@nextclaw/server 0.15.23 → 0.15.25

package/dist/index.js

@@ -1,10 +1,10 @@
 import { Hono } from "hono";
 import { compress } from "hono/compress";
 import { serve } from "@hono/node-server";
-import { AccessManager, PanelAppError, injectUiContentParamsBootstrap, isInboxDeliveryError, isPanelAppError, isPreferenceError, isProjectError, isServiceAppError, isSessionContextCompactionError, isSessionMessageCursorError, isSessionSettingsError } from "@nextclaw/kernel";
+import { AccessManager, PanelAppError, injectUiContentParamsBootstrap, isAppPackageError, isInboxDeliveryError, isPanelAppError, isPreferenceError, isProjectError, isServiceAppError, isSessionContextCompactionError, isSessionMessageCursorError, isSessionSettingsError, isSystemObjectReferenceError } from "@nextclaw/kernel";
 import { WebSocket, WebSocketServer } from "ws";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { mkdir, open, readFile, readdir, realpath, stat } from "node:fs/promises";
+import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as NextclawCore from "@nextclaw/core";
@@ -702,6 +702,118 @@ var AppRoutesController = class {
 	extensionRuntimeStatus = (c) => c.json(ok(this.options.extensions?.getRuntimeStatus?.() ?? []));
 };
 //#endregion
+//#region src/features/app-packages/controllers/app-packages.controller.ts
+var AppPackagesRoutesController = class {
+	constructor(manager) {
+		this.manager = manager;
+	}
+	list = async (c) => c.json(ok(await this.manager.listPackages()));
+	get = async (c) => {
+		try {
+			return c.json(ok(await this.manager.getPackage(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	install = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || !isRecord$2(body.data) || typeof body.data.source !== "string") return c.json(err("INVALID_APP_PACKAGE_INSTALL", "source is required"), 400);
+		try {
+			return c.json(ok(await this.manager.install(body.data.source, typeof body.data.registryUrl === "string" ? body.data.registryUrl : void 0)));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	enable = async (c) => {
+		try {
+			return c.json(ok(await this.manager.enable(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	disable = async (c) => {
+		try {
+			return c.json(ok(await this.manager.disable(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	update = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_APP_PACKAGE_UPDATE", "invalid update request"), 400);
+		try {
+			return c.json(ok(await this.manager.update(c.req.param("appId"), {
+				version: typeof body.data.version === "string" ? body.data.version : void 0,
+				registryUrl: typeof body.data.registryUrl === "string" ? body.data.registryUrl : void 0
+			})));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	rollback = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || !isRecord$2(body.data) || typeof body.data.version !== "string") return c.json(err("INVALID_APP_PACKAGE_ROLLBACK", "version is required"), 400);
+		try {
+			return c.json(ok(await this.manager.rollback(c.req.param("appId"), body.data.version)));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	uninstall = async (c) => {
+		const body = await readJson(c.req.raw);
+		const purgeData = body.ok && isRecord$2(body.data) && body.data.purgeData === true;
+		try {
+			return c.json(ok(await this.manager.uninstall(c.req.param("appId"), purgeData)));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	handleError = (c, error) => {
+		if (isAppPackageError(error)) {
+			const status = error.code === "APP_PACKAGE_NOT_FOUND" ? 404 : error.code === "APP_PACKAGE_CONFLICT" ? 409 : 400;
+			return c.json(err(error.code, error.message), status);
+		}
+		return c.json(err("APP_PACKAGE_OPERATION_FAILED", error instanceof Error ? error.message : String(error)), 400);
