@nocobase/app-plugin-releases 0.0.0-stage → 0.1.0-beta.0

package/dist/server/access/caller.js

@@ -0,0 +1,141 @@
+import { BUSINESS_KEYS, HUMAN_ONLY_ACTIONS, PAGES, SETTINGS_KEYS, allPermissions, businessKey, businessResource, levelActionsOf, noPermissions, reaches, settingsKey, } from '../../shared/access.js';
+import { forbidden } from '../errors.js';
+/** The App business, as `KeyScope.objects` names it. */
+export const APPS_BUSINESS = 'rel.apps';
+/**
+ * Permissions cut down to a credential's scope, each as the authorization plugin names it: pages (`page:<id>/access`),
+ * settings items (`settings:<item>/<action>`) and business actions (`rel:rel.apps/deploy.related`). A business action
+ * the scope covers at no level is off; one it covers keeps the caller's own reach.
+ */
+export function narrowedByScope(permissions, scope) {
+    const scopes = { ...permissions.scopes };
+    for (const { business, key } of BUSINESS_KEYS)
+        if (!levelActionsOf(key).some(({ name }) => scope.allows(businessResource(business), name)))
+            scopes[key] = 'none';
+    const settings = { ...permissions.settings };
+    for (const { item, action, key } of SETTINGS_KEYS)
+        if (!scope.allows({ type: 'settings', id: item }, action))
+            settings[key] = false;
+    const pages = { ...permissions.pages };
+    for (const page of PAGES)
+        if (!scope.allows({ type: 'page', id: page }, 'access'))
+            pages[page] = false;
+    return { scopes, settings, pages };
+}
+/** The Apps a scoped caller is limited to; undefined when it reaches every App. */
+function pickedApps(caller) {
+    const objects = caller.keyScope?.objects(APPS_BUSINESS);
+    return objects === undefined || objects === 'all' ? undefined : objects;
+}
+/** The plugin acting on its own, for expiry cleanup and startup recovery. */
+export const SYSTEM_CALLER = {
+    userId: null,
+    kind: 'system',
+    permissions: allPermissions(),
+};
+export function actorOf(caller) {
+    return { userId: caller.userId, kind: caller.kind };
+}
+export class AccessGuard {
+    access;
+    constructor(access) {
+        this.access = access;
+    }
+    /** Builds the caller for a user ID: the application's permissions for them. */
+    async callerForUser(userId, kind = 'human') {
+        const access = this.access();
+        return {
+            userId,
+            kind,
+            permissions: access
+                ? await access.permissionsOfUser(userId)
+                : noPermissions(),
+        };
+    }
+    scope(caller, action) {
+        if (caller.kind === 'system')
+            return 'all';
+        if ((caller.kind === 'agent' || caller.kind === 'key') &&
+            HUMAN_ONLY_ACTIONS.includes(action))
+            return 'none';
+        // An action the application left out reaches nothing.
+        return caller.permissions.scopes[businessKey('rel.apps', action)] ?? 'none';
+    }
+    async canApp(caller, action, app) {
+        const picked = pickedApps(caller);
+        if (picked && !picked.includes(app.id))
+            return false;
+        const scope = this.scope(caller, action);
+        if (scope === 'all' || scope === 'none')
+            return scope === 'all';
+        if (reaches(scope, app.createdBy))
+            return true;
+        if (scope.users.length === 0)
+            return false;
+        return ((await this.access()?.isRelated?.(app.id, scope.users, action)) ?? false);
+    }
+    async requireApp(caller, action, app) {
+        if (await this.canApp(caller, action, app))
+            return;
+        if ((caller.kind === 'agent' || caller.kind === 'key') &&
+            HUMAN_ONLY_ACTIONS.includes(action))
+            throw forbidden(`${caller.kind === 'agent' ? 'An agent' : 'A key'} may not ${action} an application.`, 'HUMAN_REQUIRED');
+        throw forbidden();
+    }
+    /**
+     * Refuses a caller who may take none of `actions` on any App. Routes check this before reading their input; the
+     * services check the App itself afterwards.
+     */
+    requireAnyApp(caller, ...actions) {
+        if (actions.some((action) => this.scope(caller, action) !== 'none'))
+            return;
+        if ((caller.kind === 'agent' || caller.kind === 'key') &&
+            actions.every((action) => HUMAN_ONLY_ACTIONS.includes(action)))
+            throw forbidden(`${caller.kind === 'agent' ? 'An agent' : 'A key'} may not ${actions[0]} an application.`, 'HUMAN_REQUIRED');
+        throw forbidden();
+    }
+    /** `create` has no records: it is either allowed or not, and never for a key limited to some Apps. */
+    requireCreate(caller) {
+        if (this.scope(caller, 'create') !== 'all' || pickedApps(caller))
+            throw forbidden();
+    }
+    /**
+     * The Apps a caller may see for an action: every App, or the ones the users of their scope created plus the
+     * application's related ones; null when they may see none.
+     */
+    async appFilter(caller, action) {
+        const scope = this.scope(caller, action);
+        const picked = pickedApps(caller);
+        const only = picked ? { only: picked } : {};
+        if (scope === 'all')
+            return { all: true, ...only };
+        if (scope === 'none' || scope.users.length === 0)
+            return null;
+        return {
+            all: false,
+            createdBy: scope.users,
+            ids: (await this.access()?.relatedAppIds?.(scope.users, action)) ?? [],
+            ...only,
+        };
+    }
+    hasSetting(caller, item, action) {
+        if (caller.kind === 'system')
+            return true;
+        // An upload ticket holds no settings; a scoped key holds what its scope left of its owner's.
+        return caller.permissions.settings[settingsKey(item, action)];
+    }
+    requireSetting(caller, item, action) {
+        if (!this.hasSetting(caller, item, action))
+            throw forbidden();
+    }
+    hasPage(caller, page) {
+        if (caller.kind === 'system')
+            return true;
+        return caller.permissions.pages[page];
+    }
+    requirePage(caller, page) {
+        if (!this.hasPage(caller, page))
+            throw forbidden();
+    }
+}
+//# sourceMappingURL=caller.js.map

