@gt-fe/eap-sdk 0.0.6

package/README.md

@@ -0,0 +1,370 @@
+# @gt-fe/eap-sdk
+
+`@gt-fe/eap-sdk` 是 EAP 单 Agent 项目的开发期 SDK，负责项目发现与校验、用户会话、平台 API、Tool/Skill 依赖安装、Runtime 目录物化、本地 Agent Service 以及确定性打包。
+
+Agent 的实际执行仍由 `@gt-fe/eap-runtime` 负责。SDK 不重新实现 Graph 编译、节点执行、Tool 路由或 Runtime 事件协议。
+
+## 安装
+
+```bash
+npm install @gt-fe/eap-sdk
+```
+
+本包为纯 ESM：
+
+```ts
+import { createAgentService } from '@gt-fe/eap-sdk';
+```
+
+## 项目模型
+
+一个项目只开发一个 Agent，开发者维护的源文件位于项目根目录：
+
+```text
+<project>/
+├── agent.manifest.json
+├── graph.json
+├── eap.config.json
+├── eap.lock.yaml
+├── tools/<code>/...
+├── skills/<code>/...
+└── .eap/
+    ├── remote/                         # Registry 资源缓存
+    ├── runtime/                        # 开发态 EAP_PREINSTALL_ROOT
+    │   └── agents/<agentCode>/<version>/preinstall|users/
+    ├── sessions/                       # 可选的本地会话数据
+    ├── package-staging/                # 打包临时目录
+    └── package/                        # 默认包输出目录
+```
+
+`agent.manifest.json`、`graph.json`、`eap.config.json`、`eap.lock.yaml` 以及本地 `tools/`、`skills/` 是项目输入；`.eap/` 是 SDK 生成的可删除状态。
+
+项目 `eap.config.json.version` 必须严格等于当前安装的 `@gt-fe/eap-sdk` package version；字段级配置和部署交付说明见 [dev-tools 文档入口](../../docs/README.md)。
+
+`findAgentRoot()` 和 `resolveAgentProject()` 只发现源项目，不使用 `EAP_PREINSTALL_ROOT`。选择器只支持 `root` 和 `startDir`，不存在 Agent code、版本或目录歧义选择。
+
+```ts
+import {
+  resolveAgentProject,
+  validateAgentProject,
+  type AgentProjectSelector,
+} from '@gt-fe/eap-sdk';
+
+const selector: AgentProjectSelector = { root: process.cwd() };
+const project = resolveAgentProject(selector);
+const validation = validateAgentProject(project.root);
+
+if (!validation.valid) {
+  console.error(validation.issues);
+}
+```
+
+## 核心能力
+
+| 能力 | 主要 API | 说明 |
+|---|---|---|
+| 项目发现 | `findAgentRoot()`、`resolveAgentProject()` | 查找根级单 Agent 项目 |
+| 项目校验 | `validateAgentProject()`、`validateGraph()` | 校验 Manifest、Graph、锁文件和资源路径 |
+| 用户会话 | `getCurrentUserSession()`、`saveCurrentUserSession()` | 管理当前登录用户和平台 Token |
+| 平台 API | `createPlatformClient()` | 访问 Portal、Foundation 和平台认证 |
+| 依赖安装 | `installAgentResource()`、`installAgentDependencies()` | 下载或恢复 Tool/Skill ZIP 制品，并维护锁文件 |
+| Runtime 物化 | `prepareAgentRuntime()` | 生成 Runtime 可直接读取的预装目录 |
+| 本地服务 | `createAgentService()` | 物化后创建 Runtime-backed Agent Service |
+| Standalone 服务 | `packageStandaloneAgentProject()`、`createEmbeddedAgentService()` | 将同一套物化 Runtime 输出到 `dist/runtime`，启动时不读取源项目 |
+| 打包与验包 | `packageAgentProject()`、`readAgentPackage()` | 生成并校验单 Agent Runtime 部署包 |
+| Schema | `AgentManifestSchema`、`GraphSchema`、`ToolManifestSchema` 等 | SDK 所有项目文件的 Zod Schema |
+
+所有公共 API 均从包根导出，不需要导入内部路径。
+
+## 平台 API
+
+`createPlatformClient()` 是 Portal 与 Foundation HTTP 调用的统一入口。端点由调用方显式提供，客户端会使用当前用户会话 Token；也可通过 `token` 覆盖，便于服务端或测试宿主注入凭证。
+
