@nocobase/app-plugin-agents 0.0.0-stage → 0.1.0-beta.1

package/dist/server/jobs/spec.js

@@ -0,0 +1,106 @@
+/**
+ * What an application enqueues: a job's spec as the runner will get it, except that secrets are named rather than
+ * given. A variable may come from a stored variable (`{ name, secret: { scope, scopeId, name } }`, kept wherever the
+ * secret source the application provides keeps them: the agents plugin's variables of an agent, a working directory or
+ * a scope), and a repository's HTTPS token likewise (`repo.credentials`). The claim opens them through that source for
+ * the runner that takes the job, which records the delivery; the stored job holds only the references.
+ */
+import { JOB_SPEC_SCHEMAS, } from '@nocobase/agent-protocol';
+import { z } from 'zod';
+import { invalid } from '../kernel/errors.js';
+/** A variable name: upper-case letters, digits and underscores, not starting with a digit. */
+const VARIABLE_NAME_PATTERN = /^[A-Z_][A-Z0-9_]{0,127}$/u;
+const SecretRefSchema = z.object({
+    scope: z.string().min(1).max(32),
+    scopeId: z.string().min(1).max(64),
+    name: z.string().regex(VARIABLE_NAME_PATTERN),
+});
+const CredentialsSchema = SecretRefSchema.extend({
+    username: z.string().min(1).max(200).optional(),
+});
+/** Only the references are checked here; the rest is checked by the protocol's schema once they are filled. */
+const ReferencesSchema = z.object({
+    repo: z.object({ credentials: CredentialsSchema.optional() }).loose(),
+    env: z
+        .array(z
+        .object({ name: z.string(), secret: SecretRefSchema.optional() })
+        .loose())
+        .optional(),
+});
+export function refKey(ref) {
+    return `${ref.scope}\u0000${ref.scopeId}\u0000${ref.name}`;
+}
+/** The stored variables `input` names, each once. */
+export function secretRefsOf(input) {
+    const parsed = ReferencesSchema.safeParse(input);
+    if (!parsed.success)
+        return [];
+    const refs = new Map();
+    const add = (ref) => refs.set(refKey(ref), ref);
+    if (parsed.data.repo.credentials)
+        add(parsed.data.repo.credentials);
+    for (const entry of parsed.data.env ?? [])
+        if (entry.secret)
+            add(entry.secret);
+    return [...refs.values()];
+}
+function issueText(error) {
+    const issue = error.issues[0];
+    return issue
+        ? `${issue.path.join('.') || 'spec'}: ${issue.message}`
+        : 'The job spec is invalid.';
+}
+/**
+ * `input` as the runner gets it: references filled from `values` (by `refKey`), then checked against the executor's
+ * schema. Throws `INVALID_REQUEST` naming the first problem.
+ */
+export function runnerSpec(executor, input, values) {
+    const references = ReferencesSchema.safeParse(input);
+    if (!references.success)
+        throw invalid(issueText(references.error));
+    const value = (ref) => {
+        const found = values.get(refKey(ref));
+        if (found === undefined)
+            throw invalid(`The variable ${ref.name} of ${ref.scope} ${ref.scopeId} is not set.`, { scope: ref.scope, scopeId: ref.scopeId, name: ref.name });
+        return found;
+    };
+    const raw = input;
+    const { credentials } = references.data.repo;
+    const { credentials: _dropped, ...repo } = raw.repo;
+    const filled = {
+        ...raw,
+        repo: {
+            ...repo,
+            ...(credentials
+                ? {
+                    auth: {
+                        token: value(credentials),
+                        ...(credentials.username
+                            ? { username: credentials.username }
+                            : {}),
+                    },
+                }
+                : {}),
+        },
+    };
+    filled.env = (references.data.env ?? []).map((entry) => entry.secret
+        ? { name: entry.name, value: value(entry.secret), secret: true }
+        : entry);
+    const result = JOB_SPEC_SCHEMAS[executor].safeParse(filled);
+    if (!result.success)
+        throw invalid(issueText(result.error));
+    return result.data;
+}
+/** Checks `input` as `runnerSpec` would, with every reference filled with a placeholder. */
+export function checkSpecInput(executor, input) {
+    const placeholders = new Map(secretRefsOf(input).map((ref) => [refKey(ref), 'x']));
+    runnerSpec(executor, input, placeholders);
+}
+/** How long the job may run, as its spec says; for the sweeper's backstop. */
+export function timeoutSecOf(spec) {
+    const value = spec && typeof spec === 'object'
+        ? spec.timeoutSec
+        : undefined;
+    return typeof value === 'number' && value > 0 ? value : null;
+}
+//# sourceMappingURL=spec.js.map

