@nocobase/app-plugin-agents 0.0.0-stage → 0.1.0-beta.10

package/dist/server/routes/run.d.ts

@@ -0,0 +1,10 @@
+import type { Hono } from 'hono';
+import type { Agents } from '../composition.js';
+import type { RunTokenIdentity } from '../core/runs/index.js';
+export interface RunEnv {
+    Variables: {
+        run: RunTokenIdentity;
+    };
+}
+export declare function createRunRoutes(services: Agents): Hono<RunEnv>;
+//# sourceMappingURL=run.d.ts.map

package/dist/server/routes/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../server/routes/run.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,EAAqB,MAAM,MAAM,CAAC;AAKpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAmB9D,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE;QAAE,GAAG,EAAE,gBAAgB,CAAA;KAAE,CAAC;CACtC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CA2G9D"}

package/dist/server/routes/run.js

@@ -0,0 +1,91 @@
+/**
+ * The run endpoints (`RUN_ROUTES`), mounted at `/api/agents`: what the agent's CLI asks about its own run
+ * (`/runs/current`), and the title a run on a conversation gives it, authenticated by the run token header.
+ */
+import { HEADERS, ProtocolError, RunSelfSchema, } from '@nocobase/agent-protocol';
+import { apiErrorResponse, apiValidator, cliRoute, dataResponse, describeRoute, } from '@nocobase/app-server/router';
+import { z } from 'zod';
+import { CONVERSATION_TITLE_AGENT_MAX } from '../../shared/conversations.js';
+import { RUN_SELF_ACTION } from '../core/callers/index.js';
+import { domainRouter } from '../kernel/http.js';
+import { runTokenSecurity, tags } from './openapi.js';
+import { RunContextSchema } from './schemas.js';
+const ConversationTitleInput = z.strictObject({
+    title: z
+        .string()
+        .min(1)
+        .max(CONVERSATION_TITLE_AGENT_MAX)
+        .meta({ description: 'The title, at most 40 characters.' }),
+});
+const RunConversationSchema = z.object({
+    id: z.string(),
+    title: z.string().nullable(),
+});
+export function createRunRoutes(services) {
+    const router = domainRouter();
+    const runToken = async (context, next) => {
+        context.set('run', await services.runs.authenticateToken(context.req.header(HEADERS.runToken) ?? ''));
+        await next();
+    };
+    const runTokenErrors = {
+        401: apiErrorResponse(401, 'No run token, or one that is unknown or whose run no runner holds (`RUN_TOKEN_INVALID`).'),
+        500: apiErrorResponse(500),
+    };
+    router.get('/runs/current', runToken, describeRoute({
+        tags,
+        summary: 'Get the run the token belongs to',
+        operationId: 'agentsGetCurrentRun',
+        description: "What the agent's CLI asks about its own run: the run, its agent, subject and the person who woke it.",
+        security: runTokenSecurity,
+        responses: { 200: dataResponse(RunSelfSchema), ...runTokenErrors },
+        ...cliRoute({ command: 'run self', action: RUN_SELF_ACTION }),
+    }), async (context) => context.json({ data: await services.runs.self(context.get('run')) }));
+    router.get('/runs/current/context', runToken, describeRoute({
+        tags,
+        summary: "Get the context of the token's run",
+        operationId: 'agentsGetCurrentRunContext',
+        description: "The context the run's subject assembles for it now; its fields depend on the subject kind.",
+        security: runTokenSecurity,
+        responses: {
+            200: dataResponse(RunContextSchema),
+            404: apiErrorResponse(404, 'The subject has no context to give (`RUN_CONTEXT_NOT_FOUND`).'),
+            ...runTokenErrors,
+        },
+        ...cliRoute({ command: 'run context', action: RUN_SELF_ACTION }),
+    }), async (context) => context.json({ data: await services.runs.context(context.get('run')) }));
+    router.patch('/runs/current/conversation', runToken, describeRoute({
+        tags,
+        summary: "Name the token's conversation",
+        operationId: 'agentsSetCurrentRunConversationTitle',
+        description: "A run on a conversation names it (at most 40 characters); `meta.message` says so. Refused once the conversation's owner renamed it (`CONVERSATION_CONFLICT`, `metadata.reason` `titleLocked`).",
+        security: runTokenSecurity,
+        responses: {
+            200: dataResponse(RunConversationSchema),
+            400: apiErrorResponse(400, 'The run is not on a conversation (`INVALID_REQUEST`), or its owner named it (`CONVERSATION_CONFLICT`).'),
+            ...runTokenErrors,
+        },
+        ...cliRoute({
+            command: 'conversation title set',
+            args: ['title'],
+            action: RUN_SELF_ACTION,
+            examples: ['conversation title set "Tidy the login issues"'],
+        }),
