@nextclaw/app-runtime 0.14.1 → 0.16.0

package/dist/services/app-permissions.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-permissions.service.js","names":[],"sources":["../../src/services/app-permissions.service.ts"],"sourcesContent":["import { access } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type {\n  AppDocumentAccessScope,\n  AppManifestBundle,\n} from \"#app-runtime/types/app-manifest.types.js\";\nimport { isAppStandaloneManifestBundle } from \"#app-runtime/types/app-manifest.types.js\";\nimport type {\n  AppDocumentGrantMap,\n  AppPermissionSummary,\n  ResolvedDocumentGrant,\n  ResolvedPermissions,\n} from \"#app-runtime/types/app-permissions.types.js\";\n\nexport class AppPermissionsService {\n  resolve = async (\n    bundle: AppManifestBundle,\n    documentGrantMap: AppDocumentGrantMap,\n    context?: {\n      appId?: string;\n    },\n  ): Promise<ResolvedPermissions> => {\n    if (!isAppStandaloneManifestBundle(bundle)) {\n      throw new Error(\"schema v2 组合包权限由 Panel/Service runtime grant 管理。\");\n    }\n    const requestedPermissions = bundle.manifest.permissions ?? {};\n    const documentAccess =\n      requestedPermissions.documentAccess === undefined\n        ? []\n        : await Promise.all(\n            requestedPermissions.documentAccess.map((scope) =>\n              this.resolveDocumentGrant(scope, documentGrantMap, context?.appId),\n            ),\n          );\n\n    return {\n      documentAccess,\n      allowedDomains: requestedPermissions.allowedDomains ?? [],\n      storage: {\n        enabled: requestedPermissions.storage !== undefined && requestedPermissions.storage !== false,\n        namespace:\n          typeof requestedPermissions.storage === \"object\"\n            ? requestedPermissions.storage.namespace\n            : undefined,\n      },\n      capabilities: {\n        hostBridge: requestedPermissions.capabilities?.hostBridge !== false,\n      },\n    };\n  };\n\n  summarize = (\n    bundle: AppManifestBundle,\n    permissions: ResolvedPermissions,\n  ): AppPermissionSummary => {\n    if (!isAppStandaloneManifestBundle(bundle)) {\n      throw new Error(\"schema v2 组合包权限由 Panel/Service runtime grant 管理。\");\n    }\n    return {\n      requested: bundle.manifest.permissions ?? {},\n      documentAccess: permissions.documentAccess,\n      allowedDomains: permissions.allowedDomains,\n      storage: permissions.storage,\n      capabilities: permissions.capabilities,\n    };\n  };\n\n  private resolveDocumentGrant = async (\n    scope: AppDocumentAccessScope,\n    documentGrantMap: AppDocumentGrantMap,\n    appId?: string,\n  ): Promise<ResolvedDocumentGrant> => {\n    const grantedPath = documentGrantMap[scope.id];\n    if (!grantedPath) {\n      if (appId) {\n        throw new Error(\n          `缺少 documentAccess 授权：${scope.id}。请先执行 napp grant ${appId} --document ${scope.id}=/absolute/path`,\n        );\n      }\n      throw new Error(\n        `缺少 documentAccess 授权：${scope.id}。请通过 --document ${scope.id}=/absolute/path 提供授权。`,\n      );\n    }\n    const normalizedPath = path.resolve(grantedPath);\n    try {\n      await access(normalizedPath);\n    } catch {\n      throw new Error(`documentAccess 授权路径不存在：${scope.id} -> ${normalizedPath}`);\n    }\n    return {\n      id: scope.id,\n      mode: scope.mode,\n      description: scope.description,\n      path: normalizedPath,\n    };\n  };\n}\n"],"mappings":";;;;AAcA,IAAa,wBAAb,MAAmC;CACjC,UAAU,OACR,QACA,kBACA,YAGiC;AACjC,MAAI,CAAC,8BAA8B,OAAO,CACxC,OAAM,IAAI,MAAM,mDAAmD;EAErE,MAAM,uBAAuB,OAAO,SAAS,eAAe,EAAE;AAU9D,SAAO;GACL,gBATA,qBAAqB,mBAAmB,KAAA,IACpC,EAAE,GACF,MAAM,QAAQ,IACZ,qBAAqB,eAAe,KAAK,UACvC,KAAK,qBAAqB,OAAO,kBAAkB,SAAS,MAAM,CACnE,CACF;GAIL,gBAAgB,qBAAqB,kBAAkB,EAAE;GACzD,SAAS;IACP,SAAS,qBAAqB,YAAY,KAAA,KAAa,qBAAqB,YAAY;IACxF,WACE,OAAO,qBAAqB,YAAY,WACpC,qBAAqB,QAAQ,YAC7B,KAAA;IACP;GACD,cAAc,EACZ,YAAY,qBAAqB,cAAc,eAAe,OAC/D;GACF;;CAGH,aACE,QACA,gBACyB;AACzB,MAAI,CAAC,8BAA8B,OAAO,CACxC,OAAM,IAAI,MAAM,mDAAmD;AAErE,SAAO;GACL,WAAW,OAAO,SAAS,eAAe,EAAE;GAC5C,gBAAgB,YAAY;GAC5B,gBAAgB,YAAY;GAC5B,SAAS,YAAY;GACrB,cAAc,YAAY;GAC3B;;CAGH,uBAA+B,OAC7B,OACA,kBACA,UACmC;EACnC,MAAM,cAAc,iBAAiB,MAAM;AAC3C,MAAI,CAAC,aAAa;AAChB,OAAI,MACF,OAAM,IAAI,MACR,wBAAwB,MAAM,GAAG,mBAAmB,MAAM,cAAc,MAAM,GAAG,iBAClF;AAEH,SAAM,IAAI,MACR,wBAAwB,MAAM,GAAG,kBAAkB,MAAM,GAAG,uBAC7D;;EAEH,MAAM,iBAAiB,KAAK,QAAQ,YAAY;AAChD,MAAI;AACF,SAAM,OAAO,eAAe;UACtB;AACN,SAAM,IAAI,MAAM,0BAA0B,MAAM,GAAG,MAAM,iBAAiB;;AAE5E,SAAO;GACL,IAAI,MAAM;GACV,MAAM,MAAM;GACZ,aAAa,MAAM;GACnB,MAAM;GACP"}
+{"version":3,"file":"app-permissions.service.js","names":[],"sources":["../../src/services/app-permissions.service.ts"],"sourcesContent":["import { access } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type {\n  AppDocumentAccessScope,\n  AppManifestBundle,\n} from \"#app-runtime/types/app-manifest.types.js\";\nimport type {\n  AppDocumentGrantMap,\n  AppPermissionSummary,\n  ResolvedDocumentGrant,\n  ResolvedPermissions,\n} from \"#app-runtime/types/app-permissions.types.js\";\n\nexport class AppPermissionsService {\n  resolve = async (\n    bundle: AppManifestBundle,\n    documentGrantMap: AppDocumentGrantMap,\n    context?: {\n      appId?: string;\n    },\n  ): Promise<ResolvedPermissions> => {\n    const requestedPermissions = bundle.manifest.permissions ?? {};\n    const documentAccess =\n      requestedPermissions.documentAccess === undefined\n        ? []\n        : await Promise.all(\n            requestedPermissions.documentAccess.map((scope) =>\n              this.resolveDocumentGrant(\n                scope,\n                documentGrantMap,\n                context?.appId,\n              ),\n            ),\n          );\n\n    return {\n      documentAccess,\n      allowedDomains: requestedPermissions.allowedDomains ?? [],\n      storage: {\n        enabled:\n          requestedPermissions.storage !== undefined &&\n          requestedPermissions.storage !== false,\n        namespace:\n          typeof requestedPermissions.storage === \"object\"\n            ? requestedPermissions.storage.namespace\n            : undefined,\n      },\n      capabilities: {\n        hostBridge: requestedPermissions.capabilities?.hostBridge !== false,\n      },\n    };\n  };\n\n  summarize = (\n    bundle: AppManifestBundle,\n    permissions: ResolvedPermissions,\n  ): AppPermissionSummary => {\n    return {\n      requested: bundle.manifest.permissions ?? {},\n      documentAccess: permissions.documentAccess,\n      allowedDomains: permissions.allowedDomains,\n      storage: permissions.storage,\n      capabilities: permissions.capabilities,\n    };\n  };\n\n  private resolveDocumentGrant = async (\n    scope: AppDocumentAccessScope,\n    documentGrantMap: AppDocumentGrantMap,\n    appId?: string,\n  ): Promise<ResolvedDocumentGrant> => {\n    const grantedPath = documentGrantMap[scope.id];\n    if (!grantedPath) {\n      if (appId) {\n        throw new Error(\n          `缺少 documentAccess 授权：${scope.id}。请先执行 napp grant ${appId} --document ${scope.id}=/absolute/path`,\n        );\n      }\n      throw new Error(\n        `缺少 documentAccess 授权：${scope.id}。请通过 --document ${scope.id}=/absolute/path 提供授权。