@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.10

package/dist/inbox/platform-inbox.service.d.ts

@@ -0,0 +1,151 @@
+import type { LocalizedName } from "@capybara-hq/plugin-sdk";
+import { type CatalogItemView, CatalogService } from "../catalog/catalog.service.js";
+import { CatalogRequestsService, type CatalogRequestView } from "../catalog/requests.service.js";
+import type { ScopeSyncOp } from "../db/kernel-schema.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import type { PlatformNoticeDetails } from "./platform-notices.js";
+/** The most items one platform inbox read returns. */
+export declare const PLATFORM_INBOX_MAX_ITEMS = 100;
+/** The most open scope sync failures one read takes. */
+export declare const SCOPE_SYNC_FAILURES_LIST_MAX = 200;
+/**
+ * A platform components migration run unfinished this long after its start is stuck (its worker
+ * stopped mid-run; a run takes seconds, and the next one starts at the next worker start or day).
+ */
+export declare const MIGRATION_RUN_STUCK_MS: number;
+/**
+ * An open failure of the plugin scope sync: its last attempt to install the plugin in the org, to
+ * uninstall it, or to install the dependencies a platform update added (`dependencies`) failed,
+ * and the org still differs from the scope in that direction.
+ */
+export interface ScopeSyncFailureView {
+    item: {
+        id: string;
+        name: string;
+        displayName: LocalizedName | null;
+    };
+    org: {
+        id: string;
+        name: string;
+    };
+    op: ScopeSyncOp;
+    /** The error code (`internal` for an unexpected error) and its message. */
+    code: string;
+    message: string;
+    failedAt: string;
+}
+/**
+ * The latest platform components migration run (`platform_migration_runs`) when it needs a look:
+ * finished with catalog items whose components could not be written (`itemsFailed`,
+ * `<name>@<version>`), or `stuck` (unfinished {@link MIGRATION_RUN_STUCK_MS} after its start).
+ */
+export interface MigrationRunView {
+    id: string;
+    startedAt: string;
+    finishedAt: string | null;
+    stuck: boolean;
+    itemsFailed: string[];
+}
+/**
+ * One item of the super admin's inbox (by `type`). Nothing is decided in the inbox: each item is
+ * acted on where it lives (the web links to it).
+ * - `catalog_request`: an org's pending request to the platform (`access`: use a plugin shown to
+ *   it; `import`: bring in a marketplace entry), as `GET /admin/catalog/requests` lists them;
+ * - `permission_confirmation`: a platform plugin whose extension permissions wait for a super
+ *   admin's confirmation (`GET /admin/catalog/items?pending=true`), `id` = the item's;
+ * - `org_upload_pending`: an org-owned plugin whose uploaded version (with an extension) waits for
+ *   the super admin in 待确认 (ruling P3-22; confirmed or rejected there), `id` = the item's;
+ * - `scope_sync_failed`: an open scope sync failure, `id` = `<itemId>/<orgId>`;
+ * - `platform_migration`: the latest migration run, failed items or stuck, `id` = the run's;
+ * - `ownership_transferred`: a deleted org's shared item now belongs to the platform, until a
+ *   super admin dismisses it (`POST admin/inbox/notices/:id/dismiss`).
+ */
+export type PlatformInboxItem = {
+    type: "catalog_request";
+    id: string;
+    createdAt: string;
+    request: CatalogRequestView;
+} | {
+    type: "permission_confirmation";
+    id: string;
+    createdAt: string;
+    item: CatalogItemView;
+} | {
+    type: "org_upload_pending";
+    id: string;
+    createdAt: string;
+    item: CatalogItemView;
+} | {
+    type: "scope_sync_failed";
+    id: string;
+    createdAt: string;
+    failure: ScopeSyncFailureView;
+} | {
+    type: "platform_migration";
+    id: string;
+    createdAt: string;
+    run: MigrationRunView;
+} | {
+    type: "ownership_transferred";
+    id: string;
+    createdAt: string;
+    notice: PlatformNoticeView;
+};
+/** An open platform notice (`platform_notices`, kind `ownership_transferred`). */
+export interface PlatformNoticeView {
+    id: string;
+    kind: "ownership_transferred";
+    createdAt: string;
+    detail: PlatformNoticeDetails["ownership_transferred"];
+}
+/**
+ * `GET /admin/inbox`: newest first, at most {@link PLATFORM_INBOX_MAX_ITEMS}; `truncated`: more;
+ * `total`: how many items wait in all (also `GET /admin/inbox/count`).
+ */
+export interface PlatformInboxView {
+    items: PlatformInboxItem[];
+    truncated: boolean;
+    total: number;
+}
+/**
+ * The super admin's inbox (plugin scope spec §5.1 rule 5, §13.5): what waits on the platform,
+ * gathered from the sources the admin pages read (the 待确认 tab's requests and permission
+ * confirmations), plus the scope sync's open failures and the platform components migration's
+ * latest run. Stateless, read live from PG.
+ */
+export declare class PlatformInboxService {
+    private readonly requests;
+    private readonly catalog;
+    private readonly kdb;
+    constructor(requests: Pick<CatalogRequestsService, "listDeployment" | "countPendingDeployment">, catalog: Pick<CatalogService, "list">, kdb: KernelDb);
+    list(): Promise<PlatformInboxView>;
+    /**
+     * How many items wait (the sidebar's count): the same sources, counted where they can be (the
+     * requests and the failures; the permission confirmations are the catalog's pending list).
+     */
+    count(): Promise<number>;
+    private countNotices;
+    /** The open platform notices, newest first, at most {@link PLATFORM_INBOX_MAX_ITEMS}. */
+    private notices;
+    /**
+     * A super admin dismisses a platform notice (for every super admin). Dismissing one already
+     * dismissed is fine; no notice with that id -> `inbox.notice_not_found`.
+     */
+    dismissNotice(accountId: string, id: string): Promise<void>;
+    /**
+     * The open failures still worth a look, joined to their item and org: of a live item and org,
+     * and the pair still differs in the failed direction (a person may have converged it meanwhile):
+     * an install failure while the org has no live install of the item; an uninstall or dependencies
+     * failure while it has one.
+     */
+    private failureRows;
+    private countScopeSyncFailures;
+    /** The open scope sync failures ({@link failureRows}), newest first. */
+    private scopeSyncFailures;
+    /**
+     * The latest migration run when it needs a look (see {@link MigrationRunView}); null when it
+     * finished without failed items, is still running, or there was none. An earlier run's failure
+     * is not shown: each run tries every unwritten item again.
+     */
+    private migrationRun;
+}