+```ts
+import { createPlatformClient } from '@gt-fe/eap-sdk';
+
+const platform = createPlatformClient({
+  portalEndpoint: 'https://portal.example',
+  foundationEndpoint: 'https://foundation.example',
+});
+
+const agents = await platform.portalFetch('/api/v1/agents');
+const deployment = await platform.foundationFetch('/api/v1/deployments', {
+  method: 'POST',
+  body: JSON.stringify({ agentCode: 'report-agent', version: '1.0.0' }),
+});
+```
+
+客户端同时提供 `checkPortalHealth()`、`checkFoundationHealth()`、`uploadPortalFile()`，以及会保存统一用户会话的 `loginWithCas()`、`validateAndSaveToken()`，和吊销 Token 的 `revokeToken()`。Registry Tool/Skill 安装也使用此客户端，不再维护独立 HTTP 实现。
+
+## 当前用户会话
+
+SDK 将当前用户资料和平台凭证统一保存在 `~/.eap/config.json`；可通过 `EAP_CONFIG_DIR` 修改目录。
+
+```ts
+import {
+  clearCurrentUserSession,
+  getCurrentUserSession,
+  getCurrentUserToken,
+  saveCurrentUserSession,
+} from '@gt-fe/eap-sdk';
+
+saveCurrentUserSession({
+  userId: 'U001',
+  username: 'alice',
+  roles: ['developer'],
+  permissions: [],
+  token: '<platform-token>',
+  authMethod: 'token',
+  platformUrl: 'https://foundation.example',
+});
+
+const user = getCurrentUserSession();
+const token = getCurrentUserToken();
+clearCurrentUserSession();
+```
+
+规则如下：
+
+- 同一时刻只有一个当前用户，不随 CLI profile 或 Runtime storage profile 切换。
+- `getCurrentUserSession()` 始终返回用户资料；没有已保存会话时返回 `default-user`。
+- `getCurrentUserToken()` 优先读取 `EAP_TOKEN`，否则读取已保存 Token；默认用户不提供 Token。
+- Runtime 环境准备会把当前 Token 映射为 `EAP_DELEGATION_TOKEN`。
+- 用户资料在进程内缓存；测试或特殊宿主可调用 `clearUserSessionCache()` 清除缓存。
+
+## 锁文件与资源安装
+
+`eap.lock.yaml` 使用版本 2，只供 dev-tools 在安装、校验、Runtime 准备和打包时使用。Runtime 与生产 Hosting 都不会读取它。
+
+```yaml
+lockfileVersion: 2
+resources:
+  tools:
+    - code: search-tool
+      version: 1.2.0
+      source: registry
+      path: .eap/remote/tools/search-tool/1.2.0
+      digest: sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+  skills: []
+  subagents: []
+```
+
+每条 Tool/Skill 记录包含：
+
+- `code`：Agent Manifest 中声明的资源编码。
+- `version`：确定的语义化版本。
+- `source`：`registry` 或 `local`。
+- `path`：相对于项目根的可移植目录路径。
+- `digest`：对应 Manifest 文件字节的 SHA-256，用于开发态缓存完整性校验。
+
+Registry 资源存放在 `.eap/remote`；本地资源继续由开发者维护在 `tools/<code>` 或 `skills/<code>`。本地 Tool 固定使用单工具 `tool.manifest.json`；Registry Tool 可以是 `toolset.manifest.json`，SDK 把它及同目录制品作为整体复制，不展开或校验其 `tools[]` 子工具。绝对路径、`..` 穿越、符号链接、缺失目录、缺失 Manifest 和本地/Registry 同名冲突都会被拒绝。
+
+安装单个远程资源：
+
+```ts
+import { installAgentResource } from '@gt-fe/eap-sdk';
+
+await installAgentResource({
+  root: process.cwd(),
+  kind: 'tool',
+  code: 'search-tool',
+  version: '1.2.0',
+  token: process.env.EAP_TOKEN,
+});
+```
+
+按名称和精确版本安装当前项目中的本地资源：
+
+```ts
+import { installLocalAgentResource } from '@gt-fe/eap-sdk';
+
+await installLocalAgentResource({
+  root: process.cwd(),
+  kind: 'tool',
+  code: 'echo-tool',
