@nocobase/app-plugin-agents 0.0.0-stage → 0.1.0-beta.2

package/dist/server/routes/index.js

@@ -0,0 +1,105 @@
+/**
+ * The plugin's HTTP API, under `/api/agents`. Every route carries its own authentication, because the paths of
+ * different callers share the one namespace:
+ *
+ * - people, by session: agents, skills, variables, runs, conversations, model services, prices, usage and runners
+ *   (`admin.ts`, `chat.ts`, `online/routes.ts`, `runners/admin.ts`). Scoped API keys reach only the routes whose every
+ *   operation is a settings check through `authz.can` (agents, skills, model services, prices and usage); everything
+ *   else has a personal fallback a key's scope could not bound.
+ * - a run, by its run token: `/agents/runs/current` (`run.ts`).
+ * - a person or a run: `/agents/available`, the agents the caller may give work to (`roster.ts`).
+ * - runners, by key: the runner protocol under `/agents/runners` (`runners/runner.ts`).
+ * - the tarballs, by runner key, registration token, download token or session: `/agents/dist` (`runners/dist.ts`),
+ *   where a person mints download tokens; the install script, `/agents/dist/installScript`, needs no credential.
+ *
+ * Fixed segments are registered before `/agents/:agentId` (agent ids are generated, never chosen).
+ */
+import { authenticationToken } from '@nocobase/app-plugin-authentication';
+import { authorizationToken, } from '@nocobase/app-plugin-authorization';
+import { loggingToken } from '@nocobase/app-server/logging';
+import { defineApiRoutes, } from '@nocobase/app-server/router';
+import { Hono } from 'hono';
+import { every } from 'hono/combine';
+import { agentsAccessToken, agentsToken } from '../tokens.js';
+import { createAdminRoutes } from './admin.js';
+import { createChatRoutes } from './chat.js';
+import { createModelRoutes } from '../online/routes.js';
+import { createRosterRoutes } from './roster.js';
+import { createRunRoutes } from './run.js';
+import { createAdminRoutes as createRunnersAdminRoutes, } from './runners/admin.js';
+import { createDistRoutes } from './runners/dist.js';
+import { createInstallRoutes } from './runners/install.js';
+import { createRunnerRoutes } from './runners/runner.js';
+import { runIdentityOf } from '../cli/run-credential.js';
+import { ProtocolError } from '../kernel/errors.js';
+export const apiRoutes = defineApiRoutes((app) => {
+    const { container } = app;
+    const services = container.resolve(agentsToken);
+    const authentication = container.resolve(authenticationToken);
+    const authorization = container.resolve(authorizationToken);
+    const caller = async (context, next) => {
+        const auth = context.get('auth');
+        if (!auth)
+            throw new ProtocolError('UNAUTHORIZED', 'Sign in first.');
+        const authz = context.get('authz');
+        const run = runIdentityOf(auth)?.run?.run;
+        context.set('caller', {
+            userId: auth.user.id,
+            run: run
+                ? { subjectKind: run.subjectKind, subjectId: run.subjectId }
+                : null,
+            can: (item, action) => authz.can({ resource: { type: 'settings', id: item }, action }),
+            opens: (page) => authz.can({ resource: { type: 'page', id: page }, action: 'access' }),
+            // Business levels come from the application's roles; without them, every level is none.
+            scope: (key) => container.has(agentsAccessToken)
+                ? container.resolve(agentsAccessToken).scopeOf(authz.identity, key)
+                : Promise.resolve('none'),
+        });
+        await next();
+    };
+    const guard = (scopedKeys) => every(authentication.required({ scopedKeys }), authorization.middleware(), caller);
+    // A person; scoped API keys and service-account keys are refused (`SCOPED_KEY_FORBIDDEN`).
+    const person = guard(false);
+    // A person, or a scoped key: only where every operation is a settings check the key's scope narrows.
+    const personOrScopedKey = guard(true);
+    // A person, or a run by its token (`caller.run`); other scoped keys are refused, as by `person`.
+    const personOrRun = every(authentication.required({ scopedKeys: true }), (async (context, next) => {
+        const auth = context.get('auth');
+        if (auth &&
+            !runIdentityOf(auth) &&
+            (await authentication.isScopedSession(auth, context.req.raw)))
+            throw new ProtocolError('SCOPED_KEY_FORBIDDEN', 'This endpoint does not accept scoped API keys or service-account keys.');
+        await next();
+    }), authorization.middleware(), caller);
+    const router = new Hono();
+    router.route('/agents/dist', createInstallRoutes({
+        cli: () => services.cli.name,
+        publicBasePath: app.publicBasePath,
+        publicOrigin: () => app.config.get('app')?.publicOrigin,
+    }));
+    router.route('/agents/dist', createDistRoutes(services, {
+        // Any key may download the CLI, so CI with an organization's key can install it before it signs in.
+        authenticatePerson: authentication.required({
+            scopedKeys: true,
+        }),
+        person: person,
+    }));
+    router.route('/agents/runners', createRunnerRoutes(services));
+    router.route('/agents/runners', createRunnersAdminRoutes(services, person, {
+        logger: container.has(loggingToken)
+            ? container.resolve(loggingToken).getLogger('security')
+            : undefined,
+    }));
+    router.route('/agents', createRunRoutes(services));
+    router.route('/agents', createRosterRoutes(services, personOrScopedKey));
+    router.route('/agents', createChatRoutes(services, person, personOrRun));
+    router.route('/agents', createModelRoutes(services, person, personOrScopedKey));
+    // Last: it holds `/agents/:agentId`.
+    router.route('/agents', createAdminRoutes(services, person, personOrScopedKey));
+    return router;
+});
+const routes = [
+    apiRoutes,
+];
+export default routes;
+//# sourceMappingURL=index.js.map

