jishushell 0.6.5 → 0.6.18

package/dist/services/connections/apply.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Layer 3 — connection apply hooks (§7 of the design).
+ *
+ * Two parallel tables:
+ *
+ *   - PERSIST_HOOKS: invoked by `PUT /api/instances/:id/connections`.
+ *     Writes durable state. LLM/proxy-upstream goes through saveInstanceConfig;
+ *     LLM/openai-env, search, browser, default ENV all go through
+ *     `ctx.writeConnectionEnv()` — that abstraction routes the env to
+ *     `instance.runtime.env` for OpenClaw, the Hermes integration `.env` for
+ *     Hermes, and `instance.json["connections-env"]` for generic apps.
+ *     MCP is delegated as a structured binding to the integration because
+ *     each consumer has private config semantics.
+ *
+ *   - RUNTIME_HOOKS: invoked at every start. Returns an env map only;
+ *     never writes files. The Nomad driver merges the result into the task
+ *     env so the new bindings take effect on restart.
+ *
+ * The generic layer owns category-level env/proxy materialization. Private
+ * app config such as OpenClaw MCP files or Hermes config.yaml is delegated to
+ * integration hooks.
+ *
+ * Materialization is not the binding fact itself. `instance.connections`
+ * records who is bound to whom; hooks here decide how to deliver that binding
+ * to the app. Core proxy usage metrics only cover requests that actually pass
+ * through Core proxy, so app-local provider overrides are outside this layer
+ * unless an integration explicitly imports/reconciles them.
+ */
+import * as capabilityRegistry from "../capabilities/registry.js";
+import type { CapabilityEntry } from "../capabilities/registry.js";
+import type { ResolvedConnection } from "./resolver.js";
+import type { AppInstance } from "../instances/types.js";
+import type { IntegrationConnectionApplyArgs, IntegrationConnectionBinding, IntegrationConnectionUnapplyArgs } from "../integrations/types.js";
+export declare function buildHttpBaseUrl(entry: CapabilityEntry, opts?: {
+    suffix?: string;
+}): string;
+export declare function buildWsUrl(entry: CapabilityEntry, opts?: {
+    suffix?: string;
+}): string;
+export interface ApplyContext {
+    registry: typeof capabilityRegistry;
+    /**
+     * AppIntegration handle for integration-managed consumers.
+     * `null` for generic container apps without an integration — `writeConnectionEnv`
+     * then routes to `instance.json["connections-env"]`.
+     */
+    integration: {
+        manifest?: {
+            defaultConnectionApplyMode?: "proxy-upstream" | "openai-env";
+        };
+        applyConnectionEnv?(instanceId: string, env: Record<string, string>): Promise<void>;
+        getConnectionRuntimeEnv?(instanceId: string): Record<string, string>;
+        applyConnectionBinding?(args: IntegrationConnectionApplyArgs): Promise<void>;
+        unapplyConnectionBinding?(args: IntegrationConnectionUnapplyArgs): Promise<void>;
+        listConnectionSideEffectFiles?(args: {
+            instanceId: string;
+            bindings: IntegrationConnectionBinding[];
+        }): string[];
+    } | null;
+    /** Persist env into whichever durable location matches the consumer type. */
+    writeConnectionEnv(instance: AppInstance, env: Record<string, string>): Promise<void>;
+}
+export type PersistApplyHook = (instance: AppInstance, binding: ResolvedConnection, ctx: ApplyContext) => Promise<void>;
+export type RuntimeApplyHook = (instance: AppInstance, binding: ResolvedConnection) => Record<string, string> | Promise<Record<string, string>>;
+/**
+ * §7 — resolve the auth token for a provider instance at apply time.
+ *
+ * Returns the bare token string (no "Bearer " prefix — that's the consumer's
+ * call to format). Returns `null` when:
+ *   - entry.auth is absent or kind === "none"
+ *   - tokenSource refers to data that doesn't exist on disk
+ *
+ * Supported tokenSource patterns:
+ *   instance.env.<NAME>      → read from `~/.jishushell/instances/<provider-id>/{model.env,provider.env,.env}`
+ *   instance.config.<path>   → read from the provider integration's native config via dotted path
+ *   proxy.token              → read instance proxy token from llm-proxy state
+ */
+export declare function resolveProviderToken(entry: CapabilityEntry): Promise<string | null>;
+export declare const persistLlmConnection: PersistApplyHook;
+export declare const runtimeLlmConnection: RuntimeApplyHook;
+export declare const persistSearchConnection: PersistApplyHook;
+export declare const runtimeSearchConnection: RuntimeApplyHook;
+export declare const persistBrowserConnection: PersistApplyHook;
+export declare const runtimeBrowserConnection: RuntimeApplyHook;
+export declare const persistFilesConnection: PersistApplyHook;
+export declare const runtimeFilesConnection: RuntimeApplyHook;
+export declare const persistDefaultConnection: PersistApplyHook;
+export declare const runtimeDefaultConnection: RuntimeApplyHook;
+export declare const persistMcpConnection: PersistApplyHook;
+export declare const runtimeMcpConnection: RuntimeApplyHook;
+export declare function toIntegrationConnectionBinding(binding: ResolvedConnection): IntegrationConnectionBinding;
+export type UnpersistApplyHook = (instance: AppInstance, slot: string, ctx: ApplyContext) => Promise<void>;
+export declare const PERSIST_HOOKS: Record<string, PersistApplyHook>;
+export declare const UNPERSIST_HOOKS: Record<string, UnpersistApplyHook>;
+export declare const RUNTIME_HOOKS: Record<string, RuntimeApplyHook>;
+/**
+ * Re-resolve `connections` for a consumer instance against the live capability
+ * registry and render every binding through RUNTIME_HOOKS into a flat env map.