package/dist/inbox/platform-inbox.service.js

@@ -0,0 +1,263 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { CatalogService } from "../catalog/catalog.service.js";
+import { CatalogRequestsService } from "../catalog/requests.service.js";
+import { ApiError } from "../errors.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+/** The most items one platform inbox read returns. */
+export const PLATFORM_INBOX_MAX_ITEMS = 100;
+/** The most open scope sync failures one read takes. */
+export const SCOPE_SYNC_FAILURES_LIST_MAX = 200;
+/**
+ * A platform components migration run unfinished this long after its start is stuck (its worker
+ * stopped mid-run; a run takes seconds, and the next one starts at the next worker start or day).
+ */
+export const MIGRATION_RUN_STUCK_MS = 60 * 60_000;
+/** Plugin install statuses of a plugin that is on in the org. */
+const LIVE_INSTALL = ["installing", "installed", "upgrading"];
+/**
+ * The super admin's inbox (plugin scope spec §5.1 rule 5, §13.5): what waits on the platform,
+ * gathered from the sources the admin pages read (the 待确认 tab's requests and permission
+ * confirmations), plus the scope sync's open failures and the platform components migration's
+ * latest run. Stateless, read live from PG.
+ */
+let PlatformInboxService = class PlatformInboxService {
+    requests;
+    catalog;
+    kdb;
+    constructor(requests, catalog, kdb) {
+        this.requests = requests;
+        this.catalog = catalog;
+        this.kdb = kdb;
+    }
+    async list() {
+        const [requests, requestCount, pending, failures, failureCount, run, notices, noticeCount] = await Promise.all([
+            this.requests.listDeployment(),
+            this.requests.countPendingDeployment(),
+            this.catalog.list({ pending: true }),
+            this.scopeSyncFailures(),
+            this.countScopeSyncFailures(),
+            this.migrationRun(),
+            this.notices(),
+            this.countNotices(),
+        ]);
+        const all = [
+            ...requests.map((r) => ({
+                type: "catalog_request",
+                id: r.id,
+                createdAt: r.createdAt,
+                request: r,
+            })),
+            ...pending.map((i) => ({
+                type: i.owner.kind === "org" ? "org_upload_pending" : "permission_confirmation",
+                id: i.id,
+                createdAt: i.updatedAt,
+                item: i,
+            })),
+            ...failures.map((f) => ({
+                type: "scope_sync_failed",
+                id: `${f.item.id}/${f.org.id}`,
+                createdAt: f.failedAt,
+                failure: f,
+            })),
+            ...notices.map((n) => ({
+                type: "ownership_transferred",
+                id: n.id,
+                createdAt: n.createdAt,
+                notice: n,
+            })),
+            ...(run === null
+                ? []
+                : [
+                    {
+                        type: "platform_migration",
+                        id: run.id,
+                        createdAt: run.finishedAt ?? run.startedAt,
+                        run,
+                    },
+                ]),
+        ];
+        // newest first; equal times by id (a stable order)
+        all.sort((a, b) => a.createdAt !== b.createdAt
+            ? a.createdAt < b.createdAt
+                ? 1
+                : -1
+            : a.id < b.id
+                ? -1
+                : a.id > b.id
+                    ? 1
+                    : 0);
+        const total = requestCount + pending.length + failureCount + (run === null ? 0 : 1) + noticeCount;
+        const items = all.slice(0, PLATFORM_INBOX_MAX_ITEMS);
+        return { items, truncated: total > items.length, total };
+    }
+    /**
+     * How many items wait (the sidebar's count): the same sources, counted where they can be (the
+     * requests and the failures; the permission confirmations are the catalog's pending list).
+     */
+    async count() {
+        const [requests, pending, failures, run, notices] = await Promise.all([
+            this.requests.countPendingDeployment(),
+            this.catalog.list({ pending: true }),
+            this.countScopeSyncFailures(),
+            this.migrationRun(),
+            this.countNotices(),
+        ]);
+        return requests + pending.length + failures + (run === null ? 0 : 1) + notices;
+    }
+    async countNotices() {
+        const r = await this.kdb.db
+            .selectFrom("platform_notices")
+            .select(sql `count(*)`.as("n"))
+            .where("dismissed_at", "is", null)
+            .executeTakeFirstOrThrow();
+        return Number(r.n);
+    }
+    /** The open platform notices, newest first, at most {@link PLATFORM_INBOX_MAX_ITEMS}. */
+    async notices() {
+        const rows = await this.kdb.db
+            .selectFrom("platform_notices")
+            .select(["id", "kind", "detail", "created_at"])
+            .where("dismissed_at", "is", null)
+            .orderBy("created_at", "desc")
+            .orderBy("id")
+            .limit(PLATFORM_INBOX_MAX_ITEMS)
+            .execute();