package/dist/server/access/caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../../server/access/caller.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,KAAK,EACL,aAAa,EACb,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,OAAO,EACP,WAAW,GASZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAYzC,wDAAwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,WAAgC,EAChC,KAAe;IAEf,MAAM,MAAM,GAAG,EAAE,GAAG,WAAW,CAAC,MAAM,EAAgC,CAAC;IACvE,KAAK,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,aAAa;QAC3C,IACE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACrC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAC/C;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;IACzB,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAkC,CAAC;IAC7E,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,aAAa;QAC/C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC;YACvD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,EAA2B,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,KAAK;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACxD,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAW;IACnC,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,cAAc,EAAE;CAC9B,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAQD,MAAM,OAAO,WAAW;IAEH;IADnB,YACmB,MAAwC;QAAxC,WAAM,GAAN,MAAM,CAAkC;IACxD,CAAC;IAEJ,+EAA+E;IACxE,KAAK,CAAC,aAAa,CACxB,MAAc,EACd,OAAkB,OAAO;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM;YACN,IAAI;YACJ,WAAW,EAAE,MAAM;gBACjB,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBACxC,CAAC,CAAC,aAAa,EAAE;SACpB,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAc,EAAE,MAAiB;QAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC3C,IACE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;YAClD,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAEnC,OAAO,MAAM,CAAC;QAChB,sDAAsD;QACtD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC;IAC9E,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,MAAc,EACd,MAAiB,EACjB,GAAiB;QAEjB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,KAAK,KAAK,KAAK,CAAC;QAChE,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,KAAK,CACzE,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CACrB,MAAc,EACd,MAAiB,EACjB,GAAiB;QAEjB,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC;YAAE,OAAO;QACnD,IACE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;YAClD,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAEnC,MAAM,SAAS,CACb,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,YAAY,MAAM,kBAAkB,EACrF,gBAAgB,CACjB,CAAC;QACJ,MAAM,SAAS,EAAE,CAAC;IACpB,CAAC;IAED;;;OAGG;IACI,aAAa,CAAC,MAAc,EAAE,GAAG,OAAoB;QAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC;YAAE,OAAO;QAC5E,IACE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE9D,MAAM,SAAS,CACb,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,kBAAkB,EACzF,gBAAgB,CACjB,CAAC;QACJ,MAAM,SAAS,EAAE,CAAC;IACpB,CAAC;IAED,sGAAsG;IAC/F,aAAa,CAAC,MAAc;QACjC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC;YAC9D,MAAM,SAAS,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,SAAS,CACpB,MAAc,EACd,MAAiB;QAYjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,OAAO;YACL,GAAG,EAAE,KAAK;YACV,SAAS,EAAE,KAAK,CAAC,KAAK;YACtB,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE;YACtE,GAAG,IAAI;SACR,CAAC;IACJ,CAAC;IAEM,UAAU,CACf,MAAc,EACd,IAAO,EACP,MAAyB;QAEzB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1C,6FAA6F;QAC7F,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAEM,cAAc,CACnB,MAAc,EACd,IAAO,EACP,MAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;YAAE,MAAM,SAAS,EAAE,CAAC;IAChE,CAAC;IAEM,OAAO,CAAC,MAAc,EAAE,IAAU;QACvC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAEM,WAAW,CAAC,MAAc,EAAE,IAAU;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,MAAM,SAAS,EAAE,CAAC;IACrD,CAAC;CACF"}