+  version: '1.0.0',
+});
+```
+
+按名称卸载当前项目中的本地或 Registry 资源：
+
+```ts
+import { uninstallAgentResource } from '@gt-fe/eap-sdk';
+
+await uninstallAgentResource({
+  root: process.cwd(),
+  code: 'echo-tool',
+});
+```
+
+恢复全部锁定资源并刷新本地资源记录：
+
+```ts
+import { installAgentDependencies } from '@gt-fe/eap-sdk';
+
+const result = await installAgentDependencies({ root: process.cwd() });
+console.log(result.restoredRegistryResources, result.refreshedLocalResources);
+```
+
+只有安装 API 会访问平台。服务启动和打包默认离线；远程缓存缺失时应先执行安装，而不是在 Runtime 启动后动态拉取。
+
+Registry Tool/Skill 安装会按 code 和 version 查询 Portal 资源详情，并通过其中的 `source_url` 下载 ZIP 制品。制品会解压到 `.eap/remote/tools/<code>/<version>/` 或 `.eap/remote/skills/<code>/<version>/`；锁文件中的 `digest` 是解压后根 Manifest 文件字节的 SHA-256，用于离线完整性校验。
+
+`agent.manifest.json` 只使用 `toolRefs`、`skillRefs` 和 `subagentRefs` 声明依赖；其中 `subagentRefs` 使用 `{ code, version }`，不会触发 Tool/Skill ZIP 下载。
+
+## Runtime 目录物化
+
+`prepareAgentRuntime()` 根据 Agent Manifest 和 `eap.lock.yaml` 生成一棵完整、干净的 Runtime 目录：
+
+```ts
+import { prepareAgentRuntime } from '@gt-fe/eap-sdk';
+
+const prepared = await prepareAgentRuntime({ root: process.cwd() });
+console.log(prepared.runtimeRoot);
+```
+
+资源映射规则：
+
+| 来源 | Runtime 目标目录 |
+|---|---|
+| Registry Toolset | `agents/<agentCode>/<version>/preinstall/tools/<toolsetCode>/` |
+| Registry Skill | `agents/<agentCode>/<version>/preinstall/skills/<skillCode>/` |
+| 本地 Tool | `agents/<agentCode>/<version>/users/<developerUserId>/tools/<toolCode>/` |
+| 本地 Skill | `agents/<agentCode>/<version>/users/<developerUserId>/skills/<skillCode>/` |
+
+物化器还会：
+
+- 复制根级 Agent Manifest 与 Graph。
+- 校验本地资源的根 Manifest 摘要和 Registry 解压缓存中的根 Manifest 摘要；锁文件不记录 Registry ZIP 摘要。
+- 生成 `dependencies.lock`、`snapshot.json` 和 `.ready`。
+- 把 Registry Toolset/Skill 复制到该 Agent 的 `preinstall/`，把本地 Tool/Skill 复制到 `users/<developerUserId>/`；不再生成 `shared/`。
+- 排除 `.git`、`.eap`、`node_modules`、`.env*`、coverage 和临时文件。
+- 拒绝符号链接和越界路径。
+- 通过临时目录加原子替换，避免 Runtime 看到半成品。
+
+物化器不创建 Runtime、不启动 HTTP 服务、不访问平台，也不负责压缩包。
+
+摘要字段的输入和格式见 [dev-tools SHA-256 摘要约定](../../docs/README.md#sha-256-摘要约定)。
+
+## Agent 服务
+
+`createAgentService()` 是异步工厂，因为必须先完成校验和目录物化，再构造 Runtime：
+
+```ts
+import { createAgentService } from '@gt-fe/eap-sdk';
+
+const service = await createAgentService({
+  root: process.cwd(),
+  messages: [{ role: 'system', content: '你是一个数据分析助手。' }],
+});
+
+const result = await service.invoke('汇总这份报告');
+
+for await (const event of service.stream('列出支撑数据')) {
+  console.log(event.type, event.data);
+}
+```
+
+启动本地 HTTP 服务：
+
+```ts
+await service.start({ host: '127.0.0.1', port: 3000 });
+// 使用结束后
+await service.stop();
+```
+
+默认行为：
+
+- `EAP_PREINSTALL_ROOT` 指向准备好的 `.eap/runtime`，不是项目源目录。
+- Runtime 只从准备好的 `.eap/runtime` 读取 Tool/Skill 定义；本地资源必须先锁定并物化。
