Merge branch 'main' into add-example-plugin-3

Add Example Plugin 3
2026-04-17 03:01:53 +10:00 · 2026-04-17 03:00:39 +10:00
17 changed files with 2240 additions and 128 deletions
--- a/.env.example
+++ b/.env.example
@@ -0,0 +1,9 @@
+# Gitea configuration
+GITEA_URL=http://synbox.ruv.wtf:8418
+GITEA_TOKEN=your_gitea_access_token_here
+
+# Webhook secret (must match Gitea webhook configuration)
+WEBHOOK_SECRET=your_webhook_secret_here
+
+# Server port
+PORT=3000
--- a/.gitea/scripts/validate-pr.js
+++ b/.gitea/scripts/validate-pr.js
@@ -104,7 +104,24 @@ const changedFiles = process.argv[3]?.split('\n').filter(f => f.trim()) || [];
 if (!prAuthor) {
  console.error('❌ Error: PR author not provided');
  process.exit(1);
-}
+}// Check thumbnail if provided (optional)
+      if (plugin.thumbnail) {
+        try {
+          new URL(plugin.thumbnail);
+          
+          // Validate thumbnail meets requirements
+          try {
+            const thumbInfo = await validateThumbnail(plugin.thumbnail);
+            console.log(`   ✓ Thumbnail: ${thumbInfo.format} ${thumbInfo.width}x${thumbInfo.height} (${(thumbInfo.size / 1024).toFixed(1)}KB)`);
+          } catch (thumbErr) {
+            errors.push(`❌ ${file}: Thumbnail validation failed: ${thumbErr.message}`);
+          }
+        } catch {
+          errors.push(`❌ ${file}: Invalid thumbnail URL: ${plugin.thumbnail}`);
+        }
+      }
+      
+      

 console.log(`\n🔍 Validating PR from: ${prAuthor}`);
 console.log(`📝 Changed files: ${changedFiles.length}`);
@@ -143,16 +160,12 @@ for (const file of changedFiles) {
    continue;
  }
  
-  // Adjust file paths based on working directory
-  const prFilePath = process.env.PR_FILES_DIR ? `${process.env.PR_FILES_DIR}/${file.replace('plugins/', '')}` : file;
-  const baseFilePath = file;
-  
  // Check if file was added or removed
  let isAdded = false;
  let isRemoved = false;
  
  try {
-    await access(prFilePath);
+    await access(file);
    isAdded = true;
  } catch {
    isRemoved = true;
@@ -161,7 +174,7 @@ for (const file of changedFiles) {
  if (isAdded) {
    // Validate added/modified plugin
    try {
-      const content = await readFile(prFilePath, 'utf-8');
+      const content = await readFile(file, 'utf-8');
      const plugin = JSON.parse(content);
      
      // Check if this plugin already exists on main
@@ -169,7 +182,7 @@ for (const file of changedFiles) {
      let originalAuthor = null;
      
      try {
-        const originalContent = await readFile(baseFilePath, 'utf-8');
+        const originalContent = await readFile(`../base/${file}`, 'utf-8');
        const originalPlugin = JSON.parse(originalContent);
        isModification = true;
        originalAuthor = originalPlugin.author;
@@ -213,64 +226,11 @@ for (const file of changedFiles) {
      if (plugin.repository) {
        try {
          new URL(plugin.repository);
-          
-          // Repository URL should not end with .git
-          if (plugin.repository.endsWith('.git')) {
-            errors.push(`❌ ${file}: Repository URL should not end with .git: ${plugin.repository}`);
-          }
        } catch {
          errors.push(`❌ ${file}: Invalid repository URL: ${plugin.repository}`);
        }
      }
      
-      // Check homepage URL if provided
-      if (plugin.homepage) {
-        try {
-          new URL(plugin.homepage);
-          
-          if (plugin.homepage.endsWith('.git')) {
-            errors.push(`❌ ${file}: Homepage URL should not end with .git: ${plugin.homepage}`);
-          }
-        } catch {
-          errors.push(`❌ ${file}: Invalid homepage URL: ${plugin.homepage}`);
-        }
-      }
-      
-      // Check downloadUrl if provided
-      if (plugin.downloadUrl) {
-        try {
-          new URL(plugin.downloadUrl);
-          
-          if (plugin.downloadUrl.endsWith('.git')) {
-            errors.push(`❌ ${file}: Download URL should not end with .git: ${plugin.downloadUrl}`);
-          }
-        } catch {
-          errors.push(`❌ ${file}: Invalid download URL: ${plugin.downloadUrl}`);
-        }
-      }
-      
-      // Check thumbnail if provided (optional)
-      if (plugin.thumbnail) {
-        try {
-          new URL(plugin.thumbnail);
-          
-          // Must be named thumbnail.png, thumbnail.jpg, or thumbnail.gif
-          if (!/\/thumbnail\.(png|jpg|gif)$/i.test(plugin.thumbnail)) {
-            errors.push(`❌ ${file}: Thumbnail must be named thumbnail.png, thumbnail.jpg, or thumbnail.gif`);
-          }
-          
-          // Validate thumbnail meets requirements
-          try {
-            const thumbInfo = await validateThumbnail(plugin.thumbnail);
-            console.log(`   ✓ Thumbnail: ${thumbInfo.format} ${thumbInfo.width}x${thumbInfo.height} (${(thumbInfo.size / 1024).toFixed(1)}KB)`);
-          } catch (thumbErr) {
-            errors.push(`❌ ${file}: Thumbnail validation failed: ${thumbErr.message}`);
-          }
-        } catch {
-          errors.push(`❌ ${file}: Invalid thumbnail URL: ${plugin.thumbnail}`);
-        }
-      }
-      
      if (errors.length === 0) {
        added.push(pluginId);
        console.log(`✅ Valid plugin: ${plugin.name}`);
@@ -283,7 +243,7 @@ for (const file of changedFiles) {
  } else if (isRemoved) {
    // For removed files, check the original author from main branch
    try {
-      const originalContent = await readFile(baseFilePath, 'utf-8');
+      const originalContent = await readFile(`../base/${file}`, 'utf-8');
      const originalPlugin = JSON.parse(originalContent);
      
      if (originalPlugin.author !== prAuthor) {
--- a/.gitea/workflows/validate-pr.yml
+++ b/.gitea/workflows/validate-pr.yml
@@ -67,41 +67,18 @@ jobs:
          
      - name: Validate PR (using trusted validation script from main)
        run: |
-          cd base
-          node .gitea/scripts/validate-pr.js "${{ github.event.pull_request.user.login }}" "${{ steps.changed-files.outputs.files }}"
-        env:
-          PR_FILES_DIR: ../pr/plugins
-          
-      - name: Post approval comment
-        if: success()
-        run: |
-          curl -X POST \
-            -H "Authorization: token ${{ github.token }}" \
-            -H "Content-Type: application/json" \
-            -d '{"body":"✅ **Validation passed!** Auto-merging this pull request.\n\nAll plugin requirements have been met:\n- ✓ Valid plugin schema\n- ✓ Correct filename format\n- ✓ Author verification\n- ✓ Repository URL valid\n\nYour plugin will be available in the directory shortly!"}' \
-            "http://synbox.ruv.wtf:8418/api/v1/repos/litruv/Plugin-Directory/issues/${{ github.event.pull_request.number }}/comments"
+          node base/.gitea/scripts/validate-pr.js "${{ github.event.pull_request.user.login }}" "${{ steps.changed-files.outputs.files }}"
+        working-directory: pr
          
