@agentproto/runtime 5.10.0 → 5.11.1

package/dist/app-catalog.d.ts

@@ -0,0 +1,162 @@
+import { z } from 'zod';
+import { A as AppSource } from './app-registry-B64vZEaO.js';
+
+/**
+ * App catalog — a static, hand-curated `~/.agentproto/app-catalog.json`
+ * listing apps a user could `app_install`, independent of whether any are
+ * installed yet, plus optional remote catalog `sources` (each an HTTP URL
+ * returning `{ entries: AppCatalogEntry[] }`). Read-only from the daemon's
+ * side; `app_catalog` (app-tools.ts) merges local entries, remote entries and
+ * `AppRegistry.listApps()` to report installed/hasUi status.
+ *
+ * Sources (see `resolveCatalogSources`): the default public catalog
+ * (`DEFAULT_CATALOG_SOURCE_URL`, config `catalog.defaultSource`) comes
+ * first, then config `catalog.sources` — which win over (replace) `sources`
+ * in the catalog file when set. Extra sources ADD to the default one. Remote
+ * catalogs follow the `app-catalog/v1` format; the last good copy of each is
+ * cached on disk so `app_catalog` keeps working offline.
+ */
+
+type AppPlacement = "local" | "box" | "any" | "split";
+type AppCatalogTier = "git" | "bundle" | "hosted";
+interface AppCatalogLicense {
+    kind: "free" | "paid" | "private";
+    url?: string;
+}
+interface AppCatalogRequires {
+    browser?: boolean;
+    fs?: boolean;
+    secrets?: string[];
+}
+/** Remote catalog entry (`app-catalog/v1`). `source` lets a store call
+ *  `app_install {url, ref, subdir, sha}` (git) or `app_install {url, sha256}`
+ *  (`.agentapp`). Every field but `appId` + `source` is optional, so
+ *  pre-v1 catalogs (`{ entries }` only) keep validating. */
+interface AppCatalogEntry {
+    appId: string;
+    name?: string;
+    description?: string;
+    category?: string;
+    source: AppSource;
+    placement?: AppPlacement;
+    icon?: string;
+    version?: string;
+    tier?: AppCatalogTier;
+    publisher?: string;
+    license?: AppCatalogLicense;
+    minAgentprotoVersion?: string;
+    requires?: AppCatalogRequires;
+    featured?: boolean;
+}
+/** Entry of the local `app-catalog.json` `apps` array: a directory on disk. */
+interface AppCatalogFileEntry {
+    readonly appId: string;
+    readonly name?: string;
+    readonly description?: string;
+    readonly dir: string;
+    readonly category?: string;
+}
+interface AppCatalogSource {
+    readonly url: string;
+}
+interface AppCatalogFile {
+    readonly apps: readonly AppCatalogFileEntry[];
+    readonly sources?: readonly AppCatalogSource[];
+}
+declare const AppCatalogEntrySchema: z.ZodType<AppCatalogEntry>;
+/** `schema` tag of a v1 catalog document. */
+declare const CATALOG_SCHEMA_V1 = "app-catalog/v1";
+/**
+ * Default public catalog, queried by `app_catalog` unless config
+ * `catalog.defaultSource` is `false` (a URL string replaces it). The file is
+ * a static `apps.json` served by the agentproto/site repo
+ * (`public/catalog/v1/apps.json`). Bundles it references are GitHub Release
+ * assets of the public `agentproto/apps` repo. A failing default source is
+ * never fatal: `app_catalog` falls back to the last good copy cached on
+ * disk, then to the embedded first-party list (`first-party-catalog.ts`).
+ */
+declare const DEFAULT_CATALOG_SOURCE_URL = "https://agentproto.sh/catalog/v1/apps.json";
+declare function defaultAppCatalogPath(): string;
+/**
+ * Read + parse the catalog file at `path` (default `~/.agentproto/app-catalog.json`).
+ * Tolerates a missing file (returns an empty catalog) and a malformed one
+ * (unreadable JSON, non-array `apps`, entries missing `appId`/`dir`, and
+ * `sources` without a string `url` are dropped) — never throws.
+ */
+declare function loadAppCatalogFile(path?: string): Promise<AppCatalogFile>;
+type CatalogSourceOrigin = "default" | "config" | "file";
+interface ResolvedCatalogSource extends AppCatalogSource {
+    readonly origin: CatalogSourceOrigin;
+}
+/**
+ * Remote sources `app_catalog` queries, in precedence order (first wins on
+ * an `appId` collision): the default source (unless `defaultSource: false`;
+ * a non-empty string replaces its URL), then config `catalog.sources` when
+ * set (even empty), else the catalog file's `sources`. Config/file sources
+ * ADD to the default one, they never replace it. Duplicate URLs are dropped.
+ */
+declare function resolveCatalogSources(fileSources: readonly AppCatalogSource[] | undefined, config: {
+    sources?: unknown;
+    defaultSource?: unknown;
+} | undefined): ResolvedCatalogSource[];
+/** One source's outcome, in the order sources were passed. */
+interface CatalogSourceResult {
+    url: string;
+    entries: AppCatalogEntry[];
+    /** True when `entries` come from the disk cache because the live fetch failed. */
+    stale: boolean;
+    /** When the entries were fetched (live or cached), ISO-8601. */
+    fetchedAt?: string;
+    /** False when the source yielded nothing at all (fetch failed, no cache). */
+    ok: boolean;
+}
+interface RemoteCatalogResult {
+    entries: AppCatalogEntry[];
+    warnings: string[];
+    bySource: CatalogSourceResult[];
+}
+interface RemoteCatalogClientOptions {
+    /** Default 5 minutes. */
+    ttlMs?: number;
+    /** Per-source request timeout. Default 5000. */
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    /** Directory for the last-good copy of each source (`<sha1(url)>.json`).
+     *  Absent = no disk cache (in-memory TTL cache only). */
+    cacheDir?: string;
+}
+interface RemoteCatalogClient {
+    /** Fetch + validate every source (in order, in parallel). A failing source
+     *  never throws: it yields a `warnings` line and either its last cached
+     *  copy (`stale`) or no entries. Live results are cached per URL in memory
+     *  for `ttlMs` and on disk (when `cacheDir` is set); `refresh` bypasses the
+     *  in-memory cache. */
+    fetchSources(sources: readonly AppCatalogSource[], opts?: {
+        refresh?: boolean;
+    }): Promise<RemoteCatalogResult>;
+}
+declare const DEFAULT_REMOTE_CATALOG_TTL_MS: number;
+declare const DEFAULT_REMOTE_CATALOG_TIMEOUT_MS = 5000;
+/** Disk-cache file for `url` under `cacheDir`. */
+declare function catalogCachePath(cacheDir: string, url: string): string;
+declare function createRemoteCatalogClient(options?: RemoteCatalogClientOptions): RemoteCatalogClient;
+/**
+ * Compare dotted numeric versions (`1.2.10` > `1.2.9`); a pre-release suffix
+ * (`1.2.0-beta`) ranks below the same core. Returns -1 | 0 | 1, or
+ * `undefined` when either side isn't `N.N.N`-shaped.
+ */
+declare function compareCatalogVersions(a: string, b: string): number | undefined;
+/**
+ * Is catalog `entry` an update for an installed app (recorded `source`,
+ * APP.md `version`)? Only for the same source kind, only when the pin
+ * differs (bundle sha256 / git commit), and never when the entry's version
+ * is LOWER than the installed one — a catalog listing an older release is
+ * not an update.
