@nextclaw/app-runtime 0.15.0 → 0.16.1-beta.0

package/dist/services/app-registry.service.js

@@ -1,25 +1,20 @@
-import { AppPlatformTargetService } from "./app-platform-target.service.js";
 import { AppHomeService } from "./app-home.service.js";
 import { FileLockService } from "./file-lock.service.js";
-import { AppInstanceStorageService } from "./app-instance-storage.service.js";
+import { AppRegistryParserService } from "./app-registry-parser.service.js";
 import { open, readFile, rename, rm } from "node:fs/promises";
 import path from "node:path";
 //#region src/services/app-registry.service.ts
-const SAFE_APP_ID_PATTERN = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;
-const SAFE_VERSION_PATTERN = /^[0-9A-Za-z]+(?:[._+-][0-9A-Za-z]+)*$/;
-const SAFE_COMPONENT_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var AppRegistryService = class {
-	instanceStorageService;
 	fileLockService = new FileLockService();
-	platformTargetService = new AppPlatformTargetService();
+	parser;
 	constructor(appHomeService = new AppHomeService()) {
 		this.appHomeService = appHomeService;
-		this.instanceStorageService = new AppInstanceStorageService(appHomeService);
+		this.parser = new AppRegistryParserService(appHomeService);
 	}
 	load = async () => {
 		try {
 			const raw = await readFile(this.appHomeService.getRegistryPath(), "utf-8");
-			return this.parseRegistry(JSON.parse(raw));
+			return this.parser.parse(JSON.parse(raw));
 		} catch (error) {
 			if (this.isMissingFileError(error)) return {
 				schemaVersion: 1,
@@ -67,12 +62,14 @@ var AppRegistryService = class {
 			const currentRecord = registry.apps[params.appId];
 			const currentPublisher = currentRecord?.publisher ?? currentRecord?.installedVersions[currentRecord.activeVersion]?.publisher;
 			if (currentPublisher && currentPublisher.id !== params.publisher?.id) throw new Error(`应用 ${params.appId} 已绑定发布者 ${currentPublisher.id}，拒绝由 ${params.publisher?.id ?? "未验证本地来源"} 覆盖。`);
+			const activeVersion = params.activate === false && currentRecord ? currentRecord.activeVersion : params.version;
+			const activePermissions = activeVersion === params.version ? params.permissions : currentRecord?.installedVersions[activeVersion]?.permissions ?? {};
 			const nextRecord = {
 				appId: params.appId,
 				name: params.name,
 				description: params.description,
 				publisher: currentPublisher ?? params.publisher,
-				activeVersion: params.activate === false && currentRecord ? currentRecord.activeVersion : params.version,
+				activeVersion,
 				enabled: params.enabled ?? currentRecord?.enabled ?? params.manifestSchemaVersion === 1,
 				dataDirectory: params.defaultInstance.storage.dataDirectory,
 				defaultInstance: params.defaultInstance,
@@ -99,7 +96,8 @@ var AppRegistryService = class {
 						contentSha256: params.contentSha256
 					}
 				},
-				grants: currentRecord?.grants ?? {}
+				grants: this.parser.retainCompatibleDocumentGrants(currentRecord?.grants ?? {}, activePermissions),
+				secretBindings: this.parser.retainDeclaredSecretBindings(currentRecord?.secretBindings ?? {}, activePermissions)
 			};
 			registry.apps[params.appId] = nextRecord;
 			await this.saveUnlocked(registry);
@@ -117,7 +115,9 @@ var AppRegistryService = class {
 			if (!record.installedVersions[version]) throw new Error(`应用 ${appId} 未安装版本 ${version}。`);
 			return {
 				...record,
-				activeVersion: version
+				activeVersion: version,
+				grants: this.parser.retainCompatibleDocumentGrants(record.grants, record.installedVersions[version].permissions),
+				secretBindings: this.parser.retainDeclaredSecretBindings(record.secretBindings, record.installedVersions[version].permissions)
 			};
 		});
 	};
@@ -139,16 +139,57 @@ var AppRegistryService = class {
 		});
 	};
 	updateGrants = async (appId, grants) => {
-		return await this.updateApp(appId, (record) => ({
-			...record,
-			grants: {
-				...record.grants,
-				...grants
-			}
-		}));
+		return await this.updateApp(appId, (record) => {
+			const permissions = record.installedVersions[record.activeVersion]?.permissions ?? {};
+			const scopes = new Map((permissions.documentAccess ?? []).map((scope) => [scope.id, scope]));
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			const stored = Object.fromEntries(Object.entries(grants).map(([scopeId, directoryPath]) => {
+				const scope = scopes.get(scopeId);
+				if (!scope) throw new Error(`应用 ${appId} 未声明 documentAccess scope：${scopeId}`);
+				return [scopeId, {
+					path: directoryPath,
+					mode: scope.mode,
+					grantedAt: now
+				}];
+			}));
+			return {
+				...record,
+				grants: {
+					...record.grants,
+					...stored
+				}
+			};
+		});
 	};
-	setDocumentGrant = async (appId, scopeId, directoryPath) => {
-		return await this.updateGrants(appId, { [scopeId]: directoryPath });
+	setDocumentGrant = async (appId, scopeId, directoryPath, mode) => {
+		return await this.updateApp(appId, (record) => {
+			const scope = record.installedVersions[record.activeVersion]?.permissions.documentAccess?.find((entry) => entry.id === scopeId);
+			if (!scope) throw new Error(`应用 ${appId} 未声明 documentAccess scope：${scopeId}`);
+			const effectiveMode = mode ?? scope.mode;
+			if (effectiveMode === "read-write" && scope.mode !== "read-write") throw new Error(`应用 ${appId} 的 documentAccess scope ${scopeId} 只声明了 read。`);
+			return {
+				...record,
+				grants: {
+					...record.grants,
+					[scopeId]: {
+						path: directoryPath,
+						mode: effectiveMode,
+						grantedAt: (/* @__PURE__ */ new Date()).toISOString()
+					}
+				}
+			};
+		});
+	};
+	restoreDocumentGrant = async (appId, scopeId, grant) => {
+		await this.updateApp(appId, (record) => {
+			const grants = { ...record.grants };
+			if (grant) grants[scopeId] = grant;
+			else delete grants[scopeId];
+			return {
+				...record,
+				grants
+			};
+		});
 	};
 	removeDocumentGrant = async (appId, scopeId) => {
 		let removed = false;
@@ -164,6 +205,35 @@ var AppRegistryService = class {
 		});
 		return removed;
 	};
+	bindSecret = async (appId, slotId, binding) => {
+		const normalizedSlotId = this.parser.parseSecretSlotId(slotId, "secret slot id");
+		const normalizedBinding = this.parser.parseSecretBinding(binding, `secret binding ${normalizedSlotId}`);
+		return await this.updateApp(appId, (record) => {
+			if (!(record.installedVersions[record.activeVersion]?.permissions.secrets ?? []).some((slot) => slot.id === normalizedSlotId)) throw new Error(`应用 ${appId} 未声明 Secret slot：${normalizedSlotId}`);
+			return {
+				...record,
+				secretBindings: {
+					...record.secretBindings,
+					[normalizedSlotId]: normalizedBinding
+				}
+			};
+		});
+	};
+	unbindSecret = async (appId, slotId) => {
+		const normalizedSlotId = this.parser.parseSecretSlotId(slotId, "secret slot id");
+		let removed = false;
+		await this.updateApp(appId, (record) => {
+			if (!(normalizedSlotId in record.secretBindings)) return record;
+			const secretBindings = { ...record.secretBindings };
+			delete secretBindings[normalizedSlotId];
+			removed = true;
+			return {
+				...record,
+				secretBindings
+			};
+		});
+		return removed;
+	};
 	removeApp = async (appId) => {
 		return await this.withMutation(async () => {
 			const registry = await this.load();
@@ -201,158 +271,6 @@ var AppRegistryService = class {
 		const registryPath = path.resolve(this.appHomeService.getRegistryPath());
 		return await this.fileLockService.withLock(`${registryPath}.lock`, operation);
 	};
-	parseRegistry = (rawRegistry) => {
-		const candidate = this.assertRecord(rawRegistry, "registry.json");
-		if (candidate.schemaVersion !== 1) throw new Error("当前只支持 registry schemaVersion = 1。");
-		const rawApps = this.assertRecord(candidate.apps, "registry.apps");
-		const apps = {};
-		for (const [appId, rawApp] of Object.entries(rawApps)) {
-			if (!SAFE_APP_ID_PATTERN.test(appId)) throw new Error(`registry.apps 包含不安全的 appId：${appId}`);
-			const app = this.assertRecord(rawApp, `registry.apps.${appId}`);
-			const installedVersions = {};
-			const rawVersions = this.assertRecord(app.installedVersions, `registry.apps.${appId}.installedVersions`);
-			for (const [version, rawVersion] of Object.entries(rawVersions)) {
-				if (!SAFE_VERSION_PATTERN.test(version)) throw new Error(`registry.apps.${appId} 包含不安全的版本：${version}`);
-				const versionRecord = this.assertRecord(rawVersion, `registry.apps.${appId}.installedVersions.${version}`);
-				const installDirectory = this.requireString(versionRecord.installDirectory, `registry.apps.${appId}.installedVersions.${version}.installDirectory`);
-				this.assertExactPath(installDirectory, this.appHomeService.getInstallDirectory(appId, version), `registry.apps.${appId}.installedVersions.${version}.installDirectory`);
-				installedVersions[version] = {
-					...versionRecord,
-					version,
-					installDirectory: path.resolve(installDirectory),
-					manifestSchemaVersion: versionRecord.manifestSchemaVersion === 2 ? 2 : 1,
-					target: versionRecord.target === void 0 ? void 0 : this.platformTargetService.parseArtifactTarget(versionRecord.target, `registry.apps.${appId}.installedVersions.${version}.target`),
-					components: this.parseComponents(versionRecord.components, installDirectory, `registry.apps.${appId}.installedVersions.${version}.components`),
-					dataSchemaVersion: typeof versionRecord.dataSchemaVersion === "number" && Number.isSafeInteger(versionRecord.dataSchemaVersion) && versionRecord.dataSchemaVersion > 0 ? versionRecord.dataSchemaVersion : 1
-				};
-			}
-			const activeVersion = this.requireString(app.activeVersion, `registry.apps.${appId}.activeVersion`);
-			if (!installedVersions[activeVersion]) throw new Error(`registry.apps.${appId} 缺少 activeVersion ${activeVersion}。`);
-			const dataDirectory = this.requireString(app.dataDirectory, `registry.apps.${appId}.dataDirectory`);
-			const firstInstalledAt = Object.values(installedVersions).map((version) => version.installedAt).filter((value) => typeof value === "string").sort()[0] ?? (/* @__PURE__ */ new Date(0)).toISOString();
-			const defaultInstance = this.parseDefaultInstance(app.defaultInstance, appId, dataDirectory, firstInstalledAt);
-			apps[appId] = {
-				...app,
-				appId,
-				publisher: app.publisher ?? installedVersions[activeVersion]?.publisher,
-				enabled: typeof app.enabled === "boolean" ? app.enabled : true,
-				activeVersion,
-				dataDirectory: defaultInstance.storage.dataDirectory,
-				defaultInstance,
-				installedVersions,
-				grants: app.grants && typeof app.grants === "object" ? app.grants : {}
-			};
-		}
-		return {
-			schemaVersion: 1,
-			apps,
-			suppressedBuiltIns: candidate.suppressedBuiltIns && typeof candidate.suppressedBuiltIns === "object" && !Array.isArray(candidate.suppressedBuiltIns) ? Object.fromEntries(Object.entries(candidate.suppressedBuiltIns).flatMap(([appId, raw]) => {
-				if (!raw || typeof raw !== "object" || Array.isArray(raw)) return [];
-				const suppressedAt = raw.suppressedAt;
-				return typeof suppressedAt === "string" ? [[appId, { suppressedAt }]] : [];
-			})) : {}
-		};
-	};
-	parseDefaultInstance = (rawInstance, appId, dataDirectory, createdAt) => {
-		if (!rawInstance || typeof rawInstance !== "object" || Array.isArray(rawInstance)) {
-			this.assertExactPath(dataDirectory, this.appHomeService.getAppDataDirectory(appId), `registry.apps.${appId}.dataDirectory`);
-			return this.instanceStorageService.buildLegacyDefaultInstance({
-				appId,
-				dataDirectory,
-				createdAt
-			});
-		}
-		const instance = rawInstance;
-		if (instance.id !== "default" || !instance.storage || typeof instance.storage !== "object" || instance.storage.layout !== "legacy" && instance.storage.layout !== "instance-v1") throw new Error(`registry.apps.${appId}.defaultInstance 无效。`);
-		if (instance.publisherId !== void 0 && typeof instance.publisherId !== "string") throw new Error(`registry.apps.${appId}.defaultInstance.publisherId 无效。`);
-		const dataSchemaVersion = typeof instance.dataSchemaVersion === "number" && Number.isSafeInteger(instance.dataSchemaVersion) && instance.dataSchemaVersion > 0 ? instance.dataSchemaVersion : 1;
-		const instanceCreatedAt = typeof instance.createdAt === "string" ? instance.createdAt : createdAt;
-		const instanceDirectory = path.resolve(this.appHomeService.getAppInstanceDirectory(appId, "default"));
-		const expectedStorage = {
-			layout: "instance-v1",
-			layoutVersion: 1,
-			instanceId: "default",
-			instanceDirectory,
-			dataDirectory: path.join(instanceDirectory, "data"),
-			configDirectory: path.join(instanceDirectory, "config"),
-			stateDirectory: path.join(instanceDirectory, "state"),
-			cacheDirectory: path.join(instanceDirectory, "cache"),
-			temporaryDirectory: path.join(instanceDirectory, "tmp"),
-			logsDirectory: path.join(instanceDirectory, "logs")
-		};
-		if (instance.storage.layout === "legacy") {
-			const expectedLegacyDataDirectory = this.appHomeService.getAppDataDirectory(appId);
-			this.assertExactPath(dataDirectory, expectedLegacyDataDirectory, `registry.apps.${appId}.dataDirectory`);
-			return {
-				id: "default",
-				publisherId: instance.publisherId,
-				storage: {
