@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.10

package/dist/environments/conversation-environments.d.ts

@@ -0,0 +1,75 @@
+import { ApiError } from "../errors.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { SandboxProviders } from "../sandbox/providers.js";
+import { EnvironmentAccess } from "./access.js";
+import { EnvironmentsService } from "./environments.service.js";
+/** `details[0].reason` of the error an anonymous IM conversation's sandbox call gets. */
+export declare const ANONYMOUS_NO_ENVIRONMENT = "anonymous";
+/** Anonymous IM senders have no environment (spec §4.2 item 8): their sandbox tools are off. */
+export declare const anonymousNoEnvironment: () => ApiError;
+/** How a new conversation picks its environment. */
+export interface NewConversationEnvironment {
+    /** The environment the person chose (the composer's picker); checked with `usable`. */
+    environmentId?: string;
+    /** An IM thread: the person's IM default (`environment_defaults`) when still usable. */
+    im?: boolean;
+}
+/**
+ * Which environment a conversation works in (spec 2026-11-07-environments-design §4.1 items 1, 3;
+ * §4.2 items 8, 9, 12). A conversation is bound once, to an environment of its owner
+ * (`conversations.account_id`): the one chosen at its first send, else the owner's IM default
+ * (IM threads), else the owner's default environment. Its sub-agents use the root's. Access is
+ * checked when it is bound and again on every sandbox tool call ({@link forTool}); only the owner
+ * may use a personal environment, so a conversation never reaches another person's.
+ */
+export declare class ConversationEnvironments {
+    private readonly db;
+    readonly txHost: TransactionHost;
+    private readonly providers;
+    private readonly access;
+    private readonly environments;
+    constructor(db: KernelDb, txHost: TransactionHost, providers: Pick<SandboxProviders, "cloud"> & Partial<Pick<SandboxProviders, "forName">>, access: Pick<EnvironmentAccess, "usable">, environments: Pick<EnvironmentsService, "ensureDefault">);
+    /**
+     * The environment a new conversation of `accountId` is bound to: the chosen one when it is
+     * usable by the person (else `environment.not_found` / `environment.unavailable`, and nothing
+     * is created); without a choice the IM default (IM only) or the person's default environment.
+     * Null (unbound) for anonymous IM senders, and without a cloud sandbox provider when no usable
+     * IM default (a connected machine's environment, say) applies.
+     */
+    forNew(orgId: string, accountId: string, pick?: NewConversationEnvironment): Promise<string | null>;
+    /**
+     * The environment a sandbox tool call of the conversation tree rooted at `rootConversationId`
+     * enters, checked for its owner now. A conversation still unbound (created before
+     * environments, or while no provider existed) is bound first, to the owner's IM default when it
+     * is an IM thread, else to the owner's default environment; a racing call binds it once.
+     * Throws `sandbox.unavailable` for a cloud environment (or none to bind) without a cloud
+     * provider and for an anonymous IM conversation, and `environment.not_found` /
+     * `environment.unavailable` when the owner may not use it now. A conversation bound to a
+     * connected machine's environment (`@device`) does not need a cloud provider.
+     */
+    forTool(orgId: string, rootConversationId: string): Promise<string>;
+    /**
+     * Whether a sandbox tool call of the tree rooted at `rootConversationId` has a provider to run
+     * on, for tool listings (ruling R8; no binding, no access check, never throws): a cloud
+     * provider is loaded, or the environment the conversation is bound to (an unbound IM thread:
+     * its owner's IM default) runs on a registered kernel provider (`@device`). A forbidden or gone
+     * environment still counts: the call then says why.
+     */
+    usableNow(orgId: string, rootConversationId: string): Promise<boolean>;
+    /**
+     * The person's IM default when `im` and it is still theirs, live, in this org and usable (the
+     * table has no such guard), else their default environment (created when missing); null when
+     * that is needed and there is no cloud provider to make or use it. The owner having left the org
+     * reads as `environment.not_found`.
+     */
+    private defaultFor;
+    /** Binds an unbound conversation to `environmentId`; returns what it is bound to now. */
+    private bind;
+    /** The environment runs on a kernel-internal provider (`@device`). */
+    private isInternal;
+    /** The account is the org's anonymous IM guest (no person behind it). */
+    private isAnonymous;
+    /** The conversation is (or was) an IM thread's. */
+    private isImThread;
+}

