@nextclaw/app-runtime 0.9.13 → 0.9.14

package/dist/{publish → services}/app-publish.service.js

@@ -1,12 +1,12 @@
-import { AppManifestService } from "../manifest/app-manifest.service.js";
-import { AppBundleService } from "../bundle/app-bundle.service.js";
+import { AppManifestService } from "./app-manifest.service.js";
+import { AppBundleService } from "./app-bundle.service.js";
 import { AppMarketplaceClientService } from "./app-marketplace-client.service.js";
 import { AppMarketplaceMetadataService } from "./app-marketplace-metadata.service.js";
 import { PlatformAuthStateService } from "./platform-auth-state.service.js";
-import { readFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
 import path from "node:path";
-//#region src/publish/app-publish.service.ts
+//#region src/services/app-publish.service.ts
 const DEFAULT_PLATFORM_API_BASE = "https://ai-gateway-api.nextclaw.io";
 var AppPublishService = class {
 	constructor(manifestService = new AppManifestService(), bundleService = new AppBundleService(), metadataService = new AppMarketplaceMetadataService(), marketplaceClient = new AppMarketplaceClientService(), authStateService = new PlatformAuthStateService()) {
@@ -18,9 +18,9 @@ var AppPublishService = class {
 	}
 	publish = async (params) => {
 		const { appDirectory: inputAppDirectory, metadataPath, apiBaseUrl, token } = params;
-		const distributionMode = params.mode ?? "source";
 		const appDirectory = path.resolve(inputAppDirectory);
 		const manifestBundle = await this.manifestService.load(appDirectory);
+		const distributionMode = params.mode ?? (manifestBundle.manifest.schemaVersion === 2 ? "bundle" : "source");
 		const metadata = await this.metadataService.load({
 			appDirectory,
 			manifest: manifestBundle.manifest,
@@ -58,7 +58,7 @@ var AppPublishService = class {
 			publisher: actor.publisher,
 			distributionMode,
 			manifest: manifestBundle.manifest,
-			permissions: manifestBundle.manifest.permissions ?? {},
+			permissions: manifestBundle.manifest.schemaVersion === 1 ? manifestBundle.manifest.permissions ?? {} : {},
 			bundleBase64: bundleBytes.toString("base64"),
 			bundleSha256,
 			files: publishFiles.map((file) => ({

package/dist/services/app-publish.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-publish.service.js","names":[],"sources":["../../src/services/app-publish.service.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { AppBundleService } from \"#app-runtime/services/app-bundle.service.js\";\nimport type { AppDistributionMode } from \"#app-runtime/types/app-bundle.types.js\";\nimport { AppManifestService } from \"#app-runtime/services/app-manifest.service.js\";\nimport { AppMarketplaceClientService } from \"./app-marketplace-client.service.js\";\nimport { AppMarketplaceMetadataService } from \"./app-marketplace-metadata.service.js\";\nimport type { AppPublishPayload, AppPublishResult } from \"#app-runtime/types/app-publish.types.js\";\nimport { PlatformAuthStateService } from \"./platform-auth-state.service.js\";\n\nconst DEFAULT_PLATFORM_API_BASE = \"https://ai-gateway-api.nextclaw.io\";\n\ntype ResolvedPublishActor = {\n  token: string;\n  publisher: NonNullable<AppPublishPayload[\"publisher\"]>;\n};\n\nexport class AppPublishService {\n  constructor(\n    private readonly manifestService: AppManifestService = new AppManifestService(),\n    private readonly bundleService: AppBundleService = new AppBundleService(),\n    private readonly metadataService: AppMarketplaceMetadataService = new AppMarketplaceMetadataService(),\n    private readonly marketplaceClient: AppMarketplaceClientService = new AppMarketplaceClientService(),\n    private readonly authStateService: PlatformAuthStateService = new PlatformAuthStateService(),\n  ) {}\n\n  publish = async (params: {\n    appDirectory: string;\n    metadataPath?: string;\n    apiBaseUrl?: string;\n    token?: string;\n    mode?: AppDistributionMode;\n  }): Promise<AppPublishResult> => {\n    const { appDirectory: inputAppDirectory, metadataPath, apiBaseUrl, token } = params;\n    const appDirectory = path.resolve(inputAppDirectory);\n    const manifestBundle = await this.manifestService.load(appDirectory);\n    const distributionMode = params.mode ??\n      (manifestBundle.manifest.schemaVersion === 2 ? \"bundle\" : \"source\");\n    const metadata = await this.metadataService.load({\n      appDirectory,\n      manifest: manifestBundle.manifest,\n      metadataPath,\n    });\n    const actor = await this.resolvePublishActor({\n      apiBaseUrl,\n      explicitToken: token,\n      appId: manifestBundle.manifest.id,\n    });\n    const bundle = await this.bundleService.packAppDirectory({\n      appDirectory,\n      mode: distributionMode,\n    });\n    const bundleBytes = Buffer.from(await readFile(bundle.bundlePath));\n    const bundleSha256 = createHash(\"sha256\").update(bundleBytes).digest(\"hex\");\n    const publishFiles = await this.metadataService.collectPublishFiles({\n      appDirectory,\n      metadataPath,\n    });\n    const payload: AppPublishPayload = {\n      slug: metadata.slug,\n      appId: manifestBundle.manifest.id,\n      name: manifestBundle.manifest.name,\n      version: manifestBundle.manifest.version,\n      summary: metadata.summary,\n      summaryI18n: metadata.summaryI18n,\n      description: metadata.description ?? manifestBundle.manifest.description,\n      descriptionI18n: metadata.descriptionI18n,\n      author: metadata.author,\n      tags: metadata.tags,\n      sourceRepo: metadata.sourceRepo,\n      homepage: metadata.homepage,\n      featured: metadata.featured ?? false,\n      publisher: actor.publisher,\n      distributionMode,\n      manifest: manifestBundle.manifest,\n      permissions: manifestBundle.manifest.schemaVersion === 1\n        ? manifestBundle.manifest.permissions ?? {}\n        : {},\n      bundleBase64: bundleBytes.toString(\"base64\"),\n      bundleSha256,\n      files: publishFiles.map((file) => ({\n        path: file.path,\n        contentBase64: file.bytes.toString(\"base64\"),\n      })),\n    };\n    const result = await this.marketplaceClient.publish({\n      payload,\n      apiBaseUrl,\n      token: actor.token,\n    });\n    return {\n      ...result,\n      distribution: {\n        path: bundle.bundlePath,\n        sha256: bundleSha256,\n        mode: distributionMode,\n      },\n    };\n  };\n\n  private resolvePublishActor = async (params: {\n    apiBaseUrl?: string;\n    explicitToken?: string;\n    appId: string;\n  }): Promise<ResolvedPublishActor> => {\n    const explicitToken = params.explicitToken?.trim();\n    const envAdminToken = process.env.NEXTCLAW_MARKETPLACE_ADMIN_TOKEN?.trim();\n    if (explicitToken) {\n      const token = explicitToken;\n      if (!token) {\n        throw new Error(\"缺少 publish token。\");\n      }\n      const me = await this.fetchCurrentPlatformUser({\n        token,\n        platformApiBase: this.resolvePlatformApiBase(),\n      });\n      return {\n        token,\n        publisher: this.buildUserPublisher(me, params.appId),\n      };\n    }\n\n    const authState = this.authStateService.readCurrentAuthState();\n    const platformToken = authState.token?.trim();\n    if (platformToken) {\n      const me = await this.fetchCurrentPlatformUser({\n        token: platformToken,\n        platformApiBase: this.resolvePlatformApiBase(authState.apiBaseUrl),\n      });\n      return {\n        token: platformToken,\n        publisher: this.buildUserPublisher(me, params.appId),\n      };\n    }\n\n    if (envAdminToken) {\n      return {\n        token: envAdminToken,\n        publisher: this.buildOfficialPublisher(),\n      };\n    }\n\n    throw new Error(\"发布需要 NextClaw 平台登录态。请先运行 nextclaw login，或传入 --token。\");\n  };\n\n  private fetchCurrentPlatformUser = async (params: {\n    token: string;\n    platformApiBase: string;\n  }): Promise<{\n    id: string;\n    username: string | null;\n    role: \"admin\" | \"user\";\n  }> => {\n    const response = await fetch(`${params.platformApiBase}/platform/auth/me`, {\n      headers: {\n        authorization: `Bearer ${params.token}`,\n        accept: \"application/json\",\n      },\n    });\n    const payload = await response.json().catch(() => null);\n    if (!response.ok) {\n      const message =\n        typeof payload === \"object\" &&\n        payload &&\n        \"error\" in payload &&\n        typeof (payload as { error?: { message?: unknown } }).error?.message === \"string\"\n          ? (payload as { error: { message: string } }).error.message\n          : `${response.status} ${response.statusText}`;\n      throw new Error(`读取 NextClaw 登录态失败：${message}`);\n    }\n    const user = typeof payload === \"object\" &&\n      payload &&\n      \"data\" in payload &&\n      typeof (payload as { data?: { user?: unknown } }).data?.user === \"object\" &&\n      (payload as { data: { user: Record<string, unknown> } }).data.user\n      ? (payload as { data: { user: Record<string, unknown> } }).data.user\n      : null;\n    const id = typeof user?.id === \"string\" ? user.id.trim() : \"\";\n    const username = typeof user?.username === \"string\" ? user.username.trim() : \"\";\n    const role = user?.role === \"admin\" ? \"admin\" : \"user\";\n    if (!id) {\n      throw new Error(\"平台登录态缺少用户 id。\");\n    }\n    return {\n      id,\n      username: username || null,\n      role,\n    };\n  };\n\n  private resolvePlatformApiBase = (configuredApiBase?: string): string => {\n    const source = configuredApiBase?.trim() || process.env.NEXTCLAW_PLATFORM_API_BASE?.trim() || DEFAULT_PLATFORM_API_BASE;\n    const normalized = new URL(source);\n    normalized.pathname = normalized.pathname.replace(/\\/v1\\/?$/, \"/\");\n    return normalized.toString().replace(/\\/+$/, \"\");\n  };\n\n  private buildUserPublisher = (\n    user: { id: string; username: string | null; role: \"admin\" | \"user\" },\n    appId: string,\n  ): NonNullable<AppPublishPayload[\"publisher\"]> => {\n    const isOfficialScope = appId.startsWith(\"nextclaw.\");\n    if (isOfficialScope && user.role === \"admin\") {\n      return this.buildOfficialPublisher();\n    }\n    if (!user.username) {\n      throw new Error(\"当前 NextClaw 账号还没有 username，无法发布个人 scope app。请先在平台账号页设置用户名。\");\n    }\n    return {\n      id: user.username,\n      name: user.username,\n      url: `https://platform.nextclaw.io/account`,\n    };\n  };\n\n  private buildOfficialPublisher = (): NonNullable<AppPublishPayload[\"publisher\"]> => {\n    return {\n      id: \"nextclaw\",\n      name: \"NextClaw\",\n      url: \"https://nextclaw.io\",\n    };\n  };\n}\n"],"mappings":";;;;;;;;;AAWA,MAAM,4BAA4B;AAOlC,IAAa,oBAAb,MAA+B;CAC7B,YACE,kBAAuD,IAAI,oBAAoB,EAC/E,gBAAmD,IAAI,kBAAkB,EACzE,kBAAkE,IAAI,+BAA+B,EACrG,oBAAkE,IAAI,6BAA6B,EACnG,mBAA8D,IAAI,0BAA0B,EAC5F;AALiB,OAAA,kBAAA;AACA,OAAA,gBAAA;AACA,OAAA,kBAAA;AACA,OAAA,oBAAA;AACA,OAAA,mBAAA;;CAGnB,UAAU,OAAO,WAMgB;EAC/B,MAAM,EAAE,cAAc,mBAAmB,cAAc,YAAY,UAAU;EAC7E,MAAM,eAAe,KAAK,QAAQ,kBAAkB;EACpD,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,KAAK,aAAa;EACpE,MAAM,mBAAmB,OAAO,SAC7B,eAAe,SAAS,kBAAkB,IAAI,WAAW;EAC5D,MAAM,WAAW,MAAM,KAAK,gBAAgB,KAAK;GAC/C;GACA,UAAU,eAAe;GACzB;GACD,CAAC;EACF,MAAM,QAAQ,MAAM,KAAK,oBAAoB;GAC3C;GACA,eAAe;GACf,OAAO,eAAe,SAAS;GAChC,CAAC;EACF,MAAM,SAAS,MAAM,KAAK,cAAc,iBAAiB;GACvD;GACA,MAAM;GACP,CAAC;EACF,MAAM,cAAc,OAAO,KAAK,MAAM,SAAS,OAAO,WAAW,CAAC;EAClE,MAAM,eAAe,WAAW,SAAS,CAAC,OAAO,YAAY,CAAC,OAAO,MAAM;EAC3E,MAAM,eAAe,MAAM,KAAK,gBAAgB,oBAAoB;GAClE;GACA;GACD,CAAC;EACF,MAAM,UAA6B;GACjC,MAAM,SAAS;GACf,OAAO,eAAe,SAAS;GAC/B,MAAM,eAAe,SAAS;GAC9B,SAAS,eAAe,SAAS;GACjC,SAAS,SAAS;GAClB,aAAa,SAAS;GACtB,aAAa,SAAS,eAAe,eAAe,SAAS;GAC7D,iBAAiB,SAAS;GAC1B,QAAQ,SAAS;GACjB,MAAM,SAAS;GACf,YAAY,SAAS;GACrB,UAAU,SAAS;GACnB,UAAU,SAAS,YAAY;GAC/B,WAAW,MAAM;GACjB;GACA,UAAU,eAAe;GACzB,aAAa,eAAe,SAAS,kBAAkB,IACnD,eAAe,SAAS,eAAe,EAAE,GACzC,EAAE;GACN,cAAc,YAAY,SAAS,SAAS;GAC5C;GACA,OAAO,aAAa,KAAK,UAAU;IACjC,MAAM,KAAK;IACX,eAAe,KAAK,MAAM,SAAS,SAAS;IAC7C,EAAE;GACJ;AAMD,SAAO;GACL,GANa,MAAM,KAAK,kBAAkB,QAAQ;IAClD;IACA;IACA,OAAO,MAAM;IACd,CAAC;GAGA,cAAc;IACZ,MAAM,OAAO;IACb,QAAQ;IACR,MAAM;IACP;GACF;;CAGH,sBAA8B,OAAO,WAIA;EACnC,MAAM,gBAAgB,OAAO,eAAe,MAAM;EAClD,MAAM,gBAAgB,QAAQ,IAAI,kCAAkC,MAAM;AAC1E,MAAI,eAAe;GACjB,MAAM,QAAQ;AACd,OAAI,CAAC,MACH,OAAM,IAAI,MAAM,oBAAoB;GAEtC,MAAM,KAAK,MAAM,KAAK,yBAAyB;IAC7C;IACA,iBAAiB,KAAK,wBAAwB;IAC/C,CAAC;AACF,UAAO;IACL;IACA,WAAW,KAAK,mBAAmB,IAAI,OAAO,MAAM;IACrD;;EAGH,MAAM,YAAY,KAAK,iBAAiB,sBAAsB;EAC9D,MAAM,gBAAgB,UAAU,OAAO,MAAM;AAC7C,MAAI,eAAe;GACjB,MAAM,KAAK,MAAM,KAAK,yBAAyB;IAC7C,OAAO;IACP,iBAAiB,KAAK,uBAAuB,UAAU,WAAW;IACnE,CAAC;AACF,UAAO;IACL,OAAO;IACP,WAAW,KAAK,mBAAmB,IAAI,OAAO,MAAM;IACrD;;AAGH,MAAI,cACF,QAAO;GACL,OAAO;GACP,WAAW,KAAK,wBAAwB;GACzC;AAGH,QAAM,IAAI,MAAM,uDAAuD;;CAGzE,2BAAmC,OAAO,WAOpC;EACJ,MAAM,WAAW,MAAM,MAAM,GAAG,OAAO,gBAAgB,oBAAoB,EACzE,SAAS;GACP,eAAe,UAAU,OAAO;GAChC,QAAQ;GACT,EACF,CAAC;EACF,MAAM,UAAU,MAAM,SAAS,MAAM,CAAC,YAAY,KAAK;AACvD,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,UACJ,OAAO,YAAY,YACnB,WACA,WAAW,WACX,OAAQ,QAA8C,OAAO,YAAY,WACpE,QAA2C,MAAM,UAClD,GAAG,SAAS,OAAO,GAAG,SAAS;AACrC,SAAM,IAAI,MAAM,qBAAqB,UAAU;;EAEjD,MAAM,OAAO,OAAO,YAAY,YAC9B,WACA,UAAU,WACV,OAAQ,QAA0C,MAAM,SAAS,YAChE,QAAwD,KAAK,OAC3D,QAAwD,KAAK,OAC9D;EACJ,MAAM,KAAK,OAAO,MAAM,OAAO,WAAW,KAAK,GAAG,MAAM,GAAG;EAC3D,MAAM,WAAW,OAAO,MAAM,aAAa,WAAW,KAAK,SAAS,MAAM,GAAG;EAC7E,MAAM,OAAO,MAAM,SAAS,UAAU,UAAU;AAChD,MAAI,CAAC,GACH,OAAM,IAAI,MAAM,gBAAgB;AAElC,SAAO;GACL;GACA,UAAU,YAAY;GACtB;GACD;;CAGH,0BAAkC,sBAAuC;EACvE,MAAM,SAAS,mBAAmB,MAAM,IAAI,QAAQ,IAAI,4BAA4B,MAAM,IAAI;EAC9F,MAAM,aAAa,IAAI,IAAI,OAAO;AAClC,aAAW,WAAW,WAAW,SAAS,QAAQ,YAAY,IAAI;AAClE,SAAO,WAAW,UAAU,CAAC,QAAQ,QAAQ,GAAG;;CAGlD,sBACE,MACA,UACgD;AAEhD,MADwB,MAAM,WAAW,YAAY,IAC9B,KAAK,SAAS,QACnC,QAAO,KAAK,wBAAwB;AAEtC,MAAI,CAAC,KAAK,SACR,OAAM,IAAI,MAAM,6DAA6D;AAE/E,SAAO;GACL,IAAI,KAAK;GACT,MAAM,KAAK;GACX,KAAK;GACN;;CAGH,+BAAoF;AAClF,SAAO;GACL,IAAI;GACJ,MAAM;GACN,KAAK;GACN"}

