@zhama/tego-plugin-sdk 0.0.0-stage → 1.36.0

package/dist/catalog-CSSbrfEf.d.ts

@@ -0,0 +1,361 @@
+import { z } from 'zod';
+
+/**
+ * The access catalog: everything a plugin declares about its own permissions.
+ *
+ * One JSON document per plugin (`access.json`, referenced from the manifest's
+ * `access.catalog`), read the same way by the TypeScript and the Python
+ * runtime. It is data rather than code so the pack step can validate it for
+ * either runtime, and so a TypeScript plugin importing it still gets its
+ * permission keys as literal types — JSON imports keep property names.
+ *
+ * What lives here is the *vocabulary*: permissions, their scope ladders, the
+ * roles the plugin ships, which host roles map onto them, and who a user is
+ * when nobody assigned them anything. Who holds which custom role is tenant
+ * data and lives in the `tego_access_*` tables.
+ */
+
+/**
+ * The actions a person can delegate to a digital employee.
+ *
+ * Mirrors `PluginUserContext.delegation.actions`; widening that union widens
+ * this one, and the catalog then accepts the new action.
+ */
+declare const DELEGATION_ACTIONS: readonly ["records.read", "work.prepare"];
+type DelegationAction = (typeof DELEGATION_ACTIONS)[number];
+/** Permissions every catalog has, owned by the SDK's admin API. */
+declare const RESERVED_PERMISSIONS: {
+    readonly manage: "access.manage";
+    readonly audit: "access.audit";
+};
+declare const RESERVED_GROUP = "access";
+/**
+ * The host role that must always be able to manage access.
+ *
+ * A tenant's administrators install plugins; a catalog that left them unable
+ * to reach the access settings would leave a tenant with no way back in once
+ * the last plugin-side manager was removed.
+ */
+declare const HOST_ADMIN_ROLE = "admin";
+/** Built-in principal kinds; a catalog may add its own (CRM's departments). */
+declare const BUILTIN_PRINCIPAL_KINDS: readonly ["user", "unit"];
+/** The pseudo domain type naming global assignments in role limits. */
+declare const GLOBAL_DOMAIN = "global";
+declare const accessCatalogSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    /** Bumped by the plugin when the meaning of the catalog changes. */
+    version: z.ZodNumber;
+    groups: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        labelKey: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        key: string;
+        labelKey: string;
+    }, {
+        key: string;
+        labelKey: string;
+    }>, "many">;
+    scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        labelKey: z.ZodString;
+        descriptionKey: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        labelKey: string;
+        descriptionKey?: string | undefined;
+    }, {
+        labelKey: string;
+        descriptionKey?: string | undefined;
+    }>>>;
+    permissions: z.ZodRecord<z.ZodString, z.ZodObject<{
+        group: z.ZodString;
+        labelKey: z.ZodString;
+        descriptionKey: z.ZodOptional<z.ZodString>;
+        /** Ordered from narrowest to widest; holding one includes those before it. */
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        implies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Absent means a digital employee never holds this permission. */
+        agent: z.ZodOptional<z.ZodUnion<[z.ZodObject<{
+            allowed: z.ZodLiteral<false>;
+        }, "strict", z.ZodTypeAny, {
+            allowed: false;
+        }, {
+            allowed: false;
+        }>, z.ZodObject<{
+            requires: z.ZodArray<z.ZodEnum<["records.read", "work.prepare"]>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            requires: ("records.read" | "work.prepare")[];
+        }, {
+            requires: ("records.read" | "work.prepare")[];
+        }>]>>;
+        /** Still honoured on existing roles; no longer offered for new grants. */
+        deprecated: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        group: string;
+        labelKey: string;
+        descriptionKey?: string | undefined;
+        scopes?: string[] | undefined;
+        implies?: string[] | undefined;
+        agent?: {
+            allowed: false;
+        } | {
+            requires: ("records.read" | "work.prepare")[];
+        } | undefined;
+        deprecated?: boolean | undefined;
+    }, {
+        group: string;
+        labelKey: string;
+        descriptionKey?: string | undefined;
+        scopes?: string[] | undefined;
+        implies?: string[] | undefined;
+        agent?: {
+            allowed: false;
+        } | {
+            requires: ("records.read" | "work.prepare")[];
+        } | undefined;
+        deprecated?: boolean | undefined;
+    }>>;
+    /**
+     * Navigation key → the permission that reveals it, or a list of which any
+     * one does. Unlisted keys are always shown.
+     */
+    menus: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>>;
+    roles: z.ZodRecord<z.ZodString, z.ZodObject<{
+        nameKey: z.ZodString;
+        descriptionKey: z.ZodOptional<z.ZodString>;
+        grants: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodLiteral<true>, z.ZodString]>>;
+        /** `host-admin`: only someone managing access through a host role may assign it. */
+        assignableBy: z.ZodOptional<z.ZodEnum<["access-manager", "host-admin"]>>;
+        /** Not counted against `assignment.maxRolesPerPrincipal`. */
+        exemptFromRoleLimit: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        nameKey: string;
+        grants: Record<string, string | true>;
+        descriptionKey?: string | undefined;
+        assignableBy?: "access-manager" | "host-admin" | undefined;
+        exemptFromRoleLimit?: boolean | undefined;
+    }, {
+        nameKey: string;
+        grants: Record<string, string | true>;
+        descriptionKey?: string | undefined;
+        assignableBy?: "access-manager" | "host-admin" | undefined;
+        exemptFromRoleLimit?: boolean | undefined;
+    }>>;
+    /** Host role name → the built-in roles every holder of it has. */
+    hostRoleBindings: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>;
+    defaults: z.ZodObject<{
+        /** The built-in role of a user nobody assigned anything, or null for none. */
+        unassigned: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        unassigned: string | null;
+    }, {
+        unassigned: string | null;
+    }>;
+    domains: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        labelKey: z.ZodString;
+        hierarchical: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        labelKey: string;
+        hierarchical?: boolean | undefined;
+    }, {
+        labelKey: string;
+        hierarchical?: boolean | undefined;
+    }>>>;
+    assignment: z.ZodObject<{
+        principals: z.ZodArray<z.ZodString, "many">;
+        /** Per domain type (or `global`): direct roles one user may hold there. */
+        maxRolesPerPrincipal: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    }, "strict", z.ZodTypeAny, {
+        principals: string[];
+        maxRolesPerPrincipal?: Record<string, number> | undefined;
+    }, {
+        principals: string[];
+        maxRolesPerPrincipal?: Record<string, number> | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    version: number;
+    permissions: Record<string, {
+        group: string;
+        labelKey: string;
+        descriptionKey?: string | undefined;
+        scopes?: string[] | undefined;
+        implies?: string[] | undefined;
+        agent?: {
+            allowed: false;
+        } | {
+            requires: ("records.read" | "work.prepare")[];
+        } | undefined;
+        deprecated?: boolean | undefined;
+    }>;
+    groups: {
+        key: string;
+        labelKey: string;
+    }[];
+    roles: Record<string, {
+        nameKey: string;
+        grants: Record<string, string | true>;
+        descriptionKey?: string | undefined;
+        assignableBy?: "access-manager" | "host-admin" | undefined;
+        exemptFromRoleLimit?: boolean | undefined;
+    }>;
+    hostRoleBindings: Record<string, string[]>;
+    defaults: {
+        unassigned: string | null;
+    };
+    assignment: {
+        principals: string[];
+        maxRolesPerPrincipal?: Record<string, number> | undefined;
+    };
+    scopes?: Record<string, {
+        labelKey: string;
+        descriptionKey?: string | undefined;
+    }> | undefined;
+    $schema?: string | undefined;
+    menus?: Record<string, string | string[]> | undefined;
+    domains?: Record<string, {
+        labelKey: string;
+        hierarchical?: boolean | undefined;
+    }> | undefined;
+}, {
+    version: number;
+    permissions: Record<string, {
+        group: string;
+        labelKey: string;
+        descriptionKey?: string | undefined;
+        scopes?: string[] | undefined;
+        implies?: string[] | undefined;
+        agent?: {
+            allowed: false;
+        } | {
+            requires: ("records.read" | "work.prepare")[];
+        } | undefined;
+        deprecated?: boolean | undefined;
+    }>;
+    groups: {
+        key: string;
+        labelKey: string;
+    }[];
+    roles: Record<string, {
+        nameKey: string;
+        grants: Record<string, string | true>;
+        descriptionKey?: string | undefined;
+        assignableBy?: "access-manager" | "host-admin" | undefined;
+        exemptFromRoleLimit?: boolean | undefined;
+    }>;
+    hostRoleBindings: Record<string, string[]>;
+    defaults: {
+        unassigned: string | null;
+    };
+    assignment: {
+        principals: string[];
+        maxRolesPerPrincipal?: Record<string, number> | undefined;
+    };
+    scopes?: Record<string, {
+        labelKey: string;
+        descriptionKey?: string | undefined;
+    }> | undefined;
+    $schema?: string | undefined;
+    menus?: Record<string, string | string[]> | undefined;
+    domains?: Record<string, {
+        labelKey: string;
+        hierarchical?: boolean | undefined;
+    }> | undefined;
+}>;
+type AccessCatalogInput = z.input<typeof accessCatalogSchema>;
+type GrantValue = true | string;
+type Grants = Record<string, GrantValue>;
+type AgentPolicy = {
+    allowed: false;
+} | {
+    allowed: true;
+    requires: DelegationAction[];
+};
+interface CatalogPermission {
+    key: string;
+    group: string;
+    labelKey: string;
+    descriptionKey?: string;
+    /** Null for a permission without scopes. */
+    scopes: string[] | null;
+    implies: string[];
+    agent: AgentPolicy;
+    deprecated: boolean;
+    /** Owned by the SDK (`access.*`), present in every catalog. */
+    reserved: boolean;
+}
+interface CatalogRole {
+    key: string;
+    nameKey: string;
+    descriptionKey?: string;
+    grants: Grants;
+    assignableBy: 'access-manager' | 'host-admin';
+    exemptFromRoleLimit: boolean;
+}
+/** The validated catalog the engine and the admin API run on. */
+interface AccessCatalog {
+    version: number;
+    groups: {
+        key: string;
+        labelKey: string;
+    }[];
+    scopes: Record<string, {
+        labelKey: string;
+        descriptionKey?: string | undefined;
+    }>;
+    permissions: Record<string, CatalogPermission>;
+    /** Navigation key → the permissions of which any one reveals it. */
+    menus: Record<string, string[]>;
+    roles: Record<string, CatalogRole>;
+    hostRoleBindings: Record<string, string[]>;
+    defaults: {
+        unassigned: string | null;
+    };
+    domains: Record<string, {
+        labelKey: string;
+        hierarchical: boolean;
+    }>;
+    assignment: {
+        principals: string[];
+        maxRolesPerPrincipal: Record<string, number>;
+    };
+}
+/** A catalog whose permission keys are known to the compiler. */
+type TypedAccessCatalog<P extends string> = AccessCatalog & {
+    readonly __permission?: P;
+};
+type PermissionOf<C> = C extends TypedAccessCatalog<infer P> ? P : string;
+interface CatalogIssue {
+    path: string;
+    message: string;
+}
+declare class AccessCatalogError extends Error {
+    readonly issues: CatalogIssue[];
+    constructor(issues: CatalogIssue[]);
+}
+declare function validateAccessCatalog(input: unknown): {
+    ok: true;
+    catalog: AccessCatalog;
+} | {
+    ok: false;
+    issues: CatalogIssue[];
+};
+/**
+ * Validates a catalog and keeps its permission keys as a type.
+ *
+ * Throws {@link AccessCatalogError} listing every problem, so a broken
+ * catalog stops the backend at import rather than at the first request.
+ */
+declare function defineAccess<const I extends AccessCatalogInput>(input: I): TypedAccessCatalog<(keyof I['permissions'] & string) | (typeof RESERVED_PERMISSIONS)[keyof typeof RESERVED_PERMISSIONS]>;
+/**
+ * {@link defineAccess} for the catalog file the manifest names, imported as
+ * JSON.
+ *
+ * A JSON import widens `"allowed": false` to `boolean`, so it cannot satisfy
+ * the input type at compile time; the catalog is validated here at runtime
+ * instead, exactly as pack validated it, and typed by its permission keys.
+ */
+declare function accessCatalogFromJson<const J extends {
+    permissions: Record<string, unknown>;
+}>(json: J): TypedAccessCatalog<(keyof J['permissions'] & string) | (typeof RESERVED_PERMISSIONS)[keyof typeof RESERVED_PERMISSIONS]>;
+/** Why `value` is not a valid grant of `permission`, or null when it is. */
+declare function grantProblem(permission: CatalogPermission, value: GrantValue): string | null;
+
+export { type AccessCatalog as A, BUILTIN_PRINCIPAL_KINDS as B, type CatalogIssue as C, type DelegationAction as D, type Grants as G, HOST_ADMIN_ROLE as H, type PermissionOf as P, RESERVED_GROUP as R, type TypedAccessCatalog as T, type GrantValue as a, AccessCatalogError as b, type AccessCatalogInput as c, type AgentPolicy as d, type CatalogPermission as e, type CatalogRole as f, DELEGATION_ACTIONS as g, GLOBAL_DOMAIN as h, RESERVED_PERMISSIONS as i, accessCatalogFromJson as j, accessCatalogSchema as k, defineAccess as l, grantProblem as m, validateAccessCatalog as v };