+    }), apiValidator('json', ConversationTitleInput), async (context) => {
+        const { run } = context.get('run');
+        const target = {
+            subject: { kind: run.subjectKind, id: run.subjectId },
+            actorUserId: run.actorUserId,
+        };
+        if (!(await services.conversations.ofRun(services.tx.read(), target)))
+            throw new ProtocolError('INVALID_REQUEST', 'Only a run on a conversation has a title to set.');
+        const conversation = await services.conversations.setTitleFromRun(target, context.req.valid('json').title);
+        return context.json({
+            data: { id: conversation.id, title: conversation.title },
+            meta: {
+                message: `The conversation is called "${conversation.title ?? ''}" now.`,
+            },
+        });
+    });
+    return router;
+}
+//# sourceMappingURL=run.js.map

package/dist/server/routes/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../server/routes/run.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,OAAO,EACP,aAAa,EACb,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,GACd,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAI7E,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5C,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,4BAA4B,CAAC;SACjC,IAAI,CAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAMH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,MAAM,GAAG,YAAY,EAAU,CAAC;IACtC,MAAM,QAAQ,GAA8B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAClE,OAAO,CAAC,GAAG,CACT,KAAK,EACL,MAAM,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CACnC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAC3C,CACF,CAAC;QACF,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;IACF,MAAM,cAAc,GAAG;QACrB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,0FAA0F,CAC3F;QACD,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC;KAC3B,CAAC;IACF,MAAM,CAAC,GAAG,CACR,eAAe,EACf,QAAQ,EACR,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,qBAAqB;QAClC,WAAW,EACT,sGAAsG;QACxG,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,GAAG,cAAc,EAAE;QAClE,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;KAC9D,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CACvE,CAAC;IACF,MAAM,CAAC,GAAG,CACR,uBAAuB,EACvB,QAAQ,EACR,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EAAE,4BAA4B;QACzC,WAAW,EACT,4FAA4F;QAC9F,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,gBAAgB,CAAC;YACnC,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,+DAA+D,CAChE;YACD,GAAG,cAAc;SAClB;QACD,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;KACjE,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAC1E,CAAC;IACF,MAAM,CAAC,KAAK,CACV,4BAA4B,EAC5B,QAAQ,EACR,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,sCAAsC;QACnD,WAAW,EACT,gMAAgM;QAClM,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,qBAAqB,CAAC;YACxC,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,wGAAwG,CACzG;YACD,GAAG,cAAc;SAClB;QACD,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,wBAAwB;YACjC,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,CAAC,gDAAgD,CAAC;SAC7D,CAAC;KACH,CAAC,EACF,YAAY,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAC5C,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE;YACrD,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,kDAAkD,CACnD,CAAC;QACJ,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,eAAe,CAC/D,MAAM,EACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAChC,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE;YACxD,IAAI,EAAE;gBACJ,OAAO,EAAE,+BAA+B,YAAY,CAAC,KAAK,IAAI,EAAE,QAAQ;aACzE;SACF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/runners/admin.d.ts

@@ -0,0 +1,28 @@
+import type { Hono, MiddlewareHandler } from 'hono';
+import type { SettingsAction, SettingsItem } from '../../../shared/access.js';
+import type { Runner } from '../../../shared/runners.js';
+import type { Agents } from '../../composition.js';
+/** Who is asking, and whether one of this plugin's settings grants is theirs. */
+export interface AdminCaller {
+    readonly userId: string;
+    can(item: SettingsItem, action: SettingsAction): Promise<boolean>;
+}
+export interface AdminEnv {
+    Variables: {
+        caller: AdminCaller;
+        runnerToManage: Runner;
+    };
+}
+/** Where a manager revoking someone else's runner is recorded: the application's logger. */
+export interface AdminAuditLogger {
+    info(details: Readonly<Record<string, unknown>>, message: string): void;
+}
+export interface AdminRoutesOptions {
+    /** Without one, the record goes to the console. */
+    readonly logger?: AdminAuditLogger;
+}
+/**
+ * `guard` authenticates the request and sets `caller`; the route contribution installs the real one, tests a fake.
