@owox/backend 0.38.0 → 0.39.0

package/dist/src/idp/guards/idp.guard.d.ts

@@ -19,6 +19,7 @@ export interface AuthenticatedRequest extends Request {
         pluginId?: string;
         installationId?: string;
         viewOnly?: boolean;
+        executionId?: string;
     };
 }
 export declare const AUTH_CONTEXT = "AuthContext";
@@ -31,10 +32,12 @@ export declare class IdpGuard implements CanActivate {
     constructor(reflector: Reflector, idpProviderService: IdpProviderService, cls: ClsService, idpProjectionsService: IdpProjectionsService, moduleRef: ModuleRef);
     canActivate(context: ExecutionContext): Promise<boolean>;
     private authenticateUser;
+    private authenticateExecution;
     private checkViewOnlyRestrictions;
     private checkApiKeyHeaderBinding;
     private checkApiKeyUsageRestrictions;
     private checkPluginRuntimeAuthorization;
+    private runtimeAuthorizer;
     private isNonEmptyString;
     private static readonly ROLE_DISPLAY_NAMES;
     private checkRoleAuthorization;

package/dist/src/idp/guards/idp.guard.js

@@ -13,6 +13,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.IdpGuard = exports.AUTH_CONTEXT = void 0;
 const common_1 = require("@nestjs/common");
 const idp_protocol_1 = require("@owox/idp-protocol");
+const business_violation_exception_1 = require("../../common/exceptions/business-violation.exception");
 const idp_projections_service_1 = require("../services/idp-projections.service");
 const types_1 = require("../types");
 const core_1 = require("@nestjs/core");
@@ -78,6 +79,7 @@ let IdpGuard = class IdpGuard {
                 pluginId: tokenPayload.pluginId,
                 installationId: tokenPayload.installationId,
                 viewOnly,
+                executionId: tokenPayload.executionId,
             };
             this.cls.set(exports.AUTH_CONTEXT, {
                 userId: tokenPayload.userId,
@@ -88,13 +90,16 @@ let IdpGuard = class IdpGuard {
                 pluginId: tokenPayload.pluginId,
                 installationId: tokenPayload.installationId,
                 viewOnly,
+                executionId: tokenPayload.executionId,
             });
             if (request && STATE_CHANGING_METHODS.includes(request.method)) {
                 void this.idpProjectionsService.updateProjectionsFromIdpPayload(tokenPayload);
             }
         }
         catch (error) {
-            if (error instanceof common_1.UnauthorizedException || error instanceof idp_protocol_1.AuthorizationError) {
+            if (error instanceof common_1.UnauthorizedException ||
+                error instanceof idp_protocol_1.AuthorizationError ||
+                (error instanceof business_violation_exception_1.BusinessViolationException && error.code === 'PLUGIN_SUSPENDED')) {
                 throw error;
             }
             throw new idp_protocol_1.AuthenticationError('Authentication failed');
@@ -105,6 +110,10 @@ let IdpGuard = class IdpGuard {
         return true;
     }
     async authenticateUser(request, strategy) {
+        const executionToken = request.headers['x-owox-execution-token'];
+        if (executionToken !== undefined) {
+            return this.authenticateExecution(request, executionToken);
+        }
         const idpProvider = this.idpProviderService.getProvider(request);
         const token = request.headers['x-owox-authorization'] ?? '';
         const tokenPayload = strategy === types_1.Strategy.PARSE
@@ -113,7 +122,25 @@ let IdpGuard = class IdpGuard {
         if (!tokenPayload) {
             throw new idp_protocol_1.AuthenticationError('Invalid authorization');
         }
-        return tokenPayload;
+        return { ...tokenPayload, executionId: undefined };
+    }
+    async authenticateExecution(request, executionToken) {
+        if (Array.isArray(executionToken) || request.headers['x-owox-authorization'] !== undefined) {
+            throw new idp_protocol_1.AuthenticationError('Send one authorization header');
+        }
+        const identity = await this.runtimeAuthorizer().resolveExecutionToken(executionToken);
+        if (!identity) {
+            throw new idp_protocol_1.AuthenticationError('Invalid execution token');
+        }
+        return {
+            userId: identity.userId,
+            projectId: identity.projectId,
+            roles: [identity.role],
+            authFlow: 'plugin',
+            pluginId: identity.pluginId,
+            installationId: identity.installationId,
+            executionId: identity.executionId,
+        };
     }
     checkViewOnlyRestrictions(request, tokenPayload, viewOnlySafe) {
         if (!(0, idp_protocol_1.isViewOnlyPayload)(tokenPayload)) {
@@ -161,6 +188,14 @@ let IdpGuard = class IdpGuard {
             !this.isNonEmptyString(tokenPayload.userId)) {
             throw new idp_protocol_1.AuthorizationError('Invalid plugin runtime identity');
         }
+        await this.runtimeAuthorizer().assertActiveInstallation({
+            pluginId: tokenPayload.pluginId,
+            installationId: tokenPayload.installationId,
+            projectId: tokenPayload.projectId,
+            userId: tokenPayload.userId,
+        });
+    }
+    runtimeAuthorizer() {
         let authorizer;
         try {
             authorizer = this.moduleRef.get(plugin_runtime_authorizer_port_1.PLUGIN_RUNTIME_AUTHORIZER, {
@@ -173,12 +208,7 @@ let IdpGuard = class IdpGuard {
         if (!authorizer) {
             throw new idp_protocol_1.AuthorizationError('Plugin runtime authorization is unavailable');
         }
-        await authorizer.assertActiveInstallation({
-            pluginId: tokenPayload.pluginId,
-            installationId: tokenPayload.installationId,
-            projectId: tokenPayload.projectId,
-            userId: tokenPayload.userId,
-        });
+        return authorizer;
     }
     isNonEmptyString(value) {
         return typeof value === 'string' && value.trim().length > 0;