`,\n      );\n    }\n    const normalizedPath = path.resolve(grantedPath);\n    try {\n      await access(normalizedPath);\n    } catch {\n      throw new Error(\n        `documentAccess 授权路径不存在：${scope.id} -> ${normalizedPath}`,\n      );\n    }\n    return {\n      id: scope.id,\n      mode: scope.mode,\n      description: scope.description,\n      path: normalizedPath,\n    };\n  };\n}\n"],"mappings":";;;AAaA,IAAa,wBAAb,MAAmC;CACjC,UAAU,OACR,QACA,kBACA,YAGiC;EACjC,MAAM,uBAAuB,OAAO,SAAS,eAAe,EAAE;AAc9D,SAAO;GACL,gBAbA,qBAAqB,mBAAmB,KAAA,IACpC,EAAE,GACF,MAAM,QAAQ,IACZ,qBAAqB,eAAe,KAAK,UACvC,KAAK,qBACH,OACA,kBACA,SAAS,MACV,CACF,CACF;GAIL,gBAAgB,qBAAqB,kBAAkB,EAAE;GACzD,SAAS;IACP,SACE,qBAAqB,YAAY,KAAA,KACjC,qBAAqB,YAAY;IACnC,WACE,OAAO,qBAAqB,YAAY,WACpC,qBAAqB,QAAQ,YAC7B,KAAA;IACP;GACD,cAAc,EACZ,YAAY,qBAAqB,cAAc,eAAe,OAC/D;GACF;;CAGH,aACE,QACA,gBACyB;AACzB,SAAO;GACL,WAAW,OAAO,SAAS,eAAe,EAAE;GAC5C,gBAAgB,YAAY;GAC5B,gBAAgB,YAAY;GAC5B,SAAS,YAAY;GACrB,cAAc,YAAY;GAC3B;;CAGH,uBAA+B,OAC7B,OACA,kBACA,UACmC;EACnC,MAAM,cAAc,iBAAiB,MAAM;AAC3C,MAAI,CAAC,aAAa;AAChB,OAAI,MACF,OAAM,IAAI,MACR,wBAAwB,MAAM,GAAG,mBAAmB,MAAM,cAAc,MAAM,GAAG,iBAClF;AAEH,SAAM,IAAI,MACR,wBAAwB,MAAM,GAAG,kBAAkB,MAAM,GAAG,uBAC7D;;EAEH,MAAM,iBAAiB,KAAK,QAAQ,YAAY;AAChD,MAAI;AACF,SAAM,OAAO,eAAe;UACtB;AACN,SAAM,IAAI,MACR,0BAA0B,MAAM,GAAG,MAAM,iBAC1C;;AAEH,SAAO;GACL,IAAI,MAAM;GACV,MAAM,MAAM;GACZ,aAAa,MAAM;GACnB,MAAM;GACP"}

package/dist/services/app-registry-parser.service.js

@@ -0,0 +1,200 @@
+import { AppPlatformTargetService } from "./app-platform-target.service.js";
+import { AppInstanceStorageService } from "./app-instance-storage.service.js";
+import path from "node:path";
+//#region src/services/app-registry-parser.service.ts
+const SAFE_APP_ID_PATTERN = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;
+const SAFE_VERSION_PATTERN = /^[0-9A-Za-z]+(?:[._+-][0-9A-Za-z]+)*$/;
+const SAFE_COMPONENT_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const SAFE_SECRET_SLOT_ID_PATTERN = /^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/;
+var AppRegistryParserService = class {
+	instanceStorageService;
+	platformTargetService = new AppPlatformTargetService();
+	constructor(appHomeService) {
+		this.appHomeService = appHomeService;
+		this.instanceStorageService = new AppInstanceStorageService(appHomeService);
+	}
+	parse = (rawRegistry) => {
+		const candidate = this.assertRecord(rawRegistry, "registry.json");
+		if (candidate.schemaVersion !== 1) throw new Error("当前只支持 registry schemaVersion = 1。");
+		const rawApps = this.assertRecord(candidate.apps, "registry.apps");
+		const apps = {};
+		for (const [appId, rawApp] of Object.entries(rawApps)) {
+			if (!SAFE_APP_ID_PATTERN.test(appId)) throw new Error(`registry.apps 包含不安全的 appId：${appId}`);
+			const app = this.assertRecord(rawApp, `registry.apps.${appId}`);
+			const installedVersions = this.parseInstalledVersions(appId, app.installedVersions);
+			const activeVersion = this.requireString(app.activeVersion, `registry.apps.${appId}.activeVersion`);
+			if (!installedVersions[activeVersion]) throw new Error(`registry.apps.${appId} 缺少 activeVersion ${activeVersion}。`);
+			const dataDirectory = this.requireString(app.dataDirectory, `registry.apps.${appId}.dataDirectory`);
+			const firstInstalledAt = Object.values(installedVersions).map((version) => version.installedAt).filter((value) => typeof value === "string").sort()[0] ?? (/* @__PURE__ */ new Date(0)).toISOString();
+			const defaultInstance = this.parseDefaultInstance(app.defaultInstance, appId, dataDirectory, firstInstalledAt);
+			apps[appId] = {
+				...app,
+				appId,
+				publisher: app.publisher ?? installedVersions[activeVersion]?.publisher,
+				enabled: typeof app.enabled === "boolean" ? app.enabled : true,
+				activeVersion,
+				dataDirectory: defaultInstance.storage.dataDirectory,
+				defaultInstance,
+				installedVersions,
+				grants: app.grants && typeof app.grants === "object" ? app.grants : {},
+				secretBindings: this.parseSecretBindings(app.secretBindings, `registry.apps.${appId}.secretBindings`)
+			};
+		}
+		return {
+			schemaVersion: 1,
+			apps,
+			suppressedBuiltIns: candidate.suppressedBuiltIns && typeof candidate.suppressedBuiltIns === "object" && !Array.isArray(candidate.suppressedBuiltIns) ? Object.fromEntries(Object.entries(candidate.suppressedBuiltIns).flatMap(([appId, raw]) => {
+				if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
+				const suppressedAt = raw.suppressedAt;
+				return typeof suppressedAt === "string" ? [[appId, { suppressedAt }]] : [];
+			})) : {}
+		};
+	};
+	parseSecretSlotId = (slotId, field) => {
+		if (!SAFE_SECRET_SLOT_ID_PATTERN.test(slotId)) throw new Error(`${field} 必须是稳定的 lowercase slot id。`);
+		return slotId;
+	};
+	parseSecretBinding = (rawBinding, field) => {
+		const binding = this.assertRecord(rawBinding, field);
+		if (Object.prototype.hasOwnProperty.call(binding, "value")) throw new Error(`${field} 不能保存 Secret 明文。`);
+		if (Object.keys(binding).find((key) => ![
+			"source",
+			"provider",
+			"id"
+		].includes(key))) throw new Error(`${field} 只允许保存 source、provider 和 id。`);
+		const source = this.requireString(binding.source, `${field}.source`);
+		if (source !== "env" && source !== "file" && source !== "exec") throw new Error(`${field}.source 只支持 env、file 或 exec。`);
+		return {
+			source,
+			provider: binding.provider === void 0 ? void 0 : this.requireString(binding.provider, `${field}.provider`),
+			id: this.requireString(binding.id, `${field}.id`)
+		};
+	};
+	retainDeclaredSecretBindings = (bindings, permissions) => {
+		const declared = new Set((permissions.secrets ?? []).map((slot) => slot.id));
+		return Object.fromEntries(Object.entries(bindings).filter(([slotId]) => declared.has(slotId)));
+	};
+	parseInstalledVersions = (appId, raw) => {
+		const installedVersions = {};
+		const rawVersions = this.assertRecord(raw, `registry.apps.${appId}.installedVersions`);
+		for (const [version, rawVersion] of Object.entries(rawVersions)) {
+			if (!SAFE_VERSION_PATTERN.test(version)) throw new Error(`registry.apps.${appId} 包含不安全的版本：${version}`);
+			const field = `registry.apps.${appId}.installedVersions.${version}`;
+			const versionRecord = this.assertRecord(rawVersion, field);
+			const installDirectory = this.requireString(versionRecord.installDirectory, `${field}.installDirectory`);
+			this.assertExactPath(installDirectory, this.appHomeService.getInstallDirectory(appId, version), `${field}.installDirectory`);
+			installedVersions[version] = {
+				...versionRecord,
+				version,
+				installDirectory: path.resolve(installDirectory),
+				manifestSchemaVersion: versionRecord.manifestSchemaVersion === 2 ? 2 : 1,
+				target: versionRecord.target === void 0 ? void 0 : this.platformTargetService.parseArtifactTarget(versionRecord.target, `${field}.target`),
+				components: this.parseComponents(versionRecord.components, installDirectory, `${field}.components`),
+				dataSchemaVersion: typeof versionRecord.dataSchemaVersion === "number" && Number.isSafeInteger(versionRecord.dataSchemaVersion) && versionRecord.dataSchemaVersion > 0 ? versionRecord.dataSchemaVersion : 1
+			};
+		}
+		return installedVersions;
+	};
+	parseDefaultInstance = (raw, appId, dataDirectory, createdAt) => {
+		if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+			this.assertExactPath(dataDirectory, this.appHomeService.getAppDataDirectory(appId), `registry.apps.${appId}.dataDirectory`);