+ */
+export declare function createAdminRoutes(services: Agents, guard: MiddlewareHandler<AdminEnv>, options?: AdminRoutesOptions): Hono<AdminEnv>;
+//# sourceMappingURL=admin.d.ts.map

package/dist/server/routes/runners/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../server/routes/runners/admin.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAW,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EACV,MAAM,EAIP,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAiBnD,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAMD,4FAA4F;AAC5F,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACzE;AAED,MAAM,WAAW,kBAAkB;IACjC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAClC,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CAAC,QAAQ,CAAC,CAqahB"}

package/dist/server/routes/runners/admin.js

@@ -0,0 +1,318 @@
+/**
+ * The people-facing runners API, mounted at `/api/agents/runners` beside the runner protocol (`runner.ts`): runners
+ * and registration tokens. Every route is behind the guard the route contribution passes (a signed-in user and their
+ * authorization context); what each caller may do is checked here.
+ *
+ * - `agents.runners` read/manage: every runner; adding a team runner, and revoking and deleting any runner. Revoking
+ *   someone else's runner is an emergency measure: its owner is told, and the server log records who did it.
+ * - Changing a runner (its name, slots, coding tools, policy and trust) is its owner's alone, because the runner is
+ *   their machine with their tools' sign-ins and credentials: a manager who could share it with the team would send
+ *   everyone's work there. A runner whose owner can no longer act (no owner recorded, or an owner the application's
+ *   directory reports disabled or deleted, `people.inactive`) is changed by managers of runners, or nobody could.
+ *   Anyone signed in may add a personal runner and change their own, including sharing it with the
+ *   team. Reading agents (`agents.agents` read) also shows every runner, to pick where an agent runs.
+ * - A runner's page: whoever sees a runner sees which agents it takes (`takes`), what it holds now
+ *   (`GET /agents/runners/:runnerId/work`: its runs as the caller may see them, then its jobs) and its latest runs
+ *   (`GET /agents/runners/:runnerId/runs`). What identifies its machine (its host name, where its tools are installed)
+ *   its owner, the managers of runners and anyone who may wake at least one agent see; everyone else sees neither
+ *   (`runnerForViewer`).
+ */
+import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION, } from '@nocobase/agent-protocol';
+import { apiErrorResponse, apiErrorResponses, apiValidator, cliRoute, dataResponse, describeRoute, emptyResponse, listResponse, } from '@nocobase/app-server/router';
+import { runnerForViewer } from '../../core/runs/runner-view.js';
+import { upgradeFor } from '../../distribution/index.js';
+import { forbidden, notFound } from '../../kernel/errors.js';
+import { domainRouter } from '../../kernel/http.js';
+import { tags } from '../openapi.js';
+import { RegistrationTokenInputSchema, RegistrationTokenSchema, RunnerHeldItemSchema, RunnerParams, RunnerPatchInput, RunnerRecentRunSchema, RunnerSchema, RunnerSummarySchema, } from '../schemas.js';
+function caller(context) {
+    return context.get('caller');
+}
+/**
+ * `guard` authenticates the request and sets `caller`; the route contribution installs the real one, tests a fake.
