@nextclaw/kernel 0.7.0 → 0.8.1

package/dist/index.js

@@ -10,7 +10,7 @@ import { catchError, filter, from, lastValueFrom, tap } from "rxjs";
 import { appendFileSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { access, appendFile, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { AppHomeService, AppInstallationService, AppInstanceStorageService, AppManifestService, AppRegistryService, isAppComponentManifestBundle } from "@nextclaw/app-runtime";
+import { AppHomeService, AppInstallationService, AppInstanceInventoryService, AppInstanceStorageService, AppManifestService, AppRegistryService, FileLockService, isAppComponentManifestBundle } from "@nextclaw/app-runtime";
 import { execFileSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { BUILTIN_PROVIDER_PLUGINS } from "@nextclaw/runtime";
@@ -2876,13 +2876,16 @@ var AppPackageManager = class {
 	installRuntimeHooks = (hooks) => {
 		this.runtimeHooks = hooks;
 	};
-	listPackages = async () => {
-		await this.ensureBuiltInPackages();
+	start = async () => await this.ensureBuiltInPackages();
+	listPackages = async (options = {}) => {
 		const records = await this.registryService.listApps();
-		return { entries: await Promise.all(records.map(async (record) => await this.toPackageView(await this.installationService.info(record.appId)))) };
+		return { entries: await Promise.all(records.map(async (record) => await this.toPackageView(await this.installationService.info(record.appId, { measureStorageUsage: options.includeStorageUsage !== false })))) };
 	};
+	listInstalledDataOwners = async () => (await this.registryService.listApps()).map((record) => ({
+		id: record.appId,
+		name: record.name
+	}));
 	getPackage = async (appId) => {
-		await this.ensureBuiltInPackages();
 		try {
 			return await this.toPackageView(await this.installationService.info(appId));
 		} catch (error) {
@@ -2891,7 +2894,6 @@ var AppPackageManager = class {
 		}
 	};
 	listActiveComponentSources = async () => {
-		await this.ensureBuiltInPackages();
 		const records = await this.registryService.listApps();
 		return (await Promise.all(records.filter((record) => record.enabled).map(async (record) => {
 			await this.installationService.assertVersionIntegrity(record.appId, record.activeVersion);
@@ -3188,6 +3190,165 @@ var AppPackageManager = class {
 	isMissingFileError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 };
 //#endregion
+//#region src/types/app-data.types.ts
+var AppDataError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "AppDataError";
+	}
+};
+function isAppDataError(error) {
+	return error instanceof AppDataError;
+}
+//#endregion
+//#region src/managers/app-data.manager.ts
+const DATA_ID_PREFIX = "ad1.";
+const SAFE_ID_PATTERN = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;
+const WORKSPACE_SCOPE_PATTERN = /^[a-f0-9]{16}$/;
+var AppDataManager = class {
+	appHomeService;
+	fileLockService = new FileLockService();
+	inventoryService = new AppInstanceInventoryService();
+	reconciliationDiagnostics = [];
+	constructor(params) {
+		this.params = params;
+		this.appHomeService = new AppHomeService(params.appHomeDirectory);
+	}
+	start = async () => {
+		const workspacePath = path.resolve(this.params.getWorkspacePath());
+		const [packageDiagnostics, workspaceDiagnostics] = await Promise.all([this.inventoryService.reconcileDeletions(this.appHomeService.getInstancesDirectory()), this.inventoryService.reconcileDeletions(this.getWorkspaceInstancesRoot(workspacePath))]);
+		this.reconciliationDiagnostics = [...packageDiagnostics.map((entry) => ({
+			...entry,
+			source: "package"
+		})), ...workspaceDiagnostics.map((entry) => ({
+			...entry,
+			source: "workspace-service"
+		}))];
+	};
+	list = async () => {
+		const workspacePath = path.resolve(this.params.getWorkspacePath());
+		const workspaceInstancesRoot = this.getWorkspaceInstancesRoot(workspacePath);
+		const [packageInventory, workspaceInventory, packageList, workspaceOwners] = await Promise.all([
+			this.inventoryService.list(this.appHomeService.getInstancesDirectory()),
+			this.inventoryService.list(workspaceInstancesRoot),
+			this.params.listInstalledPackageOwners(),
+			this.params.listWorkspaceDataOwners()
+		]);
+		const packageOwners = new Map(packageList.map((entry) => [entry.id, entry]));
+		const workspaceOwnerMap = new Map(workspaceOwners.map((entry) => [entry.id, entry]));
+		const workspaceScope = this.workspaceScope(workspacePath);
+		const entries = [...packageInventory.entries.map((entry) => this.toEntry({
+			entry,
+			source: "package",
+			displayName: packageOwners.get(entry.appId)?.name ?? entry.appId,
+			active: packageOwners.has(entry.appId)
+		})), ...workspaceInventory.entries.map((entry) => this.toEntry({
+			entry,
+			source: "workspace-service",
+			displayName: workspaceOwnerMap.get(entry.appId)?.title ?? entry.appId,