+ */
+declare function isCatalogUpdate(installed: {
+    readonly source?: AppSource;
+    readonly version?: string;
+}, entry: AppCatalogEntry): boolean;
+
+export { type AppCatalogEntry, AppCatalogEntrySchema, type AppCatalogFile, type AppCatalogFileEntry, type AppCatalogLicense, type AppCatalogRequires, type AppCatalogSource, type AppCatalogTier, type AppPlacement, AppSource, CATALOG_SCHEMA_V1, type CatalogSourceOrigin, type CatalogSourceResult, DEFAULT_CATALOG_SOURCE_URL, DEFAULT_REMOTE_CATALOG_TIMEOUT_MS, DEFAULT_REMOTE_CATALOG_TTL_MS, type RemoteCatalogClient, type RemoteCatalogClientOptions, type RemoteCatalogResult, type ResolvedCatalogSource, catalogCachePath, compareCatalogVersions, createRemoteCatalogClient, defaultAppCatalogPath, isCatalogUpdate, loadAppCatalogFile, resolveCatalogSources };

package/dist/app-catalog.mjs

@@ -0,0 +1,250 @@
+import { createHash } from 'crypto';
+import { readFile, mkdir, writeFile, rename } from 'fs/promises';
+import { homedir } from 'os';
+import { join } from 'path';
+import { z } from 'zod';
+
+/**
+ * @agentproto/runtime v0.1.0-alpha
+ * Long-running gateway: MCP server + HTTP transport + HEARTBEAT autonomy + conversation persistence over a workspace dir.
+ */
+
+var AppSourceSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("local") }),
+  z.object({
+    kind: z.literal("git"),
+    url: z.string().min(1),
+    ref: z.string().optional(),
+    sha: z.string().min(1),
+    subdir: z.string().optional()
+  }),
+  z.object({
+    kind: z.literal("agentapp"),
+    url: z.string().min(1),
+    sha256: z.string().min(1),
+    version: z.string().min(1),
+    size: z.number().int().nonnegative().optional()
+  })
+]);
+var AppCatalogEntrySchema = z.object({
+  appId: z.string().min(1),
+  name: z.string().optional(),
+  description: z.string().optional(),
+  category: z.string().optional(),
+  source: AppSourceSchema,
+  placement: z.enum(["local", "box", "any", "split"]).optional(),
+  icon: z.string().optional(),
+  version: z.string().optional(),
+  tier: z.enum(["git", "bundle", "hosted"]).optional(),
+  publisher: z.string().optional(),
+  license: z.object({ kind: z.enum(["free", "paid", "private"]), url: z.string().optional() }).optional(),
+  minAgentprotoVersion: z.string().optional(),
+  requires: z.object({
+    browser: z.boolean().optional(),
+    fs: z.boolean().optional(),
+    secrets: z.array(z.string()).optional()
+  }).optional(),
+  featured: z.boolean().optional()
+});
+var CATALOG_SCHEMA_V1 = "app-catalog/v1";
+var RemoteCatalogSchema = z.object({
+  schema: z.string().optional(),
+  generatedAt: z.string().optional(),
+  entries: z.array(z.unknown())
+});
+var DEFAULT_CATALOG_SOURCE_URL = "https://agentproto.sh/catalog/v1/apps.json";
+var EMPTY_CATALOG = { apps: [] };
+function defaultAppCatalogPath() {
+  return join(homedir(), ".agentproto", "app-catalog.json");
+}
+async function loadAppCatalogFile(path) {
+  const catalogPath = path ?? defaultAppCatalogPath();
+  let raw;
+  try {
+    raw = await readFile(catalogPath, "utf8");
+  } catch {
+    return EMPTY_CATALOG;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const sources = parseSources(parsed.sources);
+    const apps = Array.isArray(parsed.apps) ? parsed.apps.filter((e) => {
+      if (typeof e !== "object" || e === null) return false;
+      const rec = e;
+      return typeof rec.appId === "string" && typeof rec.dir === "string";
+    }) : [];
+    return sources.length > 0 ? { apps, sources } : { apps };
+  } catch {
+    return EMPTY_CATALOG;
+  }
+}
+function parseSources(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const s of raw) {
+    if (typeof s !== "object" || s === null) continue;
+    const url = s.url;
+    if (typeof url === "string" && url.length > 0) out.push({ url });
+  }
+  return out;
+}
+function resolveCatalogSources(fileSources, config) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (url, origin) => {
+    if (seen.has(url)) return;
+    seen.add(url);
+    out.push({ url, origin });
+  };
+  const def = config?.defaultSource;
+  if (def !== false) {
+    push(typeof def === "string" && def.length > 0 ? def : DEFAULT_CATALOG_SOURCE_URL, "default");
+  }
+  if (Array.isArray(config?.sources)) {
+    for (const s of parseSources(config.sources)) push(s.url, "config");
+  } else {
+    for (const s of fileSources ?? []) push(s.url, "file");
+  }
+  return out;
+}
+var DEFAULT_REMOTE_CATALOG_TTL_MS = 5 * 6e4;
+var DEFAULT_REMOTE_CATALOG_TIMEOUT_MS = 5e3;
+function catalogCachePath(cacheDir, url) {
+  return join(cacheDir, `${createHash("sha1").update(url).digest("hex")}.json`);
+}
+function createRemoteCatalogClient(options = {}) {
+  const ttlMs = options.ttlMs ?? DEFAULT_REMOTE_CATALOG_TTL_MS;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_REMOTE_CATALOG_TIMEOUT_MS;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const now = options.now ?? Date.now;
+  const cacheDir = options.cacheDir;
+  const cache = /* @__PURE__ */ new Map();
+  async function readDiskCache(url) {
+    if (cacheDir === void 0) return void 0;
+    try {
+      const raw = JSON.parse(await readFile(catalogCachePath(cacheDir, url), "utf8"));
+      if (raw.url !== url || !Array.isArray(raw.entries) || typeof raw.fetchedAt !== "string") return void 0;
+      const entries = [];
+      for (const e of raw.entries) {
+        const parsed = AppCatalogEntrySchema.safeParse(e);
+        if (parsed.success) entries.push(parsed.data);
+      }
+      return { entries, fetchedAt: raw.fetchedAt };
+    } catch {
+      return void 0;
+    }
+  }
+  async function writeDiskCache(url, entries, fetchedAt) {
+    if (cacheDir === void 0) return;
+    try {
+      await mkdir(cacheDir, { recursive: true });
+      const file = catalogCachePath(cacheDir, url);
+      const tmp = `${file}.tmp-${process.pid}`;
+      const body = { url, fetchedAt, entries };
+      await writeFile(tmp, JSON.stringify(body, null, 2) + "\n", "utf8");
+      await rename(tmp, file);
+    } catch {
+    }
+  }
+  async function failed(url, warning) {
+    const cached = await readDiskCache(url);
+    if (cached === void 0) return { url, entries: [], warnings: [warning], stale: false, ok: false };
+    return {
+      url,
+      entries: cached.entries,
+      warnings: [`${warning}; using the copy cached at ${cached.fetchedAt}`],
+      stale: true,
+      fetchedAt: cached.fetchedAt,
+      ok: true
+    };
+  }
+  async function fetchOne(url) {
+    let body;
+    try {
+      const res = await fetchImpl(url, {
+        headers: { Accept: "application/json" },
