@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.10

package/dist/catalog/unshare.js

@@ -0,0 +1,118 @@
+// Turning 可共享 off on an org-owned item (ruling P3-25): an `optional` / `all` scope is narrowed, in
+// the caller's transaction, to `named` = the owner plus every live org where the item is on right
+// now, so the orgs already associated keep it and no new org can see, switch on or request it
+// (§14.1 item 3). A `named` scope is left as it is: the gate in `requestable` and the writers
+// already holds back new orgs there.
+import { sql } from "kysely";
+import { audit } from "../identity/audit.js";
+import { componentOn, listedIn, loadScopeState, pluginFactsOf, switchOf, } from "./component-state.js";
+const LIVE_INSTALL = ["installing", "installed", "upgrading"];
+async function liveOrgIds(db) {
+    const rows = await db.selectFrom("orgs").select("id").where("deleted_at", "is", null).execute();
+    return rows.map((r) => r.id);
+}
+/**
+ * Narrows an org-owned plugin (row locked by the caller) whose scope is `optional` / `all` to
+ * `named` = owner + the live orgs with a live install or a switch on. Bumps `scope_version` and
+ * audits `catalog.scope_changed`; returns whether the scope changed (the caller enqueues the item's
+ * scope sync after the commit).
+ */
+export async function narrowItemOnUnshare(db, actor, item) {
+    if (item.owner_org_id === null || item.scope === "named")
+        return false;
+    const live = new Set(await liveOrgIds(db));
+    const installs = await db
+        .selectFrom("plugin_installs")
+        .select("org_id")
+        .where("item_id", "=", item.id)
+        .where("status", "in", [...LIVE_INSTALL])
+        .execute();
+    const switches = await db
+        .selectFrom("catalog_item_org_switches")
+        .select("org_id")
+        .where("item_id", "=", item.id)
+        .where("enabled", "=", true)
+        .execute();
+    const orgs = [
+        ...new Set([
+            item.owner_org_id,
+            ...[...installs, ...switches].map((r) => r.org_id).filter((o) => live.has(o)),
+        ]),
+    ].sort();
+    await db
+        .updateTable("catalog_items")
+        .set({
+        scope: "named",
+        scope_version: sql `scope_version + 1`,
+        updated_at: sql `now()`,
+    })
+        .where("id", "=", item.id)
+        .execute();
+    await db.deleteFrom("catalog_item_scope_orgs").where("item_id", "=", item.id).execute();
+    await db
+        .insertInto("catalog_item_scope_orgs")
+        .values(orgs.map((org_id) => ({ item_id: item.id, org_id })))
+        .execute();
+    await audit(db, {
+        ...(actor !== null && { actorAccountId: actor }),
+        action: "catalog.scope_changed",
+        target: item.id,
+        detail: {
+            name: item.name,
+            from: { scope: item.scope, orgs: [] },
+            to: { scope: "named", orgs },
+            reason: "unshared",
+        },
+    });
+    return true;
+}
+/**
+ * Narrows an org-owned component with its own `optional` / `all` scope (row locked by the caller)
+ * to `named` = owner + the live orgs where it is on now ({@link componentOn}). A component that
+ * follows its plugin is narrowed with the plugin. Bumps `scope_version`, audits
+ * `component.scope_changed`.
+ */
+export async function narrowComponentOnUnshare(db, actor, c) {
+    if (c.ownerOrgId === null || c.scopeMode !== "own" || c.scope === "named")
+        return false;
+    const st = await loadScopeState(db, c.kind, [c]);
+    const on = (await liveOrgIds(db)).filter((o) => componentOn(c, pluginFactsOf(st, c.itemId, o), listedIn(st, c.id, o), switchOf(st, c.id, o)));
+    const orgs = [...new Set([c.ownerOrgId, ...on])].sort();
+    await db
+        .updateTable(TABLE[c.kind])
+        .set({
+        scope: "named",
+        scope_version: sql `scope_version + 1`,
+        updated_at: sql `now()`,
+    })
+        .where("id", "=", c.id)
+        .execute();
+    await db
+        .deleteFrom("component_scope_orgs")
+        .where("kind", "=", c.kind)
+        .where("component_id", "=", c.id)
+        .execute();
+    await db
+        .insertInto("component_scope_orgs")
+        .values(orgs.map((org_id) => ({ kind: c.kind, component_id: c.id, org_id })))
+        .execute();
+    await audit(db, {
+        ...(actor !== null && { actorAccountId: actor }),
+        action: "component.scope_changed",
+        target: c.id,
+        detail: {
+            kind: c.kind,
+            name: c.name,
+            plugin: c.plugin,
+            from: { scopeMode: "own", scope: c.scope, orgs: [] },
+            to: { scopeMode: "own", scope: "named", orgs },
+            reason: "unshared",
+        },
+    });
+    return true;
+}
+const TABLE = {
+    skill: "platform_skills",
+    agent_template: "platform_agent_templates",
+    connector_template: "platform_connector_templates",
+};