+			active: workspaceOwnerMap.has(entry.appId),
+			scope: workspaceScope
+		}))].sort((left, right) => left.displayName.localeCompare(right.displayName) || left.id.localeCompare(right.id));
+		const currentDiagnostics = [...packageInventory.diagnostics.map((diagnostic) => ({
+			...diagnostic,
+			source: "package"
+		})), ...workspaceInventory.diagnostics.map((diagnostic) => ({
+			...diagnostic,
+			source: "workspace-service"
+		}))];
+		const currentDiagnosticKeys = new Set(currentDiagnostics.map((entry) => `${entry.source}:${entry.instanceDirectory}`));
+		const diagnostics = /* @__PURE__ */ new Map();
+		for (const entry of [...currentDiagnostics, ...this.reconciliationDiagnostics.filter((diagnostic) => currentDiagnosticKeys.has(`${diagnostic.source}:${diagnostic.instanceDirectory}`))]) diagnostics.set(`${entry.source}:${entry.instanceDirectory}`, entry);
+		return {
+			entries,
+			diagnostics: Array.from(diagnostics.values())
+		};
+	};
+	deleteRetained = async (dataId, confirmAppId) => {
+		const payload = this.parseDataId(dataId);
+		if (confirmAppId !== payload.appId) throw new AppDataError("APP_DATA_CONFIRMATION_MISMATCH", `确认的 App id 与目标不一致：${confirmAppId || "(empty)"}`);
+		if (payload.source === "package") await this.deletePackageData(payload);
+		else await this.deleteWorkspaceData(payload);
+		return {
+			deleted: true,
+			id: dataId,
+			appId: payload.appId,
+			instanceId: payload.instanceId
+		};
+	};
+	deletePackageData = async (payload) => {
+		await this.fileLockService.withLock(this.appHomeService.getAppOperationLockPath(payload.appId), async () => {
+			await this.inventoryService.purge({
+				instancesRoot: this.appHomeService.getInstancesDirectory(),
+				appId: payload.appId,
+				instanceId: payload.instanceId,
+				assertCanPurge: async () => {
+					if (await this.isPackageActive(payload.appId)) throw new AppDataError("APP_DATA_ACTIVE", `应用 ${payload.appId} 仍已安装，请通过卸载入口处理其数据。`);
+				}
+			});
+		}).catch((error) => this.rethrowMissing(error, payload));
+	};
+	deleteWorkspaceData = async (payload) => {
+		const workspacePath = path.resolve(this.params.getWorkspacePath());
+		if (payload.scope !== this.workspaceScope(workspacePath)) throw new AppDataError("APP_DATA_INVALID_ID", "App data id 不属于当前 workspace。");
+		const lockPath = path.join(workspacePath, ".nextclaw", "locks", "service-apps", `${payload.appId}.lock`);
+		await this.fileLockService.withLock(lockPath, async () => {
+			await this.inventoryService.purge({
+				instancesRoot: this.getWorkspaceInstancesRoot(workspacePath),
+				appId: payload.appId,
+				instanceId: payload.instanceId,
+				assertCanPurge: async () => {
+					if (await this.isWorkspaceServiceActive(payload.appId)) throw new AppDataError("APP_DATA_ACTIVE", `Service App ${payload.appId} 仍在 workspace 中，请通过 Service Apps 删除入口处理其数据。`);
+				}
+			});
+		}).catch((error) => this.rethrowMissing(error, payload));
+	};
+	toEntry = (params) => {
+		const { active, displayName, entry, scope, source } = params;
+		return {
+			id: this.createDataId({
+				version: 1,
+				source,
+				appId: entry.appId,
+				instanceId: entry.instanceId,
+				scope
+			}),
+			appId: entry.appId,
+			instanceId: entry.instanceId,
+			publisherId: entry.publisherId,
+			displayName,
+			source,
+			lifecycle: active ? "active" : "retained",
+			storage: entry.storage,
+			usage: entry.usage,
+			createdAt: entry.createdAt,
+			migratedAt: entry.migratedAt,
+			actions: { deleteRetainedData: !active }
+		};
+	};
+	createDataId = (payload) => `${DATA_ID_PREFIX}${Buffer.from(JSON.stringify(payload), "utf8").toString("base64url")}`;
+	parseDataId = (dataId) => {
+		try {
+			if (!dataId.startsWith(DATA_ID_PREFIX)) throw new Error("prefix");
+			const raw = JSON.parse(Buffer.from(dataId.slice(4), "base64url").toString("utf8"));
+			if (raw.version !== 1 || raw.source !== "package" && raw.source !== "workspace-service" || typeof raw.appId !== "string" || !SAFE_ID_PATTERN.test(raw.appId) || typeof raw.instanceId !== "string" || !SAFE_ID_PATTERN.test(raw.instanceId) || raw.source === "package" && raw.scope !== void 0 || raw.source === "workspace-service" && (typeof raw.scope !== "string" || !WORKSPACE_SCOPE_PATTERN.test(raw.scope))) throw new Error("shape");
+			return raw;
+		} catch {
+			throw new AppDataError("APP_DATA_INVALID_ID", "App data id 无效。");
+		}
+	};
+	isPackageActive = async (appId) => (await this.params.listInstalledPackageOwners()).some((entry) => entry.id === appId);
+	isWorkspaceServiceActive = async (appId) => (await this.params.listWorkspaceDataOwners()).some((entry) => entry.id === appId);
+	getWorkspaceInstancesRoot = (workspacePath) => path.join(workspacePath, ".nextclaw", "app-instances");
+	workspaceScope = (workspacePath) => createHash("sha256").update(workspacePath).digest("hex").slice(0, 16);
+	rethrowMissing = (error, payload) => {