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      body = await res.json();
+    } catch (err) {
+      const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+      const reason = timedOut ? `timed out after ${timeoutMs}ms` : err instanceof Error ? err.message : String(err);
+      return failed(url, `catalog source ${url}: ${reason}`);
+    }
+    const shape = RemoteCatalogSchema.safeParse(body);
+    if (!shape.success) {
+      return failed(url, `catalog source ${url}: expected { entries: [...] }`);
+    }
+    const entries = [];
+    const warnings = [];
+    if (shape.data.schema !== void 0 && shape.data.schema !== CATALOG_SCHEMA_V1) {
+      warnings.push(
+        `catalog source ${url}: unknown schema "${shape.data.schema}" \u2014 reading its entries as ${CATALOG_SCHEMA_V1}`
+      );
+    }
+    shape.data.entries.forEach((raw, i) => {
+      const parsed = AppCatalogEntrySchema.safeParse(raw);
+      if (parsed.success) entries.push(parsed.data);
+      else warnings.push(`catalog source ${url}: entries[${i}] invalid (${parsed.error.issues[0]?.message ?? "schema mismatch"})`);
+    });
+    const fetchedAt = new Date(now()).toISOString();
+    await writeDiskCache(url, entries, fetchedAt);
+    return { url, entries, warnings, stale: false, fetchedAt, ok: true };
+  }
+  return {
+    async fetchSources(sources, opts = {}) {
+      const results = await Promise.all(
+        sources.map(async ({ url }) => {
+          const hit = cache.get(url);
+          if (!opts.refresh && hit && now() - hit.at < ttlMs) return hit.result;
+          const result = await fetchOne(url);
+          if (!result.stale && (result.entries.length > 0 || result.warnings.length === 0)) {
+            cache.set(url, { at: now(), result });
+          } else {
+            cache.delete(url);
+          }
+          return result;
+        })
+      );
+      return {
+        entries: results.flatMap((r) => r.entries),
+        warnings: results.flatMap((r) => r.warnings),
+        bySource: results.map(({ warnings: _warnings, ...rest }) => rest)
+      };
+    }
+  };
+}
+function compareCatalogVersions(a, b) {
+  const parse = (v) => {
+    const m = /^v?(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(v.trim());
+    return m ? { core: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] !== void 0 } : void 0;
+  };
+  const pa = parse(a);
+  const pb = parse(b);
+  if (pa === void 0 || pb === void 0) return void 0;
+  for (let i = 0; i < 3; i++) {
+    const d = pa.core[i] - pb.core[i];
+    if (d !== 0) return d < 0 ? -1 : 1;
+  }
+  if (pa.pre === pb.pre) return 0;
+  return pa.pre ? -1 : 1;
+}
+function isCatalogUpdate(installed, entry) {
+  const s = installed.source;
+  if (s === void 0 || s.kind === "local" || s.kind !== entry.source.kind) return false;
+  const offered = entry.source;
+  const differs = s.kind === "agentapp" ? offered.kind === "agentapp" && offered.sha256.toLowerCase() !== s.sha256.toLowerCase() : offered.kind === "git" && offered.sha.toLowerCase() !== s.sha.toLowerCase();
+  if (!differs) return false;
+  const installedVersion = s.kind === "agentapp" ? s.version : installed.version;
+  const offeredVersion = offered.kind === "agentapp" ? offered.version : entry.version;
+  if (installedVersion !== void 0 && offeredVersion !== void 0) {
+    const cmp = compareCatalogVersions(offeredVersion, installedVersion);
+    if (cmp !== void 0 && cmp < 0) return false;
+  }
+  return true;
+}
+
+export { AppCatalogEntrySchema, CATALOG_SCHEMA_V1, DEFAULT_CATALOG_SOURCE_URL, DEFAULT_REMOTE_CATALOG_TIMEOUT_MS, DEFAULT_REMOTE_CATALOG_TTL_MS, catalogCachePath, compareCatalogVersions, createRemoteCatalogClient, defaultAppCatalogPath, isCatalogUpdate, loadAppCatalogFile, resolveCatalogSources };
+//# sourceMappingURL=app-catalog.mjs.map
+//# sourceMappingURL=app-catalog.mjs.map

package/dist/app-catalog.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/app-catalog.ts"],"names":[],"mappings":";;;;;;;;;;;AA+EA,IAAM,eAAA,GAAwC,CAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EACzE,CAAA,CAAE,OAAO,EAAE,IAAA,EAAM,EAAE,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,EACrC,EAAE,MAAA,CAAO;AAAA,IACP,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,KAAK,CAAA;AAAA,IACrB,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,IACrB,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACzB,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,IACrB,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,GAC7B,CAAA;AAAA,EACD,EAAE,MAAA,CAAO;AAAA,IACP,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,UAAU,CAAA;AAAA,IAC1B,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,IACrB,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,IACxB,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,IACzB,IAAA,EAAM,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,QAAA;AAAS,GAC/C;AACH,CAAC,CAAA;AAEM,IAAM,qBAAA,GAAoD,EAAE,MAAA,CAAO;AAAA,EACxE,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACvB,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,MAAA,EAAQ,eAAA;AAAA,EACR,SAAA,EAAW,CAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAS,OAAO,KAAA,EAAO,OAAO,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC7D,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,IAAA,EAAM,EAAE,IAAA,CAAK,CAAC,OAAO,QAAA,EAAU,QAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EACnD,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAS,EACN,MAAA,CAAO,EAAE,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,SAAS,CAAC,CAAA,EAAG,KAAK,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,EAAG,CAAA,CAChF,QAAA,EAAS;AAAA,EACZ,oBAAA,EAAsB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1C,QAAA,EAAU,EACP,MAAA,CAAO;AAAA,IACN,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,IAC9B,EAAA,EAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,IACzB,SAAS,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,EAAE,QAAA;AAAS,GACvC,EACA,QAAA,EAAS;AAAA,EACZ,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AACxB,CAAC;AAGM,IAAM,iBAAA,GAAoB;AAEjC,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA,EACnC,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,OAAA,EAAS,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,SAAS;AAC9B,CAAC,CAAA;AAWM,IAAM,0BAAA,GAA6B;AAE1C,IAAM,aAAA,GAAgC,EAAE,IAAA,EAAM,EAAC,EAAE;AAE1C,SAAS,qBAAA,GAAgC;AAC9C,EAAA,OAAO,IAAA,CAAK,OAAA,EAAQ,EAAG,aAAA,EAAe,kBAAkB,CAAA;AAC1D;AAQA,eAAsB,mBAAmB,IAAA,EAAwC;AAC/E,EAAA,MAAM,WAAA,GAAc,QAAQ,qBAAA,EAAsB;AAClD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,QAAA,CAAS,WAAA,EAAa,MAAM,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,aAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,MAAM,OAAA,GAAU,YAAA,CAAa,MAAA,CAAO,OAAO,CAAA;AAC3C,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,IAAI,IAClC,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,KAAgC;AAClD,MAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,KAAM,MAAM,OAAO,KAAA;AAChD,MAAA,MAAM,GAAA,GAAM,CAAA;AACZ,MAAA,OAAO,OAAO,GAAA,CAAI,KAAA,KAAU,QAAA,IAAY,OAAO,IAAI,GAAA,KAAQ,QAAA;AAAA,IAC7D,CAAC,IACD,EAAC;AACL,IAAA,OAAO,OAAA,CAAQ,SAAS,CAAA,GAAI,EAAE,MAAM,OAAA,EAAQ,GAAI,EAAE,IAAA,EAAK;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,aAAA;AAAA,EACT;AACF;AAEA,SAAS,aAAa,GAAA,EAAkC;AACtD,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,SAAU,EAAC;AACjC,EAAA,MAAM,MAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,KAAM,IAAA,EAAM;AACzC,IAAA,MAAM,MAAO,CAAA,CAA8B,GAAA;AAC3C,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,GAAS,GAAG,GAAA,CAAI,IAAA,CAAK,EAAE,GAAA,EAAK,CAAA;AAAA,EACjE;AACA,EAAA,OAAO,GAAA;AACT;AAeO,SAAS,qBAAA,CACd,aACA,MAAA,EACyB;AACzB,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,IAAA,GAAO,CAAC,GAAA,EAAa,MAAA,KAAsC;AAC/D,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,GAAA,CAAI,IAAA,CAAK,EAAE,GAAA,EAAK,MAAA,EAAQ,CAAA;AAAA,EAC1B,CAAA;AACA,EAAA,MAAM,MAAM,MAAA,EAAQ,aAAA;AACpB,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,IAAA,CAAK,OAAO,QAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,GAAI,GAAA,GAAM,4BAA4B,SAAS,CAAA;AAAA,EAC9F;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA,EAAG;AAClC,IAAA,KAAA,MAAW,CAAA,IAAK,aAAa,MAAA,CAAO,OAAO,GAAG,IAAA,CAAK,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EACpE,CAAA,MAAO;AACL,IAAA,KAAA,MAAW,KAAK,WAAA,IAAe,IAAI,IAAA,CAAK,CAAA,CAAE,KAAK,MAAM,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,GAAA;AACT;AA4CO,IAAM,gCAAgC,CAAA,GAAI;AAC1C,IAAM,iCAAA,GAAoC;AAG1C,SAAS,gBAAA,CAAiB,UAAkB,GAAA,EAAqB;AACtE,EAAA,OAAO,IAAA,CAAK,QAAA,EAAU,CAAA,EAAG,UAAA,CAAW,MAAM,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAC,CAAA,KAAA,CAAO,CAAA;AAC9E;AAUO,SAAS,yBAAA,CACd,OAAA,GAAsC,EAAC,EAClB;AACrB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,6BAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,iCAAA;AACvC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,KAAA;AACvC,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,IAAA,CAAK,GAAA;AAChC,EAAA,MAAM,WAAW,OAAA,CAAQ,QAAA;AACzB,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAiD;AAEnE,EAAA,eAAe,cAAc,GAAA,EAAqF;AAChH,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,MAAM,QAAA,CAAS,iBAAiB,QAAA,EAAU,GAAG,CAAA,EAAG,MAAM,CAAC,CAAA;AAC9E,MAAA,IAAI,GAAA,CAAI,GAAA,KAAQ,GAAA,IAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,IAAK,OAAO,GAAA,CAAI,SAAA,KAAc,UAAU,OAAO,KAAA,CAAA;AAChG,MAAA,MAAM,UAA6B,EAAC;AACpC,MAAA,KAAA,MAAW,CAAA,IAAK,IAAI,OAAA,EAAS;AAC3B,QAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,SAAA,CAAU,CAAC,CAAA;AAChD,QAAA,IAAI,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,IAAA,CAAK,OAAO,IAAI,CAAA;AAAA,MAC9C;AACA,MAAA,OAAO,EAAE,OAAA,EAAS,SAAA,EAAW,GAAA,CAAI,SAAA,EAAU;AAAA,IAC7C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,eAAe,cAAA,CAAe,GAAA,EAAa,OAAA,EAA4B,SAAA,EAAkC;AACvG,IAAA,IAAI,aAAa,MAAA,EAAW;AAC5B,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,CAAM,QAAA,EAAU,EAAE,SAAA,EAAW,MAAM,CAAA;AACzC,MAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,QAAA,EAAU,GAAG,CAAA;AAC3C,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,KAAA,EAAQ,QAAQ,GAAG,CAAA,CAAA;AACtC,MAAA,MAAM,IAAA,GAAyB,EAAE,GAAA,EAAK,SAAA,EAAW,OAAA,EAAQ;AACzD,MAAA,MAAM,SAAA,CAAU,KAAK,IAAA,CAAK,SAAA,CAAU,MAAM,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM,MAAM,CAAA;AACjE,MAAA,MAAM,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,IACxB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,eAAe,MAAA,CAAO,KAAa,OAAA,EAAuC;AACxE,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,GAAG,CAAA;AACtC,IAAA,IAAI,MAAA,KAAW,MAAA,EAAW,OAAO,EAAE,KAAK,OAAA,EAAS,EAAC,EAAG,QAAA,EAAU,CAAC,OAAO,CAAA,EAAG,KAAA,EAAO,KAAA,EAAO,IAAI,KAAA,EAAM;AAClG,IAAA,OAAO;AAAA,MACL,GAAA;AAAA,MACA,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,UAAU,CAAC,CAAA,EAAG,OAAO,CAAA,2BAAA,EAA8B,MAAA,CAAO,SAAS,CAAA,CAAE,CAAA;AAAA,MACrE,KAAA,EAAO,IAAA;AAAA,MACP,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,EAAA,EAAI;AAAA,KACN;AAAA,EACF;AAEA,EAAA,eAAe,SAAS,GAAA,EAAmC;AACzD,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,QAC/B,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,QACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS;AAAA,OACtC,CAAA;AACD,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AACjD,MAAA,IAAA,GAAO,MAAM,IAAI,IAAA,EAAK;AAAA,IACxB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,WAAW,GAAA,YAAe,KAAA,KAAU,IAAI,IAAA,KAAS,cAAA,IAAkB,IAAI,IAAA,KAAS,YAAA,CAAA;AACtF,MAAA,MAAM,MAAA,GAAS,QAAA,GACX,CAAA,gBAAA,EAAmB,SAAS,CAAA,EAAA,CAAA,GAC5B,eAAe,KAAA,GACb,GAAA,CAAI,OAAA,GACJ,MAAA,CAAO,GAAG,CAAA;AAChB,MAAA,OAAO,OAAO,GAAA,EAAK,CAAA,eAAA,EAAkB,GAAG,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,CAAA;AAAA,IACvD;AACA,IAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,SAAA,CAAU,IAAI,CAAA;AAChD,IAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,MAAA,OAAO,MAAA,CAAO,GAAA,EAAK,CAAA,eAAA,EAAkB,GAAG,CAAA,6BAAA,CAA+B,CAAA;AAAA,IACzE;AACA,IAAA,MAAM,UAA6B,EAAC;AACpC,IAAA,MAAM,WAAqB,EAAC;AAC5B,IAAA,IAAI,MAAM,IAAA,CAAK,MAAA,KAAW,UAAa,KAAA,CAAM,IAAA,CAAK,WAAW,iBAAA,EAAmB;AAC9E,MAAA,QAAA,CAAS,IAAA;AAAA,QACP,kBAAkB,GAAG,CAAA,kBAAA,EAAqB,MAAM,IAAA,CAAK,MAAM,mCAA8B,iBAAiB,CAAA;AAAA,OAC5G;AAAA,IACF;AACA,IAAA,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAK,CAAA,KAAM;AACrC,MAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,SAAA,CAAU,GAAG,CAAA;AAClD,MAAA,IAAI,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,IAAA,CAAK,OAAO,IAAI,CAAA;AAAA,WACvC,QAAA,CAAS,IAAA,CAAK,CAAA,eAAA,EAAkB,GAAG,aAAa,CAAC,CAAA,WAAA,EAAc,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,OAAA,IAAW,iBAAiB,CAAA,CAAA,CAAG,CAAA;AAAA,IAC7H,CAAC,CAAA;AACD,IAAA,MAAM,YAAY,IAAI,IAAA,CAAK,GAAA,EAAK,EAAE,WAAA,EAAY;AAC9C,IAAA,MAAM,cAAA,CAAe,GAAA,EAAK,OAAA,EAAS,SAAS,CAAA;AAC5C,IAAA,OAAO,EAAE,KAAK,OAAA,EAAS,QAAA,EAAU,OAAO,KAAA,EAAO,SAAA,EAAW,IAAI,IAAA,EAAK;AAAA,EACrE;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,YAAA,CAAa,OAAA,EAAS,IAAA,GAAO,EAAC,EAAG;AACrC,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,GAAA;AAAA,QAC5B,OAAA,CAAQ,GAAA,CAAI,OAAO,EAAE,KAAI,KAAM;AAC7B,UAAA,MAAM,GAAA,GAAM,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACzB,UAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,GAAA,IAAO,GAAA,KAAQ,GAAA,CAAI,EAAA,GAAK,KAAA,EAAO,OAAO,GAAA,CAAI,MAAA;AAC/D,UAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,GAAG,CAAA;AAGjC,UAAA,IAAI,CAAC,MAAA,CAAO,