@xpert-ai/plugin-sdk 3.11.2 → 3.12.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @xpert-ai/plugin-sdk
 
+## 3.12.1
+
+### Patch Changes
+
+- 6a17eca: plugin sdk and mcp toolset close
+- Updated dependencies [6a17eca]
+  - @xpert-ai/contracts@3.12.1
+
+## 3.12.0
+
+### Minor Changes
+
+- d017897: plugin integration guard
+
+### Patch Changes
+
+- Updated dependencies [d017897]
+  - @xpert-ai/contracts@3.12.0
+
 ## 3.11.2
 
 ### Patch Changes

package/index.cjs.js

@@ -132,6 +132,11 @@ function __decorate(decorators, target, key, desc) {
     else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
+function __param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
 function __metadata(metadataKey, metadataValue) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
@@ -1123,6 +1128,13 @@ function getRequiredPermissionOperation(method, permissionType) {
  * System token for resolving user permission service from plugin context.
  */ const USER_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_USER_PERMISSION_SERVICE';
 
+/**
+ * System token for resolving speech-to-text service from plugin context.
+ */ const SPEECH_TO_TEXT_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_SPEECH_TO_TEXT_PERMISSION_SERVICE';
+/**
+ * Internal system token used by core to expose the speech-to-text bridge.
+ */ const SPEECH_TO_TEXT_SERVICE_TOKEN = 'XPERT_SPEECH_TO_TEXT_SERVICE';
+
 async function createI18nInstance(pluginDir, language) {
     const instance = i18next.createInstance();
     const i18nDir = path.join(pluginDir, 'i18n');
@@ -1225,6 +1237,103 @@ class JsonSchemaValidator {
     }
 }
 
+const PLUGIN_WEBHOOK_AUTH_METADATA_KEY = 'xpert:plugin:webhook-auth';
+const PLUGIN_WEBHOOK_AUTH_SERVICE_TOKEN = 'XPERT_PLUGIN_WEBHOOK_AUTH_SERVICE';
+function PluginWebhookAuth(metadata = {}) {
+    return common.SetMetadata(PLUGIN_WEBHOOK_AUTH_METADATA_KEY, _extends({
+        integrationParam: 'id',
+        secretQueryParam: 'secret'
+    }, metadata));
+}
+exports.PluginWebhookAuthGuard = class PluginWebhookAuthGuard {
+    async canActivate(context) {
+        var _request_params, _request_query;
+        const metadata = this.resolveMetadata(context);
+        if (!metadata) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const integrationParam = metadata.integrationParam || 'id';
+        const secretQueryParam = metadata.secretQueryParam || 'secret';
+        const integrationId = this.getString((_request_params = request.params) == null ? void 0 : _request_params[integrationParam]);
+        const secret = this.getString((_request_query = request.query) == null ? void 0 : _request_query[secretQueryParam]);
+        if (!integrationId || !secret) {
+            throw new common.UnauthorizedException('Plugin webhook secret is required');
+        }
+        const authService = this.authService;
+        if (!authService) {
+            throw new common.UnauthorizedException('Plugin webhook auth service is not available');
+        }
+        const principalContext = await authService.validateWebhookSecret({
+            integrationId,
+            secret,
+            provider: metadata.provider
+        });
+        if (!(principalContext == null ? void 0 : principalContext.user) || !principalContext.headers) {
+            throw new common.UnauthorizedException('Plugin webhook secret is invalid');
+        }
+        request.user = principalContext.user;
+        var _request_headers;
+        request.headers = _extends({}, (_request_headers = request.headers) != null ? _request_headers : {}, principalContext.headers);
+        return true;
+    }
+    resolveMetadata(context) {
+        var _Reflect_getMetadata, _ref;
+        return (_ref = (_Reflect_getMetadata = Reflect.getMetadata(PLUGIN_WEBHOOK_AUTH_METADATA_KEY, context.getHandler())) != null ? _Reflect_getMetadata : Reflect.getMetadata(PLUGIN_WEBHOOK_AUTH_METADATA_KEY, context.getClass())) != null ? _ref : null;
+    }
+    getString(value) {
+        if (typeof value !== 'string') {
+            return '';
+        }
+        return value.trim();
+    }
+    constructor(authService){
+        this.authService = authService;
+    }
+};
+exports.PluginWebhookAuthGuard = __decorate([
+    common.Injectable(),
+    __param(0, common.Optional()),
+    __param(0, common.Inject(PLUGIN_WEBHOOK_AUTH_SERVICE_TOKEN)),
+    __metadata("design:paramtypes", [
+        Object
+    ])
+], exports.PluginWebhookAuthGuard);
+
+function createRuntimeCapability(id, options = {}) {
+    return Object.freeze({
+        id,
+        description: options.description
+    });
+}
+const XPERT_RUNTIME_CAPABILITIES_TOKEN = 'XPERT_RUNTIME_CAPABILITIES';
+class DefaultRuntimeCapabilityRegistry {
+    register(key, implementation) {
+        this.capabilities.set(runtimeCapabilityId(key), implementation);
+        return this;
+    }
+    has(key) {
+        return this.capabilities.has(runtimeCapabilityId(key));
+    }
+    get(key) {
+        return this.capabilities.get(runtimeCapabilityId(key));
+    }
+    require(key) {
+        const implementation = this.get(key);
+        if (!implementation) {
+            throw new Error(`Runtime capability '${runtimeCapabilityId(key)}' is not available`);
+        }
+        return implementation;
+    }
+    constructor(entries = []){
+        this.capabilities = new Map();
+        entries.forEach(([key, implementation])=>this.register(key, implementation));
+    }
+}
+function runtimeCapabilityId(key) {
+    return typeof key === 'string' ? key : key.id;
+}
+
 const DATASOURCE_STRATEGY = 'DATASOURCE_STRATEGY';
 const DataSourceStrategy = (provider)=>common.applyDecorators(common.SetMetadata(DATASOURCE_STRATEGY, provider), common.SetMetadata(STRATEGY_META_KEY, DATASOURCE_STRATEGY));
 
@@ -2600,6 +2709,18 @@ Reflect.defineMetadata(COMMAND_METADATA$1, {
     id: CreateModelClientCommand.type
 }, CreateModelClientCommand);
 
+const KnowledgebaseRuntimeCapability = createRuntimeCapability('platform.knowledgebase', {
+    description: 'List, search, and write chunks in platform knowledgebases.'
+});
+
+const KnowledgebaseDocumentsRuntimeCapability = createRuntimeCapability('platform.knowledgebase.documents', {
+    description: 'Upload, import, create, process, inspect, and delete persistent knowledgebase documents.'
+});
+
+const WorkspaceFilesRuntimeCapability = createRuntimeCapability('platform.workspace.files', {
+    description: 'Upload, read, and delete raw files in Xpert workspace volumes.'
+});
+
 const SKILL_SOURCE_PROVIDER = 'SKILL_SOURCE_PROVIDER';
 const SkillSourceProviderStrategy = (provider)=>common.applyDecorators(common.SetMetadata(SKILL_SOURCE_PROVIDER, provider), common.SetMetadata(STRATEGY_META_KEY, SKILL_SOURCE_PROVIDER));
 
@@ -2640,48 +2761,6 @@ exports.AgentMiddlewareRegistry = __decorate([
     "end"
 ];
 
