback);
+          callback();
+        };
+        contextSubscribers.add(listener);
+        return () => contextSubscribers.delete(listener);
+      })() : void 0;
+      return () => {
+        removeContext?.();
+        record2.subscribers.delete(callback);
+        if (record2.subscribers.size === 0 && record2.providerUnsubscribe) {
+          record2.providerUnsubscribe();
+          record2.providerUnsubscribe = null;
+        }
+        if (record2.subscribers.size === 0 && record2.abortController) {
+          const current = record2;
+          setTimeout(() => {
+            if (current.subscribers.size === 0 && current.abortController) {
+              current.abortController.abort();
+              current.abortController = null;
+              current.inFlight = null;
+            }
+          }, 100);
+        }
+      };
+    },
+    read(definitionId, args) {
+      const definition = registry.get(definitionId);
+      if (!definition) return void 0;
+      const key = definition.key(args, contextFor(definition));
+      return records.get(recordKey(definitionId, key))?.snapshot;
+    },
+    invalidate: scheduleInvalidation,
+    disposeOwner(ownerId) {
+      for (const [key, record2] of records) {
+        if (record2.owner !== ownerId) continue;
+        cleanupRecord(record2);
+        records.delete(key);
+      }
+    },
+    refreshRuntimeBindings,
+    subscribeContext(callback) {
+      contextSubscribers.add(callback);
+      return () => contextSubscribers.delete(callback);
+    }
+  };
+}
+
+// src/lifecycle/scopedMessageBus.ts
+function mergeSignals(scopeSignal, requestSignal) {
+  if (!requestSignal) return { signal: scopeSignal, dispose: () => void 0 };
+  if (scopeSignal.aborted) {
+    const controller2 = new AbortController();
+    controller2.abort(scopeSignal.reason);
+    return { signal: controller2.signal, dispose: () => void 0 };
+  }
+  if (requestSignal.aborted) {
+    const controller2 = new AbortController();
+    controller2.abort(requestSignal.reason);
+    return { signal: controller2.signal, dispose: () => void 0 };
+  }
+  const controller = new AbortController();
+  const abortFrom = (source) => {
+    try {
+      controller.abort(source.reason);
+    } catch {
+      controller.abort();
+    }
+  };
+  const onScopeAbort = () => abortFrom(scopeSignal);
+  const onRequestAbort = () => abortFrom(requestSignal);
+  scopeSignal.addEventListener("abort", onScopeAbort, { once: true });
+  requestSignal.addEventListener("abort", onRequestAbort, { once: true });
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      scopeSignal.removeEventListener("abort", onScopeAbort);
+      requestSignal.removeEventListener("abort", onRequestAbort);
+    }
+  };
+}
+function withScopeCleanup(scope, cleanup) {
+  let active = true;
+  let removeRevoke = () => void 0;
+  let removeDispose = () => void 0;
+  const runCleanup = () => {
+    if (!active) return;
+    active = false;
+    removeRevoke();
+    removeDispose();
+    cleanup();
+  };
+  removeRevoke = scope.onRevoke(runCleanup);
+  removeDispose = scope.onDispose(runCleanup, "message-bus-registration");
+  return () => {
+    if (!active) return;
+    active = false;
+    removeRevoke();
+    removeDispose();
+    cleanup();
+  };
+}
+function createScopedMessageBus(base, scope) {
+  return {
+    publish(type, payload, options) {
+      scope.assertActive();
+      return base.publish(type, payload, options);
+    },
+    subscribe(type, handler) {
+      scope.assertActive();
+      const unsubscribe = base.subscribe(type, (payload) => {
+        if (scope.state !== "active") return;
+        handler(payload);
+      });
+      return withScopeCleanup(scope, unsubscribe);
+    },
+    dispatch(type, payload, options) {
+      scope.assertActive();
+      const merged = mergeSignals(scope.signal, options.signal);
+      const cleanup = withScopeCleanup(scope, merged.dispose);
+      try {
+        return base.dispatch(type, payload, {
+          ...options,
+          signal: merged.signal,
+          onSettled: () => {
+            cleanup();
+            options.onSettled?.();
+          }
+        });
+      } catch (error2) {
+        cleanup();
+        throw error2;
+      }
+    },
+    request(type, payload, options) {
+      scope.assertActive();
+      const merged = mergeSignals(scope.signal, options.signal);
+      const cleanup = withScopeCleanup(scope, merged.dispose);
+      try {
+        const request = base.request(type, payload, {
+          ...options,
+          signal: merged.signal,
+          onSettled: () => {
+            cleanup();
+            options.onSettled?.();
+          }
+        });
+        return request.finally(cleanup);
+      } catch (error2) {
+        cleanup();
+        return Promise.reject(error2);
+      }
+    },
+    handle(type, handler, options) {
+      scope.assertActive();
+      const scopedHandler = (message2) => {
+        if (scope.state !== "active") {
+          throw new LifecycleScopeRevokedError(
+            `Lifecycle scope "${scope.identity.scopeId}" is ${scope.state}`
+          );
+        }
+        const merged = mergeSignals(scope.signal, message2.signal);
+        try {
+          const result = handler({ ...message2, signal: merged.signal });
+          if (result && typeof result.then === "function") {
+            return Promise.resolve(result).finally(merged.dispose);
+          }
+          merged.dispose();
+          return result;
+        } catch (error2) {
+          merged.dispose();
+          throw error2;
+        }
+      };
+      const unregister = base.handle(type, scopedHandler, options);
+      return withScopeCleanup(scope, unregister);
+    },
+    snapshot() {
+      return base.snapshot();
+    },
+    onSnapshot(handler) {
+      scope.assertActive();
+      const unsubscribe = base.onSnapshot(handler);
+      return withScopeCleanup(scope, unsubscribe);
+    }
+  };
+}
+
+// src/host/createPluginHost.ts
+function createInMemoryPluginConfigStore(initial = {}, readOnly = false) {
+  const values = new Map(Object.entries(initial).filter((entry) => typeof entry[1] === "boolean"));
+  const listeners = /* @__PURE__ */ new Set();
+  const snapshot = () => Object.freeze(Object.fromEntries(values));
+  return {
+    read: snapshot,
+    setEnabled(pluginId, enabled) {
+      if (readOnly || values.get(pluginId) === enabled) return;
+      values.set(pluginId, enabled);
+      const next = snapshot();
+      for (const listener of [...listeners]) listener(next);
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    }
+  };
+}
+var StartupCapabilityError = class extends Error {
+  details;
+  constructor(details, phase2 = "startup") {
+    const labels = details.map((item) => typeof item.capability === "string" ? item.capability : item.capability.id);
+    super(`Startup prerequisite unavailable during ${phase2}${labels.length > 0 ? `: ${labels.join(", ")}` : ""}`);
+    this.name = "StartupCapabilityError";
+    this.details = Object.freeze([...details]);
+  }
+};
+var StartupPluginError = class extends Error {
+  details;
+  constructor(details) {
+    super(`Startup plugin failed: ${details.pluginId}`);
+    this.name = "StartupPluginError";
+    this.details = Object.freeze({ ...details });
+  }
+};
+function errorMessage4(error2) {
+  return error2 instanceof Error ? error2.message : typeof error2 === "string" ? error2 : String(error2);
+}
+function makeId2(prefix) {
+  try {
+    if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return `${prefix}:${crypto.randomUUID()}`;
+  } catch {
+  }
+  return `${prefix}:${Date.now().toString(36)}:${Math.random().toString(36).slice(2)}`;
+}
+function lifecycleStateFor(state, desired) {
+  switch (state) {
+    case "starting":
+      return "starting";
+    case "stopping":
+      return "stopping";
+    case "enabled":
+      return "running";
+    case "blocked":
+      return "waiting";
+    case "error-disabled":
+    case "cleanup-pending":
+      return "failed";
+    case "disabled":
+      return "disabled";
+    case "registered":
+    case "unknown":
+      return desired ? "waiting" : "disabled";
+  }
+}
+function implementationKey(pluginId, unitId) {
+  return `${pluginId}\0${unitId}`;
+}
+function isRemote(capability) {
+  return capability.kind === "rpc" || capability.kind === "stream";
+}
+function mergeSignals2(...signals) {
+  const active = signals.filter((signal) => signal !== void 0);
