@nocobase/app-plugin-agents 0.0.0-stage → 0.1.0-beta.1

package/dist/server/routes/runners/admin.js

@@ -0,0 +1,280 @@
+/**
+ * The people-facing runners API, mounted at `/api/agents/runners` beside the runner protocol (`runner.ts`): runners
+ * and registration tokens. Every route is behind the guard the route contribution passes (a signed-in user and their
+ * authorization context); what each caller may do is checked here.
+ *
+ * - `agents.runners` read/manage: every runner; adding a team runner, changing, revoking and deleting any runner.
+ *   Anyone signed in may add a personal runner and manage their own runners, including sharing one with the team and
+ *   choosing which coding tools it runs. Reading agents (`agents.agents` read) also shows every runner, to pick where
+ *   an agent runs.
+ * - A runner's page: whoever sees a runner sees which agents it takes (`takes`), what it holds now
+ *   (`GET /agents/runners/:runnerId/work`: its runs as the caller may see them, then its jobs) and its latest runs
+ *   (`GET /agents/runners/:runnerId/runs`). What identifies its machine (its host name, where its tools are installed)
+ *   its owner, the managers of runners and anyone who may wake at least one agent see; everyone else sees neither
+ *   (`runnerForViewer`).
+ */
+import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION, } from '@nocobase/agent-protocol';
+import { apiErrorResponse, apiErrorResponses, apiValidator, cliRoute, dataResponse, describeRoute, emptyResponse, listResponse, } from '@nocobase/app-server/router';
+import { runnerForViewer } from '../../core/runs/runner-view.js';
+import { upgradeFor } from '../../distribution/index.js';
+import { forbidden, notFound } from '../../kernel/errors.js';
+import { domainRouter } from '../../kernel/http.js';
+import { tags } from '../openapi.js';
+import { RegistrationTokenInputSchema, RegistrationTokenSchema, RunnerHeldItemSchema, RunnerParams, RunnerPatchInput, RunnerRecentRunSchema, RunnerSchema, RunnerSummarySchema, } from '../schemas.js';
+function caller(context) {
+    return context.get('caller');
+}
+/**
+ * `guard` authenticates the request and sets `caller`; the route contribution installs the real one, tests a fake.
+ */
+export function createAdminRoutes(services, guard) {
+    const router = domainRouter();
+    const runnerParam = apiValidator('param', RunnerParams);
+    const notVisible = apiErrorResponse(404, 'The runner does not exist, or the caller may not see it.');
+    const manageErrors = {
+        ...apiErrorResponses,
+        403: apiErrorResponse(403, "Only the runner's owner or a manager of runners (`agents.runners` manage) may change it."),
+        404: notVisible,
+    };
+    /** Whether the caller sees every runner: `agents.runners` read, or `agents.agents` read (to pick where one runs). */
+    const seesEveryRunner = async (who) => (await who.can('agents.runners', 'read')) ||
+        (await who.can('agents.agents', 'read'));
+    /** Whether the caller may wake at least one agent; asked once per request. */
+    const usesAgents = new WeakMap();
+    const mayUseAgents = (who) => {
+        let found = usesAgents.get(who);
+        if (!found) {
+            found = services.agents
+                .list()
+                .then((agents) => agents.some((agent) => services.agents.mayInvoke(agent, who.userId)));
+            usesAgents.set(who, found);
+        }
+        return found;
+    };
+    /** What the caller may do with a runner, or 404 when they may not see it. */
+    const runnerRights = async (context, runner) => {
+        const who = caller(context);
+        const own = runner.ownerUserId === who.userId;
+        const manage = own || (await who.can('agents.runners', 'manage'));
+        const see = manage || (await seesEveryRunner(who));
+        const machine = manage || (see && (await mayUseAgents(who)));
+        return { see, manage, machine };
+    };
+    /** The agents each runner takes. */
+    const takesOf = async (runners) => runners.length > 0
+        ? services.runnerView.takes(runners)
+        : new Map();
+    const summarizeRunner = async (context, runner, takes) => {
+        const rights = await runnerRights(context, runner);
+        const held = await services.slots.held(services.tx.read(), runner.id);
+        return {
+            ...runnerForViewer(runner, rights.machine),
+            activeRuns: held.runs,
+            activeJobs: held.jobs,
+            activeByTool: held.byTool ?? {},
+            takes: takes.get(runner.id) ?? [],
+            canManage: rights.manage,
+            canChangeTrust: rights.manage,
+            updateVersion: (await upgradeFor(services.dist, runner))?.latestVersion ?? null,
+            requiredProtocol: { min: MIN_PROTOCOL_VERSION, max: PROTOCOL_VERSION },
+            offersJobs: services.jobs.kinds().length > 0,
+        };
+    };
+    const manageableRunner = async (context) => {
+        const runner = await services.runners.get(context.req.param('runnerId') ?? '');
+        const rights = await runnerRights(context, runner);
+        if (!rights.see)
+            throw notFound('Runner');
+        if (!rights.manage)
+            throw forbidden("Only the runner's owner or a manager of runners may change it.");
+        return runner;
+    };
+    // Runners.