+- 默认使用 Runtime `test` storage profile，不写入会话、消息或 checkpoint 文件。
+- 设置 `sessionPersistence: true` 后使用 Runtime `dev` profile，会话和消息保存在 `.eap/sessions`。
+
+需要注入自定义 Runtime 时，使用 `runtimeFactory(prepared, environment)`。不要传入已经构造完成、并绑定了其他 GraphLoader 根目录的 Runtime。
+
+### Standalone Runtime 服务
+
+使用现有 `eap package` 命令生成独立服务需要的 Runtime 目录：
+
+```bash
+eap package --target standalone --output ./dist/runtime
+```
+
+该模式复用项目校验、资源解析、Runtime 物化和摘要校验，但不生成 TAR.GZ，也不复制项目的
+`package.json`、`eap.config.json` 或 `eap.lock.yaml`。输出目录结构为
+`dist/runtime/agents/<code>/<version>/`。
+
+已由构建工具打包的服务入口可以直接消费该目录：
+
+```ts
+import { createEmbeddedAgentService } from '@gt-fe/eap-sdk';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const service = await createEmbeddedAgentService({
+  runtimeRoot: join(dirname(fileURLToPath(import.meta.url)), 'runtime'),
+});
+await service.start({ host: '0.0.0.0', port: 3000 });
+```
+
+`createEmbeddedAgentService()` 只校验并读取已物化 Runtime，不会重新发现源项目或执行物化。
+默认的 `eap package` 行为不变，仍然生成可交付的 TAR.GZ 部署包。
+
+## 打包与验包
+
+`packageAgentProject()` 会独立生成 package staging Runtime 树，不复用开发态 `.eap/runtime`：
+
+```ts
+import { packageAgentProject, readAgentPackage } from '@gt-fe/eap-sdk';
+
+const artifact = await packageAgentProject({
+  root: process.cwd(),
+});
+
+const verified = readAgentPackage(artifact.archivePath);
+console.log(verified.manifest.agents[0], verified.digest);
+```
+
+默认输出：
+
+```text
+.eap/package/eap-agent-project.tar.gz
+.eap/package/eap-agent-project.tar.gz.sha256
+```
+
+部署包只包含：
+
+- 物化后的 Agent 版本目录内容，直接展开到包根目录（例如 `agent.manifest.json`、`graph.json`、`preinstall/`、`users/`）。
+- 根目录的包文件索引 `eap-package.json`。
+
+部署包不会包含 `eap.lock.yaml`、`.eap/remote`、会话、checkpoint、staging 名称或其他开发缓存。`readAgentPackage()` 会校验 `eap-package.json` 的所有文件大小和摘要，并要求包内恰好有一个 Agent。
+
+## 项目配置映射
+
+`eap.config.json` 由 `EapProjectConfigSchema` 校验。SDK 在 Runtime 构造前完成以下主要映射：
+
+顶层 `version` 是 SDK package version；配置版本不匹配时项目校验、服务创建和打包都会失败。
+
+| 项目配置或输入 | Runtime 环境变量 |
+|---|---|
+| `platform.portalUrl` | `EAP_PLATFORM_ENDPOINT` |
+| `platform.foundationServiceUrl` | `FOUNDATION_SERVICE_URL` |
+| `runtime.deploymentContext` | `EAP_DEPLOYMENT_CONTEXT` |
+| `runtime.governance.enabled` | `GOVERNANCE_DISABLED` |
+| `runtime.storage` | `EAP_RUNTIME_STORAGE_PROFILE`、`EAP_CHECKPOINT_DIR` |
+| `runtime.tools` | `EAP_TOOL_EXECUTION_MODE`、`EAP_TOOL_GATEWAY_TRANSPORT` |
+| 准备好的 Runtime 目录 | `EAP_PREINSTALL_ROOT` |
+| 当前用户 Token | `EAP_DELEGATION_TOKEN` |
+
+显式环境变量优先于大多数项目配置；`EAP_PREINSTALL_ROOT` 始终使用本次物化得到的目录。
+
+## 内置模板
+
+SDK 与 CLI 使用同一套根级单 Agent 项目约定。内置模板包括：
+
+- `simple-flow`：固定顺序工作流。
+- `single-agent-with-tools`：单 Agent + ReAct Tool 调用。
+- `plan-and-execute`：规划、Tool 执行、总结。
+- `dag-workflow`：条件分支与任务聚合。
+
+工作流语义由 `graph.json` 表达，`agent.manifest.json` 只保存身份和依赖。包含 Tool 的模板自带本地、已锁定的 `echo-tool`，校验和打包不依赖 Registry 缓存。

