@schlenkr/ragents 0.1.7 → 0.1.9

package/bundles/ragents.processes/ragents-bundle.json

@@ -1,7 +1,7 @@
 {
-  "format": 3,
+  "format": 4,
   "id": "ragents.processes",
-  "api": 6,
+  "api": 7,
   "hostNames": {
     "server": {
       "@ragents/engine": [
@@ -78,7 +78,7 @@
     }
   },
   "stand": "987603befb33bb6cbdf130bf48c606f09549cfcce8811ffcef62a235640d79f5",
-  "sourceStand": "8c4a54ab7237c74d3fc000b6e0fcc400a7a9b2f9b53219a3b78587f37f978abe",
+  "sourceStand": "b20b106082b28d9bf7abcee5e45584220f512422310923eb2977bfa142346e0a",
   "server": "server/index.js",
   "web": {
     "entry": "web/index.js",

package/bundles/ragents.product/ragents-bundle.json

@@ -1,7 +1,7 @@
 {
-  "format": 3,
+  "format": 4,
   "id": "ragents.product",
-  "api": 6,
+  "api": 7,
   "hostNames": {
     "server": {
       "@ragents/engine": [
@@ -76,7 +76,7 @@
     }
   },
   "stand": "83bcb0d455b8559983cc7811b8c3ba4a9ec5d2d595c7489c322d8a7e193a2f0c",
-  "sourceStand": "5a31a5884bbdecb161987cea6fb768a81fdb6bf774a3d6687ad725f2667bd53e",
+  "sourceStand": "59844fc6fb1c2e36dfb4d854bc75ed6a678de7dbe97e5d5a20c059a038098a4d",
   "server": "server/index.js",
   "web": {
     "entry": "web/index.js",

package/bundles/ragents.profile-distribution/ragents-bundle.json

@@ -1,7 +1,7 @@
 {
-  "format": 3,
+  "format": 4,
   "id": "ragents.profile-distribution",
-  "api": 6,
+  "api": 7,
   "hostNames": {
     "server": {
       "@ragents/engine": [
@@ -52,8 +52,8 @@
     },
     "web": {}
   },
-  "stand": "bfbd7567f9d0fe8aa6b6600c5e9750caab844053d93fbce389e02a169d151b18",
-  "sourceStand": "31d397812908e9f38efe5ba5923ba6f6f53624607453b41ffd7d62e688685cbb",
+  "stand": "8894e98d0ae19da1b57689c3434e69a04ccbb6d4ead9e6a2003e9b7f4a20f3cf",
+  "sourceStand": "fbb33591b3ef32d6b62d2af2e38fc0da5556b4711e2e011d5a14fa695cff93eb",
   "server": "server/index.js",
   "exports": {
     "server": {},

package/bundles/ragents.profile-distribution/server/index.js

@@ -70,7 +70,7 @@ var checkSections = (source, raw, pluginIds) => {
       if (section === "host" && !hostConfigKeys.includes(key)) throw new Error(`${source}: host.${key} ist kein Host-Schl\xFCssel`);
       if (isEnvironmentReference(entry) || isProvisionedReference(entry)) continue;
       if (SECRET_KEY_PATTERN.test(key)) throw new Error(`${source}: ${section}.${key} ist ein Secret und muss als env("...") stehen`);
-      const valid = typeof entry === "string" || typeof entry === "number" || typeof entry === "boolean" || Array.isArray(entry) && entry.every((item) => typeof item === "string");
+      const valid = typeof entry === "string" || typeof entry === "number" || typeof entry === "boolean" || Array.isArray(entry) && entry.every((item) => typeof item === "string") || Array.isArray(entry) && entry.every((item) => !!item && typeof item === "object" && !Array.isArray(item));
       if (!valid) throw new Error(`${source}: ${section}.${key} hat keinen g\xFCltigen Wert`);
       if (typeof entry === "string" && /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(entry)) throw new Error(`${source}: ${section}.${key} verweist als Text auf die Umgebung; env("...") verwenden`);
     }