package/dist/{registry → services}/app-registry-config.service.d.ts

@@ -1,7 +1,7 @@
-import { AppHomeService } from "../paths/app-home.service.js";
-import { AppRegistryConfigSnapshot } from "./app-remote-registry.types.js";
+import { AppHomeService } from "./app-home.service.js";
+import { AppRegistryConfigSnapshot } from "../types/app-remote-registry.types.js";
 
-//#region src/registry/app-registry-config.service.d.ts
+//#region src/services/app-registry-config.service.d.ts
 declare class AppRegistryConfigService {
   private readonly appHomeService;
   constructor(appHomeService?: AppHomeService);

package/dist/{registry → services}/app-registry-config.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-registry-config.service.d.ts","names":[],"sources":["../../src/registry/app-registry-config.service.ts"],"mappings":";;;;cAQa,wBAAA;EAAA,iBAEQ,cAAA;cAAA,cAAA,GAAgB,cAAA;EAGnC,WAAA,QAAwB,OAAA,CAAQ,yBAAA;EAwBhC,cAAA,GAAwB,WAAA,aAAsB,OAAA,CAAQ,yBAAA;EAwBtD,gBAAA,QAA6B,OAAA,CAAQ,yBAAA;EAAA,QAS7B,kBAAA;EAAA,QAiBA,WAAA;EAAA,QAwBA,oBAAA;AAAA"}
+{"version":3,"file":"app-registry-config.service.d.ts","names":[],"sources":["../../src/services/app-registry-config.service.ts"],"mappings":";;;;cAQa,wBAAA;EAAA,iBAEQ,cAAA;cAAA,cAAA,GAAgB,cAAA;EAGnC,WAAA,QAAwB,OAAA,CAAQ,yBAAA;EAwBhC,cAAA,GAAwB,WAAA,aAAsB,OAAA,CAAQ,yBAAA;EAwBtD,gBAAA,QAA6B,OAAA,CAAQ,yBAAA;EAAA,QAS7B,kBAAA;EAAA,QAiBA,WAAA;EAAA,QAwBA,oBAAA;AAAA"}

package/dist/{registry → services}/app-registry-config.service.js

@@ -1,7 +1,7 @@
-import { AppHomeService } from "../paths/app-home.service.js";
-import { DEFAULT_APP_REGISTRY_URL } from "./app-remote-registry.types.js";
+import { AppHomeService } from "./app-home.service.js";
+import { DEFAULT_APP_REGISTRY_URL } from "../types/app-remote-registry.types.js";
 import { readFile, rm, writeFile } from "node:fs/promises";
-//#region src/registry/app-registry-config.service.ts
+//#region src/services/app-registry-config.service.ts
 var AppRegistryConfigService = class {
 	constructor(appHomeService = new AppHomeService()) {
 		this.appHomeService = appHomeService;

