@wopr-network/platform-core 1.0.10 → 1.1.0

package/dist/admin/rates/rate-store.d.ts

@@ -0,0 +1,89 @@
+import type { DrizzleDb } from "../../db/index.js";
+export interface SellRate {
+    id: string;
+    capability: string;
+    display_name: string;
+    unit: string;
+    price_usd: number;
+    model: string | null;
+    is_active: boolean;
+    sort_order: number;
+    created_at: string;
+    updated_at: string;
+}
+export interface ProviderCost {
+    id: string;
+    capability: string;
+    adapter: string;
+    model: string | null;
+    unit: string;
+    cost_usd: number;
+    priority: number;
+    latency_class: string;
+    is_active: boolean;
+    created_at: string;
+    updated_at: string;
+}
+export interface SellRateInput {
+    capability: string;
+    displayName: string;
+    unit: string;
+    priceUsd: number;
+    model?: string;
+    isActive?: boolean;
+    sortOrder?: number;
+}
+export interface ProviderCostInput {
+    capability: string;
+    adapter: string;
+    model?: string;
+    unit: string;
+    costUsd: number;
+    priority?: number;
+    latencyClass?: string;
+    isActive?: boolean;
+}
+export interface RateFilters {
+    capability?: string;
+    isActive?: boolean;
+    limit?: number;
+    offset?: number;
+}
+export interface ProviderCostFilters {
+    capability?: string;
+    adapter?: string;
+    isActive?: boolean;
+    limit?: number;
+    offset?: number;
+}
+export declare class RateStore {
+    private readonly db;
+    constructor(db: DrizzleDb);
+    createSellRate(input: SellRateInput): Promise<SellRate>;
+    updateSellRate(id: string, input: Partial<SellRateInput>): Promise<SellRate>;
+    deleteSellRate(id: string): Promise<boolean>;
+    getSellRate(id: string): Promise<SellRate | null>;
+    /** Look up an active sell rate by capability and model. Returns null if not found. */
+    getSellRateByModel(capability: string, model: string, unit?: string): Promise<SellRate | null>;
+    listSellRates(filters?: RateFilters): Promise<{
+        entries: SellRate[];
+        total: number;
+    }>;
+    /** List only active sell rates, ordered by capability + sort_order. For public pricing endpoint. */
+    listPublicRates(): Promise<SellRate[]>;
+    createProviderCost(input: ProviderCostInput): Promise<ProviderCost>;
+    updateProviderCost(id: string, input: Partial<ProviderCostInput>): Promise<ProviderCost>;
+    deleteProviderCost(id: string): Promise<boolean>;
+    getProviderCost(id: string): Promise<ProviderCost | null>;
+    listProviderCosts(filters?: ProviderCostFilters): Promise<{
+        entries: ProviderCost[];
+        total: number;
+    }>;
+    /** Get combined sell rate + provider cost for margin calculation */
+    getMarginReport(capability?: string): Promise<Array<{
+        capability: string;
+        sellRate: SellRate;
+        providerCosts: ProviderCost[];
+        bestMarginPct: number;
+    }>>;
+}

