@capybara-hq/kernel 0.0.0-stage → 0.1.0-rc.0

package/dist/index.d.ts

@@ -0,0 +1,67 @@
+export { SetupService } from "./admin/setup.service.js";
+export { type CatalogCli, openCatalogCli } from "./catalog/cli.js";
+export { GitSourceError, type ReadGitTreeOptions, readGitTree, } from "./catalog/git-source.js";
+export type { PluginConfirmResult, PluginReview } from "./catalog/plugin-import.js";
+export { LEGACY_FORMAT_MESSAGE, type PluginPackage, PluginPackageError, type ReadPluginPackageOptions, readPluginPackage, } from "./catalog/plugin-package.js";
+export { gatewayReplicasKey } from "./channels/supervisor.js";
+export { envName, renderConfigDocs } from "./config/docs.js";
+export { envOverrides } from "./config/env.js";
+export { type ConfigField, changedPaths, configFields, secretValues } from "./config/fields.js";
+export { fileSource } from "./config/file-source.js";
+export { ConfigError, type ConfigSource, loadConfig, loadConfigWithSources, resolveConfig, selectConfigSource, } from "./config/load.js";
+export { createNacosSource, type NacosSourceOptions } from "./config/nacos-source.js";
+export { type FieldMeta, type KernelConfig, KernelConfigSchema, MARKETPLACE_OFFICIAL_URL_DEFAULT, meta, PACKAGES_MAX_BYTES_DEFAULT, } from "./config/schema.js";
+export { type ConfigSourceKind, configSourceKind, extensionConfigSources, } from "./config/sources.js";
+export type { ConversationEvent } from "./conversations/events.js";
+export { type BusSubscriber, createBus, createBusSubscriber } from "./ctx/bus.js";
+export { createExtensionContext, type KernelDeps, pluginSchemaName, type Route, } from "./ctx/create-ctx.js";
+export { createKv } from "./ctx/kv.js";
+export { createLock } from "./ctx/lock.js";
+export { createQueue } from "./ctx/queue.js";
+export { createKeyring, createSecrets, type DerivedKeys, type Keyring, rewrapDataKeys, } from "./ctx/secrets.js";
+export { type KernelDatabase, type KernelDb, kernelDb } from "./db/kernel-schema.js";
+export { type MigrationOwner, migrate } from "./db/migrator.js";
+export { createDb } from "./db/pool.js";
+export { destructiveStatements, isDestructiveBody, isDestructiveSql, type SqlStatement, splitSqlStatements, } from "./db/sql-statements.js";
+export { ApiError, ERROR_CODES, type ErrorCode } from "./errors.js";
+export { ExtensionAdminOps, type ExtensionAdminOpsDeps } from "./extensions/admin-ops.js";
+export { ExtensionAdmin, PLUGINS_CHANGED_TOPIC } from "./extensions/admin-view.js";
+export { type ApprovalDecision, ExtensionApprovals, type PendingExtension, type PermissionSnapshot, planApprovals, snapshotCovers, withPreApproved, } from "./extensions/approvals.js";
+export { blobKey, ExtensionBlobIntegrityError, type ExtensionBlobSource, ExtensionBlobs, } from "./extensions/blobs.js";
+export { BOOTSTRAP_MANIFEST_FILE, type BootstrapEntryResult, BootstrapFailedError, type BootstrapFailure, type BootstrapResult, BootstrapService, type BootstrapServiceDeps, bootstrapManifestSha256, readBootstrapManifest, } from "./extensions/bootstrap.js";
+export { type ExtensionCli, openExtensionCli } from "./extensions/cli.js";
