@nocobase/app-plugin-agents 0.0.0-stage → 0.1.0-beta.1

package/dist/server/kernel/redaction.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Redaction on the server: what runners report about runs and jobs (events, summaries, failure details, job logs) is
+ * redacted again before it is stored, with the protocol's redactor (`createRedactor` of `@nocobase/agent-protocol`).
+ * The runner redacts first; this catches a runner that does not (an older one), and the secrets the server handed out.
+ *
+ * Those secrets are remembered here when a run or job is claimed (its variables and run token, a job's opened
+ * variables, repository token and upload headers), in memory and for the most recent claims only: after a restart, or
+ * on another instance, the common patterns still apply, and so does the runner's own redaction. Credentials this
+ * plugin issues are recognised by their prefix in any case.
+ */
+import { type Redactor } from '@nocobase/agent-protocol';
+export interface SecretMemory {
+    /** The secrets handed out with a claim of `owner` (`run:<id>`, `job:<id>`), replacing earlier ones. */
+    remember(owner: string, secrets: Iterable<string | null | undefined>): void;
+    /** Forgets `owner`'s secrets once it ended. */
+    forget(owner: string): void;
+    /** A redactor for what `owner` reports: its secrets, when remembered, and the common patterns. */
+    redactor(owner: string): Redactor;
+}
+/** How many claims' secrets are kept at once; the oldest go first. */
+export declare const SECRET_MEMORY_LIMIT = 2000;
+export declare function createSecretMemory(limit?: number): SecretMemory;
+export declare const runSecretsKey: (runId: string) => string;
+export declare const jobSecretsKey: (jobId: string) => string;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/server/kernel/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../server/kernel/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEzE,MAAM,WAAW,YAAY;IAC3B,uGAAuG;IACvG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;IAC5E,+CAA+C;IAC/C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,kGAAkG;IAClG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAIxC,wBAAgB,kBAAkB,CAChC,KAAK,GAAE,MAA4B,GAClC,YAAY,CAmBd;AAED,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,MAAwB,CAAC;AACvE,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,MAAwB,CAAC"}

package/dist/server/kernel/redaction.js

@@ -0,0 +1,39 @@
+/**
+ * Redaction on the server: what runners report about runs and jobs (events, summaries, failure details, job logs) is
+ * redacted again before it is stored, with the protocol's redactor (`createRedactor` of `@nocobase/agent-protocol`).
+ * The runner redacts first; this catches a runner that does not (an older one), and the secrets the server handed out.
+ *
+ * Those secrets are remembered here when a run or job is claimed (its variables and run token, a job's opened
+ * variables, repository token and upload headers), in memory and for the most recent claims only: after a restart, or
+ * on another instance, the common patterns still apply, and so does the runner's own redaction. Credentials this
+ * plugin issues are recognised by their prefix in any case.
+ */
+import { createRedactor } from '@nocobase/agent-protocol';
+/** How many claims' secrets are kept at once; the oldest go first. */
+export const SECRET_MEMORY_LIMIT = 2000;
+const patternsOnly = createRedactor();
+export function createSecretMemory(limit = SECRET_MEMORY_LIMIT) {
+    const redactors = new Map();
+    return {
+        remember(owner, secrets) {
+            redactors.delete(owner);
+            const redactor = createRedactor(secrets);
+            if (redactor.secrets.length === 0)
+                return;
+            redactors.set(owner, redactor);
+            while (redactors.size > limit) {
+                const oldest = redactors.keys().next();
+                if (oldest.done)
+                    break;
+                redactors.delete(oldest.value);
+            }
+        },
+        forget(owner) {
+            redactors.delete(owner);
+        },
+        redactor: (owner) => redactors.get(owner) ?? patternsOnly,
+    };
+}
+export const runSecretsKey = (runId) => `run:${runId}`;
+export const jobSecretsKey = (jobId) => `job:${jobId}`;
+//# sourceMappingURL=redaction.js.map

