@alashi/cli 0.14.0 → 0.16.0

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { AIProvider, AppContext, AppDefinition, AppManifest, AppSdkError, ConfigObject, ModelTokenUsage } from "@alashi/apps-sdk";
+import { AIProvider, AgentEvent, AppContext, AppDefinition, AppManifest, AppSdkError, AppUsageSummary, ApprovalDecision, ApprovalScope, CompiledPolicy, ConfigObject, ModelTokenUsage, PolicyDecision, PolicyRule, ToolGate, UsageDay, UsageMonth, UsageQuery, UsageTurn } from "@alashi/apps-sdk";
 import { Context, Hono, MiddlewareHandler } from "hono";
 //#region src/sources.d.ts
 type AppSourceSpec = {
@@ -81,6 +81,68 @@ interface GlobalConfig {
    * A cap is enforcement, so it lives where only the host can set it.
    */
   budgets?: Record<string, AppBudget>;
+  /**
+   * Seconds before a pending tool approval is auto-denied; default 300.
+   * Host policy like `budgets`: an app can never extend its own window.
+   */
+  approvalTimeoutSeconds?: number;
+}
+/**
+ * One tool-approval request, as surfaced to the user and logged in
+ * `apps/<name>/approvals.json`. `conversationId` is present for chat-born
+ * approvals; a cron/app-route approval has none and only shows up in the
+ * host-wide pending list.
+ */
+interface ApprovalRecord {
+  approvalId: string;
+  app: string;
+  conversationId?: string;
+  tool: string;
+  input: unknown;
+  requestedAt: string;
+  expiresAt: string;
+  status: "pending" | "allowed" | "denied" | "timeout";
+  decidedAt?: string;
+  scope?: ApprovalScope;
+  /** The policy rule that asked, when the tool gateway decided. */
+  ruleId?: string;
+  /** Human-readable why, e.g. `Bash with command starting with "curl "`. */
+  reason?: string;
+}
+/** The persisted approval decision log for an app (capped, oldest dropped first). */
+interface ApprovalLog {
+  approvals: ApprovalRecord[];
+}
+/**
+ * Always-allow grants for an app's ask-tier tools (`apps/<name>/grants.json`).
+ * OS bookkeeping like jobs.json — deliberately not a config.json key, which
+ * would restart the app (dropping its warm session) on every grant.
+ */
+interface GrantsState {
+  tools: string[];
+}
+/**
+ * The user's policy overrides for an app (`apps/<name>/policy.json`),
+ * evaluated before the manifest's rules. They may tighten anything but only
+ * loosen `ask` to `allow` — never past a manifest `deny` (see ToolGateway).
+ * "Always allow" decisions are appended here. Legacy `grants.json` tools
+ * still count, as tool-wide allow rules.
+ */
+interface UserPolicy {
+  rules: PolicyRule[];
+}
+/** One gated tool call, as a single line of `apps/<name>/tool-calls.jsonl`. */
+interface ToolCallRecord {
+  at: string;
+  tool: string;
+  toolUseId: string;
+  /** JSON of the input, truncated — enough to audit, bounded in size. */
+  inputPreview: string;
+  decision: PolicyDecision;
+  /** Which layer decided: a manifest rule, a user rule, a session grant, or the default. */
+  source: "manifest" | "user" | "session" | "default";
+  ruleId?: string;
+  reason: string;
 }
 interface Conversation {
   id: string;
@@ -106,33 +168,6 @@ interface JobState {
   lastRun: Record<string, string>;
   runs: JobRun[];
 }
-/** Tokens and cost one model consumed within a usage bucket (a day or a month). */
-interface ModelUsageTotals {
-  inputTokens: number;
-  outputTokens: number;
-  cacheReadInputTokens: number;
-  cacheCreationInputTokens: number;
-  costUsd: number;
-}
-/** One UTC day of AI spend for an app. */
-interface UsageDay {
-  /** UTC calendar day, `YYYY-MM-DD`. */
-  date: string;
-  /** Sum of the `costUsd` the provider reported for that day's turns. */
-  costUsd: number;
-  /** Turns that reported cost or token usage (turns without either are not counted). */
-  turns: number;
-  /** Per-model token/cost totals, keyed by the engine's model id. Absent for days recorded before token metering. */
-  models?: Record<string, ModelUsageTotals>;
-}
-/** One UTC calendar month of AI spend; months are never pruned. */
-interface UsageMonth {
-  /** UTC calendar month, `YYYY-MM`. */
-  month: string;
-  costUsd: number;
-  turns: number;
-  models?: Record<string, ModelUsageTotals>;
-}
 /**
  * Host-side AI spend for an app: daily series (oldest first, trimmed to the
  * retention window) plus monthly rollups that survive daily pruning so
@@ -143,6 +178,19 @@ interface UsageState {
   days: UsageDay[];
   months?: UsageMonth[];
 }
+/**
+ * One metered AI turn, as stored on a single line of `apps/<name>/turns.jsonl`
+ * — the SDK's `UsageTurn`, which is exactly what `ctx.usage.turns()` returns.
+ * Kept under a host name because the ledger, not the SDK, is where these lines
+ * live.
+ *
+ * The append-only ledger `usage.json` is a fold over: it carries enough to
+ * reproduce every day/month bucket (cost *and* per-model tokens) plus the
+ * session attribution the aggregates throw away. `sessionId`, `model`, and
+ * `modelUsage` are omitted when the engine did not report them; `costUsd` is
+ * always present and is `0` for a turn that reported tokens but no cost.
+ */
+type TurnRecord = UsageTurn;
 /** A long-lived bearer credential; only the sha256 of the secret is stored. */
 interface AuthTokenRecord {
   id: string;
@@ -194,7 +242,12 @@ declare class Store {
   appRecordPath(name: string): string;
   appChatStatePath(name: string): string;
   appJobStatePath(name: string): string;
+  appApprovalLogPath(name: string): string;
+  appGrantsPath(name: string): string;
+  appPolicyPath(name: string): string;
+  appToolCallsPath(name: string): string;
   appUsagePath(name: string): string;
+  appTurnsPath(name: string): string;
   registryCachePath(name: string): string;
   readGlobalConfig(): Promise<GlobalConfig>;
   writeGlobalConfig(config: GlobalConfig): Promise<void>;
@@ -204,10 +257,39 @@ declare class Store {
   writeAppConfig(name: string, config: ConfigObject): Promise<void>;
   readChatState(name: string): Promise<ChatState>;
   writeChatState(name: string, state: ChatState): Promise<void>;
+  readApprovalLog(name: string): Promise<ApprovalLog>;
+  writeApprovalLog(name: string, log: ApprovalLog): Promise<void>;
+  readGrants(name: string): Promise<GrantsState>;
+  writeGrants(name: string, state: GrantsState): Promise<void>;
+  readUserPolicy(name: string): Promise<UserPolicy>;
+  writeUserPolicy(name: string, policy: UserPolicy): Promise<void>;
+  /** Appends one line to the app's tool-call audit ledger. */
+  appendToolCall(name: string, record: ToolCallRecord): Promise<void>;
+  /**
+   * Parseable lines of the tool-call ledger, oldest first. Like the turn
+   * ledger, a truncated or hand-mangled line costs only itself.