package/dist/chunk-3KUOBGJN.js

@@ -0,0 +1,19 @@
+var dt=Object.defineProperty;var l=(t,n)=>dt(t,"name",{value:n,configurable:!0});import{TEGO_PLUGIN_DEV_OVERRIDES as W}from"./chunk-7K37PVGV.js";import{parseTegoPluginManifest as wt,checkPluginAccessCatalog as ht,PYTHON_LOCK_FILENAME as T,parseRequirementsLock as B,normalizePackageName as mt,PYTHON_WHEELS_DIR as pt,checkPythonVendoring as yt,PYTHON_RUNNER_VERSION as U,parseWheelFilename as gt}from"./chunk-5CU33JVY.js";import{resolvePluginParts as R,PLUGIN_MANIFEST_FILENAME as L,CLAW_MANIFEST_FILENAME as kt}from"./chunk-BTHXQWHT.js";import{createHash as J}from"crypto";import{readFile as m,readdir as b,rm as D,mkdir as y,writeFile as $,cp as g,stat as q,access as bt}from"fs/promises";import{createServer as $t}from"http";import{join as o,relative as G,sep as vt,resolve as f,dirname as v,basename as x}from"path";import Et from"jszip";import{execFile as Pt}from"child_process";import{promisify as _t}from"util";var K="template.config.json",V={IDENTITY:"identityMd",SOUL:"soulMd",AGENTS:"agentsMd",TOOLS:"toolsMd",BOOTSTRAP:"bootstrapMd",HEARTBEAT:"heartbeatMd",USER:"userMd",MEMORY:"memoryMd"};async function Y(t){const{agents:n,...a}=JSON.parse(await m(o(t,K),"utf8")),e=a.slug??t,i={...a.content,...await z(o(t,"workspace"))},s=await At(o(t,"workspace"));if(s.length>0&&(i.workspaceFiles=s),n){if(n[0]?.id!=="main")throw new Error(`${e}: the first of "agents" must be main`);if(a.content?.agentList)throw new Error(`${e}: declare the team in "agents" or in "content.agentList", not both`);const r=n.slice(1),c=(await xt(o(t,"experts"))).sort(),u=r.map(d=>d.id).sort();if(c.join()!==u.join())throw new Error(`${e}: experts/ holds [${c.join(", ")}] but "agents" declares [${u.join(", ")}]`);if(r.length>0){const d={};for(const w of r)d[w.id]=await z(o(t,"experts",w.id));i.subAgentWorkspaces=d}i.agentList=n.map(({id:d,name:w,description:h,emoji:k})=>({id:d,name:w,...h?{description:h}:{},identity:{name:w,emoji:k},...d==="main"&&r.length>0?{subagents:{allowAgents:r.map(E=>E.id)}}:{}}))}return`${JSON.stringify({...a,content:i},null,2)}
+`}l(Y,"buildAgentTemplate");async function z(t){const n=new Set(await Tt(t)),a={};for(const[e,i]of Object.entries(V)){const s=`${e}.md`;n.has(s)&&(a[i]=await X(o(t,s)))}return a}l(z,"readRootFiles");async function At(t){const n=new Set(Object.keys(V).map(e=>`${e}.md`)),a=(await Z(t)).map(e=>G(t,e).split(vt).join("/")).filter(e=>!n.has(e)).sort();return Promise.all(a.map(async e=>({path:e,content:await X(o(t,e)),...e.endsWith(".md")?{contentType:"text/markdown"}:{}})))}l(At,"readExtraFiles");async function X(t){return(await m(t,"utf8")).replace(/\n$/,"")}l(X,"readDocument");async function Z(t){const n=await b(t,{withFileTypes:!0}).catch(()=>[]),a=[];for(const e of n){if(e.name.startsWith("."))continue;const i=o(t,e.name);e.isDirectory()?a.push(...await Z(i)):e.isFile()&&a.push(i)}return a}l(Z,"walk");async function Tt(t){return(await b(t,{withFileTypes:!0}).catch(()=>[])).filter(a=>a.isFile()).map(a=>a.name)}l(Tt,"fileNames");async function xt(t){return(await b(t,{withFileTypes:!0}).catch(()=>[])).filter(a=>a.isDirectory()&&!a.name.startsWith(".")).map(a=>a.name)}l(xt,"subdirectories");var O="@tego/plugin-access-ui";async function Q(t,n,a){const e=f(t,a),i=await b(e).then(c=>c.filter(u=>u.endsWith(".json")).sort(),c=>{if(c.code==="ENOENT")return[];throw c}),s=new Map,r=n.access&&i.length>0?await Dt(t):null;for(const c of i){const u=await m(o(e,c),"utf8");if(!r){s.set(c,u);continue}s.set(c,Ct(c,u,r,await Nt(r,c)))}return s}l(Q,"readPluginLocales");async function Dt(t){for(let n=f(t);;n=v(n)){const a=o(n,"node_modules",O);if(await bt(o(a,"package.json")).then(()=>!0,()=>!1))return o(a,"locales");if(v(n)===n)break}throw new Error(`The manifest declares access, so the frontend renders ${O} \u2014 add it to this plugin's dependencies.`)}l(Dt,"accessUiLocaleDir");async function Nt(t,n){try{return await m(o(t,n),"utf8")}catch{throw new Error(`${O} has no ${n}; the plugin ships that locale, so its access screens would show bare keys.`)}}l(Nt,"readAccessLocale");function Ct(t,n,a,e){const i=JSON.parse(n),s=JSON.parse(e);for(const r of Object.keys(s))if(r in i)throw new Error(`Locale ${t} defines "${r}", which ${O} (${a}) owns \u2014 rename the plugin's key.`);return`${JSON.stringify({...i,...s},null,2)}
+`}l(Ct,"mergeLocale");var Lt=_t(Pt),tt="315532800",Ot=["src","resources","migrations"],et="requirements.in",M="tego-plugin-sdk",Ft={"linux/amd64":"x86_64","linux/arm64":"aarch64"};function St(t){const n=Ft[t],a=[`manylinux2014_${n}`];for(let e=17;e<=36;e++)a.push(`manylinux_2_${e}_${n}`);return n==="x86_64"&&a.push("manylinux2010_x86_64","manylinux1_x86_64"),a.flatMap(e=>["--platform",e])}l(St,"pipPlatformArgs");async function A(t){try{return await q(t),!0}catch{return!1}}l(A,"exists");async function nt(t,n){if(n)return f(t,n);let a=t;for(;;){const e=o(a,"packages","plugin-sdk-python");if(await A(o(e,"pyproject.toml")))return e;const i=v(a);if(i===a)throw new Error("Cannot find packages/plugin-sdk-python above the plugin root; pass backend.python.sdkProject.");a=i}}l(nt,"findSdkProject");async function F(t,n={}){try{await Lt("uv",t,{env:{...process.env,...n},maxBuffer:64*1024*1024})}catch(a){const e=a.stderr?.trim()||(a instanceof Error?a.message:String(a));throw a.code==="ENOENT"?new Error("`uv` is required to pack a python backend: https://docs.astral.sh/uv/"):new Error(`uv ${t[0]} failed:
+${e}`)}}l(F,"uv");async function at(t,n){await F(["build","--quiet","--wheel","--out-dir",n,t],{SOURCE_DATE_EPOCH:tt})}l(at,"buildSdkWheel");async function jt(t,n,a={}){const e=f(t,n.dir),i=o(e,et);if(!await A(i))throw new Error(`${n.dir}/${et} not found`);const s=o(t,"build","python-sdk");await D(s,{recursive:!0,force:!0}),await at(await nt(t,a.sdkProject),s);const r=o(e,T),{major:c,minor:u}=U;return await F(["pip","compile","--quiet",i,"--output-file",r,"--generate-hashes","--no-header","--python-version",`${c}.${u}`,"--python-platform","x86_64-manylinux_2_36","--find-links",s,"--upgrade-package",M]),r}l(jt,"lockPythonBackend");async function it(t){return J("sha256").update(await m(t)).digest("hex")}l(it,"sha256");async function Rt(t){const{major:n,minor:a}=U,e=o(t.scratch,"downloads");await y(e,{recursive:!0});for(const s of t.platforms)await F(["tool","run","--from","pip","pip","download","--quiet","--no-deps","--prefer-binary","--require-hashes","--python-version",`${n}.${a}`,"--implementation","cp","--abi",`cp${n}${a}`,"--abi","abi3","--abi","none",...St(s),"--find-links",t.sdkDist,"--requirement",t.lockPath,"--dest",e]);const i=o(t.scratch,"built");for(const s of await b(e))s.endsWith(".whl")||await F(["build","--quiet","--wheel","--out-dir",i,o(e,s)],{SOURCE_DATE_EPOCH:tt});await y(t.wheelsDir,{recursive:!0});for(const s of[e,i])if(await A(s))for(const r of(await b(s)).sort())r.endsWith(".whl")&&await g(o(s,r),o(t.wheelsDir,r))}l(Rt,"vendorWheels");async function Mt(t,n,a){const{requirements:e}=B(t),i=new Map;for(const c of(await b(n)).sort()){const u=gt(c);if(!u)continue;const d=`${u.name}==${u.version}`;i.set(d,[...i.get(d)??[],await it(o(n,c))])}const r=`${e.map(c=>{const u=i.get(`${c.name}==${c.version}`)??[];return[`${c.name}==${c.version}`,...u.map(d=>`--hash=sha256:${d}`)].join(" ")}).join(`
+`)}
+`;return await $(a,r,"utf8"),r}l(Mt,"writePackagedLock");async function It(t){const{root:n,staging:a,part:e,options:i={},log:s}=t,r=f(n,e.dir),c=o(a,e.dir);await y(c,{recursive:!0});const u=f(n,e.entryPath);if(!await A(u))throw new Error(`backend entry not found at ${u}`);await g(u,o(a,e.entryPath));for(const P of i.include??Ot){const _=o(r,P);await A(_)&&await g(_,o(c,P),{recursive:!0,filter:l(j=>!/(^|\/)(__pycache__|\.pytest_cache|\.venv)(\/|$)|\.pyc$/.test(j),"filter")})}const d=f(n,e.migrationsDirPath);await A(d)&&await g(d,o(a,e.migrationsDirPath),{recursive:!0});const w=o(r,T);if(!await A(w))throw new Error(`${e.dir}/${T} not found; run \`tego-plugin-pack lock\``);const h=await m(w,"utf8"),{errors:k,requirements:E}=B(h);if(k.length>0)throw new Error([`${e.dir}/${T} is invalid:`,...k].join(`
+  `));if(!E.some(P=>P.name===mt(M)))throw new Error(`${e.dir}/${T} must lock ${M}`);const C=o(n,"build","python-scratch");await D(C,{recursive:!0,force:!0});try{const P=o(C,"sdk");await at(await nt(n,i.sdkProject),P);const _=o(c,pt);s(`  \u203A vendoring ${E.length} packages for ${e.platforms.join(", ")}`),await Rt({lockPath:w,platforms:e.platforms,sdkDist:P,wheelsDir:_,scratch:C});const j=await Mt(h,_,o(c,T)),ft=await Promise.all((await b(_)).map(async H=>({filename:H,sha256:await it(o(_,H))}))),I=yt({lockText:j,wheels:ft,platforms:e.platforms});if(I.length>0)throw new Error(["Python backend would not install in the runner:",...I].join(`
+  `))}finally{await D(C,{recursive:!0,force:!0})}}l(It,"stagePythonBackend");var Ht=["pg","node:*"],Wt=["openclaw","openclaw/*","node:*"],rt=new Date(Date.UTC(1980,0,1));async function Bt(t){const n=f(t.root),a=t.log===null?()=>{}:t.log??(c=>console.log(c)),e=await S(n),i=R(e),s=f(n,t.outDir??"build"),r=o(s,"package");await D(r,{recursive:!0,force:!0}),await y(r,{recursive:!0});try{await $(o(r,L),`${JSON.stringify(e,null,2)}
+`,"utf8"),await zt(n,r,e),i.frontend&&(a("\u203A building frontend"),await Yt(n,r,e,i.frontend,t.frontend)),i.publicFrontend&&(a("\u203A building public pages"),await Xt(n,r,i.publicFrontend,t.publicFrontend)),i.backend?.runtime==="python"?(a("\u203A staging python backend"),await It({root:n,staging:r,part:i.backend,...t.backend?.python?{options:t.backend.python}:{},log:a})):i.backend&&(a("\u203A building backend"),await Zt(n,r,i.backend,t.backend)),i.claw&&(a("\u203A building claw"),await Qt(n,r,i.claw,e,t.claw)),await ot(n,e,a);for(const w of e.agentTemplates??[])for(const h of[w.entry,w.icon].filter(k=>!!k)){const k=f(n,h);await p(k,`agent template asset ${h}`);const E=o(r,h);await y(v(E),{recursive:!0}),await g(k,E)}const c=o(s,t.fileName??`${e.id}-${e.version}.zip`),u=await te(r,c),d=J("sha256").update(await m(c)).digest("hex");return a(`\u2705 ${G(n,c)} \u2014 ${ee(u)}`),{file:c,bytes:u,sha256:d,manifest:e}}finally{await D(r,{recursive:!0,force:!0})}}l(Bt,"packPlugin");async function Ut(t){const n=f(t.root),a=t.log===null?()=>{}:t.log??(e=>console.log(e));return ot(n,await S(n),a)}l(Ut,"buildPluginTemplates");async function ot(t,n,a){const e=[];for(const i of n.agentTemplates??[]){const s=f(t,i.entry),r=v(s);if(!await N(o(r,K)))continue;const c=await Y(r),{content:u}=JSON.parse(c);u?.usageGuide?.summary?.trim()||a(`\u26A0\uFE0F ${i.key}: missing content.usageGuide.summary (recommended for onboarding)`),await m(s,"utf8").catch(()=>null)!==c&&(await $(s,c,"utf8"),a(`\u203A rebuilt ${i.entry}`),e.push(i.entry))}return e}l(ot,"writeAgentTemplates");async function Jt(t){const n=f(t.root),a=R(await S(n)).backend;if(a?.runtime!=="python")throw new Error("Only a python backend part has a lock to compile.");return jt(n,a,t.python)}l(Jt,"lockPlugin");async function qt(t){const n=f(t.root),a=t.log===null?()=>{}:t.log??(h=>console.log(h)),e=await S(n),i=R(e).frontend;if(!i)throw new Error(`${e.id} declares no frontend part to watch.`);const s=f(n,t.frontend?.buildDir??`${i.dir}/dist`),r=f(n,t.frontend?.viteConfig??`${i.dir}/vite.config.ts`);await p(r,"frontend vite config");const c=t.port??Gt,u=Vt(s,c,()=>Q(n,e,i.i18nDirPath)),{build:d}=await import("vite");return(await d({root:n,configFile:r,logLevel:"warn",...W,build:{...W.build,watch:{}}})).on("event",h=>{h.code==="END"&&(a(`\u21BB rebuilt \u2014 reloading ${u.clientCount()} page(s)`),u.notify())}),a([`Serving ${e.id} from http://localhost:${c}/${x(i.entryPath)}`,"","Point the shell at it and restart its dev server:",`  VITE_TEGO_LOCAL_PLUGINS=${e.id}=http://localhost:${c}/${x(i.entryPath)}`,"","The release still has to be installed and enabled \u2014 this only replaces","where its bundle is fetched from. Ctrl-C to stop."].join(`
+`)),new Promise(()=>{})}l(qt,"watchPluginFrontend");var Gt=5180,Kt="/__tego_plugin_reload",st="/i18n/";function Vt(t,n,a){const e=new Set;return $t((s,r)=>{r.setHeader("Access-Control-Allow-Origin","*"),r.setHeader("Access-Control-Allow-Headers","*");const c=new URL(s.url??"/","http://localhost").pathname;if(c===Kt){r.writeHead(200,{"Content-Type":"text/event-stream","Cache-Control":"no-cache",Connection:"keep-alive"}),r.write(`: connected
+
+`),e.add(r),s.on("close",()=>e.delete(r));return}if(c.startsWith(st)){const d=c.slice(st.length);a().then(w=>{const h=w.get(d);if(h===void 0){r.writeHead(404).end();return}r.writeHead(200,{"Content-Type":ct(d),"Cache-Control":"no-store"}),r.end(h)},w=>{r.writeHead(500,{"Content-Type":"text/plain; charset=utf-8"}).end(w instanceof Error?w.message:String(w))});return}const u=f(t,`.${c}`);if(!u.startsWith(t)){r.writeHead(403).end();return}m(u).then(d=>{r.writeHead(200,{"Content-Type":ct(u),"Cache-Control":"no-store"}),r.end(d)},()=>r.writeHead(404).end())}).listen(n,"127.0.0.1"),{notify:l(()=>{for(const s of e)s.write(`data: rebuilt
+
+`)},"notify"),clientCount:l(()=>e.size,"clientCount")}}l(Vt,"serveBuildDir");function ct(t){return t.endsWith(".js")?"text/javascript; charset=utf-8":t.endsWith(".json")?"application/json; charset=utf-8":t.endsWith(".css")?"text/css; charset=utf-8":"application/octet-stream"}l(ct,"contentTypeFor");async function S(t){const n=o(t,L);let a;try{a=await m(n,"utf8")}catch{throw new Error(`${L} not found at ${n}`)}const e=wt(JSON.parse(a));if(!e.ok||!e.manifest)throw new Error([`${L} is invalid:`,...e.errors].join(`
+  `));return e.manifest}l(S,"readManifest");async function Yt(t,n,a,e,i){const s=f(t,i?.viteConfig??`${e.dir}/vite.config.ts`);await p(s,"frontend vite config");const{build:r}=await import("vite");await r({root:t,configFile:s,logLevel:"warn"});const c=f(t,i?.buildDir??`${e.dir}/dist`);await p(o(c,x(e.entryPath)),`frontend bundle (expected the vite build to write ${x(e.entryPath)})`),await y(o(n,v(e.entryPath)),{recursive:!0}),await g(c,o(n,v(e.entryPath)),{recursive:!0});const u=await Q(t,a,e.i18nDirPath);u.size>0&&await y(o(n,e.i18nDirPath),{recursive:!0});for(const[d,w]of u)await $(o(n,e.i18nDirPath,d),w,"utf8")}l(Yt,"stageFrontend");async function zt(t,n,a){const e=a.access?.catalog;if(!e)return;const i=f(t,e);await p(i,`access catalog ${e}`);const s=await m(i,"utf8"),r=ht(a,JSON.parse(s));if(!r.ok)throw new Error(["The access catalog is invalid:",...r.errors].join(`
+  `));await y(v(o(n,e)),{recursive:!0}),await $(o(n,e),s,"utf8")}l(zt,"stageAccessCatalog");async function Xt(t,n,a,e){const i=f(t,e?.viteConfig??`${a.dir}/vite.config.ts`);await p(i,"public pages vite config");const{build:s}=await import("vite");await s({root:f(t,a.dir),configFile:i,logLevel:"warn"});const r=f(t,e?.buildDir??`${a.dir}/dist`);await p(o(r,x(a.entryPath)),`public pages (expected the vite build to write ${x(a.entryPath)})`),await y(o(n,a.dir),{recursive:!0}),await g(r,o(n,a.dir),{recursive:!0})}l(Xt,"stagePublicFrontend");async function Zt(t,n,a,e){await lt(a,{root:t,outDir:n,...e?.entry?{entry:e.entry}:{},...e?.external?{external:e.external}:{}})}l(Zt,"stageBackend");async function lt(t,n){const{root:a,outDir:e}=n,i=f(a,n.entry??`${t.dir}/src/index.ts`);await p(i,"backend entry");const{build:s}=await import("esbuild");await s({entryPoints:[i],outfile:o(e,t.entryPath),bundle:!0,platform:"node",target:"node22",format:"esm",banner:{js:"import { createRequire as __tegoCreateRequire } from 'node:module'; const require = __tegoCreateRequire(import.meta.url);"},external:[...Ht,...n.external??[]],logLevel:"warning"});for(const c of t.compatibilityRepairs??[]){const u=`${t.dir}/${c.sqlFile}`;await p(f(a,u),"schema repair"),await y(v(o(e,u)),{recursive:!0}),await g(f(a,u),o(e,u))}const r=f(a,t.migrationsDirPath);await N(r)&&await g(r,o(e,t.migrationsDirPath),{recursive:!0}),await $(o(e,t.dir,"package.json"),`${JSON.stringify({type:"module"},null,2)}
+`,"utf8")}l(lt,"buildPluginBackend");async function Qt(t,n,a,e,i){const s=f(t,i?.entry??`${a.dir}/src/index.ts`);await p(s,"claw entry");const{build:r}=await import("esbuild");await r({entryPoints:[s],outfile:o(n,a.dir,"index.js"),bundle:!0,platform:"node",target:"node22",format:"esm",external:[...Wt,...i?.external??[]],logLevel:"warning"});const c=f(t,a.manifestPath);await p(c,kt);const u=JSON.parse(await m(c,"utf8"));await $(o(n,a.manifestPath),`${JSON.stringify({...u,version:e.version},null,2)}
+`,"utf8");const d=f(t,a.dir,"package.json"),w=await N(d)?JSON.parse(await m(d,"utf8")):{name:e.id,private:!0,type:"module"};await $(o(n,a.dir,"package.json"),`${JSON.stringify({...w,version:e.version,openclaw:{extensions:["./index.js"]}},null,2)}
+`,"utf8");const h=f(t,i?.skillsDir??`${a.dir}/skills`);await N(h)&&await g(h,o(n,a.dir,"skills"),{recursive:!0})}l(Qt,"stageClaw");async function te(t,n){const a=new Et;await ut(a,t,"");const e=await a.generateAsync({type:"nodebuffer",compression:"DEFLATE",compressionOptions:{level:9}});return await $(n,e),e.byteLength}l(te,"zipDirectory");async function ut(t,n,a){const e=await b(n,{withFileTypes:!0});e.sort((i,s)=>i.name.localeCompare(s.name));for(const i of e){const s=`${a}${i.name}`;i.isDirectory()?(t.file(`${s}/`,null,{dir:!0,date:rt}),await ut(t,o(n,i.name),`${s}/`)):t.file(s,await m(o(n,i.name)),{date:rt,createFolders:!1})}}l(ut,"addDirectory");async function N(t){try{return await q(t),!0}catch{return!1}}l(N,"exists2");async function p(t,n){if(!await N(t))throw new Error(`${n} not found at ${t}`)}l(p,"assertExists");function ee(t){return t<1024*1024?`${(t/1024).toFixed(1)} KB`:`${(t/1024/1024).toFixed(2)} MB`}l(ee,"formatBytes");export{Y as buildAgentTemplate,lt as buildPluginBackend,Ut as buildPluginTemplates,Jt as lockPlugin,Bt as packPlugin,qt as watchPluginFrontend};