+		if (error instanceof Error && (error.message.includes("metadata 不存在") || this.isMissingFileError(error))) throw new AppDataError("APP_DATA_NOT_FOUND", `未找到 App 数据：${payload.appId}/${payload.instanceId}`);
+		throw error;
+	};
+	isMissingFileError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+};
+//#endregion
 //#region src/managers/channel.manager.ts
 var ChannelManager = class {
 	channels = {};
@@ -9879,7 +10040,7 @@ var McpServiceAppRuntimeService = class {
 };
 //#endregion
 //#region src/utils/service-app-manifest.utils.ts
-const SERVICE_APP_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const SERVICE_APP_ID_PATTERN$1 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const SERVICE_ACTION_RISKS = new Set([
 	"read",
 	"write",
@@ -9902,7 +10063,7 @@ function parseServiceAppManifest(raw) {
 	}
 	if (!isRecord$9(parsed)) throw new Error("service-app.json must contain an object.");
 	const id = readRequiredString$6(parsed, "id");
-	if (!SERVICE_APP_ID_PATTERN.test(id)) throw new Error("service app id must be kebab-case.");
+	if (!SERVICE_APP_ID_PATTERN$1.test(id)) throw new Error("service app id must be kebab-case.");
 	const protocol = readOptionalString$7(parsed, "protocol") ?? "mcp";
 	if (protocol !== "mcp") throw new Error("service app protocol must be mcp.");
 	return {
@@ -9969,7 +10130,8 @@ var ServiceAppRecordService = class {
 		const dirPath = join(serviceAppsPath, dirName);
 		try {
 			const manifest = await readServiceAppManifest(dirPath);
-			return this.fromManifest(dirPath, manifest, void 0, await this.materializeWorkspaceStorage(manifest.id));
+			if (manifest.id !== dirName) throw new Error(`service app manifest id must match directory name: ${dirName}`);
+			return this.fromManifest(dirPath, manifest, void 0, await this.inspectWorkspaceStorage(manifest.id));
 		} catch (error) {
 			if (this.isMissingFileError(error)) return null;
 			return this.failedWorkspaceRecord(dirName, dirPath, error);
@@ -9984,14 +10146,36 @@ var ServiceAppRecordService = class {
 			return this.failedPackageRecord(source, error);
 		}
 	};
+	listWorkspaceDataOwners = async (serviceAppsPath, dirNames) => {
+		return (await Promise.all(dirNames.map(async (dirName) => {
+			try {
+				const manifest = await readServiceAppManifest(join(serviceAppsPath, dirName));
+				return manifest.id === dirName ? {
+					id: manifest.id,
+					title: manifest.title
+				} : null;
+			} catch {
+				return null;
+			}
+		}))).filter((entry) => Boolean(entry));
+	};
 	materializeWorkspaceStorage = async (serviceId) => {
-		const instanceDirectory = join(this.params.getWorkspacePath(), ".nextclaw", "app-instances", serviceId, "default");
+		const instanceDirectory = this.getWorkspaceInstanceDirectory(serviceId);
 		return (await this.instanceStorageService.materialize({
 			appId: serviceId,
 			instanceId: "default",
 			instanceDirectory
 		})).storage;
 	};
+	inspectWorkspaceStorage = async (serviceId) => {
+		const instanceDirectory = this.getWorkspaceInstanceDirectory(serviceId);
+		if (!await this.pathExists(instanceDirectory)) return;
+		return (await this.instanceStorageService.inspect({
+			appId: serviceId,
+			instanceId: "default",
+			instanceDirectory
+		})).storage;
+	};
 	fromManifest = (dirPath, manifest, packageSource, storage) => {
 		const runtimeStatus = this.params.runtimeService.getStatus(manifest.id);
 		return {
@@ -10051,9 +10235,146 @@ var ServiceAppRecordService = class {
 		isolation: source.isolation
 	});
 	toTitle = (value) => basename(value).replace(/[-_]+/g, " ").trim() || value;
+	getWorkspaceInstanceDirectory = (serviceId) => join(this.params.getWorkspacePath(), ".nextclaw", "app-instances", serviceId, "default");
+	pathExists = async (targetPath) => {
+		try {
+			await access(targetPath);
+			return true;
+		} catch (error) {
+			if (this.isMissingFileError(error)) return false;
+			throw error;
+		}
+	};
 	isMissingFileError = (error) => typeof error === "object" && error !== null && error.code === "ENOENT";
 };
 //#endregion
+//#region src/services/service-app-removal.service.ts
+const TRANSACTION_ID = "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
+const CURRENT_DELETION_PATTERN = new RegExp(`^\\.deleting-(?<appId>[a-z0-9]+(?:-[a-z0-9]+)*)-(?<transactionId>${TRANSACTION_ID})$`);
+const LEGACY_DELETION_PATTERN = new RegExp(`^(?<appId>[a-z0-9]+(?:-[a-z0-9]+)*)\\.deleting-(?<transactionId>${TRANSACTION_ID})$`);
+function isServiceAppDeletionTombstone(directoryName) {
+	return Boolean(parseServiceAppDeletionTombstone(directoryName));
+}
+var ServiceAppRemovalCleanupError = class extends Error {
+	constructor(cause) {
+		super(`临时目录清理失败：${cause instanceof Error ? cause.message : String(cause)}`);
+		this.cause = cause;
+		this.name = "ServiceAppRemovalCleanupError";
+	}
+};
+var ServiceAppRemovalService = class {
