┌─────────────────────────────────────┐
│       宿主进程 - 视频会议核心         │
│  (UI渲染、音视频引擎、信令、插件管理)  │
├─────────────────────────────────────┤
│       插件管理服务 - 独立进程          │
│  (注册表、生命周期、通信总线、权限控制)  │
├─────────────────────────────────────┤
│       插件运行时沙箱 (多实例)          │
│  ┌─────────┐ ┌─────────┐ ┌─────────┐  │
│  │ Plugin A│ │ Plugin B│ │ Plugin N│  │  ← 独立 V8 Isolate / WASM Instance
│  │ v1.2.0  │ │ v3.1.0  │ │ v0.9.5  │  │
│  └─────────┘ └─────────┘ └─────────┘  │
└─────────────────────────────────────┘

// 伪代码：流式下载 + 增量合成 + 流式哈希校验
async function fetchAndAssemble(pluginId: string, targetVersion: string) {
  const manifest = await registry.getManifest(pluginId, targetVersion);
  // 1. 并行下载分片，边下载边计算 SHA-256
  const chunks = await Promise.all(manifest.chunks.map(downloadChunkWithHash));
  
  // 2. 内存中应用 BSdiff 补丁合成最终 WASM/JS Bundle (零落盘)
  const bundle = await applyPatchesInMemory(manifest.baseVersion, chunks);
  
  // 3. 最终完整性校验
  if (!verifySignature(bundle, manifest.publicKey)) throw new Error("Signature mismatch");
  return bundle;
}

// 宿主暴露共享模块
new ModuleFederationPlugin({
  name: 'host',
  exposes: { './MediaEngine': './src/media-engine' },
  shared: { 'react': { singleton: true, strictVersion: true } }
});

// 插件声明依赖共享
new ModuleFederationPlugin({
  name: 'plugin_virtual_background',
  remotes: { host: 'host@/remoteEntry.js' },
  shared: { 'react': { singleton: true, requiredVersion: '^18.2.0' } }
});

stateDiagram-v2
    [*] --> Active_v1: 运行中
    Active_v1 --> Preparing_v2: 接收更新指令
    Preparing_v2 --> Validating_v2: 实例化新版本沙箱
    Validating_v2 --> Standby_v2: 预热完成/自检通过
    Standby_v2 --> Swapping: 原子切换指针
    Swapping --> Active_v2: 切换成功
    Swapping --> Active_v1: 切换失败/熔断 -> 回滚
    Active_v2 --> Recycling_v1: 旧实例回收

struct PluginSlot {
    active: Arc<Mutex<PluginInstance>>,
    standby: Arc<Mutex<Option<PluginInstance>>>,
}

impl PluginSlot {
    async fn hot_swap(&self, new_bundle: Bundle) -> Result<()> {
        // 1. 准备阶段：在后台构建新实例，不影响当前流量
        let new_instance = PluginInstance::spawn(new_bundle).await?;
        new_instance.warmup().await?; // 预热：JIT编译、建立连接池、加载模型
        
        // 2. 状态迁移：序列化关键状态 (会话ID、用户配置、临时缓存)
        let state_snapshot = self.active.lock().await.checkpoint()?;
        new_instance.restore(state_snapshot).await?;
        
        // 3. 原子切换：使用 Arc::swap 实现指针级无锁切换
        let mut standby_guard = self.standby.lock().await;
        *standby_guard = Some(new_instance);
        drop(standby_guard); // 释放锁
        
        // 4. 流量切换 (单线程原子操作)
        let mut active_guard = self.active.lock().await;
        let old_instance = std::mem::replace(&mut *active_guard, standby_guard.take().unwrap());
        drop(active_guard);
        
        // 5. 优雅下线旧实例
        old_instance.graceful_shutdown(Duration::from_secs(5)).await;
        Ok(())
    }
}

// IPC 发送端注入
const span = tracer.startSpan('plugin.invoke', { attributes: { 'plugin.id': id, 'plugin.version': ver } });
ipc.send({ ...payload, __trace_parent: span.context() });

// 插件沙箱端提取
const parentCtx = extract(context.active(), carrier);
const span = tracer.startSpan('plugin.handle', { attributes: { ... }, parent: parentCtx });

// 统一抽象 Trait (宿主侧)
#[async_trait]
trait PluginRuntime: Send + Sync {
    async fn instantiate(&self, module: &[u8], config: InstanceConfig) -> Result<Box<dyn PluginInstance>>;
    fn get_capabilities(&self) -> RuntimeCaps;
}

// Windows 实现：优先 Wasmtime + Win32 Job Object 隔离
struct WindowsRuntime;
#[cfg(target_os = "windows")]
impl PluginRuntime for WindowsRuntime {
    async fn instantiate(&self, module: &[u8], config: InstanceConfig) -> Result<...> {
        let mut linker = Linker::new(&engine);
        // 注入 Windows 特有 Host API (如 Media Foundation 句柄传递)
        linker.func_wrap("host_win", "mf_create_transform", |...| { ... })?;
        // 配置 Job Object 限制 CPU/内存/IO
        let job = JobObject::create()?.set_memory_limit(config.mem_limit)?;
        Ok(Box::new(WasmtimeInstance::new_in_job(module, linker, job)?))
    }
}

// Web/Electron 实现：纯 WASM + Comlink RPC
struct WebRuntime;
#[cfg(target_arch = "wasm32")]
impl PluginRuntime for WebRuntime {
    async fn instantiate(&self, module: &[u8], config: InstanceConfig) -> Result<...> {
        // 使用 Web Worker + Comlink 实现线程隔离
        const workerCode = `... Comlink.expose(await instantiateStreaming(fetch(moduleUrl), imports)) ...`;
        const worker = new Worker(URL.createObjectURL(new Blob([workerCode])));
        return Ok(Box::new(WebWorkerInstance::new(worker)));
    }
}

