cordisx 0.1.0-beta.21 → 0.1.0-beta.23

package/dist/bundled-plugins/@cordisx/plugin-cli-proxy-api/dist/service.mjs

@@ -1009,6 +1009,424 @@ function createCliProxyUpstreamRegistrarV1(registry, producer) {
   });
 }
 
+// src/service/extension-registry.ts
+import { createHash as createHash2 } from "node:crypto";
+var CLI_PROXY_GATEWAY_ADAPTER_SCHEMA_V1 = "https://raw.githubusercontent.com/cordisx/plugin-cli-proxy-api/main/schemas/cli-proxy-gateway-adapter.v1.schema.json";
+var CLI_PROXY_GATEWAY_CONNECTION_SCHEMA_V1 = "https://raw.githubusercontent.com/cordisx/plugin-cli-proxy-api/main/schemas/cli-proxy-gateway-connection.v1.schema.json";
+var CLI_PROXY_GATEWAY_ADAPTER_CONTRACT_V1 = "cordisx.cli-proxy-gateway-adapter/v1";
+var CLI_PROXY_GATEWAY_CONNECTION_CONTRACT_V1 = "cordisx.cli-proxy-gateway-connection/v1";
+var CLI_PROXY_GATEWAY_EXTENSION_PLAN_CONTRACT_V1 = "cordisx.cli-proxy-gateway-extension-plan/v1";
+var CLI_PROXY_GATEWAY_EXTENSION_REGISTRY_SERVICE_V1 = "cliProxyGatewayExtensions";
+var ID_PATTERN2 = /^[a-z0-9][a-z0-9._-]{0,95}$/;
+var HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
+var POINTER_PATTERN = /^(?:\/(?:[^~/]|~0|~1)*)+$/;
+var MAX_ADAPTERS = 64;
+var MAX_CONNECTIONS = 128;
+var MAX_MODELS2 = 256;
+function isText2(value, maximum) {
+  return value.length > 0 && value.length <= maximum && value === value.trim() && !/[\u0000-\u001f\u007f]/.test(value);
+}
+function stableValue2(value) {
+  if (Array.isArray(value)) return value.map(stableValue2);
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(
+      ([key, item]) => [key, stableValue2(item)]
+    )
+  );
+}
+function stableStringify2(value) {
+  return JSON.stringify(stableValue2(value));
+}
+function digest2(value) {
+  return `sha256:${createHash2("sha256").update(stableStringify2(value)).digest("hex")}`;
+}
+function rejection2(failure2) {
+  return { status: "rejected", diagnostic: failure2 };
+}
+function validRevision(value) {
+  return Number.isSafeInteger(value) && value > 0;
+}
+function validTemplate(value, depth = 0) {
+  if (depth > 12) return false;
+  if (value === null || typeof value === "boolean") return true;
+  if (typeof value === "number") return Number.isFinite(value);
+  if (typeof value === "string") return value.length <= 8192 && !value.includes("\0");
+  if (Array.isArray(value)) return value.length <= 128 && value.every((item) => validTemplate(item, depth + 1));
+  const entries = Object.entries(value);
+  return entries.length <= 128 && entries.every(([key, item]) => isText2(key, 256) && validTemplate(item, depth + 1));
+}
+function validateAdapter(adapter) {
+  if (adapter.$schema !== CLI_PROXY_GATEWAY_ADAPTER_SCHEMA_V1 || adapter.contract !== CLI_PROXY_GATEWAY_ADAPTER_CONTRACT_V1 || adapter.schemaVersion !== 1) return { code: "invalid-registration", field: "contract", message: "Unsupported gateway adapter contract" };
+  if (!ID_PATTERN2.test(adapter.adapterId)) {
+    return { code: "invalid-registration", field: "adapterId", message: "Invalid adapter id" };
+  }
+  if (!validRevision(adapter.revision)) {
+    return { code: "invalid-registration", field: "revision", message: "Revision must be a positive safe integer" };
+  }
+  if (adapter.sessionSources.length > 16) {
+    return { code: "invalid-registration", field: "sessionSources", message: "Too many session sources" };
+  }
+  for (const source of adapter.sessionSources) {
+    if (source.kind === "header" ? !HEADER_PATTERN.test(source.name) : !POINTER_PATTERN.test(source.pointer) || source.pointer.length > 512) return { code: "invalid-registration", field: "sessionSources", message: "Invalid session source" };
+  }
+  for (const name of adapter.request.clearHeaders ?? []) {
+    if (!HEADER_PATTERN.test(name)) {
+      return { code: "invalid-registration", field: "request.clearHeaders", message: "Invalid header name" };
+    }
+  }
+  for (const [name, value] of Object.entries(adapter.request.setHeaders ?? {})) {
+    if (!HEADER_PATTERN.test(name) || !validTemplate(value)) {
+      return { code: "invalid-registration", field: "request.setHeaders", message: "Invalid header transform" };
+    }
+  }
+  for (const [pointer, value] of Object.entries(adapter.request.setBody ?? {})) {
+    if (!POINTER_PATTERN.test(pointer) || pointer.length > 512 || !validTemplate(value)) {