+export { DEPLOYMENT_SECRETS_ORG, type DeploymentConfigField, type DeploymentConfigView, ExtensionDeploymentConfigService, mergeDeploymentConfig, PLUGIN_DEPLOYMENT_CONFIG_TOPIC, readStoredDeploymentConfig, } from "./extensions/deployment-config.js";
+export { assertSecretsReachable, ExtensionHost, type ExtensionLoadPlan, type InspectedExtension, type InstalledExtensionLoader, type InstallFailureReason, } from "./extensions/host.js";
+export { ExtensionUnloadedError, type InflightEntry, InflightTracker, PLUGIN_UNLOADED_TOOL_ERROR, type TrackOptions, trackCalls, } from "./extensions/inflight.js";
+export { type DesiredExtension, type ExtensionInstallRow, ExtensionInstalls, type IngestSource, type PackageReview, } from "./extensions/installs.js";
+export { DEFAULT_DISPOSE_TIMEOUT_MS, type DisposeOptions, ExtensionInstance, ImportTracker, type LoadDeps, loadInstance, ManifestMismatchError, type Registration, type RegistrationKind, UPGRADE_WARN_THRESHOLD, } from "./extensions/instance.js";
+export { ExtensionLifecycle, type ExtensionLifecycleDeps, type LifecycleHost, PLUGINS_RECONCILE_JOB, PLUGINS_RECONCILE_TOPIC, } from "./extensions/lifecycle.js";
+export { ensureMigrated, MIGRATE_LOCK_PREFIX, type MigrateLockDeps, PLUGINS_MIGRATED_TOPIC, unrunMigrations, } from "./extensions/migrate-lock.js";
+export { EXTENSION_PACKAGE_LIMITS, type ExtensionPackage, ExtensionPackageError, type ExtensionPackageLimits, type ExtensionPackageSection, extractExtensionPackage, HOST_ZOD_VERSION, permissionSetOfPackage, type ReadExtensionPackageOptions, readExtensionPackage, } from "./extensions/package.js";
+export { blockingKeys, computePermissionSet, diffPermissions, type PermissionSet, permissionKeys, WARNINGS_KEY_PREFIX, } from "./extensions/permission-set.js";
+export { type AdminExtensionView, type DeploymentExtensionStatus, isSensitivePermissionKey, type PermissionGroup, type PermissionItem, permissionGroups, permissionKeyItems, reviewHash, SENSITIVE_EXTENSION_POINTS, type SensitiveReason, } from "./extensions/permission-view.js";
+export { ExtensionRegistry } from "./extensions/registry.js";
+export { ExtensionResolveError, resolveExtensions } from "./extensions/resolve.js";
+export { type ExtensionLoadStatus, type ExtensionSource, newReplicaId, type PendingReason, ReplicaStatusStore, } from "./extensions/sources.js";
+export { syncPackage } from "./extensions/sync.js";
+export { type CreateHttpAppOptions, createHttpApp, type HealthOptions, type KernelHttp, type KernelHttpApp, } from "./http/app.js";
+export { type Account, AccountsService } from "./identity/accounts.js";
+export { type ApiTokenRecord, ApiTokenService } from "./identity/api-tokens.js";
+export { audit } from "./identity/audit.js";
+export { normalizeLogin, validatePassword } from "./identity/login.js";
+export { DUMMY_PASSWORD_HASH, hashPassword, verifyPassword } from "./identity/passwords.js";
+export { type IssuedSession, REFRESH_RACE_GRACE_MS, SessionService, } from "./identity/sessions.js";