package/dist/chunk-3WA3M347.cjs

@@ -0,0 +1 @@
+"use strict";var p=Object.defineProperty;var l=(e,o)=>p(e,"name",{value:o,configurable:!0});var chunkROFUQLOZ_cjs=require("./chunk-ROFUQLOZ.cjs"),chunkC2OCOPZQ_cjs=require("./chunk-C2OCOPZQ.cjs"),chunkAJY7ZHXK_cjs=require("./chunk-AJY7ZHXK.cjs"),net=require("net"),zod=require("zod");function checkPluginAccessCatalog(e,o){const t=`access.catalog (${e.access?.catalog??"?"})`,s=chunkAJY7ZHXK_cjs.validateAccessCatalog(o);if(!s.ok)return{ok:!1,errors:s.issues.map(n=>`${t}: ${n.path}: ${n.message}`)};const a=new Set((e.parts.frontend?.nav??[]).map(n=>n.key)),i=Object.keys(s.catalog.menus).filter(n=>!a.has(n)).map(n=>`${t}: menus.${n}: no parts.frontend.nav entry has this key`);return i.length>0?{ok:!1,errors:i}:{ok:!0,catalog:s.catalog}}l(checkPluginAccessCatalog,"checkPluginAccessCatalog");var PYTHON_RUNNER_VERSION={major:3,minor:12},RUNNER_GLIBC_MINOR=36,PYTHON_LOCK_FILENAME="requirements.lock",PYTHON_WHEELS_DIR="wheels";function normalizePackageName(e){return e.toLowerCase().replace(/[-_.]+/g,"-")}l(normalizePackageName,"normalizePackageName");function parseRequirementsLock(e){const o=[],t=[],s=e.replace(/\\\r?\n/g," ").split(/\r?\n/).map(a=>a.replace(/(^|\s)#.*$/,"").trim()).filter(Boolean);for(const a of s){const[i="",...n]=a.split(/\s+/),r=/^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?==([^\s;]+)$/.exec(i);if(!r||a.includes(";")){t.push(`${PYTHON_LOCK_FILENAME}: "${a.slice(0,80)}" is not a pinned "name==version" requirement without markers`);continue}const c=[];for(const d of n){const u=/^--hash=sha256:([0-9a-f]{64})$/.exec(d);u?.[1]?c.push(u[1]):t.push(`${PYTHON_LOCK_FILENAME}: unsupported option "${d.slice(0,40)}" on ${r[1]}`)}c.length===0&&t.push(`${PYTHON_LOCK_FILENAME}: ${r[1]}==${r[2]} has no --hash; compile with --generate-hashes`),o.push({name:normalizePackageName(r[1]),version:r[2].toLowerCase(),hashes:c})}return{requirements:o,errors:t}}l(parseRequirementsLock,"parseRequirementsLock");function parseWheelFilename(e){if(!e.endsWith(".whl"))return null;const o=e.slice(0,-4).split("-");if(o.length!==5&&o.length!==6)return null;const[t,s]=o,[a,i,n]=o.slice(-3);return!t||!s||!a||!i||!n?null:{name:normalizePackageName(t),version:s.toLowerCase(),pythonTags:a.split("."),abiTags:i.split("."),platformTags:n.split(".")}}l(parseWheelFilename,"parseWheelFilename");function supportsInterpreter(e){const{major:o,minor:t}=PYTHON_RUNNER_VERSION,s=`${o}${t}`;return e.pythonTags.some(a=>{if(a===`py${o}`||a===`py${s}`||a===`cp${s}`)return!0;const i=/^cp3(\d+)$/.exec(a);return i?.[1]!==void 0&&Number(i[1])<=t&&e.abiTags.includes("abi3")})}l(supportsInterpreter,"supportsInterpreter");function supportsPlatform(e,o){const t=o==="linux/amd64"?"x86_64":"aarch64";return e.platformTags.some(s=>{if(s==="any"||s===`manylinux2014_${t}`||t==="x86_64"&&/^manylinux(1|2010)_x86_64$/.test(s))return!0;const a=/^manylinux_2_(\d+)_(x86_64|aarch64)$/.exec(s);return a?.[2]===t&&Number(a[1])<=RUNNER_GLIBC_MINOR})}l(supportsPlatform,"supportsPlatform");function checkPythonVendoring(e){if(e.lockText===null)return[`Python backend ships no ${PYTHON_LOCK_FILENAME}. The runner installs offline from it with --require-hashes.`];const{requirements:o,errors:t}=parseRequirementsLock(e.lockText),s=e.wheels.map(a=>({...a,parsed:parseWheelFilename(a.filename)}));for(const a of s){if(!a.parsed){t.push(`"${a.filename}" is not a valid wheel filename`);continue}const i=o.find(n=>n.name===a.parsed.name&&n.version===a.parsed.version);i?i.hashes.includes(a.sha256)||t.push(`"${a.filename}" does not match any --hash locked for ${i.name}==${i.version}`):t.push(`"${a.filename}" is not in ${PYTHON_LOCK_FILENAME}; ship only locked wheels`)}for(const a of o){const i=s.filter(n=>n.parsed?.name===a.name&&n.parsed.version===a.version&&supportsInterpreter(n.parsed));for(const n of e.platforms)i.some(r=>supportsPlatform(r.parsed,n))||t.push(`No wheel for ${a.name}==${a.version} on ${n} (python ${PYTHON_RUNNER_VERSION.major}.${PYTHON_RUNNER_VERSION.minor})`)}return t}l(checkPythonVendoring,"checkPythonVendoring");var PLUGIN_ID_PATTERN=/^[a-z0-9][a-z0-9._-]*$/,DIRECTORY_READ="directory.read",ACCESS_HOST_API_VERSION="1.22.0",MAX_PLUGIN_ID_LENGTH=128,RELATIVE_PATH_PATTERN=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,relativePathSchema=zod.z.string().min(1).max(256).regex(RELATIVE_PATH_PATTERN,"must be a relative path inside the package").refine(e=>!e.split("/").some(o=>o===".."||o==="."),{message:'must not contain "." or ".." segments'}),localizedTextSchema=zod.z.union([zod.z.string().min(1),zod.z.record(zod.z.string().min(1),zod.z.string().min(1))]),semanticVersionSchema=zod.z.string().refine(e=>{try{return chunkC2OCOPZQ_cjs.parseSemanticVersion(e),!0}catch{return!1}},{message:"must be a valid semantic version"}),navKeySchema=zod.z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/,"must be lowercase alphanumeric with hyphens"),navEntrySchema=zod.z.object({key:navKeySchema,labelKey:zod.z.string().min(1).max(200),icon:zod.z.enum(chunkROFUQLOZ_cjs.PLUGIN_NAV_ICONS).optional(),order:zod.z.number().int().min(0).max(1e4).optional(),path:zod.z.string().regex(/^\/[A-Za-z0-9/_-]*$/,'must start with "/"').max(256).optional()}).strict(),configPropertyNameSchema=zod.z.string().min(1).max(64).regex(/^[a-zA-Z][a-zA-Z0-9_]*$/,"must be a plain identifier: a letter followed by letters, digits or underscores"),configFieldSchema=zod.z.object({type:zod.z.enum(["string","number","integer","boolean","array"]),title:zod.z.string().min(1).max(200).optional(),description:zod.z.string().min(1).max(1e3).optional(),default:zod.z.unknown().optional(),enum:zod.z.array(zod.z.union([zod.z.string().max(200),zod.z.number()])).min(1).max(50).optional(),minLength:zod.z.number().int().min(0).max(1e4).optional(),maxLength:zod.z.number().int().min(1).max(1e4).optional(),pattern:zod.z.string().min(1).max(500).optional(),format:zod.z.enum(["uri","email"]).optional(),minimum:zod.z.number().optional(),maximum:zod.z.number().optional(),items:zod.z.object({type:zod.z.literal("string"),enum:zod.z.array(zod.z.string().max(200)).min(1).max(50).optional()}).strict().optional(),maxItems:zod.z.number().int().min(1).max(200).optional()}).strict().superRefine((e,o)=>{e.type==="array"&&e.items===void 0&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["items"],message:'an array field must declare { "type": "string" } items'}),e.type!=="array"&&e.items!==void 0&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["items"],message:"only an array field may declare items"}),e.enum&&e.default!==void 0&&(e.enum.some(s=>Object.is(s,e.default))||o.addIssue({code:zod.z.ZodIssueCode.custom,path:["default"],message:"must be one of the declared enum values"}))}),localizedHintTextSchema=zod.z.union([zod.z.string().min(1).max(500),zod.z.record(zod.z.string().min(1),zod.z.string().min(1).max(500))]),configUiHintSchema=zod.z.object({label:localizedHintTextSchema.optional(),help:localizedHintTextSchema.optional(),placeholder:localizedHintTextSchema.optional(),order:zod.z.number().int().min(0).max(1e4).optional(),advanced:zod.z.boolean().optional(),sensitive:zod.z.boolean().optional()}).strict(),configDeclarationSchema=zod.z.object({schema:zod.z.object({type:zod.z.literal("object"),properties:zod.z.record(configPropertyNameSchema,configFieldSchema),required:zod.z.array(configPropertyNameSchema).max(50).optional(),additionalProperties:zod.z.literal(!1).optional()}).strict(),uiHints:zod.z.record(configPropertyNameSchema,configUiHintSchema).optional()}).strict().superRefine((e,o)=>{const t=Object.keys(e.schema.properties);t.length>50&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["schema","properties"],message:"a config section is limited to 50 fields"});for(const s of e.schema.required??[])t.includes(s)||o.addIssue({code:zod.z.ZodIssueCode.custom,path:["schema","required"],message:`"${s}" is required but not declared in properties`});for(const s of Object.keys(e.uiHints??{}))t.includes(s)||o.addIssue({code:zod.z.ZodIssueCode.custom,path:["uiHints",s],message:"no such field in the section schema"})}),frontendPartSchema=zod.z.object({dir:relativePathSchema.optional(),entry:relativePathSchema.optional(),i18nDir:relativePathSchema.optional(),icon:zod.z.enum(chunkROFUQLOZ_cjs.PLUGIN_NAV_ICONS).optional(),nav:zod.z.array(navEntrySchema).max(20).optional(),config:configDeclarationSchema.optional()}).strict().superRefine((e,o)=>{for(const[t,s]of Object.entries(e.config?.uiHints??{}))s.sensitive===!0&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["config","uiHints",t,"sensitive"],message:"the frontend config section is delivered to the browser, so it cannot hold secrets \u2014 declare this field in the backend section instead"})}).refine(e=>{const o=(e.nav??[]).map(t=>t.key);return new Set(o).size===o.length},{message:"nav entries must have unique keys",path:["nav"]}),backendLimitsSchema=zod.z.object({memoryMb:zod.z.number().int().min(64).max(4096).optional(),cpuMs:zod.z.number().int().min(100).max(6e5).optional(),requestTimeoutMs:zod.z.number().int().min(100).max(12e4).optional()}).strict(),EGRESS_HOST_PATTERN=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]$/,egressHostSchema=zod.z.string().max(259).refine(e=>{if(e==="*")return!0;const o=/^\[([0-9a-f:]+)\]:([1-9]\d{0,4})$/.exec(e);if(o)return net.isIP(o[1])===6&&Number(o[2])<=65535;const t=/^([^:]+)(?::([1-9]\d{0,4}))?$/.exec(e);if(!t)return!1;const[,s,a]=t;return a&&Number(a)>65535?!1:a&&net.isIP(s)===4||EGRESS_HOST_PATTERN.test(s)},"must be *, a lowercase hostname, hostname:port, or IP:port"),publicRouteSchema=zod.z.object({method:zod.z.enum(chunkROFUQLOZ_cjs.PLUGIN_PUBLIC_ROUTE_METHODS),path:zod.z.string().max(256).superRefine((e,o)=>{const t=chunkROFUQLOZ_cjs.publicRoutePathProblem(e);t&&o.addIssue({code:zod.z.ZodIssueCode.custom,message:t})})}).strict(),backendPartSchema=zod.z.object({dir:relativePathSchema.optional(),runtime:zod.z.enum(["node","python"]).optional(),entry:relativePathSchema.optional(),platforms:zod.z.array(zod.z.enum(["linux/amd64","linux/arm64"])).min(1).optional(),egress:zod.z.array(egressHostSchema).max(20).refine(e=>!e.includes("*")||e.length===1,{message:"the * wildcard must be the only egress entry"}).optional(),migrationsDir:relativePathSchema.optional(),compatibilityRepairs:zod.z.array(zod.z.object({id:zod.z.string().regex(/^[a-z][a-z0-9_-]{0,99}$/),sqlFile:relativePathSchema.refine(e=>e.startsWith("repairs/")&&e.endsWith(".sql"),"Use a SQL file under repairs/"),table:zod.z.string().regex(/^[a-z][a-z0-9_]{0,62}$/),column:zod.z.string().regex(/^[a-z][a-z0-9_]{0,62}$/),postgresType:zod.z.enum(["integer","text","boolean","bigint","jsonb"])}).strict()).max(100).refine(e=>new Set(e.map(o=>o.id)).size===e.length,"Repair IDs must be unique").optional(),healthPath:zod.z.string().regex(/^\/[A-Za-z0-9/_-]*$/,'must start with "/"').max(256).optional(),limits:backendLimitsSchema.optional(),publicRoutes:zod.z.array(publicRouteSchema).max(100).optional(),config:configDeclarationSchema.optional()}).strict().superRefine((e,o)=>{const t=e.publicRoutes??