@aalis/plugin-webui-server 0.14.1 → 0.16.0

package/dist/routes/media.d.ts

@@ -0,0 +1,10 @@
+import { type StorageService } from '@aalis/api-storage';
+import type { Logger } from '@aalis/core';
+import { type MediaFormat } from '@aalis/util-file-signature';
+import type express from 'express';
+import type { RouteGate } from '../gate.js';
+/** 按文件头判定出浏览器能直接显示或播放的格式，判不出或不在 {@link BROWSER_MEDIA} 里的为 undefined */
+export declare function browserMediaOf(head: Uint8Array): MediaFormat | undefined;
+/** 传入的是 storage 的业务句柄：区间读恒有定义，提供者不支持时调用即抛错 */
+export declare function registerMediaRoutes(expressApp: express.Express, storage: StorageService & Required<Pick<StorageService, 'readFileRange'>>, logger: Logger, gate: RouteGate): void;
+//# sourceMappingURL=media.d.ts.map

package/dist/routes/media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../src/routes/media.ts"],"names":[],"mappings":"AAUA,OAAO,EAAmC,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAsC,KAAK,WAAW,EAAwB,MAAM,4BAA4B,CAAC;AACxH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmB5C,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAGxE;AAED,8CAA8C;AAC9C,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,OAAO,CAAC,OAAO,EAC3B,OAAO,EAAE,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,EACzE,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,GACd,IAAI,CA8BN"}

package/dist/routes/media.js

@@ -0,0 +1,66 @@
+// ============================================================
+// routes/media.ts — 聊天里的图片、视频与音频按存储地址取
+//
+// GET /api/media?uri=<storage URI>（如 data:/images/x.png）。聊天消息与会话历史里的附件多半是存储
+// 地址，浏览器拿它当不了图片地址；客户端把它换成这条路由。只有 owner（cookie 闸）能取；按文件头判定类型，
+// 只放行浏览器能直接显示或播放的图片、视频与音频，其余（含 HTML、SVG、JSON 账本）一律 415，不在 WebUI 源里内联。
+// 响应带 nosniff 与 sandbox CSP，类型取判定结果、不取扩展名。文件不存在回 404，其余读不出的（含存储拒绝的越界路径）
+// 回 500 并记告警。
+// ============================================================
+import { isStorageNotFound, isStorageUri } from '@aalis/api-storage';
+import { detectMediaFormat, FILE_HEAD_BYTES } from '@aalis/util-file-signature';
+import { route } from '../route.js';
+import { t } from '../texts.js';
+import { pipeToResponse } from './pipe-to-response.js';
+/** 浏览器能直接显示或播放的格式：这条路由与图片代理（只取其中的图片）都只提供这几种，响应类型取判定结果 */
+const BROWSER_MEDIA = new Set([
+    'PNG',
+    'JPEG',
+    'GIF',
+    'WebP',
+    'MP4',
+    'WebM',
+    'MP3',
+    'WAV',
+    'OGG',
+    'M4A',
+]);
+/** 按文件头判定出浏览器能直接显示或播放的格式，判不出或不在 {@link BROWSER_MEDIA} 里的为 undefined */
+export function browserMediaOf(head) {
+    const format = detectMediaFormat(head.subarray(0, FILE_HEAD_BYTES));
+    return format && BROWSER_MEDIA.has(format.format) ? format : undefined;
+}
+/** 传入的是 storage 的业务句柄：区间读恒有定义，提供者不支持时调用即抛错 */
+export function registerMediaRoutes(expressApp, storage, logger, gate) {
+    route(expressApp, 'GET /api/media', gate(), async (req, res) => {
+        const uri = String(req.query.uri ?? '');
+        if (!isStorageUri(uri)) {
+            res.status(400).json({ error: t('notStorageUri') });
+            return;
+        }
+        try {
+            const format = browserMediaOf(await storage.readFileRange(uri, 0, FILE_HEAD_BYTES));
+            if (!format) {
+                res.status(415).json({ error: t('notMedia') });
+                return;
+            }
+            const { stream, stat } = await storage.createReadStream(uri);
+            res.setHeader('Content-Type', format.mime);
+            res.setHeader('Content-Length', stat.size);
+            res.setHeader('Content-Disposition', 'inline');
+            res.setHeader('X-Content-Type-Options', 'nosniff');
+            res.setHeader('Content-Security-Policy', "sandbox; default-src 'none'");
+            res.setHeader('Cache-Control', 'private, max-age=3600');
+            pipeToResponse(stream, res, logger, `媒体文件 ${uri}`);
+        }
+        catch (err) {
+            if (isStorageNotFound(err)) {
+                res.status(404).json({ error: t('fileMissing') });
+                return;
+            }
+            logger.warn(`读取媒体文件 ${uri} 失败:`, err);
+            res.status(500).json({ error: t('readFailed') });
+        }
+    });
+}
+//# sourceMappingURL=media.js.map

