@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.2

package/dist/extensions/registry.d.ts

@@ -1,18 +1,63 @@
+import { type ExtensionManifest, type ExtensionPointRef } from "@capybara-hq/plugin-sdk";
+import { type InflightTracker } from "./inflight.js";
 import type { ExtensionInstance } from "./instance.js";
+import type { ExtensionSource } from "./sources.js";
+/** One item of {@link ExtensionRegistry.list}. */
+export interface ExtensionPointEntry {
+    plugin: string;
+    capability: ExtensionPointRef;
+    impl: unknown;
+    /** 插件清单的 version。 */
+    version: string;
+    /** 部署配置摘要，见 `deploymentConfigHash`。 */
+    configHash: string;
+    /** 提供方实例的在途计数（connector / sandbox / model-provider 的 `impl` 已经包成计入它的代理）。 */
+    inflight: InflightTracker;
+}
 /**
- * 本进程生效的插件实例（按插件名，一名一个）。顺序 = 首次激活的顺序（宿主按依赖拓扑序加载；
- * 替换同名实例保持原位置）。只是本进程的视图：跨副本的期望状态在 PG（安装记录），由各副本自己 reconcile。
+ * The extension instances in effect in this process (by extension name, one each). One provider
+ * per process (decision R6 of the Nest kernel spec): the extension host writes it, other domains
+ * read extension points and manifests from it, never from the host. The order is the order of
+ * first activation (the host loads in dependency order; a replaced instance keeps its place). It
+ * is only this process's view: the desired state across replicas is in PG (the install records),
+ * and each replica reconciles itself.
  */
 export declare class ExtensionRegistry {
     private readonly instances;
     private readonly listeners;
     private rev;
+    /** The config-declared extension names of this process (the startup config `extensions` list). */
+    private declaredNames;
+    /**
+     * Records the config-declared extensions (the host at load; before it, the start sequence for
+     * the bootstrap step; the CLI from its inspection). Install records cannot take these names and
+     * the admin operations refuse them (C15).
+     */
+    declare(names: Iterable<string>): void;
+    /** The config-declared extension names → source (see {@link declare}). */
+    declared(): Map<string, ExtensionSource>;
     /** 原子替换：登记新实例，返回被替换的旧实例（由调用方 dispose）。 */
     activate(inst: ExtensionInstance): ExtensionInstance | undefined;
     /** 摘下：返回被摘下的实例（由调用方 dispose）；不在时返回 undefined。 */
     deactivate(name: string): ExtensionInstance | undefined;
     current(name: string): ExtensionInstance | undefined;
+    /**
+     * An active extension's deployment config (validated against its manifest's schema, secrets
+     * included), passed back as `config` when the kernel calls its extension points (such as the
+     * login config of `identity-source@1`); undefined when it is not active. Never echo it in a
+     * response or a log.
+     */
+    deploymentConfig(name: string): unknown;
     all(): ExtensionInstance[];
+    /**
+     * 列出提供某能力（任意主版本）的所有插件及实现；`extensionPointName` 为能力名（不含主版本），
+     * 同一插件提供多个主版本时各占一项，由调用方按主版本选择。
+     * 每项带插件版本与部署配置摘要，供调用方做「插件升级 / 改配置即失效」的缓存键。
+     * 实时取自注册表：调用方不要缓存实现对象（插件撤销 / 升级后旧实现不再有效）。
+     */
+    list(extensionPointName: string): ExtensionPointEntry[];
+    /** 已加载插件的清单（按加载顺序，即依赖拓扑序）。 */
+    manifests(): ExtensionManifest[];
     /** 每次激活 / 摘下加一（给按版本缓存的派生视图用，如插件路由表）。 */
     revision(): number;
     /**
@@ -22,3 +67,6 @@ export declare class ExtensionRegistry {
     onChange(listener: (name: string) => void): () => void;
     private changed;
 }
+/** The one {@link ExtensionRegistry}: every domain that reads extension points imports this. */
+export declare class ExtensionRegistryModule {
+}