+ */
+export function createAdminRoutes(services, guard, options = {}) {
+    const audit = options.logger ?? {
+        info: (details, message) => console.info(message, details),
+    };
+    const router = domainRouter();
+    const runnerParam = apiValidator('param', RunnerParams);
+    const notVisible = apiErrorResponse(404, 'The runner does not exist, or the caller may not see it.');
+    const editErrors = {
+        ...apiErrorResponses,
+        403: apiErrorResponse(403, "Only the runner's owner may change it; a manager of runners (`agents.runners` manage) only once its owner can no longer act."),
+        404: notVisible,
+    };
+    const revokeErrors = {
+        ...apiErrorResponses,
+        403: apiErrorResponse(403, "Only the runner's owner or a manager of runners (`agents.runners` manage) may revoke or delete it."),
+        404: notVisible,
+    };
+    /** Whether the caller sees every runner: `agents.runners` read, or `agents.agents` read (to pick where one runs). */
+    const seesEveryRunner = async (who) => (await who.can('agents.runners', 'read')) ||
+        (await who.can('agents.agents', 'read'));
+    /** Whether the caller may wake at least one agent; asked once per request. */
+    const usesAgents = new WeakMap();
+    const mayUseAgents = (who) => {
+        let found = usesAgents.get(who);
+        if (!found) {
+            found = services.agents
+                .list()
+                .then((agents) => agents.some((agent) => services.agents.mayInvoke(agent, who.userId)));
+            usesAgents.set(who, found);
+        }
+        return found;
+    };
+    /** Whether nobody can act as the runner's owner: none recorded, or one the directory reports disabled or deleted. */
+    const ownerGone = async (runner) => runner.ownerUserId === null ||
+        (await services.people.inactive(services.tx.read(), [runner.ownerUserId])).has(runner.ownerUserId);
+    /** What the caller may do with a runner, or 404 when they may not see it. */
+    const runnerRights = async (context, runner) => {
+        const who = caller(context);
+        const own = runner.ownerUserId === who.userId;
+        const revoke = own || (await who.can('agents.runners', 'manage'));
+        const edit = own || (revoke && (await ownerGone(runner)));
+        const see = revoke || (await seesEveryRunner(who));
+        const machine = revoke || (see && (await mayUseAgents(who)));
+        return { see, edit, revoke, machine };
+    };
+    /** The agents each runner takes. */
+    const takesOf = async (runners) => runners.length > 0
+        ? services.runnerView.takes(runners)
+        : new Map();
+    const summarizeRunner = async (context, runner, takes) => {
+        const rights = await runnerRights(context, runner);
+        const held = await services.slots.held(services.tx.read(), runner.id);
+        return {
+            ...runnerForViewer(runner, rights.machine),
+            activeRuns: held.runs,
+            activeJobs: held.jobs,
+            activeByTool: held.byTool ?? {},
+            takes: takes.get(runner.id) ?? [],
+            canManage: rights.edit,
+            canChangeTrust: rights.edit,
+            canRevoke: rights.revoke,
+            updateVersion: (await upgradeFor(services.dist, runner))?.latestVersion ?? null,
+            requiredProtocol: { min: MIN_PROTOCOL_VERSION, max: PROTOCOL_VERSION },
+            offersJobs: services.jobs.kinds().length > 0,
+        };
+    };
+    /** The runner named in the path if the caller may change it: 404 when they may not see it, 403 when not theirs. */
+    const editableRunner = async (context) => {
+        const runner = await services.runners.get(context.req.param('runnerId') ?? '');
+        const rights = await runnerRights(context, runner);
+        if (!rights.see)
+            throw notFound('Runner');
+        if (!rights.edit)
+            throw forbidden("Only the runner's owner may change it; a manager of runners only once its owner can no longer act.");
+        return runner;
+    };
+    /** The runner named in the path if the caller may revoke or delete it: 404 when they may not see it, else 403. */
+    const revocableRunner = async (context) => {
+        const runner = await services.runners.get(context.req.param('runnerId') ?? '');
+        const rights = await runnerRights(context, runner);
+        if (!rights.see)
+            throw notFound('Runner');
+        if (!rights.revoke)
+            throw forbidden("Only the runner's owner or a manager of runners may revoke or delete it.");
+        return runner;
+    };
+    // Runners.
