@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.2

package/dist/identity/settings.js

@@ -1,7 +1,21 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { audit } from "./audit.js";
-import { lockEnterpriseAdminsAndAuthorize } from "./enterprise-admin.js";
+import { EnterpriseAdminLock } from "./enterprise-admin.js";
 /** 币种代码：ISO 4217 的三位大写字母（如 USD、CNY）。 */
 const CurrencyCode = z.string().regex(/^[A-Z]{3}$/, "must be a 3-letter ISO 4217 currency code");
 /** 沙箱 cpu（核）与内存（MB）覆盖的范围（C19）。 */
@@ -156,24 +170,26 @@ function mergeByOrg(current, patch) {
     }
     return merged;
 }
-/** 部署级设置：每个键一行，读时缺省用默认值。 */
-export class SettingsService {
+/** Deployment settings: one row per key, defaults for missing keys. */
+let SettingsService = class SettingsService {
     db;
+    txHost;
+    adminLock;
     log;
-    constructor(db, log) {
+    constructor(db, txHost, adminLock, log) {
         this.db = db;
+        this.txHost = txHost;
+        this.adminLock = adminLock;
         this.log = log;
     }
     /**
-     * 读全部设置；传 `trx` 时在该事务内读（调用方已持有事务连接时不再占用池里的第二个连接）。
-     * 逐个键校验：库里某个键的值非法时该键用默认值并 warn 点名，其余合法的键照常生效；
-     * 不认识的键（如新版本写入的）忽略。
+     * Reads every setting, in the context's transaction when there is one (a caller holding a
+     * transaction connection does not take a second one from the pool). Each key is validated on
+     * its own: an invalid stored value falls back to the default with a warning naming the key, the
+     * valid keys apply; unknown keys (written by a newer version) are ignored.
      */
-    async get(trx) {
-        const rows = await (trx ?? this.db)
-            .selectFrom("deployment_settings")
-            .select(["key", "value"])
-            .execute();
+    async get() {
+        const rows = await this.db.selectFrom("deployment_settings").select(["key", "value"]).execute();
         const stored = new Map(rows.map((r) => [r.key, r.value]));
         const out = { ...DEFAULTS };
         for (const [key, field] of Object.entries(DEPLOYMENT_SETTINGS.shape)) {
@@ -184,7 +200,7 @@ export class SettingsService {
                 out[key] = parsed.data;
             }
             else {
-                this.log?.warn("invalid deployment setting; using default", {
+                this.log.warn("invalid deployment setting; using default", {
                     key,
                     issues: parsed.error.issues.map((i) => i.message),
                 });
@@ -192,57 +208,69 @@ export class SettingsService {
         }
         return out;
     }
-    /** 更新设置：事务内取企业管理员锁并复核发起人仍是活跃企业管理员（否则 `forbidden`）。 */
+    /** Updates settings under the enterprise admin lock, re-checking the actor (else `forbidden`). */
     async update(patch, actorAccountId, actorTokenId) {
         const check = DEPLOYMENT_SETTINGS_PATCH.safeParse(patch);
         if (!check.success) {
             throw new ApiError("validation_failed", "Invalid deployment settings", check.error.issues.map((i) => ({ path: i.path.join("."), message: i.message })));
         }
-        await this.db.transaction().execute(async (trx) => {
-            await lockEnterpriseAdminsAndAuthorize(trx, actorAccountId);
-            // 企业管理员锁串行化所有设置修改：在锁内读当前覆盖再合并，不会丢失并发修改。
-            const next = {};
-            if (check.data.orgCreation !== undefined)
-                next.orgCreation = check.data.orgCreation;
-            if (check.data.priceCurrency !== undefined)
-                next.priceCurrency = check.data.priceCurrency;
-            if (check.data.customConnectors !== undefined) {
-                next.customConnectors = check.data.customConnectors;
+        await this.write(check.data, actorAccountId, actorTokenId);
+        return this.get();
+    }
+    async write(patch, actorAccountId, actorTokenId) {
+        await this.adminLock.lockAndAuthorize(actorAccountId);
+        // The enterprise admin lock serializes every settings write: the current overrides are read
+        // and merged under it, so no concurrent change is lost