+      return { code: "invalid-registration", field: "request.setBody", message: "Invalid body transform" };
+    }
+  }
+  if (stableStringify2(adapter).length > 64 * 1024) {
+    return { code: "invalid-registration", message: "Adapter exceeds the supported size" };
+  }
+  return void 0;
+}
+function validateConnection(connection) {
+  if (connection.$schema !== CLI_PROXY_GATEWAY_CONNECTION_SCHEMA_V1 || connection.contract !== CLI_PROXY_GATEWAY_CONNECTION_CONTRACT_V1 || connection.schemaVersion !== 1) return { code: "invalid-registration", field: "contract", message: "Unsupported gateway connection contract" };
+  if (!ID_PATTERN2.test(connection.connectionId)) {
+    return { code: "invalid-registration", field: "connectionId", message: "Invalid connection id" };
+  }
+  if (!validRevision(connection.revision)) {
+    return { code: "invalid-registration", field: "revision", message: "Revision must be a positive safe integer" };
+  }
+  if (connection.wireApi !== "responses" && connection.wireApi !== "chat-completions") {
+    return { code: "invalid-registration", field: "wireApi", message: "Unsupported wire API" };
+  }
+  if (!connection.endpointPath.startsWith("/") || connection.endpointPath.startsWith("//") || connection.endpointPath.length > 512 || /[?#\u0000-\u001f\u007f]/.test(connection.endpointPath)) return { code: "invalid-registration", field: "endpointPath", message: "Invalid endpoint path" };
+  if (!ID_PATTERN2.test(connection.adapter.adapterId) || !validRevision(connection.adapter.revision)) {
+    return { code: "invalid-registration", field: "adapter", message: "Invalid adapter reference" };
+  }
+  if (connection.models.length === 0 || connection.models.length > MAX_MODELS2) {
+    return { code: "invalid-registration", field: "models", message: "Model routes are outside the supported range" };
+  }
+  const gatewayModels = /* @__PURE__ */ new Set();
+  const sourceModels = /* @__PURE__ */ new Set();
+  let defaults = 0;
+  for (const model2 of connection.models) {
+    if (!isText2(model2.sourceModelId, 256) || !isText2(model2.modelId, 256) || model2.modelId.includes("/")) {
+      return { code: "invalid-registration", field: "models", message: "Invalid model identity" };
+    }
+    if (model2.displayName !== void 0 && !isText2(model2.displayName, 200)) {
+      return { code: "invalid-registration", field: "models.displayName", message: "Invalid model display name" };
+    }
+    if (gatewayModels.has(model2.modelId) || sourceModels.has(model2.sourceModelId)) {
+      return { code: "conflicting-model", field: "models", message: "Duplicate connection model route" };
+    }
+    gatewayModels.add(model2.modelId);
+    sourceModels.add(model2.sourceModelId);
+    if (model2.enabled && model2.isDefault) defaults += 1;
+  }
+  if (!connection.models.some((model2) => model2.enabled)) {
+    return { code: "invalid-registration", field: "models", message: "At least one enabled model route is required" };
+  }
+  if (defaults > 1) {
+    return { code: "conflicting-model", field: "models.isDefault", message: "Only one default model is allowed" };
+  }
+  return void 0;
+}
+var CliProxyGatewayExtensionRegistryV1 = class {
+  constructor(pluginGeneration, sourceKey) {
+    this.pluginGeneration = pluginGeneration;
+    this.sourceKey = sourceKey;
+    if (!isText2(pluginGeneration, 256)) throw new Error("Invalid plugin generation");
+  }
+  pluginGeneration;
+  sourceKey;
+  adapters = /* @__PURE__ */ new Map();
+  connections = /* @__PURE__ */ new Map();
+  producerGenerations = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  revision = 0;
+  disposed = false;
+  activateProducer(producer, registryGeneration) {
+    if (this.disposed || registryGeneration !== this.pluginGeneration) {
+      throw new Error("Gateway extension registry generation is stale");
+    }
+    if (!ID_PATTERN2.test(producer.pluginId) || !isText2(producer.pluginGeneration, 256)) {
+      throw new Error("Invalid gateway extension producer authority");
+    }
+    if (this.producerGenerations.get(producer.pluginId) === producer.pluginGeneration) return;
+    this.producerGenerations.set(producer.pluginId, producer.pluginGeneration);
+    if (this.removeProducerEntries(producer.pluginId)) this.changed();
+  }
+  registerAdapter(adapter, registryGeneration, producer) {