package/dist/server/access/key-scope-objects.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The Apps an API key's scope may be limited to (the `releases.apps` permission group's records), in the shape of the
+ * API keys plugin's `KeyScopeObjectSource`, without importing it: the application hands this to that plugin.
+ */
+import type { AuthorizationIdentity } from '@nocobase/authorization/core';
+import type { Releases } from '../composition.js';
+export interface ReleasesKeyScopeObjects {
+    list(input: {
+        readonly identity: AuthorizationIdentity;
+        readonly search?: string;
+        readonly ids?: readonly string[];
+    }): Promise<readonly {
+        id: string;
+        title: string;
+        description?: string;
+    }[]>;
+}
+/** Lists the Apps the identity may see, by name, for choosing which ones a key reaches. */
+export declare function releasesKeyScopeObjects(releases: () => Releases): ReleasesKeyScopeObjects;
+//# sourceMappingURL=key-scope-objects.d.ts.map

package/dist/server/access/key-scope-objects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-scope-objects.d.ts","sourceRoot":"","sources":["../../../server/access/key-scope-objects.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlD,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,KAAK,EAAE;QACV,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAClC,GAAG,OAAO,CAAC,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;CAC7E;AAKD,2FAA2F;AAC3F,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,QAAQ,GACvB,uBAAuB,CAoCzB"}

package/dist/server/access/key-scope-objects.js

@@ -0,0 +1,42 @@
+import { ReleasesError } from '../errors.js';
+const PAGE_SIZE = 100;
+const MAX_PAGES = 20;
+/** Lists the Apps the identity may see, by name, for choosing which ones a key reaches. */
+export function releasesKeyScopeObjects(releases) {
+    return {
+        async list({ identity, search, ids }) {
+            // The chooser's own view of the Apps, never a scoped one: a key cannot pick records for another key.
+            const { keyScope: _keyScope, ...person } = identity;
+            const caller = await releases().callerOf(person);
+            const wanted = ids ? new Set(ids) : null;
+            const found = [];
+            for (let page = 1; page <= MAX_PAGES; page += 1) {
+                let result;
+                try {
+                    result = await releases().releases.listApps(caller, {
+                        page,
+                        pageSize: PAGE_SIZE,
+                        ...(search?.trim() ? { search: search.trim() } : {}),
+                    });
+                }
+                catch (error) {
+                    if (error instanceof ReleasesError &&
+                        error.status === 'PERMISSION_DENIED')
+                        return [];
+                    throw error;
+                }
+                for (const { app } of result.items)
+                    if (!wanted || wanted.has(app.id))
+                        found.push({
+                            id: app.id,
+                            title: app.name || app.id,
+                            ...(app.description ? { description: app.description } : {}),
+                        });
+                if (page * PAGE_SIZE >= result.total)
+                    break;
+            }
+            return found;
+        },
+    };
+}
+//# sourceMappingURL=key-scope-objects.js.map