+        const next = {};
+        if (patch.orgCreation !== undefined)
+            next.orgCreation = patch.orgCreation;
+        if (patch.priceCurrency !== undefined)
+            next.priceCurrency = patch.priceCurrency;
+        if (patch.customConnectors !== undefined)
+            next.customConnectors = patch.customConnectors;
+        if (patch.customSkills !== undefined)
+            next.customSkills = patch.customSkills;
+        const { runConcurrencyOverrides: runPatch, sandboxLimitOverrides: sandboxPatch, subagentLimitOverrides: subagentPatch, } = patch;
+        if (runPatch !== undefined || sandboxPatch !== undefined || subagentPatch !== undefined) {
+            const current = await this.get();
+            if (runPatch !== undefined) {
+                next.runConcurrencyOverrides = mergeByOrg(current.runConcurrencyOverrides, runPatch);
             }
-            if (check.data.customSkills !== undefined)
-                next.customSkills = check.data.customSkills;
-            const { runConcurrencyOverrides: runPatch, sandboxLimitOverrides: sandboxPatch, subagentLimitOverrides: subagentPatch, } = check.data;
-            if (runPatch !== undefined || sandboxPatch !== undefined || subagentPatch !== undefined) {
-                const current = await this.get(trx);
-                if (runPatch !== undefined) {
-                    next.runConcurrencyOverrides = mergeByOrg(current.runConcurrencyOverrides, runPatch);
-                }
-                if (sandboxPatch !== undefined) {
-                    next.sandboxLimitOverrides = mergeByOrg(current.sandboxLimitOverrides, sandboxPatch);
-                }
-                if (subagentPatch !== undefined) {
-                    next.subagentLimitOverrides = mergeByOrg(current.subagentLimitOverrides, subagentPatch);
-                }
+            if (sandboxPatch !== undefined) {
+                next.sandboxLimitOverrides = mergeByOrg(current.sandboxLimitOverrides, sandboxPatch);
             }
-            for (const [key, value] of Object.entries(next)) {
-                if (value === undefined)
-                    continue;
-                const json = JSON.stringify(value);
-                await trx
-                    .insertInto("deployment_settings")
-                    .values({ key, value: json, updated_by: actorAccountId })
-                    .onConflict((oc) => oc
-                    .column("key")
-                    .doUpdateSet({ value: json, updated_by: actorAccountId, updated_at: new Date() }))
-                    .execute();
+            if (subagentPatch !== undefined) {
+                next.subagentLimitOverrides = mergeByOrg(current.subagentLimitOverrides, subagentPatch);
             }
-            await audit(trx, {
-                actorAccountId,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-                action: "deployment.settings.updated",
-                detail: check.data,
-            });
+        }
+        for (const [key, value] of Object.entries(next)) {
+            if (value === undefined)
+                continue;
+            const json = JSON.stringify(value);
+            await this.db
+                .insertInto("deployment_settings")
+                .values({ key, value: json, updated_by: actorAccountId })
+                .onConflict((oc) => oc
+                .column("key")
+                .doUpdateSet({ value: json, updated_by: actorAccountId, updated_at: new Date() }))
+                .execute();
+        }
+        await audit(this.db.db, {
+            actorAccountId,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            action: "deployment.settings.updated",
+            detail: patch,
         });
-        return this.get();
     }
-}
+};
+__decorate([
+    Transactional()
+], SettingsService.prototype, "write", null);
+SettingsService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(EnterpriseAdminLock)),
+    __param(3, Inject(KERNEL_LOGGER))
+], SettingsService);
+export { SettingsService };