package/dist/environments/conversation-environments.js

@@ -0,0 +1,231 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { isInternalProvider, SandboxProviders } from "../sandbox/providers.js";
+import { environmentNotFound, sandboxUnavailable } from "../sandbox/sandbox.service.js";
+import { EnvironmentAccess } from "./access.js";
+import { EnvironmentsService } from "./environments.service.js";
+/** `details[0].reason` of the error an anonymous IM conversation's sandbox call gets. */
+export const ANONYMOUS_NO_ENVIRONMENT = "anonymous";
+/** Anonymous IM senders have no environment (spec §4.2 item 8): their sandbox tools are off. */
+export const anonymousNoEnvironment = () => new ApiError("sandbox.unavailable", "Anonymous IM senders have no environment, so the sandbox is not available", [{ reason: ANONYMOUS_NO_ENVIRONMENT }]);
+/**
+ * Which environment a conversation works in (spec 2026-11-07-environments-design §4.1 items 1, 3;
+ * §4.2 items 8, 9, 12). A conversation is bound once, to an environment of its owner
+ * (`conversations.account_id`): the one chosen at its first send, else the owner's IM default
+ * (IM threads), else the owner's default environment. Its sub-agents use the root's. Access is
+ * checked when it is bound and again on every sandbox tool call ({@link forTool}); only the owner
+ * may use a personal environment, so a conversation never reaches another person's.
+ */
+let ConversationEnvironments = class ConversationEnvironments {
+    db;
+    txHost;
+    providers;
+    access;
+    environments;
+    constructor(db, txHost, providers, access, environments) {
+        this.db = db;
+        this.txHost = txHost;
+        this.providers = providers;
+        this.access = access;
+        this.environments = environments;
+    }
+    /**
+     * The environment a new conversation of `accountId` is bound to: the chosen one when it is
+     * usable by the person (else `environment.not_found` / `environment.unavailable`, and nothing
+     * is created); without a choice the IM default (IM only) or the person's default environment.
+     * Null (unbound) for anonymous IM senders, and without a cloud sandbox provider when no usable
+     * IM default (a connected machine's environment, say) applies.
+     */
+    async forNew(orgId, accountId, pick = {}) {
+        if (pick.environmentId !== undefined) {
+            return (await this.access.usable(orgId, accountId, pick.environmentId)).id;
+        }
+        if (pick.im !== true && this.providers.cloud() === undefined)
+            return null;
+        if (await this.isAnonymous(orgId, accountId))
+            return null;
+        return this.defaultFor(orgId, accountId, pick.im === true);
+    }
+    /**
+     * The environment a sandbox tool call of the conversation tree rooted at `rootConversationId`
+     * enters, checked for its owner now. A conversation still unbound (created before
+     * environments, or while no provider existed) is bound first, to the owner's IM default when it
+     * is an IM thread, else to the owner's default environment; a racing call binds it once.
+     * Throws `sandbox.unavailable` for a cloud environment (or none to bind) without a cloud
+     * provider and for an anonymous IM conversation, and `environment.not_found` /
+     * `environment.unavailable` when the owner may not use it now. A conversation bound to a
+     * connected machine's environment (`@device`) does not need a cloud provider.
+     */
+    async forTool(orgId, rootConversationId) {
+        const conv = await this.db
+            .selectFrom("conversations")
+            .select(["account_id", "environment_id"])
+            .where("id", "=", rootConversationId)
+            .where("org_id", "=", orgId)
+            .executeTakeFirst();
+        if (!conv)
+            throw environmentNotFound();
+        if (await this.isAnonymous(orgId, conv.account_id))
+            throw anonymousNoEnvironment();
+        let environmentId = conv.environment_id;
+        if (environmentId === null) {
+            const im = await this.isImThread(rootConversationId);
+            const chosen = await this.defaultFor(orgId, conv.account_id, im);
+            if (chosen === null)
+                throw sandboxUnavailable();
+            environmentId = await this.bind(rootConversationId, chosen);
+        }
+        if (this.providers.cloud() === undefined && !(await this.isInternal(environmentId))) {
+            throw sandboxUnavailable();
+        }
+        return (await this.access.usable(orgId, conv.account_id, environmentId)).id;
+    }
+    /**
+     * Whether a sandbox tool call of the tree rooted at `rootConversationId` has a provider to run
+     * on, for tool listings (ruling R8; no binding, no access check, never throws): a cloud
+     * provider is loaded, or the environment the conversation is bound to (an unbound IM thread:
+     * its owner's IM default) runs on a registered kernel provider (`@device`). A forbidden or gone
+     * environment still counts: the call then says why.
+     */