[];t.forEach((s,a)=>{const i=t.slice(0,a).find(n=>chunkROFUQLOZ_cjs.publicRoutesOverlap(n,s));i&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["publicRoutes",a],message:`"${chunkROFUQLOZ_cjs.formatPublicRoute(s)}" can match the same requests as "${chunkROFUQLOZ_cjs.formatPublicRoute(i)}"`})}),e.platforms&&(e.runtime??"node")!=="python"&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["platforms"],message:'only applies to runtime "python"'})}),clawPartSchema=zod.z.object({dir:relativePathSchema.optional(),hooks:zod.z.object({allowPromptInjection:zod.z.boolean().optional(),allowConversationAccess:zod.z.boolean().optional()}).strict().optional()}).strict();function containsPath(e,o){return o===e||o.startsWith(`${e}/`)}l(containsPath,"containsPath");var publicFrontendPartSchema=zod.z.object({dir:relativePathSchema.optional()}).strict(),partsSchema=zod.z.object({frontend:frontendPartSchema.optional(),backend:backendPartSchema.optional(),claw:clawPartSchema.optional(),publicFrontend:publicFrontendPartSchema.optional()}).strict().refine(e=>e.frontend!==void 0||e.backend!==void 0||e.claw!==void 0,{message:"a plugin must declare at least one of frontend, backend, claw"}).superRefine((e,o)=>{const t=[["frontend",e.frontend?.dir??chunkROFUQLOZ_cjs.PLUGIN_PART_DEFAULTS.frontend.dir],["backend",e.backend?.dir??chunkROFUQLOZ_cjs.PLUGIN_PART_DEFAULTS.backend.dir],["claw",e.claw?.dir??chunkROFUQLOZ_cjs.PLUGIN_PART_DEFAULTS.claw.dir],["publicFrontend",e.publicFrontend?.dir??chunkROFUQLOZ_cjs.PLUGIN_PART_DEFAULTS.publicFrontend.dir]].filter(([s])=>e[s]!==void 0);for(const[s,a]of t)for(const[i,n]of t)s!==i&&containsPath(a,n)&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:[i,"dir"],message:a===n?`must not be the same directory as the ${s} part ("${a}")`:`must not sit inside the ${s} part's directory ("${a}")`})}),permissionsSchema=zod.z.object({required:zod.z.array(zod.z.string().min(1).max(128)).max(50).optional()}).strict(),declaresSchema=zod.z.object({database:zod.z.boolean().optional(),storage:zod.z.boolean().optional(),events:zod.z.boolean().optional(),notifications:zod.z.boolean().optional()}).strict(),tegoPluginManifestSchema=zod.z.object({manifestVersion:zod.z.literal(1),id:zod.z.string().max(MAX_PLUGIN_ID_LENGTH).regex(PLUGIN_ID_PATTERN,"must be lowercase letters, digits, dot, underscore or hyphen, starting with a letter or digit"),version:semanticVersionSchema,displayName:localizedTextSchema,description:localizedTextSchema.optional(),author:zod.z.string().max(200).optional(),homepage:zod.z.string().url().max(500).optional(),icon:relativePathSchema.optional(),category:zod.z.string().min(1).max(64).optional(),tags:zod.z.array(zod.z.string().min(1).max(64)).max(20).optional(),hostApiRange:zod.z.string().refine(chunkC2OCOPZQ_cjs.isValidHostApiRange,{message:'must be a caret range like "^1.2.0" or an exact "1.2.0"'}).optional(),scope:zod.z.enum(["avatar","tenant"]),declares:declaresSchema.optional(),parts:partsSchema,permissions:permissionsSchema.optional(),access:zod.z.object({catalog:relativePathSchema}).strict().optional(),audit:zod.z.object({tools:zod.z.record(zod.z.string().min(1).max(128),zod.z.object({category:zod.z.enum(["read","write","search","browse","exec","knowledge","memory","message","schedule","delegate","document","plugin"]).optional(),title:localizedTextSchema.optional(),target:zod.z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).optional(),risk:zod.z.enum(["low","medium","high"]).optional(),dataClasses:zod.z.array(zod.z.string().min(1).max(32)).max(10).optional()}).strict()).optional()}).strict().optional(),agentTemplates:zod.z.array(zod.z.object({key:navKeySchema,entry:relativePathSchema,icon:relativePathSchema.optional()}).strict()).max(20).optional(),workDelegation:zod.z.object({allowedAvatarRoles:zod.z.array(zod.z.string().min(1).max(100)).min(1).max(20),settingsRoute:zod.z.string().regex(/^\/[A-Za-z0-9/_-]*$/,'must start with "/"').max(256).refine(e=>!e.startsWith("//"),"must be a plugin page").optional(),summary:localizedTextSchema.refine(e=>(typeof e=="string"?[e]:Object.values(e)).every(o=>o.length<=120),"must be at most 120 characters in every locale").optional(),privacyPolicyUrl:zod.z.string().url().max(2048).refine(e=>e.startsWith("https://"),"must be an https URL").optional(),conversationCapture:zod.z.boolean().optional()}).strict().optional(),conversationRecordRoutes:zod.z.array(zod.z.object({entity:navKeySchema,path:relativePathSchema,contextQuery:zod.z.string().max(200).regex(/^[A-Za-z0-9_=&-]+$/).optional(),labelFields:zod.z.array(zod.z.string().regex(/^[A-Za-z][A-Za-z0-9_]*$/)).min(1).max(3).optional()}).strict()).max(30).optional(),agentReadiness:zod.z.object({path:relativePathSchema}).strict().optional()}).strict().superRefine((e,o)=>{const t=new Set;for(const[r,c]of(e.agentTemplates??[]).entries())t.has(c.key)&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["agentTemplates",r,"key"],message:"duplicate template key"}),t.add(c.key);const s=new Set;for(const[r,c]of(e.conversationRecordRoutes??[]).entries())s.has(c.entity)&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["conversationRecordRoutes",r,"entity"],message:"duplicate conversation entity"}),s.add(c.entity);(e.parts.frontend!==void 0||e.parts.backend!==void 0)&&e.hostApiRange===void 0&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["hostApiRange"],message:"required when a frontend or backend part is declared, so the host can refuse incompatible releases"});const i=e.parts.backend?.publicRoutes??[];if(e.parts.publicFrontend!==void 0&&i.length===0&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["parts","publicFrontend"],message:"requires parts.backend.publicRoutes for the pages to call"}),e.parts.backend===void 0&&e.declares)for(const r of["database","storage","events"])e.declares[r]===!0&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["declares",r],message:"requires a backend part"});e.permissions?.required?.includes("knowledge.manage")&&(!e.parts.backend||!e.hostApiRange||chunkC2OCOPZQ_cjs.isValidHostApiRange(e.hostApiRange)&&chunkC2OCOPZQ_cjs.compareSkillSemanticVersions(chunkC2OCOPZQ_cjs.hostApiRangeMinimum(e.hostApiRange),"1.23.0")<0)&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["hostApiRange"],message:"knowledge.manage requires a backend and host API ^1.23.0 or later"}),e.permissions?.required?.includes("proactive.emit")&&(!e.parts.backend||!e.hostApiRange||chunkC2OCOPZQ_cjs.isValidHostApiRange(e.hostApiRange)&&chunkC2OCOPZQ_cjs.compareSkillSemanticVersions(chunkC2OCOPZQ_cjs.hostApiRangeMinimum(e.hostApiRange),"1.26.0")<0)&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["hostApiRange"],message:"proactive.emit requires a backend and host API ^1.26.0 or later"}),e.permissions?.required?.includes("attention.request")&&(!e.parts.backend||!e.hostApiRange||chunkC2OCOPZQ_cjs.isValidHostApiRange(e.hostApiRange)&&chunkC2OCOPZQ_cjs.compareSkillSemanticVersions(chunkC2OCOPZQ_cjs.hostApiRangeMinimum(e.hostApiRange),"1.34.0")<0)&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["hostApiRange"],message:"attention.request requires a backend and host API ^1.34.0 or later"}),e.permissions?.required?.includes("mail.send")&&(!e.parts.backend||!e.hostApiRange||chunkC2OCOPZQ_cjs.isValidHostApiRange(e.hostApiRange)&&chunkC2OCOPZQ_cjs.compareSkillSemanticVersions(chunkC2OCOPZQ_cjs.hostApiRangeMinimum(e.hostApiRange),"1.29.0")<0)&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["hostApiRange"],message:"mail.send requires a backend and host API ^1.29.0 or later"}),e.agentReadiness!==void 0&&e.parts.backend===void 0&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["agentReadiness"],message:"requires a backend part to answer it"}),(e.agentReadiness!==void 0||e.workDelegation?.settingsRoute!==void 0)&&(!e.hostApiRange||chunkC2OCOPZQ_cjs.isValidHostApiRange(e.hostApiRange)&&chunkC2OCOPZQ_cjs.compareSkillSemanticVersions(chunkC2OCOPZQ_cjs.hostApiRangeMinimum(e.hostApiRange),"1.30.0")<0)&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["hostApiRange"],message:"agentReadiness and workDelegation.settingsRoute require host API ^1.30.0 or later"}),e.workDelegation!==void 0&&e.parts.backend===void 0&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["workDelegation"],message:"requires a backend part to act on it"});const n=e.workDelegation;(n?.summary!==void 0||n?.privacyPolicyUrl!==void 0||n?.conversationCapture!==void 0)&&(!e.hostApiRange||chunkC2OCOPZQ_cjs.isValidHostApiRange(e.hostApiRange)&&chunkC2OCOPZQ_cjs.compareSkillSemanticVersions(chunkC2OCOPZQ_cjs.hostApiRangeMinimum(e.hostApiRange),"1.33.0")<0)&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["hostApiRange"],message:"workDelegation.summary, privacyPolicyUrl and conversationCapture require host API ^1.33.0 or later"}),e.access!==void 0&&(e.parts.backend===void 0&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["access"],message:"requires a backend part to enforce it"}),e.permissions?.required?.includes(DIRECTORY_READ)||o.addIssue({code:zod.z.ZodIssueCode.custom,path:["permissions","required"],message:`must include "${DIRECTORY_READ}" when access is declared`}),e.hostApiRange!==void 0&&chunkC2OCOPZQ_cjs.isValidHostApiRange(e.hostApiRange)&&chunkC2OCOPZQ_cjs.compareSkillSemanticVersions(chunkC2OCOPZQ_cjs.hostApiRangeMinimum(e.hostApiRange),ACCESS_HOST_API_VERSION)<0&&o.addIssue({code:zod.z.ZodIssueCode.custom,path:["hostApiRange"],message:`access needs host API ${ACCESS_HOST_API_VERSION} \u2014 declare "^${ACCESS_HOST_API_VERSION}" or later`})),(e.parts.frontend?.nav??[]).forEach((r,c)=>{const d=chunkROFUQLOZ_cjs.pluginMenuPermission(e.id,r.key);d.length<=chunkROFUQLOZ_cjs.MAX_PLUGIN_MENU_PERMISSION_LENGTH||o.addIssue({code:zod.z.ZodIssueCode.custom,path:["parts","frontend","nav",c,"key"],message:`together with the plugin id this derives "${d}" (${d.length} chars), over the ${chunkROFUQLOZ_cjs.MAX_PLUGIN_MENU_PERMISSION_LENGTH}-char limit \u2014 shorten the id or the key`})})});function formatIssues(e){return e.issues.map(o=>{const t=o.path.join(".");return t?`${t}: ${o.message}`:o.message})}l(formatIssues,"formatIssues");function parseTegoPluginManifest(e){const o=tegoPluginManifestSchema.safeParse(e);return o.success?{ok:!0,manifest:o.data,errors:[]}:{ok:!1,errors:formatIssues(o.error)}}l(parseTegoPluginManifest,"parseTegoPluginManifest"),exports.PYTHON_LOCK_FILENAME=PYTHON_LOCK_FILENAME,exports.PYTHON_RUNNER_VERSION=PYTHON_RUNNER_VERSION,exports.PYTHON_WHEELS_DIR=PYTHON_WHEELS_DIR,exports.checkPluginAccessCatalog=checkPluginAccessCatalog,exports.checkPythonVendoring=checkPythonVendoring,exports.normalizePackageName=normalizePackageName,exports.parseRequirementsLock=parseRequirementsLock,exports.parseTegoPluginManifest=parseTegoPluginManifest,exports.parseWheelFilename=parseWheelFilename,exports.tegoPluginManifestSchema=tegoPluginManifestSchema;