package/dist/routes/media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.js","sourceRoot":"","sources":["../../src/routes/media.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,6DAA6D;AAC7D,sEAAsE;AACtE,wEAAwE;AACxE,cAAc;AACd,+DAA+D;AAE/D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAuB,MAAM,oBAAoB,CAAC;AAE1F,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAA0C,MAAM,4BAA4B,CAAC;AAGxH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,yDAAyD;AACzD,MAAM,aAAa,GAAiC,IAAI,GAAG,CAAC;IAC1D,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,OAAO,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,mBAAmB,CACjC,UAA2B,EAC3B,OAAyE,EACzE,MAAc,EACd,IAAe;IAEf,KAAK,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;YACpF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;YAC/C,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,6BAA6B,CAAC,CAAC;YACxE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;YACxD,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/pages.d.ts

@@ -0,0 +1,22 @@
+import type { UserIdentity } from '@aalis/api-authority';
+import type { FrameTexts, WebuiAdminEvent } from '@aalis/api-webui';
+import { type Logger } from '@aalis/core';
+import type express from 'express';
+import type { RouteGate } from '../gate.js';
+import { type LayoutStore } from '../layout.js';
+import type { PageRegistry } from '../pages.js';
+export declare function registerPageRoutes(expressApp: express.Express, deps: {
+    registry: PageRegistry;
+    layout: LayoutStore;
+    /** 存储服务在不在：布局记录读写要它 */
+    storageReady(): boolean;
+    send(event: WebuiAdminEvent): void;
+    logger: Logger;
+    /** 一个插件的字典，交给插件前端 */
+    texts(plugin: string): FrameTexts;
+}, identify: (req: {
+    headers: {
+        cookie?: string;
+    };
+}) => UserIdentity | undefined, gate: RouteGate): void;
+//# sourceMappingURL=pages.d.ts.map

package/dist/routes/pages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/routes/pages.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAiB,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,KAAK,MAAM,EAAmB,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAc,KAAK,WAAW,EAAwB,MAAM,cAAc,CAAC;AAElF,OAAO,KAAK,EAAE,YAAY,EAAS,MAAM,aAAa,CAAC;AAIvD,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,OAAO,CAAC,OAAO,EAC3B,IAAI,EAAE;IACJ,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;IACpB,uBAAuB;IACvB,YAAY,IAAI,OAAO,CAAC;IACxB,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;CACnC,EACD,QAAQ,EAAE,CAAC,GAAG,EAAE;IAAE,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAAK,YAAY,GAAG,SAAS,EAC7E,IAAI,EAAE,SAAS,GACd,IAAI,CA2FN"}