+    async usableNow(orgId, rootConversationId) {
+        if (this.providers.cloud() !== undefined)
+            return true;
+        const conv = await this.db
+            .selectFrom("conversations")
+            .select(["account_id", "environment_id"])
+            .where("id", "=", rootConversationId)
+            .where("org_id", "=", orgId)
+            .executeTakeFirst();
+        if (!conv)
+            return false;
+        let environmentId = conv.environment_id;
+        if (environmentId === null) {
+            if (!(await this.isImThread(rootConversationId)))
+                return false;
+            const row = await this.db
+                .selectFrom("environment_defaults")
+                .select("environment_id")
+                .where("org_id", "=", orgId)
+                .where("account_id", "=", conv.account_id)
+                .executeTakeFirst();
+            if (!row)
+                return false;
+            environmentId = row.environment_id;
+        }
+        const env = await this.db
+            .selectFrom("environments")
+            .select("provider")
+            .where("id", "=", environmentId)
+            .executeTakeFirst();
+        const provider = env?.provider ?? null;
+        return (provider !== null &&
+            isInternalProvider(provider) &&
+            this.providers.forName?.(provider) !== undefined);
+    }
+    /**
+     * The person's IM default when `im` and it is still theirs, live, in this org and usable (the
+     * table has no such guard), else their default environment (created when missing); null when
+     * that is needed and there is no cloud provider to make or use it. The owner having left the org
+     * reads as `environment.not_found`.
+     */
+    async defaultFor(orgId, accountId, im) {
+        if (im) {
+            const row = await this.db
+                .selectFrom("environment_defaults")
+                .select("environment_id")
+                .where("org_id", "=", orgId)
+                .where("account_id", "=", accountId)
+                .executeTakeFirst();
+            if (row) {
+                try {
+                    return (await this.access.usable(orgId, accountId, row.environment_id)).id;
+                }
+                catch (e) {
+                    if (!isEnvironmentGone(e))
+                        throw e;
+                }
+            }
+        }
+        if (this.providers.cloud() === undefined)
+            return null;
+        try {
+            return await this.environments.ensureDefault(orgId, accountId);
+        }
+        catch (e) {
+            if (e instanceof ApiError && e.code === "org.not_found")
+                throw environmentNotFound();
+            throw e;
+        }
+    }
+    /** Binds an unbound conversation to `environmentId`; returns what it is bound to now. */
+    async bind(conversationId, environmentId) {
+        await this.db
+            .updateTable("conversations")
+            .set({ environment_id: environmentId })
+            .where("id", "=", conversationId)
+            .where("environment_id", "is", null)
+            .execute();
+        const row = await this.db
+            .selectFrom("conversations")
+            .select("environment_id")
+            .where("id", "=", conversationId)
+            .executeTakeFirstOrThrow();
+        return row.environment_id ?? environmentId;
+    }
+    /** The environment runs on a kernel-internal provider (`@device`). */
+    async isInternal(environmentId) {
+        const row = await this.db
+            .selectFrom("environments")
+            .select("provider")
+            .where("id", "=", environmentId)
+            .executeTakeFirst();
+        const provider = row?.provider ?? null;
+        return provider !== null && isInternalProvider(provider);
+    }
+    /** The account is the org's anonymous IM guest (no person behind it). */
+    async isAnonymous(orgId, accountId) {
+        const row = await this.db
+            .selectFrom("org_anonymous_accounts")
+            .select("account_id")
+            .where("org_id", "=", orgId)
+            .where("account_id", "=", accountId)
+            .executeTakeFirst();
+        return row !== undefined;
+    }
+    /** The conversation is (or was) an IM thread's. */
+    async isImThread(conversationId) {
+        const row = await this.db
+            .selectFrom("channel_threads")
+            .select("id")
+            .where("conversation_id", "=", conversationId)
+            .limit(1)
+            .executeTakeFirst();
+        return row !== undefined;
+    }
+};
+__decorate([
+    Transactional()
+], ConversationEnvironments.prototype, "bind", null);
+ConversationEnvironments = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(SandboxProviders)),
+    __param(3, Inject(EnvironmentAccess)),
+    __param(4, Inject(EnvironmentsService))
+], ConversationEnvironments);
+export { ConversationEnvironments };
+const isEnvironmentGone = (e) => e instanceof ApiError &&
+    (e.code === "environment.not_found" || e.code === "environment.unavailable");