package/bundles/ragents.profile-distribution/server/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../plugins/ragents.profile-distribution/server/index.ts", "../../../plugins/ragents.profile-distribution/contract.ts", "../../../plugins/ragents.profile-distribution/server/archive.ts", "../../../plugins/ragents.profile-distribution/server/config.ts"],
-  "sourcesContent": ["import { DomainError, implement, type HttpRouteContribution, type RAgentsPlugin } from \"@ragents/engine\";\nimport { readHostApiVersion, readHostVersion, readPackageVersion } from \"@ragents/host/host-version.js\";\nimport type { PluginModule } from \"@ragents/host/plugin-support/plugin-module.js\";\nimport { writeJson } from \"@ragents/host/plugin-support/http.js\";\nimport { profileArchivePath, profileDistributionContracts, type ClientProfileDescription } from \"../contract.js\";\nimport { inspectClientProfile, packClientProfile } from \"./archive.js\";\nimport { profileDistributionConfig, profileDistributionConfigDescriptors } from \"./config.js\";\n\ninterface DistributionState {\n  readonly description: ClientProfileDescription;\n  readonly archive: Buffer;\n}\n\nconst archivePattern = /^\\/profile\\/([0-9a-f]{64})\\.tar\\.gz$/;\n\nconst archiveRoute = (state: () => DistributionState): HttpRouteContribution => ({\n  id: \"ragents.profile-distribution.archive\",\n  isApiPath: (pathname) => pathname.startsWith(\"/profile/\"),\n  matches: (request, url) => request.method === \"GET\" && archivePattern.test(url.pathname),\n  requiredRights: [\"profile.fetch\"],\n  handle: ({ response, url }) => {\n    const current = state();\n    const version = archivePattern.exec(url.pathname)?.[1];\n    if (version !== current.description.version) {\n      writeJson(response, 404, { error: `Der Stand ${version} wird nicht mehr angeboten; aktuell ist ${current.description.version}` });\n      return;\n    }\n    response.writeHead(200, {\n      \"Content-Type\": \"application/gzip\",\n      \"Content-Length\": current.archive.byteLength,\n      \"Cache-Control\": \"no-store\",\n    });\n    response.end(current.archive);\n  },\n});\n\nconst profileDistributionPlugin: RAgentsPlugin = {\n  manifest: { id: \"ragents.profile-distribution\" },\n  register: (host) => {\n    host.config(...profileDistributionConfigDescriptors);\n    const file = profileDistributionConfig.clientProfileFile();\n    if (!file) {\n      host.lifecycle({\n        id: \"ragents.profile-distribution\",\n        initialize: () => console.log(\"Profilverteilung: CLIENT_PROFILE_FILE ist nicht gesetzt, dieser Server bietet kein Client-Profil an\"),\n      });\n      return;\n    }\n    let ready: DistributionState | undefined;\n    const state = (): DistributionState => {\n      if (!ready) throw new DomainError(\"profile-not-ready\", \"Das Client-Profil ist noch nicht gepackt.\", 503);\n      return ready;\n    };\n    host.lifecycle({\n      id: \"ragents.profile-distribution\",\n      initialize: async () => {\n        const hostVersion = profileDistributionConfig.hostVersion() ?? readHostVersion();\n        const packageVersion = readPackageVersion();\n        const hostApi = readHostApiVersion();\n        const inspected = await inspectClientProfile(file);\n        const packed = await packClientProfile(inspected);\n        ready = {\n          archive: packed.archive,\n          description: {\n            profile: inspected.profile,\n            version: packed.version,\n            hostApi,\n            hostVersion,\n            packageVersion,\n            file: inspected.file,\n            size: packed.archive.byteLength,\n            archivePath: profileArchivePath(packed.version),\n            plugins: inspected.plugins.map((plugin) => ({ id: plugin.id, source: plugin.source })),\n          },\n        };\n        console.log(`Profilverteilung: ${inspected.profile} Stand ${packed.version.slice(0, 12)} (${packed.entries.length} Dateien, ${packed.archive.byteLength} Byte, Host-API ${hostApi}, Host ${hostVersion.slice(0, 12)}, Paket ${packageVersion})`);\n      },\n    });\n    host.methods(implement(profileDistributionContracts.describe, () => state().description));\n    host.http(archiveRoute(state));\n  },\n};\n\nexport const plugin: PluginModule = {\n  create: () => profileDistributionPlugin,\n};\n", "import { Type, type Static } from \"typebox\";\nimport { defineOperation } from \"@ragents/engine/src/rpc/contract\";\n\nconst pluginEntry = Type.Object({\n  id: Type.String({ minLength: 1 }),\n  source: Type.Union([Type.Literal(\"host\"), Type.Literal(\"archive\")], {\n    description: \"host: der Client nimmt das eingebaute Bundle seines Hosts; archive: das Bundle liegt im Archiv\",\n  }),\n}, { additionalProperties: false });\n\nconst description = Type.Object({\n  profile: Type.String({ minLength: 1, description: \"Profilname; die Datei hei\u00DFt ragents.config.<profil>.ts\" }),\n  version: Type.String({ minLength: 64, maxLength: 64, description: \"Stand des Archivs als SHA-256\" }),\n  hostApi: Type.Integer({ minimum: 1, description: \"Nummer der Host-API, gegen die die Bundles im Archiv gebaut sind; der Host des Clients muss genau diese bieten\" }),\n  hostVersion: Type.String({ minLength: 40, maxLength: 40, description: \"Git-Commit des Hosts dieses Servers; ein Checkout mit anderer Host-API kommt damit zu einer passenden\" }),\n  packageVersion: Type.String({ minLength: 1, description: \"Fassung des npm-Pakets, die diesen Commit tr\u00E4gt; eine Installation mit anderer Host-API kommt damit zu einer passenden\" }),\n  file: Type.String({ minLength: 1, description: \"Pfad der Profildatei innerhalb des Archivs\" }),\n  size: Type.Integer({ minimum: 0, description: \"Archivgr\u00F6\u00DFe in Byte\" }),\n  archivePath: Type.String({ minLength: 1, description: \"HTTP-Pfad des Archivs auf diesem Server\" }),\n  plugins: Type.Array(pluginEntry),\n}, { additionalProperties: false });\n\nexport type ClientProfileDescription = Static<typeof description>;\n\nexport const profileArchivePath = (version: string): string => `/profile/${version}.tar.gz`;\n\nexport const profileDistributionContracts = {\n  describe: defineOperation({\n    id: \"ragents.profile.describe\",\n    description: \"Das Client-Profil dieses Servers: Name, Stand, verlangte Host-API, Host- und Paketfassung, Plugins und Archiv. Recht: profile.fetch.\",\n    rights: [\"profile.fetch\"],\n    input: Type.Object({}, { additionalProperties: false }),\n    result: description,\n  }),\n};\n", "import { createHash } from \"node:crypto\";\nimport { readdirSync, statSync, lstatSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { create as createTar } from \"tar\";\nimport { hostConfigKeys } from \"@ragents/host/config.js\";\nimport { isEnvironmentReference, isProvisionedReference } from \"@ragents/host/config-definition.js\";\nimport { resolveAnonymousUser, resolveProfileUsers, SECRET_KEY_PATTERN } from \"@ragents/host/config-file.js\";\nimport { discoverPluginIds, resolvePluginEntries, type ResolvedPlugin } from \"@ragents/host/profile/plugin-discovery.js\";\nimport { bundlesRoot, isPluginPath } from \"@ragents/host/plugin-support/plugins-root.js\";\n\nexport interface ClientProfilePlugin extends ResolvedPlugin {\n  readonly source: \"host\" | \"archive\";\n}\n\nexport interface InspectedClientProfile {\n  readonly profile: string;\n  readonly source: string;\n  readonly root: string;\n  readonly file: string;\n  readonly plugins: readonly ClientProfilePlugin[];\n}\n\nexport interface PackedClientProfile {\n  readonly archive: Buffer;\n  readonly version: string;\n  readonly entries: readonly string[];\n}\n\nconst PROFILE_FILE = /^ragents\\.config\\.([a-z0-9]+(?:-[a-z0-9]+)*)\\.ts$/;\n\nconst commonRoot = (first: string, others: readonly string[]): string => {\n  let root = first;\n  for (const folder of others) {\n    while (folder !== root && !folder.startsWith(root + path.sep)) {\n      const parent = path.dirname(root);\n      if (parent === root) throw new Error(`Profildatei und Plugin ${folder} haben keinen gemeinsamen Ordner`);\n      root = parent;\n    }\n  }\n  return root;\n};\n\nconst posixRelative = (root: string, target: string): string => path.relative(root, target).split(path.sep).join(\"/\");\n\n// Jeder Name ist frei, damit ein Passwort- oder Token-Verweis auch ohne die Client-Umgebung pr\u00FCfbar ist.\nconst placeholderEnvironment: Readonly<Record<string, string | undefined>> = new Proxy({}, { get: () => \"client-placeholder-value\" });\n\nconst checkSections = (source: string, raw: Record<string, unknown>, pluginIds: ReadonlySet<string>): void => {\n  for (const [section, value] of Object.entries(raw)) {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(`${source}: die Sektion ${section} ist kein Objekt`);\n    if (section !== \"host\" && !pluginIds.has(section)) throw new Error(`${source}: die Sektion ${section} geh\u00F6rt zu keinem Plugin aus host.PLUGINS`);\n    for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {\n      if (section === \"host\" && !hostConfigKeys.includes(key)) throw new Error(`${source}: host.${key} ist kein Host-Schl\u00FCssel`);\n      if (isEnvironmentReference(entry) || isProvisionedReference(entry)) continue;\n      if (SECRET_KEY_PATTERN.test(key)) throw new Error(`${source}: ${section}.${key} ist ein Secret und muss als env(\"...\") stehen`);\n      const valid = typeof entry === \"string\" || typeof entry === \"number\" || typeof entry === \"boolean\"\n        || (Array.isArray(entry) && entry.every((item) => typeof item === \"string\"));\n      if (!valid) throw new Error(`${source}: ${section}.