KAAA,KAAU,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA,IAAK,MAAA,CAAO,QAAA,CAAS,MAAA,KAAW,CAAA,CAAA,EAAI;AAChF,YAAA,KAAA,CAAM,IAAI,GAAA,EAAK,EAAE,IAAI,GAAA,EAAI,EAAG,QAAQ,CAAA;AAAA,UACtC,CAAA,MAAO;AACL,YAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAAA,UAClB;AACA,UAAA,OAAO,MAAA;AAAA,QACT,CAAC;AAAA,OACH;AACA,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,OAAA,CAAQ,OAAA,CAAQ,CAAA,CAAA,KAAK,EAAE,OAAO,CAAA;AAAA,QACvC,QAAA,EAAU,OAAA,CAAQ,OAAA,CAAQ,CAAA,CAAA,KAAK,EAAE,QAAQ,CAAA;AAAA,QACzC,QAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,CAAC,EAAE,UAAU,SAAA,EAAW,GAAG,IAAA,EAAK,KAAM,IAAI;AAAA,OAClE;AAAA,IACF;AAAA,GACF;AACF;AAOO,SAAS,sBAAA,CAAuB,GAAW,CAAA,EAA+B;AAC/E,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAA4D;AACzE,IAAA,MAAM,CAAA,GAAI,+BAAA,CAAgC,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA;AACvD,IAAA,OAAO,CAAA,GAAI,EAAE,IAAA,EAAM,CAAC,MAAA,CAAO,EAAE,CAAC,CAAC,CAAA,EAAG,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA,EAAG,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA,EAAG,GAAA,EAAK,CAAA,CAAE,CAAC,CAAA,KAAM,MAAA,EAAU,GAAI,MAAA;AAAA,EAC7F,CAAA;AACA,EAAA,MAAM,EAAA,GAAK,MAAM,CAAC,CAAA;AAClB,EAAA,MAAM,EAAA,GAAK,MAAM,CAAC,CAAA;AAClB,EAAA,IAAI,EAAA,KAAO,MAAA,IAAa,EAAA,KAAO,MAAA,EAAW,OAAO,MAAA;AACjD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,MAAM,IAAI,EAAA,CAAG,IAAA,CAAK,CAAC,CAAA,GAAK,EAAA,CAAG,KAAK,CAAC,CAAA;AACjC,IAAA,IAAI,CAAA,KAAM,CAAA,EAAG,OAAO,CAAA,GAAI,IAAI,EAAA,GAAK,CAAA;AAAA,EACnC;AACA,EAAA,IAAI,EAAA,CAAG,GAAA,KAAQ,EAAA,CAAG,GAAA,EAAK,OAAO,CAAA;AAC9B,EAAA,OAAO,EAAA,CAAG,MAAM,EAAA,GAAK,CAAA;AACvB;AASO,SAAS,eAAA,CACd,WACA,KAAA,EACS;AACT,EAAA,MAAM,IAAI,SAAA,CAAU,MAAA;AACpB,EAAA,IAAI,CAAA,KAAM,MAAA,IAAa,CAAA,CAAE,IAAA,KAAS,OAAA,IAAW,EAAE,IAAA,KAAS,KAAA,CAAM,MAAA,CAAO,IAAA,EAAM,OAAO,KAAA;AAClF,EAAA,MAAM,UAAU,KAAA,CAAM,MAAA;AACtB,EAAA,MAAM,OAAA,GACJ,CAAA,CAAE,IAAA,KAAS,UAAA,GACP,OAAA,CAAQ,SAAS,UAAA,IAAc,OAAA,CAAQ,MAAA,CAAO,WAAA,EAAY,KAAM,CAAA,CAAE,OAAO,WAAA,EAAY,GACrF,OAAA,CAAQ,IAAA,KAAS,KAAA,IAAS,OAAA,CAAQ,IAAI,WAAA,EAAY,KAAM,CAAA,CAAE,GAAA,CAAI,WAAA,EAAY;AAChF,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA;AACrB,EAAA,MAAM,mBAAmB,CAAA,CAAE,IAAA,KAAS,UAAA,GAAa,CAAA,CAAE,UAAU,SAAA,CAAU,OAAA;AACvE,EAAA,MAAM,iBAAiB,OAAA,CAAQ,IAAA,KAAS,UAAA,GAAa,OAAA,CAAQ,UAAU,KAAA,CAAM,OAAA;AAC7E,EAAA,IAAI,gBAAA,KAAqB,MAAA,IAAa,cAAA,KAAmB,MAAA,EAAW;AAClE,IAAA,MAAM,GAAA,GAAM,sBAAA,CAAuB,cAAA,EAAgB,gBAAgB,CAAA;AACnE,IAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,GAAM,CAAA,EAAG,OAAO,KAAA;AAAA,EAC3C;AACA,EAAA,OAAO,IAAA;AACT","file":"app-catalog.mjs","sourcesContent":["/**\n * App catalog — a static, hand-curated `~/.agentproto/app-catalog.json`\n * listing apps a user could `app_install`, independent of whether any are\n * installed yet, plus optional remote catalog `sources` (each an HTTP URL\n * returning `{ entries: AppCatalogEntry[] }`). Read-only from the daemon's\n * side; `app_catalog` (app-tools.ts) merges local entries, remote entries and\n * `AppRegistry.listApps()` to report installed/hasUi status.\n *\n * Sources (see `resolveCatalogSources`): the default public catalog\n * (`DEFAULT_CATALOG_SOURCE_URL`, config `catalog.defaultSource`) comes\n * first, then config `catalog.sources` — which win over (replace) `sources`\n * in the catalog file when set. Extra sources ADD to the default one. Remote\n * catalogs follow the `app-catalog/v1` format; the last good copy of each is\n * cached on disk so `app_catalog` keeps working offline.\n */\n\nimport { createHash } from \"node:crypto\"\nimport { mkdir, readFile, rename, writeFile } from \"node:fs/promises\"\nimport { homedir } from \"node:os\"\nimport { join } from \"node:path\"\nimport { z } from \"zod\"\nimport type { AppSource } from \"./app-registry.js\"\n\nexport type { AppSource }\n\nexport type AppPlacement = \"local\" | \"box\" | \"any\" | \"split\"\n\nexport type AppCatalogTier = \"git\" | \"bundle\" | \"hosted\"\n\nexport interface AppCatalogLicense {\n  kind: \"free\" | \"paid\" | \"private\"\n  url?: string\n}\n\nexport interface AppCatalogRequires {\n  browser?: boolean\n  fs?: boolean\n  secrets?: string[]\n}\n\n/** Remote catalog entry (`app-catalog/v1`). `source` lets a store call\n *  `app_install {url, ref, subdir, sha}` (git) or `app_install {url, sha256}`\n *  (`.agentapp`). Every field but `appId` + `source` is optional, so\n *  pre-v1 catalogs (`{ entries }` only) keep validating. */\nexport interface AppCatalogEntry {\n  appId: string\n  name?: string\n  description?: string\n  category?: string\n  source: AppSource\n  placement?: AppPlacement\n  icon?: string\n  version?: string\n  tier?: AppCatalogTier\n  publisher?: string\n  license?: AppCatalogLicense\n  minAgentprotoVersion?: string\n  requires?: AppCatalogRequires\n  featured?: boolean\n}\n\n/** Entry of the local `app-catalog.json` `apps` array: a directory on disk. */\nexport interface AppCatalogFileEntry {\n  readonly appId: string\n  readonly name?: string\n  readonly description?: string\n  readonly dir: string\n  readonly category?: string\n}\n\nexport interface AppCatalogSource {\n  readonly url: string\n}\n\nexport interface AppCatalogFile {\n  readonly apps: readonly AppCatalogFileEntry[]\n  readonly sources?: readonly AppCatalogSource[]\n}\n\nconst AppSourceSchema: z.ZodType<AppSource> = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"local\") }),\n  z.object({\n    kind: z.literal(\"git\"),\n    url: z.string().min(1),\n    ref: z.string().optional(),\n    sha: z.string().min(1),\n    subdir: z.string().optional(),\n  }),\n  z.object({\n    kind: z.literal(\"agentapp\"),\n    url: z.string().min(1),\n    sha256: z.string().min(1),\n    version: z.string().min(1),\n    size: z.number().int().nonnegative().optional(),\n  }),\n])\n\nexport const AppCatalogEntrySchema: z.ZodType<AppCatalogEntry> = z.object({\n  appId: z.string().min(1),\n  name: z.string().optional(),\n  description: z.string().optional(),\n  category: z.string().optional(),\n  source: AppSourceSchema,\n  placement: z.enum([\"local\", \"box\", \"any\", \"split\"]).optional(),\n  icon: z.string().optional(),\n  version: z.string().optional(),\n  tier: z.enum([\"git\", \"bundle\", \"hosted\"]).optional(),\n  publisher: z.string().optional(),\n  license: z\n    .object({ kind: z.enum([\"free\", \"paid\", \"private\"]), url: z.string().optional() })\n    .optional(),\n  minAgentprotoVersion: z.string().optional(),\n  requires: z\n    .object({\n      browser: z.boolean().optional(),\n      fs: z.boolean().optional(),\n      secrets: z.array(z.string()).optional(),\n    })\n    .optional(),\n  featured: z.boolean().optional(),\n})\n\n/** `schema` tag of a v1 catalog document. */\nexport const CATALOG_SCHEMA_V1 = \"app-catalog/v1\"\n\nconst RemoteCatalogSchema = z.object({\n  schema: z.string().optional(),\n  generatedAt: z.string().optional(),\n  entries: z.array(z.unknown()),\n})\n\n/**\n * Default public catalog, queried by `app_catalog` unless config\n * `catalog.defaultSource` is `false` (a URL string replaces it). The file is\n * a static `apps.json` served by the agentproto/site repo\n * (`public/catalog/v1/apps.json`). Bundles it references are GitHub Release\n * assets of the public `agentproto/apps` repo. A failing default source is\n * never fatal: `app_catalog` falls back to the last good copy cached on\n * disk, then to the embedded first-party list (`first-party-catalog.ts`).