+ *
+ * Use this at every start (not at PUT time) so that provider port / address
+ * changes propagate without requiring the user to re-bind. preCreate mode is
+ * used to stay tolerant: a missing required binding is surfaced via the
+ * Connections badge, not by failing start with a stale provider URL.
+ *
+ * Failures are caught and logged — start should never block on env merging.
+ */
+export declare function renderRuntimeConnectionsEnv(spec: import("../../types.js").AppSpec, instance: {
+    id: string;
+    connections?: import("../../types.js").InstanceConnections;
+}): Promise<Record<string, string>>;

package/dist/services/connections/apply.js

@@ -0,0 +1,444 @@
+// ── URL builders (§7.0) ─────────────────────────────────────────────────
+function isIPv6(host) {
+    return /:.*:/.test(host) && !host.startsWith("[");
+}
+function bracketIPv6(host) {
+    return isIPv6(host) ? `[${host}]` : host;
+}
+export function buildHttpBaseUrl(entry, opts = {}) {
+    const protocol = entry.protocol === "https" ? "https" : "http";
+    const url = new URL(`${protocol}://${bracketIPv6(entry.host)}:${entry.hostPort}`);
+    if (entry.path && entry.path !== "/")
+        url.pathname = entry.path;
+    const suffix = opts.suffix ?? "";
+    if (suffix) {
+        const norm = (s) => s.replace(/^\/+|\/+$/g, "");
+        if (!norm(url.pathname).endsWith(norm(suffix))) {
+            url.pathname = `${url.pathname.replace(/\/+$/, "")}/${suffix.replace(/^\/+/, "")}`;
+        }
+    }
+    return url.toString().replace(/\/$/, "");
+}
+export function buildWsUrl(entry, opts = {}) {
+    const protocol = entry.protocol === "wss" ? "wss" : "ws";
+    let url = `${protocol}://${bracketIPv6(entry.host)}:${entry.hostPort}`;
+    if (entry.path && entry.path !== "/")
+        url += entry.path;
+    if (opts.suffix)
+        url += opts.suffix.startsWith("/") ? opts.suffix : `/${opts.suffix}`;
+    return url;
+}
+// ── providerKindFromEntry for LLM proxy-upstream mode ─────────────────
+function providerKindFromEntry(entry) {
+    if (entry.providerKind)
+        return entry.providerKind;
+    const m = entry.capability.match(/^llm-(ollama|vllm|sglang)$/);
+    if (m)
+        return m[1];
+    return "custom";
+}
+// ── LLM proxy-upstream mode ────────────────────────────────────────────
+const persistLlmProxyUpstream = async (instance, binding, _ctx) => {
+    if (binding.entries.length !== 1)
+        return;
+    const entry = binding.entries[0];
+    const baseUrl = buildHttpBaseUrl(entry, { suffix: "/v1" });
+    const providerKind = providerKindFromEntry(entry);
+    // Probe the upstream so the user gets a "one-click connect" experience on
+    // the Connections tab: without this, models[] is empty and selectedModelId
+    // ends up as the placeholder "default", causing an immediate 404 from
+    // ollama / any sane backend on the very first chat request.
+    //
+    // probeProviderModels reuses the same path the LLM-Provider tab's "拉取
+    // 模型" button uses; failure (network, 4xx, etc.) is logged and swallowed
+    // — bind itself must not be blocked by transient probe issues. When the
+    // probe succeeds we also pre-pick the first model so the chat works
+    // without the user touching anything else.