+  const controller = new AbortController();
+  const abort = (signal) => {
+    try {
+      controller.abort(signal.reason);
+    } catch {
+      controller.abort();
+    }
+  };
+  const listeners = active.map((signal) => {
+    const listener = () => abort(signal);
+    if (signal.aborted) abort(signal);
+    else signal.addEventListener("abort", listener, { once: true });
+    return { signal, listener };
+  });
+  return {
+    signal: controller.signal,
+    dispose() {
+      for (const item of listeners) item.signal.removeEventListener("abort", item.listener);
+    }
+  };
+}
+function assertTimeout(value) {
+  const result = value ?? 3e4;
+  if (!Number.isFinite(result) || result < 1 || result > 3e5) throw new TypeError("timeoutMs must be a finite number from 1 to 300000");
+  return result;
+}
+function rejectedStreamSubscription(error2) {
+  let rejectReady;
+  let rejectClosed;
+  const ready = new Promise((_, reject) => {
+    rejectReady = reject;
+  });
+  const closed = new Promise((_, reject) => {
+    rejectClosed = reject;
+  });
+  void ready.catch(() => void 0);
+  void closed.catch(() => void 0);
+  rejectReady(error2);
+  rejectClosed(error2);
+  return { ready, closed, cancel() {
+  } };
+}
+function createPluginHost(options = {}) {
+  const configuredRuntime = options.runtime;
+  const runtimeKind = configuredRuntime ?? "window-main";
+  const runtimeId = options.runtimeId ?? `${runtimeKind}:runtime`;
+  const runtimeInstanceId = options.runtimeInstanceId ?? makeId2(runtimeId);
+  let capabilityBridge = options.capabilityBridge;
+  let versionCounter = 0;
+  let disposed = false;
+  let disposePromise;
+  const listeners = /* @__PURE__ */ new Set();
+  const known = /* @__PURE__ */ new Map();
+  const records = /* @__PURE__ */ new Map();
+  const enabled = /* @__PURE__ */ new Set();
+  const stateCache = /* @__PURE__ */ new Map();
+  const publicClients = /* @__PURE__ */ new Map();
+  const configStore = options.configStore ?? createInMemoryPluginConfigStore(options.initialPluginConfig);
+  const internalConfigWrites = /* @__PURE__ */ new Set();
+  const starting = /* @__PURE__ */ new Map();
+  const stopping = /* @__PURE__ */ new Map();
+  let start;
+  let intentSnapshot = options.pluginIntentCoordinator?.snapshot();
+  const bump = () => {
+    versionCounter += 1;
+    for (const listener of [...listeners]) {
+      try {
+        listener({ version: versionCounter });
+      } catch {
+      }
+    }
+  };
+  const rootScope = createLifecycleScope({ kind: "root", metadata: { attributes: Object.freeze({ ...options.rootAttributes ?? {}, runtimeId, runtimeInstanceId }) }, onChange: bump });
+  const messageBus = options.messageBus ?? createMessageBus();
+  const resourceRegistry = options.resourceRegistry ?? createResourceRegistry();
+  const capabilities = createCapabilityRegistry();
+  capabilities.provide(RESOURCE_REGISTRY, resourceRegistry, "host", rootScope);
+  const taskScheduler = createScopedTaskScheduler(rootScope);
+  const resourceStore = createResourceStore(resourceRegistry, options.resourceCapabilityResolver ?? (() => void 0), (ownerId) => {
+    const instance = ownerId ? records.get(ownerId)?.scope : void 0;
+    return instance?.identity.attributes ?? rootScope.identity.attributes;
+  });
+  const addHostCapabilities = (source) => {
+    if (!source) return;
+    let entries;
+    if (Array.isArray(source)) entries = source;
+    else {
+      const map = source;
+      entries = [...map.entries()].map(([capability, value]) => ({ capability, value }));
+    }
+    for (const item of entries) capabilities.provide(item.capability, item.value, "host", rootScope);
+  };
+  addHostCapabilities(options.capabilities);
+  addHostCapabilities(options.builtinCapabilities);
+  const manifestUnit = (manifest) => selectRuntimeUnit(manifest, configuredRuntime);
+  const desired = (manifest) => {
+    if (manifest.startup === "required" || manifest.canDisable === false) return true;
+    if (intentSnapshot && Object.prototype.hasOwnProperty.call(intentSnapshot.desiredEnabled, manifest.id)) return intentSnapshot.desiredEnabled[manifest.id] === true;
+    return configStore.read()[manifest.id] ?? manifest.defaultEnabled;
+  };
+  const desiredRevision = (pluginId) => intentSnapshot?.desiredRevision[pluginId];
+  const writeConfigIntent = (pluginId, value) => {
+    internalConfigWrites.add(pluginId);
+    try {
+      configStore.setEnabled(pluginId, value);
+    } finally {
+      internalConfigWrites.delete(pluginId);
+    }
+  };
+  const initializeConfigIntent = (manifest) => {
+    if (options.pluginIntentCoordinator) return;
+    const current = configStore.read();
+    if (required(manifest)) {
+      if (current[manifest.id] !== true) writeConfigIntent(manifest.id, true);
+    } else if (!Object.prototype.hasOwnProperty.call(current, manifest.id)) {
+      writeConfigIntent(manifest.id, manifest.defaultEnabled);
+    }
+  };
+  const definitionList = (pluginId, unitId) => {
+    const fromRegistry = options.runtimeUnitImplementationRegistry?.getCapabilities?.(pluginId, unitId);
+    if (fromRegistry) return fromRegistry;
+    return options.capabilityDefinitions?.get(implementationKey(pluginId, unitId)) ?? [];
+  };
+  const graph = () => buildPluginGraph([...known.values()], { runtime: configuredRuntime, enabledPluginIds: enabled, externalRuntimeDependencies: options.externalRuntimeDependencies, builtinCapabilities: new Set(capabilities.descriptors()) });
+  const unavailableReason = (manifest) => {
+    const unit = manifestUnit(manifest);
+    if (!unit) return manifest.units && manifest.units.length > 0 ? "runtime_unit_ambiguous" : void 0;
+    return options.runtimeUnitAvailability?.({ pluginId: manifest.id, unitId: unit.id, runtime: unit.runtime });
+  };
+  const validateManifest = (manifest) => {
+    if (!manifest || typeof manifest.id !== "string" || manifest.id.trim() === "") throw new TypeError("Plugin id must be a non-empty string");
+    if ((manifest.units?.length ?? 0) > 1 && configuredRuntime === void 0) {
+      throw new Error(`Plugin "${manifest.id}" execution must be explicit for multi-unit manifests`);
+    }
+    options.manifestValidator?.(manifest);
+    validatePluginGraph([manifest], { runtime: configuredRuntime, allowMissingDependencies: true });
+  };
+  const missingDependencies = (manifest) => {
+    const unit = manifestUnit(manifest);
+    if (!unit) return [];
+    const localRuntime = unit.runtime;
+    const current = graph();
+    return (unit.dependencies ?? []).filter((dependency) => dependency.source !== "peer").filter((dependency) => {
+      if (dependency.optional) return false;
+      if (capabilities.has(dependency.capability)) return false;
+      if ((current.providers[capabilityKey(dependency.capability)]?.length ?? 0) > 0) {
+        const provider = current.providers[capabilityKey(dependency.capability)]?.[0];
+        return provider === void 0 || !enabled.has(provider);
+      }
+      if (dependency.sourceRuntime !== localRuntime && options.externalRuntimeDependencies) return false;
+      return true;
+    }).map((dependency) => dependency.capability);
+  };
+  const required = (manifest) => manifest.startup === "required" || manifest.canDisable === false;
+  const createUnavailableRemoteClient = (capability, scope) => {
+    if (capability.kind === "rpc") return {
+      call(request, _options) {
+        scope.assertActive();
+        return Promise.reject(new WebLoomError("capability_unavailable", `Capability "${capability.id}" is unavailable in the remote Runtime`, "wait", { capabilityId: capability.id }));
+      }
+    };
+    return {
+      subscribe(request, _options) {
+        scope.assertActive();
+        return rejectedStreamSubscription(new WebLoomError("capability_unavailable", `Capability "${capability.id}" is unavailable in the remote Runtime`, "wait", { capabilityId: capability.id }));
+      }
+    };
+  };
+  const getRemoteClient = (capability, scope, forceRemote = false) => {
+    if (!forceRemote && capabilities.has(capability)) {
+      if (capability.kind === "rpc") return createLocalRpcClient(capability, scope);
+      return createLocalStreamClient(capability, scope);
+    }
+    if (capabilityBridge) return capabilityBridge.getClient(capability, scope);
+    if (forceRemote) return createUnavailableRemoteClient(capability, scope);
+    if (capability.kind === "rpc") return createLocalRpcClient(capability, scope);