+export { DEPLOYMENT_SETTINGS, type DeploymentSettings, SettingsService, } from "./identity/settings.js";
+export { createKernel, KERNEL_MIGRATIONS_DIR, KERNEL_SCHEMA, type Kernel, type KernelOptions, type KernelRuns, migrateAll, } from "./kernel.js";
+export { createLogger, type KernelLogger, LOG_LEVELS, type LogLevel } from "./log.js";
+export { type Org, OrgsService } from "./orgs/orgs.service.js";
+export { fetchNpmPackage, IntegrityMismatchError, type NpmFetchConfig, NpmFetchError, PackageTooLargeError, } from "./packages/npm.js";
+export { UNKNOWN_RESULT_TEXT } from "./runtime/context/pairing.js";
+export type { AgentLoop, LoopContext, LoopOutcome } from "./runtime/loop.js";
+export { MAINTENANCE_QUEUE_NAME } from "./runtime/maintenance.js";
+export { runJobId } from "./runtime/run-queue.js";
+export { SANDBOX_DESTROY_JOB, SANDBOX_SUSPEND_JOB, } from "./sandbox/lifecycle.js";
+export { SANDBOX_LOCK_TTL_MS, SandboxService, type SandboxServiceDeps, type SandboxUseInfo, } from "./sandbox/sandbox.service.js";
+export { MAX_STORAGE_KEY_BYTES, StorageKeyError, } from "./storage/prefix.js";
+export { StorageService, type StorageServiceDeps } from "./storage/storage.service.js";
+export { SANDBOX_RECREATED_NOTICE, SANDBOX_STARTED_NOTICE, } from "./tools/builtins/sandbox/common.js";

package/dist/index.js

@@ -0,0 +1,65 @@
+export { SetupService } from "./admin/setup.service.js";
+export { openCatalogCli } from "./catalog/cli.js";
+// The git reader marketplaces use; core's check:bootstrap reads the official marketplace with it.
+export { GitSourceError, readGitTree, } from "./catalog/git-source.js";
+export { LEGACY_FORMAT_MESSAGE, PluginPackageError, readPluginPackage, } from "./catalog/plugin-package.js";
+export { gatewayReplicasKey } from "./channels/supervisor.js";
+export { envName, renderConfigDocs } from "./config/docs.js";
+export { envOverrides } from "./config/env.js";
+export { changedPaths, configFields, secretValues } from "./config/fields.js";
+export { fileSource } from "./config/file-source.js";
+export { ConfigError, loadConfig, loadConfigWithSources, resolveConfig, selectConfigSource, } from "./config/load.js";
+export { createNacosSource } from "./config/nacos-source.js";
+export { KernelConfigSchema, MARKETPLACE_OFFICIAL_URL_DEFAULT, meta, PACKAGES_MAX_BYTES_DEFAULT, } from "./config/schema.js";
+export { configSourceKind, extensionConfigSources, } from "./config/sources.js";
+export { createBus, createBusSubscriber } from "./ctx/bus.js";
+export { createExtensionContext, pluginSchemaName, } from "./ctx/create-ctx.js";
+export { createKv } from "./ctx/kv.js";
+export { createLock } from "./ctx/lock.js";
+export { createQueue } from "./ctx/queue.js";
+export { createKeyring, createSecrets, rewrapDataKeys, } from "./ctx/secrets.js";
+export { kernelDb } from "./db/kernel-schema.js";
+export { migrate } from "./db/migrator.js";
+export { createDb } from "./db/pool.js";
+export { destructiveStatements, isDestructiveBody, isDestructiveSql, splitSqlStatements, } from "./db/sql-statements.js";
+export { ApiError, ERROR_CODES } from "./errors.js";