+    let models;
+    let selectedModelId = binding.selectedModelId;
+    try {
+        const { probeProviderModels } = await import("../llm-proxy/probe.js");
+        const probed = await probeProviderModels(baseUrl, "", "Authorization", providerKind);
+        if (probed && probed.length > 0) {
+            models = probed
+                .map((m) => ({ id: String(m.id ?? m.name ?? ""), name: String(m.name ?? m.id ?? "") }))
+                .filter((m) => m.id);
+            if (!selectedModelId && models.length > 0)
+                selectedModelId = models[0].id;
+        }
+    }
+    catch (e) {
+        console.warn(`[connection-apply] probe upstream failed for ${instance.id} (${providerKind}, ${baseUrl}): ${e?.message ?? e}`);
+    }
+    // saveInstanceConfig encrypts apiKey itself — pass plaintext (empty for
+    // local LOCAL_PROVIDER_IDS ollama / vllm / sglang / custom).
+    const { getInstanceConfig, saveInstanceConfig } = await import("../llm-proxy/instance-proxy.js");
+    const config = getInstanceConfig(instance.id) ?? {};
+    const xj = (config["x-jishushell"] ??= {});
+    xj.proxy = xj.proxy ?? {};
+    xj.proxy.upstream = {
+        providerId: providerKind,
+        baseUrl,
+        api: "openai-completions",
+        authHeader: false,
+        apiKey: "",
+        ...(models && models.length ? { models } : {}),
+        ...(selectedModelId ? { selectedModelId } : {}),
+    };
+    await saveInstanceConfig(instance.id, config);
+};
+// ── resolveProviderToken (§7, PR B) ────────────────────────────────────
+/**
+ * §7 — resolve the auth token for a provider instance at apply time.
+ *
+ * Returns the bare token string (no "Bearer " prefix — that's the consumer's
+ * call to format). Returns `null` when:
+ *   - entry.auth is absent or kind === "none"
+ *   - tokenSource refers to data that doesn't exist on disk
+ *
+ * Supported tokenSource patterns:
+ *   instance.env.<NAME>      → read from `~/.jishushell/instances/<provider-id>/{model.env,provider.env,.env}`
+ *   instance.config.<path>   → read from the provider integration's native config via dotted path
+ *   proxy.token              → read instance proxy token from llm-proxy state
+ */
+export async function resolveProviderToken(entry) {
+    const auth = entry.auth;
+    if (!auth || auth.kind === "none")
+        return null;
+    const src = auth.tokenSource;
+    if (!src)
+        return null;
+    // instance.env.<NAME>
+    const envMatch = src.match(/^instance\.env\.([A-Z][A-Z0-9_]*)$/);
+    if (envMatch) {
+        const name = envMatch[1];
+        return readEnvVarFromInstanceFiles(entry.instanceId, name);
+    }
+    if (src === "proxy.token") {
+        const { getInstanceToken } = await import("../llm-proxy/instance-proxy.js");
+        if (typeof getInstanceToken !== "function")
+            return null;
+        const token = getInstanceToken(entry.instanceId);
+        return typeof token === "string" && token ? token : null;
+    }
+    // instance.config.<dotted.path>
+    const cfgMatch = src.match(/^instance\.config\.(.+)$/);
+    if (cfgMatch) {
+        const path = cfgMatch[1];
+        return readConfigPathFromProviderIntegration(entry.instanceId, path);
+    }
+    return null;
+}
+async function readEnvVarFromInstanceFiles(instanceId, name) {
+    const { readFile } = await import("node:fs/promises");
+    const { join } = await import("node:path");
+    const { resolveAppDir } = await import("../app-common/paths.js");
+    const instanceDir = resolveAppDir(instanceId);
+    // Probe known env-file locations within the canonical instance dir.