package/dist/admin/rates/rate-store.js

@@ -0,0 +1,301 @@
+import crypto from "node:crypto";
+import { and, asc, count, eq, isNull, sql } from "drizzle-orm";
+import { providerCosts, sellRates } from "../../db/schema/index.js";
+const MAX_LIMIT = 250;
+const DEFAULT_LIMIT = 50;
+export class RateStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    // ── Sell Rates ──
+    async createSellRate(input) {
+        // Check for existing NULL-model sell rate for this capability (application-level uniqueness)
+        if (!input.model) {
+            const existing = (await this.db
+                .select({ id: sellRates.id })
+                .from(sellRates)
+                .where(and(eq(sellRates.capability, input.capability), isNull(sellRates.model))))[0];
+            if (existing) {
+                throw new Error(`A sell rate with capability '${input.capability}' and NULL model already exists`);
+            }
+        }
+        const id = crypto.randomUUID();
+        const now = new Date().toISOString();
+        const isActive = input.isActive ?? true;
+        const sortOrder = input.sortOrder ?? 0;
+        await this.db.insert(sellRates).values({
+            id,
+            capability: input.capability,
+            displayName: input.displayName,
+            unit: input.unit,
+            priceUsd: input.priceUsd,
+            model: input.model ?? null,
+            isActive,
+            sortOrder,
+            createdAt: now,
+            updatedAt: now,
+        });
+        return (await this.getSellRate(id));
+    }
+    async updateSellRate(id, input) {
+        const existing = await this.getSellRate(id);
+        if (!existing) {
+            throw new Error(`Sell rate with id '${id}' not found`);
+        }
+        // Check NULL-model uniqueness if changing model to NULL.
+        // Use the updated capability (if being changed) rather than the existing one.
+        if ("model" in input && !input.model) {
+            const effectiveCapability = input.capability ?? existing.capability;
+            const duplicate = (await this.db
+                .select({ id: sellRates.id })
+                .from(sellRates)
+                .where(and(eq(sellRates.capability, effectiveCapability), isNull(sellRates.model), sql `${sellRates.id} != ${id}`)))[0];
+            if (duplicate) {
+                throw new Error(`A sell rate with capability '${effectiveCapability}' and NULL model already exists`);
+            }
+        }
+        const setValues = {};
+        if (input.capability !== undefined)
+            setValues.capability = input.capability;
+        if (input.displayName !== undefined)
+            setValues.displayName = input.displayName;
+        if (input.unit !== undefined)
+            setValues.unit = input.unit;
+        if (input.priceUsd !== undefined)
+            setValues.priceUsd = input.priceUsd;
+        if ("model" in input)
+            setValues.model = input.model ?? null;
+        if (input.isActive !== undefined)
+            setValues.isActive = input.isActive;
+        if (input.sortOrder !== undefined)
+            setValues.sortOrder = input.sortOrder;
+        setValues.updatedAt = new Date().toISOString();
+        await this.db.update(sellRates).set(setValues).where(eq(sellRates.id, id));
+        return (await this.getSellRate(id));
+    }
+    async deleteSellRate(id) {
+        const result = await this.db.delete(sellRates).where(eq(sellRates.id, id)).returning({ id: sellRates.id });
+        return result.length > 0;
+    }
+    async getSellRate(id) {
+        const rows = await this.db.select().from(sellRates).where(eq(sellRates.id, id));
+        return rows[0] ? toSellRate(rows[0]) : null;
+    }
+    /** Look up an active sell rate by capability and model. Returns null if not found. */
+    async getSellRateByModel(capability, model, unit) {
+        const conditions = [eq(sellRates.capability, capability), eq(sellRates.model, model), eq(sellRates.isActive, true)];
+        if (unit !== undefined) {
+            conditions.push(eq(sellRates.unit, unit));
+        }
+        const rows = await this.db
+            .select()
+            .from(sellRates)
+            .where(and(...conditions))
+            .orderBy(asc(sellRates.sortOrder), asc(sellRates.createdAt))
+            .limit(1);
+        return rows[0] ? toSellRate(rows[0]) : null;
+    }
+    async listSellRates(filters) {
+        const wheres = buildSellRateWheres(filters);
+        const countResult = (await this.db.select({ count: count() }).from(sellRates).where(wheres))[0];
+        const total = countResult?.count ?? 0;
+        const limit = Math.min(filters?.limit ?? DEFAULT_LIMIT, MAX_LIMIT);
+        const offset = filters?.offset ?? 0;
+        const rows = await this.db
+            .select()
+            .from(sellRates)
+            .where(wheres)
+            .orderBy(asc(sellRates.capability), asc(sellRates.sortOrder), asc(sellRates.displayName))
+            .limit(limit)
+            .offset(offset);
+        return { entries: rows.map(toSellRate), total };
+    }
+    /** List only active sell rates, ordered by capability + sort_order. For public pricing endpoint. */
+    async listPublicRates() {
+        const rows = await this.db
+            .select()
+            .from(sellRates)
+            .where(eq(sellRates.isActive, true))
+            .orderBy(asc(sellRates.capability), asc(sellRates.sortOrder), asc(sellRates.displayName));
+        return rows.map(toSellRate);
+    }
+    // ── Provider Costs ──
+    async createProviderCost(input) {
+        // Check for existing NULL-model provider cost (application-level uniqueness)
+        if (!input.model) {
+            const existing = (await this.db
+                .select({ id: providerCosts.id })
+                .from(providerCosts)
+                .where(and(eq(providerCosts.capability, input.capability), eq(providerCosts.adapter, input.adapter), isNull(providerCosts.model))))[0];
+            if (existing) {
+                throw new Error(`A provider cost with capability '${input.capability}', adapter '${input.adapter}', and NULL model already exists`);
+            }
+        }
+        const id = crypto.randomUUID();
+        const now = new Date().toISOString();
+        const isActive = input.isActive ?? true;
+        const priority = input.priority ?? 0;
+        const latencyClass = input.latencyClass ?? "standard";
+        await this.db.insert(providerCosts).values({
+            id,
+            capability: input.capability,
+            adapter: input.adapter,
+            model: input.model ?? null,
+            unit: input.unit,
+            costUsd: input.costUsd,
