@nextclaw/server 0.20.4 → 0.21.0

package/dist/index.js

@@ -2156,6 +2156,81 @@ var AppPackagesRoutesController = class {
 			return this.handleError(c, error);
 		}
 	};
+	inspectDependencies = async (c) => {
+		try {
+			return c.json(ok(await this.manager.inspectDependencies(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	verifyDependencies = async (c) => {
+		try {
+			return c.json(ok(await this.manager.verifyDependencies(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	setupDependencies = async (c) => {
+		try {
+			return c.json(ok(await this.manager.setupDependencies(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	bindDependency = async (c) => {
+		const body = await readJson(c.req.raw);
+		const input = body.ok ? readDependencyBinding(body.data, true) : void 0;
+		if (!input) return c.json(err("INVALID_APP_PACKAGE_DEPENDENCY", "binding fields are required"), 400);
+		try {
+			return c.json(ok(await this.manager.bindDependency(c.req.param("appId"), input)));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	unbindDependency = async (c) => {
+		const body = await readJson(c.req.raw);
+		const input = body.ok ? readDependencyBinding(body.data, false) : void 0;
+		if (!input) return c.json(err("INVALID_APP_PACKAGE_DEPENDENCY", "binding fields are required"), 400);
+		try {
+			return c.json(ok(await this.manager.unbindDependency(c.req.param("appId"), input)));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	inspectSecrets = async (c) => {
+		try {
+			return c.json(ok(await this.manager.inspectSecrets(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	verifySecrets = async (c) => {
+		try {
+			return c.json(ok(await this.manager.verifySecrets(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	bindSecret = async (c) => {
+		const body = await readJson(c.req.raw);
+		const input = body.ok ? readSecretBinding(body.data) : void 0;
+		if (!input) return c.json(err("INVALID_APP_SECRET_BINDING", "slotId, source, and id are required"), 400);
+		try {
+			return c.json(ok(await this.manager.bindSecret(c.req.param("appId"), input)));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
+	unbindSecret = async (c) => {
+		const body = await readJson(c.req.raw);
+		const slotId = body.ok && isRecord$3(body.data) && typeof body.data.slotId === "string" ? body.data.slotId.trim() : "";
+		if (!slotId) return c.json(err("INVALID_APP_SECRET_BINDING", "slotId is required"), 400);
+		try {
+			return c.json(ok(await this.manager.unbindSecret(c.req.param("appId"), slotId)));
+		} catch (error) {
+			return this.handleError(c, error);
+		}
+	};
 	install = async (c) => {
 		const body = await readJson(c.req.raw);
 		if (!body.ok || !isRecord$3(body.data) || typeof body.data.source !== "string") return c.json(err("INVALID_APP_PACKAGE_INSTALL", "source is required"), 400);
@@ -2211,12 +2286,36 @@ var AppPackagesRoutesController = class {
 	};
 	handleError = (c, error) => {
 		if (isAppPackageError(error)) {
-			const status = error.code === "APP_PACKAGE_NOT_FOUND" ? 404 : error.code === "APP_PACKAGE_CONFLICT" ? 409 : 400;
+			const status = error.code === "APP_PACKAGE_NOT_FOUND" ? 404 : error.code === "APP_PACKAGE_CONFLICT" || error.code === "APP_PACKAGE_NOT_READY" || error.code === "SECRET_BINDING_MISSING" || error.code === "SECRET_RESOLUTION_FAILED" ? 409 : 400;
 			return c.json(err(error.code, error.message), status);
 		}
 		return c.json(err("APP_PACKAGE_OPERATION_FAILED", error instanceof Error ? error.message : String(error)), 400);
 	};
 };
+function readDependencyBinding(value, requireProvider) {
+	if (!isRecord$3(value) || typeof value.componentId !== "string" || !value.componentId.trim() || !["capability", "resource"].includes(String(value.requirementKind)) || typeof value.requirementId !== "string" || !value.requirementId.trim() || requireProvider && (typeof value.providerId !== "string" || !value.providerId.trim())) return;
+	return {
+		componentId: value.componentId,
+		requirementKind: value.requirementKind,
+		requirementId: value.requirementId,
+		...requireProvider ? { providerId: value.providerId } : {}
+	};
+}
+function readSecretBinding(value) {