package/dist/chunk-5CU33JVY.js

@@ -0,0 +1 @@
+var N=Object.defineProperty;var u=(o,t)=>N(o,"name",{value:t,configurable:!0});import{PLUGIN_NAV_ICONS as _,publicRoutePathProblem as E,PLUGIN_PUBLIC_ROUTE_METHODS as L,publicRoutesOverlap as H,formatPublicRoute as w,PLUGIN_PART_DEFAULTS as b,pluginMenuPermission as O,MAX_PLUGIN_MENU_PERMISSION_LENGTH as P}from"./chunk-BTHXQWHT.js";import{parseSemanticVersion as D,isValidHostApiRange as p,compareSkillSemanticVersions as m,hostApiRangeMinimum as h}from"./chunk-7XHF3YSK.js";import{validateAccessCatalog as U}from"./chunk-VMCGDDGP.js";import{isIP as C}from"net";import{z as e}from"zod";function M(o,t){const a=`access.catalog (${o.access?.catalog??"?"})`,n=U(t);if(!n.ok)return{ok:!1,errors:n.issues.map(r=>`${a}: ${r.path}: ${r.message}`)};const s=new Set((o.parts.frontend?.nav??[]).map(r=>r.key)),i=Object.keys(n.catalog.menus).filter(r=>!s.has(r)).map(r=>`${a}: menus.${r}: no parts.frontend.nav entry has this key`);return i.length>0?{ok:!1,errors:i}:{ok:!0,catalog:n.catalog}}u(M,"checkPluginAccessCatalog");var v={major:3,minor:12},F=36,f="requirements.lock",G="wheels";function I(o){return o.toLowerCase().replace(/[-_.]+/g,"-")}u(I,"normalizePackageName");function S(o){const t=[],a=[],n=o.replace(/\\\r?\n/g," ").split(/\r?\n/).map(s=>s.replace(/(^|\s)#.*$/,"").trim()).filter(Boolean);for(const s of n){const[i="",...r]=s.split(/\s+/),c=/^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?==([^\s;]+)$/.exec(i);if(!c||s.includes(";")){a.push(`${f}: "${s.slice(0,80)}" is not a pinned "name==version" requirement without markers`);continue}const l=[];for(const g of r){const x=/^--hash=sha256:([0-9a-f]{64})$/.exec(g);x?.[1]?l.push(x[1]):a.push(`${f}: unsupported option "${g.slice(0,40)}" on ${c[1]}`)}l.length===0&&a.push(`${f}: ${c[1]}==${c[2]} has no --hash; compile with --generate-hashes`),t.push({name:I(c[1]),version:c[2].toLowerCase(),hashes:l})}return{requirements:t,errors:a}}u(S,"parseRequirementsLock");function Z(o){if(!o.endsWith(".whl"))return null;const t=o.slice(0,-4).split("-");if(t.length!==5&&t.length!==6)return null;const[a,n]=t,[s,i,r]=t.slice(-3);return!a||!n||!s||!i||!r?null:{name:I(a),version:n.toLowerCase(),pythonTags:s.split("."),abiTags:i.split("."),platformTags:r.split(".")}}u(Z,"parseWheelFilename");function V(o){const{major:t,minor:a}=v,n=`${t}${a}`;return o.pythonTags.some(s=>{if(s===`py${t}`||s===`py${n}`||s===`cp${n}`)return!0;const i=/^cp3(\d+)$/.exec(s);return i?.[1]!==void 0&&Number(i[1])<=a&&o.abiTags.includes("abi3")})}u(V,"supportsInterpreter");function W(o,t){const a=t==="linux/amd64"?"x86_64":"aarch64";return o.platformTags.some(n=>{if(n==="any"||n===`manylinux2014_${a}`||a==="x86_64"&&/^manylinux(1|2010)_x86_64$/.test(n))return!0;const s=/^manylinux_2_(\d+)_(x86_64|aarch64)$/.exec(n);return s?.[2]===a&&Number(s[1])<=F})}u(W,"supportsPlatform");function B(o){if(o.lockText===null)return[`Python backend ships no ${f}. The runner installs offline from it with --require-hashes.`];const{requirements:t,errors:a}=S(o.lockText),n=o.wheels.map(s=>({...s,parsed:Z(s.filename)}));for(const s of n){if(!s.parsed){a.push(`"${s.filename}" is not a valid wheel filename`);continue}const i=t.find(r=>r.name===s.parsed.name&&r.version===s.parsed.version);i?i.hashes.includes(s.sha256)||a.push(`"${s.filename}" does not match any --hash locked for ${i.name}==${i.version}`):a.push(`"${s.filename}" is not in ${f}; ship only locked wheels`)}for(const s of t){const i=n.filter(r=>r.parsed?.name===s.name&&r.parsed.version===s.version&&V(r.parsed));for(const r of o.platforms)i.some(c=>W(c.parsed,r))||a.push(`No wheel for ${s.name}==${s.version} on ${r} (python ${v.major}.${v.minor})`)}return a}u(B,"checkPythonVendoring");var K=/^[a-z0-9][a-z0-9._-]*$/,T="directory.read",R="1.22.0",Y=128,Q=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,d=e.string().min(1).max(256).regex(Q,"must be a relative path inside the package").refine(o=>!o.split("/").some(t=>t===".."||t==="."),{message:'must not contain "." or ".." segments'}),y=e.union([e.string().min(1),e.record(e.string().min(1),e.string().min(1))]),X=e.string().refine(o=>{try{return D(o),!0}catch{return!1}},{message:"must be a valid semantic version"}),k=e.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/,"must be lowercase alphanumeric with hyphens"),J=e.object({key:k,labelKey:e.string().min(1).max(200),icon:e.enum(_).optional(),order:e.number().int().min(0).max(1e4).optional(),path:e.string().regex(/^\/[A-Za-z0-9/_-]*$/,'must start with "/"').max(256).optional()}).strict(),A=e.string().min(1).max(64).regex(/^[a-zA-Z][a-zA-Z0-9_]*$/,"must be a plain identifier: a letter followed by letters, digits or underscores"),ee=e.object({type:e.enum(["string","number","integer","boolean","array"]),title:e.string().min(1).max(200).optional(),description:e.string().min(1).max(1e3).optional(),default:e.unknown().optional(),enum:e.array(e.union([e.string().max(200),e.number()])).min(1).max(50).optional(),minLength:e.number().int().min(0).max(1e4).optional(),maxLength:e.number().int().min(1).max(1e4).optional(),pattern:e.string().min(1).max(500).optional(),format:e.enum(["uri","email"]).optional(),minimum:e.number().optional(),maximum:e.number().optional(),items:e.object({type:e.literal("string"),enum:e.array(e.string().max(200)).min(1).max(50).optional()}).strict().optional(),maxItems:e.number().int().min(1).max(200).optional()}).strict().superRefine((o,t)=>{o.type==="array"&&o.items===void 0&&t.addIssue({code:e.ZodIssueCode.custom,path:["items"],message:'an array field must declare { "type": "string" } items'}),o.type!=="array"&&o.items!==void 0&&t.addIssue({code:e.ZodIssueCode.custom,path:["items"],message:"only an array field may declare items"}),o.enum&&o.default!==void 0&&(o.enum.some(n=>Object.is(n,o.default))||t.addIssue({code:e.ZodIssueCode.custom,path:["default"],message:"must be one of the declared enum values"}))}),$=e.union([e.string().min(1).max(500),e.record(e.string().min(1),e.string().min(1).max(500))]),oe=e.object({label:$.optional(),help:$.optional(),placeholder:$.optional(),order:e.number().int().min(0).max(1e4).optional(),advanced:e.boolean().optional(),sensitive:e.boolean().optional()}).strict(),j=e.object({schema:e.object({type:e.literal("object"),properties:e.record(A,ee),required:e.array(A).max(50).optional(),additionalProperties:e.literal(!1).optional()}).strict(),uiHints:e.record(A,oe).optional()}).strict().superRefine((o,t)=>{const a=Object.keys(o.schema.properties);a.length>50&&t.addIssue({code:e.ZodIssueCode.custom,path:["schema","properties"],message:"a config section is limited to 50 fields"});for(const n of o.schema.required??[])a.includes(n)||t.addIssue({code:e.ZodIssueCode.custom,path:["schema","required"],message:`"${n}" is required but not declared in properties`});for(const n of Object.keys(o.uiHints??{}))a.includes(n)||t.addIssue({code:e.ZodIssueCode.custom,path:["uiHints",n],message:"no such field in the section schema"})}),te=e.object({dir:d.optional(),entry:d.optional(),i18nDir:d.optional(),icon:e.enum(_).optional(),nav:e.array(J).max(20).optional(),config:j.optional()}).strict().superRefine((o,t)=>{for(const[a,n]of Object.entries(o.config?.uiHints??{}))n.sensitive===!0&&t.addIssue({code:e.ZodIssueCode.custom,path:["config","uiHints",a,"sensitive"],message:"the frontend config section is delivered to the browser, so it cannot hold secrets \u2014 declare this field in the backend section instead"})}).refine(o=>{const t=(o.nav??[]).map(a=>a.key);return new Set(t).size===t.length},{message:"nav entries must have unique keys",path:["nav"]}),ae=e.object({memoryMb:e.number().int().min(64).max(4096).optional(),cpuMs:e.number().int().min(100).max(6e5).optional(),requestTimeoutMs:e.number().int().min(100).max(12e4).optional()}).strict(),q=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]$/,se=e.string().max(259).refine(o=>{if(o==="*")return!0;const t=/^\[([0-9a-f:]+)\]:([1-9]\d{0,4})$/.exec(o);if(t)return C(t[1])===6&&Number(t[2])<=65535;const a=/^([^:]+)(?::([1-9]\d{0,4}))?$/.exec(o);if(!a)return!1;const[,n,s]=a;return s&&Number(s)>65535?!1:s&&C(n)===4||q.test(n)},"must be *, a lowercase hostname, hostname:port, or IP:port"),ne=e.object({method:e.enum(L),path:e.string().max(256).superRefine((o,t)=>{const a=E(o);a&&t.addIssue({code:e.ZodIssueCode.custom,message:a})})}).strict(),re=e.object({dir:d.optional(),runtime:e.enum(["node","python"]).optional(),entry:d.optional(),platforms:e.array(e.enum(["linux/amd64","linux/arm64"])).min(1).optional(),egress:e.array(se).max(20).refine(o=>!o.includes("*")||o.length===1,{message:"the * wildcard must be the only egress entry"}).optional(),migrationsDir:d.optional(),compatibilityRepairs:e.array(e.object({id:e.string().regex(/^[a-z][a-z0-9_-]{0,99}$/),sqlFile:d.refine(o=>o.startsWith("repairs/")&&o.endsWith(".sql"),"Use a SQL file under repairs/"),table:e.string().regex(/^[a-z][a-z0-9_]{0,62}$/),column:e.string().regex(/^[a-z][a-z0-9_]{0,62}$/),postgresType:e.enum(["integer","text","boolean","bigint","jsonb"])}).strict()).max(100).refine(o=>new Set(o.map(t=>t.id)).size===o.length,"Repair IDs must be unique").optional(),healthPath:e.string().regex(/^\/[A-Za-z0-9/_-]*$/,'must start with "/"').max(256).optional(),limits:ae.optional(),publicRoutes:e.array(ne).max(100).optional(),config:j.optional()}).strict().superRefine((o,t)=>{const a=o.publicRoutes??[];a.forEach((n,s)=>{const i=a.slice(0,s).find(r=>H(r,n));i&&t.addIssue({code:e.ZodIssueCode.custom,path:["publicRoutes",s],message:`"${w(n)}" can match the same requests as "${w(i)}"`})}),o.platforms&&(o.runtime??"node")!=="python"&&t.addIssue({code:e.ZodIssueCode.custom,path:["platforms"],message:'only applies to runtime "python"'})}),ie=e.object({dir:d.optional(),hooks:e.object({allowPromptInjection:e.boolean().optional(),allowConversationAccess:e.boolean().optional()}).strict().optional()}).strict();function ce(o,t){return t===o||t.startsWith(`${o}/`)}u(ce,"containsPath");var de=e.object({dir:d.optional()}).strict(),le=e.object({frontend:te.optional(),backend:re.optional(),claw:ie.optional(),publicFrontend:de.optional()}).strict().refine(o=>o.frontend!==void 0||o.backend!==void 0||o.claw!==void 0,{message:"a plugin must declare at least one of frontend, backend, claw"}).superRefine((o,t)=>{const a=[["frontend",o.frontend?.dir??b.frontend.dir],["backend",o.backend?.dir??b.backend.dir],["claw",o.claw?.dir??b.claw.dir],["publicFrontend",o.publicFrontend?.dir??b.publicFrontend.dir]].filter(([n])=>o[n]!==void 0);for(const[n,s]of a)for(const[i,r]of a)n!==i&&ce(s,r)&&t.addIssue({code:e.ZodIssueCode.custom,path:[i,"dir"],message:s===r?`must not be the same directory as the ${n} part ("${s}")`:`must not sit inside the ${n} part's directory ("${s}")`})}),ue=e.object({required:e.array(e.string().min(1).max(128)).max(50).optional()}).strict(),pe=e.object({database:e.boolean().optional(),storage:e.boolean().optional(),events:e.boolean().optional(),notifications:e.boolean().optional()}).strict(),z=e.object({manifestVersion:e.literal(1),id:e.string().max(Y).regex(K,"must be lowercase letters, digits, dot, underscore or hyphen, starting with a letter or digit"),version:X,displayName:y,description:y.optional(),author:e.string().max(200).optional(),homepage:e.string().url().max(500).optional(),icon:d.optional(),category:e.string().min(1).max(64).optional(),tags:e.array(e.string().min(1).max(64)).max(20).optional(),hostApiRange:e.string().refine(p,{message:'must be a caret range like "^1.2.0" or an exact "1.2.0"'}).optional(),scope:e.enum(["avatar","tenant"]),declares:pe.optional(),parts:le,permissions:ue.optional(),access:e.object({catalog:d}).strict().optional(),audit:e.object({tools:e.record(e.string().min(1).max(128),e.object({category:e.enum(["read","write","search","browse","exec","knowledge","memory","message","schedule","delegate","document","plugin"]).optional(),title:y.optional(),target:e.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).optional(),risk:e.enum(["low","medium","high"]).optional(),dataClasses:e.array(e.string().min(1).max(32)).max(10).optional()}).strict()).optional()}).strict().optional(),agentTemplates:e.array(e.object({key:k,entry:d,icon:d.optional()}).strict()).max(20).optional(),workDelegation:e.object({allowedAvatarRoles:e.array(e.string().min(1).max(100)).min(1).max(20),settingsRoute:e.string().regex(/^\/[A-Za-z0-9/_-]*$/,'must start with "/"').max(256).refine(o=>!o.startsWith("//"),"must be a plugin page").optional(),summary:y.refine(o=>(typeof o=="string"?[o]:Object.values(o)).every(t=>t.length<=120),"must be at most 120 characters in every locale").optional(),privacyPolicyUrl:e.string().url().max(2048).refine(o=>o.startsWith("https://"),"must be an https URL").optional(),conversationCapture:e.boolean().optional()}).strict().optional(),conversationRecordRoutes:e.array(e.object({entity:k,path:d,contextQuery:e.string().max(200).regex(/^[A-Za-z0-9_=&-]+$/).optional(),labelFields:e.array(e.string().regex(/^[A-Za-z][A-Za-z0-9_]*$/)).min(1).max(3).optional()}).strict()).max(30).optional(),agentReadiness:e.object({path:d}).strict().optional()}).strict().superRefine((o,t)=>{const a=new Set;for(const[c,l]of(o.agentTemplates??[]).entries())a.has(l.key)&&t.addIssue({code:e.ZodIssueCode.custom,path:["agentTemplates",c,"key"],message:"duplicate template key"}),a.add(l.key);const n=new Set;for(const[c,l]of(o.conversationRecordRoutes??[]).entries())n.has(l.entity)&&t.addIssue({code:e.ZodIssueCode.custom,path:["conversationRecordRoutes",c,"entity"],message:"duplicate conversation entity"}),n.add(l.entity);(o.parts.frontend!==void 0||o.parts.backend!==void 0)&&o.hostApiRange===void 0&&t.addIssue({code:e.ZodIssueCode.custom,path:["hostApiRange"],message:"required when a frontend or backend part is declared, so the host can refuse incompatible releases"});const i=o.parts.backend?.publicRoutes??[];if(o.parts.publicFrontend!==void 0&&i.length===0&&t.addIssue({code:e.ZodIssueCode.custom,path:["parts","publicFrontend"],message:"requires parts.backend.publicRoutes for the pages to call"}),o.parts.backend===void 0&&o.declares)for(const c of["database","storage","events"])o.declares[c]===!0&&t.addIssue({code:e.ZodIssueCode.custom,path:["declares",c],message:"requires a backend part"});o.permissions?.required?.includes("knowledge.manage")&&(!o.parts.backend||!o.hostApiRange||p(o.hostApiRange)&&m(h(o.hostApiRange),"1.23.0")<0)&&t.addIssue({code:e.ZodIssueCode.custom,path:["hostApiRange"],message:"knowledge.manage requires a backend and host API ^1.23.0 or later"}),o.permissions?.required?.includes("proactive.emit")&&(!o.parts.backend||!o.hostApiRange||p(o.hostApiRange)&&m(h(o.hostApiRange),"1.26.0")<0)&&t.addIssue({code:e.ZodIssueCode.custom,path:["hostApiRange"],message:"proactive.emit requires a backend and host API ^1.26.0 or later"}),o.permissions?.required?.includes("attention.request")&&(!o.parts.backend||!o.hostApiRange||p(o.hostApiRange)&&m(h(o.hostApiRange),"1.34.0")<0)&&t.addIssue({code:e.ZodIssueCode.custom,path:["hostApiRange"],message:"attention.request requires a backend and host API ^1.34.0 or later"}),o.permissions?.required?.includes("mail.send")&&(!o.parts.backend||!o.hostApiRange||p(o.hostApiRange)&&m(h(o.hostApiRange),"1.29.0")<0)&&t.addIssue({code:e.ZodIssueCode.custom,path:["hostApiRange"],message:"mail.send requires a backend and host API ^1.29.0 or later"}),o.agentReadiness!==void 0&&o.parts.backend===void 0&&t.addIssue({code:e.ZodIssueCode.custom,path:["agentReadiness"],message:"requires a backend part to answer it"}),(o.agentReadiness!==void 0||o.workDelegation?.settingsRoute!==void 0)&&(!o.hostApiRange||p(o.hostApiRange)&&m(h(o.hostApiRange),"1.30.0")<0)&&t.addIssue({code:e.ZodIssueCode.custom,path:["hostApiRange"],message:"agentReadiness and workDelegation.settingsRoute require host API ^1.30.0 or later"}),o.workDelegation!==void 0&&o.parts.backend===void 0&&t.addIssue({code:e.ZodIssueCode.custom,path:["workDelegation"],message:"requires a backend part to act on it"});const r=o.workDelegation;(r?.summary!==void 0||r?.privacyPolicyUrl!==void 0||r?.conversationCapture!==void 0)&&(!o.hostApiRange||p(o.hostApiRange)&&m(h(o.hostApiRange),"1.33.0")<0)&&t.addIssue({code:e.ZodIssueCode.custom,path:["hostApiRange"],message:"workDelegation.summary, privacyPolicyUrl and conversationCapture require host API ^1.33.0 or later"}),o.access!==void 0&&(o.parts.backend===void 0&&t.addIssue({code:e.ZodIssueCode.custom,path:["access"],message:"requires a backend part to enforce it"}),o.permissions?.required?.includes(T)||t.addIssue({code:e.ZodIssueCode.custom,path:["permissions","required"],message:`must include "${T}" when access is declared`}),o.hostApiRange!==void 0&&p(o.hostApiRange)&&m(h(o.hostApiRange),R)<0&&t.addIssue({code:e.ZodIssueCode.custom,path:["hostApiRange"],message:`access needs host API ${R} \u2014 declare "^${R}" or later`})),(o.parts.frontend?.nav??[]).forEach((c,l)=>{const g=O(o.id,c.key);g.length<=P||t.addIssue({code:e.ZodIssueCode.custom,path:["parts","frontend","nav",l,"key"],message:`together with the plugin id this derives "${g}" (${g.length} chars), over the ${P}-char limit \u2014 shorten the id or the key`})})});function me(o){return o.issues.map(t=>{const a=t.path.join(".");return a?`${a}: ${t.message}`:t.message})}u(me,"formatIssues");function he(o){const t=z.safeParse(o);return t.success?{ok:!0,manifest:t.data,errors:[]}:{ok:!1,errors:me(t.error)}}u(he,"parseTegoPluginManifest");export{f as PYTHON_LOCK_FILENAME,v as PYTHON_RUNNER_VERSION,G as PYTHON_WHEELS_DIR,M as checkPluginAccessCatalog,B as checkPythonVendoring,I as normalizePackageName,S as parseRequirementsLock,he as parseTegoPluginManifest,Z as parseWheelFilename,z as tegoPluginManifestSchema};