package/dist/server/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EACL,kBAAkB,GAEnB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EACL,eAAe,GAGhB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,IAAI,EAA0B,MAAM,MAAM,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAiB,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EACL,iBAAiB,IAAI,wBAAwB,GAE9C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,CAAC,MAAM,SAAS,GACpB,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE;IACtB,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAK5D,MAAM,MAAM,GAAgC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAClE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE;YACpB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,GAAG,EAAE,GAAG;gBACN,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;gBAC5D,CAAC,CAAC,IAAI;YACR,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CACpB,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;YACjE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACd,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACvE,wFAAwF;YACxF,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CACb,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC9B,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;gBACnE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,UAAmB,EAA+B,EAAE,CACjE,KAAK,CACH,cAAc,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,EACvC,aAAa,CAAC,UAAU,EAAE,EAC1B,MAAM,CACP,CAAC;IACJ,2FAA2F;IAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,qGAAqG;IACrG,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,iGAAiG;IACjG,MAAM,WAAW,GAAgC,KAAK,CACpD,cAAc,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAC7C,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IACE,IAAI;YACJ,CAAC,aAAa,CAAC,IAAI,CAAC;YACpB,CAAC,MAAM,cAAc,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAE7D,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,wEAAwE,CACzE,CAAC;QACJ,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAgC,EACjC,aAAa,CAAC,UAAU,EAAE,EAC1B,MAAM,CACP,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAC1B,MAAM,CAAC,KAAK,CACV,cAAc,EACd,mBAAmB,CAAC;QAClB,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI;QAC5B,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,YAAY,EAAE,GAAG,EAAE,CACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAA4B,KAAK,CAAC,EAAE,YAAY;KACjE,CAAC,CACH,CAAC;IACF,MAAM,CAAC,KAAK,CACV,cAAc,EACd,gBAAgB,CAAC,QAAQ,EAAE;QACzB,oGAAoG;QACpG,kBAAkB,EAAE,cAAc,CAAC,QAAQ,CAAC;YAC1C,UAAU,EAAE,IAAI;SACjB,CAAsB;QACvB,MAAM,EAAE,MAAuD;KAChE,CAAC,CACH,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CACV,iBAAiB,EACjB,wBAAwB,CACtB,QAAQ,EACR,MAAuD,EACvD;QACE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC;YACvD,CAAC,CAAC,SAAS;KACd,CACF,CACF,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CACV,SAAS,EACT,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,CACvD,CAAC;IACF,qCAAqC;IACrC,MAAM,CAAC,KAAK,CACV,SAAS,EACT,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,CACvD,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,MAAM,MAAM,GAA0D;IACpE,SAAS;CACV,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/server/routes/openapi.d.ts