package/dist/server/jobs/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../server/jobs/spec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,gBAAgB,GAMjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,8FAA8F;AAC9F,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AA4B1D,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH,+GAA+G;AAC/G,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE;IACrE,GAAG,EAAE,CAAC;SACH,KAAK,CACJ,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,EAAE,CAAC;SAChE,KAAK,EAAE,CACX;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,UAAU,MAAM,CAAC,GAAc;IACnC,OAAO,GAAG,GAAG,CAAC,KAAK,SAAS,GAAG,CAAC,OAAO,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE;QACvC,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,KAAK;QACV,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE;QACvD,CAAC,CAAC,0BAA0B,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,QAAW,EACX,KAAc,EACd,MAAmC;IAEnC,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,GAAc,EAAU,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,OAAO,CACX,gBAAgB,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,cAAc,EACrE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAC3D,CAAC;QACJ,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,KAEX,CAAC;IACF,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IACpD,MAAM,MAAM,GAA4B;QACtC,GAAG,GAAG;QACN,IAAI,EAAE;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,WAAW;gBACb,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;wBACzB,GAAG,CAAC,WAAW,CAAC,QAAQ;4BACtB,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE;4BACpC,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;IACF,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACrD,KAAK,CAAC,MAAM;QACV,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;QAChE,CAAC,CAAC,KAAK,CACV,CAAC;IACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,QAAiB,EAAE,KAAc;IAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CACrD,CAAC;IACF,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,KAAK,GACT,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAC9B,CAAC,CAAE,IAAiC,CAAC,UAAU;QAC/C,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC"}

package/dist/server/kernel/clock.d.ts

@@ -0,0 +1,10 @@
+/** The time, injectable so tests can move it. */
+export interface Clock {
+    now(): Date;
+}
+export declare const systemClock: Clock;
+/** `date` plus `ms` milliseconds, as ISO 8601. */
+export declare function later(date: Date, ms: number): string;
+/** Whether ISO 8601 `at` is before `date`; null is never. */
+export declare function isBefore(at: string | null | undefined, date: Date): boolean;
+//# sourceMappingURL=clock.d.ts.map

package/dist/server/kernel/clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.d.ts","sourceRoot":"","sources":["../../../server/kernel/clock.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,MAAM,WAAW,KAAK;IACpB,GAAG,IAAI,IAAI,CAAC;CACb;AAED,eAAO,MAAM,WAAW,EAAE,KAAiC,CAAC;AAE5D,kDAAkD;AAClD,wBAAgB,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,6DAA6D;AAC7D,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAE3E"}

package/dist/server/kernel/clock.js

@@ -0,0 +1,10 @@
+export const systemClock = { now: () => new Date() };
+/** `date` plus `ms` milliseconds, as ISO 8601. */
+export function later(date, ms) {
+    return new Date(date.getTime() + ms).toISOString();
+}
+/** Whether ISO 8601 `at` is before `date`; null is never. */
+export function isBefore(at, date) {
+    return at !== null && at !== undefined && Date.parse(at) < date.getTime();
+}
+//# sourceMappingURL=clock.js.map

package/dist/server/kernel/clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.js","sourceRoot":"","sources":["../../../server/kernel/clock.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,WAAW,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAE5D,kDAAkD;AAClD,MAAM,UAAU,KAAK,CAAC,IAAU,EAAE,EAAU;IAC1C,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACrD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,QAAQ,CAAC,EAA6B,EAAE,IAAU;IAChE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;AAC5E,CAAC"}

package/dist/server/kernel/crypto.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Credentials (runner keys, run tokens, registration tokens): random strings shown once; only their SHA-256 hash is
+ * stored, and a presented credential is found by its hash. Values the server must read back are sealed instead
+ * (`secrets.ts`).
+ */
+import { CREDENTIAL_PREFIXES } from '@nocobase/agent-protocol';
+/**
+ * The prefixes that tell credentials apart in logs and support requests. They are the protocol's, so every redactor
+ * recognises a credential by its prefix without knowing its value.
+ */
+export declare const CREDENTIAL_PREFIX: typeof CREDENTIAL_PREFIXES;
+/** A new credential: the prefix and 32 random bytes, base64url. */
+export declare function createCredential(prefix: string): string;
+/** The stored form of a credential. */
+export declare function hashCredential(value: string): string;
+/** The first characters of a credential, safe to show. */
+export declare function credentialPrefix(value: string): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/server/kernel/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../server/kernel/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,OAAO,mBAClB,CAAC;AAEtB,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,uCAAuC;AACvC,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/server/kernel/crypto.js