+            priority,
+            latencyClass,
+            isActive,
+            createdAt: now,
+            updatedAt: now,
+        });
+        return (await this.getProviderCost(id));
+    }
+    async updateProviderCost(id, input) {
+        const existing = await this.getProviderCost(id);
+        if (!existing) {
+            throw new Error(`Provider cost with id '${id}' not found`);
+        }
+        // Check NULL-model uniqueness if changing model to NULL.
+        // Use the updated capability/adapter (if being changed) rather than the existing ones.
+        if ("model" in input && !input.model) {
+            const effectiveCapability = input.capability ?? existing.capability;
+            const effectiveAdapter = input.adapter ?? existing.adapter;
+            const duplicate = (await this.db
+                .select({ id: providerCosts.id })
+                .from(providerCosts)
+                .where(and(eq(providerCosts.capability, effectiveCapability), eq(providerCosts.adapter, effectiveAdapter), isNull(providerCosts.model), sql `${providerCosts.id} != ${id}`)))[0];
+            if (duplicate) {
+                throw new Error(`A provider cost with capability '${effectiveCapability}', adapter '${effectiveAdapter}', and NULL model already exists`);
+            }
+        }
+        const setValues = {};
+        if (input.capability !== undefined)
+            setValues.capability = input.capability;
+        if (input.adapter !== undefined)
+            setValues.adapter = input.adapter;
+        if ("model" in input)
+            setValues.model = input.model ?? null;
+        if (input.unit !== undefined)
+            setValues.unit = input.unit;
+        if (input.costUsd !== undefined)
+            setValues.costUsd = input.costUsd;
+        if (input.priority !== undefined)
+            setValues.priority = input.priority;
+        if (input.latencyClass !== undefined)
+            setValues.latencyClass = input.latencyClass;
+        if (input.isActive !== undefined)
+            setValues.isActive = input.isActive;
+        setValues.updatedAt = new Date().toISOString();
+        await this.db.update(providerCosts).set(setValues).where(eq(providerCosts.id, id));
+        return (await this.getProviderCost(id));
+    }
+    async deleteProviderCost(id) {
+        const result = await this.db
+            .delete(providerCosts)
+            .where(eq(providerCosts.id, id))
+            .returning({ id: providerCosts.id });
+        return result.length > 0;
+    }
+    async getProviderCost(id) {
+        const rows = await this.db.select().from(providerCosts).where(eq(providerCosts.id, id));
+        return rows[0] ? toProviderCost(rows[0]) : null;
+    }
+    async listProviderCosts(filters) {
+        const wheres = buildProviderCostWheres(filters);
+        const countResult = (await this.db.select({ count: count() }).from(providerCosts).where(wheres))[0];
+        const total = countResult?.count ?? 0;
+        const limit = Math.min(filters?.limit ?? DEFAULT_LIMIT, MAX_LIMIT);
+        const offset = filters?.offset ?? 0;
+        const rows = await this.db
+            .select()
+            .from(providerCosts)
+            .where(wheres)
+            .orderBy(asc(providerCosts.capability), asc(providerCosts.priority), asc(providerCosts.adapter))
+            .limit(limit)
+            .offset(offset);
+        return { entries: rows.map(toProviderCost), total };
+    }
+    // ── Margin Reporting ──
+    /** Get combined sell rate + provider cost for margin calculation */
+    async getMarginReport(capability) {
+        const wheres = capability ? eq(sellRates.capability, capability) : undefined;
+        const allSellRates = await this.db
+            .select()
+            .from(sellRates)
+            .where(wheres)
+            .orderBy(asc(sellRates.capability), asc(sellRates.sortOrder));
+        const result = [];
+        for (const sr of allSellRates) {
+            const costs = (await this.db
+                .select()
+                .from(providerCosts)
+                .where(eq(providerCosts.capability, sr.capability))
+                .orderBy(asc(providerCosts.priority), asc(providerCosts.costUsd))).map(toProviderCost);
+            const sellRate = toSellRate(sr);
+            const minCost = costs.length > 0 ? Math.min(...costs.map((pc) => pc.cost_usd)) : 0;
+            const bestMarginPct = sellRate.price_usd > 0 ? ((sellRate.price_usd - minCost) / sellRate.price_usd) * 100 : 0;
+            result.push({
+                capability: sellRate.capability,
+                sellRate,
+                providerCosts: costs,
+                bestMarginPct,
+            });
+        }
+        return result;
+    }
+}
+// ---------------------------------------------------------------------------
+// WHERE clause builders
+// ---------------------------------------------------------------------------
+function buildSellRateWheres(filters) {
+    const clauses = [];
+    if (filters?.capability)
+        clauses.push(eq(sellRates.capability, filters.capability));
+    if (filters?.isActive !== undefined)
+        clauses.push(eq(sellRates.isActive, filters.isActive));
+    return clauses.length > 0 ? and(...clauses) : undefined;
+}
+function buildProviderCostWheres(filters) {
+    const clauses = [];
+    if (filters?.capability)
+        clauses.push(eq(providerCosts.capability, filters.capability));
+    if (filters?.adapter)
+        clauses.push(eq(providerCosts.adapter, filters.adapter));
+    if (filters?.isActive !== undefined)
+        clauses.push(eq(providerCosts.isActive, filters.isActive));
+    return clauses.length > 0 ? and(...clauses) : undefined;
+}
+// ---------------------------------------------------------------------------
+// Row mappers
+// ---------------------------------------------------------------------------
+function toSellRate(row) {
+    return {
+        id: row.id,
+        capability: row.capability,
+        display_name: row.displayName,
+        unit: row.unit,
+        price_usd: row.priceUsd,
+        model: row.model,
+        is_active: row.isActive,
+        sort_order: row.sortOrder,
+        created_at: row.createdAt,
+        updated_at: row.updatedAt,
+    };
+}
+function toProviderCost(row) {
+    return {
+        id: row.id,
+        capability: row.capability,
+        adapter: row.adapter,
+        model: row.model,
+        unit: row.unit,
+        cost_usd: row.costUsd,
+        priority: row.priority,
+        latency_class: row.latencyClass,
+        is_active: row.isActive,
+        created_at: row.createdAt,
+        updated_at: row.updatedAt,
+    };
+}