+    /** The runner named in the path, or 404 when the caller may not see it. */
+    const visibleRunner = async (context) => {
+        const runner = await services.runners.get(context.req.param('runnerId') ?? '');
+        if (!(await runnerRights(context, runner)).see)
+            throw notFound('Runner');
+        return runner;
+    };
+    router.get('/', guard, describeRoute({
+        tags,
+        summary: 'List runners',
+        operationId: 'agentsListRunners',
+        ...cliRoute({
+            command: 'runtime list',
+            columns: ['id', 'name', 'status', 'ownerName', 'trust', 'activeRuns'],
+        }),
+        description: "Every runner for a reader of runners or of agents (`agents.runners` or `agents.agents` read); otherwise the caller's own.",
+        responses: {
+            200: listResponse(RunnerSummarySchema),
+            ...apiErrorResponses,
+        },
+    }), async (context) => {
+        const visible = [];
+        for (const runner of await services.runners.list())
+            if ((await runnerRights(context, runner)).see)
+                visible.push(runner);
+        const takes = await takesOf(visible);
+        const data = [];
+        for (const runner of visible)
+            data.push(await summarizeRunner(context, runner, takes));
+        return context.json({ data, meta: { total: data.length } });
+    });
+    router.post('/registrationTokens', guard, describeRoute({
+        tags,
+        summary: 'Create a runner registration token',
+        operationId: 'agentsCreateRunnerRegistrationToken',
+        ...cliRoute({
+            command: 'runtime token create',
+            examples: ['runtime token create --trust team'],
+        }),
+        description: 'A one-time token the install script registers a runner with; the token is shown only in this answer. Anyone signed in may add a personal runner; a runner shared with the team (`trust: team`) needs `agents.runners` manage.',
+        responses: {
+            201: dataResponse(RegistrationTokenSchema, 'Created.'),
+            ...apiErrorResponses,
+        },
+    }), apiValidator('json', RegistrationTokenInputSchema), async (context) => {
+        const who = caller(context);
+        const input = context.req.valid('json');
+        if (input.trust === 'team' &&
+            !(await who.can('agents.runners', 'manage')))
+            throw forbidden('Adding a runner shared with the team needs agents.runners manage permission.');
+        return context.json({
+            data: await services.runners.createRegistrationToken(who.userId, input),
+        }, 201);
+    });
+    router.get('/:runnerId', guard, describeRoute({
+        tags,
+        summary: 'Get a runner',
+        operationId: 'agentsGetRunner',
+        ...cliRoute({
+            command: 'runtime get',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+        }),
+        responses: {
+            200: dataResponse(RunnerSummarySchema),
+            ...apiErrorResponses,
+            404: notVisible,
+        },
+    }), runnerParam, async (context) => {
+        const runner = await visibleRunner(context);
+        return context.json({
+            data: await summarizeRunner(context, runner, await takesOf([runner])),
+        });
+    });
+    /** What the runner holds now: its runs, then its jobs. */
+    router.get('/:runnerId/work', guard, describeRoute({
+        tags,
+        summary: 'List the work a runner holds',
+        operationId: 'agentsListRunnerWork',
+        ...cliRoute({
+            command: 'runtime work',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+            columns: ['id', 'kind', 'title', 'status', 'startedAt'],
+        }),
+        description: 'Its runs as the caller may see them, then its jobs, while they are dispatched or running.',
+        responses: {
+            200: listResponse(RunnerHeldItemSchema),
+            ...apiErrorResponses,
+            404: notVisible,
+        },
+    }), runnerParam, async (context) => {
+        const runner = await visibleRunner(context);
+        const runs = await services.runnerView.held(runner, caller(context).userId);
+        const jobs = (await services.jobs.list({ runnerId: runner.id, limit: 200 })).filter((job) => job.status === 'dispatched' || job.status === 'running');
+        const data = [
+            ...runs,
+            ...jobs.map((job) => ({
+                id: job.id,
+                kind: 'job',
+                title: job.title ?? job.kind,
+                status: job.status,
+                startedAt: job.startedAt ?? job.dispatchedAt,
+                path: null,
+            })),
+        ];
+        return context.json({ data, meta: { total: data.length } });
+    });
+    router.get('/:runnerId/runs', guard, describeRoute({
+        tags,
+        summary: "List a runner's recent runs",
+        operationId: 'agentsListRunnerRuns',
+        ...cliRoute({
+            command: 'runtime runs',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+            columns: ['id', 'title', 'status', 'createdAt'],
+        }),
+        description: 'Its latest runs whatever their status, newest first, without the link of a private run the caller is not part of.',