+        return rows.map((r) => ({
+            id: r.id,
+            kind: r.kind,
+            createdAt: r.created_at.toISOString(),
+            detail: r.detail,
+        }));
+    }
+    /**
+     * A super admin dismisses a platform notice (for every super admin). Dismissing one already
+     * dismissed is fine; no notice with that id -> `inbox.notice_not_found`.
+     */
+    async dismissNotice(accountId, id) {
+        if (!UUID_RE.test(id))
+            throw new ApiError("inbox.notice_not_found", "Notice not found");
+        const r = await this.kdb.db
+            .updateTable("platform_notices")
+            .set({ dismissed_at: sql `now()`, dismissed_by: accountId })
+            .where("id", "=", id)
+            .where("dismissed_at", "is", null)
+            .executeTakeFirst();
+        if (r.numUpdatedRows > 0n)
+            return;
+        const exists = await this.kdb.db
+            .selectFrom("platform_notices")
+            .select("id")
+            .where("id", "=", id)
+            .executeTakeFirst();
+        if (!exists)
+            throw new ApiError("inbox.notice_not_found", "Notice not found");
+    }
+    /**
+     * The open failures still worth a look, joined to their item and org: of a live item and org,
+     * and the pair still differs in the failed direction (a person may have converged it meanwhile):
+     * an install failure while the org has no live install of the item; an uninstall or dependencies
+     * failure while it has one.
+     */
+    failureRows() {
+        return this.kdb.db
+            .selectFrom("plugin_scope_sync_failures as f")
+            .innerJoin("catalog_items as i", "i.id", "f.item_id")
+            .innerJoin("orgs as o", "o.id", "f.org_id")
+            .where("i.deleted_at", "is", null)
+            .where("o.deleted_at", "is", null)
+            .where((eb) => {
+            const live = eb.exists(eb
+                .selectFrom("plugin_installs as p")
+                .select("p.id")
+                .whereRef("p.org_id", "=", "f.org_id")
+                .whereRef("p.item_id", "=", "f.item_id")
+                .where("p.status", "in", [...LIVE_INSTALL]));
+            return eb.or([
+                eb.and([eb("f.op", "=", "install"), eb.not(live)]),
+                eb.and([eb("f.op", "in", ["uninstall", "dependencies"]), live]),
+            ]);
+        });
+    }
+    async countScopeSyncFailures() {
+        const r = await this.failureRows()
+            .select(sql `count(*)`.as("n"))
+            .executeTakeFirstOrThrow();
+        return Number(r.n);
+    }
+    /** The open scope sync failures ({@link failureRows}), newest first. */
+    async scopeSyncFailures() {
+        const rows = await this.failureRows()
+            .select([
+            "f.item_id",
+            "i.name as item_name",
+            "i.display_name",
+            "f.org_id",
+            "o.name as org_name",
+            "f.op",
+            "f.code",
+            "f.message",
+            "f.failed_at",
+        ])
+            .orderBy("f.failed_at", "desc")
+            .orderBy("f.item_id")
+            .orderBy("f.org_id")
+            .limit(SCOPE_SYNC_FAILURES_LIST_MAX)
+            .execute();
+        return rows.map((r) => ({
+            item: { id: r.item_id, name: r.item_name, displayName: r.display_name },
+            org: { id: r.org_id, name: r.org_name },
+            op: r.op,
+            code: r.code,
+            message: r.message,
+            failedAt: r.failed_at.toISOString(),
+        }));
+    }
+    /**
+     * The latest migration run when it needs a look (see {@link MigrationRunView}); null when it
+     * finished without failed items, is still running, or there was none. An earlier run's failure
+     * is not shown: each run tries every unwritten item again.
+     */
+    async migrationRun() {
+        const run = await this.kdb.db
+            .selectFrom("platform_migration_runs")
+            .select(["id", "started_at", "finished_at", "stats"])
+            .orderBy("started_at", "desc")
+            .orderBy("id", "desc")
+            .limit(1)
+            .executeTakeFirst();
+        if (run === undefined)
+            return null;
+        const failed = run.stats.itemsFailed;
+        const itemsFailed = Array.isArray(failed)
+            ? failed.filter((x) => typeof x === "string")
+            : [];
+        const stuck = run.finished_at === null && run.started_at.getTime() < Date.now() - MIGRATION_RUN_STUCK_MS;
+        if (!stuck && (run.finished_at === null || itemsFailed.length === 0))
+            return null;
+        return {
+            id: run.id,
+            startedAt: run.started_at.toISOString(),
+            finishedAt: run.finished_at?.toISOString() ?? null,
+            stuck,
+            itemsFailed,
+        };
+    }
+};
+PlatformInboxService = __decorate([
+    Injectable(),
+    __param(0, Inject(CatalogRequestsService)),
+    __param(1, Inject(CatalogService)),
+    __param(2, Inject(KernelDb))
+], PlatformInboxService);
+export { PlatformInboxService };
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/inbox/platform-notices.d.ts

