@nocobase/app-plugin-agents 0.0.0-stage → 0.1.0-beta.2

package/dist/server/core/variables/variable.service.js

@@ -0,0 +1,278 @@
+import { isReservedVariable, VARIABLE_NAME_PATTERN, VARIABLE_VALUE_MAX_BYTES, } from '../../../shared/variables.js';
+import { invalid, notFound } from '../../kernel/errors.js';
+import { stringArray } from '../../kernel/values.js';
+import { JobSecretsNotAllowed } from '../../jobs/spec.js';
+import { runnersRepo } from '../../runners/runner.store.js';
+function secrets(conn) {
+    return conn.repository('agSecrets');
+}
+function audits(conn) {
+    return conn.repository('agSecretAudits');
+}
+/** The variables named in a JSON column, such as `agRuns.teamOnlyVariables`; anything else reads as none. */
+export function variableRefs(value) {
+    const parsed = typeof value === 'string'
+        ? (() => {
+            try {
+                return JSON.parse(value);
+            }
+            catch {
+                return null;
+            }
+        })()
+        : value;
+    if (!Array.isArray(parsed))
+        return [];
+    return parsed.flatMap((item) => {
+        if (!item || typeof item !== 'object')
+            return [];
+        const { scope, scopeId, name } = item;
+        return typeof scope === 'string' &&
+            typeof scopeId === 'string' &&
+            typeof name === 'string'
+            ? [{ scope, scopeId, name }]
+            : [];
+    });
+}
+/** Variables as a person reads them in a wait or a notice: `NPM_TOKEN (agent 42), API_KEY (workdir 7)`. */
+export function describeVariables(variables) {
+    return variables
+        .map((each) => `${each.name} (${each.scope} ${each.scopeId})`)
+        .join(', ');
+}
+/** What a variable's value is bound to: moved to another scope or name, it no longer opens. */
+export function variableAad(variable) {
+    return [variable.scope, variable.scopeId, variable.name];
+}
+/** Why `name` and `value` cannot be stored, or nothing. */
+export function checkVariable(name, value, cli) {
+    if (!VARIABLE_NAME_PATTERN.test(name))
+        throw invalid('A variable name uses upper-case letters, digits and underscores, and does not start with a digit.', { reason: 'pattern' });
+    if (isReservedVariable(name, cli))
+        throw invalid(`${name} is reserved.`, { reason: 'reserved' });
+    if (Buffer.byteLength(value, 'utf8') > VARIABLE_VALUE_MAX_BYTES)
+        throw invalid('The value is larger than 8 KB.', { reason: 'tooLong' });
+}
+export function createVariableService(deps) {
+    const { tx, ids, clock, box, people, cli } = deps;
+    const of = (conn, target) => secrets(conn).findMany({
+        filter: { scope: target.scope, scopeId: target.scopeId },
+        sort: (sort) => sort.field('name').asc(),
+    });
+    const audit = (conn, target, entry) => audits(conn).createOne({
+        values: {
+            id: ids.next(),
+            scope: target.scope,
+            scopeId: target.scopeId,
+            action: entry.action,
+            names: [...entry.names],
+            userId: entry.userId ?? null,
+            runId: entry.runId ?? null,
+            jobId: entry.jobId ?? null,
+            runnerId: entry.runnerId ?? null,
+            at: clock.now().toISOString(),
+        },
+    });
+    const open = (record) => box.open(record.valueEncrypted, variableAad(record));
+    return {
+        async list(target) {
+            const conn = tx.read();
+            const records = await of(conn, target);
+            const names = await people.names(conn, records.map((record) => record.updatedById));
+            return records.map((record) => ({
+                name: record.name,
+                teamRunnersOnly: Boolean(record.teamRunnersOnly),
+                updatedAt: record.updatedAt,
+                updatedById: record.updatedById,
+                updatedByName: record.updatedById
+                    ? (names.get(record.updatedById) ?? null)
+                    : null,
+            }));
+        },
+        set: (target, name, value, userId, options = {}) => tx.run(async ({ conn }) => {
+            const existing = await secrets(conn).findOne({
+                filter: { scope: target.scope, scopeId: target.scopeId, name },
+            });
+            if (value === undefined && !existing)
+                throw invalid('A new variable needs a value.', {
+                    reason: 'valueRequired',
+                });
+            if (value !== undefined)
+                checkVariable(name, value, cli);
+            const sealed = value === undefined
+                ? undefined
+                : box.seal(value, variableAad({ ...target, name }));
+            const now = clock.now().toISOString();
+            if (existing)
+                await secrets(conn).updateMany({
+                    filter: { id: existing.id },
+                    values: {
+                        ...(sealed === undefined ? {} : { valueEncrypted: sealed }),
+                        ...(options.teamRunnersOnly === undefined
+                            ? {}
+                            : { teamRunnersOnly: options.teamRunnersOnly }),
+                        updatedById: userId,