+   */
+  readToolCalls(name: string): Promise<ToolCallRecord[]>;
+  /** Replaces the tool-call ledger atomically (tmp file + rename), for trimming. */
+  writeToolCalls(name: string, records: ToolCallRecord[]): Promise<void>;
   readJobState(name: string): Promise<JobState>;
   writeJobState(name: string, state: JobState): Promise<void>;
   readUsageState(name: string): Promise<UsageState>;
   writeUsageState(name: string, state: UsageState): Promise<void>;
+  /** Appends one line to the app's turn ledger, creating the container if needed. */
+  appendTurnRecord(name: string, record: TurnRecord): Promise<void>;
+  /**
+   * Every parseable line of the app's turn ledger, in file order (oldest
+   * first); an absent file reads as no turns.
+   *
+   * An append-only log written across crashes and hand edits will eventually
+   * contain a truncated or malformed line. One bad line must cost only itself,
+   * so unparseable lines — and lines without an `at` timestamp, which nothing
+   * downstream could place in time — are skipped rather than thrown on.
+   */
+  readTurnRecords(name: string): Promise<TurnRecord[]>;
+  /** Replaces the app's turn ledger atomically (tmp file + rename), for compaction. */
+  writeTurnRecords(name: string, records: TurnRecord[]): Promise<void>;
   get authStatePath(): string;
   readAuthState(): Promise<AuthState>;
   writeAuthState(state: AuthState): Promise<void>;
@@ -332,72 +414,131 @@ declare const USAGE_RETENTION_DAYS = 90;
 declare function utcDay(at?: Date): string;
 /** Money for humans: sub-dollar spend needs the extra digits, larger sums don't. */
 declare function formatUsd(value: number): string;
-/** One turn's metering as reported by the engine; either part may be missing. */
+/** One turn's metering as reported by the engine; every part may be missing. */
 interface TurnUsage {
   costUsd?: number;
   /** Per-turn token/cost deltas keyed by model id (provider-neutral). */
   modelUsage?: Record<string, ModelTokenUsage>;
-}
-/** A summary of an app's recorded spend, as served by GET /api/apps/:name/usage. */
-interface UsageSummary {
-  /** The UTC day "today" refers to. */
-  date: string;
-  /** Spend recorded so far today. */
-  todayCostUsd: number;
-  /** Turns recorded so far today. */
-  todayTurns: number;
-  /** Per-model tokens/cost recorded so far today. */
-  todayModels: Record<string, ModelUsageTotals>;
-  /** Spend across the whole retention window. */
-  totalCostUsd: number;
-  /** Per-model tokens/cost across the whole retention window. */
-  models: Record<string, ModelUsageTotals>;
-  /** Days kept in the retention window. */
-  retentionDays: number;
-  /**
-   * Whether the host has ever metered a turn for this app (monthly rollups
-   * persist, so this survives the daily retention window). False means "no
-   * data at all" — which is not the same thing as a measured zero, and must
-   * not be rendered as `$0.0000`. The host meters only sessions an app opens
-   * through `ctx.ai`, so an app that tracks its own costs elsewhere can be
-   * unrecorded here while still reporting real spend of its own.
-   */
-  recorded: boolean;
-  /** Daily series, oldest first; days with no spend are absent. */
-  days: UsageDay[];
-  /** Monthly rollups, oldest first; never pruned, so trends outlive the daily window. */
-  months: UsageMonth[];
+  /** Provider session the turn belonged to, for the per-turn ledger. */
+  sessionId?: string;
+  /** Model the session ran on, as reported by the engine's session event. */
+  model?: string;
 }
+/**
+ * Filters for {@link UsageRecorder.turns}; both are optional and ANDed. The
+ * SDK's `UsageQuery` — the same object an app passes to `ctx.usage.turns()`,
+ * which is this reader with the app's own name already bound.
+ */
+type TurnQuery = UsageQuery;
+/**
+ * A summary of an app's recorded spend, as served by GET
+ * /api/apps/:name/usage and returned by `ctx.usage.summary()` — the SDK's
+ * `AppUsageSummary`, aliased rather than restated so the endpoint, the
+ * dashboard, and the app contract can never drift apart.
+ *
+ * The field that carries meaning beyond its type is `recorded`: it says
+ * whether the host has ever metered a turn for this app (monthly rollups
+ * persist, so it survives the daily retention window). False means "no data at
+ * all" — not the same thing as a measured zero, and never to be rendered as
+ * `$0.0000`. The host meters only sessions an app opens through `ctx.ai`, so an
+ * app that tracks its own costs elsewhere can be unrecorded here while still
+ * reporting real spend of its own.
+ */
+type UsageSummary = AppUsageSummary;
 /**
  * Per-app AI spend and token usage, persisted as OS bookkeeping in the app
- * container (`apps/<name>/usage.json`, next to jobs.json and chat.json):
- * a per-UTC-day series trimmed to the retention window, plus per-month
- * rollups that are kept forever.
+ * container next to jobs.json and chat.json, in two files:
+ *
+ * - `apps/<name>/turns.jsonl` — the ledger: one line per metered turn,
+ *   append-only, oldest first, carrying the session attribution the
+ *   aggregates throw away.
+ * - `apps/<name>/usage.json` — a fold over that ledger: a per-UTC-day series
+ *   trimmed to the retention window, plus per-month rollups kept forever.
+ *
+ * The two are written together inside one per-app queue, so a turn can never
+ * land in one and not the other, and concurrent turns can neither lose an
+ * update nor interleave a half-written line. Each app has its own queue, so a
+ * slow write for one app never delays another.
  *
  * Cost and per-model tokens arrive from the `result` event, whose fields the
  * SDK contract marks optional: engines that report neither simply contribute
- * nothing. Writes are serialized per app so concurrent turns cannot lose an
- * update, and each app has its own queue so a slow write for one app never
- * delays another.