package/dist/routes/pages.js

@@ -0,0 +1,104 @@
+// ============================================================
+// routes/pages.ts — 声明式页面、会话面板与布局记录的 REST 路由
+//
+// 路径与返回形状见 api-webui 的 page.ts。页面的数据源与动作要把调用者交给插件，这两条路由自己解析身份（与 gate 同一判定）；
+// 其余用 gate。闸门与校验在 pages.ts，这里只把请求交过去、把结果连同它要的渲染选项写回。插件前端的字典是这一页所属插件
+// 的（插件名取实例 id 第一个「:」之前的部分），原样交出。布局记录存在插件数据里，存储服务不在时回 503。
+// ============================================================
+import { parseInstanceId } from '@aalis/core';
+import { LayoutFull, parseLayoutOperation } from '../layout.js';
+import { renderWith, skipSchemaDefaults } from '../localize.js';
+import { route } from '../route.js';
+import { t } from '../texts.js';
+export function registerPageRoutes(expressApp, deps, identify, gate) {
+    const { registry, layout } = deps;
+    const reply = (res, { status, body, render }) => {
+        if (render)
+            renderWith(res, render);
+        res.status(status).json(body);
+    };
+    const forbidden = (res) => res.status(403).json({ error: t('ownerRequired') });
+    route(expressApp, 'GET /api/pages', gate(), (_req, res) => {
+        const pages = registry.views();
+        const inputs = pages.flatMap(page => Object.values(page.actions ?? {}).map(action => action.input));
+        renderWith(res, { skip: skipSchemaDefaults(inputs) });
+        res.json({ pages });
+    });
+    route(expressApp, 'GET /api/session-pages', gate(), async (req, res) => {
+        reply(res, await registry.panelPages(req.query.sessionId));
+    });
+    route(expressApp, 'GET /api/pages/:instance/:pageKey/texts', gate(), (req, res) => {
+        const { instance, pageKey } = req.params;
+        if (!registry.placementOf({ instance, pageKey })) {
+            return res.status(404).json({ error: t('pageMissing', { page: pageKey, instance }) });
+        }
+        // 字典是原样数据：译文表的键可能恰好是文字对象的那几个
+        renderWith(res, { skip: () => true });
+        res.json(deps.texts(parseInstanceId(instance).moduleName));
+    });
+    route(expressApp, 'GET /api/pages/:instance/:pageKey/data/:componentId', async (req, res) => {
+        const caller = identify(req);
+        if (!caller)
+            return forbidden(res);
+        const { instance, pageKey, componentId } = req.params;
+        reply(res, await registry.data(instance, pageKey, componentId, req.query, { caller }));
+    });
+    route(expressApp, 'POST /api/pages/:instance/:pageKey/actions/:action', async (req, res) => {
+        const caller = identify(req);
+        if (!caller)
+            return forbidden(res);
+        const { instance, pageKey, action } = req.params;
+        reply(res, await registry.act(instance, pageKey, action, req.body, { caller }, req.socket.remoteAddress ?? '未知'));
+    });
+    const storageMissing = (res) => res.status(503).json({ error: t('noStorageLayout') });
+    route(expressApp, 'GET /api/layout', gate(), async (_req, res) => {
+        if (!deps.storageReady())
+            return storageMissing(res);
+        try {
+            res.json(await layout.read());
+        }
+        catch (err) {
+            deps.logger.warn('读取布局记录失败:', err);
+            res.status(500).json({ error: t('layoutReadFailed') });
+        }
+    });
+    route(expressApp, 'POST /api/layout', gate(), async (req, res) => {
+        if (!deps.storageReady())
+            return storageMissing(res);
+        const operation = parseLayoutOperation(req.body);
+        if (!operation) {
+            return res.status(400).json({ error: t('layoutOpInvalid') });
+        }
+        // 固定与打开插件标签只收此刻登记着、位置对的页面；其余只动记录，所属插件停用时也能改
+        const wanted = operation.op === 'pin'
+            ? { page: operation.page, placement: 'plugin', refusal: t('pinPluginOnly') }
+            : operation.op === 'open-tab' && !('host' in operation.tab)
+                ? { page: operation.tab, placement: 'session', refusal: t('openSessionOnly') }
+                : undefined;
+        if (wanted) {
+            const placement = registry.placementOf(wanted.page);
+            if (!placement) {
+                return res
+                    .status(404)
+                    .json({ error: t('pageMissing', { page: wanted.page.pageKey, instance: wanted.page.instance }) });
+            }
+            if (placement !== wanted.placement)
+                return res.status(400).json({ error: wanted.refusal });
+        }
+        try {
+            const { records, changed } = await layout.apply(operation);
+            if (changed)
+                deps.send({ type: 'layout.changed' });
+            res.json(records);
+        }
+        catch (err) {
+            if (err instanceof LayoutFull) {
+                res.status(409).json({ error: err.text });
+                return;
+            }
+            deps.logger.warn('保存布局记录失败:', err);
+            res.status(500).json({ error: t('layoutSaveFailed') });
+        }
+    });
+}
+//# sourceMappingURL=pages.js.map