      - name: Auto-merge PR
        if: success()
        run: |
-          cd pr
          echo "✅ Validation passed - Auto-merging PR"
-          
-          # Configure git with token authentication
-          git config user.name "gitea-actions[bot]"
-          git config user.email "gitea-actions[bot]@users.noreply.gitea.io"
-          
-          # Set up authenticated remote URL using github.token
-          git remote set-url origin "http://oauth2:${{ github.token }}@synbox.ruv.wtf:8418/litruv/Plugin-Directory.git"
-          
-          # Fetch and merge
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
          git fetch origin ${{ github.event.pull_request.head.ref }}
          git checkout main
          git merge --squash origin/${{ github.event.pull_request.head.ref }}
          git commit -m "${{ github.event.pull_request.title }}"
-          
-          # Push changes
          git push origin main
-          
-          # Delete the PR branch
          git push origin --delete ${{ github.event.pull_request.head.ref }}
--- a/README.md
+++ b/README.md
@@ -1,63 +1,124 @@
 # Plugin Directory

-Git-based plugin registry for Plugin Host. No server needed - just JSON files.
+A simple git-based plugin registry for the Plugin Host system.

-## How to Submit a Plugin
+## 📦 What This Is

-### 1. Create your plugin JSON file
+A collection of JSON files that describe available plugins. The Plugin Host fetches these definitions directly from the git repository.

-Filename format: `plugins/{username}-{plugin-name}.json`
+## 🚀 How It Works

-Example: `plugins/litruv-example-plugin.json`
+1. Plugin authors create a JSON file in `plugins/` directory
+2. Submit via Pull Request
+3. Gitea Actions validate the submission
+4. If valid, maintainer merges the PR
+5. Plugin Host automatically discovers the new plugin
+
+## 📝 Submitting a Plugin
+
+### 1. Fork this repository
+
+### 2. Create your plugin definition
+
+Create `plugins/your-plugin-id.json`:

 ```json
 {
-  "id": "litruv-example-plugin",
-  "name": "Example Plugin",
+  "id": "your-plugin-id",
+  "name": "Your Plugin Name",
  "version": "1.0.0",
  "description": "What your plugin does",
-  "author": "litruv",
-  "repository": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example",
-  "homepage": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example",
-  "thumbnail": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example/raw/branch/main/thumbnail.png",
-  "tags": ["example"]
+  "author": "your-gitea-username",
+  "repository": "http://synbox.ruv.wtf:8418/you/your-plugin.git",
+  "downloadUrl": "http://synbox.ruv.wtf:8418/you/your-plugin/archive/main.zip",
+  "homepage": "http://synbox.ruv.wtf:8418/you/your-plugin",
+  "tags": ["category", "keywords"]
 }
 ```

-**Required fields:** `id`, `name`, `version`, `description`, `author`, `repository`
+**Required fields:**
+- `id` - Must match filename (without .json)
+- `name` - Display name
+- `version` - Semantic version (X.Y.Z)
+- `description` - Brief description
+- `author` - Your Gitea username (must match PR creator)
+- `repository` - Git repository URL

-**Optional fields:** `homepage`, `thumbnail`, `tags`, `downloadUrl`
+### 3. Create Pull Request

-**Rules:**
- All URLs must NOT end with `.git`
- `repository` and `homepage` should point to your plugin repo (without .git)
- `thumbnail` must be `thumbnail.png`, `thumbnail.jpg`, or `thumbnail.gif` (max 512x512, max 2MB)
+Gitea Actions will automatically validate:
+- ✅ File is in `plugins/` directory
+- ✅ File is valid JSON
+- ✅ All required fields present
+- ✅ ID matches filename
+- ✅ Author matches your username
+- ✅ Version format is valid
+- ✅ URLs are valid

-**Important:**
- Filename must start with your username: `{username}-`
- Plugin `id` must match filename (without .json)
- `author` field must match your Gitea username
+**Note:** Don't edit `plugins/index.json` - it's automatically generated when your PR is merged!

-### 2. Create a Pull Request
+### 4. Merge

-Push your branch and create a PR. Gitea Actions will automatically:
- Validate your submission
- Post approval comment if valid
- Auto-merge and update the plugin index
+If validation passes, maintainer will merge your PR. The `index.json` file will be automatically updated.

-That's it! Your plugin will be available immediately after merge.
+## 🗑️ Removing Your Plugin

-## Updating or Removing
+Only plugin authors can remove their own plugins:

- **Update:** Create PR with modified JSON (version bump required)
- **Remove:** Create PR deleting your plugin JSON file
+1. Fork this repository
+2. Delete `plugins/your-plugin-id.json`
+3. Create Pull Request

-You can only modify/remove plugins you authored.
+## 🔄 Updating Your Plugin

-## Plugin Discovery
+1. Fork this repository
+2. Edit `plugins/your-plugin-id.json`
+3. Update version number and any other fields
+4. Create Pull Request
+
+## 📋 Plugin Schema
+
+See [SCHEMA.md](SCHEMA.md) for full schema documentation.
+
+## 🔍 Validation Rules
+
+PRs must:
+- Only modify files in `plugins/` directory
+- Only modify `.json` files
+- Have valid JSON
+- Match the plugin schema
+- Have author field matching PR creator
+- Have plugin ID matching filename
+
+## 🏗️ Directory Structure

-Plugin Host fetches from:
 ```
-http://synbox.ruv.wtf:8418/litruv/Plugin-Directory/raw/branch/main/plugins/index.json
+Plugin-Directory/
+├── plugins/
+│   ├── example-plugin.json
+│   ├── your-plugin.json
+│   └── ...
+├── .gitea/
+│   ├── workflows/
+│   │   └── validate-pr.yml
+│   └── scripts/
+│       └── validate-pr.js
+└── README.md
 ```