package/dist/src/idp/oauth/controllers/oauth-authorization.controller.js

@@ -19,6 +19,7 @@ const internal_helpers_1 = require("@owox/internal-helpers");
 const idp_protocol_1 = require("@owox/idp-protocol");
 const idp_provider_service_1 = require("../../services/idp-provider.service");
 const oauth_client_registry_1 = require("../oauth-client.registry");
+const mcp_client_integration_1 = require("../mcp-client-integration");
 const oauth_idp_port_1 = require("../oauth-idp.port");
 const oauth_project_selection_service_1 = require("../oauth-project-selection.service");
 const oauth_project_member_resolver_1 = require("../oauth-project-member.resolver");
@@ -66,7 +67,7 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
         const authorizationRequest = validated.request;
         const resourceContext = validated.resourceContext;
         const provider = this.idpProviderService.getProvider(request);
-        const authorization = await this.resolveAuthorizationContext(provider, request, response);
+        const authorization = await this.resolveAuthorizationContext(provider, request, response, (0, mcp_client_integration_1.getMcpClientIntegration)(authorizationRequest.redirectUri));
         if (!authorization) {
             return;
         }
@@ -160,7 +161,7 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
             ? this.projectSelectionService.resolveSelectedProjectMember(provider, context, projects, selectedProjectId)
             : this.projectMemberResolver.resolve(context);
     }
-    async resolveAuthorizationContext(provider, request, response) {
+    async resolveAuthorizationContext(provider, request, response, integration) {
         const accessToken = this.getHeaderValue(request, 'x-owox-authorization');
         if (accessToken) {
             const payload = await provider.parseToken(accessToken);
@@ -170,7 +171,7 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
         }
         const refreshToken = this.getCookieValue(request, 'refreshToken');
         if (!refreshToken) {
-            this.redirectToSignIn(request, response);
+            this.redirectToSignIn(request, response, integration);
             return null;
         }
         try {
@@ -178,13 +179,13 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
             this.persistRefreshTokenIfReturned(request, response, auth);
             const payload = await provider.parseToken(auth.accessToken);
             if (!payload) {
-                this.redirectToSignIn(request, response);
+                this.redirectToSignIn(request, response, integration);
                 return null;
             }
             return { context: this.toAuthorizationContext(payload), accessToken: auth.accessToken };
         }
         catch {
-            this.redirectToSignIn(request, response);
+            this.redirectToSignIn(request, response, integration);
             return null;
         }
     }
@@ -221,13 +222,14 @@ let OAuthAuthorizationController = OAuthAuthorizationController_1 = class OAuthA
             maxAge: auth.refreshTokenExpiresIn * 1000,
         });
     }
-    redirectToSignIn(request, response) {
+    redirectToSignIn(request, response, integration) {
         const currentUrl = request.originalUrl || request.url;
         const host = request.get('host') ?? 'localhost';
         const signInUrl = new URL('/auth/sign-in', `${request.protocol}://${host}`);
         signInUrl.searchParams.set('redirect', currentUrl);
         signInUrl.searchParams.set('redirect-to', currentUrl);
         signInUrl.searchParams.set('app-redirect-to', currentUrl);
+        signInUrl.searchParams.set('integration', integration);
         this.logger.log('Redirecting OAuth authorize request to sign-in', {
             clientId: this.extractClientId(currentUrl, request, host),
             host,