+			return this.instanceStorageService.buildLegacyDefaultInstance({
+				appId,
+				dataDirectory,
+				createdAt
+			});
+		}
+		const instance = raw;
+		if (instance.id !== "default" || !instance.storage || typeof instance.storage !== "object" || instance.storage.layout !== "legacy" && instance.storage.layout !== "instance-v1") throw new Error(`registry.apps.${appId}.defaultInstance 无效。`);
+		if (instance.publisherId !== void 0 && typeof instance.publisherId !== "string") throw new Error(`registry.apps.${appId}.defaultInstance.publisherId 无效。`);
+		const dataSchemaVersion = typeof instance.dataSchemaVersion === "number" && Number.isSafeInteger(instance.dataSchemaVersion) && instance.dataSchemaVersion > 0 ? instance.dataSchemaVersion : 1;
+		const instanceCreatedAt = typeof instance.createdAt === "string" ? instance.createdAt : createdAt;
+		const instanceDirectory = path.resolve(this.appHomeService.getAppInstanceDirectory(appId, "default"));
+		const expectedStorage = {
+			layout: "instance-v1",
+			layoutVersion: 1,
+			instanceId: "default",
+			instanceDirectory,
+			dataDirectory: path.join(instanceDirectory, "data"),
+			configDirectory: path.join(instanceDirectory, "config"),
+			stateDirectory: path.join(instanceDirectory, "state"),
+			cacheDirectory: path.join(instanceDirectory, "cache"),
+			temporaryDirectory: path.join(instanceDirectory, "tmp"),
+			logsDirectory: path.join(instanceDirectory, "logs")
+		};
+		if (instance.storage.layout === "legacy") {
+			const legacy = this.appHomeService.getAppDataDirectory(appId);
+			this.assertExactPath(dataDirectory, legacy, `registry.apps.${appId}.dataDirectory`);
+			return {
+				id: "default",
+				publisherId: instance.publisherId,
+				storage: {
+					...expectedStorage,
+					layout: "legacy",
+					dataDirectory: path.resolve(legacy)
+				},
+				dataSchemaVersion,
+				createdAt: instanceCreatedAt,
+				migratedAt: instance.migratedAt,
+				legacyDataDirectory: path.resolve(legacy)
+			};
+		}
+		for (const [field, expectedPath] of Object.entries(expectedStorage).filter(([key]) => key.endsWith("Directory"))) this.assertExactPath(instance.storage[field], expectedPath, `registry.apps.${appId}.defaultInstance.storage.${field}`);
+		this.assertExactPath(dataDirectory, expectedStorage.dataDirectory, `registry.apps.${appId}.dataDirectory`);
+		return {
+			id: "default",
+			publisherId: instance.publisherId,
+			storage: expectedStorage,
+			dataSchemaVersion,
+			createdAt: instanceCreatedAt,
+			migratedAt: instance.migratedAt,
+			legacyDataDirectory: instance.legacyDataDirectory
+		};
+	};
+	parseSecretBindings = (raw, field) => {
+		if (raw === void 0) return {};
+		return Object.fromEntries(Object.entries(this.assertRecord(raw, field)).map(([slotId, binding]) => {
+			const normalized = this.parseSecretSlotId(slotId, `${field} slot id`);
+			return [normalized, this.parseSecretBinding(binding, `${field}.${normalized}`)];
+		}));
+	};
+	parseComponents = (raw, installDirectory, field) => {
+		if (raw === void 0) return void 0;
+		if (!Array.isArray(raw)) throw new Error(`${field} 必须是数组。`);
+		return raw.map((item, index) => {
+			const component = this.assertRecord(item, `${field}[${index}]`);
+			if (component.kind !== "panel" && component.kind !== "service") throw new Error(`${field}[${index}].kind 无效。`);
+			const id = this.requireString(component.id, `${field}[${index}].id`);
+			if (!SAFE_COMPONENT_ID_PATTERN.test(id)) throw new Error(`${field}[${index}].id 不安全。`);
+			const relativePath = this.requireString(component.path, `${field}[${index}].path`);
+			const directory = path.resolve(installDirectory, relativePath);
+			const relative = path.relative(path.resolve(installDirectory), directory);
+			if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`${field}[${index}].path 必须位于版本目录内。`);
+			const manifestPath = path.join(directory, component.kind === "panel" ? "panel-app.json" : "service-app.json");
+			this.assertExactPath(component.componentDirectory, directory, `${field}[${index}].componentDirectory`);
+			this.assertExactPath(component.manifestPath, manifestPath, `${field}[${index}].manifestPath`);
+			return {
+				kind: component.kind,
+				id,
+				path: relativePath,
+				componentDirectory: directory,
+				manifestPath
+			};
+		});
+	};
+	assertExactPath = (actual, expected, field) => {
+		if (typeof actual !== "string" || path.resolve(actual) !== path.resolve(expected)) throw new Error(`${field} 必须位于受管路径 ${path.resolve(expected)}。`);
+	};
+	assertRecord = (value, field) => {
+		if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${field} 必须是对象。`);
+		return value;
+	};
+	requireString = (value, field) => {
+		if (typeof value !== "string" || !value.trim()) throw new Error(`${field} 必须是非空字符串。`);
+		return value;
+	};
+};
+//#endregion
+export { AppRegistryParserService };
+
+//# sourceMappingURL=app-registry-parser.service.js.map

package/dist/services/app-registry-parser.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-registry-parser.service.js","names":[],"sources":["../../src/services/app-registry-parser.service.ts"],"sourcesContent":["import path from \"node:path\";\nimport type { AppPermissions, AppResolvedComponent } from \"#app-runtime/types/app-manifest.types.js\";\nimport type { AppHomeService } from \"#app-runtime/services/app-home.service.js\";\nimport { AppInstanceStorageService } from \"#app-runtime/services/app-instance-storage.service.js\";\nimport { AppPlatformTargetService } from \"#app-runtime/services/app-platform-target.service.js\";\nimport type { AppInstanceRecord } from \"#app-runtime/types/app-storage.types.js\";\nimport type {\n  AppRegistry,\n  AppRegistryAppRecord,\n  AppRegistryInstalledVersion,\n  AppSecretBinding,\n  AppSecretBindingMap,\n} from \"#app-runtime/types/app-registry.types.js\";\n\nconst SAFE_APP_ID_PATTERN = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;\nconst SAFE_VERSION_PATTERN = /^[0-9A-Za-z]+(?:[._+-][0-9A-Za-z]+)*$/;\nconst SAFE_COMPONENT_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst SAFE_SECRET_SLOT_ID_PATTERN = /^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/;\n\nexport class AppRegistryParserService {\n  private readonly instanceStorageService: AppInstanceStorageService;\n  private readonly platformTargetService = new AppPlatformTargetService();\n\n  constructor(private readonly appHomeService: AppHomeService) {\n    this.instanceStorageService = new AppInstanceStorageService(appHomeService);\n  }\n\n  parse = (rawRegistry: unknown): AppRegistry => {\n    const candidate = this.assertRecord(rawRegistry, \"registry.json\");\n    if (candidate.schemaVersion !== 1) throw new Error(\"当前只支持 registry schemaVersion = 1。\");\n    const rawApps = this.assertRecord(candidate.apps, \"registry.apps\");\n    const apps: Record<string, AppRegistryAppRecord> = {};\n    for (const [appId, rawApp] of Object.entries(rawApps)) {\n      if (!SAFE_APP_ID_PATTERN.test(appId)) throw new Error(`registry.apps 包含不安全的 appId：${appId}`);\n      const app = this.assertRecord(rawApp, `registry.apps.${appId}`) as Partial<AppRegistryAppRecord>;\n      const installedVersions = this.parseInstalledVersions(appId, app.installedVersions);\n      const activeVersion = this.requireString(app.activeVersion, `registry.apps.