+	fileLockService = new FileLockService();
+	listCanonicalDirectoryNames = async (serviceAppsPath) => (await this.listDirectories(serviceAppsPath)).filter((directoryName) => !directoryName.startsWith(".") && !isServiceAppDeletionTombstone(directoryName));
+	remove = async (params) => await this.fileLockService.withLock(params.lockPath, async () => {
+		const record = await params.loadRecord();
+		await this.removeLocked({
+			...params,
+			record
+		});
+		return record;
+	});
+	reconcile = async (params) => {
+		const { grantStore, lockPathForAppId, serviceAppsPath } = params;
+		const diagnostics = [];
+		for (const directoryName of await this.listDirectories(serviceAppsPath)) {
+			const appId = parseServiceAppDeletionTombstone(directoryName);
+			if (!appId) continue;
+			const stagedPath = join(serviceAppsPath, directoryName);
+			const canonicalPath = join(serviceAppsPath, appId);
+			try {
+				await this.fileLockService.withLock(lockPathForAppId(appId), async () => {
+					const manifest = await readServiceAppManifest(stagedPath);
+					if (manifest.id !== appId) throw new Error(`Service App 删除墓碑 identity 不匹配：${manifest.id}`);
+					if (!await this.pathExists(canonicalPath)) await grantStore.revokeActionsByPrefix(`${appId}.`);
+					await rm(stagedPath, { recursive: true });
+				});
+			} catch (error) {
+				diagnostics.push({
+					appId,
+					stagedPath,
+					message: error instanceof Error ? error.message : String(error)
+				});
+			}
+		}
+		return diagnostics.sort((left, right) => left.stagedPath.localeCompare(right.stagedPath));
+	};
+	removeLocked = async (params) => {
+		const { grantStore, purgeData, record, stopRuntime } = params;
+		const grants = (await grantStore.list()).filter((grant) => grant.actionId.startsWith(`${record.id}.`));
+		const stagedPaths = [];
+		try {
+			await stopRuntime(record);
+			await this.stageSourcePath(record.dirPath, stagedPaths);
+			if (purgeData && record.storage) await this.stageInstancePath(record.storage.instanceDirectory, stagedPaths);
+			await grantStore.revokeActionsByPrefix(`${record.id}.`);
+		} catch (error) {
+			const recoveryErrors = [...await this.restoreStagedPaths(stagedPaths), ...await this.restoreGrants(grantStore, grants)];
+			if (recoveryErrors.length > 0) throw new AggregateError([error, ...recoveryErrors], `Service App ${record.id} 删除失败，且恢复未完整完成。`);
+			throw error;
+		}
+		try {
+			await Promise.all(stagedPaths.map(async ({ stagedPath }) => await rm(stagedPath, { recursive: true })));
+		} catch (error) {
+			throw new ServiceAppRemovalCleanupError(error);
+		}
+	};
+	stageSourcePath = async (originalPath, stagedPaths) => {
+		const stagedPath = join(dirname(originalPath), `.deleting-${basename(originalPath)}-${randomUUID()}`);
+		await rename(originalPath, stagedPath);
+		stagedPaths.push({
+			originalPath,
+			stagedPath
+		});
+	};
+	stageInstancePath = async (originalPath, stagedPaths) => {
+		const stagedPath = `${originalPath}.deleting-${randomUUID()}`;
+		await rename(originalPath, stagedPath);
+		stagedPaths.push({
+			originalPath,
+			stagedPath
+		});
+	};
+	listDirectories = async (directory) => {
+		try {
+			return (await readdir(directory, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+		} catch (error) {
+			if (this.isMissingFileError(error)) return [];
+			throw error;
+		}
+	};
+	pathExists = async (targetPath) => {
+		try {
+			await access(targetPath);
+			return true;
+		} catch (error) {
+			if (this.isMissingFileError(error)) return false;
+			throw error;
+		}
+	};
+	isMissingFileError = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+	restoreStagedPaths = async (stagedPaths) => {
+		const errors = [];
+		for (const entry of [...stagedPaths].reverse()) try {
+			await rename(entry.stagedPath, entry.originalPath);
+		} catch (error) {
+			errors.push(error);
+		}
+		return errors;
+	};
+	restoreGrants = async (grantStore, grants) => {
+		const errors = [];
+		for (const grant of grants) try {
+			await grantStore.grant(grant);
+		} catch (error) {
+			errors.push(error);
+		}
+		return errors;
+	};
+};
+function parseServiceAppDeletionTombstone(directoryName) {
+	return CURRENT_DELETION_PATTERN.exec(directoryName)?.groups?.appId ?? LEGACY_DELETION_PATTERN.exec(directoryName)?.groups?.appId;
+}
+//#endregion
 //#region src/stores/service-action-grant.store.ts
 const EMPTY_GRANTS = {
 	version: 1,
@@ -10192,6 +10513,7 @@ function mergeServiceAppRuntimeActions({ record, manifest, runtimeActions }) {
 //#endregion
 //#region src/managers/service-app.manager.ts
 const SERVICE_ACTION_GRANTS_FILE_NAME = ".service-action-grants.json";
+const SERVICE_APP_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var ServiceAppError = class extends Error {
 	constructor(code, message) {
 		super(message);
@@ -10199,12 +10521,12 @@ var ServiceAppError = class extends Error {