+                        updatedAt: now,
+                    },
+                });
+            else
+                await secrets(conn).createOne({
+                    values: {
+                        id: ids.next(),
+                        scope: target.scope,
+                        scopeId: target.scopeId,
+                        name,
+                        valueEncrypted: sealed,
+                        teamRunnersOnly: options.teamRunnersOnly ?? false,
+                        createdById: userId,
+                        updatedById: userId,
+                        createdAt: now,
+                        updatedAt: now,
+                    },
+                });
+            await audit(conn, target, { action: 'set', names: [name], userId });
+            await deps.onChange?.(conn, target, {
+                name,
+                change: existing ? 'changed' : 'added',
+                byUserId: userId,
+            });
+        }),
+        remove: (target, name, userId) => tx.run(async ({ conn }) => {
+            const existing = await secrets(conn).findOne({
+                filter: { scope: target.scope, scopeId: target.scopeId, name },
+            });
+            if (!existing)
+                throw notFound('Variable');
+            await secrets(conn).deleteMany({ filter: { id: existing.id } });
+            await audit(conn, target, { action: 'delete', names: [name], userId });
+            await deps.onChange?.(conn, target, {
+                name,
+                change: 'removed',
+                byUserId: userId,
+            });
+        }),
+        reveal: (target, userId) => tx.run(async ({ conn }) => {
+            const records = await of(conn, target);
+            const values = records.map((record) => ({
+                name: record.name,
+                value: open(record),
+            }));
+            if (values.length > 0)
+                await audit(conn, target, {
+                    action: 'reveal',
+                    names: values.map((value) => value.name),
+                    userId,
+                });
+            return values;
+        }),
+        async audits(target, limit = 50, cursor) {
+            const conn = tx.read();
+            const records = await audits(conn).findMany({
+                filter: { scope: target.scope, scopeId: target.scopeId },
+                sort: (sort) => [sort.field('at').desc(), sort.field('id').desc()],
+                limit,
+                ...(cursor ? { cursor } : {}),
+            });
+            const names = await people.names(conn, records.map((record) => record.userId));
+            return records.map((record) => ({
+                id: record.id,
+                at: record.at,
+                action: record.action,
+                names: stringArray(record.names),
+                userId: record.userId,
+                userName: record.userId ? (names.get(record.userId) ?? null) : null,
+                runId: record.runId,
+                jobId: record.jobId,
+                runnerId: record.runnerId,
+            }));
+        },
+        async clear(conn, target) {
+            await secrets(conn).deleteMany({
+                filter: { scope: target.scope, scopeId: target.scopeId },
+            });
+        },
+        async namesOf(conn, targets) {
+            const names = new Set();
+            for (const target of targets)
+                for (const record of await of(conn, target))
+                    names.add(record.name);
+            return [...names].sort();
+        },
+        async teamOnly(conn, targets) {
+            const merged = new Map();
+            for (const target of targets)
+                for (const record of await of(conn, target))
+                    merged.set(record.name, {
+                        scope: target.scope,
+                        scopeId: target.scopeId,
+                        name: record.name,
+                        only: Boolean(record.teamRunnersOnly),
+                    });
+            return [...merged.values()]
+                .filter((variable) => variable.only)
+                .map(({ only: _only, ...variable }) => variable);
+        },
+        async holding(conn, targets) {
+            const held = [];
+            for (const target of targets)
+                if ((await secrets(conn).count({
+                    filter: { scope: target.scope, scopeId: target.scopeId },
+                })) > 0)
+                    held.push(target);
+            return held;
+        },
+        async forRun(conn, targets, delivery) {
+            const merged = new Map();
+            for (const target of targets) {
+                const records = await of(conn, target);
+                if (records.length === 0)
+                    continue;
+                for (const record of records)
+                    merged.set(record.name, open(record));
+                await audit(conn, target, {
+                    action: 'deliver',
+                    names: records.map((record) => record.name),
+                    runId: delivery.runId,
+                    runnerId: delivery.runnerId,
+                });