package/dist/server/kernel/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../server/kernel/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAiB,MAAM,0BAA0B,CAAC;AAWzE,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;AAEtC,MAAM,UAAU,kBAAkB,CAChC,QAAgB,mBAAmB;IAEnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,OAAO;QACL,QAAQ,CAAC,KAAK,EAAE,OAAO;YACrB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAC1C,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC/B,OAAO,SAAS,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;gBACvC,IAAI,MAAM,CAAC,IAAI;oBAAE,MAAM;gBACvB,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK;YACV,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,YAAY;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC;AACvE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC"}

package/dist/server/kernel/scopes.d.ts

@@ -0,0 +1,34 @@
+import type { I18nText } from '../../shared/i18n.js';
+export declare const CORE_SCOPES: readonly ["agent", "workdir"];
+export type CoreScope = (typeof CORE_SCOPES)[number];
+/** A scope key: a short identifier, stored in `scope` columns of 32 characters. */
+export declare const SCOPE_KEY_PATTERN: RegExp;
+export interface ScopeAccess {
+    /** Whether the user may see the scope's settings. */
+    readonly visible: boolean;
+    /** Whether the user may change them. */
+    readonly manage: boolean;
+}
+export interface ScopeKind {
+    /** `SCOPE_KEY_PATTERN`; `agent` is reserved. */
+    readonly key: string;
+    readonly title: I18nText;
+    readonly description?: I18nText;
+    /** What `userId` may do with the scope `scopeId`; null when it does not exist. */
+    access(scopeId: string, userId: string): Promise<ScopeAccess | null>;
+}
+export interface ScopeKindRegistry {
+    /** Returns what removes the kind. A key has one kind. */
+    register(kind: ScopeKind): () => void;
+    get(key: string): ScopeKind | undefined;
+    /** The registered kinds in the order they were registered, `workdir` last. */
+    list(): readonly ScopeKind[];
+    /** The scope keys values may be kept under now: `agent`, `workdir` and the registered ones. */
+    keys(): readonly string[];
+    /** What `userId` may do with the scope; null when it does not exist or no kind decides. */
+    access(scope: string, scopeId: string, userId: string): Promise<ScopeAccess | null>;
+}
+/** `workdir` as people read it when the application gives it no title of its own. */
+export declare const WORKDIR_TITLE: I18nText;
+export declare function createScopeKinds(): ScopeKindRegistry;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/server/kernel/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../../server/kernel/scopes.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,eAAO,MAAM,WAAW,+BAAgC,CAAC;AAEzD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,EAAE,MAAoC,CAAC;AAErE,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;IAChC,kFAAkF;IAClF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,IAAI,CAAC;IACtC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IACxC,8EAA8E;IAC9E,IAAI,IAAI,SAAS,SAAS,EAAE,CAAC;IAC7B,+FAA+F;IAC/F,IAAI,IAAI,SAAS,MAAM,EAAE,CAAC;IAC1B,2FAA2F;IAC3F,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CAChC;AAED,qFAAqF;AACrF,eAAO,MAAM,aAAa,EAAE,QAG3B,CAAC;AAEF,wBAAgB,gBAAgB,IAAI,iBAAiB,CA0BpD"}