+    return createLocalStreamClient(capability, scope);
+  };
+  const createLocalRpcClient = (capability, scope) => {
+    const client = {
+      call(request, callOptions = {}) {
+        scope.assertActive();
+        const timeoutMs = assertTimeout(callOptions.timeoutMs);
+        const timeoutController = new AbortController();
+        const merged = mergeSignals2(timeoutController.signal, scope.signal, callOptions.signal);
+        const deadlineAt = Date.now() + timeoutMs;
+        return new Promise((resolve, reject) => {
+          let settled = false;
+          let timedOut = false;
+          let timer;
+          const finish = (error2, value) => {
+            if (settled) return;
+            settled = true;
+            if (timer !== void 0) clearTimeout(timer);
+            merged.dispose();
+            if (error2 !== void 0) reject(error2);
+            else resolve(value);
+          };
+          const entry = capabilities.registration(capability);
+          if (!entry || entry.capability.kind !== "rpc") {
+            finish(new WebLoomError("capability_unavailable", `Capability "${capability.id}" is not available`, "wait", { capabilityId: capability.id }));
+            return;
+          }
+          const rpc = capability;
+          const context = {
+            signal: merged.signal,
+            deadlineAt,
+            ...callOptions.operationId !== void 0 ? { operationId: callOptions.operationId } : {},
+            reference: entry.reference,
+            origin: "local"
+          };
+          timer = setTimeout(() => {
+            timedOut = true;
+            try {
+              timeoutController.abort(new WebLoomError("call_timeout", "Capability call timed out", "execute"));
+            } catch {
+              timeoutController.abort();
+            }
+            finish(new WebLoomError("call_timeout", "Capability call timed out", "execute", { capabilityId: capability.id, serviceInstanceId: entry.reference.serviceInstanceId }));
+          }, timeoutMs);
+          const onAbort = () => {
+            if (!timedOut) finish(new WebLoomError("request_cancelled", "Capability call was cancelled", "dispose", { capabilityId: capability.id }));
+          };
+          merged.signal.addEventListener("abort", onAbort, { once: true });
+          if (merged.signal.aborted) {
+            onAbort();
+            return;
+          }
+          let invoke;
+          try {
+            invoke = invokeCapabilityHandler(entry, request, context);
+          } catch (error2) {
+            finish(error2 instanceof WebLoomError ? error2 : new WebLoomError("handler_failed", errorMessage4(error2), "execute", { capabilityId: capability.id }));
+            return;
+          }
+          Promise.resolve(invoke).then((value) => {
+            if (settled) return;
+            try {
+              finish(void 0, rpc.response.parse(value));
+            } catch (error2) {
+              finish(new WebLoomError("response_validation_failed", errorMessage4(error2), "receive", { capabilityId: capability.id }));
+            }
+          }, (error2) => finish(error2 instanceof WebLoomError ? error2 : new WebLoomError("handler_failed", errorMessage4(error2), "execute", { capabilityId: capability.id })));
+        });
+      }
+    };
+    return client;
+  };
+  const createLocalStreamClient = (capability, scope) => {
+    const client = {
+      subscribe(request, subscribeOptions) {
+        scope.assertActive();
+        const timeoutMs = assertTimeout(subscribeOptions.timeoutMs);
+        const timeoutController = new AbortController();
+        const merged = mergeSignals2(timeoutController.signal, scope.signal, subscribeOptions.signal);
+        let cancelled = false;
+        let timedOut = false;
+        let iterator;
+        let readyTimer;
+        let iteratorReturnStarted = false;
+        let readySettled = false;
+        let closedSettled = false;
+        let resolveReady;
+        let rejectReady;
+        let resolveClosed;
+        let rejectClosed;
+        const ready = new Promise((resolve, reject) => {
+          resolveReady = resolve;
+          rejectReady = reject;
+        });
+        const closed = new Promise((resolve, reject) => {
+          resolveClosed = resolve;
+          rejectClosed = reject;
+        });
+        void ready.catch(() => void 0);
+        void closed.catch(() => void 0);
+        const settleReadyResolve = () => {
+          if (!readySettled) {
+            readySettled = true;
+            resolveReady();
+          }
+        };
+        const settleReadyReject = (error2) => {
+          if (!readySettled) {
+            readySettled = true;
+            rejectReady(error2);
+          }
+        };
+        const settleClosedResolve = () => {
+          if (!closedSettled) {
+            closedSettled = true;
+            resolveClosed();
+          }
+        };
+        const settleClosedReject = (error2) => {
+          if (!closedSettled) {
+            closedSettled = true;
+            rejectClosed(error2);
+          }
+        };
+        const closeIterator = (late) => {
+          const current = iterator ?? late;
+          if (!current || iteratorReturnStarted) return;
+          const close = current.return;
+          if (!close) {
+            iteratorReturnStarted = true;
+            return;
+          }
+          iteratorReturnStarted = true;
+          try {
+            void Promise.resolve(close.call(current)).catch(() => void 0);
+          } catch {
+          }
+        };
+        const terminate = (error2) => {
+          if (cancelled) return;
+          cancelled = true;
+          if (readyTimer !== void 0) clearTimeout(readyTimer);
+          closeIterator();
+          merged.dispose();
+          settleReadyReject(error2);
+          settleClosedReject(error2);
+        };
+        const cancel = (reason = "stream cancelled") => {
+          const error2 = timedOut ? new WebLoomError("call_timeout", "Stream subscription timed out while opening", "wait", { capabilityId: capability.id }) : new WebLoomError("request_cancelled", "Stream subscription was cancelled", "dispose", { capabilityId: capability.id });
+          terminate(error2);
+        };
+        merged.signal.addEventListener("abort", () => cancel("stream cancelled"), { once: true });
+        const start2 = async () => {
+          try {
+            const entry = capabilities.registration(capability);
+            if (!entry || entry.capability.kind !== "stream") throw new WebLoomError("capability_unavailable", `Capability "${capability.id}" is not available`, "wait", { capabilityId: capability.id });
+            const stream = capability;
+            const context = { signal: merged.signal, deadlineAt: Date.now() + timeoutMs, reference: entry.reference, origin: "local" };
+            readyTimer = setTimeout(() => {
+              if (cancelled || readySettled) return;
+              timedOut = true;
+              try {
+                timeoutController.abort(new WebLoomError("call_timeout", "Stream subscription timed out while opening", "wait"));
+              } catch {
+                timeoutController.abort();
+              }
+              terminate(new WebLoomError("call_timeout", "Stream subscription timed out while opening", "wait", { capabilityId: capability.id }));
+            }, timeoutMs);
+            const iterable = await capabilities.openStream(capability, request, context);
+            if (cancelled) {
+              try {
+                closeIterator(iterable[Symbol.asyncIterator]());
+              } catch {
+              }
+              return;
+            }
+            iterator = iterable[Symbol.asyncIterator]();
+            if (readyTimer !== void 0) clearTimeout(readyTimer);
+            settleReadyResolve();
+            while (!cancelled) {
+              const next = await iterator.next();
+              if (next.done) {
+                cancelled = true;
+                settleClosedResolve();
+                break;
+              }
+              if (cancelled) break;
+              try {
+                const item = stream.item.parse(next.value);
+                await subscribeOptions.onNext(item);
+              } catch {
+                terminate(new WebLoomError("handler_failed", "Local stream consumer failed", "execute", { capabilityId: capability.id }));
+                break;
+              }
+            }