package/dist/chunk-7K37PVGV.js

@@ -0,0 +1,5 @@
+var f=Object.defineProperty;var s=(e,t)=>f(e,"name",{value:t,configurable:!0});import{SHARED_MODULE_IDS as l}from"./chunk-7XHF3YSK.js";import g from"magic-string";import{createRequire as h}from"module";import{join as p,dirname as E}from"path";var m="@tego/ui",d="@tego/ui/tailwind-preset",y=["@tego/plugin-access-ui"],O="**/*.{js,cjs}";function v({pluginId:e,root:t,content:n}){const i=h(p(t,"vite.config.ts")),o=s(u=>p(E(i.resolve(u)),O),"compiledCodeOf");let r;try{r=i(d)}catch(u){throw new Error(`tegoPluginTailwind: cannot resolve ${d} from ${t}; install ${m} in the plugin`,{cause:u})}const a=y.flatMap(u=>{try{return[o(u)]}catch{return[]}});return{presets:[r],content:[...n,o(m),...a],corePlugins:{preflight:!1},important:`.${e}`}}s(v,"tegoPluginTailwind");var _="tego-shared:",S=["chrome87","firefox78","safari14","edge88"],c={mode:"development",build:{minify:!1,sourcemap:"inline"}};function D(e){return{name:"tego-plugin-inline-css",enforce:"post",generateBundle(t,n){const i=Object.entries(n).filter(([r,a])=>a.type==="asset"&&r.endsWith(".css")).map(([r,a])=>(delete n[r],String(a.source))).join(`
+`);if(!i)return;const o=Object.values(n).find(r=>r.type==="chunk"&&r.isEntry);o?.type==="chunk"&&(o.code=`(function(){try{var s=document.createElement('style');s.setAttribute('data-tego-plugin',${JSON.stringify(e)});s.textContent=${JSON.stringify(i)};document.head.appendChild(s)}catch(e){}})();
+${o.code}`)}}}s(D,"inlineCss");function C(){return{name:"tego-plugin-isolate-chunk-scope",renderChunk:{order:"post",handler(e){const t=new g(e);return t.prepend(`(function(){
+`),t.append(`
+})();`),{code:t.toString(),map:t.generateMap({hires:!0})}}}}}s(C,"isolateChunkScope");function P(e){const t=Object.fromEntries(l.map(i=>[i,`${_}${i}`])),n=e.development??!1;return{plugins:[D(e.pluginId??""),C()],mode:n?c.mode:"production",esbuild:{jsx:"automatic",jsxDev:!1},build:{outDir:e.outDir??"dist",emptyOutDir:!0,target:S,sourcemap:n?c.build.sourcemap:!1,minify:n?c.build.minify:!0,cssCodeSplit:!1,rollupOptions:{input:e.entry,external:[...l],output:{format:"system",paths:t,entryFileNames:"index.js",chunkFileNames:"[name]-[hash].js",assetFileNames:"[name]-[hash][extname]"},preserveEntrySignatures:"exports-only"}}}}s(P,"tegoPluginFrontend");export{c as TEGO_PLUGIN_DEV_OVERRIDES,P as tegoPluginFrontend,v as tegoPluginTailwind};

package/dist/chunk-7XHF3YSK.js

@@ -0,0 +1 @@
+var $=Object.defineProperty;var i=(r,e)=>$(r,"name",{value:e,configurable:!0});function s(r){const e=/^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(r);if(!e)throw new Error(`Invalid semantic version: ${r}`);return{major:Number(e[1]),minor:Number(e[2]),patch:Number(e[3]),prerelease:e[4]?.split(".")??[]}}i(s,"parseSemanticVersion");function a(r,e){const u=s(r),t=s(e);for(const n of["major","minor","patch"])if(u[n]!==t[n])return u[n]-t[n];if(u.prerelease.length===0)return t.prerelease.length===0?0:1;if(t.prerelease.length===0)return-1;const l=Math.max(u.prerelease.length,t.prerelease.length);for(let n=0;n<l;n++){const o=u.prerelease[n],c=t.prerelease[n];if(o===void 0)return-1;if(c===void 0)return 1;if(o===c)continue;const m=/^\d+$/.test(o)?Number(o):null,f=/^\d+$/.test(c)?Number(c):null;return m!==null&&f!==null?m-f:m!==null?-1:f!==null?1:o.localeCompare(c)}return 0}i(a,"compareSkillSemanticVersions");var h="1.36.0",N=["react","react-dom","react-dom/client","react/jsx-runtime","@tego/ui","react-i18next","lucide-react","@tego/chat/plugin-surface"],p=/^\^(\d+)\.(\d+)\.(\d+)$/,d=/^(\d+)\.(\d+)\.(\d+)$/;function A(r){return p.test(r)||d.test(r)}i(A,"isValidHostApiRange");function E(r){const e=p.exec(r)??d.exec(r);if(!e)throw new Error(`Unsupported host API range "${r}". Use "^X.Y.Z" or "X.Y.Z".`);return`${e[1]}.${e[2]}.${e[3]}`}i(E,"hostApiRangeMinimum");function x(r,e,u){return r>0?`${r+1}.0.0`:e>0?`0.${e+1}.0`:`0.0.${u+1}`}i(x,"caretUpperBound");function b(r,e){if(d.exec(r))return a(e,r)===0;const t=p.exec(r);if(!t)throw new Error(`Unsupported host API range "${r}". Use "^X.Y.Z" or "X.Y.Z".`);s(e);const l=`${t[1]}.${t[2]}.${t[3]}`,n=x(Number(t[1]),Number(t[2]),Number(t[3]));return a(e,l)>=0&&a(e,n)<0}i(b,"satisfiesHostApiRange");export{h as HOST_API_VERSION,N as SHARED_MODULE_IDS,a as compareSkillSemanticVersions,E as hostApiRangeMinimum,A as isValidHostApiRange,s as parseSemanticVersion,b as satisfiesHostApiRange};

package/dist/chunk-AJY7ZHXK.cjs

@@ -0,0 +1,3 @@
+"use strict";var R=Object.defineProperty;var c=(i,n)=>R(i,"name",{value:n,configurable:!0});var chunkOP64Y4IN_cjs=require("./chunk-OP64Y4IN.cjs"),zod=require("zod"),DELEGATION_ACTIONS=["records.read","work.prepare"],RESERVED_PERMISSIONS={manage:"access.manage",audit:"access.audit"},RESERVED_GROUP="access",HOST_ADMIN_ROLE="admin",BUILTIN_PRINCIPAL_KINDS=["user","unit"],GLOBAL_DOMAIN="global",SEGMENT="[a-z][a-z0-9_]*",permissionKeyPattern=new RegExp(`^${SEGMENT}(\\.${SEGMENT})+$`),namePattern=new RegExp(`^${SEGMENT}$`),labelKey=zod.z.string().min(1).max(200),agentPolicySchema=zod.z.union([zod.z.object({allowed:zod.z.literal(!1)}).strict(),zod.z.object({requires:zod.z.array(zod.z.enum(DELEGATION_ACTIONS)).min(1)}).strict()]),permissionSchema=zod.z.object({group:zod.z.string().regex(namePattern),labelKey,descriptionKey:labelKey.optional(),scopes:zod.z.array(zod.z.string().regex(namePattern)).min(1).optional(),implies:zod.z.array(zod.z.string().regex(permissionKeyPattern)).optional(),agent:agentPolicySchema.optional(),deprecated:zod.z.boolean().optional()}).strict(),grantValueSchema=zod.z.union([zod.z.literal(!0),zod.z.string().regex(namePattern)]),builtinRoleSchema=zod.z.object({nameKey:labelKey,descriptionKey:labelKey.optional(),grants:zod.z.record(zod.z.string(),grantValueSchema),assignableBy:zod.z.enum(["access-manager","host-admin"]).optional(),exemptFromRoleLimit:zod.z.boolean().optional()}).strict(),accessCatalogSchema=zod.z.object({$schema:zod.z.string().optional(),version:zod.z.number().int().min(1),groups:zod.z.array(zod.z.object({key:zod.z.string().regex(namePattern),labelKey}).strict()).min(1),scopes:zod.z.record(zod.z.string().regex(namePattern),zod.z.object({labelKey,descriptionKey:labelKey.optional()}).strict()).optional(),permissions:zod.z.record(zod.z.string(),permissionSchema),menus:zod.z.record(zod.z.string().min(1),zod.z.union([zod.z.string(),zod.z.array(zod.z.string()).min(1)])).optional(),roles:zod.z.record(zod.z.string(),builtinRoleSchema),hostRoleBindings:zod.z.record(zod.z.string().min(1),zod.z.array(zod.z.string()).min(1)),defaults:zod.z.object({unassigned:zod.z.string().nullable()}).strict(),domains:zod.z.record(zod.z.string().regex(namePattern),zod.z.object({labelKey,hierarchical:zod.z.boolean().optional()}).strict()).optional(),assignment:zod.z.object({principals:zod.z.array(zod.z.string().regex(namePattern)).min(1),maxRolesPerPrincipal:zod.z.record(zod.z.string().regex(namePattern),zod.z.number().int().min(1)).optional()}).strict()}).strict(),AccessCatalogError=class extends Error{static{c(this,"AccessCatalogError")}constructor(i){super(`Invalid access catalog:
+${i.map(n=>`- ${n.path}: ${n.message}`).join(`
+`)}`),this.issues=i,this.name="AccessCatalogError"}issues},RESERVED_DEFINITIONS={[RESERVED_PERMISSIONS.manage]:{group:RESERVED_GROUP,labelKey:"tegoAccess.permission.manage",descriptionKey:"tegoAccess.permission.manageDescription",scopes:null,implies:[RESERVED_PERMISSIONS.audit],agent:{allowed:!1},deprecated:!1,reserved:!0},[RESERVED_PERMISSIONS.audit]:{group:RESERVED_GROUP,labelKey:"tegoAccess.permission.audit",descriptionKey:"tegoAccess.permission.auditDescription",scopes:null,implies:[],agent:{allowed:!1},deprecated:!1,reserved:!0}};function lookupTable(i={}){return Object.assign(Object.create(null),i)}c(lookupTable,"lookupTable");function validateAccessCatalog(i){const n=accessCatalogSchema.safeParse(i);if(!n.success)return{ok:!1,issues:n.error.issues.map(e=>({path:e.path.join(".")||"(root)",message:e.message}))};const t=n.data,m=[],r=c((e,s)=>m.push({path:e,message:s}),"issue"),d=new Set;for(const[e,s]of t.groups.entries())s.key===RESERVED_GROUP&&r(`groups.${e}`,`"${RESERVED_GROUP}" is reserved for the SDK`),d.has(s.key)&&r(`groups.${e}`,`duplicate group "${s.key}"`),d.add(s.key);const $=new Set(Object.keys(t.scopes??{})),l=lookupTable();for(const[e,s]of Object.entries(t.permissions)){const o=`permissions.${e}`;permissionKeyPattern.test(e)||r(o,"a permission key is `<resource>.<action>` in lower snake case"),e.startsWith(`${RESERVED_GROUP}.`)&&r(o,`"${RESERVED_GROUP}.*" permissions are reserved for the SDK`),d.has(s.group)||r(`${o}.group`,`unknown group "${s.group}"`);const a=s.scopes??null;if(a){new Set(a).size!==a.length&&r(`${o}.scopes`,"a scope appears twice");for(const p of a)$.has(p)||r(`${o}.scopes`,`scope "${p}" is not declared in "scopes"`)}l[e]={key:e,group:s.group,labelKey:s.labelKey,...s.descriptionKey?{descriptionKey:s.descriptionKey}:{},scopes:a,implies:s.implies??[],agent:s.agent&&"requires"in s.agent?{allowed:!0,requires:[...new Set(s.agent.requires)]}:{allowed:!1},deprecated:s.deprecated??!1,reserved:!1}}for(const[e,s]of Object.entries(RESERVED_DEFINITIONS))l[e]={key:e,...s};for(const e of Object.values(l)){if(e.reserved)continue;const s=`permissions.${e.key}.implies`;for(const o of e.implies){const a=l[o];if(!a){r(s,`unknown permission "${o}"`);continue}if(o===e.key&&r(s,"a permission cannot imply itself"),a.reserved&&r(s,`"${o}" is reserved and can only be granted directly`),a.scopes&&!e.scopes&&r(s,`"${o}" has scopes, so only a permission with the same scopes can imply it`),a.scopes&&e.scopes)for(const p of e.scopes)a.scopes.includes(p)||r(s,`"${o}" does not offer scope "${p}"`)}}const k=c((e,s)=>{for(const[o,a]of Object.entries(s)){const p=l[o];if(!p){r(`${e}.${o}`,"unknown permission");continue}const b=grantProblem(p,a);b&&r(`${e}.${o}`,b)}},"checkGrants"),g=lookupTable();for(const[e,s]of Object.entries(t.roles)){const o=`roles.${e}`;namePattern.test(e)||r(o,"a role key is lower snake case"),k(`${o}.grants`,s.grants),g[e]={key:e,nameKey:s.nameKey,...s.descriptionKey?{descriptionKey:s.descriptionKey}:{},grants:s.grants,assignableBy:s.assignableBy??"access-manager",exemptFromRoleLimit:s.exemptFromRoleLimit??!1}}const f=lookupTable();for(const[e,s]of Object.entries(t.menus??{})){f[e]=[...new Set(typeof s=="string"?[s]:s)];for(const o of f[e])l[o]||r(`menus.${e}`,`unknown permission "${o}"`)}for(const[e,s]of Object.entries(t.hostRoleBindings))for(const o of s)g[o]||r(`hostRoleBindings.${e}`,`unknown role "${o}"`);(t.hostRoleBindings[HOST_ADMIN_ROLE]??[]).some(e=>grantsInclude(l,g[e]?.grants??{},RESERVED_PERMISSIONS.manage))||r("hostRoleBindings",`the host "${HOST_ADMIN_ROLE}" role must bind to a role holding "${RESERVED_PERMISSIONS.manage}", or a tenant could lock itself out`);const u=t.defaults.unassigned;if(u!==null){const e=g[u];e?grantsInclude(l,e.grants,RESERVED_PERMISSIONS.manage)&&r("defaults.unassigned",`the default role cannot hold "${RESERVED_PERMISSIONS.manage}": every user would manage access`):r("defaults.unassigned",`unknown role "${u}"`)}const y=lookupTable();for(const[e,s]of Object.entries(t.domains??{}))e===GLOBAL_DOMAIN&&r(`domains.${e}`,`"${GLOBAL_DOMAIN}" names global assignments`),y[e]={labelKey:s.labelKey,hierarchical:s.hierarchical??!1};const z=[...new Set(t.assignment.principals)];z.includes("user")||r("assignment.principals","users must be assignable");const h=t.assignment.maxRolesPerPrincipal??{};for(const e of Object.keys(h))e!==GLOBAL_DOMAIN&&!y[e]&&r(`assignment.maxRolesPerPrincipal.${e}`,`unknown domain type "${e}"`);return m.length>0?{ok:!1,issues:m}:{ok:!0,catalog:{version:t.version,groups:[...t.groups,{key:RESERVED_GROUP,labelKey:"tegoAccess.group.access"}],scopes:lookupTable(t.scopes),permissions:l,menus:f,roles:g,hostRoleBindings:lookupTable(t.hostRoleBindings),defaults:{unassigned:u},domains:y,assignment:{principals:z,maxRolesPerPrincipal:lookupTable(h)}}}}c(validateAccessCatalog,"validateAccessCatalog");function defineAccess(i){const n=validateAccessCatalog(i);if(!n.ok)throw new AccessCatalogError(n.issues);return n.catalog}c(defineAccess,"defineAccess");function accessCatalogFromJson(i){const n=validateAccessCatalog(i);if(!n.ok)throw new AccessCatalogError(n.issues);return n.catalog}c(accessCatalogFromJson,"accessCatalogFromJson");function grantProblem(i,n){return i.scopes===null?n===!0?null:"this permission has no scopes; grant it as `true`":n===!0?`this permission needs a scope: one of ${i.scopes.join(", ")}`:i.scopes.includes(n)?null:`scope "${n}" is not one of ${i.scopes.join(", ")}`}c(grantProblem,"grantProblem");function grantsInclude(i,n,t){return t in chunkOP64Y4IN_cjs.expandImplications(i,n)}c(grantsInclude,"grantsInclude"),exports.AccessCatalogError=AccessCatalogError,exports.BUILTIN_PRINCIPAL_KINDS=BUILTIN_PRINCIPAL_KINDS,exports.DELEGATION_ACTIONS=DELEGATION_ACTIONS,exports.GLOBAL_DOMAIN=GLOBAL_DOMAIN,exports.HOST_ADMIN_ROLE=HOST_ADMIN_ROLE,exports.RESERVED_GROUP=RESERVED_GROUP,exports.RESERVED_PERMISSIONS=RESERVED_PERMISSIONS,exports.accessCatalogFromJson=accessCatalogFromJson,exports.accessCatalogSchema=accessCatalogSchema,exports.defineAccess=defineAccess,exports.grantProblem=grantProblem,exports.validateAccessCatalog=validateAccessCatalog;