+## 🔗 Plugin Host Integration
+
+The Plugin Host fetches plugin definitions from:
+```
+http://synbox.ruv.wtf:8418/litruv/Plugin-Directory/raw/branch/main/plugins/
+```
+
+No server needed - just static JSON files served by Gitea!
+
+## 📖 Example Plugins
+
+- [example-plugin.json](plugins/example-plugin.json) - Reference implementation
+
+## License
+
+MIT
--- a/SCHEMA.md
+++ b/SCHEMA.md
@@ -0,0 +1,73 @@
+# Plugin Schema
+
+All plugin definitions must be valid JSON files following this schema.
+
+## Required Fields
+
+| Field | Type | Description | Example |
+|-------|------|-------------|---------|
+| `id` | string | Unique identifier (must match filename) | `"awesome-plugin"` |
+| `name` | string | Display name | `"Awesome Plugin"` |
+| `version` | string | Semantic version | `"1.0.0"` |
+| `description` | string | What the plugin does | `"Does awesome things"` |
+| `author` | string | Gitea username of creator | `"litruv"` |
+| `repository` | string | Git repository URL | `"http://synbox.ruv.wtf:8418/litruv/awesome-plugin.git"` |
+
+## Optional Fields
+
+| Field | Type | Description | Example |
+|-------|------|-------------|---------|
+| `downloadUrl` | string | Direct download URL | `"http://synbox.ruv.wtf:8418/litruv/awesome-plugin/archive/main.zip"` |
+| `homepage` | string | Plugin homepage or documentation | `"http://synbox.ruv.wtf:8418/litruv/awesome-plugin"` |
+| `tags` | array | Category tags | `["utility", "automation"]` |
+| `addedDate` | string | ISO 8601 date | `"2026-04-17T00:00:00.000Z"` |
+| `dependencies` | object | Required dependencies | `{"lodash": "^4.17.21"}` |
+
+## Example
+
+```json
+{
+  "id": "example-plugin",
+  "name": "Example Plugin",
+  "version": "1.0.0",
+  "description": "An example plugin demonstrating the plugin system capabilities",
+  "author": "litruv",
+  "repository": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example.git",
+  "downloadUrl": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example/archive/main.zip",
+  "homepage": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example",
+  "tags": ["example", "demo"],
+  "addedDate": "2026-04-17T00:00:00.000Z"
+}
+```
+
+## Validation Rules
+
+1. **Filename Match**: Plugin ID must match the filename (without .json extension)
+   - ✅ `awesome-plugin.json` with `"id": "awesome-plugin"`
+   - ❌ `awesome-plugin.json` with `"id": "different-name"`
+
+2. **Version Format**: Must follow semantic versioning (X.Y.Z)
+   - ✅ `"1.0.0"`, `"2.5.3"`, `"0.1.0"`
+   - ❌ `"1.0"`, `"v1.0.0"`, `"latest"`
+
+3. **Author Matching**: For new plugins, author must match PR creator
+   - If PR is by user `litruv`, author field must be `"litruv"`
+
+4. **Valid URLs**: Repository, downloadUrl, and homepage must be valid URLs
+   - ✅ `"http://example.com/repo.git"`
+   - ❌ `"not-a-url"`, `"//example.com"`
+
+5. **Tags**: If present, must be an array of strings
+   - ✅ `["tag1", "tag2"]`
+   - ❌ `"tag1,tag2"`, `{"tag": "value"}`
+
+## Submission Process
+
+1. Create a JSON file in the `plugins/` directory
+2. Filename must be `{plugin-id}.json`
+3. Ensure all required fields are present
+4. Author field must match your Gitea username
+5. Create a Pull Request
+6. Automated validation will run
+7. If valid, PR auto-merges
+8. If invalid, you'll receive comments explaining what to fix
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -0,0 +1,137 @@
+# Security Model
+
+## Authentication vs Git Configuration
+
+### How User Identity Works
+
+**Question:** Can't I just set my git username to anything and bypass validation?
+
+**Answer:** No. The validation uses **Gitea account authentication**, not git commit authors.
+
+#### Git Commit Author (NOT used for validation)
+```bash
+# This can be set to anything locally
+git config user.name "anyone"
+git config user.email "anyone@example.com"
+git commit -m "My commit"
+```
+These values are **NOT** used for plugin ownership validation.
+
+#### PR Creator (used for validation)
+When you create a Pull Request:
+1. You must be logged into your Gitea account
+2. The PR is created through Gitea's authenticated API
+3. `github.event.pull_request.user.login` = your authenticated Gitea username
+
+**This is what validation checks against.**
+
+### Example Attack Scenario (Prevented)
+
+❌ **Attacker tries:**
+```bash
+# Configure git to impersonate someone
+git config user.name "victim"
+git config user.email "victim@example.com"
+
+# Modify victim's plugin
+vim plugins/victim-plugin.json
+# Change author to "attacker"
+
+git commit -m "Update plugin"
+git push
+
+# Create PR (must log into Gitea as "attacker" account)
+```
+
+✅ **What happens:**
+1. PR is created by authenticated Gitea user: `attacker`
+2. Validation script receives: `prAuthor = "attacker"`
+3. Validation checks original plugin from main branch: `original.author = "victim"`
+4. Check fails: `"victim" !== "attacker"`
+5. **Result:** ❌ `Cannot modify plugin owned by "victim" (you are "attacker")`
+
+The git commit author is irrelevant - what matters is **who is logged into Gitea when creating the PR**.
+
+## Security Measures
+
+### 1. Dual Checkout
+```yaml
+- Checkout main branch → base/ (trusted validation scripts)
+- Checkout PR branch → pr/ (untrusted user submissions)
+```
+Validation script always runs from `base/`, never from PR branch.
+
+### 2. Infrastructure Protection
+PRs that modify `.gitea/` directory are automatically rejected.
+
+### 3. Ownership Verification
+All modifications/deletions check **original ownership from main branch**:
+```javascript
+// Check original plugin from main (base/)
+const originalPlugin = readFile('../base/plugins/example.json');
+
+// User can only modify if they own the original
+if (originalPlugin.author !== prAuthor) {
+  reject("Cannot modify plugin owned by someone else");
+}
+```
+
+### 4. Author Field Validation
+New plugins must have `author` field matching the PR creator's authenticated Gitea username.
+
+## What About Collaboration?
+
+**Q:** What if I want someone else to update my plugin?
+
+**A:** They cannot submit PRs directly. Options:
+1. Transfer ownership by updating the `author` field yourself
+2. They fork your plugin repo and create their own plugin entry
+3. Add them as collaborators to your plugin repository (not the directory)
+
+## Trust Model
+
+### Trusted Components
+- Main branch content (validated history)
+- Gitea authentication system
+- GitHub Actions runner environment
+- Validation scripts on main branch
+
+### Untrusted Components
+- PR branch content (user submissions)
+- Git commit metadata (names, emails)
+- PR descriptions and comments
+
+### Validation Flow
+```
+1. User authenticates to Gitea → Trusted user identity
+2. User creates PR → github.event.pull_request.user.login
+3. Validation runs from main branch scripts → Trusted code
+4. Checks plugin ownership against main → Trusted ownership data
+5. Validates PR author matches plugin author → Secure check
+```
+
+## Reporting Security Issues
+
+If you find a security vulnerability in the plugin directory system:
+1. **Do NOT create a public issue or PR**
+2. Contact the repository maintainer directly
+3. Provide detailed reproduction steps
+4. Allow time for a fix before public disclosure
+
+## Additional Safeguards
+
+### Rate Limiting
+Gitea's built-in rate limiting prevents spam PR attacks.
+
+### Branch Protection
+The `main` branch is protected:
+- Direct pushes disabled
+- All changes via PR
+- Auto-merge only after validation passes
+
+### Audit Trail
+All changes are tracked in git history:
+- Who created the PR (Gitea account)
+- What changed (git diff)
+- When it was merged (git commit timestamp)
+- Why validation passed (CI logs)
--- a/VALIDATION_RULES.md
+++ b/VALIDATION_RULES.md
@@ -0,0 +1,200 @@
+# Plugin Validation Rules
+
+All plugin submissions are automatically validated before being merged. PRs must pass all validation checks to be auto-merged.
+
+## Security
+