+	};
+};
+//#endregion
+//#region src/app/controllers/system-object-references.controller.ts
+function readLimit(value) {
+	if (value === void 0) return void 0;
+	const limit = Number(value);
+	return Number.isSafeInteger(limit) && limit >= 1 && limit <= 50 ? limit : null;
+}
+var SystemObjectReferencesRoutesController = class {
+	constructor(manager) {
+		this.manager = manager;
+	}
+	list = async (c) => {
+		const limit = readLimit(c.req.query("limit"));
+		if (limit === null) return c.json(err("INVALID_SYSTEM_OBJECT_QUERY", `limit must be between 1 and 50`), 400);
+		try {
+			return c.json(ok(await this.manager.listReferences({
+				query: c.req.query("query"),
+				limit,
+				objectType: c.req.query("objectType")
+			})));
+		} catch (error) {
+			if (!isSystemObjectReferenceError(error)) throw error;
+			return c.json(err(error.code, error.message), 400);
+		}
+	};
+	resolve = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || !isRecord$2(body.data) || typeof body.data.uri !== "string" || !body.data.uri.trim()) return c.json(err("INVALID_SYSTEM_OBJECT_REFERENCE", "uri must be a non-empty string"), 400);
+		try {
+			return c.json(ok(await this.manager.resolveReference(body.data.uri)));
+		} catch (error) {
+			if (!isSystemObjectReferenceError(error)) throw error;
+			const status = error.code === "SYSTEM_OBJECT_NOT_FOUND" ? 404 : 400;
+			return c.json(err(error.code, error.message), status);
+		}
+	};
+};
+//#endregion
 //#region src/features/config/providers/server-builtin-provider.provider.ts
 const SERVER_BUILTIN_PROVIDER_OVERRIDES = [{
 	name: "minimax-portal",
@@ -3081,7 +3193,6 @@ var InboxDeliveriesRoutesController = class {
 			deliveryId
 		}));
 	};
-	continueInChat = async (c) => await this.handleManagerAction(c, () => this.manager.continueInChat(c.req.param("deliveryId")));
 	handleManagerAction = async (c, action) => {
 		try {
 			return c.json(ok(await action()));
@@ -3734,6 +3845,17 @@ function findUnsupportedSkillInstallKind(items) {
 }
 //#endregion
 //#region src/features/marketplace/controllers/skill-marketplace.controller.ts
+const MARKETPLACE_SKILL_LOCAL_CHANGES_ERROR_CODE = "MARKETPLACE_SKILL_LOCAL_CHANGES";
+function readStructuredError(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	if (!error || typeof error !== "object") return { message };
+	const value = error;
+	return {
+		message,
+		code: typeof value.code === "string" ? value.code : void 0,
+		details: value.details && typeof value.details === "object" && !Array.isArray(value.details) ? value.details : void 0
+	};
+}
 async function installMarketplaceSkill(params) {
 	const { body, options } = params;
 	const spec = typeof body.spec === "string" ? body.spec.trim() : "";
@@ -3903,9 +4025,11 @@ var SkillMarketplaceController = class {
 			});
 			return c.json(ok(payload));
 		} catch (error) {
-			const message = String(error);
+			const structuredError = readStructuredError(error);
+			const message = structuredError.message;
 			if (message.startsWith("INVALID_BODY:")) return c.json(err("INVALID_BODY", message.slice(13)), 400);
 			if (message.startsWith("NOT_AVAILABLE:")) return c.json(err("NOT_AVAILABLE", message.slice(14)), 503);
+			if (structuredError.code === MARKETPLACE_SKILL_LOCAL_CHANGES_ERROR_CODE) return c.json(err(MARKETPLACE_SKILL_LOCAL_CHANGES_ERROR_CODE, message, structuredError.details), 409);
 			return c.json(err("MANAGE_FAILED", message), 400);
 		}
 	};
@@ -4839,6 +4963,8 @@ var ServiceAppsRoutesController = class {
 };
 //#endregion
 //#region src/app/utils/ncp-session-event-stream.utils.ts
+const NCP_SESSION_STREAM_HEARTBEAT_INTERVAL_MS = 25e3;
+const NCP_SESSION_STREAM_HEARTBEAT_FRAME = ": keepalive\n\n";