package/dist/routes/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/routes/pages.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,6CAA6C;AAC7C,EAAE;AACF,4EAA4E;AAC5E,oEAAoE;AACpE,0DAA0D;AAC1D,+DAA+D;AAI/D,OAAO,EAAe,eAAe,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EAAE,UAAU,EAAoB,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC;AAEhC,MAAM,UAAU,kBAAkB,CAChC,UAA2B,EAC3B,IASC,EACD,QAA6E,EAC7E,IAAe;IAEf,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,CAAI,GAAwC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAY,EAAE,EAAE;QAChG,IAAI,MAAM;YAAE,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,GAAoC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAEhH,KAAK,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpG,UAAU,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrE,KAAK,CAAC,GAAG,EAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,UAAU,EAAE,yCAAyC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YACjD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,6BAA6B;QAC7B,UAAU,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,UAAU,EAAE,qDAAqD,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1F,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACtD,KAAK,CAAC,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,UAAU,EAAE,oDAAoD,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACjD,KAAK,CAAC,GAAG,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,CAAC,GAAoC,EAAE,EAAE,CAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAExD,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,4CAA4C;QAC5C,MAAM,MAAM,GACV,SAAS,CAAC,EAAE,KAAK,KAAK;YACpB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE;YAC5E,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC;gBACzD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE;gBAC9E,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG;qBACP,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YACtG,CAAC;YACD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/pipe-to-response.d.ts

@@ -0,0 +1,9 @@
+import type { Readable, Writable } from 'node:stream';
+import type { Logger } from '@aalis/core';
+/**
+ * 把读流写进响应。读流出错（打开前文件被删、读到一半出错）或客户端中途断开时，pipeline 把两端都销毁、断开这次
+ * 响应，响应头可能已经发出，不再改回错误码。裸 pipe 不处理源流的错误，没有监听的 'error' 会让进程退出；客户端断开
+ * 时也不销毁源流，fd 不回收。中途断开是常事，只记读流出错；label 是日志里这次发送的说明
+ */
+export declare function pipeToResponse(stream: Readable, res: Writable, logger: Logger, label: string): void;
+//# sourceMappingURL=pipe-to-response.d.ts.map

package/dist/routes/pipe-to-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipe-to-response.d.ts","sourceRoot":"","sources":["../../src/routes/pipe-to-response.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAInG"}

package/dist/routes/pipe-to-response.js

@@ -0,0 +1,16 @@
+// ============================================================
+// routes/pipe-to-response.ts — 把存储读流写进 HTTP 响应
+// ============================================================
+import { pipeline } from 'node:stream/promises';
+/**
+ * 把读流写进响应。读流出错（打开前文件被删、读到一半出错）或客户端中途断开时，pipeline 把两端都销毁、断开这次
+ * 响应，响应头可能已经发出，不再改回错误码。裸 pipe 不处理源流的错误，没有监听的 'error' 会让进程退出；客户端断开
+ * 时也不销毁源流，fd 不回收。中途断开是常事，只记读流出错；label 是日志里这次发送的说明
+ */
+export function pipeToResponse(stream, res, logger, label) {
+    pipeline(stream, res).catch((err) => {
+        if (err.code !== 'ERR_STREAM_PREMATURE_CLOSE')
+            logger.warn(`${label} 读取出错: ${err.message}`);
+    });
+}
+//# sourceMappingURL=pipe-to-response.js.map

package/dist/routes/pipe-to-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipe-to-response.js","sourceRoot":"","sources":["../../src/routes/pipe-to-response.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+CAA+C;AAC/C,+DAA+D;AAG/D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAgB,EAAE,GAAa,EAAE,MAAc,EAAE,KAAa;IAC3F,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAA0B,EAAE,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,KAAK,4BAA4B;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/plugins.d.ts