-function createRuntimeCapability(id, options = {}) {
-    return Object.freeze({
-        id,
-        description: options.description
-    });
-}
-const XPERT_RUNTIME_CAPABILITIES_TOKEN = 'XPERT_RUNTIME_CAPABILITIES';
-class DefaultAgentMiddlewareRuntimeCapabilityRegistry {
-    register(key, implementation) {
-        this.capabilities.set(runtimeCapabilityId(key), implementation);
-        return this;
-    }
-    has(key) {
-        return this.capabilities.has(runtimeCapabilityId(key));
-    }
-    get(key) {
-        return this.capabilities.get(runtimeCapabilityId(key));
-    }
-    require(key) {
-        const implementation = this.get(key);
-        if (!implementation) {
-            throw new Error(`Runtime capability '${runtimeCapabilityId(key)}' is not available`);
-        }
-        return implementation;
-    }
-    constructor(entries = []){
-        this.capabilities = new Map();
-        entries.forEach(([key, implementation])=>this.register(key, implementation));
-    }
-}
-function runtimeCapabilityId(key) {
-    return typeof key === 'string' ? key : key.id;
-}
-
-const KnowledgebaseRuntimeCapability = createRuntimeCapability('platform.knowledgebase', {
-    description: 'List, search, and write chunks in platform knowledgebases.'
-});
-
-const KnowledgebaseDocumentsRuntimeCapability = createRuntimeCapability('platform.knowledgebase.documents', {
-    description: 'Upload, import, create, process, inspect, and delete persistent knowledgebase documents.'
-});
-
 const AssistantTaskRuntimeCapability = createRuntimeCapability('platform.assistant_task', {
     description: 'Start asynchronous tasks on the current platform assistant.'
 });
@@ -4484,7 +4563,8 @@ exports.DEFAULT_SANDBOX_SHELL_TIMEOUT_SEC = DEFAULT_SANDBOX_SHELL_TIMEOUT_SEC;
 exports.DOCUMENT_SOURCE_STRATEGY = DOCUMENT_SOURCE_STRATEGY;
 exports.DOCUMENT_TRANSFORMER_STRATEGY = DOCUMENT_TRANSFORMER_STRATEGY;
 exports.DataSourceStrategy = DataSourceStrategy;
-exports.DefaultAgentMiddlewareRuntimeCapabilityRegistry = DefaultAgentMiddlewareRuntimeCapabilityRegistry;
+exports.DefaultAgentMiddlewareRuntimeCapabilityRegistry = DefaultRuntimeCapabilityRegistry;
+exports.DefaultRuntimeCapabilityRegistry = DefaultRuntimeCapabilityRegistry;
 exports.DocumentSourceStrategy = DocumentSourceStrategy;
 exports.DocumentTransformerStrategy = DocumentTransformerStrategy;
 exports.FILE_STORAGE_PROVIDER = FILE_STORAGE_PROVIDER;
@@ -4516,12 +4596,15 @@ exports.PERMISSION_OPERATION_METADATA_KEY = PERMISSION_OPERATION_METADATA_KEY;
 exports.PLUGIN_CONFIG_RESOLVER_TOKEN = PLUGIN_CONFIG_RESOLVER_TOKEN;
 exports.PLUGIN_METADATA = PLUGIN_METADATA;
 exports.PLUGIN_METADATA_KEY = PLUGIN_METADATA_KEY;
+exports.PLUGIN_WEBHOOK_AUTH_METADATA_KEY = PLUGIN_WEBHOOK_AUTH_METADATA_KEY;
+exports.PLUGIN_WEBHOOK_AUTH_SERVICE_TOKEN = PLUGIN_WEBHOOK_AUTH_SERVICE_TOKEN;
 exports.PROVIDE_AI_MODEL_LLM = PROVIDE_AI_MODEL_LLM;
 exports.PROVIDE_AI_MODEL_MODERATION = PROVIDE_AI_MODEL_MODERATION;
 exports.PROVIDE_AI_MODEL_RERANK = PROVIDE_AI_MODEL_RERANK;
 exports.PROVIDE_AI_MODEL_SPEECH2TEXT = PROVIDE_AI_MODEL_SPEECH2TEXT;
 exports.PROVIDE_AI_MODEL_TEXT_EMBEDDING = PROVIDE_AI_MODEL_TEXT_EMBEDDING;
 exports.PROVIDE_AI_MODEL_TTS = PROVIDE_AI_MODEL_TTS;
+exports.PluginWebhookAuth = PluginWebhookAuth;
 exports.RETRIEVER_STRATEGY = RETRIEVER_STRATEGY;
 exports.RequestContext = RequestContext;
 exports.RequirePermissionOperation = RequirePermissionOperation;
@@ -4530,6 +4613,8 @@ exports.RetrieverStrategy = RetrieverStrategy;
 exports.SANDBOX_PROVIDER = SANDBOX_PROVIDER;
 exports.SANDBOX_SHELL_TIMEOUT_LIMITS_SEC = SANDBOX_SHELL_TIMEOUT_LIMITS_SEC;
 exports.SKILL_SOURCE_PROVIDER = SKILL_SOURCE_PROVIDER;
+exports.SPEECH_TO_TEXT_PERMISSION_SERVICE_TOKEN = SPEECH_TO_TEXT_PERMISSION_SERVICE_TOKEN;
+exports.SPEECH_TO_TEXT_SERVICE_TOKEN = SPEECH_TO_TEXT_SERVICE_TOKEN;
 exports.SSOProviderStrategyKey = SSOProviderStrategyKey;
 exports.SSO_BINDING_PERMISSION_SERVICE_TOKEN = SSO_BINDING_PERMISSION_SERVICE_TOKEN;
 exports.SSO_PROVIDER = SSO_PROVIDER;
@@ -4554,6 +4639,7 @@ exports.WORKFLOW_NODE_STRATEGY = WORKFLOW_NODE_STRATEGY;
 exports.WORKFLOW_TRIGGER_STRATEGY = WORKFLOW_TRIGGER_STRATEGY;
 exports.WorkflowNodeStrategy = WorkflowNodeStrategy;
 exports.WorkflowTriggerStrategy = WorkflowTriggerStrategy;
+exports.WorkspaceFilesRuntimeCapability = WorkspaceFilesRuntimeCapability;
 exports.WrapWorkflowNodeExecutionCommand = WrapWorkflowNodeExecutionCommand;
 exports.XPERT_RUNTIME_CAPABILITIES_TOKEN = XPERT_RUNTIME_CAPABILITIES_TOKEN;
 exports.XpFileSystem = XpFileSystem;

package/index.esm.js

@@ -1,4 +1,4 @@
-import { Module, Logger, applyDecorators, SetMetadata, HttpException, HttpStatus, BadRequestException, Injectable, Inject, NotFoundException, ForbiddenException } from '@nestjs/common';
+import { Module, Logger, applyDecorators, SetMetadata, HttpException, HttpStatus, BadRequestException, Injectable, Inject, Optional, UnauthorizedException, NotFoundException, ForbiddenException } from '@nestjs/common';
 import { MODULE_METADATA } from '@nestjs/common/constants';
 import { pick } from 'lodash-es';
 import { DiscoveryService, Reflector } from '@nestjs/core';
@@ -111,6 +111,11 @@ function __decorate(decorators, target, key, desc) {
     else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
+function __param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
 function __metadata(metadataKey, metadataValue) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
 }
@@ -1102,6 +1107,13 @@ function getRequiredPermissionOperation(method, permissionType) {
  * System token for resolving user permission service from plugin context.
  */ const USER_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_USER_PERMISSION_SERVICE';
 
+/**
+ * System token for resolving speech-to-text service from plugin context.
+ */ const SPEECH_TO_TEXT_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_SPEECH_TO_TEXT_PERMISSION_SERVICE';
+/**
+ * Internal system token used by core to expose the speech-to-text bridge.
+ */ const SPEECH_TO_TEXT_SERVICE_TOKEN = 'XPERT_SPEECH_TO_TEXT_SERVICE';
+
 async function createI18nInstance(pluginDir, language) {
     const instance = createInstance();
     const i18nDir = path__default.join(pluginDir, 'i18n');
@@ -1204,6 +1216,103 @@ class JsonSchemaValidator {
     }
 }
 