 function readEventSessionId(event) {
 	const payload = "payload" in event ? event.payload : null;
 	if (!payload || typeof payload !== "object") return null;
@@ -4852,8 +4978,13 @@ function createNcpSessionEventStreamResponse(eventBus, payload, signal) {
 	let controller = null;
 	let closed = false;
 	let unsubscribe = () => void 0;
+	let heartbeat = null;
 	const cleanup = () => {
 		unsubscribe();
+		if (heartbeat) {
+			clearInterval(heartbeat);
+			heartbeat = null;
+		}
 		signal.removeEventListener("abort", close);
 	};
 	const close = () => {
@@ -4870,6 +5001,9 @@ function createNcpSessionEventStreamResponse(eventBus, payload, signal) {
 		start: (streamController) => {
 			controller = streamController;
 			unsubscribe = eventBus.on(eventKeys.ncpEvent, push);
+			heartbeat = setInterval(() => {
+				if (!closed && !signal.aborted) controller?.enqueue(encoder.encode(NCP_SESSION_STREAM_HEARTBEAT_FRAME));
+			}, NCP_SESSION_STREAM_HEARTBEAT_INTERVAL_MS);
 			signal.addEventListener("abort", close, { once: true });
 			if (signal.aborted) close();
 		},
@@ -5079,6 +5213,28 @@ function isServerPathBrowseError(error) {
 	return error instanceof ServerPathBrowseError;
 }
 //#endregion
+//#region src/features/server-path/utils/server-path-search.utils.ts
+function isServerPathInside(basePath, candidatePath) {
+	const relativePath = relative(basePath, candidatePath);
+	return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
+}
+function normalizeServerPathRelativePath(value) {
+	return value.split(sep).join("/");
+}
+function resolveServerPathSearchScore(entry, query) {
+	if (!query) return 1;
+	const normalizedQuery = query.toLocaleLowerCase();
+	const normalizedName = entry.name.toLocaleLowerCase();
+	const normalizedPath = entry.relativePath.toLocaleLowerCase();
+	if (!normalizedQuery.split(/\s+/).filter(Boolean).every((term) => normalizedPath.includes(term))) return 0;
+	if (normalizedName === normalizedQuery) return 1e3;
+	if (normalizedName.startsWith(normalizedQuery)) return 850;
+	if (normalizedName.includes(normalizedQuery)) return 700;
+	if (normalizedPath.startsWith(normalizedQuery)) return 600;
+	if (normalizedPath.split("/").some((segment) => segment.startsWith(normalizedQuery))) return 550;
+	return 400 - Math.min(normalizedPath.length, 300);
+}
+//#endregion
 //#region src/features/server-path/utils/server-path-directory.utils.ts
 var ServerPathDirectoryCreateError = class extends Error {
 	constructor(code, message) {
@@ -5092,28 +5248,46 @@ function normalizeDirectoryName(value) {
 	if (!name || name === "." || name === ".." || name.includes("/") || name.includes("\\")) throw new ServerPathDirectoryCreateError("SERVER_PATH_DIRECTORY_NAME_INVALID", "directory name is invalid");
 	return name;
 }
-function readFileErrorCode(error) {
+function readFileErrorCode$1(error) {
 	return typeof error === "object" && error !== null && "code" in error ? String(error.code ?? "") : void 0;
 }
-async function createServerPathDirectory(input) {
-	let parentPath;
+function resolveDirectoryPath(value) {
 	try {
-		parentPath = resolveServerPath({ path: typeof input.parentPath === "string" ? input.parentPath : null });
+		return resolveServerPath({ path: typeof value === "string" ? value : null });
 	} catch (error) {
 		if (error instanceof ServerPathResolutionError) throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_INVALID", error.message);
 		throw error;
 	}
+}
+async function assertParentInsideBase(baseValue, parentPath) {
+	if (typeof baseValue !== "string" || !baseValue.trim()) return;
+	const basePath = resolveDirectoryPath(baseValue);
+	if (!isServerPathInside(basePath, parentPath)) throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_INVALID", "parent path must stay inside the project root");