package/dist/channels/actions.d.ts

@@ -1,9 +1,9 @@
 import type { ChannelCard, InboundEvent, InboundSender } from "@capybara-hq/plugin-sdk";
-import type { KernelDb } from "../db/kernel-schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import type { ApprovalsService } from "../tools/approvals.service.js";
 import type { QuestionsService } from "../tools/questions.service.js";
 import type { ChannelConnectionRow, ChannelConnections } from "./connections.service.js";
-import type { ChannelOutboundScheduler } from "./inbound.js";
+import { type ChannelJobs } from "./jobs.js";
 import { type ChannelLocale, type ChannelPhrase } from "./phrases.js";
 type CardActionEvent = Extract<InboundEvent, {
     type: "card_action";
@@ -14,11 +14,13 @@ export type SpeakerResolver = (connectionId: string, row: ChannelConnectionRow,
     threadAccount: string | null;
 } | undefined>;
 export interface ChannelCardActionsDeps {
-    db: KernelDb;
+    /** The context-aware kernel-schema handle (read at call time). */
+    readonly db: KernelSchemaDb;
     connections: Pick<ChannelConnections, "row" | "send">;
     approvals: Pick<ApprovalsService, "decide">;
     questions: Pick<QuestionsService, "answer">;
-    outbound: ChannelOutboundScheduler;
+    /** The delivery of the card's conversation. */
+    outbound: Pick<ChannelJobs, "enqueue">;
     resolveSpeaker: SpeakerResolver;
 }
 /**