\n */\nexport const DEFAULT_CATALOG_SOURCE_URL = \"https://agentproto.sh/catalog/v1/apps.json\"\n\nconst EMPTY_CATALOG: AppCatalogFile = { apps: [] }\n\nexport function defaultAppCatalogPath(): string {\n  return join(homedir(), \".agentproto\", \"app-catalog.json\")\n}\n\n/**\n * Read + parse the catalog file at `path` (default `~/.agentproto/app-catalog.json`).\n * Tolerates a missing file (returns an empty catalog) and a malformed one\n * (unreadable JSON, non-array `apps`, entries missing `appId`/`dir`, and\n * `sources` without a string `url` are dropped) — never throws.\n */\nexport async function loadAppCatalogFile(path?: string): Promise<AppCatalogFile> {\n  const catalogPath = path ?? defaultAppCatalogPath()\n  let raw: string\n  try {\n    raw = await readFile(catalogPath, \"utf8\")\n  } catch {\n    return EMPTY_CATALOG\n  }\n  try {\n    const parsed = JSON.parse(raw) as { apps?: unknown; sources?: unknown }\n    const sources = parseSources(parsed.sources)\n    const apps = Array.isArray(parsed.apps)\n      ? parsed.apps.filter((e): e is AppCatalogFileEntry => {\n          if (typeof e !== \"object\" || e === null) return false\n          const rec = e as Record<string, unknown>\n          return typeof rec.appId === \"string\" && typeof rec.dir === \"string\"\n        })\n      : []\n    return sources.length > 0 ? { apps, sources } : { apps }\n  } catch {\n    return EMPTY_CATALOG\n  }\n}\n\nfunction parseSources(raw: unknown): AppCatalogSource[] {\n  if (!Array.isArray(raw)) return []\n  const out: AppCatalogSource[] = []\n  for (const s of raw) {\n    if (typeof s !== \"object\" || s === null) continue\n    const url = (s as Record<string, unknown>).url\n    if (typeof url === \"string\" && url.length > 0) out.push({ url })\n  }\n  return out\n}\n\nexport type CatalogSourceOrigin = \"default\" | \"config\" | \"file\"\n\nexport interface ResolvedCatalogSource extends AppCatalogSource {\n  readonly origin: CatalogSourceOrigin\n}\n\n/**\n * Remote sources `app_catalog` queries, in precedence order (first wins on\n * an `appId` collision): the default source (unless `defaultSource: false`;\n * a non-empty string replaces its URL), then config `catalog.sources` when\n * set (even empty), else the catalog file's `sources`. Config/file sources\n * ADD to the default one, they never replace it. Duplicate URLs are dropped.\n */\nexport function resolveCatalogSources(\n  fileSources: readonly AppCatalogSource[] | undefined,\n  config: { sources?: unknown; defaultSource?: unknown } | undefined,\n): ResolvedCatalogSource[] {\n  const out: ResolvedCatalogSource[] = []\n  const seen = new Set<string>()\n  const push = (url: string, origin: CatalogSourceOrigin): void => {\n    if (seen.has(url)) return\n    seen.add(url)\n    out.push({ url, origin })\n  }\n  const def = config?.defaultSource\n  if (def !== false) {\n    push(typeof def === \"string\" && def.length > 0 ? def : DEFAULT_CATALOG_SOURCE_URL, \"default\")\n  }\n  if (Array.isArray(config?.sources)) {\n    for (const s of parseSources(config.sources)) push(s.url, \"config\")\n  } else {\n    for (const s of fileSources ?? []) push(s.url, \"file\")\n  }\n  return out\n}\n\n/** One source's outcome, in the order sources were passed. */\nexport interface CatalogSourceResult {\n  url: string\n  entries: AppCatalogEntry[]\n  /** True when `entries` come from the disk cache because the live fetch failed. */\n  stale: boolean\n  /** When the entries were fetched (live or cached), ISO-8601. */\n  fetchedAt?: string\n  /** False when the source yielded nothing at all (fetch failed, no cache). */\n  ok: boolean\n}\n\nexport interface RemoteCatalogResult {\n  entries: AppCatalogEntry[]\n  warnings: string[]\n  bySource: CatalogSourceResult[]\n}\n\nexport interface RemoteCatalogClientOptions {\n  /** Default 5 minutes. */\n  ttlMs?: number\n  /** Per-source request timeout. Default 5000. */\n  timeoutMs?: number\n  fetchImpl?: typeof fetch\n  now?: () => number\n  /** Directory for the last-good copy of each source (`<sha1(url)>.json`).\n   *  Absent = no disk cache (in-memory TTL cache only). */\n  cacheDir?: string\n}\n\nexport interface RemoteCatalogClient {\n  /** Fetch + validate every source (in order, in parallel). A failing source\n   *  never throws: it yields a `warnings` line and either its last cached\n   *  copy (`stale`) or no entries. Live results are cached per URL in memory\n   *  for `ttlMs` and on disk (when `cacheDir` is set); `refresh` bypasses the\n   *  in-memory cache. */\n  fetchSources(\n    sources: readonly AppCatalogSource[],\n    opts?: { refresh?: boolean },\n  ): Promise<RemoteCatalogResult>\n}\n\nexport const DEFAULT_REMOTE_CATALOG_TTL_MS = 5 * 60_000\nexport const DEFAULT_REMOTE_CATALOG_TIMEOUT_MS = 5_000\n\n/** Disk-cache file for `url` under `cacheDir`. */\nexport function catalogCachePath(cacheDir: string, url: string): string {\n  return join(cacheDir, `${createHash(\"sha1\").update(url).digest(\"hex\")}.json`)\n}\n\ninterface CatalogDiskCache {\n  url: string\n  fetchedAt: string\n  entries: unknown[]\n}\n\ntype SourceFetch = CatalogSourceResult & { warnings: string[] }\n\nexport function createRemoteCatalogClient(\n  options: RemoteCatalogClientOptions = {},\n): RemoteCatalogClient {\n  const ttlMs = options.ttlMs ?? DEFAULT_REMOTE_CATALOG_TTL_MS\n  const timeoutMs = options.timeoutMs ?? DEFAULT_REMOTE_CATALOG_TIMEOUT_MS\n  const fetchImpl = options.fetchImpl ?? fetch\n  const now = options.now ?? Date.now\n  const cacheDir = options.cacheDir\n  const cache = new Map<string, { at: number; result: SourceFetch }>()\n\n  async function readDiskCache(url: string): Promise<{ entries: AppCatalogEntry[]; fetchedAt: string } | undefined> {\n    if (cacheDir === undefined) return undefined\n    try {\n      const raw = JSON.parse(await readFile(catalogCachePath(cacheDir, url), \"utf8\")) as Partial<CatalogDiskCache>\n      if (raw.url !