package/dist/src/idp/oauth/mcp-client-integration.d.ts

@@ -0,0 +1 @@
+export declare function getMcpClientIntegration(redirectUri: string): string;

package/dist/src/idp/oauth/mcp-client-integration.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getMcpClientIntegration = getMcpClientIntegration;
+function getMcpClientIntegration(redirectUri) {
+    const origin = new URL(redirectUri).origin;
+    switch (origin) {
+        case 'https://claude.ai':
+            return 'claude';
+        case 'https://chatgpt.com':
+            return 'chatgpt';
+        default:
+            return 'owox-data-marts';
+    }
+}
+//# sourceMappingURL=mcp-client-integration.js.map

package/dist/src/idp/ports/plugin-runtime-authorizer.port.d.ts

@@ -1,10 +1,16 @@
+import type { Role } from '@owox/idp-protocol';
 export interface PluginRuntimeIdentity {
     readonly pluginId: string;
     readonly installationId: string;
     readonly projectId: string;
     readonly userId: string;
 }
+export interface PluginExecutionIdentity extends PluginRuntimeIdentity {
+    readonly executionId: string;
+    readonly role: Role;
+}
 export declare const PLUGIN_RUNTIME_AUTHORIZER: unique symbol;
 export interface PluginRuntimeAuthorizerPort {
     assertActiveInstallation(identity: PluginRuntimeIdentity): Promise<void>;
+    resolveExecutionToken(token: string): Promise<PluginExecutionIdentity | null>;
 }

package/dist/src/idp/types/auth.types.d.ts

@@ -12,4 +12,5 @@ export interface AuthorizationContext {
     pluginId?: string;
     installationId?: string;
     viewOnly?: boolean;
+    executionId?: string;
 }

package/dist/src/migrations/1790900000000-add-plugin-version-backend.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class AddPluginVersionBackend1790900000000 implements MigrationInterface {
+    readonly name = "AddPluginVersionBackend1790900000000";
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/src/migrations/1790900000000-add-plugin-version-backend.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddPluginVersionBackend1790900000000 = void 0;
+const typeorm_1 = require("typeorm");
+const TABLE = 'plugin_version';
+const COLUMN = 'backend';
+class AddPluginVersionBackend1790900000000 {
+    name = 'AddPluginVersionBackend1790900000000';
+    async up(queryRunner) {
+        if (!(await queryRunner.hasColumn(TABLE, COLUMN))) {
+            await queryRunner.addColumn(TABLE, new typeorm_1.TableColumn({ name: COLUMN, type: 'json', isNullable: true }));
+        }
+    }
+    async down(queryRunner) {
+        if (await queryRunner.hasColumn(TABLE, COLUMN)) {
+            await queryRunner.dropColumn(TABLE, COLUMN);
+        }
+    }
+}
+exports.AddPluginVersionBackend1790900000000 = AddPluginVersionBackend1790900000000;
+//# sourceMappingURL=1790900000000-add-plugin-version-backend.js.map