package/dist/channels/actions.js

@@ -1,6 +1,6 @@
+import { imLocale, recipientLocale } from "../conversations/message-context.js";
 import { ApiError } from "../errors.js";
-import { readOrgSettings } from "../orgs/settings.service.js";
-import { idempotencyKey } from "./outbound.js";
+import { idempotencyKey } from "./jobs.js";
 import { phrase } from "./phrases.js";
 import { findThread, threadKeyOf } from "./threads.js";
 /** 授权 / 状态类失败 → 回给点击者的一句话（不改卡片）；其余错误照常抛出。 */
@@ -11,6 +11,7 @@ const REPLY_FOR = {
     "approval.already_decided": "alreadyHandled",
     "question.already_answered": "alreadyHandled",
     validation_failed: "invalidAction",
+    "approval.scope_not_allowed": "invalidAction",
 };
 /**
  * IM 卡片上的按钮操作（Review Focus 2）：点击者按入站同样的规则映射到账号（未绑定 → 私聊回绑定卡片、群里只提示去私聊），
@@ -31,7 +32,10 @@ export class ChannelCardActions {
         // 连接停用、组织已删除或插件在该组织停用（停用广播与长连接断开之间仍可能有事件到达）：什么都不做
         if (row?.status !== "active" || !row.pluginEnabled)
             return;
-        const { locale } = await readOrgSettings(this.deps.db, row.orgId);
+        // the clicker's language (maintainer decision 2026-11-08): the platform's, else the org's
+        // until the clicker is resolved, then their latest web message's (see below)
+        const im = imLocale(e.sender.locale);
+        let locale = await recipientLocale(this.deps.db, { orgId: row.orgId, im });
         const a = e.action;
         // Ruling A13：卡片必须是本连接发在这个 chat 里的（防止伪造卡片 id 去处理别处的请求）。
         // A `pending` row counts (T5a): delivery records the card before sending it, so a click that
@@ -47,7 +51,7 @@ export class ChannelCardActions {
         // 有平台事件 id 时回复带幂等键（任务重试不重复回复）；没有时同一张卡片的不同点击无法区分，不带
         const key = e.eventId !== undefined ? idempotencyKey(`${connectionId}-${e.eventId}-reply`) : undefined;
         const replyTo = (t) => async (k, cards) => {
-            await connections.send(connectionId, t, { text: phrase(k, locale), ...(cards !== undefined && { cards }) }, key);
+            await connections.send(connectionId, t, { text: phrase(k, locale), ...(cards !== undefined && { cards }) }, key, locale);
         };
         // Ruling A13：卡片必须是本连接发在这个 chat 里的（防止伪造卡片 id 去处理别处的请求）。在解析发言人之前判断：
         // 卡片 id 被转发 / 重放到别的会话时，绝不在那里发绑定链接或绑定任何人——只回一句「不能处理」，并按群处理
@@ -74,6 +78,9 @@ export class ChannelCardActions {
         const who = await this.deps.resolveSpeaker(connectionId, row, e.sender, isGroup, locale, reply);
         if (who === undefined)
             return;
+        if (im === undefined && who.threadAccount !== null) {
+            locale = await recipientLocale(this.deps.db, { orgId: row.orgId, accountId: who.accountId });
+        }
         // 匿名访客共用一个账号：只能处理自己话题里的卡片，且不能留下「本会话 / 以后都允许」的授权
         const anonymous = who.threadAccount === null;
         if (anonymous) {