package/dist/auth/index.d.ts

@@ -0,0 +1,2 @@
+export * from './user-session.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,2 @@
+export * from './user-session.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/dist/auth/user-session.d.ts

@@ -0,0 +1,23 @@
+export type UserAuthMethod = 'token' | 'password' | 'cas';
+export interface UserSession {
+    userId: string;
+    username?: string;
+    displayName?: string;
+    roles: string[];
+    permissions: string[];
+    token: string;
+    refreshToken?: string;
+    authMethod: UserAuthMethod;
+    platformUrl: string;
+}
+export interface UserSessionOptions {
+    env?: NodeJS.ProcessEnv;
+}
+export declare const DEBUG_USER: UserSession;
+export declare const DEFAULT_USER: UserSession;
+export declare function getCurrentUserSession(options?: UserSessionOptions): UserSession;
+export declare function getCurrentUserToken(options?: UserSessionOptions): string | undefined;
+export declare function saveCurrentUserSession(session: UserSession, options?: UserSessionOptions): void;
+export declare function clearCurrentUserSession(options?: UserSessionOptions): void;
+export declare function clearUserSessionCache(): void;
+//# sourceMappingURL=user-session.d.ts.map

package/dist/auth/user-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-session.d.ts","sourceRoot":"","sources":["../../src/auth/user-session.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAMD,eAAO,MAAM,UAAU,EAAE,WASxB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,WAS1B,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CASnF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,kBAAuB,GAAG,MAAM,GAAG,SAAS,CAIxF;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CAaN;AAED,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,kBAAuB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/dist/auth/user-session.js