+ * nothing.
  */
 declare class UsageRecorder {
   private readonly store;
   private readonly retentionDays;
-  /** Serializes usage.json read-modify-write per app. */
+  /** Serializes the usage.json read-modify-write and ledger append per app. */
   private readonly queues;
+  /** Apps whose ledger has already been compacted in this process. */
+  private readonly compacted;
   constructor(store: Store, retentionDays?: number);
   /**
-   * Adds one turn's cost and token usage to the app's totals for the UTC day
-   * and month of `at`. A missing, non-finite, or negative `costUsd` is
-   * ignored; a turn that reports neither valid cost nor any model usage is
-   * not counted and nothing is written, so a provider that omits metering
-   * cannot corrupt the totals.
+   * Appends the turn to the app's ledger and adds its cost and token usage to
+   * the totals for the UTC day and month of `at`. A missing, non-finite, or
+   * negative `costUsd` is ignored; a turn that reports neither valid cost nor
+   * any model usage is not counted and nothing is written at all, so a
+   * provider that omits metering cannot corrupt the totals.
+   *
+   * Both writes happen in the same queued unit of work, ledger first: if the
+   * aggregate write then fails, the ledger is *ahead* of usage.json and
+   * `rebuild()` can recover the turn. The other order would lose it.
    */
   record(appName: string, turn: TurnUsage, at?: Date): Promise<void>;
   /** The app's recorded usage, oldest first, with expired days filtered out. */
   read(appName: string, at?: Date): Promise<Required<UsageState>>;
   /** Today's spend plus the daily/monthly series, for the dashboard and the usage endpoints. */
   summary(appName: string, at?: Date): Promise<UsageSummary>;
+  /**
+   * The app's metered turns, oldest first, with expired lines excluded.
+   *
+   * `since` is an inclusive lower bound compared lexically against the ISO
+   * `at` (so a plain `YYYY-MM-DD` works as "from that day on"), `sessionId`
+   * narrows to one provider session, and both are ANDed. This is the one
+   * reader for the ledger: everything that needs per-turn detail goes through
+   * it rather than parsing the file itself.
+   */
+  turns(appName: string, query?: TurnQuery, at?: Date): Promise<TurnRecord[]>;
+  /**
+   * Rewrites the app's ledger without the lines that have aged out of the
+   * retention window (the same window usage.json days use). Unparseable lines
+   * are dropped by the same rewrite, since only parsed records are written
+   * back.
+   *
+   * Runs inside the per-app queue, so it can never race a turn being
+   * appended. Pure bookkeeping: callers should treat a failure as noise, not
+   * as a reason to fail whatever they were doing.
+   */
+  compact(appName: string, at?: Date): Promise<void>;
+  /**
+   * Rebuilds usage.json from turns.jsonl, for when the two have drifted apart
+   * (a lost write, a crash mid-fold, a hand edit). The result is exactly what
+   * the incremental fold in `record()` would have produced from the same
+   * lines: same day and month buckets, same turn counts, same per-model
+   * totals, same rounding.
+   *
+   * Caveat, by construction: the ledger is pruned at `retentionDays` but
+   * usage.json months are kept forever, so months the ledger no longer covers
+   * cannot be recomputed. Those keep their existing rollup and only the
+   * months the ledger does cover are replaced — a rebuild never silently
+   * erases older history. The one month that is *partially* covered (the one
+   * the retention cutoff falls in) is replaced by its in-window part, which is
+   * all the ledger can still account for.
+   *
+   * Returns the state it wrote.
+   */
+  rebuild(appName: string, at?: Date): Promise<Required<UsageState>>;
+  /** The oldest UTC day still inside the retention window at `at`. */
+  private cutoff;
+  private inWindow;
+  /** The compaction body; assumes it is already inside the app's queue. */
+  private compactNow;
+  /**
+   * Trims the ledger on the app's first append of the process, so a host that
+   * is never restarted still sheds expired lines. Compaction is bookkeeping
+   * and must never break a turn, so a failure is swallowed — the next process
+   * tries again, and meanwhile `turns()` filters expired lines out anyway.
+   */
+  private compactOnce;
   private apply;
   /**
    * One-time migration for files written before monthly rollups existed:
@@ -629,6 +770,121 @@ interface ResolvedApp {
 /** Finds an app by name across configured registries (refreshing caches). */
 declare function resolveApp(store: Store, appName: string): Promise<ResolvedApp>;
 //#endregion
+//#region src/approvals.d.ts
+type ApprovalRequired = Extract<AgentEvent, {
+  type: "approval_required";
+}>;
+type ApprovalResolved = Extract<AgentEvent, {
+  type: "approval_resolved";
+}>;
+/**
+ * Host-wide bookkeeping for interactive tool approvals. Sessions wrapped by
+ * `superviseSession` register every `approval_required` here, so chat turns
+ * and cron jobs alike show up in one pending list; decisions flow back through
+ * `respond()` to the provider, and every outcome is appended to the app's
+ * `approvals.json` log. The registry also arms the host's timeout policy:
+ * a request nobody decides is denied after {@link DEFAULT_APPROVAL_TIMEOUT_MS}
+ * (overridable via `approvalTimeoutSeconds` in the global config — host
+ * policy, like budgets).
+ *
+ * Always-allow grants (`grants.json`) are written here too, so ask→allow
+ * promotion stays inside manifest bounds in one place.
+ */
+declare class ApprovalRegistry {
+  #private;
+  constructor(store: Store, options?: {
+    timeoutMs?: number;
+  });
+  /** Applies the host-config timeout override; safe to fire-and-forget at boot. */
+  init(): Promise<void>;
+  /** Registers a provider-born approval request and arms the auto-deny timer. */
+  track(app: string, event: ApprovalRequired, respond: (decision: ApprovalDecision) => Promise<void>): void;
+  /** Attaches the conversation a chat-born approval belongs to (cron ones have none). */
+  annotate(approvalId: string, fields: {
+    conversationId: string;
+  }): void;
+  /** The pending or settled record, for endpoint lookups. */
+  get(approvalId: string): ApprovalRecord | undefined;
+  /** Snapshots of pending records, optionally narrowed; newest last. */
+  pending(filter?: {
+    app?: string;
+    conversationId?: string;
+  }): ApprovalRecord[];
+  /**
+   * Applies a user decision: settles the record, then forwards the decision to
+   * the session that is suspended on it. Returns 'unknown' for an id this host
+   * never saw and 'resolved' for one already decided, so the endpoint can tell
+   * 404 from 409.