package/dist/channels/cards.d.ts

@@ -1,9 +1,13 @@
-import type { ChannelCard, FormAnswer, InputForm, OutboundMessage } from "@capybara-hq/plugin-sdk";
-import type { KernelDb } from "../db/kernel-schema.js";
-import type { ApprovalsService } from "../tools/approvals.service.js";
+import { type ChannelCard, type FormAnswer, type InputForm, type OutboundMessage } from "@capybara-hq/plugin-sdk";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import type { ApprovalsService, ApprovalView } from "../tools/approvals.service.js";
+import { type ToolInfo } from "../tools/info.js";
+import type { ToolRegistry } from "../tools/registry.js";
 import { type ChannelLocale } from "./phrases.js";
-/** 审批卡片里工具参数预览的最大长度（字符）。 */
-export declare const INPUT_PREVIEW_MAX = 500;
+/** The longest call line of an approval card (characters, the ellipsis included). */
+export declare const CARD_SUMMARY_MAX = 300;
+/** The longest key argument quoted in a call line without a summary (its first line). */
+export declare const KEY_ARG_MAX = 120;
 /**
  * 看起来是凭据的参数名（按整词判断，避免误伤 `max_tokens` 这类键）：其值在 IM 卡片里打码。
  * 工具参数由模型生成，内核没有「本次注入的凭据」可比对（那是工具结果的打码方式，见 tools/redact.ts），
@@ -13,23 +17,41 @@ export declare function isSecretKey(key: string): boolean;
 /** 递归复制，键名像凭据的值替换为 `***`。 */
 export declare function maskSecrets(value: unknown): unknown;
 /**
- * 工具参数预览：凭据样式的键打码后序列化为 JSON，再经 `redact`（连接密钥的按值打码）处理，
- * 截断到 {@link INPUT_PREVIEW_MAX} 字符（含省略号）。
+ * The key argument of a call, as the web's tool row picks it: the first declared key argument
+ * present, else the first string input other than `description`. Credential-like keys are skipped
+ * (see {@link isSecretKey}); the value's first line, cut to {@link KEY_ARG_MAX}.
  */
-export declare function inputPreview(input: unknown, redact?: (s: string) => string): string;
+export declare function keyArgument(input: unknown, keyArgs: readonly string[]): string | undefined;
+/**
+ * The approval card's one line about the call (maintainer decision 2026-11-08: what the web
+ * shows, never the raw input, which may hold a whole prompt and is seen by everyone in a group):
+ * the kernel-rendered summary in the card's language (Platform operations, per-call policies),
+ * else the tool's declared title and key argument (`Title: arg`, either alone), else "". Redacted
+ * by `redact` (the connection's secret values), cut to {@link CARD_SUMMARY_MAX}. The full input is
+ * behind the card's web link.
+ */
+export declare function callSummary(v: Pick<ApprovalView, "summary" | "input">, display: Pick<ToolInfo, "title" | "keyArgs"> | undefined, locale: ChannelLocale, redact?: (s: string) => string): string;
 /** 去掉末尾斜杠的 `http.publicUrl`；未配置返回 undefined。 */
 export declare function webBase(publicUrl: string | undefined): string | undefined;
 /** 会话的网页链接（与审批详情的 `conversationPath` 一致：`/chat/<id>`，不含语言前缀）。 */
 export declare const conversationUrl: (base: string, conversationId: string) => string;
 /** 个人连接页里某个连接器的位置（与网页 ConnectCard 的链接一致）。 */
 export declare const connectUrl: (base: string, connectorId: string) => string;
+/**
+ * The tool as the card names it (tool naming spec §7): a builtin by its name; a connector or
+ * extension tool as `<display name> [<tool>]` (the connector's name, the plugin's display name in
+ * the card's language), the way the web labels it.
+ */
+export declare function approvalToolName(v: Pick<ApprovalView, "toolKey" | "toolName" | "connector" | "extension">, locale: ChannelLocale): string;
 export interface CardDeps {
-    db: KernelDb;
+    db: KernelSchemaDb;
     approvals: Pick<ApprovalsService, "describe">;
+    /** The tools' display metadata (title, key arguments) for a call without a summary. */
+    registry: Pick<ToolRegistry, "builtinSpecs" | "extensionToolSpecs">;
 }
 /**
- * 审批卡片（按审批的当前状态）；审批不存在返回 undefined。按角色升级的审批只能「仅此一次」。
- * `webUrl` = `http.publicUrl` + 会话路径。
+ * The approval card in the approval's current state; undefined when the approval does not exist.
+ * A role escalation offers only "once". `webUrl` = `http.publicUrl` + the conversation path.
  */
 export declare function approvalCard(d: CardDeps, approvalId: string, base: string, locale: ChannelLocale, redact?: (s: string) => string): Promise<Extract<ChannelCard, {
     kind: "approval";