// 工厂模式：编译期单态化，零运行时开销
fn create_runtime() -> Arc<dyn PluginRuntime> {
    #[cfg(target_os = "windows")] return Arc::new(WindowsRuntime);
    #[cfg(target_os = "macos")] return Arc::new(MacOSRuntime);
    #[cfg(target_os = "linux")] return Arc::new(LinuxRuntime);
    #[cfg(target_arch = "wasm32")] return Arc::new(WebRuntime);
}

// plugin_api.h (宿主与原生插件契约，严禁 C++ ABI)
typedef struct { int width, height; uint64_t timestamp; void* gpu_handle; } VideoFrame;
typedef void (*FrameCallback)(VideoFrame*, void* user_data);

PLUGIN_API int32_t plugin_init(PluginContext* ctx, const char* config_json);
PLUGIN_API int32_t plugin_process_frame(VideoFrame* in, VideoFrame* out, FrameCallback cb);
PLUGIN_API void plugin_shutdown();
PLUGIN_API const char* plugin_get_manifest_json(); // 返回 WASM Component Model 兼容的 WIT 描述

# 一键初始化
npx create-videoconf-plugin my-virtual-bg --template=wasm-rust-react --lang=typescript

# 目录结构
my-virtual-bg/
├── plugin.wit           # 接口定义 (WIT IDL) - 契约优先
├── src/
│   ├── host/            # 宿主侧 TypeScript SDK 自动生成
│   ├── guest/           # 插件侧实现 (Rust/AssemblyScript/TS)
│   └── shared/          # 共享类型 (Zod/TypeBox Schema)
├── tests/
│   ├── contract.test.ts # 契约测试 (Pact/Schemathesis)
│   └── e2e.spec.ts      # Playwright 对接真实客户端
├── .github/workflows/   # 标准 CI: Lint -> Test -> Build -> Sign -> Publish
└── plugin.config.json   # 权限声明、资源配额、入口点

# .github/workflows/contract-test.yml
jobs:
  contract-verification:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        plugin: [virtual-bg, live-caption, recorder] # 所有上架插件
    steps:
      - uses: actions/checkout@v4
      - name: Fetch Plugin Artifact
        uses: actions/download-artifact@v4
        with: { name: ${{ matrix.plugin }}-wasm }
      - name: Run Contract Tests
        run: |
          # 1. 启动 Pact Mock Provider (模拟宿主 API)
          # 2. 加载插件 WASM，驱动其调用 Host API
          # 3. 验证请求参数/返回值符合 OpenAPI/WIT Schema
          cargo test --manifest-path ${{ matrix.plugin }}/Cargo.toml contract
      - name: Publish Results
        uses: pact-foundation/pact-broker-action@v1

graph LR
    A[开发者提交源码/产物] --> B{CI 构建}
    B --> C[Syft 生成 SBOM]
    C --> D[Trivy/Grype 漏洞扫描]
    D --> E[OPA 策略评估<br/>- 禁止高危依赖<br/>- 权限最小化检查<br/>- 代码签名验证]
    E -- 通过 --> F[Cosign/Notary 签名<br/>ReKOR 透明日志]
    F --> G[私有 OCI Registry<br/>存储 WASM + Manifest]
    G --> H[客户端增量拉取]
    E -- 失败 --> I[阻断发布 & 反馈报告]

// 宿主侧：导出 GPU 纹理句柄
fn export_gpu_handle(frame: &VideoFrame) -> Result<ExternalGpuHandle> {
    #[cfg(target_os = "windows")] { frame.texture.create_shared_handle() } // NT HANDLE
    #[cfg(target_os = "macos")] { frame.texture.create_iosurface() }       // IOSurfaceRef
    #[cfg(target_os = "linux")] { frame.texture.export_dmabuf() }         // DMABUF FD
    #[cfg(target_arch = "wasm32")] { frame.gpu_texture }                  // WebGPU GPUTexture
}

// 插件侧 WASM (WASI-NN / WebGPU 导入)
#[link(wasm_import_module = "host_media")]
extern "C" {
    fn import_gpu_texture(handle: u64, width: u32, height: u32, format: u32) -> u32; // 返回插件侧 Texture ID
}

// 插件处理逻辑：直接在 GPU 侧跑 Shader/Compute Shader，零 CPU 拷贝
fn process_shader(input_tex: u32, output_tex: u32) {
    // 绑定 Pipeline，Dispatch Compute Shader
    // 仅同步 Fence/Semaphore，不搬运像素数据
}

# chaos_experiment.py (基于 Chaos Toolkit / 自研框架)
experiment = {
    "title": "插件热更新过程中的网络分区韧性验证",
    "steady-state-hypothesis": {
        "title": "会议核心指标正常",
        "probes": [
            {"type": "probe", "name": "meeting_connectivity", "threshold": "> 99.9%"},
            {"type": "probe", "name": "plugin_crash_rate", "threshold": "< 0.01%"}
        ]
    },
    "method": [
        {
            "type": "action",
            "name": "trigger-hot-update",
            "provider": "plugin-mgmt",
            "arguments": {"plugin_id": "virtual-bg", "version": "2.1.0"}
        },
        {
            "type": "action",
            "name": "inject-network-partition",
            "provider": "chaosblade",
            "arguments": {"target": "plugin-mgmt-svc", "loss": "50%", "duration": "30s"}
        },
        {
            "type": "probe",
            "name": "verify-rollback",
            "provider": "custom",
            "arguments": {"expect_version": "2.0.5", "timeout": "10s"} # 期望自动回滚
        }
    ],
    "rollbacks": [{"type": "action", "name": "restore-network"}]
}