+const PLUGIN_WEBHOOK_AUTH_METADATA_KEY = 'xpert:plugin:webhook-auth';
+const PLUGIN_WEBHOOK_AUTH_SERVICE_TOKEN = 'XPERT_PLUGIN_WEBHOOK_AUTH_SERVICE';
+function PluginWebhookAuth(metadata = {}) {
+    return SetMetadata(PLUGIN_WEBHOOK_AUTH_METADATA_KEY, _extends({
+        integrationParam: 'id',
+        secretQueryParam: 'secret'
+    }, metadata));
+}
+let PluginWebhookAuthGuard = class PluginWebhookAuthGuard {
+    async canActivate(context) {
+        var _request_params, _request_query;
+        const metadata = this.resolveMetadata(context);
+        if (!metadata) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const integrationParam = metadata.integrationParam || 'id';
+        const secretQueryParam = metadata.secretQueryParam || 'secret';
+        const integrationId = this.getString((_request_params = request.params) == null ? void 0 : _request_params[integrationParam]);
+        const secret = this.getString((_request_query = request.query) == null ? void 0 : _request_query[secretQueryParam]);
+        if (!integrationId || !secret) {
+            throw new UnauthorizedException('Plugin webhook secret is required');
+        }
+        const authService = this.authService;
+        if (!authService) {
+            throw new UnauthorizedException('Plugin webhook auth service is not available');
+        }
+        const principalContext = await authService.validateWebhookSecret({
+            integrationId,
+            secret,
+            provider: metadata.provider
+        });
+        if (!(principalContext == null ? void 0 : principalContext.user) || !principalContext.headers) {
+            throw new UnauthorizedException('Plugin webhook secret is invalid');
+        }
+        request.user = principalContext.user;
+        var _request_headers;
+        request.headers = _extends({}, (_request_headers = request.headers) != null ? _request_headers : {}, principalContext.headers);
+        return true;
+    }
+    resolveMetadata(context) {
+        var _Reflect_getMetadata, _ref;
+        return (_ref = (_Reflect_getMetadata = Reflect.getMetadata(PLUGIN_WEBHOOK_AUTH_METADATA_KEY, context.getHandler())) != null ? _Reflect_getMetadata : Reflect.getMetadata(PLUGIN_WEBHOOK_AUTH_METADATA_KEY, context.getClass())) != null ? _ref : null;
+    }
+    getString(value) {
+        if (typeof value !== 'string') {
+            return '';
+        }
+        return value.trim();
+    }
+    constructor(authService){
+        this.authService = authService;
+    }
+};
+PluginWebhookAuthGuard = __decorate([
+    Injectable(),
+    __param(0, Optional()),
+    __param(0, Inject(PLUGIN_WEBHOOK_AUTH_SERVICE_TOKEN)),
+    __metadata("design:paramtypes", [
+        Object
+    ])
+], PluginWebhookAuthGuard);
+
+function createRuntimeCapability(id, options = {}) {
+    return Object.freeze({
+        id,
+        description: options.description
+    });
+}
+const XPERT_RUNTIME_CAPABILITIES_TOKEN = 'XPERT_RUNTIME_CAPABILITIES';
+class DefaultRuntimeCapabilityRegistry {
+    register(key, implementation) {
+        this.capabilities.set(runtimeCapabilityId(key), implementation);
+        return this;
+    }
+    has(key) {
+        return this.capabilities.has(runtimeCapabilityId(key));
+    }
+    get(key) {
+        return this.capabilities.get(runtimeCapabilityId(key));
+    }
+    require(key) {
+        const implementation = this.get(key);
+        if (!implementation) {
+            throw new Error(`Runtime capability '${runtimeCapabilityId(key)}' is not available`);
+        }
+        return implementation;
+    }
+    constructor(entries = []){
+        this.capabilities = new Map();
+        entries.forEach(([key, implementation])=>this.register(key, implementation));
+    }
+}
+function runtimeCapabilityId(key) {
+    return typeof key === 'string' ? key : key.id;
+}
+
 const DATASOURCE_STRATEGY = 'DATASOURCE_STRATEGY';
 const DataSourceStrategy = (provider)=>applyDecorators(SetMetadata(DATASOURCE_STRATEGY, provider), SetMetadata(STRATEGY_META_KEY, DATASOURCE_STRATEGY));
 
@@ -2579,6 +2688,18 @@ Reflect.defineMetadata(COMMAND_METADATA$1, {
     id: CreateModelClientCommand.type
 }, CreateModelClientCommand);
 
+const KnowledgebaseRuntimeCapability = createRuntimeCapability('platform.knowledgebase', {
+    description: 'List, search, and write chunks in platform knowledgebases.'
+});
+
+const KnowledgebaseDocumentsRuntimeCapability = createRuntimeCapability('platform.knowledgebase.documents', {
+    description: 'Upload, import, create, process, inspect, and delete persistent knowledgebase documents.'
+});
+
+const WorkspaceFilesRuntimeCapability = createRuntimeCapability('platform.workspace.files', {
+    description: 'Upload, read, and delete raw files in Xpert workspace volumes.'
+});
+
 const SKILL_SOURCE_PROVIDER = 'SKILL_SOURCE_PROVIDER';
 const SkillSourceProviderStrategy = (provider)=>applyDecorators(SetMetadata(SKILL_SOURCE_PROVIDER, provider), SetMetadata(STRATEGY_META_KEY, SKILL_SOURCE_PROVIDER));
 
@@ -2619,48 +2740,6 @@ AgentMiddlewareRegistry = __decorate([
     "end"
 ];
 
-function createRuntimeCapability(id, options = {}) {
-    return Object.freeze({
-        id,
-        description: options.description
-    });
-}
-const XPERT_RUNTIME_CAPABILITIES_TOKEN = 'XPERT_RUNTIME_CAPABILITIES';
-class DefaultAgentMiddlewareRuntimeCapabilityRegistry {
-    register(key, implementation) {
-        this.capabilities.set(runtimeCapabilityId(key), implementation);
-        return this;
-    }
-    has(key) {
-        return this.capabilities.has(runtimeCapabilityId(key));
-    }
-    get(key) {
-        return this.capabilities.get(runtimeCapabilityId(key));
-    }
-    require(key) {
-        const implementation = this.get(key);
-        if (!implementation) {
-            throw new Error(`Runtime capability '${runtimeCapabilityId(key)}' is not available`);
-        }
-        return implementation;
-    }
-    constructor(entries = []){
-        this.capabilities = new Map();
-        entries.forEach(([key, implementation])=>this.register(key, implementation));
-    }
-}
-function runtimeCapabilityId(key) {
-    return typeof key === 'string' ? key : key.id;
-}
-
-const KnowledgebaseRuntimeCapability = createRuntimeCapability('platform.knowledgebase', {
-    description: 'List, search, and write chunks in platform knowledgebases.'
-});
-
-const KnowledgebaseDocumentsRuntimeCapability = createRuntimeCapability('platform.knowledgebase.documents', {
-    description: 'Upload, import, create, process, inspect, and delete persistent knowledgebase documents.'
-});
-
 const AssistantTaskRuntimeCapability = createRuntimeCapability('platform.assistant_task', {
     description: 'Start asynchronous tasks on the current platform assistant.'
 });
@@ -4420,4 +4499,4 @@ function escapeHtmlAttribute(value) {
 
 const VIEW_EXTENSION_CACHE_SERVICE_TOKEN = 'XPERT_PLUGIN_VIEW_EXTENSION_CACHE_SERVICE';
 