package/dist/channels/cards.js

@@ -1,7 +1,10 @@
-import { KEY_SEPARATOR } from "../tools/naming.js";
+import { parseToolKey, } from "@capybara-hq/plugin-sdk";
+import { toolInfo } from "../tools/info.js";
 import { phrase } from "./phrases.js";
-/** 审批卡片里工具参数预览的最大长度（字符）。 */
-export const INPUT_PREVIEW_MAX = 500;
+/** The longest call line of an approval card (characters, the ellipsis included). */
+export const CARD_SUMMARY_MAX = 300;
+/** The longest key argument quoted in a call line without a summary (its first line). */
+export const KEY_ARG_MAX = 120;
 /** 打码后替换成的文本。 */
 const MASK = "***";
 /** 出现即视为凭据的整词。 */
@@ -62,19 +65,70 @@ export function maskSecrets(value) {
     }
     return value;
 }
-/**
- * 工具参数预览：凭据样式的键打码后序列化为 JSON，再经 `redact`（连接密钥的按值打码）处理，
- * 截断到 {@link INPUT_PREVIEW_MAX} 字符（含省略号）。
- */
-export function inputPreview(input, redact = (s) => s) {
-    let s;
+const cut = (s, max) => (s.length <= max ? s : `${s.slice(0, max - 1)}…`);
+const firstLine = (s) => s
+    .split(/\r?\n/)
+    .find((l) => l.trim() !== "")
+    ?.trim() ?? "";
+const valueText = (v) => {
+    if (typeof v === "string")
+        return v;
     try {
-        s = redact(JSON.stringify(maskSecrets(input ?? {})) ?? "");
+        return JSON.stringify(v) ?? "";
     }
     catch {
-        s = "";
+        return "";
+    }
+};
+/**
+ * The key argument of a call, as the web's tool row picks it: the first declared key argument
+ * present, else the first string input other than `description`. Credential-like keys are skipped
+ * (see {@link isSecretKey}); the value's first line, cut to {@link KEY_ARG_MAX}.
+ */
+export function keyArgument(input, keyArgs) {
+    if (typeof input !== "object" || input === null || Array.isArray(input))
+        return undefined;
+    const rec = input;
+    // a structured value is shown as compact JSON with nested credential-like keys masked
+    const pick = (v) => {
+        const line = firstLine(valueText(maskSecrets(v)));
+        return line === "" ? undefined : cut(line, KEY_ARG_MAX);
+    };
+    for (const k of keyArgs) {
+        if (Object.hasOwn(rec, k) && rec[k] !== undefined && !isSecretKey(k)) {
+            const v = pick(rec[k]);
+            if (v !== undefined)
+                return v;
+        }
+    }
+    for (const [k, v] of Object.entries(rec)) {
+        if (typeof v === "string" && k !== "description" && !isSecretKey(k)) {
+            const line = pick(v);
+            if (line !== undefined)
+                return line;
+        }
     }
-    return s.length <= INPUT_PREVIEW_MAX ? s : `${s.slice(0, INPUT_PREVIEW_MAX - 1)}…`;
+    return undefined;
+}
+/**
+ * The approval card's one line about the call (maintainer decision 2026-11-08: what the web
+ * shows, never the raw input, which may hold a whole prompt and is seen by everyone in a group):
+ * the kernel-rendered summary in the card's language (Platform operations, per-call policies),
+ * else the tool's declared title and key argument (`Title: arg`, either alone), else "". Redacted
+ * by `redact` (the connection's secret values), cut to {@link CARD_SUMMARY_MAX}. The full input is
+ * behind the card's web link.
+ */
+export function callSummary(v, display, locale, redact = (s) => s) {
+    let line;
+    if (v.summary !== null) {
+        line = v.summary[locale];
+    }
+    else {
+        const title = display?.title?.trim() || undefined;
+        const arg = keyArgument(v.input, display?.keyArgs ?? []);
+        line = title !== undefined && arg !== undefined ? `${title}: ${arg}` : (title ?? arg ?? "");
+    }
+    return cut(redact(line), CARD_SUMMARY_MAX);