package/dist/server/access/key-scope-objects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-scope-objects.js","sourceRoot":"","sources":["../../../server/access/key-scope-objects.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAU7C,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CACrC,QAAwB;IAExB,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;YAClC,qGAAqG;YACrG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzC,MAAM,KAAK,GAA0D,EAAE,CAAC;YACxE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE;wBAClD,IAAI;wBACJ,QAAQ,EAAE,SAAS;wBACnB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrD,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IACE,KAAK,YAAY,aAAa;wBAC9B,KAAK,CAAC,MAAM,KAAK,mBAAmB;wBAEpC,OAAO,EAAE,CAAC;oBACZ,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,KAAK;oBAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC/B,KAAK,CAAC,IAAI,CAAC;4BACT,EAAE,EAAE,GAAG,CAAC,EAAE;4BACV,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE;4BACzB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC7D,CAAC,CAAC;gBACP,IAAI,IAAI,GAAG,SAAS,IAAI,MAAM,CAAC,KAAK;oBAAE,MAAM;YAC9C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/composition.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The plugin's services wired together, without a container: the provider builds them from the application, and tests
+ * and harnesses build them directly.
+ */
+import type { AuthorizationIdentity } from '@nocobase/authorization/core';
+import type { DatabaseManager } from '@nocobase/db';
+import type { Logger } from '@nocobase/logging';
+import type { ActorKind } from '../shared/releases.js';
+import { AccessGuard, type Caller } from './access/caller.js';
+import type { ReleasesPluginConfig } from './config.js';
+import type { DriverRegistry } from './drivers/types.js';
+import { UploadTicketService } from './services/credentials.js';
+import { EnvironmentService } from './services/environments.js';
+import { ReleasesEventBus } from './services/events.js';
+import { RegistryService } from './services/registries.js';
+import { ReleasesService } from './services/releases.js';
+import { DeploymentRequestService } from './services/requests.js';
+import type { ReleasesSecrets } from './services/secrets.js';
+import type { ReleasesAccess } from './tokens.js';
+export interface ReleasesCompositionOptions {
+    readonly database: DatabaseManager;
+    readonly config: Pick<ReleasesPluginConfig, 'artifact' | 'dataDir' | 'maxArtifactSizeMB' | 'logging' | 'uploadTicketTtlSeconds'>;
+    readonly drivers: DriverRegistry;
+    /** The application's roles; resolved on each use, so it may be bound after the plugin. */
+    readonly access: () => ReleasesAccess | undefined;
+    /** The application's secrets service: seals environment and registry credentials. */
+    readonly secrets?: ReleasesSecrets;
+    /** The application's own public base path, which no App may take. */
+    readonly reservedBasePath?: string;
+    /** The application's own origin (`app.publicOrigin`), which Apps served under a path of it take as theirs. */
+    readonly publicOrigin?: string | null;
+    readonly logger?: Logger;
+}
+export interface Releases {
+    readonly releases: ReleasesService;
+    readonly environments: EnvironmentService;
+    /** Image registries: settings and their write-only pull credentials. */
+    readonly registries: RegistryService;
+    readonly requests: DeploymentRequestService;
+    readonly tickets: UploadTicketService;
+    readonly events: ReleasesEventBus;
+    readonly drivers: DriverRegistry;
+    readonly guard: AccessGuard;
+    /** The caller for a signed-in identity: the application's permissions and actor kind. */
+    callerOf(identity: AuthorizationIdentity): Promise<Caller>;
+    /** The caller for a user ID, as a person, an agent or an application rule acting for them. */
+    callerForUser(userId: string, kind?: ActorKind): Promise<Caller>;
+    /** The plugin acting on its own (cleanup, recovery). */
+    readonly system: Caller;
+}
+export declare function createReleases(options: ReleasesCompositionOptions): Releases;
+//# sourceMappingURL=composition.d.ts.map

package/dist/server/composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../../server/composition.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,WAAW,EAGX,KAAK,MAAM,EACZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,IAAI,CACnB,oBAAoB,EAClB,UAAU,GACV,SAAS,GACT,mBAAmB,GACnB,SAAS,GACT,wBAAwB,CAC3B,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,8GAA8G;IAC9G,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,8FAA8F;IAC9F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,0BAA0B,GAAG,QAAQ,CA+F5E"}