${appId}.activeVersion`);\n      if (!installedVersions[activeVersion]) throw new Error(`registry.apps.${appId} 缺少 activeVersion ${activeVersion}。`);\n      const dataDirectory = this.requireString(app.dataDirectory, `registry.apps.${appId}.dataDirectory`);\n      const firstInstalledAt = Object.values(installedVersions)\n        .map((version) => version.installedAt)\n        .filter((value): value is string => typeof value === \"string\")\n        .sort()[0] ?? new Date(0).toISOString();\n      const defaultInstance = this.parseDefaultInstance(app.defaultInstance, appId, dataDirectory, firstInstalledAt);\n      apps[appId] = {\n        ...(app as AppRegistryAppRecord),\n        appId,\n        publisher: app.publisher ?? installedVersions[activeVersion]?.publisher,\n        enabled: typeof app.enabled === \"boolean\" ? app.enabled : true,\n        activeVersion,\n        dataDirectory: defaultInstance.storage.dataDirectory,\n        defaultInstance,\n        installedVersions,\n        grants: app.grants && typeof app.grants === \"object\" ? app.grants : {},\n        secretBindings: this.parseSecretBindings(app.secretBindings, `registry.apps.${appId}.secretBindings`),\n      };\n    }\n    const suppressedBuiltIns = candidate.suppressedBuiltIns &&\n      typeof candidate.suppressedBuiltIns === \"object\" && !Array.isArray(candidate.suppressedBuiltIns)\n      ? Object.fromEntries(Object.entries(candidate.suppressedBuiltIns).flatMap(([appId, raw]) => {\n          if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return [];\n          const suppressedAt = (raw as { suppressedAt?: unknown }).suppressedAt;\n          return typeof suppressedAt === \"string\" ? [[appId, { suppressedAt }]] : [];\n        }))\n      : {};\n    return { schemaVersion: 1, apps, suppressedBuiltIns };\n  };\n\n  parseSecretSlotId = (slotId: string, field: string): string => {\n    if (!SAFE_SECRET_SLOT_ID_PATTERN.test(slotId)) throw new Error(`${field} 必须是稳定的 lowercase slot id。`);\n    return slotId;\n  };\n\n  parseSecretBinding = (rawBinding: unknown, field: string): AppSecretBinding => {\n    const binding = this.assertRecord(rawBinding, field);\n    if (Object.prototype.hasOwnProperty.call(binding, \"value\")) throw new Error(`${field} 不能保存 Secret 明文。`);\n    const unsupportedField = Object.keys(binding).find((key) => ![\"source\", \"provider\", \"id\"].includes(key));\n    if (unsupportedField) throw new Error(`${field} 只允许保存 source、provider 和 id。`);\n    const source = this.requireString(binding.source, `${field}.source`);\n    if (source !== \"env\" && source !== \"file\" && source !== \"exec\") {\n      throw new Error(`${field}.source 只支持 env、file 或 exec。`);\n    }\n    return {\n      source,\n      provider: binding.provider === undefined ? undefined : this.requireString(binding.provider, `${field}.provider`),\n      id: this.requireString(binding.id, `${field}.id`),\n    };\n  };\n\n  retainDeclaredSecretBindings = (bindings: AppSecretBindingMap, permissions: AppPermissions): AppSecretBindingMap => {\n    const declared = new Set((permissions.secrets ?? []).map((slot) => slot.id));\n    return Object.fromEntries(Object.entries(bindings).filter(([slotId]) => declared.has(slotId)));\n  };\n\n  private parseInstalledVersions = (appId: string, raw: unknown): Record<string, AppRegistryInstalledVersion> => {\n    const installedVersions: Record<string, AppRegistryInstalledVersion> = {};\n    const rawVersions = this.assertRecord(raw, `registry.apps.${appId}.installedVersions`);\n    for (const [version, rawVersion] of Object.entries(rawVersions)) {\n      if (!SAFE_VERSION_PATTERN.test(version)) throw new Error(`registry.apps.${appId} 包含不安全的版本：${version}`);\n      const field = `registry.apps.${appId}.installedVersions.${version}`;\n      const versionRecord = this.assertRecord(rawVersion, field) as Partial<AppRegistryInstalledVersion>;\n      const installDirectory = this.requireString(versionRecord.installDirectory, `${field}.installDirectory`);\n      this.assertExactPath(installDirectory, this.appHomeService.getInstallDirectory(appId, version), `${field}.installDirectory`);\n      installedVersions[version] = {\n        ...(versionRecord as AppRegistryInstalledVersion),\n        version,\n        installDirectory: path.resolve(installDirectory),\n        manifestSchemaVersion: versionRecord.manifestSchemaVersion === 2 ? 2 : 1,\n        target: versionRecord.target === undefined ? undefined : this.platformTargetService.parseArtifactTarget(versionRecord.target, `${field}.target`),\n        components: this.parseComponents(versionRecord.components, installDirectory, `${field}.components`),\n        dataSchemaVersion: typeof versionRecord.dataSchemaVersion === \"number\" &&\n          Number.isSafeInteger(versionRecord.dataSchemaVersion) && versionRecord.dataSchemaVersion > 0\n          ? versionRecord.dataSchemaVersion : 1,\n      };\n    }\n    return installedVersions;\n  };\n\n  private parseDefaultInstance = (raw: unknown, appId: string, dataDirectory: string, createdAt: string): AppInstanceRecord => {\n    if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) {\n      this.assertExactPath(dataDirectory, this.appHomeService.getAppDataDirectory(appId), `registry.apps.${appId}.dataDirectory`);\n      return this.instanceStorageService.buildLegacyDefaultInstance({ appId, dataDirectory, createdAt });\n    }\n    const instance = raw as Partial<AppInstanceRecord>;\n    if (instance.id !== \"default\" || !instance.storage || typeof instance.storage !== \"object\" ||\n      (instance.storage.layout !== \"legacy\" && instance.storage.layout !== \"instance-v1\")) {\n      throw new Error(`registry.apps.${appId}.defaultInstance 无效。`);\n    }\n    if (instance.publisherId !== undefined && typeof instance.publisherId !== \"string\") {\n      throw new Error(`registry.apps.${appId}.defaultInstance.publisherId 无效。`);\n    }\n    const dataSchemaVersion = typeof instance.dataSchemaVersion === \"number\" && Number.isSafeInteger(instance.dataSchemaVersion) && instance.dataSchemaVersion > 0\n      ? instance.dataSchemaVersion : 1;\n    const instanceCreatedAt = typeof instance.createdAt === \"string\" ? instance.createdAt : createdAt;\n    const instanceDirectory = path.resolve(this.appHomeService.getAppInstanceDirectory(appId, \"default\"));\n    const expectedStorage = {\n      layout: \"instance-v1\" as const, layoutVersion: 1 as const, instanceId: \"default\", instanceDirectory,\n      dataDirectory: path.join(instanceDirectory, \"data\"), configDirectory: path.join(instanceDirectory, \"config\"),\n      stateDirectory: path.join(instanceDirectory, \"state\"), cacheDirectory: path.join(instanceDirectory, \"cache\"),\n      temporaryDirectory: path.join(instanceDirectory, \"tmp\"), logsDirectory: path.join(instanceDirectory, \"logs\"),\n    };\n    if (instance.storage.layout === \"legacy\") {\n      const legacy = this.appHomeService.getAppDataDirectory(appId);\n      this.assertExactPath(dataDirectory, legacy, `registry.apps.