 }
 /** 去掉末尾斜杠的 `http.publicUrl`；未配置返回 undefined。 */
 export function webBase(publicUrl) {
@@ -83,13 +137,26 @@ export function webBase(publicUrl) {
 /** 会话的网页链接（与审批详情的 `conversationPath` 一致：`/chat/<id>`，不含语言前缀）。 */
 export const conversationUrl = (base, conversationId) => `${base}/chat/${conversationId}`;
 /** 个人连接页里某个连接器的位置（与网页 ConnectCard 的链接一致）。 */
-export const connectUrl = (base, connectorId) => `${base}/settings/connections#connector-${encodeURIComponent(connectorId)}`;
-/** 来源内的工具名：连接器工具去掉 `<slug>__`（审批详情已处理），插件工具去掉 `<插件>__`。 */
-function shortToolName(v) {
+export const connectUrl = (base, connectorId) => `${base}/account/connections#connector-${encodeURIComponent(connectorId)}`;
+const PLATFORM_KEY_PREFIX = "Platform:";
+/**
+ * The tool as the card names it (tool naming spec §7): a builtin by its name; a connector or
+ * extension tool as `<display name> [<tool>]` (the connector's name, the plugin's display name in
+ * the card's language), the way the web labels it.
+ */
+export function approvalToolName(v, locale) {
+    // a Platform call is keyed `Platform:<operation>`: the label names the operation
+    if (v.toolKey.startsWith(PLATFORM_KEY_PREFIX)) {
+        return `Platform [${v.toolKey.slice(PLATFORM_KEY_PREFIX.length)}]`;
+    }
+    // `toolName` is already the connector's own name for its tool
     if (v.connector)
-        return v.toolName;
-    const i = v.toolKey.indexOf(KEY_SEPARATOR);
-    return i > 0 ? v.toolKey.slice(i + KEY_SEPARATOR.length) : v.toolKey;
+        return `${v.connector.name} [${v.toolName}]`;
+    const parsed = parseToolKey(v.toolKey);
+    const tool = parsed && parsed.kind !== "builtin" ? parsed.tool : v.toolName;
+    if (v.extension)
+        return `${v.extension.displayName[locale]} [${tool}]`;
+    return v.toolKey;
 }
 /** 账号显示名；不存在返回 undefined。 */
 async function displayName(db, accountId) {
@@ -103,23 +170,28 @@ async function displayName(db, accountId) {
     return r?.display_name || undefined;
 }
 /**
- * 审批卡片（按审批的当前状态）；审批不存在返回 undefined。按角色升级的审批只能「仅此一次」。
- * `webUrl` = `http.publicUrl` + 会话路径。
+ * The approval card in the approval's current state; undefined when the approval does not exist.
+ * A role escalation offers only "once". `webUrl` = `http.publicUrl` + the conversation path.
  */
 export async function approvalCard(d, approvalId, base, locale, redact) {
     const v = await d.approvals.describe(approvalId);
     if (!v)
         return undefined;
     const decidedBy = await displayName(d.db, v.decidedBy);
+    const display = v.summary === null
+        ? (await toolInfo({ db: d.db, registry: d.registry }, v.orgId, [v.toolKey]))[0]
+        : undefined;
     return {
         kind: "approval",
         id: v.id,
         title: phrase("approvalTitle", locale),
-        toolName: shortToolName(v),
-        ...(v.connector && { appName: v.connector.name }),
+        // the label carries the source, so no separate appName (renderers would repeat it)
+        toolName: approvalToolName(v, locale),
         agentName: v.agent.name || "Agent",
-        inputPreview: inputPreview(v.input, redact),
-        scopes: v.requestedFor === null ? ["once"] : ["once", "session", "always"],
+        // the field keeps its contract name; it carries the call line, never the raw input
+        inputPreview: callSummary(v, display, locale, redact),
+        // the scopes the approval allows (the kernel stores them for per-call policies)
+        scopes: v.scopes,
         expiresAt: v.expiresAt,
         state: v.status,
         ...(decidedBy !== undefined && { decidedBy }),