package/dist/src/migrations/1790900000001-create-plugin-action-execution.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class CreatePluginActionExecution1790900000001 implements MigrationInterface {
+    readonly name = "CreatePluginActionExecution1790900000001";
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/src/migrations/1790900000001-create-plugin-action-execution.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatePluginActionExecution1790900000001 = void 0;
+const typeorm_1 = require("typeorm");
+const migration_utils_1 = require("./migration-utils");
+const TABLE = 'plugin_action_execution';
+class CreatePluginActionExecution1790900000001 {
+    name = 'CreatePluginActionExecution1790900000001';
+    async up(queryRunner) {
+        if (await queryRunner.hasTable(TABLE)) {
+            return;
+        }
+        const payloadType = queryRunner.connection.options.type === 'mysql' ? 'mediumtext' : 'text';
+        await queryRunner.createTable(new typeorm_1.Table({
+            name: TABLE,
+            columns: [
+                { name: 'id', type: 'varchar', length: '36', isPrimary: true },
+                { name: 'pluginId', type: 'varchar', length: '36', isNullable: false },
+                { name: 'pluginVersionId', type: 'varchar', length: '36', isNullable: false },
+                { name: 'installationId', type: 'varchar', length: '36', isNullable: false },
+                { name: 'projectId', type: 'varchar', length: '255', isNullable: false },
+                { name: 'userId', type: 'varchar', length: '255', isNullable: false },
+                { name: 'action', type: 'varchar', length: '64', isNullable: false },
+                { name: 'input', type: payloadType, isNullable: true },
+                { name: 'trigger', type: 'varchar', length: '16', isNullable: false },
+                { name: 'status', type: 'varchar', length: '16', isNullable: false },
+                { name: 'role', type: 'varchar', length: '16', isNullable: false },
+                { name: 'tokenHash', type: 'varchar', length: '64', isNullable: true },
+                { name: 'deadlineAt', type: 'datetime', isNullable: true, default: null },
+                { name: 'createdAt', type: 'datetime', default: 'CURRENT_TIMESTAMP' },
+                { name: 'startedAt', type: 'datetime', isNullable: true, default: null },
+                { name: 'finishedAt', type: 'datetime', isNullable: true, default: null },
+                { name: 'errorCode', type: 'varchar', length: '64', isNullable: true },
+                { name: 'errorMessage', type: 'varchar', length: '1000', isNullable: true },
+                { name: 'result', type: payloadType, isNullable: true },
+                { name: 'payloadsClearedAt', type: 'datetime', isNullable: true, default: null },
+                { name: 'payloadBytes', type: 'int', isNullable: false, default: 0 },
+            ],
+        }));
+        for (const index of [
+            new typeorm_1.TableIndex({
+                name: 'UQ_plugin_action_execution_token',
+                columnNames: ['tokenHash'],
+                isUnique: true,
+            }),
+            new typeorm_1.TableIndex({
+                name: 'idx_plugin_action_execution_running',
+                columnNames: ['installationId', 'status'],
+            }),
+            new typeorm_1.TableIndex({
+                name: 'idx_plugin_action_execution_deadline',
+                columnNames: ['status', 'deadlineAt'],
+            }),
+            new typeorm_1.TableIndex({
+                name: 'idx_plugin_action_execution_starts',
+                columnNames: ['installationId', 'startedAt', 'payloadBytes'],
+            }),
+            new typeorm_1.TableIndex({
+                name: 'idx_plugin_action_execution_finished',
+                columnNames: ['finishedAt'],
+            }),
+            new typeorm_1.TableIndex({
+                name: 'idx_plugin_action_execution_payloads',
+                columnNames: ['payloadsClearedAt', 'finishedAt'],
+            }),
+        ]) {
+            await queryRunner.createIndex(TABLE, index);
+        }
+    }
+    async down(queryRunner) {
+        if (await queryRunner.hasTable(TABLE)) {
+            await (0, migration_utils_1.softDropTable)(queryRunner, TABLE);
+        }
+    }
+}
+exports.CreatePluginActionExecution1790900000001 = CreatePluginActionExecution1790900000001;
+//# sourceMappingURL=1790900000001-create-plugin-action-execution.js.map