package/dist/server/kernel/scopes.js

@@ -0,0 +1,47 @@
+/**
+ * The scopes variables and default skills are kept in, besides an agent's own. This plugin knows two keys:
+ *
+ * - `agent`: an agent's own; reserved, decided by `agents.agents` permissions;
+ * - `workdir`: a working directory a run works in (`SubjectDir.scopeId`), a git checkout or a plain directory.
+ *
+ * Everything else is the application's: it registers a kind for each scope its subjects name (`SubjectAssembly.scopes`,
+ * such as the group a run's subject belongs to), with its title and who may see and change what is kept there. An
+ * application registers `workdir` too, to say who may see and change a working directory's; without a registered kind,
+ * nobody may.
+ */
+import { ACCESS_NAMESPACE } from '../../shared/access.js';
+export const CORE_SCOPES = ['agent', 'workdir'];
+/** A scope key: a short identifier, stored in `scope` columns of 32 characters. */
+export const SCOPE_KEY_PATTERN = /^[a-z][A-Za-z0-9]{1,31}$/u;
+/** `workdir` as people read it when the application gives it no title of its own. */
+export const WORKDIR_TITLE = {
+    key: 'scopes.workdir',
+    ns: ACCESS_NAMESPACE,
+};
+export function createScopeKinds() {
+    const kinds = new Map();
+    return {
+        register(kind) {
+            if (kind.key === 'agent' || !SCOPE_KEY_PATTERN.test(kind.key))
+                throw new Error(`Not a scope key an application may register: ${kind.key}`);
+            if (kinds.has(kind.key))
+                throw new Error(`Scope kind already registered: ${kind.key}`);
+            kinds.set(kind.key, kind);
+            return () => {
+                if (kinds.get(kind.key) === kind)
+                    kinds.delete(kind.key);
+            };
+        },
+        get: (key) => kinds.get(key),
+        list: () => [
+            ...[...kinds.values()].filter((kind) => kind.key !== 'workdir'),
+            ...[...kinds.values()].filter((kind) => kind.key === 'workdir'),
+        ],
+        keys: () => [...new Set([...CORE_SCOPES, ...kinds.keys()])],
+        access: async (scope, scopeId, userId) => {
+            const kind = kinds.get(scope);
+            return kind ? kind.access(scopeId, userId) : null;
+        },
+    };
+}
+//# sourceMappingURL=scopes.js.map

package/dist/server/kernel/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../../server/kernel/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,SAAS,CAAU,CAAC;AAIzD,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAW,2BAA2B,CAAC;AAkCrE,qFAAqF;AACrF,MAAM,CAAC,MAAM,aAAa,GAAa;IACrC,GAAG,EAAE,gBAAgB;IACrB,EAAE,EAAE,gBAAgB;CACrB,CAAC;AAEF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,OAAO;QACL,QAAQ,CAAC,IAAI;YACX,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC3D,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,GAAG,EAAE,CAC3D,CAAC;YACJ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1B,OAAO,GAAG,EAAE;gBACV,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;oBAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3D,CAAC,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,GAAG,EAAE,CAAC;YACV,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;YAC/D,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;SAChE;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/kernel/secrets.d.ts

@@ -0,0 +1,12 @@
+import type { SecretsService } from '@nocobase/app-server/secrets';
+export declare const VARIABLES_SECRET_PURPOSE = "@nocobase/app-plugin-agents/variables";
+export declare const MODEL_SERVICE_KEY_SECRET_PURPOSE = "@nocobase/app-plugin-agents/model-service-keys";
+/** What the plugin needs of the secrets service. */
+export type AgentsSecrets = Pick<SecretsService, 'ready' | 'seal' | 'open'>;
+/** Seals and opens values of one purpose, each bound to its record by `aad`. */
+export interface Sealer {
+    seal(plaintext: string, aad: readonly string[]): string;
+    open(sealed: string, aad: readonly string[]): string;
+}
+export declare function createSealer(secrets: AgentsSecrets | undefined, purpose: string): Sealer;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/server/kernel/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../server/kernel/secrets.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,eAAO,MAAM,wBAAwB,0CAA0C,CAAC;AAChF,eAAO,MAAM,gCAAgC,mDACK,CAAC;AAEnD,oDAAoD;AACpD,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;AAE5E,gFAAgF;AAChF,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC;CACtD;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GACd,MAAM,CAaR"}