+   */
+  respond(approvalId: string, decision: ApprovalDecision): "ok" | "unknown" | "resolved";
+  /**
+   * Observes a provider-side resolution (session closed, interrupt) arriving
+   * through the event stream. A registry-initiated decision already settled
+   * the record, so this is a no-op for it.
+   */
+  resolved(event: ApprovalResolved): void;
+  /**
+   * Marks an approval whose session's event stream ended without a resolution
+   * (crash, abrupt close) as denied, so nothing stays pending forever.
+   */
+  abandon(approvalId: string): void;
+  /** Reads the app's always-allow grants. */
+  grants(app: string): Promise<string[]>;
+  /**
+   * Persists an always-allow grant. Validated against the manifest's askTools:
+   * a grant can promote ask→allow but never allow a tool the manifest did not
+   * declare askable.
+   */
+  addGrant(app: string, tool: string, askTools: string[]): Promise<void>;
+  /** Clears timers and denies everything still pending (host shutdown). */
+  close(): void;
+  /** Resolves when all queued approvals.json writes have landed (tests). */
+  flush(): Promise<void>;
+}
+//#endregion
+//#region src/tool-gateway.d.ts
+/** What a session's gate needs to know; one per createSession. */
+interface GateSession {
+  gate: ToolGate;
+  /** Forget this session's grants (call when the session closes). */
+  end: () => void;
+}
+/**
+ * The host's tool gateway: every tool call any app session makes — chat,
+ * cron, app routes; built-in, MCP, subagent — is decided here (see
+ * `SessionOptions.toolGate`). Layers, in order:
+ *
+ * 1. the manifest policy (rules, then `allowedTools`/`askTools` sugar);
+ * 2. the user's overrides (`policy.json`, plus legacy `grants.json`) — which
+ *    may tighten anything but never loosen past a manifest `deny`;
+ * 3. session grants ("approve for session"), keyed by the rule that asked;
+ *
+ * and every decision is appended to the app's `tool-calls.jsonl` audit
+ * ledger. `ask` verdicts go on to the provider's interactive approval flow;
+ * `applyDecision` turns the user's answer into a session grant or a
+ * persistent user rule.
+ */
+declare class ToolGateway {
+  #private;
+  constructor(store: Store);
+  /** Builds the gate for one new session of `app`. */
+  session(app: string, manifestPolicy: CompiledPolicy): GateSession;
+  /** The user override layer as stored: policy.json rules, then legacy grants. */
+  userPolicy(app: string): Promise<UserPolicy>;
+  /**
+   * Applies the scope of a user's answer to a call this gateway sent to
+   * `ask`: `session` grants the asking rule for the rest of the session,
+   * `always` appends an allow rule with the asking rule's scope to the app's
+   * policy.json. Returns false for approvals this gateway never saw (legacy
+   * name-level sessions), so the caller can fall back.
+   */
+  applyDecision(approvalId: string, decision: ApprovalDecision): Promise<boolean>;
+  /** The newest audit lines for an app, newest last. */
+  recentCalls(app: string, limit?: number): Promise<ToolCallRecord[]>;
+  /** Resolves when queued ledger and policy writes have landed (tests). */
+  flush(): Promise<void>;
+}
+//#endregion
 //#region src/runtime.d.ts
 /**
  * Builds the AppContext for an installed app: merges the config layers
@@ -641,10 +897,13 @@ declare function resolveApp(store: Store, appName: string): Promise<ResolvedApp>
  * while required keys are missing the scoped provider fails closed.
  *
  * When a `usage` recorder is supplied, every session opened through the
- * returned context reports its per-turn cost to it, and the app's host-set
- * daily spend cap (if any) is enforced on every createSession.
+ * returned context reports its per-turn cost to it, the app's host-set daily
+ * spend cap (if any) is enforced on every createSession, and `ctx.usage` reads
+ * back the app's own ledger. Without one there is no metering, no cap, and
+ * `ctx.usage` answers "nothing recorded" — the member is required by the
+ * contract, so it is always present.
  */
-declare function buildAppContext(store: Store, manifest: AppManifest, provider: AIProvider, usage?: UsageRecorder): Promise<AppContext>;
+declare function buildAppContext(store: Store, manifest: AppManifest, provider: AIProvider, usage?: UsageRecorder, approvals?: ApprovalRegistry, gateway?: ToolGateway): Promise<AppContext>;
 //#endregion
 //#region src/scheduler.d.ts
 interface SchedulableApp {
@@ -733,21 +992,42 @@ interface ServerOptions {
  *   GET  /api/apps/:name/usage  recorded AI spend: today's total, a daily series,
  *                               per-model token totals, monthly rollups,
  *                               `recorded`, and the budget status
+ *   GET  /api/apps/:name/turns  the per-turn ledger that summary folds: `{ turns }`,
+ *                               oldest first, each with `at`, `costUsd`, and the
+ *                               session/model attribution the buckets drop.