+	try {
+		const [realBasePath, realParentPath] = await Promise.all([realpath(basePath), realpath(parentPath)]);
+		if (!isServerPathInside(realBasePath, realParentPath)) throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_INVALID", "parent path must stay inside the project root");
+	} catch (error) {
+		if (error instanceof ServerPathDirectoryCreateError) throw error;
+		throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_INVALID", "project root and parent path must exist");
+	}
+}
+function throwDirectoryCreationError(error) {
+	const code = readFileErrorCode$1(error);
+	if (code === "EEXIST") throw new ServerPathDirectoryCreateError("SERVER_PATH_DIRECTORY_EXISTS", "directory already exists");
+	if (code === "ENOENT") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_FOUND", "parent directory does not exist");
+	if (code === "ENOTDIR") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_DIRECTORY", "parent path must point to a directory");
+	if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_WRITABLE", "parent directory is not writable");
+	throw error;
+}
+async function createServerPathDirectory(input) {
+	const parentPath = resolveDirectoryPath(input.parentPath);
+	await assertParentInsideBase(input.basePath, parentPath);
 	const directoryPath = join(parentPath, normalizeDirectoryName(input.name));
 	try {
 		await mkdir(directoryPath);
 		return { path: directoryPath };
 	} catch (error) {
-		const code = readFileErrorCode(error);
-		if (code === "EEXIST") throw new ServerPathDirectoryCreateError("SERVER_PATH_DIRECTORY_EXISTS", "directory already exists");
-		if (code === "ENOENT") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_FOUND", "parent directory does not exist");
-		if (code === "ENOTDIR") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_DIRECTORY", "parent path must point to a directory");
-		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_WRITABLE", "parent directory is not writable");
-		throw error;
+		throwDirectoryCreationError(error);
 	}
 }
 function isServerPathDirectoryCreateError(error) {
@@ -5405,28 +5579,6 @@ function isServerPathContentError(error) {
 	return error instanceof ServerPathContentError;
 }
 //#endregion
-//#region src/features/server-path/utils/server-path-search.utils.ts
-function isServerPathInside(basePath, candidatePath) {
-	const relativePath = relative(basePath, candidatePath);
-	return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
-}
-function normalizeServerPathRelativePath(value) {
-	return value.split(sep).join("/");
-}
-function resolveServerPathSearchScore(entry, query) {
-	if (!query) return 1;
-	const normalizedQuery = query.toLocaleLowerCase();
-	const normalizedName = entry.name.toLocaleLowerCase();
-	const normalizedPath = entry.relativePath.toLocaleLowerCase();
-	if (!normalizedQuery.split(/\s+/).filter(Boolean).every((term) => normalizedPath.includes(term))) return 0;
-	if (normalizedName === normalizedQuery) return 1e3;
-	if (normalizedName.startsWith(normalizedQuery)) return 850;
-	if (normalizedName.includes(normalizedQuery)) return 700;
-	if (normalizedPath.startsWith(normalizedQuery)) return 600;
-	if (normalizedPath.split("/").some((segment) => segment.startsWith(normalizedQuery))) return 550;
-	return 400 - Math.min(normalizedPath.length, 300);
-}
-//#endregion
 //#region src/features/server-path/services/server-path-search.service.ts
 const DEFAULT_RESULT_LIMIT = 50;
 const MAX_RESULT_LIMIT = 100;
@@ -5614,6 +5766,199 @@ function isServerPathSearchError(error) {
 	return error instanceof ServerPathSearchError;
 }
 //#endregion
+//#region src/features/server-path/utils/server-path-mutation.utils.ts