+**The validation script runs from the main branch, not from your PR branch.** This prevents malicious PRs from modifying the validation logic. PRs that attempt to modify `.gitea/` directory files will be automatically rejected.
+
+## File Requirements
+
+### 1. Location
+- ✅ Only modify files in `plugins/` directory
+- ❌ Cannot modify files outside `plugins/`
+- ❌ Cannot modify `.gitea/` infrastructure files
+- ⚠️ `plugins/index.json` is auto-generated - don't manually edit it
+
+### 2. File Naming
+- **Filename must be prefixed with your username**
+- Format: `username-plugin-name.json`
+- Example: `litruv-example-plugin.json`
+- ❌ Invalid: `example-plugin.json` (missing username prefix)
+- ❌ Invalid: `otheruser-plugin.json` (wrong username)
+
+This prevents naming conflicts and makes ownership visible.
+
+### 3. File Type
+- ✅ Only `.json` files are allowed in `plugins/` directory
+- ❌ No other file types (images, scripts, etc. must be in plugin repo)
+
+## Plugin JSON Schema
+
+### Required Fields
+Every plugin JSON must have these fields:
+
+```json
+{
+  "id": "string",
+  "name": "string",
+  "version": "string",
+  "description": "string",
+  "author": "string",
+  "repository": "string"
+}
+```
+
+### Field Validation Rules
+
+#### `id` (required)
+- Must match the filename
+- Example: `litruv-example-plugin.json` → `"id": "litruv-example-plugin"`
+- Must include username prefix matching filename
+- Lowercase, hyphens allowed, no spaces
+
+#### `name` (required)
+- Display name for the plugin
+- Human-readable, any format
+
+#### `version` (required)
+- Must follow semantic versioning: `x.y.z`
+- Example: `"1.0.0"`, `"2.1.3"`
+- ❌ Invalid: `"v1.0"`, `"1.0"`, `"latest"`
+
+#### `description` (required)
+- Short description of what the plugin does
+- Will be shown in the plugin browser
+
+#### `author` (required)
+- **MUST MATCH YOUR GITEA USERNAME**
+- This enforces ownership - you can only submit/remove plugins authored by you
+- Case-sensitive
+
+#### `repository` (required)
+- Git repository URL where the plugin code lives
+- Must be a valid URL
+- Example: `"http://synbox.ruv.wtf:8418/username/Plugin-Name.git"`
+
+#### `thumbnail` (optional)
+- URL to plugin thumbnail image
+- **Requirements:**
+  - Format: PNG, JPG, or GIF only
+  - Max dimensions: 512×512 pixels
+  - Max file size: 2MB
+  - Must be accessible via HTTP/HTTPS
+- Example: `"http://synbox.ruv.wtf:8418/username/Plugin-Name/raw/branch/main/thumbnail.png"`
+- Validation checks actual image format (magic bytes), dimensions, and size
+
+### Optional Fields
+You can include any additional fields for metadata:
+- `homepage` - Project homepage URL
+- `downloadUrl` - Direct download link
+- `tags` - Array of tags
+- `addedDate` - ISO timestamp
+
+## Ownership Rules
+
+### Adding Plugins
+- The `author` field must match your Gitea username
+- This is checked automatically
+
+### Modifying Plugins
+- **You can only modify plugins where the ORIGINAL author (on main branch) is you**
+- Even if you change the `author` field in your PR, validation checks against the original
+- Attempting to modify someone else's plugin will fail validation with:
+  ```
+  ❌ plugins/their-plugin.json: Cannot modify plugin owned by "them" (you are "you")
+  ```
+
+### Removing Plugins
+- **You can only remove plugins where the ORIGINAL author (on main branch) is you**
+- The validation checks the plugin's author from the main branch, not from your PR
+- Attempting to remove someone else's plugin will fail validation with:
+  ```
+  ❌ plugins/their-plugin.json: Cannot remove plugin owned by "them" (you are "you")
+  ```
+
+**Security Note:** All ownership checks use the plugin data from the `main` branch, not from your PR. You cannot bypass ownership by modifying the `author` field.
+
+## Validation Process
+
+1. **File check**: Ensures only `plugins/*.json` files are modified
+2. **Infrastructure check**: Blocks any `.gitea/` modifications
+3. **JSON parsing**: Validates JSON syntax
+4. **Schema validation**: Checks all required fields exist
+5. **Field validation**: Validates each field's format and rules
+6. **Thumbnail validation** (if provided): Downloads and validates image
+7. **Author matching**: Ensures `author` field matches PR creator
+8. **Auto-merge**: If all checks pass, PR is automatically merged
+
+## Testing Locally
+
+You can test your plugin JSON before submitting:
+
+```bash
+cd Plugin-Directory
+node .gitea/scripts/validate-pr.js "your-username" "plugins/your-plugin.json"
+```
+
+## Common Errors
+
+### ❌ Author mismatch
+```
+❌ plugins/example-plugin.json: Author "someone" must match PR creator "you"
+```
+**Fix**: Change `"author": "someone"` to `"author": "you"`
+
+### ❌ ID doesn't match filename
+```litruv-my-plugin.json: Plugin ID "different-name" doesn't match filename "litruv-my-plugin.json"
+```
+**Fix**: Change `"id": "different-name"` to `"id": "litruv-my-plugin"`
+
+### ❌ Filename missing username prefix
+```
+❌ plugins/my-plugin.json: Filename must start with your username "litruv-" (e.g., "litruv-my-plugin.json")
+```
+**Fix**: Rename file from `my-plugin.json` to `litruv-my-plugin.json` and update the `id` field
+**Fix**: Change `"id": "different-name"` to `"id": "my-plugin"`
+
+### ❌ Invalid version
+```
+❌ plugins/example-plugin.json: Invalid version format: v1.0
+```
+**Fix**: Use semantic versioning like `"version": "1.0.0"`
+
+### ❌ Thumbnail too large
+```
+❌ plugins/example-plugin.json: Thumbnail validation failed: Thumbnail exceeds 2MB limit (3.45MB)
+```
+**Fix**: Compress your thumbnail to under 2MB
+
+### ❌ Thumbnail dimensions too large
+```
+❌ plugins/example-plugin.json: Thumbnail validation failed: Thumbnail dimensions 1024x768 exceed 512x512
+```
+**Fix**: litruv-example-plugin",
+  "name": "Example Plugin",
+  "version": "1.0.0",
+  "description": "An example plugin demonstrating the plugin system capabilities",
+  "author": "litruv",
+  "repository": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example.git",
+  "thumbnail": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example/raw/branch/main/thumbnail.png",
+  "homepage": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example",
+  "tags": ["example", "demo"]
+}
+```
+
+Filename: `litruv-example-plugin.json"author": "litruv",
+  "repository": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example.git",
+  "thumbnail": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example/raw/branch/main/thumbnail.png",
+  "homepage": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example",
+  "tags": ["example", "demo"]
+}
+```
+
+## Security Note
+
+**Never include sensitive information in plugin JSON files.** These files are public and will be served to all plugin host users. Do not include:
+- API keys or tokens
+- Passwords
+- Private URLs or endpoints
+- Personal information
--- a/package-lock.json
+++ b/package-lock.json
@@ -0,0 +1,920 @@
+{
+  "name": "@pluginhost/directory",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@pluginhost/directory",
+      "version": "1.0.0",
+      "license": "MIT",
+      "dependencies": {
+        "express": "^4.18.2",
+        "node-fetch": "^3.3.2"
+      }
+    },
+    "node_modules/accepts": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "~2.1.34",
+        "negotiator": "0.6.3"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/array-flatten": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
+      "license": "MIT"
+    },
+    "node_modules/body-parser": {
+      "version": "1.20.4",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.4.tgz",
+      "integrity": "sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "content-type": "~1.0.5",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "~1.2.0",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "on-finished": "~2.4.1",
+        "qs": "~6.14.0",
+        "raw-body": "~2.5.3",