package/dist/chunk-BN6TGHSB.cjs

@@ -0,0 +1 @@
+"use strict";var s=Object.defineProperty;var n=(e,t)=>s(e,"name",{value:t,configurable:!0});var zod=require("zod"),pluginDiagramSchema=zod.z.object({kind:zod.z.enum(["mermaid","html"]),source:zod.z.string().min(1).max(262144),destinationKey:zod.z.string().min(1).max(1024),width:zod.z.number().int().min(320).max(2048).default(1200),height:zod.z.number().int().min(240).max(2048).default(800)}).strict(),directoryPrincipalSchema=zod.z.discriminatedUnion("kind",[zod.z.object({kind:zod.z.literal("user"),id:zod.z.string().uuid()}).strict(),zod.z.object({kind:zod.z.literal("unit"),id:zod.z.string().uuid(),includeDescendants:zod.z.boolean().default(!1),roles:zod.z.array(zod.z.enum(["owner","admin","member","viewer"])).min(1).default(["owner","admin","member"])}).strict()]),directoryMatchSchema=zod.z.object({userId:zod.z.string().uuid(),principals:zod.z.array(directoryPrincipalSchema).min(1).max(200)}).strict(),directoryIdentitySchema=zod.z.object({userId:zod.z.string().uuid()}).strict(),directoryValidateSchema=zod.z.object({principals:zod.z.array(directoryPrincipalSchema).min(1).max(200)}).strict(),directoryListSchema=zod.z.object({kind:zod.z.enum(["users","units"]),search:zod.z.string().max(200).optional(),ids:zod.z.array(zod.z.string().uuid()).min(1).max(100).optional(),offset:zod.z.number().int().min(0).default(0),limit:zod.z.number().int().min(1).max(100).default(50)}).strict(),accountInviteSchema=zod.z.object({requestId:zod.z.string().uuid(),organizationName:zod.z.string().trim().min(1).max(200),userId:zod.z.string().uuid().optional(),username:zod.z.string().trim().min(1).max(100).optional(),email:zod.z.string().trim().email().max(255).optional(),fullName:zod.z.string().trim().min(1).max(200).optional(),phone:zod.z.string().trim().max(50).optional()}).strict().superRefine((e,t)=>{!e.userId&&(!e.username||!e.email||!e.fullName)&&t.addIssue({code:"custom",message:"A new user requires username, email and fullName"})}),accountProvisionSchema=accountInviteSchema.innerType().extend({password:zod.z.string().min(8).max(128).regex(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/).optional()}).superRefine((e,t)=>{!e.userId&&(!e.username||!e.email||!e.fullName)&&t.addIssue({code:"custom",message:"A new user requires username, email and fullName"}),!e.userId&&!e.password&&t.addIssue({code:"custom",message:"A new account requires an initial password"})}),accountInvitationSchema=zod.z.object({invitationId:zod.z.string().uuid()}).strict(),accountPasswordResetSchema=zod.z.object({userId:zod.z.string().uuid(),newPassword:zod.z.string().min(8).max(128).regex(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/)}).strict(),pluginKnowledgeReferenceSchema=zod.z.object({knowledgeBaseId:zod.z.string().uuid(),documentId:zod.z.string().uuid(),paragraphId:zod.z.string().uuid(),quote:zod.z.string().trim().min(1).max(4e3).optional(),expectedContentSha256:zod.z.string().regex(/^[a-f0-9]{64}$/).optional()}).strict(),pluginKnowledgeVerifySchema=zod.z.object({userId:zod.z.string().uuid(),avatarId:zod.z.string().uuid(),references:zod.z.array(pluginKnowledgeReferenceSchema).min(1).max(20)}).strict(),PLUGIN_COLLECTION_IMPORT_MAX=50,collectionKeySchema=zod.z.string().regex(/^[a-z0-9][a-z0-9_-]{0,63}$/,'Use lowercase letters, digits, "_" or "-"'),metadataScalarSchema=zod.z.union([zod.z.string().max(512),zod.z.number().finite(),zod.z.boolean(),zod.z.null()]),collectionMetadataSchema=zod.z.record(zod.z.string().min(1).max(64),metadataScalarSchema).refine(e=>Object.keys(e).length<=32,{message:"At most 32 metadata keys"}),pluginCollectionEnsureSchema=zod.z.object({key:collectionKeySchema,name:zod.z.string().trim().min(1).max(128),accessMode:zod.z.enum(["private","managed"]).optional(),policyScope:zod.z.string().trim().min(1).max(128).optional()}).strict(),pluginCollectionPermissionsSchema=zod.z.object({key:collectionKeySchema,syncRevision:zod.z.string().uuid().optional(),grants:zod.z.array(zod.z.object({subjectType:zod.z.enum(["user","team","role","tenant"]),subjectId:zod.z.string().uuid()}).strict()).max(999)}).strict(),pluginCollectionMoveSchema=zod.z.object({migrationId:zod.z.string().uuid(),sourceKey:collectionKeySchema,targetKey:collectionKeySchema,syncRevision:zod.z.string().uuid(),externalIds:zod.z.array(zod.z.string().min(1).max(256)).min(1).max(200).refine(e=>new Set(e).size===e.length,"externalIds must be unique")}).strict().refine(e=>e.sourceKey!==e.targetKey,"source and target must differ"),pluginCollectionAccessSchema=zod.z.object({key:collectionKeySchema.optional(),enabled:zod.z.boolean().optional(),syncRevision:zod.z.string().uuid().optional(),identityRevision:zod.z.string().min(1).max(64).optional()}).strict().refine(e=>!e.enabled||!!(e.identityRevision&&e.syncRevision),{message:"identityRevision and syncRevision are required to resume collection reads"}),pluginCollectionImportSchema=zod.z.object({key:collectionKeySchema,syncRevision:zod.z.string().uuid().optional(),documents:zod.z.array(zod.z.object({externalId:zod.z.string().min(1).max(256),title:zod.z.string().trim().min(1).max(256),text:zod.z.string().min(1).max(2e5),metadata:collectionMetadataSchema.optional()}).strict()).min(1).max(PLUGIN_COLLECTION_IMPORT_MAX).refine(e=>new Set(e.map(t=>t.externalId)).size===e.length,{message:"externalId must be unique within a batch"})}).strict(),pluginCollectionImportFilesSchema=zod.z.object({key:collectionKeySchema,syncRevision:zod.z.string().uuid().optional(),documents:zod.z.array(zod.z.object({externalId:zod.z.string().min(1).max(256),title:zod.z.string().trim().min(1).max(256),storageKey:zod.z.string().min(1).max(512),fileName:zod.z.string().trim().min(1).max(256),contentSha256:zod.z.string().regex(/^[a-f0-9]{64}$/),metadata:collectionMetadataSchema.optional()}).strict()).min(1).max(20).refine(e=>new Set(e.map(t=>t.externalId)).size===e.length,{message:"externalId must be unique within a batch"})}).strict(),pluginCollectionStatusSchema=zod.z.object({key:collectionKeySchema}).strict(),pluginCollectionDeleteSchema=zod.z.object({key:collectionKeySchema}).strict(),pluginCollectionDocumentsStatusSchema=zod.z.object({key:collectionKeySchema,externalIds:zod.z.array(zod.z.string().min(1).max(256)).min(1).max(200).optional(),offset:zod.z.number().int().nonnegative().optional()}).strict(),PLUGIN_COLLECTION_CONTENT_PAGE_MAX=100,pluginCollectionDocumentContentSchema=zod.z.object({key:collectionKeySchema,externalId:zod.z.string().min(1).max(256),page:zod.z.number().int().min(1).default(1),pageSize:zod.z.number().int().min(1).max(PLUGIN_COLLECTION_CONTENT_PAGE_MAX).default(PLUGIN_COLLECTION_CONTENT_PAGE_MAX)}).strict(),pluginCollectionSearchSchema=zod.z.object({key:collectionKeySchema,query:zod.z.string().trim().min(1).max(2e3),topK:zod.z.number().int().min(1).max(50).default(10),filter:zod.z.record(zod.z.string().min(1).max(64),zod.z.union([metadataScalarSchema,zod.z.array(metadataScalarSchema).max(50)])).optional()}).strict(),pluginCollectionRemoveSchema=zod.z.object({key:collectionKeySchema,externalIds:zod.z.array(zod.z.string().min(1).max(256)).min(1).max(200)}).strict(),pluginKnowledgeListInputSchema=zod.z.object({actionProof:zod.z.string().min(1).max(512),search:zod.z.string().max(128).optional(),sourceDepartments:zod.z.array(zod.z.object({externalId:zod.z.string().min(1).max(256),path:zod.z.array(zod.z.string().trim().min(1).max(500)).min(2).max(64),sourceVersion:zod.z.string().regex(/^[a-f0-9]{64}$/)}).strict()).max(2e3).optional(),departmentExternalIds:zod.z.array(zod.z.string().min(1).max(256)).max(2e3).optional(),sourceDocumentIds:zod.z.array(zod.z.string().min(1).max(256)).max(2e3).optional()}).strict(),pluginAdminActionSchema=zod.z.enum(["knowledge.list","knowledge.create.preview","knowledge.create","knowledge.document.prepare","knowledge.document.preview","knowledge.document.import","knowledge.task.read"]),pluginApprovalDigestSchema=zod.z.string().regex(/^[a-f0-9]{64}$/),pluginAdminProofSchema=zod.z.object({action:pluginAdminActionSchema,digest:pluginApprovalDigestSchema}).strict(),pluginKnowledgeBaseInputSchema=zod.z.object({name:zod.z.string().min(1).max(64),description:zod.z.string().max(256).optional(),scope:zod.z.object({type:zod.z.literal("team"),teamId:zod.z.string().uuid()}).strict(),grants:zod.z.array(zod.z.object({subjectType:zod.z.enum(["user","role","team","tenant"]),subjectId:zod.z.string().uuid(),permission:zod.z.enum(["view","use","operate","manage"]),expiresAt:zod.z.string().datetime().nullable().optional()}).strict()).max(100),idempotencyKey:zod.z.string().min(8).max(200)}).strict(),fileNameSchema=zod.z.string().min(1).max(128).refine(e=>!/[\\/\0\r\n]/u.test(e)),pluginDocumentContentInputSchema=zod.z.object({knowledgeBaseId:zod.z.string().uuid(),objectKey:zod.z.string().min(1).max(512),fileName:fileNameSchema,sha256:pluginApprovalDigestSchema}).strict(),pluginDocumentBatchItemSchema=pluginDocumentContentInputSchema.extend({sourceDocumentId:zod.z.string().min(1).max(256),sourceVersion:zod.z.string().max(256),sourceDigest:pluginApprovalDigestSchema,attachmentDigest:pluginApprovalDigestSchema,contentType:zod.z.literal("text/markdown"),idempotencyKey:zod.z.string().min(8).max(512),departmentExternalId:zod.z.string().min(1).max(256),departmentPath:zod.z.array(zod.z.string().min(1).max(500).refine(e=>e.trim().length>0)).min(2).max(64).optional(),departmentSourceVersion:pluginApprovalDigestSchema.optional(),teamId:zod.z.string().uuid(),bindingRevision:zod.z.number().int().positive(),departmentMappingDigest:pluginApprovalDigestSchema.optional(),baseAclVersion:zod.z.number().int().positive()}).strict(),pluginDocumentBatchInputSchema=zod.z.object({ruleVersion:zod.z.number().int().positive(),items:zod.z.array(pluginDocumentBatchItemSchema).min(1).max(100).refine(e=>new Set(e.map(t=>JSON.stringify([t.sourceDocumentId,t.knowledgeBaseId]))).size===e.length,"Duplicate source document and knowledge base")}).strict().superRefine((e,t)=>{const a=new Map;for(const i of e.items){const r=JSON.stringify([i.departmentPath,i.departmentSourceVersion]),o=a.get(i.departmentExternalId);o&&o!==r&&t.addIssue({code:zod.z.ZodIssueCode.custom,message:"Conflicting source department snapshots"}),a.set(i.departmentExternalId,r)}e.ruleVersion>=3&&e.items.some(i=>!i.departmentPath||!i.departmentSourceVersion)&&t.addIssue({code:zod.z.ZodIssueCode.custom,message:"Source department path snapshot required"}),e.ruleVersion===1&&new Set(e.items.map(i=>i.sourceDocumentId)).size!==e.items.length&&t.addIssue({code:zod.z.ZodIssueCode.custom,message:"Legacy batches require unique source documents"}),e.ruleVersion>=2&&e.items.some(i=>!i.departmentMappingDigest)&&t.addIssue({code:zod.z.ZodIssueCode.custom,message:"Organization mapping snapshot required"})}),pluginApprovedSchema=n(e=>zod.z.object({actionProof:zod.z.string().min(1).max(512),approvedDigest:pluginApprovalDigestSchema,input:e}).strict(),"pluginApprovedSchema"),PLUGIN_CONTEXT_HEADERS={userId:"x-tego-plugin-user-id",tenantId:"x-tego-plugin-tenant-id",roles:"x-tego-plugin-roles",avatarId:"x-tego-plugin-avatar-id",delegation:"x-tego-plugin-delegation",issuedAt:"x-tego-plugin-issued-at",signature:"x-tego-plugin-signature",public:"x-tego-plugin-public",installId:"x-tego-plugin-install-id",publicRoute:"x-tego-plugin-public-route",clientIp:"x-tego-plugin-client-ip"};function definePluginBackend(e){return e}n(definePluginBackend,"definePluginBackend"),exports.PLUGIN_COLLECTION_CONTENT_PAGE_MAX=PLUGIN_COLLECTION_CONTENT_PAGE_MAX,exports.PLUGIN_COLLECTION_IMPORT_MAX=PLUGIN_COLLECTION_IMPORT_MAX,exports.PLUGIN_CONTEXT_HEADERS=PLUGIN_CONTEXT_HEADERS,exports.accountInvitationSchema=accountInvitationSchema,exports.accountInviteSchema=accountInviteSchema,exports.accountPasswordResetSchema=accountPasswordResetSchema,exports.accountProvisionSchema=accountProvisionSchema,exports.definePluginBackend=definePluginBackend,exports.directoryIdentitySchema=directoryIdentitySchema,exports.directoryListSchema=directoryListSchema,exports.directoryMatchSchema=directoryMatchSchema,exports.directoryPrincipalSchema=directoryPrincipalSchema,exports.directoryValidateSchema=directoryValidateSchema,exports.pluginAdminActionSchema=pluginAdminActionSchema,exports.pluginAdminProofSchema=pluginAdminProofSchema,exports.pluginApprovalDigestSchema=pluginApprovalDigestSchema,exports.pluginApprovedSchema=pluginApprovedSchema,exports.pluginCollectionAccessSchema=pluginCollectionAccessSchema,exports.pluginCollectionDeleteSchema=pluginCollectionDeleteSchema,exports.pluginCollectionDocumentContentSchema=pluginCollectionDocumentContentSchema,exports.pluginCollectionDocumentsStatusSchema=pluginCollectionDocumentsStatusSchema,exports.pluginCollectionEnsureSchema=pluginCollectionEnsureSchema,exports.pluginCollectionImportFilesSchema=pluginCollectionImportFilesSchema,exports.pluginCollectionImportSchema=pluginCollectionImportSchema,exports.pluginCollectionMoveSchema=pluginCollectionMoveSchema,exports.pluginCollectionPermissionsSchema=pluginCollectionPermissionsSchema,exports.pluginCollectionRemoveSchema=pluginCollectionRemoveSchema,exports.pluginCollectionSearchSchema=pluginCollectionSearchSchema,exports.pluginCollectionStatusSchema=pluginCollectionStatusSchema,exports.pluginDiagramSchema=pluginDiagramSchema,exports.pluginDocumentBatchInputSchema=pluginDocumentBatchInputSchema,exports.pluginDocumentBatchItemSchema=pluginDocumentBatchItemSchema,exports.pluginDocumentContentInputSchema=pluginDocumentContentInputSchema,exports.pluginKnowledgeBaseInputSchema=pluginKnowledgeBaseInputSchema,exports.pluginKnowledgeListInputSchema=pluginKnowledgeListInputSchema,exports.pluginKnowledgeReferenceSchema=pluginKnowledgeReferenceSchema,exports.pluginKnowledgeVerifySchema=pluginKnowledgeVerifySchema;