package/dist/src/migrations/1791000000000-add-credential-public-metadata.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class AddCredentialPublicMetadata1791000000000 implements MigrationInterface {
+    readonly name = "AddCredentialPublicMetadata1791000000000";
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/src/migrations/1791000000000-add-credential-public-metadata.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddCredentialPublicMetadata1791000000000 = void 0;
+const typeorm_1 = require("typeorm");
+const CREDENTIAL = 'credential';
+const COLUMN = 'publicMetadata';
+class AddCredentialPublicMetadata1791000000000 {
+    name = 'AddCredentialPublicMetadata1791000000000';
+    async up(queryRunner) {
+        if ((await queryRunner.hasTable(CREDENTIAL)) &&
+            !(await queryRunner.hasColumn(CREDENTIAL, COLUMN))) {
+            await queryRunner.addColumn(CREDENTIAL, new typeorm_1.TableColumn({ name: COLUMN, type: 'json', isNullable: true }));
+        }
+    }
+    async down(queryRunner) {
+        if ((await queryRunner.hasTable(CREDENTIAL)) &&
+            (await queryRunner.hasColumn(CREDENTIAL, COLUMN))) {
+            await queryRunner.dropColumn(CREDENTIAL, COLUMN);
+        }
+    }
+}
+exports.AddCredentialPublicMetadata1791000000000 = AddCredentialPublicMetadata1791000000000;
+//# sourceMappingURL=1791000000000-add-credential-public-metadata.js.map

package/dist/src/plugin-host/collections/dto/domain/plugin-collection.types.d.ts

@@ -20,6 +20,7 @@ export interface PluginCollectionPageDto {
 }
 export interface ResolvedPluginCollection {
     readonly declaration: PluginCollectionDeclaration;
+    readonly semver: string;
     readonly namespaceKey: string;
     readonly memberId: string | null;
 }

package/dist/src/plugin-host/collections/errors/plugin-collection.errors.d.ts

@@ -7,6 +7,12 @@ export declare class PluginCollectionAuthorizationDeniedError extends ForbiddenE
 }
 export declare class PluginCollectionValidationError extends BadRequestException {
 }
+export declare class PluginCollectionNotEntityBoundError extends PluginCollectionValidationError {
+    constructor(collectionName: string, semver: string);
+}
+export declare class PluginCollectionParentIdRequiredError extends PluginCollectionValidationError {
+    constructor(collectionName: string, entityType: string, semver: string);
+}
 export declare class PluginCollectionQuotaExceededError extends PayloadTooLargeException {
     constructor(limit: string);
 }

package/dist/src/plugin-host/collections/errors/plugin-collection.errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PluginCollectionQuotaExceededError = exports.PluginCollectionValidationError = exports.PluginCollectionAuthorizationDeniedError = exports.PluginCollectionNotFoundError = void 0;
+exports.PluginCollectionQuotaExceededError = exports.PluginCollectionParentIdRequiredError = exports.PluginCollectionNotEntityBoundError = exports.PluginCollectionValidationError = exports.PluginCollectionAuthorizationDeniedError = exports.PluginCollectionNotFoundError = void 0;
 const common_1 = require("@nestjs/common");
 class PluginCollectionNotFoundError extends common_1.NotFoundException {
     constructor() {
@@ -17,6 +17,24 @@ exports.PluginCollectionAuthorizationDeniedError = PluginCollectionAuthorization
 class PluginCollectionValidationError extends common_1.BadRequestException {
 }
 exports.PluginCollectionValidationError = PluginCollectionValidationError;
+class PluginCollectionNotEntityBoundError extends PluginCollectionValidationError {
+    constructor(collectionName, semver) {
+        super({
+            code: 'PLUGIN_COLLECTION_NOT_ENTITY_BOUND',
+            message: `Collection "${collectionName}" has no entityBinding in plugin.json of the current version ${semver}, so put does not accept parentId`,
+        });
+    }
+}
+exports.PluginCollectionNotEntityBoundError = PluginCollectionNotEntityBoundError;
+class PluginCollectionParentIdRequiredError extends PluginCollectionValidationError {
+    constructor(collectionName, entityType, semver) {
+        super({
+            code: 'PLUGIN_COLLECTION_PARENT_ID_REQUIRED',
+            message: `Collection "${collectionName}" has an entityBinding to ${entityType} in plugin.json of the current version ${semver}, so put requires parentId`,
+        });
+    }
+}
+exports.PluginCollectionParentIdRequiredError = PluginCollectionParentIdRequiredError;
 class PluginCollectionQuotaExceededError extends common_1.PayloadTooLargeException {
     constructor(limit) {
         super(`Plugin collection limit exceeded: ${limit}`);

package/dist/src/plugin-host/collections/services/plugin-collection-declaration.service.js