+    const generationFailure = this.generationFailure(registryGeneration, producer);
+    if (generationFailure !== void 0) return generationFailure;
+    const validation = validateAdapter(adapter);
+    if (validation !== void 0) return rejection2(validation);
+    const current = this.adapters.get(adapter.adapterId);
+    const ownership = this.ownershipFailure(current?.producer, producer);
+    if (ownership !== void 0) return ownership;
+    if (current !== void 0) {
+      const revision = this.revisionResult(current.adapter.revision, adapter.revision, current.adapter, adapter);
+      if (revision !== void 0) return revision;
+    } else if (this.adapters.size >= MAX_ADAPTERS) {
+      return rejection2({ code: "capacity-exceeded", message: "Gateway adapter capacity was reached" });
+    }
+    this.adapters.set(adapter.adapterId, { producer, adapter: structuredClone(adapter) });
+    this.changed();
+    return { status: current === void 0 ? "registered" : "updated", registryRevision: this.revision };
+  }
+  registerConnection(connection, registryGeneration, producer) {
+    const generationFailure = this.generationFailure(registryGeneration, producer);
+    if (generationFailure !== void 0) return generationFailure;
+    const validation = validateConnection(connection);
+    if (validation !== void 0) return rejection2(validation);
+    const current = this.connections.get(connection.connectionId);
+    const ownership = this.ownershipFailure(current?.producer, producer);
+    if (ownership !== void 0) return ownership;
+    const sourceKey = this.sourceKey(connection.source);
+    if (!isText2(sourceKey, 512)) {
+      return rejection2({
+        code: "invalid-registration",
+        field: "source",
+        message: "Invalid connection source reference"
+      });
+    }
+    if (current !== void 0) {
+      const revision = this.revisionResult(
+        current.connection.revision,
+        connection.revision,
+        { ...current.connection, source: current.sourceKey },
+        { ...connection, source: sourceKey }
+      );
+      if (revision !== void 0) return revision;
+    } else if (this.connections.size >= MAX_CONNECTIONS) {
+      return rejection2({ code: "capacity-exceeded", message: "Gateway connection capacity was reached" });
+    }
+    for (const [connectionId, entry] of this.connections) {
+      if (connectionId === connection.connectionId) continue;
+      if (entry.sourceKey === sourceKey) {
+        return rejection2({
+          code: "conflicting-source",
+          field: "source",
+          message: "Connection source is already registered"
+        });
+      }
+      const existingModels = new Set(
+        entry.connection.models.filter((model2) => entry.connection.enabled && model2.enabled).map(
+          (model2) => `${entry.connection.connectionId}/${model2.modelId}`
+        )
+      );
+      if (connection.models.some(
+        (model2) => connection.enabled && model2.enabled && existingModels.has(
+          `${connection.connectionId}/${model2.modelId}`
+        )
+      )) return rejection2({ code: "conflicting-model", field: "models", message: "Gateway model is already registered" });
+    }
+    this.connections.set(connection.connectionId, {
+      producer,
+      sourceKey,
+      connection: structuredClone(connection)
+    });
+    this.changed();
+    return { status: current === void 0 ? "registered" : "updated", registryRevision: this.revision };
+  }
+  revokeAdapter(input, registryGeneration, producer) {
+    const generationFailure = this.generationFailure(registryGeneration, producer);
+    if (generationFailure !== void 0) return generationFailure;
+    const current = this.adapters.get(input.adapterId);
+    if (current === void 0) {
+      return rejection2({ code: "not-found", field: "adapterId", message: "Adapter is not registered" });
+    }
+    const ownership = this.ownershipFailure(current.producer, producer);
+    if (ownership !== void 0) return ownership;
+    if (current.adapter.revision !== input.expectedRevision) {
+      return rejection2({ code: "stale-revision", field: "expectedRevision", message: "Adapter revision is stale" });
+    }
+    this.adapters.delete(input.adapterId);
+    this.changed();
+    return { status: "revoked", registryRevision: this.revision };