+ *                               ?since=<timestamp> (inclusive) and ?session=<id>
+ *                               narrow it, ANDed; an unreadable `since` is a 400
  *   GET  /api/apps/:name/budget today's spend against the app's daily cap,
  *                               plus `recorded`
  *   PUT  /api/apps/:name/budget { dailyUsd: number | null } -> set or clear the cap
  *                               (a host setting; apps cannot set their own)
- *   POST /api/apps/:name/chat   { message, conversationId? } -> SSE stream of AgentEvents
- *                               (omit conversationId to start a new conversation; the
- *                                id is echoed in the x-conversation-id response header;
- *                                402 when the app is over its daily spend cap)
+ *   POST /api/apps/:name/chat   { message, conversationId? } -> 202 { conversationId };
+ *                               the turn runs detached and its AgentEvents are published
+ *                               on the conversation's event bus (omit conversationId to
+ *                               start a new conversation; the id is also echoed in the
+ *                               x-conversation-id response header; 402 when the app is
+ *                               over its daily spend cap)
+ *   GET  /api/apps/:name/chat/:conversationId/events standing SSE from the conversation
+ *                               bus: replay from Last-Event-ID (or ?lastEventId=), then
+ *                               live; a scrolled-out id gets a `resync` event first
+ *   GET  /api/apps/:name/chat/:conversationId/pending-approvals  reconnect snapshot of
+ *                               undecided tool approvals for this conversation
+ *   POST /api/apps/:name/chat/:conversationId/approvals/:approvalId
+ *                               { behavior: "allow"|"deny", scope?, message? } -> decide a
+ *                               pending approval (scope "always" persists a grant);
+ *                               404 unknown/expired, 409 already decided
+ *   GET  /api/approvals         host-wide pending tool approvals (chat and cron alike)
+ *   POST /api/approvals/:approvalId  decide a pending approval regardless of source
  *   GET  /api/apps/:name/chat/conversations          conversations, most recent first
  *   POST /api/apps/:name/chat/conversations  { sessionId?, title? } -> create a conversation,
  *                               optionally adopting an existing provider session (e.g. an
  *                               app-run investigation) so chat continues where it left off
  *   GET  /api/apps/:name/chat/:conversationId/history  past turns from the provider transcript
+ *                               plus the conversation's settled approval records
  *   GET  /api/apps/:name/jobs           manifest-declared jobs with schedule/status
  *   POST /api/apps/:name/jobs/:job/run  trigger a job now (409 while already running)
+ *   GET  /api/apps/:name/policy         effective tool policy: user overrides + manifest rules
+ *   GET  /api/apps/:name/tool-calls?limit=  newest gated tool calls (audit ledger)
  *   GET  /api/apps/:name/manifest       read-only app definition: instructions, agents,
  *                                       skills (with dir contents), allowed tools,
  *                                       MCP servers (with configured state), jobs, model