+        responses: {
+            200: listResponse(RunnerRecentRunSchema),
+            ...apiErrorResponses,
+            404: notVisible,
+        },
+    }), runnerParam, async (context) => {
+        const runner = await visibleRunner(context);
+        const data = await services.runnerView.recent(runner, caller(context).userId);
+        return context.json({ data, meta: { total: data.length } });
+    });
+    router.patch('/:runnerId', guard, describeRoute({
+        tags,
+        summary: 'Update a runner',
+        operationId: 'agentsUpdateRunner',
+        ...cliRoute({
+            command: 'runtime update',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+        }),
+        responses: { 200: dataResponse(RunnerSchema), ...manageErrors },
+    }), runnerParam, async (context, next) => {
+        context.set('runnerToManage', await manageableRunner(context));
+        await next();
+    }, apiValidator('json', RunnerPatchInput), async (context) => context.json({
+        data: await services.runners.update(context.get('runnerToManage').id, context.req.valid('json')),
+    }));
+    router.post('/:runnerId/revoke', guard, describeRoute({
+        tags,
+        summary: 'Revoke a runner',
+        operationId: 'agentsRevokeRunner',
+        ...cliRoute({
+            command: 'runtime revoke',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+            confirm: 'Revoke this runtime? It stops taking work and must register again.',
+        }),
+        description: 'Revokes the runner and its keys; the runs and jobs it held go back to the queue.',
+        responses: { 200: dataResponse(RunnerSchema), ...manageErrors },
+    }), runnerParam, async (context) => {
+        const runner = await manageableRunner(context);
+        const revoked = await services.runners.revoke(runner.id);
+        // What it held goes back to the queue now rather than at the next sweep.
+        await services.sweeper.sweep();
+        return context.json({ data: revoked });
+    });
+    router.delete('/:runnerId', guard, describeRoute({
+        tags,
+        summary: 'Delete a runner',
+        operationId: 'agentsDeleteRunner',
+        ...cliRoute({
+            command: 'runtime delete',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+            confirm: 'Delete this runtime?',
+        }),
+        description: 'Deletes a revoked runner; its past runs keep its id.',
+        responses: {
+            204: emptyResponse(),
+            ...manageErrors,
+            400: apiErrorResponse(400, 'The runner is not revoked (`RUNNER_NOT_REVOKED`).'),
+        },
+    }), runnerParam, async (context) => {
+        const runner = await manageableRunner(context);
+        await services.runners.remove(runner.id);
+        return context.body(null, 204);
+    });
+    return router;
+}
+//# sourceMappingURL=admin.js.map

package/dist/server/routes/runners/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../../server/routes/runners/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,GACb,MAAM,6BAA6B,CAAC;AAWrC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAYvB,SAAS,MAAM,CAAC,OAA0B;IACxC,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,KAAkC;IAElC,MAAM,MAAM,GAAG,YAAY,EAAY,CAAC;IACxC,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,gBAAgB,CACjC,GAAG,EACH,0DAA0D,CAC3D,CAAC;IACF,MAAM,YAAY,GAAG;QACnB,GAAG,iBAAiB;QACpB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,0FAA0F,CAC3F;QACD,GAAG,EAAE,UAAU;KAChB,CAAC;IAEF,qHAAqH;IACrH,MAAM,eAAe,GAAG,KAAK,EAAE,GAAgB,EAAoB,EAAE,CACnE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IAE3C,8EAA8E;IAC9E,MAAM,UAAU,GAAG,IAAI,OAAO,EAAiC,CAAC;IAChE,MAAM,YAAY,GAAG,CAAC,GAAgB,EAAoB,EAAE;QAC1D,IAAI,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,QAAQ,CAAC,MAAM;iBACpB,IAAI,EAAE;iBACN,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACf,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CACrE,CAAC;YACJ,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,6EAA6E;IAC7E,MAAM,YAAY,GAAG,KAAK,EACxB,OAA0B,EAC1B,MAAc,EAKb,EAAE;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,KAAK,GAAG,CAAC,MAAM,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC,CAAC;IAEF,oCAAoC;IACpC,MAAM,OAAO,GAAG,KAAK,EACnB,OAA0B,EACiC,EAAE,CAC7D,OAAO,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QACpC,CAAC,CAAC,IAAI,GAAG,EAAuC,CAAC;IAErD,MAAM,eAAe,GAAG,KAAK,EAC3B,OAA0B,EAC1B,MAAc,EACd,KAAuD,EAC/B,EAAE;QAC1B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO;YACL,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,YAAY,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YAC/B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;YACjC,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,aAAa,EACX,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,aAAa,IAAI,IAAI;YAClE,gBAAgB,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,gBAAgB,EAAE;YACtE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,CAAC;SAC7C,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAC5B,OAA0B,EACT,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CACpC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,MAAM;YAChB,MAAM,SAAS,CACb,gEAAgE,CACjE,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,WAAW;IACX,2EAA2E;IAC3E,MAAM,aAAa,GAAG,KAAK,EAAE,OAA0B,EAAmB,EAAE;QAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CACpC,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,GAAG,EACH,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,cAAc;QACvB,WAAW,EAAE,mBAAmB;QAChC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC;SACtE,CAAC;QACF,WAAW,EACT,2HAA2H;QAC7H,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,mBAAmB,CAAC;YACtC,GAAG,iBAAiB;SACrB;KACF,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;YAChD,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO;YAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EAAE,qCAAqC;QAClD,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,sBAAsB;YAC/B,QAAQ,EAAE,CAAC,mCAAmC,CAAC;SAChD,CAAC;QACF,WAAW,EACT,+NAA+N;QACjO,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,uBAAuB,EAAE,UAAU,CAAC;YACtD,GAAG,iBAAiB;SACrB;KACF,CAAC,EACF,YAAY,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAClD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,IACE,KAAK,CAAC,KAAK,KAAK,MAAM;YACtB,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAE5C,MAAM,SAAS,CACb,8EAA8E,CAC/E,CAAC;QACJ,OAAO,OAAO,CAAC,IAAI,CACjB;YACE,IAAI,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CAClD,GAAG,CAAC,MAAM,EACV,KAAK,CACN;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CACF,CAAC;IACF,MAAM,CAAC,GAAG,CACR,YAAY,EACZ,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,cAAc;QACvB,WAAW,EAAE,iBAAiB;QAC9B,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;SACzC,CAAC;QACF,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,mBAAmB,CAAC;YACtC,GAAG,iBAAiB;YACpB,GAAG,EAAE,UAAU;SAChB;KACF,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACtE,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IACF,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CACR,iBAAiB,EACjB,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,sBAAsB;QACnC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YACxC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC;SACxD,CAAC;QACF,WAAW,EACT,2FAA2F;QAC7F,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,oBAAoB,CAAC;YACvC,GAAG,iBAAiB;YACpB,GAAG,EAAE,UAAU;SAChB;KACF,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CACzC,MAAM,EACN,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CACvB,CAAC;QACF,MAAM,IAAI,GAAG,CACX,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAC9D,CAAC,MAAM,CACN,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CACjE,CAAC;QACF,MAAM,IAAI,GAAqB;YAC7B,GAAG,IAAI;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,KAAc;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI;gBAC5B,MAAM,EAAE,GAAG,CAAC,MAAkC;gBAC9C,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,YAAY;gBAC5C,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;SACJ,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,MAAM,CAAC,GAAG,CACR,iBAAiB,EACjB,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,sBAAsB;QACnC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YACxC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC;SAChD,CAAC;QACF,WAAW,EACT,mHAAmH;QACrH,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,qBAAqB,CAAC;YACxC,GAAG,iBAAiB;YACpB,GAAG,EAAE,UAAU;SAChB;KACF,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,CAC3C,MAAM,EACN,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CACvB,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,MAAM,CAAC,KAAK,CACV,YAAY,EACZ,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EAAE,oBAAoB;QACjC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;SACzC,CAAC;QACF,SAAS,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,YAAY,CAAC,EAAE,GAAG,YAAY,EAAE;KAChE,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,EACD,YAAY,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACtC,KAAK,EAAE,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CACjC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAC1B;KACF,CAAC,CACL,CAAC;IACF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EAAE,oBAAoB;QACjC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YACxC,OAAO,EACL,oEAAoE;SACvE,CAAC;QACF,WAAW,EACT,kFAAkF;QACpF,SAAS,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,YAAY,CAAC,EAAE,GAAG,YAAY,EAAE;KAChE,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,yEAAyE;QACzE,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACzC,CAAC,CACF,CAAC;IACF,MAAM,CAAC,MAAM,CACX,YAAY,EACZ,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EAAE,oBAAoB;QACjC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YACxC,OAAO,EAAE,sBAAsB;SAChC,CAAC;QACF,WAAW,EAAE,sDAAsD;QACnE,SAAS,EAAE;YACT,GAAG,EAAE,aAAa,EAAE;YACpB,GAAG,YAAY;YACf,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,mDAAmD,CACpD;SACF;KACF,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/runners/dist.d.ts

@@ -0,0 +1,20 @@
+import { type DistArtifact } from '@nocobase/agent-protocol';
+import type { Hono, MiddlewareHandler } from 'hono';
+import type { Agents } from '../../composition.js';
+import type { AdminEnv } from './admin.js';
+export interface DistRoutesOptions {
+    /**
+     * Lets a signed-in person through when the request carries neither a runner key nor a registration token; it
+     * answers 401 itself otherwise. Without it only runners and the install script may download.