@@ -0,0 +1,30 @@
+import { type ApiDocumentFragment, type ApiResponseObject, type DescribeRouteOptions, type OpenAPIV3_1 } from '@nocobase/app-server/router';
+import type { z } from 'zod';
+/** The tag every agents operation is listed under. */
+export declare const tags: string[];
+/** Security scheme names, in `components.securitySchemes`. */
+export declare const SECURITY_SCHEMES: {
+    readonly runToken: "runToken";
+    readonly runnerKey: "runnerKey";
+    readonly registrationToken: "registrationToken";
+    readonly downloadToken: "downloadToken";
+};
+/** The schemes, with the headers they travel in, merged into the document by the plugin's provider. */
+export declare function agentsSecurityFragment(): ApiDocumentFragment;
+/** Only a run token. */
+export declare const runTokenSecurity: OpenAPIV3_1.SecurityRequirementObject[];
+/** Only a runner key. */
+export declare const runnerKeySecurity: OpenAPIV3_1.SecurityRequirementObject[];
+/** A person (session or API key), or a run token. */
+export declare const personOrRunSecurity: OpenAPIV3_1.SecurityRequirementObject[];
+/** A runner key, a registration token, a download token, or a person (session or API key). */
+export declare const downloadSecurity: OpenAPIV3_1.SecurityRequirementObject[];
+/** The protocol version header a runner sends with every request. */
+export declare const protocolHeader: OpenAPIV3_1.ParameterObject;
+/** The errors of a request authenticated by a runner key. */
+export declare const runnerKeyErrors: Readonly<Record<string, ApiResponseObject>>;
+/** The errors of a report on a run or a job the runner holds. */
+export declare const heldWorkErrors: Readonly<Record<string, ApiResponseObject>>;
+/** A JSON request body documented without being validated by the route itself, which reads it in the handler. */
+export declare function jsonRequestBody(schema: z.ZodType): NonNullable<DescribeRouteOptions['requestBody']>;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/server/routes/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../../server/routes/openapi.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,sDAAsD;AACtD,eAAO,MAAM,IAAI,EAAE,MAAM,EAAe,CAAC;AAEzC,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,uGAAuG;AACvG,wBAAgB,sBAAsB,IAAI,mBAAmB,CAqC5D;AAED,wBAAwB;AACxB,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,yBAAyB,EAEnE,CAAC;AAEF,yBAAyB;AACzB,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,yBAAyB,EAEpE,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,yBAAyB,EAItE,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,yBAAyB,EAMnE,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,eAOxC,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAMvE,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAetE,CAAC;AAEF,iHAAiH;AACjH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,CAAC,CAAC,OAAO,GAChB,WAAW,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAKlD"}