package/dist/server/kernel/secrets.js

@@ -0,0 +1,20 @@
+/**
+ * Values the server must read back to deliver them — variables, model service keys — sealed with the application's
+ * secrets service (`secrets.keys`), each bound to the record it belongs to. Without keys, storing or reading one fails
+ * with `SECRETS_KEY_MISSING` (503), which says what to configure.
+ */
+import { ProtocolError } from '@nocobase/agent-protocol';
+export const VARIABLES_SECRET_PURPOSE = '@nocobase/app-plugin-agents/variables';
+export const MODEL_SERVICE_KEY_SECRET_PURPOSE = '@nocobase/app-plugin-agents/model-service-keys';
+export function createSealer(secrets, purpose) {
+    const ready = () => {
+        if (!secrets?.ready)
+            throw new ProtocolError('SECRETS_KEY_MISSING', 'Secrets need a key: set secrets.keys in the application configuration, or SECRETS_KEYS in the environment.');
+        return secrets;
+    };
+    return {
+        seal: (plaintext, aad) => ready().seal(plaintext, { purpose, aad }),
+        open: (sealed, aad) => ready().open(sealed, { purpose, aad }),
+    };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/server/kernel/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../server/kernel/secrets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,uCAAuC,CAAC;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,gDAAgD,CAAC;AAWnD,MAAM,UAAU,YAAY,CAC1B,OAAkC,EAClC,OAAe;IAEf,MAAM,KAAK,GAAG,GAAkB,EAAE;QAChC,IAAI,CAAC,OAAO,EAAE,KAAK;YACjB,MAAM,IAAI,aAAa,CACrB,qBAAqB,EACrB,4GAA4G,CAC7G,CAAC;QACJ,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QACnE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC"}

package/dist/server/kernel/tx.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Units of work. A transaction collects the events its writes announce and publishes them only after it commits, so a
+ * listener never sees a change that was rolled back.
+ */
+import type { DatabaseConnection, DatabaseManager } from '@nocobase/db';
+import type { AgentsEvent, AgentsEventBus } from './events.js';
+export interface Tx {
+    readonly conn: DatabaseConnection;
+    readonly emit: (event: AgentsEvent) => void;
+}
+export interface TxRunner {
+    /** Runs `fn` in a transaction; with `outer`, joins that unit of work and publishes when it commits. */
+    run<T>(fn: (tx: Tx) => Promise<T>, outer?: Tx): Promise<T>;
+    /** The connection for reads outside a transaction. */
+    read(): DatabaseConnection;
+}
+export declare function createTxRunner(database: Pick<DatabaseManager, 'transaction' | 'connection'>, bus: Pick<AgentsEventBus, 'emit'>): TxRunner;
+//# sourceMappingURL=tx.d.ts.map

package/dist/server/kernel/tx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tx.d.ts","sourceRoot":"","sources":["../../../server/kernel/tx.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAExE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,WAAW,EAAE;IACjB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,QAAQ;IACvB,uGAAuG;IACvG,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,sDAAsD;IACtD,IAAI,IAAI,kBAAkB,CAAC;CAC5B;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,GAAG,YAAY,CAAC,EAC7D,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,GAChC,QAAQ,CAaV"}

package/dist/server/kernel/tx.js

@@ -0,0 +1,15 @@
+export function createTxRunner(database, bus) {
+    return {
+        async run(fn, outer) {
+            if (outer)
+                return fn(outer);
+            const pending = [];
+            const result = await database.transaction((conn) => fn({ conn, emit: (event) => pending.push(event) }));
+            for (const event of pending)
+                bus.emit(event);
+            return result;
+        },
+        read: () => database.connection(),
+    };
+}
+//# sourceMappingURL=tx.js.map

package/dist/server/kernel/tx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tx.js","sourceRoot":"","sources":["../../../server/kernel/tx.ts"],"names":[],"mappings":"AAoBA,MAAM,UAAU,cAAc,CAC5B,QAA6D,EAC7D,GAAiC;IAEjC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK;YACjB,IAAI,KAAK;gBAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAkB,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CACjD,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CACnD,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE;KAClC,CAAC;AACJ,CAAC"}