package/dist/chunk-BTHXQWHT.js

@@ -0,0 +1 @@
+var U=Object.defineProperty;var a=(t,n)=>U(t,"name",{value:n,configurable:!0});var k=["bar-chart","bell","bookmark","book-open","bot","briefcase","building","calendar","chart-pie","clipboard-list","clock","contact","credit-card","database","file-text","folder","globe","handshake","inbox","key","layers","layout-dashboard","library","link","list-todo","mail","map-pin","message-square","mic","package","phone","puzzle","receipt","search","settings","shield","shopping-cart","sliders","sparkles","star","table","tag","target","trending-up","truck","users","wallet","workflow","wrench","zap"],E="puzzle",y=["node","python"],b=["linux/amd64","linux/arm64"],R="tego.plugin.json",_="openclaw.plugin.json",c={frontend:{dir:"frontend",entry:"index.js",i18nDir:"i18n"},backend:{dir:"backend",runtime:"node",entry:{node:"index.js",python:"app.py"},migrationsDir:"migrations",healthPath:"/healthz"},claw:{dir:"claw"},publicFrontend:{dir:"public-frontend",entry:"index.html"}};function G(t){return t.scope??(t.parts.claw?"avatar":"tenant")}a(G,"resolvePluginScope");function O(t){const n=t.declares??{};return{database:n.database??t.parts.backend!==void 0,storage:n.storage??!1,events:n.events??!1,notifications:n.notifications??!1}}a(O,"resolvePluginDeclares");var A=["frontend","backend","claw","publicFrontend"];function S(t){return A.filter(n=>t.parts[n]!==void 0)}a(S,"declaredPartNames");function C(t){const n={},e=t.parts.frontend;if(e){const i=e.dir??c.frontend.dir;n.frontend={dir:i,entryPath:`${i}/${e.entry??c.frontend.entry}`,i18nDirPath:`${i}/${e.i18nDir??c.frontend.i18nDir}`,nav:e.nav??[],...e.config?{config:e.config}:{}}}const r=t.parts.backend;if(r){const i=r.dir??c.backend.dir,l=r.runtime??c.backend.runtime;n.backend={dir:i,runtime:l,entryPath:`${i}/${r.entry??c.backend.entry[l]}`,platforms:l==="python"?[...r.platforms??b]:[],egress:[...new Set(r.egress??[])].sort(),migrationsDirPath:`${i}/${r.migrationsDir??c.backend.migrationsDir}`,...r.compatibilityRepairs?{compatibilityRepairs:r.compatibilityRepairs}:{},healthPath:r.healthPath??c.backend.healthPath,limits:r.limits??{},publicRoutes:r.publicRoutes??[],...r.config?{config:r.config}:{}}}const o=t.parts.claw;if(o){const i=o.dir??c.claw.dir;n.claw={dir:i,manifestPath:`${i}/${_}`,...o.hooks?{hooks:o.hooks}:{}}}const s=t.parts.publicFrontend;if(s){const i=s.dir??c.publicFrontend.dir;n.publicFrontend={dir:i,entryPath:`${i}/${c.publicFrontend.entry}`}}return n}a(C,"resolvePluginParts");var w=["GET","POST","PUT","PATCH","DELETE"],$="/public/plugins/api",P="/public/plugins/pages",m="/public/plugins/avatars/api",g="/public/plugins/avatars/pages",D=/^(?:\/(?:[A-Za-z0-9._~-]+|:[A-Za-z_][A-Za-z0-9_]*))+$/;function p(t){return t.split("/").slice(1)}a(p,"segments");function d(t){return t.startsWith(":")}a(d,"isParam");function I(t){return`${t.method} ${t.path}`}a(I,"formatPublicRoute");function F(t){if(!D.test(t))return'must be "/"-separated literal segments or ":name" parameters, e.g. "/public/inspections/:token"';const n=p(t);if(n.some(r=>/^\.+$/.test(r)))return'must not contain "." or ".." segments';const e=n.filter(d);return new Set(e).size!==e.length?"must not repeat a parameter name":null}a(F,"publicRoutePathProblem");function z(t,n){if(t.method!==n.method)return!1;const e=p(t.path),r=p(n.path);return e.length!==r.length?!1:e.every((o,s)=>{const i=r[s];return d(o)||d(i)||o===i})}a(z,"publicRoutesOverlap");function M(t,n,e){const r=n.toUpperCase(),o=p(e.startsWith("/")?e:`/${e}`);if(o.some(s=>s===""))return null;for(const s of t){if(s.method!==r)continue;const i=p(s.path);if(i.length!==o.length)continue;const l={};if(i.every((u,T)=>{const h=o[T];return d(u)?(l[u.slice(1)]=h,!0):u===h}))return{route:I(s),params:l}}return null}a(M,"matchPublicRoute");function x(t){const n=t.indexOf(`${g}/`);if(n!==-1){const i=t.slice(n+g.length+1),[l,f,u]=i.split("/");return!l||!f||!u?null:`${t.slice(0,n)}${m}/${l}/${f}/${u}`}const e=t.indexOf(`${P}/`);if(e===-1)return null;const r=t.slice(e+P.length+1),[o,s]=r.split("/");return!o||!s?null:`${t.slice(0,e)}${$}/${o}/${s}`}a(x,"publicApiBaseFromPagePath");var B="/p",H="plugin-api",j=["zh-CN","zh-TW","en","ja","ko","de","es","fr","it","pt"];function N(t){return`plugin.${t}`}a(N,"pluginI18nNamespace");function K(t,n){return`${N(t)}:${n}`}a(K,"pluginI18nKey");function v(t,n){return`plugin-${t}-${n}`}a(v,"pluginMenuKey");var W=100;function L(t){return`${B}/${t}`}a(L,"pluginBasePath");function V(t,n){const e=L(t);return!n||n==="/"?e:`${e}${n}`}a(V,"pluginNavPath");function Z(t,n="/"){const e=n.startsWith("/")?n:`/${n}`;return`${H}/${t}${e==="/"?"":e}`}a(Z,"pluginApiPath");function q(t,n="zh-CN"){return typeof t=="string"?t:t[n]??t.en??Object.values(t)[0]??""}a(q,"localizedTextToString");function X(t,n){return`menu.${v(t,n)}`}a(X,"pluginMenuPermission");export{_ as CLAW_MANIFEST_FILENAME,W as MAX_PLUGIN_MENU_PERMISSION_LENGTH,m as PLUGIN_AVATAR_PUBLIC_API_PATH,g as PLUGIN_AVATAR_PUBLIC_PAGES_PATH,b as PLUGIN_BACKEND_PLATFORMS,y as PLUGIN_BACKEND_RUNTIMES,R as PLUGIN_MANIFEST_FILENAME,k as PLUGIN_NAV_ICONS,E as PLUGIN_NAV_ICON_FALLBACK,c as PLUGIN_PART_DEFAULTS,A as PLUGIN_PART_NAMES,$ as PLUGIN_PUBLIC_API_PATH,P as PLUGIN_PUBLIC_PAGES_PATH,w as PLUGIN_PUBLIC_ROUTE_METHODS,j as PLUGIN_SUPPORTED_LOCALES,S as declaredPartNames,I as formatPublicRoute,q as localizedTextToString,M as matchPublicRoute,Z as pluginApiPath,L as pluginBasePath,K as pluginI18nKey,N as pluginI18nNamespace,v as pluginMenuKey,X as pluginMenuPermission,V as pluginNavPath,x as publicApiBaseFromPagePath,F as publicRoutePathProblem,z as publicRoutesOverlap,O as resolvePluginDeclares,C as resolvePluginParts,G as resolvePluginScope};

package/dist/chunk-C2OCOPZQ.cjs

@@ -0,0 +1 @@
+"use strict";var p=Object.defineProperty;var o=(r,e)=>p(r,"name",{value:e,configurable:!0});function parseSemanticVersion(r){const e=/^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(r);if(!e)throw new Error(`Invalid semantic version: ${r}`);return{major:Number(e[1]),minor:Number(e[2]),patch:Number(e[3]),prerelease:e[4]?.split(".")??[]}}o(parseSemanticVersion,"parseSemanticVersion");function compareSkillSemanticVersions(r,e){const i=parseSemanticVersion(r),t=parseSemanticVersion(e);for(const n of["major","minor","patch"])if(i[n]!==t[n])return i[n]-t[n];if(i.prerelease.length===0)return t.prerelease.length===0?0:1;if(t.prerelease.length===0)return-1;const c=Math.max(i.prerelease.length,t.prerelease.length);for(let n=0;n<c;n++){const s=i.prerelease[n],u=t.prerelease[n];if(s===void 0)return-1;if(u===void 0)return 1;if(s===u)continue;const a=/^\d+$/.test(s)?Number(s):null,l=/^\d+$/.test(u)?Number(u):null;return a!==null&&l!==null?a-l:a!==null?-1:l!==null?1:s.localeCompare(u)}return 0}o(compareSkillSemanticVersions,"compareSkillSemanticVersions");var HOST_API_VERSION="1.36.0",SHARED_MODULE_IDS=["react","react-dom","react-dom/client","react/jsx-runtime","@tego/ui","react-i18next","lucide-react","@tego/chat/plugin-surface"],CARET_RANGE_PATTERN=/^\^(\d+)\.(\d+)\.(\d+)$/,EXACT_VERSION_PATTERN=/^(\d+)\.(\d+)\.(\d+)$/;function isValidHostApiRange(r){return CARET_RANGE_PATTERN.test(r)||EXACT_VERSION_PATTERN.test(r)}o(isValidHostApiRange,"isValidHostApiRange");function hostApiRangeMinimum(r){const e=CARET_RANGE_PATTERN.exec(r)??EXACT_VERSION_PATTERN.exec(r);if(!e)throw new Error(`Unsupported host API range "${r}". Use "^X.Y.Z" or "X.Y.Z".`);return`${e[1]}.${e[2]}.${e[3]}`}o(hostApiRangeMinimum,"hostApiRangeMinimum");function caretUpperBound(r,e,i){return r>0?`${r+1}.0.0`:e>0?`0.${e+1}.0`:`0.0.${i+1}`}o(caretUpperBound,"caretUpperBound");function satisfiesHostApiRange(r,e){if(EXACT_VERSION_PATTERN.exec(r))return compareSkillSemanticVersions(e,r)===0;const t=CARET_RANGE_PATTERN.exec(r);if(!t)throw new Error(`Unsupported host API range "${r}". Use "^X.Y.Z" or "X.Y.Z".`);parseSemanticVersion(e);const c=`${t[1]}.${t[2]}.${t[3]}`,n=caretUpperBound(Number(t[1]),Number(t[2]),Number(t[3]));return compareSkillSemanticVersions(e,c)>=0&&compareSkillSemanticVersions(e,n)<0}o(satisfiesHostApiRange,"satisfiesHostApiRange"),exports.HOST_API_VERSION=HOST_API_VERSION,exports.SHARED_MODULE_IDS=SHARED_MODULE_IDS,exports.compareSkillSemanticVersions=compareSkillSemanticVersions,exports.hostApiRangeMinimum=hostApiRangeMinimum,exports.isValidHostApiRange=isValidHostApiRange,exports.parseSemanticVersion=parseSemanticVersion,exports.satisfiesHostApiRange=satisfiesHostApiRange;