+export { ExtensionAdminOps } from "./extensions/admin-ops.js";
+export { ExtensionAdmin, PLUGINS_CHANGED_TOPIC } from "./extensions/admin-view.js";
+export { ExtensionApprovals, planApprovals, snapshotCovers, withPreApproved, } from "./extensions/approvals.js";
+export { blobKey, ExtensionBlobIntegrityError, ExtensionBlobs, } from "./extensions/blobs.js";
+export { BOOTSTRAP_MANIFEST_FILE, BootstrapFailedError, BootstrapService, bootstrapManifestSha256, readBootstrapManifest, } from "./extensions/bootstrap.js";
+export { openExtensionCli } from "./extensions/cli.js";
+export { DEPLOYMENT_SECRETS_ORG, ExtensionDeploymentConfigService, mergeDeploymentConfig, PLUGIN_DEPLOYMENT_CONFIG_TOPIC, readStoredDeploymentConfig, } from "./extensions/deployment-config.js";
+export { assertSecretsReachable, ExtensionHost, } from "./extensions/host.js";
+export { ExtensionUnloadedError, InflightTracker, PLUGIN_UNLOADED_TOOL_ERROR, trackCalls, } from "./extensions/inflight.js";
+export { ExtensionInstalls, } from "./extensions/installs.js";
+export { DEFAULT_DISPOSE_TIMEOUT_MS, ExtensionInstance, ImportTracker, loadInstance, ManifestMismatchError, UPGRADE_WARN_THRESHOLD, } from "./extensions/instance.js";
+export { ExtensionLifecycle, PLUGINS_RECONCILE_JOB, PLUGINS_RECONCILE_TOPIC, } from "./extensions/lifecycle.js";
+export { ensureMigrated, MIGRATE_LOCK_PREFIX, PLUGINS_MIGRATED_TOPIC, unrunMigrations, } from "./extensions/migrate-lock.js";
+export { EXTENSION_PACKAGE_LIMITS, ExtensionPackageError, extractExtensionPackage, HOST_ZOD_VERSION, permissionSetOfPackage, readExtensionPackage, } from "./extensions/package.js";
+export { blockingKeys, computePermissionSet, diffPermissions, permissionKeys, WARNINGS_KEY_PREFIX, } from "./extensions/permission-set.js";
+export { isSensitivePermissionKey, permissionGroups, permissionKeyItems, reviewHash, SENSITIVE_EXTENSION_POINTS, } from "./extensions/permission-view.js";
+export { ExtensionRegistry } from "./extensions/registry.js";
+export { ExtensionResolveError, resolveExtensions } from "./extensions/resolve.js";
+export { newReplicaId, ReplicaStatusStore, } from "./extensions/sources.js";
+export { syncPackage } from "./extensions/sync.js";
+export { createHttpApp, } from "./http/app.js";
+export { AccountsService } from "./identity/accounts.js";
+export { ApiTokenService } from "./identity/api-tokens.js";
+export { audit } from "./identity/audit.js";
+export { normalizeLogin, validatePassword } from "./identity/login.js";
+export { DUMMY_PASSWORD_HASH, hashPassword, verifyPassword } from "./identity/passwords.js";
+export { REFRESH_RACE_GRACE_MS, SessionService, } from "./identity/sessions.js";
+export { DEPLOYMENT_SETTINGS, SettingsService, } from "./identity/settings.js";
+export { createKernel, KERNEL_MIGRATIONS_DIR, KERNEL_SCHEMA, migrateAll, } from "./kernel.js";
+export { createLogger, LOG_LEVELS } from "./log.js";
+export { OrgsService } from "./orgs/orgs.service.js";
+export { fetchNpmPackage, IntegrityMismatchError, NpmFetchError, PackageTooLargeError, } from "./packages/npm.js";