+var ServerPathMutationError = class extends Error {
+	constructor(code, message, details) {
+		super(message);
+		this.code = code;
+		this.details = details;
+		this.name = "ServerPathMutationError";
+	}
+};
+function readFileErrorCode(error) {
+	return typeof error === "object" && error !== null && "code" in error ? String(error.code ?? "") : void 0;
+}
+function resolveScopedPaths(input) {
+	let basePath;
+	let targetPath;
+	try {
+		basePath = resolveServerPath({ path: typeof input.basePath === "string" ? input.basePath : null });
+		targetPath = resolveServerPath({
+			path: typeof input.targetPath === "string" ? input.targetPath : null,
+			basePath
+		});
+	} catch (error) {
+		if (error instanceof ServerPathResolutionError) throw new ServerPathMutationError("SERVER_PATH_BASE_INVALID", error.message);
+		throw error;
+	}
+	if (!isServerPathInside(basePath, targetPath)) throw new ServerPathMutationError("SERVER_PATH_OUTSIDE_BASE", "target path must stay inside the project root");
+	if (!input.allowRoot && targetPath === basePath) throw new ServerPathMutationError("SERVER_PATH_ROOT_PROTECTED", "the project root cannot be deleted");
+	return {
+		basePath,
+		targetPath
+	};
+}
+async function resolveRealBasePath(basePath) {
+	try {
+		const resolved = await realpath(basePath);
+		if (!(await stat(resolved)).isDirectory()) throw new ServerPathMutationError("SERVER_PATH_BASE_INVALID", "project root must point to a directory");
+		return resolved;
+	} catch (error) {
+		if (error instanceof ServerPathMutationError) throw error;
+		throw new ServerPathMutationError("SERVER_PATH_BASE_INVALID", "project root does not exist or is not accessible");
+	}
+}
+async function assertExistingPathInsideRealBase(params) {
+	const [realBasePath, realTargetPath] = await Promise.all([resolveRealBasePath(params.basePath), realpath(params.targetPath).catch(() => null)]);
+	if (!realTargetPath) throw new ServerPathMutationError("SERVER_PATH_ENTRY_NOT_FOUND", "target path does not exist");
+	if (!isServerPathInside(realBasePath, realTargetPath)) throw new ServerPathMutationError("SERVER_PATH_OUTSIDE_BASE", "target path must stay inside the project root");
+}
+function normalizeEntryName(value) {
+	const name = typeof value === "string" ? value.trim() : "";
+	if (!name || name === "." || name === ".." || name.includes("/") || name.includes("\\") || name.includes("\0") || basename(name) !== name) throw new ServerPathMutationError("SERVER_PATH_FILE_NAME_INVALID", "entry name is invalid");
+	return name;
+}
+async function createServerPathFile(input) {
+	const { basePath, targetPath: parentPath } = resolveScopedPaths({
+		basePath: input.basePath,
+		targetPath: input.parentPath,
+		allowRoot: true
+	});
+	await assertExistingPathInsideRealBase({
+		basePath,
+		targetPath: parentPath
+	});
+	if (!(await stat(parentPath).catch(() => null))?.isDirectory()) throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_DIRECTORY", "file parent must point to a directory");
+	const name = normalizeEntryName(input.name);
+	const path = join(parentPath, name);
+	try {
+		await writeFile(path, "", { flag: "wx" });
+	} catch (error) {
+		const code = readFileErrorCode(error);
+		if (code === "EEXIST") throw new ServerPathMutationError("SERVER_PATH_FILE_EXISTS", "target file already exists");
+		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_WRITABLE", "file parent is not writable");
+		throw error;
+	}
+	return {
+		name,
+		path,
+		kind: "file"
+	};
+}
+async function renameServerPathEntry(input) {
+	const { basePath, targetPath } = resolveScopedPaths({
+		basePath: input.basePath,
+		targetPath: input.path
+	});
+	await assertExistingPathInsideRealBase({
+		basePath,
+		targetPath
+	});