+  }
+  revokeConnection(input, registryGeneration, producer) {
+    const generationFailure = this.generationFailure(registryGeneration, producer);
+    if (generationFailure !== void 0) return generationFailure;
+    const current = this.connections.get(input.connectionId);
+    if (current === void 0) {
+      return rejection2({ code: "not-found", field: "connectionId", message: "Connection is not registered" });
+    }
+    const ownership = this.ownershipFailure(current.producer, producer);
+    if (ownership !== void 0) return ownership;
+    if (current.connection.revision !== input.expectedRevision) {
+      return rejection2({ code: "stale-revision", field: "expectedRevision", message: "Connection revision is stale" });
+    }
+    this.connections.delete(input.connectionId);
+    this.changed();
+    return { status: "revoked", registryRevision: this.revision };
+  }
+  disposeProducer(producer, registryGeneration) {
+    const generationFailure = this.generationFailure(registryGeneration, producer);
+    if (generationFailure !== void 0) return generationFailure;
+    this.producerGenerations.delete(producer.pluginId);
+    if (!this.removeProducerEntries(producer.pluginId, producer.pluginGeneration)) {
+      return { status: "unchanged", registryRevision: this.revision };
+    }
+    this.changed();
+    return { status: "revoked", registryRevision: this.revision };
+  }
+  subscribe(listener) {
+    if (this.disposed) throw new Error("Gateway extension registry generation is stale");
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  plan(pluginGeneration) {
+    if (this.disposed || pluginGeneration !== this.pluginGeneration) {
+      return { code: "stale-generation", message: "Gateway extension plan generation is stale" };
+    }
+    const adapters = [...this.adapters.values()].map((entry) => structuredClone(entry.adapter)).sort(
+      (left, right) => left.adapterId.localeCompare(right.adapterId)
+    );
+    const connections = [];
+    const composition = [];
+    for (const entry of [...this.connections.values()].sort(
+      (left, right) => left.connection.connectionId.localeCompare(right.connection.connectionId)
+    )) {
+      const connection = entry.connection;
+      const adapter = this.adapters.get(connection.adapter.adapterId)?.adapter;
+      const adapterAvailable = adapter?.enabled === true && adapter.revision === connection.adapter.revision;
+      const enabled = connection.enabled && (!connection.adapter.required || adapterAvailable);
+      const index = connections.length;
+      connections.push({
+        connectionId: connection.connectionId,
+        revision: connection.revision,
+        enabled,
+        adapterId: connection.adapter.adapterId,
+        adapterRevision: connection.adapter.revision,
+        adapterRequired: connection.adapter.required,
+        adapterAvailable,
+        wireApi: connection.wireApi,
+        endpointPath: connection.endpointPath,
+        endpoint: null,
+        authorization: connection.authorization,
+        credential: null,
+        models: connection.models.filter((model2) => model2.enabled).sort(
+          (left, right) => left.modelId.localeCompare(right.modelId)
+        ).map((model2) => ({
+          sourceModelId: model2.sourceModelId,
+          gatewayModelId: `${connection.connectionId}/${model2.modelId}`,
+          displayName: model2.displayName ?? model2.modelId,
+          isDefault: model2.isDefault
+        }))
+      });
+      if (!enabled) continue;
+      const sourceAlias = `extension-${index}`;
+      composition.push({
+        connectionId: connection.connectionId,
+        sourceAlias,
+        source: connection.source,
+        originPointer: `/connections/${index}/endpoint`,
+        ...connection.authorization === "bearer" ? { authorizationPointer: `/connections/${index}/credential` } : {}
+      });
+    }
+    const base = {
+      contract: CLI_PROXY_GATEWAY_EXTENSION_PLAN_CONTRACT_V1,
+      schemaVersion: 1,
+      pluginGeneration: this.pluginGeneration,
+      registryRevision: this.revision,
+      configuration: { adapters, connections },
+      composition
+    };
+    return { ...base, planDigest: digest2({ ...base, composition: composition.map(({ source: _, ...item }) => item) }) };
+  }
+  dispose() {