package/dist/server/composition.js

@@ -0,0 +1,105 @@
+import { noPermissions } from '../shared/access.js';
+import { AccessGuard, SYSTEM_CALLER, narrowedByScope, } from './access/caller.js';
+import { UploadTicketService } from './services/credentials.js';
+import { EnvironmentService } from './services/environments.js';
+import { ReleasesEventBus } from './services/events.js';
+import { RegistryService } from './services/registries.js';
+import { ReleasesService } from './services/releases.js';
+import { DeploymentRequestService } from './services/requests.js';
+import { VariableStore } from './services/variables.js';
+export function createReleases(options) {
+    const guard = new AccessGuard(options.access);
+    const events = new ReleasesEventBus(options.logger);
+    const variables = new VariableStore({
+        database: options.database,
+        secrets: options.secrets,
+    });
+    // The environment service reaches the releases service through these callbacks, created right after it.
+    // eslint-disable-next-line prefer-const
+    let releases;
+    const environments = new EnvironmentService({
+        database: options.database,
+        drivers: options.drivers,
+        guard,
+        secrets: options.secrets,
+        onChanged: (id) => releases.environmentChanged(id),
+        countApps: (id) => releases.countApps(id),
+        check: (id) => releases.checkEnvironment(id),
+        variables,
+    });
+    const registries = new RegistryService({
+        database: options.database,
+        guard,
+        secrets: options.secrets,
+    });
+    releases = new ReleasesService({
+        database: options.database,
+        environments,
+        registries,
+        guard,
+        events,
+        artifact: options.config.artifact,
+        dataDir: options.config.dataDir,
+        maxArtifactBytes: options.config.maxArtifactSizeMB === undefined
+            ? undefined
+            : options.config.maxArtifactSizeMB * 1024 * 1024,
+        logging: options.config.logging,
+        reservedBasePath: options.reservedBasePath,
+        publicOrigin: options.publicOrigin ?? null,
+        variables,
+        secrets: options.secrets,
+        logger: options.logger,
+    });
+    const requests = new DeploymentRequestService({
+        database: options.database,
+        releases,
+        environments,
+        guard,
+        events,
+        access: options.access,
+    });
+    const tickets = new UploadTicketService({
+        database: options.database,
+        releases,
+        environments,
+        guard,
+        defaultTtlSeconds: options.config.uploadTicketTtlSeconds,
+    });
+    return {
+        releases,
+        environments,
+        registries,
+        requests,
+        tickets,
+        events,
+        drivers: options.drivers,
+        guard,
+        system: SYSTEM_CALLER,
+        async callerOf(identity) {
+            const access = options.access();
+            if (identity.principal.type !== 'user')
+                return { userId: null, kind: 'human', permissions: noPermissions() };
+            const permissions = access
+                ? await access.permissionsOf(identity)
+                : noPermissions();
+            const { keyScope } = identity;
+            // A scoped credential (an API key with a scope, a service account's key) is a key, never a person: it may not
+            // take a person-only action or deploy to a protected environment. One the
+            // application names an agent's (an agent's run, bounded by its scope) acts as the agent, under the same limits.
+            if (keyScope)
+                return {
+                    userId: identity.principal.id,
+                    kind: access?.actorKindOf?.(identity) === 'agent' ? 'agent' : 'key',
+                    permissions: narrowedByScope(permissions, keyScope),
+                    keyScope,
+                };
+            return {
+                userId: identity.principal.id,
+                kind: access?.actorKindOf?.(identity) ?? 'human',
+                permissions,
+            };
+        },
+        callerForUser: (userId, kind) => guard.callerForUser(userId, kind),
+    };
+}
+//# sourceMappingURL=composition.js.map

package/dist/server/composition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition.js","sourceRoot":"","sources":["../../server/composition.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EACL,WAAW,EACX,aAAa,EACb,eAAe,GAEhB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AA4CxD,MAAM,UAAU,cAAc,CAAC,OAAmC;IAChE,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,wGAAwG;IACxG,wCAAwC;IACxC,IAAI,QAAqC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,kBAAkB,CAAC;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnD,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,SAAS;KACV,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,QAAQ,GAAG,IAAI,eAAe,CAAC;QAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY;QACZ,UAAU;QACV,KAAK;QACL,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;QAC/B,gBAAgB,EACd,OAAO,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YAC5C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI,GAAG,IAAI;QACpD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;QAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC1C,SAAS;QACT,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;QAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,YAAY;QACZ,KAAK;QACL,MAAM;QACN,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,YAAY;QACZ,KAAK;QACL,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,sBAAsB;KACzD,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,UAAU;QACV,QAAQ;QACR,OAAO;QACP,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK;QACL,MAAM,EAAE,aAAa;QACrB,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACrB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;gBACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,CAAC;YACvE,MAAM,WAAW,GAAG,MAAM;gBACxB,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;gBACtC,CAAC,CAAC,aAAa,EAAE,CAAC;YACpB,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;YAC9B,8GAA8G;YAC9G,0EAA0E;YAC1E,gHAAgH;YAChH,IAAI,QAAQ;gBACV,OAAO;oBACL,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;oBAC7B,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;oBACnE,WAAW,EAAE,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC;oBACnD,QAAQ;iBACT,CAAC;YACJ,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;gBAC7B,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,OAAO;gBAChD,WAAW;aACZ,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;KACnE,CAAC;AACJ,CAAC"}