+          } catch (error2) {
+            if (!cancelled) {
+              const wrapped = error2 instanceof WebLoomError ? error2 : new WebLoomError("handler_failed", "Local stream operation failed", "execute", { capabilityId: capability.id });
+              terminate(wrapped);
+            }
+          } finally {
+            merged.dispose();
+          }
+        };
+        if (merged.signal.aborted) cancel("stream cancelled");
+        else void start2();
+        return { ready, closed, cancel };
+      }
+    };
+    return client;
+  };
+  const beginStop = (record2, reason) => {
+    if (record2.state !== "enabled" && record2.state !== "starting" && record2.state !== "blocked" && record2.state !== "error-disabled") return false;
+    record2.stopRequested = reason;
+    record2.state = "stopping";
+    record2.scope?.revoke(reason);
+    for (const contribution of record2.contributions) {
+      try {
+        contribution.revoke();
+      } catch {
+      }
+    }
+    for (const capability of record2.provided) capabilities.revoke(capability, record2.instanceId);
+    for (const capability of record2.provided) publicClients.delete(capabilityKey(capability));
+    enabled.delete(record2.manifest.id);
+    bump();
+    return true;
+  };
+  const finishStop = async (record2, reason, preserveIntent) => {
+    const scope = record2.scope;
+    const projectLateCleanup = (result, error2) => {
+      if (result) record2.cleanup = result;
+      if (error2 !== void 0) {
+        record2.state = "cleanup-pending";
+        record2.error = errorMessage4(error2);
+        bump();
+        return;
+      }
+      if (!result || result.cleanupIncomplete || record2.state !== "cleanup-pending") return;
+      const currentDesired2 = desired(record2.manifest);
+      const missing2 = missingDependencies(record2.manifest);
+      const unavailable2 = unavailableReason(record2.manifest);
+      record2.state = currentDesired2 && (missing2.length > 0 || unavailable2) ? "blocked" : "disabled";
+      record2.blockedBy = record2.state === "blocked" ? [.../* @__PURE__ */ new Set([...missing2.map((item) => `missing:${item.kind}:${item.id}@${item.version}`), ...unavailable2 ? [unavailable2] : []])] : void 0;
+      record2.error = void 0;
+      bump();
+      if (currentDesired2 && record2.state === "disabled" && !disposed) {
+        queueMicrotask(() => {
+          void start(record2.manifest.id).catch(() => void 0);
+        });
+      }
+    };
+    if (!scope && record2.state === "cleanup-pending") return;
+    const cleanup = scope ? await scope.dispose({
+      reason,
+      timeoutMs: options.lifecycleCleanupTimeoutMs,
+      teardown: record2.teardown,
+      onLateSuccess: (_resourceId, result) => projectLateCleanup(result),
+      onLateFailure: (_resourceId, error2, result) => projectLateCleanup(result, error2)
+    }) : void 0;
+    if (cleanup) record2.cleanup = cleanup;
+    record2.scope = void 0;
+    record2.provided = [];
+    record2.teardown = void 0;
+    record2.instanceId = void 0;
+    record2.unitId = void 0;
+    record2.stopRequested = void 0;
+    record2.contributions = [];
+    const currentDesired = desired(record2.manifest);
+    const missing = missingDependencies(record2.manifest);
+    const unavailable = unavailableReason(record2.manifest);
+    const hasTimeout = Boolean(cleanup?.pending.length && cleanup.errors.some((item) => item.code === "lifecycle.cleanup_timeout"));
+    const cleanupError = cleanup?.errors.find((item) => item.code !== "lifecycle.cleanup_timeout");
+    if (hasTimeout) {
+      record2.state = "cleanup-pending";
+      record2.error = cleanupError?.message ?? "Plugin cleanup is still pending";
+    } else if (cleanupError || cleanup?.cleanupIncomplete) {
+      record2.state = "error-disabled";
+      record2.error = cleanupError?.message ?? "Plugin cleanup did not complete";
+    } else if (currentDesired && (missing.length > 0 || unavailable)) {
+      record2.state = "blocked";
+      record2.blockedBy = [
+        .../* @__PURE__ */ new Set([
+          ...missing.map((item) => `missing:${item.kind}:${item.id}@${item.version}`),
+          ...unavailable ? [unavailable] : []
+        ])
+      ];
+      record2.error = void 0;
+    } else {
+      record2.state = "disabled";
+      record2.blockedBy = void 0;
+      record2.error = void 0;
+    }
+    bump();
+    if (currentDesired && record2.state === "disabled" && !disposed) {
+      queueMicrotask(() => {
+        void start(record2.manifest.id).catch(() => void 0);
+      });
+    }
+  };
+  const stopAfterBegin = (record2, reason, preserveIntent) => {
+    const existing = stopping.get(record2.manifest.id);
+    if (existing) return existing;
+    if (record2.state !== "stopping") return Promise.resolve();
+    const startingTask = starting.get(record2.manifest.id);
+    const task = (startingTask ? startingTask.catch(() => void 0) : Promise.resolve()).then(() => finishStop(record2, reason)).finally(() => {
+      if (stopping.get(record2.manifest.id) === task) stopping.delete(record2.manifest.id);
+    });
+    stopping.set(record2.manifest.id, task);
+    return task;
+  };
+  const stop = async (record2, reason, preserveIntent) => {
+    const existing = stopping.get(record2.manifest.id);
+    if (existing) return existing;
+    if (!beginStop(record2, reason)) return;
+    return stopAfterBegin(record2, reason);
+  };
+  const registerContribution = async (record2, unit, instanceId, scope) => {
+    if (unit.contribution === void 0) return;
+    for (const adapter of options.contributionAdapters ?? []) {
+      const result = await adapter.register({ pluginId: record2.manifest.id, unitId: unit.id, instanceId, scope, contribution: unit.contribution, manifest: record2.manifest });
+      if (!result) continue;
+      const handle = typeof result === "function" ? { revoke: result } : result;
+      let active = true;
+      let disposePromise2;
+      const runtime = {
+        get active() {
+          return active;
+        },
+        revoke() {
+          if (!active) return;
+          active = false;
+          handle.revoke?.();
+        },
+        dispose() {
+          if (disposePromise2) return disposePromise2;
+          disposePromise2 = Promise.resolve(handle.dispose?.());
+          disposePromise2.catch(() => void 0);
+          return disposePromise2;
+        }
+      };
+      record2.contributions.push(runtime);
+      scope.onRevoke(() => runtime.revoke());
+      scope.onDispose(() => runtime.dispose(), `contribution:${adapter.name ?? "anonymous"}`);
+    }
+  };
+  const startImplementation = async (pluginId) => {
+    const record2 = records.get(pluginId);
+    if (!record2) throw new Error(`Plugin "${pluginId}" is not registered`);
+    if (record2.state === "enabled") return;
+    if (record2.state === "starting") return;
+    if (disposed) throw new LifecycleScopeRevokedError("Plugin host is disposed");
+    const unit = manifestUnit(record2.manifest);
+    if (!unit) {
+      record2.state = "blocked";
+      record2.blockedBy = ["runtime_unit_ambiguous"];
+      bump();
+      return;
+    }
+    const unavailable = options.runtimeUnitAvailability?.({ pluginId, unitId: unit.id, runtime: unit.runtime });
+    const missing = missingDependencies(record2.manifest);
+    if (unavailable || missing.length > 0) {
+      record2.state = "blocked";
+      record2.blockedBy = [...unavailable ? [unavailable] : [], ...missing.map((item) => `missing:${item.kind}:${item.id}@${item.version}`)];
+      bump();
+      if (required(record2.manifest)) throw new StartupCapabilityError(missing.map((capability) => ({ capability })), "startup");
+      return;
+    }
+    const parent = options.runtimeUnitParentScope?.({ pluginId, unitId: unit.id, runtime: unit.runtime, manifest: record2.manifest }) ?? rootScope;
+    const attributes = cloneFrozenAttributes(options.runtimeUnitAttributes?.({ pluginId, unitId: unit.id, runtime: unit.runtime, manifest: record2.manifest }));
+    const scope = parent.child("runtime-unit", { pluginId, attributes });
+    const instanceId = scope.identity.instanceId;
+    const permissions = [...unit.permissions ?? []];
+    const policy = options.permissionPolicy?.({ pluginId, unitId: unit.id, identity: scope.identity, requested: permissions });
+    const lease = createPermissionLease({ identity: scope.identity, requested: permissions, approved: policy?.approved ?? permissions, sessionConstraints: policy?.sessionConstraints, scope, ...policy?.binding });