+    const candidates = [
+        join(instanceDir, "agent-home", ".env"),
+        join(instanceDir, ".env"),
+        join(instanceDir, "model.env"),
+        join(instanceDir, "provider.env"),
+    ];
+    for (const filePath of candidates) {
+        try {
+            const content = await readFile(filePath, "utf8");
+            for (const line of content.split("\n")) {
+                const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*?)\s*$/);
+                if (!m)
+                    continue;
+                if (m[1] !== name)
+                    continue;
+                let val = m[2];
+                if ((val.startsWith('"') && val.endsWith('"')) ||
+                    (val.startsWith("'") && val.endsWith("'"))) {
+                    val = val.slice(1, -1);
+                }
+                if (!val)
+                    continue;
+                return val;
+            }
+        }
+        catch {
+            // file missing — try next
+        }
+    }
+    return null;
+}
+function readDottedConfigPath(config, path) {
+    if (!config || typeof config !== "object")
+        return null;
+    let cur = config;
+    for (const part of path.split(".")) {
+        if (cur == null || typeof cur !== "object")
+            return null;
+        cur = cur[part];
+    }
+    return typeof cur === "string" && cur ? cur : null;
+}
+async function readConfigPathFromProviderIntegration(instanceId, path) {
+    try {
+        const { resolveExecutionOwner } = await import("../app-common/execution-owner.js");
+        const owner = resolveExecutionOwner(instanceId);
+        if (owner?.type !== "integration")
+            return null;
+        const { getIntegration } = await import("../integrations/index.js");
+        const integration = getIntegration(owner.integrationKind);
+        const config = integration.getStoredNativeConfig?.(instanceId)
+            ?? integration.getNativeConfig?.(instanceId)
+            ?? null;
+        return readDottedConfigPath(config, path);
+    }
+    catch {
+        return null;
+    }
+}
+// ── LLM openai-env mode ────────────────────────────────────────────────
+async function llmOpenaiEnv(binding) {
+    if (binding.entries.length !== 1)
+        return {};
+    const entry = binding.entries[0];
+    const rootUrl = buildHttpBaseUrl(entry);
+    const baseUrl = buildHttpBaseUrl(entry, { suffix: "/v1" });
+    const token = await resolveProviderToken(entry);
+    const slotValue = providerKindFromEntry(entry) === "ollama" && /(?:^|_)OLLAMA_URL$/i.test(binding.slot)
+        ? rootUrl
+        : baseUrl;
+    return {
+        [binding.slot]: slotValue,
+        OPENAI_API_KEY: token ?? "",
+        OPENAI_API_BASE: baseUrl,
+        OPENAI_BASE_URL: baseUrl,
+    };
+}
+const persistLlmOpenaiEnv = async (instance, binding, ctx) => {
+    await ctx.writeConnectionEnv(instance, await llmOpenaiEnv(binding));
+};
+const _runtimeLlmOpenaiEnv = async (_instance, binding) => llmOpenaiEnv(binding);
+// ── LLM dispatch ───────────────────────────────────────────────────────
+export const persistLlmConnection = async (instance, binding, ctx) => {
+    const mode = binding.apply ?? defaultLlmMode(ctx);
+    if (mode === "proxy-upstream")
+        return persistLlmProxyUpstream(instance, binding, ctx);
+    return persistLlmOpenaiEnv(instance, binding, ctx);
+};
+export const runtimeLlmConnection = async (_instance, binding) => {
+    const mode = binding.apply ?? "openai-env"; // integration-typed defaults handled at persist time
+    if (mode === "proxy-upstream")
+        return {}; // runtime env already pinned by integration
+    return llmOpenaiEnv(binding);
+};
+function defaultLlmMode(ctx) {
+    return ctx.integration?.manifest?.defaultConnectionApplyMode ?? "openai-env";
+}
+// ── Search ─────────────────────────────────────────────────────────────
+function searchEnv(binding) {
+    if (binding.entries.length !== 1)
+        return {};
+    const entry = binding.entries[0];
+    const url = buildHttpBaseUrl(entry, { suffix: entry.path && entry.path !== "/" ? "" : "/search" });
+    return { [binding.slot]: url };
+}
+export const persistSearchConnection = async (instance, binding, ctx) => {
+    await ctx.writeConnectionEnv(instance, searchEnv(binding));
+};
+export const runtimeSearchConnection = (_instance, binding) => searchEnv(binding);
+// ── Browser ────────────────────────────────────────────────────────────
+function browserEnv(binding) {
+    if (binding.entries.length !== 1)
+        return {};
+    const entry = binding.entries[0];
+    const url = entry.protocol === "ws" || entry.protocol === "wss"
+        ? buildWsUrl(entry)
+        : buildHttpBaseUrl(entry);
+    return { [binding.slot]: url };
+}
+export const persistBrowserConnection = async (instance, binding, ctx) => {
+    await ctx.writeConnectionEnv(instance, browserEnv(binding));
+};
+export const runtimeBrowserConnection = (_instance, binding) => browserEnv(binding);
+// ── Files (UI-only: inject panel URL so agent can surface filebrowser) ─
+function filesEnv(binding) {
+    if (binding.entries.length !== 1)
+        return {};
+    const entry = binding.entries[0];
+    const url = buildHttpBaseUrl(entry);
+    return { [binding.slot]: url };
+}
+export const persistFilesConnection = async (instance, binding, ctx) => {
+    await ctx.writeConnectionEnv(instance, filesEnv(binding));
+};
+export const runtimeFilesConnection = (_instance, binding) => filesEnv(binding);
+// ── Knowledge (integration-owned kb shim wiring) ───────────────────────
+//
+// The Knowledge slot's runtime effect is owned by the consuming integration:
+// it reads the persisted binding and writes whatever private shim/config files
+// that app needs. The previous mapping reused `persistFilesConnection`, which
+// wrote a `KNOWLEDGE_BASE_URL=<provider-url>` env var that no consumer reads.
+// The URL alone is also useless without auth and provider-specific metadata.