@@ -0,0 +1,19 @@
+import type { OwnedRef } from "../catalog/ownership.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+export type PlatformNoticeKind = "ownership_transferred";
+/** The `detail` of each platform notice kind. */
+export interface PlatformNoticeDetails {
+    /** A deleted org's (or owner's) shared item now belongs to the platform. */
+    ownership_transferred: {
+        ref: OwnedRef;
+        name: string;
+        fromOrg: {
+            id: string;
+            name: string;
+        };
+        reason: "owner_deleted" | "org_deleted";
+        /** How many other orgs use it. */
+        usedBy: number;
+    };
+}
+export declare function addPlatformNotice<K extends PlatformNoticeKind>(db: KernelSchemaDb, kind: K, detail: PlatformNoticeDetails[K]): Promise<void>;

package/dist/inbox/platform-notices.js

@@ -0,0 +1,9 @@
+// Platform notices (`platform_notices`, plugin scope phase 3, ruling P3-22): what the super admins
+// are told, until any one of them dismisses it. Written in the caller's transaction.
+import { randomUUID } from "node:crypto";
+export async function addPlatformNotice(db, kind, detail) {
+    await db
+        .insertInto("platform_notices")
+        .values({ id: randomUUID(), kind, detail: JSON.stringify(detail) })
+        .execute();
+}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { SetupService } from "./admin/setup.service.js";
+export { closeKernelApp, createKernelApp, type KernelAppOptions, kernelAppHttp, kernelAppPort, startKernelApp, } from "./app.js";
 export { type CatalogCli, openCatalogCli } from "./catalog/cli.js";
 export { GitSourceError, type ReadGitTreeOptions, readGitTree, } from "./catalog/git-source.js";
 export type { PluginConfirmResult, PluginReview } from "./catalog/plugin-import.js";
@@ -19,23 +20,23 @@ export { createKv } from "./ctx/kv.js";
 export { createLock } from "./ctx/lock.js";
 export { createQueue } from "./ctx/queue.js";
 export { createKeyring, createSecrets, type DerivedKeys, type Keyring, rewrapDataKeys, } from "./ctx/secrets.js";
-export { type KernelDatabase, type KernelDb, kernelDb } from "./db/kernel-schema.js";
+export { type KernelDatabase, type KernelSchemaDb, kernelDb } from "./db/kernel-schema.js";
 export { type MigrationOwner, migrate } from "./db/migrator.js";
 export { createDb } from "./db/pool.js";
 export { destructiveStatements, isDestructiveBody, isDestructiveSql, type SqlStatement, splitSqlStatements, } from "./db/sql-statements.js";
 export { ApiError, ERROR_CODES, type ErrorCode } from "./errors.js";
-export { ExtensionAdminOps, type ExtensionAdminOpsDeps } from "./extensions/admin-ops.js";
+export { ExtensionAdminOps } from "./extensions/admin-ops.js";
 export { ExtensionAdmin, PLUGINS_CHANGED_TOPIC } from "./extensions/admin-view.js";
 export { type ApprovalDecision, ExtensionApprovals, type PendingExtension, type PermissionSnapshot, planApprovals, snapshotCovers, withPreApproved, } from "./extensions/approvals.js";
 export { blobKey, ExtensionBlobIntegrityError, type ExtensionBlobSource, ExtensionBlobs, } from "./extensions/blobs.js";
-export { BOOTSTRAP_MANIFEST_FILE, type BootstrapEntryResult, BootstrapFailedError, type BootstrapFailure, type BootstrapResult, BootstrapService, type BootstrapServiceDeps, bootstrapManifestSha256, readBootstrapManifest, } from "./extensions/bootstrap.js";