package/dist/server/config.d.ts

@@ -0,0 +1,127 @@
+import type { AppRuntimeLogging } from '@nocobase/app-server/logging';
+import type { AppDriveDiskConfig } from '@nocobase/drive';
+import type { LoggingConfig } from '@nocobase/logging';
+/** The application's `releases` configuration section. */
+export interface ReleasesPluginConfig {
+    /** Where release archives are stored. */
+    readonly artifact: AppDriveDiskConfig;
+    /** The plugin's own files: deployment logs and the configuration each deployment applied. */
+    readonly dataDir: string;
+    /** Largest accepted release archive, in MiB (256 by default). */
+    readonly maxArtifactSizeMB?: number;
+    /** Lifetime of an upload ticket when the request names none, in seconds (900 by default, at most 3600). */
+    readonly uploadTicketTtlSeconds?: number;
+    readonly logging?: {
+        readonly deployments?: {
+            readonly enabled?: boolean;
+            readonly retentionDays?: number;
+            readonly maxFileSizeMB?: number;
+            readonly maxTotalSizeMB?: number;
+        };
+        readonly apps?: AppRuntimeLogging;
+    };
+    /**
+     * The local App Host that runs Apps in process. Enabled, the plugin starts it as a child process and registers the
+     * `host` driver; an environment with run mode `in-process` deploys into it.
+     */
+    readonly host?: ReleasesHostConfig;
+    /**
+     * The Docker Host: a second App Host child that runs Apps in Docker containers (`@nocobase/app-host-docker`, which
+     * the application must install) and no App code itself. Enabled, environments may choose the run mode `docker`. Its
+     * listener is where Docker Apps are reached.
+     */
+    readonly docker?: ReleasesDockerHostConfig;
+}
+/** The Docker Host child (`releases.docker`). */
+export interface ReleasesDockerHostConfig {
+    readonly enabled: boolean;
+    readonly driver?: 'auto' | 'node' | 'tsx';
+    /** Its executable; `@nocobase/app-host-docker/cli` resolved from this plugin by default. */
+    readonly entrypoint?: string;
+    readonly appRevisionsDir: string;
+    /** Where it keeps each App's configuration file (data lives in Docker volumes). */
+    readonly appVolumesDir: string;
+    readonly configPath: string;
+    /** Where it records deployment outcomes; `control/` next to the revisions directory by default. */
+    readonly controlDir?: string;
+    readonly childOutputDir?: string;
+    /** Its listener, which Docker Apps are reached through: `127.0.0.1` unless something in front must reach it. */
+    readonly host?: string;
+    readonly port?: number;
+    /** Public origin of its listener (or a pattern with `{appId}`) for environments without their own URL pattern. */
+    readonly publicUrl?: string;
+    readonly startTimeoutMs?: number;
+    readonly ipcTimeoutMs?: number;
+    readonly shutdownTimeoutMs?: number;
+    readonly autoRestart?: boolean;
+    readonly tsxCli?: string;
+    readonly tsconfig?: string;
+    readonly logging?: LoggingConfig;
+    /**
+     * Its environment; omitted, it inherits this application's (it runs no App code, and an environment's
+     * `env.allow` copies from it).
+     */
+    readonly env?: {
+        readonly allow?: readonly string[];
+        readonly set?: Readonly<Record<string, string>>;
+    };
+    /** How often it stops idle containers and makes Apps dormant, in seconds (60). */
+    readonly sweepIntervalSeconds?: number;
+    readonly activationHoldMs?: number;
+    readonly activationWaitMs?: number;
+    /** Host-wide settings of the Docker backend (`pollIntervalMs`, `reachTimeoutMs`). */
+    readonly backend?: Readonly<Record<string, unknown>>;
+}
+export interface ReleasesHostConfig {
+    readonly enabled: boolean;
+    readonly driver?: 'auto' | 'node' | 'tsx';
+    readonly appRevisionsDir: string;
+    readonly appVolumesDir: string;
+    readonly configPath: string;
+    readonly childOutputDir?: string;
+    readonly host?: string;
+    readonly port?: number;
+    /** Public origin of the Host listener for environments without their own URL pattern. */
+    readonly publicUrl?: string;
+    /** Where the Host records deployment outcomes; `control/` next to the revisions directory by default. */
+    readonly controlDir?: string;
+    readonly startTimeoutMs?: number;
+    readonly ipcTimeoutMs?: number;
+    readonly shutdownTimeoutMs?: number;
+    readonly autoRestart?: boolean;
+    readonly maxAutomaticRestarts?: number;
+    readonly automaticRestartWindowMs?: number;
+    readonly automaticRestartBaseDelayMs?: number;
+    readonly entrypoint?: string;
+    readonly tsxCli?: string;
+    readonly tsconfig?: string;
+    readonly logging?: LoggingConfig;
+    /**
+     * The Host child's environment (`AppHostSupervisor` `env`): with `allow`, only the listed variables reach it, so
+     * Apps cannot read this application's secrets; omitted, it inherits everything.
+     */
+    readonly env?: {
+        readonly allow?: readonly string[];
+        readonly set?: Readonly<Record<string, string>>;
+    };
+    /** User and group the Host child runs as (needs the privilege to switch users). */
+    readonly uid?: number;
+    readonly gid?: number;
+    /** A command the Host child is started through, such as `['setpriv', '--reuid=preview', '--']`. */
+    readonly launchPrefix?: readonly string[];
+    /**
+     * Restart the Host once this many Apps were removed, replaced, stopped for idleness or made dormant since it started,
+     * replaying the desired set: in-process Apps cannot unload their modules, so every runtime that goes away leaves
+     * memory behind. The restart waits while an on-demand App is running. Off when omitted.
+     */
+    readonly restartAfterChurn?: number;
+    /** How often the Host's idle stops and dormancies are read for `restartAfterChurn`, in milliseconds (60000). */
+    readonly churnCheckIntervalMs?: number;
+    /** How often the Host stops idle Apps and makes due Apps dormant, in seconds (60). */
+    readonly sweepIntervalSeconds?: number;
+    /** How long a page request to a stopped App waits before it gets the Host's starting page, in milliseconds (1500). */
+    readonly activationHoldMs?: number;
+    /** How long other requests to a stopped App wait for it to start, in milliseconds (60000). */
+    readonly activationWaitMs?: number;
+}
+//# sourceMappingURL=config.d.ts.map