@@ -0,0 +1,25 @@
+/**
+ * Credentials (runner keys, run tokens, registration tokens): random strings shown once; only their SHA-256 hash is
+ * stored, and a presented credential is found by its hash. Values the server must read back are sealed instead
+ * (`secrets.ts`).
+ */
+import { CREDENTIAL_PREFIXES } from '@nocobase/agent-protocol';
+import { createHash, randomBytes } from 'node:crypto';
+/**
+ * The prefixes that tell credentials apart in logs and support requests. They are the protocol's, so every redactor
+ * recognises a credential by its prefix without knowing its value.
+ */
+export const CREDENTIAL_PREFIX = CREDENTIAL_PREFIXES;
+/** A new credential: the prefix and 32 random bytes, base64url. */
+export function createCredential(prefix) {
+    return `${prefix}${randomBytes(32).toString('base64url')}`;
+}
+/** The stored form of a credential. */
+export function hashCredential(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+/** The first characters of a credential, safe to show. */
+export function credentialPrefix(value) {
+    return value.slice(0, 12);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/server/kernel/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../server/kernel/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,mBAAmB,CAAC;AAEtB,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC"}

package/dist/server/kernel/errors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Errors services throw. They are the protocol's errors (`@nocobase/agent-protocol`): each code is a reason of domain
+ * `agents`, and the routers render it as the standard error body (`kernel/http.ts`).
+ */
+import { ProtocolError, type ErrorCode } from '@nocobase/agent-protocol';
+export { ProtocolError };
+export declare function invalid(message: string, details?: Readonly<Record<string, unknown>>): ProtocolError;
+export type Missing = 'Agent' | 'Run' | 'Run context' | 'Brief' | 'Conversation' | 'Skill' | 'Skill version' | 'Skill file' | 'Mount' | 'Variable' | 'Runner' | 'Job' | 'Model service' | 'Scope' | 'Product' | 'File' | 'Attachment';
+/** An object that does not exist, or that the caller may not see: the two are indistinguishable on purpose. */
+export declare function notFound(what: Missing): ProtocolError;
+export declare function forbidden(message: string): ProtocolError;
+/** The state of what the request names forbids it; `code` says which state. */
+export declare function precondition(code: ErrorCode, message: string, details?: Readonly<Record<string, unknown>>): ProtocolError;
+/** A concurrent change won: read again and retry. */
+export declare function conflict(message: string, details?: Readonly<Record<string, unknown>>): ProtocolError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/server/kernel/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../server/kernel/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,wBAAgB,OAAO,CACrB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC1C,aAAa,CAEf;AAED,MAAM,MAAM,OAAO,GACf,OAAO,GACP,KAAK,GACL,aAAa,GACb,OAAO,GACP,cAAc,GACd,OAAO,GACP,eAAe,GACf,YAAY,GACZ,OAAO,GACP,UAAU,GACV,QAAQ,GACR,KAAK,GACL,eAAe,GACf,OAAO,GACP,SAAS,GACT,MAAM,GACN,YAAY,CAAC;AAsBjB,+GAA+G;AAC/G,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAErD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAExD;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAC1B,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC1C,aAAa,CAEf;AAED,qDAAqD;AACrD,wBAAgB,QAAQ,CACtB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC1C,aAAa,CAEf"}