-					...expectedStorage,
-					layout: "legacy",
-					dataDirectory: path.resolve(expectedLegacyDataDirectory)
-				},
-				dataSchemaVersion,
-				createdAt: instanceCreatedAt,
-				migratedAt: instance.migratedAt,
-				legacyDataDirectory: path.resolve(expectedLegacyDataDirectory)
-			};
-		}
-		for (const [field, expectedPath] of Object.entries({
-			instanceDirectory: expectedStorage.instanceDirectory,
-			dataDirectory: expectedStorage.dataDirectory,
-			configDirectory: expectedStorage.configDirectory,
-			stateDirectory: expectedStorage.stateDirectory,
-			cacheDirectory: expectedStorage.cacheDirectory,
-			temporaryDirectory: expectedStorage.temporaryDirectory,
-			logsDirectory: expectedStorage.logsDirectory
-		})) this.assertExactPath(instance.storage[field], expectedPath, `registry.apps.${appId}.defaultInstance.storage.${field}`);
-		this.assertExactPath(dataDirectory, expectedStorage.dataDirectory, `registry.apps.${appId}.dataDirectory`);
-		return {
-			id: "default",
-			publisherId: instance.publisherId,
-			storage: expectedStorage,
-			dataSchemaVersion,
-			createdAt: instanceCreatedAt,
-			migratedAt: instance.migratedAt,
-			legacyDataDirectory: instance.legacyDataDirectory
-		};
-	};
-	assertExactPath = (actual, expected, field) => {
-		if (typeof actual !== "string" || path.resolve(actual) !== path.resolve(expected)) throw new Error(`${field} 必须位于受管路径 ${path.resolve(expected)}。`);
-	};
-	parseComponents = (rawComponents, installDirectory, field) => {
-		if (rawComponents === void 0) return;
-		if (!Array.isArray(rawComponents)) throw new Error(`${field} 必须是数组。`);
-		return rawComponents.map((rawComponent, index) => {
-			const component = this.assertRecord(rawComponent, `${field}[${index}]`);
-			const kind = component.kind;
-			if (kind !== "panel" && kind !== "service") throw new Error(`${field}[${index}].kind 无效。`);
-			const id = this.requireString(component.id, `${field}[${index}].id`);
-			if (!SAFE_COMPONENT_ID_PATTERN.test(id)) throw new Error(`${field}[${index}].id 不安全。`);
-			const relativeComponentPath = this.requireString(component.path, `${field}[${index}].path`);
-			const expectedComponentDirectory = path.resolve(installDirectory, relativeComponentPath);
-			const relativeToInstall = path.relative(path.resolve(installDirectory), expectedComponentDirectory);
-			if (!relativeToInstall || relativeToInstall.startsWith("..") || path.isAbsolute(relativeToInstall)) throw new Error(`${field}[${index}].path 必须位于版本目录内。`);
-			const expectedManifestPath = path.join(expectedComponentDirectory, kind === "panel" ? "panel-app.json" : "service-app.json");
-			this.assertExactPath(component.componentDirectory, expectedComponentDirectory, `${field}[${index}].componentDirectory`);
-			this.assertExactPath(component.manifestPath, expectedManifestPath, `${field}[${index}].manifestPath`);
-			return {
-				kind,
-				id,
-				path: relativeComponentPath,
-				componentDirectory: expectedComponentDirectory,
-				manifestPath: expectedManifestPath
-			};
-		});
-	};
-	assertRecord = (value, field) => {
-		if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${field} 必须是对象。`);
-		return value;
-	};
-	requireString = (value, field) => {
-		if (typeof value !== "string" || !value.trim()) throw new Error(`${field} 必须是非空字符串。`);
-		return value;
-	};
 	isMissingFileError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 };
 //#endregion

package/dist/services/app-registry.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-registry.service.js","names":[],"sources":["../../src/services/app-registry.service.ts"],"sourcesContent":["import { open, readFile, rename, rm } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type {\n  AppPermissions,\n  AppPlatformSecuritySummary,\n  AppResolvedComponent,\n} from \"#app-runtime/types/app-manifest.types.js\";\nimport type { AppDocumentGrantMap } from \"#app-runtime/types/app-permissions.types.js\";\nimport { AppHomeService } from \"#app-runtime/services/app-home.service.js\";\nimport { AppInstanceStorageService } from \"#app-runtime/services/app-instance-storage.service.js\";\nimport { AppPlatformTargetService } from \"#app-runtime/services/app-platform-target.service.js\";\nimport { FileLockService } from \"#app-runtime/services/file-lock.service.js\";\nimport type { AppInstanceRecord } from \"#app-runtime/types/app-storage.types.js\";\nimport type {\n  AppInstallSourceKind,\n  AppRegistry,\n  AppRegistryAppRecord,\n  AppRegistryInstalledVersion,\n} from \"#app-runtime/types/app-registry.types.js\";\n\nconst SAFE_APP_ID_PATTERN = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;\nconst SAFE_VERSION_PATTERN = /^[0-9A-Za-z]+(?:[._+-][0-9A-Za-z]+)*$/;\nconst SAFE_COMPONENT_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\nexport class AppRegistryService {\n  private readonly instanceStorageService: AppInstanceStorageService;\n  private readonly fileLockService = new FileLockService();\n  private readonly platformTargetService = new AppPlatformTargetService();\n\n  constructor(private readonly appHomeService: AppHomeService = new AppHomeService()) {\n    this.instanceStorageService = new AppInstanceStorageService(appHomeService);\n  }\n\n  load = async (): Promise<AppRegistry> => {\n    try {\n      const raw = await readFile(this.appHomeService.getRegistryPath(), \"utf-8\");\n      return this.parseRegistry(JSON.parse(raw) as unknown);\n    } catch (error) {\n      if (this.isMissingFileError(error)) {\n        return { schemaVersion: 1, apps: {}, suppressedBuiltIns: {} };\n      }\n      throw error;\n    }\n  };\n\n  save = async (registry: AppRegistry): Promise<void> => {\n    await this.withMutation(async () => await this.saveUnlocked(registry));\n  };\n\n  private saveUnlocked = async (registry: AppRegistry): Promise<void> => {\n    await this.appHomeService.ensureBaseDirectories();\n    const registryPath = this.appHomeService.getRegistryPath();\n    const temporaryPath = path.join(\n      path.dirname(registryPath),\n      `.${path.basename(registryPath)}.${process.pid}.${Date.now()}.tmp`,\n    );\n    const handle = await open(temporaryPath, \"wx\", 0o600);\n    try {\n      await handle.writeFile(`${JSON.stringify(registry, null, 2)}\\n`, \"utf-8\");\n      await handle.sync();\n    } finally {\n      await handle.close();\n    }\n    try {\n      await rename(temporaryPath, registryPath);\n    } catch (error) {\n      await rm(temporaryPath, { force: true });\n      throw error;\n    }\n  };\n\n  listApps = async (): Promise<AppRegistryAppRecord[]> => {\n    const registry = await this.load();\n    return Object.values(registry.apps).sort((left, right) => left.appId.localeCompare(right.appId));\n  };\n\n  getApp = async (appId: string): Promise<AppRegistryAppRecord | undefined> => {\n    const registry = await this.load();\n    return registry.apps[appId];\n  };\n\n  getActiveVersion = async (appId: string): Promise<AppRegistryInstalledVersion | undefined> => {\n    const appRecord = await this.getApp(appId);\n    return appRecord?.installedVersions[appRecord.activeVersion];\n  };\n\n  upsertInstallation = async (params: {\n    appId: string;\n    name: string;\n    description?: string;\n    version: string;\n    installDirectory: string;\n    defaultInstance: AppInstanceRecord;\n    sourceKind: AppInstallSourceKind;\n    sourceRef: string;\n    installedAt: string;\n    distributionMode?: AppRegistryInstalledVersion[\"distributionMode\"];\n    permissions: AppPermissions;\n    registryUrl?: string;\n    bundleUrl?: string;\n    sha256?: string;\n    target?: AppRegistryInstalledVersion[\"target\"];\n    publisher?: AppRegistryInstalledVersion[\"publisher\"];\n    manifestSchemaVersion: 1 | 2;\n    components?: AppResolvedComponent[];\n    primaryPanelId?: string;\n    security?: AppPlatformSecuritySummary;\n    dataSchemaVersion: number;\n    contentSha256?: string;\n    enabled?: boolean;\n    activate?: boolean;\n  }): Promise<AppRegistryAppRecord> => {\n    return await this.withMutation(async () => {\n      const registry = await this.load();\n      const currentRecord = registry.apps[params.appId];\n      const currentPublisher = currentRecord?.publisher ??\n        currentRecord?.installedVersions[currentRecord.activeVersion]?.publisher;\n      if (currentPublisher && currentPublisher.id !== params.publisher?.id) {\n        throw new Error(\n          `应用 ${params.appId} 已绑定发布者 ${currentPublisher.id}，拒绝由 ${params.publisher?.id ?? \"未验证本地来源\"} 覆盖。`,\n        );\n      }\n      const nextRecord: AppRegistryAppRecord = {\n        appId: params.appId,\n        name: params.name,\n        description: params.description,\n        publisher: currentPublisher ?? params.publisher,\n        activeVersion: params.activate === false && currentRecord\n          ? currentRecord.activeVersion\n          : params.version,\n        enabled: params.enabled ?? currentRecord?.enabled ?? params.manifestSchemaVersion === 1,\n        dataDirectory: params.defaultInstance.storage.dataDirectory,\n        defaultInstance: params.defaultInstance,\n        installedVersions: {\n          ...(currentRecord?.installedVersions ?? {}),\n          [params.version]: {\n            version: params.version,\n            installDirectory: params.installDirectory,\n            sourceKind: params.sourceKind,\n            sourceRef: params.sourceRef,\n            installedAt: params.installedAt,\n            distributionMode: params.distributionMode,\n            permissions: params.permissions,\n            registryUrl: params.registryUrl,\n            bundleUrl: params.bundleUrl,\n            sha256: params.sha256,\n            target: params.target,\n            publisher: params.publisher,\n            manifestSchemaVersion: params.manifestSchemaVersion,\n            components: params.components,\n            primaryPanelId: params.primaryPanelId,\n            security: params.security,\n            dataSchemaVersion: params.dataSchemaVersion,\n            contentSha256: params.contentSha256,\n          },\n        },\n        grants: currentRecord?.grants ?? {},\n      };\n      registry.apps[params.appId] = nextRecord;\n      await this.saveUnlocked(registry);\n      return nextRecord;\n    });\n  };\n\n  setEnabled = async (appId: string, enabled: boolean): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => ({ ...record, enabled }));\n  };\n\n  activateVersion = async (\n    appId: string,\n    version: string,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => {\n      if (!record.installedVersions[version]) {\n        throw new Error(`应用 ${appId} 未安装版本 ${version}。`);\n      }\n      return { ...record, activeVersion: version };\n    });\n  };\n\n  setVersionContentDigest = async (\n    appId: string,\n    version: string,\n    contentSha256: string,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => {\n      const installedVersion = record.installedVersions[version];\n      if (!installedVersion) {\n        throw new Error(`应用 ${appId} 未安装版本 ${version}。`);\n      }\n      if (installedVersion.contentSha256 && installedVersion.contentSha256 !== contentSha256) {\n        throw new Error(`应用 ${appId}@${version} 已存在不同的代码完整性摘要。`);\n      }\n      return {\n        ...record,\n        installedVersions: {\n          ...record.installedVersions,\n          [version]: { ...installedVersion, contentSha256 },\n        },\n      };\n    });\n  };\n\n  updateGrants = async (\n    appId: string,\n    grants: AppDocumentGrantMap,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => ({\n      ...record,\n      grants: { ...record.grants, ...grants },\n    }));\n  };\n\n  setDocumentGrant = async (\n    appId: string,\n    scopeId: string,\n    directoryPath: string,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateGrants(appId, { [scopeId]: directoryPath });\n  };\n\n  removeDocumentGrant = async (appId: string, scopeId: string): Promise<boolean> => {\n    let removed = false;\n    await this.updateApp(appId, (record) => {\n      if (!(scopeId in record.grants)) {\n        return record;\n      }\n      const grants = { ...record.grants };\n      delete grants[scopeId];\n      removed = true;\n      return { ...record, grants };\n    });\n    return removed;\n  };\n\n  removeApp = async (appId: string): Promise<AppRegistryAppRecord | undefined> => {\n    return await this.withMutation(async () => {\n      const registry = await this.load();\n      const appRecord = registry.apps[appId];\n      if (!appRecord) {\n        return undefined;\n      }\n      delete registry.apps[appId];\n      await this.saveUnlocked(registry);\n      return appRecord;\n    });\n  };\n\n  isBuiltInSuppressed = async (appId: string): Promise<boolean> => {\n    const registry = await this.load();\n    return Boolean(registry.suppressedBuiltIns[appId]);\n  };\n\n  setBuiltInSuppressed = async (appId: string, suppressed: boolean): Promise<void> => {\n    await this.withMutation(async () => {\n      const registry = await this.load();\n      if (suppressed) {\n        registry.suppressedBuiltIns[appId] = { suppressedAt: new Date().toISOString() };\n      } else {\n        delete registry.suppressedBuiltIns[appId];\n      }\n      await this.saveUnlocked(registry);\n    });\n  };\n\n  private updateApp = async (\n    appId: string,\n    update: (record: AppRegistryAppRecord) => AppRegistryAppRecord,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.withMutation(async () => {\n      const registry = await this.load();\n      const appRecord = registry.apps[appId];\n      if (!appRecord) {\n        throw new Error(`未找到已安装应用：${appId}`);\n      }\n      const nextRecord = update(appRecord);\n      registry.apps[appId] = nextRecord;\n      await this.saveUnlocked(registry);\n      return nextRecord;\n    });\n  };\n\n  private withMutation = async <T>(operation: () => Promise<T>): Promise<T> => {\n    const registryPath = path.resolve(this.appHomeService.getRegistryPath());\n    return await this.fileLockService.withLock(`${registryPath}.lock`, operation);\n  };\n\n  private parseRegistry = (rawRegistry: unknown): AppRegistry => {\n    const candidate = this.assertRecord(rawRegistry, \"registry.json\");\n    if (candidate.schemaVersion !