+    if (this.disposed) return;
+    this.disposed = true;
+    this.adapters.clear();
+    this.connections.clear();
+    this.producerGenerations.clear();
+    this.listeners.clear();
+    this.revision += 1;
+  }
+  revisionResult(currentRevision, nextRevision, current, next) {
+    if (nextRevision < currentRevision) {
+      return rejection2({ code: "stale-revision", field: "revision", message: "Extension revision is stale" });
+    }
+    if (nextRevision !== currentRevision) return void 0;
+    return stableStringify2(current) === stableStringify2(next) ? { status: "unchanged", registryRevision: this.revision } : rejection2({ code: "stale-revision", field: "revision", message: "Revision was reused with different content" });
+  }
+  ownershipFailure(current, producer) {
+    if (current === void 0) return void 0;
+    if (current.pluginId !== producer.pluginId) {
+      return rejection2({ code: "conflicting-producer", message: "Extension is owned by another producer" });
+    }
+    if (current.pluginGeneration !== producer.pluginGeneration) {
+      return {
+        status: "stale-generation",
+        diagnostic: { code: "stale-generation", message: "Extension producer generation is stale" }
+      };
+    }
+    return void 0;
+  }
+  generationFailure(registryGeneration, producer) {
+    if (this.disposed || registryGeneration !== this.pluginGeneration || this.producerGenerations.get(producer.pluginId) !== producer.pluginGeneration) {
+      return {
+        status: "stale-generation",
+        diagnostic: { code: "stale-generation", message: "Gateway extension registry generation is stale" }
+      };
+    }
+    return void 0;
+  }
+  removeProducerEntries(pluginId, pluginGeneration) {
+    let removed = false;
+    for (const [adapterId, entry] of this.adapters) {
+      if (entry.producer.pluginId !== pluginId || pluginGeneration !== void 0 && entry.producer.pluginGeneration !== pluginGeneration) continue;
+      this.adapters.delete(adapterId);
+      removed = true;
+    }
+    for (const [connectionId, entry] of this.connections) {
+      if (entry.producer.pluginId !== pluginId || pluginGeneration !== void 0 && entry.producer.pluginGeneration !== pluginGeneration) continue;
+      this.connections.delete(connectionId);
+      removed = true;
+    }
+    return removed;
+  }
+  changed() {
+    this.revision += 1;
+    for (const listener of this.listeners) listener(this.revision);
+  }
+};
+function createCliProxyGatewayExtensionRegistrarV1(registry, producer) {
+  registry.activateProducer(producer, registry.pluginGeneration);
+  let disposed = false;
+  const currentRevision = () => {
+    const plan = registry.plan(registry.pluginGeneration);
+    return "code" in plan ? 0 : plan.registryRevision;
+  };
+  return Object.freeze({
+    producer,
+    registerAdapter: (adapter) => disposed ? {
+      status: "stale-generation",
+      diagnostic: { code: "stale-generation", message: "Extension registrar is disposed" }
+    } : registry.registerAdapter(adapter, registry.pluginGeneration, producer),
+    revokeAdapter: (input) => disposed ? {
+      status: "stale-generation",
+      diagnostic: { code: "stale-generation", message: "Extension registrar is disposed" }
+    } : registry.revokeAdapter(input, registry.pluginGeneration, producer),
+    registerConnection: (connection) => disposed ? {
+      status: "stale-generation",
+      diagnostic: { code: "stale-generation", message: "Extension registrar is disposed" }
+    } : registry.registerConnection(connection, registry.pluginGeneration, producer),
+    revokeConnection: (input) => disposed ? {
+      status: "stale-generation",
+      diagnostic: { code: "stale-generation", message: "Extension registrar is disposed" }
+    } : registry.revokeConnection(input, registry.pluginGeneration, producer),
+    dispose: () => {
+      if (disposed) return { status: "unchanged", registryRevision: currentRevision() };
+      disposed = true;
+      return registry.disposeProducer(producer, registry.pluginGeneration);
+    }
+  });
+}
+
 // src/service/index.ts
 var OPERATIONS = [
   "models.list",
@@ -1055,12 +1473,20 @@ var apply = async (ctx, input) => {
   }
 };
 export {
+  CLI_PROXY_GATEWAY_ADAPTER_CONTRACT_V1,
+  CLI_PROXY_GATEWAY_ADAPTER_SCHEMA_V1,
+  CLI_PROXY_GATEWAY_CONNECTION_CONTRACT_V1,