package/dist/server/kernel/errors.js

@@ -0,0 +1,44 @@
+/**
+ * Errors services throw. They are the protocol's errors (`@nocobase/agent-protocol`): each code is a reason of domain
+ * `agents`, and the routers render it as the standard error body (`kernel/http.ts`).
+ */
+import { ProtocolError } from '@nocobase/agent-protocol';
+export { ProtocolError };
+export function invalid(message, details) {
+    return new ProtocolError('INVALID_REQUEST', message, details);
+}
+const MISSING = {
+    Agent: 'AGENT_NOT_FOUND',
+    Run: 'RUN_NOT_FOUND',
+    'Run context': 'RUN_CONTEXT_NOT_FOUND',
+    Brief: 'BRIEF_NOT_FOUND',
+    Conversation: 'CONVERSATION_NOT_FOUND',
+    Skill: 'SKILL_NOT_FOUND',
+    'Skill version': 'SKILL_VERSION_NOT_FOUND',
+    'Skill file': 'SKILL_FILE_NOT_FOUND',
+    Mount: 'MOUNT_NOT_FOUND',
+    Variable: 'VARIABLE_NOT_FOUND',
+    Runner: 'RUNNER_NOT_FOUND',
+    Job: 'JOB_NOT_FOUND',
+    'Model service': 'MODEL_SERVICE_NOT_FOUND',
+    Scope: 'SCOPE_NOT_FOUND',
+    Product: 'PRODUCT_NOT_FOUND',
+    File: 'DIST_FILE_NOT_FOUND',
+    Attachment: 'NOT_FOUND',
+};
+/** An object that does not exist, or that the caller may not see: the two are indistinguishable on purpose. */
+export function notFound(what) {
+    return new ProtocolError(MISSING[what], `${what} not found.`);
+}
+export function forbidden(message) {
+    return new ProtocolError('FORBIDDEN', message);
+}
+/** The state of what the request names forbids it; `code` says which state. */
+export function precondition(code, message, details) {
+    return new ProtocolError(code, message, details);
+}
+/** A concurrent change won: read again and retry. */
+export function conflict(message, details) {
+    return new ProtocolError('CONFLICT', message, details);
+}
+//# sourceMappingURL=errors.js.map

package/dist/server/kernel/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../server/kernel/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAkB,MAAM,0BAA0B,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,MAAM,UAAU,OAAO,CACrB,OAAe,EACf,OAA2C;IAE3C,OAAO,IAAI,aAAa,CAAC,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAqBD,MAAM,OAAO,GAAyC;IACpD,KAAK,EAAE,iBAAiB;IACxB,GAAG,EAAE,eAAe;IACpB,aAAa,EAAE,uBAAuB;IACtC,KAAK,EAAE,iBAAiB;IACxB,YAAY,EAAE,wBAAwB;IACtC,KAAK,EAAE,iBAAiB;IACxB,eAAe,EAAE,yBAAyB;IAC1C,YAAY,EAAE,sBAAsB;IACpC,KAAK,EAAE,iBAAiB;IACxB,QAAQ,EAAE,oBAAoB;IAC9B,MAAM,EAAE,kBAAkB;IAC1B,GAAG,EAAE,eAAe;IACpB,eAAe,EAAE,yBAAyB;IAC1C,KAAK,EAAE,iBAAiB;IACxB,OAAO,EAAE,mBAAmB;IAC5B,IAAI,EAAE,qBAAqB;IAC3B,UAAU,EAAE,WAAW;CACxB,CAAC;AAEF,+GAA+G;AAC/G,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,IAAI,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAC1B,IAAe,EACf,OAAe,EACf,OAA2C;IAE3C,OAAO,IAAI,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,QAAQ,CACtB,OAAe,EACf,OAA2C;IAE3C,OAAO,IAAI,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC"}