package/dist/server/routes/openapi.js

@@ -0,0 +1,101 @@
+/**
+ * What the plugin's routes share in the API document: the tag, the credentials that are not a session or an API key
+ * (a run token, a runner key, a registration token, a download token) as security schemes, and the requirements built from them.
+ */
+import { HEADERS } from '@nocobase/agent-protocol';
+import { apiErrorResponse, resolver, } from '@nocobase/app-server/router';
+/** The tag every agents operation is listed under. */
+export const tags = ['Agents'];
+/** Security scheme names, in `components.securitySchemes`. */
+export const SECURITY_SCHEMES = {
+    runToken: 'runToken',
+    runnerKey: 'runnerKey',
+    registrationToken: 'registrationToken',
+    downloadToken: 'downloadToken',
+};
+/** The schemes, with the headers they travel in, merged into the document by the plugin's provider. */
+export function agentsSecurityFragment() {
+    return {
+        owner: '@nocobase/app-plugin-agents',
+        namespace: 'agents',
+        components: {
+            securitySchemes: {
+                [SECURITY_SCHEMES.runToken]: {
+                    type: 'apiKey',
+                    in: 'header',
+                    name: HEADERS.runToken,
+                    description: "A run's token, which the runner hands the agent's CLI for the run. It acts as the person who woke the agent, within the agent's business actions, and works only while a runner holds the run.",
+                },
+                [SECURITY_SCHEMES.runnerKey]: {
+                    type: 'apiKey',
+                    in: 'header',
+                    name: HEADERS.runnerKey,
+                    description: "A runner's key, issued when it registered. Runner protocol requests also send their protocol version in `x-nocobase-protocol`.",
+                },
+                [SECURITY_SCHEMES.registrationToken]: {
+                    type: 'apiKey',
+                    in: 'header',
+                    name: HEADERS.registrationToken,
+                    description: 'An unused one-time registration token from "Add runtime", so the install script can download the runner before it registers with the token.',
+                },
+                [SECURITY_SCHEMES.downloadToken]: {
+                    type: 'apiKey',
+                    in: 'header',
+                    name: HEADERS.downloadToken,
+                    description: 'A short-lived download token a signed-in person created (`POST /api/agents/dist/downloadTokens`), so the install script can download the CLI on a machine where nobody is signed in yet: the CLI alone, for the platform of its first request, a few times within 30 minutes.',
+                },
+            },
+        },
+    };
+}
+/** Only a run token. */
+export const runTokenSecurity = [
+    { [SECURITY_SCHEMES.runToken]: [] },
+];
+/** Only a runner key. */
+export const runnerKeySecurity = [
+    { [SECURITY_SCHEMES.runnerKey]: [] },
+];
+/** A person (session or API key), or a run token. */
+export const personOrRunSecurity = [
+    { cookieAuth: [] },
+    { apiKeyAuth: [] },
+    { [SECURITY_SCHEMES.runToken]: [] },
+];
+/** A runner key, a registration token, a download token, or a person (session or API key). */
+export const downloadSecurity = [
+    { [SECURITY_SCHEMES.runnerKey]: [] },
+    { [SECURITY_SCHEMES.registrationToken]: [] },
+    { [SECURITY_SCHEMES.downloadToken]: [] },
+    { cookieAuth: [] },
+    { apiKeyAuth: [] },
+];
+/** The protocol version header a runner sends with every request. */
+export const protocolHeader = {
+    in: 'header',
+    name: HEADERS.protocol,
+    required: false,
+    schema: { type: 'integer' },
+    description: 'The runner protocol version the runner speaks. A runner whose protocol this application does not serve is kept connected but given no work, and its run and job reports are refused with `PROTOCOL_UNSUPPORTED`.',
+};
+/** The errors of a request authenticated by a runner key. */
+export const runnerKeyErrors = {
+    401: apiErrorResponse(401, 'No runner key, or one that is unknown or revoked, or whose owner is disabled (`RUNNER_KEY_INVALID`, `RUNNER_REVOKED`, `RUNNER_OWNER_DISABLED`).'),
+    500: apiErrorResponse(500),
+};
+/** The errors of a report on a run or a job the runner holds. */
+export const heldWorkErrors = {
+    ...runnerKeyErrors,
+    400: apiErrorResponse(400, 'The work has ended (`RUN_NOT_ACTIVE`), or the runner speaks a protocol this application does not serve (`PROTOCOL_UNSUPPORTED`).'),
+    403: apiErrorResponse(403, 'Another runner holds the work (`RUN_NOT_OWNED`).'),
+    404: apiErrorResponse(404),
+    409: apiErrorResponse(409, 'The lease was lost: the work moved on, and the runner must stop it (`LEASE_LOST`).'),
+};
+/** A JSON request body documented without being validated by the route itself, which reads it in the handler. */
+export function jsonRequestBody(schema) {
+    return {
+        required: false,
+        content: { 'application/json': { schema: resolver(schema, 'input') } },
+    };
+}
+//# sourceMappingURL=openapi.js.map