package/dist/extensions/registry.js

@@ -1,11 +1,44 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { parseExtensionPoint, } from "@capybara-hq/plugin-sdk";
+import { Injectable, Module } from "@nestjs/common";
+import { trackCalls } from "./inflight.js";
+/** 内核消费的提供方能力：调用计入提供方实例的在途计数（撤销 / 升级时排空，C17）。 */
+const TRACKED_EXTENSION_POINTS = {
+    connector: { sessions: ["open"] },
+    sandbox: {},
+    "model-provider": {},
+};
 /**
- * 本进程生效的插件实例（按插件名，一名一个）。顺序 = 首次激活的顺序（宿主按依赖拓扑序加载；
- * 替换同名实例保持原位置）。只是本进程的视图：跨副本的期望状态在 PG（安装记录），由各副本自己 reconcile。
+ * The extension instances in effect in this process (by extension name, one each). One provider
+ * per process (decision R6 of the Nest kernel spec): the extension host writes it, other domains
+ * read extension points and manifests from it, never from the host. The order is the order of
+ * first activation (the host loads in dependency order; a replaced instance keeps its place). It
+ * is only this process's view: the desired state across replicas is in PG (the install records),
+ * and each replica reconciles itself.
  */
-export class ExtensionRegistry {
+let ExtensionRegistry = class ExtensionRegistry {
     instances = new Map();
     listeners = new Set();
     rev = 0;
+    /** The config-declared extension names of this process (the startup config `extensions` list). */
+    declaredNames = new Map();
+    /**
+     * Records the config-declared extensions (the host at load; before it, the start sequence for
+     * the bootstrap step; the CLI from its inspection). Install records cannot take these names and
+     * the admin operations refuse them (C15).
+     */
+    declare(names) {
+        this.declaredNames = new Map([...names].map((n) => [n, "config"]));
+    }
+    /** The config-declared extension names → source (see {@link declare}). */
+    declared() {
+        return new Map(this.declaredNames);
+    }
     /** 原子替换：登记新实例，返回被替换的旧实例（由调用方 dispose）。 */
     activate(inst) {
         const old = this.instances.get(inst.name);
@@ -25,9 +58,50 @@ export class ExtensionRegistry {
     current(name) {
         return this.instances.get(name);
     }
+    /**
+     * An active extension's deployment config (validated against its manifest's schema, secrets
+     * included), passed back as `config` when the kernel calls its extension points (such as the
+     * login config of `identity-source@1`); undefined when it is not active. Never echo it in a
+     * response or a log.
+     */
+    deploymentConfig(name) {
+        return this.instances.get(name)?.config;
+    }
     all() {
         return [...this.instances.values()];
     }
+    /**
+     * 列出提供某能力（任意主版本）的所有插件及实现；`extensionPointName` 为能力名（不含主版本），
+     * 同一插件提供多个主版本时各占一项，由调用方按主版本选择。
+     * 每项带插件版本与部署配置摘要，供调用方做「插件升级 / 改配置即失效」的缓存键。
+     * 实时取自注册表：调用方不要缓存实现对象（插件撤销 / 升级后旧实现不再有效）。
+     */
+    list(extensionPointName) {
+        const out = [];
+        const tracked = TRACKED_EXTENSION_POINTS[extensionPointName];
+        for (const i of this.instances.values()) {
+            for (const [cap, impl] of i.provided) {
+                if (parseExtensionPoint(cap).name === extensionPointName) {
+                    out.push({
+                        plugin: i.name,
+                        capability: cap,
+                        // 内核消费的提供方调用计入实例在途计数：停用 / 升级时先排空、到时限中止（C17）
+                        impl: tracked && typeof impl === "object" && impl !== null
+                            ? trackCalls(impl, i.inflight, tracked)
+                            : impl,
+                        version: i.version,
+                        configHash: i.configHash,
+                        inflight: i.inflight,
+                    });
+                }
+            }
+        }
+        return out;
+    }
+    /** 已加载插件的清单（按加载顺序，即依赖拓扑序）。 */
+    manifests() {
+        return this.all().map((i) => i.manifest);
+    }
     /** 每次激活 / 摘下加一（给按版本缓存的派生视图用，如插件路由表）。 */
     revision() {
         return this.rev;
@@ -53,4 +127,15 @@ export class ExtensionRegistry {
             }
         }
     }
-}
+};
+ExtensionRegistry = __decorate([
+    Injectable()
+], ExtensionRegistry);
+export { ExtensionRegistry };
+/** The one {@link ExtensionRegistry}: every domain that reads extension points imports this. */
+let ExtensionRegistryModule = class ExtensionRegistryModule {
+};
+ExtensionRegistryModule = __decorate([
+    Module({ providers: [ExtensionRegistry], exports: [ExtensionRegistry] })
+], ExtensionRegistryModule);
+export { ExtensionRegistryModule };