package/dist/server/kernel/events.d.ts

@@ -0,0 +1,122 @@
+/**
+ * What happened, announced after the transaction that did it commits. Listeners are realtime pushes and wake-ups;
+ * delivery is in-process and best effort, so nothing a listener does may be needed for correctness.
+ */
+import type { JobStatus, RunStatus } from '@nocobase/agent-protocol';
+/**
+ * Something people should hear about, for the application to deliver where its people look (an inbox, say): the
+ * plugin decides who and what, the application how. Text is English, for a reader without the application's own
+ * wording; `type` and `params` are what the application words it from.
+ *
+ * - `runner_upgrade_required` (subject `runner`): a runner connected speaking a protocol this application does not
+ *   serve, so it gets no work until it is upgraded; to its owner. `params`: `runnerName`, `runnerVersion`,
+ *   `protocolVersion` (the runner's), `minProtocolVersion` and `maxProtocolVersion` (the application's),
+ *   `latestVersion` (the runner the application serves for its platform, or null).
+ */
+export interface RunnerNotice {
+    /** Stable for the same news: delivering it twice tells people once. */
+    readonly key: string;
+    readonly type: 'runner_upgrade_required';
+    readonly userIds: readonly string[];
+    readonly subject: {
+        readonly kind: 'runner';
+        readonly id: string;
+        readonly label: string;
+    };
+    readonly title: string;
+    readonly body: string;
+    readonly params: Readonly<Record<string, string | number | null>>;
+}
+export type AgentsEvent = 
+/** A run entered the queue, or a queued run's input changed what a runner would see. */
+{
+    readonly type: 'run.queued';
+    readonly runId: string;
+    readonly agentId: string;
+} | {
+    readonly type: 'run.changed';
+    readonly runId: string;
+    readonly status: RunStatus;
+}
+/** Events were stored; `lastSeq` is the highest one. */
+ | {
+    readonly type: 'run.events';
+    readonly runId: string;
+    readonly lastSeq: number;
+} | {
+    readonly type: 'run.input';
+    readonly runId: string;
+    readonly inputId: string;
+}
+/** A run went back to the queue; it may be claimed from `availableAt`. */
+ | {
+    readonly type: 'run.requeued';
+    readonly runId: string;
+    readonly availableAt: string | null;
+}
+/** A conversation got messages (up to `lastSeq`), or its title, agent, run or state changed. Announced to its owner. */
+ | {
+    readonly type: 'conversation.changed';
+    readonly conversationId: string;
+    readonly userId: string;
+    readonly lastSeq?: number;
+} | {
+    readonly type: 'agent.changed';
+    readonly agentId: string;
+}
+/**
+ * The agent can no longer be given work: it was archived or deleted. Its queued runs were withdrawn in the same
+ * transaction; the application lets go of the work it gave the agent (the assembling application clears it as executor of unfinished
+ * issues). `byUserId` is who archived or deleted it, `name` its name then.
+ */
+ | {
+    readonly type: 'agent.removed';
+    readonly agentId: string;
+    readonly name: string;
+    readonly reason: 'archived' | 'deleted';
+    readonly byUserId: string | null;
+} | {
+    readonly type: 'runner.changed';
+    readonly runnerId: string;
+}
+/** A job entered the queue, or went back to it (`availableAt`: when it may be claimed). */
+ | {
+    readonly type: 'job.queued';
+    readonly jobId: string;
+    readonly availableAt: string | null;
+} | {
+    readonly type: 'job.changed';
+    readonly jobId: string;
+    readonly status: JobStatus;
+}
+/** Job events were stored; `lastSeq` is the highest one. */
+ | {
+    readonly type: 'job.events';
+    readonly jobId: string;
+    readonly lastSeq: number;
+}
+/** People should hear of something (`RunnerNotice`); the application delivers it. */
+ | {
+    readonly type: 'notice';
+    readonly notice: RunnerNotice;
+}
+/**
+ * What a notice told no longer holds, so the application settles it where people look: for
+ * `runner_upgrade_required`, the runner connected again speaking a protocol the application serves.
+ */
+ | {
+    readonly type: 'notice.cleared';
+    readonly notice: Pick<RunnerNotice, 'type' | 'subject'>;
+};
+export type AgentsEventType = AgentsEvent['type'];
+export type AgentsEventOf<T extends AgentsEventType> = Extract<AgentsEvent, {
+    readonly type: T;
+}>;
+export interface AgentsEventBus {
+    emit(event: AgentsEvent): void;
+    /** Returns what stops listening. */
+    on<T extends AgentsEventType>(type: T, listener: (event: AgentsEventOf<T>) => void): () => void;
+    onAny(listener: (event: AgentsEvent) => void): () => void;
+}
+export declare function createEventBus(onListenerError?: (error: unknown) => void): AgentsEventBus;
+//# sourceMappingURL=events.d.ts.map

package/dist/server/kernel/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../server/kernel/events.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,WAAW;AACrB,wFAAwF;AACtF;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AACH,wDAAwD;GACtD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AACH,0EAA0E;GACxE;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AACH,wHAAwH;GACtH;IACE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC9D;;;;GAIG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAChE,2FAA2F;GACzF;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AACH,4DAA4D;GAC1D;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AACH,qFAAqF;GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE;AAC5D;;;GAGG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACzD,CAAC;AAEN,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAElD,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,eAAe,IAAI,OAAO,CAC5D,WAAW,EACX;IAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;CAAE,CACrB,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/B,oCAAoC;IACpC,EAAE,CAAC,CAAC,SAAS,eAAe,EAC1B,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,GAC1C,MAAM,IAAI,CAAC;IACd,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CAC3D;AAED,wBAAgB,cAAc,CAC5B,eAAe,GAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAsB,GAC1D,cAAc,CA4BhB"}