+	if (!isRecord$3(value) || typeof value.slotId !== "string" || !value.slotId.trim() || ![
+		"env",
+		"file",
+		"exec"
+	].includes(String(value.source)) || typeof value.id !== "string" || !value.id.trim() || value.provider !== void 0 && (typeof value.provider !== "string" || !value.provider.trim())) return;
+	return {
+		slotId: value.slotId.trim(),
+		binding: {
+			source: value.source,
+			provider: typeof value.provider === "string" ? value.provider.trim() : void 0,
+			id: value.id.trim()
+		}
+	};
+}
 //#endregion
 //#region src/features/app-data/controllers/app-data.controller.ts
 var AppDataRoutesController = class {
@@ -6741,8 +6840,17 @@ function statusForServiceAppError(code) {
 		case "AUTHORIZATION_REQUIRED": return 401;
 		case "SERVICE_APP_ACTION_NOT_DECLARED": return 403;
 		case "SERVICE_APP_ACTION_NOT_FOUND":
-		case "SERVICE_APP_NOT_FOUND": return 404;
-		case "SERVICE_APP_RUNTIME_FAILED": return 502;
+		case "SERVICE_APP_NOT_FOUND":
+		case "SERVICE_APP_JOB_NOT_FOUND":
+		case "SERVICE_APP_RESIDENT_EVENT_NOT_FOUND": return 404;
+		case "SERVICE_APP_RUNTIME_FAILED":
+		case "WASI_ABI_VERSION_MISMATCH":
+		case "WASI_COMPONENT_FAILED":
+		case "WASI_COMPONENT_TRAP":
+		case "WASI_GUEST_EXPORT_MISSING": return 502;
+		case "WASI_CAPABILITY_DENIED": return 403;
+		case "WASI_INPUT_SCHEMA_MISMATCH": return 422;
+		case "STREAM_CURSOR_EXPIRED": return 422;
 		default: return 400;
 	}
 }
@@ -6760,6 +6868,39 @@ var ServiceAppsRoutesController = class {
 			return this.handleServiceAppError(c, error);
 		}
 	};
+	inspectServiceAppAiCapabilities = async (c) => {
+		try {
+			return c.json(ok(await this.params.serviceAppManager.inspectServiceAppAiCapabilities(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	verifyServiceAppAiCapabilities = async (c) => {
+		try {
+			return c.json(ok(await this.params.serviceAppManager.verifyServiceAppAiCapabilities(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	bindServiceAppAiCapability = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || body.data?.kind !== "model" && body.data?.kind !== "agent" || typeof body.data.slotId !== "string" || typeof body.data.targetId !== "string") return c.json(err("INVALID_SERVICE_APP_AI_BINDING", "kind, slotId, and targetId are required."), 400);
+		try {
+			const result = body.data.kind === "model" ? await this.params.serviceAppManager.bindServiceAppModelSlot(c.req.param("appId"), body.data.slotId, body.data.targetId) : await this.params.serviceAppManager.bindServiceAppAgentSlot(c.req.param("appId"), body.data.slotId, body.data.targetId);
+			return c.json(ok(result));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	unbindServiceAppAiCapability = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || body.data?.kind !== "model" && body.data?.kind !== "agent" || typeof body.data.slotId !== "string") return c.json(err("INVALID_SERVICE_APP_AI_BINDING", "kind and slotId are required."), 400);
+		try {
+			return c.json(ok(await this.params.serviceAppManager.unbindServiceAppAiSlot(c.req.param("appId"), body.data.kind, body.data.slotId)));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
 	listServiceActions = async (c) => {
 		try {
 			const bridgeSession = this.readOptionalBridgeSession(c);
@@ -6797,6 +6938,121 @@ var ServiceAppsRoutesController = class {
 			return this.handleServiceAppError(c, error);
 		}
 	};
+	invokeInstalledServiceAction = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || body.data?.input !== void 0 && !isRecord$3(body.data.input)) return c.json(err("INVALID_SERVICE_ACTION_REQUEST", "invalid service action request"), 400);
+		try {
+			return c.json(ok(await this.params.serviceAppManager.invokeInstalledServiceAction(c.req.param("appId"), c.req.param("actionName"), isRecord$3(body.data?.input) ? body.data.input : {})));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	/**
+	* Agent tool providers call the same manager method. This explicit endpoint
+	* is the non-LLM integration/diagnostic surface: it still requires a real
+	* configured Agent and its explicit Service Action grant, so it cannot
+	* impersonate either a Panel bridge or an arbitrary Agent.