+export { UNKNOWN_RESULT_TEXT } from "./runtime/context/pairing.js";
+export { MAINTENANCE_QUEUE_NAME } from "./runtime/maintenance.js";
+export { runJobId } from "./runtime/run-queue.js";
+export { SANDBOX_DESTROY_JOB, SANDBOX_SUSPEND_JOB, } from "./sandbox/lifecycle.js";
+export { SANDBOX_LOCK_TTL_MS, SandboxService, } from "./sandbox/sandbox.service.js";
+export { MAX_STORAGE_KEY_BYTES, StorageKeyError, } from "./storage/prefix.js";
+export { StorageService } from "./storage/storage.service.js";
+export { SANDBOX_RECREATED_NOTICE, SANDBOX_STARTED_NOTICE, } from "./tools/builtins/sandbox/common.js";

package/dist/kernel.d.ts

@@ -0,0 +1,256 @@
+import { type BootstrapManifest, type ExtensionContext } from "@capybara-hq/plugin-sdk";
+import { CatalogService } from "./catalog/catalog.service.js";
+import { MarketplacesService } from "./catalog/marketplaces.service.js";
+import { PluginImport } from "./catalog/plugin-import.js";
+import { ChannelConnections } from "./channels/connections.service.js";
+import { ChannelInbound } from "./channels/inbound.js";
+import { ChannelOutbound } from "./channels/outbound.js";
+import { type ConfigSource } from "./config/load.js";
+import { type KernelConfig } from "./config/schema.js";
+import { type ConfigSourceKind } from "./config/sources.js";
+import { AttachmentsService } from "./conversations/attachments.service.js";
+import { EventLog } from "./conversations/event-log.js";
+import type { EvalReplayHooks } from "./evals/run-replay.js";
+import { ExtensionAdminOps } from "./extensions/admin-ops.js";
+import { ExtensionAdmin } from "./extensions/admin-view.js";
+import type { PendingExtension } from "./extensions/approvals.js";
+import { ExtensionBlobs } from "./extensions/blobs.js";
+import { BootstrapService } from "./extensions/bootstrap.js";
+import { ExtensionDeploymentConfigService } from "./extensions/deployment-config.js";
+import { ExtensionHost } from "./extensions/host.js";
+import { ExtensionInstalls } from "./extensions/installs.js";
+import { ExtensionLifecycle } from "./extensions/lifecycle.js";
+import { OrgExtensionConfigs } from "./extensions/org-config.js";
+import { type KernelHttp } from "./http/app.js";
+import { IdentityBinding } from "./identity/binding.js";
+import { ExternalIdentities } from "./identity/external.js";
+import { SsoFlow } from "./identity/sso.js";
+import { type KernelLogger } from "./log.js";
+import { PricesService } from "./models/prices.js";
+import { ModelPurposesService } from "./models/purposes.js";
+import { DirectorySync } from "./orgs/directory-sync.js";
+import { Offboarding } from "./orgs/offboarding.js";
+import { RunAbort } from "./runtime/abort.js";
+import { ConversationLock } from "./runtime/conversation-lock.js";
+import { type LoopDeps } from "./runtime/langgraph-loop.js";
+import type { AgentLoop } from "./runtime/loop.js";
+import { Maintenance } from "./runtime/maintenance.js";
+import { ProviderRegistry } from "./runtime/providers.js";
+import { OrgQuota } from "./runtime/quota.js";
+import { RunQueue } from "./runtime/run-queue.js";