package/dist/api/drizzle-rate-limit-repository.d.ts

@@ -0,0 +1,10 @@
+import type { DrizzleDb } from "../db/index.js";
+import type { IRateLimitRepository } from "./rate-limit-repository.js";
+import type { RateLimitEntry } from "./repository-types.js";
+export declare class DrizzleRateLimitRepository implements IRateLimitRepository {
+    private readonly db;
+    constructor(db: DrizzleDb);
+    increment(key: string, scope: string, windowMs: number): Promise<RateLimitEntry>;
+    get(key: string, scope: string): Promise<RateLimitEntry | null>;
+    purgeStale(windowMs: number): Promise<number>;
+}

package/dist/api/drizzle-rate-limit-repository.js

@@ -0,0 +1,42 @@
+import { and, eq, lt, sql } from "drizzle-orm";
+import { rateLimitEntries } from "../db/schema/index.js";
+export class DrizzleRateLimitRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async increment(key, scope, windowMs) {
+        const now = Date.now();
+        const result = await this.db
+            .insert(rateLimitEntries)
+            .values({ key, scope, count: 1, windowStart: now })
+            .onConflictDoUpdate({
+            target: [rateLimitEntries.key, rateLimitEntries.scope],
+            set: {
+                count: sql `CASE WHEN ${now} - ${rateLimitEntries.windowStart} < ${windowMs} THEN ${rateLimitEntries.count} + 1 ELSE 1 END`,
+                windowStart: sql `CASE WHEN ${now} - ${rateLimitEntries.windowStart} < ${windowMs} THEN ${rateLimitEntries.windowStart} ELSE ${now} END`,
+            },
+        })
+            .returning();
+        const row = result[0];
+        return { key: row.key, scope: row.scope, count: row.count, windowStart: row.windowStart };
+    }
+    async get(key, scope) {
+        const rows = await this.db
+            .select()
+            .from(rateLimitEntries)
+            .where(and(eq(rateLimitEntries.key, key), eq(rateLimitEntries.scope, scope)));
+        const row = rows[0];
+        if (!row)
+            return null;
+        return { key: row.key, scope: row.scope, count: row.count, windowStart: row.windowStart };
+    }
+    async purgeStale(windowMs) {
+        const cutoff = Date.now() - windowMs;
+        const result = await this.db
+            .delete(rateLimitEntries)
+            .where(lt(rateLimitEntries.windowStart, cutoff))
+            .returning({ key: rateLimitEntries.key });
+        return result.length;
+    }
+}