+// Making this an explicit no-op stops misleading env injection while still
+// letting `instance.connections` track the binding.
+const persistKnowledgeConnection = async (_instance, _binding, _ctx) => {
+    // No-op: real wiring lives in the owning integration's onBeforeStart hook.
+    // instance.connections is persisted by the route before hooks run, so the
+    // binding still sticks.
+};
+const runtimeKnowledgeConnection = (_instance, _binding) => {
+    // No-op: kb shim wiring belongs to the integration's private config path,
+    // not runtime env injection.
+    return {};
+};
+// unpersistKnowledgeConnection lives further down with the other unpersist
+// hooks (UnpersistApplyHook type is declared later in the file).
+// ── Default ENV (bindable exact + unknown categories) ─────────────────
+function defaultEnv(binding) {
+    if (binding.entries.length === 0)
+        return {};
+    // For default-ENV bindings we serialize entry.address (host:port[/path]).
+    return { [binding.slot]: binding.entries.map((e) => e.address).join(",") };
+}
+export const persistDefaultConnection = async (instance, binding, ctx) => {
+    await ctx.writeConnectionEnv(instance, defaultEnv(binding));
+};
+export const runtimeDefaultConnection = (_instance, binding) => defaultEnv(binding);
+// ── MCP — delegate structured binding to the integration (§7.2).
+//
+// The generic connection layer must not know whether the consumer persists
+// MCP servers in mcporter.json, config.yaml, or another private file. It only
+// hands the validated binding to the integration; the integration owns the
+// app-specific persistence and source markers.
+export const persistMcpConnection = async (instance, binding, _ctx) => {
+    if (binding.entries.length === 0)
+        return;
+    await _ctx.integration?.applyConnectionBinding?.({
+        instanceId: instance.id,
+        binding: toIntegrationConnectionBinding(binding),
+    });
+};
+export const runtimeMcpConnection = (_instance, _binding) => {
+    // MCP bindings are persisted by the integration directly; no env injection
+    // is needed on the runtime task.
+    return {};
+};
+export function toIntegrationConnectionBinding(binding) {
+    return {
+        slot: binding.slot,
+        capability: binding.capability,
+        category: binding.category,
+        entries: binding.entries.map((entry) => ({ ...entry })),
+    };
+}
+const unpersistLlmConnection = async (instance, _slot, ctx) => {
+    // Proxy-upstream consumers keep their LLM target on
+    // `x-jishushell.proxy.upstream`. When the binding disappears, fall back to
+    // the core default provider so the chat path stays usable. openai-env
+    // consumers just have their env cleared.
+    if (defaultLlmMode(ctx) !== "proxy-upstream") {
+        await ctx.writeConnectionEnv(instance, { OPENAI_BASE_URL: "", OPENAI_API_KEY: "" });
+        return;
+    }
+    const { decryptApiKey } = await import("../llm-proxy/encryption.js");
+    const { pushDefaultProviderToInstance } = await import("../llm-proxy/instance-proxy.js");
+    const { getDefaultLlmProvider, normalizeProviderApi } = await import("../llm-proxy/providers.js");
+    const dp = getDefaultLlmProvider();
+    if (!dp) {
+        // No default to fall back to — leave the upstream as-is. The
+        // Connections badge already surfaces "未绑定" for the consumer; the
+        // proxy will return 401/4xx until the user picks a provider.
+        return;
+    }
+    await pushDefaultProviderToInstance(instance.id, {
+        providerId: dp.id,
+        baseUrl: dp.baseUrl,
+        api: normalizeProviderApi(dp.api),
+        authHeader: !!dp.authHeader,
+        models: dp.models ?? [],
+        selectedModelId: dp.selectedModelId ?? "",
+        apiKey: dp.apiKey ? decryptApiKey(dp.apiKey) : "",
+    });
+};
+const unpersistEnvSlotConnection = async (instance, slot, ctx) => {
+    // Search / browser / default-ENV all inject a single env var with key
+    // === slot. Empty-string overwrites the previous value so consumers see
+    // an unset binding instead of the stale URL.
+    await ctx.writeConnectionEnv(instance, { [slot]: "" });
+};
+const unpersistMcpConnection = async (instance, slot, _ctx) => {
+    await _ctx.integration?.unapplyConnectionBinding?.({
+        instanceId: instance.id,
+        category: "mcp",
+        slot,
+    });
+};
+const unpersistKnowledgeConnection = async (_instance, _slot, _ctx) => {
+    // No-op: the owning integration detects a missing binding on the next start
+    // and removes its private shim/config artifacts. Clearing env here would be
+    // meaningless because persistKnowledgeConnection never injected anything.