package/dist/environments/dto.d.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+/** An environment's name: trimmed, 1-64 characters (unique per person, case-insensitive). */
+export declare const EnvironmentName: z.ZodString;
+export declare const EnvironmentNameBody: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strict>;
+export declare const EnvironmentParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+declare const EnvironmentCreateBodyDto_base: import("../infra/validation/create-zod-dto.js").ZodDtoClass<z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strict>>;
+export declare class EnvironmentCreateBodyDto extends EnvironmentCreateBodyDto_base {
+}
+declare const EnvironmentRenameBodyDto_base: import("../infra/validation/create-zod-dto.js").ZodDtoClass<z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strict>>;
+export declare class EnvironmentRenameBodyDto extends EnvironmentRenameBodyDto_base {
+}
+declare const EnvironmentParamsDto_base: import("../infra/validation/create-zod-dto.js").ZodDtoClass<z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>>;
+export declare class EnvironmentParamsDto extends EnvironmentParamsDto_base {
+}
+export {};

package/dist/environments/dto.js

@@ -0,0 +1,12 @@
+import { z } from "zod";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+/** An environment's name: trimmed, 1-64 characters (unique per person, case-insensitive). */
+export const EnvironmentName = z.string().trim().min(1).max(64);
+export const EnvironmentNameBody = z.object({ name: EnvironmentName }).strict();
+export const EnvironmentParams = z.object({ id: z.string().min(1).max(100) });
+export class EnvironmentCreateBodyDto extends createZodDto(EnvironmentNameBody, "EnvironmentCreateBody") {
+}
+export class EnvironmentRenameBodyDto extends createZodDto(EnvironmentNameBody, "EnvironmentRenameBody") {
+}
+export class EnvironmentParamsDto extends createZodDto(EnvironmentParams, "EnvironmentParams") {
+}

package/dist/environments/environments.controller.d.ts

@@ -0,0 +1,36 @@
+import type { z } from "zod";
+import { type Principal } from "../identity/principal.js";
+import { type OrgContext } from "../orgs/org.guard.js";
+import { type EnvironmentNameBody, type EnvironmentParams } from "./dto.js";
+import { type EnvironmentList, EnvironmentsService, type EnvironmentView } from "./environments.service.js";
+/**
+ * A person's environments in an org (`/api/v1/orgs/:orgId/environments`, spec
+ * 2026-11-07-environments-design §9; `agents.use`, human users only: a service token gets 403).
+ * Phase 1 has personal cloud environments only, each visible to its owner alone: another member
+ * gets 404 `environment.not_found`.
+ * - `GET /` → `{ items, defaultId, lastUsedId, cloudAvailable }` (`cloudAvailable`: there is a
+ *   current sandbox provider; ruling R4);
+ * - `POST / { name }` → 201 `{ environment }`; `GET /:id`, `PATCH /:id { name }` → `{ environment }`;
+ * - `DELETE /:id` → 202 (destroyed by a job after the response);
+ * - `POST /:id/files/reset` → 202 (the reset is enqueued: a worker empties the files, the next use
+ *   starts empty);
+ * - `DELETE /:id/machine` → 204: a device environment's machine is disconnected (its credential
+ *   revoked; it must sign in again).
+ */
+export declare class EnvironmentsController {
+    private readonly environments;
+    constructor(environments: EnvironmentsService);
+    list(principal: Principal, org: OrgContext): Promise<EnvironmentList>;
+    create(principal: Principal, org: OrgContext, body: z.infer<typeof EnvironmentNameBody>): Promise<{
+        environment: EnvironmentView;
+    }>;
+    get(principal: Principal, org: OrgContext, params: z.infer<typeof EnvironmentParams>): Promise<{
+        environment: EnvironmentView;
+    }>;
+    rename(principal: Principal, org: OrgContext, params: z.infer<typeof EnvironmentParams>, body: z.infer<typeof EnvironmentNameBody>): Promise<{
+        environment: EnvironmentView;
+    }>;
+    remove(principal: Principal, org: OrgContext, params: z.infer<typeof EnvironmentParams>): Promise<void>;
+    resetFiles(principal: Principal, org: OrgContext, params: z.infer<typeof EnvironmentParams>): Promise<void>;
+    revokeMachine(principal: Principal, org: OrgContext, params: z.infer<typeof EnvironmentParams>): Promise<void>;
+}