package/dist/server/routes/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../../server/routes/openapi.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EACL,gBAAgB,EAChB,QAAQ,GAKT,MAAM,6BAA6B,CAAC;AAGrC,sDAAsD;AACtD,MAAM,CAAC,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,CAAC;AAEzC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,aAAa,EAAE,eAAe;CACtB,CAAC;AAEX,uGAAuG;AACvG,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,KAAK,EAAE,6BAA6B;QACpC,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE;YACV,eAAe,EAAE;gBACf,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE;oBAC3B,IAAI,EAAE,QAAQ;oBACd,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,OAAO,CAAC,QAAQ;oBACtB,WAAW,EACT,gMAAgM;iBACnM;gBACD,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE;oBAC5B,IAAI,EAAE,QAAQ;oBACd,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,OAAO,CAAC,SAAS;oBACvB,WAAW,EACT,gIAAgI;iBACnI;gBACD,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE;oBACpC,IAAI,EAAE,QAAQ;oBACd,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,OAAO,CAAC,iBAAiB;oBAC/B,WAAW,EACT,6IAA6I;iBAChJ;gBACD,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE;oBAChC,IAAI,EAAE,QAAQ;oBACd,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,OAAO,CAAC,aAAa;oBAC3B,WAAW,EACT,+QAA+Q;iBAClR;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,MAAM,gBAAgB,GAA4C;IACvE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE;CACpC,CAAC;AAEF,yBAAyB;AACzB,MAAM,CAAC,MAAM,iBAAiB,GAA4C;IACxE,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE;CACrC,CAAC;AAEF,qDAAqD;AACrD,MAAM,CAAC,MAAM,mBAAmB,GAA4C;IAC1E,EAAE,UAAU,EAAE,EAAE,EAAE;IAClB,EAAE,UAAU,EAAE,EAAE,EAAE;IAClB,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE;CACpC,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAA4C;IACvE,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE;IACpC,EAAE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE;IAC5C,EAAE,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE;IACxC,EAAE,UAAU,EAAE,EAAE,EAAE;IAClB,EAAE,UAAU,EAAE,EAAE,EAAE;CACnB,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAgC;IACzD,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,OAAO,CAAC,QAAQ;IACtB,QAAQ,EAAE,KAAK;IACf,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,WAAW,EACT,kNAAkN;CACrN,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,eAAe,GAAgD;IAC1E,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,iJAAiJ,CAClJ;IACD,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC;CAC3B,CAAC;AAEF,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAgD;IACzE,GAAG,eAAe;IAClB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,kIAAkI,CACnI;IACD,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,kDAAkD,CACnD;IACD,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC;IAC1B,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,oFAAoF,CACrF;CACF,CAAC;AAEF,iHAAiH;AACjH,MAAM,UAAU,eAAe,CAC7B,MAAiB;IAEjB,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE;KACvE,CAAC;AACJ,CAAC"}

package/dist/server/routes/roster.d.ts

@@ -0,0 +1,6 @@
+import type { Hono, MiddlewareHandler } from 'hono';
+import type { Agents } from '../composition.js';
+import type { AdminEnv } from './admin.js';
+/** `guard` authenticates the request (a run token included) and sets `caller`. */
+export declare function createRosterRoutes(services: Agents, guard: MiddlewareHandler<AdminEnv>): Hono<AdminEnv>;
+//# sourceMappingURL=roster.d.ts.map

package/dist/server/routes/roster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roster.d.ts","sourceRoot":"","sources":["../../../server/routes/roster.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,kFAAkF;AAClF,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,CAsDhB"}