+     */
+    readonly authenticatePerson?: MiddlewareHandler;
+    /**
+     * Authenticates a person and sets `caller`, for minting a download token; without it no one can mint one. The route
+     * contribution passes the people guard (scoped keys refused), tests a fake.
+     */
+    readonly person?: MiddlewareHandler<AdminEnv>;
+}
+/** `key=value` lines a POSIX shell reads without a JSON parser. Values never contain a newline. */
+export declare function artifactEnv(artifact: DistArtifact): string;
+export declare function createDistRoutes(services: Pick<Agents, 'runners' | 'dist' | 'downloadTokens'>, options?: DistRoutesOptions): Hono;
+//# sourceMappingURL=dist.d.ts.map

package/dist/server/routes/runners/dist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist.d.ts","sourceRoot":"","sources":["../../../../server/routes/runners/dist.ts"],"names":[],"mappings":"AAeA,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,0BAA0B,CAAC;AAUlC,OAAO,KAAK,EAAW,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AASnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,iBAAiB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;CAC/C;AAED,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAY1D;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,gBAAgB,CAAC,EAC7D,OAAO,GAAE,iBAAsB,GAC9B,IAAI,CAmNN"}

package/dist/server/routes/runners/dist.js

@@ -0,0 +1,190 @@
+/**
+ * `/api/agents/dist`: the runner and the application's CLI as standalone tarballs (`DIST_ROUTES` of
+ * `@nocobase/agent-protocol`, served from `distribution/`).
+ *
+ * Who may download: a runner by its key (self-update, and the CLI a run names), the install script by the one-time
+ * registration token it was given (`HEADERS.registrationToken`; the token stays unused until the script registers
+ * with it) or by a download token (`HEADERS.downloadToken`: the CLI for one platform, a few downloads within 30
+ * minutes), or a signed-in person. Nothing here is public: the install script itself is, from `install.ts`.
+ *
+ * `POST /downloadTokens` mints a download token for any signed-in person (a session or a personal API key; scoped
+ * keys are refused): it reaches nothing the person could not download themselves, and lets a machine where nobody is
+ * signed in yet install the CLI, after which `acme login` signs it in as that person.
+ */
+import { Readable } from 'node:stream';
+import { DistArtifactSchema, DistManifestSchema, HEADERS, ProtocolError, } from '@nocobase/agent-protocol';
+import { apiErrorResponse, apiErrorResponses, apiValidator, dataResponse, cliRoute, describeRoute, resolver, } from '@nocobase/app-server/router';
+import { z } from 'zod';
+import { domainRouter } from '../../kernel/http.js';
+import { downloadSecurity, tags } from '../openapi.js';
+import { DistFileParams, DistTargetParams, DistTargetQuery, DownloadTokenSchema, } from '../schemas.js';
+/** `key=value` lines a POSIX shell reads without a JSON parser. Values never contain a newline. */
+export function artifactEnv(artifact) {
+    const parsed = DistArtifactSchema.parse(artifact);
+    return [
+        `product=${parsed.product}`,
+        `version=${parsed.version}`,
+        `target=${parsed.target}`,
+        `url=${parsed.url}`,
+        `sha256=${parsed.sha256}`,
+        `size=${parsed.size}`,
+        `channel=${parsed.channel}`,
+        '',
+    ].join('\n');
+}
+export function createDistRoutes(services, options = {}) {
+    const router = domainRouter();
+    /** What a download token is asked for on this request: the manifest, a platform, or a tarball (which counts). */
+    const admitDownloadToken = async (context, token) => {
+        const { product, target, version, file } = context.req.param();
+        if (version !== undefined && file !== undefined && product !== undefined) {
+            // Checked before the file is looked up, so an invalid token learns nothing about which files there are.