== 1) {\n      throw new Error(\"当前只支持 registry schemaVersion = 1。\");\n    }\n    const rawApps = this.assertRecord(candidate.apps, \"registry.apps\");\n    const apps: Record<string, AppRegistryAppRecord> = {};\n    for (const [appId, rawApp] of Object.entries(rawApps)) {\n      if (!SAFE_APP_ID_PATTERN.test(appId)) {\n        throw new Error(`registry.apps 包含不安全的 appId：${appId}`);\n      }\n      const app = this.assertRecord(rawApp, `registry.apps.${appId}`) as Partial<AppRegistryAppRecord>;\n      const installedVersions: Record<string, AppRegistryInstalledVersion> = {};\n      const rawVersions = this.assertRecord(\n        app.installedVersions,\n        `registry.apps.${appId}.installedVersions`,\n      );\n      for (const [version, rawVersion] of Object.entries(rawVersions)) {\n        if (!SAFE_VERSION_PATTERN.test(version)) {\n          throw new Error(`registry.apps.${appId} 包含不安全的版本：${version}`);\n        }\n        const versionRecord = this.assertRecord(\n          rawVersion,\n          `registry.apps.${appId}.installedVersions.${version}`,\n        ) as Partial<AppRegistryInstalledVersion>;\n        const installDirectory = this.requireString(\n          versionRecord.installDirectory,\n          `registry.apps.${appId}.installedVersions.${version}.installDirectory`,\n        );\n        this.assertExactPath(\n          installDirectory,\n          this.appHomeService.getInstallDirectory(appId, version),\n          `registry.apps.${appId}.installedVersions.${version}.installDirectory`,\n        );\n        installedVersions[version] = {\n          ...(versionRecord as AppRegistryInstalledVersion),\n          version,\n          installDirectory: path.resolve(installDirectory),\n          manifestSchemaVersion: versionRecord.manifestSchemaVersion === 2 ? 2 : 1,\n          target: versionRecord.target === undefined\n            ? undefined\n            : this.platformTargetService.parseArtifactTarget(\n                versionRecord.target,\n                `registry.apps.${appId}.installedVersions.${version}.target`,\n              ),\n          components: this.parseComponents(\n            versionRecord.components,\n            installDirectory,\n            `registry.apps.${appId}.installedVersions.${version}.components`,\n          ),\n          dataSchemaVersion: typeof versionRecord.dataSchemaVersion === \"number\" &&\n            Number.isSafeInteger(versionRecord.dataSchemaVersion) &&\n            versionRecord.dataSchemaVersion > 0\n            ? versionRecord.dataSchemaVersion\n            : 1,\n        };\n      }\n      const activeVersion = this.requireString(app.activeVersion, `registry.apps.${appId}.activeVersion`);\n      if (!installedVersions[activeVersion]) {\n        throw new Error(`registry.apps.${appId} 缺少 activeVersion ${activeVersion}。`);\n      }\n      const dataDirectory = this.requireString(\n        app.dataDirectory,\n        `registry.apps.${appId}.dataDirectory`,\n      );\n      const firstInstalledAt = Object.values(installedVersions)\n        .map((version) => version.installedAt)\n        .filter((value): value is string => typeof value === \"string\")\n        .sort()[0] ?? new Date(0).toISOString();\n      const defaultInstance = this.parseDefaultInstance(\n        app.defaultInstance,\n        appId,\n        dataDirectory,\n        firstInstalledAt,\n      );\n      apps[appId] = {\n        ...(app as AppRegistryAppRecord),\n        appId,\n        publisher: app.publisher ?? installedVersions[activeVersion]?.publisher,\n        enabled: typeof app.enabled === \"boolean\" ? app.enabled : true,\n        activeVersion,\n        dataDirectory: defaultInstance.storage.dataDirectory,\n        defaultInstance,\n        installedVersions,\n        grants: app.grants && typeof app.grants === \"object\" ? app.grants : {},\n      };\n    }\n    const suppressedBuiltIns = candidate.suppressedBuiltIns &&\n      typeof candidate.suppressedBuiltIns === \"object\" &&\n      !Array.isArray(candidate.suppressedBuiltIns)\n      ? Object.fromEntries(Object.entries(candidate.suppressedBuiltIns).flatMap(([appId, raw]) => {\n          if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) {\n            return [];\n          }\n          const suppressedAt = (raw as { suppressedAt?: unknown }).suppressedAt;\n          return typeof suppressedAt === \"string\" ? [[appId, { suppressedAt }]] : [];\n        }))\n      : {};\n    return { schemaVersion: 1, apps, suppressedBuiltIns };\n  };\n\n  private parseDefaultInstance = (\n    rawInstance: unknown,\n    appId: string,\n    dataDirectory: string,\n    createdAt: string,\n  ): AppInstanceRecord => {\n    if (!rawInstance || typeof rawInstance !== \"object\" || Array.isArray(rawInstance)) {\n      this.assertExactPath(\n        dataDirectory,\n        this.appHomeService.getAppDataDirectory(appId),\n        `registry.apps.${appId}.dataDirectory`,\n      );\n      return this.instanceStorageService.buildLegacyDefaultInstance({\n        appId,\n        dataDirectory,\n        createdAt,\n      });\n    }\n    const instance = rawInstance as Partial<AppInstanceRecord>;\n    if (\n      instance.id !== \"default\" ||\n      !instance.storage ||\n      typeof instance.storage !== \"object\" ||\n      (instance.storage.layout !== \"legacy\" && instance.storage.layout !== \"instance-v1\")\n    ) {\n      throw new Error(`registry.apps.${appId}.defaultInstance 无效。`);\n    }\n    if (instance.publisherId !== undefined && typeof instance.publisherId !== \"string\") {\n      throw new Error(`registry.apps.${appId}.defaultInstance.publisherId 无效。`);\n    }\n    const dataSchemaVersion = typeof instance.dataSchemaVersion === \"number\" &&\n      Number.isSafeInteger(instance.dataSchemaVersion) &&\n      instance.dataSchemaVersion > 0\n      ? instance.dataSchemaVersion\n      : 1;\n    const instanceCreatedAt = typeof instance.createdAt === \"string\"\n      ? instance.createdAt\n      : createdAt;\n    const instanceDirectory = path.resolve(\n      this.appHomeService.getAppInstanceDirectory(appId, \"default\"),\n    );\n    const expectedStorage = {\n      layout: \"instance-v1\" as const,\n      layoutVersion: 1 as const,\n      instanceId: \"default\",\n      instanceDirectory,\n      dataDirectory: path.join(instanceDirectory, \"data\"),\n      configDirectory: path.join(instanceDirectory, \"config\"),\n      stateDirectory: path.join(instanceDirectory, \"state\"),\n      cacheDirectory: path.join(instanceDirectory, \"cache\"),\n      temporaryDirectory: path.join(instanceDirectory, \"tmp\"),\n      logsDirectory: path.join(instanceDirectory, \"logs\"),\n    };\n    if (instance.storage.layout === \"legacy\") {\n      const expectedLegacyDataDirectory = this.appHomeService.getAppDataDirectory(appId);\n      this.assertExactPath(\n        dataDirectory,\n        expectedLegacyDataDirectory,\n        `registry.apps.${appId}.dataDirectory`,\n      );\n      return {\n        id: \"default\",\n        publisherId: instance.publisherId,\n        storage: {\n          ...expectedStorage,\n          layout: \"legacy\",\n          dataDirectory: path.resolve(expectedLegacyDataDirectory),\n        },\n        dataSchemaVersion,\n        createdAt: instanceCreatedAt,\n        migratedAt: instance.migratedAt,\n        legacyDataDirectory: path.resolve(expectedLegacyDataDirectory),\n      };\n    }\n    for (const [field, expectedPath] of Object.entries({\n      instanceDirectory: expectedStorage.instanceDirectory,\n      dataDirectory: expectedStorage.dataDirectory,\n      configDirectory: expectedStorage.configDirectory,\n      stateDirectory: expectedStorage.stateDirectory,\n      cacheDirectory: expectedStorage.cacheDirectory,\n      temporaryDirectory: expectedStorage.temporaryDirectory,\n      logsDirectory: expectedStorage.logsDirectory,\n    })) {\n      this.assertExactPath(\n        instance.storage[field as keyof typeof instance.storage] as string,\n        expectedPath,\n        `registry.apps.${appId}.defaultInstance.storage.${field}`,\n      );\n    }\n    this.assertExactPath(\n      dataDirectory,\n      expectedStorage.dataDirectory,\n      `registry.apps.${appId}.dataDirectory`,\n    );\n    return {\n      id: \"default\",\n      publisherId: instance.publisherId,\n      storage: expectedStorage,\n      dataSchemaVersion,\n      createdAt: instanceCreatedAt,\n      migratedAt: instance.migratedAt,\n      legacyDataDirectory: instance.legacyDataDirectory,\n    };\n  };\n\n  private assertExactPath = (actual: unknown, expected: string, field: string): void => {\n    if (typeof actual !== \"string\" || path.resolve(actual) !== path.resolve(expected)) {\n      throw new Error(`${field} 必须位于受管路径 ${path.resolve(expected)}。`);\n    }\n  };\n\n  private parseComponents = (\n    rawComponents: unknown,\n    installDirectory: string,\n    field: string,\n  ): AppResolvedComponent[] | undefined => {\n    if (rawComponents === undefined) {\n      return undefined;\n    }\n    if (!Array.isArray(rawComponents)) {\n      throw new Error(`${field} 必须是数组。`);\n    }\n    return rawComponents.map((rawComponent, index) => {\n      const component = this.assertRecord(rawComponent, `${field}[${index}]`);\n      const kind = component.kind;\n      if (kind !== \"panel\" && kind !== \"service\") {\n        throw new Error(`${field}[${index}].kind 无效。`);\n      }\n      const id = this.requireString(component.id, `${field}[${index}].id`);\n      if (!SAFE_COMPONENT_ID_PATTERN.test(id)) {\n        throw new Error(`${field}[${index}].id 不安全。`);\n      }\n      const relativeComponentPath = this.requireString(\n        component.path,\n        `${field}[${index}].path`,\n      );\n      const expectedComponentDirectory = path.resolve(installDirectory, relativeComponentPath);\n      const relativeToInstall = path.relative(\n        path.resolve(installDirectory),\n        expectedComponentDirectory,\n      );\n      if (\n        !relativeToInstall ||\n        relativeToInstall.startsWith(\"..\") ||\n        path.isAbsolute(relativeToInstall)\n      ) {\n        throw new Error(`${field}[${index}].path 必须位于版本目录内。`);\n      }\n      const expectedManifestPath = path.join(\n        expectedComponentDirectory,\n        kind === \"panel\" ? \"panel-app.json\" : \"service-app.json\",\n      );\n      this.assertExactPath(\n        component.componentDirectory,\n        expectedComponentDirectory,\n        `${field}[${index}].componentDirectory`,\n      );\n      this.assertExactPath(\n        component.manifestPath,\n        expectedManifestPath,\n        `${field}[${index}].manifestPath`,\n      );\n      return {\n        kind,\n        id,\n        path: relativeComponentPath,\n        componentDirectory: expectedComponentDirectory,\n        manifestPath: expectedManifestPath,\n      };\n    });\n  };\n\n  private assertRecord = (value: unknown, field: string): Record<string, unknown> => {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n      throw new Error(`${field} 必须是对象。`);\n    }\n    return value as Record<string, unknown>;\n  };\n\n  private requireString = (value: unknown, field: string): string => {\n    if (typeof value !== \"string\" || !value.trim()) {\n      throw new Error(`${field} 必须是非空字符串。`);\n    }\n    return value;\n  };\n\n  private isMissingFileError = (error: unknown): boolean =>\n    typeof error === \"object\" && error !