package/dist/services/app-registry-config.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-registry-config.service.js","names":[],"sources":["../../src/services/app-registry-config.service.ts"],"sourcesContent":["import { readFile, rm, writeFile } from \"node:fs/promises\";\nimport { AppHomeService } from \"#app-runtime/services/app-home.service.js\";\nimport {\n  DEFAULT_APP_REGISTRY_URL,\n  type AppRegistryConfig,\n  type AppRegistryConfigSnapshot,\n} from \"#app-runtime/types/app-remote-registry.types.js\";\n\nexport class AppRegistryConfigService {\n  constructor(\n    private readonly appHomeService: AppHomeService = new AppHomeService(),\n  ) {}\n\n  getSnapshot = async (): Promise<AppRegistryConfigSnapshot> => {\n    const envUrl = process.env.NEXTCLAW_APP_REGISTRY?.trim();\n    if (envUrl) {\n      return {\n        defaultUrl: DEFAULT_APP_REGISTRY_URL,\n        currentUrl: this.normalizeRegistryUrl(envUrl),\n        source: \"env\",\n      };\n    }\n    const config = await this.loadOptionalConfig();\n    if (config) {\n      return {\n        defaultUrl: DEFAULT_APP_REGISTRY_URL,\n        currentUrl: this.normalizeRegistryUrl(config.registry.url),\n        source: \"config\",\n      };\n    }\n    return {\n      defaultUrl: DEFAULT_APP_REGISTRY_URL,\n      currentUrl: DEFAULT_APP_REGISTRY_URL,\n      source: \"default\",\n    };\n  };\n\n  setRegistryUrl = async (registryUrl: string): Promise<AppRegistryConfigSnapshot> => {\n    const normalized = this.normalizeRegistryUrl(registryUrl);\n    await this.appHomeService.ensureBaseDirectories();\n    await writeFile(\n      this.appHomeService.getConfigPath(),\n      `${JSON.stringify(\n        {\n          schemaVersion: 1,\n          registry: {\n            url: normalized,\n          },\n        } satisfies AppRegistryConfig,\n        null,\n        2,\n      )}\\n`,\n      \"utf-8\",\n    );\n    return {\n      defaultUrl: DEFAULT_APP_REGISTRY_URL,\n      currentUrl: normalized,\n      source: \"config\",\n    };\n  };\n\n  resetRegistryUrl = async (): Promise<AppRegistryConfigSnapshot> => {\n    await rm(this.appHomeService.getConfigPath(), { force: true });\n    return {\n      defaultUrl: DEFAULT_APP_REGISTRY_URL,\n      currentUrl: DEFAULT_APP_REGISTRY_URL,\n      source: \"default\",\n    };\n  };\n\n  private loadOptionalConfig = async (): Promise<AppRegistryConfig | undefined> => {\n    try {\n      const raw = await readFile(this.appHomeService.getConfigPath(), \"utf-8\");\n      return this.parseConfig(JSON.parse(raw) as unknown);\n    } catch (error) {\n      if (\n        typeof error === \"object\" &&\n        error !== null &&\n        \"code\" in error &&\n        error.code === \"ENOENT\"\n      ) {\n        return undefined;\n      }\n      throw error;\n    }\n  };\n\n  private parseConfig = (rawConfig: unknown): AppRegistryConfig => {\n    if (!rawConfig || typeof rawConfig !== \"object\" || Array.isArray(rawConfig)) {\n      throw new Error(\"config.json 必须是对象。\");\n    }\n    const candidate = rawConfig as Record<string, unknown>;\n    if (candidate.schemaVersion !== 1) {\n      throw new Error(\"当前只支持 config schemaVersion = 1。\");\n    }\n    const registry = candidate.registry;\n    if (!registry || typeof registry !== \"object\" || Array.isArray(registry)) {\n      throw new Error(\"config.registry 必须是对象。\");\n    }\n    const registryUrl = (registry as Record<string, unknown>).url;\n    if (typeof registryUrl !== \"string\" || !registryUrl.trim()) {\n      throw new Error(\"config.registry.url 必须是非空字符串。\");\n    }\n    return {\n      schemaVersion: 1,\n      registry: {\n        url: this.normalizeRegistryUrl(registryUrl),\n      },\n    };\n  };\n\n  private normalizeRegistryUrl = (registryUrl: string): string => {\n    let normalized: URL;\n    try {\n      normalized = new URL(registryUrl);\n    } catch {\n      throw new Error(`非法 registry URL：${registryUrl}`);\n    }\n    if (normalized.protocol !== \"http:\" && normalized.protocol !== \"https:\") {\n      throw new Error(`registry URL 只支持 http/https：${registryUrl}`);\n    }\n    const text = normalized.toString();\n    return text.endsWith(\"/\") ? text : `${text}/`;\n  };\n}\n"],"mappings":";;;;AAQA,IAAa,2BAAb,MAAsC;CACpC,YACE,iBAAkD,IAAI,gBAAgB,EACtE;AADiB,OAAA,iBAAA;;CAGnB,cAAc,YAAgD;EAC5D,MAAM,SAAS,QAAQ,IAAI,uBAAuB,MAAM;AACxD,MAAI,OACF,QAAO;GACL,YAAY;GACZ,YAAY,KAAK,qBAAqB,OAAO;GAC7C,QAAQ;GACT;EAEH,MAAM,SAAS,MAAM,KAAK,oBAAoB;AAC9C,MAAI,OACF,QAAO;GACL,YAAY;GACZ,YAAY,KAAK,qBAAqB,OAAO,SAAS,IAAI;GAC1D,QAAQ;GACT;AAEH,SAAO;GACL,YAAY;GACZ,YAAY;GACZ,QAAQ;GACT;;CAGH,iBAAiB,OAAO,gBAA4D;EAClF,MAAM,aAAa,KAAK,qBAAqB,YAAY;AACzD,QAAM,KAAK,eAAe,uBAAuB;AACjD,QAAM,UACJ,KAAK,eAAe,eAAe,EACnC,GAAG,KAAK,UACN;GACE,eAAe;GACf,UAAU,EACR,KAAK,YACN;GACF,EACD,MACA,EACD,CAAC,KACF,QACD;AACD,SAAO;GACL,YAAY;GACZ,YAAY;GACZ,QAAQ;GACT;;CAGH,mBAAmB,YAAgD;AACjE,QAAM,GAAG,KAAK,eAAe,eAAe,EAAE,EAAE,OAAO,MAAM,CAAC;AAC9D,SAAO;GACL,YAAY;GACZ,YAAY;GACZ,QAAQ;GACT;;CAGH,qBAA6B,YAAoD;AAC/E,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,KAAK,eAAe,eAAe,EAAE,QAAQ;AACxE,UAAO,KAAK,YAAY,KAAK,MAAM,IAAI,CAAY;WAC5C,OAAO;AACd,OACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACV,MAAM,SAAS,SAEf;AAEF,SAAM;;;CAIV,eAAuB,cAA0C;AAC/D,MAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,UAAU,CACzE,OAAM,IAAI,MAAM,qBAAqB;EAEvC,MAAM,YAAY;AAClB,MAAI,UAAU,kBAAkB,EAC9B,OAAM,IAAI,MAAM,kCAAkC;EAEpD,MAAM,WAAW,UAAU;AAC3B,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,SAAS,CACtE,OAAM,IAAI,MAAM,yBAAyB;EAE3C,MAAM,cAAe,SAAqC;AAC1D,MAAI,OAAO,gBAAgB,YAAY,CAAC,YAAY,MAAM,CACxD,OAAM,IAAI,MAAM,gCAAgC;AAElD,SAAO;GACL,eAAe;GACf,UAAU,EACR,KAAK,KAAK,qBAAqB,YAAY,EAC5C;GACF;;CAGH,wBAAgC,gBAAgC;EAC9D,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,IAAI,YAAY;UAC3B;AACN,SAAM,IAAI,MAAM,mBAAmB,cAAc;;AAEnD,MAAI,WAAW,aAAa,WAAW,WAAW,aAAa,SAC7D,OAAM,IAAI,MAAM,+BAA+B,cAAc;EAE/D,MAAM,OAAO,WAAW,UAAU;AAClC,SAAO,KAAK,SAAS,IAAI,GAAG,OAAO,GAAG,KAAK"}

package/dist/{registry → services}/app-registry.service.d.ts

@@ -1,14 +1,16 @@
-import { AppPermissions } from "../manifest/app-manifest.types.js";
-import { AppDocumentGrantMap } from "../permissions/app-permissions.types.js";
-import { AppHomeService } from "../paths/app-home.service.js";
-import { AppInstallSourceKind, AppRegistry, AppRegistryAppRecord, AppRegistryInstalledVersion } from "./app-registry.types.js";
+import { AppPermissions, AppResolvedComponent } from "../types/app-manifest.types.js";
+import { AppDocumentGrantMap } from "../types/app-permissions.types.js";
+import { AppHomeService } from "./app-home.service.js";
+import { AppInstallSourceKind, AppRegistry, AppRegistryAppRecord, AppRegistryInstalledVersion } from "../types/app-registry.types.js";
 
-//#region src/registry/app-registry.service.d.ts
+//#region src/services/app-registry.service.d.ts
 declare class AppRegistryService {
   private readonly appHomeService;
+  private static readonly mutationQueues;
   constructor(appHomeService?: AppHomeService);
   load: () => Promise<AppRegistry>;
   save: (registry: AppRegistry) => Promise<void>;
+  private saveUnlocked;
   listApps: () => Promise<AppRegistryAppRecord[]>;
   getApp: (appId: string) => Promise<AppRegistryAppRecord | undefined>;
   getActiveVersion: (appId: string) => Promise<AppRegistryInstalledVersion | undefined>;
@@ -28,12 +30,23 @@ declare class AppRegistryService {
     bundleUrl?: string;
     sha256?: string;
     publisher?: AppRegistryInstalledVersion["publisher"];
+    manifestSchemaVersion: 1 | 2;
+    components?: AppResolvedComponent[];
+    primaryPanelId?: string;
+    enabled?: boolean;
   }) => Promise<AppRegistryAppRecord>;
+  setEnabled: (appId: string, enabled: boolean) => Promise<AppRegistryAppRecord>;
+  activateVersion: (appId: string, version: string) => Promise<AppRegistryAppRecord>;
   updateGrants: (appId: string, grants: AppDocumentGrantMap) => Promise<AppRegistryAppRecord>;
   setDocumentGrant: (appId: string, scopeId: string, directoryPath: string) => Promise<AppRegistryAppRecord>;
   removeDocumentGrant: (appId: string, scopeId: string) => Promise<boolean>;
   removeApp: (appId: string) => Promise<AppRegistryAppRecord | undefined>;
+  private updateApp;
+  private withMutation;
   private parseRegistry;
+  private assertRecord;
+  private requireString;
+  private isMissingFileError;
 }
 //#endregion
 export { AppRegistryService };

package/dist/services/app-registry.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-registry.service.d.ts","names":[],"sources":["../../src/services/app-registry.service.ts"],"mappings":";;;;;;cAYa,kBAAA;EAAA,iBAGkB,cAAA;EAAA,wBAFL,cAAA;cAEK,cAAA,GAAgB,cAAA;EAE7C,IAAA,QAAiB,OAAA,CAAQ,WAAA;EAazB,IAAA,GAAc,QAAA,EAAU,WAAA,KAAc,OAAA;EAAA,QAI9B,YAAA;EAsBR,QAAA,QAAqB,OAAA,CAAQ,oBAAA;EAK7B,MAAA,GAAgB,KAAA,aAAgB,OAAA,CAAQ,oBAAA;EAKxC,gBAAA,GAA0B,KAAA,aAAgB,OAAA,CAAQ,2BAAA;EAKlD,kBAAA,GAA4B,MAAA;IAC1B,KAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA;IACA,gBAAA;IACA,aAAA;IACA,UAAA,EAAY,oBAAA;IACZ,SAAA;IACA,WAAA;IACA,gBAAA,GAAmB,2BAAA;IACnB,WAAA,EAAa,cAAA;IACb,WAAA;IACA,SAAA;IACA,MAAA;IACA,SAAA,GAAY,2BAAA;IACZ,qBAAA;IACA,UAAA,GAAa,oBAAA;IACb,cAAA;IACA,OAAA;EAAA,MACE,OAAA,CAAQ,oBAAA;EAsCZ,UAAA,GAAoB,KAAA,UAAe,OAAA,cAAmB,OAAA,CAAQ,oBAAA;EAI9D,eAAA,GACE,KAAA,UACA,OAAA,aACC,OAAA,CAAQ,oBAAA;EASX,YAAA,GACE,KAAA,UACA,MAAA,EAAQ,mBAAA,KACP,OAAA,CAAQ,oBAAA;EAOX,gBAAA,GACE,KAAA,UACA,OAAA,UACA,aAAA,aACC,OAAA,CAAQ,oBAAA;EAIX,mBAAA,GAA6B,KAAA,UAAe,OAAA,aAAkB,OAAA;EAc9D,SAAA,GAAmB,KAAA,aAAgB,OAAA,CAAQ,oBAAA;EAAA,QAanC,SAAA;EAAA,QAiBA,YAAA;EAAA,QAcA,aAAA;EAAA,QAyCA,YAAA;EAAA,QAOA,aAAA;EAAA,QAOA,kBAAA;AAAA"}