 		this.name = "ServiceAppError";
 	}
 };
-function isServiceAppError(error) {
-	return error instanceof ServiceAppError;
-}
+const isServiceAppError = (error) => error instanceof ServiceAppError;
 var ServiceAppManager = class {
+	removalService = new ServiceAppRemovalService();
 	runtimeService;
 	recordService;
+	reconciliationDiagnostics = [];
 	constructor(params) {
 		this.params = params;
 		this.runtimeService = params.runtimeService ?? new McpServiceAppRuntimeService({ getConfig: () => params.configManager.config });
@@ -10213,6 +10535,13 @@ var ServiceAppManager = class {
 			runtimeService: this.runtimeService
 		});
 	}
+	start = async () => {
+		this.reconciliationDiagnostics = await this.removalService.reconcile({
+			grantStore: this.createGrantStore(),
+			lockPathForAppId: (appId) => this.getServiceAppLockPath(this.getWorkspacePath(), appId),
+			serviceAppsPath: this.getServiceAppsPath(this.getWorkspacePath())
+		});
+	};
 	listServiceApps = async () => {
 		const workspacePath = this.getWorkspacePath();
 		const serviceAppsPath = this.getServiceAppsPath(workspacePath);
@@ -10223,6 +10552,7 @@ var ServiceAppManager = class {
 		return {
 			workspacePath,
 			serviceAppsPath,
+			diagnostics: this.reconciliationDiagnostics,
 			entries: [...workspaceEntries, ...packageEntries].filter((entry) => Boolean(entry)).sort((left, right) => left.title.localeCompare(right.title))
 		};
 	};
@@ -10235,7 +10565,7 @@ var ServiceAppManager = class {
 		return await Promise.all(actions.map(async (action) => await this.withGrantState(action, params)));
 	};
 	discoverServiceAppActions = async (appId) => {
-		const { manifest, record } = await this.requireServiceApp(appId);
+		const { manifest, record } = await this.requireServiceApp(appId, true);
 		return mergeServiceAppRuntimeActions({
 			record,
 			manifest,
@@ -10248,7 +10578,7 @@ var ServiceAppManager = class {
 	invokeServiceAction = async (actionId, request) => {
 		this.assertCaller(request.caller);
 		this.assertDeclaredAction(actionId, request.declaredActions);
-		const { manifest, record } = await this.requireServiceAppForAction(actionId);
+		const { manifest, record } = await this.requireServiceAppForAction(actionId, true);
 		const actionName = getServiceActionName(actionId, record.id);
 		if (!Object.hasOwn(manifest.actions, actionName)) throw new ServiceAppError("SERVICE_APP_ACTION_NOT_FOUND", "service action not found");
 		const declaredRisk = manifest.actions[actionName]?.risk ?? "dangerous";
@@ -10300,20 +10630,34 @@ var ServiceAppManager = class {
 		await this.runtimeService.restart(record.id);
 		return await this.getServiceApp(appId);
 	};
-	deleteServiceApp = async (appId) => {
-		const { record } = await this.requireServiceApp(appId);
-		if (record.sourceKind === "package") throw new ServiceAppError("SERVICE_APP_MANAGED_SOURCE", `package service must be managed through Apps: ${record.packageId}`);
-		await this.runtimeService.restart(record.id);
-		await rm(record.dirPath, { recursive: true });
-		await this.createGrantStore().revokeActionsByPrefix(`${record.id}.`);
+	listWorkspaceDataOwners = async () => await this.recordService.listWorkspaceDataOwners(this.getServiceAppsPath(this.getWorkspacePath()), await this.listServiceAppDirNames(this.getServiceAppsPath(this.getWorkspacePath())));
+	deleteServiceApp = async (appId, purgeData = false) => {
+		if (!SERVICE_APP_ID_PATTERN.test(appId)) throw new ServiceAppError("SERVICE_APP_INVALID_MANIFEST", "service app id must use kebab-case");
+		const workspacePath = this.getWorkspacePath();
+		let record;
+		try {
+			record = await this.removalService.remove({
+				grantStore: this.createGrantStore(),
+				lockPath: this.getServiceAppLockPath(workspacePath, appId),
+				purgeData,
+				loadRecord: async () => {
+					const { record } = await this.requireServiceApp(appId);
+					if (record.sourceKind === "package") throw new ServiceAppError("SERVICE_APP_MANAGED_SOURCE", `package service must be managed through Apps: ${record.packageId}`);
+					return record;
+				},
+				stopRuntime: async (loaded) => await this.runtimeService.restart(loaded.id)
+			});
+		} catch (error) {
+			if (error instanceof ServiceAppRemovalCleanupError) throw new ServiceAppError("SERVICE_APP_RUNTIME_FAILED", `Service App ${appId} 已从 workspace 移除，但${error.message}`);
+			throw error;
+		}
 		return {
 			deleted: true,
-			id: record.id
+			id: record.id,
+			dataRemoved: purgeData
 		};
 	};
-	dispose = async () => {
-		await this.runtimeService.dispose();
-	};
+	dispose = async () => await this.runtimeService.dispose();
 	assertCanActivatePackageComponents = async (components) => {
 		const serviceComponents = components.filter((component) => component.kind === "service");
 		if (serviceComponents.length === 0) return;
@@ -10382,12 +10726,12 @@ var ServiceAppManager = class {