+    const grantedPermissions = permissions.filter(
+      (permission) => (policy?.approved ?? permissions).includes(permission) && (policy?.sessionConstraints === void 0 || policy.sessionConstraints.includes(permission))
+    );
+    const definitions = definitionList(pluginId, unit.id);
+    record2.state = "starting";
+    record2.scope = scope;
+    record2.instanceId = instanceId;
+    record2.unitId = unit.id;
+    record2.error = void 0;
+    record2.blockedBy = void 0;
+    record2.provided = [];
+    bump();
+    definitions.filter((capability) => capability.kind === "local");
+    const declaredProvides = unit.provides ?? [];
+    const declaredDependencies = unit.dependencies ?? [];
+    const resolveCapability = (capability, optional) => {
+      const descriptor = capabilityDescriptor(capability);
+      const declared = [...declaredProvides, ...declaredDependencies.map((dependency2) => dependency2.capability)].some((item) => capabilityKey(item) === capabilityKey(descriptor));
+      if (!declared) throw new WebLoomError("capability_unavailable", `Capability "${capability.id}" is not declared by plugin`, "validate", { capabilityId: capability.id });
+      if (capability.kind === "local") {
+        if (!capabilities.has(capability)) {
+          if (optional) return void 0;
+          throw new WebLoomError("capability_unavailable", `Capability "${capability.id}" is not available`, "wait", { capabilityId: capability.id });
+        }
+        return capabilities.get(capability);
+      }
+      const dependency = declaredDependencies.find((item) => capabilityKey(item.capability) === capabilityKey(descriptor));
+      if (dependency?.source === "peer") {
+        throw new WebLoomError("capability_unavailable", `Capability "${capability.id}" is only available through call.peer`, "dispatch", { capabilityId: capability.id });
+      }
+      const remote = dependency?.sourceRuntime !== void 0 && dependency.sourceRuntime !== unit.runtime;
+      if (optional && remote && (!capabilityBridge || !capabilityBridge.services().some((service) => service.kind === capability.kind && service.capabilityId === capability.id && service.contractVersion === capability.version))) return void 0;
+      if (optional && !remote && !capabilities.has(capability)) return void 0;
+      return getRemoteClient(capability, scope, remote);
+    };
+    const handle = (capability, handler) => {
+      if (scope.state !== "active") return;
+      const descriptor = capabilityDescriptor(capability);
+      if (!declaredProvides.some((item) => capabilityKey(item) === capabilityKey(descriptor))) throw new WebLoomError("capability_unavailable", `Plugin "${pluginId}" cannot handle undeclared capability`, "validate", { capabilityId: capability.id });
+      const reference = Object.freeze({ kind: capability.kind, capabilityId: capability.id, contractVersion: capability.version, runtime: unit.runtime, runtimeInstanceId, serviceInstanceId: makeId2(`service:${instanceId}:${capability.id}`), attributes });
+      const peerDependencies = declaredDependencies.filter((dependency) => dependency.source === "peer").map((dependency) => dependency.capability);
+      if (capability.kind === "rpc") capabilities.handle(capability, handler, instanceId, scope, reference, peerDependencies);
+      else capabilities.stream(capability, handler, instanceId, scope, reference, peerDependencies);
+      record2.provided.push(capability);
+      bump();
+    };
+    const provide = (capability, value) => {
+      if (scope.state !== "active") return;
+      const descriptor = capabilityDescriptor(capability);
+      if (!declaredProvides.some((item) => capabilityKey(item) === capabilityKey(descriptor))) throw new WebLoomError("capability_unavailable", `Plugin "${pluginId}" cannot provide undeclared capability`, "validate", { capabilityId: capability.id });
+      capabilities.provide(capability, value, instanceId, scope);
+      record2.provided.push(capability);
+      bump();
+    };
+    const context = {
+      pluginId,
+      instanceId,
+      unitId: unit.id,
+      scope,
+      signal: scope.signal,
+      permissions: grantedPermissions,
+      permissionLease: lease,
+      taskScheduler,
+      // Context extensions are realm-local host injection points. They may
+      // intentionally contain live services (for example a logger or a
+      // coordinator facade), so they are not wire attributes and must not be
+      // forced through the DTO/structured-clone validator. The extension
+      // callback remains the trust boundary; transport-visible attributes
+      // continue to use cloneFrozenAttributes above and at exposure time.
+      extension: options.contextExtension?.({ pluginId, unitId: unit.id, instanceId, scope, manifest: record2.manifest }) ?? {},
+      config: unit.config,
+      onDispose(cleanup) {
+        scope.onDispose(cleanup);
+      },
+      provide,
+      handle,
+      capability(capability) {
+        return resolveCapability(capability, false);
+      },
+      optionalCapability(capability) {
+        return resolveCapability(capability, true);
+      },
+      messageBus: createScopedMessageBus(messageBus, scope)
+    };
+    try {
+      const setup = options.runtimeUnitImplementationRegistry?.get(pluginId, unit.id);
+      if (!setup) throw new Error(`Runtime implementation is unavailable for ${pluginId}/${unit.id}`);
+      const result = await setup(context);
+      record2.teardown = typeof result === "function" ? result : void 0;
+      await registerContribution(record2, unit, instanceId, scope);
+      if (required(record2.manifest)) {
+        for (const descriptor of declaredProvides) {
+          if (!record2.provided.some((capability) => capabilityKey(capability) === capabilityKey(descriptor))) throw new Error(`Plugin "${pluginId}" did not register declared capability "${descriptor.id}@${descriptor.version}"`);
+        }
+      }
+      if (record2.stopRequested || scope.state !== "active") {
+        return;
+      }
+      if (!desired(record2.manifest)) {
+        queueMicrotask(() => {
+          void stop(record2, "startup superseded", false).catch(() => void 0);
+        });
+        return;
+      }
+      record2.state = "enabled";
+      enabled.add(pluginId);
+      bump();
+    } catch (error2) {
+      if (record2.stopRequested || scope.state !== "active") {
+        return;
+      }
+      record2.state = "error-disabled";
+      record2.error = errorMessage4(error2);
+      scope.revoke("plugin setup failed");
+      for (const capability of record2.provided) capabilities.revoke(capability, instanceId);
+      record2.provided = [];
+      record2.cleanup = await scope.dispose({ reason: "plugin setup failed", timeoutMs: options.lifecycleCleanupTimeoutMs });
+      record2.scope = void 0;
+      record2.instanceId = void 0;
+      record2.unitId = void 0;
+      bump();
+      if (required(record2.manifest)) throw new StartupPluginError({ pluginId, unitId: unit.id, capabilities: declaredProvides, state: record2.state, error: record2.error });
+    }
+  };
+  start = async (pluginId) => {
+    const existingStop = stopping.get(pluginId);
+    if (existingStop) await existingStop;
+    const existing = starting.get(pluginId);
+    if (existing) return existing;
+    const task = startImplementation(pluginId);
+    starting.set(pluginId, task);
+    try {
+      await task;
+    } finally {
+      if (starting.get(pluginId) === task) starting.delete(pluginId);
+    }
+  };
+  let reconcilePromise;
+  let reconcileRequested = false;
+  const runReconcile = async () => {
+    let progress = true;
+    while (progress) {
+      progress = false;
+      const stops = [];
+      for (const record2 of records.values()) {
+        const wants = desired(record2.manifest);
+        const invalid = record2.state === "enabled" || record2.state === "starting" ? missingDependencies(record2.manifest).length > 0 || unavailableReason(record2.manifest) !== void 0 : false;
+        if (!wants && (record2.state === "enabled" || record2.state === "starting" || record2.state === "blocked") || wants && invalid) {
+          const before = record2.state;
+          stops.push(stop(record2, wants ? "runtime dependency unavailable" : "desired intent disabled"));
+          progress = progress || before !== record2.state;
+        }
+      }