package/dist/extensions/sources.d.ts

@@ -1,4 +1,6 @@
-import type { KernelDb } from "../db/kernel-schema.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import type { KernelLogger } from "../log.js";
 /**
  * Where an extension comes from (C15 / C13):
  * - `config`: the startup config's `extensions` list (development mode and existing deployments),
@@ -33,15 +35,17 @@ export interface ExtensionLoadStatus {
 /** This replica's extension load status (PG `extension_replica_status`; each replica writes only its own rows). */
 export declare class ReplicaStatusStore {
     private readonly db;
-    readonly replicaId: string;
-    private readonly httpReplicaId?;
-    private readonly redact;
+    /** Its `redact` masks `detail` before it is written (an error may carry a secret an extension put in it). */
+    private readonly log;
     /** 本进程写过行（停机时才需要删；没写过时不碰数据库，例如启动在迁移前就失败）。 */
     private wrote;
-    /**
-     * @param redact 写 `detail` 之前打码（内核传 logger 的 `redact`：报错信息里可能带着插件拼进去的密钥）。
-     */
-    constructor(db: KernelDb, replicaId: string, httpReplicaId?: string | undefined, redact?: (text: string) => string);
+    /** This process's replica id ({@link newReplicaId}; one store per process). */
+    readonly replicaId: string;
+    /** `http.replicaId` of the startup config (recorded with each row). */
+    private readonly httpReplicaId;
+    constructor(db: KernelDb, config: KernelConfigService, 
+    /** Its `redact` masks `detail` before it is written (an error may carry a secret an extension put in it). */
+    log: Pick<KernelLogger, "redact">);
     /** 打码后截断到 {@link MAX_DETAIL}。 */
     private cleanDetail;
     /** 写入（覆盖）本副本该插件的一行，心跳取当前时间。 */

package/dist/extensions/sources.js

@@ -1,6 +1,19 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomBytes } from "node:crypto";
 import { hostname } from "node:os";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
 /** 副本（进程）id：`<hostname>-<pid>-<6 位随机>`，每个进程唯一（`http.replicaId` 可能跨重启不变或多副本相同）。 */
 export function newReplicaId() {
     return `${hostname()}-${process.pid}-${randomBytes(3).toString("hex")}`;
@@ -8,25 +21,26 @@ export function newReplicaId() {
 /** detail 的长度上限（报错信息可能很长）。 */
 const MAX_DETAIL = 2000;
 /** This replica's extension load status (PG `extension_replica_status`; each replica writes only its own rows). */
-export class ReplicaStatusStore {
+let ReplicaStatusStore = class ReplicaStatusStore {
     db;
-    replicaId;
-    httpReplicaId;
-    redact;
+    log;
     /** 本进程写过行（停机时才需要删；没写过时不碰数据库，例如启动在迁移前就失败）。 */
     wrote = false;
-    /**
-     * @param redact 写 `detail` 之前打码（内核传 logger 的 `redact`：报错信息里可能带着插件拼进去的密钥）。
-     */
-    constructor(db, replicaId, httpReplicaId, redact = (t) => t) {
+    /** This process's replica id ({@link newReplicaId}; one store per process). */
+    replicaId = newReplicaId();
+    /** `http.replicaId` of the startup config (recorded with each row). */
+    httpReplicaId;
+    constructor(db, config, 
+    /** Its `redact` masks `detail` before it is written (an error may carry a secret an extension put in it). */
+    log) {
         this.db = db;
-        this.replicaId = replicaId;
-        this.httpReplicaId = httpReplicaId;
-        this.redact = redact;
+        this.log = log;
+        const id = config.get().http.replicaId;
+        this.httpReplicaId = id === undefined ? undefined : String(id);
     }
     /** 打码后截断到 {@link MAX_DETAIL}。 */
     cleanDetail(detail) {
-        return this.redact(detail).slice(0, MAX_DETAIL);
+        return this.log.redact(detail).slice(0, MAX_DETAIL);
     }
     /** 写入（覆盖）本副本该插件的一行，心跳取当前时间。 */
     async write(s) {
@@ -117,4 +131,11 @@ export class ReplicaStatusStore {
             .where("replica_id", "=", this.replicaId)
             .execute();
     }
-}
+};
+ReplicaStatusStore = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(KernelConfigService)),
+    __param(2, Inject(KERNEL_LOGGER))
+], ReplicaStatusStore);
+export { ReplicaStatusStore };