package/dist/server/kernel/events.js

@@ -0,0 +1,32 @@
+export function createEventBus(onListenerError = () => undefined) {
+    const listeners = new Set();
+    return {
+        emit(event) {
+            for (const listener of [...listeners]) {
+                try {
+                    listener(event);
+                }
+                catch (error) {
+                    onListenerError(error);
+                }
+            }
+        },
+        on(type, listener) {
+            const wrapped = (event) => {
+                if (event.type === type)
+                    listener(event);
+            };
+            listeners.add(wrapped);
+            return () => {
+                listeners.delete(wrapped);
+            };
+        },
+        onAny(listener) {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+    };
+}
+//# sourceMappingURL=events.js.map

package/dist/server/kernel/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../server/kernel/events.ts"],"names":[],"mappings":"AA8HA,MAAM,UAAU,cAAc,CAC5B,kBAA4C,GAAG,EAAE,CAAC,SAAS;IAE3D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC1D,OAAO;QACL,IAAI,CAAC,KAAK;YACR,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,eAAe,CAAC,KAAK,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QACD,EAAE,CAAC,IAAI,EAAE,QAAQ;YACf,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAE,EAAE;gBACrC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;oBAAE,QAAQ,CAAC,KAAmC,CAAC,CAAC;YACzE,CAAC,CAAC;YACF,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/kernel/http.d.ts

@@ -0,0 +1,23 @@
+/**
+ * HTTP helpers for the route modules: the routers' error handler, which renders the services' `ProtocolError` as the
+ * standard error body (domain `agents` unless the error names another), and opaque page tokens. Only route code
+ * imports this file; services never see a request.
+ */
+import { ProtocolError } from '@nocobase/agent-protocol';
+import { ApiError } from '@nocobase/app-server/router';
+import type { Env, ErrorHandler } from 'hono';
+import { Hono } from 'hono';
+import type { z } from 'zod';
+/** The standard error for a protocol error. */
+export declare function toApiError(error: ProtocolError): ApiError;
+/** Protocol errors as the standard body; the framework renders what it recognizes and rethrows the rest. */
+export declare const errorHandler: ErrorHandler;
+/** A router whose errors go through `errorHandler`. */
+export declare function domainRouter<E extends Env = Env>(): Hono<E>;
+/** An error of this plugin's domain. */
+export declare function agentsApiError(options: Omit<ConstructorParameters<typeof ApiError>[0], 'domain'>): ApiError;
+/** A page token: the position after the last item of a page, opaque to the client. */
+export declare function encodePageToken(position: unknown): string;
+/** The position a page token holds; 400 `INVALID_PAGE_TOKEN` for a token this API did not give. */
+export declare function decodePageToken<T>(token: string, schema: z.ZodType<T>): T;
+//# sourceMappingURL=http.d.ts.map

package/dist/server/kernel/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../server/kernel/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAuB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAmB,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,+CAA+C;AAC/C,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,QAAQ,CAUzD;AAED,4GAA4G;AAC5G,eAAO,MAAM,YAAY,EAAE,YAIxB,CAAC;AAEJ,uDAAuD;AACvD,wBAAgB,YAAY,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAI3D;AAED,wCAAwC;AACxC,wBAAgB,cAAc,CAC5B,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GACjE,QAAQ,CAEV;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED,mGAAmG;AACnG,wBAAgB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAiBzE"}