+import { type RunHooks } from "./runtime/run-worker.js";
+import { UsageReporter } from "./runtime/usage-report.js";
+import { Waits } from "./runtime/waits.js";
+import { SandboxService } from "./sandbox/sandbox.service.js";
+import { SkillChangesService } from "./skills/changes.service.js";
+import { SkillsService } from "./skills/skills.service.js";
+import { StorageService } from "./storage/storage.service.js";
+import { ApprovalsService } from "./tools/approvals.service.js";
+import { ConnectorContent } from "./tools/connector-content.js";
+import { Credentials } from "./tools/credentials.js";
+import { ToolDrift } from "./tools/drift.js";
+import { ToolOutputs } from "./tools/outputs.js";
+import { ToolPipeline } from "./tools/pipeline.js";
+import { QuestionsService } from "./tools/questions.service.js";
+import { ToolRegistry } from "./tools/registry.js";
+/**
+ * 内核迁移目录。src/ 与 dist/ 都在包根下一层，所以统一指向 `<包根>/src/migrations`：
+ * 用 tsx 从源码运行与运行 tsc 产物时解析到同一个目录（SQL 文件不进 dist，随包发布 src/migrations）。
+ */
+export declare const KERNEL_MIGRATIONS_DIR: string;
+/** 内核 PG schema。 */
+export declare const KERNEL_SCHEMA = "capybara";
+/**
+ * 停机分阶段预算：每阶段实际等待 `min(阶段预算, 总剩余)`，按顺序为
+ * migrate（中止进行中的内核迁移并等其会话结束）2s → http 10s → runs 10s → plugins 5s，合计 27s，
+ * 余下 3s 给 bus / redis / pg 收尾（这三步共享总剩余）。
+ * http 阶段是一个截止时间：先等进行中的监听完成（否则关闭会与监听交错留下端口），再关闭 HTTP，
+ * 两步共用这 10s；到点仍未关完就强制断开所有连接。
+ * runs 阶段（从原插件阶段的 15s 中划出 10s）：本进程的运行收到停机信号，在下一个步骤边界停下、
+ * 任务回到队列；超出预算的运行交给 BullMQ stalled 机制由其他 worker 续跑（spec 8.5）。
+ * 因此任一前序阶段卡死时，插件队列仍至少有 5s 排空，总时长不超过 30s。
+ */
+export declare const STOP_BUDGET_MS: {
+    readonly migrate: 2000;
+    readonly http: 10000;
+    readonly runs: 10000;
+    readonly plugins: 5000;
+};
+/** 运行编排相关的内核服务（后续任务的 loop / SSE 使用）。 */
+export interface KernelRuns {
+    readonly eventLog: EventLog;
+    readonly registry: ProviderRegistry;
+    readonly queue: RunQueue;
+    readonly lock: ConversationLock;
+    readonly quota: OrgQuota;
+    readonly abort: RunAbort;
+    /** 构造 loop 用的依赖（单步模型调用 + 工具执行管线）。 */
+    readonly stepDeps: LoopDeps;
+    /** 运行等待人处理：续跑、超时、等待中中止。 */
+    readonly waits: Waits;
+    /** 内核维护队列（等待超时、输出存档清理等）。 */
+    readonly maintenance: Maintenance;
+}
+/** 工具相关的内核服务。 */
+export interface KernelTools {
+    readonly registry: ToolRegistry;
+    readonly credentials: Credentials;
+    /** 输出存档（超大工具结果）。 */
+    readonly outputs: ToolOutputs;
+    /** 工具执行管线（tools 节点使用）。 */
+    readonly pipeline: ToolPipeline;
+    /** 工具调用审批与「以后都允许」授权。 */
+    readonly approvals: ApprovalsService;
+    /** 工具调用的输入请求（回答后续跑）。 */
+    readonly questions: QuestionsService;
+    /** 工具定义漂移检测（周期扫描、list_changed、手动刷新）。 */
+    readonly drift: ToolDrift;
+    /** 连接器的 prompts / resources（斜杠命令、@ 资源引用与消息附件）。 */
+    readonly connectorContent: ConnectorContent;
+}
+/** 外部身份相关的内核服务（渠道运行时、通讯录同步与 HTTP 共用）。 */
+export interface KernelIdentity {
+    /** 外部身份 ↔ 账号（登录、渠道入站、通讯录共用 `(source, externalId)` 键）。 */
+    readonly external: ExternalIdentities;
+    /** IM 身份的一次性绑定链接。 */
+    readonly binding: IdentityBinding;
+    /** 第三方登录（`identity-source@1`）。 */