@@ -1,51 +1,45 @@
-import type { UserIdentity } from '@aalis/api-authority';
 import type { CommandService } from '@aalis/api-commands';
 import { type HostConfig } from '@aalis/api-host-config';
 import type { PluginSourceService } from '@aalis/api-plugin-source';
 import type { ToolService } from '@aalis/api-tools';
-import type { WebUIService, WebuiActionHandler } from '@aalis/api-webui';
-import type { AppService, Logger, PluginManagerService, ServiceRef } from '@aalis/core';
+import type { ErrorResponse } from '@aalis/api-webui';
+import type { AppService, Logger, PluginManagerService, ServiceSelection, Services } from '@aalis/core';
+import { type TextRef } from '@aalis/schema-i18n';
 import type express from 'express';
 import type { RouteGate } from '../gate.js';
-/**
- * 落盘被拒后运行态怎样与文件对齐：插件配置与新建的实例随配置文件热重载（文件里没有配置段的后缀实例会被卸载）；
- * 启停与服务偏好只在重启时按文件登记
- */
-declare const RECONCILE: {
-    readonly reload: "修好配置文件后会按文件内容重载";
-    readonly restart: "修好配置文件后，重启时以文件内容为准";
-};
 /**
  * 管理动作改完运行态之后落盘；失败时回 `applied: true` 并返回 false：改动已在运行态生效、只是没写进文件，
  * 调用方别当成「没改成」去重试。宿主拒写（配置文件有尚未生效的外部修改）回 409，之后以文件为准对账；
  * 其它失败（权限、磁盘写满等）回 500，文件没变也不会触发重载，改动留在文档里，下一次成功保存时一并写入。
+ * `reconcile` 是落盘被拒后运行态怎样与文件对齐：插件配置、新建的实例与服务偏好随配置文件热重载（reload，文件里没有配置段的
+ * 后缀实例会被卸载）；启停只在重启时按文件登记（restart）。被拒的可能是配置文件，也可能是密钥文件，拒写原因里点了名，
+ * 这里不指具体哪个文件。
  * `outcome` 是动作之后插件没有落在预期状态的说明（如激活失败转 error、仍在激活、保持禁用）：落盘也失败时放在回执开头，
  * 两件事一并说明。
  */
-export declare function saveAfterApply(doc: Pick<HostConfig, 'save'>, res: express.Response, reconcile: keyof typeof RECONCILE, outcome?: string): Promise<boolean>;
+export declare function saveAfterApply(doc: Pick<HostConfig, 'save'>, res: express.Response<ErrorResponse>, reconcile: 'reload' | 'restart', outcome?: TextRef): Promise<boolean>;
 /** 插件管理 + 全局配置路由用到的能力 */
 interface PluginRoutesCaps {
-    app: ServiceRef<AppService>;
-    plugins: ServiceRef<PluginManagerService>;
+    app: Pick<ServiceSelection<AppService>, 'present' | 'use'>;
+    plugins: Pick<ServiceSelection<PluginManagerService>, 'present' | 'use'>;
     /** 宿主的插件来源；打包宿主不提供，扫描路由随之报不可用 */
-    source: Pick<ServiceRef<PluginSourceService>, 'current'>;
+    source: Pick<ServiceSelection<PluginSourceService>, 'present' | 'use'>;
     /** 配置文档的读写与落盘（宿主提供；缺席时读写文档的路由返回 503） */
-    hostConfig: Pick<ServiceRef<HostConfig>, 'current'>;
-    tools: Pick<ServiceRef<ToolService>, 'current'>;
-    commands: Pick<ServiceRef<CommandService>, 'current'>;
-    /**
-     * 取当前 webui-server 提供者（页面登记表的读取面）。本插件自己提供这个服务，
-     * 写死引用就绕过了解析——第三方若以更高优先级接管 webui-server，页面列表该跟着走。
-     */
-    webui(): WebUIService | undefined;
+    hostConfig: Pick<ServiceSelection<HostConfig>, 'present' | 'use'>;
+    tools: Pick<ServiceSelection<ToolService>, 'present' | 'use'>;
+    commands: Pick<ServiceSelection<CommandService>, 'present' | 'use'>;
+    /** 当前有提供者的服务名：列表与回执据它判缺与在等；列表另据它读各插件的本插件偏好与此刻的选择 */
+    services: Pick<Services, 'names' | 'preferred' | 'inspect'>;
+    /** 提供这个界面的插件实例：经这些路由停用不了它，列表给它标 self */
+    self: string;
+    /** 家目录（宿主路径的 home）：宿主配置一并给出；宿主不提供路径时没有 */
+    home?: string;
+    /** 本地已装包的版本，每取一次列表现查一遍（装卸与更新会改它） */
+    versions(): (name: string) => string | undefined;
     /** 裁剪 schema 外字段时点名 warn，保存全局配置后重启失败时记 error；测试可不传 */
     logger?: Logger;
 }
 /** 注册插件管理 + 全局配置相关 REST 路由 */
-export declare function registerPluginRoutes(expressApp: express.Express, caps: PluginRoutesCaps, identify: (req: {
-    headers: {
-        cookie?: string;
-    };
-}) => UserIdentity | undefined, gate: RouteGate, getAction: (plugin: string, method: string) => WebuiActionHandler | undefined): void;
+export declare function registerPluginRoutes(expressApp: express.Express, caps: PluginRoutesCaps, gate: RouteGate): void;
 export {};
 //# sourceMappingURL=plugins.d.ts.map