+  CLI_PROXY_GATEWAY_CONNECTION_SCHEMA_V1,
+  CLI_PROXY_GATEWAY_EXTENSION_PLAN_CONTRACT_V1,
+  CLI_PROXY_GATEWAY_EXTENSION_REGISTRY_SERVICE_V1,
   CLI_PROXY_GATEWAY_PLAN_CONTRACT_V1,
   CLI_PROXY_MODEL_CATALOG_CONTRACT_V1,
   CLI_PROXY_UPSTREAM_DESCRIPTOR_CONTRACT_V1,
   CLI_PROXY_UPSTREAM_DESCRIPTOR_SCHEMA_V1,
   CLI_PROXY_UPSTREAM_REGISTRY_SERVICE_V1,
+  CliProxyGatewayExtensionRegistryV1,
   CliProxyUpstreamRegistryV1,
   apply,
+  createCliProxyGatewayExtensionRegistrarV1,
   createCliProxyUpstreamRegistrarV1
 };

package/dist/bundled-plugins/@cordisx/plugin-cli-proxy-api/dist/types/service/extension-context.d.ts

@@ -0,0 +1,2 @@
+import type { ManagedServiceContextProviderV1 } from '@cordisx/protocol/managed-service-context/v1';
+export declare function createCliProxyGatewayExtensionContextProviderV1(): ManagedServiceContextProviderV1;

package/dist/bundled-plugins/@cordisx/plugin-cli-proxy-api/dist/types/service/extension-registry.d.ts

@@ -0,0 +1,163 @@
+export declare const CLI_PROXY_GATEWAY_ADAPTER_SCHEMA_V1 = "https://raw.githubusercontent.com/cordisx/plugin-cli-proxy-api/main/schemas/cli-proxy-gateway-adapter.v1.schema.json";
+export declare const CLI_PROXY_GATEWAY_CONNECTION_SCHEMA_V1 = "https://raw.githubusercontent.com/cordisx/plugin-cli-proxy-api/main/schemas/cli-proxy-gateway-connection.v1.schema.json";
+export declare const CLI_PROXY_GATEWAY_ADAPTER_CONTRACT_V1 = "cordisx.cli-proxy-gateway-adapter/v1";
+export declare const CLI_PROXY_GATEWAY_CONNECTION_CONTRACT_V1 = "cordisx.cli-proxy-gateway-connection/v1";
+export declare const CLI_PROXY_GATEWAY_EXTENSION_PLAN_CONTRACT_V1 = "cordisx.cli-proxy-gateway-extension-plan/v1";
+export declare const CLI_PROXY_GATEWAY_EXTENSION_REGISTRY_SERVICE_V1 = "cliProxyGatewayExtensions";
+export type CliProxyGatewayWireApiV1 = 'responses' | 'chat-completions';
+export type CliProxyGatewayTemplateV1 = null | boolean | number | string | readonly CliProxyGatewayTemplateV1[] | {
+    readonly [key: string]: CliProxyGatewayTemplateV1;
+};
+export type CliProxyGatewaySessionSourceV1 = {
+    readonly kind: 'header';
+    readonly name: string;
+} | {
+    readonly kind: 'body-json-pointer';
+    readonly pointer: `/${string}`;
+};
+export interface CliProxyGatewayAdapterV1 {
+    readonly $schema: typeof CLI_PROXY_GATEWAY_ADAPTER_SCHEMA_V1;
+    readonly contract: typeof CLI_PROXY_GATEWAY_ADAPTER_CONTRACT_V1;
+    readonly schemaVersion: 1;
+    readonly adapterId: string;
+    readonly revision: number;
+    readonly enabled: boolean;
+    readonly requiredSession: boolean;
+    readonly sessionSources: readonly CliProxyGatewaySessionSourceV1[];
+    readonly request: {
+        readonly clearHeaders?: readonly string[];
+        readonly setHeaders?: Readonly<Record<string, CliProxyGatewayTemplateV1>>;
+        readonly setBody?: Readonly<Record<`/${string}`, CliProxyGatewayTemplateV1>>;
+    };
+}
+export interface CliProxyGatewayConnectionModelV1 {
+    readonly sourceModelId: string;
+    readonly modelId: string;
+    readonly displayName?: string;
+    readonly enabled: boolean;
+    readonly isDefault: boolean;
+}
+export interface CliProxyGatewayConnectionV1<Source> {
+    readonly $schema: typeof CLI_PROXY_GATEWAY_CONNECTION_SCHEMA_V1;
+    readonly contract: typeof CLI_PROXY_GATEWAY_CONNECTION_CONTRACT_V1;
+    readonly schemaVersion: 1;
+    readonly connectionId: string;
+    readonly revision: number;
+    readonly enabled: boolean;
+    readonly source: Source;
+    readonly wireApi: CliProxyGatewayWireApiV1;
+    readonly endpointPath: `/${string}`;
+    readonly authorization: 'none' | 'bearer';
+    readonly adapter: {
+        readonly adapterId: string;
+        readonly revision: number;
+        readonly required: boolean;
+    };
+    readonly models: readonly CliProxyGatewayConnectionModelV1[];
+}
+export interface CliProxyGatewayExtensionProducerV1 {
+    readonly pluginId: string;
+    readonly pluginGeneration: string;
+}
+export type CliProxyGatewayExtensionDiagnosticCodeV1 = 'invalid-registration' | 'capacity-exceeded' | 'conflicting-producer' | 'conflicting-source' | 'conflicting-model' | 'stale-revision' | 'stale-generation' | 'not-found';
+export interface CliProxyGatewayExtensionDiagnosticV1 {
+    readonly code: CliProxyGatewayExtensionDiagnosticCodeV1;
+    readonly field?: string;