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/sources.ts","../src/store.ts","../src/auth.ts","../src/usage.ts","../src/budget.ts","../src/compat.ts","../src/installer.ts","../src/loader.ts","../src/portability.ts","../src/registry.ts","../src/runtime.ts","../src/scheduler.ts","../src/server.ts"],"mappings":";;;KAQY;EACN;EAAa;EAAa;;EAC1B;EAAe;;;KAGT,YAAY;EAAkB;EAAkB;;iBAE5C,eAAe,cAAc;;iBAwBvB,YAAY,MAAM,eAAe,kBAAkB;;iBAanD,aAAa,MAAM,eAAe,kBAAkB;;;UC9CzD;EACf;EACA;;;UAIe;;;;;EAKf;;;;;;;;;;;;;;KAeU;;UAGK;EACf,OAAO;;;;;;EAMP;;;;;;;EAOA;;UAGe;EACf,YAAY;EACZ;;EAEA;;EAEA,OAAO;;EAEP,OAAO,eAAe;;;;;;;;;EAStB,UAAU,eAAe;;UAGV;EACf;;EAEA;EACA;EACA;;;UAIe;EACf,eAAe;;UAGA;EACf;EACA;EACA;EACA;EACA;EACA;;;UAIe;EACf,SAAS;EACT,MAAM;;;UAIS;EACf;EACA;EACA;EACA;EACA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA,SAAS,eAAe;;;UAIT;;EAEf;EACA;EACA;EACA,SAAS,eAAe;;;;;;;;UAST;EACf,MAAM;EACN,SAAS;;;UAIM;EACf;EACA;EACA;EACA;EACA;;;UAIe;EACf;;EAEA;EACA;EACA;EACA;;;UAIe;EACf,QAAQ;EACR,UAAU;;UAGK;EACf;EACA;;EAEA;EACA,QAAQ;EACR;EACA;;;;;;;cAwBW;WACF;EAET,YAAY;MAIR;MAIA;MAIA;MAIA;;EAKJ,OAAO;EAOP,WAAW;EAIX,WAAW;EAIX,cAAc;EAId,cAAc;EAId,iBAAiB;EAIjB,gBAAgB;EAIhB,aAAa;EAIb,kBAAkB;EAOlB,oBAA0B,QAAQ;EAIlC,kBAAwB,QAAQ,eAAe;EAI/C,cAAoB,eAAe,QAAQ;EAI3C,eAAqB,QAAQ,gBAAgB;EAI7C,cAAoB,eAAe,QAAQ;EAI3C,eAAqB,cAAc,QAAQ,eAAe;EAI1D,cAAoB,eAAe,QAAQ;EAK3C,eAAqB,cAAc,OAAO,YAAY;EAItD,aAAmB,eAAe,QAAQ;EAK1C,cAAoB,cAAc,OAAO,WAAW;EAIpD,eAAqB,eAAe,QAAQ;EAW5C,gBAAsB,cAAc,OAAO,aAAa;MAIpD;EAIJ,iBAAuB,QAAQ;EAK/B,eAAqB,OAAO,YAAY;EAIxC,iBAAuB,QAAQ;;;;cCrUpB;;UAMI;EACf;EACA;;EAEA;;;KAIU;;YAGA;IACR,WAAW;;;;;;;;;;;;;;;;;;;iBAmDC,iBACd,kBACA;EAAW,IAAI;GACf;;;;;;;iBAcc,cAAc,cAAc,gCAAgC;;UAoB3D;EACf;EACA;EACA;EACA;;;;;;;cAQW;mBAIC;UAHJ;UACA;EAER,YAAY,OAAwB;;;;;;EAOpC;;EAOA,UAAgB,iBAAiB;IAAU;IAAY;;EAcvD,cAAoB,QAAQ;;EAM5B,YAAkB,aAAa;;;;;EAc/B,kBAAwB,iBAAiB,QAAQ;;EAUjD,eAAqB,oCAAoC,QAAQ;UAOnD;;EAad,cAAoB,UAAU,UAAU,KAAI,OAAoB;;EAgBhE,gBACE,2BACA,KAAI,OACH,QAAQ;;EAUX,eAAqB,gBAAgB;;UAQ7B;;;KAgBE,yBAAyB,GAAG;UAEvB;EACf,mBAAmB;;;;;;;;iBAqBL,qBACd,OAAO,OACP,MAAM,aACN,UAAS,wBACR;;;;;;;;iBAwFa,mBAAmB,KAAK,MAAM,MAAM;;;;cCrXvC;;iBAQG,OAAO,KAAI;;iBAcX,UAAU;;UAKT;EACf;;EAEA,aAAa,eAAe;;;UAIb;;EAEf;;EAEA;;EAEA;;EAEA,aAAa,eAAe;;EAE5B;;EAEA,QAAQ,eAAe;;EAEvB;;;;;;;;;EASA;;EAEA,MAAM;;EAEN,QAAQ;;;;;;;;;;;;;;cA6HG;mBAKT;mBACA;;mBAJe;EAEjB,YACE,OAAwB,OACxB;;;;;;;;EAUF,OAAO,iBAAiB,MAAM,WAAW,KAAI,OAAoB;;EAsCjE,KAAW,iBAAiB,KAAI,OAAoB,QAAQ,SAAS;;EAKrE,QAAc,iBAAiB,KAAI,OAAoB,QAAQ;UAsBvD;;;;;;;UAmBA;;UAmBA;UAsCA;;;;;;;;;cClVG;;UAGI;;EAEf;;EAEA;;;;;;EAMA;;EAEA;;EAEA;;EAEA;;;;;;;;;;;cAYW,4BAA4B;WAC9B,aAAa;WACb;;WAEA;;WAEA;;WAEA;EAET,YAAY,iBAAiB;IAAU;IAAc;IAAkB;;;SAchE,GAAG,eAAe,OAAO;;;;;;;;;;;;;iBAkBlB,UAAU,QAAQ,cAAc;;iBAYhC,gBAAgB,SAAS,cAAc,+BAA+B;;iBAchE,aACpB,OAAO,OACP,OAAO,eACP,cACA,KAAI,OACH,QAAQ;;;;;;iBAUW,mBACpB,OAAO,OACP,OAAO,eACP,cACA,KAAI,OACH;;;;;;iBAemB,aACpB,OAAO,OACP,cACA,+BACC;;;;;;;iBC5Ia,sBAAsB,UAAU,KAAK;;;;iBCkB/B,oBAAoB,cAAc;UAevC;;EAEf;;;;;;;;UASe;EACf,QAAQ;;EAER;;;;;;;iBAQoB,WACpB,OAAO,OACP,iBAAiB,eACjB,UAAS,iBACR,QAAQ;iBA0EW,UAAU,OAAO,OAAO,eAAe,QAAQ;UAsBpD;;EAEf;;iBAGoB,UACpB,OAAO,OACP,cACA,UAAS,gBACR;;;UCxIc;EACf,YAAY;EACZ,UAAU;EACV;;;;;;EAMA;;UAGe;;;;;;;EAOf,QAAQ;;;;;;;iBAQY,QAAQ,iBAAiB,UAAS,iBAAsB,QAAQ;;;;;;;;;;;;;;;cCvBzE;UAaI;EACf;EACA;EACA,KAAK;;EAEL;;UAGe;;EAEf;;UAGe;EACf;EACA,QAAQ;EACR;EACA;;UAGe;EACf,QAAQ;EACR;EACA;;;;;;iBA8CoB,UACpB,OAAO,OACP,UAAU,YACV,cACA,UAAS,gBACR,QAAQ;;iBAgMW,UACpB,OAAO,OACP,UAAU,YACV,sBACC,QAAQ;;;UC3TM;EACf;EACA;EACA;EACA;EACA;;UAGe;EACf,MAAM;;;;;;;iBAkCc,gBAAgB,OAAO,OAAO,UAAU,cAAc,QAAQ;iBAuB9D,gBACpB,OAAO,OACP,eACC,QAAQ;iBASW,YAAY,OAAO,OAAO,cAAc,cAAc,QAAQ;iBAW9D,eAAe,OAAO,OAAO,eAAe;UAWjD;EACf;EACA,KAAK;;;iBAIe,WAAW,OAAO,OAAO,kBAAkB,QAAQ;;;;;;;;;;;;;;;;;iBCmFnD,gBACpB,OAAO,OACP,UAAU,aACV,UAAU,YACV,QAAQ,gBACP,QAAQ;;;UCrMM;EACf,UAAU;EACV,KAAK;EACL,cAAc,gBAAgB,KAAK,eAAe;;UAGnC;EACf;EACA;EACA;;EAEA;EACA;EACA;EACA;EACA,YAAY;;;;;;;;cAiBD;mBAQT;mBACA;UARM;UACA;UACA;;UAEA;EAER,YACE,OAAwB,OACxB,SAA0B,iBAAiB,QAAQ;EAGrD,SAAe;EAuCf;;MAOI;;;;;EAQJ,IACE,iBACA,iBACA,UAAS,oBACR,QAAQ;;EAmCX,OAAa,kBAAkB,QAAQ;UA4B/B;;;;UCtDO;;EAEf,KAAK;;EAEL,WAAW;;EAEX,MAAM;;EAEN,SAAS;;UAGM;;EAEf,OAAO;;;;;;EAMP,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkDL,aACd,OAAO,OACP,UAAU,YACV,UAAS,gBACR"