package/dist/routes/plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/routes/plugins.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,wBAAwB,CAAC;AAC9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAa,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAe,UAAU,EAAE,MAAM,aAAa,CAAC;AAWrG,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAM5C;;;GAGG;AACH,QAAA,MAAM,SAAS;;;CAGL,CAAC;AAEX;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAC7B,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,SAAS,EAAE,MAAM,OAAO,SAAS,EACjC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAmBlB;AA8BD,yBAAyB;AACzB,UAAU,gBAAgB;IACxB,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5B,OAAO,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAC1C,iCAAiC;IACjC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC,CAAC;IACzD,wCAAwC;IACxC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;IACpD,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IAChD,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC,CAAC;IACtD;;;OAGG;IACH,KAAK,IAAI,YAAY,GAAG,SAAS,CAAC;IAClC,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8BAA8B;AAC9B,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,OAAO,CAAC,OAAO,EAC3B,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,CAAC,GAAG,EAAE;IAAE,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAAK,YAAY,GAAG,SAAS,EAC7E,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,GAC5E,IAAI,CA8nBN"}
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/routes/plugins.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAEL,KAAK,UAAU,EAGhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EACV,UAAU,EACV,MAAM,EACN,oBAAoB,EAGpB,gBAAgB,EAChB,QAAQ,EACT,MAAM,aAAa,CAAC;AAerB,OAAO,EAAU,KAAK,OAAO,EAAuB,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAuB5C;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAC7B,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EACpC,SAAS,EAAE,QAAQ,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAuED,yBAAyB;AACzB,UAAU,gBAAgB;IACxB,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,CAAC;IACzE,iCAAiC;IACjC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,CAAC;IACvE,wCAAwC;IACxC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,CAAC;IAClE,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,CAAC;IAC9D,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,CAAC;IACpE,oDAAoD;IACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC,CAAC;IAC5D,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,QAAQ,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACjD,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8BAA8B;AAC9B,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAomB/G"}