package/dist/server/kernel/values.d.ts

@@ -0,0 +1,19 @@
+/** Reading column values defensively: JSON columns may hold anything an older version wrote. */
+/** The strings in a JSON array column; anything else reads as empty. */
+export declare function stringArray(value: unknown): string[];
+/** Trimmed, non-empty and unique, in order. */
+export declare function cleanList(values: readonly string[]): string[];
+/** Whether every item of `wanted` is in `available`. */
+export declare function covers(available: readonly string[], wanted: readonly string[]): boolean;
+/** A JSON object column, or an empty object. */
+export declare function jsonObject(value: unknown): Record<string, unknown>;
+/** What a JSON column holds. */
+export type JsonColumn = string | number | boolean | null | readonly unknown[] | Readonly<Record<string, unknown>>;
+/** `value` as a JSON column value: plain JSON as is, anything else through a JSON round trip. */
+export declare function asJson(value: unknown): JsonColumn;
+/** `text` cut to at most `bytes` of UTF-8, and whether it was cut. */
+export declare function truncateBytes(text: string, bytes: number): {
+    text: string;
+    truncated: boolean;
+};
+//# sourceMappingURL=values.d.ts.map

package/dist/server/kernel/values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../../server/kernel/values.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAEhG,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAUpD;AAED,+CAA+C;AAC/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAO7D;AAED,wDAAwD;AACxD,wBAAgB,MAAM,CACpB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAGT;AAED,gDAAgD;AAChD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWlE;AAED,gCAAgC;AAChC,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,OAAO,EAAE,GAClB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC,iGAAiG;AACjG,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAUjD;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAMtC"}

package/dist/server/kernel/values.js

@@ -0,0 +1,64 @@
+/** Reading column values defensively: JSON columns may hold anything an older version wrote. */
+/** The strings in a JSON array column; anything else reads as empty. */
+export function stringArray(value) {
+    if (typeof value === 'string') {
+        try {
+            return stringArray(JSON.parse(value));
+        }
+        catch {
+            return [];
+        }
+    }
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((item) => typeof item === 'string');
+}
+/** Trimmed, non-empty and unique, in order. */
+export function cleanList(values) {
+    const seen = new Set();
+    for (const value of values) {
+        const trimmed = value.trim();
+        if (trimmed)
+            seen.add(trimmed);
+    }
+    return [...seen];
+}
+/** Whether every item of `wanted` is in `available`. */
+export function covers(available, wanted) {
+    const set = new Set(available);
+    return wanted.every((item) => set.has(item));
+}
+/** A JSON object column, or an empty object. */
+export function jsonObject(value) {
+    if (typeof value === 'string') {
+        try {
+            return jsonObject(JSON.parse(value));
+        }
+        catch {
+            return {};
+        }
+    }
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+/** `value` as a JSON column value: plain JSON as is, anything else through a JSON round trip. */
+export function asJson(value) {
+    if (value === undefined)
+        return null;
+    if (value === null ||
+        typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean')
+        return value;
+    return JSON.parse(JSON.stringify(value));
+}
+/** `text` cut to at most `bytes` of UTF-8, and whether it was cut. */
+export function truncateBytes(text, bytes) {
+    if (Buffer.byteLength(text, 'utf8') <= bytes)
+        return { text, truncated: false };
+    const cut = Buffer.from(text, 'utf8').subarray(0, bytes).toString('utf8');
+    // A cut inside a multi-byte character decodes to U+FFFD at the end; drop it.
+    return { text: cut.replace(/\uFFFD$/u, ''), truncated: true };
+}
+//# sourceMappingURL=values.js.map

package/dist/server/kernel/values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.js","sourceRoot":"","sources":["../../../server/kernel/values.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAEhG,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,SAAS,CAAC,MAAyB;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,MAAM,CACpB,SAA4B,EAC5B,MAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAWD,iGAAiG;AACjG,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS;QAE1B,OAAO,KAAK,CAAC;IACf,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAe,CAAC;AACzD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,KAAa;IAEb,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK;QAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1E,6EAA6E;IAC7E,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAChE,CAAC"}

package/dist/server/locales/en-US.d.ts

@@ -0,0 +1,4 @@
+import accessEnUS from '../../shared/locales/access.en-US.js';
+declare const enUS: typeof accessEnUS;
+export default enUS;
+//# sourceMappingURL=en-US.d.ts.map

package/dist/server/locales/en-US.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"en-US.d.ts","sourceRoot":"","sources":["../../../server/locales/en-US.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,sCAAsC,CAAC;AAE9D,QAAA,MAAM,IAAI,EAAE,OAAO,UAElB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/server/locales/en-US.js