package/dist/server/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../server/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,2GAA2G;IAC3G,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,WAAW,CAAC,EAAE;YACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;YAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;SAClC,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;KACnC,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,CAAC;CAC5C;AAED,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IAC1C,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,mFAAmF;IACnF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mGAAmG;IACnG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,gHAAgH;IAChH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,kHAAkH;IAClH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACjD,CAAC;IACF,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,qFAAqF;IACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,yGAAyG;IACzG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACjD,CAAC;IACF,mFAAmF;IACnF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,gHAAgH;IAChH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,sFAAsF;IACtF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,sHAAsH;IACtH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,8FAA8F;IAC9F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC"}

package/dist/server/config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.js.map

package/dist/server/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../server/config.ts"],"names":[],"mappings":""}

package/dist/server/drivers/host/driver.d.ts

@@ -0,0 +1,87 @@
+import type { HostManagementService } from '@nocobase/app-host/management';
+import type { AppHostSupervisorInfo } from '@nocobase/app-host/supervisor';
+import type { AppRuntimeLogging } from '@nocobase/app-server/logging';
+import type { AppDriveDiskConfig } from '@nocobase/drive';
+import { type Logger, type LoggingConfig } from '@nocobase/logging';
+import { type DeploymentDriver, type DriverCapabilities } from '../types.js';
+/** The backend of Apps that run in the Host process. */
+export declare const IN_PROCESS_BACKEND = "in-process";
+export declare const DOCKER_BACKEND = "docker";
+/** What each backend this driver knows can do; another backend a Host offers is treated as the in-process one. */
+export declare const HOST_BACKEND_CAPABILITIES: Readonly<Record<string, DriverCapabilities>>;
+/** What the driver needs from `AppHostSupervisor`; tests pass a fake. */
+export interface HostRuntimeController {
+    getInfo(): Pick<AppHostSupervisorInfo, 'status' | 'targetUrl'>;
+    onReady(listener: () => void): () => void;
+    ensureStarted(): Promise<URL>;
+    /** The child's management service; asked for per call, since a restarted child is reached through a new client. */
+    getManagementClient(): Promise<HostManagementService>;
+    /** Stops and starts the Host child; its `onReady` listeners then replay the desired sets. */
+    restart?(reason?: string): Promise<URL>;
+}
+/** A Host the driver deploys to, for the environments whose backend it runs. */
+export interface HostEndpointOptions {
+    readonly controller: HostRuntimeController;
+    /** Prepares the Host before it first starts, such as writing its configuration file (`writeHostConfig`). */
+    readonly prepare?: () => Promise<void>;
+    /**
+     * The public origin and path its listener is reached at (`https://apps.example.com`, or `/` behind this
+     * application's own listener), with `{appId}` or as a base. An environment's URL pattern wins over it. Without
+     * either, URLs point at the Host's local listener.
+     */
+    readonly publicUrl?: string;
+    /**
+     * Restart the Host once this many Apps were replaced, removed, stopped for idleness or made dormant since it
+     * started: in-process Apps cannot unload their modules (ESM has no unload), so every runtime that goes away leaves
+     * memory behind; a restart replays the desired sets into a fresh process, where on-demand Apps stay stopped until
+     * requested. The restart waits while an on-demand App is running. Off when omitted.
+     */
+    readonly restartAfterChurn?: number;
+}
+export interface HostDriverOptions {
+    /** The Host for each backend environments may choose; `in-process` is required. */
+    readonly hosts: Readonly<Record<string, HostEndpointOptions>>;
+    /** The Apps' own logging, passed into every deployment. */
+    readonly appLogging?: AppRuntimeLogging;