package/dist/services/app-registry.service.js

@@ -0,0 +1,210 @@
+import { AppHomeService } from "./app-home.service.js";
+import { open, readFile, rename, rm } from "node:fs/promises";
+import path from "node:path";
+//#region src/services/app-registry.service.ts
+var AppRegistryService = class AppRegistryService {
+	static mutationQueues = /* @__PURE__ */ new Map();
+	constructor(appHomeService = new AppHomeService()) {
+		this.appHomeService = appHomeService;
+	}
+	load = async () => {
+		await this.appHomeService.ensureBaseDirectories();
+		try {
+			const raw = await readFile(this.appHomeService.getRegistryPath(), "utf-8");
+			return this.parseRegistry(JSON.parse(raw));
+		} catch (error) {
+			if (this.isMissingFileError(error)) return {
+				schemaVersion: 1,
+				apps: {}
+			};
+			throw error;
+		}
+	};
+	save = async (registry) => {
+		await this.withMutation(async () => await this.saveUnlocked(registry));
+	};
+	saveUnlocked = async (registry) => {
+		await this.appHomeService.ensureBaseDirectories();
+		const registryPath = this.appHomeService.getRegistryPath();
+		const temporaryPath = path.join(path.dirname(registryPath), `.${path.basename(registryPath)}.${process.pid}.${Date.now()}.tmp`);
+		const handle = await open(temporaryPath, "wx", 384);
+		try {
+			await handle.writeFile(`${JSON.stringify(registry, null, 2)}\n`, "utf-8");
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+		try {
+			await rename(temporaryPath, registryPath);
+		} catch (error) {
+			await rm(temporaryPath, { force: true });
+			throw error;
+		}
+	};
+	listApps = async () => {
+		const registry = await this.load();
+		return Object.values(registry.apps).sort((left, right) => left.appId.localeCompare(right.appId));
+	};
+	getApp = async (appId) => {
+		return (await this.load()).apps[appId];
+	};
+	getActiveVersion = async (appId) => {
+		const appRecord = await this.getApp(appId);
+		return appRecord?.installedVersions[appRecord.activeVersion];
+	};
+	upsertInstallation = async (params) => {
+		return await this.withMutation(async () => {
+			const registry = await this.load();
+			const currentRecord = registry.apps[params.appId];
+			const nextRecord = {
+				appId: params.appId,
+				name: params.name,
+				description: params.description,
+				activeVersion: params.version,
+				enabled: params.enabled ?? currentRecord?.enabled ?? params.manifestSchemaVersion === 1,
+				dataDirectory: params.dataDirectory,
+				installedVersions: {
+					...currentRecord?.installedVersions ?? {},
+					[params.version]: {
+						version: params.version,
+						installDirectory: params.installDirectory,
+						sourceKind: params.sourceKind,
+						sourceRef: params.sourceRef,
+						installedAt: params.installedAt,
+						distributionMode: params.distributionMode,
+						permissions: params.permissions,
+						registryUrl: params.registryUrl,
+						bundleUrl: params.bundleUrl,
+						sha256: params.sha256,
+						publisher: params.publisher,
+						manifestSchemaVersion: params.manifestSchemaVersion,
+						components: params.components,
+						primaryPanelId: params.primaryPanelId
+					}
+				},
+				grants: currentRecord?.grants ?? {}
+			};
+			registry.apps[params.appId] = nextRecord;
+			await this.saveUnlocked(registry);
+			return nextRecord;
+		});
+	};
+	setEnabled = async (appId, enabled) => {
+		return await this.updateApp(appId, (record) => ({
+			...record,
+			enabled
+		}));
+	};
+	activateVersion = async (appId, version) => {
+		return await this.updateApp(appId, (record) => {
+			if (!record.installedVersions[version]) throw new Error(`应用 ${appId} 未安装版本 ${version}。`);
+			return {
+				...record,
+				activeVersion: version
+			};
+		});
+	};
+	updateGrants = async (appId, grants) => {
+		return await this.updateApp(appId, (record) => ({
+			...record,
+			grants: {
+				...record.grants,
+				...grants
+			}
+		}));
+	};
+	setDocumentGrant = async (appId, scopeId, directoryPath) => {
+		return await this.updateGrants(appId, { [scopeId]: directoryPath });
+	};
+	removeDocumentGrant = async (appId, scopeId) => {
+		let removed = false;
+		await this.updateApp(appId, (record) => {
+			if (!(scopeId in record.grants)) return record;
+			const grants = { ...record.grants };
+			delete grants[scopeId];
+			removed = true;
+			return {
+				...record,
+				grants
+			};
+		});
+		return removed;
+	};
+	removeApp = async (appId) => {
+		return await this.withMutation(async () => {
+			const registry = await this.load();
+			const appRecord = registry.apps[appId];
+			if (!appRecord) return;
+			delete registry.apps[appId];
+			await this.saveUnlocked(registry);
+			return appRecord;
+		});
+	};
+	updateApp = async (appId, update) => {
+		return await this.withMutation(async () => {
+			const registry = await this.load();
+			const appRecord = registry.apps[appId];
+			if (!appRecord) throw new Error(`未找到已安装应用：${appId}`);
+			const nextRecord = update(appRecord);
+			registry.apps[appId] = nextRecord;
+			await this.saveUnlocked(registry);
+			return nextRecord;
+		});
+	};
+	withMutation = async (operation) => {
+		const registryPath = path.resolve(this.appHomeService.getRegistryPath());
+		const current = (AppRegistryService.mutationQueues.get(registryPath) ?? Promise.resolve()).catch(() => void 0).then(operation);
+		AppRegistryService.mutationQueues.set(registryPath, current);
+		try {
+			return await current;
+		} finally {
+			if (AppRegistryService.mutationQueues.get(registryPath) === current) AppRegistryService.mutationQueues.delete(registryPath);
+		}
+	};
+	parseRegistry = (rawRegistry) => {
+		const candidate = this.assertRecord(rawRegistry, "registry.json");
+		if (candidate.schemaVersion !== 1) throw new Error("当前只支持 registry schemaVersion = 1。");
+		const rawApps = this.assertRecord(candidate.apps, "registry.apps");
+		const apps = {};
+		for (const [appId, rawApp] of Object.entries(rawApps)) {
+			const app = this.assertRecord(rawApp, `registry.apps.${appId}`);
+			const installedVersions = {};
+			const rawVersions = this.assertRecord(app.installedVersions, `registry.apps.${appId}.installedVersions`);
+			for (const [version, rawVersion] of Object.entries(rawVersions)) {
+				const versionRecord = this.assertRecord(rawVersion, `registry.apps.${appId}.installedVersions.${version}`);
+				installedVersions[version] = {
+					...versionRecord,
+					version,
+					manifestSchemaVersion: versionRecord.manifestSchemaVersion === 2 ? 2 : 1
+				};
+			}
+			const activeVersion = this.requireString(app.activeVersion, `registry.apps.${appId}.activeVersion`);
+			if (!installedVersions[activeVersion]) throw new Error(`registry.apps.${appId} 缺少 activeVersion ${activeVersion}。`);
+			apps[appId] = {
+				...app,
+				appId,
+				enabled: typeof app.enabled === "boolean" ? app.enabled : true,
+				activeVersion,
+				installedVersions,
+				grants: app.grants && typeof app.grants === "object" ? app.grants : {}
+			};
+		}
+		return {
+			schemaVersion: 1,
+			apps
+		};
+	};
+	assertRecord = (value, field) => {
+		if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${field} 必须是对象。`);
+		return value;
+	};
+	requireString = (value, field) => {
+		if (typeof value !== "string" || !value.trim()) throw new Error(`${field} 必须是非空字符串。`);
+		return value;
+	};
+	isMissingFileError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+};
+//#endregion
+export { AppRegistryService };
+
+//# sourceMappingURL=app-registry.service.js.map