+    readonly message: string;
+}
+export type CliProxyGatewayExtensionMutationResultV1 = {
+    readonly status: 'registered' | 'updated' | 'revoked';
+    readonly registryRevision: number;
+} | {
+    readonly status: 'unchanged';
+    readonly registryRevision: number;
+} | {
+    readonly status: 'rejected' | 'stale-generation';
+    readonly diagnostic: CliProxyGatewayExtensionDiagnosticV1;
+};
+export interface CliProxyGatewayExtensionRegistrarV1<Source> {
+    readonly producer: CliProxyGatewayExtensionProducerV1;
+    registerAdapter(adapter: CliProxyGatewayAdapterV1): CliProxyGatewayExtensionMutationResultV1;
+    revokeAdapter(input: {
+        readonly adapterId: string;
+        readonly expectedRevision: number;
+    }): CliProxyGatewayExtensionMutationResultV1;
+    registerConnection(connection: CliProxyGatewayConnectionV1<Source>): CliProxyGatewayExtensionMutationResultV1;
+    revokeConnection(input: {
+        readonly connectionId: string;
+        readonly expectedRevision: number;
+    }): CliProxyGatewayExtensionMutationResultV1;
+    dispose(): CliProxyGatewayExtensionMutationResultV1;
+}
+export interface CliProxyGatewayExtensionConsumerContextV1<Source> {
+    readonly cliProxyGatewayExtensions: CliProxyGatewayExtensionRegistrarV1<Source>;
+}
+export interface CliProxyGatewayExtensionPlanV1<Source> {
+    readonly contract: typeof CLI_PROXY_GATEWAY_EXTENSION_PLAN_CONTRACT_V1;
+    readonly schemaVersion: 1;
+    readonly pluginGeneration: string;
+    readonly registryRevision: number;
+    readonly planDigest: `sha256:${string}`;
+    readonly configuration: {
+        readonly adapters: readonly CliProxyGatewayAdapterV1[];
+        readonly connections: readonly {
+            readonly connectionId: string;
+            readonly revision: number;
+            readonly enabled: boolean;
+            readonly adapterId: string;
+            readonly adapterRevision: number;
+            readonly adapterRequired: boolean;
+            readonly adapterAvailable: boolean;
+            readonly wireApi: CliProxyGatewayWireApiV1;
+            readonly endpointPath: `/${string}`;
+            readonly endpoint: null;
+            readonly authorization: 'none' | 'bearer';
+            readonly credential: null;
+            readonly models: readonly {
+                readonly sourceModelId: string;
+                readonly gatewayModelId: string;
+                readonly displayName: string;
+                readonly isDefault: boolean;
+            }[];
+        }[];
+    };
+    readonly composition: readonly {
+        readonly connectionId: string;
+        readonly sourceAlias: string;
+        readonly source: Source;
+        readonly originPointer: `/${string}`;
+        readonly authorizationPointer?: `/${string}`;
+    }[];
+}
+export declare class CliProxyGatewayExtensionRegistryV1<Source> {
+    readonly pluginGeneration: string;
+    private readonly sourceKey;
+    private readonly adapters;
+    private readonly connections;
+    private readonly producerGenerations;
+    private readonly listeners;
+    private revision;
+    private disposed;
+    constructor(pluginGeneration: string, sourceKey: (source: Source) => string);
+    activateProducer(producer: CliProxyGatewayExtensionProducerV1, registryGeneration: string): void;
+    registerAdapter(adapter: CliProxyGatewayAdapterV1, registryGeneration: string, producer: CliProxyGatewayExtensionProducerV1): CliProxyGatewayExtensionMutationResultV1;
+    registerConnection(connection: CliProxyGatewayConnectionV1<Source>, registryGeneration: string, producer: CliProxyGatewayExtensionProducerV1): CliProxyGatewayExtensionMutationResultV1;
+    revokeAdapter(input: {
+        readonly adapterId: string;
+        readonly expectedRevision: number;
+    }, registryGeneration: string, producer: CliProxyGatewayExtensionProducerV1): CliProxyGatewayExtensionMutationResultV1;
+    revokeConnection(input: {
+        readonly connectionId: string;
+        readonly expectedRevision: number;
+    }, registryGeneration: string, producer: CliProxyGatewayExtensionProducerV1): CliProxyGatewayExtensionMutationResultV1;
+    disposeProducer(producer: CliProxyGatewayExtensionProducerV1, registryGeneration: string): CliProxyGatewayExtensionMutationResultV1;