@@ -0,0 +1,162 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+const configCache = new Map();
+export const DEBUG_USER = {
+    userId: 'debug-user-001',
+    username: 'debug',
+    displayName: 'Debug User',
+    roles: ['admin', 'developer'],
+    permissions: ['read', 'write', 'delete', 'admin'],
+    token: 'debug-token',
+    authMethod: 'token',
+    platformUrl: 'http://localhost:3000',
+};
+export const DEFAULT_USER = {
+    userId: 'default-user',
+    username: 'default-user',
+    displayName: 'Default User',
+    roles: [],
+    permissions: [],
+    token: '',
+    authMethod: 'token',
+    platformUrl: '',
+};
+export function getCurrentUserSession(options = {}) {
+    const env = options.env ?? process.env;
+    const document = loadConfigDocument(configPath(env));
+    const session = normalizeUserSession(document.user);
+    if (session)
+        return session;
+    if (env.EAP_DEBUG_USER === 'true' || env.EAP_DEBUG_USER === '1') {
+        return cloneSession(DEBUG_USER);
+    }
+    return cloneSession(DEFAULT_USER);
+}
+export function getCurrentUserToken(options = {}) {
+    const env = options.env ?? process.env;
+    const override = nonEmptyString(env.EAP_TOKEN);
+    return override ?? nonEmptyString(getCurrentUserSession({ env }).token);
+}
+export function saveCurrentUserSession(session, options = {}) {
+    const env = options.env ?? process.env;
+    const path = configPath(env);
+    const document = loadConfigDocument(path);
+    document.user = cloneSession(session);
+    removeLegacyAuth(document);
+    const platform = asObject(document.platform) ?? {};
+    delete platform.endpoint;
+    delete platform.hostingEndpoint;
+    platform.portalUrl = session.platformUrl;
+    document.platform = platform;
+    delete document.hosting;
+    persistConfigDocument(path, document);
+}
+export function clearCurrentUserSession(options = {}) {
+    const env = options.env ?? process.env;
+    const path = configPath(env);
+    if (!existsSync(path)) {
+        configCache.delete(path);
+        return;
+    }
+    const document = loadConfigDocument(path);
+    delete document.user;
+    removeLegacyAuth(document);
+    persistConfigDocument(path, document);
+}
+export function clearUserSessionCache() {
+    configCache.clear();
+}
+function configPath(env) {
+    const directory = nonEmptyString(env.EAP_CONFIG_DIR) ?? join(homedir(), '.eap');
+    return resolve(directory, 'config.json');
+}
+function loadConfigDocument(path) {
+    const cached = configCache.get(path);
+    if (cached)
+        return cached;
+    if (!existsSync(path)) {
+        const empty = {};
+        configCache.set(path, empty);
+        return empty;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Invalid EAP user configuration: ${path} (${reason})`);
+    }
+    const document = asObject(parsed);
+    if (!document)
+        throw new Error(`Invalid EAP user configuration: ${path}`);
+    configCache.set(path, document);
+    return document;
+}
+function persistConfigDocument(path, document) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tempPath = `${path}.${process.pid}.tmp`;
+    writeFileSync(tempPath, `${JSON.stringify(document, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+    renameSync(tempPath, path);
+    configCache.set(path, document);
+}
+function normalizeUserSession(value) {
+    const user = asObject(value);
+    if (!user)
+        return undefined;
+    const userId = nonEmptyString(user.userId);
+    const token = nonEmptyString(user.token);
+    if (!userId || !token)
+        return undefined;
+    const authMethod = user.authMethod === 'password' || user.authMethod === 'cas'
+        ? user.authMethod
+        : 'token';
+    const username = nonEmptyString(user.username);
+    const displayName = nonEmptyString(user.displayName);
+    const refreshToken = nonEmptyString(user.refreshToken);
+    return {
+        userId,
+        ...(username ? { username } : {}),
+        ...(displayName ? { displayName } : {}),
+        roles: stringArray(user.roles),
+        permissions: stringArray(user.permissions),
+        token,
+        ...(refreshToken ? { refreshToken } : {}),
+        authMethod,
+        platformUrl: nonEmptyString(user.platformUrl) ?? '',
+    };
+}
+function cloneSession(session) {
+    return {
+        ...session,
+        roles: [...session.roles],
+        permissions: [...session.permissions],
+    };
+}
+function removeLegacyAuth(document) {
+    delete document.auth;
+    const profiles = asObject(document.profiles);
+    if (!profiles)
+        return;
+    for (const profile of Object.values(profiles)) {
+        const profileConfig = asObject(profile);
+        if (profileConfig)
+            delete profileConfig.auth;
+    }
+}
+function asObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function nonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0 ? value : undefined;
+}
+function stringArray(value) {
+    return Array.isArray(value) ? value.filter((item) => typeof item === 'string') : [];
+}
+//# sourceMappingURL=user-session.js.map