+      if (stops.length > 0) await Promise.all(stops);
+      for (const manifest of known.values()) {
+        const record2 = records.get(manifest.id);
+        if (!record2 || !desired(manifest)) continue;
+        if (record2.state !== "registered" && record2.state !== "disabled" && record2.state !== "blocked") continue;
+        const before = record2.state;
+        await start(manifest.id);
+        progress = progress || before !== record2.state;
+      }
+    }
+  };
+  const reconcile = async () => {
+    if (disposed) return;
+    if (reconcilePromise) {
+      reconcileRequested = true;
+      return reconcilePromise;
+    }
+    const task = (async () => {
+      do {
+        reconcileRequested = false;
+        await runReconcile();
+      } while (reconcileRequested && !disposed);
+    })().finally(() => {
+      reconcilePromise = void 0;
+    });
+    reconcilePromise = task;
+    return task;
+  };
+  const submitIntent = async (pluginId, desiredEnabled) => {
+    if (!known.has(pluginId)) throw new Error(`Plugin "${pluginId}" is not registered`);
+    if (options.pluginIntentCoordinator) {
+      const current = options.pluginIntentCoordinator.snapshot();
+      return options.pluginIntentCoordinator.submit({
+        commandId: makeId2(`plugin-intent:${pluginId}`),
+        authorityInstanceId: options.pluginIntentCoordinator.authorityInstanceId,
+        expectedRevision: current.revision,
+        pluginId,
+        desiredEnabled
+      });
+    }
+    internalConfigWrites.add(pluginId);
+    try {
+      configStore.setEnabled(pluginId, desiredEnabled);
+    } finally {
+      internalConfigWrites.delete(pluginId);
+    }
+    return {
+      status: "accepted",
+      commandId: makeId2(`plugin-intent:${pluginId}`),
+      snapshot: { revision: 0, desiredEnabled: configStore.read(), desiredRevision: {} },
+      persisted: true
+    };
+  };
+  const enable = async (pluginId) => {
+    const result = await submitIntent(pluginId, true);
+    if (result.status !== "accepted" && result.status !== "duplicate") {
+      throw new Error(`Could not enable plugin "${pluginId}": ${result.status}`);
+    }
+    await reconcile();
+    const record2 = records.get(pluginId);
+    if (record2?.state === "cleanup-pending") throw new Error(`Plugin "${pluginId}" cleanup is pending`);
+  };
+  const collectStopPlan = (pluginId) => {
+    const current = graph();
+    const result = [];
+    const visited = /* @__PURE__ */ new Set();
+    const visitDependents = (providerId) => {
+      for (const dependent of reverseDependentsOf(current, providerId)) {
+        if (visited.has(dependent.pluginId)) continue;
+        const dependentRecord = records.get(dependent.pluginId);
+        if (!dependentRecord) continue;
+        visited.add(dependent.pluginId);
+        visitDependents(dependent.pluginId);
+        if (dependentRecord.state === "enabled" || dependentRecord.state === "starting" || dependentRecord.state === "stopping" || dependentRecord.state === "blocked" || dependentRecord.state === "error-disabled") result.push(dependentRecord);
+      }
+    };
+    visitDependents(pluginId);
+    const target = records.get(pluginId);
+    if (target && (target.state === "enabled" || target.state === "starting" || target.state === "stopping" || target.state === "blocked" || target.state === "error-disabled")) result.push(target);
+    return result;
+  };
+  const host = {
+    capabilities,
+    messageBus,
+    resourceRegistry,
+    resourceStore,
+    rootScope,
+    taskScheduler,
+    runtimeKind,
+    runtimeId,
+    runtimeInstanceId,
+    installed: () => [...known.keys()],
+    manifests: () => [...known.keys()],
+    state(pluginId) {
+      const record2 = records.get(pluginId);
+      const manifest = record2?.manifest;
+      const unit = manifest ? manifestUnit(manifest) : void 0;
+      if (!record2) {
+        const cached2 = stateCache.get(pluginId);
+        if (cached2?.signature === "unknown") return cached2.state;
+        const unknownState = { id: pluginId, kind: "disabled", lifecycleState: "disabled", desiredEnabled: false, units: [] };
+        stateCache.set(pluginId, { signature: "unknown", state: unknownState });
+        return unknownState;
+      }
+      const desiredEnabled = desired(record2.manifest);
+      const signature = JSON.stringify([record2.state, record2.error, record2.blockedBy, record2.instanceId, record2.unitId, desiredEnabled, desiredRevision(record2.manifest.id), record2.cleanup]);
+      const cached = stateCache.get(pluginId);
+      if (cached?.signature === signature) return cached.state;
+      const unitState = unit ? [{ pluginId, unitId: unit.id, runtime: unit.runtime, kind: record2.state, ...record2.instanceId ? { instanceId: record2.instanceId } : {}, ...record2.error ? { error: record2.error } : {} }] : [];
+      const next = { id: pluginId, kind: record2.state, lifecycleState: lifecycleStateFor(record2.state, desiredEnabled), ...record2.error ? { error: record2.error } : {}, desiredEnabled, ...desiredRevision(record2.manifest.id) !== void 0 ? { desiredRevision: desiredRevision(record2.manifest.id) } : {}, ...record2.instanceId ? { instanceId: record2.instanceId } : {}, ...record2.unitId ? { unitId: record2.unitId } : {}, ...record2.blockedBy ? { blockedBy: [...record2.blockedBy] } : {}, ...record2.cleanup ? { cleanup: record2.cleanup } : {}, units: unitState };
+      stateCache.set(pluginId, { signature, state: next });
+      return next;
+    },
+    scope: (pluginId) => records.get(pluginId)?.scope,
+    refreshRuntimeUnitSnapshots: bump,
+    reconcile,
+    graph,
+    version: () => versionCounter,
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    getManifest: (pluginId) => known.get(pluginId),
+    reverseDeps(pluginId) {
+      return [...reverseDependentsOf(graph(), pluginId)];
+    },
+    validateManifestSet(manifests) {
+      for (const manifest of manifests) {
+        options.manifestValidator?.(manifest);
+      }
+      validatePluginGraph(manifests, { runtime: configuredRuntime, builtinCapabilities: new Set(capabilities.descriptors()), externalRuntimeDependencies: options.externalRuntimeDependencies });
+    },
+    provide(capability, value) {
+      if (disposed) throw new LifecycleScopeRevokedError("Plugin host is disposed");
+      capabilities.provide(capability, value, "host", rootScope);
+      bump();
+    },
+    register: async (manifest) => {
+      if (disposed) throw new LifecycleScopeRevokedError("Plugin host is disposed");
+      validateManifest(manifest);
+      if (known.has(manifest.id)) throw new Error(`Plugin "${manifest.id}" is already registered`);
+      known.set(manifest.id, manifest);
+      records.set(manifest.id, { manifest, state: "registered", provided: [], contributions: [] });
+      initializeConfigIntent(manifest);
+      bump();
+      await reconcile();
+    },
+    registerAll: async (manifests) => {
+      if (disposed) throw new LifecycleScopeRevokedError("Plugin host is disposed");
+      validatePluginGraph(manifests, { runtime: configuredRuntime, builtinCapabilities: new Set(capabilities.descriptors()), externalRuntimeDependencies: options.externalRuntimeDependencies, allowMissingDependencies: true });
+      for (const manifest of manifests) {
+        validateManifest(manifest);
+        if (known.has(manifest.id)) throw new Error(`Plugin "${manifest.id}" is already registered`);
+      }
+      for (const manifest of manifests) {
+        known.set(manifest.id, manifest);
+        records.set(manifest.id, { manifest, state: "registered", provided: [], contributions: [] });
+        initializeConfigIntent(manifest);
+      }
+      bump();
+      await reconcile();
+    },
+    enable,
+    retry: async (pluginId) => {
+      const record2 = records.get(pluginId);
+      if (!record2) throw new Error(`Plugin "${pluginId}" is not registered`);
+      record2.state = "registered";
+      record2.error = void 0;
+      await start(pluginId);
+    },
+    submitIntent: async (pluginId, desiredEnabled) => {
+      const result = await submitIntent(pluginId, desiredEnabled);
+      if (result.status === "accepted" || result.status === "duplicate") await reconcile();
+      return result;
+    },
+    disable: async (pluginId) => {
+      const record2 = records.get(pluginId);
+      if (!record2) throw new Error(`Plugin "${pluginId}" is not registered`);
+      if (required(record2.manifest)) return { ok: false, reason: `Plugin "${pluginId}" cannot be disabled` };