+            }
+            return [...merged].map(([name, value]) => ({ name, value }));
+        },
+        async forJob(conn, refs, delivery) {
+            const values = new Map();
+            const byTarget = new Map();
+            const selected = [];
+            for (const ref of refs) {
+                const key = `${ref.scope}\u0000${ref.scopeId}`;
+                byTarget.set(key, [...(byTarget.get(key) ?? []), ref]);
+            }
+            for (const wanted of byTarget.values()) {
+                const target = { scope: wanted[0].scope, scopeId: wanted[0].scopeId };
+                const names = new Set(wanted.map((ref) => ref.name));
+                const records = (await of(conn, target)).filter((record) => names.has(record.name));
+                if (records.length === 0)
+                    continue;
+                selected.push({ target, records });
+            }
+            if (selected.some(({ records }) => records.some((record) => record.teamRunnersOnly))) {
+                const runner = await runnersRepo(conn).findOne({
+                    filter: { id: delivery.runnerId },
+                });
+                if (runner?.trust !== 'team')
+                    throw new JobSecretsNotAllowed();
+            }
+            for (const { target, records } of selected) {
+                for (const record of records)
+                    values.set(`${target.scope}\u0000${target.scopeId}\u0000${record.name}`, open(record));
+                await audit(conn, target, {
+                    action: 'deliver',
+                    names: records.map((record) => record.name),
+                    jobId: delivery.jobId,
+                    runnerId: delivery.runnerId,
+                });
+            }
+            return values;
+        },
+    };
+}
+//# sourceMappingURL=variable.service.js.map

package/dist/server/core/variables/variable.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"variable.service.js","sourceRoot":"","sources":["../../../../server/core/variables/variable.service.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,GAOzB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAI3D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AA4B5D,SAAS,OAAO,CAAC,IAAwB;IACvC,OAAO,IAAI,CAAC,UAAU,CAAe,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,MAAM,CAAC,IAAwB;IACtC,OAAO,IAAI,CAAC,UAAU,CAAc,gBAAgB,CAAC,CAAC;AACxD,CAAC;AA+FD,6GAA6G;AAC7G,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,EAAE;QACN,CAAC,CAAC,KAAK,CAAC;IACZ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,IAAa,EAAiB,EAAE;QACrD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACjD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAA+B,CAAC;QACjE,OAAO,OAAO,KAAK,KAAK,QAAQ;YAC9B,OAAO,OAAO,KAAK,QAAQ;YAC3B,OAAO,IAAI,KAAK,QAAQ;YACxB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,iBAAiB,CAAC,SAAiC;IACjE,OAAO,SAAS;SACb,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC;SAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,WAAW,CAAC,QAI3B;IACC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa,EAAE,GAAY;IACrE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,MAAM,OAAO,CACX,mGAAmG,EACnG,EAAE,MAAM,EAAE,SAAS,EAAE,CACtB,CAAC;IACJ,IAAI,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC;QAC/B,MAAM,OAAO,CAAC,GAAG,IAAI,eAAe,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,wBAAwB;QAC7D,MAAM,OAAO,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,IAAyB;IAEzB,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAElD,MAAM,EAAE,GAAG,CAAC,IAAwB,EAAE,MAAsB,EAAE,EAAE,CAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACrB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;QACxD,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE;KACzC,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,CACZ,IAAwB,EACxB,MAAsB,EACtB,KAOC,EACD,EAAE,CACF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;QACrB,MAAM,EAAE;YACN,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE;YACd,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YACvB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SAC9B;KACF,CAAC,CAAC;IAEL,MAAM,IAAI,GAAG,CAAC,MAAoB,EAAU,EAAE,CAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B,IAAI,EACJ,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAC5C,CAAC;YACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;gBAChD,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,WAAW;oBAC/B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;oBACzC,CAAC,CAAC,IAAI;aACT,CAAC,CAAC,CAAC;QACN,CAAC;QAED,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CACjD,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC3C,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE;aAC/D,CAAC,CAAC;YACH,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,QAAQ;gBAClC,MAAM,OAAO,CAAC,+BAA+B,EAAE;oBAC7C,MAAM,EAAE,eAAe;iBACxB,CAAC,CAAC;YACL,IAAI,KAAK,KAAK,SAAS;gBAAE,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,MAAM,GACV,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,QAAQ;gBACV,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;oBAC7B,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;oBAC3B,MAAM,EAAE;wBACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