== url || !Array.isArray(raw.entries) || typeof raw.fetchedAt !== \"string\") return undefined\n      const entries: AppCatalogEntry[] = []\n      for (const e of raw.entries) {\n        const parsed = AppCatalogEntrySchema.safeParse(e)\n        if (parsed.success) entries.push(parsed.data)\n      }\n      return { entries, fetchedAt: raw.fetchedAt }\n    } catch {\n      return undefined\n    }\n  }\n\n  async function writeDiskCache(url: string, entries: AppCatalogEntry[], fetchedAt: string): Promise<void> {\n    if (cacheDir === undefined) return\n    try {\n      await mkdir(cacheDir, { recursive: true })\n      const file = catalogCachePath(cacheDir, url)\n      const tmp = `${file}.tmp-${process.pid}`\n      const body: CatalogDiskCache = { url, fetchedAt, entries }\n      await writeFile(tmp, JSON.stringify(body, null, 2) + \"\\n\", \"utf8\")\n      await rename(tmp, file)\n    } catch {\n      // Best-effort — a cache write failure must not fail the listing.\n    }\n  }\n\n  async function failed(url: string, warning: string): Promise<SourceFetch> {\n    const cached = await readDiskCache(url)\n    if (cached === undefined) return { url, entries: [], warnings: [warning], stale: false, ok: false }\n    return {\n      url,\n      entries: cached.entries,\n      warnings: [`${warning}; using the copy cached at ${cached.fetchedAt}`],\n      stale: true,\n      fetchedAt: cached.fetchedAt,\n      ok: true,\n    }\n  }\n\n  async function fetchOne(url: string): Promise<SourceFetch> {\n    let body: unknown\n    try {\n      const res = await fetchImpl(url, {\n        headers: { Accept: \"application/json\" },\n        signal: AbortSignal.timeout(timeoutMs),\n      })\n      if (!res.ok) throw new Error(`HTTP ${res.status}`)\n      body = await res.json()\n    } catch (err) {\n      const timedOut = err instanceof Error && (err.name === \"TimeoutError\" || err.name === \"AbortError\")\n      const reason = timedOut\n        ? `timed out after ${timeoutMs}ms`\n        : err instanceof Error\n          ? err.message\n          : String(err)\n      return failed(url, `catalog source ${url}: ${reason}`)\n    }\n    const shape = RemoteCatalogSchema.safeParse(body)\n    if (!shape.success) {\n      return failed(url, `catalog source ${url}: expected { entries: [...] }`)\n    }\n    const entries: AppCatalogEntry[] = []\n    const warnings: string[] = []\n    if (shape.data.schema !== undefined && shape.data.schema !== CATALOG_SCHEMA_V1) {\n      warnings.push(\n        `catalog source ${url}: unknown schema \"${shape.data.schema}\" — reading its entries as ${CATALOG_SCHEMA_V1}`,\n      )\n    }\n    shape.data.entries.forEach((raw, i) => {\n      const parsed = AppCatalogEntrySchema.safeParse(raw)\n      if (parsed.success) entries.push(parsed.data)\n      else warnings.push(`catalog source ${url}: entries[${i}] invalid (${parsed.error.issues[0]?.message ?? \"schema mismatch\"})`)\n    })\n    const fetchedAt = new Date(now()).toISOString()\n    await writeDiskCache(url, entries, fetchedAt)\n    return { url, entries, warnings, stale: false, fetchedAt, ok: true }\n  }\n\n  return {\n    async fetchSources(sources, opts = {}) {\n      const results = await Promise.all(\n        sources.map(async ({ url }) => {\n          const hit = cache.get(url)\n          if (!opts.refresh && hit && now() - hit.at < ttlMs) return hit.result\n          const result = await fetchOne(url)\n          // Neither failures nor stale disk fallbacks are cached in memory,\n          // so a flaky source retries on the next call.\n          if (!result.stale && (result.entries.length > 0 || result.warnings.length === 0)) {\n            cache.set(url, { at: now(), result })\n          } else {\n            cache.delete(url)\n          }\n          return result\n        }),\n      )\n      return {\n        entries: results.flatMap(r => r.entries),\n        warnings: results.flatMap(r => r.warnings),\n        bySource: results.map(({ warnings: _warnings, ...rest }) => rest),\n      }\n    },\n  }\n}\n\n/**\n * Compare dotted numeric versions (`1.2.10` > `1.2.9`); a pre-release suffix\n * (`1.2.0-beta`) ranks below the same core. Returns -1 | 0 | 1, or\n * `undefined` when either side isn't `N.N.N`-shaped.\n */\nexport function compareCatalogVersions(a: string, b: string): number | undefined {\n  const parse = (v: string): { core: number[]; pre: boolean } | undefined => {\n    const m = /^v?(\\d+)\\.(\\d+)\\.(\\d+)(-.+)?$/.exec(v.trim())\n    return m ? { core: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] !== undefined } : undefined\n  }\n  const pa = parse(a)\n  const pb = parse(b)\n  if (pa === undefined || pb === undefined) return undefined\n  for (let i = 0; i < 3; i++) {\n    const d = pa.core[i]! - pb.core[i]!\n    if (d !== 0) return d < 0 ? -1 : 1\n  }\n  if (pa.pre === pb.pre) return 0\n  return pa.pre ? -1 : 1\n}\n\n/**\n * Is catalog `entry` an update for an installed app (recorded `source`,\n * APP.md `version`)? Only for the same source kind, only when the pin\n * differs (bundle sha256 / git commit), and never when the entry's version\n * is LOWER than the installed one — a catalog listing an older release is\n * not an update.\n */\nexport function isCatalogUpdate(\n  installed: { readonly source?: AppSource; readonly version?: string },\n  entry: AppCatalogEntry,\n): boolean {\n  const s = installed.source\n  if (s === undefined || s.kind === \"local\" || s.kind !== entry.source.kind) return false\n  const offered = entry.source\n  const differs =\n    s.kind === \"agentapp\"\n      ? offered.kind === \"agentapp\" && offered.sha256.toLowerCase() !== s.sha256.toLowerCase()\n      : offered.kind === \"git\" && offered.sha.toLowerCase() !== s.sha.toLowerCase()\n  if (!differs) return false\n  const installedVersion = s.kind === \"agentapp\" ? s.version : installed.version\n  const offeredVersion = offered.kind === \"agentapp\" ? offered.version : entry.version\n  if (installedVersion !== undefined && offeredVersion !== undefined) {\n    const cmp = compareCatalogVersions(offeredVersion, installedVersion)\n    if (cmp !== undefined && cmp < 0) return false\n  }\n  return true\n}\n"]}

package/dist/app-registry-B64vZEaO.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Persisted installed-app + app-run state for the `app_*` daemon verbs
+ * (app-tools.ts). Mirrors workflow-runner.ts's persistence pattern exactly:
+ * an in-memory store, write-tmp + rename on every mutation, and persistence
+ * OFF by default so unit tests never touch ~/.agentproto/.