package/dist/server/routes/roster.js

@@ -0,0 +1,53 @@
+/**
+ * `GET /api/agents/available`: the agents the caller may give work to, for a person (session or API key, scoped keys
+ * included) and for an agent's run, which asks for the person who woke it. The agents' configuration is the settings
+ * API's (`GET /api/agents`, `agents.agents` read); this answers only what picking one needs.
+ */
+import { apiErrorResponses, cliRoute, describeRoute, listResponse, } from '@nocobase/app-server/router';
+import { entryTools } from '../../shared/agents.js';
+import { AGENTS_VIEW_ACTION } from '../core/callers/index.js';
+import { domainRouter } from '../kernel/http.js';
+import { personOrRunSecurity, tags } from './openapi.js';
+import { AvailableAgentSchema } from './schemas.js';
+/** `guard` authenticates the request (a run token included) and sets `caller`. */
+export function createRosterRoutes(services, guard) {
+    const router = domainRouter();
+    router.get('/available', guard, describeRoute({
+        tags,
+        summary: 'List the agents the caller may give work to',
+        operationId: 'agentsListAvailableAgents',
+        description: 'The agents that are not archived and that the caller (for a run, the person who woke its agent) may wake: what each is good at, and whether it can take work now. An online agent with no model of its own answers with the system default chat model, and is left out only while there is none.',
+        security: personOrRunSecurity,
+        responses: {
+            200: listResponse(AvailableAgentSchema),
+            ...apiErrorResponses,
+        },
+        ...cliRoute({
+            command: 'agent list',
+            action: AGENTS_VIEW_ACTION,
+            columns: ['id', 'name', 'type', 'online', 'busy', 'goodAt'],
+            examples: ['agent list', 'agent list --json'],
+        }),
+    }), async (context) => {
+        const userId = context.get('caller').userId;
+        const hasDefault = Boolean((await services.online.services.defaults()).effectiveChat);
+        const agents = (await services.agents.list()).filter((agent) => !agent.archivedAt &&
+            (agent.modelEntries.length > 0 ||
+                (agent.type === 'online' && hasDefault)) &&
+            services.agents.mayInvoke(agent, userId));
+        // Whether a runner would take the caller's work: theirs, or a team runner allowed the agent's variables.
+        const availability = await services.availability(services.tx.read(), agents, userId);
+        const data = agents.map((agent) => ({
+            id: agent.id,
+            name: agent.name,
+            goodAt: agent.description ?? '',
+            type: agent.type,
+            tool: entryTools(agent)[0] ?? null,
+            online: availability.get(agent.id)?.online ?? false,
+            busy: availability.get(agent.id)?.busy ?? 0,
+        }));
+        return context.json({ data, meta: { total: data.length } });
+    });
+    return router;
+}
+//# sourceMappingURL=roster.js.map

package/dist/server/routes/roster.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roster.js","sourceRoot":"","sources":["../../../server/routes/roster.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,YAAY,GACb,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,UAAU,EAAuB,MAAM,wBAAwB,CAAC;AAEzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,KAAkC;IAElC,MAAM,MAAM,GAAG,YAAY,EAAY,CAAC;IACxC,MAAM,CAAC,GAAG,CACR,YAAY,EACZ,KAAK,EACL,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,6CAA6C;QACtD,WAAW,EAAE,2BAA2B;QACxC,WAAW,EACT,kSAAkS;QACpS,QAAQ,EAAE,mBAAmB;QAC7B,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,oBAAoB,CAAC;YACvC,GAAG,iBAAiB;SACrB;QACD,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YAC3D,QAAQ,EAAE,CAAC,YAAY,EAAE,mBAAmB,CAAC;SAC9C,CAAC;KACH,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAC5C,MAAM,UAAU,GAAG,OAAO,CACxB,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,aAAa,CAC1D,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,UAAU;YACjB,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;gBAC5B,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC;YAC1C,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAC3C,CAAC;QACF,yGAAyG;QACzG,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,YAAY,CAC9C,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAClB,MAAM,EACN,MAAM,CACP,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAkB,EAAE,CAAC,CAAC;YAClD,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;YAClC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,IAAI,KAAK;YACnD,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC;SAC5C,CAAC,CAAC,CAAC;QACJ,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/run.d.ts

@@ -0,0 +1,10 @@
+import type { Hono } from 'hono';
+import type { Agents } from '../composition.js';
+import type { RunTokenIdentity } from '../core/runs/index.js';
+export interface RunEnv {
+    Variables: {
+        run: RunTokenIdentity;
+    };
+}
+export declare function createRunRoutes(services: Agents): Hono<RunEnv>;
+//# sourceMappingURL=run.d.ts.map

package/dist/server/routes/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../server/routes/run.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,EAAqB,MAAM,MAAM,CAAC;AAKpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAmB9D,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE;QAAE,GAAG,EAAE,gBAAgB,CAAA;KAAE,CAAC;CACtC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CA2G9D"}