package/dist/channels/channels.module.d.ts

@@ -0,0 +1,40 @@
+import { WorkerHost } from "@nestjs/bullmq";
+import { type DynamicModule } from "@nestjs/common";
+import type { Job, Worker } from "bullmq";
+import type { KernelConfig } from "../config/schema.js";
+import { type ProcessorWorkerOptions } from "../infra/queue/configured-processor.js";
+import { type ChannelJobData } from "./jobs.js";
+import { ChannelOutbound } from "./outbound.js";
+/**
+ * Channels on every role: the org's channel connections, inbound (dedupe and enqueue; the inbound
+ * jobs), the outbound delivery, the producer of the channel queue `cap-kernel-channels`, the
+ * anonymous guests. The roles' parts are the role modules': the queue's consumer
+ * ({@link ChannelWorkersModule}) and the gateway check job are the worker role's, the long-connection
+ * supervisor and the webhook inbound the gateway role's (`GatewayModule`).
+ */
+export declare class ChannelsModule {
+}
+/** The consumer of `cap-kernel-channels` (deliveries and inbound jobs): {@link ChannelOutbound}. */
+export declare class ChannelsProcessor extends WorkerHost<Worker<ChannelJobData>> {
+    private readonly outbound;
+    constructor(outbound: ChannelOutbound);
+    process(job: Job<ChannelJobData>, token?: string): Promise<void>;
+    failed(job: Job<ChannelJobData> | undefined, err: Error): void;
+    error(err: Error): void;
+}
+/**
+ * The worker options of the channel queue's consumer, from the startup config: concurrency
+ * `channels.deliveryConcurrency`, the run queue's job lock and stalled detection, and the delivery
+ * backoff (a platform's retry-after, else exponential).
+ */
+export declare function channelsProcessorOptions(config: Pick<KernelConfig, "runtime" | "channels">): ProcessorWorkerOptions;
+/**
+ * The consumer of the channel queue (concurrency `channels.deliveryConcurrency`, the run queue's job
+ * lock and stalled detection, the delivery backoff). Imported only by the worker role
+ * (`WorkerModule`), so other roles get no processor and no BullMQ worker. It never starts by itself:
+ * the worker role (`WorkerRole`) starts it after the extension load; `ChannelOutbound.close` closes it
+ * on stop.
+ */
+export declare class ChannelWorkersModule {
+    static forRoot(config: KernelConfig): DynamicModule;
+}