== null &&\n    \"code\" in error && (error as { code?: unknown }).code === \"ENOENT\";\n}\n"],"mappings":";;;;;;;AAoBA,MAAM,sBAAsB;AAC5B,MAAM,uBAAuB;AAC7B,MAAM,4BAA4B;AAElC,IAAa,qBAAb,MAAgC;CAC9B;CACA,kBAAmC,IAAI,iBAAiB;CACxD,wBAAyC,IAAI,0BAA0B;CAEvE,YAAY,iBAAkD,IAAI,gBAAgB,EAAE;AAAvD,OAAA,iBAAA;AAC3B,OAAK,yBAAyB,IAAI,0BAA0B,eAAe;;CAG7E,OAAO,YAAkC;AACvC,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,KAAK,eAAe,iBAAiB,EAAE,QAAQ;AAC1E,UAAO,KAAK,cAAc,KAAK,MAAM,IAAI,CAAY;WAC9C,OAAO;AACd,OAAI,KAAK,mBAAmB,MAAM,CAChC,QAAO;IAAE,eAAe;IAAG,MAAM,EAAE;IAAE,oBAAoB,EAAE;IAAE;AAE/D,SAAM;;;CAIV,OAAO,OAAO,aAAyC;AACrD,QAAM,KAAK,aAAa,YAAY,MAAM,KAAK,aAAa,SAAS,CAAC;;CAGxE,eAAuB,OAAO,aAAyC;AACrE,QAAM,KAAK,eAAe,uBAAuB;EACjD,MAAM,eAAe,KAAK,eAAe,iBAAiB;EAC1D,MAAM,gBAAgB,KAAK,KACzB,KAAK,QAAQ,aAAa,EAC1B,IAAI,KAAK,SAAS,aAAa,CAAC,GAAG,QAAQ,IAAI,GAAG,KAAK,KAAK,CAAC,MAC9D;EACD,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,IAAM;AACrD,MAAI;AACF,SAAM,OAAO,UAAU,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,KAAK,QAAQ;AACzE,SAAM,OAAO,MAAM;YACX;AACR,SAAM,OAAO,OAAO;;AAEtB,MAAI;AACF,SAAM,OAAO,eAAe,aAAa;WAClC,OAAO;AACd,SAAM,GAAG,eAAe,EAAE,OAAO,MAAM,CAAC;AACxC,SAAM;;;CAIV,WAAW,YAA6C;EACtD,MAAM,WAAW,MAAM,KAAK,MAAM;AAClC,SAAO,OAAO,OAAO,SAAS,KAAK,CAAC,MAAM,MAAM,UAAU,KAAK,MAAM,cAAc,MAAM,MAAM,CAAC;;CAGlG,SAAS,OAAO,UAA6D;AAE3E,UADiB,MAAM,KAAK,MAAM,EAClB,KAAK;;CAGvB,mBAAmB,OAAO,UAAoE;EAC5F,MAAM,YAAY,MAAM,KAAK,OAAO,MAAM;AAC1C,SAAO,WAAW,kBAAkB,UAAU;;CAGhD,qBAAqB,OAAO,WAyBS;AACnC,SAAO,MAAM,KAAK,aAAa,YAAY;GACzC,MAAM,WAAW,MAAM,KAAK,MAAM;GAClC,MAAM,gBAAgB,SAAS,KAAK,OAAO;GAC3C,MAAM,mBAAmB,eAAe,aACtC,eAAe,kBAAkB,cAAc,gBAAgB;AACjE,OAAI,oBAAoB,iBAAiB,OAAO,OAAO,WAAW,GAChE,OAAM,IAAI,MACR,MAAM,OAAO,MAAM,UAAU,iBAAiB,GAAG,OAAO,OAAO,WAAW,MAAM,UAAU,MAC3F;GAEH,MAAM,aAAmC;IACvC,OAAO,OAAO;IACd,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,WAAW,oBAAoB,OAAO;IACtC,eAAe,OAAO,aAAa,SAAS,gBACxC,cAAc,gBACd,OAAO;IACX,SAAS,OAAO,WAAW,eAAe,WAAW,OAAO,0BAA0B;IACtF,eAAe,OAAO,gBAAgB,QAAQ;IAC9C,iBAAiB,OAAO;IACxB,mBAAmB;KACjB,GAAI,eAAe,qBAAqB,EAAE;MACzC,OAAO,UAAU;MAChB,SAAS,OAAO;MAChB,kBAAkB,OAAO;MACzB,YAAY,OAAO;MACnB,WAAW,OAAO;MAClB,aAAa,OAAO;MACpB,kBAAkB,OAAO;MACzB,aAAa,OAAO;MACpB,aAAa,OAAO;MACpB,WAAW,OAAO;MAClB,QAAQ,OAAO;MACf,QAAQ,OAAO;MACf,WAAW,OAAO;MAClB,uBAAuB,OAAO;MAC9B,YAAY,OAAO;MACnB,gBAAgB,OAAO;MACvB,UAAU,OAAO;MACjB,mBAAmB,OAAO;MAC1B,eAAe,OAAO;MACvB;KACF;IACD,QAAQ,eAAe,UAAU,EAAE;IACpC;AACD,YAAS,KAAK,OAAO,SAAS;AAC9B,SAAM,KAAK,aAAa,SAAS;AACjC,UAAO;IACP;;CAGJ,aAAa,OAAO,OAAe,YAAoD;AACrF,SAAO,MAAM,KAAK,UAAU,QAAQ,YAAY;GAAE,GAAG;GAAQ;GAAS,EAAE;;CAG1E,kBAAkB,OAChB,OACA,YACkC;AAClC,SAAO,MAAM,KAAK,UAAU,QAAQ,WAAW;AAC7C,OAAI,CAAC,OAAO,kBAAkB,SAC5B,OAAM,IAAI,MAAM,MAAM,MAAM,SAAS,QAAQ,GAAG;AAElD,UAAO;IAAE,GAAG;IAAQ,eAAe;IAAS;IAC5C;;CAGJ,0BAA0B,OACxB,OACA,SACA,kBACkC;AAClC,SAAO,MAAM,KAAK,UAAU,QAAQ,WAAW;GAC7C,MAAM,mBAAmB,OAAO,kBAAkB;AAClD,OAAI,CAAC,iBACH,OAAM,IAAI,MAAM,MAAM,MAAM,SAAS,QAAQ,GAAG;AAElD,OAAI,iBAAiB,iBAAiB,iBAAiB,kBAAkB,cACvE,OAAM,IAAI,MAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAE1D,UAAO;IACL,GAAG;IACH,mBAAmB;KACjB,GAAG,OAAO;MACT,UAAU;MAAE,GAAG;MAAkB;MAAe;KAClD;IACF;IACD;;CAGJ,eAAe,OACb,OACA,WACkC;AAClC,SAAO,MAAM,KAAK,UAAU,QAAQ,YAAY;GAC9C,GAAG;GACH,QAAQ;IAAE,GAAG,OAAO;IAAQ,GAAG;IAAQ;GACxC,EAAE;;CAGL,mBAAmB,OACjB,OACA,SACA,kBACkC;AAClC,SAAO,MAAM,KAAK,aAAa,OAAO,GAAG,UAAU,eAAe,CAAC;;CAGrE,sBAAsB,OAAO,OAAe,YAAsC;EAChF,IAAI,UAAU;AACd,QAAM,KAAK,UAAU,QAAQ,WAAW;AACtC,OAAI,EAAE,WAAW,OAAO,QACtB,QAAO;GAET,MAAM,SAAS,EAAE,GAAG,OAAO,QAAQ;AACnC,UAAO,OAAO;AACd,aAAU;AACV,UAAO;IAAE,GAAG;IAAQ;IAAQ;IAC5B;AACF,SAAO;;CAGT,YAAY,OAAO,UAA6D;AAC9E,SAAO,MAAM,KAAK,aAAa,YAAY;GACzC,MAAM,WAAW,MAAM,KAAK,MAAM;GAClC,MAAM,YAAY,SAAS,KAAK;AAChC,OAAI,CAAC,UACH;AAEF,UAAO,SAAS,KAAK;AACrB,SAAM,KAAK,aAAa,SAAS;AACjC,UAAO;IACP;;CAGJ,sBAAsB,OAAO,UAAoC;EAC/D,MAAM,WAAW,MAAM,KAAK,MAAM;AAClC,SAAO,QAAQ,SAAS,mBAAmB,OAAO;;CAGpD,uBAAuB,OAAO,OAAe,eAAuC;AAClF,QAAM,KAAK,aAAa,YAAY;GAClC,MAAM,WAAW,MAAM,KAAK,MAAM;AAClC,OAAI,WACF,UAAS,mBAAmB,SAAS,EAAE,+BAAc,IAAI,MAAM,EAAC,aAAa,EAAE;OAE/E,QAAO,SAAS,mBAAmB;AAErC,SAAM,KAAK,aAAa,SAAS;IACjC;;CAGJ,YAAoB,OAClB,OACA,WACkC;AAClC,SAAO,MAAM,KAAK,aAAa,YAAY;GACzC,MAAM,WAAW,MAAM,KAAK,MAAM;GAClC,MAAM,YAAY,SAAS,KAAK;AAChC,OAAI,CAAC,UACH,OAAM,IAAI,MAAM,YAAY,QAAQ;GAEtC,MAAM,aAAa,OAAO,UAAU;AACpC,YAAS,KAAK,SAAS;AACvB,SAAM,KAAK,aAAa,SAAS;AACjC,UAAO;IACP;;CAGJ,eAAuB,OAAU,cAA4C;EAC3E,MAAM,eAAe,KAAK,QAAQ,KAAK,eAAe,iBAAiB,CAAC;AACxE,SAAO,MAAM,KAAK,gBAAgB,SAAS,GAAG,aAAa,QAAQ,UAAU;;CAG/E,iBAAyB,gBAAsC;EAC7D,MAAM,YAAY,KAAK,aAAa,aAAa,gBAAgB;AACjE,MAAI,UAAU,kBAAkB,EAC9B,OAAM,IAAI,MAAM,oCAAoC;EAEtD,MAAM,UAAU,KAAK,aAAa,UAAU,MAAM,gBAAgB;EAClE,MAAM,OAA6C,EAAE;AACrD,OAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,QAAQ,EAAE;AACrD,OAAI,CAAC,oBAAoB,KAAK,MAAM,CAClC,OAAM,IAAI,MAAM,8BAA8B,QAAQ;GAExD,MAAM,MAAM,KAAK,aAAa,QAAQ,iBAAiB,QAAQ;GAC/D,MAAM,oBAAiE,EAAE;GACzE,MAAM,cAAc,KAAK,aACvB,IAAI,mBACJ,iBAAiB,MAAM,oBACxB;AACD,QAAK,MAAM,CAAC,SAAS,eAAe,OAAO,QAAQ,YAAY,EAAE;AAC/D,QAAI,CAAC,qBAAqB,KAAK,QAAQ,CACrC,OAAM,IAAI,MAAM,iBAAiB,MAAM,YAAY,UAAU;IAE/D,MAAM,gBAAgB,KAAK,aACzB,YACA,iBAAiB,MAAM,qBAAqB,UAC7C;IACD,MAAM,mBAAmB,KAAK,cAC5B,cAAc,kBACd,iBAAiB,MAAM,qBAAqB,QAAQ,mBACrD;AACD,SAAK,gBACH,kBACA,KAAK,eAAe,oBAAoB,OAAO,QAAQ,EACvD,iBAAiB,MAAM,qBAAqB,QAAQ,mBACrD;AACD,sBAAkB,WAAW;KAC3B,GAAI;KACJ;KACA,kBAAkB,KAAK,QAAQ,iBAAiB;KAChD,uBAAuB,cAAc,0BAA0B,IAAI,IAAI;KACvE,QAAQ,cAAc,WAAW,KAAA,IAC7B,KAAA,IACA,KAAK,sBAAsB,oBACzB,cAAc,QACd,iBAAiB,MAAM,qBAAqB,QAAQ,SACrD;KACL,YAAY,KAAK,gBACf,cAAc,YACd,kBACA,iBAAiB,MAAM,qBAAqB,QAAQ,aACrD;KACD,mBAAmB,OAAO,cAAc,sBAAsB,YAC5D,OAAO,cAAc,cAAc,kBAAkB,IACrD,cAAc,oBAAoB,IAChC,cAAc,oBACd;KACL;;GAEH,MAAM,gBAAgB,KAAK,cAAc,IAAI,eAAe,iBAAiB,MAAM,gBAAgB;AACnG,OAAI,CAAC,kBAAkB,eACrB,OAAM,IAAI,MAAM,iBAAiB,MAAM,oBAAoB,cAAc,GAAG;GAE9E,MAAM,gBAAgB,KAAK,cACzB,IAAI,eACJ,iBAAiB,MAAM,gBACxB;GACD,MAAM,mBAAmB,OAAO,OAAO,kBAAkB,CACtD,KAAK,YAAY,QAAQ,YAAY,CACrC,QAAQ,UAA2B,OAAO,UAAU,SAAS,CAC7D,MAAM,CAAC,uBAAM,IAAI,KAAK,EAAE,EAAC,aAAa;GACzC,MAAM,kBAAkB,KAAK,qBAC3B,IAAI,iBACJ,OACA,eACA,iBACD;AACD,QAAK,SAAS;IACZ,GAAI;IACJ;IACA,WAAW,IAAI,aAAa,kBAAkB,gBAAgB;IAC9D,SAAS,OAAO,IAAI,YAAY,YAAY,IAAI,UAAU;IAC1D;IACA,eAAe,gBAAgB,QAAQ;IACvC;IACA;IACA,QAAQ,IAAI,UAAU,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,EAAE;IACvE;;AAaH,SAAO;GAAE,eAAe;GAAG;GAAM,oBAXN,UAAU,sBACnC,OAAO,UAAU,uBAAuB,YACxC,CAAC,MAAM,QAAQ,UAAU,mBAAmB,GAC1C,OAAO,YAAY,OAAO,QAAQ,UAAU,mBAAmB,CAAC,SAAS,CAAC,OAAO,SAAS;AACxF,QAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CACvD,QAAO,EAAE;IAEX,MAAM,eAAgB,IAAmC;AACzD,WAAO,OAAO,iBAAiB,WAAW,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,GAAG,EAAE;KAC1E,CAAC,GACH,EAAE;GAC+C;;CAGvD,wBACE,aACA,OACA,eACA,cACsB;AACtB,MAAI,CAAC,eAAe,OAAO,gBAAgB,YAAY,MAAM,QAAQ,YAAY,EAAE;AACjF,QAAK,gBACH,eACA,KAAK,eAAe,oBAAoB,MAAM,EAC9C,iBAAiB,MAAM,gBACxB;AACD,UAAO,KAAK,uBAAuB,2BAA2B;IAC5D;IACA;IACA;IACD,CAAC;;EAEJ,MAAM,WAAW;AACjB,MACE,SAAS,OAAO,aAChB,CAAC,SAAS,WACV,OAAO,SAAS,YAAY,YAC3B,SAAS,QAAQ,WAAW,YAAY,SAAS,QAAQ,WAAW,cAErE,OAAM,IAAI,MAAM,iBAAiB,MAAM,sBAAsB;AAE/D,MAAI,SAAS,gBAAgB,KAAA,KAAa,OAAO,SAAS,gBAAgB,SACxE,OAAM,IAAI,MAAM,iBAAiB,MAAM,kCAAkC;EAE3E,MAAM,oBAAoB,OAAO,SAAS,sBAAsB,YAC9D,OAAO,cAAc,SAAS,kBAAkB,IAChD,SAAS,oBAAoB,IAC3B,SAAS,oBACT;EACJ,MAAM,oBAAoB,OAAO,SAAS,cAAc,WACpD,SAAS,YACT;EACJ,MAAM,oBAAoB,KAAK,QAC7B,KAAK,eAAe,wBAAwB,OAAO,UAAU,CAC9D;EACD,MAAM,kBAAkB;GACtB,QAAQ;GACR,eAAe;GACf,YAAY;GACZ;GACA,eAAe,KAAK,KAAK,mBAAmB,OAAO;GACnD,iBAAiB,KAAK,KAAK,mBAAmB,SAAS;GACvD,gBAAgB,KAAK,KAAK,mBAAmB,QAAQ;GACrD,gBAAgB,KAAK,KAAK,mBAAmB,QAAQ;GACrD,oBAAoB,KAAK,KAAK,mBAAmB,MAAM;GACvD,eAAe,KAAK,KAAK,mBAAmB,OAAO;GACpD;AACD,MAAI,SAAS,QAAQ,WAAW,UAAU;GACxC,MAAM,8BAA8B,KAAK,eAAe,oBAAoB,MAAM;AAClF,QAAK,gBACH,eACA,6BACA,iBAAiB,MAAM,gBACxB;AACD,UAAO;IACL,IAAI;IACJ,aAAa,SAAS;IACtB,SAAS;KACP,GAAG;KACH,QAAQ;KACR,eAAe,KAAK,QAAQ,4BAA4B;KACzD;IACD;IACA,WAAW;IACX,YAAY,SAAS;IACrB,qBAAqB,KAAK,QAAQ,4BAA4B;IAC/D;;AAEH,OAAK,MAAM,CAAC,OAAO,iBAAiB,OAAO,QAAQ;GACjD,mBAAmB,gBAAgB;GACnC,eAAe,gBAAgB;GAC/B,iBAAiB,gBAAgB;GACjC,gBAAgB,gBAAgB;GAChC,gBAAgB,gBAAgB;GAChC,oBAAoB,gBAAgB;GACpC,eAAe,gBAAgB;GAChC,CAAC,CACA,MAAK,gBACH,SAAS,QAAQ,QACjB,cACA,iBAAiB,MAAM,2BAA2B,QACnD;AAEH,OAAK,gBACH,eACA,gBAAgB,eAChB,iBAAiB,MAAM,gBACxB;AACD,SAAO;GACL,IAAI;GACJ,aAAa,SAAS;GACtB,SAAS;GACT;GACA,WAAW;GACX,YAAY,SAAS;GACrB,qBAAqB,SAAS;GAC/B;;CAGH,mBAA2B,QAAiB,UAAkB,UAAwB;AACpF,MAAI,OAAO,WAAW,YAAY,KAAK,QAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS,CAC/E,OAAM,IAAI,MAAM,GAAG,MAAM,YAAY,KAAK,QAAQ,SAAS,CAAC,GAAG;;CAInE,mBACE,eACA,kBACA,UACuC;AACvC,MAAI,kBAAkB,KAAA,EACpB;AAEF,MAAI,CAAC,MAAM,QAAQ,cAAc,CAC/B,OAAM,IAAI,MAAM,GAAG,MAAM,SAAS;AAEpC,SAAO,cAAc,KAAK,cAAc,UAAU;GAChD,MAAM,YAAY,KAAK,aAAa,cAAc,GAAG,MAAM,GAAG,MAAM,GAAG;GACvE,MAAM,OAAO,UAAU;AACvB,OAAI,SAAS,WAAW,SAAS,UAC/B,OAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,YAAY;GAEhD,MAAM,KAAK,KAAK,cAAc,UAAU,IAAI,GAAG,MAAM,GAAG,MAAM,MAAM;AACpE,OAAI,CAAC,0BAA0B,KAAK,GAAG,CACrC,OAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,WAAW;GAE/C,MAAM,wBAAwB,KAAK,cACjC,UAAU,MACV,GAAG,MAAM,GAAG,MAAM,QACnB;GACD,MAAM,6BAA6B,KAAK,QAAQ,kBAAkB,sBAAsB;GACxF,MAAM,oBAAoB,KAAK,SAC7B,KAAK,QAAQ,iBAAiB,EAC9B,2BACD;AACD,OACE,CAAC,qBACD,kBAAkB,WAAW,KAAK,IAClC,KAAK,WAAW,kBAAkB,CAElC,OAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,mBAAmB;GAEvD,MAAM,uBAAuB,KAAK,KAChC,4BACA,SAAS,UAAU,mBAAmB,mBACvC;AACD,QAAK,gBACH,UAAU,oBACV,4BACA,GAAG,MAAM,GAAG,MAAM,sBACnB;AACD,QAAK,gBACH,UAAU,cACV,sBACA,GAAG,MAAM,GAAG,MAAM,gBACnB;AACD,UAAO;IACL;IACA;IACA,MAAM;IACN,oBAAoB;IACpB,cAAc;IACf;IACD;;CAGJ,gBAAwB,OAAgB,UAA2C;AACjF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,OAAM,IAAI,MAAM,GAAG,MAAM,SAAS;AAEpC,SAAO;;CAGT,iBAAyB,OAAgB,UAA0B;AACjE,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,MAAM,CAC5C,OAAM,IAAI,MAAM,GAAG,MAAM,YAAY;AAEvC,SAAO;;CAGT,sBAA8B,UAC5B,OAAO,UAAU,YAAY,UAAU,QACvC,UAAU,SAAU,MAA6B,SAAS"}
+{"version":3,"file":"app-registry.service.js","names":[],"sources":["../../src/services/app-registry.service.ts"],"sourcesContent":["import { open, readFile, rename, rm } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type {\n  AppPermissions,\n  AppPlatformSecuritySummary,\n  AppResolvedComponent,\n} from \"#app-runtime/types/app-manifest.types.js\";\nimport type {\n  AppDocumentGrantMap,\n  AppStoredDocumentGrant,\n} from \"#app-runtime/types/app-permissions.types.js\";\nimport { AppHomeService } from \"#app-runtime/services/app-home.service.js\";\nimport { AppRegistryParserService } from \"#app-runtime/services/app-registry-parser.service.js\";\nimport { FileLockService } from \"#app-runtime/services/file-lock.service.js\";\nimport type { AppInstanceRecord } from \"#app-runtime/types/app-storage.types.js\";\nimport type {\n  AppInstallSourceKind,\n  AppRegistry,\n  AppRegistryAppRecord,\n  AppRegistryInstalledVersion,\n  AppSecretBinding,\n} from \"#app-runtime/types/app-registry.types.js\";\n\nexport class AppRegistryService {\n  private readonly fileLockService = new FileLockService();\n  private readonly parser: AppRegistryParserService;\n\n  constructor(\n    private readonly appHomeService: AppHomeService = new AppHomeService(),\n  ) {\n    this.parser = new AppRegistryParserService(appHomeService);\n  }\n\n  load = async (): Promise<AppRegistry> => {\n    try {\n      const raw = await readFile(\n        this.appHomeService.getRegistryPath(),\n        \"utf-8\",\n      );\n      return this.parser.parse(JSON.parse(raw) as unknown);\n    } catch (error) {\n      if (this.isMissingFileError(error)) {\n        return { schemaVersion: 1, apps: {}, suppressedBuiltIns: {} };\n      }\n      throw error;\n    }\n  };\n\n  save = async (registry: AppRegistry): Promise<void> => {\n    await this.withMutation(async () => await this.saveUnlocked(registry));\n  };\n\n  private saveUnlocked = async (registry: AppRegistry): Promise<void> => {\n    await this.appHomeService.ensureBaseDirectories();\n    const registryPath = this.appHomeService.getRegistryPath();\n    const temporaryPath = path.join(\n      path.dirname(registryPath),\n      `.${path.basename(registryPath)}.${process.pid}.${Date.now()}.tmp`,\n    );\n    const handle = await open(temporaryPath, \"wx\", 0o600);\n    try {\n      await handle.writeFile(`${JSON.stringify(registry, null, 2)}\\n`, \"utf-8\");\n      await handle.sync();\n    } finally {\n      await handle.close();\n    }\n    try {\n      await rename(temporaryPath, registryPath);\n    } catch (error) {\n      await rm(temporaryPath, { force: true });\n      throw error;\n    }\n  };\n\n  listApps = async (): Promise<AppRegistryAppRecord[]> => {\n    const registry = await this.load();\n    return Object.values(registry.apps).sort((left, right) =>\n      left.appId.localeCompare(right.appId),\n    );\n  };\n\n  getApp = async (appId: string): Promise<AppRegistryAppRecord | undefined> => {\n    const registry = await this.load();\n    return registry.apps[appId];\n  };\n\n  getActiveVersion = async (\n    appId: string,\n  ): Promise<AppRegistryInstalledVersion | undefined> => {\n    const appRecord = await this.getApp(appId);\n    return appRecord?.installedVersions[appRecord.activeVersion];\n  };\n\n  upsertInstallation = async (params: {\n    appId: string;\n    name: string;\n    description?: string;\n    version: string;\n    installDirectory: string;\n    defaultInstance: AppInstanceRecord;\n    sourceKind: AppInstallSourceKind;\n    sourceRef: string;\n    installedAt: string;\n    distributionMode?: AppRegistryInstalledVersion[\"distributionMode\"];\n    permissions: AppPermissions;\n    registryUrl?: string;\n    bundleUrl?: string;\n    sha256?: string;\n    target?: AppRegistryInstalledVersion[\"target\"];\n    publisher?: AppRegistryInstalledVersion[\"publisher\"];\n    manifestSchemaVersion: 1 | 2;\n    components?: AppResolvedComponent[];\n    primaryPanelId?: string;\n    security?: AppPlatformSecuritySummary;\n    dataSchemaVersion: number;\n    contentSha256?: string;\n    enabled?: boolean;\n    activate?: boolean;\n  }): Promise<AppRegistryAppRecord> => {\n    return await this.withMutation(async () => {\n      const registry = await this.load();\n      const currentRecord = registry.apps[params.appId];\n      const currentPublisher =\n        currentRecord?.publisher ??