package/dist/files/files.module.d.ts

@@ -0,0 +1,3 @@
+/** File previewers (`file-preview@1`): which previewers take a file, the org's order, rendering. */
+export declare class FilesModule {
+}

package/dist/files/files.module.js

@@ -0,0 +1,22 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { ConversationsModule } from "../conversations/conversations.module.js";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { StorageModule } from "../storage/storage.module.js";
+import { PreviewerRegistry } from "./previewers.js";
+/** File previewers (`file-preview@1`): which previewers take a file, the org's order, rendering. */
+let FilesModule = class FilesModule {
+};
+FilesModule = __decorate([
+    Module({
+        imports: [ExtensionsModule, ConversationsModule, StorageModule],
+        providers: [PreviewerRegistry],
+        exports: [PreviewerRegistry],
+    })
+], FilesModule);
+export { FilesModule };

package/dist/files/previewers.controller.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
-import type { OrgPreviewerItem, PreviewerItem, PreviewerRegistry } from "./previewers.js";
+import { type OrgPreviewerItem, type PreviewerItem, PreviewerRegistry } from "./previewers.js";
 declare const PreviewQuery: z.ZodObject<{
     locale: z.ZodDefault<z.ZodEnum<{
         en: "en";
@@ -15,6 +15,11 @@ declare const OrderBody: z.ZodObject<{
         disabled: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/** The previewer named in a preview path (the other path parameters are read as they are). */
+declare const PreviewParams: z.ZodObject<{
+    plugin: z.ZodString;
+    previewerId: z.ZodString;
+}, z.core.$strip>;
 /**
  * `file-preview@1` (UI refresh B Task 11):
  * - `GET /api/v1/orgs/:orgId/conversations/:id/files/:fileId/previewers` → `{ previewers }`: the
@@ -33,7 +38,7 @@ export declare class FilePreviewersController {
     forFile(principal: Principal, org: OrgContext, id: string, fileId: string): Promise<{
         previewers: PreviewerItem[];
     }>;
-    preview(principal: Principal, org: OrgContext, id: string, fileId: string, plugin: string, previewerId: string, q: z.infer<typeof PreviewQuery>): Promise<{
+    preview(principal: Principal, org: OrgContext, id: string, fileId: string, { plugin, previewerId }: z.infer<typeof PreviewParams>, q: z.infer<typeof PreviewQuery>): Promise<{
         view: import("@capybara-hq/plugin-sdk").UiView;
     }>;
     list(org: OrgContext): Promise<{