+    readonly sso: SsoFlow;
+    /** 成员离职处理（移出、离开、通讯录同步共用）。 */
+    readonly offboarding: Offboarding;
+    /** 通讯录同步（`directory@1`：每小时扫描、手动、`directory_changed` 提示）。 */
+    readonly directory: DirectorySync;
+}
+/** 渠道运行时（连接、入站、出站投递）。 */
+export interface KernelChannels {
+    /** 组织的渠道连接（CRUD、运行时配置、出站会话 `outbound` / `send`）。 */
+    readonly connections: ChannelConnections;
+    /** 出站投递与入站任务（队列 `cap-kernel-channels`；worker 角色消费）。 */
+    readonly outbound: ChannelOutbound;
+    /** 入站事件：`onEvent`（插件 `connect` 的回调，去重并入队）与 `handle`（worker 上处理入站任务）。 */
+    readonly inbound: ChannelInbound;
+}
+/** 运行中的内核实例。 */
+export interface Kernel {
+    /** 内核 HTTP：进程内注入请求、列出路由。 */
+    readonly http: KernelHttp;
+    readonly host: ExtensionHost;
+    /** usage.report delivery (fast path, sweeper and, on the worker role, the worker). */
+    readonly usageReport: UsageReporter;
+    /** This process's replica id (`<hostname>-<pid>-<6 random chars>`, written to `extension_replica_status`). */
+    readonly replicaId: string;
+    /** 插件包的导入（上传 / npm）与安装记录。 */
+    readonly extensionInstalls: ExtensionInstalls;
+    /** 部署级插件后台：列表、状态与网页批准权限。 */
+    readonly extensionAdmin: ExtensionAdmin;
+    /** 部署级插件的安装 / 启用 / 停用 / 卸载（只写期望状态并发布 `kernel.plugins.changed`）。 */
+    readonly extensionAdminOps: ExtensionAdminOps;
+    /** 本副本的插件生命周期：订阅 bus 并 reconcile 到 PG 期望状态（C16）。 */
+    readonly extensionLifecycle: ExtensionLifecycle;
+    /** 内容寻址的插件包存储（对象存储或 PG）。 */
+    readonly extensionBlobs: ExtensionBlobs;
+    /** The enterprise catalog: items and imports (plugins / connector templates / skills). */
+    readonly catalog: CatalogService;
+    /** Enterprise import of plugins (plugin tgz files): prepare / confirm and staging cleanup. */
+    readonly pluginImport: PluginImport;
+    /** The bootstrap step (package ecosystem spec §7); `start()` runs it when given `bootstrapDir`. */
+    readonly bootstrap: BootstrapService;
+    /** Marketplaces: official / enterprise marketplaces and their refresh. */
+    readonly marketplaces: MarketplacesService;
+    /** 部署级插件配置（PG，文件 / 环境变量里有的字段只读；C10）。 */
+    readonly extensionDeploymentConfigs: ExtensionDeploymentConfigService;
+    /** 组织级插件启用状态与配置（密钥字段加密存储）。 */
+    readonly orgExtensionConfigs: OrgExtensionConfigs;
+    /** 内核总线（命名空间 `kernel`）。 */
+    readonly bus: ExtensionContext["bus"];
+    /** 运行编排服务。 */
+    readonly runs: KernelRuns;
+    /** 工具注册表与连接器凭据。 */
+    readonly tools: KernelTools;
+    /** 外部身份、绑定、第三方登录与离职处理。 */
+    readonly identity: KernelIdentity;
+    /** 渠道连接与入站。 */
+    readonly channels: KernelChannels;
+    /**
+     * 对象存储（`object-store@1` 提供方之上的前缀隔离，内核用 `kernel(orgId)`）；
+     * 没有提供方时 `available` 为 false，各方法 reject `storage.unavailable`。
+     */
+    readonly storage: StorageService;
+    /** 对话附件（上传、finalize、绑定、取字节、过期清理）。 */
+    readonly attachments: AttachmentsService;
+    /** 技能库（组织技能的上传、版本、列表与软删除）。 */
+    readonly skills: SkillsService;
+    /** agent 自写技能（`skill_write`）与共享 agent 的技能变更审批（R4）。 */
+    readonly skillChanges: SkillChangesService;