package/dist/services/app-registry.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-registry.service.js","names":[],"sources":["../../src/services/app-registry.service.ts"],"sourcesContent":["import { open, readFile, rename, rm } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type { AppPermissions, AppResolvedComponent } from \"#app-runtime/types/app-manifest.types.js\";\nimport type { AppDocumentGrantMap } from \"#app-runtime/types/app-permissions.types.js\";\nimport { AppHomeService } from \"#app-runtime/services/app-home.service.js\";\nimport type {\n  AppInstallSourceKind,\n  AppRegistry,\n  AppRegistryAppRecord,\n  AppRegistryInstalledVersion,\n} from \"#app-runtime/types/app-registry.types.js\";\n\nexport class AppRegistryService {\n  private static readonly mutationQueues = new Map<string, Promise<unknown>>();\n\n  constructor(private readonly appHomeService: AppHomeService = new AppHomeService()) {}\n\n  load = async (): Promise<AppRegistry> => {\n    await this.appHomeService.ensureBaseDirectories();\n    try {\n      const raw = await readFile(this.appHomeService.getRegistryPath(), \"utf-8\");\n      return this.parseRegistry(JSON.parse(raw) as unknown);\n    } catch (error) {\n      if (this.isMissingFileError(error)) {\n        return { schemaVersion: 1, apps: {} };\n      }\n      throw error;\n    }\n  };\n\n  save = async (registry: AppRegistry): Promise<void> => {\n    await this.withMutation(async () => await this.saveUnlocked(registry));\n  };\n\n  private saveUnlocked = async (registry: AppRegistry): Promise<void> => {\n    await this.appHomeService.ensureBaseDirectories();\n    const registryPath = this.appHomeService.getRegistryPath();\n    const temporaryPath = path.join(\n      path.dirname(registryPath),\n      `.${path.basename(registryPath)}.${process.pid}.${Date.now()}.tmp`,\n    );\n    const handle = await open(temporaryPath, \"wx\", 0o600);\n    try {\n      await handle.writeFile(`${JSON.stringify(registry, null, 2)}\\n`, \"utf-8\");\n      await handle.sync();\n    } finally {\n      await handle.close();\n    }\n    try {\n      await rename(temporaryPath, registryPath);\n    } catch (error) {\n      await rm(temporaryPath, { force: true });\n      throw error;\n    }\n  };\n\n  listApps = async (): Promise<AppRegistryAppRecord[]> => {\n    const registry = await this.load();\n    return Object.values(registry.apps).sort((left, right) => left.appId.localeCompare(right.appId));\n  };\n\n  getApp = async (appId: string): Promise<AppRegistryAppRecord | undefined> => {\n    const registry = await this.load();\n    return registry.apps[appId];\n  };\n\n  getActiveVersion = async (appId: string): Promise<AppRegistryInstalledVersion | undefined> => {\n    const appRecord = await this.getApp(appId);\n    return appRecord?.installedVersions[appRecord.activeVersion];\n  };\n\n  upsertInstallation = async (params: {\n    appId: string;\n    name: string;\n    description?: string;\n    version: string;\n    installDirectory: string;\n    dataDirectory: string;\n    sourceKind: AppInstallSourceKind;\n    sourceRef: string;\n    installedAt: string;\n    distributionMode?: AppRegistryInstalledVersion[\"distributionMode\"];\n    permissions: AppPermissions;\n    registryUrl?: string;\n    bundleUrl?: string;\n    sha256?: string;\n    publisher?: AppRegistryInstalledVersion[\"publisher\"];\n    manifestSchemaVersion: 1 | 2;\n    components?: AppResolvedComponent[];\n    primaryPanelId?: string;\n    enabled?: boolean;\n  }): Promise<AppRegistryAppRecord> => {\n    return await this.withMutation(async () => {\n      const registry = await this.load();\n      const currentRecord = registry.apps[params.appId];\n      const nextRecord: AppRegistryAppRecord = {\n        appId: params.appId,\n        name: params.name,\n        description: params.description,\n        activeVersion: params.version,\n        enabled: params.enabled ?? currentRecord?.enabled ?? params.manifestSchemaVersion === 1,\n        dataDirectory: params.dataDirectory,\n        installedVersions: {\n          ...(currentRecord?.installedVersions ?? {}),\n          [params.version]: {\n            version: params.version,\n            installDirectory: params.installDirectory,\n            sourceKind: params.sourceKind,\n            sourceRef: params.sourceRef,\n            installedAt: params.installedAt,\n            distributionMode: params.distributionMode,\n            permissions: params.permissions,\n            registryUrl: params.registryUrl,\n            bundleUrl: params.bundleUrl,\n            sha256: params.sha256,\n            publisher: params.publisher,\n            manifestSchemaVersion: params.manifestSchemaVersion,\n            components: params.components,\n            primaryPanelId: params.primaryPanelId,\n          },\n        },\n        grants: currentRecord?.grants ?? {},\n      };\n      registry.apps[params.appId] = nextRecord;\n      await this.saveUnlocked(registry);\n      return nextRecord;\n    });\n  };\n\n  setEnabled = async (appId: string, enabled: boolean): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => ({ ...record, enabled }));\n  };\n\n  activateVersion = async (\n    appId: string,\n    version: string,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => {\n      if (!record.installedVersions[version]) {\n        throw new Error(`应用 ${appId} 未安装版本 ${version}。`);\n      }\n      return { ...record, activeVersion: version };\n    });\n  };\n\n  updateGrants = async (\n    appId: string,\n    grants: AppDocumentGrantMap,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateApp(appId, (record) => ({\n      ...record,\n      grants: { ...record.grants, ...grants },\n    }));\n  };\n\n  setDocumentGrant = async (\n    appId: string,\n    scopeId: string,\n    directoryPath: string,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.updateGrants(appId, { [scopeId]: directoryPath });\n  };\n\n  removeDocumentGrant = async (appId: string, scopeId: string): Promise<boolean> => {\n    let removed = false;\n    await this.updateApp(appId, (record) => {\n      if (!(scopeId in record.grants)) {\n        return record;\n      }\n      const grants = { ...record.grants };\n      delete grants[scopeId];\n      removed = true;\n      return { ...record, grants };\n    });\n    return removed;\n  };\n\n  removeApp = async (appId: string): Promise<AppRegistryAppRecord | undefined> => {\n    return await this.withMutation(async () => {\n      const registry = await this.load();\n      const appRecord = registry.apps[appId];\n      if (!appRecord) {\n        return undefined;\n      }\n      delete registry.apps[appId];\n      await this.saveUnlocked(registry);\n      return appRecord;\n    });\n  };\n\n  private updateApp = async (\n    appId: string,\n    update: (record: AppRegistryAppRecord) => AppRegistryAppRecord,\n  ): Promise<AppRegistryAppRecord> => {\n    return await this.withMutation(async () => {\n      const registry = await this.load();\n      const appRecord = registry.apps[appId];\n      if (!appRecord) {\n        throw new Error(`未找到已安装应用：${appId}`);\n      }\n      const nextRecord = update(appRecord);\n      registry.apps[appId] = nextRecord;\n      await this.saveUnlocked(registry);\n      return nextRecord;\n    });\n  };\n\n  private withMutation = async <T>(operation: () => Promise<T>): Promise<T> => {\n    const registryPath = path.resolve(this.appHomeService.getRegistryPath());\n    const previous = AppRegistryService.mutationQueues.get(registryPath) ?? Promise.resolve();\n    const current = previous.catch(() => undefined).then(operation);\n    AppRegistryService.mutationQueues.set(registryPath, current);\n    try {\n      return await current;\n    } finally {\n      if (AppRegistryService.mutationQueues.get(registryPath) === current) {\n        AppRegistryService.mutationQueues.delete(registryPath);\n      }\n    }\n  };\n\n  private parseRegistry = (rawRegistry: unknown): AppRegistry => {\n    const candidate = this.assertRecord(rawRegistry, \"registry.json\");\n    if (candidate.schemaVersion !== 1) {\n      throw new Error(\"当前只支持 registry schemaVersion = 1。\");\n    }\n    const rawApps = this.assertRecord(candidate.apps, \"registry.apps\");\n    const apps: Record<string, AppRegistryAppRecord> = {};\n    for (const [appId, rawApp] of Object.entries(rawApps)) {\n      const app = this.assertRecord(rawApp, `registry.apps.${appId}`) as Partial<AppRegistryAppRecord>;\n      const installedVersions: Record<string, AppRegistryInstalledVersion> = {};\n      const rawVersions = this.assertRecord(\n        app.installedVersions,\n        `registry.apps.${appId}.installedVersions`,\n      );\n      for (const [version, rawVersion] of Object.entries(rawVersions)) {\n        const versionRecord = this.assertRecord(\n          rawVersion,\n          `registry.apps.${appId}.installedVersions.${version}`,\n        ) as Partial<AppRegistryInstalledVersion>;\n        installedVersions[version] = {\n          ...(versionRecord as AppRegistryInstalledVersion),\n          version,\n          manifestSchemaVersion: versionRecord.manifestSchemaVersion === 2 ? 2 : 1,\n        };\n      }\n      const activeVersion = this.requireString(app.activeVersion, `registry.apps.${appId}.activeVersion`);\n      if (!installedVersions[activeVersion]) {\n        throw new Error(`registry.apps.${appId} 缺少 activeVersion ${activeVersion}。`);\n      }\n      apps[appId] = {\n        ...(app as AppRegistryAppRecord),\n        appId,\n        enabled: typeof app.enabled === \"boolean\" ? app.enabled : true,\n        activeVersion,\n        installedVersions,\n        grants: app.grants && typeof app.grants === \"object\" ? app.grants : {},\n      };\n    }\n    return { schemaVersion: 1, apps };\n  };\n\n  private assertRecord = (value: unknown, field: string): Record<string, unknown> => {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n      throw new Error(`${field} 必须是对象。`);\n    }\n    return value as Record<string, unknown>;\n  };\n\n  private requireString = (value: unknown, field: string): string => {\n    if (typeof value !== \"string\" || !value.trim()) {\n      throw new Error(`${field} 必须是非空字符串。`);\n    }\n    return value;\n  };\n\n  private isMissingFileError = (error: unknown): boolean =>\n    typeof error === \"object\" && error !== null &&\n    \"code\" in error && (error as { code?: unknown }).code === \"ENOENT\";\n}\n"],"mappings":";;;;AAYA,IAAa,qBAAb,MAAa,mBAAmB;CAC9B,OAAwB,iCAAiB,IAAI,KAA+B;CAE5E,YAAY,iBAAkD,IAAI,gBAAgB,EAAE;AAAvD,OAAA,iBAAA;;CAE7B,OAAO,YAAkC;AACvC,QAAM,KAAK,eAAe,uBAAuB;AACjD,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,KAAK,eAAe,iBAAiB,EAAE,QAAQ;AAC1E,UAAO,KAAK,cAAc,KAAK,MAAM,IAAI,CAAY;WAC9C,OAAO;AACd,OAAI,KAAK,mBAAmB,MAAM,CAChC,QAAO;IAAE,eAAe;IAAG,MAAM,EAAE;IAAE;AAEvC,SAAM;;;CAIV,OAAO,OAAO,aAAyC;AACrD,QAAM,KAAK,aAAa,YAAY,MAAM,KAAK,aAAa,SAAS,CAAC;;CAGxE,eAAuB,OAAO,aAAyC;AACrE,QAAM,KAAK,eAAe,uBAAuB;EACjD,MAAM,eAAe,KAAK,eAAe,iBAAiB;EAC1D,MAAM,gBAAgB,KAAK,KACzB,KAAK,QAAQ,aAAa,EAC1B,IAAI,KAAK,SAAS,aAAa,CAAC,GAAG,QAAQ,IAAI,GAAG,KAAK,KAAK,CAAC,MAC9D;EACD,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,IAAM;AACrD,MAAI;AACF,SAAM,OAAO,UAAU,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,KAAK,QAAQ;AACzE,SAAM,OAAO,MAAM;YACX;AACR,SAAM,OAAO,OAAO;;AAEtB,MAAI;AACF,SAAM,OAAO,eAAe,aAAa;WAClC,OAAO;AACd,SAAM,GAAG,eAAe,EAAE,OAAO,MAAM,CAAC;AACxC,SAAM;;;CAIV,WAAW,YAA6C;EACtD,MAAM,WAAW,MAAM,KAAK,MAAM;AAClC,SAAO,OAAO,OAAO,SAAS,KAAK,CAAC,MAAM,MAAM,UAAU,KAAK,MAAM,cAAc,MAAM,MAAM,CAAC;;CAGlG,SAAS,OAAO,UAA6D;AAE3E,UADiB,MAAM,KAAK,MAAM,EAClB,KAAK;;CAGvB,mBAAmB,OAAO,UAAoE;EAC5F,MAAM,YAAY,MAAM,KAAK,OAAO,MAAM;AAC1C,SAAO,WAAW,kBAAkB,UAAU;;CAGhD,qBAAqB,OAAO,WAoBS;AACnC,SAAO,MAAM,KAAK,aAAa,YAAY;GACzC,MAAM,WAAW,MAAM,KAAK,MAAM;GAClC,MAAM,gBAAgB,SAAS,KAAK,OAAO;GAC3C,MAAM,aAAmC;IACvC,OAAO,OAAO;IACd,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,eAAe,OAAO;IACtB,SAAS,OAAO,WAAW,eAAe,WAAW,OAAO,0BAA0B;IACtF,eAAe,OAAO;IACtB,mBAAmB;KACjB,GAAI,eAAe,qBAAqB,EAAE;MACzC,OAAO,UAAU;MAChB,SAAS,OAAO;MAChB,kBAAkB,OAAO;MACzB,YAAY,OAAO;MACnB,WAAW,OAAO;MAClB,aAAa,OAAO;MACpB,kBAAkB,OAAO;MACzB,aAAa,OAAO;MACpB,aAAa,OAAO;MACpB,WAAW,OAAO;MAClB,QAAQ,OAAO;MACf,WAAW,OAAO;MAClB,uBAAuB,OAAO;MAC9B,YAAY,OAAO;MACnB,gBAAgB,OAAO;MACxB;KACF;IACD,QAAQ,eAAe,UAAU,EAAE;IACpC;AACD,YAAS,KAAK,OAAO,SAAS;AAC9B,SAAM,KAAK,aAAa,SAAS;AACjC,UAAO;IACP;;CAGJ,aAAa,OAAO,OAAe,YAAoD;AACrF,SAAO,MAAM,KAAK,UAAU,QAAQ,YAAY;GAAE,GAAG;GAAQ;GAAS,EAAE;;CAG1E,kBAAkB,OAChB,OACA,YACkC;AAClC,SAAO,MAAM,KAAK,UAAU,QAAQ,WAAW;AAC7C,OAAI,CAAC,OAAO,kBAAkB,SAC5B,OAAM,IAAI,MAAM,MAAM,MAAM,SAAS,QAAQ,GAAG;AAElD,UAAO;IAAE,GAAG;IAAQ,eAAe;IAAS;IAC5C;;CAGJ,eAAe,OACb,OACA,WACkC;AAClC,SAAO,MAAM,KAAK,UAAU,QAAQ,YAAY;GAC9C,GAAG;GACH,QAAQ;IAAE,GAAG,OAAO;IAAQ,GAAG;IAAQ;GACxC,EAAE;;CAGL,mBAAmB,OACjB,OACA,SACA,kBACkC;AAClC,SAAO,MAAM,KAAK,aAAa,OAAO,GAAG,UAAU,eAAe,CAAC;;CAGrE,sBAAsB,OAAO,OAAe,YAAsC;EAChF,IAAI,UAAU;AACd,QAAM,KAAK,UAAU,QAAQ,WAAW;AACtC,OAAI,EAAE,WAAW,OAAO,QACtB,QAAO;GAET,MAAM,SAAS,EAAE,GAAG,OAAO,QAAQ;AACnC,UAAO,OAAO;AACd,aAAU;AACV,UAAO;IAAE,GAAG;IAAQ;IAAQ;IAC5B;AACF,SAAO;;CAGT,YAAY,OAAO,UAA6D;AAC9E,SAAO,MAAM,KAAK,aAAa,YAAY;GACzC,MAAM,WAAW,MAAM,KAAK,MAAM;GAClC,MAAM,YAAY,SAAS,KAAK;AAChC,OAAI,CAAC,UACH;AAEF,UAAO,SAAS,KAAK;AACrB,SAAM,KAAK,aAAa,SAAS;AACjC,UAAO;IACP;;CAGJ,YAAoB,OAClB,OACA,WACkC;AAClC,SAAO,MAAM,KAAK,aAAa,YAAY;GACzC,MAAM,WAAW,MAAM,KAAK,MAAM;GAClC,MAAM,YAAY,SAAS,KAAK;AAChC,OAAI,CAAC,UACH,OAAM,IAAI,MAAM,YAAY,QAAQ;GAEtC,MAAM,aAAa,OAAO,UAAU;AACpC,YAAS,KAAK,SAAS;AACvB,SAAM,KAAK,aAAa,SAAS;AACjC,UAAO;IACP;;CAGJ,eAAuB,OAAU,cAA4C;EAC3E,MAAM,eAAe,KAAK,QAAQ,KAAK,eAAe,iBAAiB,CAAC;EAExE,MAAM,WADW,mBAAmB,eAAe,IAAI,aAAa,IAAI,QAAQ,SAAS,EAChE,YAAY,KAAA,EAAU,CAAC,KAAK,UAAU;AAC/D,qBAAmB,eAAe,IAAI,cAAc,QAAQ;AAC5D,MAAI;AACF,UAAO,MAAM;YACL;AACR,OAAI,mBAAmB,eAAe,IAAI,aAAa,KAAK,QAC1D,oBAAmB,eAAe,OAAO,aAAa;;;CAK5D,iBAAyB,gBAAsC;EAC7D,MAAM,YAAY,KAAK,aAAa,aAAa,gBAAgB;AACjE,MAAI,UAAU,kBAAkB,EAC9B,OAAM,IAAI,MAAM,oCAAoC;EAEtD,MAAM,UAAU,KAAK,aAAa,UAAU,MAAM,gBAAgB;EAClE,MAAM,OAA6C,EAAE;AACrD,OAAK,MAAM,CAAC,OAAO,WAAW,OAAO,QAAQ,QAAQ,EAAE;GACrD,MAAM,MAAM,KAAK,aAAa,QAAQ,iBAAiB,QAAQ;GAC/D,MAAM,oBAAiE,EAAE;GACzE,MAAM,cAAc,KAAK,aACvB,IAAI,mBACJ,iBAAiB,MAAM,oBACxB;AACD,QAAK,MAAM,CAAC,SAAS,eAAe,OAAO,QAAQ,YAAY,EAAE;IAC/D,MAAM,gBAAgB,KAAK,aACzB,YACA,iBAAiB,MAAM,qBAAqB,UAC7C;AACD,sBAAkB,WAAW;KAC3B,GAAI;KACJ;KACA,uBAAuB,cAAc,0BAA0B,IAAI,IAAI;KACxE;;GAEH,MAAM,gBAAgB,KAAK,cAAc,IAAI,eAAe,iBAAiB,MAAM,gBAAgB;AACnG,OAAI,CAAC,kBAAkB,eACrB,OAAM,IAAI,MAAM,iBAAiB,MAAM,oBAAoB,cAAc,GAAG;AAE9E,QAAK,SAAS;IACZ,GAAI;IACJ;IACA,SAAS,OAAO,IAAI,YAAY,YAAY,IAAI,UAAU;IAC1D;IACA;IACA,QAAQ,IAAI,UAAU,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,EAAE;IACvE;;AAEH,SAAO;GAAE,eAAe;GAAG;GAAM;;CAGnC,gBAAwB,OAAgB,UAA2C;AACjF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,OAAM,IAAI,MAAM,GAAG,MAAM,SAAS;AAEpC,SAAO;;CAGT,iBAAyB,OAAgB,UAA0B;AACjE,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,MAAM,CAC5C,OAAM,IAAI,MAAM,GAAG,MAAM,YAAY;AAEvC,SAAO;;CAGT,sBAA8B,UAC5B,OAAO,UAAU,YAAY,UAAU,QACvC,UAAU,SAAU,MAA6B,SAAS"}