-export { ACCOUNT_BINDING_PERMISSION_SERVICE_TOKEN, AGENT_CHAT_DISPATCH_MESSAGE_TYPE, AGENT_MIDDLEWARE_STRATEGY, AIModelProviderNotFoundException, AIModelProviderRegistry, AIModelProviderStrategy, AI_MODEL_PROVIDER, ANALYTICS_PERMISSION_SERVICE_TOKEN, AdapterDataSourceStrategy, AgentMiddlewareRegistry, AgentMiddlewareStrategy, AiModelNotFoundException, AssistantTaskRuntimeCapability, BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE_TOKEN, BaseHTTPQueryRunner, BaseQueryRunner, BaseSQLQueryRunner, BaseSandbox, BaseStrategyRegistry, BaseTool, BaseToolset, BuiltinToolset, CHAT_CHANNEL, CHAT_CHANNEL_TEXT_LIMITS, CancelConversationCommand, ChatChannel, ChatChannelRegistry, ChatOAICompatReasoningModel, CommonParameterRules, CreateModelClientCommand, CredentialsValidateFailedError, DATASOURCE_STRATEGY, DBCreateTableMode, DBProtocolEnum, DBSyntaxEnum, DBTableAction, DBTableDataAction, DEFAULT_EXECUTION_CONFIG, DEFAULT_SANDBOX_EXECUTION_MAX_OUTPUT_BYTES, DEFAULT_SANDBOX_FILE_OPERATION_EXECUTION_OPTIONS, DEFAULT_SANDBOX_FILE_OPERATION_TIMEOUT_MS, DEFAULT_SANDBOX_FILE_OPERATION_TIMEOUT_SEC, DEFAULT_SANDBOX_FILE_SEARCH_EXECUTION_OPTIONS, DEFAULT_SANDBOX_FILE_SEARCH_TIMEOUT_MS, DEFAULT_SANDBOX_FILE_SEARCH_TIMEOUT_SEC, DEFAULT_SANDBOX_SHELL_EXECUTION_OPTIONS, DEFAULT_SANDBOX_SHELL_TIMEOUT_MS, DEFAULT_SANDBOX_SHELL_TIMEOUT_SEC, DOCUMENT_SOURCE_STRATEGY, DOCUMENT_TRANSFORMER_STRATEGY, DataSourceStrategy, DataSourceStrategyRegistry, DefaultAgentMiddlewareRuntimeCapabilityRegistry, DocumentSourceRegistry, DocumentSourceStrategy, DocumentTransformerRegistry, DocumentTransformerStrategy, FILE_STORAGE_PROVIDER, FILE_UPLOAD_TARGET_STRATEGY, FileRuntimeCapability, FileStorageProvider, FileStorageProviderRegistry, FileUploadTargetRegistry, FileUploadTargetStrategy, GLOBAL_ORGANIZATION_SCOPE, HANDOFF_PERMISSION_SERVICE_TOKEN, HANDOFF_PROCESSOR_STRATEGY, HANDOFF_QUEUE_SERVICE_TOKEN, HandoffProcessorRegistry, HandoffProcessorStrategy, IMAGE_UNDERSTANDING_STRATEGY, INTEGRATION_PERMISSION_SERVICE_TOKEN, INTEGRATION_STRATEGY, ImageUnderstandingRegistry, ImageUnderstandingStrategy, IntegrationStrategyKey, IntegrationStrategyRegistry, JUMP_TO_TARGETS, JsonSchemaValidator, KNOWLEDGE_STRATEGY, KnowledgeStrategyKey, KnowledgeStrategyRegistry, KnowledgebaseDocumentsRuntimeCapability, KnowledgebaseRuntimeCapability, LLMUsage, LargeLanguageModel, ModelProvider, ORGANIZATION_METADATA_KEY, OpenAICompatibleReranker, PERMISSION_OPERATION_METADATA_KEY, PLUGIN_CONFIG_RESOLVER_TOKEN, PLUGIN_METADATA, PLUGIN_METADATA_KEY, PROVIDE_AI_MODEL_LLM, PROVIDE_AI_MODEL_MODERATION, PROVIDE_AI_MODEL_RERANK, PROVIDE_AI_MODEL_SPEECH2TEXT, PROVIDE_AI_MODEL_TEXT_EMBEDDING, PROVIDE_AI_MODEL_TTS, RETRIEVER_STRATEGY, RequestContext, RequestContextMiddleware, RequirePermissionOperation, RerankModel, RetrieverRegistry, RetrieverStrategy, SANDBOX_PROVIDER, SANDBOX_SHELL_TIMEOUT_LIMITS_SEC, SKILL_SOURCE_PROVIDER, SSOProviderRegistry, SSOProviderStrategyKey, SSO_BINDING_PERMISSION_SERVICE_TOKEN, SSO_PROVIDER, STRATEGY_META_KEY, SandboxProviderRegistry, SandboxProviderStrategy, SkillSourceProviderRegistry, SkillSourceProviderStrategy, Speech2TextChatModel, SpeechToTextModel, StrategyBus, TEXT_SPLITTER_STRATEGY, TOOLSET_STRATEGY, TextEmbeddingModelManager, TextSplitterRegistry, TextSplitterStrategy, TextToSpeechModel, ToolsetRegistry, ToolsetStrategy, USER_PERMISSION_SERVICE_TOKEN, VECTOR_STORE_STRATEGY, VIEW_EXTENSION_CACHE_SERVICE_TOKEN, VIEW_EXTENSION_PROVIDER, VectorStoreRegistry, VectorStoreStrategy, ViewExtensionProvider, ViewExtensionProviderRegistry, WORKFLOW_NODE_STRATEGY, WORKFLOW_TRIGGER_STRATEGY, WorkflowNodeRegistry, WorkflowNodeStrategy, WorkflowTriggerRegistry, WorkflowTriggerStrategy, WrapWorkflowNodeExecutionCommand, XPERT_RUNTIME_CAPABILITIES_TOKEN, XpFileSystem, XpertServerPlugin, als, appendSandboxMessage, buildSandboxTimeoutMessage, calcTokenUsage, chunkText, countTokensSafe, createI18nInstance, createPluginLogger, createRuntimeCapability, defineAgentMessageType, defineChannelMessageType, downloadRemoteFile, formatSandboxTimeout, getErrorMessage, getModelContextSize, getPermissionOperationMetadata, getPositionList, getPositionMap, getRequestContext, getRequiredPermissionOperation, isRemoteFile, isSandboxBackend, isSandboxManagedServiceAdapter, isSandboxServiceProxyAdapter, isSandboxTerminalAdapter, isStructuredMessageType, loadYamlFile, mergeCredentials, mergeParentChildChunks, normalizeContextSize, renderRemoteReactIframeHtml, resolveSandboxBackend, resolveSandboxExecutionOptions, resolveSandboxManagedServiceAdapter, resolveSandboxServiceProxyAdapter, resolveSandboxTerminalAdapter, runWithRequestContext, secondsToMilliseconds, sumTokenUsage };
+export { ACCOUNT_BINDING_PERMISSION_SERVICE_TOKEN, AGENT_CHAT_DISPATCH_MESSAGE_TYPE, AGENT_MIDDLEWARE_STRATEGY, AIModelProviderNotFoundException, AIModelProviderRegistry, AIModelProviderStrategy, AI_MODEL_PROVIDER, ANALYTICS_PERMISSION_SERVICE_TOKEN, AdapterDataSourceStrategy, AgentMiddlewareRegistry, AgentMiddlewareStrategy, AiModelNotFoundException, AssistantTaskRuntimeCapability, BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE_TOKEN, BaseHTTPQueryRunner, BaseQueryRunner, BaseSQLQueryRunner, BaseSandbox, BaseStrategyRegistry, BaseTool, BaseToolset, BuiltinToolset, CHAT_CHANNEL, CHAT_CHANNEL_TEXT_LIMITS, CancelConversationCommand, ChatChannel, ChatChannelRegistry, ChatOAICompatReasoningModel, CommonParameterRules, CreateModelClientCommand, CredentialsValidateFailedError, DATASOURCE_STRATEGY, DBCreateTableMode, DBProtocolEnum, DBSyntaxEnum, DBTableAction, DBTableDataAction, DEFAULT_EXECUTION_CONFIG, DEFAULT_SANDBOX_EXECUTION_MAX_OUTPUT_BYTES, DEFAULT_SANDBOX_FILE_OPERATION_EXECUTION_OPTIONS, DEFAULT_SANDBOX_FILE_OPERATION_TIMEOUT_MS, DEFAULT_SANDBOX_FILE_OPERATION_TIMEOUT_SEC, DEFAULT_SANDBOX_FILE_SEARCH_EXECUTION_OPTIONS, DEFAULT_SANDBOX_FILE_SEARCH_TIMEOUT_MS, DEFAULT_SANDBOX_FILE_SEARCH_TIMEOUT_SEC, DEFAULT_SANDBOX_SHELL_EXECUTION_OPTIONS, DEFAULT_SANDBOX_SHELL_TIMEOUT_MS, DEFAULT_SANDBOX_SHELL_TIMEOUT_SEC, DOCUMENT_SOURCE_STRATEGY, DOCUMENT_TRANSFORMER_STRATEGY, DataSourceStrategy, DataSourceStrategyRegistry, DefaultRuntimeCapabilityRegistry as DefaultAgentMiddlewareRuntimeCapabilityRegistry, DefaultRuntimeCapabilityRegistry, DocumentSourceRegistry, DocumentSourceStrategy, DocumentTransformerRegistry, DocumentTransformerStrategy, FILE_STORAGE_PROVIDER, FILE_UPLOAD_TARGET_STRATEGY, FileRuntimeCapability, FileStorageProvider, FileStorageProviderRegistry, FileUploadTargetRegistry, FileUploadTargetStrategy, GLOBAL_ORGANIZATION_SCOPE, HANDOFF_PERMISSION_SERVICE_TOKEN, HANDOFF_PROCESSOR_STRATEGY, HANDOFF_QUEUE_SERVICE_TOKEN, HandoffProcessorRegistry, HandoffProcessorStrategy, IMAGE_UNDERSTANDING_STRATEGY, INTEGRATION_PERMISSION_SERVICE_TOKEN, INTEGRATION_STRATEGY, ImageUnderstandingRegistry, ImageUnderstandingStrategy, IntegrationStrategyKey, IntegrationStrategyRegistry, JUMP_TO_TARGETS, JsonSchemaValidator, KNOWLEDGE_STRATEGY, KnowledgeStrategyKey, KnowledgeStrategyRegistry, KnowledgebaseDocumentsRuntimeCapability, KnowledgebaseRuntimeCapability, LLMUsage, LargeLanguageModel, ModelProvider, ORGANIZATION_METADATA_KEY, OpenAICompatibleReranker, PERMISSION_OPERATION_METADATA_KEY, PLUGIN_CONFIG_RESOLVER_TOKEN, PLUGIN_METADATA, PLUGIN_METADATA_KEY, PLUGIN_WEBHOOK_AUTH_METADATA_KEY, PLUGIN_WEBHOOK_AUTH_SERVICE_TOKEN, PROVIDE_AI_MODEL_LLM, PROVIDE_AI_MODEL_MODERATION, PROVIDE_AI_MODEL_RERANK, PROVIDE_AI_MODEL_SPEECH2TEXT, PROVIDE_AI_MODEL_TEXT_EMBEDDING, PROVIDE_AI_MODEL_TTS, PluginWebhookAuth, PluginWebhookAuthGuard, RETRIEVER_STRATEGY, RequestContext, RequestContextMiddleware, RequirePermissionOperation, RerankModel, RetrieverRegistry, RetrieverStrategy, SANDBOX_PROVIDER, SANDBOX_SHELL_TIMEOUT_LIMITS_SEC, SKILL_SOURCE_PROVIDER, SPEECH_TO_TEXT_PERMISSION_SERVICE_TOKEN, SPEECH_TO_TEXT_SERVICE_TOKEN, SSOProviderRegistry, SSOProviderStrategyKey, SSO_BINDING_PERMISSION_SERVICE_TOKEN, SSO_PROVIDER, STRATEGY_META_KEY, SandboxProviderRegistry, SandboxProviderStrategy, SkillSourceProviderRegistry, SkillSourceProviderStrategy, Speech2TextChatModel, SpeechToTextModel, StrategyBus, TEXT_SPLITTER_STRATEGY, TOOLSET_STRATEGY, TextEmbeddingModelManager, TextSplitterRegistry, TextSplitterStrategy, TextToSpeechModel, ToolsetRegistry, ToolsetStrategy, USER_PERMISSION_SERVICE_TOKEN, VECTOR_STORE_STRATEGY, VIEW_EXTENSION_CACHE_SERVICE_TOKEN, VIEW_EXTENSION_PROVIDER, VectorStoreRegistry, VectorStoreStrategy, ViewExtensionProvider, ViewExtensionProviderRegistry, WORKFLOW_NODE_STRATEGY, WORKFLOW_TRIGGER_STRATEGY, WorkflowNodeRegistry, WorkflowNodeStrategy, WorkflowTriggerRegistry, WorkflowTriggerStrategy, WorkspaceFilesRuntimeCapability, WrapWorkflowNodeExecutionCommand, XPERT_RUNTIME_CAPABILITIES_TOKEN, XpFileSystem, XpertServerPlugin, als, appendSandboxMessage, buildSandboxTimeoutMessage, calcTokenUsage, chunkText, countTokensSafe, createI18nInstance, createPluginLogger, createRuntimeCapability, defineAgentMessageType, defineChannelMessageType, downloadRemoteFile, formatSandboxTimeout, getErrorMessage, getModelContextSize, getPermissionOperationMetadata, getPositionList, getPositionMap, getRequestContext, getRequiredPermissionOperation, isRemoteFile, isSandboxBackend, isSandboxManagedServiceAdapter, isSandboxServiceProxyAdapter, isSandboxTerminalAdapter, isStructuredMessageType, loadYamlFile, mergeCredentials, mergeParentChildChunks, normalizeContextSize, renderRemoteReactIframeHtml, resolveSandboxBackend, resolveSandboxExecutionOptions, resolveSandboxManagedServiceAdapter, resolveSandboxServiceProxyAdapter, resolveSandboxTerminalAdapter, runWithRequestContext, secondsToMilliseconds, sumTokenUsage };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xpert-ai/plugin-sdk",
-  "version": "3.11.2",
+  "version": "3.12.1",
   "license": "AGPL-3.0",
   "repository": {
     "type": "git",