+};
+// ── Hook registries ────────────────────────────────────────────────────
+export const PERSIST_HOOKS = {
+    llm: persistLlmConnection,
+    search: persistSearchConnection,
+    browser: persistBrowserConnection,
+    mcp: persistMcpConnection,
+    files: persistFilesConnection,
+    // Knowledge bindings are persisted in instance.connections before hooks
+    // run. The owning integration performs its private shim/config wiring from
+    // that state. This generic hook deliberately does not inject a URL-only env
+    // value because it lacks the auth and provider metadata needed to work.
+    knowledge: persistKnowledgeConnection,
+    default: persistDefaultConnection,
+};
+export const UNPERSIST_HOOKS = {
+    llm: unpersistLlmConnection,
+    search: unpersistEnvSlotConnection,
+    browser: unpersistEnvSlotConnection,
+    mcp: unpersistMcpConnection,
+    files: unpersistEnvSlotConnection,
+    knowledge: unpersistKnowledgeConnection,
+    default: unpersistEnvSlotConnection,
+};
+export const RUNTIME_HOOKS = {
+    llm: runtimeLlmConnection,
+    search: runtimeSearchConnection,
+    browser: runtimeBrowserConnection,
+    mcp: runtimeMcpConnection,
+    files: runtimeFilesConnection,
+    knowledge: runtimeKnowledgeConnection,
+    default: runtimeDefaultConnection,
+};
+/**
+ * Re-resolve `connections` for a consumer instance against the live capability
+ * registry and render every binding through RUNTIME_HOOKS into a flat env map.
+ *
+ * Use this at every start (not at PUT time) so that provider port / address
+ * changes propagate without requiring the user to re-bind. preCreate mode is
+ * used to stay tolerant: a missing required binding is surfaced via the
+ * Connections badge, not by failing start with a stale provider URL.
+ *
+ * Failures are caught and logged — start should never block on env merging.
+ */
+export async function renderRuntimeConnectionsEnv(spec, instance) {
+    try {
+        const connections = instance.connections ?? {};
+        const { resolveConnections } = await import("./resolver.js");
+        const { resolved } = resolveConnections(spec, { connections }, "preCreate");
+        if (resolved.length === 0)
+            return {};
+        const merged = {};
+        for (const binding of resolved) {
+            const hook = RUNTIME_HOOKS[binding.category];
+            if (!hook)
+                continue;
+            const env = await hook(instance, binding);
+            Object.assign(merged, env);
+        }
+        return merged;
+    }
+    catch (e) {
+        console.warn(`[connection-apply] renderRuntimeConnectionsEnv failed for ${instance.id}: ${e?.message ?? e}`);
+        return {};
+    }
+}
+//# sourceMappingURL=apply.js.map

package/dist/services/connections/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../src/services/connections/apply.ts"],"names":[],"mappings":"AAwCA,2EAA2E;AAE3E,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAsB,EACtB,OAA4B,EAAE;IAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,QAAQ,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG;QAAE,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAsB,EACtB,OAA4B,EAAE;IAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,GAAG,GAAG,GAAG,QAAQ,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG;QAAE,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IACtF,OAAO,GAAG,CAAC;AACb,CAAC;AA4BD,yEAAyE;AAEzE,SAAS,qBAAqB,CAAC,KAAsB;IACnD,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC;IAClD,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC/D,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAeD,0EAA0E;AAE1E,MAAM,uBAAuB,GAAqB,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClF,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAElD,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,4DAA4D;IAC5D,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,2CAA2C;IAC3C,IAAI,MAA+E,CAAC;IACpF,IAAI,eAAe,GAAwB,OAAe,CAAC,eAAe,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACrF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,MAAM;iBACZ,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC3F,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,eAAe,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CACV,gDAAgD,QAAQ,CAAC,EAAE,KAAK,YAAY,KAAK,OAAO,MAAM,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAChH,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAS,CAAC,CAAC;IAClD,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;IAC1B,EAAE,CAAC,KAAK,CAAC,QAAQ,GAAG;QAClB,UAAU,EAAE,YAAY;QACxB,OAAO;QACP,GAAG,EAAE,oBAAoB;QACzB,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,EAAE;QACV,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,MAAM,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,0EAA0E;AAE1E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAsB;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,sBAAsB;IACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACjE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,2BAA2B,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAC1B,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC5E,IAAI,OAAO,gBAAgB,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAED,gCAAgC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,qCAAqC,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,UAAkB,EAAE,IAAY;IACzE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACtD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC9C,oEAAoE;IACpE,MAAM,UAAU,GAAa;QAC3B,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;QACzB,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;QAC9B,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC;KAClC,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBAC/D,IAAI,CAAC,CAAC;oBAAE,SAAS;gBACjB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,SAAS;gBAC5B,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACf,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC1C,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC1C,CAAC;oBACD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzB,CAAC;gBACD,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA8C,EAAE,IAAY;IACxF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,GAAG,GAAQ,MAAM,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxD,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,qCAAqC,CAAC,UAAkB,EAAE,IAAY;IACnF,IAAI,CAAC;QACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