+            await services.downloadTokens.admit(token, { product });
+            const found = await services.dist.file(product, version, file);
+            await services.downloadTokens.admit(token, {
+                product,
+                target: found.target,
+                download: true,
+            });
+            return;
+        }
+        await services.downloadTokens.admit(token, {
+            ...(product === undefined ? {} : { product }),
+            ...(target === undefined ? {} : { target }),
+        });
+    };
+    // Downloads read only: a runner key is checked without counting as the runner being seen.
+    const allowed = async (context, next) => {
+        const runnerKey = context.req.header(HEADERS.runnerKey);
+        if (runnerKey) {
+            await services.runners.authenticate(runnerKey, { touch: false });
+            return next();
+        }
+        const downloadToken = context.req.header(HEADERS.downloadToken);
+        if (downloadToken) {
+            await admitDownloadToken(context, downloadToken);
+            return next();
+        }
+        const token = context.req.header(HEADERS.registrationToken);
+        if (token) {
+            if (!(await services.runners.isRegistrationTokenUsable(token)))
+                throw new ProtocolError('REGISTRATION_TOKEN_INVALID', 'The registration token is unknown, used or expired. Create a new one with "Add runtime".');
+            return next();
+        }
+        if (options.authenticatePerson)
+            return options.authenticatePerson(context, next);
+        throw new ProtocolError('UNAUTHORIZED', 'Send a runner key, a registration token, a download token, or sign in.');
+    };
+    const downloadErrors = {
+        401: apiErrorResponse(401, 'No runner key, registration token, download token or signed-in person, or one that is not valid (`UNAUTHORIZED`, `REGISTRATION_TOKEN_INVALID`, `DOWNLOAD_TOKEN_INVALID`, `RUNNER_KEY_INVALID`).'),
+        500: apiErrorResponse(500),
+    };
+    const credentials = 'A runner (its key), the install script (an unused registration token, or a download token for its platform) or a signed-in person may download.';
+    if (options.person !== undefined) {
+        const person = options.person;
+        router.post('/downloadTokens', person, describeRoute({
+            tags,
+            summary: 'Create a CLI download token',
+            operationId: 'agentsCreateDistDownloadToken',
+            // Minted by the page that shows the install prompt; a signed-in CLI has no use for one.
+            ...cliRoute(false),
+            description: 'A short-lived token the install script downloads the application CLI with (`curl -fsSL <server>/api/agents/dist/installScript | sh -s -- --token <token>`) on a machine where nobody is signed in yet; it is shown only in this answer. It downloads only the CLI, for the platform of its first request, a few times within 30 minutes, and registers no runner. Any signed-in person may create one: it reaches nothing they could not download themselves. Scoped API keys are refused (`SCOPED_KEY_FORBIDDEN`).',
+            responses: {
+                201: dataResponse(DownloadTokenSchema, 'Created.'),
+                ...apiErrorResponses,
+            },
+        }), async (context) => {
+            const caller = context.get('caller');
+            return context.json({ data: await services.downloadTokens.create(caller.userId) }, 201);
+        });
+    }
+    router.get('/manifest', allowed, describeRoute({
+        tags,
+        summary: 'Get the distribution manifest',
+        operationId: 'agentsGetDistManifest',
+        // Plumbing: the runner, its install script and `acme` itself download from here.
+        ...cliRoute(false),
+        description: `Every version of the runner and the CLI the application serves, per platform. ${credentials}`,
+        security: downloadSecurity,
+        responses: {
+            200: dataResponse(DistManifestSchema),
+            ...downloadErrors,
+        },
+    }), async (context) => context.json({ data: await services.dist.manifest() }));
+    router.get('/products/:product/targets/:target', allowed, describeRoute({
+        tags,
+        summary: "Resolve a product's current artifact for a platform",
+        operationId: 'agentsResolveDistArtifact',
+        // Plumbing: the runner, its install script and `acme` itself download from here.