${appId}.dataDirectory`);\n      return { id: \"default\", publisherId: instance.publisherId, storage: { ...expectedStorage, layout: \"legacy\", dataDirectory: path.resolve(legacy) }, dataSchemaVersion, createdAt: instanceCreatedAt, migratedAt: instance.migratedAt, legacyDataDirectory: path.resolve(legacy) };\n    }\n    for (const [field, expectedPath] of Object.entries(expectedStorage).filter(([key]) => key.endsWith(\"Directory\"))) {\n      this.assertExactPath(instance.storage[field as keyof typeof instance.storage], expectedPath as string, `registry.apps.${appId}.defaultInstance.storage.${field}`);\n    }\n    this.assertExactPath(dataDirectory, expectedStorage.dataDirectory, `registry.apps.${appId}.dataDirectory`);\n    return { id: \"default\", publisherId: instance.publisherId, storage: expectedStorage, dataSchemaVersion, createdAt: instanceCreatedAt, migratedAt: instance.migratedAt, legacyDataDirectory: instance.legacyDataDirectory };\n  };\n\n  private parseSecretBindings = (raw: unknown, field: string): AppSecretBindingMap => {\n    if (raw === undefined) return {};\n    return Object.fromEntries(Object.entries(this.assertRecord(raw, field)).map(([slotId, binding]) => {\n      const normalized = this.parseSecretSlotId(slotId, `${field} slot id`);\n      return [normalized, this.parseSecretBinding(binding, `${field}.${normalized}`)];\n    }));\n  };\n\n  private parseComponents = (raw: unknown, installDirectory: string, field: string): AppResolvedComponent[] | undefined => {\n    if (raw === undefined) return undefined;\n    if (!Array.isArray(raw)) throw new Error(`${field} 必须是数组。`);\n    return raw.map((item, index) => {\n      const component = this.assertRecord(item, `${field}[${index}]`);\n      if (component.kind !== \"panel\" && component.kind !== \"service\") throw new Error(`${field}[${index}].kind 无效。`);\n      const id = this.requireString(component.id, `${field}[${index}].id`);\n      if (!SAFE_COMPONENT_ID_PATTERN.test(id)) throw new Error(`${field}[${index}].id 不安全。`);\n      const relativePath = this.requireString(component.path, `${field}[${index}].path`);\n      const directory = path.resolve(installDirectory, relativePath);\n      const relative = path.relative(path.resolve(installDirectory), directory);\n      if (!relative || relative.startsWith(\"..\") || path.isAbsolute(relative)) throw new Error(`${field}[${index}].path 必须位于版本目录内。`);\n      const manifestPath = path.join(directory, component.kind === \"panel\" ? \"panel-app.json\" : \"service-app.json\");\n      this.assertExactPath(component.componentDirectory, directory, `${field}[${index}].componentDirectory`);\n      this.assertExactPath(component.manifestPath, manifestPath, `${field}[${index}].manifestPath`);\n      return { kind: component.kind, id, path: relativePath, componentDirectory: directory, manifestPath };\n    });\n  };\n\n  private assertExactPath = (actual: unknown, expected: string, field: string): void => {\n    if (typeof actual !== \"string\" || path.resolve(actual) !== path.resolve(expected)) throw new Error(`${field} 必须位于受管路径 ${path.resolve(expected)}。`);\n  };\n\n  private assertRecord = (value: unknown, field: string): Record<string, unknown> => {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(`${field} 必须是对象。`);\n    return value as Record<string, unknown>;\n  };\n\n  private requireString = (value: unknown, field: string): string => {\n    if (typeof value !== \"string\" || !value.trim()) throw new Error(`${field} 必须是非空字符串。`);\n    return value;\n  };\n}\n"],"mappings":";;;;AAcA,MAAM,sBAAsB;AAC5B,MAAM,uBAAuB;AAC7B,MAAM,4BAA4B;AAClC,MAAM,8BAA8B;AAEpC,IAAa,2BAAb,MAAsC;CACpC;CACA,wBAAyC,IAAI,0BAA0B;CAEvE,YAAY,gBAAiD;AAAhC,OAAA,iBAAA;AAC3B,OAAK,yBAAyB,IAAI,0BAA0B,eAAe;;CAG7E,SAAS,gBAAsC;EAC7C,MAAM,YAAY,KAAK,aAAa,aAAa,gBAAgB;AACjE,MAAI,UAAU,kBAAkB,EAAG,OAAM,IAAI,MAAM,oCAAoC;EACvF,MAAM,UAAU,KAAK,aAAa,UAAU,MAAM,gBAAgB;EAClE,MAAM,OAA6C,EAAE;AACrD,OAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,QAAQ,EAAE;AACrD,OAAI,CAAC,oBAAoB,KAAK,MAAM,CAAE,OAAM,IAAI,MAAM,8BAA8B,QAAQ;GAC5F,MAAM,MAAM,KAAK,aAAa,QAAQ,iBAAiB,QAAQ;GAC/D,MAAM,oBAAoB,KAAK,uBAAuB,OAAO,IAAI,kBAAkB;GACnF,MAAM,gBAAgB,KAAK,cAAc,IAAI,eAAe,iBAAiB,MAAM,gBAAgB;AACnG,OAAI,CAAC,kBAAkB,eAAgB,OAAM,IAAI,MAAM,iBAAiB,MAAM,oBAAoB,cAAc,GAAG;GACnH,MAAM,gBAAgB,KAAK,cAAc,IAAI,eAAe,iBAAiB,MAAM,gBAAgB;GACnG,MAAM,mBAAmB,OAAO,OAAO,kBAAkB,CACtD,KAAK,YAAY,QAAQ,YAAY,CACrC,QAAQ,UAA2B,OAAO,UAAU,SAAS,CAC7D,MAAM,CAAC,uBAAM,IAAI,KAAK,EAAE,EAAC,aAAa;GACzC,MAAM,kBAAkB,KAAK,qBAAqB,IAAI,iBAAiB,OAAO,eAAe,iBAAiB;AAC9G,QAAK,SAAS;IACZ,GAAI;IACJ;IACA,WAAW,IAAI,aAAa,kBAAkB,gBAAgB;IAC9D,SAAS,OAAO,IAAI,YAAY,YAAY,IAAI,UAAU;IAC1D;IACA,eAAe,gBAAgB,QAAQ;IACvC;IACA;IACA,QAAQ,IAAI,UAAU,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,EAAE;IACtE,gBAAgB,KAAK,oBAAoB,IAAI,gBAAgB,iBAAiB,MAAM,iBAAiB;IACtG;;AAUH,SAAO;GAAE,eAAe;GAAG;GAAM,oBARN,UAAU,sBACnC,OAAO,UAAU,uBAAuB,YAAY,CAAC,MAAM,QAAQ,UAAU,mBAAmB,GAC9F,OAAO,YAAY,OAAO,QAAQ,UAAU,mBAAmB,CAAC,SAAS,CAAC,OAAO,SAAS;AACxF,QAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAE,QAAO,EAAE;IACpE,MAAM,eAAgB,IAAmC;AACzD,WAAO,OAAO,iBAAiB,WAAW,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,GAAG,EAAE;KAC1E,CAAC,GACH,EAAE;GAC+C;;CAGvD,qBAAqB,QAAgB,UAA0B;AAC7D,MAAI,CAAC,4BAA4B,KAAK,OAAO,CAAE,OAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;AACpG,SAAO;;CAGT,sBAAsB,YAAqB,UAAoC;EAC7E,MAAM,UAAU,KAAK,aAAa,YAAY,MAAM;AACpD,MAAI,OAAO,UAAU,eAAe,KAAK,SAAS,QAAQ,CAAE,OAAM,IAAI,MAAM,GAAG,MAAM,kBAAkB;AAEvG,MADyB,OAAO,KAAK,QAAQ,CAAC,MAAM,QAAQ,CAAC;GAAC;GAAU;GAAY;GAAK,CAAC,SAAS,IAAI,CAAC,CAClF,OAAM,IAAI,MAAM,GAAG,MAAM,8BAA8B;EAC7E,MAAM,SAAS,KAAK,cAAc,QAAQ,QAAQ,GAAG,MAAM,SAAS;AACpE,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,OACtD,OAAM,IAAI,MAAM,GAAG,MAAM,8BAA8B;AAEzD,SAAO;GACL;GACA,UAAU,QAAQ,aAAa,KAAA,IAAY,KAAA,IAAY,KAAK,cAAc,QAAQ,UAAU,GAAG,MAAM,WAAW;GAChH,IAAI,KAAK,cAAc,QAAQ,IAAI,GAAG,MAAM,KAAK;GAClD;;CAGH,gCAAgC,UAA+B,gBAAqD;EAClH,MAAM,WAAW,IAAI,KAAK,YAAY,WAAW,EAAE,EAAE,KAAK,SAAS,KAAK,GAAG,CAAC;AAC5E,SAAO,OAAO,YAAY,OAAO,QAAQ,SAAS,CAAC,QAAQ,CAAC,YAAY,SAAS,IAAI,OAAO,CAAC,CAAC;;CAGhG,0BAAkC,OAAe,QAA8D;EAC7G,MAAM,oBAAiE,EAAE;EACzE,MAAM,cAAc,KAAK,aAAa,KAAK,iBAAiB,MAAM,oBAAoB;AACtF,OAAK,MAAM,CAAC,SAAS,eAAe,OAAO,QAAQ,YAAY,EAAE;AAC/D,OAAI,CAAC,qBAAqB,KAAK,QAAQ,CAAE,OAAM,IAAI,MAAM,iBAAiB,MAAM,YAAY,UAAU;GACtG,MAAM,QAAQ,iBAAiB,MAAM,qBAAqB;GAC1D,MAAM,gBAAgB,KAAK,aAAa,YAAY,MAAM;GAC1D,MAAM,mBAAmB,KAAK,cAAc,cAAc,kBAAkB,GAAG,MAAM,mBAAmB;AACxG,QAAK,gBAAgB,kBAAkB,KAAK,eAAe,oBAAoB,OAAO,QAAQ,EAAE,GAAG,MAAM,mBAAmB;AAC5H,qBAAkB,WAAW;IAC3B,GAAI;IACJ;IACA,kBAAkB,KAAK,QAAQ,iBAAiB;IAChD,uBAAuB,cAAc,0BAA0B,IAAI,IAAI;IACvE,QAAQ,cAAc,WAAW,KAAA,IAAY,KAAA,IAAY,KAAK,sBAAsB,oBAAoB,cAAc,QAAQ,GAAG,MAAM,SAAS;IAChJ,YAAY,KAAK,gBAAgB,cAAc,YAAY,kBAAkB,GAAG,MAAM,aAAa;IACnG,mBAAmB,OAAO,cAAc,sBAAsB,YAC5D,OAAO,cAAc,cAAc,kBAAkB,IAAI,cAAc,oBAAoB,IACzF,cAAc,oBAAoB;IACvC;;AAEH,SAAO;;CAGT,wBAAgC,KAAc,OAAe,eAAuB,cAAyC;AAC3H,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,EAAE;AACzD,QAAK,gBAAgB,eAAe,KAAK,eAAe,oBAAoB,MAAM,EAAE,iBAAiB,MAAM,gBAAgB;AAC3H,UAAO,KAAK,uBAAuB,2BAA2B;IAAE;IAAO;IAAe;IAAW,CAAC;;EAEpG,MAAM,WAAW;AACjB,MAAI,SAAS,OAAO,aAAa,CAAC,SAAS,WAAW,OAAO,SAAS,YAAY,YAC/E,SAAS,QAAQ,WAAW,YAAY,SAAS,QAAQ,WAAW,cACrE,OAAM,IAAI,MAAM,iBAAiB,MAAM,sBAAsB;AAE/D,MAAI,SAAS,gBAAgB,KAAA,KAAa,OAAO,SAAS,gBAAgB,SACxE,OAAM,IAAI,MAAM,iBAAiB,MAAM,kCAAkC;EAE3E,MAAM,oBAAoB,OAAO,SAAS,sBAAsB,YAAY,OAAO,cAAc,SAAS,kBAAkB,IAAI,SAAS,oBAAoB,IACzJ,SAAS,oBAAoB;EACjC,MAAM,oBAAoB,OAAO,SAAS,cAAc,WAAW,SAAS,YAAY;EACxF,MAAM,oBAAoB,KAAK,QAAQ,KAAK,eAAe,wBAAwB,OAAO,UAAU,CAAC;EACrG,MAAM,kBAAkB;GACtB,QAAQ;GAAwB,eAAe;GAAY,YAAY;GAAW;GAClF,eAAe,KAAK,KAAK,mBAAmB,OAAO;GAAE,iBAAiB,KAAK,KAAK,mBAAmB,SAAS;GAC5G,gBAAgB,KAAK,KAAK,mBAAmB,QAAQ;GAAE,gBAAgB,KAAK,KAAK,mBAAmB,QAAQ;GAC5G,oBAAoB,KAAK,KAAK,mBAAmB,MAAM;GAAE,eAAe,KAAK,KAAK,mBAAmB,OAAO;GAC7G;AACD,MAAI,SAAS,QAAQ,WAAW,UAAU;GACxC,MAAM,SAAS,KAAK,eAAe,oBAAoB,MAAM;AAC7D,QAAK,gBAAgB,eAAe,QAAQ,iBAAiB,MAAM,gBAAgB;AACnF,UAAO;IAAE,IAAI;IAAW,aAAa,SAAS;IAAa,SAAS;KAAE,GAAG;KAAiB,QAAQ;KAAU,eAAe,KAAK,QAAQ,OAAO;KAAE;IAAE;IAAmB,WAAW;IAAmB,YAAY,SAAS;IAAY,qBAAqB,KAAK,QAAQ,OAAO;IAAE;;AAElR,OAAK,MAAM,CAAC,OAAO,iBAAiB,OAAO,QAAQ,gBAAgB,CAAC,QAAQ,CAAC,SAAS,IAAI,SAAS,YAAY,CAAC,CAC9G,MAAK,gBAAgB,SAAS,QAAQ,QAAyC,cAAwB,iBAAiB,MAAM,2BAA2B,QAAQ;AAEnK,OAAK,gBAAgB,eAAe,gBAAgB,eAAe,iBAAiB,MAAM,gBAAgB;AAC1G,SAAO;GAAE,IAAI;GAAW,aAAa,SAAS;GAAa,SAAS;GAAiB;GAAmB,WAAW;GAAmB,YAAY,SAAS;GAAY,qBAAqB,SAAS;GAAqB;;CAG5N,uBAA+B,KAAc,UAAuC;AAClF,MAAI,QAAQ,KAAA,EAAW,QAAO,EAAE;AAChC,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,aAAa,KAAK,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,aAAa;GACjG,MAAM,aAAa,KAAK,kBAAkB,QAAQ,GAAG,MAAM,UAAU;AACrE,UAAO,CAAC,YAAY,KAAK,mBAAmB,SAAS,GAAG,MAAM,GAAG,aAAa,CAAC;IAC/E,CAAC;;CAGL,mBAA2B,KAAc,kBAA0B,UAAsD;AACvH,MAAI,QAAQ,KAAA,EAAW,QAAO,KAAA;AAC9B,MAAI,CAAC,MAAM,QAAQ,IAAI,CAAE,OAAM,IAAI,MAAM,GAAG,MAAM,SAAS;AAC3D,SAAO,IAAI,KAAK,MAAM,UAAU;GAC9B,MAAM,YAAY,KAAK,aAAa,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG;AAC/D,OAAI,UAAU,SAAS,WAAW,UAAU,SAAS,UAAW,OAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,YAAY;GAC9G,MAAM,KAAK,KAAK,cAAc,UAAU,IAAI,GAAG,MAAM,GAAG,MAAM,MAAM;AACpE,OAAI,CAAC,0BAA0B,KAAK,GAAG,CAAE,OAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,WAAW;GACtF,MAAM,eAAe,KAAK,cAAc,UAAU,MAAM,GAAG,MAAM,GAAG,MAAM,QAAQ;GAClF,MAAM,YAAY,KAAK,QAAQ,kBAAkB,aAAa;GAC9D,MAAM,WAAW,KAAK,SAAS,KAAK,QAAQ,iBAAiB,EAAE,UAAU;AACzE,OAAI,CAAC,YAAY,SAAS,WAAW,KAAK,IAAI,KAAK,WAAW,SAAS,CAAE,OAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,mBAAmB;GAC9H,MAAM,eAAe,KAAK,KAAK,WAAW,UAAU,SAAS,UAAU,mBAAmB,mBAAmB;AAC7G,QAAK,gBAAgB,UAAU,oBAAoB,WAAW,GAAG,MAAM,GAAG,MAAM,sBAAsB;AACtG,QAAK,gBAAgB,UAAU,cAAc,cAAc,GAAG,MAAM,GAAG,MAAM,gBAAgB;AAC7F,UAAO;IAAE,MAAM,UAAU;IAAM;IAAI,MAAM;IAAc,oBAAoB;IAAW;IAAc;IACpG;;CAGJ,mBAA2B,QAAiB,UAAkB,UAAwB;AACpF,MAAI,OAAO,WAAW,YAAY,KAAK,QAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS,CAAE,OAAM,IAAI,MAAM,GAAG,MAAM,YAAY,KAAK,QAAQ,SAAS,CAAC,GAAG;;CAGpJ,gBAAwB,OAAgB,UAA2C;AACjF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAAE,OAAM,IAAI,MAAM,GAAG,MAAM,SAAS;AACnG,SAAO;;CAGT,iBAAyB,OAAgB,UAA0B;AACjE,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,MAAM,CAAE,OAAM,IAAI,MAAM,GAAG,MAAM,YAAY;AACrF,SAAO"}

package/dist/services/app-registry.service.d.ts

@@ -2,14 +2,13 @@ import { AppPermissions, AppPlatformSecuritySummary, AppResolvedComponent } from
 import { AppDocumentGrantMap } from "../types/app-permissions.types.js";
 import { AppHomeService } from "./app-home.service.js";
 import { AppInstanceRecord } from "../types/app-storage.types.js";
-import { AppInstallSourceKind, AppRegistry, AppRegistryAppRecord, AppRegistryInstalledVersion } from "../types/app-registry.types.js";
+import { AppInstallSourceKind, AppRegistry, AppRegistryAppRecord, AppRegistryInstalledVersion, AppSecretBinding } from "../types/app-registry.types.js";
 
 //#region src/services/app-registry.service.d.ts
 declare class AppRegistryService {
   private readonly appHomeService;
-  private readonly instanceStorageService;
   private readonly fileLockService;
-  private readonly platformTargetService;
+  private readonly parser;
   constructor(appHomeService?: AppHomeService);
   load: () => Promise<AppRegistry>;
   save: (registry: AppRegistry) => Promise<void>;
@@ -49,17 +48,13 @@ declare class AppRegistryService {
   updateGrants: (appId: string, grants: AppDocumentGrantMap) => Promise<AppRegistryAppRecord>;
   setDocumentGrant: (appId: string, scopeId: string, directoryPath: string) => Promise<AppRegistryAppRecord>;
   removeDocumentGrant: (appId: string, scopeId: string) => Promise<boolean>;
+  bindSecret: (appId: string, slotId: string, binding: AppSecretBinding) => Promise<AppRegistryAppRecord>;
+  unbindSecret: (appId: string, slotId: string) => Promise<boolean>;
   removeApp: (appId: string) => Promise<AppRegistryAppRecord | undefined>;
   isBuiltInSuppressed: (appId: string) => Promise<boolean>;
   setBuiltInSuppressed: (appId: string, suppressed: boolean) => Promise<void>;
   private updateApp;
   private withMutation;
-  private parseRegistry;
-  private parseDefaultInstance;
-  private assertExactPath;
-  private parseComponents;
-  private assertRecord;
-  private requireString;
   private isMissingFileError;
 }
 //#endregion

package/dist/services/app-registry.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-registry.service.d.ts","names":[],"sources":["../../src/services/app-registry.service.ts"],"mappings":";;;;;;;cAwBa,kBAAA;EAAA,iBAKkB,cAAA;EAAA,iBAJZ,sBAAA;EAAA,iBACA,eAAA;EAAA,iBACA,qBAAA;cAEY,cAAA,GAAgB,cAAA;EAI7C,IAAA,QAAiB,OAAA,CAAQ,WAAA;EAYzB,IAAA,GAAc,QAAA,EAAU,WAAA,KAAc,OAAA;EAAA,QAI9B,YAAA;EAsBR,QAAA,QAAqB,OAAA,CAAQ,oBAAA;EAK7B,MAAA,GAAgB,KAAA,aAAgB,OAAA,CAAQ,oBAAA;EAKxC,gBAAA,GAA0B,KAAA,aAAgB,OAAA,CAAQ,2BAAA;EAKlD,kBAAA,GAA4B,MAAA;IAC1B,KAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA;IACA,gBAAA;IACA,eAAA,EAAiB,iBAAA;IACjB,UAAA,EAAY,oBAAA;IACZ,SAAA;IACA,WAAA;IACA,gBAAA,GAAmB,2BAAA;IACnB,WAAA,EAAa,cAAA;IACb,WAAA;IACA,SAAA;IACA,MAAA;IACA,MAAA,GAAS,2BAAA;IACT,SAAA,GAAY,2BAAA;IACZ,qBAAA;IACA,UAAA,GAAa,oBAAA;IACb,cAAA;IACA,QAAA,GAAW,0BAAA;IACX,iBAAA;IACA,aAAA;IACA,OAAA;IACA,QAAA;EAAA,MACE,OAAA,CAAQ,oBAAA;EAqDZ,UAAA,GAAoB,KAAA,UAAe,OAAA,cAAmB,OAAA,CAAQ,oBAAA;EAI9D,eAAA,GACE,KAAA,UACA,OAAA,aACC,OAAA,CAAQ,oBAAA;EASX,uBAAA,GACE,KAAA,UACA,OAAA,UACA,aAAA,aACC,OAAA,CAAQ,oBAAA;EAmBX,YAAA,GACE,KAAA,UACA,MAAA,EAAQ,mBAAA,KACP,OAAA,CAAQ,oBAAA;EAOX,gBAAA,GACE,KAAA,UACA,OAAA,UACA,aAAA,aACC,OAAA,CAAQ,oBAAA;EAIX,mBAAA,GAA6B,KAAA,UAAe,OAAA,aAAkB,OAAA;EAc9D,SAAA,GAAmB,KAAA,aAAgB,OAAA,CAAQ,oBAAA;EAa3C,mBAAA,GAA6B,KAAA,aAAgB,OAAA;EAK7C,oBAAA,GAA8B,KAAA,UAAe,UAAA,cAAsB,OAAA;EAAA,QAY3D,SAAA;EAAA,QAiBA,YAAA;EAAA,QAKA,aAAA;EAAA,QAqGA,oBAAA;EAAA,QAyGA,eAAA;EAAA,QAMA,eAAA;EAAA,QA6DA,YAAA;EAAA,QAOA,aAAA;EAAA,QAOA,kBAAA;AAAA"}
+{"version":3,"file":"app-registry.service.d.ts","names":[],"sources":["../../src/services/app-registry.service.ts"],"mappings":";;;;;;;cAgBa,kBAAA;EAAA,iBAIkB,cAAA;EAAA,iBAHZ,eAAA;EAAA,iBACA,MAAA;cAEY,cAAA,GAAgB,cAAA;EAI7C,IAAA,QAAiB,OAAA,CAAQ,WAAA;EAYzB,IAAA,GAAc,QAAA,EAAU,WAAA,KAAc,OAAA;EAAA,QAI9B,YAAA;EAsBR,QAAA,QAAqB,OAAA,CAAQ,oBAAA;EAK7B,MAAA,GAAgB,KAAA,aAAgB,OAAA,CAAQ,oBAAA;EAKxC,gBAAA,GAA0B,KAAA,aAAgB,OAAA,CAAQ,2BAAA;EAKlD,kBAAA,GAA4B,MAAA;IAC1B,KAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA;IACA,gBAAA;IACA,eAAA,EAAiB,iBAAA;IACjB,UAAA,EAAY,oBAAA;IACZ,SAAA;IACA,WAAA;IACA,gBAAA,GAAmB,2BAAA;IACnB,WAAA,EAAa,cAAA;IACb,WAAA;IACA,SAAA;IACA,MAAA;IACA,MAAA,GAAS,2BAAA;IACT,SAAA,GAAY,2BAAA;IACZ,qBAAA;IACA,UAAA,GAAa,oBAAA;IACb,cAAA;IACA,QAAA,GAAW,0BAAA;IACX,iBAAA;IACA,aAAA;IACA,OAAA;IACA,QAAA;EAAA,MACE,OAAA,CAAQ,oBAAA;EAgEZ,UAAA,GAAoB,KAAA,UAAe,OAAA,cAAmB,OAAA,CAAQ,oBAAA;EAI9D,eAAA,GACE,KAAA,UACA,OAAA,aACC,OAAA,CAAQ,oBAAA;EAgBX,uBAAA,GACE,KAAA,UACA,OAAA,UACA,aAAA,aACC,OAAA,CAAQ,oBAAA;EAmBX,YAAA,GACE,KAAA,UACA,MAAA,EAAQ,mBAAA,KACP,OAAA,CAAQ,oBAAA;EAOX,gBAAA,GACE,KAAA,UACA,OAAA,UACA,aAAA,aACC,OAAA,CAAQ,oBAAA;EAIX,mBAAA,GAA6B,KAAA,UAAe,OAAA,aAAkB,OAAA;EAc9D,UAAA,GACE,KAAA,UACA,MAAA,UACA,OAAA,EAAS,gBAAA,KACR,OAAA,CAAQ,oBAAA;EAmBX,YAAA,GAAsB,KAAA,UAAe,MAAA,aAAiB,OAAA;EAetD,SAAA,GAAmB,KAAA,aAAgB,OAAA,CAAQ,oBAAA;EAa3C,mBAAA,GAA6B,KAAA,aAAgB,OAAA;EAK7C,oBAAA,GAA8B,KAAA,UAAe,UAAA,cAAsB,OAAA;EAAA,QAY3D,SAAA;EAAA,QAiBA,YAAA;EAAA,QAMA,kBAAA;AAAA"}