package/src/index.d.ts

@@ -11,6 +11,7 @@ export * from './lib/toolset/index';
 export * from './lib/core/index';
 export * from './lib/data/index';
 export * from './lib/ai-model/index';
+export * from './lib/runtime/index';
 export * from './lib/agent/index';
 export * from './lib/channel/index';
 export * from './lib/file/index';

package/src/lib/agent/middleware/capabilities/assistant-task.d.ts

@@ -42,4 +42,4 @@ export interface AgentMiddlewareAssistantTaskApi {
     startTask(input: AgentMiddlewareAssistantTaskInput): Promise<AgentMiddlewareAssistantTaskResult>;
     getTaskStatus?(input: AgentMiddlewareAssistantTaskStatusInput): Promise<AgentMiddlewareAssistantTaskResult | null>;
 }
-export declare const AssistantTaskRuntimeCapability: import("../runtime-capability").RuntimeCapabilityKey<AgentMiddlewareAssistantTaskApi>;
+export declare const AssistantTaskRuntimeCapability: import("../../../core/runtime-capability").RuntimeCapabilityKey<AgentMiddlewareAssistantTaskApi>;

package/src/lib/agent/middleware/capabilities/file.d.ts

@@ -26,4 +26,4 @@ export type AgentMiddlewareResolvedFile = {
 export interface AgentMiddlewareFileApi {
     resolveFile(input: AgentMiddlewareFileReference): Promise<AgentMiddlewareResolvedFile | null>;
 }
-export declare const FileRuntimeCapability: import("../runtime-capability").RuntimeCapabilityKey<AgentMiddlewareFileApi>;
+export declare const FileRuntimeCapability: import("../../../core/runtime-capability").RuntimeCapabilityKey<AgentMiddlewareFileApi>;

package/src/lib/agent/middleware/capabilities/index.d.ts

@@ -1,4 +1,2 @@
-export * from './knowledgebase';
-export * from './knowledgebase-documents';
 export * from './assistant-task';
 export * from './file';

package/src/lib/agent/middleware/runtime-capability.d.ts

@@ -1,22 +1,2 @@
-export type RuntimeCapabilityKey<T> = {
-    readonly id: string;
-    readonly description?: string;
-    readonly __type?: T;
-};
-export declare function createRuntimeCapability<T>(id: string, options?: {
-    description?: string;
-}): RuntimeCapabilityKey<T>;
-export interface AgentMiddlewareRuntimeCapabilityRegistry {
-    has<T>(key: RuntimeCapabilityKey<T> | string): boolean;
-    get<T>(key: RuntimeCapabilityKey<T> | string): T | undefined;
-    require<T>(key: RuntimeCapabilityKey<T> | string): T;
-}
-export declare const XPERT_RUNTIME_CAPABILITIES_TOKEN = "XPERT_RUNTIME_CAPABILITIES";
-export declare class DefaultAgentMiddlewareRuntimeCapabilityRegistry implements AgentMiddlewareRuntimeCapabilityRegistry {
-    private readonly capabilities;
-    constructor(entries?: Array<[RuntimeCapabilityKey<unknown> | string, unknown]>);
-    register<T>(key: RuntimeCapabilityKey<T> | string, implementation: T): this;
-    has<T>(key: RuntimeCapabilityKey<T> | string): boolean;
-    get<T>(key: RuntimeCapabilityKey<T> | string): T | undefined;
-    require<T>(key: RuntimeCapabilityKey<T> | string): T;
-}
+export { createRuntimeCapability, DefaultRuntimeCapabilityRegistry, DefaultRuntimeCapabilityRegistry as DefaultAgentMiddlewareRuntimeCapabilityRegistry, XPERT_RUNTIME_CAPABILITIES_TOKEN } from '../../core/runtime-capability';
+export type { RuntimeCapabilityKey, RuntimeCapabilityRegistry, RuntimeCapabilityRegistry as AgentMiddlewareRuntimeCapabilityRegistry } from '../../core/runtime-capability';

package/src/lib/agent/middleware/runtime.d.ts

@@ -6,7 +6,7 @@ import type { BaseMessage } from '@langchain/core/messages';
 import { ICopilotModel, ILLMUsage, IXpertAgentExecution, JSONValue, TSandboxConfigurable } from '@xpert-ai/contracts';
 import { Subscriber } from 'rxjs';
 import { IRerank } from '../../ai-model/types';
-import type { AgentMiddlewareRuntimeCapabilityRegistry } from './runtime-capability';
+import type { RuntimeCapabilityRegistry } from '../../core';
 export * from './runtime-capability';
 export * from './capabilities';
 /**
@@ -99,5 +99,5 @@ export interface AgentMiddlewareRuntimeApi {
     createModelClient<T = AgentMiddlewareModelClient>(copilotModel: ICopilotModel, options: AgentMiddlewareCreateModelClientOptions): Promise<T>;
     wrapWorkflowNodeExecution<T>(run: (execution: Partial<IXpertAgentExecution>) => Promise<AgentMiddlewareWrapWorkflowNodeExecutionResult<T>>, params: AgentMiddlewareWrapWorkflowNodeExecutionParams): Promise<T>;
     emitMiddlewareEvent?(event: AgentMiddlewareEvent): Promise<void> | void;
-    capabilities?: AgentMiddlewareRuntimeCapabilityRegistry;
+    capabilities?: RuntimeCapabilityRegistry;
 }