+	*/
+	invokeAgentServiceAction = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || body.data?.input !== void 0 && !isRecord$3(body.data.input)) return c.json(err("INVALID_SERVICE_ACTION_REQUEST", "invalid service action request"), 400);
+		try {
+			return c.json(ok(await this.params.serviceAppManager.invokeServiceAction(c.req.param("actionId"), {
+				caller: {
+					surface: "agent",
+					agentId: c.req.param("agentId")
+				},
+				input: isRecord$3(body.data?.input) ? body.data.input : {}
+			})));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	listVerificationRecords = async (c) => {
+		try {
+			return c.json(ok(await this.params.serviceAppManager.listVerificationRecords({
+				acceptanceId: this.readOptionalQuery(c, "acceptanceId"),
+				appId: this.readOptionalQuery(c, "appId"),
+				limit: this.readLimit(c)
+			})));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	/** Stable read-only projection of the single portable-runtime acceptance registry. */
+	getPortableRuntimeAcceptanceContract = async (c) => {
+		try {
+			return c.json(ok(this.params.portableRuntimeAcceptance.contract(this.readLocale(c))));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	getPortableRuntimeAcceptanceStatus = async (c) => {
+		try {
+			return c.json(ok(await this.params.portableRuntimeAcceptance.status({
+				appId: this.readOptionalQuery(c, "appId"),
+				locale: this.readLocale(c)
+			})));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	exportPortableRuntimeAcceptance = async (c) => {
+		try {
+			return c.json(ok(await this.params.portableRuntimeAcceptance.export({
+				appId: this.readOptionalQuery(c, "appId"),
+				locale: this.readLocale(c)
+			})));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	listServiceAppJobs = async (c) => {
+		try {
+			return c.json(ok(await this.params.serviceAppManager.listServiceAppJobs(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	getServiceAppJob = async (c) => {
+		try {
+			return c.json(ok(await this.params.serviceAppManager.getServiceAppJob(c.req.param("appId"), c.req.param("jobId"))));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	/** Cursor replay only; a disconnected client never changes Job execution. */
+	watchServiceAppJob = async (c) => {
+		const afterSequence = this.readAfterSequence(c);
+		if (afterSequence === null) return c.json(err("INVALID_JOB_CURSOR", "afterSequence must be a non-negative integer"), 400);
+		try {
+			return c.json(ok(await this.params.serviceAppManager.watchServiceAppJob(c.req.param("appId"), c.req.param("jobId"), afterSequence)));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	cancelServiceAppJob = async (c) => {
+		try {
+			return c.json(ok(await this.params.serviceAppManager.cancelServiceAppJob(c.req.param("appId"), c.req.param("jobId"))));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	/** Inspect durable Resident delivery facts; payload stays private to the instance journal. */
+	listResidentInbox = async (c) => {
+		try {
+			return c.json(ok(await this.params.serviceAppManager.listResidentInbox(c.req.param("appId"), { deadLettersOnly: c.req.query("deadLetters") === "true" })));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
+	replayResidentDeadLetter = async (c) => {
+		try {
+			return c.json(ok(await this.params.serviceAppManager.replayResidentDeadLetter(c.req.param("appId"), c.req.param("eventId"))));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
 	grantServiceAction = async (c) => {
 		try {
 			const bridgeSession = this.requireBridgeSession(c);
@@ -6898,8 +7154,24 @@ var ServiceAppsRoutesController = class {
 		};
 		return null;
 	};
+	readOptionalQuery = (c, key) => {
+		return c.req.query(key)?.trim() || void 0;
+	};
+	readLocale = (c) => c.req.query("locale") === "en" ? "en" : "zh-CN";
+	readLimit = (c) => {
+		const raw = c.req.query("limit");
+		if (!raw) return void 0;
+		const value = Number(raw);
+		return Number.isInteger(value) && value > 0 ? value : void 0;
+	};
+	readAfterSequence = (c) => {
+		const raw = c.req.query("afterSequence");
+		if (raw === void 0 || raw === "") return void 0;
+		const value = Number(raw);
+		return Number.isInteger(value) && value >= 0 ? value : null;
+	};
 	handleServiceAppError = (c, error) => {
-		if (isServiceAppError(error)) return c.json(err(error.code, error.message), statusForServiceAppError(error.code));
+		if (isServiceAppError(error)) return c.json(err(error.code, error.message, error.details), statusForServiceAppError(error.code));
 		if (isPanelAppError(error)) return c.json(err(error.code, error.message), 404);