package/dist/server/routes/run.js

@@ -0,0 +1,91 @@
+/**
+ * The run endpoints (`RUN_ROUTES`), mounted at `/api/agents`: what the agent's CLI asks about its own run
+ * (`/runs/current`), and the title a run on a conversation gives it, authenticated by the run token header.
+ */
+import { HEADERS, ProtocolError, RunSelfSchema, } from '@nocobase/agent-protocol';
+import { apiErrorResponse, apiValidator, cliRoute, dataResponse, describeRoute, } from '@nocobase/app-server/router';
+import { z } from 'zod';
+import { CONVERSATION_TITLE_AGENT_MAX } from '../../shared/conversations.js';
+import { RUN_SELF_ACTION } from '../core/callers/index.js';
+import { domainRouter } from '../kernel/http.js';
+import { runTokenSecurity, tags } from './openapi.js';
+import { RunContextSchema } from './schemas.js';
+const ConversationTitleInput = z.strictObject({
+    title: z
+        .string()
+        .min(1)
+        .max(CONVERSATION_TITLE_AGENT_MAX)
+        .meta({ description: 'The title, at most 40 characters.' }),
+});
+const RunConversationSchema = z.object({
+    id: z.string(),
+    title: z.string().nullable(),
+});
+export function createRunRoutes(services) {
+    const router = domainRouter();
+    const runToken = async (context, next) => {
+        context.set('run', await services.runs.authenticateToken(context.req.header(HEADERS.runToken) ?? ''));
+        await next();
+    };
+    const runTokenErrors = {
+        401: apiErrorResponse(401, 'No run token, or one that is unknown or whose run no runner holds (`RUN_TOKEN_INVALID`).'),
+        500: apiErrorResponse(500),
+    };
+    router.get('/runs/current', runToken, describeRoute({
+        tags,
+        summary: 'Get the run the token belongs to',
+        operationId: 'agentsGetCurrentRun',
+        description: "What the agent's CLI asks about its own run: the run, its agent, subject and the person who woke it.",
+        security: runTokenSecurity,
+        responses: { 200: dataResponse(RunSelfSchema), ...runTokenErrors },
+        ...cliRoute({ command: 'run self', action: RUN_SELF_ACTION }),
+    }), async (context) => context.json({ data: await services.runs.self(context.get('run')) }));
+    router.get('/runs/current/context', runToken, describeRoute({
+        tags,
+        summary: "Get the context of the token's run",
+        operationId: 'agentsGetCurrentRunContext',
+        description: "The context the run's subject assembles for it now; its fields depend on the subject kind.",
+        security: runTokenSecurity,
+        responses: {
+            200: dataResponse(RunContextSchema),
+            404: apiErrorResponse(404, 'The subject has no context to give (`RUN_CONTEXT_NOT_FOUND`).'),
+            ...runTokenErrors,
+        },
+        ...cliRoute({ command: 'run context', action: RUN_SELF_ACTION }),
+    }), async (context) => context.json({ data: await services.runs.context(context.get('run')) }));
+    router.patch('/runs/current/conversation', runToken, describeRoute({
+        tags,
+        summary: "Name the token's conversation",
+        operationId: 'agentsSetCurrentRunConversationTitle',
+        description: "A run on a conversation names it (at most 40 characters); `meta.message` says so. Refused once the conversation's owner renamed it (`CONVERSATION_CONFLICT`, `metadata.reason` `titleLocked`).",
+        security: runTokenSecurity,
+        responses: {
+            200: dataResponse(RunConversationSchema),
+            400: apiErrorResponse(400, 'The run is not on a conversation (`INVALID_REQUEST`), or its owner named it (`CONVERSATION_CONFLICT`).'),
+            ...runTokenErrors,
+        },
+        ...cliRoute({
+            command: 'conversation title set',
+            args: ['title'],
+            action: RUN_SELF_ACTION,
+            examples: ['conversation title set "Tidy the login issues"'],
+        }),
+    }), apiValidator('json', ConversationTitleInput), async (context) => {
+        const { run } = context.get('run');
+        const target = {
+            subject: { kind: run.subjectKind, id: run.subjectId },
+            actorUserId: run.actorUserId,
+        };
+        if (!(await services.conversations.ofRun(services.tx.read(), target)))
+            throw new ProtocolError('INVALID_REQUEST', 'Only a run on a conversation has a title to set.');
+        const conversation = await services.conversations.setTitleFromRun(target, context.req.valid('json').title);
+        return context.json({
+            data: { id: conversation.id, title: conversation.title },
+            meta: {
+                message: `The conversation is called "${conversation.title ?? ''}" now.`,
+            },
+        });
+    });
+    return router;
+}
+//# sourceMappingURL=run.js.map