package/src/lib/core/index.d.ts

@@ -7,3 +7,5 @@ export * from './utils';
 export * from './context/index';
 export * from './types';
 export * from './strategy-bus';
+export * from './webhook';
+export * from './runtime-capability';

package/src/lib/core/permissions/general.d.ts

@@ -1,4 +1,5 @@
 import type { IIntegration, IPagination } from '@xpert-ai/contracts';
+import type { PluginWebhookCredentialResult } from '../webhook';
 /**
  * Base Permission type
  */
@@ -69,4 +70,14 @@ export declare const INTEGRATION_PERMISSION_SERVICE_TOKEN = "XPERT_PLUGIN_INTEGR
 export interface IntegrationPermissionService {
     read<TIntegration = IIntegration>(id: string, options?: Record<string, any>): Promise<TIntegration | null>;
     findAll<TIntegration = IIntegration>(options?: Record<string, any>): Promise<IPagination<TIntegration>>;
+    ensureWebhookCredential?(id: string, options?: {
+        provider?: string | null;
+        rotateIfRevoked?: boolean;
+    }): Promise<PluginWebhookCredentialResult | null>;
+    rotateWebhookCredential?(id: string, options?: {
+        provider?: string | null;
+    }): Promise<PluginWebhookCredentialResult | null>;
+    revokeWebhookCredential?(id: string, options?: {
+        provider?: string | null;
+    }): Promise<boolean>;
 }

package/src/lib/core/permissions/index.d.ts

@@ -14,17 +14,19 @@ export * from './auth-login';
 export * from './bound-identity-login';
 export * from './sso-binding';
 export * from './user';
+export * from './speech-to-text';
 import type { FileSystemPermission, IntegrationPermission, KnowledgePermission, LLMPermission, VectorStorePermission } from './general';
 import type { AnalyticsPermission } from './analytics';
 import type { AccountBindingPermission } from './account-binding';
 import type { BoundIdentityLoginPermission } from './bound-identity-login';
 import type { HandoffPermission } from './handoff';
+import type { SpeechToTextPermission } from './speech-to-text';
 import type { SsoBindingPermission } from './sso-binding';
 import type { UserPermission } from './user';
 /**
  * Union type for all permissions
  */
-export type Permission = LLMPermission | VectorStorePermission | KnowledgePermission | FileSystemPermission | IntegrationPermission | AnalyticsPermission | AccountBindingPermission | BoundIdentityLoginPermission | SsoBindingPermission | UserPermission | HandoffPermission;
+export type Permission = LLMPermission | VectorStorePermission | KnowledgePermission | FileSystemPermission | IntegrationPermission | AnalyticsPermission | AccountBindingPermission | BoundIdentityLoginPermission | SsoBindingPermission | UserPermission | HandoffPermission | SpeechToTextPermission;
 /**
  * Permissions array type
  */

package/src/lib/core/permissions/speech-to-text.d.ts

@@ -0,0 +1,41 @@
+export type SpeechToTextPermissionOperation = 'transcribe';
+/**
+ * Speech-to-text Permission
+ * Example: { type: 'speech_to_text', operations: ['transcribe'] }
+ */
+export interface SpeechToTextPermission {
+    type: 'speech_to_text';
+    operations?: SpeechToTextPermissionOperation[];
+    scope?: string[];
+    description?: string;
+}
+/**
+ * System token for resolving speech-to-text service from plugin context.
+ */
+export declare const SPEECH_TO_TEXT_PERMISSION_SERVICE_TOKEN = "XPERT_PLUGIN_SPEECH_TO_TEXT_PERMISSION_SERVICE";
+/**
+ * Internal system token used by core to expose the speech-to-text bridge.
+ */
+export declare const SPEECH_TO_TEXT_SERVICE_TOKEN = "XPERT_SPEECH_TO_TEXT_SERVICE";
+export interface SpeechToTextTranscribeFileInput {
+    data: Uint8Array;
+    originalName: string;
+    mimeType?: string;
+    size?: number;
+}
+export interface SpeechToTextTranscribeInput {
+    xpertId: string;
+    isDraft?: boolean;
+    tenantId?: string | null;
+    organizationId?: string | null;
+    file: SpeechToTextTranscribeFileInput;
+}
+export interface SpeechToTextTranscribeResult {
+    text: string;
+}
+/**
+ * Speech-to-text service exposed to plugins under permission control.
+ */
+export interface SpeechToTextPermissionService {
+    transcribe(input: SpeechToTextTranscribeInput): Promise<SpeechToTextTranscribeResult>;
+}

package/src/lib/core/runtime-capability.d.ts

@@ -0,0 +1,22 @@
+export type RuntimeCapabilityKey<T> = {
+    readonly id: string;
+    readonly description?: string;
+    readonly __type?: T;
+};
+export declare function createRuntimeCapability<T>(id: string, options?: {
+    description?: string;
+}): RuntimeCapabilityKey<T>;
+export interface RuntimeCapabilityRegistry {
+    has<T>(key: RuntimeCapabilityKey<T> | string): boolean;
+    get<T>(key: RuntimeCapabilityKey<T> | string): T | undefined;
+    require<T>(key: RuntimeCapabilityKey<T> | string): T;
+}
+export declare const XPERT_RUNTIME_CAPABILITIES_TOKEN = "XPERT_RUNTIME_CAPABILITIES";
+export declare class DefaultRuntimeCapabilityRegistry implements RuntimeCapabilityRegistry {
+    private readonly capabilities;
+    constructor(entries?: Array<[RuntimeCapabilityKey<unknown> | string, unknown]>);
+    register<T>(key: RuntimeCapabilityKey<T> | string, implementation: T): this;
+    has<T>(key: RuntimeCapabilityKey<T> | string): boolean;
+    get<T>(key: RuntimeCapabilityKey<T> | string): T | undefined;
+    require<T>(key: RuntimeCapabilityKey<T> | string): T;
+}

package/src/lib/core/webhook.d.ts

@@ -0,0 +1,41 @@
+import type { IApiPrincipal } from '@xpert-ai/contracts';
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+export declare const PLUGIN_WEBHOOK_AUTH_METADATA_KEY = "xpert:plugin:webhook-auth";
+export declare const PLUGIN_WEBHOOK_AUTH_SERVICE_TOKEN = "XPERT_PLUGIN_WEBHOOK_AUTH_SERVICE";
+export type PluginWebhookAuthMetadata = {
+    provider?: string;
+    integrationParam?: string;
+    secretQueryParam?: string;
+};
+export type PluginWebhookCredentialRecord = {
+    id: string;
+    tokenHash: string;
+    tokenPrefix?: string;
+    createdAt: string;
+    rotatedAt?: string | null;
+    revokedAt?: string | null;
+};
+export type PluginWebhookCredentialResult = {
+    token: string;
+    credential: PluginWebhookCredentialRecord;
+};
+export type PluginWebhookAuthRequest = {
+    integrationId: string;
+    secret: string;
+    provider?: string | null;
+};
+export type PluginWebhookAuthResult = {
+    user: IApiPrincipal;
+    headers: Record<string, string>;
+};
+export interface PluginWebhookAuthService {
+    validateWebhookSecret(input: PluginWebhookAuthRequest): Promise<PluginWebhookAuthResult | null>;
+}
+export declare function PluginWebhookAuth(metadata?: PluginWebhookAuthMetadata): import("@nestjs/common").CustomDecorator<string>;
+export declare class PluginWebhookAuthGuard implements CanActivate {
+    private readonly authService?;
+    constructor(authService?: PluginWebhookAuthService | null);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private resolveMetadata;
+    private getString;
+}

package/src/lib/runtime/capabilities/index.d.ts

@@ -0,0 +1,3 @@
+export * from './knowledgebase';
+export * from './knowledgebase-documents';
+export * from './workspace-files';