\n        currentRecord?.installedVersions[currentRecord.activeVersion]\n          ?.publisher;\n      if (currentPublisher && currentPublisher.id !== params.publisher?.id) {\n        throw new Error(\n          `应用 ${params.appId} 已绑定发布者 ${currentPublisher.id}，拒绝由 ${params.publisher?.id ?? \"未验证本地来源\"} 覆盖。`,\n        );\n      }\n      const activeVersion =\n        params.activate === false && currentRecord\n          ? currentRecord.activeVersion\n          : params.version;\n      const activePermissions =\n        activeVersion === params.version\n          ? params.permissions\n          : (currentRecord?.installedVersions[activeVersion]?.permissions ??\n            {});\n      const nextRecord: AppRegistryAppRecord = {\n        appId: params.appId,\n        name: params.name,\n        description: params.description,\n        publisher: currentPublisher ?? params.publisher,\n        activeVersion,\n        enabled:\n          params.enabled ??\n          currentRecord?.enabled ??\n          params.manifestSchemaVersion === 1,\n        dataDirectory: params.defaultInstance.storage.dataDirectory,\n        defaultInstance: params.defaultInstance,\n        installedVersions: {\n          ...(currentRecord?.installedVersions ?? {}),\n          [params.version]: {\n            version: params.version,\n            installDirectory: params.installDirectory,\n            sourceKind: params.sourceKind,\n            sourceRef: params.sourceRef,\n            installedAt: params.installedAt,\n            distributionMode: params.distributionMode,\n            permissions: params.permissions,\n            registryUrl: params.registryUrl,\n            bundleUrl: params.bundleUrl,\n            sha256: params.sha256,\n            target: params.target,\n            publisher: params.publisher,\n            manifestSchemaVersion: params.manifestSchemaVersion,\n            components: params.components,\n            primaryPanelId: params.primaryPanelId,\n            security: params.security,\n            dataSchemaVersion: params.dataSchemaVersion,\n            contentSha256: params.contentSha256,\n          },\n        },\n        grants: this.parser.retainCompatibleDocumentGrants(\n          currentRecord?.grants ?? {},\n          activePermissions,\n        ),\n        // A SecretRef is an active permission, not retained App data. Keep only\n        // bindings declared by the active version so an update cannot leave an\n        // undeclared credential reachable by a later runtime snapshot.\n        secretBindings: this.parser.retainDeclaredSecretBindings(\n          currentRecord?.secretBindings ?? {},\n          activePermissions,\n        ),\n      };\n      registry.apps[params.appId] = nextRecord;\n      await this.saveUnlocked(registry);\n      return nextRecord;\n    });\n  };\n\n  setEnabled = async (\n    appId: string,\n    enabled: boolean,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => ({ ...record, enabled }));\n  };\n\n  activateVersion = async (\n    appId: string,\n    version: string,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => {\n      if (!record.installedVersions[version]) {\n        throw new Error(`应用 ${appId} 未安装版本 ${version}。`);\n      }\n      return {\n        ...record,\n        activeVersion: version,\n        grants: this.parser.retainCompatibleDocumentGrants(\n          record.grants,\n          record.installedVersions[version].permissions,\n        ),\n        secretBindings: this.parser.retainDeclaredSecretBindings(\n          record.secretBindings,\n          record.installedVersions[version].permissions,\n        ),\n      };\n    });\n  };\n\n  setVersionContentDigest = async (\n    appId: string,\n    version: string,\n    contentSha256: string,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => {\n      const installedVersion = record.installedVersions[version];\n      if (!installedVersion) {\n        throw new Error(`应用 ${appId} 未安装版本 ${version}。`);\n      }\n      if (\n        installedVersion.contentSha256 &&\n        installedVersion.contentSha256 !== contentSha256\n      ) {\n        throw new Error(\n          `应用 ${appId}@${version} 已存在不同的代码完整性摘要。`,\n        );\n      }\n      return {\n        ...record,\n        installedVersions: {\n          ...record.installedVersions,\n          [version]: { ...installedVersion, contentSha256 },\n        },\n      };\n    });\n  };\n\n  updateGrants = async (\n    appId: string,\n    grants: AppDocumentGrantMap,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => {\n      const permissions =\n        record.installedVersions[record.activeVersion]?.permissions ?? {};\n      const scopes = new Map(\n        (permissions.documentAccess ?? []).map((scope) => [scope.id, scope]),\n      );\n      const now = new Date().toISOString();\n      const stored = Object.fromEntries(\n        Object.entries(grants).map(([scopeId, directoryPath]) => {\n          const scope = scopes.get(scopeId);\n          if (!scope)\n            throw new Error(\n              `应用 ${appId} 未声明 documentAccess scope：${scopeId}`,\n            );\n          return [\n            scopeId,\n            { path: directoryPath, mode: scope.mode, grantedAt: now },\n          ];\n        }),\n      );\n      return { ...record, grants: { ...record.grants, ...stored } };\n    });\n  };\n\n  setDocumentGrant = async (\n    appId: string,\n    scopeId: string,\n    directoryPath: string,\n    mode?: \"read\" | \"read-write\",\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => {\n      const scope = record.installedVersions[\n        record.activeVersion\n      ]?.permissions.documentAccess?.find((entry) => entry.id === scopeId);\n      if (!scope)\n        throw new Error(\n          `应用 ${appId} 未声明 documentAccess scope：${scopeId}`,\n        );\n      const effectiveMode = mode ?? scope.mode;\n      if (effectiveMode === \"read-write\" && scope.mode !== \"read-write\") {\n        throw new Error(\n          `应用 ${appId} 的 documentAccess scope ${scopeId} 只声明了 read。`,\n        );\n      }\n      return {\n        ...record,\n        grants: {\n          ...record.grants,\n          [scopeId]: {\n            path: directoryPath,\n            mode: effectiveMode,\n            grantedAt: new Date().toISOString(),\n          },\n        },\n      };\n    });\n  };\n\n  restoreDocumentGrant = async (\n    appId: string,\n    scopeId: string,\n    grant: AppStoredDocumentGrant | undefined,\n  ): Promise<void> => {\n    await this.updateApp(appId, (record) => {\n      const grants = { ...record.grants };\n      if (grant) grants[scopeId] = grant;\n      else delete grants[scopeId];\n      return { ...record, grants };\n    });\n  };\n\n  removeDocumentGrant = async (\n    appId: string,\n    scopeId: string,\n  ): Promise<boolean> => {\n    let removed = false;\n    await this.updateApp(appId, (record) => {\n      if (!(scopeId in record.grants)) {\n        return record;\n      }\n      const grants = { ...record.grants };\n      delete grants[scopeId];\n      removed = true;\n      return { ...record, grants };\n    });\n    return removed;\n  };\n\n  bindSecret = async (\n    appId: string,\n    slotId: string,\n    binding: AppSecretBinding,\n  ): Promise<AppRegistryAppRecord> => {\n    const normalizedSlotId = this.parser.parseSecretSlotId(\n      slotId,\n      \"secret slot id\",\n    );\n    const normalizedBinding = this.parser.parseSecretBinding(\n      binding,\n      `secret binding ${normalizedSlotId}`,\n    );\n    return await this.updateApp(appId, (record) => {\n      const activeVersion = record.installedVersions[record.activeVersion];\n      const declaredSlots = activeVersion?.permissions.secrets ?? [];\n      if (!declaredSlots.some((slot) => slot.id === normalizedSlotId)) {\n        throw new Error(\n          `应用 ${appId} 未声明 Secret slot：${normalizedSlotId}`,\n        );\n      }\n      return {\n        ...record,\n        secretBindings: {\n          ...record.secretBindings,\n          [normalizedSlotId]: normalizedBinding,\n        },\n      };\n    });\n  };\n\n  unbindSecret = async (appId: string, slotId: string): Promise<boolean> => {\n    const normalizedSlotId = this.parser.parseSecretSlotId(\n      slotId,\n      \"secret slot id\",\n    );\n    let removed = false;\n    await this.updateApp(appId, (record) => {\n      if (!(normalizedSlotId in record.secretBindings)) {\n        return record;\n      }\n      const secretBindings = { ...record.secretBindings };\n      delete secretBindings[normalizedSlotId];\n      removed = true;\n      return { ...record, secretBindings };\n    });\n    return removed;\n  };\n\n  removeApp = async (\n    appId: string,\n  ): Promise<AppRegistryAppRecord | undefined> => {\n    return await this.withMutation(async () => {\n      const registry = await this.load();\n      const appRecord = registry.apps[appId];\n      if (!appRecord) {\n        return undefined;\n      }\n      delete registry.apps[appId];\n      await this.saveUnlocked(registry);\n      return appRecord;\n    });\n  };\n\n  isBuiltInSuppressed = async (appId: string): Promise<boolean> => {\n    const registry = await this.load();\n    return Boolean(registry.suppressedBuiltIns[appId]);\n  };\n\n  setBuiltInSuppressed = async (\n    appId: string,\n    suppressed: boolean,\n  ): Promise<void> => {\n    await this.withMutation(async () => {\n      const registry = await this.load();\n      if (suppressed) {\n        registry.suppressedBuiltIns[appId] = {\n          suppressedAt: new Date().toISOString(),\n        };\n      } else {\n        delete registry.suppressedBuiltIns[appId];\n      }\n      await this.saveUnlocked(registry);\n    });\n  };\n\n  private updateApp = async (\n    appId: string,\n    update: (record: AppRegistryAppRecord) => AppRegistryAppRecord,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.withMutation(async () => {\n      const registry = await this.load();\n      const appRecord = registry.apps[appId];\n      if (!appRecord) {\n        throw new Error(`未找到已安装应用：${appId}`);\n      }\n      const nextRecord = update(appRecord);\n      registry.apps[appId] = nextRecord;\n      await this.saveUnlocked(registry);\n      return nextRecord;\n    });\n  };\n\n  private withMutation = async <T>(operation: () => Promise<T>): Promise<T> => {\n    const registryPath = path.resolve(this.appHomeService.getRegistryPath());\n    return await this.fileLockService.withLock(\n      `${registryPath}.lock`,\n      operation,\n    );\n  };\n\n  private isMissingFileError = (error: unknown): boolean =>\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    (error as { code?: unknown }).code === \"ENOENT\";\n}\n"],"mappings":";;;;;;AAuBA,IAAa,qBAAb,MAAgC;CAC9B,kBAAmC,IAAI,iBAAiB;CACxD;CAEA,YACE,iBAAkD,IAAI,gBAAgB,EACtE;AADiB,OAAA,iBAAA;AAEjB,OAAK,SAAS,IAAI,yBAAyB,eAAe;;CAG5D,OAAO,YAAkC;AACvC,MAAI;GACF,MAAM,MAAM,MAAM,SAChB,KAAK,eAAe,iBAAiB,EACrC,QACD;AACD,UAAO,KAAK,OAAO,MAAM,KAAK,MAAM,IAAI,CAAY;WAC7C,OAAO;AACd,OAAI,KAAK,mBAAmB,MAAM,CAChC,QAAO;IAAE,eAAe;IAAG,MAAM,EAAE;IAAE,oBAAoB,EAAE;IAAE;AAE/D,SAAM;;;CAIV,OAAO,OAAO,aAAyC;AACrD,QAAM,KAAK,aAAa,YAAY,MAAM,KAAK,aAAa,SAAS,CAAC;;CAGxE,eAAuB,OAAO,aAAyC;AACrE,QAAM,KAAK,eAAe,uBAAuB;EACjD,MAAM,eAAe,KAAK,eAAe,iBAAiB;EAC1D,MAAM,gBAAgB,KAAK,KACzB,KAAK,QAAQ,aAAa,EAC1B,IAAI,KAAK,SAAS,aAAa,CAAC,GAAG,QAAQ,IAAI,GAAG,KAAK,KAAK,CAAC,MAC9D;EACD,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,IAAM;AACrD,MAAI;AACF,SAAM,OAAO,UAAU,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,KAAK,QAAQ;AACzE,SAAM,OAAO,MAAM;YACX;AACR,SAAM,OAAO,OAAO;;AAEtB,MAAI;AACF,SAAM,OAAO,eAAe,aAAa;WAClC,OAAO;AACd,SAAM,GAAG,eAAe,EAAE,OAAO,MAAM,CAAC;AACxC,SAAM;;;CAIV,WAAW,YAA6C;EACtD,MAAM,WAAW,MAAM,KAAK,MAAM;AAClC,SAAO,OAAO,OAAO,SAAS,KAAK,CAAC,MAAM,MAAM,UAC9C,KAAK,MAAM,cAAc,MAAM,MAAM,CACtC;;CAGH,SAAS,OAAO,UAA6D;AAE3E,UADiB,MAAM,KAAK,MAAM,EAClB,KAAK;;CAGvB,mBAAmB,OACjB,UACqD;EACrD,MAAM,YAAY,MAAM,KAAK,OAAO,MAAM;AAC1C,SAAO,WAAW,kBAAkB,UAAU;;CAGhD,qBAAqB,OAAO,WAyBS;AACnC,SAAO,MAAM,KAAK,aAAa,YAAY;GACzC,MAAM,WAAW,MAAM,KAAK,MAAM;GAClC,MAAM,gBAAgB,SAAS,KAAK,OAAO;GAC3C,MAAM,mBACJ,eAAe,aACf,eAAe,kBAAkB,cAAc,gBAC3C;AACN,OAAI,oBAAoB,iBAAiB,OAAO,OAAO,WAAW,GAChE,OAAM,IAAI,MACR,MAAM,OAAO,MAAM,UAAU,iBAAiB,GAAG,OAAO,OAAO,WAAW,MAAM,UAAU,MAC3F;GAEH,MAAM,gBACJ,OAAO,aAAa,SAAS,gBACzB,cAAc,gBACd,OAAO;GACb,MAAM,oBACJ,kBAAkB,OAAO,UACrB,OAAO,cACN,eAAe,kBAAkB,gBAAgB,eAClD,EAAE;GACR,MAAM,aAAmC;IACvC,OAAO,OAAO;IACd,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,WAAW,oBAAoB,OAAO;IACtC;IACA,SACE,OAAO,WACP,eAAe,WACf,OAAO,0BAA0B;IACnC,eAAe,OAAO,gBAAgB,QAAQ;IAC9C,iBAAiB,OAAO;IACxB,mBAAmB;KACjB,GAAI,eAAe,qBAAqB,EAAE;MACzC,OAAO,UAAU;MAChB,SAAS,OAAO;MAChB,kBAAkB,OAAO;MACzB,YAAY,OAAO;MACnB,WAAW,OAAO;MAClB,aAAa,OAAO;MACpB,kBAAkB,OAAO;MACzB,aAAa,OAAO;MACpB,aAAa,OAAO;MACpB,WAAW,OAAO;MAClB,QAAQ,OAAO;MACf,QAAQ,OAAO;MACf,WAAW,OAAO;MAClB,uBAAuB,OAAO;MAC9B,YAAY,OAAO;MACnB,gBAAgB,OAAO;MACvB,UAAU,OAAO;MACjB,mBAAmB,OAAO;MAC1B,eAAe,OAAO;MACvB;KACF;IACD,QAAQ,KAAK,OAAO,+BAClB,eAAe,UAAU,EAAE,EAC3B,kBACD;IAID,gBAAgB,KAAK,OAAO,6BAC1B,eAAe,kBAAkB,EAAE,EACnC,kBACD;IACF;AACD,YAAS,KAAK,OAAO,SAAS;AAC9B,SAAM,KAAK,aAAa,SAAS;AACjC,UAAO;IACP;;CAGJ,aAAa,OACX,OACA,YACkC;AAClC,SAAO,MAAM,KAAK,UAAU,QAAQ,YAAY;GAAE,GAAG;GAAQ;GAAS,EAAE;;CAG1E,kBAAkB,OAChB,OACA,YACkC;AAClC,SAAO,MAAM,KAAK,UAAU,QAAQ,WAAW;AAC7C,OAAI,CAAC,OAAO,kBAAkB,SAC5B,OAAM,IAAI,MAAM,MAAM,MAAM,SAAS,QAAQ,GAAG;AAElD,UAAO;IACL,GAAG;IACH,eAAe;IACf,QAAQ,KAAK,OAAO,+BAClB,OAAO,QACP,OAAO,kBAAkB,SAAS,YACnC;IACD,gBAAgB,KAAK,OAAO,6BAC1B,OAAO,gBACP,OAAO,kBAAkB,SAAS,YACnC;IACF;IACD;;CAGJ,0BAA0B,OACxB,OACA,SACA,kBACkC;AAClC,SAAO,MAAM,KAAK,UAAU,QAAQ,WAAW;GAC7C,MAAM,mBAAmB,OAAO,kBAAkB;AAClD,OAAI,CAAC,iBACH,OAAM,IAAI,MAAM,MAAM,MAAM,SAAS,QAAQ,GAAG;AAElD,OACE,iBAAiB,iBACjB,iBAAiB,kBAAkB,cAEnC,OAAM,IAAI,MACR,MAAM,MAAM,GAAG,QAAQ,iBACxB;AAEH,UAAO;IACL,GAAG;IACH,mBAAmB;KACjB,GAAG,OAAO;MACT,UAAU;MAAE,GAAG;MAAkB;MAAe;KAClD;IACF;IACD;;CAGJ,eAAe,OACb,OACA,WACkC;AAClC,SAAO,MAAM,KAAK,UAAU,QAAQ,WAAW;GAC7C,MAAM,cACJ,OAAO,kBAAkB,OAAO,gBAAgB,eAAe,EAAE;GACnE,MAAM,SAAS,IAAI,KAChB,YAAY,kBAAkB,EAAE,EAAE,KAAK,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,CACrE;GACD,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;GACpC,MAAM,SAAS,OAAO,YACpB,OAAO,QAAQ,OAAO,CAAC,KAAK,CAAC,SAAS,mBAAmB;IACvD,MAAM,QAAQ,OAAO,IAAI,QAAQ;AACjC,QAAI,CAAC,MACH,OAAM,IAAI,MACR,MAAM,MAAM,4BAA4B,UACzC;AACH,WAAO,CACL,SACA;KAAE,MAAM;KAAe,MAAM,MAAM;KAAM,WAAW;KAAK,CAC1D;KACD,CACH;AACD,UAAO;IAAE,GAAG;IAAQ,QAAQ;KAAE,GAAG,OAAO;KAAQ,GAAG;KAAQ;IAAE;IAC7D;;CAGJ,mBAAmB,OACjB,OACA,SACA,eACA,SACkC;AAClC,SAAO,MAAM,KAAK,UAAU,QAAQ,WAAW;GAC7C,MAAM,QAAQ,OAAO,kBACnB,OAAO,gBACN,YAAY,gBAAgB,MAAM,UAAU,MAAM,OAAO,QAAQ;AACpE,OAAI,CAAC,MACH,OAAM,IAAI,MACR,MAAM,MAAM,4BAA4B,UACzC;GACH,MAAM,gBAAgB,QAAQ,MAAM;AACpC,OAAI,kBAAkB,gBAAgB,MAAM,SAAS,aACnD,OAAM,IAAI,MACR,MAAM,MAAM,0BAA0B,QAAQ,aAC/C;AAEH,UAAO;IACL,GAAG;IACH,QAAQ;KACN,GAAG,OAAO;MACT,UAAU;MACT,MAAM;MACN,MAAM;MACN,4BAAW,IAAI,MAAM,EAAC,aAAa;MACpC;KACF;IACF;IACD;;CAGJ,uBAAuB,OACrB,OACA,SACA,UACkB;AAClB,QAAM,KAAK,UAAU,QAAQ,WAAW;GACtC,MAAM,SAAS,EAAE,GAAG,OAAO,QAAQ;AACnC,OAAI,MAAO,QAAO,WAAW;OACxB,QAAO,OAAO;AACnB,UAAO;IAAE,GAAG;IAAQ;IAAQ;IAC5B;;CAGJ,sBAAsB,OACpB,OACA,YACqB;EACrB,IAAI,UAAU;AACd,QAAM,KAAK,UAAU,QAAQ,WAAW;AACtC,OAAI,EAAE,WAAW,OAAO,QACtB,QAAO;GAET,MAAM,SAAS,EAAE,GAAG,OAAO,QAAQ;AACnC,UAAO,OAAO;AACd,aAAU;AACV,UAAO;IAAE,GAAG;IAAQ;IAAQ;IAC5B;AACF,SAAO;;CAGT,aAAa,OACX,OACA,QACA,YACkC;EAClC,MAAM,mBAAmB,KAAK,OAAO,kBACnC,QACA,iBACD;EACD,MAAM,oBAAoB,KAAK,OAAO,mBACpC,SACA,kBAAkB,mBACnB;AACD,SAAO,MAAM,KAAK,UAAU,QAAQ,WAAW;AAG7C,OAAI,EAFkB,OAAO,kBAAkB,OAAO,gBACjB,YAAY,WAAW,EAAE,EAC3C,MAAM,SAAS,KAAK,OAAO,iBAAiB,CAC7D,OAAM,IAAI,MACR,MAAM,MAAM,mBAAmB,mBAChC;AAEH,UAAO;IACL,GAAG;IACH,gBAAgB;KACd,GAAG,OAAO;MACT,mBAAmB;KACrB;IACF;IACD;;CAGJ,eAAe,OAAO,OAAe,WAAqC;EACxE,MAAM,mBAAmB,KAAK,OAAO,kBACnC,QACA,iBACD;EACD,IAAI,UAAU;AACd,QAAM,KAAK,UAAU,QAAQ,WAAW;AACtC,OAAI,EAAE,oBAAoB,OAAO,gBAC/B,QAAO;GAET,MAAM,iBAAiB,EAAE,GAAG,OAAO,gBAAgB;AACnD,UAAO,eAAe;AACtB,aAAU;AACV,UAAO;IAAE,GAAG;IAAQ;IAAgB;IACpC;AACF,SAAO;;CAGT,YAAY,OACV,UAC8C;AAC9C,SAAO,MAAM,KAAK,aAAa,YAAY;GACzC,MAAM,WAAW,MAAM,KAAK,MAAM;GAClC,MAAM,YAAY,SAAS,KAAK;AAChC,OAAI,CAAC,UACH;AAEF,UAAO,SAAS,KAAK;AACrB,SAAM,KAAK,aAAa,SAAS;AACjC,UAAO;IACP;;CAGJ,sBAAsB,OAAO,UAAoC;EAC/D,MAAM,WAAW,MAAM,KAAK,MAAM;AAClC,SAAO,QAAQ,SAAS,mBAAmB,OAAO;;CAGpD,uBAAuB,OACrB,OACA,eACkB;AAClB,QAAM,KAAK,aAAa,YAAY;GAClC,MAAM,WAAW,MAAM,KAAK,MAAM;AAClC,OAAI,WACF,UAAS,mBAAmB,SAAS,EACnC,+BAAc,IAAI,MAAM,EAAC,aAAa,EACvC;OAED,QAAO,SAAS,mBAAmB;AAErC,SAAM,KAAK,aAAa,SAAS;IACjC;;CAGJ,YAAoB,OAClB,OACA,WACkC;AAClC,SAAO,MAAM,KAAK,aAAa,YAAY;GACzC,MAAM,WAAW,MAAM,KAAK,MAAM;GAClC,MAAM,YAAY,SAAS,KAAK;AAChC,OAAI,CAAC,UACH,OAAM,IAAI,MAAM,YAAY,QAAQ;GAEtC,MAAM,aAAa,OAAO,UAAU;AACpC,YAAS,KAAK,SAAS;AACvB,SAAM,KAAK,aAAa,SAAS;AACjC,UAAO;IACP;;CAGJ,eAAuB,OAAU,cAA4C;EAC3E,MAAM,eAAe,KAAK,QAAQ,KAAK,eAAe,iBAAiB,CAAC;AACxE,SAAO,MAAM,KAAK,gBAAgB,SAChC,GAAG,aAAa,QAChB,UACD;;CAGH,sBAA8B,UAC5B,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA6B,SAAS"}

package/dist/services/app-rust-wasi-scaffold-template.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-rust-wasi-scaffold-template.service.d.ts","names":[],"sources":["../../src/services/app-rust-wasi-scaffold-template.service.ts"],"mappings":";;;cAaa,kCAAA;EACX,UAAA,GAAc,MAAA;IAAU,KAAA;IAAe,OAAA;EAAA,MAAoB,eAAA;EAAA,QAqCnD,aAAA;EAAA,QAwBA,kBAAA;EAAA,QASA,oBAAA;EAAA,QAoBA,wBAAA;EAAA,QAkBA,cAAA;EAAA,QAcA,eAAA;EAAA,QAuEA,WAAA;EAAA,QAwCA,cAAA;EAAA,QA6BA,gBAAA;EAAA,QA4BA,wBAAA;EAAA,QAmBA,aAAA;EAAA,QAMA,YAAA;AAAA"}
+{"version":3,"file":"app-rust-wasi-scaffold-template.service.d.ts","names":[],"sources":["../../src/services/app-rust-wasi-scaffold-template.service.ts"],"mappings":";;;cAkCa,kCAAA;EACX,UAAA,GAAc,MAAA;IAAU,KAAA;IAAe,OAAA;EAAA,MAAoB,eAAA;EAAA,QAsCnD,aAAA;EAAA,QAwBA,kBAAA;EAAA,QASA,oBAAA;EAAA,QAoBA,wBAAA;EAAA,QAkBA,cAAA;EAAA,QA4BA,eAAA;EAAA,QAyEA,WAAA;EAAA,QAwCA,cAAA;EAAA,QA6BA,gBAAA;EAAA,QA4BA,wBAAA;EAAA,QAmBA,aAAA;EAAA,QAMA,YAAA;AAAA"}

package/dist/services/app-rust-wasi-scaffold-template.service.js

@@ -2,6 +2,26 @@ import { readFileSync } from "node:fs";
 //#region src/services/app-rust-wasi-scaffold-template.service.ts
 const RUST_WASI_GUEST_CRATE_NAME = "nextclaw-rust-wasi-guest";
 const PORTABLE_SERVICE_WIT = readFileSync(new URL("../../resources/wit/portable-service.wit", import.meta.url), "utf8");
+const STANDARD_PORTABLE_WIT_DEPS = [
+	"deps/http@0.2.6/package.wit",
+	"deps/http@0.2.6/handler.wit",
+	"deps/http@0.2.6/types.wit",
+	"deps/io@0.2.6/error.wit",
+	"deps/io@0.2.6/poll.wit",
+	"deps/io@0.2.6/streams.wit",
+	"deps/io@0.2.6/world.wit",
+	"deps/clocks@0.2.6/monotonic-clock.wit",
+	"deps/clocks@0.2.6/timezone.wit",
+	"deps/clocks@0.2.6/wall-clock.wit",
+	"deps/clocks@0.2.6/world.wit",
+	"deps/config@0.2.0-draft-2024-09-27/package.wit",
+	"deps/config@0.2.0-draft-2024-09-27/store.wit",
+	"deps/spin@2.0.0/package.wit",
+	"deps/spin@2.0.0/sqlite.wit"
+].map((relativePath) => ({
+	relativePath: `guest/wit/${relativePath}`,
+	content: readFileSync(new URL(`../../resources/wit/${relativePath}`, import.meta.url), "utf8")
+}));
 const RUST_WASI_CARGO_LOCK = readFileSync(new URL("../../resources/rust-wasi/Cargo.lock", import.meta.url), "utf8");
 var AppRustWasiScaffoldTemplateService = class {
 	buildFiles = (params) => {
@@ -54,6 +74,7 @@ var AppRustWasiScaffoldTemplateService = class {
 				relativePath: "guest/wit/portable-service.wit",
 				content: PORTABLE_SERVICE_WIT
 			},
+			...STANDARD_PORTABLE_WIT_DEPS,
 			{
 				relativePath: "tests/service-smoke.json",
 				content: `${JSON.stringify(this.buildServiceSmokeFixture(serviceId), null, 2)}\n`
@@ -154,10 +175,26 @@ wit-bindgen = "0.44.0"
 
 [lib]
 crate-type = ["cdylib"]
+
+[package.metadata.component]
+package = "nextclaw:portable-service"
+
+[package.metadata.component.target]
+path = "wit"
+world = "service-app"
+
+[package.metadata.component.target.dependencies]
+"fermyon:spin" = { path = "wit/deps/spin@2.0.0" }
+"wasi:http" = { path = "wit/deps/http@0.2.6" }
+"wasi:io" = { path = "wit/deps/io@0.2.6" }
+"wasi:clocks" = { path = "wit/deps/clocks@0.2.6" }
+"wasi:config" = { path = "wit/deps/config@0.2.0-draft-2024-09-27" }
 `;
 	buildRustSource = () => `wit_bindgen::generate!({
     path: "wit",
     world: "service-app",
+    // Generate standard WASI HTTP's transitive interfaces for later use by a Guest.
+    generate_all,
 });
 
 use exports::nextclaw::portable_service::service::{Action, Guest};

package/dist/services/app-rust-wasi-scaffold-template.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-rust-wasi-scaffold-template.service.js","names":[],"sources":["../../src/services/app-rust-wasi-scaffold-template.service.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport type { AppScaffoldFile } from \"./app-ts-http-scaffold-template.service.js\";\n\nconst RUST_WASI_GUEST_CRATE_NAME = \"nextclaw-rust-wasi-guest\";\nconst PORTABLE_SERVICE_WIT = readFileSync(\n  new URL(\"../../resources/wit/portable-service.wit\", import.meta.url),\n  \"utf8\",\n);\nconst RUST_WASI_CARGO_LOCK = readFileSync(\n  new URL(\"../../resources/rust-wasi/Cargo.lock\", import.meta.url),\n  \"utf8\",\n);\n\nexport class AppRustWasiScaffoldTemplateService {\n  buildFiles = (params: { appId: string; appName: string }): AppScaffoldFile[] => {\n    const { appId, appName } = params;\n    const packageSlug = appId.replace(/[^a-z0-9]+/g, \"-\");\n    const panelId = `${packageSlug}-panel`;\n    const serviceId = `${packageSlug}-service`;\n    return [\n      {\n        relativePath: \"manifest.json\",\n        content: `${JSON.stringify(this.buildManifest(appId, appName, panelId, serviceId), null, 2)}\\n`,\n      },\n      {\n        relativePath: \"marketplace.json\",\n        content: `${JSON.stringify(this.buildMarketplaceMetadata(appName), null, 2)}\\n`,\n      },\n      { relativePath: \"README.md\", content: this.buildReadme(appName, serviceId) },\n      {\n        relativePath: `panels/${panelId}.panel/panel-app.json`,\n        content: `${JSON.stringify(this.buildPanelManifest(panelId, appName, serviceId), null, 2)}\\n`,\n      },\n      { relativePath: `panels/${panelId}.panel/index.html`, content: this.buildPanelHtml(appName) },\n      { relativePath: `panels/${panelId}.panel/app.js`, content: this.buildPanelScript(serviceId) },\n      {\n        relativePath: `service-components/${serviceId}/service-app.json`,\n        content: `${JSON.stringify(this.buildServiceManifest(serviceId), null, 2)}\\n`,\n      },\n      { relativePath: \"guest/Cargo.toml\", content: this.buildCargoToml() },\n      { relativePath: \"guest/Cargo.lock\", content: RUST_WASI_CARGO_LOCK },\n      { relativePath: \"guest/src/lib.rs\", content: this.buildRustSource() },\n      { relativePath: \"guest/wit/portable-service.wit\", content: PORTABLE_SERVICE_WIT },\n      {\n        relativePath: \"tests/service-smoke.json\",\n        content: `${JSON.stringify(this.buildServiceSmokeFixture(serviceId), null, 2)}\\n`,\n      },\n      { relativePath: \"assets/icon.svg\", content: this.buildIconSvg() },\n    ];\n  };\n\n  private buildManifest = (\n    appId: string,\n    appName: string,\n    panelId: string,\n    serviceId: string,\n  ) => ({\n    schemaVersion: 2,\n    id: appId,\n    name: appName,\n    version: \"0.1.0\",\n    description: `${appName}，由 Rust/WASI Component 保存持久计数。`,\n    icon: \"assets/icon.svg\",\n    engines: { nextclaw: \">=0.45.4\" },\n    presentation: { primaryPanel: panelId },\n    runtime: { profile: \"wasi\" },\n    distribution: { mode: \"universal\" },\n    storage: { scope: \"global\", schemaVersion: 1 },\n    permissions: { storage: { namespace: appId.replace(/\\./g, \"-\") } },\n    components: [\n      { kind: \"panel\", path: `panels/${panelId}.panel` },\n      { kind: \"service\", path: `service-components/${serviceId}` },\n    ],\n  });\n\n  private buildPanelManifest = (panelId: string, appName: string, serviceId: string) => ({\n    id: panelId,\n    title: appName,\n    description: \"读取并增加由 Rust/WASI Component 持久保存的计数。\",\n    icon: \"🦀\",\n    entry: \"index.html\",\n    actions: [`${serviceId}.counter_read`, `${serviceId}.counter_increment`],\n  });\n\n  private buildServiceManifest = (serviceId: string) => ({\n    id: serviceId,\n    title: \"Rust/WASI 持久计数组件\",\n    description: \"通过宿主 KV 读取和增加持久计数。\",\n    protocol: \"wasi-component\",\n    component: { entry: \"service.wasm\" },\n    actions: {\n      counter_read: { risk: \"read\", title: \"读取持久计数\" },\n      counter_increment: {\n        risk: \"write\",\n        title: \"增加持久计数\",\n        inputSchema: {\n          type: \"object\",\n          properties: { step: { type: \"integer\", minimum: 1, maximum: 100 } },\n          additionalProperties: false,\n        },\n      },\n    },\n  });\n\n  private buildServiceSmokeFixture = (serviceId: string) => ({\n    schemaVersion: 1,\n    component: serviceId,\n    resetData: true,\n    steps: [\n      {\n        action: \"counter_increment\",\n        input: { step: 3 },\n        expect: { counter: 3, persistedBy: \"host.kv\" },\n      },\n      {\n        action: \"counter_read\",\n        input: {},\n        expect: { counter: 3, persistedBy: \"host.kv\" },\n      },\n    ],\n  });\n\n  private buildCargoToml = (): string => `[package]\nname = \"${RUST_WASI_GUEST_CRATE_NAME}\"\nversion = \"0.1.0\"\nedition = \"2024\"\npublish = false\n\n[dependencies]\nserde_json = \"1.0\"\nwit-bindgen = \"0.44.0\"\n\n[lib]\ncrate-type = [\"cdylib\"]\n`;\n\n  private buildRustSource = (): string => `wit_bindgen::generate!({\n    path: \"wit\",\n    world: \"service-app\",\n});\n\nuse exports::nextclaw::portable_service::service::{Action, Guest};\nuse nextclaw::portable_service::host;\nuse serde_json::{Value, json};\n\nstruct Component;\n\nimpl Guest for Component {\n    fn list_actions() -> Vec<Action> {\n        vec![\n            Action {\n                name: \"counter_read\".into(),\n                title: \"读取持久计数\".into(),\n                description: \"从宿主管理的 KV 存储读取计数。\".into(),\n            },\n            Action {\n                name: \"counter_increment\".into(),\n                title: \"增加持久计数\".into(),\n                description: \"在 Rust/WASM 中计算，并通过宿主 KV 持久化。\".into(),\n            },\n        ]\n    }\n\n    fn invoke(action: String, input_json: String) -> Result<String, String> {\n        host::log(host::LogLevel::Info, &format!(\"invoking {action}\"));\n        let input: Value = serde_json::from_str(&input_json).unwrap_or_else(|_| json!