@ryuhq/sdk 0.0.5

package/dist/agent.d.cts

@@ -0,0 +1,3 @@
+export { A as Agent, b as AgentConfig, c as AgentEvent, U as AgentEventAuthRequired, V as AgentEventError, W as AgentEventResult, X as AgentEventText, Y as AgentEventToolCall, Z as AgentEventToolResult, d as AgentTool, _ as AssistantMessage, $ as Elicitation, E as Endpoint, h as GenerateResult, a0 as LoopConfig, a1 as LoopMessage, a2 as ModelCallOptions, a3 as ModelCallResult, a4 as ModelUsage, Q as QueryInput, n as QueryOptions, t as RemoteToolRef, a5 as RyuToolOptions, a6 as ToolCall, a7 as ToolExecContext, a8 as ToolExecResult, a9 as ToolFunctionDef, aa as callModelWithTools, y as createAgent, ab as detectElicitation, ac as executeTool, N as query, ad as resolveToolDefs, ae as runAgentLoop, O as ryuTool } from './index-CEbS1SlS.cjs';
+import './manifest.cjs';
+import 'zod';

package/dist/agent.d.ts

@@ -0,0 +1,3 @@
+export { A as Agent, b as AgentConfig, c as AgentEvent, U as AgentEventAuthRequired, V as AgentEventError, W as AgentEventResult, X as AgentEventText, Y as AgentEventToolCall, Z as AgentEventToolResult, d as AgentTool, _ as AssistantMessage, $ as Elicitation, E as Endpoint, h as GenerateResult, a0 as LoopConfig, a1 as LoopMessage, a2 as ModelCallOptions, a3 as ModelCallResult, a4 as ModelUsage, Q as QueryInput, n as QueryOptions, t as RemoteToolRef, a5 as RyuToolOptions, a6 as ToolCall, a7 as ToolExecContext, a8 as ToolExecResult, a9 as ToolFunctionDef, aa as callModelWithTools, y as createAgent, ab as detectElicitation, ac as executeTool, N as query, ad as resolveToolDefs, ae as runAgentLoop, O as ryuTool } from './index-DAxq7Y0R.js';
+import './manifest.js';
+import 'zod';

package/dist/agent.js

@@ -0,0 +1,23 @@
+import {
+  Agent,
+  callModelWithTools,
+  createAgent,
+  detectElicitation,
+  executeTool,
+  query,
+  resolveToolDefs,
+  runAgentLoop,
+  ryuTool
+} from "./chunk-KPKMMGVC.js";
+import "./chunk-ODFEUVPW.js";
+export {
+  Agent,
+  callModelWithTools,
+  createAgent,
+  detectElicitation,
+  executeTool,
+  query,
+  resolveToolDefs,
+  runAgentLoop,
+  ryuTool
+};

package/dist/chunk-GXHL5CO7.js

@@ -0,0 +1,353 @@
+// src/manifest.ts
+import { createRequire } from "module";
+import { z } from "zod";
+var cachedNative = null;
+var nativeLoadError = null;
+function loadNative() {
+  if (cachedNative) {
+    return cachedNative;
+  }
+  if (nativeLoadError) {
+    throw nativeLoadError;
+  }
+  try {
+    const req = createRequire(import.meta.url);
+    cachedNative = req("@ryuhq/sdk-native");
+    return cachedNative;
+  } catch (cause) {
+    nativeLoadError = new Error(
+      "@ryuhq/sdk-native (the Rust-cored napi addon) is not available; Core-strict manifest validation requires it. Build/install the addon, or use PluginManifestSchema (pure-JS zod) for authoring-time validation.",
+      { cause }
+    );
+    throw nativeLoadError;
+  }
+}
+var RunnableKindSchema = z.enum([
+  "agent",
+  "workflow",
+  "tool",
+  "skill",
+  // A companion surface (in-desktop panel). Added so a packable plugin can
+  // declare a companion runnable that flows through Core's existing Companion
+  // handler → app_contrib → `GET /api/plugins/contributions` → the desktop
+  // `/plugin/<id>` route. Its `config.ui_entry` (see `CompanionRunnableConfigSchema`)
+  // is what `ryu pack` bundles into `ui_code`.