package/dist/files/previewers.controller.js

@@ -7,17 +7,26 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Controller, Get, Header, Inject, Param, Put, Query } from "@nestjs/common";
+import { Controller, Get, Header, Inject, Param, Put } from "@nestjs/common";
 import { z } from "zod";
-import { FILE_PREVIEWERS } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
 import { CurrentPrincipal, requireUser } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam, ZQuery } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { PreviewerRegistry } from "./previewers.js";
 const Id = z.string().min(1).max(100);
 const PreviewQuery = z.object({ locale: z.enum(["zh", "en"]).default("en") });
 const OrderBody = z.object({
     items: z.array(z.object({ plugin: Id, id: Id, disabled: z.boolean().default(false) })).max(500),
 });
+/** The previewer named in a preview path (the other path parameters are read as they are). */
+const PreviewParams = z.object({ plugin: Id, previewerId: Id });
+class FilePreviewQueryDto extends createZodDto(PreviewQuery, "FilePreviewQuery") {
+}
+class FilePreviewParamsDto extends createZodDto(PreviewParams, "FilePreviewParams") {
+}
+class FilePreviewersOrderBodyDto extends createZodDto(OrderBody, "FilePreviewersOrderBody") {
+}
 /**
  * `file-preview@1` (UI refresh B Task 11):
  * - `GET /api/v1/orgs/:orgId/conversations/:id/files/:fileId/previewers` → `{ previewers }`: the
@@ -39,7 +48,7 @@ let FilePreviewersController = class FilePreviewersController {
         const p = requireUser(principal);
         return { previewers: await this.previewers.forFile(org.orgId, id, p.account.id, fileId) };
     }
-    async preview(principal, org, id, fileId, plugin, previewerId, q) {
+    async preview(principal, org, id, fileId, { plugin, previewerId }, q) {
         const p = requireUser(principal);
         const view = await this.previewers.render({
             orgId: org.orgId,
@@ -82,9 +91,8 @@ __decorate([
     __param(1, CurrentOrg()),
     __param(2, Param("id")),
     __param(3, Param("fileId")),
-    __param(4, Param("plugin", new ZodPipe(Id))),
-    __param(5, Param("previewerId", new ZodPipe(Id))),
-    __param(6, Query(new ZodPipe(PreviewQuery)))
+    __param(4, ZParam(FilePreviewParamsDto)),
+    __param(5, ZQuery(FilePreviewQueryDto))
 ], FilePreviewersController.prototype, "preview", null);
 __decorate([
     Get("file-previewers"),
@@ -96,10 +104,10 @@ __decorate([
     OrgAction("org.extensions.manage"),
     __param(0, CurrentOrg()),
     __param(1, CurrentPrincipal()),
-    __param(2, Body(new ZodPipe(OrderBody)))
+    __param(2, ZBody(FilePreviewersOrderBodyDto))
 ], FilePreviewersController.prototype, "put", null);
 FilePreviewersController = __decorate([
     Controller("api/v1/orgs/:orgId"),
-    __param(0, Inject(FILE_PREVIEWERS))
+    __param(0, Inject(PreviewerRegistry))
 ], FilePreviewersController);
 export { FilePreviewersController };