+    /** The runner named in the path, or 404 when the caller may not see it. */
+    const visibleRunner = async (context) => {
+        const runner = await services.runners.get(context.req.param('runnerId') ?? '');
+        if (!(await runnerRights(context, runner)).see)
+            throw notFound('Runner');
+        return runner;
+    };
+    router.get('/', guard, describeRoute({
+        tags,
+        summary: 'List runners',
+        operationId: 'agentsListRunners',
+        ...cliRoute({
+            command: 'runtime list',
+            columns: ['id', 'name', 'status', 'ownerName', 'trust', 'activeRuns'],
+        }),
+        description: "Every runner for a reader of runners or of agents (`agents.runners` or `agents.agents` read); otherwise the caller's own.",
+        responses: {
+            200: listResponse(RunnerSummarySchema),
+            ...apiErrorResponses,
+        },
+    }), async (context) => {
+        const visible = [];
+        for (const runner of await services.runners.list())
+            if ((await runnerRights(context, runner)).see)
+                visible.push(runner);
+        const takes = await takesOf(visible);
+        const data = [];
+        for (const runner of visible)
+            data.push(await summarizeRunner(context, runner, takes));
+        return context.json({ data, meta: { total: data.length } });
+    });
+    router.post('/registrationTokens', guard, describeRoute({
+        tags,
+        summary: 'Create a runner registration token',
+        operationId: 'agentsCreateRunnerRegistrationToken',
+        ...cliRoute({
+            command: 'runtime token create',
+            examples: ['runtime token create --trust team'],
+        }),
+        description: 'A one-time token the install script registers a runner with; the token is shown only in this answer. Anyone signed in may add a personal runner; a runner shared with the team (`trust: team`) needs `agents.runners` manage.',
+        responses: {
+            201: dataResponse(RegistrationTokenSchema, 'Created.'),
+            ...apiErrorResponses,
+        },
+    }), apiValidator('json', RegistrationTokenInputSchema), async (context) => {
+        const who = caller(context);
+        const input = context.req.valid('json');
+        if (input.trust === 'team' &&
+            !(await who.can('agents.runners', 'manage')))
+            throw forbidden('Adding a runner shared with the team needs agents.runners manage permission.');
+        return context.json({
+            data: await services.runners.createRegistrationToken(who.userId, input),
+        }, 201);
+    });
+    router.get('/:runnerId', guard, describeRoute({
+        tags,
+        summary: 'Get a runner',
+        operationId: 'agentsGetRunner',
+        ...cliRoute({
+            command: 'runtime get',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+        }),
+        responses: {
+            200: dataResponse(RunnerSummarySchema),
+            ...apiErrorResponses,
+            404: notVisible,
+        },
+    }), runnerParam, async (context) => {
+        const runner = await visibleRunner(context);
+        return context.json({
+            data: await summarizeRunner(context, runner, await takesOf([runner])),
+        });
+    });
+    /** What the runner holds now: its runs, then its jobs. */
+    router.get('/:runnerId/work', guard, describeRoute({
+        tags,
+        summary: 'List the work a runner holds',
+        operationId: 'agentsListRunnerWork',
+        ...cliRoute({
+            command: 'runtime work',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+            columns: ['id', 'kind', 'title', 'status', 'startedAt'],
+        }),
+        description: 'Its runs as the caller may see them, then its jobs, while they are dispatched or running.',
+        responses: {
+            200: listResponse(RunnerHeldItemSchema),
+            ...apiErrorResponses,
+            404: notVisible,
+        },
+    }), runnerParam, async (context) => {
+        const runner = await visibleRunner(context);
+        const runs = await services.runnerView.held(runner, caller(context).userId);
+        const jobs = (await services.jobs.list({ runnerId: runner.id, limit: 200 })).filter((job) => job.status === 'dispatched' || job.status === 'running');
+        const data = [
+            ...runs,
+            ...jobs.map((job) => ({
+                id: job.id,
+                kind: 'job',
+                title: job.title ?? job.kind,
+                status: job.status,
+                startedAt: job.startedAt ?? job.dispatchedAt,
+                path: null,
+            })),
+        ];
+        return context.json({ data, meta: { total: data.length } });
+    });
+    router.get('/:runnerId/runs', guard, describeRoute({
+        tags,
+        summary: "List a runner's recent runs",