({}));\n        match action.as_str() {\n            \"counter_read\" => Ok(counter_result(read_counter()?)),\n            \"counter_increment\" => {\n                let step = input.get(\"step\").and_then(Value::as_i64).unwrap_or(1);\n                if !(1..=100).contains(&step) {\n                    return Err(\"INVALID_INPUT: step must be between 1 and 100\".into());\n                }\n                let counter = read_counter()?.saturating_add(step);\n                host::kv_set(\"counter\", &counter.to_string())?;\n                Ok(counter_result(counter))\n            }\n            _ => Err(format!(\"UNKNOWN_ACTION: {action}\")),\n        }\n    }\n\n    fn start(_config_json: String) -> Result<String, String> {\n        Ok(json!({ \"started\": true, \"mode\": \"action\" }).to_string())\n    }\n\n    fn handle_event(_event_json: String) -> Result<String, String> {\n        Err(\"UNSUPPORTED_LIFECYCLE: action component does not accept resident events\".into())\n    }\n\n    fn stop(_reason_json: String) -> Result<String, String> {\n        Ok(json!({ \"stopped\": true, \"mode\": \"action\" }).to_string())\n    }\n}\n\nfn read_counter() -> Result<i64, String> {\n    Ok(host::kv_get(\"counter\")?\n        .and_then(|value| value.parse().ok())\n        .unwrap_or(0))\n}\n\nfn counter_result(counter: i64) -> String {\n    json!({ \"counter\": counter, \"persistedBy\": \"host.kv\" }).to_string()\n}\n\nexport!(Component with_types_in self);\n`;\n\n  private buildReadme = (appName: string, serviceId: string): string => `# ${appName}\n\n这是一个可以独立构建的 Rust/WASI Component App。Panel 和 Agent 调用同一组 Service Action，计数通过 NextClaw 宿主 KV 持久保存。\n\n## 1. 准备 Rust 工具链\n\n\\`\\`\\`bash\nrustup target add wasm32-wasip2\n\\`\\`\\`\n\n## 2. 构建 Component\n\n\\`\\`\\`bash\ncd guest\ncargo build --release --target wasm32-wasip2\ncp target/wasm32-wasip2/release/nextclaw_rust_wasi_guest.wasm ../service-components/${serviceId}/service.wasm\ncd ..\n\\`\\`\\`\n\n项目内的 \\`guest/wit/portable-service.wit\\` 是当前 Service Action 与宿主能力合同；不需要 NextClaw 源码仓库。\n\n## 3. 检查和调试\n\n\\`\\`\\`bash\nnextclaw app check .\nnextclaw app dev .\nnextclaw app call . counter_read\nnextclaw app call . counter_increment --input '{\"step\":2}'\n\\`\\`\\`\n\n如果一个包包含多个 Service Component，请增加 \\`--component <component-id>\\`。\n\n## 4. 打包和安装\n\n\\`\\`\\`bash\nnextclaw app pack . --target universal --out ${this.normalizeSlug(appName)}.napp\nnextclaw app install ./${this.normalizeSlug(appName)}.napp\n\\`\\`\\`\n`;\n\n  private buildPanelHtml = (appName: string): string => `<!doctype html>\n<html lang=\"zh-CN\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>${appName}</title>\n    <style>\n      :root { font-family: ui-sans-serif, system-ui, sans-serif; color: #172033; background: #f5f7fb; }\n      body { margin: 0; min-height: 100vh; display: grid; place-items: center; }\n      main { width: min(420px, calc(100vw - 40px)); padding: 28px; border-radius: 24px; background: white; box-shadow: 0 18px 60px #24324a1f; }\n      p { color: #667085; }\n      output { display: block; margin: 24px 0; font-size: 64px; font-weight: 700; }\n      button { border: 0; border-radius: 999px; padding: 12px 18px; background: #172033; color: white; cursor: pointer; }\n      #error { color: #b42318; }\n    </style>\n  </head>\n  <body>\n    <main>\n      <h1>${appName}</h1>\n      <p>这个数字由 Rust/WASI Component 计算，并通过宿主 KV 持久保存。</p>\n      <output id=\"counter\">…</output>\n      <button id=\"increment\" type=\"button\">增加 1</button>\n      <p id=\"error\" role=\"alert\"></p>\n    </main>\n    <script src=\"app.js\"></script>\n  </body>\n</html>\n`;\n\n  private buildPanelScript = (serviceId: string): string => `const counter = document.querySelector(\"#counter\");\nconst error = document.querySelector(\"#error\");\nconst increment = document.querySelector(\"#increment\");\n\nasync function readCounter() {\n  error.textContent = \"\";\n  try {\n    const result = await window.nextclaw.serviceActions.invoke(\"${serviceId}.counter_read\", {});\n    counter.textContent = String(result.counter ?? 0);\n  } catch (cause) {\n    error.textContent = cause instanceof Error ? cause.message : String(cause);\n  }\n}\n\nasync function incrementCounter() {\n  error.textContent = \"\";\n  try {\n    const result = await window.nextclaw.serviceActions.invoke(\"${serviceId}.counter_increment\", { step: 1 });\n    counter.textContent = String(result.counter ?? 0);\n  } catch (cause) {\n    error.textContent = cause instanceof Error ? cause.message : String(cause);\n  }\n}\n\nincrement.addEventListener(\"click\", incrementCounter);\nvoid readCounter();\n`;\n\n  private buildMarketplaceMetadata = (appName: string) => ({\n    slug: this.normalizeSlug(appName),\n    summary: `${appName} Rust/WASI Component 示例。`,\n    summaryI18n: {\n      zh: `${appName} Rust/WASI Component 示例。`,\n      en: `${appName}, a Rust/WASI Component example.`,\n    },\n    description: \"A minimal Rust/WASI Component App with a Panel and host-managed persistent KV.\",\n    descriptionI18n: {\n      zh: \"一个包含 Panel 和宿主持久 KV 的最小 Rust/WASI Component App。\",\n      en: \"A minimal Rust/WASI Component App with a Panel and host-managed persistent KV.\",\n    },\n    author: \"NextClaw\",\n    tags: [\"starter\", \"rust\", \"wasi-component\", \"official\"],\n    sourceRepo: \"https://github.com/Peiiii/nextclaw\",\n    homepage: \"https://nextclaw.io\",\n    featured: false,\n  });\n\n  private normalizeSlug = (value: string): string => value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\") || \"rust-wasi-app\";\n\n  private buildIconSvg = (): string => `<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 128 128\">\n  <rect width=\"128\" height=\"128\" rx=\"30\" fill=\"#172033\"/>\n  <path d=\"M31 40h66v48H31z\" fill=\"#fff\" opacity=\".12\"/>\n  <path d=\"M43 52h42v8H43zm0 16h28v8H43z\" fill=\"#fff\"/>\n  <circle cx=\"88\" cy=\"76\" r=\"12\" fill=\"#f59e0b\"/>\n</svg>\n`;\n}\n"],"mappings":";;AAGA,MAAM,6BAA6B;AACnC,MAAM,uBAAuB,aAC3B,IAAI,IAAI,4CAA4C,OAAO,KAAK,IAAI,EACpE,OACD;AACD,MAAM,uBAAuB,aAC3B,IAAI,IAAI,wCAAwC,OAAO,KAAK,IAAI,EAChE,OACD;AAED,IAAa,qCAAb,MAAgD;CAC9C,cAAc,WAAkE;EAC9E,MAAM,EAAE,OAAO,YAAY;EAC3B,MAAM,cAAc,MAAM,QAAQ,eAAe,IAAI;EACrD,MAAM,UAAU,GAAG,YAAY;EAC/B,MAAM,YAAY,GAAG,YAAY;AACjC,SAAO;GACL;IACE,cAAc;IACd,SAAS,GAAG,KAAK,UAAU,KAAK,cAAc,OAAO,SAAS,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC;IAC7F;GACD;IACE,cAAc;IACd,SAAS,GAAG,KAAK,UAAU,KAAK,yBAAyB,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC7E;GACD;IAAE,cAAc;IAAa,SAAS,KAAK,YAAY,SAAS,UAAU;IAAE;GAC5E;IACE,cAAc,UAAU,QAAQ;IAChC,SAAS,GAAG,KAAK,UAAU,KAAK,mBAAmB,SAAS,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC;IAC3F;GACD;IAAE,cAAc,UAAU,QAAQ;IAAoB,SAAS,KAAK,eAAe,QAAQ;IAAE;GAC7F;IAAE,cAAc,UAAU,QAAQ;IAAgB,SAAS,KAAK,iBAAiB,UAAU;IAAE;GAC7F;IACE,cAAc,sBAAsB,UAAU;IAC9C,SAAS,GAAG,KAAK,UAAU,KAAK,qBAAqB,UAAU,EAAE,MAAM,EAAE,CAAC;IAC3E;GACD;IAAE,cAAc;IAAoB,SAAS,KAAK,gBAAgB;IAAE;GACpE;IAAE,cAAc;IAAoB,SAAS;IAAsB;GACnE;IAAE,cAAc;IAAoB,SAAS,KAAK,iBAAiB;IAAE;GACrE;IAAE,cAAc;IAAkC,SAAS;IAAsB;GACjF;IACE,cAAc;IACd,SAAS,GAAG,KAAK,UAAU,KAAK,yBAAyB,UAAU,EAAE,MAAM,EAAE,CAAC;IAC/E;GACD;IAAE,cAAc;IAAmB,SAAS,KAAK,cAAc;IAAE;GAClE;;CAGH,iBACE,OACA,SACA,SACA,eACI;EACJ,eAAe;EACf,IAAI;EACJ,MAAM;EACN,SAAS;EACT,aAAa,GAAG,QAAQ;EACxB,MAAM;EACN,SAAS,EAAE,UAAU,YAAY;EACjC,cAAc,EAAE,cAAc,SAAS;EACvC,SAAS,EAAE,SAAS,QAAQ;EAC5B,cAAc,EAAE,MAAM,aAAa;EACnC,SAAS;GAAE,OAAO;GAAU,eAAe;GAAG;EAC9C,aAAa,EAAE,SAAS,EAAE,WAAW,MAAM,QAAQ,OAAO,IAAI,EAAE,EAAE;EAClE,YAAY,CACV;GAAE,MAAM;GAAS,MAAM,UAAU,QAAQ;GAAS,EAClD;GAAE,MAAM;GAAW,MAAM,sBAAsB;GAAa,CAC7D;EACF;CAED,sBAA8B,SAAiB,SAAiB,eAAuB;EACrF,IAAI;EACJ,OAAO;EACP,aAAa;EACb,MAAM;EACN,OAAO;EACP,SAAS,CAAC,GAAG,UAAU,gBAAgB,GAAG,UAAU,oBAAoB;EACzE;CAED,wBAAgC,eAAuB;EACrD,IAAI;EACJ,OAAO;EACP,aAAa;EACb,UAAU;EACV,WAAW,EAAE,OAAO,gBAAgB;EACpC,SAAS;GACP,cAAc;IAAE,MAAM;IAAQ,OAAO;IAAU;GAC/C,mBAAmB;IACjB,MAAM;IACN,OAAO;IACP,aAAa;KACX,MAAM;KACN,YAAY,EAAE,MAAM;MAAE,MAAM;MAAW,SAAS;MAAG,SAAS;MAAK,EAAE;KACnE,sBAAsB;KACvB;IACF;GACF;EACF;CAED,4BAAoC,eAAuB;EACzD,eAAe;EACf,WAAW;EACX,WAAW;EACX,OAAO,CACL;GACE,QAAQ;GACR,OAAO,EAAE,MAAM,GAAG;GAClB,QAAQ;IAAE,SAAS;IAAG,aAAa;IAAW;GAC/C,EACD;GACE,QAAQ;GACR,OAAO,EAAE;GACT,QAAQ;IAAE,SAAS;IAAG,aAAa;IAAW;GAC/C,CACF;EACF;CAED,uBAAuC;UAC/B,2BAA2B;;;;;;;;;;;;CAanC,wBAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuExC,eAAuB,SAAiB,cAA8B,KAAK,QAAQ;;;;;;;;;;;;;;;sFAeC,UAAU;;;;;;;;;;;;;;;;;;;;+CAoBjD,KAAK,cAAc,QAAQ,CAAC;yBAClD,KAAK,cAAc,QAAQ,CAAC;;;CAInD,kBAA0B,YAA4B;;;;;aAK3C,QAAQ;;;;;;;;;;;;;YAaT,QAAQ;;;;;;;;;;CAWlB,oBAA4B,cAA8B;;;;;;;kEAOM,UAAU;;;;;;;;;;kEAUV,UAAU;;;;;;;;;;CAW1E,4BAAoC,aAAqB;EACvD,MAAM,KAAK,cAAc,QAAQ;EACjC,SAAS,GAAG,QAAQ;EACpB,aAAa;GACX,IAAI,GAAG,QAAQ;GACf,IAAI,GAAG,QAAQ;GAChB;EACD,aAAa;EACb,iBAAiB;GACf,IAAI;GACJ,IAAI;GACL;EACD,QAAQ;EACR,MAAM;GAAC;GAAW;GAAQ;GAAkB;GAAW;EACvD,YAAY;EACZ,UAAU;EACV,UAAU;EACX;CAED,iBAAyB,UAA0B,MAChD,MAAM,CACN,aAAa,CACb,QAAQ,eAAe,IAAI,CAC3B,QAAQ,YAAY,GAAG,IAAI;CAE9B,qBAAqC"}
+{"version":3,"file":"app-rust-wasi-scaffold-template.service.js","names":[],"sources":["../../src/services/app-rust-wasi-scaffold-template.service.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport type { AppScaffoldFile } from \"./app-ts-http-scaffold-template.service.js\";\n\nconst RUST_WASI_GUEST_CRATE_NAME = \"nextclaw-rust-wasi-guest\";\nconst PORTABLE_SERVICE_WIT = readFileSync(\n  new URL(\"../../resources/wit/portable-service.wit\", import.meta.url),\n  \"utf8\",\n);\nconst STANDARD_PORTABLE_WIT_FILES = [\n  \"deps/http@0.2.6/package.wit\",\n  \"deps/http@0.2.6/handler.wit\",\n  \"deps/http@0.2.6/types.wit\",\n  \"deps/io@0.2.6/error.wit\",\n  \"deps/io@0.2.6/poll.wit\",\n  \"deps/io@0.2.6/streams.wit\",\n  \"deps/io@0.2.6/world.wit\",\n  \"deps/clocks@0.2.6/monotonic-clock.wit\",\n  \"deps/clocks@0.2.6/timezone.wit\",\n  \"deps/clocks@0.2.6/wall-clock.wit\",\n  \"deps/clocks@0.2.6/world.wit\",\n  \"deps/config@0.2.0-draft-2024-09-27/package.wit\",\n  \"deps/config@0.2.0-draft-2024-09-27/store.wit\",\n  \"deps/spin@2.0.0/package.wit\",\n  \"deps/spin@2.0.0/sqlite.wit\",\n] as const;\nconst STANDARD_PORTABLE_WIT_DEPS: AppScaffoldFile[] = STANDARD_PORTABLE_WIT_FILES.map((relativePath) => ({\n  relativePath: `guest/wit/${relativePath}`,\n  content: readFileSync(new URL(`../../resources/wit/${relativePath}`, import.meta.url), \"utf8\"),\n}));\nconst RUST_WASI_CARGO_LOCK = readFileSync(\n  new URL(\"../../resources/rust-wasi/Cargo.lock\", import.meta.url),\n  \"utf8\",\n);\n\nexport class AppRustWasiScaffoldTemplateService {\n  buildFiles = (params: { appId: string; appName: string }): AppScaffoldFile[] => {\n    const { appId, appName } = params;\n    const packageSlug = appId.replace(/[^a-z0-9]+/g, \"-\");\n    const panelId = `${packageSlug}-panel`;\n    const serviceId = `${packageSlug}-service`;\n    return [\n      {\n        relativePath: \"manifest.json\",\n        content: `${JSON.stringify(this.buildManifest(appId, appName, panelId, serviceId), null, 2)}\\n`,\n      },\n      {\n        relativePath: \"marketplace.json\",\n        content: `${JSON.stringify(this.buildMarketplaceMetadata(appName), null, 2)}\\n`,\n      },\n      { relativePath: \"README.md\", content: this.buildReadme(appName, serviceId) },\n      {\n        relativePath: `panels/${panelId}.panel/panel-app.json`,\n        content: `${JSON.stringify(this.buildPanelManifest(panelId, appName, serviceId), null, 2)}\\n`,\n      },\n      { relativePath: `panels/${panelId}.panel/index.html`, content: this.buildPanelHtml(appName) },\n      { relativePath: `panels/${panelId}.panel/app.js`, content: this.buildPanelScript(serviceId) },\n      {\n        relativePath: `service-components/${serviceId}/service-app.json`,\n        content: `${JSON.stringify(this.buildServiceManifest(serviceId), null, 2)}\\n`,\n      },\n      { relativePath: \"guest/Cargo.toml\", content: this.buildCargoToml() },\n      { relativePath: \"guest/Cargo.lock\", content: RUST_WASI_CARGO_LOCK },\n      { relativePath: \"guest/src/lib.rs\", content: this.buildRustSource() },\n      { relativePath: \"guest/wit/portable-service.wit\", content: PORTABLE_SERVICE_WIT },\n      ...STANDARD_PORTABLE_WIT_DEPS,\n      {\n        relativePath: \"tests/service-smoke.json\",\n        content: `${JSON.stringify(this.buildServiceSmokeFixture(serviceId), null, 2)}\\n`,\n      },\n      { relativePath: \"assets/icon.svg\", content: this.buildIconSvg() },\n    ];\n  };\n\n  private buildManifest = (\n    appId: string,\n    appName: string,\n    panelId: string,\n    serviceId: string,\n  ) => ({\n    schemaVersion: 2,\n    id: appId,\n    name: appName,\n    version: \"0.1.0\",\n    description: `${appName}，由 Rust/WASI Component 保存持久计数。`,\n    icon: \"assets/icon.svg\",\n    engines: { nextclaw: \">=0.45.4\" },\n    presentation: { primaryPanel: panelId },\n    runtime: { profile: \"wasi\" },\n    distribution: { mode: \"universal\" },\n    storage: { scope: \"global\", schemaVersion: 1 },\n    permissions: { storage: { namespace: appId.replace(/\\./g, \"-\") } },\n    components: [\n      { kind: \"panel\", path: `panels/${panelId}.panel` },\n      { kind: \"service\", path: `service-components/${serviceId}` },\n    ],\n  });\n\n  private buildPanelManifest = (panelId: string, appName: string, serviceId: string) => ({\n    id: panelId,\n    title: appName,\n    description: \"读取并增加由 Rust/WASI Component 持久保存的计数。