package/dist/files/previewers.d.ts

@@ -1,8 +1,9 @@
 import { type FilePreviewer, type Logger, type UiView } from "@capybara-hq/plugin-sdk";
-import type { ConversationFiles } from "../conversations/files.js";
-import type { KernelDb } from "../db/kernel-schema.js";
-import type { ExtensionHost } from "../extensions/host.js";
-import type { StorageService } from "../storage/storage.service.js";
+import { ConversationFiles } from "../conversations/files.js";
+import { ExtensionHost } from "../extensions/host.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { StorageService } from "../storage/storage.service.js";
 /** Time limit of a previewer's render (UI refresh spec §5.3: 10 s on the conversation page). */
 export declare const FILE_PREVIEW_TIMEOUT_MS = 10000;
 /** A previewer that takes a file, as listed for the conversation page. */
@@ -24,29 +25,21 @@ export interface OrgPreviewerItem extends PreviewerItem {
     position: number;
     disabled: boolean;
 }
-export interface PreviewerRegistryDeps {
-    db: KernelDb;
-    host: Pick<ExtensionHost, "list">;
-    /** Extensions enabled in the org (queried every time). */
-    enabledPlugins(orgId: string): Promise<Set<string>>;
-    files: Pick<ConversationFiles, "file">;
-    storage: Pick<StorageService, "kernel">;
-    log: Pick<Logger, "warn">;
-    /** Default {@link FILE_PREVIEW_TIMEOUT_MS}. */
-    timeoutMs?: number;
-}
+/** Optional provider: a view previewer's render time limit (ms) instead of {@link FILE_PREVIEW_TIMEOUT_MS} (tests). */
+export declare const FILE_PREVIEW_TIMEOUT: unique symbol;
 /**
  * `file-preview@1` (UI refresh spec §5.8): which previewers take a file, in the org's order
  * (`capybara.file_previewers` rows first by position, then the rest in provider order; disabled ones
  * dropped; only extensions enabled in the org), and rendering a view previewer through a read grant
  * for that one file (valid only during the call, capped at the previewer's `maxBytes`; the extension
  * never gets a storage key or URL). Providers are validated when they are provided (`ctx.provide`).
- * Not Nest-dependent; no state across requests.
+ * No state across requests.
  */
 export declare class PreviewerRegistry {
-    private readonly d;
+    readonly txHost: TransactionHost;
     private readonly timeoutMs;
-    constructor(d: PreviewerRegistryDeps);
+    private readonly d;
+    constructor(kdb: Pick<KernelDb, "db">, host: Pick<ExtensionHost, "list" | "enabledPlugins">, files: Pick<ConversationFiles, "file">, storage: Pick<StorageService, "kernel">, log: Pick<Logger, "warn">, txHost: TransactionHost, timeoutMs?: number);
     /** Every previewer loaded on this replica, in provider order (load order, then list order). */
     private loaded;
     /** The org's previewers (enabled extensions only) in its order, disabled ones included. */
@@ -68,6 +61,8 @@ export declare class PreviewerRegistry {
         accountId?: string;
         tokenId?: string;
     }): Promise<OrgPreviewerItem[]>;
+    /** Replaces the org's rows of the previewers this replica knows, in one transaction. */
+    private putIn;
     /** Previewers that take this file (viewer must read the conversation), in the org's order. */
     forFile(orgId: string, conversationId: string, viewer: string, fileId: string): Promise<PreviewerItem[]>;
     private accepting;