package/dist/environments/environments.controller.js

@@ -0,0 +1,124 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Delete, Get, HttpCode, Inject, Patch, Post } from "@nestjs/common";
+import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { EnvironmentCreateBodyDto, EnvironmentParamsDto, EnvironmentRenameBodyDto, } from "./dto.js";
+import { EnvironmentsService, } from "./environments.service.js";
+/**
+ * A person's environments in an org (`/api/v1/orgs/:orgId/environments`, spec
+ * 2026-11-07-environments-design §9; `agents.use`, human users only: a service token gets 403).
+ * Phase 1 has personal cloud environments only, each visible to its owner alone: another member
+ * gets 404 `environment.not_found`.
+ * - `GET /` → `{ items, defaultId, lastUsedId, cloudAvailable }` (`cloudAvailable`: there is a
+ *   current sandbox provider; ruling R4);
+ * - `POST / { name }` → 201 `{ environment }`; `GET /:id`, `PATCH /:id { name }` → `{ environment }`;
+ * - `DELETE /:id` → 202 (destroyed by a job after the response);
+ * - `POST /:id/files/reset` → 202 (the reset is enqueued: a worker empties the files, the next use
+ *   starts empty);
+ * - `DELETE /:id/machine` → 204: a device environment's machine is disconnected (its credential
+ *   revoked; it must sign in again).
+ */
+let EnvironmentsController = class EnvironmentsController {
+    environments;
+    constructor(environments) {
+        this.environments = environments;
+    }
+    async list(principal, org) {
+        const p = requireUser(principal);
+        return this.environments.list(org.orgId, p.account.id);
+    }
+    async create(principal, org, body) {
+        const p = requireUser(principal);
+        return {
+            environment: await this.environments.create(org.orgId, p.account.id, { name: body.name }, patTokenId(p)),
+        };
+    }
+    async get(principal, org, params) {
+        const p = requireUser(principal);
+        return { environment: await this.environments.get(org.orgId, p.account.id, params.id) };
+    }
+    async rename(principal, org, params, body) {
+        const p = requireUser(principal);
+        return {
+            environment: await this.environments.rename(org.orgId, p.account.id, params.id, body.name, patTokenId(p)),
+        };
+    }
+    async remove(principal, org, params) {
+        const p = requireUser(principal);
+        await this.environments.remove(org.orgId, p.account.id, params.id, patTokenId(p));
+    }
+    async resetFiles(principal, org, params) {
+        const p = requireUser(principal);
+        await this.environments.resetFiles(org.orgId, p.account.id, params.id, patTokenId(p));
+    }
+    async revokeMachine(principal, org, params) {
+        const p = requireUser(principal);
+        await this.environments.revokeMachine(org.orgId, p.account.id, params.id, patTokenId(p));
+    }
+};
+__decorate([
+    Get(),
+    OrgAction("agents.use"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg())
+], EnvironmentsController.prototype, "list", null);
+__decorate([
+    Post(),
+    OrgAction("agents.use"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZBody(EnvironmentCreateBodyDto))
+], EnvironmentsController.prototype, "create", null);
+__decorate([
+    Get(":id"),
+    OrgAction("agents.use"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(EnvironmentParamsDto))
+], EnvironmentsController.prototype, "get", null);
+__decorate([
+    Patch(":id"),
+    OrgAction("agents.use"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(EnvironmentParamsDto)),
+    __param(3, ZBody(EnvironmentRenameBodyDto))
+], EnvironmentsController.prototype, "rename", null);
+__decorate([
+    Delete(":id"),
+    HttpCode(202),
+    OrgAction("agents.use"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(EnvironmentParamsDto))
+], EnvironmentsController.prototype, "remove", null);
+__decorate([
+    Post(":id/files/reset"),
+    HttpCode(202),
+    OrgAction("agents.use"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(EnvironmentParamsDto))
+], EnvironmentsController.prototype, "resetFiles", null);
+__decorate([
+    Delete(":id/machine"),
+    HttpCode(204),
+    OrgAction("agents.use"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(EnvironmentParamsDto))
+], EnvironmentsController.prototype, "revokeMachine", null);
+EnvironmentsController = __decorate([
+    Controller("api/v1/orgs/:orgId/environments"),
+    __param(0, Inject(EnvironmentsService))
+], EnvironmentsController);
+export { EnvironmentsController };