+	const entryStats = await lstat(targetPath).catch(() => null);
+	if (!entryStats) throw new ServerPathMutationError("SERVER_PATH_ENTRY_NOT_FOUND", "target path does not exist");
+	const name = normalizeEntryName(input.name);
+	const path = join(resolve(targetPath, ".."), name);
+	if (!isServerPathInside(basePath, path)) throw new ServerPathMutationError("SERVER_PATH_OUTSIDE_BASE", "target path must stay inside the project root");
+	if (await lstat(path).then(() => true).catch(() => false)) throw new ServerPathMutationError("SERVER_PATH_FILE_EXISTS", "target entry already exists");
+	try {
+		await rename(targetPath, path);
+	} catch (error) {
+		const code = readFileErrorCode(error);
+		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_WRITABLE", "target path is not writable");
+		throw error;
+	}
+	return {
+		oldPath: targetPath,
+		path,
+		name,
+		kind: entryStats.isDirectory() ? "directory" : "file"
+	};
+}
+async function deleteServerPathEntry(input) {
+	const { basePath, targetPath } = resolveScopedPaths({
+		basePath: input.basePath,
+		targetPath: input.path
+	});
+	await assertExistingPathInsideRealBase({
+		basePath,
+		targetPath
+	});
+	let entryStats;
+	try {
+		entryStats = await lstat(targetPath);
+	} catch {
+		throw new ServerPathMutationError("SERVER_PATH_ENTRY_NOT_FOUND", "target path does not exist");
+	}
+	const kind = entryStats.isDirectory() ? "directory" : "file";
+	try {
+		await rm(targetPath, {
+			recursive: kind === "directory",
+			force: false
+		});
+	} catch (error) {
+		const code = readFileErrorCode(error);
+		if (code === "ENOENT") throw new ServerPathMutationError("SERVER_PATH_ENTRY_NOT_FOUND", "target path does not exist");
+		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_WRITABLE", "target path is not writable");
+		throw error;
+	}
+	return {
+		path: targetPath,
+		kind
+	};
+}
+async function uploadServerPathFiles(input) {
+	const { basePath, targetPath } = resolveScopedPaths({
+		basePath: input.basePath,
+		targetPath: input.targetPath,
+		allowRoot: true
+	});
+	await assertExistingPathInsideRealBase({
+		basePath,
+		targetPath
+	});
+	if (!(await stat(targetPath).catch(() => null))?.isDirectory()) throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_DIRECTORY", "upload target must point to a directory");
+	if (input.files.length === 0) throw new ServerPathMutationError("SERVER_PATH_ENTRY_INVALID", "at least one upload file is required");
+	const normalizedFiles = input.files.map((file) => ({
+		file,
+		name: normalizeEntryName(file.name)
+	}));
+	const uniqueNames = /* @__PURE__ */ new Set();
+	for (const { name } of normalizedFiles) {
+		if (uniqueNames.has(name)) throw new ServerPathMutationError("SERVER_PATH_FILE_NAME_INVALID", "upload file names must be unique");
+		uniqueNames.add(name);
+	}
+	if (!input.overwrite) {
+		const conflicts = (await Promise.all(normalizedFiles.map(async ({ name }) => {
+			return await lstat(join(targetPath, name)).then(() => true).catch(() => false) ? name : null;
+		}))).filter((name) => Boolean(name));
+		if (conflicts.length > 0) throw new ServerPathMutationError("SERVER_PATH_FILE_EXISTS", "one or more upload files already exist", { conflicts });
+	}
+	try {
+		return {
+			files: await Promise.all(normalizedFiles.map(async ({ file, name }) => {
+				const path = resolve(targetPath, name);
+				const content = Buffer.from(await file.arrayBuffer());
+				await writeFile(path, content, { flag: input.overwrite ? "w" : "wx" });
+				return {
+					name,
+					path,
+					sizeBytes: content.byteLength
+				};
+			})),
+			overwritten: input.overwrite
+		};
+	} catch (error) {
+		const code = readFileErrorCode(error);