package/dist/files/previewers.js

@@ -1,8 +1,25 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { FILE_PREVIEW_EXTENSION_POINT, previewerAccepts, validateUiView, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable, Optional } from "@nestjs/common";
 import { sql } from "kysely";
+import { ConversationFiles } from "../conversations/files.js";
 import { ApiError } from "../errors.js";
+import { ExtensionHost } from "../extensions/host.js";
 import { audit } from "../identity/audit.js";
-import { callExtension } from "../ui/views.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { StorageService } from "../storage/storage.service.js";
+import { callExtension } from "../ui/call-extension.js";
 /** Time limit of a previewer's render (UI refresh spec §5.3: 10 s on the conversation page). */
 export const FILE_PREVIEW_TIMEOUT_MS = 10_000;
 const notFound = () => new ApiError("ui.not_found", "Previewer not found");
@@ -40,20 +57,33 @@ async function readAtMost(body, max) {
     }
     return out;
 }
+/** Optional provider: a view previewer's render time limit (ms) instead of {@link FILE_PREVIEW_TIMEOUT_MS} (tests). */
+export const FILE_PREVIEW_TIMEOUT = Symbol("FILE_PREVIEW_TIMEOUT");
 /**
  * `file-preview@1` (UI refresh spec §5.8): which previewers take a file, in the org's order
  * (`capybara.file_previewers` rows first by position, then the rest in provider order; disabled ones
  * dropped; only extensions enabled in the org), and rendering a view previewer through a read grant
  * for that one file (valid only during the call, capped at the previewer's `maxBytes`; the extension
  * never gets a storage key or URL). Providers are validated when they are provided (`ctx.provide`).
- * Not Nest-dependent; no state across requests.
+ * No state across requests.
  */
-export class PreviewerRegistry {
-    d;
+let PreviewerRegistry = class PreviewerRegistry {
+    txHost;
     timeoutMs;
-    constructor(d) {
-        this.d = d;
-        this.timeoutMs = d.timeoutMs ?? FILE_PREVIEW_TIMEOUT_MS;
+    d;
+    constructor(kdb, host, files, storage, log, txHost, timeoutMs = FILE_PREVIEW_TIMEOUT_MS) {
+        this.txHost = txHost;
+        this.timeoutMs = timeoutMs;
+        this.d = {
+            get db() {
+                return kdb.db;
+            },
+            host,
+            enabledPlugins: (orgId) => host.enabledPlugins(orgId),
+            files,
+            storage,
+            log,
+        };
     }
     /** Every previewer loaded on this replica, in provider order (load order, then list order). */
     loaded() {
@@ -119,36 +149,38 @@ export class PreviewerRegistry {
             }
             seen.add(k);
         }
-        await this.d.db.transaction().execute(async (trx) => {
-            if (known.size > 0) {
-                await trx
-                    .deleteFrom("file_previewers")
-                    .where("org_id", "=", orgId)
-                    .where(sql `plugin || '/' || previewer_id`, "in", [...known])
-                    .execute();
-            }
-            if (items.length > 0) {
-                await trx
-                    .insertInto("file_previewers")
-                    .values(items.map((i, position) => ({
-                    org_id: orgId,
-                    plugin: i.plugin,
-                    previewer_id: i.id,
-                    position,
-                    disabled: i.disabled,
-                })))
-                    .execute();
-            }
-            await audit(trx, {
-                ...(actor.accountId !== undefined && { actorAccountId: actor.accountId }),
-                ...(actor.tokenId !== undefined && { actorTokenId: actor.tokenId }),
-                orgId,
-                action: "org.file_previewers.updated",
-                detail: { items },
-            });
-        });
+        await this.putIn(orgId, items, known, actor);
         return this.list(orgId);
     }
+    /** Replaces the org's rows of the previewers this replica knows, in one transaction. */
+    async putIn(orgId, items, known, actor) {
+        if (known.size > 0) {
+            await this.d.db
+                .deleteFrom("file_previewers")
+                .where("org_id", "=", orgId)
+                .where(sql `plugin || '/' || previewer_id`, "in", [...known])
+                .execute();
+        }
+        if (items.length > 0) {
+            await this.d.db
+                .insertInto("file_previewers")
+                .values(items.map((i, position) => ({
+                org_id: orgId,
+                plugin: i.plugin,
+                previewer_id: i.id,
+                position,
+                disabled: i.disabled,
+            })))
+                .execute();
+        }
+        await audit(this.d.db, {
+            ...(actor.accountId !== undefined && { actorAccountId: actor.accountId }),
+            ...(actor.tokenId !== undefined && { actorTokenId: actor.tokenId }),
+            orgId,
+            action: "org.file_previewers.updated",
+            detail: { items },
+        });
+    }
     /** Previewers that take this file (viewer must read the conversation), in the org's order. */
     async forFile(orgId, conversationId, viewer, fileId) {
         const file = await this.d.files.file(orgId, conversationId, viewer, fileId);
@@ -247,4 +279,19 @@ export class PreviewerRegistry {
         const file = await this.d.files.file(t.orgId, t.conversationId, t.accountId, t.fileId);
         return (await this.accepting(t.orgId, file)).some((l) => l.plugin === t.plugin && l.previewer.embed === t.contribution);
     }
-}
+};
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PreviewerRegistry.prototype, "putIn", null);
+PreviewerRegistry = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(ExtensionHost)),
+    __param(2, Inject(ConversationFiles)),
+    __param(3, Inject(StorageService)),
+    __param(4, Inject(KERNEL_LOGGER)),
+    __param(5, Inject(TransactionHost)),
+    __param(6, Optional()),
+    __param(6, Inject(FILE_PREVIEW_TIMEOUT))
+], PreviewerRegistry);
+export { PreviewerRegistry };

package/dist/http/adapter.d.ts

@@ -0,0 +1,3 @@
+import { FastifyAdapter } from "@nestjs/platform-fastify";
+/** The kernel's Fastify adapter: trusted proxies (`http.trustProxy`) and validated request ids. */
+export declare function createKernelAdapter(trustProxy?: boolean | number | string[]): FastifyAdapter;