+        "type-is": "~1.6.18",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/content-disposition": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "5.2.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/content-type": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie-signature": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz",
+      "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
+      "license": "MIT"
+    },
+    "node_modules/data-uri-to-buffer": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-4.0.1.tgz",
+      "integrity": "sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/destroy": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "license": "MIT"
+    },
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "license": "MIT"
+    },
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/express": {
+      "version": "4.22.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
+      "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
+      "license": "MIT",
+      "dependencies": {
+        "accepts": "~1.3.8",
+        "array-flatten": "1.1.1",
+        "body-parser": "~1.20.3",
+        "content-disposition": "~0.5.4",
+        "content-type": "~1.0.4",
+        "cookie": "~0.7.1",
+        "cookie-signature": "~1.0.6",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "finalhandler": "~1.3.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.0",
+        "merge-descriptors": "1.0.3",
+        "methods": "~1.1.2",
+        "on-finished": "~2.4.1",
+        "parseurl": "~1.3.3",
+        "path-to-regexp": "~0.1.12",
+        "proxy-addr": "~2.0.7",
+        "qs": "~6.14.0",
+        "range-parser": "~1.2.1",
+        "safe-buffer": "5.2.1",
+        "send": "~0.19.0",
+        "serve-static": "~1.16.2",
+        "setprototypeof": "1.2.0",
+        "statuses": "~2.0.1",
+        "type-is": "~1.6.18",
+        "utils-merge": "1.0.1",
+        "vary": "~1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/fetch-blob": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/fetch-blob/-/fetch-blob-3.2.0.tgz",
+      "integrity": "sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/jimmywarting"
+        },
+        {
+          "type": "paypal",
+          "url": "https://paypal.me/jimmywarting"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "node-domexception": "^1.0.0",
+        "web-streams-polyfill": "^3.0.3"
+      },
+      "engines": {
+        "node": "^12.20 || >= 14.13"
+      }
+    },
+    "node_modules/finalhandler": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
+      "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "2.6.9",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "on-finished": "~2.4.1",
+        "parseurl": "~1.3.3",
+        "statuses": "~2.0.2",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/formdata-polyfill": {
+      "version": "4.0.10",
+      "resolved": "https://registry.npmjs.org/formdata-polyfill/-/formdata-polyfill-4.0.10.tgz",
+      "integrity": "sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g==",
+      "license": "MIT",
+      "dependencies": {
+        "fetch-blob": "^3.1.2"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.4.24",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/merge-descriptors": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
+      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/methods": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+      "license": "MIT",
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "license": "MIT"
+    },
+    "node_modules/negotiator": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/node-domexception": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
+      "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==",
+      "deprecated": "Use your platform's native DOMException instead",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/jimmywarting"
+        },
+        {
+          "type": "github",
+          "url": "https://paypal.me/jimmywarting"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.5.0"
+      }
+    },
+    "node_modules/node-fetch": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.2.tgz",
+      "integrity": "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==",
+      "license": "MIT",
+      "dependencies": {
+        "data-uri-to-buffer": "^4.0.0",
+        "fetch-blob": "^3.1.4",
+        "formdata-polyfill": "^4.0.10"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/node-fetch"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+      "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
+      "license": "MIT"
+    },
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "license": "MIT",
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.14.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
+      "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "side-channel": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/raw-body": {
+      "version": "2.5.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
+      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
+    "node_modules/send": {
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
+      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "1.2.0",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.1",
+        "mime": "1.6.0",
+        "ms": "2.1.3",
+        "on-finished": "~2.4.1",
+        "range-parser": "~1.2.1",
+        "statuses": "~2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/send/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/serve-static": {
+      "version": "1.16.3",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
+      "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
+      "license": "MIT",
+      "dependencies": {
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "parseurl": "~1.3.3",
+        "send": "~0.19.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "license": "ISC"
+    },
+    "node_modules/side-channel": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
+    "node_modules/type-is": {
+      "version": "1.6.18",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "license": "MIT",
+      "dependencies": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.24"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/utils-merge": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/web-streams-polyfill": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz",
+      "integrity": "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    }
+  }
+}
--- a/package.json
+++ b/package.json
@@ -0,0 +1,19 @@
+{
+  "name": "@pluginhost/directory",
+  "version": "1.0.0",
+  "description": "Automated plugin directory with PR validation and auto-merge",
+  "main": "src/server.js",
+  "type": "module",
+  "scripts": {
+    "start": "node src/server.js",
+    "dev": "node --watch src/server.js",
+    "validate": "node src/validate.js"
+  },
+  "keywords": ["plugin", "directory", "registry"],
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "express": "^4.18.2",
+    "node-fetch": "^3.3.2"
+  }
+}
--- a/plugins/index.json
+++ b/plugins/index.json
@@ -1,6 +1,6 @@
 {
  "version": "1.0.0",
-  "updatedAt": "2026-04-16T17:29:40.639Z",
+  "updatedAt": "2026-04-16T16:58:43.725Z",
  "plugins": [
    "litruv-example-plugin",
    "litruv-example-plugin-2"
--- a/plugins/litruv-example-plugin-2.json
+++ b/plugins/litruv-example-plugin-2.json
@@ -4,7 +4,7 @@
  "version": "1.0.0",
  "description": "A second example plugin demonstrating additional capabilities",
  "author": "litruv",
-  "repository": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example2",
+  "repository": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example2.git",
  "downloadUrl": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example2/archive/main.zip",
  "homepage": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example2",
  "tags": ["example", "demo", "filtering", "validation"],
--- a/plugins/litruv-example-plugin-3.json
+++ b/plugins/litruv-example-plugin-3.json
@@ -4,7 +4,7 @@
  "version": "1.0.0",
  "description": "A third example plugin demonstrating async operations and data storage",