+export { BOOTSTRAP_MANIFEST_FILE, type BootstrapEntryResult, BootstrapFailedError, type BootstrapFailure, type BootstrapResolveOptions, type BootstrapResult, BootstrapService, bootstrapManifestSha256, readBootstrapManifest, resolveBootstrapPackages, } from "./extensions/bootstrap.js";
 export { type ExtensionCli, openExtensionCli } from "./extensions/cli.js";
-export { DEPLOYMENT_SECRETS_ORG, type DeploymentConfigField, type DeploymentConfigView, ExtensionDeploymentConfigService, mergeDeploymentConfig, PLUGIN_DEPLOYMENT_CONFIG_TOPIC, readStoredDeploymentConfig, } from "./extensions/deployment-config.js";
+export { DEPLOYMENT_SECRETS_ORG, type DeploymentConfigField, type DeploymentConfigView, ExtensionDeploymentConfigService, mergeDeploymentConfig, PLUGIN_DEPLOYMENT_CONFIG_TOPIC, readStoredDeploymentConfig, type SecretEntry, } from "./extensions/deployment-config.js";
 export { assertSecretsReachable, ExtensionHost, type ExtensionLoadPlan, type InspectedExtension, type InstalledExtensionLoader, type InstallFailureReason, } from "./extensions/host.js";
 export { ExtensionUnloadedError, type InflightEntry, InflightTracker, PLUGIN_UNLOADED_TOOL_ERROR, type TrackOptions, trackCalls, } from "./extensions/inflight.js";
 export { type DesiredExtension, type ExtensionInstallRow, ExtensionInstalls, type IngestSource, type PackageReview, } from "./extensions/installs.js";
 export { DEFAULT_DISPOSE_TIMEOUT_MS, type DisposeOptions, ExtensionInstance, ImportTracker, type LoadDeps, loadInstance, ManifestMismatchError, type Registration, type RegistrationKind, UPGRADE_WARN_THRESHOLD, } from "./extensions/instance.js";
-export { ExtensionLifecycle, type ExtensionLifecycleDeps, type LifecycleHost, PLUGINS_RECONCILE_JOB, PLUGINS_RECONCILE_TOPIC, } from "./extensions/lifecycle.js";
+export { ExtensionLifecycle, PLUGINS_RECONCILE_JOB, PLUGINS_RECONCILE_TOPIC, } from "./extensions/lifecycle.js";
 export { ensureMigrated, MIGRATE_LOCK_PREFIX, type MigrateLockDeps, PLUGINS_MIGRATED_TOPIC, unrunMigrations, } from "./extensions/migrate-lock.js";
 export { EXTENSION_PACKAGE_LIMITS, type ExtensionPackage, ExtensionPackageError, type ExtensionPackageLimits, type ExtensionPackageSection, extractExtensionPackage, HOST_ZOD_VERSION, permissionSetOfPackage, type ReadExtensionPackageOptions, readExtensionPackage, } from "./extensions/package.js";
 export { blockingKeys, computePermissionSet, diffPermissions, type PermissionSet, permissionKeys, WARNINGS_KEY_PREFIX, } from "./extensions/permission-set.js";
@@ -44,24 +45,34 @@ export { ExtensionRegistry } from "./extensions/registry.js";
 export { ExtensionResolveError, resolveExtensions } from "./extensions/resolve.js";
 export { type ExtensionLoadStatus, type ExtensionSource, newReplicaId, type PendingReason, ReplicaStatusStore, } from "./extensions/sources.js";
 export { syncPackage } from "./extensions/sync.js";
-export { type CreateHttpAppOptions, createHttpApp, type HealthOptions, type KernelHttp, type KernelHttpApp, } from "./http/app.js";
-export { type Account, AccountsService } from "./identity/accounts.js";
+export type { KernelHttp, KernelHttpApp } from "./http/app.js";
+export { type Account, AccountsModule, AccountsService } from "./identity/accounts.js";
 export { type ApiTokenRecord, ApiTokenService } from "./identity/api-tokens.js";