+        operationId: 'agentsListRunnerRuns',
+        ...cliRoute({
+            command: 'runtime runs',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+            columns: ['id', 'title', 'status', 'createdAt'],
+        }),
+        description: 'Its latest runs whatever their status, newest first, without the link of a private run the caller is not part of.',
+        responses: {
+            200: listResponse(RunnerRecentRunSchema),
+            ...apiErrorResponses,
+            404: notVisible,
+        },
+    }), runnerParam, async (context) => {
+        const runner = await visibleRunner(context);
+        const data = await services.runnerView.recent(runner, caller(context).userId);
+        return context.json({ data, meta: { total: data.length } });
+    });
+    router.patch('/:runnerId', guard, describeRoute({
+        tags,
+        summary: 'Update a runner',
+        operationId: 'agentsUpdateRunner',
+        ...cliRoute({
+            command: 'runtime update',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+        }),
+        description: "Its owner's alone, a manager of runners (`agents.runners` manage) included; a runner whose owner can no longer act (none recorded, or disabled or deleted) is changed by managers of runners.",
+        responses: { 200: dataResponse(RunnerSchema), ...editErrors },
+    }), runnerParam, async (context, next) => {
+        context.set('runnerToManage', await editableRunner(context));
+        await next();
+    }, apiValidator('json', RunnerPatchInput), async (context) => context.json({
+        data: await services.runners.update(context.get('runnerToManage').id, context.req.valid('json')),
+    }));
+    router.post('/:runnerId/revoke', guard, describeRoute({
+        tags,
+        summary: 'Revoke a runner',
+        operationId: 'agentsRevokeRunner',
+        ...cliRoute({
+            command: 'runtime revoke',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+            confirm: 'Revoke this runtime? It stops taking work and must register again.',
+        }),
+        description: "Revokes the runner and its keys; the runs and jobs it held go back to the queue. Its owner or a manager of runners (`agents.runners` manage); a manager revoking someone else's runner tells its owner.",
+        responses: { 200: dataResponse(RunnerSchema), ...revokeErrors },
+    }), runnerParam, async (context) => {
+        const runner = await revocableRunner(context);
+        const by = caller(context).userId;
+        const revoked = await services.runners.revoke(runner.id, { by });
+        if (runner.ownerUserId !== null && runner.ownerUserId !== by)
+            audit.info({
+                event: 'agents.runner.revoked',
+                runnerId: runner.id,
+                runnerName: runner.name,
+                ownerUserId: runner.ownerUserId,
+                actorId: by,
+            }, "A manager of runners revoked someone else's runner.");
+        // What it held goes back to the queue now rather than at the next sweep.
+        await services.sweeper.sweep();
+        return context.json({ data: revoked });
+    });
+    router.delete('/:runnerId', guard, describeRoute({
+        tags,
+        summary: 'Delete a runner',
+        operationId: 'agentsDeleteRunner',
+        ...cliRoute({
+            command: 'runtime delete',
+            args: ['runnerId'],
+            flags: { runnerId: { name: 'runtime' } },
+            confirm: 'Delete this runtime?',
+        }),
+        description: 'Deletes a revoked runner; its past runs keep its id.',
+        responses: {
+            204: emptyResponse(),
+            ...revokeErrors,
+            400: apiErrorResponse(400, 'The runner is not revoked (`RUNNER_NOT_REVOKED`).'),
+        },
+    }), runnerParam, async (context) => {
+        const runner = await revocableRunner(context);
+        await services.runners.remove(runner.id);
+        return context.body(null, 204);
+    });
+    return router;
+}
+//# sourceMappingURL=admin.js.map

package/dist/server/routes/runners/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../../server/routes/runners/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,GACb,MAAM,6BAA6B,CAAC;AAWrC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAYvB,SAAS,MAAM,CAAC,OAA0B;IACxC,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAYD;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,KAAkC,EAClC,UAA8B,EAAE;IAEhC,MAAM,KAAK,GAAqB,OAAO,CAAC,MAAM,IAAI;QAChD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3D,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,EAAY,CAAC;IACxC,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,gBAAgB,CACjC,GAAG,EACH,0DAA0D,CAC3D,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,iBAAiB;QACpB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,8HAA8H,CAC/H;QACD,GAAG,EAAE,UAAU;KAChB,CAAC;IACF,MAAM,YAAY,GAAG;QACnB,GAAG,iBAAiB;QACpB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,oGAAoG,CACrG;QACD,GAAG,EAAE,UAAU;KAChB,CAAC;IAEF,qHAAqH;IACrH,MAAM,eAAe,GAAG,KAAK,EAAE,GAAgB,EAAoB,EAAE,CACnE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IAE3C,8EAA8E;IAC9E,MAAM,UAAU,GAAG,IAAI,OAAO,EAAiC,CAAC;IAChE,MAAM,YAAY,GAAG,CAAC,GAAgB,EAAoB,EAAE;QAC1D,IAAI,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,QAAQ,CAAC,MAAM;iBACpB,IAAI,EAAE;iBACN,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACf,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CACrE,CAAC;YACJ,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,qHAAqH;IACrH,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE,CAC3D,MAAM,CAAC,WAAW,KAAK,IAAI;QAC3B,CACE,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CACzE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE5B,6EAA6E;IAC7E,MAAM,YAAY,GAAG,KAAK,EACxB,OAA0B,EAC1B,MAAc,EAMb,EAAE;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,KAAK,GAAG,CAAC,MAAM,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACxC,CAAC,CAAC;IAEF,oCAAoC;IACpC,MAAM,OAAO,GAAG,KAAK,EACnB,OAA0B,EACiC,EAAE,CAC7D,OAAO,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QACpC,CAAC,CAAC,IAAI,GAAG,EAAuC,CAAC;IAErD,MAAM,eAAe,GAAG,KAAK,EAC3B,OAA0B,EAC1B,MAAc,EACd,KAAuD,EAC/B,EAAE;QAC1B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO;YACL,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,YAAY,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YAC/B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;YACjC,SAAS,EAAE,MAAM,CAAC,IAAI;YACtB,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,aAAa,EACX,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,aAAa,IAAI,IAAI;YAClE,gBAAgB,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,gBAAgB,EAAE;YACtE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,CAAC;SAC7C,CAAC;IACJ,CAAC,CAAC;IAEF,mHAAmH;IACnH,MAAM,cAAc,GAAG,KAAK,EAC1B,OAA0B,EACT,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CACpC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI;YACd,MAAM,SAAS,CACb,oGAAoG,CACrG,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,kHAAkH;IAClH,MAAM,eAAe,GAAG,KAAK,EAC3B,OAA0B,EACT,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CACpC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,MAAM;YAChB,MAAM,SAAS,CACb,0EAA0E,CAC3E,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,WAAW;IACX,2EAA2E;IAC3E,MAAM,aAAa,GAAG,KAAK,EAAE,OAA0B,EAAmB,EAAE;QAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CACpC,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,GAAG,EACH,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,cAAc;QACvB,WAAW,EAAE,mBAAmB;QAChC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC;SACtE,CAAC;QACF,WAAW,EACT,2HAA2H;QAC7H,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,mBAAmB,CAAC;YACtC,GAAG,iBAAiB;SACrB;KACF,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;YAChD,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO;YAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EAAE,qCAAqC;QAClD,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,sBAAsB;YAC/B,QAAQ,EAAE,CAAC,mCAAmC,CAAC;SAChD,CAAC;QACF,WAAW,EACT,+NAA+N;QACjO,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,uBAAuB,EAAE,UAAU,CAAC;YACtD,GAAG,iBAAiB;SACrB;KACF,CAAC,EACF,YAAY,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAClD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,IACE,KAAK,CAAC,KAAK,KAAK,MAAM;YACtB,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAE5C,MAAM,SAAS,CACb,8EAA8E,CAC/E,CAAC;QACJ,OAAO,OAAO,CAAC,IAAI,CACjB;YACE,IAAI,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CAClD,GAAG,CAAC,MAAM,EACV,KAAK,CACN;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CACF,CAAC;IACF,MAAM,CAAC,GAAG,CACR,YAAY,EACZ,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,cAAc;QACvB,WAAW,EAAE,iBAAiB;QAC9B,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;SACzC,CAAC;QACF,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,mBAAmB,CAAC;YACtC,GAAG,iBAAiB;YACpB,GAAG,EAAE,UAAU;SAChB;KACF,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACtE,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IACF,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CACR,iBAAiB,EACjB,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,sBAAsB;QACnC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YACxC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC;SACxD,CAAC;QACF,WAAW,EACT,2FAA2F;QAC7F,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,oBAAoB,CAAC;YACvC,GAAG,iBAAiB;YACpB,GAAG,EAAE,UAAU;SAChB;KACF,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CACzC,MAAM,EACN,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CACvB,CAAC;QACF,MAAM,IAAI,GAAG,CACX,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAC9D,CAAC,MAAM,CACN,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