${key} hat keinen g\u00FCltigen Wert`);\n      if (typeof entry === \"string\" && /^\\$\\{[A-Za-z_][A-Za-z0-9_]*\\}$/.test(entry)) throw new Error(`${source}: ${section}.${key} verweist als Text auf die Umgebung; env(\"...\") verwenden`);\n    }\n  }\n};\n\n/** Pr\u00FCft die Client-Profildatei ohne ihre Umgebung und bestimmt, welche Plugins ins Archiv geh\u00F6ren. */\nexport const inspectClientProfile = async (source: string, root = bundlesRoot): Promise<InspectedClientProfile> => {\n  const name = PROFILE_FILE.exec(path.basename(source));\n  if (!name) throw new Error(`Die Client-Profildatei muss ragents.config.<profil>.ts hei\u00DFen: ${source}`);\n  if (!statSync(source, { throwIfNoEntry: false })?.isFile()) throw new Error(`Die Client-Profildatei ${source} fehlt`);\n  const profile = name[1]!;\n  const module = await import(pathToFileURL(source).href) as Record<string, unknown>;\n  const raw = module.config;\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) throw new Error(`${source} exportiert keine Konstante config`);\n  const host = (raw as Record<string, unknown>).host as Record<string, unknown> | undefined;\n  const entries = host?.PLUGINS;\n  if (!Array.isArray(entries) || entries.length === 0 || !entries.every((entry) => typeof entry === \"string\" && entry)) {\n    throw new Error(`${source}: host.PLUGINS muss eine nicht leere Liste sein`);\n  }\n  if (host?.PRODUCT_PROFILE !== profile) throw new Error(`${source}: host.PRODUCT_PROFILE muss ${profile} sein`);\n  const directory = path.dirname(source);\n  const unportable = (entries as string[]).filter((entry) => isPluginPath(entry) && !/^\\.{1,2}\\//.test(entry));\n  if (unportable.length > 0) {\n    throw new Error(`${source}: ${unportable.join(\", \")} nennt ein Bundle absolut oder mit ~/; der Client l\u00F6st diesen Pfad auf seinem eigenen Rechner auf und f\u00E4nde dort nicht das gelieferte Bundle. Im Client-Profil jedes Bundle relativ zur Profildatei nennen (./ oder ../)`);\n  }\n  const plugins = ((): readonly ClientProfilePlugin[] => {\n    try {\n      return resolvePluginEntries(entries as string[], directory, root)\n        .map((plugin, index) => ({ ...plugin, source: isPluginPath((entries as string[])[index]!) ? \"archive\" : \"host\" }));\n    } catch (cause) {\n      throw new Error(`${source}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });\n    }\n  })();\n  checkSections(source, raw as Record<string, unknown>, new Set([...discoverPluginIds(root), ...plugins.map((plugin) => plugin.id)]));\n  const users = resolveProfileUsers(source, module.users, placeholderEnvironment);\n  const anonymous = resolveAnonymousUser(source, module.anonymousUser);\n  if (users && anonymous) throw new Error(`${source}: users und anonymousUser schlie\u00DFen einander aus`);\n  const archived = plugins.filter((plugin) => plugin.source === \"archive\").map((plugin) => plugin.folder);\n  const commonDirectory = commonRoot(directory, archived);\n  return { profile, source, root: commonDirectory, file: posixRelative(commonDirectory, source), plugins };\n};\n\nconst collectFiles = (folder: string, root: string): string[] => {\n  const files: string[] = [];\n  for (const entry of readdirSync(folder, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name, \"en\"))) {\n    const absolute = path.join(folder, entry.name);\n    if (entry.isSymbolicLink()) throw new Error(`Das Client-Profil enth\u00E4lt einen symbolischen Link, den das Archiv nicht abbildet: ${absolute}`);\n    if (entry.isDirectory()) {\n      files.push(...collectFiles(absolute, root));\n    } else if (entry.isFile()) {\n      files.push(posixRelative(root, absolute));\n    }\n  }\n  return files;\n};\n\n/** Die Eintr\u00E4ge des Archivs: die Profildatei und die Dateien der Bundles, die sie per Pfad nennt; das Web hat der Client selbst. */\nexport const clientProfileEntries = (inspected: InspectedClientProfile): readonly string[] => {\n  const entries = [inspected.file, ...inspected.plugins.filter((plugin) => plugin.source === \"archive\").flatMap((plugin) => collectFiles(plugin.folder, inspected.root))];\n  for (const entry of entries) {\n    if (!lstatSync(path.join(inspected.root, entry)).isFile()) throw new Error(`Der Archiveintrag ${entry} ist keine Datei`);\n  }\n  return entries;\n};\n\n/** Packt die Eintr\u00E4ge deterministisch aus ihrem gemeinsamen Ordner; der Stand ist der SHA-256 des Archivs. */\nexport const packClientProfile = async (inspected: InspectedClientProfile): Promise<PackedClientProfile> => {\n  const entries = clientProfileEntries(inspected);\n  const chunks: Buffer[] = [];\n  for await (const chunk of createTar({ gzip: { level: 9 }, cwd: inspected.root, portable: true, noMtime: true }, [...entries])) {\n    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n  }\n  const archive = Buffer.concat(chunks);\n  return { archive, version: createHash(\"sha256\").update(archive).digest(\"hex\"), entries };\n};\n", "import path from \"node:path\";\nimport { configFilePath } from \"@ragents/host/config-file.js\";\nimport { declaredEnvironment } from \"@ragents/host/plugin-support/plugin-config.js\";\n\nexport const profileDistributionConfigDescriptors = [\n  { key: \"CLIENT_PROFILE_FILE\", source: \"environment\" },\n  { key: \"HOST_VERSION\", source: \"environment\" },\n] as const;\n\nconst env = declaredEnvironment(profileDistributionConfigDescriptors);\n\n/** Der Pfad gilt relativ zur Server-Profildatei, damit beide Dateien nebeneinander liegen k\u00F6nnen. */\nconst resolveClientProfileFile = (): string | undefined => {\n  const value = env.optional(\"CLIENT_PROFILE_FILE\");\n  if (!value) return undefined;\n  const profile = configFilePath();\n  return path.resolve(profile ? path.dirname(profile) : process.cwd(), value);\n};\n\nexport const profileDistributionConfig = Object.freeze({\n  clientProfileFile: resolveClientProfileFile,\n  hostVersion: () => {\n    const value = env.optional(\"HOST_VERSION\");\n    if (value !== undefined && !/^[0-9a-f]{40}$/.test(value)) throw new Error(`HOST_VERSION muss ein vollst\u00E4ndiger Git-Commit sein, nicht \"${value}\"`);\n    return value;\n  },\n});\n"],
-  "mappings": ";;;;AAAA,SAAS,aAAa,iBAAiE;AACvF,SAAS,oBAAoB,iBAAiB,0BAA0B;AAExE,SAAS,iBAAiB;;;ACH1B,SAAS,YAAyB;AAClC,SAAS,uBAAuB;AAEhC,IAAM,cAAc,KAAK,OAAO;AAAA,EAC9B,IAAI,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAA,EAChC,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,MAAM,GAAG,KAAK,QAAQ,SAAS,CAAC,GAAG;AAAA,IAClE,aAAa;AAAA,EACf,CAAC;AACH,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,cAAc,KAAK,OAAO;AAAA,EAC9B,SAAS,KAAK,OAAO,EAAE,WAAW,GAAG,aAAa,4DAAyD,CAAC;AAAA,EAC5G,SAAS,KAAK,OAAO,EAAE,WAAW,IAAI,WAAW,IAAI,aAAa,gCAAgC,CAAC;AAAA,EACnG,SAAS,KAAK,QAAQ,EAAE,SAAS,GAAG,aAAa,iHAAiH,CAAC;AAAA,EACnK,aAAa,KAAK,OAAO,EAAE,WAAW,IAAI,WAAW,IAAI,aAAa,wGAAwG,CAAC;AAAA,EAC/K,gBAAgB,KAAK,OAAO,EAAE,WAAW,GAAG,aAAa,4HAAyH,CAAC;AAAA,EACnL,MAAM,KAAK,OAAO,EAAE,WAAW,GAAG,aAAa,6CAA6C,CAAC;AAAA,EAC7F,MAAM,KAAK,QAAQ,EAAE,SAAS,GAAG,aAAa,4BAAsB,CAAC;AAAA,EACrE,aAAa,KAAK,OAAO,EAAE,WAAW,GAAG,aAAa,0CAA0C,CAAC;AAAA,EACjG,SAAS,KAAK,MAAM,WAAW;AACjC,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAI3B,IAAM,qBAAqB,CAAC,YAA4B,YAAY,OAAO;AAE3E,IAAM,+BAA+B;AAAA,EAC1C,UAAU,gBAAgB;AAAA,IACxB,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,QAAQ,CAAC,eAAe;AAAA,IACxB,OAAO,KAAK,OAAO,CAAC,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAAA,IACtD,QAAQ;AAAA,EACV,CAAC;AACH;;;AClCA,SAAS,kBAAkB;AAC3B,SAAS,aAAa,UAAU,iBAAiB;AACjD,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAC9B,SAAS,UAAU,iBAAiB;AACpC,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB,8BAA8B;AAC/D,SAAS,sBAAsB,qBAAqB,0BAA0B;AAC9E,SAAS,mBAAmB,4BAAiD;AAC7E,SAAS,aAAa,oBAAoB;AAoB1C,IAAM,eAAe;AAErB,IAAM,aAAa,CAAC,OAAe,WAAsC;AACvE,MAAI,OAAO;AACX,aAAW,UAAU,QAAQ;AAC3B,WAAO,WAAW,QAAQ,CAAC,OAAO,WAAW,OAAO,KAAK,GAAG,GAAG;AAC7D,YAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,UAAI,WAAW,KAAM,OAAM,IAAI,MAAM,0BAA0B,MAAM,kCAAkC;AACvG,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,gBAAgB,CAAC,MAAc,WAA2B,KAAK,SAAS,MAAM,MAAM,EAAE,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AAGpH,IAAM,yBAAuE,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,MAAM,2BAA2B,CAAC;AAEpI,IAAM,gBAAgB,CAAC,QAAgB,KAA8B,cAAyC;AAC5G,aAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAClD,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,iBAAiB,OAAO,kBAAkB;AACpI,QAAI,YAAY,UAAU,CAAC,UAAU,IAAI,OAAO,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,iBAAiB,OAAO,8CAA2C;AAC/I,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC3E,UAAI,YAAY,UAAU,CAAC,eAAe,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,UAAU,GAAG,6BAA0B;AACzH,UAAI,uBAAuB,KAAK,KAAK,uBAAuB,KAAK,EAAG;AACpE,UAAI,mBAAmB,KAAK,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,KAAK,OAAO,IAAI,GAAG,gDAAgD;AAC9H,YAAM,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,aACnF,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ;AAC5E,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,GAAG,MAAM,KAAK,OAAO,IAAI,GAAG,8BAA2B;AACnF,UAAI,OAAO,UAAU,YAAY,iCAAiC,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,KAAK,OAAO,IAAI,GAAG,2DAA2D;AAAA,IACxL;AAAA,EACF;AACF;AAGO,IAAM,uBAAuB,OAAO,QAAgB,OAAO,gBAAiD;AACjH,QAAM,OAAO,aAAa,KAAK,KAAK,SAAS,MAAM,CAAC;AACpD,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,qEAAkE,MAAM,EAAE;AACrG,MAAI,CAAC,SAAS,QAAQ,EAAE,gBAAgB,MAAM,CAAC,GAAG,OAAO,EAAG,OAAM,IAAI,MAAM,0BAA0B,MAAM,QAAQ;AACpH,QAAM,UAAU,KAAK,CAAC;AACtB,QAAM,SAAS,MAAM,OAAO,cAAc,MAAM,EAAE;AAClD,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;AACxH,QAAM,OAAQ,IAAgC;AAC9