@@ -0,0 +1,6 @@
+import accessEnUS from '../../shared/locales/access.en-US.js';
+const enUS = {
+    ...accessEnUS,
+};
+export default enUS;
+//# sourceMappingURL=en-US.js.map

package/dist/server/locales/en-US.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"en-US.js","sourceRoot":"","sources":["../../../server/locales/en-US.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,sCAAsC,CAAC;AAE9D,MAAM,IAAI,GAAsB;IAC9B,GAAG,UAAU;CACd,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/server/locales/index.d.ts

@@ -0,0 +1,4 @@
+import type { LocaleLoaders } from '@nocobase/i18n';
+declare const locales: LocaleLoaders;
+export default locales;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/locales/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/locales/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,QAAA,MAAM,OAAO,EAAE,aAGd,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/dist/server/locales/index.js

@@ -0,0 +1,6 @@
+const locales = {
+    'en-US': () => import('./en-US.js'),
+    'zh-CN': () => import('./zh-CN.js'),
+};
+export default locales;
+//# sourceMappingURL=index.js.map

package/dist/server/locales/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/locales/index.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,GAAkB;IAC7B,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;IACnC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;CACpC,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/dist/server/locales/zh-CN.d.ts

@@ -0,0 +1,4 @@
+import accessZhCN from '../../shared/locales/access.zh-CN.js';
+declare const zhCN: typeof accessZhCN;
+export default zhCN;
+//# sourceMappingURL=zh-CN.d.ts.map

package/dist/server/locales/zh-CN.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zh-CN.d.ts","sourceRoot":"","sources":["../../../server/locales/zh-CN.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,sCAAsC,CAAC;AAE9D,QAAA,MAAM,IAAI,EAAE,OAAO,UAElB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/server/locales/zh-CN.js

@@ -0,0 +1,6 @@
+import accessZhCN from '../../shared/locales/access.zh-CN.js';
+const zhCN = {
+    ...accessZhCN,
+};
+export default zhCN;
+//# sourceMappingURL=zh-CN.js.map

package/dist/server/locales/zh-CN.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zh-CN.js","sourceRoot":"","sources":["../../../server/locales/zh-CN.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,sCAAsC,CAAC;AAE9D,MAAM,IAAI,GAAsB;IAC9B,GAAG,UAAU;CACd,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/server/online/cli-command.d.ts

@@ -0,0 +1,20 @@
+import type { CliCommand } from '@nocobase/app-server/router';
+import { type Command } from '../vendor/just-bash.js';
+/** What the shell's `acme` reaches: the run's commands, and the application answering them as the run. */
+export interface CommandSurface {
+    /** The command's name, such as `acme`. */
+    readonly bin: string;
+    readonly commands: readonly CliCommand[];
+    /**
+     * Sends a request as the run; `path` is the command's, below the server's origin. A JSON body is a string; a
+     * `multipart/form-data` body is a form, whose content type the request sets.
+     */
+    send(request: {
+        readonly method: string;
+        readonly path: string;
+        readonly body?: string | FormData;
+    }): Promise<Response>;
+}
+/** The `acme` command of a run's shell. */
+export declare function cliCommand(surface: CommandSurface): Command;
+//# sourceMappingURL=cli-command.d.ts.map

package/dist/server/online/cli-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-command.d.ts","sourceRoot":"","sources":["../../../server/online/cli-command.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAM9D,OAAO,EAEL,KAAK,OAAO,EAGb,MAAM,wBAAwB,CAAC;AAEhC,0GAA0G;AAC1G,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;IACzC;;;OAGG;IACH,IAAI,CAAC,OAAO,EAAE;QACZ,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;KACnC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACvB;AAiSD,2CAA2C;AAC3C,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAqH3D"}