 export { audit } from "./identity/audit.js";
 export { normalizeLogin, validatePassword } from "./identity/login.js";
 export { DUMMY_PASSWORD_HASH, hashPassword, verifyPassword } from "./identity/passwords.js";
 export { type IssuedSession, REFRESH_RACE_GRACE_MS, SessionService, } from "./identity/sessions.js";
 export { DEPLOYMENT_SETTINGS, type DeploymentSettings, SettingsService, } from "./identity/settings.js";
-export { createKernel, KERNEL_MIGRATIONS_DIR, KERNEL_SCHEMA, type Kernel, type KernelOptions, type KernelRuns, migrateAll, } from "./kernel.js";
-export { createLogger, type KernelLogger, LOG_LEVELS, type LogLevel } from "./log.js";
+export { type KernelCliOptions, openKernelCli, openKernelCliOverPool, } from "./infra/cli/kernel-cli.module.js";
+export { GUARD_CIRCUIT_LIMIT, GUARD_CIRCUIT_WINDOW_MS, installProcessGuards, type ProcessGuardDeps, } from "./infra/lifecycle/process-guards.js";
+export { handleShutdownSignals, type ShutdownSignalHandle, type ShutdownSignalOptions, } from "./infra/lifecycle/shutdown-signals.js";
+export { KERNEL_MIGRATIONS_DIR, KERNEL_SCHEMA, migrateAll } from "./kernel.js";
+export { createLogger, type KernelLogger, LOG_FORMATS, LOG_LEVELS, type LogFormat, type LoggerOptions, type LogLevel, type LogOutput, } from "./log.js";
+export { createConfiguredLogger, loggerOptionsFromConfig } from "./log-config.js";
+export { type ContextJob, type JobWrapper, type LogContext, logContext, setJobWrapper, setTraceContextSource, withJobContext, withLogContext, } from "./log-context.js";
 export { type Org, OrgsService } from "./orgs/orgs.service.js";
+export type { KernelOverride } from "./overrides.js";
 export { fetchNpmPackage, IntegrityMismatchError, type NpmFetchConfig, NpmFetchError, PackageTooLargeError, } from "./packages/npm.js";
+export { checkInputParity, inputParity, type ParityFinding, type ParityOperation, } from "./platform/parity.js";
+export { PLATFORM_OPERATION_PROVIDERS } from "./platform/platform-ops.module.js";
+export { PlatformOperations } from "./platform/registry.js";
+export { ROUTE_SCHEMAS, type RouteSchemas } from "./platform/route-schemas.js";
 export { UNKNOWN_RESULT_TEXT } from "./runtime/context/pairing.js";
 export type { AgentLoop, LoopContext, LoopOutcome } from "./runtime/loop.js";
-export { MAINTENANCE_QUEUE_NAME } from "./runtime/maintenance.js";
+export { MAINTENANCE_QUEUE_NAME } from "./runtime/maintenance-queue.js";
 export { runJobId } from "./runtime/run-queue.js";
-export { SANDBOX_DESTROY_JOB, SANDBOX_SUSPEND_JOB, } from "./sandbox/lifecycle.js";
-export { SANDBOX_LOCK_TTL_MS, SandboxService, type SandboxServiceDeps, type SandboxUseInfo, } from "./sandbox/sandbox.service.js";
+export { SANDBOX_DESTROY_JOB, SANDBOX_SUSPEND_JOB, } from "./sandbox/jobs.js";
+export { SANDBOX_LOCK_TTL_MS, SandboxService, type SandboxUseInfo, } from "./sandbox/sandbox.service.js";
 export { MAX_STORAGE_KEY_BYTES, StorageKeyError, } from "./storage/prefix.js";
-export { StorageService, type StorageServiceDeps } from "./storage/storage.service.js";
-export { SANDBOX_RECREATED_NOTICE, SANDBOX_STARTED_NOTICE, } from "./tools/builtins/sandbox/common.js";
+export { PrefixedStorage, StorageService, type StorageSource, } from "./storage/storage.service.js";
+export { SANDBOX_RESTARTED_NOTICE, SANDBOX_STARTED_NOTICE, } from "./tools/builtins/sandbox/common.js";