@@ -27,8 +27,8 @@ let PluginCollectionDeclarationService = class PluginCollectionDeclarationServic
         if (!plugin?.currentVersionId)
             throw new plugin_collection_errors_1.PluginCollectionNotFoundError();
         const version = await this.versions.findById(plugin.currentVersionId);
-        const declaration = (version?.collections ?? []).find(item => item.name === collectionName);
-        if (!declaration)
+        const declaration = version?.collections?.find(item => item.name === collectionName);
+        if (!version || !declaration)
             throw new plugin_collection_errors_1.PluginCollectionNotFoundError();
         const memberId = declaration.scope === 'member' ? context.userId : null;
         const namespaceKey = (0, node_crypto_1.createHash)('sha256')
@@ -40,7 +40,7 @@ let PluginCollectionDeclarationService = class PluginCollectionDeclarationServic
             collectionName,
         ]))
             .digest('hex');
-        return { declaration, namespaceKey, memberId };
+        return { declaration, semver: version.semver, namespaceKey, memberId };
     }
 };
 exports.PluginCollectionDeclarationService = PluginCollectionDeclarationService;

package/dist/src/plugin-host/collections/use-cases/put-plugin-collection-document.service.js

@@ -27,6 +27,13 @@ let PutPluginCollectionDocumentService = class PutPluginCollectionDocumentServic
     async run(command) {
         const resolved = await this.declarations.resolve(command.collectionName, command.context);
         try {
+            const { entityBinding } = resolved.declaration;
+            if (command.parentId !== null && !entityBinding) {
+                throw new plugin_collection_errors_1.PluginCollectionNotEntityBoundError(command.collectionName, resolved.semver);
+            }
+            if (command.parentId === null && entityBinding) {
+                throw new plugin_collection_errors_1.PluginCollectionParentIdRequiredError(command.collectionName, entityBinding.type, resolved.semver);
+            }
             return await this.persistence.put(resolved, command);
         }
         catch (error) {

package/dist/src/plugin-host/constants/plugin-action-limits.d.ts

@@ -0,0 +1,34 @@
+export declare const PLUGIN_ACTION_LIMITS: {
+    readonly maxActions: 50;
+    readonly maxInputSchemaBytes: number;
+    readonly maxInputSchemaNodes: 2000;
+    readonly maxInputBytes: number;
+    readonly maxJsonDepth: 100;
+    readonly routeBodyLimit: "512kb";
+    readonly maxResultBytes: number;
+    readonly maxErrorMessageChars: 1000;
+    readonly maxReportedInputErrors: 20;
+    readonly maxRunningPerInstallation: 5;
+    readonly maxStartsPerInstallationPerMinute: 60;
+    readonly maxStartsPerInstallationPerDay: 5000;
+    readonly maxPayloadBytesPerInstallation: number;
+    readonly maxWaitSeconds: 20;
+    readonly waitPollMs: 1000;
+    readonly cancelPollMs: 5000;
+    readonly orphanGraceMs: 60000;
+    readonly payloadRetentionHours: 24;
+    readonly rowRetentionDays: 90;
+    readonly sweepBatchSize: 500;
+    readonly validationWorkers: 2;
+    readonly validationBudgetMs: 500;
+    readonly inputSchemaCompileBudgetMs: 2000;
+    readonly validationBootMs: 5000;
+    readonly validationWorkerHeapMb: 64;
+    readonly validationWorkerCacheSize: 50;
+    readonly maxValidationsPerVersion: 4;
+    readonly maxQueuedValidations: 64;
+};
+export declare const PLUGIN_ACTION_ERROR_CODE_PATTERN: RegExp;
+export declare const PLUGIN_ACTION_RESERVED_ERROR_CODES: ReadonlySet<string>;
+export declare const PLUGIN_ACTION_RESERVED_ERROR_CODE_PREFIX = "BACKEND_";
+export declare function isPluginOwnedErrorCode(code: unknown): code is string;