package/dist/identity/sso.controller.d.ts

@@ -1,11 +1,11 @@
 import type { FastifyReply, FastifyRequest } from "fastify";
-import type { KernelConfig } from "../config/schema.js";
-import type { AccountsService } from "./accounts.js";
-import type { IdentityBinding, PendingBinding } from "./binding.js";
-import type { ExternalIdentities, LinkedIdentity } from "./external.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { AccountsService } from "./accounts.js";
+import { IdentityBinding, type PendingBinding } from "./binding.js";
+import { ExternalIdentities, type LinkedIdentity } from "./external.js";
 import { type Principal } from "./principal.js";
-import type { SessionService } from "./sessions.js";
-import { type SsoFlow } from "./sso.js";
+import { SessionService } from "./sessions.js";
+import { SsoFlow } from "./sso.js";
 /**
  * 第三方登录（`/api/v1/auth/sources`、`/api/v1/auth/sso/:plugin/*`，均为公开路由）。浏览器整页跳转，
  * 发起与回调都以 302 结束；失败回登录页并带原因码（`/login?error=<code>`），不回显身份源文本。
@@ -15,7 +15,7 @@ export declare class SsoController {
     private readonly sessions;
     private readonly accounts;
     private readonly config;
-    constructor(flow: SsoFlow, sessions: SessionService, accounts: AccountsService, config: () => KernelConfig);
+    constructor(flow: SsoFlow, sessions: SessionService, accounts: AccountsService, config: KernelConfigService);
     sources(): {
         sources: {
             plugin: string;

package/dist/identity/sso.controller.js

@@ -8,11 +8,15 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Controller, Delete, Get, HttpCode, Inject, Param, Post, Query, Req, Res, } from "@nestjs/common";
-import { ACCOUNTS, EXTERNAL_IDENTITIES, IDENTITY_BINDING, KERNEL_CONFIG, SESSIONS, SSO_FLOW, } from "../http/tokens.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { AccountsService } from "./accounts.js";
 import { clientMeta } from "./auth.controller.js";
+import { IdentityBinding } from "./binding.js";
 import { setSessionCookies } from "./cookies.js";
+import { ExternalIdentities } from "./external.js";
 import { CurrentPrincipal, Public, requireUser, SessionOnly } from "./principal.js";
-import { SSO_BINDING_COOKIE, SSO_COOKIE_PATH, SSO_STATE_TTL_SECONDS, ssoBrowserBinding, } from "./sso.js";
+import { SessionService } from "./sessions.js";
+import { SSO_BINDING_COOKIE, SSO_COOKIE_PATH, SSO_STATE_TTL_SECONDS, SsoFlow, ssoBrowserBinding, } from "./sso.js";
 const MAX_QUERY_KEYS = 50;
 const MAX_QUERY_VALUE = 4096;
 /** 查询参数只取单值字符串（重复参数 / 数组 / 超长值丢弃）。 */
@@ -78,7 +82,7 @@ let SsoController = class SsoController {
             }
             else {
                 const session = await this.sessions.create(account.id, clientMeta(req));
-                setSessionCookies(reply, session, this.config());
+                setSessionCookies(reply, session, this.config.get());
                 location = this.flow.webUrl(r.returnTo);
             }
         }
@@ -110,10 +114,10 @@ __decorate([
 ], SsoController.prototype, "callback", null);
 SsoController = __decorate([
     Controller("api/v1/auth"),
-    __param(0, Inject(SSO_FLOW)),
-    __param(1, Inject(SESSIONS)),
-    __param(2, Inject(ACCOUNTS)),
-    __param(3, Inject(KERNEL_CONFIG))
+    __param(0, Inject(SsoFlow)),
+    __param(1, Inject(SessionService)),
+    __param(2, Inject(AccountsService)),
+    __param(3, Inject(KernelConfigService))
 ], SsoController);
 export { SsoController };
 /**
@@ -155,7 +159,7 @@ __decorate([
 ], BindController.prototype, "bind", null);
 BindController = __decorate([
     Controller("api/v1/bind"),
-    __param(0, Inject(IDENTITY_BINDING))
+    __param(0, Inject(IdentityBinding))
 ], BindController);
 export { BindController };
 /** 本人绑定的外部身份（`/api/v1/me/identities`）：列出、解除。 */
@@ -187,6 +191,6 @@ __decorate([
 ], MeIdentitiesController.prototype, "unlink", null);
 MeIdentitiesController = __decorate([
     Controller("api/v1/me/identities"),
-    __param(0, Inject(EXTERNAL_IDENTITIES))
+    __param(0, Inject(ExternalIdentities))
 ], MeIdentitiesController);
 export { MeIdentitiesController };