package/dist/index.js

@@ -1,4 +1,5 @@
 export { SetupService } from "./admin/setup.service.js";
+export { closeKernelApp, createKernelApp, kernelAppHttp, kernelAppPort, startKernelApp, } from "./app.js";
 export { openCatalogCli } from "./catalog/cli.js";
 // The git reader marketplaces use; core's check:bootstrap reads the official marketplace with it.
 export { GitSourceError, readGitTree, } from "./catalog/git-source.js";
@@ -27,7 +28,7 @@ export { ExtensionAdminOps } from "./extensions/admin-ops.js";
 export { ExtensionAdmin, PLUGINS_CHANGED_TOPIC } from "./extensions/admin-view.js";
 export { ExtensionApprovals, planApprovals, snapshotCovers, withPreApproved, } from "./extensions/approvals.js";
 export { blobKey, ExtensionBlobIntegrityError, ExtensionBlobs, } from "./extensions/blobs.js";
-export { BOOTSTRAP_MANIFEST_FILE, BootstrapFailedError, BootstrapService, bootstrapManifestSha256, readBootstrapManifest, } from "./extensions/bootstrap.js";
+export { BOOTSTRAP_MANIFEST_FILE, BootstrapFailedError, BootstrapService, bootstrapManifestSha256, readBootstrapManifest, resolveBootstrapPackages, } from "./extensions/bootstrap.js";
 export { openExtensionCli } from "./extensions/cli.js";
 export { DEPLOYMENT_SECRETS_ORG, ExtensionDeploymentConfigService, mergeDeploymentConfig, PLUGIN_DEPLOYMENT_CONFIG_TOPIC, readStoredDeploymentConfig, } from "./extensions/deployment-config.js";
 export { assertSecretsReachable, ExtensionHost, } from "./extensions/host.js";
@@ -43,23 +44,33 @@ export { ExtensionRegistry } from "./extensions/registry.js";
 export { ExtensionResolveError, resolveExtensions } from "./extensions/resolve.js";
 export { newReplicaId, ReplicaStatusStore, } from "./extensions/sources.js";
 export { syncPackage } from "./extensions/sync.js";
-export { createHttpApp, } from "./http/app.js";
-export { AccountsService } from "./identity/accounts.js";
+export { AccountsModule, AccountsService } from "./identity/accounts.js";
 export { ApiTokenService } from "./identity/api-tokens.js";
 export { audit } from "./identity/audit.js";
 export { normalizeLogin, validatePassword } from "./identity/login.js";
 export { DUMMY_PASSWORD_HASH, hashPassword, verifyPassword } from "./identity/passwords.js";
 export { REFRESH_RACE_GRACE_MS, SessionService, } from "./identity/sessions.js";
 export { DEPLOYMENT_SETTINGS, SettingsService, } from "./identity/settings.js";
-export { createKernel, KERNEL_MIGRATIONS_DIR, KERNEL_SCHEMA, migrateAll, } from "./kernel.js";
-export { createLogger, LOG_LEVELS } from "./log.js";
+export { openKernelCli, openKernelCliOverPool, } from "./infra/cli/kernel-cli.module.js";
+export { GUARD_CIRCUIT_LIMIT, GUARD_CIRCUIT_WINDOW_MS, installProcessGuards, } from "./infra/lifecycle/process-guards.js";
+export { handleShutdownSignals, } from "./infra/lifecycle/shutdown-signals.js";
+export { KERNEL_MIGRATIONS_DIR, KERNEL_SCHEMA, migrateAll } from "./kernel.js";
+export { createLogger, LOG_FORMATS, LOG_LEVELS, } from "./log.js";
+export { createConfiguredLogger, loggerOptionsFromConfig } from "./log-config.js";
+export { logContext, setJobWrapper, setTraceContextSource, withJobContext, withLogContext, } from "./log-context.js";
 export { OrgsService } from "./orgs/orgs.service.js";
 export { fetchNpmPackage, IntegrityMismatchError, NpmFetchError, PackageTooLargeError, } from "./packages/npm.js";
+// Test seam: the Platform input-parity test in tools/checks (no runtime caller).
+export { checkInputParity, inputParity, } from "./platform/parity.js";
+// Test seam (the parity test builds every operation from these without a Nest app).
+export { PLATFORM_OPERATION_PROVIDERS } from "./platform/platform-ops.module.js";
+export { PlatformOperations } from "./platform/registry.js";
+export { ROUTE_SCHEMAS } from "./platform/route-schemas.js";
 export { UNKNOWN_RESULT_TEXT } from "./runtime/context/pairing.js";
-export { MAINTENANCE_QUEUE_NAME } from "./runtime/maintenance.js";
+export { MAINTENANCE_QUEUE_NAME } from "./runtime/maintenance-queue.js";
 export { runJobId } from "./runtime/run-queue.js";
-export { SANDBOX_DESTROY_JOB, SANDBOX_SUSPEND_JOB, } from "./sandbox/lifecycle.js";
+export { SANDBOX_DESTROY_JOB, SANDBOX_SUSPEND_JOB, } from "./sandbox/jobs.js";
 export { SANDBOX_LOCK_TTL_MS, SandboxService, } from "./sandbox/sandbox.service.js";
 export { MAX_STORAGE_KEY_BYTES, StorageKeyError, } from "./storage/prefix.js";
-export { StorageService } from "./storage/storage.service.js";
-export { SANDBOX_RECREATED_NOTICE, SANDBOX_STARTED_NOTICE, } from "./tools/builtins/sandbox/common.js";
+export { PrefixedStorage, StorageService, } from "./storage/storage.service.js";
+export { SANDBOX_RESTARTED_NOTICE, SANDBOX_STARTED_NOTICE, } from "./tools/builtins/sandbox/common.js";