+  "companion"
+]);
+var RunnableMetaSchema = z.object({
+  /** Stable unique identifier (e.g. `"agent-researcher"`). */
+  id: z.string().min(1),
+  /** Human-readable display name. */
+  name: z.string().min(1),
+  /** Which kind of runnable this entry describes. */
+  kind: RunnableKindSchema,
+  /**
+   * Optional per-kind config blob. Mirrors Core's `RunnableEntry.config`
+   * (`Option<serde_json::Value>`) so a manifest authored here round-trips
+   * through Core-strict validation. Left opaque (a record) at this authoring
+   * layer; the per-kind shape is enforced by Core's `validate_runnable`.
+   *
+   * For a `companion` runnable, `config.ui_entry` names the plugin's UI entry
+   * module (relative to the manifest dir). `ryu pack` bundles that entry into
+   * the emitted `ui_code`; Core's `CompanionConfig.ui_entry` is the lockstep
+   * field so a packed companion validates.
+   */
+  config: z.record(z.string(), z.unknown()).optional()
+});
+function labelImpersonatesSystemChrome(label) {
+  const lower = label.toLowerCase();
+  return lower.includes("ryu") || lower.includes("system");
+}
+var CompanionSurfaceSchema = z.object({
+  /** Display label for the companion panel tab or tooltip. Anti-impersonation:
+   *  may not pose as first-party Ryu/system chrome (see
+   *  {@link labelImpersonatesSystemChrome}). */
+  label: z.string().min(1).refine((value) => !labelImpersonatesSystemChrome(value), {
+    message: "companion label must not impersonate system chrome (must not contain 'ryu' or 'system')"
+  }),
+  /** Icon identifier resolved by the desktop shell. */
+  icon: z.string().optional(),
+  /** Keyboard shortcut string (e.g. `"ctrl+shift+r"`). */
+  shortcut: z.string().optional()
+});
+var TurnHookContributionSchema = z.object({
+  /** Stable id for this hook (unique within the plugin). */
+  id: z.string().min(1),
+  /** Turn boundary this fires on. Today only `"post_assistant_turn"`. */
+  on: z.string().min(1).default("post_assistant_turn"),
+  /** The JS hook body executed in the sandbox (returns a directive). */
+  code: z.string().min(1)
+});
+var DEFAULT_WIDGET_MIME = "text/html+skybridge";
+var DEFAULT_WIDGET_DISPLAY_MODE = "inline";
+var WidgetContributionSchema = z.object({
+  /** The fully-qualified tool id whose result renders this widget. */
+  tool_id: z.string().min(1),
+  /** `ui://widget/<slug>.html` — the widget resource uri. */
+  uri: z.string().min(1),
+  /** Source entry (e.g. `src/apps/checklist/index.tsx`) for `ryu pack`. */
+  ui_entry: z.string().optional(),
+  /** Widget MIME dialect (default `text/html+skybridge`). */
+  mime: z.string().default(DEFAULT_WIDGET_MIME),
+  /** Default display mode (`inline` | `fullscreen` | `pip`). */
+  default_display_mode: z.string().default(DEFAULT_WIDGET_DISPLAY_MODE)
+});
+var ToolAppConfigSchema = z.object({
+  /** MCP tool slug this runnable wraps — the fully-qualified `<server>__<name>` id. */
+  slug: z.string().min(1),
+  /** The tool description the model reads when choosing it. Carried here because a
+   *  packed app's manifest is the only channel (there is no `generated.rs`); Core's
+   *  app-tool synthesis reads it back onto the `RegistryTool`. */
+  description: z.string(),
+  /** JSON Schema for the tool's arguments (used for validation + the LLM tool
+   *  surface). Snake_case to match `widget_accessible`. Absent = no arguments. */
+  input_schema: z.record(z.string(), z.unknown()).optional(),
+  /** True when calling this tool renders the app's widget (carries the template). */
+  widget: z.boolean().default(false),
+  /** True when a mounted widget may `callTool` this tool (a companion), or when a
+   *  render tool's widget may call any companion the app declares. */
+  widget_accessible: z.boolean().default(false),