package/dist/src/plugin-host/constants/plugin-action-limits.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLUGIN_ACTION_RESERVED_ERROR_CODE_PREFIX = exports.PLUGIN_ACTION_RESERVED_ERROR_CODES = exports.PLUGIN_ACTION_ERROR_CODE_PATTERN = exports.PLUGIN_ACTION_LIMITS = void 0;
+exports.isPluginOwnedErrorCode = isPluginOwnedErrorCode;
+exports.PLUGIN_ACTION_LIMITS = {
+    maxActions: 50,
+    maxInputSchemaBytes: 32 * 1024,
+    maxInputSchemaNodes: 2000,
+    maxInputBytes: 256 * 1024,
+    maxJsonDepth: 100,
+    routeBodyLimit: '512kb',
+    maxResultBytes: 1024 * 1024,
+    maxErrorMessageChars: 1000,
+    maxReportedInputErrors: 20,
+    maxRunningPerInstallation: 5,
+    maxStartsPerInstallationPerMinute: 60,
+    maxStartsPerInstallationPerDay: 5000,
+    maxPayloadBytesPerInstallation: 100 * 1024 * 1024,
+    maxWaitSeconds: 20,
+    waitPollMs: 1000,
+    cancelPollMs: 5000,
+    orphanGraceMs: 60_000,
+    payloadRetentionHours: 24,
+    rowRetentionDays: 90,
+    sweepBatchSize: 500,
+    validationWorkers: 2,
+    validationBudgetMs: 500,
+    inputSchemaCompileBudgetMs: 2000,
+    validationBootMs: 5000,
+    validationWorkerHeapMb: 64,
+    validationWorkerCacheSize: 50,
+    maxValidationsPerVersion: 4,
+    maxQueuedValidations: 64,
+};
+exports.PLUGIN_ACTION_ERROR_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+exports.PLUGIN_ACTION_RESERVED_ERROR_CODES = new Set([
+    'TIMED_OUT',
+    'CANCELLED',
+    'ACTION_NOT_DECLARED',
+    'INVALID_INPUT',
+    'INSTALLATION_INACTIVE',
+    'PLUGIN_SUSPENDED',
+]);
+exports.PLUGIN_ACTION_RESERVED_ERROR_CODE_PREFIX = 'BACKEND_';
+function isPluginOwnedErrorCode(code) {
+    return (typeof code === 'string' &&
+        exports.PLUGIN_ACTION_ERROR_CODE_PATTERN.test(code) &&
+        !code.startsWith(exports.PLUGIN_ACTION_RESERVED_ERROR_CODE_PREFIX) &&
+        !exports.PLUGIN_ACTION_RESERVED_ERROR_CODES.has(code));
+}
+//# sourceMappingURL=plugin-action-limits.js.map

package/dist/src/plugin-host/controllers/plugin-action-runtime.controller.d.ts

@@ -0,0 +1,20 @@
+import type { Request } from 'express';
+import { type AuthorizationContext } from '../../idp';
+import { PluginActionExecutionApiDto, PluginActionExecutionQueryApiDto, PluginActionWorkerContextApiDto, StartedPluginActionExecutionApiDto } from '../dto/presentation/plugin-action-api.dto';
+import { PluginPresentationMapper } from '../mappers/plugin-presentation.mapper';
+import { CancelPluginActionExecutionService } from '../use-cases/cancel-plugin-action-execution.service';
+import { GetCurrentPluginActionExecutionService } from '../use-cases/get-current-plugin-action-execution.service';
+import { GetPluginActionExecutionService } from '../use-cases/get-plugin-action-execution.service';
+import { StartPluginActionExecutionService } from '../use-cases/start-plugin-action-execution.service';
+export declare class PluginActionRuntimeController {
+    private readonly startExecution;
+    private readonly getExecution;
+    private readonly cancelExecution;
+    private readonly getCurrentExecution;
+    private readonly mapper;
+    constructor(startExecution: StartPluginActionExecutionService, getExecution: GetPluginActionExecutionService, cancelExecution: CancelPluginActionExecutionService, getCurrentExecution: GetCurrentPluginActionExecutionService, mapper: PluginPresentationMapper);
+    start(action: string, body: Record<string, unknown> | undefined, context: AuthorizationContext): Promise<StartedPluginActionExecutionApiDto>;
+    current(context: AuthorizationContext): Promise<PluginActionWorkerContextApiDto>;
+    get(id: string, query: PluginActionExecutionQueryApiDto, context: AuthorizationContext, request: Request): Promise<PluginActionExecutionApiDto>;
+    cancel(id: string, context: AuthorizationContext): Promise<PluginActionExecutionApiDto>;
+}