package/dist/{registry → services}/app-remote-registry-client.service.d.ts

@@ -1,7 +1,7 @@
-import { AppRemoteRegistryResolution } from "./app-remote-registry.types.js";
+import { AppRemoteRegistryResolution } from "../types/app-remote-registry.types.js";
 import { AppRegistryConfigService } from "./app-registry-config.service.js";
 
-//#region src/registry/app-remote-registry-client.service.d.ts
+//#region src/services/app-remote-registry-client.service.d.ts
 declare class AppRemoteRegistryClientService {
   private readonly configService;
   constructor(configService?: AppRegistryConfigService);
@@ -22,6 +22,10 @@ declare class AppRemoteRegistryClientService {
   private readRequiredString;
   private readOptionalString;
   private normalizeBundleFileName;
+  private readGetResponse;
+  private isTransientHttpStatus;
+  private isTransientNetworkError;
+  private waitBeforeRetry;
   private normalizeRegistryUrl;
 }
 //#endregion

package/dist/services/app-remote-registry-client.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-remote-registry-client.service.d.ts","names":[],"sources":["../../src/services/app-remote-registry-client.service.ts"],"mappings":";;;;cAaa,8BAAA;EAAA,iBAEQ,aAAA;cAAA,aAAA,GAAe,wBAAA;EAGlC,OAAA,GAAiB,MAAA;IACf,KAAA;IACA,OAAA;IACA,WAAA;EAAA,MACE,OAAA,CAAQ,2BAAA;EAoCZ,cAAA,GAAwB,MAAA;IACtB,UAAA,EAAY,2BAAA;IACZ,eAAA;EAAA,MACE,OAAA;IACF,UAAA;EAAA;EAAA,QAkCM,aAAA;EAAA,QAsCA,YAAA;EAAA,QAwDA,cAAA;EAAA,QAkBA,kBAAA;EAAA,QAOA,kBAAA;EAAA,QAUA,uBAAA;EAAA,QAIA,eAAA;EAAA,QA6CA,qBAAA;EAAA,QAIA,uBAAA;EAAA,QAIA,eAAA;EAAA,QAMA,oBAAA;AAAA"}

package/dist/{registry → services}/app-remote-registry-client.service.js

@@ -1,8 +1,10 @@
 import { AppRegistryConfigService } from "./app-registry-config.service.js";
-import { writeFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
+import { writeFile } from "node:fs/promises";
 import path from "node:path";
-//#region src/registry/app-remote-registry-client.service.ts
+//#region src/services/app-remote-registry-client.service.ts
+const MAX_REMOTE_BUNDLE_BYTES = 25 * 1024 * 1024;
+const MAX_REGISTRY_GET_ATTEMPTS = 3;
 var AppRemoteRegistryClientService = class {
 	constructor(configService = new AppRegistryConfigService()) {
 		this.configService = configService;
@@ -11,9 +13,8 @@ var AppRemoteRegistryClientService = class {
 		const { appId, version: requestedVersion, registryUrl: overrideRegistryUrl } = params;
 		const registryUrl = overrideRegistryUrl ? this.normalizeRegistryUrl(overrideRegistryUrl) : (await this.configService.getSnapshot()).currentUrl;
 		const metadataUrl = new URL(encodeURIComponent(appId), registryUrl).toString();
-		const response = await fetch(metadataUrl);
-		if (!response.ok) throw new Error(`无法从 registry 拉取 ${appId} metadata：${response.status} ${response.statusText}`);
-		const document = this.parseDocument(await response.json(), appId);
+		const rawDocument = await this.readGetResponse(metadataUrl, `无法从 registry 拉取 ${appId} metadata`, async (response) => await response.json());
+		const document = this.parseDocument(rawDocument, appId);
 		const version = requestedVersion ?? document["dist-tags"].latest;
 		const versionRecord = document.versions[version];
 		if (!versionRecord) throw new Error(`registry ${registryUrl} 未提供 ${appId}@${version}。`);
@@ -32,9 +33,13 @@ var AppRemoteRegistryClientService = class {
 	};
 	downloadBundle = async (params) => {
 		const { resolution, targetDirectory } = params;
-		const response = await fetch(resolution.bundleUrl);
-		if (!response.ok) throw new Error(`无法下载 bundle：${resolution.bundleUrl} (${response.status} ${response.statusText})`);
-		const bundleBytes = Buffer.from(await response.arrayBuffer());
+		const bundleBytes = await this.readGetResponse(resolution.bundleUrl, `无法下载 bundle：${resolution.bundleUrl}`, async (response) => {
+			const contentLength = Number(response.headers.get("content-length"));
+			if (Number.isFinite(contentLength) && contentLength > MAX_REMOTE_BUNDLE_BYTES) throw new Error(`远程 bundle 超过 ${MAX_REMOTE_BUNDLE_BYTES} bytes 上限。`);
+			const bytes = Buffer.from(await response.arrayBuffer());
+			if (bytes.byteLength > MAX_REMOTE_BUNDLE_BYTES) throw new Error(`远程 bundle 超过 ${MAX_REMOTE_BUNDLE_BYTES} bytes 上限。`);
+			return bytes;
+		});
 		const actualSha256 = createHash("sha256").update(bundleBytes).digest("hex");
 		if (actualSha256 !== resolution.sha256) throw new Error(`bundle checksum 校验失败：期望 ${resolution.sha256}，实际 ${actualSha256}`);
 		const bundlePath = path.join(targetDirectory, `${this.normalizeBundleFileName(resolution.appId)}-${resolution.version}.napp`);
@@ -102,6 +107,47 @@ var AppRemoteRegistryClientService = class {
 	normalizeBundleFileName = (appId) => {
 		return appId.replace(/[^a-zA-Z0-9._-]+/g, "-");
 	};
+	readGetResponse = async (url, operation, read) => {
+		let lastError;
+		for (let attempt = 1; attempt <= MAX_REGISTRY_GET_ATTEMPTS; attempt += 1) {
+			try {
+				const response = await fetch(url);
+				if (!response.ok) {
+					if (this.isTransientHttpStatus(response.status) && attempt < MAX_REGISTRY_GET_ATTEMPTS) {
+						await response.body?.cancel();
+						await this.waitBeforeRetry(attempt);
+						continue;
+					}
+					throw new Error(`${operation}：${response.status} ${response.statusText}`);
+				}
+				try {
+					return await read(response);
+				} catch (error) {
+					if (!this.isTransientNetworkError(error) || attempt === MAX_REGISTRY_GET_ATTEMPTS) throw error;
+					lastError = error;
+				}
+			} catch (error) {
+				if (!this.isTransientNetworkError(error) || attempt === MAX_REGISTRY_GET_ATTEMPTS) {
+					if (this.isTransientNetworkError(error)) throw new Error(`${operation}失败（已尝试 ${MAX_REGISTRY_GET_ATTEMPTS} 次）。`, { cause: error });
+					throw error;
+				}
+				lastError = error;
+			}
+			await this.waitBeforeRetry(attempt);
+		}
+		throw new Error(`${operation}失败（已尝试 ${MAX_REGISTRY_GET_ATTEMPTS} 次）。`, { cause: lastError });
+	};
+	isTransientHttpStatus = (status) => {
+		return status === 408 || status === 429 || status >= 500;
+	};
+	isTransientNetworkError = (error) => {
+		return error instanceof TypeError;
+	};
+	waitBeforeRetry = async (attempt) => {
+		await new Promise((resolve) => {
+			setTimeout(resolve, attempt * 100);
+		});
+	};
 	normalizeRegistryUrl = (registryUrl) => {
 		let normalized;
 		try {