+    subscribe(listener: (revision: number) => void): () => void;
+    plan(pluginGeneration: string): CliProxyGatewayExtensionPlanV1<Source> | CliProxyGatewayExtensionDiagnosticV1;
+    dispose(): void;
+    private revisionResult;
+    private ownershipFailure;
+    private generationFailure;
+    private removeProducerEntries;
+    private changed;
+}
+export declare function createCliProxyGatewayExtensionRegistrarV1<Source>(registry: CliProxyGatewayExtensionRegistryV1<Source>, producer: CliProxyGatewayExtensionProducerV1): CliProxyGatewayExtensionRegistrarV1<Source>;

package/dist/bundled-plugins/@cordisx/plugin-cli-proxy-api/dist/types/service/gateway-definition.d.ts

@@ -1,6 +1,7 @@
 export declare const CLI_PROXY_GATEWAY_MODEL_CATALOG_SCHEMA_V1: "https://raw.githubusercontent.com/cordisx/plugin-cli-proxy-api/main/schemas/cli-proxy-gateway-model-catalog.v1.schema.json";
 export declare const CLI_PROXY_GATEWAY_CODEX_UPSTREAMS_SCHEMA_V1: "https://raw.githubusercontent.com/cordisx/plugin-cli-proxy-api/main/schemas/cli-proxy-gateway-codex-upstream.v1.schema.json";
 export declare const CLI_PROXY_GATEWAY_OPENAI_UPSTREAMS_SCHEMA_V1: "https://raw.githubusercontent.com/cordisx/plugin-cli-proxy-api/main/schemas/cli-proxy-gateway-openai-upstream.v1.schema.json";
+export declare const CLI_PROXY_GATEWAY_EXTENSION_PLAN_SCHEMA_V1: "https://raw.githubusercontent.com/cordisx/plugin-cli-proxy-api/main/schemas/cli-proxy-gateway-extension-plan.v1.schema.json";
 export declare const CLI_PROXY_GATEWAY_SERVICE_ID = "gateway-runtime";
 export declare const CLI_PROXY_GATEWAY_MANAGEMENT_V1: Readonly<{
     credentialSlot: "management-key";
@@ -59,6 +60,12 @@ export declare const cliProxyGatewayDefinition: {
         readonly target: "configuration";
         readonly pointer: "/openai-compatibility";
         readonly valueSchema: "https://raw.githubusercontent.com/cordisx/plugin-cli-proxy-api/main/schemas/cli-proxy-gateway-openai-upstream.v1.schema.json";
+    }, {
+        readonly slot: "gateway-extensions";
+        readonly source: "composition";
+        readonly target: "configuration";
+        readonly pointer: "/plugins/configs/cordisx-gateway-bridge";
+        readonly valueSchema: "https://raw.githubusercontent.com/cordisx/plugin-cli-proxy-api/main/schemas/cli-proxy-gateway-extension-plan.v1.schema.json";
     }];
     readonly authentication: {
         readonly mode: "none";

package/dist/bundled-plugins/@cordisx/plugin-cli-proxy-api/dist/types/service/gateway.d.ts

@@ -2,16 +2,19 @@ import type { Fiber } from '@deepseek-ai/cordis';
 import type { ManagedServiceContextProviderV1 } from '@cordisx/protocol/managed-service-context/v1';
 import type { ManagedServiceApplyInputV1, ManagedServiceApplyV1, ManagedServiceIdentityV1, ManagedServiceServiceContextV1 } from '@cordisx/protocol/managed-service-runtime/v1';
 import { managedServiceUI } from './gateway-ui.js';
+import { CliProxyGatewayExtensionRegistryV1 } from './extension-registry.js';
 import { CliProxyUpstreamRegistryV1 } from './upstream-registry.js';
 export * from './gateway-definition.js';
+export * from './extension-registry.js';
 export * from './upstream-registry.js';
 export declare const contextServices: readonly ManagedServiceContextProviderV1[];
 export { managedServiceUI };
 export declare const CLI_PROXY_NATIVE_PROVIDER_ID = "cli-proxy-api";
 export type CliProxyGatewayContextV1 = ManagedServiceServiceContextV1 & Pick<Fiber, 'effect'> & {
     readonly cliProxyUpstreams: CliProxyUpstreamRegistryV1<ManagedServiceIdentityV1>;
+    readonly cliProxyGatewayExtensions: CliProxyGatewayExtensionRegistryV1<ManagedServiceIdentityV1>;
 };
 export declare function activateCliProxyGateway(context: CliProxyGatewayContextV1, input: ManagedServiceApplyInputV1): Promise<void>;
 export declare const apply: ManagedServiceApplyV1 & {
-    inject: readonly ["managedServices", "cliProxyUpstreams"];
+    inject: readonly ["managedServices", "cliProxyUpstreams", "cliProxyGatewayExtensions"];
 };

package/dist/bundled-plugins/@cordisx/plugin-cli-proxy-api/dist/types/service/index.d.ts

@@ -1,3 +1,4 @@
 import type { PlatformProviderServiceApplyV2 } from '@cordisx/protocol/platform-provider/v2';
 export * from './upstream-registry.js';
+export * from './extension-registry.js';
 export declare const apply: PlatformProviderServiceApplyV2;