+		if (code === "EEXIST") throw new ServerPathMutationError("SERVER_PATH_FILE_EXISTS", "one or more upload files already exist");
+		if (code === "ENOENT" || code === "ENOTDIR") throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_DIRECTORY", "upload target must point to an existing directory");
+		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_WRITABLE", "upload target is not writable");
+		throw error;
+	}
+}
+function isServerPathMutationError(error) {
+	return error instanceof ServerPathMutationError;
+}
+//#endregion
 //#region src/features/server-path/controllers/server-path.controller.ts
 function readIncludeFilesFlag(value) {
 	return value === "1" || value === "true";
@@ -5661,6 +6006,7 @@ var ServerPathRoutesController = class {
 		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_SERVER_PATH_DIRECTORY", "directory input is required"), 400);
 		try {
 			return c.json(ok(await createServerPathDirectory({
+				basePath: body.data.basePath,
 				parentPath: body.data.parentPath,
 				name: body.data.name
 			})), 201);
@@ -5669,6 +6015,68 @@ var ServerPathRoutesController = class {
 			throw error;
 		}
 	};
+	uploadFiles = async (c) => {
+		let formData;
+		try {
+			formData = await c.req.raw.formData();
+		} catch {
+			return c.json(err("INVALID_SERVER_PATH_UPLOAD", "multipart upload is required"), 400);
+		}
+		const files = formData.getAll("files").flatMap((value) => typeof value === "string" ? [] : [{
+			name: value.name,
+			arrayBuffer: () => value.arrayBuffer()
+		}]);
+		try {
+			return c.json(ok(await uploadServerPathFiles({
+				basePath: formData.get("basePath"),
+				targetPath: formData.get("targetPath"),
+				overwrite: formData.get("overwrite") === "true",
+				files
+			})), 201);
+		} catch (error) {
+			if (isServerPathMutationError(error)) return c.json(err(error.code, error.message, error.details), error.code === "SERVER_PATH_FILE_EXISTS" ? 409 : 400);
+			throw error;
+		}
+	};
+	createFile = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_SERVER_PATH_FILE", "file input is required"), 400);
+		try {
+			return c.json(ok(await createServerPathFile({
+				basePath: body.data.basePath,
+				parentPath: body.data.parentPath,
+				name: body.data.name
+			})), 201);
+		} catch (error) {
+			if (isServerPathMutationError(error)) return c.json(err(error.code, error.message, error.details), error.code === "SERVER_PATH_FILE_EXISTS" ? 409 : 400);
+			throw error;
+		}
+	};
+	renameEntry = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_SERVER_PATH_RENAME", "rename input is required"), 400);
+		try {
+			return c.json(ok(await renameServerPathEntry({
+				basePath: body.data.basePath,
+				path: body.data.path,
+				name: body.data.name
+			})));
+		} catch (error) {
+			if (isServerPathMutationError(error)) return c.json(err(error.code, error.message, error.details), error.code === "SERVER_PATH_FILE_EXISTS" ? 409 : 400);
+			throw error;
+		}
+	};
+	deleteEntry = async (c) => {
+		try {
+			return c.json(ok(await deleteServerPathEntry({
+				basePath: c.req.query("basePath"),
+				path: c.req.query("path")
+			})));
+		} catch (error) {
+			if (isServerPathMutationError(error)) return c.json(err(error.code, error.message, error.details), 400);
+			throw error;
+		}
+	};
 	read = async (c) => {
 		try {
 			const payload = await readServerPath({
@@ -5710,11 +6118,13 @@ function createUiRouteControllers(options, authService, marketplaceBaseUrls) {
 	const { kernel, panelAppClientSdkScript, remoteAccess, runtimeControl, runtimeUpdate } = options;
 	return {
 		app: new AppRoutesController(options),
+		appPackages: new AppPackagesRoutesController(kernel.appPackageManager),
 		agents: new AgentsRoutesController(options),
 		auth: new AuthRoutesController(authService),