package/dist/services/app-registry.service.js

@@ -1,25 +1,20 @@
-import { AppPlatformTargetService } from "./app-platform-target.service.js";
 import { AppHomeService } from "./app-home.service.js";
 import { FileLockService } from "./file-lock.service.js";
-import { AppInstanceStorageService } from "./app-instance-storage.service.js";
+import { AppRegistryParserService } from "./app-registry-parser.service.js";
 import { open, readFile, rename, rm } from "node:fs/promises";
 import path from "node:path";
 //#region src/services/app-registry.service.ts
-const SAFE_APP_ID_PATTERN = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;
-const SAFE_VERSION_PATTERN = /^[0-9A-Za-z]+(?:[._+-][0-9A-Za-z]+)*$/;
-const SAFE_COMPONENT_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var AppRegistryService = class {
-	instanceStorageService;
 	fileLockService = new FileLockService();
-	platformTargetService = new AppPlatformTargetService();
+	parser;
 	constructor(appHomeService = new AppHomeService()) {
 		this.appHomeService = appHomeService;
-		this.instanceStorageService = new AppInstanceStorageService(appHomeService);
+		this.parser = new AppRegistryParserService(appHomeService);
 	}
 	load = async () => {
 		try {
 			const raw = await readFile(this.appHomeService.getRegistryPath(), "utf-8");
-			return this.parseRegistry(JSON.parse(raw));
+			return this.parser.parse(JSON.parse(raw));
 		} catch (error) {
 			if (this.isMissingFileError(error)) return {
 				schemaVersion: 1,
@@ -67,12 +62,14 @@ var AppRegistryService = class {
 			const currentRecord = registry.apps[params.appId];
 			const currentPublisher = currentRecord?.publisher ?? currentRecord?.installedVersions[currentRecord.activeVersion]?.publisher;
 			if (currentPublisher && currentPublisher.id !== params.publisher?.id) throw new Error(`应用 ${params.appId} 已绑定发布者 ${currentPublisher.id}，拒绝由 ${params.publisher?.id ?? "未验证本地来源"} 覆盖。`);
+			const activeVersion = params.activate === false && currentRecord ? currentRecord.activeVersion : params.version;
+			const activePermissions = activeVersion === params.version ? params.permissions : currentRecord?.installedVersions[activeVersion]?.permissions ?? {};
 			const nextRecord = {
 				appId: params.appId,
 				name: params.name,
 				description: params.description,
 				publisher: currentPublisher ?? params.publisher,
-				activeVersion: params.activate === false && currentRecord ? currentRecord.activeVersion : params.version,
+				activeVersion,
 				enabled: params.enabled ?? currentRecord?.enabled ?? params.manifestSchemaVersion === 1,
 				dataDirectory: params.defaultInstance.storage.dataDirectory,
 				defaultInstance: params.defaultInstance,
@@ -99,7 +96,8 @@ var AppRegistryService = class {
 						contentSha256: params.contentSha256
 					}
 				},
-				grants: currentRecord?.grants ?? {}
+				grants: currentRecord?.grants ?? {},
+				secretBindings: this.parser.retainDeclaredSecretBindings(currentRecord?.secretBindings ?? {}, activePermissions)
 			};
 			registry.apps[params.appId] = nextRecord;
 			await this.saveUnlocked(registry);
@@ -117,7 +115,8 @@ var AppRegistryService = class {
 			if (!record.installedVersions[version]) throw new Error(`应用 ${appId} 未安装版本 ${version}。`);
 			return {
 				...record,
-				activeVersion: version
+				activeVersion: version,
+				secretBindings: this.parser.retainDeclaredSecretBindings(record.secretBindings, record.installedVersions[version].permissions)
 			};
 		});
 	};
@@ -164,6 +163,35 @@ var AppRegistryService = class {
 		});
 		return removed;
 	};
+	bindSecret = async (appId, slotId, binding) => {
+		const normalizedSlotId = this.parser.parseSecretSlotId(slotId, "secret slot id");
+		const normalizedBinding = this.parser.parseSecretBinding(binding, `secret binding ${normalizedSlotId}`);
+		return await this.updateApp(appId, (record) => {
+			if (!(record.installedVersions[record.activeVersion]?.permissions.secrets ?? []).some((slot) => slot.id === normalizedSlotId)) throw new Error(`应用 ${appId} 未声明 Secret slot：${normalizedSlotId}`);
+			return {
+				...record,
+				secretBindings: {
+					...record.secretBindings,
+					[normalizedSlotId]: normalizedBinding
+				}
+			};
+		});
+	};
+	unbindSecret = async (appId, slotId) => {
+		const normalizedSlotId = this.parser.parseSecretSlotId(slotId, "secret slot id");
+		let removed = false;
+		await this.updateApp(appId, (record) => {
+			if (!(normalizedSlotId in record.secretBindings)) return record;
+			const secretBindings = { ...record.secretBindings };
+			delete secretBindings[normalizedSlotId];
+			removed = true;
+			return {
+				...record,
+				secretBindings
+			};
+		});
+		return removed;
+	};
 	removeApp = async (appId) => {
 		return await this.withMutation(async () => {
 			const registry = await this.load();
@@ -201,158 +229,6 @@ var AppRegistryService = class {
 		const registryPath = path.resolve(this.appHomeService.getRegistryPath());
 		return await this.fileLockService.withLock(`${registryPath}.lock`, operation);
 	};
-	parseRegistry = (rawRegistry) => {
-		const candidate = this.assertRecord(rawRegistry, "registry.json");
-		if (candidate.schemaVersion !== 1) throw new Error("当前只支持 registry schemaVersion = 1。");
-		const rawApps = this.assertRecord(candidate.apps, "registry.apps");
-		const apps = {};
-		for (const [appId, rawApp] of Object.entries(rawApps)) {
-			if (!SAFE_APP_ID_PATTERN.test(appId)) throw new Error(`registry.apps 包含不安全的 appId：${appId}`);
-			const app = this.assertRecord(rawApp, `registry.apps.${appId}`);
-			const installedVersions = {};
-			const rawVersions = this.assertRecord(app.installedVersions, `registry.apps.${appId}.installedVersions`);
-			for (const [version, rawVersion] of Object.entries(rawVersions)) {
-				if (!SAFE_VERSION_PATTERN.test(version)) throw new Error(`registry.apps.${appId} 包含不安全的版本：${version}`);
-				const versionRecord = this.assertRecord(rawVersion, `registry.apps.${appId}.installedVersions.${version}`);
-				const installDirectory = this.requireString(versionRecord.installDirectory, `registry.apps.${appId}.installedVersions.${version}.installDirectory`);
-				this.assertExactPath(installDirectory, this.appHomeService.getInstallDirectory(appId, version), `registry.apps.${appId}.installedVersions.${version}.installDirectory`);
-				installedVersions[version] = {
-					...versionRecord,
-					version,
-					installDirectory: path.resolve(installDirectory),
-					manifestSchemaVersion: versionRecord.manifestSchemaVersion === 2 ? 2 : 1,
-					target: versionRecord.target === void 0 ? void 0 : this.platformTargetService.parseArtifactTarget(versionRecord.target, `registry.apps.${appId}.installedVersions.${version}.target`),
-					components: this.parseComponents(versionRecord.components, installDirectory, `registry.apps.${appId}.installedVersions.${version}.components`),