package/dist/channels/channels.module.js

@@ -0,0 +1,130 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ChannelWorkersModule_1;
+import { OnWorkerEvent, WorkerHost } from "@nestjs/bullmq";
+import { Inject, Injectable, Module } from "@nestjs/common";
+import { ConversationsModule } from "../conversations/conversations.module.js";
+import { EventLogModule } from "../conversations/event-log.js";
+import { EnvironmentsModule } from "../environments/environments.module.js";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { IdentityModule } from "../identity/identity.module.js";
+import { configuredProcessor, } from "../infra/queue/configured-processor.js";
+import { QueueModule } from "../infra/queue/queue.module.js";
+import { runJob } from "../infra/queue/run-job.js";
+import { OrgLockModule } from "../orgs/org-lock.js";
+import { OrgsModule } from "../orgs/orgs.module.js";
+import { RuntimeModule } from "../runtime/runtime.module.js";
+import { ToolsModule } from "../tools/tools.module.js";
+import { ChannelConnections } from "./connections.service.js";
+import { ChannelInbound } from "./inbound.js";
+import { CHANNEL_QUEUE_NAME, ChannelJobs } from "./jobs.js";
+import { ChannelOutbound, deliverBackoff } from "./outbound.js";
+import { AnonymousGuestLock, AnonymousGuests } from "./threads.js";
+/**
+ * Channels on every role: the org's channel connections, inbound (dedupe and enqueue; the inbound
+ * jobs), the outbound delivery, the producer of the channel queue `cap-kernel-channels`, the
+ * anonymous guests. The roles' parts are the role modules': the queue's consumer
+ * ({@link ChannelWorkersModule}) and the gateway check job are the worker role's, the long-connection
+ * supervisor and the webhook inbound the gateway role's (`GatewayModule`).
+ */
+let ChannelsModule = class ChannelsModule {
+};
+ChannelsModule = __decorate([
+    Module({
+        imports: [
+            EnvironmentsModule,
+            EventLogModule,
+            ExtensionsModule,
+            IdentityModule,
+            OrgLockModule,
+            OrgsModule,
+            ToolsModule,
+            ConversationsModule,
+            RuntimeModule,
+            QueueModule.registerQueue(CHANNEL_QUEUE_NAME),
+        ],
+        providers: [
+            ChannelJobs,
+            ChannelConnections,
+            AnonymousGuestLock,
+            AnonymousGuests,
+            ChannelInbound,
+            ChannelOutbound,
+        ],
+        exports: [ChannelJobs, ChannelConnections, AnonymousGuests, ChannelInbound, ChannelOutbound],
+    })
+], ChannelsModule);
+export { ChannelsModule };
+/** The consumer of `cap-kernel-channels` (deliveries and inbound jobs): {@link ChannelOutbound}. */
+let ChannelsProcessor = class ChannelsProcessor extends WorkerHost {
+    outbound;
+    constructor(outbound) {
+        super();
+        this.outbound = outbound;
+    }
+    process(job, token) {
+        return runJob(CHANNEL_QUEUE_NAME, job, () => this.outbound.process(job, token));
+    }
+    failed(job, err) {
+        this.outbound.onFailed(job, err);
+    }
+    error(err) {
+        this.outbound.onError(err);
+    }
+};
+__decorate([
+    OnWorkerEvent("failed")
+], ChannelsProcessor.prototype, "failed", null);
+__decorate([
+    OnWorkerEvent("error")
+], ChannelsProcessor.prototype, "error", null);
+ChannelsProcessor = __decorate([
+    Injectable(),
+    __param(0, Inject(ChannelOutbound))
+], ChannelsProcessor);
+export { ChannelsProcessor };
+/**
+ * The worker options of the channel queue's consumer, from the startup config: concurrency
+ * `channels.deliveryConcurrency`, the run queue's job lock and stalled detection, and the delivery
+ * backoff (a platform's retry-after, else exponential).
+ */
+export function channelsProcessorOptions(config) {
+    return {
+        concurrency: config.channels.deliveryConcurrency,
+        lockDuration: config.runtime.jobLockMs,
+        stalledInterval: config.runtime.stalledIntervalMs,
+        maxStalledCount: 3,
+        settings: { backoffStrategy: (n, _type, err) => deliverBackoff(n, err) },
+    };
+}
+/**
+ * The consumer of the channel queue (concurrency `channels.deliveryConcurrency`, the run queue's job
+ * lock and stalled detection, the delivery backoff). Imported only by the worker role
+ * (`WorkerModule`), so other roles get no processor and no BullMQ worker. It never starts by itself:
+ * the worker role (`WorkerRole`) starts it after the extension load; `ChannelOutbound.close` closes it
+ * on stop.
+ */
+let ChannelWorkersModule = ChannelWorkersModule_1 = class ChannelWorkersModule {
+    static forRoot(config) {
+        return {
+            module: ChannelWorkersModule_1,
+            imports: [ChannelsModule],
+            providers: [
+                configuredProcessor(ChannelsProcessor, CHANNEL_QUEUE_NAME, channelsProcessorOptions(config)),
+            ],
+            exports: [ChannelsProcessor],
+        };
+    }
+};
+ChannelWorkersModule = ChannelWorkersModule_1 = __decorate([
+    Module({})
+    // biome-ignore lint/complexity/noStaticOnlyClass: a Nest dynamic module
+], ChannelWorkersModule);
+export { ChannelWorkersModule };

package/dist/channels/channels.schemas.d.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+export declare const ChannelCreateSchema: z.ZodObject<{
+    plugin: z.ZodString;
+    name: z.ZodString;
+    agentId: z.ZodString;
+    config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    unboundPolicy: z.ZodOptional<z.ZodEnum<{
+        anonymous: "anonymous";
+        bind: "bind";
+    }>>;
+}, z.core.$strict>;
+export declare const ChannelPatchSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    agentId: z.ZodOptional<z.ZodString>;
+    unboundPolicy: z.ZodOptional<z.ZodEnum<{
+        anonymous: "anonymous";
+        bind: "bind";
+    }>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>>;
+    inboundMode: z.ZodOptional<z.ZodEnum<{
+        long_connection: "long_connection";
+        webhook: "webhook";
+    }>>;
+    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+/** 「我已更新应用」: the template hash of the setup guide the person was shown. */
+export declare const ChannelGuideAckSchema: z.ZodObject<{
+    hash: z.ZodString;
+}, z.core.$strict>;
+export declare const ChannelPathParams: z.ZodObject<{
+    connectionId: z.ZodString;
+}, z.core.$strip>;
+export declare const CHANNEL_ROUTES: readonly RouteSchemas[];