package/dist/identity/sso.d.ts

@@ -1,8 +1,8 @@
 import { type Logger } from "@capybara-hq/plugin-sdk";
 import type { Redis } from "ioredis";
-import type { KernelConfig } from "../config/schema.js";
-import type { ExtensionHost } from "../extensions/host.js";
-import { type ExternalIdentities } from "./external.js";
+import { ExtensionRegistry } from "../extensions/registry.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { ExternalIdentities } from "./external.js";
 /** state 的有效期（秒）。 */
 export declare const SSO_STATE_TTL_SECONDS = 600;
 /** 浏览器绑定 Cookie：回调必须来自发起登录的同一个浏览器（防登录 CSRF / 把回跳链接转给别人）。 */
@@ -22,13 +22,6 @@ export type SsoLoginError = "sso.unavailable" | "sso.state_invalid" | "sso.sessi
 export declare function ssoBrowserBinding(existing: string | undefined): string;
 /** 回跳页面：站内相对路径（以单个 `/` 开头，非 `//`），否则 `/`（防开放重定向）。 */
 export declare function safeReturnTo(p: string | undefined): string;
-export interface SsoFlowDeps {
-    redis: Redis;
-    config: () => KernelConfig;
-    host: Pick<ExtensionHost, "list" | "deploymentConfig">;
-    external: ExternalIdentities;
-    log: Pick<Logger, "warn">;
-}
 /** 回调结果：成功给账号与回跳页面，失败给原因码。 */
 export type SsoCallbackResult = {
     ok: true;
@@ -48,8 +41,12 @@ export type SsoCallbackResult = {
  * 由此证明本人控制该外部身份，升级为可登录（Ruling A18，见 `ExternalIdentities.resolve`）。
  */
 export declare class SsoFlow {
-    private readonly deps;
-    constructor(deps: SsoFlowDeps);
+    private readonly redis;
+    private readonly config;
+    private readonly registry;
+    private readonly external;
+    private readonly log;
+    constructor(redis: Redis, config: Pick<KernelConfigService, "get">, registry: Pick<ExtensionRegistry, "list" | "deploymentConfig">, external: ExternalIdentities, log: Pick<Logger, "warn">);
     /** 已启用的登录方式：`auth.loginSources` 中（按其顺序）且已加载、提供 `identity-source@1` 的插件。 */
     sources(): {
         plugin: string;