C,QAAM,UAAU,MAAM;AACtB,MAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,KAAK,CAAC,QAAQ,MAAM,CAAC,UAAU,OAAO,UAAU,YAAY,KAAK,GAAG;AACpH,UAAM,IAAI,MAAM,GAAG,MAAM,iDAAiD;AAAA,EAC5E;AACA,MAAI,MAAM,oBAAoB,QAAS,OAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B,OAAO,OAAO;AAC7G,QAAM,YAAY,KAAK,QAAQ,MAAM;AACrC,QAAM,aAAc,QAAqB,OAAO,CAAC,UAAU,aAAa,KAAK,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC;AAC3G,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,IAAI,MAAM,GAAG,MAAM,KAAK,WAAW,KAAK,IAAI,CAAC,gOAA0N;AAAA,EAC/Q;AACA,QAAM,WAAW,MAAsC;AACrD,QAAI;AACF,aAAO,qBAAqB,SAAqB,WAAW,IAAI,EAC7D,IAAI,CAACA,SAAQ,WAAW,EAAE,GAAGA,SAAQ,QAAQ,aAAc,QAAqB,KAAK,CAAE,IAAI,YAAY,OAAO,EAAE;AAAA,IACrH,SAAS,OAAO;AACd,YAAM,IAAI,MAAM,GAAG,MAAM,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;AAAA,IACnG;AAAA,EACF,GAAG;AACH,gBAAc,QAAQ,KAAgC,oBAAI,IAAI,CAAC,GAAG,kBAAkB,IAAI,GAAG,GAAG,QAAQ,IAAI,CAACA,YAAWA,QAAO,EAAE,CAAC,CAAC,CAAC;AAClI,QAAM,QAAQ,oBAAoB,QAAQ,OAAO,OAAO,sBAAsB;AAC9E,QAAM,YAAY,qBAAqB,QAAQ,OAAO,aAAa;AACnE,MAAI,SAAS,UAAW,OAAM,IAAI,MAAM,GAAG,MAAM,qDAAkD;AACnG,QAAM,WAAW,QAAQ,OAAO,CAACA,YAAWA,QAAO,WAAW,SAAS,EAAE,IAAI,CAACA,YAAWA,QAAO,MAAM;AACtG,QAAM,kBAAkB,WAAW,WAAW,QAAQ;AACtD,SAAO,EAAE,SAAS,QAAQ,MAAM,iBAAiB,MAAM,cAAc,iBAAiB,MAAM,GAAG,QAAQ;AACzG;AAEA,IAAM,eAAe,CAAC,QAAgB,SAA2B;AAC/D,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,YAAY,QAAQ,EAAE,eAAe,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,MAAM,IAAI,CAAC,GAAG;AACjI,UAAM,WAAW,KAAK,KAAK,QAAQ,MAAM,IAAI;AAC7C,QAAI,MAAM,eAAe,EAAG,OAAM,IAAI,MAAM,wFAAqF,QAAQ,EAAE;AAC3I,QAAI,MAAM,YAAY,GAAG;AACvB,YAAM,KAAK,GAAG,aAAa,UAAU,IAAI,CAAC;AAAA,IAC5C,WAAW,MAAM,OAAO,GAAG;AACzB,YAAM,KAAK,cAAc,MAAM,QAAQ,CAAC;AAAA,IAC1C;AAAA,EACF;AACA,SAAO;AACT;AAGO,IAAM,uBAAuB,CAAC,cAAyD;AAC5F,QAAM,UAAU,CAAC,UAAU,MAAM,GAAG,UAAU,QAAQ,OAAO,CAACA,YAAWA,QAAO,WAAW,SAAS,EAAE,QAAQ,CAACA,YAAW,aAAaA,QAAO,QAAQ,UAAU,IAAI,CAAC,CAAC;AACtK,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,UAAU,KAAK,KAAK,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,EAAG,OAAM,IAAI,MAAM,qBAAqB,KAAK,kBAAkB;AAAA,EACzH;AACA,SAAO;AACT;AAGO,IAAM,oBAAoB,OAAO,cAAoE;AAC1G,QAAM,UAAU,qBAAqB,SAAS;AAC9C,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,UAAU,MAAM,UAAU,MAAM,SAAS,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG;AAC7H,WAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,EACjE;AACA,QAAM,UAAU,OAAO,OAAO,MAAM;AACpC,SAAO,EAAE,SAAS,SAAS,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK,GAAG,QAAQ;AACzF;;;ACrIA,OAAOC,WAAU;AACjB,SAAS,sBAAsB;AAC/B,SAAS,2BAA2B;AAE7B,IAAM,uCAAuC;AAAA,EAClD,EAAE,KAAK,uBAAuB,QAAQ,cAAc;AAAA,EACpD,EAAE,KAAK,gBAAgB,QAAQ,cAAc;AAC/C;AAEA,IAAM,MAAM,oBAAoB,oCAAoC;AAGpE,IAAM,2BAA2B,MAA0B;AACzD,QAAM,QAAQ,IAAI,SAAS,qBAAqB;AAChD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,eAAe;AAC/B,SAAOA,MAAK,QAAQ,UAAUA,MAAK,QAAQ,OAAO,IAAI,QAAQ,IAAI,GAAG,KAAK;AAC5E;AAEO,IAAM,4BAA4B,OAAO,OAAO;AAAA,EACrD,mBAAmB;AAAA,EACnB,aAAa,MAAM;AACjB,UAAM,QAAQ,IAAI,SAAS,cAAc;AACzC,QAAI,UAAU,UAAa,CAAC,iBAAiB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,kEAA+D,KAAK,GAAG;AACjJ,WAAO;AAAA,EACT;AACF,CAAC;;;AHbD,IAAM,iBAAiB;AAEvB,IAAM,eAAe,CAAC,WAA2D;AAAA,EAC/E,IAAI;AAAA,EACJ,WAAW,CAAC,aAAa,SAAS,WAAW,WAAW;AAAA,EACxD,SAAS,CAAC,SAAS,QAAQ,QAAQ,WAAW,SAAS,eAAe,KAAK,IAAI,QAAQ;AAAA,EACvF,gBAAgB,CAAC,eAAe;AAAA,EAChC,QAAQ,CAAC,EAAE,UAAU,IAAI,MAAM;AAC7B,UAAM,UAAU,MAAM;AACtB,UAAM,UAAU,eAAe,KAAK,IAAI,QAAQ,IAAI,CAAC;AACrD,QAAI,YAAY,QAAQ,YAAY,SAAS;AAC3C,gBAAU,UAAU,KAAK,EAAE,OAAO,aAAa,OAAO,2CAA2C,QAAQ,YAAY,OAAO,GAAG,CAAC;AAChI;AAAA,IACF;AACA,aAAS,UAAU,KAAK;AAAA,MACtB,gBAAgB;AAAA,MAChB,kBAAkB,QAAQ,QAAQ;AAAA,MAClC,iBAAiB;AAAA,IACnB,CAAC;AACD,aAAS,IAAI,QAAQ,OAAO;AAAA,EAC9B;AACF;AAEA,IAAM,4BAA2C;AAAA,EAC/C,UAAU,EAAE,IAAI,+BAA+B;AAAA,EAC/C,UAAU,CAAC,SAAS;AAClB,SAAK,OAAO,GAAG,oCAAoC;AACnD,UAAM,OAAO,0BAA0B,kBAAkB;AACzD,QAAI,CAAC,MAAM;AACT,WAAK,UAAU;AAAA,QACb,IAAI;AAAA,QACJ,YAAY,MAAM,QAAQ,IAAI,qGAAqG;AAAA,MACrI,CAAC;AACD;AAAA,IACF;AACA,QAAI;AACJ,UAAM,QAAQ,MAAyB;AACrC,UAAI,CAAC,MAAO,OAAM,IAAI,YAAY,qBAAqB,6CAA6C,GAAG;AACvG,aAAO;AAAA,IACT;AACA,SAAK,UAAU;AAAA,MACb,IAAI;AAAA,MACJ,YAAY,YAAY;AACtB,cAAM,cAAc,0BAA0B,YAAY,KAAK,gBAAgB;AAC/E,cAAM,iBAAiB,mBAAmB;AAC1C,cAAM,UAAU,mBAAmB;AACnC,cAAM,YAAY,MAAM,qBAAqB,IAAI;AACjD,cAAM,SAAS,MAAM,kBAAkB,SAAS;AAChD,gBAAQ;AAAA,UACN,SAAS,OAAO;AAAA,UAChB,aAAa;AAAA,YACX,SAAS,UAAU;AAAA,YACnB,SAAS,OAAO;AAAA,YAChB;AAAA,YACA;AAAA,YACA;AAAA,YACA,MAAM,UAAU;AAAA,YAChB,MAAM,OAAO,QAAQ;AAAA,YACrB,aAAa,mBAAmB,OAAO,OAAO;AAAA,YAC9C,SAAS,UAAU,QAAQ,IAAI,CAACC,aAAY,EAAE,IAAIA,QAAO,IAAI,QAAQA,QAAO,OAAO,EAAE;AAAA,UACvF;AAAA,QACF;AACA,gBAAQ,IAAI,qBAAqB,UAAU,OAAO,UAAU,OAAO,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,OAAO,QAAQ,MAAM,aAAa,OAAO,QAAQ,UAAU,mBAAmB,OAAO,UAAU,YAAY,MAAM,GAAG,EAAE,CAAC,WAAW,cAAc,GAAG;AAAA,MACjP;AAAA,IACF,CAAC;AACD,SAAK,QAAQ,UAAU,6BAA6B,UAAU,MAAM,MAAM,EAAE,WAAW,CAAC;AACxF,SAAK,KAAK,aAAa,KAAK,CAAC;AAAA,EAC/B;AACF;AAEO,IAAM,SAAuB;AAAA,EAClC,QAAQ,MAAM;AAChB;",
+  "sourcesContent": ["import { DomainError, implement, type HttpRouteContribution, type RAgentsPlugin } from \"@ragents/engine\";\nimport { readHostApiVersion, readHostVersion, readPackageVersion } from \"@ragents/host/host-version.js\";\nimport type { PluginModule } from \"@ragents/host/plugin-support/plugin-module.js\";\nimport { writeJson } from \"@ragents/host/plugin-support/http.js\";\nimport { profileArchivePath, profileDistributionContracts, type ClientProfileDescription } from \"../contract.js\";\nimport { inspectClientProfile, packClientProfile } from \"./archive.js\";\nimport { profileDistributionConfig, profileDistributionConfigDescriptors } from \"./config.js\";\n\ninterface DistributionState {\n  readonly description: ClientProfileDescription;\n  readonly archive: Buffer;\n}\n\nconst archivePattern = /^\\/profile\\/([0-9a-f]{64})\\.tar\\.gz$/;\n\nconst archiveRoute = (state: () => DistributionState): HttpRouteContribution => ({\n  id: \"ragents.profile-distribution.archive\",\n  isApiPath: (pathname) => pathname.startsWith(\"/profile/\"),\n  matches: (request, url) => request.method === \"GET\" && archivePattern.test(url.pathname),\n  requiredRights: [\"profile.fetch\"],\n  handle: ({ response, url }) => {\n    const current = state();\n    const version = archivePattern.exec(url.pathname)?.[1];\n    if (version !== current.description.version) {\n      writeJson(response, 404, { error: `Der Stand ${version} wird nicht mehr angeboten; aktuell ist ${current.description.version}` });\n      return;\n    }\n    response.writeHead(200, {\n      \"Content-Type\": \"application/gzip\",\n      \"Content-Length\": current.archive.byteLength,\n      \"Cache-Control\": \"no-store\",\n    });\n    response.end(current.archive);\n  },\n});\n\nconst profileDistributionPlugin: RAgentsPlugin = {\n  manifest: { id: \"ragents.profile-distribution\" },\n  register: (host) => {\n    host.config(...profileDistributionConfigDescriptors);\n    const file = profileDistributionConfig.clientProfileFile();\n    if (!file) {\n      host.lifecycle({\n        id: \"ragents.profile-distribution\",\n        initialize: () => console.log(\"Profilverteilung: CLIENT_PROFILE_FILE ist nicht gesetzt, dieser Server bietet kein Client-Profil an\"),\n      });\n      return;\n    }\n    let ready: DistributionState | undefined;\n    const state = (): DistributionState => {\n      if (!ready) throw new DomainError(\"profile-not-ready\", \"Das Client-Profil ist noch nicht gepackt.\", 503);\n      return ready;\n    };\n    host.lifecycle({\n      id: \"ragents.profile-distribution\",\n      initialize: async () => {\n        const hostVersion = profileDistributionConfig.hostVersion() ?? readHostVersion();\n        const packageVersion = readPackageVersion();\n        const hostApi = readHostApiVersion();\n        const inspected = await inspectClientProfile(file);\n        const packed = await packClientProfile(inspected);\n        ready = {\n          archive: packed.archive,\n          description: {\n            profile: inspected.profile,\n            version: packed.version,\n            hostApi,\n            hostVersion,\n            packageVersion,\n            file: inspected.file,\n            size: packed.archive.byteLength,\n            archivePath: profileArchivePath(packed.version),\n            plugins: inspected.plugins.map((plugin) => ({ id: plugin.id, source: plugin.source })),\n          },\n        };\n        console.log(`Profilverteilung: ${inspected.profile} Stand ${packed.version.slice(0, 12)} (${packed.entries.length} Dateien, ${packed.archive.byteLength} Byte, Host-API ${hostApi}, Host ${hostVersion.slice(0, 12)}, Paket ${packageVersion})`);\n      },\n    });\n    host.methods(implement(profileDistributionContracts.describe, () => state().description));\n    host.http(archiveRoute(state));\n  },\n};\n\nexport const plugin: PluginModule = {\n  create: () => profileDistributionPlugin,\n};\n", "import { Type, type Static } from \"typebox\";\nimport { defineOperation } from \"@ragents/engine/src/rpc/contract\";\n\nconst pluginEntry = Type.Object({\n  id: Type.String({ minLength: 1 }),\n  source: Type.Union([Type.Literal(\"host\"), Type.Literal(\"archive\")], {\n    description: \"host: der Client nimmt das eingebaute Bundle seines Hosts; archive: das Bundle liegt im Archiv\",\n  }),\n}, { additionalProperties: false });\n\nconst description = Type.Object({\n  profile: Type.String({ minLength: 1, description: \"Profilname; die Datei hei\u00DFt ragents.config.