package/dist/server/kernel/http.js

@@ -0,0 +1,56 @@
+/**
+ * HTTP helpers for the route modules: the routers' error handler, which renders the services' `ProtocolError` as the
+ * standard error body (domain `agents` unless the error names another), and opaque page tokens. Only route code
+ * imports this file; services never see a request.
+ */
+import { AGENTS_ERROR_DOMAIN, ProtocolError } from '@nocobase/agent-protocol';
+import { ApiError, apiErrorHandler } from '@nocobase/app-server/router';
+import { Hono } from 'hono';
+/** The standard error for a protocol error. */
+export function toApiError(error) {
+    return new ApiError({
+        status: error.apiStatus,
+        reason: error.code,
+        domain: error.domain,
+        message: error.message,
+        ...(error.details ? { metadata: error.details } : {}),
+        httpStatus: error.status,
+        cause: error,
+    });
+}
+/** Protocol errors as the standard body; the framework renders what it recognizes and rethrows the rest. */
+export const errorHandler = (error, context) => apiErrorHandler(error instanceof ProtocolError ? toApiError(error) : error, context);
+/** A router whose errors go through `errorHandler`. */
+export function domainRouter() {
+    const router = new Hono();
+    router.onError(errorHandler);
+    return router;
+}
+/** An error of this plugin's domain. */
+export function agentsApiError(options) {
+    return new ApiError({ ...options, domain: AGENTS_ERROR_DOMAIN });
+}
+/** A page token: the position after the last item of a page, opaque to the client. */
+export function encodePageToken(position) {
+    return Buffer.from(JSON.stringify(position), 'utf8').toString('base64url');
+}
+/** The position a page token holds; 400 `INVALID_PAGE_TOKEN` for a token this API did not give. */
+export function decodePageToken(token, schema) {
+    try {
+        const parsed = schema.safeParse(JSON.parse(Buffer.from(token, 'base64url').toString('utf8')));
+        if (parsed.success)
+            return parsed.data;
+    }
+    catch {
+        // Refused below.
+    }
+    throw agentsApiError({
+        status: 'INVALID_ARGUMENT',
+        reason: 'INVALID_PAGE_TOKEN',
+        message: 'pageToken is not one this API gave.',
+        fieldViolations: [
+            { field: 'pageToken', description: 'Not a page token of this list.' },
+        ],
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/server/kernel/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../server/kernel/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,+CAA+C;AAC/C,MAAM,UAAU,UAAU,CAAC,KAAoB;IAC7C,OAAO,IAAI,QAAQ,CAAC;QAClB,MAAM,EAAE,KAAK,CAAC,SAAS;QACvB,MAAM,EAAE,KAAK,CAAC,IAAI;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,UAAU,EAAE,KAAK,CAAC,MAA8B;QAChD,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAC3D,eAAe,CACb,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAC1D,OAAO,CACR,CAAC;AAEJ,uDAAuD;AACvD,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAK,CAAC;IAC7B,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,cAAc,CAC5B,OAAkE;IAElE,OAAO,IAAI,QAAQ,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,QAAiB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAAI,KAAa,EAAE,MAAoB;IACpE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC7D,CAAC;QACF,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,MAAM,cAAc,CAAC;QACnB,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,oBAAoB;QAC5B,OAAO,EAAE,qCAAqC;QAC9C,eAAe,EAAE;YACf,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,gCAAgC,EAAE;SACtE;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/server/kernel/ids.d.ts

@@ -0,0 +1,9 @@
+/** String ids for every record this plugin creates. */
+export interface IdSource {
+    next(): string;
+}
+/** Over the application's id generator (`idGeneratorToken` of `@nocobase/app-server/id-generator`). */
+export declare function createIdSource(generator: {
+    generateString(): string;
+}): IdSource;
+//# sourceMappingURL=ids.d.ts.map

package/dist/server/kernel/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../../server/kernel/ids.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,MAAM,WAAW,QAAQ;IACvB,IAAI,IAAI,MAAM,CAAC;CAChB;AAED,uGAAuG;AACvG,wBAAgB,cAAc,CAAC,SAAS,EAAE;IACxC,cAAc,IAAI,MAAM,CAAC;CAC1B,GAAG,QAAQ,CAEX"}

package/dist/server/kernel/ids.js

@@ -0,0 +1,5 @@
+/** Over the application's id generator (`idGeneratorToken` of `@nocobase/app-server/id-generator`). */
+export function createIdSource(generator) {
+    return { next: () => generator.generateString() };
+}
+//# sourceMappingURL=ids.js.map

package/dist/server/kernel/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../../server/kernel/ids.ts"],"names":[],"mappings":"AAKA,uGAAuG;AACvG,MAAM,UAAU,cAAc,CAAC,SAE9B;IACC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC;AACpD,CAAC"}