package/src/lib/runtime/capabilities/knowledgebase-documents.d.ts

@@ -0,0 +1,121 @@
+import { JSONValue } from '@xpert-ai/contracts';
+export type KnowledgebaseDocumentFile = {
+    buffer: Buffer;
+    originalname?: string;
+    mimetype?: string;
+    size?: number;
+};
+export type KnowledgebaseDocumentMetadata = Record<string, JSONValue>;
+export type KnowledgebaseDocumentParserConfig = Record<string, JSONValue>;
+export type KnowledgebaseDocumentDraft = {
+    id?: string;
+    name?: string;
+    type?: string;
+    category?: string;
+    sourceType?: string;
+    sourceConfig?: Record<string, JSONValue>;
+    filePath?: string;
+    fileUrl?: string;
+    mimeType?: string;
+    size?: string | number;
+    parentId?: string;
+    parserConfig?: KnowledgebaseDocumentParserConfig;
+    metadata?: KnowledgebaseDocumentMetadata;
+};
+export type KnowledgebaseDocumentRecord = {
+    id: string;
+    name?: string;
+    type?: string;
+    category?: string | null;
+    sourceType?: string | null;
+    filePath?: string;
+    fileUrl?: string;
+    mimeType?: string;
+    size?: string | number;
+    status?: string | null;
+    progress?: number | null;
+    processMsg?: string | null;
+    knowledgebaseId?: string;
+    metadata?: KnowledgebaseDocumentMetadata;
+};
+export type KnowledgebaseUploadFileInput = {
+    knowledgebaseId: string;
+    file: KnowledgebaseDocumentFile;
+    path?: string;
+    parentId?: string;
+};
+export type KnowledgebaseUploadedFile = {
+    name: string;
+    filePath: string;
+    fileUrl: string;
+    mimeType?: string;
+    size?: number;
+    sourceHash?: string;
+};
+export type KnowledgebaseCreateDocumentsInput = {
+    knowledgebaseId: string;
+    documents: KnowledgebaseDocumentDraft[];
+    parserConfig?: KnowledgebaseDocumentParserConfig;
+    metadata?: KnowledgebaseDocumentMetadata;
+    process?: boolean;
+};
+export type KnowledgebaseCreateDocumentsResult = {
+    documents: KnowledgebaseDocumentRecord[];
+    processingStarted?: boolean;
+};
+export type KnowledgebaseImportArchiveInput = {
+    knowledgebaseId: string;
+    file: KnowledgebaseDocumentFile;
+    path?: string;
+    parentId?: string;
+    packageId?: string;
+    packageCode?: string;
+    parserConfig?: KnowledgebaseDocumentParserConfig;
+    metadata?: KnowledgebaseDocumentMetadata;
+    process?: boolean;
+    maxEntries?: number;
+    maxEntrySizeBytes?: number;
+    maxDepth?: number;
+    supportedExtensions?: string[];
+};
+export type KnowledgebaseImportArchiveResult = {
+    archive: KnowledgebaseUploadedFile;
+    documents: KnowledgebaseDocumentRecord[];
+    skipped: Array<{
+        path: string;
+        reason: string;
+    }>;
+    warnings: string[];
+    processingStarted?: boolean;
+    unsupported?: boolean;
+};
+export type KnowledgebaseStartProcessingInput = {
+    knowledgebaseId?: string;
+    documentIds: string[];
+};
+export type KnowledgebaseDocumentStatusInput = {
+    knowledgebaseId?: string;
+    documentIds: string[];
+};
+export type KnowledgebaseDocumentStatusResult = {
+    documents: KnowledgebaseDocumentRecord[];
+};
+export type KnowledgebaseDeleteDocumentsInput = {
+    knowledgebaseId?: string;
+    documentIds: string[];
+};
+export type KnowledgebaseDeleteDocumentsResult = {
+    knowledgebaseId?: string;
+    documentIds: string[];
+    deletedDocumentCount: number;
+    missingDocumentIds?: string[];
+};
+export interface KnowledgebaseDocumentsApi {
+    uploadFile(input: KnowledgebaseUploadFileInput): Promise<KnowledgebaseUploadedFile>;
+    importArchive(input: KnowledgebaseImportArchiveInput): Promise<KnowledgebaseImportArchiveResult>;
+    createDocuments(input: KnowledgebaseCreateDocumentsInput): Promise<KnowledgebaseCreateDocumentsResult>;
+    startProcessing(input: KnowledgebaseStartProcessingInput): Promise<KnowledgebaseDocumentStatusResult>;
+    getDocumentStatus(input: KnowledgebaseDocumentStatusInput): Promise<KnowledgebaseDocumentStatusResult>;
+    deleteDocuments(input: KnowledgebaseDeleteDocumentsInput): Promise<KnowledgebaseDeleteDocumentsResult>;
+}
+export declare const KnowledgebaseDocumentsRuntimeCapability: import("../../core/runtime-capability").RuntimeCapabilityKey<KnowledgebaseDocumentsApi>;

package/src/lib/{agent/middleware → runtime}/capabilities/knowledgebase.d.ts

@@ -1,36 +1,36 @@
 import { JSONValue } from '@xpert-ai/contracts';
-export type AgentMiddlewareKnowledgebaseRetrievalMode = 'vector' | 'graph' | 'hybrid';
-export type AgentMiddlewareKnowledgebaseMetadata = Record<string, JSONValue>;
-export type AgentMiddlewareKnowledgebaseRetrievalSettings = {
-    mode?: AgentMiddlewareKnowledgebaseRetrievalMode;
+export type KnowledgebaseRetrievalMode = 'vector' | 'graph' | 'hybrid';
+export type KnowledgebaseMetadata = Record<string, JSONValue>;
+export type KnowledgebaseRetrievalSettings = {
+    mode?: KnowledgebaseRetrievalMode;
     neighborHops?: number;
     entityTopK?: number;
     communityTopK?: number;
     graphWeight?: number;
 };
-export type AgentMiddlewareKnowledgebaseSearchInput = {
+export type KnowledgebaseSearchInput = {
     tenantId?: string;
     organizationId?: string;
     knowledgebaseIds: string[];
     query: string;
     k?: number;
     score?: number;
-    filter?: AgentMiddlewareKnowledgebaseMetadata;
-    retrieval?: AgentMiddlewareKnowledgebaseRetrievalSettings;
+    filter?: KnowledgebaseMetadata;
+    retrieval?: KnowledgebaseRetrievalSettings;
     source: string;
     requestId?: string;
 };
-export type AgentMiddlewareKnowledgebaseDocument = {
+export type KnowledgebaseDocument = {
     id?: string;
     pageContent: string;
     metadata?: Record<string, unknown>;
 };
-export type AgentMiddlewareKnowledgebaseListInput = {
+export type KnowledgebaseListInput = {
     workspaceId?: string | null;
     published?: boolean;
     limit?: number;
 };
-export type AgentMiddlewareKnowledgebaseListItem = {
+export type KnowledgebaseListItem = {
     id: string;
     name?: string;
     description?: string | null;
@@ -46,24 +46,24 @@ export type AgentMiddlewareKnowledgebaseListItem = {
     } | null;
     graphStatus?: string | null;
 };
-export type AgentMiddlewareKnowledgebaseWriteChunkInput = {
+export type KnowledgebaseWriteChunkInput = {
     xpertId: string;
     agentKey: string;
     knowledgebaseIds: string[];
     knowledgebaseId: string;
     text: string;
     title?: string;
-    metadata?: AgentMiddlewareKnowledgebaseMetadata;
+    metadata?: KnowledgebaseMetadata;
     writeKey: string;
     executionId?: string;
     threadId?: string;
 };
-export type AgentMiddlewareKnowledgebaseWriteChunkResult = {
+export type KnowledgebaseWriteChunkResult = {
     status?: 'created' | 'skipped';
     chunkId?: string;
     message?: string;
 };
-export type AgentMiddlewareKnowledgebaseDeleteChunksInput = {
+export type KnowledgebaseDeleteChunksInput = {
     xpertId: string;
     agentKey: string;
     knowledgebaseIds: string[];
@@ -71,17 +71,17 @@ export type AgentMiddlewareKnowledgebaseDeleteChunksInput = {
     writeKeys?: string[];
     writeKeyPrefix?: string;
 };
-export type AgentMiddlewareKnowledgebaseDeleteChunksResult = {
+export type KnowledgebaseDeleteChunksResult = {
     deletedCount: number;
     knowledgebaseId: string;
     documentId?: string;
     writeKeys?: string[];
     writeKeyPrefix?: string;
 };
-export interface AgentMiddlewareKnowledgebaseApi {
-    list(input: AgentMiddlewareKnowledgebaseListInput): Promise<AgentMiddlewareKnowledgebaseListItem[]>;
-    search(input: AgentMiddlewareKnowledgebaseSearchInput): Promise<AgentMiddlewareKnowledgebaseDocument[]>;
-    writeChunk(input: AgentMiddlewareKnowledgebaseWriteChunkInput): Promise<AgentMiddlewareKnowledgebaseWriteChunkResult>;
-    deleteChunks(input: AgentMiddlewareKnowledgebaseDeleteChunksInput): Promise<AgentMiddlewareKnowledgebaseDeleteChunksResult>;
+export interface KnowledgebaseApi {
+    list(input: KnowledgebaseListInput): Promise<KnowledgebaseListItem[]>;
+    search(input: KnowledgebaseSearchInput): Promise<KnowledgebaseDocument[]>;
+    writeChunk(input: KnowledgebaseWriteChunkInput): Promise<KnowledgebaseWriteChunkResult>;
+    deleteChunks(input: KnowledgebaseDeleteChunksInput): Promise<KnowledgebaseDeleteChunksResult>;
 }
-export declare const KnowledgebaseRuntimeCapability: import("../runtime-capability").RuntimeCapabilityKey<AgentMiddlewareKnowledgebaseApi>;
+export declare const KnowledgebaseRuntimeCapability: import("../../core/runtime-capability").RuntimeCapabilityKey<KnowledgebaseApi>;