<profil>.ts\" }),\n  version: Type.String({ minLength: 64, maxLength: 64, description: \"Stand des Archivs als SHA-256\" }),\n  hostApi: Type.Integer({ minimum: 1, description: \"Nummer der Host-API, gegen die die Bundles im Archiv gebaut sind; der Host des Clients muss genau diese bieten\" }),\n  hostVersion: Type.String({ minLength: 40, maxLength: 40, description: \"Git-Commit des Hosts dieses Servers; ein Checkout mit anderer Host-API kommt damit zu einer passenden\" }),\n  packageVersion: Type.String({ minLength: 1, description: \"Fassung des npm-Pakets, die diesen Commit tr\u00E4gt; eine Installation mit anderer Host-API kommt damit zu einer passenden\" }),\n  file: Type.String({ minLength: 1, description: \"Pfad der Profildatei innerhalb des Archivs\" }),\n  size: Type.Integer({ minimum: 0, description: \"Archivgr\u00F6\u00DFe in Byte\" }),\n  archivePath: Type.String({ minLength: 1, description: \"HTTP-Pfad des Archivs auf diesem Server\" }),\n  plugins: Type.Array(pluginEntry),\n}, { additionalProperties: false });\n\nexport type ClientProfileDescription = Static<typeof description>;\n\nexport const profileArchivePath = (version: string): string => `/profile/${version}.tar.gz`;\n\nexport const profileDistributionContracts = {\n  describe: defineOperation({\n    id: \"ragents.profile.describe\",\n    description: \"Das Client-Profil dieses Servers: Name, Stand, verlangte Host-API, Host- und Paketfassung, Plugins und Archiv. Recht: profile.fetch.\",\n    rights: [\"profile.fetch\"],\n    input: Type.Object({}, { additionalProperties: false }),\n    result: description,\n  }),\n};\n", "import { createHash } from \"node:crypto\";\nimport { readdirSync, statSync, lstatSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { create as createTar } from \"tar\";\nimport { hostConfigKeys } from \"@ragents/host/config.js\";\nimport { isEnvironmentReference, isProvisionedReference } from \"@ragents/host/config-definition.js\";\nimport { resolveAnonymousUser, resolveProfileUsers, SECRET_KEY_PATTERN } from \"@ragents/host/config-file.js\";\nimport { discoverPluginIds, resolvePluginEntries, type ResolvedPlugin } from \"@ragents/host/profile/plugin-discovery.js\";\nimport { bundlesRoot, isPluginPath } from \"@ragents/host/plugin-support/plugins-root.js\";\n\nexport interface ClientProfilePlugin extends ResolvedPlugin {\n  readonly source: \"host\" | \"archive\";\n}\n\nexport interface InspectedClientProfile {\n  readonly profile: string;\n  readonly source: string;\n  readonly root: string;\n  readonly file: string;\n  readonly plugins: readonly ClientProfilePlugin[];\n}\n\nexport interface PackedClientProfile {\n  readonly archive: Buffer;\n  readonly version: string;\n  readonly entries: readonly string[];\n}\n\nconst PROFILE_FILE = /^ragents\\.config\\.([a-z0-9]+(?:-[a-z0-9]+)*)\\.ts$/;\n\nconst commonRoot = (first: string, others: readonly string[]): string => {\n  let root = first;\n  for (const folder of others) {\n    while (folder !== root && !folder.startsWith(root + path.sep)) {\n      const parent = path.dirname(root);\n      if (parent === root) throw new Error(`Profildatei und Plugin ${folder} haben keinen gemeinsamen Ordner`);\n      root = parent;\n    }\n  }\n  return root;\n};\n\nconst posixRelative = (root: string, target: string): string => path.relative(root, target).split(path.sep).join(\"/\");\n\n// Jeder Name ist frei, damit ein Passwort- oder Token-Verweis auch ohne die Client-Umgebung pr\u00FCfbar ist.\nconst placeholderEnvironment: Readonly<Record<string, string | undefined>> = new Proxy({}, { get: () => \"client-placeholder-value\" });\n\nconst checkSections = (source: string, raw: Record<string, unknown>, pluginIds: ReadonlySet<string>): void => {\n  for (const [section, value] of Object.entries(raw)) {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(`${source}: die Sektion ${section} ist kein Objekt`);\n    if (section !== \"host\" && !pluginIds.has(section)) throw new Error(`${source}: die Sektion ${section} geh\u00F6rt zu keinem Plugin aus host.PLUGINS`);\n    for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {\n      if (section === \"host\" && !hostConfigKeys.includes(key)) throw new Error(`${source}: host.${key} ist kein Host-Schl\u00FCssel`);\n      if (isEnvironmentReference(entry) || isProvisionedReference(entry)) continue;\n      if (SECRET_KEY_PATTERN.test(key)) throw new Error(`${source}: ${section}.${key} ist ein Secret und muss als env(\"...\") stehen`);\n      const valid = typeof entry === \"string\" || typeof entry === \"number\" || typeof entry === \"boolean\"\n        || (Array.isArray(entry) && entry.every((item) => typeof item === \"string\"))\n        || (Array.isArray(entry) && entry.every((item) => !!item && typeof item === \"object\" && !Array.isArray(item)));\n      if (!valid) throw new Error(`${source}: ${section}.${key} hat keinen g\u00FCltigen Wert`);\n      if (typeof entry === \"string\" && /^\\$\\{[A-Za-z_][A-Za-z0-9_]*\\}$/.test(entry)) throw new Error(`${source}: ${section}.${key} verweist als Text auf die Umgebung; env(\"...\") verwenden`);\n    }\n  }\n};\n\n/** Pr\u00FCft die Client-Profildatei ohne ihre Umgebung und bestimmt, welche Plugins ins Archiv geh\u00F6ren. */\nexport const inspectClientProfile = async (source: string, root = bundlesRoot): Promise<InspectedClientProfile> => {\n  const name = PROFILE_FILE.exec(path.basename(source));\n  if (!name) throw new Error(`Die Client-Profildatei muss ragents.config.<profil>.ts hei\u00DFen: ${source}`);\n  if (!statSync(source, { throwIfNoEntry: false })?.isFile()) throw new Error(`Die Client-Profildatei ${source} fehlt`);\n  const profile = name[1]!;\n  const module = await import(pathToFileURL(source).href) as Record<string, unknown>;\n  const raw = module.config;\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) throw new Error(`${source} exportiert keine Konstante config`);\n  const host = (raw as Record<string, unknown>).host as Record<string, unknown> | undefined;\n  const entries = host?.PLUGINS;\n  if (!Array.isArray(entries) || entries.length === 0 || !entries.every((entry) => typeof entry === \"string\" && entry)) {\n    throw new Error(`${source}: host.PLUGINS muss eine nicht leere Liste sein`);\n  }\n  if (host?.PRODUCT_PROFILE !== profile) throw new Error(`${source}: host.PRODUCT_PROFILE muss ${profile} sein`);\n  const directory = path.dirname(source);\n  const unportable = (entries as string[]).filter((entry) => isPluginPath(entry) && !/^\\.{1,2}\\//.test(entry));\n  if (unportable.length > 0) {\n    throw new Error(`${source}: ${unportable.join(\", \")} nennt ein Bundle absolut oder mit ~/; der Client l\u00F6st diesen Pfad auf seinem eigenen Rechner auf und f\u00E4nde dort nicht das gelieferte Bundle. Im Client-Profil jedes Bundle relativ zur Profildatei nennen (./ oder ../)`);\n  }\n  const plugins = ((): readonly ClientProfilePlugin[] => {\n    try {\n      return resolvePluginEntries(entries as string[], directory, root)\n        .map((plugin, index) => ({ ...plugin, source: isPluginPath((entries as string[])[index]!) ? \"archive\" : \"host\" }));\n    } catch (cause) {\n      throw new Error(`${source}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });\n    }\n  })();\n  checkSections(source, raw as Record<string, unknown>, new Set([...discoverPluginIds(root), ...plugins.map((plugin) => plugin.id)]));\n  const users = resolveProfileUsers(source, module.users, placeholderEnvironment);\n  const anonymous = resolveAnonymousUser(source, module.anonymousUser);\n  if (users && anonymous) throw new Error(`${source}: users und anonymousUser schlie\u00DFen einander aus`);\n  const archived = plugins.filter((plugin) => plugin.source === \"archive\").map((plugin) => plugin.folder);\n  const commonDirectory = commonRoot(directory, archived);\n  return { profile, source, root: commonDirectory, file: posixRelative(commonDirectory, source), plugins };\n};\n\nconst collectFiles = (folder: string, root: string): string[] => {\n  const files: string[] = [];\n  for (const entry of readdirSync(folder, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name, \"en\"))) {\n    const absolute = path.join(folder, entry.name);\n    if (entry.isSymbolicLink()) throw new Error(`Das Client-Profil enth\u00E4lt einen symbolischen Link, den das Archiv nicht abbildet: ${absolute}`);\n    if (entry.isDirectory()) {\n      files.push(...collectFiles(absolute, root));\n    } else if (entry.isFile()) {\n      files.push(posixRelative(root, absolute));\n    }\n  }\n  return files;\n};\n\n/** Die Eintr\u00E4ge des Archivs: die Profildatei und die Dateien der Bundles, die sie per Pfad nennt; das Web hat der Client selbst. */\nexport const clientProfileEntries = (inspected: InspectedClientProfile): readonly string[] => {\n  const entries = [inspected.file, ...inspected.plugins.filter((plugin) => plugin.source === \"archive\").flatMap((plugin) => collectFiles(plugin.folder, inspected.root))];\n  for (const entry of entries) {\n    if (!lstatSync(path.join(inspected.root, entry)).isFile()) throw new Error(`Der Archiveintrag ${entry} ist keine Datei`);\n  }\n  return entries;\n};\n\n/** Packt die Eintr\u00E4ge deterministisch aus ihrem gemeinsamen Ordner; der Stand ist der SHA-256 des Archivs. */\nexport const packClientProfile = async (inspected: InspectedClientProfile): Promise<PackedClientProfile> => {\n  const entries = clientProfileEntries(inspected);\n  const chunks: Buffer[] = [];\n  for await (const chunk of createTar({ gzip: { level: 9 }, cwd: inspected.root, portable: true, noMtime: true }, [...entries])) {\n    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n  }\n  const archive = Buffer.concat(chunks);\n  return { archive, version: createHash(\"sha256\").update(archive).digest(\"hex\"), entries };\n};\n", "import path from \"node:path\";\nimport { configFilePath } from \"@ragents/host/config-file.js\";\nimport { declaredEnvironment } from \"@ragents/host/plugin-support/plugin-config.js\";\n\nexport const profileDistributionConfigDescriptors = [\n  { key: \"CLIENT_PROFILE_FILE\", source: \"environment\" },\n  { key: \"HOST_VERSION\", source: \"environment\" },\n] as const;\n\nconst env = declaredEnvironment(profileDistributionConfigDescriptors);\n\n/** Der Pfad gilt relativ zur Server-Profildatei, damit beide Dateien nebeneinander liegen k\u00F6nnen. */\nconst resolveClientProfileFile = (): string | undefined => {\n  const value = env.optional(\"CLIENT_PROFILE_FILE\");\n  if (!value) return undefined;\n  const profile = configFilePath();\n  return path.resolve(profile ? path.dirname(profile) : process.cwd(), value);\n};\n\nexport const profileDistributionConfig = Object.freeze({\n  clientProfileFile: resolveClientProfileFile,\n  hostVersion: () => {\n    const value = env.optional(\"HOST_VERSION\");\n    if (value !== undefined && !/^[0-9a-f]{40}$/.test(value)) throw new Error(`HOST_VERSION muss ein vollst\u00E4ndiger Git-Commit sein, nicht \"${value}\"`);\n    return value;\n  },\n});\n"],