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/sources.ts","../src/store.ts","../src/auth.ts","../src/usage.ts","../src/budget.ts","../src/compat.ts","../src/installer.ts","../src/loader.ts","../src/portability.ts","../src/registry.ts","../src/approvals.ts","../src/tool-gateway.ts","../src/runtime.ts","../src/scheduler.ts","../src/server.ts"],"mappings":";;;KAQY;EACN;EAAa;EAAa;;EAC1B;EAAe;;;KAGT,YAAY;EAAkB;EAAkB;;iBAE5C,eAAe,cAAc;;iBAwBvB,YAAY,MAAM,eAAe,kBAAkB;;iBAanD,aAAa,MAAM,eAAe,kBAAkB;;;UCnCzD;EACf;EACA;;;UAIe;;;;;EAKf;;;;;;;;;;;;;;KAeU;;UAGK;EACf,OAAO;;;;;;EAMP;;;;;;;EAOA;;UAGe;EACf,YAAY;EACZ;;EAEA;;EAEA,OAAO;;EAEP,OAAO,eAAe;;;;;;;;;EAStB,UAAU,eAAe;;;;;EAKzB;;;;;;;;UASe;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;;EAER;;EAEA;;;UAIe;EACf,WAAW;;;;;;;UAQI;EACf;;;;;;;;;UAUe;EACf,OAAO;;;UAIQ;EACf;EACA;EACA;;EAEA;EACA,UAAU;;EAEV;EACA;EACA;;UAGe;EACf;;EAEA;EACA;EACA;;;UAIe;EACf,eAAe;;UAGA;EACf;EACA;EACA;EACA;EACA;EACA;;;UAIe;EACf,SAAS;EACT,MAAM;;;;;;;;UAwBS;EACf,MAAM;EACN,SAAS;;;;;;;;;;;;;;KAeC,aAAa;;UAGR;EACf;EACA;EACA;EACA;EACA;;;UAIe;EACf;;EAEA;EACA;EACA;EACA;;;UAIe;EACf,QAAQ;EACR,UAAU;;UAGK;EACf;EACA;;EAEA;EACA,QAAQ;EACR;EACA;;;;;;;cAwBW;WACF;EAET,YAAY;MAIR;MAIA;MAIA;MAIA;;EAKJ,OAAO;EAOP,WAAW;EAIX,WAAW;EAIX,cAAc;EAId,cAAc;EAId,iBAAiB;EAIjB,gBAAgB;EAIhB,mBAAmB;EAInB,cAAc;EAId,cAAc;EAId,iBAAiB;EAIjB,aAAa;EAIb,aAAa;EAIb,kBAAkB;EAOlB,oBAA0B,QAAQ;EAIlC,kBAAwB,QAAQ,eAAe;EAI/C,cAAoB,eAAe,QAAQ;EAI3C,eAAqB,QAAQ,gBAAgB;EAI7C,cAAoB,eAAe,QAAQ;EAI3C,eAAqB,cAAc,QAAQ,eAAe;EAI1D,cAAoB,eAAe,QAAQ;EAK3C,eAAqB,cAAc,OAAO,YAAY;EAItD,gBAAsB,eAAe,QAAQ;EAK7C,iBAAuB,cAAc,KAAK,cAAc;EAIxD,WAAiB,eAAe,QAAQ;EAKxC,YAAkB,cAAc,OAAO,cAAc;EAIrD,eAAqB,eAAe,QAAQ;EAK5C,gBAAsB,cAAc,QAAQ,aAAa;;EAKzD,eAAqB,cAAc,QAAQ,iBAAiB;;;;;EAU5D,cAAoB,eAAe,QAAQ;;EAsB3C,eAAqB,cAAc,SAAS,mBAAmB;EAQ/D,aAAmB,eAAe,QAAQ;EAK1C,cAAoB,cAAc,OAAO,WAAW;EAIpD,eAAqB,eAAe,QAAQ;EAW5C,gBAAsB,cAAc,OAAO,aAAa;;EAKxD,iBAAuB,cAAc,QAAQ,aAAa;;;;;;;;;;EAe1D,gBAAsB,eAAe,QAAQ;;EAwB7C,iBAAuB,cAAc,SAAS,eAAe;MAQzD;EAIJ,iBAAuB,QAAQ;EAK/B,eAAqB,OAAO,YAAY;EAIxC,iBAAuB,QAAQ;;;;cC1hBpB;;UAMI;EACf;EACA;;EAEA;;;KAIU;;YAGA;IACR,WAAW;;;;;;;;;;;;;;;;;;;iBAmDC,iBACd,kBACA;EAAW,IAAI;GACf;;;;;;;iBAcc,cAAc,cAAc,gCAAgC;;UAoB3D;EACf;EACA;EACA;EACA;;;;;;;cAQW;mBAIC;UAHJ;UACA;EAER,YAAY,OAAwB;;;;;;EAOpC;;EAOA,UAAgB,iBAAiB;IAAU;IAAY;;EAcvD,cAAoB,QAAQ;;EAM5B,YAAkB,aAAa;;;;;EAc/B,kBAAwB,iBAAiB,QAAQ;;EAUjD,eAAqB,oCAAoC,QAAQ;UAOnD;;EAad,cAAoB,UAAU,UAAU,KAAI,OAAoB;;EAgBhE,gBACE,2BACA,KAAI,OACH,QAAQ;;EAUX,eAAqB,gBAAgB;;UAQ7B;;;KAgBE,yBAAyB,GAAG;UAEvB;EACf,mBAAmB;;;;;;;;iBAqBL,qBACd,OAAO,OACP,MAAM,aACN,UAAS,wBACR;;;;;;;;iBAwFa,mBAAmB,KAAK,MAAM,MAAM;;;;cC9WvC;;iBAQG,OAAO,KAAI;;iBAcX,UAAU;;UAKT;EACf;;EAEA,aAAa,eAAe;;EAE5B;;EAEA;;;;;;;KAQU,YAAY;;;;;;;;;;;;;;;KA0CZ,eAAe;;;;;;;;;;;;;;;;;;;;cAmId;mBAQT;mBACA;;mBAPe;;mBAGA;EAEjB,YACE,OAAwB,OACxB;;;;;;;;;;;;EAcF,OAAO,iBAAiB,MAAM,WAAW,KAAI,OAAoB;;EA6CjE,KAAW,iBAAiB,KAAI,OAAoB,QAAQ,SAAS;;EAKrE,QAAc,iBAAiB,KAAI,OAAoB,QAAQ;;;;;;;;;;EA+B/D,MACE,iBACA,QAAO,WACP,KAAI,OACH,QAAQ;;;;;;;;;;;EAsBX,QAAQ,iBAAiB,KAAI,OAAoB;;;;;;;;;;;;;;;;;;EA0BjD,QAAQ,iBAAiB,KAAI,OAAoB,QAAQ,SAAS;;UAqC1D;UAIA;;UAKM;;;;;;;UAgBA;UAUN;;;;;;;UAmBA;;UAmBA;UAsCA;;;;;;;;;cCzgBG;;UAGI;;EAEf;;EAEA;;;;;;EAMA;;EAEA;;EAEA;;EAEA;;;;;;;;;;;cAYW,4BAA4B;WAC9B,aAAa;WACb;;WAEA;;WAEA;;WAEA;EAET,YAAY,iBAAiB;IAAU;IAAc;IAAkB;;;SAchE,GAAG,eAAe,OAAO;;;;;;;;;;;;;iBAkBlB,UAAU,QAAQ,cAAc;;iBAYhC,gBAAgB,SAAS,cAAc,+BAA+B;;iBAchE,aACpB,OAAO,OACP,OAAO,eACP,cACA,KAAI,OACH,QAAQ;;;;;;iBAUW,mBACpB,OAAO,OACP,OAAO,eACP,cACA,KAAI,OACH;;;;;;iBAemB,aACpB,OAAO,OACP,cACA,+BACC;;;;;;;iBC5Ia,sBAAsB,UAAU,KAAK;;;;iBCkB/B,oBAAoB,cAAc;UAevC;;EAEf;;;;;;;;UASe;EACf,QAAQ;;EAER;;;;;;;iBAQoB,WACpB,OAAO,OACP,iBAAiB,eACjB,UAAS,iBACR,QAAQ;iBA0EW,UAAU,OAAO,OAAO,eAAe,QAAQ;UAsBpD;;EAEf;;iBAGoB,UACpB,OAAO,OACP,cACA,UAAS,gBACR;;;UCxIc;EACf,YAAY;EACZ,UAAU;EACV;;;;;;EAMA;;UAGe;;;;;;;EAOf,QAAQ;;;;;;;iBAQY,QAAQ,iBAAiB