\",\n    icon: \"🦀\",\n    entry: \"index.html\",\n    actions: [`${serviceId}.counter_read`, `${serviceId}.counter_increment`],\n  });\n\n  private buildServiceManifest = (serviceId: string) => ({\n    id: serviceId,\n    title: \"Rust/WASI 持久计数组件\",\n    description: \"通过宿主 KV 读取和增加持久计数。\",\n    protocol: \"wasi-component\",\n    component: { entry: \"service.wasm\" },\n    actions: {\n      counter_read: { risk: \"read\", title: \"读取持久计数\" },\n      counter_increment: {\n        risk: \"write\",\n        title: \"增加持久计数\",\n        inputSchema: {\n          type: \"object\",\n          properties: { step: { type: \"integer\", minimum: 1, maximum: 100 } },\n          additionalProperties: false,\n        },\n      },\n    },\n  });\n\n  private buildServiceSmokeFixture = (serviceId: string) => ({\n    schemaVersion: 1,\n    component: serviceId,\n    resetData: true,\n    steps: [\n      {\n        action: \"counter_increment\",\n        input: { step: 3 },\n        expect: { counter: 3, persistedBy: \"host.kv\" },\n      },\n      {\n        action: \"counter_read\",\n        input: {},\n        expect: { counter: 3, persistedBy: \"host.kv\" },\n      },\n    ],\n  });\n\n  private buildCargoToml = (): string => `[package]\nname = \"${RUST_WASI_GUEST_CRATE_NAME}\"\nversion = \"0.1.0\"\nedition = \"2024\"\npublish = false\n\n[dependencies]\nserde_json = \"1.0\"\nwit-bindgen = \"0.44.0\"\n\n[lib]\ncrate-type = [\"cdylib\"]\n\n[package.metadata.component]\npackage = \"nextclaw:portable-service\"\n\n[package.metadata.component.target]\npath = \"wit\"\nworld = \"service-app\"\n\n[package.metadata.component.target.dependencies]\n\"fermyon:spin\" = { path = \"wit/deps/spin@2.0.0\" }\n\"wasi:http\" = { path = \"wit/deps/http@0.2.6\" }\n\"wasi:io\" = { path = \"wit/deps/io@0.2.6\" }\n\"wasi:clocks\" = { path = \"wit/deps/clocks@0.2.6\" }\n\"wasi:config\" = { path = \"wit/deps/config@0.2.0-draft-2024-09-27\" }\n`;\n\n  private buildRustSource = (): string => `wit_bindgen::generate!({\n    path: \"wit\",\n    world: \"service-app\",\n    // Generate standard WASI HTTP's transitive interfaces for later use by a Guest.\n    generate_all,\n});\n\nuse exports::nextclaw::portable_service::service::{Action, Guest};\nuse nextclaw::portable_service::host;\nuse serde_json::{Value, json};\n\nstruct Component;\n\nimpl Guest for Component {\n    fn list_actions() -> Vec<Action> {\n        vec![\n            Action {\n                name: \"counter_read\".into(),\n                title: \"读取持久计数\".into(),\n                description: \"从宿主管理的 KV 存储读取计数。\".into(),\n            },\n            Action {\n                name: \"counter_increment\".into(),\n                title: \"增加持久计数\".into(),\n                description: \"在 Rust/WASM 中计算，并通过宿主 KV 持久化。\".into(),\n            },\n        ]\n    }\n\n    fn invoke(action: String, input_json: String) -> Result<String, String> {\n        host::log(host::LogLevel::Info, &format!(\"invoking {action}\"));\n        let input: Value = serde_json::from_str(&input_json).unwrap_or_else(|_| json!({}));\n        match action.as_str() {\n            \"counter_read\" => Ok(counter_result(read_counter()?)),\n            \"counter_increment\" => {\n                let step = input.get(\"step\").and_then(Value::as_i64).unwrap_or(1);\n                if !(1..=100).contains(&step) {\n                    return Err(\"INVALID_INPUT: step must be between 1 and 100\".into());\n                }\n                let counter = read_counter()?.saturating_add(step);\n                host::kv_set(\"counter\", &counter.to_string())?;\n                Ok(counter_result(counter))\n            }\n            _ => Err(format!(\"UNKNOWN_ACTION: {action}\")),\n        }\n    }\n\n    fn start(_config_json: String) -> Result<String, String> {\n        Ok(json!({ \"started\": true, \"mode\": \"action\" }).to_string())\n    }\n\n    fn handle_event(_event_json: String) -> Result<String, String> {\n        Err(\"UNSUPPORTED_LIFECYCLE: action component does not accept resident events\".into())\n    }\n\n    fn stop(_reason_json: String) -> Result<String, String> {\n        Ok(json!({ \"stopped\": true, \"mode\": \"action\" }).to_string())\n    }\n}\n\nfn read_counter() -> Result<i64, String> {\n    Ok(host::kv_get(\"counter\")?\n        .and_then(|value| value.parse().ok())\n        .unwrap_or(0))\n}\n\nfn counter_result(counter: i64) -> String {\n    json!({ \"counter\": counter, \"persistedBy\": \"host.kv\" }).to_string()\n}\n\nexport!(Component with_types_in self);\n`;\n\n  private buildReadme = (appName: string, serviceId: string): string => `# ${appName}\n\n这是一个可以独立构建的 Rust/WASI Component App。Panel 和 Agent 调用同一组 Service Action，计数通过 NextClaw 宿主 KV 持久保存。\n\n## 1. 准备 Rust 工具链\n\n\\`\\`\\`bash\nrustup target add wasm32-wasip2\n\\`\\`\\`\n\n## 2. 构建 Component\n\n\\`\\`\\`bash\ncd guest\ncargo build --release --target wasm32-wasip2\ncp target/wasm32-wasip2/release/nextclaw_rust_wasi_guest.wasm ../service-components/${serviceId}/service.wasm\ncd ..\n\\`\\`\\`\n\n项目内的 \\`guest/wit/portable-service.wit\\` 是当前 Service Action 与宿主能力合同；不需要 NextClaw 源码仓库。\n\n## 3. 检查和调试\n\n\\`\\`\\`bash\nnextclaw app check .\nnextclaw app dev .\nnextclaw app call . counter_read\nnextclaw app call . counter_increment --input '{\"step\":2}'\n\\`\\`\\`\n\n如果一个包包含多个 Service Component，请增加 \\`--component <component-id>\\`。\n\n## 4. 打包和安装\n\n\\`\\`\\`bash\nnextclaw app pack . --target universal --out ${this.normalizeSlug(appName)}.napp\nnextclaw app install ./${this.normalizeSlug(appName)}.napp\n\\`\\`\\`\n`;\n\n  private buildPanelHtml = (appName: string): string => `<!doctype html>\n<html lang=\"zh-CN\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>${appName}</title>\n    <style>\n      :root { font-family: ui-sans-serif, system-ui, sans-serif; color: #172033; background: #f5f7fb; }\n      body { margin: 0; min-height: 100vh; display: grid; place-items: center; }\n      main { width: min(420px, calc(100vw - 40px)); padding: 28px; border-radius: 24px; background: white; box-shadow: 0 18px 60px #24324a1f; }\n      p { color: #667085; }\n      output { display: block; margin: 24px 0; font-size: 64px; font-weight: 700; }\n      button { border: 0; border-radius: 999px; padding: 12px 18px; background: #172033; color: white; cursor: pointer; }\n      #error { color: #b42318; }\n    </style>\n  </head>\n  <body>\n    <main>\n      <h1>${appName}</h1>\n      <p>这个数字由 Rust/WASI Component 计算，并通过宿主 KV 持久保存。</p>\n      <output id=\"counter\">…</output>\n      <button id=\"increment\" type=\"button\">增加 1</button>\n      <p id=\"error\" role=\"alert\"></p>\n    </main>\n    <script src=\"app.js\"></script>\n  </body>\n</html>\n`;\n\n  private buildPanelScript = (serviceId: string): string => `const counter = document.querySelector(\"#counter\");\nconst error = document.querySelector(\"#error\");\nconst increment = document.querySelector(\"#increment\");\n\nasync function readCounter() {\n  error.textContent = \"\";\n  try {\n    const result = await window.nextclaw.serviceActions.invoke(\"${serviceId}.counter_read\", {});\n    counter.textContent = String(result.counter ?? 0);\n  } catch (cause) {\n    error.textContent = cause instanceof Error ? cause.message : String(cause);\n  }\n}\n\nasync function incrementCounter() {\n  error.textContent = \"\";\n  try {\n    const result = await window.nextclaw.serviceActions.invoke(\"${serviceId}.counter_increment\", { step: 1 });\n    counter.textContent = String(result.counter ?? 0);\n  } catch (cause) {\n    error.textContent = cause instanceof Error ? cause.message : String(cause);\n  }\n}\n\nincrement.addEventListener(\"click\", incrementCounter);\nvoid readCounter();\n`;\n\n  private buildMarketplaceMetadata = (appName: string) => ({\n    slug: this.normalizeSlug(appName),\n    summary: `${appName} Rust/WASI Component 示例。`,\n    summaryI18n: {\n      zh: `${appName} Rust/WASI Component 示例。`,\n      en: `${appName}, a Rust/WASI Component example.`,\n    },\n    description: \"A minimal Rust/WASI Component App with a Panel and host-managed persistent KV.\",\n    descriptionI18n: {\n      zh: \"一个包含 Panel 和宿主持久 KV 的最小 Rust/WASI Component App。\",\n      en: \"A minimal Rust/WASI Component App with a Panel and host-managed persistent KV.\",\n    },\n    author: \"NextClaw\",\n    tags: [\"starter\", \"rust\", \"wasi-component\", \"official\"],\n    sourceRepo: \"https://github.com/Peiiii/nextclaw\",\n    homepage: \"https://nextclaw.io\",\n    featured: false,\n  });\n\n  private normalizeSlug = (value: string): string => value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\") || \"rust-wasi-app\";\n\n  private buildIconSvg = (): string => `<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 128 128\">\n  <rect width=\"128\" height=\"128\" rx=\"30\" fill=\"#172033\"/>\n  <path d=\"M31 40h66v48H31z\" fill=\"#fff\" opacity=\".12\"/>\n  <path d=\"M43 52h42v8H43zm0 16h28v8H43z\" fill=\"#fff\"/>\n  <circle cx=\"88\" cy=\"76\" r=\"12\" fill=\"#f59e0b\"/>\n</svg>\n`;\n}\n"],"mappings":";;AAGA,MAAM,6BAA6B;AACnC,MAAM,uBAAuB,aAC3B,IAAI,IAAI,4CAA4C,OAAO,KAAK,IAAI,EACpE,OACD;AAkBD,MAAM,6BAjB8B;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CACiF,KAAK,kBAAkB;CACvG,cAAc,aAAa;CAC3B,SAAS,aAAa,IAAI,IAAI,uBAAuB,gBAAgB,OAAO,KAAK,IAAI,EAAE,OAAO;CAC/F,EAAE;AACH,MAAM,uBAAuB,aAC3B,IAAI,IAAI,wCAAwC,OAAO,KAAK,IAAI,EAChE,OACD;AAED,IAAa,qCAAb,MAAgD;CAC9C,cAAc,WAAkE;EAC9E,MAAM,EAAE,OAAO,YAAY;EAC3B,MAAM,cAAc,MAAM,QAAQ,eAAe,IAAI;EACrD,MAAM,UAAU,GAAG,YAAY;EAC/B,MAAM,YAAY,GAAG,YAAY;AACjC,SAAO;GACL;IACE,cAAc;IACd,SAAS,GAAG,KAAK,UAAU,KAAK,cAAc,OAAO,SAAS,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC;IAC7F;GACD;IACE,cAAc;IACd,SAAS,GAAG,KAAK,UAAU,KAAK,yBAAyB,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC7E;GACD;IAAE,cAAc;IAAa,SAAS,KAAK,YAAY,SAAS,UAAU;IAAE;GAC5E;IACE,cAAc,UAAU,QAAQ;IAChC,SAAS,GAAG,KAAK,UAAU,KAAK,mBAAmB,SAAS,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC;IAC3F;GACD;IAAE,cAAc,UAAU,QAAQ;IAAoB,SAAS,KAAK,eAAe,QAAQ;IAAE;GAC7F;IAAE,cAAc,UAAU,QAAQ;IAAgB,SAAS,KAAK,iBAAiB,UAAU;IAAE;GAC7F;IACE,cAAc,sBAAsB,UAAU;IAC9C,SAAS,GAAG,KAAK,UAAU,KAAK,qBAAqB,UAAU,EAAE,MAAM,EAAE,CAAC;IAC3E;GACD;IAAE,cAAc;IAAoB,SAAS,KAAK,gBAAgB;IAAE;GACpE;IAAE,cAAc;IAAoB,SAAS;IAAsB;GACnE;IAAE,cAAc;IAAoB,SAAS,KAAK,iBAAiB;IAAE;GACrE;IAAE,cAAc;IAAkC,SAAS;IAAsB;GACjF,GAAG;GACH;IACE,cAAc;IACd,SAAS,GAAG,KAAK,UAAU,KAAK,yBAAyB,UAAU,EAAE,MAAM,EAAE,CAAC;IAC/E;GACD;IAAE,cAAc;IAAmB,SAAS,KAAK,cAAc;IAAE;GAClE;;CAGH,iBACE,OACA,SACA,SACA,eACI;EACJ,eAAe;EACf,IAAI;EACJ,MAAM;EACN,SAAS;EACT,aAAa,GAAG,QAAQ;EACxB,MAAM;EACN,SAAS,EAAE,UAAU,YAAY;EACjC,cAAc,EAAE,cAAc,SAAS;EACvC,SAAS,EAAE,SAAS,QAAQ;EAC5B,cAAc,EAAE,MAAM,aAAa;EACnC,SAAS;GAAE,OAAO;GAAU,eAAe;GAAG;EAC9C,aAAa,EAAE,SAAS,EAAE,WAAW,MAAM,QAAQ,OAAO,IAAI,EAAE,EAAE;EAClE,YAAY,CACV;GAAE,MAAM;GAAS,MAAM,UAAU,QAAQ;GAAS,EAClD;GAAE,MAAM;GAAW,MAAM,sBAAsB;GAAa,CAC7D;EACF;CAED,sBAA8B,SAAiB,SAAiB,eAAuB;EACrF,IAAI;EACJ,OAAO;EACP,aAAa;EACb,MAAM;EACN,OAAO;EACP,SAAS,CAAC,GAAG,UAAU,gBAAgB,GAAG,UAAU,oBAAoB;EACzE;CAED,wBAAgC,eAAuB;EACrD,IAAI;EACJ,OAAO;EACP,aAAa;EACb,UAAU;EACV,WAAW,EAAE,OAAO,gBAAgB;EACpC,SAAS;GACP,cAAc;IAAE,MAAM;IAAQ,OAAO;IAAU;GAC/C,mBAAmB;IACjB,MAAM;IACN,OAAO;IACP,aAAa;KACX,MAAM;KACN,YAAY,EAAE,MAAM;MAAE,MAAM;MAAW,SAAS;MAAG,SAAS;MAAK,EAAE;KACnE,sBAAsB;KACvB;IACF;GACF;EACF;CAED,4BAAoC,eAAuB;EACzD,eAAe;EACf,WAAW;EACX,WAAW;EACX,OAAO,CACL;GACE,QAAQ;GACR,OAAO,EAAE,MAAM,GAAG;GAClB,QAAQ;IAAE,SAAS;IAAG,aAAa;IAAW;GAC/C,EACD;GACE,QAAQ;GACR,OAAO,EAAE;GACT,QAAQ;IAAE,SAAS;IAAG,aAAa;IAAW;GAC/C,CACF;EACF;CAED,uBAAuC;UAC/B,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BnC,wBAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyExC,eAAuB,SAAiB,cAA8B,KAAK,QAAQ;;;;;;;;;;;;;;;sFAeC,UAAU;;;;;;;;;;;;;;;;;;;;+CAoBjD,KAAK,cAAc,QAAQ,CAAC;yBAClD,KAAK,cAAc,QAAQ,CAAC;;;CAInD,kBAA0B,YAA4B;;;;;aAK3C,QAAQ;;;;;;;;;;;;;YAaT,QAAQ;;;;;;;;;;CAWlB,oBAA4B,cAA8B;;;;;;;kEAOM,UAAU;;;;;;;;;;kEAUV,UAAU;;;;;;;;;;CAW1E,4BAAoC,aAAqB;EACvD,MAAM,KAAK,cAAc,QAAQ;EACjC,SAAS,GAAG,QAAQ;EACpB,aAAa;GACX,IAAI,GAAG,QAAQ;GACf,IAAI,GAAG,QAAQ;GAChB;EACD,aAAa;EACb,iBAAiB;GACf,IAAI;GACJ,IAAI;GACL;EACD,QAAQ;EACR,MAAM;GAAC;GAAW;GAAQ;GAAkB;GAAW;EACvD,YAAY;EACZ,UAAU;EACV,UAAU;EACX;CAED,iBAAyB,UAA0B,MAChD,MAAM,CACN,aAAa,CACb,QAAQ,eAAe,IAAI,CAC3B,QAAQ,YAAY,GAAG,IAAI;CAE9B,qBAAqC"}

package/dist/types/app-installation.types.d.ts

@@ -1,6 +1,6 @@
 import { AppArtifactTarget, AppPermissions, AppResolvedComponent } from "./app-manifest.types.js";
 import { AppDistributionMode } from "./app-bundle.types.js";
-import { AppDocumentGrantMap } from "./app-permissions.types.js";
+import { AppDocumentGrantMap, AppStoredDocumentGrantMap } from "./app-permissions.types.js";
 import { AppInstanceRecord, AppStorageContext, AppStorageUsage } from "./app-storage.types.js";
 import { AppPublisher } from "./app-remote-registry.types.js";
 import { AppInstallSourceKind } from "./app-registry.types.js";
@@ -57,7 +57,7 @@ type AppInfoResult = {
     primaryPanelId?: string;
     contentSha256?: string;
   }>;
-  grants: AppDocumentGrantMap;
+  grants: AppStoredDocumentGrantMap;
 };
 type InstalledAppListItem = {
   appId: string;