+    /** 模型价格表（PG `model_prices`，成本读时计算）。 */
+    readonly prices: PricesService;
+    /** 模型用途映射（部署默认 + 组织覆盖；评委用途 `eval`）。 */
+    readonly purposes: ModelPurposesService;
+    /**
+     * 按对话的沙箱（`sandbox@1` 提供方之上：懒创建、锁、休眠与销毁）；
+     * 没有提供方时 `available` 为 false，使用时抛 `sandbox.unavailable`（503）。
+     */
+    readonly sandbox: SandboxService;
+    readonly log: KernelLogger;
+    /** 当前生效的配置（热更新只替换 `hot` 字段）。 */
+    readonly config: KernelConfig;
+    /**
+     * 实际监听的端口；尚未 start 或已 stop 时为 undefined。
+     * 所有角色都监听：worker-only 只暴露 `/healthz` 与 `/readyz`（供 K8s 探针）。
+     */
+    readonly port: number | undefined;
+    start(): Promise<void>;
+    /** 优雅停机：幂等，总时长不超过 30s。 */
+    stop(): Promise<void>;
+}
+/** createKernel 的可选项。 */
+export interface KernelOptions {
+    /** 配置来源；提供 `watch` 时启用热更新。 */
+    source?: ConfigSource;
+    /** 解析插件裸包名的目录，默认 `process.cwd()`；相对路径按当前 cwd 解析。 */
+    resolveFrom?: string;
+    /** 默认按 `config.log.level` 新建 JSON logger。 */
+    logger?: KernelLogger;
+    /** 热更新时与来源原始值合并的环境变量，默认 `process.env`。 */
+    env?: NodeJS.ProcessEnv;
+    /**
+     * 运行使用的 AgentLoop 工厂（测试用）。默认是 {@link LangGraphLoop}：checkpoint 存在内核的
+     * `KyselyCheckpointSaver`，worker 崩溃后其他副本从 checkpoint 续跑。
+     */
+    loop?: (deps: LoopDeps) => AgentLoop;
+    /** 运行 worker 的测试钩子。 */
+    runHooks?: RunHooks;
+    /** 评测整轮回放的测试钩子。 */
+    evalHooks?: EvalReplayHooks;
+    /**
+     * The directory holding the bootstrap packages (`<name>-<version>.tgz`, baked into the image;
+     * package ecosystem spec §7). When given, `start()` runs the bootstrap step (see
+     * `extensions/bootstrap.ts`) before loading extensions unless it is already done for the
+     * manifest, and refuses to start when it cannot complete a required entry. Omitted: no bootstrap
+     * step (tests, or a deployment whose init container ran `capybara bootstrap`).
+     */
+    bootstrapDir?: string;
+    /** The bootstrap manifest; default the `bootstrap.json` shipped with the kernel package. */
+    bootstrapManifest?: BootstrapManifest;
+    /**
+     * Where each extension deployment config field of the startup config comes from (the
+     * `extensionConfigSources` returned by `loadConfigWithSources`); these fields are read-only in the
+     * admin console (D8). When omitted it is derived from `config.extensionConfig`: fields present in
+     * the environment are `env`, the rest take the `CAPYBARA_CONFIG_SOURCE` kind (file / nacos).
+     */
+    extensionConfigSources?: Record<string, Record<string, ConfigSourceKind>>;
+}
+/**
+ * 运行内核迁移与所有已配置插件的迁移（不调用插件 setup，不连接 Redis）。
+ * 权限待批准的插件不迁移（`extensionPermissions.autoApprove` 时除外），经 `opts.onPending` 报告。
+ */
+export declare function migrateAll(config: KernelConfig, opts?: {
+    resolveFrom?: string;
+    onPending?: (pending: PendingExtension[]) => void;
+}): Promise<{
+    schema: string;
+    plugin?: string;
+    applied: string[];
+}[]>;
+/** 构建内核：创建连接（Redis 惰性连接）、插件宿主与 HTTP 应用；`start()` 才真正连接、迁移、加载插件与监听。 */
+export declare function createKernel(config: KernelConfig, opts?: KernelOptions): Promise<Kernel>;