package/dist/api/drizzle-sig-penalty-repository.d.ts

@@ -0,0 +1,12 @@
+import type { DrizzleDb } from "../db/index.js";
+import type { SigPenalty } from "./repository-types.js";
+import type { ISigPenaltyRepository } from "./sig-penalty-repository.js";
+export declare class DrizzleSigPenaltyRepository implements ISigPenaltyRepository {
+    private readonly db;
+    constructor(db: DrizzleDb);
+    get(ip: string, source: string): Promise<SigPenalty | null>;
+    recordFailure(ip: string, source: string): Promise<SigPenalty>;
+    clear(ip: string, source: string): Promise<void>;
+    purgeStale(decayMs: number): Promise<number>;
+    private toSigPenalty;
+}

package/dist/api/drizzle-sig-penalty-repository.js

@@ -0,0 +1,61 @@
+import { and, eq, lt, sql } from "drizzle-orm";
+import { webhookSigPenalties } from "../db/schema/index.js";
+const MAX_BACKOFF_MS = 15 * 60 * 1000; // 15 minutes
+export class DrizzleSigPenaltyRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async get(ip, source) {
+        const rows = await this.db
+            .select()
+            .from(webhookSigPenalties)
+            .where(and(eq(webhookSigPenalties.ip, ip), eq(webhookSigPenalties.source, source)));
+        return rows[0] ? this.toSigPenalty(rows[0]) : null;
+    }
+    async recordFailure(ip, source) {
+        const now = Date.now();
+        const result = await this.db
+            .insert(webhookSigPenalties)
+            .values({ ip, source, failures: 1, blockedUntil: now + Math.min(1000 * 2 ** 1, MAX_BACKOFF_MS), updatedAt: now })
+            .onConflictDoUpdate({
+            target: [webhookSigPenalties.ip, webhookSigPenalties.source],
+            set: {
+                failures: sql `${webhookSigPenalties.failures} + 1`,
+                blockedUntil: sql `${now} + LEAST(1000 * POWER(2, ${webhookSigPenalties.failures} + 1), ${MAX_BACKOFF_MS})`,
+                updatedAt: sql `${now}`,
+            },
+        })
+            .returning();
+        const row = result[0];
+        return {
+            ip: row.ip,
+            source: row.source,
+            failures: row.failures,
+            blockedUntil: row.blockedUntil,
+            updatedAt: row.updatedAt,
+        };
+    }
+    async clear(ip, source) {
+        await this.db
+            .delete(webhookSigPenalties)
+            .where(and(eq(webhookSigPenalties.ip, ip), eq(webhookSigPenalties.source, source)));
+    }
+    async purgeStale(decayMs) {
+        const cutoff = Date.now() - decayMs;
+        const result = await this.db
+            .delete(webhookSigPenalties)
+            .where(lt(webhookSigPenalties.blockedUntil, cutoff))
+            .returning({ ip: webhookSigPenalties.ip });
+        return result.length;
+    }
+    toSigPenalty(row) {
+        return {
+            ip: row.ip,
+            source: row.source,
+            failures: row.failures,
+            blockedUntil: row.blockedUntil,
+            updatedAt: row.updatedAt,
+        };
+    }
+}

package/dist/api/marketplace-content-repository.d.ts

@@ -0,0 +1,18 @@
+import type { DrizzleDb } from "../db/index.js";
+export interface PluginMarketplaceContentRow {
+    pluginId: string;
+    version: string;
+    markdown: string;
+    source: "superpower_md" | "manifest_description";
+    updatedAt: number;
+}
+export interface IMarketplaceContentRepository {
+    getByPluginId(pluginId: string): Promise<PluginMarketplaceContentRow | null>;
+    upsert(row: PluginMarketplaceContentRow): Promise<void>;
+}
+export declare class DrizzleMarketplaceContentRepository implements IMarketplaceContentRepository {
+    private db;
+    constructor(db: DrizzleDb);
+    getByPluginId(pluginId: string): Promise<PluginMarketplaceContentRow | null>;
+    upsert(row: PluginMarketplaceContentRow): Promise<void>;
+}