;wBAC3D,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;4BACvC,CAAC,CAAC,EAAE;4BACJ,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;wBACjD,WAAW,EAAE,MAAM;wBACnB,SAAS,EAAE,GAAG;qBACf;iBACF,CAAC,CAAC;;gBAEH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;oBAC5B,MAAM,EAAE;wBACN,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE;wBACd,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,IAAI;wBACJ,cAAc,EAAE,MAAO;wBACvB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,KAAK;wBACjD,WAAW,EAAE,MAAM;wBACnB,WAAW,EAAE,MAAM;wBACnB,SAAS,EAAE,GAAG;wBACd,SAAS,EAAE,GAAG;qBACf;iBACF,CAAC,CAAC;YACL,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE;gBAClC,IAAI;gBACJ,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;gBACtC,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC,CAAC;QAEJ,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAC/B,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC3C,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE;aAC/D,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ;gBAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACvE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE;gBAClC,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC,CAAC;QAEJ,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CACzB,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACxB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACtC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;aACpB,CAAC,CAAC,CAAC;YACJ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBACnB,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE;oBACxB,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;oBACxC,MAAM;iBACP,CAAC,CAAC;YACL,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEJ,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,MAAM;YACrC,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;gBACxD,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClE,KAAK;gBACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B,IAAI,EACJ,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CACvC,CAAC;YACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9B,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,MAAM,EAAE,MAAM,CAAC,MAA6B;gBAC5C,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBACnE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM;YACtB,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;gBAC7B,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;aACzD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO;YACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAChC,KAAK,MAAM,MAAM,IAAI,OAAO;gBAC1B,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO;YAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2C,CAAC;YAClE,KAAK,MAAM,MAAM,IAAI,OAAO;gBAC1B,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;oBACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;wBACtB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;qBACtC,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;iBACxB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;iBACnC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO;YACzB,MAAM,IAAI,GAAqB,EAAE,CAAC;YAClC,KAAK,MAAM,MAAM,IAAI,OAAO;gBAC1B,IACE,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;oBACzB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;iBACzD,CAAC,CAAC,GAAG,CAAC;oBAEP,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ;YAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;YACzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBACnC,KAAK,MAAM,MAAM,IAAI,OAAO;oBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpE,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE;oBACxB,MAAM,EAAE,SAAS;oBACjB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ;YAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;YAChD,MAAM,QAAQ,GACZ,EAAE,CAAC;YACL,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,SAAS,GAAG,CAAC,OAAO,EAAE,CAAC;gBAC/C,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrD,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACzD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CACvB,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACrC,CAAC;YACD,IACE,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CACjD,EACD,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;oBAC7C,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE;iBAClC,CAAC,CAAC;gBACH,IAAI,MAAM,EAAE,KAAK,KAAK,MAAM;oBAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;YACjE,CAAC;YACD,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3C,KAAK,MAAM,MAAM,IAAI,OAAO;oBAC1B,MAAM,CAAC,GAAG,CACR,GAAG,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,OAAO,SAAS,MAAM,CAAC,IAAI,EAAE,EAC5D,IAAI,CAAC,MAAM,CAAC,CACb,CAAC;gBACJ,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE;oBACxB,MAAM,EAAE,SAAS;oBACjB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/distribution/dist.service.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Distribution: the runner (`nocobase-runner`) and the application's CLI (such as `acme`), served by the application
+ * itself as standalone tarballs (one per target, each bundling Node), so nothing is published to a registry and a
+ * machine needs nothing installed.