package/dist/auth/user-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-session.js","sourceRoot":"","sources":["../../src/auth/user-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsBnD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEpD,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,MAAM,EAAE,gBAAgB;IACxB,QAAQ,EAAE,OAAO;IACjB,WAAW,EAAE,YAAY;IACzB,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;IAC7B,WAAW,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;IACjD,KAAK,EAAE,aAAa;IACpB,UAAU,EAAE,OAAO;IACnB,WAAW,EAAE,uBAAuB;CACrC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAgB;IACvC,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,cAAc;IAC3B,KAAK,EAAE,EAAE;IACT,WAAW,EAAE,EAAE;IACf,KAAK,EAAE,EAAE;IACT,UAAU,EAAE,OAAO;IACnB,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,UAA8B,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,CAAC,cAAc,KAAK,GAAG,EAAE,CAAC;QAChE,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAA8B,EAAE;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,QAAQ,IAAI,cAAc,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoB,EACpB,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC;IACzB,OAAO,QAAQ,CAAC,eAAe,CAAC;IAChC,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IACzC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7B,OAAO,QAAQ,CAAC,OAAO,CAAC;IACxB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAA8B,EAAE;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC;IACrB,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB;IACxC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC1E,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAAsB;IACjE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAChE,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3B,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK;QAC5E,CAAC,CAAC,IAAI,CAAC,UAAU;QACjB,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO;QACL,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAC9B,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC;QAC1C,KAAK;QACL,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,UAAU;QACV,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAoB;IACxC,OAAO;QACL,GAAG,OAAO;QACV,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;QACzB,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAsB;IAC9C,OAAO,QAAQ,CAAC,IAAI,CAAC;IACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,aAAa;YAAE,OAAO,aAAa,CAAC,IAAI,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAC,KAAqB;QACvB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtG,CAAC"}

package/dist/config/index.d.ts

@@ -0,0 +1,2 @@
+export * from './project-runtime.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC"}

package/dist/config/index.js

@@ -0,0 +1,2 @@
+export * from './project-runtime.js';
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC"}

package/dist/config/project-runtime.d.ts

@@ -0,0 +1,25 @@
+import { type EapProjectConfig } from '../schema/project-config.js';
+export declare class ProjectRuntimeConfigError extends Error {
+    readonly path: string;
+    constructor(message: string, path: string);
+}
+export interface LoadProjectRuntimeConfigOptions {
+    root: string;
+}
+export interface LoadedProjectRuntimeConfig {
+    root: string;
+    path: string;
+    config: EapProjectConfig;
+}
+export interface ResolveProjectRuntimeEnvironmentOptions extends LoadProjectRuntimeConfigOptions {
+    preinstallRoot: string;
+    env?: NodeJS.ProcessEnv;
+    loginToken?: string;
+}
+export interface ResolvedProjectRuntimeEnvironment extends LoadedProjectRuntimeConfig {
+    environment: Record<string, string>;
+}
+export declare function loadProjectRuntimeConfig(options: LoadProjectRuntimeConfigOptions): LoadedProjectRuntimeConfig;
+export declare function resolveProjectRuntimeEnvironment(options: ResolveProjectRuntimeEnvironmentOptions): ResolvedProjectRuntimeEnvironment;
+export declare function applyProjectRuntimeEnvironment(options: ResolveProjectRuntimeEnvironmentOptions): ResolvedProjectRuntimeEnvironment;
+//# sourceMappingURL=project-runtime.d.ts.map

package/dist/config/project-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../../src/config/project-runtime.ts"],"names":[],"mappings":"AAIA,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAI5F,qBAAa,yBAA0B,SAAQ,KAAK;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAtC,OAAO,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,uCAAwC,SAAQ,+BAA+B;IAC9F,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iCAAkC,SAAQ,0BAA0B;IACnF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,+BAA+B,GACvC,0BAA0B,CAwB5B;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,uCAAuC,GAC/C,iCAAiC,CAmCnC;AAMD,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,uCAAuC,GAC/C,iCAAiC,CAKnC"}