package/dist/environments/environments.module.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Environments (spec 2026-11-07-environments-design): a person's environments
+ * ({@link EnvironmentsService}), who may use one ({@link EnvironmentAccess}) and the one a
+ * conversation works in ({@link ConversationEnvironments}). The instances and file systems are the
+ * {@link SandboxModule}'s.
+ */
+export declare class EnvironmentsModule {
+}

package/dist/environments/environments.module.js

@@ -0,0 +1,31 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { DevicesModule } from "../devices/devices.module.js";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { SandboxModule } from "../sandbox/sandbox.module.js";
+import { EnvironmentAccess } from "./access.js";
+import { ConversationEnvironments } from "./conversation-environments.js";
+import { EnvironmentsService } from "./environments.service.js";
+/**
+ * Environments (spec 2026-11-07-environments-design): a person's environments
+ * ({@link EnvironmentsService}), who may use one ({@link EnvironmentAccess}) and the one a
+ * conversation works in ({@link ConversationEnvironments}). The instances and file systems are the
+ * {@link SandboxModule}'s.
+ */
+let EnvironmentsModule = class EnvironmentsModule {
+};
+EnvironmentsModule = __decorate([
+    Module({
+        // ExtensionsModule: the provider display names of demoted defaults; DevicesModule: deleting a
+        // device environment revokes its machine
+        imports: [SandboxModule, ExtensionsModule, DevicesModule],
+        providers: [EnvironmentAccess, EnvironmentsService, ConversationEnvironments],
+        exports: [EnvironmentAccess, EnvironmentsService, ConversationEnvironments],
+    })
+], EnvironmentsModule);
+export { EnvironmentsModule };

package/dist/environments/environments.schemas.d.ts

@@ -0,0 +1,3 @@
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** The environments routes the Platform operations mirror (`check:platform-ops` keys). */
+export declare const ENVIRONMENT_ROUTES: readonly RouteSchemas[];

package/dist/environments/environments.schemas.js

@@ -0,0 +1,14 @@
+import { EnvironmentNameBody, EnvironmentParams } from "./dto.js";
+/** The environments routes the Platform operations mirror (`check:platform-ops` keys). */
+export const ENVIRONMENT_ROUTES = [
+    { route: "GET /api/v1/orgs/:orgId/environments" },
+    { route: "POST /api/v1/orgs/:orgId/environments", body: EnvironmentNameBody },
+    { route: "GET /api/v1/orgs/:orgId/environments/:id", params: EnvironmentParams },
+    {
+        route: "PATCH /api/v1/orgs/:orgId/environments/:id",
+        params: EnvironmentParams,
+        body: EnvironmentNameBody,
+    },
+    { route: "DELETE /api/v1/orgs/:orgId/environments/:id", params: EnvironmentParams },
+    { route: "POST /api/v1/orgs/:orgId/environments/:id/files/reset", params: EnvironmentParams },
+];