+        ...cliRoute(false),
+        description: `The current version of \`product\` (the application's CLI, which carries the runner, or \`nocobase-runner\`) for \`target\` (such as \`darwin-arm64\` or \`linux-x64\`), with its download path and SHA-256. \`format=env\` answers the same as \`key=value\` lines a POSIX shell reads, as the install script does. Never cached. ${credentials}`,
+        security: downloadSecurity,
+        responses: {
+            200: {
+                description: 'The artifact: `{ data }` in JSON, or with `format=env` the lines `product=`, `version=`, `target=`, `url=`, `sha256=`, `size=` and `channel=` as `text/plain`.',
+                content: {
+                    'application/json': {
+                        schema: resolver(z.object({ data: DistArtifactSchema })),
+                    },
+                    'text/plain': {
+                        schema: {
+                            type: 'string',
+                            description: 'One `key=value` line per field.',
+                        },
+                    },
+                },
+            },
+            404: apiErrorResponse(404, 'The product is not served, or not for this platform (`PRODUCT_NOT_FOUND`, `PLATFORM_UNSUPPORTED`).'),
+            ...downloadErrors,
+        },
+    }), apiValidator('param', DistTargetParams), apiValidator('query', DistTargetQuery), async (context) => {
+        const { product, target } = context.req.valid('param');
+        const artifact = await services.dist.resolve(product, target);
+        if (context.req.valid('query').format === 'env')
+            return context.text(artifactEnv(artifact), 200, {
+                'cache-control': 'no-store',
+            });
+        return context.json({ data: artifact }, 200, {
+            'cache-control': 'no-store',
+        });
+    });
+    router.get('/products/:product/versions/:version/files/:file', allowed, describeRoute({
+        tags,
+        summary: 'Download a distribution file',
+        operationId: 'agentsDownloadDistFile',
+        // Plumbing: the runner, its install script and `acme` itself download from here.
+        ...cliRoute(false),
+        description: `A tarball the manifest lists, as \`application/gzip\`, with its SHA-256 in \`x-checksum-sha256\`. Immutable, so it may be cached. ${credentials}`,
+        security: downloadSecurity,
+        responses: {
+            200: {
+                description: 'The file.',
+                headers: {
+                    'x-checksum-sha256': {
+                        description: "The file's SHA-256, in hex.",
+                        schema: { type: 'string' },
+                    },
+                },
+                content: {
+                    'application/gzip': {
+                        schema: { type: 'string', format: 'binary' },
+                    },
+                },
+            },
+            404: apiErrorResponse(404, 'The manifest lists no such file (`DIST_FILE_NOT_FOUND`).'),
+            ...downloadErrors,
+        },
+    }), apiValidator('param', DistFileParams), async (context) => {
+        const { product, version, file: name } = context.req.valid('param');
+        const file = await services.dist.file(product, version, name);
+        const stream = Readable.toWeb(file.open());
+        return context.body(stream, 200, {
+            'content-type': 'application/gzip',
+            'content-length': String(file.size),
+            'x-checksum-sha256': file.sha256,
+            'cache-control': 'private, max-age=31536000, immutable',
+        });
+    });
+    return router;
+}
+//# sourceMappingURL=dist.js.map

package/dist/server/routes/runners/dist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist.js","sourceRoot":"","sources":["../../../../server/routes/runners/dist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,OAAO,EACP,aAAa,GAEd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,QAAQ,GACT,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAgBvB,mGAAmG;AACnG,MAAM,UAAU,WAAW,CAAC,QAAsB;IAChD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO;QACL,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,UAAU,MAAM,CAAC,MAAM,EAAE;QACzB,OAAO,MAAM,CAAC,GAAG,EAAE;QACnB,UAAU,MAAM,CAAC,MAAM,EAAE;QACzB,QAAQ,MAAM,CAAC,IAAI,EAAE;QACrB,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAA6D,EAC7D,UAA6B,EAAE;IAE/B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAE9B,iHAAiH;IACjH,MAAM,kBAAkB,GAAG,KAAK,EAC9B,OAAgB,EAChB,KAAa,EACE,EAAE;QACjB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAE3D,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACzE,wGAAwG;YACxG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/D,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE;gBACzC,OAAO;gBACP,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE;YACzC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,0FAA0F;IAC1F,MAAM,OAAO,GAAsB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC5D,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;gBAC5D,MAAM,IAAI,aAAa,CACrB,4BAA4B,EAC5B,0FAA0F,CAC3F,CAAC;YACJ,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,CAAC,kBAAkB;YAC5B,OAAO,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,aAAa,CACrB,cAAc,EACd,wEAAwE,CACzE,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG;QACrB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,iMAAiM,CAClM;QACD,