,KAAK,EAAE,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,qBAAqB,EAAE,CAAC,UAAU,CAAC;eACzD,WAAW,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC;eACzC,IAAI,CAAC;QACV,OAAO,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAE1E,KAAK,UAAU,YAAY,CAAC,OAA2B;IACrD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QACrG,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,OAAO,CAAC;IACZ,OAAO;QACL,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS;QACzB,cAAc,EAAE,KAAK,IAAI,EAAE;QAC3B,eAAe,EAAE,OAAO;QACxB,eAAe,EAAE,OAAO;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAqB,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC7E,MAAM,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAqB,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAEnG,0EAA0E;AAE1E,MAAM,CAAC,MAAM,oBAAoB,GAAqB,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAqB,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC,CAAE,qDAAqD;IAClG,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,EAAE,CAAC,CAAG,4CAA4C;IACxF,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,SAAS,cAAc,CAAC,GAAiB;IACvC,OAAO,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,0BAA0B,IAAI,YAAY,CAAC;AAC/E,CAAC;AAED,0EAA0E;AAE1E,SAAS,SAAS,CAAC,OAA2B;IAC5C,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACnG,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAqB,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACxF,MAAM,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AAEpG,0EAA0E;AAE1E,SAAS,UAAU,CAAC,OAA2B;IAC7C,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAC7D,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAqB,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACzF,MAAM,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAEtG,0EAA0E;AAE1E,SAAS,QAAQ,CAAC,OAA2B;IAC3C,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAqB,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACvF,MAAM,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAElG,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,oDAAoD;AAEpD,MAAM,0BAA0B,GAAqB,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;IACvF,2EAA2E;IAC3E,0EAA0E;IAC1E,wBAAwB;AAC1B,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;IAC3E,0EAA0E;IAC1E,6BAA6B;IAC7B,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,2EAA2E;AAC3E,iEAAiE;AAEjE,yEAAyE;AAEzE,SAAS,UAAU,CAAC,OAA2B;IAC7C,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,0EAA0E;IAC1E,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAqB,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACzF,MAAM,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAEtG,kEAAkE;AAClE,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,2EAA2E;AAC3E,+CAA+C;AAE/C,MAAM,CAAC,MAAM,oBAAoB,GAAqB,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtF,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzC,MAAM,IAAI,CAAC,WAAW,EAAE,sBAAsB,EAAE,CAAC;QAC/C,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,OAAO,EAAE,8BAA8B,CAAC,OAAO,CAAC;KACjD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;IAC5E,2EAA2E;IAC3E,iCAAiC;IACjC,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,UAAU,8BAA8B,CAAC,OAA2B;IACxE,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAoBD,MAAM,sBAAsB,GAAuB,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAChF,oDAAoD;IACpD,2EAA2E;IAC3E,sEAAsE;IACtE,yCAAyC;IACzC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAC7C,MAAM,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACrE,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;IACzF,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAClG,MAAM,EAAE,GAAG,qBAAqB,EAAE,CAAC;IACnC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,6DAA6D;QAC7D,iEAAiE;QACjE,6DAA6D;QAC7D,OAAO;IACT,CAAC;IACD,MAAM,6BAA6B,CAAC,QAAQ,CAAC,EAAE,EAAE;QAC/C,UAAU,EAAE,EAAE,CAAC,EAAE;QACjB,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,GAAG,EAAE,oBAAoB,CAAC,EAAE,CAAC,GAAG,CAAC;QACjC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU;QAC3B,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE;QACvB,eAAe,EAAE,EAAE,CAAC,eAAe,IAAI,EAAE;QACzC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;KAClD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAuB,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACnF,sEAAsE;IACtE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,GAAG,CAAC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAuB,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAChF,MAAM,IAAI,CAAC,WAAW,EAAE,wBAAwB,EAAE,CAAC;QACjD,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,QAAQ,EAAE,KAAK;QACf,IAAI;KACL,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAuB,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;IACxF,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;AAC5E,CAAC,CAAC;AAEF,0EAA0E;AAE1E,MAAM,CAAC,MAAM,aAAa,GAAqC;IAC7D,GAAG,EAAE,oBAAoB;IACzB,MAAM,EAAE,uBAAuB;IAC/B,OAAO,EAAE,wBAAwB;IACjC,GAAG,EAAE,oBAAoB;IACzB,KAAK,EAAE,sBAAsB;IAC7B,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,SAAS,EAAE,0BAA0B;IACrC,OAAO,EAAE,wBAAwB;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,GAAG,EAAE,sBAAsB;IAC3B,MAAM,EAAE,0BAA0B;IAClC,OAAO,EAAE,0BAA0B;IACnC,GAAG,EAAE,sBAAsB;IAC3B,KAAK,EAAE,0BAA0B;IACjC,SAAS,EAAE,4BAA4B;IACvC,OAAO,EAAE,0BAA0B;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAqC;IAC7D,GAAG,EAAE,oBAAoB;IACzB,MAAM,EAAE,uBAAuB;IAC/B,OAAO,EAAE,wBAAwB;IACjC,GAAG,EAAE,oBAAoB;IACzB,KAAK,EAAE,sBAAsB;IAC7B,SAAS,EAAE,0BAA0B;IACrC,OAAO,EAAE,wBAAwB;CAClC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAsC,EACtC,QAAoF;IAEpF,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;QAC/C,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7D,MAAM,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAErC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAuB,EAAE,OAAO,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CACV,6DAA6D,QAAQ,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAC/F,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/services/connections/resolver.d.ts

@@ -0,0 +1,82 @@
+import type { CapabilityEntry } from "../capabilities/registry.js";
+import type { AppRequire, AppSpec, InstanceConnections } from "../../types.js";
+export declare function isCategoryToken(s: string): boolean;
+/**
+ * Extract the category of a provide-side capability name. Returns the
+ * category token when the name is `<token>-something`; null for legacy exact
+ * names like `ollama-api`.