CACjE,CAAC;QACF,MAAM,IAAI,GAAqB;YAC7B,GAAG,IAAI;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,KAAc;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI;gBAC5B,MAAM,EAAE,GAAG,CAAC,MAAkC;gBAC9C,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,YAAY;gBAC5C,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;SACJ,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,MAAM,CAAC,GAAG,CACR,iBAAiB,EACjB,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,sBAAsB;QACnC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YACxC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC;SAChD,CAAC;QACF,WAAW,EACT,mHAAmH;QACrH,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,qBAAqB,CAAC;YACxC,GAAG,iBAAiB;YACpB,GAAG,EAAE,UAAU;SAChB;KACF,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,CAC3C,MAAM,EACN,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CACvB,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,MAAM,CAAC,KAAK,CACV,YAAY,EACZ,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EAAE,oBAAoB;QACjC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;SACzC,CAAC;QACF,WAAW,EACT,+LAA+L;QACjM,SAAS,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,YAAY,CAAC,EAAE,GAAG,UAAU,EAAE;KAC9D,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,EACD,YAAY,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACtC,KAAK,EAAE,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CACjC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAC1B;KACF,CAAC,CACL,CAAC;IACF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EAAE,oBAAoB;QACjC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YACxC,OAAO,EACL,oEAAoE;SACvE,CAAC;QACF,WAAW,EACT,yMAAyM;QAC3M,SAAS,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,YAAY,CAAC,EAAE,GAAG,YAAY,EAAE;KAChE,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,EAAE;YAC1D,KAAK,CAAC,IAAI,CACR;gBACE,KAAK,EAAE,uBAAuB;gBAC9B,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,EAAE;aACZ,EACD,qDAAqD,CACtD,CAAC;QACJ,yEAAyE;QACzE,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACzC,CAAC,CACF,CAAC;IACF,MAAM,CAAC,MAAM,CACX,YAAY,EACZ,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EAAE,oBAAoB;QACjC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YACxC,OAAO,EAAE,sBAAsB;SAChC,CAAC;QACF,WAAW,EAAE,sDAAsD;QACnE,SAAS,EAAE;YACT,GAAG,EAAE,aAAa,EAAE;YACpB,GAAG,YAAY;YACf,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,mDAAmD,CACpD;SACF;KACF,CAAC,EACF,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/runners/dist.d.ts

@@ -0,0 +1,24 @@
+import { type DistArtifact, type DistNpmPackage, type DistResolution } from '@nocobase/agent-protocol';
+import type { Hono, MiddlewareHandler } from 'hono';
+import type { Agents } from '../../composition.js';
+import type { AdminEnv } from './admin.js';
+export interface DistRoutesOptions {
+    /**
+     * Lets a signed-in person through when the request carries neither a runner key nor a registration token; it
+     * answers 401 itself otherwise. Without it only runners and the install script may download.
+     */
+    readonly authenticatePerson?: MiddlewareHandler;
+    /**
+     * Authenticates a person and sets `caller`, for minting a download token; without it no one can mint one. The route
+     * contribution passes the people guard (scoped keys refused), tests a fake.
+     */
+    readonly person?: MiddlewareHandler<AdminEnv>;
+}
+/** `key=value` lines a POSIX shell reads without a JSON parser. Values never contain a newline. */
+export declare function artifactEnv(artifact: DistArtifact): string;
+/** The same lines for an npm answer, led by `kind=npm`; only a caller that sent `accept=npm` reads them. */
+export declare function npmPackageEnv(npm: DistNpmPackage): string;
+/** `artifactEnv` or `npmPackageEnv`, whichever the answer is. */
+export declare function resolutionEnv(resolution: DistResolution): string;
+export declare function createDistRoutes(services: Pick<Agents, 'runners' | 'dist' | 'downloadTokens'>, options?: DistRoutesOptions): Hono;
+//# sourceMappingURL=dist.d.ts.map

package/dist/server/routes/runners/dist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist.d.ts","sourceRoot":"","sources":["../../../../server/routes/runners/dist.ts"],"names":[],"mappings":"AAeA,OAAO,EAWL,KAAK,YAAY,EAEjB,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAUlC,OAAO,KAAK,EAAW,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AASnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,iBAAiB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;CAC/C;AAED,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAc1D;AAED,4GAA4G;AAC5G,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAUzD;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,UAAU,EAAE,cAAc,GAAG,MAAM,CAIhE;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,gBAAgB,CAAC,EAC7D,OAAO,GAAE,iBAAsB,GAC9B,IAAI,CA4NN"}