-					dataSchemaVersion: typeof versionRecord.dataSchemaVersion === "number" && Number.isSafeInteger(versionRecord.dataSchemaVersion) && versionRecord.dataSchemaVersion > 0 ? versionRecord.dataSchemaVersion : 1
-				};
-			}
-			const activeVersion = this.requireString(app.activeVersion, `registry.apps.${appId}.activeVersion`);
-			if (!installedVersions[activeVersion]) throw new Error(`registry.apps.${appId} 缺少 activeVersion ${activeVersion}。`);
-			const dataDirectory = this.requireString(app.dataDirectory, `registry.apps.${appId}.dataDirectory`);
-			const firstInstalledAt = Object.values(installedVersions).map((version) => version.installedAt).filter((value) => typeof value === "string").sort()[0] ?? (/* @__PURE__ */ new Date(0)).toISOString();
-			const defaultInstance = this.parseDefaultInstance(app.defaultInstance, appId, dataDirectory, firstInstalledAt);
-			apps[appId] = {
-				...app,
-				appId,
-				publisher: app.publisher ?? installedVersions[activeVersion]?.publisher,
-				enabled: typeof app.enabled === "boolean" ? app.enabled : true,
-				activeVersion,
-				dataDirectory: defaultInstance.storage.dataDirectory,
-				defaultInstance,
-				installedVersions,
-				grants: app.grants && typeof app.grants === "object" ? app.grants : {}
-			};
-		}
-		return {
-			schemaVersion: 1,
-			apps,
-			suppressedBuiltIns: candidate.suppressedBuiltIns && typeof candidate.suppressedBuiltIns === "object" && !Array.isArray(candidate.suppressedBuiltIns) ? Object.fromEntries(Object.entries(candidate.suppressedBuiltIns).flatMap(([appId, raw]) => {
-				if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
-				const suppressedAt = raw.suppressedAt;
-				return typeof suppressedAt === "string" ? [[appId, { suppressedAt }]] : [];
-			})) : {}
-		};
-	};
-	parseDefaultInstance = (rawInstance, appId, dataDirectory, createdAt) => {
-		if (!rawInstance || typeof rawInstance !== "object" || Array.isArray(rawInstance)) {
-			this.assertExactPath(dataDirectory, this.appHomeService.getAppDataDirectory(appId), `registry.apps.${appId}.dataDirectory`);
-			return this.instanceStorageService.buildLegacyDefaultInstance({
-				appId,
-				dataDirectory,
-				createdAt
-			});
-		}
-		const instance = rawInstance;
-		if (instance.id !== "default" || !instance.storage || typeof instance.storage !== "object" || instance.storage.layout !== "legacy" && instance.storage.layout !== "instance-v1") throw new Error(`registry.apps.${appId}.defaultInstance 无效。`);
-		if (instance.publisherId !== void 0 && typeof instance.publisherId !== "string") throw new Error(`registry.apps.${appId}.defaultInstance.publisherId 无效。`);
-		const dataSchemaVersion = typeof instance.dataSchemaVersion === "number" && Number.isSafeInteger(instance.dataSchemaVersion) && instance.dataSchemaVersion > 0 ? instance.dataSchemaVersion : 1;
-		const instanceCreatedAt = typeof instance.createdAt === "string" ? instance.createdAt : createdAt;
-		const instanceDirectory = path.resolve(this.appHomeService.getAppInstanceDirectory(appId, "default"));
-		const expectedStorage = {
-			layout: "instance-v1",
-			layoutVersion: 1,
-			instanceId: "default",
-			instanceDirectory,
-			dataDirectory: path.join(instanceDirectory, "data"),
-			configDirectory: path.join(instanceDirectory, "config"),
-			stateDirectory: path.join(instanceDirectory, "state"),
-			cacheDirectory: path.join(instanceDirectory, "cache"),
-			temporaryDirectory: path.join(instanceDirectory, "tmp"),
-			logsDirectory: path.join(instanceDirectory, "logs")
-		};
-		if (instance.storage.layout === "legacy") {
-			const expectedLegacyDataDirectory = this.appHomeService.getAppDataDirectory(appId);
-			this.assertExactPath(dataDirectory, expectedLegacyDataDirectory, `registry.apps.${appId}.dataDirectory`);
-			return {
-				id: "default",
-				publisherId: instance.publisherId,
-				storage: {
-					...expectedStorage,
-					layout: "legacy",
-					dataDirectory: path.resolve(expectedLegacyDataDirectory)
-				},
-				dataSchemaVersion,
-				createdAt: instanceCreatedAt,
-				migratedAt: instance.migratedAt,
-				legacyDataDirectory: path.resolve(expectedLegacyDataDirectory)
-			};
-		}
-		for (const [field, expectedPath] of Object.entries({
-			instanceDirectory: expectedStorage.instanceDirectory,
-			dataDirectory: expectedStorage.dataDirectory,
-			configDirectory: expectedStorage.configDirectory,
-			stateDirectory: expectedStorage.stateDirectory,
-			cacheDirectory: expectedStorage.cacheDirectory,
-			temporaryDirectory: expectedStorage.temporaryDirectory,
-			logsDirectory: expectedStorage.logsDirectory
-		})) this.assertExactPath(instance.storage[field], expectedPath, `registry.apps.${appId}.defaultInstance.storage.${field}`);
-		this.assertExactPath(dataDirectory, expectedStorage.dataDirectory, `registry.apps.${appId}.dataDirectory`);
-		return {
-			id: "default",
-			publisherId: instance.publisherId,
-			storage: expectedStorage,
-			dataSchemaVersion,
-			createdAt: instanceCreatedAt,
-			migratedAt: instance.migratedAt,
-			legacyDataDirectory: instance.legacyDataDirectory
-		};
-	};
-	assertExactPath = (actual, expected, field) => {
-		if (typeof actual !== "string" || path.resolve(actual) !== path.resolve(expected)) throw new Error(`${field} 必须位于受管路径 ${path.resolve(expected)}。`);
-	};
-	parseComponents = (rawComponents, installDirectory, field) => {
-		if (rawComponents === void 0) return;
-		if (!Array.isArray(rawComponents)) throw new Error(`${field} 必须是数组。`);
-		return rawComponents.map((rawComponent, index) => {
-			const component = this.assertRecord(rawComponent, `${field}[${index}]`);
-			const kind = component.kind;
-			if (kind !== "panel" && kind !== "service") throw new Error(`${field}[${index}].kind 无效。`);
-			const id = this.requireString(component.id, `${field}[${index}].id`);
-			if (!SAFE_COMPONENT_ID_PATTERN.test(id)) throw new Error(`${field}[${index}].id 不安全。`);
-			const relativeComponentPath = this.requireString(component.path, `${field}[${index}].path`);
-			const expectedComponentDirectory = path.resolve(installDirectory, relativeComponentPath);
-			const relativeToInstall = path.relative(path.resolve(installDirectory), expectedComponentDirectory);
-			if (!relativeToInstall || relativeToInstall.startsWith("..") || path.isAbsolute(relativeToInstall)) throw new Error(`${field}[${index}].path 必须位于版本目录内。`);
-			const expectedManifestPath = path.join(expectedComponentDirectory, kind === "panel" ? "panel-app.json" : "service-app.json");
-			this.assertExactPath(component.componentDirectory, expectedComponentDirectory, `${field}[${index}].componentDirectory`);
-			this.assertExactPath(component.manifestPath, expectedManifestPath, `${field}[${index}].manifestPath`);
-			return {
-				kind,
-				id,
-				path: relativeComponentPath,
-				componentDirectory: expectedComponentDirectory,
-				manifestPath: expectedManifestPath
-			};
-		});
-	};
-	assertRecord = (value, field) => {
-		if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${field} 必须是对象。`);
-		return value;
-	};
-	requireString = (value, field) => {
-		if (typeof value !== "string" || !value.trim()) throw new Error(`${field} 必须是非空字符串。`);
-		return value;
-	};
 	isMissingFileError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 };
 //#endregion