+  /** Optional status label shown while the render tool runs. */
+  invoking: z.string().optional(),
+  /** Optional status label shown when the render tool finishes. */
+  invoked: z.string().optional()
+});
+var ContributesSchema = z.object({
+  turn_hooks: z.array(TurnHookContributionSchema).default([]),
+  composer_controls: z.array(z.record(z.string(), z.unknown())).default([]),
+  settings_tabs: z.array(z.record(z.string(), z.unknown())).default([]),
+  slash_commands: z.array(z.record(z.string(), z.unknown())).default([]),
+  /** App widgets (Ryu Apps). Each binds a render tool id to its
+   *  `ui://widget/<slug>.html` template. Mirrors the Rust-side
+   *  `Contributes.widgets` field, without which the CLI's zod parse would strip
+   *  every widget an app authored here declares. */
+  widgets: z.array(WidgetContributionSchema).default([])
+});
+var SetupStepSchema = z.object({
+  /** Card heading (e.g. the companion app name). */
+  title: z.string().optional(),
+  /** Instruction body shown under the title. */
+  description: z.string().optional(),
+  /** Label for the optional action button. */
+  actionLabel: z.string().optional(),
+  /** URL the action button opens (validated server-side on publish). */
+  actionUrl: z.string().optional()
+});
+var AppDependencySchema = z.object({
+  /** The `id` of the plugin this one depends on. */
+  id: z.string().min(1, "dependency id is required"),
+  /** Optional MINIMUM version the dependency must satisfy (`"1.2.0"` = `">=1.2.0"`). */
+  min_version: z.string().min(1).optional()
+});
+var CapabilityReqSchema = z.object({
+  /** Capability name (e.g. `"rag"`, `"memory"`, `"tts"`). Matched against a
+   *  provider's `provides[].capability`. */
+  capability: z.string().min(1, "capability name is required"),
+  /** Optional MINIMUM capability version the bound provider must satisfy
+   *  (`"1.2.0"` = `">=1.2.0"`). Absent = any version. */
+  min_version: z.string().min(1).optional()
+});
+var RequiresSchema = z.object({
+  /** Other plugins that must be installed + enabled before this one enables. */
+  apps: z.array(AppDependencySchema).default([]),
+  /**
+   * Abstract capability edges the broker resolves to a bound provider at
+   * enable time. Mirrors `Requires::capabilities` in
+   * `crates/ryu-kernel-contracts` — an `apps` edge names a specific plugin; a
+   * `capabilities` edge names a capability and lets the binding registry choose
+   * the provider. Each is lowered to an app-id graph edge once bound, so the
+   * enable/disable/cycle machinery is shared. Empty for the common case.
+   */
+  capabilities: z.array(CapabilityReqSchema).default([]),
+  /**
+   * Permission grants implied by the dependencies. Declaration only — the
+   * Gateway remains the sole authority on what a grant *allows*, and Core's
+   * dependency graph resolves `apps` only.
+   */
+  grants: z.array(z.string()).default([])
+});
+var SurfaceSchema = z.enum([
+  /** The Ryu Gateway. */
+  "gateway",
+  /** A headless Core node (no UI). */
+  "core",
+  /** The Tauri desktop app. */
+  "desktop",
+  /** The Electron dynamic-island companion. */
+  "island",
+  /** The Expo/React-Native mobile app. */
+  "mobile",
+  /** The browser extension. */
+  "extension",
+  /** The Next.js web app. */
+  "web",
+  /** The terminal client. */
+  "cli"
+]);
+var PluginManifestSchema = z.object({
+  /** Reverse-domain unique identifier (e.g. `"com.example.my-plugin"`). */
+  id: z.string().min(1, "id is required"),
+  /** Human-readable display name shown in the plugin store / launcher. */
+  name: z.string().min(1, "name is required"),
+  /**
+   * Semver version string (e.g. `"1.0.0"`). Core's loader rejects any manifest
+   * whose version is not valid semver; the regex here enforces the same rule at
+   * SDK-build time.