+ *
+ * `nocobase cli build` of `@nocobase/app-cli` (`--runner` for the runner) builds each product into a directory of its
+ * own, with its own manifest, so the products are built and mounted apart (in CI, one artifact each):
+ *
+ *   <dir>/<channel>/<product>/manifest.json
+ *   <dir>/<channel>/<product>/<version>/<product>-v<version>-<target>.tar.gz
+ *
+ * where a product's manifest lists its versions with each target's file (relative to the product's directory),
+ * SHA-256 and size. The application serves one channel (`agents.dist.channel`, `stable` by default); a product's
+ * current version is the one `agents.dist.versions` pins, or the highest the channel has. Only files a manifest lists
+ * are ever served.
+ */
+import { type ReadStream } from 'node:fs';
+import { type DistArtifact, type DistManifest } from '@nocobase/agent-protocol';
+/** `agents.dist` in the application's configuration. */
+export interface DistConfig {
+    /** Where the built tarballs are; `storage/runners/dist` of the application by default. */
+    readonly dir?: string;
+    /** Which channel to serve: `stable` by default. */
+    readonly channel?: string;
+    /** A version to serve per product instead of the channel's highest, such as `{ acme: '0.3.1' }`. */
+    readonly versions?: Readonly<Record<string, string>>;
+}
+export declare const DEFAULT_CHANNEL = "stable";
+/** A file the application may serve, found through the manifest. */
+export interface DistFile {
+    /** The platform it is built for. */
+    readonly target: string;
+    readonly path: string;
+    readonly sha256: string;
+    readonly size: number;
+    open(): ReadStream;
+}
+export interface DistService {
+    readonly channel: string;
+    /** What the channel serves now; empty when nothing was built. */
+    manifest(): Promise<DistManifest>;
+    /** The current `product` for `target`, or null. */
+    find(product: string, target: string): Promise<DistArtifact | null>;
+    /** Like `find`, but 404: `PLATFORM_UNSUPPORTED` with the targets there are, or `NOT_FOUND` for no such product. */
+    resolve(product: string, target: string): Promise<DistArtifact>;
+    /** A file the manifest lists (any version on the channel); 404 otherwise. */
+    file(product: string, version: string, name: string): Promise<DistFile>;
+}
+export declare function createDistService(config?: DistConfig): DistService;
+//# sourceMappingURL=dist.service.d.ts.map

package/dist/server/distribution/dist.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist.service.d.ts","sourceRoot":"","sources":["../../../server/distribution/dist.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAI5D,OAAO,EAOL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,0BAA0B,CAAC;AAKlC,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAED,eAAO,MAAM,eAAe,WAAW,CAAC;AA6BxC,oEAAoE;AACpE,MAAM,WAAW,QAAQ;IACvB,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,IAAI,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAClC,mDAAmD;IACnD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACpE,mHAAmH;IACnH,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAChE,6EAA6E;IAC7E,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACzE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,UAAe,GAAG,WAAW,CA6LtE"}

package/dist/server/distribution/dist.service.js

@@ -0,0 +1,201 @@
+/**
+ * Distribution: the runner (`nocobase-runner`) and the application's CLI (such as `acme`), served by the application
+ * itself as standalone tarballs (one per target, each bundling Node), so nothing is published to a registry and a
+ * machine needs nothing installed.
+ *
+ * `nocobase cli build` of `@nocobase/app-cli` (`--runner` for the runner) builds each product into a directory of its
+ * own, with its own manifest, so the products are built and mounted apart (in CI, one artifact each):
+ *
+ *   <dir>/<channel>/<product>/manifest.json
+ *   <dir>/<channel>/<product>/<version>/<product>-v<version>-<target>.tar.gz
+ *
+ * where a product's manifest lists its versions with each target's file (relative to the product's directory),
+ * SHA-256 and size. The application serves one channel (`agents.dist.channel`, `stable` by default); a product's
+ * current version is the one `agents.dist.versions` pins, or the highest the channel has. Only files a manifest lists
+ * are ever served.