+    /** How often the driver reads the Host's idle stops and dormancies for `restartAfterChurn` (60 s by default). */
+    readonly churnCheckIntervalMs?: number;
+    /** How the application configured each Host, shown read-only with an environment's settings, by backend. */
+    readonly facts?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+    /** The driver kind; `host` unless an application registers two. */
+    readonly kind?: string;
+    readonly logger?: Logger;
+}
+/** The Host driver, plus what an application's listener needs to forward the in-process Host's traffic. */
+export interface HostDeploymentDriver extends DeploymentDriver {
+    /** Where to forward requests outside this application's mount, or null while the in-process Host is not ready. */
+    proxyTarget(): URL | null;
+    /** Apps replaced, removed, stopped for idleness or made dormant since the in-process Host last started. */
+    churn(): number;
+    /** Restarts the in-process Host and replays its environments' desired sets, reclaiming unloaded Apps' memory. */
+    restartHost(reason?: string): Promise<void>;
+}
+/** An environment's Host settings. */
+export interface HostEnvironmentSettings {
+    readonly backend: string;
+    readonly backendConfig: Readonly<Record<string, unknown>>;
+}
+export declare function hostEnvironmentSettings(config: Readonly<Record<string, unknown>>): HostEnvironmentSettings;
+export declare function createHostDriver(options: HostDriverOptions): HostDeploymentDriver;
+/** What a Host child's configuration file holds; see `writeHostConfig`. */
+export interface HostConfigFile {
+    readonly artifact: AppDriveDiskConfig;
+    readonly appVolumesDir: string;
+    readonly appRevisionsDir?: string;
+    /** Where the Host records deployment outcomes. */
+    readonly controlDir?: string;
+    readonly logging?: LoggingConfig;
+    /** How often the Host stops idle Apps and makes Apps dormant, in seconds (60 by default). */
+    readonly sweepIntervalSeconds?: number;
+    readonly activationHoldMs?: number;
+    readonly activationWaitMs?: number;
+    /** Host-wide settings of the Host's backends (`host.backends.<name>`). */
+    readonly backends?: Readonly<Record<string, Record<string, unknown>>>;
+}
+/** Writes a managed Host child's configuration file (`AppHostSupervisor` `configPath`) before it starts. */
+export declare function writeHostConfig(configPath: string, config: HostConfigFile): Promise<void>;
+//# sourceMappingURL=driver.d.ts.map

package/dist/server/drivers/host/driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../../server/drivers/host/driver.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAGV,qBAAqB,EAItB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAIL,KAAK,MAAM,EACX,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EAKxB,MAAM,aAAa,CAAC;AAErB,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAC/C,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,kHAAkH;AAClH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAC9C,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAcnC,CAAC;AAEF,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,OAAO,IAAI,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC;IAC/D,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAC1C,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,mHAAmH;IACnH,mBAAmB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtD,6FAA6F;IAC7F,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACzC;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,4GAA4G;IAC5G,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC9D,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC,iHAAiH;IACjH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,4GAA4G;IAC5G,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,2GAA2G;AAC3G,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,kHAAkH;IAClH,WAAW,IAAI,GAAG,GAAG,IAAI,CAAC;IAC1B,2GAA2G;IAC3G,KAAK,IAAI,MAAM,CAAC;IAChB,iHAAiH;IACjH,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,sCAAsC;AACtC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3D;AAID,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,uBAAuB,CAsBzB;AAgBD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,iBAAiB,GACzB,oBAAoB,CA0gBtB;AA+GD,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,kDAAkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,6FAA6F;IAC7F,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CACvE;AAED,4GAA4G;AAC5G,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAiCf"}