+   */
+  version: z.string().regex(
+    /^\d+\.\d+\.\d+(?:-[\w.]+)?(?:\+[\w.]+)?$/,
+    "version must be a valid semver string (e.g. 1.0.0)"
+  ),
+  /**
+   * Lower-case hex `sha256(utf8_bytes(ui_code))` binding the plugin's bundled
+   * sandboxed-UI code to this manifest. `ryu pack` / `ryu publish` compute it and
+   * write it here BEFORE the manifest is signed, so the hash rides INSIDE the
+   * Gateway-signed surface while the `ui_code` blob rides OUTSIDE it as payload;
+   * Core's install path recomputes the hash over the fetched code and rejects a
+   * mismatch fail-closed. Absent for a manifest-only plugin (no bundled UI).
+   * Mirrors Core's `PluginManifest.ui_code_sha256`.
+   */
+  ui_code_sha256: z.string().nullish(),
+  /** The Runnables this plugin bundles. */
+  runnables: z.array(RunnableMetaSchema).default([]),
+  /**
+   * Permission grants this plugin declares it needs (e.g. `"mcp:web_search"`).
+   * Declarations only — grant enforcement is the Gateway's responsibility.
+   */
+  permission_grants: z.array(z.string()).default([]),
+  /**
+   * Optional Companion surface (an in-desktop overlay or sidebar panel).
+   * Absent when the plugin has no Companion surface.
+   */
+  companion: CompanionSurfaceSchema.optional(),
+  /**
+   * VS-Code-style activation events (`"*"`, `"onStartup"`, `"onChat"`,
+   * `"onCommand:<id>"`). Empty = eager. Turn-hook plugins are driven by their
+   * enabled flag, so `["*"]` is the usual value.
+   */
+  activation_events: z.array(z.string()).default([]),
+  /**
+   * Contribution points: server-side turn hooks + declarative UI widgets.
+   * Absent for a plugin that contributes nothing here.
+   */
+  contributes: ContributesSchema.optional(),
+  /**
+   * **Plugin-to-plugin dependencies** — the other plugins this one needs. Core
+   * resolves them into a topological enable order (dependencies enable first;
+   * disabling one is refused while an enabled dependent needs it).
+   *
+   * Absent = **no dependencies**, the backward-compatible default. Kept
+   * `.optional()` (never defaulted) so a manifest that declares none serialises
+   * with no `requires` key at all, exactly like Core's
+   * `#[serde(skip_serializing_if = "Option::is_none")]`.
+   */
+  requires: RequiresSchema.optional(),
+  /**
+   * Host surfaces this plugin runs on. **Empty or absent = runs on EVERY
+   * surface** — the backward-compatible default, which must never be read as
+   * "runs nowhere". Core filters only when the list is explicitly non-empty, and
+   * only at the read boundary (`GET /api/plugins`, keyed on `x-ryu-surface`), so
+   * an unsupported-target plugin stays installable and inspectable.
+   */
+  targets: z.array(SurfaceSchema).default([]),
+  /**
+   * Optional per-item AFFILIATE terms: the commission paid to a referrer when a
+   * referred user buys this (paid) item. `value` is basis points for `percent`
+   * (2000 = 20%) or minor units (cents) for `flat`. Absent (or `enabled:false`)
+   * falls back to the seller org owner's default affiliate terms. This is the
+   * authoring surface for the marketplace publish body's `affiliate` field (the
+   * server re-validates it); it only takes effect on a paid item.