 		if (!action) throw new ServiceAppError("SERVICE_APP_ACTION_NOT_FOUND", "service action not found");
 		return action;
 	};
-	requireServiceAppForAction = async (actionId) => {
+	requireServiceAppForAction = async (actionId, materializeStorage = false) => {
 		const appId = actionId.split(".")[0]?.trim();
 		if (!appId) throw new ServiceAppError("SERVICE_APP_INVALID_ACTION", "service action id is invalid");
-		return await this.requireServiceApp(appId);
+		return await this.requireServiceApp(appId, materializeStorage);
 	};
-	requireServiceApp = async (appId) => {
+	requireServiceApp = async (appId, materializeStorage = false) => {
 		let dirPath = join(this.getServiceAppsPath(this.getWorkspacePath()), appId);
 		let packageSource;
 		try {
@@ -10402,9 +10746,10 @@ var ServiceAppManager = class {
 			if (!(await stat(dirPath)).isDirectory()) throw new ServiceAppError("SERVICE_APP_NOT_FOUND", "service app not found");
 			const manifest = await readServiceAppManifest(dirPath);
 			if (manifest.id !== appId) throw new ServiceAppError("SERVICE_APP_INVALID_MANIFEST", "service app manifest id must match directory name");
+			const storage = packageSource?.storage ?? (materializeStorage ? await this.recordService.materializeWorkspaceStorage(manifest.id) : await this.recordService.inspectWorkspaceStorage(manifest.id));
 			return {
 				manifest,
-				record: this.recordService.fromManifest(dirPath, manifest, packageSource, packageSource?.storage ?? await this.recordService.materializeWorkspaceStorage(manifest.id))
+				record: this.recordService.fromManifest(dirPath, manifest, packageSource, storage)
 			};
 		} catch (error) {
 			if (isServiceAppError(error)) throw error;
@@ -10422,7 +10767,7 @@ var ServiceAppManager = class {
 				const manifest = await readServiceAppManifest(dirPath);
 				return {
 					manifest,
-					record: this.recordService.fromManifest(dirPath, manifest, void 0, await this.recordService.materializeWorkspaceStorage(manifest.id))
+					record: this.recordService.fromManifest(dirPath, manifest, void 0, await this.recordService.inspectWorkspaceStorage(manifest.id))
 				};
 			} catch {
 				return null;
@@ -10450,13 +10795,13 @@ var ServiceAppManager = class {
 	normalizeActionIds = (actionIds) => Array.from(new Set(actionIds.map((actionId) => actionId.trim()).filter((actionId) => actionId.length > 0)));
 	getWorkspacePath = () => getWorkspacePathFromConfig(this.params.configManager.config);
 	getServiceAppsPath = (workspacePath) => join(workspacePath, DEFAULT_SERVICE_APPS_DIR);
+	getServiceAppLockPath = (workspacePath, appId) => join(workspacePath, ".nextclaw", "locks", "service-apps", `${appId}.lock`);
 	createGrantStore = () => new ServiceActionGrantStore(join(this.getServiceAppsPath(this.getWorkspacePath()), SERVICE_ACTION_GRANTS_FILE_NAME));
 	listPackageComponentSources = async () => await this.params.listPackageComponentSources?.() ?? [];
 	listServiceAppDirNames = async (serviceAppsPath) => {
 		try {
-			return (await readdir(serviceAppsPath, { withFileTypes: true })).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
+			return await this.removalService.listCanonicalDirectoryNames(serviceAppsPath);
 		} catch (error) {
-			if (this.isMissingFileError(error)) return [];
 			throw new ServiceAppError("SERVICE_APP_READ_FAILED", error instanceof Error ? error.message : String(error));
 		}
 	};
@@ -15515,35 +15860,48 @@ var ToolProviderContribution = class {
 	};
 };
 //#endregion
-//#region src/app/nextclaw-kernel.ts
+//#region src/app/kernel-storage-paths.ts
 function resolveKernelAppHomeDirectory(options) {
 	const homeDir = options.homeDir?.trim();
 	return resolve(homeDir ? expandHome(homeDir) : getDataDir(), "apps");
 }
 function resolveKernelSessionsDir(options) {
 	const homeDir = options.homeDir?.trim();
-	if (homeDir) return ensureDir(resolve(expandHome(homeDir), "sessions"));
-	return getSessionsPath();
+	return homeDir ? ensureDir(resolve(expandHome(homeDir), "sessions")) : getSessionsPath();
 }
 function resolveKernelAutomationStorePath(options) {
-	const homeDir = options.homeDir?.trim();
-	if (homeDir) return resolve(expandHome(homeDir), "cron", "jobs.json");
-	return resolve(getDataDir(), "cron", "jobs.json");
+	return resolveKernelDataPath(options, "cron", "jobs.json");
 }
 function resolveKernelPreferenceStorePath(options) {
-	const homeDir = options.homeDir?.trim();
-	if (homeDir) return resolve(expandHome(homeDir), "preferences", "preferences.json");
-	return resolve(getDataDir(), "preferences", "preferences.json");
+	return resolveKernelDataPath(options, "preferences", "preferences.json");
 }
 function resolveKernelProjectStorePath(options) {
-	const homeDir = options.homeDir?.trim();
-	if (homeDir) return resolve(expandHome(homeDir), "projects", "projects.json");
-	return resolve(getDataDir(), "projects", "projects.json");