package/dist/services/app-remote-registry-client.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-remote-registry-client.service.js","names":[],"sources":["../../src/services/app-remote-registry-client.service.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { AppRegistryConfigService } from \"./app-registry-config.service.js\";\nimport type {\n  AppRemoteRegistryDocument,\n  AppRemoteRegistryResolution,\n  AppRemoteRegistryVersion,\n} from \"#app-runtime/types/app-remote-registry.types.js\";\n\nconst MAX_REMOTE_BUNDLE_BYTES = 25 * 1024 * 1024;\nconst MAX_REGISTRY_GET_ATTEMPTS = 3;\n\nexport class AppRemoteRegistryClientService {\n  constructor(\n    private readonly configService: AppRegistryConfigService = new AppRegistryConfigService(),\n  ) {}\n\n  resolve = async (params: {\n    appId: string;\n    version?: string;\n    registryUrl?: string;\n  }): Promise<AppRemoteRegistryResolution> => {\n    const { appId, version: requestedVersion, registryUrl: overrideRegistryUrl } = params;\n    const registryUrl = overrideRegistryUrl\n      ? this.normalizeRegistryUrl(overrideRegistryUrl)\n      : (await this.configService.getSnapshot()).currentUrl;\n    const metadataUrl = new URL(encodeURIComponent(appId), registryUrl).toString();\n    const rawDocument = await this.readGetResponse(\n      metadataUrl,\n      `无法从 registry 拉取 ${appId} metadata`,\n      async (response) => await response.json(),\n    );\n    const document = this.parseDocument(rawDocument, appId);\n    const version = requestedVersion ?? document[\"dist-tags\"].latest;\n    const versionRecord = document.versions[version];\n    if (!versionRecord) {\n      throw new Error(`registry ${registryUrl} 未提供 ${appId}@${version}。`);\n    }\n    return {\n      registryUrl,\n      metadataUrl,\n      appId,\n      version,\n      description: versionRecord.description ?? document.description,\n      publisher: versionRecord.publisher,\n      permissions: versionRecord.permissions,\n      distributionMode: versionRecord.dist.kind === \"source\" ? \"source\" : \"bundle\",\n      bundleUrl: new URL(\n        versionRecord.dist.artifact ??\n          versionRecord.dist.source ??\n          versionRecord.dist.bundle,\n        metadataUrl,\n      ).toString(),\n      sha256: versionRecord.dist.sha256,\n    };\n  };\n\n  downloadBundle = async (params: {\n    resolution: AppRemoteRegistryResolution;\n    targetDirectory: string;\n  }): Promise<{\n    bundlePath: string;\n  }> => {\n    const { resolution, targetDirectory } = params;\n    const bundleBytes = await this.readGetResponse(\n      resolution.bundleUrl,\n      `无法下载 bundle：${resolution.bundleUrl}`,\n      async (response) => {\n        const contentLength = Number(response.headers.get(\"content-length\"));\n        if (Number.isFinite(contentLength) && contentLength > MAX_REMOTE_BUNDLE_BYTES) {\n          throw new Error(`远程 bundle 超过 ${MAX_REMOTE_BUNDLE_BYTES} bytes 上限。`);\n        }\n        const bytes = Buffer.from(await response.arrayBuffer());\n        if (bytes.byteLength > MAX_REMOTE_BUNDLE_BYTES) {\n          throw new Error(`远程 bundle 超过 ${MAX_REMOTE_BUNDLE_BYTES} bytes 上限。`);\n        }\n        return bytes;\n      },\n    );\n    const actualSha256 = createHash(\"sha256\").update(bundleBytes).digest(\"hex\");\n    if (actualSha256 !== resolution.sha256) {\n      throw new Error(\n        `bundle checksum 校验失败：期望 ${resolution.sha256}，实际 ${actualSha256}`,\n      );\n    }\n    const bundlePath = path.join(\n      targetDirectory,\n      `${this.normalizeBundleFileName(resolution.appId)}-${resolution.version}.napp`,\n    );\n    await writeFile(bundlePath, bundleBytes);\n    return {\n      bundlePath,\n    };\n  };\n\n  private parseDocument = (\n    rawDocument: unknown,\n    appId: string,\n  ): AppRemoteRegistryDocument => {\n    if (!rawDocument || typeof rawDocument !== \"object\" || Array.isArray(rawDocument)) {\n      throw new Error(`registry ${appId} metadata 必须是对象。`);\n    }\n    const candidate = rawDocument as Record<string, unknown>;\n    const name = this.readRequiredString(candidate.name, \"name\");\n    if (name !== appId) {\n      throw new Error(`registry 返回的包名与请求不一致：请求 ${appId}，收到 ${name}`);\n    }\n    const distTags = candidate[\"dist-tags\"];\n    if (!distTags || typeof distTags !== \"object\" || Array.isArray(distTags)) {\n      throw new Error(\"registry metadata 缺少 dist-tags。\");\n    }\n    const versions = candidate.versions;\n    if (!versions || typeof versions !== \"object\" || Array.isArray(versions)) {\n      throw new Error(\"registry metadata 缺少 versions。\");\n    }\n    return {\n      name,\n      description: this.readOptionalString(candidate.description, \"description\"),\n      \"dist-tags\": {\n        latest: this.readRequiredString(\n          (distTags as Record<string, unknown>).latest,\n          \"dist-tags.latest\",\n        ),\n      },\n      versions: Object.fromEntries(\n        Object.entries(versions).map(([version, rawVersion]) => [\n          version,\n          this.parseVersion(rawVersion, name, version),\n        ]),\n      ),\n    };\n  };\n\n  private parseVersion = (\n    rawVersion: unknown,\n    appId: string,\n    version: string,\n  ): AppRemoteRegistryVersion => {\n    if (!rawVersion || typeof rawVersion !== \"object\" || Array.isArray(rawVersion)) {\n      throw new Error(`registry metadata 的 versions.${version} 必须是对象。`);\n    }\n    const candidate = rawVersion as Record<string, unknown>;\n    const name = this.readRequiredString(candidate.name, `versions.${version}.name`);\n    const parsedVersion = this.readRequiredString(\n      candidate.version,\n      `versions.${version}.version`,\n    );\n    if (name !== appId || parsedVersion !== version) {\n      throw new Error(`registry metadata 的 versions.${version} 与 app id/version 不一致。`);\n    }\n    const dist = candidate.dist;\n    if (!dist || typeof dist !== \"object\" || Array.isArray(dist)) {\n      throw new Error(`registry metadata 的 versions.${version}.dist 必须是对象。`);\n    }\n    const distCandidate = dist as Record<string, unknown>;\n    return {\n      name,\n      version: parsedVersion,\n      description: this.readOptionalString(\n        candidate.description,\n        `versions.${version}.description`,\n      ),\n      publisher: this.parsePublisher(candidate.publisher, version),\n      permissions: candidate.permissions as AppRemoteRegistryVersion[\"permissions\"],\n      dist: {\n        kind:\n          distCandidate.kind === \"source\" || distCandidate.kind === \"bundle\"\n            ? distCandidate.kind\n            : undefined,\n        artifact: this.readOptionalString(\n          distCandidate.artifact,\n          `versions.${version}.dist.artifact`,\n        ),\n        bundle: this.readRequiredString(\n          distCandidate.bundle,\n          `versions.${version}.dist.bundle`,\n        ),\n        source: this.readOptionalString(\n          distCandidate.source,\n          `versions.${version}.dist.source`,\n        ),\n        sha256: this.readRequiredString(\n          distCandidate.sha256,\n          `versions.${version}.dist.sha256`,\n        ),\n      },\n    };\n  };\n\n  private parsePublisher = (\n    rawPublisher: unknown,\n    version: string,\n  ): AppRemoteRegistryVersion[\"publisher\"] => {\n    if (rawPublisher === undefined) {\n      return undefined;\n    }\n    if (!rawPublisher || typeof rawPublisher !== \"object\" || Array.isArray(rawPublisher)) {\n      throw new Error(`versions.${version}.publisher 必须是对象。`);\n    }\n    const candidate = rawPublisher as Record<string, unknown>;\n    return {\n      id: this.readRequiredString(candidate.id, `versions.${version}.publisher.id`),\n      name: this.readRequiredString(candidate.name, `versions.${version}.publisher.name`),\n      url: this.readOptionalString(candidate.url, `versions.${version}.publisher.url`),\n    };\n  };\n\n  private readRequiredString = (value: unknown, fieldName: string): string => {\n    if (typeof value !== \"string\" || !value.trim()) {\n      throw new Error(`${fieldName} 必须是非空字符串。`);\n    }\n    return value.trim();\n  };\n\n  private readOptionalString = (\n    value: unknown,\n    fieldName: string,\n  ): string | undefined => {\n    if (value === undefined) {\n      return undefined;\n    }\n    return this.readRequiredString(value, fieldName);\n  };\n\n  private normalizeBundleFileName = (appId: string): string => {\n    return appId.replace(/[^a-zA-Z0-9._-]+/g, \"-\");\n  };\n\n  private readGetResponse = async <T>(\n    url: string,\n    operation: string,\n    read: (response: Response) => Promise<T>,\n  ): Promise<T> => {\n    let lastError: unknown;\n    for (let attempt = 1; attempt <= MAX_REGISTRY_GET_ATTEMPTS; attempt += 1) {\n      try {\n        const response = await fetch(url);\n        if (!response.ok) {\n          if (this.isTransientHttpStatus(response.status) && attempt < MAX_REGISTRY_GET_ATTEMPTS) {\n            await response.body?.cancel();\n            await this.waitBeforeRetry(attempt);\n            continue;\n          }\n          throw new Error(`${operation}：${response.status} ${response.statusText}`);\n        }\n        try {\n          return await read(response);\n        } catch (error) {\n          if (!this.isTransientNetworkError(error) || attempt === MAX_REGISTRY_GET_ATTEMPTS) {\n            throw error;\n          }\n          lastError = error;\n        }\n      } catch (error) {\n        if (!this.isTransientNetworkError(error) || attempt === MAX_REGISTRY_GET_ATTEMPTS) {\n          if (this.isTransientNetworkError(error)) {\n            throw new Error(\n              `${operation}失败（已尝试 ${MAX_REGISTRY_GET_ATTEMPTS} 次）。`,\n              { cause: error },\n            );\n          }\n          throw error;\n        }\n        lastError = error;\n      }\n      await this.waitBeforeRetry(attempt);\n    }\n    throw new Error(\n      `${operation}失败（已尝试 ${MAX_REGISTRY_GET_ATTEMPTS} 次）。`,\n      { cause: lastError },\n    );\n  };\n\n  private isTransientHttpStatus = (status: number): boolean => {\n    return status === 408 || status === 429 || status >= 500;\n  };\n\n  private isTransientNetworkError = (error: unknown): boolean => {\n    return error instanceof TypeError;\n  };\n\n  private waitBeforeRetry = async (attempt: number): Promise<void> => {\n    await new Promise<void>((resolve) => {\n      setTimeout(resolve, attempt * 100);\n    });\n  };\n\n  private normalizeRegistryUrl = (registryUrl: string): string => {\n    let normalized: URL;\n    try {\n      normalized = new URL(registryUrl);\n    } catch {\n      throw new Error(`非法 registry URL：${registryUrl}`);\n    }\n    if (normalized.protocol !== \"http:\" && normalized.protocol !== \"https:\") {\n      throw new Error(`registry URL 只支持 http/https：${registryUrl}`);\n    }\n    const text = normalized.toString();\n    return text.endsWith(\"/\") ? text : `${text}/`;\n  };\n}\n"],"mappings":";;;;;AAUA,MAAM,0BAA0B,KAAK,OAAO;AAC5C,MAAM,4BAA4B;AAElC,IAAa,iCAAb,MAA4C;CAC1C,YACE,gBAA2D,IAAI,0BAA0B,EACzF;AADiB,OAAA,gBAAA;;CAGnB,UAAU,OAAO,WAI2B;EAC1C,MAAM,EAAE,OAAO,SAAS,kBAAkB,aAAa,wBAAwB;EAC/E,MAAM,cAAc,sBAChB,KAAK,qBAAqB,oBAAoB,IAC7C,MAAM,KAAK,cAAc,aAAa,EAAE;EAC7C,MAAM,cAAc,IAAI,IAAI,mBAAmB,MAAM,EAAE,YAAY,CAAC,UAAU;EAC9E,MAAM,cAAc,MAAM,KAAK,gBAC7B,aACA,mBAAmB,MAAM,YACzB,OAAO,aAAa,MAAM,SAAS,MAAM,CAC1C;EACD,MAAM,WAAW,KAAK,cAAc,aAAa,MAAM;EACvD,MAAM,UAAU,oBAAoB,SAAS,aAAa;EAC1D,MAAM,gBAAgB,SAAS,SAAS;AACxC,MAAI,CAAC,cACH,OAAM,IAAI,MAAM,YAAY,YAAY,OAAO,MAAM,GAAG,QAAQ,GAAG;AAErE,SAAO;GACL;GACA;GACA;GACA;GACA,aAAa,cAAc,eAAe,SAAS;GACnD,WAAW,cAAc;GACzB,aAAa,cAAc;GAC3B,kBAAkB,cAAc,KAAK,SAAS,WAAW,WAAW;GACpE,WAAW,IAAI,IACb,cAAc,KAAK,YACjB,cAAc,KAAK,UACnB,cAAc,KAAK,QACrB,YACD,CAAC,UAAU;GACZ,QAAQ,cAAc,KAAK;GAC5B;;CAGH,iBAAiB,OAAO,WAKlB;EACJ,MAAM,EAAE,YAAY,oBAAoB;EACxC,MAAM,cAAc,MAAM,KAAK,gBAC7B,WAAW,WACX,eAAe,WAAW,aAC1B,OAAO,aAAa;GAClB,MAAM,gBAAgB,OAAO,SAAS,QAAQ,IAAI,iBAAiB,CAAC;AACpE,OAAI,OAAO,SAAS,cAAc,IAAI,gBAAgB,wBACpD,OAAM,IAAI,MAAM,gBAAgB,wBAAwB,YAAY;GAEtE,MAAM,QAAQ,OAAO,KAAK,MAAM,SAAS,aAAa,CAAC;AACvD,OAAI,MAAM,aAAa,wBACrB,OAAM,IAAI,MAAM,gBAAgB,wBAAwB,YAAY;AAEtE,UAAO;IAEV;EACD,MAAM,eAAe,WAAW,SAAS,CAAC,OAAO,YAAY,CAAC,OAAO,MAAM;AAC3E,MAAI,iBAAiB,WAAW,OAC9B,OAAM,IAAI,MACR,2BAA2B,WAAW,OAAO,MAAM,eACpD;EAEH,MAAM,aAAa,KAAK,KACtB,iBACA,GAAG,KAAK,wBAAwB,WAAW,MAAM,CAAC,GAAG,WAAW,QAAQ,OACzE;AACD,QAAM,UAAU,YAAY,YAAY;AACxC,SAAO,EACL,YACD;;CAGH,iBACE,aACA,UAC8B;AAC9B,MAAI,CAAC,eAAe,OAAO,gBAAgB,YAAY,MAAM,QAAQ,YAAY,CAC/E,OAAM,IAAI,MAAM,YAAY,MAAM,kBAAkB;EAEtD,MAAM,YAAY;EAClB,MAAM,OAAO,KAAK,mBAAmB,UAAU,MAAM,OAAO;AAC5D,MAAI,SAAS,MACX,OAAM,IAAI,MAAM,2BAA2B,MAAM,MAAM,OAAO;EAEhE,MAAM,WAAW,UAAU;AAC3B,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,SAAS,CACtE,OAAM,IAAI,MAAM,kCAAkC;EAEpD,MAAM,WAAW,UAAU;AAC3B,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,SAAS,CACtE,OAAM,IAAI,MAAM,iCAAiC;AAEnD,SAAO;GACL;GACA,aAAa,KAAK,mBAAmB,UAAU,aAAa,cAAc;GAC1E,aAAa,EACX,QAAQ,KAAK,mBACV,SAAqC,QACtC,mBACD,EACF;GACD,UAAU,OAAO,YACf,OAAO,QAAQ,SAAS,CAAC,KAAK,CAAC,SAAS,gBAAgB,CACtD,SACA,KAAK,aAAa,YAAY,MAAM,QAAQ,CAC7C,CAAC,CACH;GACF;;CAGH,gBACE,YACA,OACA,YAC6B;AAC7B,MAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,WAAW,CAC5E,OAAM,IAAI,MAAM,gCAAgC,QAAQ,SAAS;EAEnE,MAAM,YAAY;EAClB,MAAM,OAAO,KAAK,mBAAmB,UAAU,MAAM,YAAY,QAAQ,OAAO;EAChF,MAAM,gBAAgB,KAAK,mBACzB,UAAU,SACV,YAAY,QAAQ,UACrB;AACD,MAAI,SAAS,SAAS,kBAAkB,QACtC,OAAM,IAAI,MAAM,gCAAgC,QAAQ,wBAAwB;EAElF,MAAM,OAAO,UAAU;AACvB,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,KAAK,CAC1D,OAAM,IAAI,MAAM,gCAAgC,QAAQ,cAAc;EAExE,MAAM,gBAAgB;AACtB,SAAO;GACL;GACA,SAAS;GACT,aAAa,KAAK,mBAChB,UAAU,aACV,YAAY,QAAQ,cACrB;GACD,WAAW,KAAK,eAAe,UAAU,WAAW,QAAQ;GAC5D,aAAa,UAAU;GACvB,MAAM;IACJ,MACE,cAAc,SAAS,YAAY,cAAc,SAAS,WACtD,cAAc,OACd,KAAA;IACN,UAAU,KAAK,mBACb,cAAc,UACd,YAAY,QAAQ,gBACrB;IACD,QAAQ,KAAK,mBACX,cAAc,QACd,YAAY,QAAQ,cACrB;IACD,QAAQ,KAAK,mBACX,cAAc,QACd,YAAY,QAAQ,cACrB;IACD,QAAQ,KAAK,mBACX,cAAc,QACd,YAAY,QAAQ,cACrB;IACF;GACF;;CAGH,kBACE,cACA,YAC0C;AAC1C,MAAI,iBAAiB,KAAA,EACnB;AAEF,MAAI,CAAC,gBAAgB,OAAO,iBAAiB,YAAY,MAAM,QAAQ,aAAa,CAClF,OAAM,IAAI,MAAM,YAAY,QAAQ,mBAAmB;EAEzD,MAAM,YAAY;AAClB,SAAO;GACL,IAAI,KAAK,mBAAmB,UAAU,IAAI,YAAY,QAAQ,eAAe;GAC7E,MAAM,KAAK,mBAAmB,UAAU,MAAM,YAAY,QAAQ,iBAAiB;GACnF,KAAK,KAAK,mBAAmB,UAAU,KAAK,YAAY,QAAQ,gBAAgB;GACjF;;CAGH,sBAA8B,OAAgB,cAA8B;AAC1E,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,MAAM,CAC5C,OAAM,IAAI,MAAM,GAAG,UAAU,YAAY;AAE3C,SAAO,MAAM,MAAM;;CAGrB,sBACE,OACA,cACuB;AACvB,MAAI,UAAU,KAAA,EACZ;AAEF,SAAO,KAAK,mBAAmB,OAAO,UAAU;;CAGlD,2BAAmC,UAA0B;AAC3D,SAAO,MAAM,QAAQ,qBAAqB,IAAI;;CAGhD,kBAA0B,OACxB,KACA,WACA,SACe;EACf,IAAI;AACJ,OAAK,IAAI,UAAU,GAAG,WAAW,2BAA2B,WAAW,GAAG;AACxE,OAAI;IACF,MAAM,WAAW,MAAM,MAAM,IAAI;AACjC,QAAI,CAAC,SAAS,IAAI;AAChB,SAAI,KAAK,sBAAsB,SAAS,OAAO,IAAI,UAAU,2BAA2B;AACtF,YAAM,SAAS,MAAM,QAAQ;AAC7B,YAAM,KAAK,gBAAgB,QAAQ;AACnC;;AAEF,WAAM,IAAI,MAAM,GAAG,UAAU,GAAG,SAAS,OAAO,GAAG,SAAS,aAAa;;AAE3E,QAAI;AACF,YAAO,MAAM,KAAK,SAAS;aACpB,OAAO;AACd,SAAI,CAAC,KAAK,wBAAwB,MAAM,IAAI,YAAY,0BACtD,OAAM;AAER,iBAAY;;YAEP,OAAO;AACd,QAAI,CAAC,KAAK,wBAAwB,MAAM,IAAI,YAAY,2BAA2B;AACjF,SAAI,KAAK,wBAAwB,MAAM,CACrC,OAAM,IAAI,MACR,GAAG,UAAU,SAAS,0BAA0B,OAChD,EAAE,OAAO,OAAO,CACjB;AAEH,WAAM;;AAER,gBAAY;;AAEd,SAAM,KAAK,gBAAgB,QAAQ;;AAErC,QAAM,IAAI,MACR,GAAG,UAAU,SAAS,0BAA0B,OAChD,EAAE,OAAO,WAAW,CACrB;;CAGH,yBAAiC,WAA4B;AAC3D,SAAO,WAAW,OAAO,WAAW,OAAO,UAAU;;CAGvD,2BAAmC,UAA4B;AAC7D,SAAO,iBAAiB;;CAG1B,kBAA0B,OAAO,YAAmC;AAClE,QAAM,IAAI,SAAe,YAAY;AACnC,cAAW,SAAS,UAAU,IAAI;IAClC;;CAGJ,wBAAgC,gBAAgC;EAC9D,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,IAAI,YAAY;UAC3B;AACN,SAAM,IAAI,MAAM,mBAAmB,cAAc;;AAEnD,MAAI,WAAW,aAAa,WAAW,WAAW,aAAa,SAC7D,OAAM,IAAI,MAAM,+BAA+B,cAAc;EAE/D,MAAM,OAAO,WAAW,UAAU;AAClC,SAAO,KAAK,SAAS,IAAI,GAAG,OAAO,GAAG,KAAK"}