package/src/lib/runtime/capabilities/workspace-files.d.ts

@@ -0,0 +1,45 @@
+export type WorkspaceFileCatalog = 'projects' | 'users' | 'knowledges' | 'skills' | 'xperts';
+export type WorkspaceFileScope = {
+    tenantId?: string | null;
+    userId?: string | null;
+    catalog?: WorkspaceFileCatalog | null;
+    scopeId?: string | null;
+    projectId?: string | null;
+    knowledgeId?: string | null;
+    rootId?: string | null;
+    xpertId?: string | null;
+    isolateByUser?: boolean | null;
+};
+export type WorkspaceUploadBufferInput = WorkspaceFileScope & {
+    buffer: Buffer;
+    originalName: string;
+    mimeType?: string | null;
+    size?: number | null;
+    folder?: string | null;
+    fileName?: string | null;
+    metadata?: Record<string, unknown>;
+};
+export type WorkspaceFileReference = WorkspaceFileScope & {
+    filePath: string;
+};
+export type WorkspaceFile = {
+    name: string;
+    filePath: string;
+    workspacePath: string;
+    fileUrl?: string;
+    url?: string;
+    mimeType?: string;
+    size?: number;
+    catalog: WorkspaceFileCatalog;
+    scopeId?: string;
+    metadata?: Record<string, unknown>;
+};
+export type WorkspaceFileBuffer = WorkspaceFile & {
+    buffer: Buffer;
+};
+export interface WorkspaceFilesApi {
+    uploadBuffer(input: WorkspaceUploadBufferInput): Promise<WorkspaceFile>;
+    readBuffer(input: WorkspaceFileReference): Promise<WorkspaceFileBuffer>;
+    deleteFile(input: WorkspaceFileReference): Promise<void>;
+}
+export declare const WorkspaceFilesRuntimeCapability: import("../../core/runtime-capability").RuntimeCapabilityKey<WorkspaceFilesApi>;

package/src/lib/runtime/index.d.ts

@@ -0,0 +1,2 @@
+export * from './runtime-capability';
+export * from './capabilities';

package/src/lib/runtime/runtime-capability.d.ts

@@ -0,0 +1 @@
+export * from '../core/runtime-capability';

package/src/lib/agent/middleware/capabilities/knowledgebase-documents.d.ts

@@ -1,121 +0,0 @@
-import { JSONValue } from '@xpert-ai/contracts';
-export type AgentMiddlewareKnowledgebaseDocumentFile = {
-    buffer: Buffer;
-    originalname?: string;
-    mimetype?: string;
-    size?: number;
-};
-export type AgentMiddlewareKnowledgebaseDocumentMetadata = Record<string, JSONValue>;
-export type AgentMiddlewareKnowledgebaseDocumentParserConfig = Record<string, JSONValue>;
-export type AgentMiddlewareKnowledgebaseDocumentDraft = {
-    id?: string;
-    name?: string;
-    type?: string;
-    category?: string;
-    sourceType?: string;
-    sourceConfig?: Record<string, JSONValue>;
-    filePath?: string;
-    fileUrl?: string;
-    mimeType?: string;
-    size?: string | number;
-    parentId?: string;
-    parserConfig?: AgentMiddlewareKnowledgebaseDocumentParserConfig;
-    metadata?: AgentMiddlewareKnowledgebaseDocumentMetadata;
-};
-export type AgentMiddlewareKnowledgebaseDocumentRecord = {
-    id: string;
-    name?: string;
-    type?: string;
-    category?: string | null;
-    sourceType?: string | null;
-    filePath?: string;
-    fileUrl?: string;
-    mimeType?: string;
-    size?: string | number;
-    status?: string | null;
-    progress?: number | null;
-    processMsg?: string | null;
-    knowledgebaseId?: string;
-    metadata?: AgentMiddlewareKnowledgebaseDocumentMetadata;
-};
-export type AgentMiddlewareKnowledgebaseUploadFileInput = {
-    knowledgebaseId: string;
-    file: AgentMiddlewareKnowledgebaseDocumentFile;
-    path?: string;
-    parentId?: string;
-};
-export type AgentMiddlewareKnowledgebaseUploadedFile = {
-    name: string;
-    filePath: string;
-    fileUrl: string;
-    mimeType?: string;
-    size?: number;
-    sourceHash?: string;
-};
-export type AgentMiddlewareKnowledgebaseCreateDocumentsInput = {
-    knowledgebaseId: string;
-    documents: AgentMiddlewareKnowledgebaseDocumentDraft[];
-    parserConfig?: AgentMiddlewareKnowledgebaseDocumentParserConfig;
-    metadata?: AgentMiddlewareKnowledgebaseDocumentMetadata;
-    process?: boolean;
-};
-export type AgentMiddlewareKnowledgebaseCreateDocumentsResult = {
-    documents: AgentMiddlewareKnowledgebaseDocumentRecord[];
-    processingStarted?: boolean;
-};
-export type AgentMiddlewareKnowledgebaseImportArchiveInput = {
-    knowledgebaseId: string;
-    file: AgentMiddlewareKnowledgebaseDocumentFile;
-    path?: string;
-    parentId?: string;
-    packageId?: string;
-    packageCode?: string;
-    parserConfig?: AgentMiddlewareKnowledgebaseDocumentParserConfig;
-    metadata?: AgentMiddlewareKnowledgebaseDocumentMetadata;
-    process?: boolean;
-    maxEntries?: number;
-    maxEntrySizeBytes?: number;
-    maxDepth?: number;
-    supportedExtensions?: string[];
-};
-export type AgentMiddlewareKnowledgebaseImportArchiveResult = {
-    archive: AgentMiddlewareKnowledgebaseUploadedFile;
-    documents: AgentMiddlewareKnowledgebaseDocumentRecord[];
-    skipped: Array<{
-        path: string;
-        reason: string;
-    }>;
-    warnings: string[];
-    processingStarted?: boolean;
-    unsupported?: boolean;
-};
-export type AgentMiddlewareKnowledgebaseStartProcessingInput = {
-    knowledgebaseId?: string;
-    documentIds: string[];
-};
-export type AgentMiddlewareKnowledgebaseDocumentStatusInput = {
-    knowledgebaseId?: string;
-    documentIds: string[];
-};
-export type AgentMiddlewareKnowledgebaseDocumentStatusResult = {
-    documents: AgentMiddlewareKnowledgebaseDocumentRecord[];
-};
-export type AgentMiddlewareKnowledgebaseDeleteDocumentsInput = {
-    knowledgebaseId?: string;
-    documentIds: string[];
-};
-export type AgentMiddlewareKnowledgebaseDeleteDocumentsResult = {
-    knowledgebaseId?: string;
-    documentIds: string[];
-    deletedDocumentCount: number;
-    missingDocumentIds?: string[];
-};
-export interface AgentMiddlewareKnowledgebaseDocumentsApi {
-    uploadFile(input: AgentMiddlewareKnowledgebaseUploadFileInput): Promise<AgentMiddlewareKnowledgebaseUploadedFile>;
-    importArchive(input: AgentMiddlewareKnowledgebaseImportArchiveInput): Promise<AgentMiddlewareKnowledgebaseImportArchiveResult>;
-    createDocuments(input: AgentMiddlewareKnowledgebaseCreateDocumentsInput): Promise<AgentMiddlewareKnowledgebaseCreateDocumentsResult>;
-    startProcessing(input: AgentMiddlewareKnowledgebaseStartProcessingInput): Promise<AgentMiddlewareKnowledgebaseDocumentStatusResult>;
-    getDocumentStatus(input: AgentMiddlewareKnowledgebaseDocumentStatusInput): Promise<AgentMiddlewareKnowledgebaseDocumentStatusResult>;
-    deleteDocuments(input: AgentMiddlewareKnowledgebaseDeleteDocumentsInput): Promise<AgentMiddlewareKnowledgebaseDeleteDocumentsResult>;
-}
-export declare const KnowledgebaseDocumentsRuntimeCapability: import("../runtime-capability").RuntimeCapabilityKey<AgentMiddlewareKnowledgebaseDocumentsApi>;