  "author": "litruv",
-  "repository": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example3",
+  "repository": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example3.git",
  "homepage": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example3",
  "tags": ["example", "async", "storage"]
 }
--- a/plugins/litruv-example-plugin.json
+++ b/plugins/litruv-example-plugin.json
@@ -4,7 +4,7 @@
  "version": "1.0.0",
  "description": "An example plugin demonstrating the plugin system capabilities",
  "author": "litruv",
-  "repository": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example",
+  "repository": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example.git",
  "thumbnail": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example/raw/branch/main/thumbnail.png",
  "downloadUrl": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example/archive/main.zip",
  "homepage": "http://synbox.ruv.wtf:8418/litruv/Plugin-Example",
--- a/src/Validator.js
+++ b/src/Validator.js
@@ -0,0 +1,193 @@
+import { readFile } from 'fs/promises';
+
+/**
+ * Validator - Validates PR changes against plugin directory rules
+ */
+export class Validator {
+  constructor() {
+    this.requiredFields = ['id', 'name', 'version', 'description', 'author', 'repository'];
+    this.optionalFields = ['downloadUrl', 'homepage', 'tags', 'addedDate', 'dependencies'];
+  }
+
+  /**
+   * Validate a PR's file changes
+   */
+  async validatePR(files, prAuthor) {
+    const errors = [];
+    const added = [];
+    const removed = [];
+
+    // Check that all files are in the plugins/ directory
+    const invalidPaths = files.filter(f => !f.filename.startsWith('plugins/'));
+    if (invalidPaths.length > 0) {
+      errors.push(`Files outside plugins/ directory: ${invalidPaths.map(f => f.filename).join(', ')}`);
+    }
+
+    // Check that all files are .json files
+    const nonJsonFiles = files.filter(f => 
+      f.filename.startsWith('plugins/') && !f.filename.endsWith('.json')
+    );
+    if (nonJsonFiles.length > 0) {
+      errors.push(`Non-JSON files in plugins/: ${nonJsonFiles.map(f => f.filename).join(', ')}`);
+    }
+
+    // Process each changed file
+    for (const file of files) {
+      if (!file.filename.startsWith('plugins/') || !file.filename.endsWith('.json')) {
+        continue;
+      }
+
+      const pluginId = file.filename.replace('plugins/', '').replace('.json', '');
+
+      if (file.status === 'added' || file.status === 'modified') {
+        // Validate added/modified plugins
+        try {
+          const validation = await this.validatePluginFile(file, pluginId, prAuthor);
+          
+          if (!validation.valid) {
+            errors.push(...validation.errors.map(e => `${file.filename}: ${e}`));
+          } else {
+            added.push(pluginId);
+          }
+        } catch (error) {
+          errors.push(`${file.filename}: ${error.message}`);
+        }
+      } else if (file.status === 'removed') {
+        // Validate removed plugins (check ownership)
+        try {
+          const canRemove = await this.validateRemoval(pluginId, prAuthor);
+          
+          if (!canRemove.valid) {
+            errors.push(...canRemove.errors.map(e => `${file.filename}: ${e}`));
+          } else {
+            removed.push(pluginId);
+          }
+        } catch (error) {
+          errors.push(`${file.filename}: ${error.message}`);
+        }
+      }
+    }
+
+    // Must have at least one change
+    if (files.length === 0) {
+      errors.push('PR has no file changes');
+    }
+
+    return {
+      valid: errors.length === 0,
+      errors,
+      added,
+      removed
+    };
+  }
+
+  /**
+   * Validate a plugin JSON file
+   */
+  async validatePluginFile(file, pluginId, prAuthor) {
+    const errors = [];
+
+    try {
+      // Parse the JSON content from the file patch
+      const content = this.extractFileContent(file);
+      const plugin = JSON.parse(content);
+
+      // Check required fields
+      for (const field of this.requiredFields) {
+        if (!plugin[field]) {
+          errors.push(`Missing required field: ${field}`);
+        }
+      }
+
+      // Check that ID matches filename
+      if (plugin.id !== pluginId) {
+        errors.push(`Plugin ID "${plugin.id}" does not match filename "${pluginId}.json"`);
+      }
+
+      // Validate version format (semver-ish)
+      if (plugin.version && !this.isValidVersion(plugin.version)) {
+        errors.push(`Invalid version format: ${plugin.version} (expected: X.Y.Z)`);
+      }
+
+      // Validate repository URL
+      if (plugin.repository && !this.isValidUrl(plugin.repository)) {
+        errors.push(`Invalid repository URL: ${plugin.repository}`);
+      }
+
+      // Validate author matches PR author (for new plugins)
+      if (file.status === 'added' && plugin.author !== prAuthor) {
+        errors.push(`Author "${plugin.author}" must match PR author "${prAuthor}"`);
+      }
+
+      // Validate tags if present
+      if (plugin.tags && !Array.isArray(plugin.tags)) {
+        errors.push('Tags must be an array');
+      }
+
+    } catch (error) {
+      errors.push(`Invalid JSON: ${error.message}`);
+    }
+
+    return {
+      valid: errors.length === 0,
+      errors
+    };
+  }
+
+  /**
+   * Validate that a user can remove a plugin
+   */
+  async validateRemoval(pluginId, prAuthor) {
+    const errors = [];
+
+    try {
+      // Read the existing plugin file from disk
+      const content = await readFile(`./plugins/${pluginId}.json`, 'utf-8');
+      const plugin = JSON.parse(content);
+
+      // Check if the PR author is the plugin author
+      if (plugin.author !== prAuthor) {
+        errors.push(`Cannot remove plugin: you are not the author (author: ${plugin.author})`);
+      }
+    } catch (error) {
+      // If file doesn't exist, it's probably already removed
+      console.warn(`Could not validate removal of ${pluginId}:`, error.message);
+    }
+
+    return {
+      valid: errors.length === 0,
+      errors
+    };
+  }
+
+  /**
+   * Extract file content from Gitea file object
+   * In a real implementation, you'd fetch the raw content from the PR
+   */
+  extractFileContent(file) {
+    // This is a simplified version
+    // In production, fetch the actual file content from the PR's head branch
+    
+    // For now, return a placeholder that would need to be fetched
+    throw new Error('File content extraction not fully implemented - fetch from PR branch');
+  }
+
+  /**
+   * Validate semantic version format
+   */
+  isValidVersion(version) {
+    return /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/.test(version);
+  }
+
+  /**
+   * Validate URL format
+   */
+  isValidUrl(url) {
+    try {
+      new URL(url);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
--- a/src/ValidatorEnhanced.js
+++ b/src/ValidatorEnhanced.js
@@ -0,0 +1,232 @@
+import { WebhookHandler } from './WebhookHandler.js';
+import fetch from 'node-fetch';
+
+/**
+ * Enhanced validator that fetches actual file content from PR
+ */
+export class Validator {
+  constructor(webhookHandler) {
+    this.handler = webhookHandler;
+    this.requiredFields = ['id', 'name', 'version', 'description', 'author', 'repository'];
+    this.optionalFields = ['downloadUrl', 'homepage', 'tags', 'addedDate', 'dependencies'];
+  }
+
+  /**
+   * Validate a PR's file changes
+   */
+  async validatePR(files, prAuthor, prNumber) {
+    const errors = [];
+    const added = [];
+    const removed = [];
+
+    // Check that all files are in the plugins/ directory
+    const invalidPaths = files.filter(f => !f.filename.startsWith('plugins/'));
+    if (invalidPaths.length > 0) {
+      errors.push(`Files outside plugins/ directory: ${invalidPaths.map(f => f.filename).join(', ')}`);
+    }
+
+    // Check that all files are .json files
+    const nonJsonFiles = files.filter(f => 
+      f.filename.startsWith('plugins/') && !f.filename.endsWith('.json')