package/dist/api/marketplace-content-repository.js

@@ -0,0 +1,44 @@
+import { eq } from "drizzle-orm";
+import { pluginMarketplaceContent } from "../db/schema/plugin-marketplace-content.js";
+export class DrizzleMarketplaceContentRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async getByPluginId(pluginId) {
+        const rows = await this.db
+            .select()
+            .from(pluginMarketplaceContent)
+            .where(eq(pluginMarketplaceContent.pluginId, pluginId));
+        const row = rows[0];
+        if (!row)
+            return null;
+        return {
+            pluginId: row.pluginId,
+            version: row.version,
+            markdown: row.markdown,
+            source: row.source,
+            updatedAt: row.updatedAt,
+        };
+    }
+    async upsert(row) {
+        await this.db
+            .insert(pluginMarketplaceContent)
+            .values({
+            pluginId: row.pluginId,
+            version: row.version,
+            markdown: row.markdown,
+            source: row.source,
+            updatedAt: row.updatedAt,
+        })
+            .onConflictDoUpdate({
+            target: pluginMarketplaceContent.pluginId,
+            set: {
+                version: row.version,
+                markdown: row.markdown,
+                source: row.source,
+                updatedAt: row.updatedAt,
+            },
+        });
+    }
+}

package/dist/api/marketplace-content-service.d.ts

@@ -0,0 +1,12 @@
+import type { IMarketplaceContentRepository } from "./marketplace-content-repository.js";
+interface FsAdapters {
+    readFile: (path: string) => Promise<string>;
+    resolvePkg: (pkgName: string) => string;
+}
+/**
+ * Extract SUPERPOWER.md from a plugin's npm package directory and cache it.
+ * Falls back to manifest.description if the file is absent.
+ * Skips extraction if the cached version matches.
+ */
+export declare function extractPluginContent(pluginId: string, version: string, manifestDescription: string, repo: IMarketplaceContentRepository, adapters?: FsAdapters): Promise<void>;
+export {};

package/dist/api/marketplace-content-service.js

@@ -0,0 +1,43 @@
+import { readFile as fsReadFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+const defaultAdapters = {
+    readFile: (path) => fsReadFile(path, "utf-8"),
+    resolvePkg: (pkgName) => {
+        const require = createRequire(import.meta.url);
+        return require.resolve(`${pkgName}/package.json`);
+    },
+};
+/**
+ * Extract SUPERPOWER.md from a plugin's npm package directory and cache it.
+ * Falls back to manifest.description if the file is absent.
+ * Skips extraction if the cached version matches.
+ */
+export async function extractPluginContent(pluginId, version, manifestDescription, repo, adapters = defaultAdapters) {
+    // Skip if already cached at this version
+    const existing = await repo.getByPluginId(pluginId);
+    if (existing && existing.version === version)
+        return;
+    const npmPkgName = `@wopr-network/wopr-plugin-${pluginId}`;
+    let markdown;
+    let source;
+    try {
+        const pkgJsonPath = adapters.resolvePkg(npmPkgName);
+        const pkgDir = dirname(pkgJsonPath);
+        const superpowerPath = join(pkgDir, "SUPERPOWER.md");
+        markdown = await adapters.readFile(superpowerPath);
+        source = "superpower_md";
+    }
+    catch {
+        // SUPERPOWER.md not found or package not resolvable — use manifest description
+        markdown = manifestDescription;
+        source = "manifest_description";
+    }
+    await repo.upsert({
+        pluginId,
+        version,
+        markdown,
+        source,
+        updatedAt: Date.now(),
+    });
+}

package/dist/api/middleware/get-client-ip.d.ts

@@ -0,0 +1,22 @@
+import type { Context } from "hono";
+/**
+ * Parse the TRUSTED_PROXY_IPS env var into a Set of IP addresses.
+ * Returns an empty set if the value is undefined or empty.
+ */
+export declare function parseTrustedProxies(envValue: string | undefined): Set<string>;
+/**
+ * Determine the real client IP.
+ *
+ * - If `socketAddr` matches a trusted proxy, use the **first** (leftmost)
+ *   value from `X-Forwarded-For` (the original client IP).
+ * - Otherwise, use `socketAddr` directly (XFF is untrusted).
+ * - Falls back to `"unknown"` if neither is available.
+ */
+export declare function getClientIp(xffHeader: string | undefined, socketAddr: string | undefined, trusted?: Set<string>): string;
+/**
+ * Convenience wrapper: extract client IP from a Hono Context.
+ * Reads XFF header and socket address from the request.
+ * Optionally accepts a trusted proxy set (defaults to the module-level set
+ * parsed from TRUSTED_PROXY_IPS — useful for testing).
+ */
+export declare function getClientIpFromContext(c: Context, trusted?: Set<string>): string;