 		config: new ConfigRoutesController(options),
 		cron: new CronRoutesController(options),
 		inboxDeliveries: new InboxDeliveriesRoutesController(kernel.inboxDeliveryManager),
+		systemObjectReferences: new SystemObjectReferencesRoutesController(kernel.systemObjectReferenceManager),
 		ncpSession: new NcpSessionRoutesController(options),
 		ncpAsset: new NcpAssetRoutesController(options),
 		panelApps: new PanelAppsRoutesController(kernel.panelAppManager, { panelAppClientSdkScript }),
@@ -5833,7 +6243,7 @@ var UiRouteRegistry = class {
 		]]);
 	};
 	mountResourceRoutes = () => {
-		const { ncpSession, inboxDeliveries, panelApps, preferences, projects, serviceApps, serverPath } = this.controllers;
+		const { appPackages, ncpSession, inboxDeliveries, panelApps, preferences, projects, serviceApps, serverPath, systemObjectReferences } = this.controllers;
 		this.mountRoutes([
 			[
 				"get",
@@ -5905,10 +6315,55 @@ var UiRouteRegistry = class {
 				"/api/inbox/deliveries/:deliveryId",
 				inboxDeliveries.delete
 			],
+			[
+				"get",
+				"/api/system-object-references",
+				systemObjectReferences.list
+			],
+			[
+				"post",
+				"/api/system-object-references/resolve",
+				systemObjectReferences.resolve
+			],
+			[
+				"get",
+				"/api/app-packages",
+				appPackages.list
+			],
+			[
+				"post",
+				"/api/app-packages/install",
+				appPackages.install
+			],
+			[
+				"get",
+				"/api/app-packages/:appId",
+				appPackages.get
+			],
+			[
+				"post",
+				"/api/app-packages/:appId/enable",
+				appPackages.enable
+			],
+			[
+				"post",
+				"/api/app-packages/:appId/disable",
+				appPackages.disable
+			],
+			[
+				"post",
+				"/api/app-packages/:appId/update",
+				appPackages.update
+			],
 			[
 				"post",
-				"/api/inbox/deliveries/:deliveryId/continue",
-				inboxDeliveries.continueInChat
+				"/api/app-packages/:appId/rollback",
+				appPackages.rollback
+			],
+			[
+				"delete",
+				"/api/app-packages/:appId",
+				appPackages.uninstall
 			],
 			[
 				"get",
@@ -6095,6 +6550,26 @@ var UiRouteRegistry = class {
 				"/api/server-paths/directory",
 				serverPath.createDirectory
 			],
+			[
+				"post",
+				"/api/server-paths/file",
+				serverPath.createFile
+			],
+			[
+				"post",
+				"/api/server-paths/files",
+				serverPath.uploadFiles
+			],
+			[
+				"patch",
+				"/api/server-paths/entry",
+				serverPath.renameEntry
+			],
+			[
+				"delete",
+				"/api/server-paths/entry",
+				serverPath.deleteEntry
+			],
 			[
 				"get",
 				"/api/server-paths/read",
@@ -6670,6 +7145,6 @@ async function startUiServer(gateway) {
 	};
 }
 //#endregion
-export { ConfigRoutesController, InboxDeliveriesRoutesController, PanelAppsRoutesController, RuntimeControlRoutesController, ServiceAppsRoutesController, buildConfigMeta, buildConfigSchemaView, buildConfigView, buildProviderTemplatesView, buildProvidersView, createProvider, createUiRouter, deleteProvider, ensureUiBridgeSecret, executeConfigAction, getUiBridgeSecretPath, loadConfigOrDefault, readUiBridgeSecret, startUiServer, updateChannel, updateModel, updateProvider, updateRuntime, updateSearch, updateSecrets };
+export { AppPackagesRoutesController, ConfigRoutesController, InboxDeliveriesRoutesController, PanelAppsRoutesController, RuntimeControlRoutesController, ServiceAppsRoutesController, buildConfigMeta, buildConfigSchemaView, buildConfigView, buildProviderTemplatesView, buildProvidersView, createProvider, createUiRouter, deleteProvider, ensureUiBridgeSecret, executeConfigAction, getUiBridgeSecretPath, loadConfigOrDefault, readUiBridgeSecret, startUiServer, updateChannel, updateModel, updateProvider, updateRuntime, updateSearch, updateSecrets };
 
 //# sourceMappingURL=index.js.map