package/dist/server/kernel/people.d.ts

@@ -0,0 +1,28 @@
+/**
+ * People as this plugin shows them: names for owners and audit lines, whom to pick from when an agent is shared with
+ * some people, and who can no longer act (whose runners stop authenticating). The plugin keeps no users of its own;
+ * the application plugs its directory in (its members, say). Without one, people are shown by id, there is no one to
+ * pick and nobody is inactive.
+ */
+import type { DatabaseConnection } from '@nocobase/db';
+import type { UserRef } from '../../shared/agents.js';
+export interface PeopleSource {
+    names(conn: DatabaseConnection, ids: readonly string[]): Promise<ReadonlyMap<string, string>>;
+    list(conn: DatabaseConnection): Promise<readonly UserRef[]>;
+    /**
+     * Of `ids`, the people who can no longer act (an account disabled or deleted). A runner whose owner is among them
+     * stops authenticating. Without it, nobody is.
+     */
+    inactive?(conn: DatabaseConnection, ids: readonly string[]): Promise<ReadonlySet<string>>;
+}
+export interface People {
+    /** Sets the directory; returns what removes it. */
+    provide(source: PeopleSource): () => void;
+    /** The names of `ids` that the directory knows. */
+    names(conn: DatabaseConnection, ids: readonly (string | null | undefined)[]): Promise<ReadonlyMap<string, string>>;
+    list(conn: DatabaseConnection): Promise<readonly UserRef[]>;
+    /** Of `ids`, those the directory says can no longer act; none without a directory that says. */
+    inactive(conn: DatabaseConnection, ids: readonly (string | null | undefined)[]): Promise<ReadonlySet<string>>;
+}
+export declare function createPeople(): People;
+//# sourceMappingURL=people.d.ts.map

package/dist/server/kernel/people.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"people.d.ts","sourceRoot":"","sources":["../../../server/kernel/people.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,WAAW,YAAY;IAC3B,KAAK,CACH,IAAI,EAAE,kBAAkB,EACxB,GAAG,EAAE,SAAS,MAAM,EAAE,GACrB,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IAC5D;;;OAGG;IACH,QAAQ,CAAC,CACP,IAAI,EAAE,kBAAkB,EACxB,GAAG,EAAE,SAAS,MAAM,EAAE,GACrB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,MAAM;IACrB,mDAAmD;IACnD,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,IAAI,CAAC;IAC1C,mDAAmD;IACnD,KAAK,CACH,IAAI,EAAE,kBAAkB,EACxB,GAAG,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GAC1C,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IAC5D,gGAAgG;IAChG,QAAQ,CACN,IAAI,EAAE,kBAAkB,EACxB,GAAG,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GAC1C,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED,wBAAgB,YAAY,IAAI,MAAM,CAyBrC"}

package/dist/server/kernel/people.js

@@ -0,0 +1,30 @@
+export function createPeople() {
+    let source;
+    return {
+        provide(next) {
+            source = next;
+            return () => {
+                if (source === next)
+                    source = undefined;
+            };
+        },
+        async names(conn, ids) {
+            const wanted = [
+                ...new Set(ids.filter((id) => Boolean(id))),
+            ];
+            if (!source || wanted.length === 0)
+                return new Map();
+            return source.names(conn, wanted);
+        },
+        list: async (conn) => (source ? source.list(conn) : []),
+        async inactive(conn, ids) {
+            const wanted = [
+                ...new Set(ids.filter((id) => Boolean(id))),
+            ];
+            if (!source?.inactive || wanted.length === 0)
+                return new Set();
+            return source.inactive(conn, wanted);
+        },
+    };
+}
+//# sourceMappingURL=people.js.map

package/dist/server/kernel/people.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"people.js","sourceRoot":"","sources":["../../../server/kernel/people.ts"],"names":[],"mappings":"AA0CA,MAAM,UAAU,YAAY;IAC1B,IAAI,MAAgC,CAAC;IACrC,OAAO;QACL,OAAO,CAAC,IAAI;YACV,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,GAAG,EAAE;gBACV,IAAI,MAAM,KAAK,IAAI;oBAAE,MAAM,GAAG,SAAS,CAAC;YAC1C,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG;YACnB,MAAM,MAAM,GAAG;gBACb,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;aAC1D,CAAC;YACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YACrD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG;YACtB,MAAM,MAAM,GAAG;gBACb,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;aAC1D,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC"}