+ */
+import { createReadStream } from 'node:fs';
+import { readdir, readFile, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { compareVersions, DIST_PRODUCT_PATTERN, DIST_ROUTES, DIST_TARGET_PATTERN, ProtocolError, routePath, } from '@nocobase/agent-protocol';
+import { z } from 'zod';
+import { notFound } from '../kernel/errors.js';
+export const DEFAULT_CHANNEL = 'stable';
+const StoredTargetSchema = z.object({
+    file: z.string().min(1),
+    sha256: z.string().regex(/^[0-9a-f]{64}$/u),
+    size: z.number().int().nonnegative(),
+});
+const StoredVersionsSchema = z.record(z.string(), z.object({ targets: z.record(z.string(), StoredTargetSchema) }));
+/** The manifest of one product, `<channel>/<product>/manifest.json`, with files relative to the product's directory. */
+const ProductManifestSchema = z.object({
+    schema: z.literal(1),
+    product: z.string().regex(DIST_PRODUCT_PATTERN),
+    bin: z.string().optional(),
+    versions: StoredVersionsSchema,
+});
+export function createDistService(config = {}) {
+    const channel = config.channel ?? DEFAULT_CHANNEL;
+    const channelDir = config.dir === undefined ? null : path.resolve(config.dir, channel);
+    let cache;
+    /** Each product's manifest file with its modification time, or nothing when there is none. */
+    const manifestFiles = async () => {
+        if (channelDir === null)
+            return [];
+        const found = [];
+        let entries;
+        try {
+            entries = (await readdir(channelDir)).sort();
+        }
+        catch {
+            return found;
+        }
+        for (const product of entries) {
+            if (!DIST_PRODUCT_PATTERN.test(product))
+                continue;
+            const file = path.join(channelDir, product, 'manifest.json');
+            try {
+                found.push({ file, product, mtimeMs: (await stat(file)).mtimeMs });
+            }
+            catch {
+                // A product not built yet.
+            }
+        }
+        return found;
+    };
+    const readManifest = async (file) => {
+        try {
+            return JSON.parse(await readFile(file, 'utf8'));
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const load = async () => {
+        const files = await manifestFiles();
+        if (files.length === 0) {
+            cache = undefined;
+            return null;
+        }
+        const key = files
+            .map((entry) => `${entry.file}:${entry.mtimeMs}`)
+            .join('|');
+        if (cache?.key === key)
+            return cache.manifest;
+        const merged = { products: {} };
+        for (const entry of files) {
+            const raw = await readManifest(entry.file);
+            const product = entry.product;
+            const parsed = ProductManifestSchema.safeParse(raw);
+            if (!parsed.success || parsed.data.product !== product) {
+                console.error(`Agents: ${entry.file} is not the distribution manifest of ${product}.`);
+                continue;
+            }
+            // Its files are relative to the product's directory; the merged ones are relative to the channel's.