+  "mappings": ";;;;AAAA,SAAS,aAAa,iBAAiE;AACvF,SAAS,oBAAoB,iBAAiB,0BAA0B;AAExE,SAAS,iBAAiB;;;ACH1B,SAAS,YAAyB;AAClC,SAAS,uBAAuB;AAEhC,IAAM,cAAc,KAAK,OAAO;AAAA,EAC9B,IAAI,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAA,EAChC,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,MAAM,GAAG,KAAK,QAAQ,SAAS,CAAC,GAAG;AAAA,IAClE,aAAa;AAAA,EACf,CAAC;AACH,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,cAAc,KAAK,OAAO;AAAA,EAC9B,SAAS,KAAK,OAAO,EAAE,WAAW,GAAG,aAAa,4DAAyD,CAAC;AAAA,EAC5G,SAAS,KAAK,OAAO,EAAE,WAAW,IAAI,WAAW,IAAI,aAAa,gCAAgC,CAAC;AAAA,EACnG,SAAS,KAAK,QAAQ,EAAE,SAAS,GAAG,aAAa,iHAAiH,CAAC;AAAA,EACnK,aAAa,KAAK,OAAO,EAAE,WAAW,IAAI,WAAW,IAAI,aAAa,wGAAwG,CAAC;AAAA,EAC/K,gBAAgB,KAAK,OAAO,EAAE,WAAW,GAAG,aAAa,4HAAyH,CAAC;AAAA,EACnL,MAAM,KAAK,OAAO,EAAE,WAAW,GAAG,aAAa,6CAA6C,CAAC;AAAA,EAC7F,MAAM,KAAK,QAAQ,EAAE,SAAS,GAAG,aAAa,4BAAsB,CAAC;AAAA,EACrE,aAAa,KAAK,OAAO,EAAE,WAAW,GAAG,aAAa,0CAA0C,CAAC;AAAA,EACjG,SAAS,KAAK,MAAM,WAAW;AACjC,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAI3B,IAAM,qBAAqB,CAAC,YAA4B,YAAY,OAAO;AAE3E,IAAM,+BAA+B;AAAA,EAC1C,UAAU,gBAAgB;AAAA,IACxB,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,QAAQ,CAAC,eAAe;AAAA,IACxB,OAAO,KAAK,OAAO,CAAC,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAAA,IACtD,QAAQ;AAAA,EACV,CAAC;AACH;;;AClCA,SAAS,kBAAkB;AAC3B,SAAS,aAAa,UAAU,iBAAiB;AACjD,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAC9B,SAAS,UAAU,iBAAiB;AACpC,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB,8BAA8B;AAC/D,SAAS,sBAAsB,qBAAqB,0BAA0B;AAC9E,SAAS,mBAAmB,4BAAiD;AAC7E,SAAS,aAAa,oBAAoB;AAoB1C,IAAM,eAAe;AAErB,IAAM,aAAa,CAAC,OAAe,WAAsC;AACvE,MAAI,OAAO;AACX,aAAW,UAAU,QAAQ;AAC3B,WAAO,WAAW,QAAQ,CAAC,OAAO,WAAW,OAAO,KAAK,GAAG,GAAG;AAC7D,YAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,UAAI,WAAW,KAAM,OAAM,IAAI,MAAM,0BAA0B,MAAM,kCAAkC;AACvG,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,gBAAgB,CAAC,MAAc,WAA2B,KAAK,SAAS,MAAM,MAAM,EAAE,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AAGpH,IAAM,yBAAuE,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,MAAM,2BAA2B,CAAC;AAEpI,IAAM,gBAAgB,CAAC,QAAgB,KAA8B,cAAyC;AAC5G,aAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAClD,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,iBAAiB,OAAO,kBAAkB;AACpI,QAAI,YAAY,UAAU,CAAC,UAAU,IAAI,OAAO,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,iBAAiB,OAAO,8CAA2C;AAC/I,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC3E,UAAI,YAAY,UAAU,CAAC,eAAe,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,UAAU,GAAG,6BAA0B;AACzH,UAAI,uBAAuB,KAAK,KAAK,uBAAuB,KAAK,EAAG;AACpE,UAAI,mBAAmB,KAAK,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,KAAK,OAAO,IAAI,GAAG,gDAAgD;AAC9H,YAAM,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,aACnF,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,KACtE,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC;AAC9G,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,GAAG,MAAM,KAAK,OAAO,IAAI,GAAG,8BAA2B;AACnF,UAAI,OAAO,UAAU,YAAY,iCAAiC,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,KAAK,OAAO,IAAI,GAAG,2DAA2D;AAAA,IACxL;AAAA,EACF;AACF;AAGO,IAAM,uBAAuB,OAAO,QAAgB,OAAO,gBAAiD;AACjH,QAAM,OAAO,aAAa,KAAK,KAAK,SAAS,MAAM,CAAC;AACpD,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,qEAAkE,MAAM,EAAE;AACrG,MAAI,CAAC,SAAS,QAAQ,EAAE,gBAAgB,MAAM,CAAC,GAAG,OAAO,EAAG,OAAM,IAAI,MAAM,0BAA0B,MAAM,QAAQ;AACpH,QAAM,UAAU,KAAK,CAAC;AACtB,QAAM,SAAS,MAAM,OAAO,cAAc,MAAM,EAAE;AAClD,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;AACxH,QAAM,OAAQ,IAAgC;AAC9C,QAAM,UAAU,MAAM;AACtB,MAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,KAAK,CAAC,QAAQ,MAAM,CAAC,UAAU,OAAO,UAAU,YAAY,KAAK,GAAG;AACpH,UAAM,IAAI,MAAM,GAAG,MAAM,iDAAiD;AAAA,EAC5E;AACA,MAAI,MAAM,oBAAoB,QAAS,OAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B,OAAO,OAAO;AAC7G,QAAM,YAAY,KAAK,QAAQ,MAAM;AACrC,QAAM,aAAc,QAAqB,OAAO,CAAC,UAAU,aAAa,KAAK,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC;AAC3G,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,IAAI,MAAM,GAAG,MAAM,KAAK,WAAW,KAAK,IAAI,CAAC,gOAA0N;AAAA,EAC/Q;AACA,QAAM,WAAW,MAAsC;AACrD,QAAI;AACF,aAAO,qBAAqB,SAAqB,WAAW,IAAI,EAC7D,IAAI,CAACA,SAAQ,WAAW,EAAE,GAAGA,SAAQ,QAAQ,aAAc,QAAqB,KAAK,CAAE,IAAI,YAAY,OAAO,EAAE;AAAA,IACrH,SAAS,OAAO;AACd,YAAM,IAAI,MAAM,GAAG,MAAM,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;AAAA,IACnG;AAAA,EACF,GAAG;AACH,gBAAc,QAAQ,KAAgC,oBAAI,IAAI,CAAC,GAAG,kBAAkB,IAAI,GAAG,GAAG,QAAQ,IAAI,CAACA,YAAWA,QAAO,EAAE,CAAC,CAAC,CAAC;AAClI,QAAM,QAAQ,oBAAoB,QAAQ,OAAO,OAAO,sBAAsB;AAC9E,QAAM,YAAY,qBAAqB,QAAQ,OAAO,aAAa;AACnE,MAAI,SAAS,UAAW,OAAM,IAAI,MAAM,GAAG,MAAM,qDAAkD;AACnG,QAAM,WAAW,QAAQ,OAAO,CAACA,YAAWA,QAAO,WAAW,SAAS,EAAE,IAAI,CAACA,YAAWA,QAAO,MAAM;AACtG,QAAM,kBAAkB,WAAW,WAAW,QAAQ;AACtD,SAAO,EAAE,SAAS,QAAQ,MAAM,iBAAiB,MAAM,cAAc,iBAAiB,MAAM,GAAG,QAAQ;AACzG;AAEA,IAAM,eAAe,CAAC,QAAgB,SAA2B;AAC/D,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,YAAY,QAAQ,EAAE,eAAe,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,MAAM,IAAI,CAAC,GAAG;AACjI,UAAM,WAAW,KAAK,KAAK,QAAQ,MAAM,IAAI;AAC7C,QAAI,MAAM,eAAe,EAAG,OAAM,IAAI,MAAM,wFAAqF,QAAQ,EAAE;AAC3I,QAAI,MAAM,YAAY,GAAG;AACvB,YAAM,KAAK,GAAG,aAAa,UAAU,IAAI,CAAC;AAAA,IAC5C,WAAW,MAAM,OAAO,GAAG;AACzB,YAAM,KAAK,cAAc,MAAM,QAAQ,CAAC;AAAA,IAC1C;AAAA,EACF;AACA,SAAO;AACT;AAGO,IAAM,uBAAuB,CAAC,cAAyD;AAC5F,QAAM,UAAU,CAAC,UAAU,MAAM,GAAG,UAAU,QAAQ,OAAO,CAACA,YAAWA,QAAO,WAAW,SAAS,EAAE,QAAQ,CAACA,YAAW,aAAaA,QAAO,QAAQ,UAAU,IAAI,CAAC,CAAC;AACtK,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,UAAU,KAAK,KAAK,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,EAAG,OAAM,IAAI,MAAM,qBAAqB,KAAK,kBAAkB;AAAA,EACzH;AACA,SAAO;AACT;AAGO,IAAM,oBAAoB,OAAO,cAAoE;AAC1G,QAAM,UAAU,qBAAqB,SAAS;AAC9C,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,UAAU,MAAM,UAAU,MAAM,SAAS,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG;AAC7H,WAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,EACjE;AACA,QAAM,UAAU,OAAO,OAAO,MAAM;AACpC,SAAO,EAAE,SAAS,SAAS,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK,GAAG,QAAQ;AACzF;;;ACtIA,OAAOC,WAAU;AACjB,SAAS,sBAAsB;AAC/B,SAAS,2BAA2B;AAE7B,IAAM,uCAAuC;AAAA,EAClD,EAAE,KAAK,uBAAuB,QAAQ,cAAc;AAAA,EACpD,EAAE,KAAK,gBAAgB,QAAQ,cAAc;AAC/C;AAEA,IAAM,MAAM,oBAAoB,oCAAoC;AAGpE,IAAM,2BAA2B,MAA0B;AACzD,QAAM,QAAQ,IAAI,SAAS,qBAAqB;AAChD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,eAAe;AAC/B,SAAOA,MAAK,QAAQ,UAAUA,MAAK,QAAQ,OAAO,IAAI,QAAQ,IAAI,GAAG,KAAK;AAC5E;AAEO,IAAM,4BAA4B,OAAO,OAAO;AAAA,EACrD,mBAAmB;AAAA,EACnB,aAAa,MAAM;AACjB,UAAM,QAAQ,IAAI,SAAS,cAAc;AACzC,QAAI,UAAU,UAAa,CAAC,iBAAiB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,kEAA+D,KAAK,GAAG;AACjJ,WAAO;AAAA,EACT;AACF,CAAC;;;AHbD,IAAM,iBAAiB;AAEvB,IAAM,eAAe,CAAC,WAA2D;AAAA,EAC/E,IAAI;AAAA,EACJ,WAAW,CAAC,aAAa,SAAS,WAAW,WAAW;AAAA,EACxD,SAAS,CAAC,SAAS,QAAQ,QAAQ,WAAW,SAAS,eAAe,KAAK,IAAI,QAAQ;AAAA,EACvF,gBAAgB,CAAC,eAAe;AAAA,EAChC,QAAQ,CAAC,EAAE,UAAU,IAAI,MAAM;AAC7B,UAAM,UAAU,MAAM;AACtB,UAAM,UAAU,eAAe,KAAK,IAAI,QAAQ,IAAI,CAAC;AACrD,QAAI,YAAY,QAAQ,YAAY,SAAS;AAC3C,gBAAU,UAAU,KAAK,EAAE,OAAO,aAAa,OAAO,2CAA2C,QAAQ,YAAY,OAAO,GAAG,CAAC;AAChI;AAAA,IACF;AACA,aAAS,UAAU,KAAK;AAAA,MACtB,gBAAgB;AAAA,MAChB,kBAAkB,QAAQ,QAAQ;AAAA,MAClC,iBAAiB;AAAA,IACnB,CAAC;AACD,aAAS,IAAI,QAAQ,OAAO;AAAA,EAC9B;AACF;AAEA,IAAM,4BAA2C;AAAA,EAC/C,UAAU,EAAE,IAAI,+BAA+B;AAAA,EAC/C,UAAU,CAAC,SAAS;AAClB,SAAK,OAAO,GAAG,oCAAoC;AACnD,UAAM,OAAO,0BAA0B,kBAAkB;AACzD,QAAI,CAAC,MAAM;AACT,WAAK,UAAU;AAAA,QACb,IAAI;AAAA,QACJ,YAAY,MAAM,QAAQ,IAAI,qGAAqG;AAAA,MACrI,CAAC;AACD;AAAA,IACF;AACA,QAAI;AACJ,UAAM,QAAQ,MAAyB;AACrC,UAAI,CAAC,MAAO,OAAM,IAAI,YAAY,qBAAqB,6CAA6C,GAAG;AACvG,aAAO;AAAA,IACT;AACA,SAAK,UAAU;AAAA,MACb,IAAI;AAAA,MACJ,YAAY,YAAY;AACtB,cAAM,cAAc,0BAA0B,YAAY,KAAK,gBAAgB;AAC/E,cAAM,iBAAiB,mBAAmB;AAC1C,cAAM,UAAU,mBAAmB;AACnC,cAAM,YAAY,MAAM,qBAAqB,IAAI;AACjD,cAAM,SAAS,MAAM,kBAAkB,SAAS;AAChD,gBAAQ;AAAA,UACN,SAAS,OAAO;AAAA,UAChB,aAAa;AAAA,YACX,SAAS,UAAU;AAAA,YACnB,SAAS,OAAO;AAAA,YAChB;AAAA,YACA;AAAA,YACA;AAAA,YACA,MAAM,UAAU;AAAA,YAChB,MAAM,OAAO,QAAQ;AAAA,YACrB,aAAa,mBAAmB,OAAO,OAAO;AAAA,YAC9C,SAAS,UAAU,QAAQ,IAAI,CAACC,aAAY,EAAE,IAAIA,QAAO,IAAI,QAAQA,QAAO,OAAO,EAAE;AAAA,UACvF;AAAA,QACF;AACA,gBAAQ,IAAI,qBAAqB,UAAU,OAAO,UAAU,OAAO,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,OAAO,QAAQ,MAAM,aAAa,OAAO,QAAQ,UAAU,mBAAmB,OAAO,UAAU,YAAY,MAAM,GAAG,EAAE,CAAC,WAAW,cAAc,GAAG;AAAA,MACjP;AAAA,IACF,CAAC;AACD,SAAK,QAAQ,UAAU,6BAA6B,UAAU,MAAM,MAAM,EAAE,WAAW,CAAC;AACxF,SAAK,KAAK,aAAa,KAAK,CAAC;AAAA,EAC/B;AACF;AAEO,IAAM,SAAuB;AAAA,EAClC,QAAQ,MAAM;AAChB;",
   "names": ["plugin", "path", "plugin"]
 }