 		if (error instanceof Error && error.message === "panel app bridge session is required") return c.json(err("PANEL_APP_BRIDGE_SESSION_REQUIRED", error.message), 401);
 		return c.json(err("SERVICE_APP_REQUEST_FAILED", "The Service App request failed. Please retry."), 500);
@@ -6994,7 +7266,8 @@ function createUiRouteControllers(options, authService, marketplaceBaseUrls, ser
 		projects: new ProjectsRoutesController(kernel.projectManager),
 		serviceApps: new ServiceAppsRoutesController({
 			panelAppManager: kernel.panelAppManager,
-			serviceAppManager: kernel.serviceAppManager
+			serviceAppManager: kernel.serviceAppManager,
+			portableRuntimeAcceptance: kernel.portableRuntimeAcceptance
 		}),
 		serverPath: new ServerPathRoutesController(serverPathWatchService),
 		remote: remoteAccess ? new RemoteRoutesController(remoteAccess) : null,
@@ -7303,6 +7576,51 @@ var UiRouteRegistry = class {
 				"/api/app-packages/:appId",
 				appPackages.get
 			],
+			[
+				"get",
+				"/api/app-packages/:appId/dependencies",
+				appPackages.inspectDependencies
+			],
+			[
+				"get",
+				"/api/app-packages/:appId/dependencies/verify",
+				appPackages.verifyDependencies
+			],
+			[
+				"post",
+				"/api/app-packages/:appId/dependencies/setup",
+				appPackages.setupDependencies
+			],
+			[
+				"post",
+				"/api/app-packages/:appId/dependencies/bind",
+				appPackages.bindDependency
+			],
+			[
+				"post",
+				"/api/app-packages/:appId/dependencies/unbind",
+				appPackages.unbindDependency
+			],
+			[
+				"get",
+				"/api/app-packages/:appId/secrets",
+				appPackages.inspectSecrets
+			],
+			[
+				"post",
+				"/api/app-packages/:appId/secrets/verify",
+				appPackages.verifySecrets
+			],
+			[
+				"post",
+				"/api/app-packages/:appId/secrets/bind",
+				appPackages.bindSecret
+			],
+			[
+				"post",
+				"/api/app-packages/:appId/secrets/unbind",
+				appPackages.unbindSecret
+			],
 			[
 				"post",
 				"/api/app-packages/:appId/enable",
@@ -7443,6 +7761,26 @@ var UiRouteRegistry = class {
 				"/api/service-apps",
 				serviceApps.listServiceApps
 			],
+			[
+				"get",
+				"/api/service-apps/:appId/ai-capabilities",
+				serviceApps.inspectServiceAppAiCapabilities
+			],
+			[
+				"post",
+				"/api/service-apps/:appId/ai-capabilities/verify",
+				serviceApps.verifyServiceAppAiCapabilities
+			],
+			[
+				"post",
+				"/api/service-apps/:appId/ai-capabilities/bind",
+				serviceApps.bindServiceAppAiCapability
+			],
+			[
+				"post",
+				"/api/service-apps/:appId/ai-capabilities/unbind",
+				serviceApps.unbindServiceAppAiCapability
+			],
 			[
 				"post",
 				"/api/service-apps/:appId/restart",
@@ -7453,6 +7791,36 @@ var UiRouteRegistry = class {
 				"/api/service-apps/:appId/actions/discover",
 				serviceApps.discoverServiceAppActions
 			],
+			[
+				"get",
+				"/api/service-apps/:appId/jobs",
+				serviceApps.listServiceAppJobs
+			],
+			[
+				"get",
+				"/api/service-apps/:appId/jobs/:jobId",
+				serviceApps.getServiceAppJob
+			],
+			[
+				"get",
+				"/api/service-apps/:appId/jobs/:jobId/watch",
+				serviceApps.watchServiceAppJob
+			],
+			[
+				"post",
+				"/api/service-apps/:appId/jobs/:jobId/cancel",
+				serviceApps.cancelServiceAppJob
+			],
+			[
+				"get",
+				"/api/service-apps/:appId/resident-inbox",
+				serviceApps.listResidentInbox
+			],
+			[
+				"post",
+				"/api/service-apps/:appId/resident-inbox/:eventId/replay",
+				serviceApps.replayResidentDeadLetter
+			],
 			[
 				"get",
 				"/api/service-apps/:appId",
@@ -7473,6 +7841,31 @@ var UiRouteRegistry = class {
 				"/api/service-actions/:actionId/invoke",
 				serviceApps.invokeServiceAction
 			],
+			[
+				"post",
+				"/api/service-apps/:appId/actions/:actionName/invoke",
+				serviceApps.invokeInstalledServiceAction
+			],
+			[
+				"get",
+				"/api/runtime-verification-records",
+				serviceApps.listVerificationRecords
+			],
+			[
+				"get",
+				"/api/portable-runtime/acceptance/contract",
+				serviceApps.getPortableRuntimeAcceptanceContract
+			],
+			[
+				"get",
+				"/api/portable-runtime/acceptance/status",
+				serviceApps.getPortableRuntimeAcceptanceStatus
+			],
+			[
+				"get",
+				"/api/portable-runtime/acceptance/export",
+				serviceApps.exportPortableRuntimeAcceptance
+			],
 			[
 				"post",
 				"/api/service-actions/:actionId/grant",
@@ -7498,6 +7891,11 @@ var UiRouteRegistry = class {
 				"/api/agents/:agentId/service-action-grants",
 				serviceApps.grantAgentServiceActions
 			],
+			[
+				"post",
+				"/api/agents/:agentId/service-actions/:actionId/invoke",
+				serviceApps.invokeAgentServiceAction
+			],
 			[
 				"delete",
 				"/api/service-action-grants/:actionId",