+    );
+    if (nonJsonFiles.length > 0) {
+      errors.push(`Non-JSON files in plugins/: ${nonJsonFiles.map(f => f.filename).join(', ')}`);
+    }
+
+    // Process each changed file
+    for (const file of files) {
+      if (!file.filename.startsWith('plugins/') || !file.filename.endsWith('.json')) {
+        continue;
+      }
+
+      const pluginId = file.filename.replace('plugins/', '').replace('.json', '');
+
+      if (file.status === 'added' || file.status === 'modified') {
+        // Fetch and validate the file content
+        try {
+          const content = await this.fetchPRFileContent(prNumber, file.filename);
+          const validation = await this.validatePluginContent(content, pluginId, prAuthor, file.status);
+          
+          if (!validation.valid) {
+            errors.push(...validation.errors.map(e => `${file.filename}: ${e}`));
+          } else {
+            added.push(pluginId);
+          }
+        } catch (error) {
+          errors.push(`${file.filename}: ${error.message}`);
+        }
+      } else if (file.status === 'removed') {
+        // Validate removed plugins (check ownership)
+        try {
+          const canRemove = await this.validateRemoval(pluginId, prAuthor);
+          
+          if (!canRemove.valid) {
+            errors.push(...canRemove.errors.map(e => `${file.filename}: ${e}`));
+          } else {
+            removed.push(pluginId);
+          }
+        } catch (error) {
+          errors.push(`${file.filename}: ${error.message}`);
+        }
+      }
+    }
+
+    // Must have at least one change
+    if (files.length === 0) {
+      errors.push('PR has no file changes');
+    }
+
+    return {
+      valid: errors.length === 0,
+      errors,
+      added,
+      removed
+    };
+  }
+
+  /**
+   * Fetch file content from a PR
+   */
+  async fetchPRFileContent(prNumber, filename) {
+    const pr = await this.getPRDetails(prNumber);
+    const headSha = pr.head.sha;
+    
+    const url = `${this.handler.giteaUrl}/api/v1/repos/${this.handler.repoOwner}/${this.handler.repoName}/contents/${filename}?ref=${headSha}`;
+    
+    const response = await fetch(url, {
+      headers: { 'Authorization': `token ${this.handler.giteaToken}` }
+    });
+
+    if (!response.ok) {
+      throw new Error(`Failed to fetch file: ${response.statusText}`);
+    }
+
+    const data = await response.json();
+    const content = Buffer.from(data.content, 'base64').toString('utf-8');
+    return content;
+  }
+
+  /**
+   * Get PR details
+   */
+  async getPRDetails(prNumber) {
+    const url = `${this.handler.giteaUrl}/api/v1/repos/${this.handler.repoOwner}/${this.handler.repoName}/pulls/${prNumber}`;
+    
+    const response = await fetch(url, {
+      headers: { 'Authorization': `token ${this.handler.giteaToken}` }
+    });
+
+    if (!response.ok) {
+      throw new Error(`Failed to fetch PR: ${response.statusText}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Validate plugin JSON content
+   */
+  async validatePluginContent(content, pluginId, prAuthor, status) {
+    const errors = [];
+
+    try {
+      const plugin = JSON.parse(content);
+
+      // Check required fields
+      for (const field of this.requiredFields) {
+        if (!plugin[field]) {
+          errors.push(`Missing required field: ${field}`);
+        }
+      }
+
+      // Check that ID matches filename
+      if (plugin.id !== pluginId) {
+        errors.push(`Plugin ID "${plugin.id}" does not match filename "${pluginId}.json"`);
+      }
+
+      // Validate version format (semver-ish)
+      if (plugin.version && !this.isValidVersion(plugin.version)) {
+        errors.push(`Invalid version format: ${plugin.version} (expected: X.Y.Z)`);
+      }
+
+      // Validate repository URL
+      if (plugin.repository && !this.isValidUrl(plugin.repository)) {
+        errors.push(`Invalid repository URL: ${plugin.repository}`);
+      }
+
+      // Validate author matches PR author (for new plugins)
+      if (status === 'added' && plugin.author !== prAuthor) {
+        errors.push(`Author "${plugin.author}" must match PR author "${prAuthor}"`);
+      }
+
+      // Validate tags if present
+      if (plugin.tags && !Array.isArray(plugin.tags)) {
+        errors.push('Tags must be an array');
+      }
+
+    } catch (error) {
+      errors.push(`Invalid JSON: ${error.message}`);
+    }
+
+    return {
+      valid: errors.length === 0,
+      errors
+    };
+  }
+
+  /**
+   * Validate that a user can remove a plugin
+   */
+  async validateRemoval(pluginId, prAuthor) {
+    const errors = [];
+
+    try {
+      // Read the existing plugin file from main branch
+      const url = `${this.handler.giteaUrl}/api/v1/repos/${this.handler.repoOwner}/${this.handler.repoName}/contents/plugins/${pluginId}.json`;
+      
+      const response = await fetch(url, {
+        headers: { 'Authorization': `token ${this.handler.giteaToken}` }
+      });
+
+      if (!response.ok) {
+        // If file doesn't exist on main, removal is fine
+        return { valid: true, errors: [] };
+      }
+
+      const data = await response.json();
+      const content = Buffer.from(data.content, 'base64').toString('utf-8');
+      const plugin = JSON.parse(content);
+
+      // Check if the PR author is the plugin author
+      if (plugin.author !== prAuthor) {
+        errors.push(`Cannot remove plugin: you are not the author (author: ${plugin.author})`);
+      }
+    } catch (error) {
+      console.warn(`Could not validate removal of ${pluginId}:`, error.message);
+    }
+
+    return {
+      valid: errors.length === 0,
+      errors
+    };
+  }
+
+  /**
+   * Validate semantic version format
+   */
+  isValidVersion(version) {
+    return /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/.test(version);
+  }
+
+  /**
+   * Validate URL format
+   */
+  isValidUrl(url) {
+    try {
+      new URL(url);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
--- a/src/WebhookHandler.js
+++ b/src/WebhookHandler.js
@@ -0,0 +1,245 @@
+import crypto from 'crypto';
+import fetch from 'node-fetch';
+import { readdir, readFile } from 'fs/promises';
+import { join, dirname, resolve } from 'path';
+import { fileURLToPath } from 'url';
+import { Validator } from './ValidatorEnhanced.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+/**
+ * WebhookHandler - Processes Gitea webhooks for automated PR handling
+ */
+export class WebhookHandler {
+  constructor(options) {
+    this.giteaUrl = options.giteaUrl;
+    this.giteaToken = options.giteaToken;
+    this.webhookSecret = options.webhookSecret;
+    this.repoOwner = options.repoOwner;
+    this.repoName = options.repoName;
+    this.validator = new Validator(this);
+  }
+
+  /**
+   * Verify webhook signature
+   */
+  verifySignature(payload, signature) {
+    if (!this.webhookSecret) return true; // Skip if no secret configured
+    
+    const hmac = crypto.createHmac('sha256', this.webhookSecret);
+    const digest = hmac.update(JSON.stringify(payload)).digest('hex');
+    return signature === digest;
+  }
+
+  /**
+   * Handle pull request webhook
+   */
+  async handlePullRequest(payload) {
+    const { action, pull_request, repository } = payload;
+    
+    console.log(`PR #${pull_request.number}: ${action} by ${pull_request.user.login}`);
+
+    // Only process opened or synchronized PRs
+    if (action !== 'opened' && action !== 'synchronize') {
+      console.log('Skipping PR action:', action);
+      return;
+    }
+
+    try {
+      // Get PR details
+      const prNumber = pull_request.number;
+      const prAuthor = pull_request.user.login;
+      const headBranch = pull_request.head.ref;
+      const baseBranch = pull_request.base.ref;
+
+      // Get file changes in the PR
+      const files = await this.getPRFiles(prNumber);
+      
+      console.log(`PR files changed: ${files.map(f => `${f.filename} (${f.status})`).join(', ')}`);
+
+      // Validate the PR