+      if (options.pluginIntentCoordinator) {
+        const result = await submitIntent(pluginId, false);
+        if (result.status !== "accepted" && result.status !== "duplicate") return { ok: false, reason: `Could not disable plugin "${pluginId}": ${result.status}` };
+      } else {
+        writeConfigIntent(pluginId, false);
+      }
+      const plan = collectStopPlan(pluginId);
+      for (const item of plan) {
+        const reason = item.manifest.id === pluginId ? "plugin disabled" : `dependency ${pluginId} disabled`;
+        beginStop(item, reason);
+      }
+      await Promise.all(plan.map((item) => stopAfterBegin(item, item.manifest.id === pluginId ? "plugin disabled" : `dependency ${pluginId} disabled`, item.manifest.id !== pluginId)));
+      return { ok: true };
+    },
+    suspend: async (pluginId, reason = "runtime identity changed") => {
+      const record2 = records.get(pluginId);
+      if (record2) await stop(record2, reason);
+    },
+    unregister: async (pluginId) => {
+      const record2 = records.get(pluginId);
+      if (!record2) return;
+      if (required(record2.manifest)) throw new Error(`Plugin "${pluginId}" cannot be unregistered`);
+      await host.disable(pluginId);
+      records.delete(pluginId);
+      known.delete(pluginId);
+      bump();
+    },
+    dispose: (reason = "plugin host disposed") => {
+      if (disposePromise) return disposePromise;
+      disposed = true;
+      disposePromise = (async () => {
+        for (const record2 of [...records.values()].reverse()) await stop(record2, reason);
+        return rootScope.dispose({ reason, timeoutMs: options.lifecycleCleanupTimeoutMs });
+      })();
+      return disposePromise;
+    },
+    assertCapabilities(requiredCapabilities, extra = {}) {
+      const details = [];
+      const current = graph();
+      for (const capability of requiredCapabilities) {
+        if (capabilities.has(capability)) continue;
+        const descriptor = capabilityDescriptor(capability);
+        const providerPluginId = current.providers[capabilityKey(descriptor)]?.[0];
+        const provider = providerPluginId ? records.get(providerPluginId) : void 0;
+        details.push({
+          capability: descriptor,
+          providerPluginId,
+          providerState: provider?.state,
+          providerError: provider?.error,
+          configuredEnabled: provider ? desired(provider.manifest) : void 0
+        });
+      }
+      if (details.length > 0) throw new StartupCapabilityError(details, extra.phase);
+    },
+    serviceReferences() {
+      return capabilities.registrations().filter((entry) => isRemote(entry.capability)).map((entry) => entry.reference);
+    },
+    capability(capability) {
+      if (capability.kind === "local") return capabilities.get(capability);
+      const key = capabilityKey(capability);
+      const cached = publicClients.get(key);
+      if (cached) return cached;
+      const client = getRemoteClient(capability, rootScope);
+      publicClients.set(key, client);
+      return client;
+    },
+    optionalCapability(capability) {
+      if (capability.kind === "local") return capabilities.has(capability) ? capabilities.get(capability) : void 0;
+      if (capabilityBridge && !capabilityBridge.services().some((service) => service.kind === capability.kind && service.capabilityId === capability.id && service.contractVersion === capability.version) && !capabilities.has(capability)) return void 0;
+      if (!capabilityBridge && !capabilities.has(capability)) return void 0;
+      return host.capability(capability);
+    },
+    attachRemote(bridge) {
+      capabilityBridge?.invalidate("Remote bridge replaced");
+      capabilityBridge = bridge;
+      bump();
+    },
+    detachRemote(reason = "Remote bridge detached") {
+      capabilityBridge?.invalidate(reason);
+      capabilityBridge = void 0;
+      bump();
+    },
+    registerImplementation(implementation) {
+      const registry = options.runtimeUnitImplementationRegistry;
+      if (!registry?.register) throw new Error("This Host was not created with an advanced implementation registry");
+      registry.register(implementation);
+    },
+    inspect() {
+      return { runtimeId, runtimeKind, runtimeInstanceId, version: versionCounter, pluginCount: known.size, peerCount: 0, pendingCallCount: 0, activeStreamCount: 0, plugins: [...known.keys()].sort().map((id) => host.state(id)) };
+    },
+    explain(target) {
+      const id = typeof target === "string" ? target : target.id;
+      const record2 = records.get(id);
+      if (!record2) return { target: id, reasons: ["unknown"] };
+      const blocked = record2.blockedBy ?? [];
+      return { target: id, state: record2.state, reasons: blocked.length > 0 ? blocked : record2.error ? [record2.error] : [] };
+    }
+  };
+  if (options.pluginIntentCoordinator) options.pluginIntentCoordinator.subscribe((snapshot) => {
+    intentSnapshot = snapshot;
+    void reconcile();
+    bump();
+  });
+  configStore.subscribe((snapshot) => {
+    if (internalConfigWrites.size === 0 && !options.pluginIntentCoordinator) {
+      for (const record2 of records.values()) {
+        if (required(record2.manifest) && snapshot[record2.manifest.id] !== true) writeConfigIntent(record2.manifest.id, true);
+      }
+    }
+    if (internalConfigWrites.size === 0) void reconcile();
+  });
+  return host;
+}
+
+// src/host/runtimeUnitImplementationRegistry.ts
+function implementationKey2(pluginId, unitId) {
+  return `${pluginId}\0${unitId}`;
+}
+function createRuntimeUnitImplementationRegistry(implementations = []) {
+  const entries = /* @__PURE__ */ new Map();
+  const register = (implementation) => {
+    const key = implementationKey2(implementation.pluginId, implementation.unitId);
+    if (entries.has(key)) throw new Error(`\u8FD0\u884C\u5355\u5143\u5B9E\u73B0\u91CD\u590D\u6CE8\u518C: ${implementation.pluginId}/${implementation.unitId}`);
+    entries.set(key, { ...implementation, capabilities: implementation.capabilities ? Object.freeze([...implementation.capabilities]) : void 0 });
+  };
+  for (const implementation of implementations) register(implementation);
+  return {
+    get(pluginId, unitId) {
+      return entries.get(implementationKey2(pluginId, unitId))?.setup;
+    },
+    getCapabilities(pluginId, unitId) {
+      return entries.get(implementationKey2(pluginId, unitId))?.capabilities;
+    },
+    register,
+    unregister(pluginId, unitId) {
+      entries.delete(implementationKey2(pluginId, unitId));
+    }
+  };
+}
+
+// src/runtime/pluginDefinitions.ts
+function cloneDependencies(dependencies, runtime) {
+  if (!dependencies) return void 0;
+  return Object.freeze(dependencies.map((dependency) => {
+    const base = {
+      capability: Object.freeze({ ...dependency.capability }),
+      ...dependency.optional !== void 0 ? { optional: dependency.optional } : {},
+      ...dependency.reason !== void 0 ? { reason: dependency.reason } : {}
+    };
+    return Object.freeze(dependency.source === "peer" ? { ...base, source: "peer" } : { ...base, sourceRuntime: dependency.sourceRuntime ?? runtime });
+  }));
+}
+function selectUnit(input, runtime) {
+  const candidates = [...input.manifest.units ?? []];
+  if (candidates.length === 0) return { id: input.manifest.id, runtime };
+  const requested = input.unitId;
+  if (requested !== void 0) {
+    const unit = candidates.find((candidate) => candidate.id === requested);
+    if (!unit) throw new Error(`Plugin "${input.manifest.id}" does not declare unit "${requested}"`);
+    if (unit.runtime !== void 0 && unit.runtime !== runtime) throw new Error(`Plugin "${input.manifest.id}" unit "${requested}" targets ${unit.runtime}, not ${runtime}`);
+    return { ...unit, runtime };
+  }
+  const matches = candidates.filter((unit) => unit.runtime === void 0 || unit.runtime === runtime);
+  if (matches.length !== 1 || !matches[0]) throw new Error(`Plugin "${input.manifest.id}" has ${matches.length} implementation units for ${runtime}; specify unitId explicitly`);
+  return { ...matches[0], runtime };
+}
+function materializePluginDefinition(input, runtime) {
+  if (!input || !input.manifest || typeof input.manifest.id !== "string" || input.manifest.id.trim() === "") throw new TypeError("Plugin manifest id must be a non-empty string");
+  if (typeof input.setup !== "function") throw new TypeError(`Plugin "${input.manifest.id}" setup must be a function`);