+            const versions = {};
+            for (const [version, stored] of Object.entries(parsed.data.versions))
+                versions[version] = {
+                    targets: Object.fromEntries(Object.entries(stored.targets).map(([target, file]) => [
+                        target,
+                        { ...file, file: path.posix.join(product, file.file) },
+                    ])),
+                };
+            merged.products[product] = {
+                ...(parsed.data.bin === undefined ? {} : { bin: parsed.data.bin }),
+                versions,
+            };
+        }
+        cache = { key, manifest: merged };
+        return merged;
+    };
+    const currentVersion = (stored, product) => {
+        const versions = Object.keys(stored.products[product]?.versions ?? {});
+        const pinned = config.versions?.[product];
+        if (pinned !== undefined)
+            return versions.includes(pinned) ? pinned : null;
+        return versions.sort(compareVersions).at(-1) ?? null;
+    };
+    const artifact = (stored, product, target) => {
+        const version = currentVersion(stored, product);
+        if (version === null)
+            return null;
+        const entry = stored.products[product]?.versions[version]?.targets[target];
+        if (entry === undefined)
+            return null;
+        return {
+            product,
+            version,
+            target,
+            url: routePath(DIST_ROUTES.file, {
+                product,
+                version,
+                file: path.posix.basename(entry.file),
+            }),
+            sha256: entry.sha256,
+            size: entry.size,
+            channel,
+        };
+    };
+    return {
+        channel,
+        async manifest() {
+            const stored = await load();
+            const products = {};
+            for (const product of Object.keys(stored?.products ?? {})) {
+                const version = stored && currentVersion(stored, product);
+                if (!stored || version === null)
+                    continue;
+                products[product] = {
+                    version,
+                    targets: Object.keys(stored.products[product]?.versions[version]?.targets ?? {}).sort(),
+                };
+            }
+            return { channel, products };
+        },
+        async find(product, target) {
+            const stored = await load();
+            return stored ? artifact(stored, product, target) : null;
+        },
+        async resolve(product, target) {
+            if (!DIST_PRODUCT_PATTERN.test(product))
+                throw notFound('Product');
+            if (!DIST_TARGET_PATTERN.test(target))
+                throw new ProtocolError('PLATFORM_UNSUPPORTED', `${target} is not a platform name such as darwin-arm64 or linux-x64.`);
+            const stored = await load();
+            const found = stored ? artifact(stored, product, target) : null;
+            if (found)
+                return found;
+            const version = stored ? currentVersion(stored, product) : null;
+            if (!stored || version === null)
+                throw new ProtocolError('NOT_FOUND', `This application serves no ${product} on the ${channel} channel. Build it with nocobase cli build.`);
+            const targets = Object.keys(stored.products[product]?.versions[version]?.targets ?? {}).sort();
+            throw new ProtocolError('PLATFORM_UNSUPPORTED', `${product} ${version} is not built for ${target}; it is for ${targets.join(', ') || 'no platform'}.`, { targets });
+        },
+        async file(product, version, name) {
+            const stored = await load();
+            const targets = stored?.products[product]?.versions[version]?.targets;
+            const found = Object.entries(targets ?? {}).find(([, candidate]) => path.posix.basename(candidate.file) === name);
+            if (!found || channelDir === null)
+                throw notFound('File');
+            const [target, entry] = found;
+            const file = path.resolve(channelDir, entry.file);
+            if (!file.startsWith(`${channelDir}${path.sep}`))
+                throw notFound('File');
+            let size;
+            try {
+                size = (await stat(file)).size;
+            }
+            catch {
+                throw notFound('File');
+            }
+            return {
+                target,
+                path: file,
+                sha256: entry.sha256,
+                size,
+                open: () => createReadStream(file),
+            };
+        },
+    };
+}
+//# sourceMappingURL=dist.service.js.map

package/dist/server/distribution/dist.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist.service.js","sourceRoot":"","sources":["../../../server/distribution/dist.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,gBAAgB,EAAmB,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,aAAa,EACb,SAAS,GAGV,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAY/C,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CACnC,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAChE,CAAC;AAEF,wHAAwH;AACxH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,QAAQ,EAAE,oBAAoB;CAC/B,CAAC,CAAC;AAgCH,MAAM,UAAU,iBAAiB,CAAC,SAAqB,EAAE;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;IAClD,MAAM,UAAU,GACd,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,KAA4D,CAAC;IAEjE,8FAA8F;IAC9F,MAAM,aAAa,GAAG,KAAK,IAEzB,EAAE;QACF,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,KAAK,GAAyD,EAAE,CAAC;QACvE,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAS;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;YAC7D,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