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC;KAC3B,CAAC;IACF,MAAM,WAAW,GACf,iJAAiJ,CAAC;IAEpJ,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,MAAsC,EACtC,aAAa,CAAC;YACZ,IAAI;YACJ,OAAO,EAAE,6BAA6B;YACtC,WAAW,EAAE,+BAA+B;YAC5C,wFAAwF;YACxF,GAAG,QAAQ,CAAC,KAAK,CAAC;YAClB,WAAW,EACT,qfAAqf;YACvf,SAAS,EAAE;gBACT,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,UAAU,CAAC;gBAClD,GAAG,iBAAiB;aACrB;SACF,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,MAAM,GAAI,OAAwC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvE,OAAO,OAAO,CAAC,IAAI,CACjB,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAC7D,GAAG,CACJ,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,CACR,WAAW,EACX,OAAO,EACP,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,uBAAuB;QACpC,iFAAiF;QACjF,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClB,WAAW,EAAE,iFAAiF,WAAW,EAAE;QAC3G,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,kBAAkB,CAAC;YACrC,GAAG,cAAc;SAClB;KACF,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAC1E,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,oCAAoC,EACpC,OAAO,EACP,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,2BAA2B;QACxC,iFAAiF;QACjF,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClB,WAAW,EAAE,sUAAsU,WAAW,EAAE;QAChW,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE;YACT,GAAG,EAAE;gBACH,WAAW,EACT,gKAAgK;gBAClK,OAAO,EAAE;oBACP,kBAAkB,EAAE;wBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;qBACzD;oBACD,YAAY,EAAE;wBACZ,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,iCAAiC;yBAC/C;qBACF;iBACF;aACF;YACD,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,oGAAoG,CACrG;YACD,GAAG,cAAc;SAClB;KACF,CAAC,EACF,YAAY,CAAC,OAAO,EAAE,gBAAgB,CAAC,EACvC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EACtC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,KAAK;YAC7C,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE;gBAC9C,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;QACL,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE;YAC3C,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,kDAAkD,EAClD,OAAO,EACP,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,wBAAwB;QACrC,iFAAiF;QACjF,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClB,WAAW,EAAE,qIAAqI,WAAW,EAAE;QAC/J,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE;YACT,GAAG,EAAE;gBACH,WAAW,EAAE,WAAW;gBACxB,OAAO,EAAE;oBACP,mBAAmB,EAAE;wBACnB,WAAW,EAAE,6BAA6B;wBAC1C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC3B;iBACF;gBACD,OAAO,EAAE;oBACP,kBAAkB,EAAE;wBAClB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;qBAC7C;iBACF;aACF;YACD,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,0DAA0D,CAC3D;YACD,GAAG,cAAc;SAClB;KACF,CAAC,EACF,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,EACrC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAA+B,CAAC;QACzE,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YAC/B,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACnC,mBAAmB,EAAE,IAAI,CAAC,MAAM;YAChC,eAAe,EAAE,sCAAsC;SACxD,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/runners/install.d.ts

@@ -0,0 +1,23 @@
+import { Hono, type Context } from 'hono';
+/** What the script installs, and where it was served from. */
+export interface InstallScriptOptions {
+    /** The application's CLI command (`agents.cli.name`), which is also the product it is served as. */
+    readonly cli: string;
+    /** A URL of plain characters, the default `--server`; nothing (then `--server` is required) otherwise. */
+    readonly server?: string;
+}
+/** The script for the application's CLI `cli`, with `server` as its default `--server`. */
+export declare function installScript(options: InstallScriptOptions): string;
+/** What the routes serve, and where the application is published when it knows. */
+export interface InstallRoutesOptions {
+    /** The application's CLI command, read per request (`agents.cli.name`). */
+    readonly cli: () => string;
+    /** `app.publicOrigin`, read per request; the request's own origin (or its forwarded one) otherwise. */
+    readonly publicOrigin?: () => string | undefined;
+    /** The base path the application is served under, such as `/main`; read from the request's path otherwise. */
+    readonly publicBasePath?: string;
+}
+/** The address the script was requested at: what the person's `curl` reached, base path included. */
+export declare function requestedServer(context: Context, options?: Pick<InstallRoutesOptions, 'publicOrigin' | 'publicBasePath'>): string;
+export declare function createInstallRoutes(options: InstallRoutesOptions): Hono;
+//# sourceMappingURL=install.d.ts.map

package/dist/server/routes/runners/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../../server/routes/runners/install.ts"],"names":[],"mappings":"AA6CA,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAO1C,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,oGAAoG;IACpG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0GAA0G;IAC1G,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CASnE;AAED,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,uGAAuG;IACvG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACjD,8GAA8G;IAC9G,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,qGAAqG;AACrG,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,GAAG,gBAAgB,CAAM,GAC1E,MAAM,CA2BR;AA0PD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAuCvE"}