+      const validation = await this.validator.validatePR(files, prAuthor, prNumber);
+
+      if (!validation.valid) {
+        console.log('Validation failed:', validation.errors);
+        await this.commentOnPR(prNumber, this.buildErrorComment(validation.errors));
+        await this.labelPR(prNumber, 'validation-failed');
+        return;
+      }
+
+      // PR is valid, auto-approve and merge
+      console.log('✓ PR validation passed');
+      await this.commentOnPR(prNumber, this.buildSuccessComment(validation));
+      await this.labelPR(prNumber, 'auto-approved');
+      await this.mergePR(prNumber);
+      
+      console.log(`✓ Auto-merged PR #${prNumber}`);
+    } catch (error) {
+      console.error('Error handling PR:', error);
+      await this.commentOnPR(pull_request.number, 
+        `❌ **Automation Error**\n\nFailed to process this PR: ${error.message}`
+      );
+    }
+  }
+
+  /**
+   * Get files changed in a PR
+   */
+  async getPRFiles(prNumber) {
+    const url = `${this.giteaUrl}/api/v1/repos/${this.repoOwner}/${this.repoName}/pulls/${prNumber}/files`;
+    const response = await fetch(url, {
+      headers: { 'Authorization': `token ${this.giteaToken}` }
+    });
+
+    if (!response.ok) {
+      throw new Error(`Failed to fetch PR files: ${response.statusText}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Comment on a PR
+   */
+  async commentOnPR(prNumber, body) {
+    const url = `${this.giteaUrl}/api/v1/repos/${this.repoOwner}/${this.repoName}/issues/${prNumber}/comments`;
+    
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Authorization': `token ${this.giteaToken}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({ body })
+    });
+
+    if (!response.ok) {
+      console.error('Failed to comment on PR:', response.statusText);
+    }
+  }
+
+  /**
+   * Label a PR
+   */
+  async labelPR(prNumber, label) {
+    const url = `${this.giteaUrl}/api/v1/repos/${this.repoOwner}/${this.repoName}/issues/${prNumber}/labels`;
+    
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Authorization': `token ${this.giteaToken}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({ labels: [label] })
+    });
+
+    if (!response.ok) {
+      console.error('Failed to label PR:', response.statusText);
+    }
+  }
+
+  /**
+   * Merge a PR
+   */
+  async mergePR(prNumber) {
+    const url = `${this.giteaUrl}/api/v1/repos/${this.repoOwner}/${this.repoName}/pulls/${prNumber}/merge`;
+    
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Authorization': `token ${this.giteaToken}`,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        Do: 'squash',
+        MergeMessageField: 'Auto-merged plugin directory update',
+        delete_branch_after_merge: true
+      })
+    });
+
+    if (!response.ok) {
+      throw new Error(`Failed to merge PR: ${response.statusText}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Build error comment for PR
+   */
+  buildErrorComment(errors) {
+    let comment = '❌ **Validation Failed**\n\nThis PR cannot be auto-merged due to the following issues:\n\n';
+    
+    errors.forEach(error => {
+      comment += `- ${error}\n`;
+    });
+
+    comment += '\n**Rules:**\n';
+    comment += '1. Only modify files in the `plugins/` directory\n';
+    comment += '2. Only add or remove `.json` files\n';
+    comment += '3. JSON files must match the plugin schema\n';
+    comment += '4. You can only remove plugins you authored\n';
+    comment += '5. Plugin ID must match the filename (without .json)\n';
+    comment += '\nPlease fix these issues and push again.';
+
+    return comment;
+  }
+
+  /**
+   * Build success comment for PR
+   */
+  buildSuccessComment(validation) {
+    let comment = '✅ **Validation Passed**\n\nThis PR has been automatically approved and will be merged.\n\n';
+    
+    if (validation.added.length > 0) {
+      comment += `**Added plugins:** ${validation.added.join(', ')}\n`;
+    }
+    
+    if (validation.removed.length > 0) {
+      comment += `**Removed plugins:** ${validation.removed.join(', ')}\n`;
+    }
+
+    comment += '\nTo undo this change, create a new PR that reverses these changes.';
+
+    return comment;
+  }
+
+  /**
+   * List all plugins from the plugins directory
+   */
+  async listPlugins() {
+    const pluginsDir = resolve(__dirname, '../plugins');
+    const files = await readdir(pluginsDir);
+    const plugins = [];
+
+    for (const file of files) {
+      if (file.endsWith('.json')) {
+        try {
+          const content = await readFile(join(pluginsDir, file), 'utf-8');
+          const plugin = JSON.parse(content);
+          plugins.push(plugin);
+        } catch (error) {
+          console.error(`Error reading plugin ${file}:`, error);
+        }
+      }
+    }
+
+    return plugins;
+  }
+
+  /**
+   * Get a specific plugin
+   */
+  async getPlugin(pluginId) {
+    const pluginsDir = resolve(__dirname, '../plugins');
+    const filePath = join(pluginsDir, `${pluginId}.json`);
+    
+    try {
+      const content = await readFile(filePath, 'utf-8');
+      return JSON.parse(content);
+    } catch (error) {
+      return null;
+    }
+  }
+}
--- a/src/server.js
+++ b/src/server.js
@@ -0,0 +1,86 @@
+import express from 'express';
+import { WebhookHandler } from './WebhookHandler.js';
+import { readFile } from 'fs/promises';
+
+const app = express();
+const port = process.env.PORT || 3000;
+const webhookSecret = process.env.WEBHOOK_SECRET || '';
+
+app.use(express.json());
+
+const handler = new WebhookHandler({
+  giteaUrl: process.env.GITEA_URL || 'http://synbox.ruv.wtf:8418',
+  giteaToken: process.env.GITEA_TOKEN || '',
+  webhookSecret,
+  repoOwner: 'litruv',
+  repoName: 'Plugin-Directory'
+});
+
+/**
+ * Health check endpoint
+ */
+app.get('/health', (req, res) => {
+  res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+/**
+ * List all plugins endpoint
+ */
+app.get('/plugins', async (req, res) => {
+  try {
+    const plugins = await handler.listPlugins();
+    res.json({ plugins, count: plugins.length });
+  } catch (error) {
+    console.error('Error listing plugins:', error);
+    res.status(500).json({ error: 'Failed to list plugins' });
+  }
+});
+
+/**
+ * Get specific plugin endpoint
+ */
+app.get('/plugins/:pluginId', async (req, res) => {
+  try {
+    const plugin = await handler.getPlugin(req.params.pluginId);
+    if (plugin) {
+      res.json(plugin);
+    } else {
+      res.status(404).json({ error: 'Plugin not found' });
+    }
+  } catch (error) {
+    console.error('Error getting plugin:', error);
+    res.status(500).json({ error: 'Failed to get plugin' });
+  }
+});
+
+/**
+ * Webhook endpoint for Gitea PR events
+ */
+app.post('/webhook', async (req, res) => {
+  try {
+    const signature = req.headers['x-gitea-signature'];
+    const event = req.headers['x-gitea-event'];
+    
+    if (!handler.verifySignature(req.body, signature)) {
+      console.warn('Invalid webhook signature');
+      return res.status(401).json({ error: 'Invalid signature' });
+    }
+
+    console.log(`Received webhook event: ${event}`);
+
+    if (event === 'pull_request') {
+      await handler.handlePullRequest(req.body);
+    }
+
+    res.json({ status: 'processed' });
+  } catch (error) {
+    console.error('Webhook error:', error);
+    res.status(500).json({ error: 'Webhook processing failed' });
+  }
+});
+
+app.listen(port, () => {
+  console.log(`Plugin Directory server running on port ${port}`);
+  console.log(`Webhook endpoint: http://litruv-sub:${port}/webhook`);
+  console.log(`Plugin list: http://litruv-sub:${port}/plugins`);
+});
Author	SHA1	Message	Date
litruv	7283f2a2b5	Merge branch 'main' into add-example-plugin-3 Some checks failed Validate Plugin PR / validate (pull_request) Failing after 9s Details	2026-04-17 03:01:53 +10:00
Max Litruv Boonzaayer	0a1727b218	Add Example Plugin 3 Some checks failed Validate Plugin PR / validate (pull_request) Failing after 9s Details	2026-04-17 03:00:39 +10:00