package/dist/infra/cache/cache.module.d.ts

@@ -0,0 +1,3 @@
+/** Global: `CacheService` (and the `@Cacheable` / `@CacheEvict` decorators, which read it from `this.cacheService`). */
+export declare class CacheModule {
+}

package/dist/infra/cache/cache.module.js

@@ -0,0 +1,16 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Global, Module } from "@nestjs/common";
+import { CacheService } from "./cache.service.js";
+/** Global: `CacheService` (and the `@Cacheable` / `@CacheEvict` decorators, which read it from `this.cacheService`). */
+let CacheModule = class CacheModule {
+};
+CacheModule = __decorate([
+    Global(),
+    Module({ providers: [CacheService], exports: [CacheService] })
+], CacheModule);
+export { CacheModule };

package/dist/infra/cache/cache.service.d.ts

@@ -0,0 +1,21 @@
+import type { Redis } from "ioredis";
+import type { KernelLogger } from "../../log.js";
+/** Stored instead of a value when a method returned null and `cacheNull` is set. */
+export declare const CACHE_NULL_SENTINEL = "__CACHE_NULL__";
+/**
+ * Redis access of `@Cacheable` / `@CacheEvict`. Every operation fails open: a Redis error is
+ * logged at warn and behaves like a miss (read) or a no-op (write, delete); it never throws.
+ */
+export declare class CacheService {
+    private readonly redis;
+    private readonly log;
+    constructor(redis: Redis, log: KernelLogger);
+    /** The raw stored string under `cache:<key>`, or undefined on a miss or a Redis error. */
+    get(key: string): Promise<string | undefined>;
+    /** Stores `value` under `cache:<key>` with a TTL in seconds. */
+    set(key: string, value: string, ttlSeconds: number): Promise<void>;
+    /** Like `set`, serializing `value` as JSON; an unserializable value (bigint, cycle) is not cached. */
+    setJson(key: string, value: unknown, ttlSeconds: number): Promise<void>;
+    /** Deletes `cache:<key>`. */
+    del(key: string): Promise<void>;
+}