,UAAS,iBAAsB,QAAQ;;;;;;;;;;;;;;;cCvBzE;UAaI;EACf;EACA;EACA,KAAK;;EAEL;;UAGe;;EAEf;;UAGe;EACf;EACA,QAAQ;EACR;EACA;;UAGe;EACf,QAAQ;EACR;EACA;;;;;;iBA8CoB,UACpB,OAAO,OACP,UAAU,YACV,cACA,UAAS,gBACR,QAAQ;;iBAgMW,UACpB,OAAO,OACP,UAAU,YACV,sBACC,QAAQ;;;UC3TM;EACf;EACA;EACA;EACA;EACA;;UAGe;EACf,MAAM;;;;;;;iBAkCc,gBAAgB,OAAO,OAAO,UAAU,cAAc,QAAQ;iBAuB9D,gBACpB,OAAO,OACP,eACC,QAAQ;iBASW,YAAY,OAAO,OAAO,cAAc,cAAc,QAAQ;iBAW9D,eAAe,OAAO,OAAO,eAAe;UAWjD;EACf;EACA,KAAK;;;iBAIe,WAAW,OAAO,OAAO,kBAAkB,QAAQ;;;KCxGpE,mBAAmB,QAAQ;EAAc;;KACzC,mBAAmB,QAAQ;EAAc;;;;;;;;;;;;;;;cAqBjC;;EAQX,YAAY,OAAO,OAAO;IAAW;;;EAMrC,QAAc;;EASd,MACE,aACA,OAAO,kBACP,UAAU,UAAU,qBAAqB;;EAsB3C,SAAS,oBAAoB;IAAU;;;EAQvC,IAAI,qBAAqB;;EAKzB,QAAQ;IAAU;IAAc;MAAiC;;;;;;;EAkBjE,QAAQ,oBAAoB,UAAU;;;;;;EAmBtC,SAAS,OAAO;;;;;EAYhB,QAAQ;;EAOR,OAAa,cAAc;;;;;;EAS3B,SAAe,aAAa,cAAc,qBAAqB;;EAW/D;;EAoDA,SAAS;;;;;UC5LM;EACf,MAAM;;EAEN;;;;;;;;;;;;;;;;;cAkBW;;EAQX,YAAY,OAAO;;EAKnB,QAAQ,aAAa,gBAAgB,iBAAiB;;EAOtD,WAAiB,cAAc,QAAQ;;;;;;;;EAsBvC,cAAoB,oBAAoB,UAAU,mBAAmB;;EAkBrE,YAAkB,aAAa,iBAAc,QAAQ;;EAOrD,SAAS;;;;;;;;;;;;;;;;;;;;;iBC4RW,gBACpB,OAAO,OACP,UAAU,aACV,UAAU,YACV,QAAQ,eACR,YAAY,kBACZ,UAAU,cACT,QAAQ;;;UCvZM;EACf,UAAU;EACV,KAAK;EACL,cAAc,gBAAgB,KAAK,eAAe;;UAGnC;EACf;EACA;EACA;;EAEA;EACA;EACA;EACA;EACA,YAAY;;;;;;;;cAiBD;mBAQT;mBACA;UARM;UACA;UACA;;UAEA;EAER,YACE,OAAwB,OACxB,SAA0B,iBAAiB,QAAQ;EAGrD,SAAe;EAuCf;;MAOI;;;;;EAQJ,IACE,iBACA,iBACA,UAAS,oBACR,QAAQ;;EAmCX,OAAa,kBAAkB,QAAQ;UA4B/B;;;;UC9CO;;EAEf,KAAK;;EAEL,WAAW;;EAEX,MAAM;;EAEN,SAAS;;UAGM;;EAEf,OAAO;;;;;;EAMP,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuEL,aACd,OAAO,OACP,UAAU,YACV,UAAS,gBACR"}

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { A as UsageRecorder, C as BudgetExceededError, D as budgetStatusFor, E as budgetStatus, F as createAuthMiddleware, I as isConsoleRequest, L as registerAuthRoutes, M as utcDay, N as AuthService, O as setAppBudget, P as SESSION_COOKIE, R as requiredLevel, S as BUDGET_EXCEEDED_CODE, T as assertWithinBudget, _ as fetchSource, a as EXPORT_FORMAT_VERSION, b as loadApp, c as installApp, d as updateApp, f as addRegistry, g as resolveApp, h as removeRegistry, j as formatUsd, k as USAGE_RETENTION_DAYS, l as installDependencies, m as refreshRegistry, n as createServer, o as exportApp, p as readCachedIndex, r as buildAppContext, s as importApp, t as Store, u as removeApp, v as parseSourceArg, w as appBudget, x as checkSdkCompatibility, y as updateSource } from "./store-DoAGOynU.mjs";
+import { A as UsageRecorder, C as BudgetExceededError, D as budgetStatusFor, E as budgetStatus, F as createAuthMiddleware, I as isConsoleRequest, L as registerAuthRoutes, M as utcDay, N as AuthService, O as setAppBudget, P as SESSION_COOKIE, R as requiredLevel, S as BUDGET_EXCEEDED_CODE, T as assertWithinBudget, _ as fetchSource, a as EXPORT_FORMAT_VERSION, b as loadApp, c as installApp, d as updateApp, f as addRegistry, g as resolveApp, h as removeRegistry, j as formatUsd, k as USAGE_RETENTION_DAYS, l as installDependencies, m as refreshRegistry, n as createServer, o as exportApp, p as readCachedIndex, r as buildAppContext, s as importApp, t as Store, u as removeApp, v as parseSourceArg, w as appBudget, x as checkSdkCompatibility, y as updateSource } from "./store-DvLX0Kft.mjs";
 export { AuthService, BUDGET_EXCEEDED_CODE, BudgetExceededError, EXPORT_FORMAT_VERSION, SESSION_COOKIE, Store, USAGE_RETENTION_DAYS, UsageRecorder, addRegistry, appBudget, assertWithinBudget, budgetStatus, budgetStatusFor, buildAppContext, checkSdkCompatibility, createAuthMiddleware, createServer, exportApp, fetchSource, formatUsd, importApp, installApp, installDependencies, isConsoleRequest, loadApp, parseSourceArg, readCachedIndex, refreshRegistry, registerAuthRoutes, removeApp, removeRegistry, requiredLevel, resolveApp, setAppBudget, updateApp, updateSource, utcDay };