+   */
+  affiliate: z.object({
+    enabled: z.boolean().default(false),
+    rule: z.object({
+      type: z.enum(["percent", "flat"]),
+      value: z.number().nonnegative(),
+      recurring: z.boolean().default(false),
+      durationMonths: z.number().int().positive().nullish(),
+      fundedBy: z.enum(["platform", "seller"]).default("platform")
+    }).optional()
+  }).optional(),
+  // ── Rich listing metadata (Phase 1.5) ──────────────────────────────────────
+  // Optional store-listing fields a plugin author declares so the marketplace
+  // detail dialog renders a richer App-Store-style preview. Field names align
+  // with the Claude `.claude-plugin/marketplace.json` plugin-entry standard where
+  // one exists (`author`, `homepage`, `keywords`, `category`, `license`); the
+  // rest are Ryu extensions. `ryu publish` forwards these FLAT into the publish
+  // body (not inside the signed manifest blob) so the control plane stores them.
+  // All optional + additive: a manifest omitting them still validates.
+  /** Longer plain/markdown description shown in the detail dialog. */
+  description: z.string().optional(),
+  /** Short one-line pitch shown under the name (Ryu extension). */
+  tagline: z.string().optional(),
+  /**
+   * Publisher identity. A bare string OR a Claude-style object; `ryu publish`
+   * resolves it to the display `developer` (`author.name` when an object).
+   */
+  author: z.union([
+    z.string(),
+    z.object({
+      name: z.string(),
+      email: z.string().optional(),
+      url: z.string().optional()
+    })
+  ]).optional(),
+  /** Project/marketing homepage — maps to the listing `website` (Claude field). */
+  homepage: z.string().optional(),
+  /** Free-text search keywords (Claude field). */
+  keywords: z.array(z.string()).optional(),
+  /** Taxonomy category beyond the runnable kinds (Claude field). */
+  category: z.string().optional(),
+  /** SPDX-ish license identifier (Claude field). */
+  license: z.string().optional(),
+  /** Square logo/icon URL for the listing card + detail header. */
+  iconUrl: z.string().optional(),
+  /** Ordered App-Store-style screenshot gallery URLs (Ryu extension). */
+  screenshots: z.array(z.string()).optional(),
+  /** Privacy policy URL surfaced on detail (Ryu extension). */
+  privacyPolicyUrl: z.string().optional(),
+  /** Terms-of-service URL surfaced on detail (Ryu extension). */
+  termsOfServiceUrl: z.string().optional(),
+  /**
+   * Human-readable capability strings (Ryu extension). When omitted the control
+   * plane derives a default from `permission_grants`, so declaring this is only
+   * needed to override the derived labels.
+   */
+  capabilities: z.array(z.string()).optional(),
+  /** Example prompt chips shown on detail (Ryu extension). */
+  examplePrompts: z.array(z.string()).optional(),
+  /**
+   * Optional companion/config card (Ryu extension): a single setup step or an
+   * array of steps guiding the user through post-install configuration.
+   */
+  setup: z.union([SetupStepSchema, z.array(SetupStepSchema)]).optional()
+});
+function validatePluginId(id) {
+  loadNative().validatePluginId(id);
+}
+function validateManifestStrict(manifestJson) {
+  return loadNative().parseAndValidateManifest(manifestJson);
+}
+function coreManifestJsonSchema() {
+  return JSON.parse(loadNative().pluginManifestJsonSchema());
+}
+
+export {
+  RunnableKindSchema,
+  RunnableMetaSchema,
+  labelImpersonatesSystemChrome,
+  CompanionSurfaceSchema,
+  TurnHookContributionSchema,
+  WidgetContributionSchema,
+  ToolAppConfigSchema,
+  ContributesSchema,
+  SetupStepSchema,
+  AppDependencySchema,
+  CapabilityReqSchema,
+  RequiresSchema,
+  SurfaceSchema,
+  PluginManifestSchema,
+  validatePluginId,
+  validateManifestStrict,
+  coreManifestJsonSchema
+};