package/dist/server/routes/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../server/routes/run.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,OAAO,EACP,aAAa,EACb,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,GACd,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAI7E,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5C,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,4BAA4B,CAAC;SACjC,IAAI,CAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAMH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,MAAM,GAAG,YAAY,EAAU,CAAC;IACtC,MAAM,QAAQ,GAA8B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAClE,OAAO,CAAC,GAAG,CACT,KAAK,EACL,MAAM,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CACnC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAC3C,CACF,CAAC;QACF,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;IACF,MAAM,cAAc,GAAG;QACrB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,0FAA0F,CAC3F;QACD,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC;KAC3B,CAAC;IACF,MAAM,CAAC,GAAG,CACR,eAAe,EACf,QAAQ,EACR,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,qBAAqB;QAClC,WAAW,EACT,sGAAsG;QACxG,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,GAAG,cAAc,EAAE;QAClE,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;KAC9D,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CACvE,CAAC;IACF,MAAM,CAAC,GAAG,CACR,uBAAuB,EACvB,QAAQ,EACR,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EAAE,4BAA4B;QACzC,WAAW,EACT,4FAA4F;QAC9F,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,gBAAgB,CAAC;YACnC,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,+DAA+D,CAChE;YACD,GAAG,cAAc;SAClB;QACD,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;KACjE,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAC1E,CAAC;IACF,MAAM,CAAC,KAAK,CACV,4BAA4B,EAC5B,QAAQ,EACR,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,sCAAsC;QACnD,WAAW,EACT,gMAAgM;QAClM,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,qBAAqB,CAAC;YACxC,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,wGAAwG,CACzG;YACD,GAAG,cAAc;SAClB;QACD,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,wBAAwB;YACjC,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,CAAC,gDAAgD,CAAC;SAC7D,CAAC;KACH,CAAC,EACF,YAAY,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAC5C,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE;YACrD,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,kDAAkD,CACnD,CAAC;QACJ,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,eAAe,CAC/D,MAAM,EACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAChC,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE;YACxD,IAAI,EAAE;gBACJ,OAAO,EAAE,+BAA+B,YAAY,CAAC,KAAK,IAAI,EAAE,QAAQ;aACzE;SACF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/runners/admin.d.ts

@@ -0,0 +1,28 @@
+import type { Hono, MiddlewareHandler } from 'hono';
+import type { SettingsAction, SettingsItem } from '../../../shared/access.js';
+import type { Runner } from '../../../shared/runners.js';
+import type { Agents } from '../../composition.js';
+/** Who is asking, and whether one of this plugin's settings grants is theirs. */
+export interface AdminCaller {
+    readonly userId: string;
+    can(item: SettingsItem, action: SettingsAction): Promise<boolean>;
+}
+export interface AdminEnv {
+    Variables: {
+        caller: AdminCaller;
+        runnerToManage: Runner;
+    };
+}
+/** Where a manager revoking someone else's runner is recorded: the application's logger. */
+export interface AdminAuditLogger {
+    info(details: Readonly<Record<string, unknown>>, message: string): void;
+}
+export interface AdminRoutesOptions {
+    /** Without one, the record goes to the console. */
+    readonly logger?: AdminAuditLogger;
+}
+/**
+ * `guard` authenticates the request and sets `caller`; the route contribution installs the real one, tests a fake.
+ */
+export declare function createAdminRoutes(services: Agents, guard: MiddlewareHandler<AdminEnv>, options?: AdminRoutesOptions): Hono<AdminEnv>;
+//# sourceMappingURL=admin.d.ts.map

package/dist/server/routes/runners/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../server/routes/runners/admin.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAW,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EACV,MAAM,EAIP,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAiBnD,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAMD,4FAA4F;AAC5F,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACzE;AAED,MAAM,WAAW,kBAAkB;IACjC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAClC,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CAAC,QAAQ,CAAC,CAqahB"}