+  const unit = selectUnit(input, runtime);
+  const materializedUnit = Object.freeze({
+    ...unit,
+    runtime,
+    ...cloneDependencies(unit.dependencies, runtime) ? { dependencies: cloneDependencies(unit.dependencies, runtime) } : {},
+    ...unit.provides ? { provides: Object.freeze(unit.provides.map((item) => Object.freeze({ ...item }))) } : {},
+    ...unit.permissions ? { permissions: Object.freeze([...unit.permissions]) } : {}
+  });
+  const manifest = Object.freeze({
+    id: input.manifest.id,
+    name: input.manifest.name,
+    ...input.manifest.description !== void 0 ? { description: input.manifest.description } : {},
+    startup: input.manifest.startup,
+    defaultEnabled: input.manifest.defaultEnabled,
+    canDisable: input.manifest.canDisable,
+    units: Object.freeze([materializedUnit])
+  });
+  const capabilities = Object.freeze([...input.capabilities ?? []]);
+  return { manifest, unitId: unit.id, setup: input.setup, capabilities };
+}
+function materializePluginDefinitions(inputs, runtime) {
+  return inputs.map((input) => materializePluginDefinition(input, runtime));
+}
+
+// src/runtime/runtimeTypes.ts
+var RuntimeInitializationError = class extends Error {
+  code = "runtime_initialization_failed";
+  details;
+  constructor(details) {
+    super(`Runtime initialization failed${details.pluginId ? ` for ${details.pluginId}` : ""} during ${details.phase}: ${details.error}`);
+    this.name = "RuntimeInitializationError";
+    this.details = Object.freeze({ ...details });
+  }
+};
+var RuntimeUnavailableError = class extends Error {
+  code = "transport_unavailable";
+  constructor(message2 = "Runtime is unavailable") {
+    super(message2);
+    this.name = "RuntimeUnavailableError";
+  }
+};
+
+// src/runtime/windowRuntime.ts
+var appHosts = /* @__PURE__ */ new WeakMap();
+var ownedHosts = /* @__PURE__ */ new WeakSet();
+function makeRuntimeInstanceId(runtimeId) {
+  try {
+    if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return `${runtimeId}:${crypto.randomUUID()}`;
+  } catch {
+  }
+  return `${runtimeId}:${Date.now().toString(36)}:${Math.random().toString(36).slice(2)}`;
+}
+function message(error2) {
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+function snapshotFromHost(host, id, instanceId, state = "ready") {
+  const units = host.installed().flatMap((pluginId) => host.state(pluginId).units.map((unit) => ({ pluginId: unit.pluginId, unitId: unit.unitId, runtime: unit.runtime, ...unit.instanceId !== void 0 ? { instanceId: unit.instanceId } : {}, state: unit.kind })));
+  const services = state === "ready" ? host.serviceReferences().map((service) => ({ kind: service.kind, capabilityId: service.capabilityId, contractVersion: service.contractVersion, serviceInstanceId: service.serviceInstanceId, attributes: cloneFrozenAttributes(service.attributes), ...service.grantId !== void 0 ? { grantId: service.grantId } : {}, ...service.authorizationRevision !== void 0 ? { authorizationRevision: service.authorizationRevision } : {} })) : [];
+  return Object.freeze({ protocolVersion: RUNTIME_PROTOCOL_VERSION, runtimeId: id, runtimeKind: "window-main", runtimeInstanceId: instanceId, revision: Math.max(1, host.version()), state, units: Object.freeze(units), services: Object.freeze(services) });
+}
+async function createAppFromHost(id, instanceId, host) {
+  if (ownedHosts.has(host)) throw new Error("This WebLoom Host is already owned by a WindowApp");
+  let current = snapshotFromHost(host, id, instanceId, "starting");
+  let disposed = false;
+  let disposePromise;
+  const listeners = /* @__PURE__ */ new Set();
+  const emit = (state) => {
+    current = snapshotFromHost(host, id, instanceId, state ?? (disposed ? "disposed" : "ready"));
+    for (const listener of [...listeners]) {
+      try {
+        listener(current);
+      } catch {
+      }
+    }
+  };
+  const removeHost = host.subscribe(() => emit());
+  const app = {
+    runtimeKind: "window-main",
+    runtimeId: id,
+    runtimeInstanceId: instanceId,
+    state: () => current,
+    pluginState: (pluginId) => host.state(pluginId),
+    capability(capability) {
+      if (disposed) throw new RuntimeUnavailableError("Window Runtime has been disposed");
+      return host.capability(capability);
+    },
+    optionalCapability(capability) {
+      if (disposed) return void 0;
+      return host.optionalCapability(capability);
+    },
+    inspect() {
+      return host.inspect();
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      listener(current);
+      return () => listeners.delete(listener);
+    },
+    dispose(reason = "window runtime disposed") {
+      if (disposePromise) return disposePromise;
+      disposed = true;
+      emit("stopping");
+      removeHost();
+      disposePromise = host.dispose(reason).then((result) => {
+        emit("disposed");
+        return result;
+      }, (error2) => {
+        emit("failed");
+        throw error2;
+      });
+      return disposePromise;
+    }
+  };
+  appHosts.set(app, host);
+  ownedHosts.add(host);
+  emit("ready");
+  return app;
+}
+async function createWindowApp(options) {
+  const id = options.id ?? "window-main";
+  const instanceId = makeRuntimeInstanceId(id);
+  let materialized;
+  try {
+    materialized = materializePluginDefinitions(options.plugins, "window-main");
+  } catch (error2) {
+    throw new RuntimeInitializationError({ phase: "validate", error: message(error2) });
+  }
+  const implementations = createRuntimeUnitImplementationRegistry(materialized.map((item) => ({ pluginId: item.manifest.id, unitId: item.unitId, setup: item.setup, capabilities: item.capabilities })));
+  const { id: _id, plugins: _plugins, ...hostOptions } = options;
+  const host = createPluginHost({ ...hostOptions, runtime: "window-main", runtimeId: id, runtimeInstanceId: instanceId, runtimeUnitImplementationRegistry: implementations });
+  try {
+    await host.registerAll(materialized.map((item) => item.manifest));
+  } catch (error2) {
+    await host.dispose("window Runtime initialization failed").catch(() => void 0);
+    if (error2 instanceof StartupPluginError) throw new RuntimeInitializationError({ pluginId: error2.details.pluginId, unitId: error2.details.unitId, phase: "startup", error: error2.details.error ?? error2.message });
+    throw new RuntimeInitializationError({ phase: "startup", error: message(error2) });
+  }
+  return createAppFromHost(id, instanceId, host);
+}
+async function createWindowAppFromHost(options) {
+  const id = options.id ?? options.host.runtimeId;
+  if (options.host.runtimeKind !== "window-main") throw new TypeError("createWindowAppFromHost requires a window-main Host");
+  return createAppFromHost(id, options.host.runtimeInstanceId, options.host);
+}
+function hostForWindowApp(app) {
+  const host = appHosts.get(app);
+  if (!host) throw new Error("WindowApp is not owned by a WebLoom Host");
+  return host;
+}
+
+export { DEFAULT_RUNTIME_LIMITS, LIFECYCLE_ERROR_TEXT, LifecycleScopeRevokedError, PermissionDeniedError, PermissionLeaseRevokedError, RESOURCE_OWNER, RESOURCE_REGISTRY, RUNTIME_CALL_TYPE, RUNTIME_CANCEL_TYPE, RUNTIME_CREDIT_TYPE, RUNTIME_ERROR_MESSAGE_TYPE, RUNTIME_ERROR_TYPE, RUNTIME_NEXT_TYPE, RUNTIME_PROTOCOL_VERSION, RUNTIME_RESULT_TYPE, RUNTIME_SNAPSHOT_TYPE, RuntimeInitializationError, RuntimeUnavailableError, SCOPED_TASK_SCHEDULER_CAPABILITY, StartupCapabilityError, StartupPluginError, UpgradeGateRejectedError, WebLoomError, assertCapability, assertReceivedPortSet, buildPluginGraph, capabilityDescriptor, capabilityKey, cloneFrozenAttributes, createCapabilityRegistry, createInMemoryPluginConfigStore, createLifecycleScope, createMessageBus, createPermissionLease, createPluginHost, createReceivePortLedger, createResourceRegistry, createResourceScope, createResourceStore, createRuntimeBudget, createRuntimeMessageCodec, createRuntimeUnitImplementationRegistry, createScopedTaskScheduler, createWindowApp, createWindowAppFromHost, defineCapability, dependenciesOfManifest, hostForWindowApp, invokeCapabilityHandler, isCapability, isCapabilityDescriptor, isRuntimeSnapshot, lifecycleErrorText, materializePluginDefinitions, normalizeRuntimeLimits, providesOfManifest, registerOwnedResource, reverseDependentsOf, selectRuntimeUnit, validateDto, validatePluginGraph, validateRawDto, validateTransferList, validateTransferListWithStats };
+//# sourceMappingURL=chunk-HJKPKWI7.js.map
+//# sourceMappingURL=chunk-HJKPKWI7.js.map