+	return resolveKernelDataPath(options, "projects", "projects.json");
 }
 function resolveKernelInboxDeliveryStorePath(options) {
+	return resolveKernelDataPath(options, "inbox", "deliveries.json");
+}
+function resolveKernelDataPath(options, ...segments) {
 	const homeDir = options.homeDir?.trim();
-	if (homeDir) return resolve(expandHome(homeDir), "inbox", "deliveries.json");
-	return resolve(getDataDir(), "inbox", "deliveries.json");
+	return resolve(homeDir ? expandHome(homeDir) : getDataDir(), ...segments);
+}
+//#endregion
+//#region src/app/nextclaw-kernel.ts
+function createKernelServiceAppManagers(params) {
+	const { appHomeDirectory, appPackageManager, configManager } = params;
+	const serviceAppManager = new ServiceAppManager({
+		configManager,
+		listPackageComponentSources: appPackageManager.listActiveComponentSources
+	});
+	return {
+		serviceAppManager,
+		appDataManager: new AppDataManager({
+			appHomeDirectory,
+			getWorkspacePath: () => getWorkspacePathFromConfig(configManager.config),
+			listInstalledPackageOwners: appPackageManager.listInstalledDataOwners,
+			listWorkspaceDataOwners: serviceAppManager.listWorkspaceDataOwners
+		})
+	};
 }
 var NextclawKernelControlManager = class {
 	runtimeControl = null;
@@ -15569,6 +15927,7 @@ var NextclawKernel = class {
 	skills;
 	automation;
 	appPackageManager;
+	appDataManager;
 	channels;
 	sessionRequests;
 	sessionSearch;
@@ -15646,10 +16005,11 @@ var NextclawKernel = class {
 			listPackageComponentSources: this.appPackageManager.listActiveComponentSources
 		});
 		this.preferenceManager = new PreferenceManager({ storePath: resolveKernelPreferenceStorePath(options) });
-		this.serviceAppManager = new ServiceAppManager({
-			configManager: this.configManager,
-			listPackageComponentSources: this.appPackageManager.listActiveComponentSources
-		});
+		({appDataManager: this.appDataManager, serviceAppManager: this.serviceAppManager} = createKernelServiceAppManagers({
+			appHomeDirectory: resolveKernelAppHomeDirectory(options),
+			appPackageManager: this.appPackageManager,
+			configManager: this.configManager
+		}));
 		this.installAppPackageRuntimeHooks();
 		this.extensions = new ExtensionManager({
 			configManager: this.configManager,
@@ -15713,6 +16073,9 @@ var NextclawKernel = class {
 	};
 	getGatewayController = () => this.gatewayController;
 	start = async () => {
+		await this.appPackageManager.start();
+		await this.appDataManager.start();
+		await this.serviceAppManager.start();
 		this.sessionSearch.start();
 		this.mcpManager.start();
 		this.providerModelCatalog.start();
@@ -16306,6 +16669,6 @@ function resolveLegacyEventType(message) {
 	return `message.${role || "other"}`;
 }
 //#endregion
-export { AUTOMATIC_UPDATE_CHECK_INTERVAL_MS, AccessManager, AgentManager, AgentRunClient, AppPackageError, AppPackageManager, AutomationManager, BuiltinNarpRuntimeProviderService, CONTEXT_COMPACTION_CONTINUATION_TEXT, CONTEXT_COMPACTION_PROJECTION_KIND, CONTEXT_COMPACTION_PROJECTION_METADATA_KEY, CONTEXT_COMPACTION_SYSTEM_PREAMBLE, CONTEXT_COMPACTION_TIMELINE_KIND, ChannelManager, CommandRegistry, ConfigManager, ContextCompactionJournalRecoveryService, ContextCompactionPreflightService, DEFAULT_AGENT_RUNTIME_ENTRY_ID, DEFAULT_SERVICE_ACTION_RISK, ExtensionManager, GatewayInboundProcessor, InboxDeliveryError, InboxDeliveryManager, LlmProviderManager, LlmUsageManager, LlmUsageStore, MAX_INBOX_DELIVERY_CONTENT_LENGTH, McpManager, McpServiceAppRuntimeService, NARP_HTTP_RUNTIME_KIND, NARP_STDIO_RUNTIME_KIND, NEXTCLAW_TIMELINE_KIND_METADATA_KEY, NcpAgentSessionJournalStore, NextclawKernel, PANEL_APP_AGENT_CAPABILITIES, PROJECT_TEMPLATE_IDS, PROVIDER_MODEL_CATALOG_REFRESH_INTERVAL_MS, PanelAppAssetTokenService, PanelAppError, PanelAppManager, PreferenceError, PreferenceManager, ProjectError, ProjectManager, ProviderManagerNcpLLMApi, ProviderModelCatalogManager, SERVICE_APP_MANIFEST_FILE_NAME, ServiceAppError, ServiceAppManager, SessionContextCompactionError, SessionContextCompactionManager, SessionManager, SessionMessageCursorError, SessionRequestManager, SessionSettingsError, SkillManager, SystemObjectReferenceError, SystemObjectReferenceManager, UpdateManifestReader, buildAgentRunSendPayload, buildContextCompactionModelProjection, buildContextCompactionTimelineNcpMessage, buildLlmUsageSummary, buildLocalizedTextMap, buildNextclawNcpRunContext, buildServiceActionId, createAgentRuntimeSessionRequestDispatcher, createAssetTools, createContextCompactionMessageId, createContextWindowSignature, createCronJobSystemObjectProvider, createInboxDeliverySystemObjectProvider, createLlmUsageRecord, describeAgentRuntimeSessionTypes, dispatchAgentRuntimeSessionRequest, dispatchChannelReplyRoute, dispatchPromptOverNcp, getAutomaticUpdateCheckDelay, getServiceActionName, getServiceAppManifestPath, getUiContentParamsBootstrapScript, getUnsignedUpdateManifest, hasLlmUsageTelemetry, injectUiContentParamsBootstrap, isAppPackageError, isContextCompactionProjectionMessage, isContextCompactionTimelineMessage, isContextWindowSnapshot, isInboxDeliveryError, isPanelAppAgentCapability, isPanelAppError, isPreferenceError, isProjectError, isReplyCapableChannel, isServiceAppError, isSessionContextCompactionError, isSessionMessageCursorError, isSessionSettingsError, isSystemObjectReferenceError, listExtensionChannelIds, listServiceAppManifestActions, mergeServiceAppRuntimeActions, normalizeAgentRuntimeSessionTypeIcon, normalizeLlmUsageModel, normalizeOptionalString, parseServiceAppManifest, parseSkillFrontmatter, readContextCompactionCheckpoint, readContextWindowEventSessionId, readLatestContextCompactionCheckpoint, readLearningLoopRuntimeConfig, readMetadataModel, readMetadataThinking, readServiceAppManifest, resolveAgentRuntimeEntries, resolveAutomaticUpdateCheckIntervalMs, resolveChannelReplyRoute, resolveEffectiveModel, resolveLegacyEventType, resolveSessionChannelContext, runGatewayInboundLoop, sanitizeLlmUsage, serializeUnsignedUpdateManifest, shouldRefreshContextWindowDuringStream, shouldRefreshContextWindowImmediately, stripSkillFrontmatter, syncSessionThinkingPreference, toNcpMessages, waitForAgentRuntimeSessionReply };
+export { AUTOMATIC_UPDATE_CHECK_INTERVAL_MS, AccessManager, AgentManager, AgentRunClient, AppDataError, AppDataManager, AppPackageError, AppPackageManager, AutomationManager, BuiltinNarpRuntimeProviderService, CONTEXT_COMPACTION_CONTINUATION_TEXT, CONTEXT_COMPACTION_PROJECTION_KIND, CONTEXT_COMPACTION_PROJECTION_METADATA_KEY, CONTEXT_COMPACTION_SYSTEM_PREAMBLE, CONTEXT_COMPACTION_TIMELINE_KIND, ChannelManager, CommandRegistry, ConfigManager, ContextCompactionJournalRecoveryService, ContextCompactionPreflightService, DEFAULT_AGENT_RUNTIME_ENTRY_ID, DEFAULT_SERVICE_ACTION_RISK, ExtensionManager, GatewayInboundProcessor, InboxDeliveryError, InboxDeliveryManager, LlmProviderManager, LlmUsageManager, LlmUsageStore, MAX_INBOX_DELIVERY_CONTENT_LENGTH, McpManager, McpServiceAppRuntimeService, NARP_HTTP_RUNTIME_KIND, NARP_STDIO_RUNTIME_KIND, NEXTCLAW_TIMELINE_KIND_METADATA_KEY, NcpAgentSessionJournalStore, NextclawKernel, PANEL_APP_AGENT_CAPABILITIES, PROJECT_TEMPLATE_IDS, PROVIDER_MODEL_CATALOG_REFRESH_INTERVAL_MS, PanelAppAssetTokenService, PanelAppError, PanelAppManager, PreferenceError, PreferenceManager, ProjectError, ProjectManager, ProviderManagerNcpLLMApi, ProviderModelCatalogManager, SERVICE_APP_MANIFEST_FILE_NAME, ServiceAppError, ServiceAppManager, SessionContextCompactionError, SessionContextCompactionManager, SessionManager, SessionMessageCursorError, SessionRequestManager, SessionSettingsError, SkillManager, SystemObjectReferenceError, SystemObjectReferenceManager, UpdateManifestReader, buildAgentRunSendPayload, buildContextCompactionModelProjection, buildContextCompactionTimelineNcpMessage, buildLlmUsageSummary, buildLocalizedTextMap, buildNextclawNcpRunContext, buildServiceActionId, createAgentRuntimeSessionRequestDispatcher, createAssetTools, createContextCompactionMessageId, createContextWindowSignature, createCronJobSystemObjectProvider, createInboxDeliverySystemObjectProvider, createLlmUsageRecord, describeAgentRuntimeSessionTypes, dispatchAgentRuntimeSessionRequest, dispatchChannelReplyRoute, dispatchPromptOverNcp, getAutomaticUpdateCheckDelay, getServiceActionName, getServiceAppManifestPath, getUiContentParamsBootstrapScript, getUnsignedUpdateManifest, hasLlmUsageTelemetry, injectUiContentParamsBootstrap, isAppDataError, isAppPackageError, isContextCompactionProjectionMessage, isContextCompactionTimelineMessage, isContextWindowSnapshot, isInboxDeliveryError, isPanelAppAgentCapability, isPanelAppError, isPreferenceError, isProjectError, isReplyCapableChannel, isServiceAppError, isSessionContextCompactionError, isSessionMessageCursorError, isSessionSettingsError, isSystemObjectReferenceError, listExtensionChannelIds, listServiceAppManifestActions, mergeServiceAppRuntimeActions, normalizeAgentRuntimeSessionTypeIcon, normalizeLlmUsageModel, normalizeOptionalString, parseServiceAppManifest, parseSkillFrontmatter, readContextCompactionCheckpoint, readContextWindowEventSessionId, readLatestContextCompactionCheckpoint, readLearningLoopRuntimeConfig, readMetadataModel, readMetadataThinking, readServiceAppManifest, resolveAgentRuntimeEntries, resolveAutomaticUpdateCheckIntervalMs, resolveChannelReplyRoute, resolveEffectiveModel, resolveLegacyEventType, resolveSessionChannelContext, runGatewayInboundLoop, sanitizeLlmUsage, serializeUnsignedUpdateManifest, shouldRefreshContextWindowDuringStream, shouldRefreshContextWindowImmediately, stripSkillFrontmatter, syncSessionThinkingPreference, toNcpMessages, waitForAgentRuntimeSessionReply };
 
 //# sourceMappingURL=index.js.map