package/dist/{cli → services}/app-runtime-cli.service.d.ts

@@ -1,6 +1,6 @@
 import { AppRuntimeOptionsService } from "./app-runtime-options.service.js";
 
-//#region src/cli/app-runtime-cli.service.d.ts
+//#region src/services/app-runtime-cli.service.d.ts
 declare class AppRuntimeCliService {
   private readonly optionsService;
   constructor(optionsService?: AppRuntimeOptionsService);

package/dist/services/app-runtime-cli.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-runtime-cli.service.d.ts","names":[],"sources":["../../src/services/app-runtime-cli.service.ts"],"mappings":";;;cAqBa,oBAAA;EAAA,iBAEQ,cAAA;cAAA,cAAA,GAAgB,wBAAA;EAGnC,GAAA,QAAgB,OAAA;EAAA,QAkBR,QAAA;EAAA,QA8DA,YAAA;EAAA,QAWA,aAAA;EAAA,QAUA,WAAA;EAAA,QAsBA,YAAA;EAAA,QAwBA,SAAA;EAAA,QAcA,SAAA;EAAA,QAcA,UAAA;EAAA,QAYA,aAAA;EAAA,QAcA,qBAAA;EAAA,QAYA,aAAA;EAAA,QAWA,YAAA;EAAA,QAYA,eAAA;EAAA,QAWA,UAAA;EAAA,QAQA,UAAA;EAAA,QAUA,cAAA;EAAA,QA8CA,iBAAA;EAAA,QAUA,WAAA;EAAA,QAWA,YAAA;EAAA,QAWA,UAAA;EAAA,QAwBA,KAAA;AAAA"}

package/dist/{cli → services}/app-runtime-cli.service.js

@@ -1,24 +1,24 @@
 import { version } from "../package.js";
-import { CreateCommand } from "../commands/create.controller.js";
-import { AppRuntimeToolchainService } from "../runtime/app-runtime-toolchain.service.js";
-import { AppBuildService } from "../runtime/app-build.service.js";
-import { RunCommand } from "../commands/run.controller.js";
-import { DevCommand } from "../commands/dev.controller.js";
-import { GrantCommand } from "../commands/grant.controller.js";
-import { InfoCommand } from "../commands/info.controller.js";
-import { InspectCommand } from "../commands/inspect.controller.js";
-import { InstallCommand } from "../commands/install.controller.js";
-import { ListCommand } from "../commands/list.controller.js";
-import { PackCommand } from "../commands/pack.controller.js";
-import { PermissionsCommand } from "../commands/permissions.controller.js";
-import { PublishCommand } from "../commands/publish.controller.js";
-import { RegistryCommand } from "../commands/registry.controller.js";
-import { RevokeCommand } from "../commands/revoke.controller.js";
-import { UninstallCommand } from "../commands/uninstall.controller.js";
-import { UpdateCommand } from "../commands/update.controller.js";
-import { ValidatePublishCommand } from "../commands/validate-publish.controller.js";
+import { CreateCommand } from "../controllers/create.controller.js";
+import { AppRuntimeToolchainService } from "./app-runtime-toolchain.service.js";
+import { AppBuildService } from "./app-build.service.js";
+import { RunCommand } from "../controllers/run.controller.js";
+import { DevCommand } from "../controllers/dev.controller.js";
+import { GrantCommand } from "../controllers/grant.controller.js";
+import { InfoCommand } from "../controllers/info.controller.js";
+import { InspectCommand } from "../controllers/inspect.controller.js";
+import { InstallCommand } from "../controllers/install.controller.js";
+import { ListCommand } from "../controllers/list.controller.js";
+import { PackCommand } from "../controllers/pack.controller.js";
+import { PermissionsCommand } from "../controllers/permissions.controller.js";
+import { PublishCommand } from "../controllers/publish.controller.js";
+import { RegistryCommand } from "../controllers/registry.controller.js";
+import { RevokeCommand } from "../controllers/revoke.controller.js";
+import { UninstallCommand } from "../controllers/uninstall.controller.js";
+import { UpdateCommand } from "../controllers/update.controller.js";
+import { ValidatePublishCommand } from "../controllers/validate-publish.controller.js";
 import { AppRuntimeOptionsService } from "./app-runtime-options.service.js";
-//#region src/cli/app-runtime-cli.service.ts
+//#region src/services/app-runtime-cli.service.ts
 var AppRuntimeCliService = class {
 	constructor(optionsService = new AppRuntimeOptionsService()) {
 		this.optionsService = optionsService;