package/bundles/ragents.reference/ragents-bundle.json

@@ -1,7 +1,7 @@
 {
-  "format": 3,
+  "format": 4,
   "id": "ragents.reference",
-  "api": 6,
+  "api": 7,
   "hostNames": {
     "server": {},
     "web": {
@@ -21,7 +21,7 @@
     }
   },
   "stand": "b3fa5275dc209c315f26ec832458603d442d2a56974471ee83292e7d26079a12",
-  "sourceStand": "6db28f060bf31d72dc73f716a86c7122ce25d67e6b9c81ceba034e96fe735fd9",
+  "sourceStand": "a6ac0a9bec2e9929d8b11737f505dfe8f4905d26ed7cf53fcf5fc1aa0bf642bc",
   "server": "server/index.js",
   "web": {
     "entry": "web/index.js",

package/bundles/ragents.todo/ragents-bundle.json

@@ -1,7 +1,7 @@
 {
-  "format": 3,
+  "format": 4,
   "id": "ragents.todo",
-  "api": 6,
+  "api": 7,
   "hostNames": {
     "server": {
       "@ragents/engine": [
@@ -33,7 +33,7 @@
     }
   },
   "stand": "3dd3347780b8ddbe369e9024096d5da94ba34cf37b1003b55e03e3cbc8cd4779",
-  "sourceStand": "dfb507ba9b2a9f99023f75cdb676872db58dcd0f33fab1d1e468c3f09bdebebe",
+  "sourceStand": "5176b6fe21a1fcac3e38a74ad59e29a68c5dfe1ae2b1bc829ade65add91206ad",
   "server": "server/index.js",
   "web": {
     "entry": "web/index.js",

package/bundles/ragents.transcript/ragents-bundle.json

@@ -1,7 +1,7 @@
 {
-  "format": 3,
+  "format": 4,
   "id": "ragents.transcript",
-  "api": 6,
+  "api": 7,
   "hostNames": {
     "server": {
       "@ragents/engine": [
@@ -23,7 +23,7 @@
     "web": {}
   },
   "stand": "98d8ba054df383ac3d2d13e25de7f1930a7e4301654e188847cfc1fcf135490b",
-  "sourceStand": "047848b91abec440121b9d392fd4c268799e674198b9497cd9ad842d32522025",
+  "sourceStand": "04596bd6ff61db0f6f956bec63fc8783f329a03f32e80366fb5beed4e1bdf55d",
   "server": "server/index.js",
   "exports": {
     "server": {},

package/bundles/ragents.watch/ragents-bundle.json

@@ -1,7 +1,7 @@
 {
-  "format": 3,
+  "format": 4,
   "id": "ragents.watch",
-  "api": 6,
+  "api": 7,
   "hostNames": {
     "server": {
       "@ragents/engine": [
@@ -25,7 +25,7 @@
     "web": {}
   },
   "stand": "f5cade80192041cee54457035b293425a10f1de42b49f1d804117ad7951c1b00",
-  "sourceStand": "9b701a2a9708f14452ca7548677c735f70b6d013e1e0438bbd7a19c38bc96545",
+  "sourceStand": "0515fbdf8c4bf2859a4c09d2d1c0feb9ebf502af2f164cc6337f9d44d0463cc4",
   "server": "server/index.js",
   "exports": {
     "server": {

package/bundles/ragents.workspace/ragents-bundle.json

@@ -1,7 +1,7 @@
 {
-  "format": 3,
+  "format": 4,
   "id": "ragents.workspace",
-  "api": 6,
+  "api": 7,
   "hostNames": {
     "server": {
       "@ragents/engine": [
@@ -9,7 +9,8 @@
         "RPC_ERROR_CODES",
         "RpcError",
         "implement",
-        "implementChannel"
+        "implementChannel",
+        "schemaComplaints"
       ],
       "@ragents/engine/src/http/contracts": [
         "openJson"
@@ -41,6 +42,7 @@
         "documentStoreToken"
       ],
       "@ragents/host/ragents/host-services": [
+        "executorContributionsToken",
         "hostAddressToken",
         "runGuardToken",
         "runWorkspaceProviderToken",
@@ -61,12 +63,16 @@
         "WORKSPACE_EXECUTOR_VERSION",
         "listDirectory",
         "readTextFile",
+        "ripgrepAvailable",
         "sandboxRunEnvironment",
         "shellPlatformText",
         "watchDirectory"
       ],
       "typebox": [
         "Type"
+      ],
+      "typebox/value": [
+        "Value"
       ]
     },
     "web": {
@@ -130,8 +136,8 @@
       ]
     }
   },
-  "stand": "014f6c3e925196716315c4827b73e71a9b98579e620f0cc1beeb3bec763520a8",
-  "sourceStand": "dabaf431c288a40f14c521ca52da35a66e80e1a5352b5486d464b91a7cbecd5e",
+  "stand": "3c8b0a3987ba2d958b91f944a88898e53dab2c89c977e5e50d44ad2ad77f9900",
+  "sourceStand": "d8ec60ed343831c7b32192a9d681350af375365fcf692366bc55e35d2850dcf9",
   "server": "server/index.js",
   "web": {
     "entry": "web/index.js",

package/bundles/ragents.workspace/server/index.js

@@ -8,6 +8,7 @@ import { documentStoreToken } from "@ragents/host/ragents/document-store.js";
 import { workspaceResolverToken, workspaceRuntimeToken } from "@ragents/host/ragents/workspace-runtime.js";
 import { sandboxServicesToken } from "@ragents/host/plugin-support/workspace-sandbox-host.js";
 import {
+  executorContributionsToken,
   hostAddressToken,
   runtimeProviderToken,
   runGuardToken,
@@ -16,19 +17,20 @@ import {
 } from "@ragents/host/ragents/host-services.js";
 import { pluginAsset } from "@ragents/host/plugin-support/plugin-folder.js";
 import { ServerProcessSandbox } from "@ragents/host/plugin-support/process-sandbox.js";
+import { ripgrepAvailable } from "@ragents/workspace-executor";
 import { boundToTools as boundToTools2, handlebarsPrompt } from "@ragents/host/plugin-support/prompt.js";
 
 // server/shell-platform.ts
 import { shellPlatformText } from "@ragents/workspace-executor";
 import { boundToTools } from "@ragents/host/plugin-support/prompt.js";
-var shellPlatformChapter = (platform) => `## Shell platform
+var shellPlatformChapter = (platform, tools) => `## Shell platform
 
-${shellPlatformText(platform)}`;
-var shellPlatformPrompt = (id, order, chapterFor) => boundToTools({
+${shellPlatformText(platform, tools)}`;
+var shellPlatformPrompt = (id, order, serverTools, chapterFor) => boundToTools({
   id,
   order,
   delivery: "initial",
-  render: () => shellPlatformChapter(process.platform),
+  render: () => shellPlatformChapter(process.platform, serverTools),
   ...chapterFor ? { renderForRun: chapterFor } : {}
 }, "bash");
 
@@ -60,17 +62,32 @@ var freshServerBinding = () => ({ machine: "server", folder: "fresh" });
 var WORKSPACE_CLIENT_ID_PATTERN = /^[A-Za-z0-9_-]{8,64}$/;
 var clientId = Type.String({ pattern: "^[A-Za-z0-9_-]{8,64}$", description: "Stabile Kennung des Arbeitsplatzes" });
 var executorVersion = Type.String({ minLength: 1, maxLength: 64, description: "Stand des Executors, den der Arbeitsplatz mitbringt" });
+var PLUGIN_ID_PATTERN = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;
+var executorContributions = Type.Array(Type.Object({
+  plugin: Type.String({ pattern: PLUGIN_ID_PATTERN.source, maxLength: 128, description: "Kennung des Plugins" }),
+  stand: Type.String({ pattern: "^[0-9a-f]{64}$", description: "SHA-256 der Datei des Beitrags" })
+}, { additionalProperties: false }), { maxItems: 64, description: "Die Beitr\xE4ge der Plugins zum Executor, in der Reihenfolge der Pluginliste des Servers" });
 var clientDescription = {
   label: Type.String({ minLength: 1, maxLength: 120 }),
   hostname: Type.String({ minLength: 1 }),
   platform: Type.String({ minLength: 1 }),
   folders: Type.Array(Type.String({ minLength: 1 }), { maxItems: 32 }),
-  runsDirectory: Type.String({ minLength: 1, description: "Absoluter Ordner, unter dem der Arbeitsplatz die neuen Ordner je Run anlegt" })
+  runsDirectory: Type.String({ minLength: 1, description: "Absoluter Ordner, unter dem der Arbeitsplatz die neuen Ordner je Run anlegt" }),
+  ripgrep: Type.Boolean({ description: "Ob die Bash des Arbeitsplatzes rg findet" })
 };
 var clientInfoSchema = Type.Object({
   id: Type.String(),
   ...clientDescription
 }, { additionalProperties: false });
+var clientRegistrationSchema = Type.Object({
+  id: clientId,
+  ...clientDescription,
+  executor: executorVersion,
+  contributions: executorContributions
+}, { additionalProperties: false });
+var otherExecutorRegistration = Type.Object({ label: clientDescription.label, executor: executorVersion }, {
+  description: "Anmeldung mit einem anderen Executor-Stand in beliebiger Form; der Server lehnt sie mit workspace-executor-version ab"
+});
 var absolutePath = Type.String({ minLength: 1, description: "Absoluter Pfad im gebundenen Ordner" });
 var WORKSPACE_CLIENT_STOP_OPERATION = "stop";
 var workspaceClientContracts = {
@@ -128,11 +145,18 @@ var workspaceContracts = {
       input: Type.Object({}, { additionalProperties: false }),
       result: Type.Array(clientInfoSchema)
     }),
+    contributions: defineOperation({
+      id: "ragents.workspace.clients.contributions",
+      description: "Die Beitr\xE4ge der Plugins zum Executor, die ein Arbeitsplatz vor der Anmeldung l\xE4dt und mit ihr zur\xFCckmeldet. Ein Arbeitsplatz mit anderem Executor-Stand scheitert an seinem Stand; weitere Felder z\xE4hlen nicht.",
+      rights: ["runs.write"],
+      input: Type.Object({ label: clientDescription.label, executor: executorVersion }),
+      result: executorContributions
+    }),
     register: defineOperation({
       id: "ragents.workspace.clients.register",
-      description: "Einen Arbeitsplatz anmelden oder seine Ordner erneuern; die Verbindung dieser Anfrage wird sein R\xFCckweg und braucht einen Ereignisstrom.",
+      description: "Einen Arbeitsplatz anmelden oder seine Ordner erneuern; die Verbindung dieser Anfrage wird sein R\xFCckweg und braucht einen Ereignisstrom. Ein Arbeitsplatz mit anderem Executor-Stand scheitert an seinem Stand, bevor die \xFCbrige Form z\xE4hlt.",
       rights: ["runs.write"],
-      input: Type.Object({ id: clientId, ...clientDescription, executor: executorVersion }, { additionalProperties: false }),
+      input: Type.Union([clientRegistrationSchema, otherExecutorRegistration]),
       result: clientInfoSchema
     }),
     unregister: defineOperation({
@@ -228,11 +252,11 @@ var serverDirectoryFolder = (directory) => {
   }
   return { path: resolved };
 };
-var executorShellChapter = (registry, owner, binding) => {
+var executorShellChapter = (registry, owner, binding, serverTools) => {
   const { machine } = binding;
-  if (machine === "server") return shellPlatformChapter(process.platform);
+  if (machine === "server") return shellPlatformChapter(process.platform, serverTools);
   const client = registry.info(owner, machine.client);
-  return client ? shellPlatformChapter(client.platform) : `## Shell platform
+  return client ? shellPlatformChapter(client.platform, { ripgrep: client.ripgrep }) : `## Shell platform
 