+ */
+export declare function categoryFromProviderCapability(cap: string): string | null;
+/**
+ * For LLM `proxy-upstream` mode: convert a provide capability like
+ * `llm-ollama` to the providerKind token (`ollama` / `vllm` / `sglang` /
+ * `custom`) the embedded llm-proxy expects on `x-jishushell.proxy.upstream.providerId`.
+ */
+export declare function providerKindFromCapability(cap: string): string;
+export interface ResolvedConnection {
+    slot: string;
+    capability: string;
+    category: string;
+    required: boolean;
+    apply?: "proxy-upstream" | "openai-env";
+    cardinality: "one" | "many";
+    /** Provider entries (single-candidate has length 1; many can be ≥1). */
+    entries: CapabilityEntry[];
+    /** Source of the resolved provider set. Runtime hot paths only resolve persisted facts. */
+    source: "persisted-binding";
+}
+export interface PendingRequire {
+    slot: string;
+    capability: string;
+    required: boolean;
+    reason: "no-candidate" | "ambiguous" | "user-disconnected" | "needs-ui-binding";
+}
+export interface ResolveResult {
+    resolved: ResolvedConnection[];
+    pending: PendingRequire[];
+}
+export type ResolveMode = "preCreate" | "runtime";
+export declare class ConnectionError extends Error {
+    code: string;
+    statusCode: number;
+    details?: any;
+    constructor(code: string, statusCode: number, message: string, details?: any);
+}
+export declare function entryMatchesRequire(req: AppRequire, entry: CapabilityEntry): boolean;
+/**
+ * Resolve all `requires` on `spec` against the registry + the instance's
+ * persisted bindings.
+ *
+ * @param spec     Consumer app spec (`requires[]` is the input)
+ * @param instance Consumer app instance shape — may be a stub
+ *                 `{ connections: {} }` during clone / install
+ *                 (preCreate mode) or the live instance.json (runtime).
+ * @param mode     Affects error semantics: preCreate never throws on
+ *                 missing/ambiguous; runtime throws.
+ */
+export declare function resolveConnections(spec: AppSpec, instance: {
+    connections?: InstanceConnections;
+}, mode: ResolveMode): ResolveResult;
+export interface InstallTimeConnectionMaterialization {
+    connections: InstanceConnections;
+    resolved: ResolvedConnection[];
+    pending: PendingRequire[];
+}
+/**
+ * Create/install boundary only.
+ *
+ * This preserves the old "single running exact provider works out of the box"
+ * UX by materializing it into `instance.connections` before the instance is
+ * first persisted. The materialized connection becomes the canonical fact that
+ * later runtime/status/proxy/capability paths read. Do not call this from hot
+ * paths: registry enumeration here is a one-shot install-time convenience, not
+ * a new fallback source of truth.
+ */
+export declare function materializeInstallTimeConnections(spec: AppSpec, existingConnections?: InstanceConnections): InstallTimeConnectionMaterialization;
+/**
+ * Convenience helper: resolved → flat env map (for default-ENV legacy
+ * fallback path used in install Phase 1, see §6.4 lazy materialization).
+ * Only entries with category=="default" are projected; LLM/MCP/Search/Browser
+ * categories use their own apply hooks (PR 4) and are skipped here.
+ */
+export declare function resolvedToLegacyEnv(resolved: ResolvedConnection[]): Record<string, string>;