;YAAC,MAAM,CAAC;gBACP,2BAA2B;YAC7B,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE;QAC5D,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,IAAoC,EAAE;QACtD,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,GAAG,SAAS,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,KAAK;aACd,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;aAChD,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,KAAK,EAAE,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;QAC9C,MAAM,MAAM,GAAmB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,CACX,WAAW,KAAK,CAAC,IAAI,wCAAwC,OAAO,GAAG,CACxE,CAAC;gBACF,SAAS;YACX,CAAC;YACD,oGAAoG;YACpG,MAAM,QAAQ,GAAmD,EAAE,CAAC;YACpE,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAClE,QAAQ,CAAC,OAAO,CAAC,GAAG;oBAClB,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;wBACrD,MAAM;wBACN,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;qBACvD,CAAC,CACH;iBACF,CAAC;YACJ,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG;gBACzB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClE,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CACrB,MAAsB,EACtB,OAAe,EACA,EAAE;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,OAAO,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACvD,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CACf,MAAsB,EACtB,OAAe,EACf,MAAc,EACO,EAAE;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO;YACL,OAAO;YACP,OAAO;YACP,MAAM;YACN,GAAG,EAAE,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE;gBAC/B,OAAO;gBACP,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;aACtC,CAAC;YACF,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO;SACR,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QAEP,KAAK,CAAC,QAAQ;YACZ,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,MAAM,QAAQ,GACZ,EAAE,CAAC;YACL,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC1D,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,IAAI;oBAAE,SAAS;gBAC1C,QAAQ,CAAC,OAAO,CAAC,GAAG;oBAClB,OAAO;oBACP,OAAO,EAAE,MAAM,CAAC,IAAI,CAClB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI,EAAE,CAC3D,CAAC,IAAI,EAAE;iBACT,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM;YACxB,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM;YAC3B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACnE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnC,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,GAAG,MAAM,4DAA4D,CACtE,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChE,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChE,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,IAAI;gBAC7B,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,8BAA8B,OAAO,WAAW,OAAO,6CAA6C,CACrG,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI,EAAE,CAC3D,CAAC,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,GAAG,OAAO,IAAI,OAAO,qBAAqB,MAAM,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,GAAG,EACrG,EAAE,OAAO,EAAE,CACZ,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI;YAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;YACtE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAChE,CAAC;YACF,IAAI,CAAC,KAAK,IAAI,UAAU,KAAK,IAAI;gBAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzE,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YACD,OAAO;gBACL,MAAM;gBACN,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI;gBACJ,IAAI,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;aACnC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/distribution/download-tokens.d.ts

@@ -0,0 +1,30 @@
+import type { DownloadToken } from '../../shared/runners.js';
+import { type Clock } from '../kernel/clock.js';
+import type { IdSource } from '../kernel/ids.js';
+import type { TxRunner } from '../kernel/tx.js';
+/** How long a download token stays usable. */
+export declare const DOWNLOAD_TOKEN_TTL_MS: number;
+/** How many tarball downloads one token allows, so a failed download can be retried. */
+export declare const DOWNLOAD_TOKEN_MAX_DOWNLOADS = 3;
+/** What a request with a download token asks for. */
+export interface DownloadRequest {
+    readonly product?: string;
+    /** The platform it resolves or downloads for; absent for the manifest. */
+    readonly target?: string;
+    /** A tarball download, which counts against the token. */
+    readonly download?: boolean;
+}
+export interface DownloadTokenService {
+    create(createdById: string | null): Promise<DownloadToken>;
+    /** Lets `request` through with `token`, binding its platform and counting a download; `DOWNLOAD_TOKEN_INVALID` otherwise. */
+    admit(token: string, request: DownloadRequest): Promise<void>;
+}
+export interface DownloadTokenServiceDeps {
+    /** The one product a download token downloads: the application's CLI (`agents.cli.name`). */
+    readonly product: string;
+    readonly tx: TxRunner;
+    readonly ids: IdSource;
+    readonly clock: Clock;
+}
+export declare function createDownloadTokenService(deps: DownloadTokenServiceDeps): DownloadTokenService;
+//# sourceMappingURL=download-tokens.d.ts.map

package/dist/server/distribution/download-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"download-tokens.d.ts","sourceRoot":"","sources":["../../../server/distribution/download-tokens.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAS,KAAK,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAMvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,EAAE,MAAoB,CAAC;AAEzD,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAkB9C,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3D,6HAA6H;IAC7H,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,wBAAwB;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,wBAAwB,GAC7B,oBAAoB,CAwEtB"}