 The workstation ${machine.label} that holds this project is not registered right now, so the platform of its shell is unknown; the workspace tools fail until it connects again.`;
 };
@@ -386,11 +410,13 @@ var createBrowseChannel = (options) => implementChannel(workspaceContracts.chann
 });
 
 // server/clients.ts
+import { Value } from "typebox/value";
 import {
   DomainError as DomainError2,
   RPC_ERROR_CODES,
   RpcError,
-  implement as implement2
+  implement as implement2,
+  schemaComplaints
 } from "@ragents/engine";
 import {
   WORKSPACE_EXECUTOR_VERSION,
@@ -420,6 +446,26 @@ var withClientCause = (cause, label) => {
 var unreached = (cause) => cause instanceof DomainError2 && (cause.code === "workspace-client-disconnected" || cause.code === "workspace-client-timeout");
 var messageOf = (cause) => cause instanceof Error ? cause.message : String(cause);
 var keyOf = (owner, id) => JSON.stringify([owner, id]);
+var assertExecutor = (label, executor) => {
+  if (executor === WORKSPACE_EXECUTOR_VERSION) return;
+  const action = Number(executor) > Number(WORKSPACE_EXECUTOR_VERSION) ? "Den Server auf die Fassung des Arbeitsplatzes aktualisieren." : "Die RAgents-Erweiterung in VS Code beziehungsweise das Paket @schlenkr/ragents auf dem Arbeitsplatz aktualisieren.";
+  throw new DomainError2(
+    "workspace-executor-version",
+    `Der Arbeitsplatz ${label} bringt den Executor ${executor} mit, der Server verlangt ${WORKSPACE_EXECUTOR_VERSION}. ${action}`,
+    409
+  );
+};
+var described = (contributions) => contributions.map(({ plugin: plugin2, stand }) => `${plugin2} (${stand.slice(0, 12)})`).join(", ") || "keine";
+var assertContributions = (label, expected, given) => {
+  const key = (entry) => `${entry.plugin}\0${entry.stand}`;
+  const same = expected.length === given.length && expected.every((entry) => given.some((other) => key(other) === key(entry)));
+  if (same) return;
+  throw new DomainError2(
+    "workspace-executor-contributions",
+    `Der Arbeitsplatz ${label} bringt die Executor-Beitr\xE4ge ${described(given)} mit, der Server verlangt ${described(expected)}. Der Arbeitsplatz fragt sie mit ragents.workspace.clients.contributions ab und meldet sich danach erneut an.`,
+    409
+  );
+};
 var assertMayRegister = (access, local) => {
   if (local || access.enabled && access.user !== null) return;
   throw new DomainError2(
@@ -429,21 +475,21 @@ var assertMayRegister = (access, local) => {
   );
 };
 var WorkspaceClientRegistry = class {
+  /** Was die Plugins des Servers zum Executor beitragen; jeder Arbeitsplatz muss genau diese Beiträge tragen. */
+  contributions;
   #clients = /* @__PURE__ */ new Map();
   /** Stopps, die den Arbeitsplatz noch nicht erreicht haben, je Arbeitsplatz und Run mit dem Ordner der Bindung. */
   #pendingStops = /* @__PURE__ */ new Map();
   #stopRetries = /* @__PURE__ */ new Map();
-  async register(id, description, executor, connection) {
+  constructor(contributions) {
+    this.contributions = contributions.map(({ plugin: plugin2, stand }) => ({ plugin: plugin2, stand }));
+  }
+  async register(id, description, executor, contributions, connection) {
     if (connection.streamless) {
       throw new DomainError2("stream-required", "Die Anmeldung eines Arbeitsplatzes braucht einen Ereignisstrom.", 409);
     }
-    if (executor !== WORKSPACE_EXECUTOR_VERSION) {
-      throw new DomainError2(
-        "workspace-executor-version",
-        `Der Arbeitsplatz ${description.label} bringt den Executor ${executor} mit, der Server verlangt ${WORKSPACE_EXECUTOR_VERSION}.`,
-        409
-      );
-    }
+    assertExecutor(description.label, executor);
+    assertContributions(description.label, this.contributions, contributions);
     const owner = connection.userId;
     const key = keyOf(owner, id);
     const previous = this.#clients.get(key);
@@ -624,9 +670,22 @@ var WorkspaceClientRegistry = class {
 };
 var clientMethods = (registry) => [
   implement2(workspaceContracts.clients.list, (_input, { access }) => registry.list(ownerOf(access))),
-  implement2(workspaceContracts.clients.register, ({ id, executor, ...description }, { access, connection, local }) => {
+  implement2(workspaceContracts.clients.contributions, ({ label, executor }, { access, local }) => {
     assertMayRegister(access, local);
-    return registry.register(id, description, executor, connection);
+    assertExecutor(label, executor);
+    return registry.contributions.map((entry) => ({ ...entry }));
+  }),
+  implement2(workspaceContracts.clients.register, (input, { access, connection, local }) => {
+    assertMayRegister(access, local);
+    assertExecutor(input.label, input.executor);
+    if (!Value.Check(clientRegistrationSchema, input)) {
+      throw new RpcError(
+        RPC_ERROR_CODES.invalidParams,
+        `Ung\xFCltige Eingabe f\xFCr ${workspaceContracts.clients.register.id}: ${schemaComplaints(clientRegistrationSchema, input, "params")}`
+      );
+    }
+    const { id, executor, contributions, ...description } = input;
+    return registry.register(id, description, executor, contributions, connection);
   }),
   implement2(workspaceContracts.clients.unregister, ({ id }, { access, connection }) => {
     registry.unregister(ownerOf(access), id, connection);
@@ -640,7 +699,9 @@ import { PROCESS_SANDBOX_DEFAULT_NETWORK } from "@ragents/host/plugin-support/pr
 var workspaceConfigDescriptors = [
   { key: "PROCESS_SANDBOX", source: "environment" },
   { key: "PROCESS_SANDBOX_NETWORK", source: "environment" },
-  { key: "RAGENTS_BASH", source: "environment" }
+  { key: "RAGENTS_BASH", source: "environment" },
+  { key: "RAGENTS_RG", source: "environment" },
+  { key: "RAGENTS_BASH_TIMEOUT_SECONDS", source: "environment" }
 ];
 var env = declaredEnvironment(workspaceConfigDescriptors);
 var processSandboxSetting = () => {
@@ -652,6 +713,8 @@ var processSandboxSetting = () => {
   return { enabled: mode === "on", network };
 };
 var bashSetting = () => env.optional("RAGENTS_BASH") || void 0;
+var rgSetting = () => env.optional("RAGENTS_RG") || void 0;
+var bashTimeoutSetting = () => env.optional("RAGENTS_BASH_TIMEOUT_SECONDS") ? env.positiveNumber("RAGENTS_BASH_TIMEOUT_SECONDS", "") : void 0;
 
 // server/runtime.ts
 import { mkdir, realpath } from "node:fs/promises";
@@ -727,6 +790,7 @@ var RunWorkspaceRuntime = class {
     this.#nugetCacheDirectory = path2.join(options.globalDirectory, "nuget-cache");
     this.sandbox = new WorkspaceSandboxHost({
       contributorName: "ragents.workspace.sandbox",
+      contributions: options.contributions,
       workspaceFor: options.sessionWorkspaceFor,
       identFor: () => Promise.resolve(void 0),
       skillPaths: options.skillPaths,
@@ -735,7 +799,9 @@ var RunWorkspaceRuntime = class {
       executorFor: (runId) => Promise.resolve(this.#executorFor(runId)),
       serverDirectoryFor: (runId) => this.#serverDirectoryFor(runId),
       ...options.processSandbox ? { processSandbox: options.processSandbox } : {},
-      ...options.bash === void 0 ? {} : { bash: options.bash }
+      ...options.bash === void 0 ? {} : { bash: options.bash },
+      ...options.rg === void 0 ? {} : { rg: options.rg },
+      ...options.bashTimeoutSeconds === void 0 ? {} : { bashTimeoutSeconds: options.bashTimeoutSeconds }
     });
   }
   /** Arbeit eines Runs, die auf dem Server läuft, während sein Arbeitsbereich auf einem Arbeitsplatz liegt. */
@@ -815,8 +881,8 @@ var RunWorkspaceRuntime = class {
   async #withRoots(workspace, onWorkstation) {
     const roots = await this.sandbox.serverRoots();
     if (roots.length === 0) return workspace;
-    const described = onWorkstation ? workstationRootsDescription(roots) : serverRootsDescription(roots);
-    return { ...workspace, description: [workspace.description, described].filter(Boolean).join("\n\n") };
+    const described2 = onWorkstation ? workstationRootsDescription(roots) : serverRootsDescription(roots);
+    return { ...workspace, description: [workspace.description, described2].filter(Boolean).join("\n\n") };
   }
   placementOf(runId) {
     const { machine, folder } = bindingOf(this.#options.runState(runId));
@@ -970,7 +1036,8 @@ var ragentsWorkspacePlugin = (skillPaths) => ({
       if (!directory) throw new Error("In diesem Profil gibt es keine Dateiablage; das Plugin ragents.documents fehlt");
       return directory;
     };
-    const clients = new WorkspaceClientRegistry();
+    const contributions = host.service(executorContributionsToken);
+    const clients = new WorkspaceClientRegistry(contributions);
     const contribution = () => host.optionalService(workspaceResolverToken);
     host.config(...workspaceConfigDescriptors);
     const sandboxSetting = processSandboxSetting();
@@ -980,10 +1047,16 @@ var ragentsWorkspacePlugin = (skillPaths) => ({
       dataDirectory: path3.dirname(host.storage.sessionsRoot)
     }) : void 0;
     const bash = bashSetting();
+    const rg = rgSetting();
+    const bashTimeoutSeconds = bashTimeoutSetting();
+    const serverTools = { ripgrep: ripgrepAvailable(rg, process.env) };
     const runtime = new RunWorkspaceRuntime({
       clients,
+      contributions: contributions.map((contribution2) => contribution2.parts),
       ...processSandbox ? { processSandbox } : {},
       ...bash === void 0 ? {} : { bash },
+      ...rg === void 0 ? {} : { rg },
+      ...bashTimeoutSeconds === void 0 ? {} : { bashTimeoutSeconds },
       globalDirectory: host.storage.root(),
       sessionDirectory: (runId, ...segments) => host.storage.session(runId, ...segments),
       storageRootFor: (runId) => path3.join(host.storage.sessionsRoot, runId),
@@ -1012,9 +1085,9 @@ var ragentsWorkspacePlugin = (skillPaths) => ({
         // Die Regeln gelten für die Arbeitsbereiche des Hosts; eine beigesteuerte Art beschreibt ihre eigenen.
         render: (context) => contribution()?.kind ? "" : rules.render(context)
       }, ...agentWorkspaceToolNames),
-      shellPlatformPrompt("ragents.workspace.shell.prompt", 102, (runId) => {
+      shellPlatformPrompt("ragents.workspace.shell.prompt", 102, serverTools, (runId) => {
         const state = runState(runId);
-        return executorShellChapter(clients, workspaceOwnerOf(state), bindingOf(state));
+        return executorShellChapter(clients, workspaceOwnerOf(state), bindingOf(state), serverTools);
       })
     );
     const browseOptions = {