+ */
+
+/** The catalog an app was installed from (`app_install {catalogUrl}`):
+ *  `app_updates` / `app_resync` follow THAT catalog's entry for `appId`,
+ *  never another source's. */
+interface AppCatalogRef {
+    url: string;
+    appId: string;
+}
+/** Where an installed app came from — the pin `app_resync` compares against.
+ *  Absent on a record (legacy / `{dir}` install) means `{ kind: "local" }`. */
+type AppSource = {
+    kind: "local";
+} | {
+    kind: "git";
+    url: string;
+    ref?: string;
+    sha: string;
+    subdir?: string;
+    catalogId?: AppCatalogRef;
+} | {
+    kind: "agentapp";
+    url: string;
+    sha256: string;
+    version: string;
+    size?: number;
+    catalogId?: AppCatalogRef;
+};
+
+export type { AppSource as A };

package/dist/app-remote-install.d.ts

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+import { A as AppSource } from './app-registry-B64vZEaO.js';
+
+/**
+ * Remote sources for `app_install` / `app_resync`: git URLs and `.agentapp`
+ * bundles (URL or local file). Pure staging + swap — no registry, no
+ * validation: `app-tools.ts` runs `performInstall` on whatever this hands
+ * back, so the same manifest checks apply to every source.
+ *
+ * Remote-installed apps live under `<appsDir>/<slug>` (the daemon state dir's
+ * `apps/`), never in the user's cwd. A (re)install stages into a hidden
+ * sibling temp dir first and swaps it in, so a failed clone / digest mismatch
+ * / manifest error leaves the previous install untouched.
+ */
+
+declare const DOWNLOAD_TIMEOUT_MS = 30000;
+declare const DOWNLOAD_MAX_BYTES: number;
+/** `app_install` input: exactly one of `{dir}` | `{url, ref?, subdir?, sha?, sha256?, allowBuild?}` | `{file, sha256?}`. */
+declare const appInstallInputSchema: z.ZodUnion<readonly [z.ZodObject<{
+    dir: z.ZodString;
+    dataDir: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    url: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+    subdir: z.ZodOptional<z.ZodString>;
+    sha: z.ZodOptional<z.ZodString>;
+    sha256: z.ZodOptional<z.ZodString>;
+    allowBuild: z.ZodOptional<z.ZodBoolean>;
+    catalogUrl: z.ZodOptional<z.ZodString>;
+    dataDir: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    file: z.ZodString;
+    sha256: z.ZodOptional<z.ZodString>;
+    catalogUrl: z.ZodOptional<z.ZodString>;
+    dataDir: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+type AppInstallInput = z.infer<typeof appInstallInputSchema>;
+declare const APP_INSTALL_EXCLUSIVE_ERROR: string;
+/** A `{url}` ending in `.agentapp` (ignoring query/fragment) is a bundle, anything else is git. */
+declare function isAgentappUrl(url: string): boolean;
+interface StagedApp {
+    /** Directory name under `appsDir` the staged tree will be swapped into. */
+    readonly slug: string;
+    /** Hidden sibling of the final dir holding the staged tree. */
+    readonly tmpDir: string;
+    /** Path of the app dir inside the staged tree (`subdir` for git, `""` otherwise). */
+    readonly subdir: string;
+    readonly source: AppSource;
+    /** Remove the staged tree (idempotent) — call when the stage is not swapped in. */
+    discard(): Promise<void>;
+}
+/** `<repo-name>[-<subdir-slug>]` — repo name is the URL's last path segment minus `.git`. */
+declare function gitSlug(url: string, subdir?: string): string;
+/** Shallow-clone `url` into a temp sibling of `<appsDir>/<slug>` and pin the commit. */
+declare function stageGitApp(input: {
+    appsDir: string;
+    url: string;
+    ref?: string;
+    subdir?: string;
+    expectedSha?: string;
+}): Promise<StagedApp>;
+/** Stream `url` (http(s):// or file://) to `destFile` under the timeout + size
+ *  cap. Exported for `agentproto catalog verify`, which applies the same
+ *  download caps as `app_install`. */
+declare function downloadTo(url: string, destFile: string): Promise<void>;
+/**
+ * Fetch (or read) a `.agentapp`, verify + unpack it into a temp sibling of
+ * `<appsDir>/<safe-id>`. A digest mismatch (or any unpack refusal) throws and
+ * leaves nothing behind.
+ */
+declare function stageAgentApp(input: {
+    appsDir: string;
+    url?: string;
+    file?: string;
+    expectedSha256?: string;
+}): Promise<StagedApp>;
+interface AppSwap {
+    /** Drop the previous tree — the new one is final. */
+    commit(): Promise<void>;
+    /** Put the previous tree (and its data) back, discarding the new one. */
+    rollback(): Promise<void>;
+}
+/**
+ * Swap the staged tree in at `target`, keeping the previous tree aside until
+ * the caller commits. When the previous install's `dataDir` lived inside the
+ * old tree (the `<dir>/data` default), it is carried into the new tree so a
+ * re-install never loses app data.
+ */
+declare function swapInStaged(input: {
+    tmpDir: string;
+    target: string;
+    previousDataDir?: string;
+}): Promise<AppSwap>;
+/** The commit `url`'s `ref` (default `HEAD`) currently points at, via `git ls-remote`. */
+declare function remoteGitSha(url: string, ref?: string): Promise<string>;
+
+export { APP_INSTALL_EXCLUSIVE_ERROR, type AppInstallInput, type AppSwap, DOWNLOAD_MAX_BYTES, DOWNLOAD_TIMEOUT_MS, type StagedApp, appInstallInputSchema, downloadTo, gitSlug, isAgentappUrl, remoteGitSha, stageAgentApp, stageGitApp, swapInStaged };