package/dist/identity/sso.js

@@ -1,8 +1,21 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { IDENTITY_SOURCE_EXTENSION_POINT, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { ApiError } from "../errors.js";
-import { isSafeReturnPath } from "../tools/oauth/flow.js";
-import { IdentityNotVerified } from "./external.js";
+import { ExtensionRegistry } from "../extensions/registry.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KERNEL_LOGGER, REDIS } from "../infra/tokens.js";
+import { isSafeReturnPath } from "../tools/oauth/flow-paths.js";
+import { ExternalIdentities, IdentityNotVerified } from "./external.js";
 /** state 的有效期（秒）。 */
 export const SSO_STATE_TTL_SECONDS = 600;
 /** 浏览器绑定 Cookie：回调必须来自发起登录的同一个浏览器（防登录 CSRF / 把回跳链接转给别人）。 */
@@ -41,38 +54,46 @@ export function safeReturnTo(p) {
  * 已登录的用户也可以发起（「登录状态下绑定」）：回调请求带着同一账号的 Web 会话时，经 IM 绑定链接建立的身份
  * 由此证明本人控制该外部身份，升级为可登录（Ruling A18，见 `ExternalIdentities.resolve`）。
  */
-export class SsoFlow {
-    deps;
-    constructor(deps) {
-        this.deps = deps;
+let SsoFlow = class SsoFlow {
+    redis;
+    config;
+    registry;
+    external;
+    log;
+    constructor(redis, config, registry, external, log) {
+        this.redis = redis;
+        this.config = config;
+        this.registry = registry;
+        this.external = external;
+        this.log = log;
     }
     /** 已启用的登录方式：`auth.loginSources` 中（按其顺序）且已加载、提供 `identity-source@1` 的插件。 */
     sources() {
-        return this.deps.config().auth.loginSources.flatMap((plugin) => {
+        return this.config.get().auth.loginSources.flatMap((plugin) => {
             const src = this.provider(plugin);
             return src ? [{ plugin, label: { zh: src.label.zh, en: src.label.en } }] : [];
         });
     }
     provider(plugin) {
-        if (!this.deps.config().auth.loginSources.includes(plugin))
+        if (!this.config.get().auth.loginSources.includes(plugin))
             return undefined;
-        const entry = this.deps.host
+        const entry = this.registry
             .list("identity-source")
             .find((e) => e.plugin === plugin && e.capability === IDENTITY_SOURCE_EXTENSION_POINT);
         return entry?.impl;
     }
     redirectUri(plugin) {
-        const base = (this.deps.config().http.publicUrl ?? "").replace(/\/+$/, "");
+        const base = (this.config.get().http.publicUrl ?? "").replace(/\/+$/, "");
         return `${base}/api/v1/auth/sso/${encodeURIComponent(plugin)}/callback`;
     }
     /** 绑定 Cookie 是否加 Secure：`auth.cookieSecure`，或 `http.publicUrl` 是 https（浏览器经 https 访问）。 */
     cookieSecure() {
-        const cfg = this.deps.config();
+        const cfg = this.config.get();
         return cfg.auth.cookieSecure || (cfg.http.publicUrl ?? "").startsWith("https:");
     }
     /** 网页地址：`http.publicUrl` + 站内路径（未配置 publicUrl 时为相对地址）。 */
     webUrl(path) {
-        const base = (this.deps.config().http.publicUrl ?? "").replace(/\/+$/, "");
+        const base = (this.config.get().http.publicUrl ?? "").replace(/\/+$/, "");
         return `${base}${path}`;
     }
     /** 登录页并带原因码。 */
@@ -85,7 +106,7 @@ export class SsoFlow {
      */
     async start(plugin, returnTo, binding, sessionAccountId) {
         const src = this.provider(plugin);
-        if (!src || !this.deps.config().http.publicUrl)
+        if (!src || !this.config.get().http.publicUrl)
             return this.loginError("sso.unavailable");
         const state = b64url();
         const nonce = b64url();
@@ -94,7 +115,7 @@ export class SsoFlow {
         let url;
         try {
             url = src.authorizeUrl({
-                config: this.deps.host.deploymentConfig(plugin),
+                config: this.registry.deploymentConfig(plugin),
                 redirectUri,
                 state,
                 nonce,
@@ -106,7 +127,7 @@ export class SsoFlow {
                 throw new Error("authorize URL must be http(s)");
         }
         catch (err) {
-            this.deps.log.warn("identity source authorizeUrl failed", { plugin, err });
+            this.log.warn("identity source authorizeUrl failed", { plugin, err });
             return this.loginError("sso.unavailable");
         }
         const rec = {
@@ -118,7 +139,7 @@ export class SsoFlow {
             codeVerifier,
             ...(sessionAccountId !== undefined && { sessionAccountId }),
         };
-        await this.deps.redis.set(stateKey(state), JSON.stringify(rec), "EX", SSO_STATE_TTL_SECONDS);
+        await this.redis.set(stateKey(state), JSON.stringify(rec), "EX", SSO_STATE_TTL_SECONDS);
         return url;
     }
     /**
@@ -133,7 +154,7 @@ export class SsoFlow {
         const state = query.state;
         if (state === undefined || !STATE_RE.test(state))
             return { ok: false, error: "sso.state_invalid" };
-        const raw = await this.deps.redis.getdel(stateKey(state));
+        const raw = await this.redis.getdel(stateKey(state));
         if (raw === null)
             return { ok: false, error: "sso.state_invalid" };
         const rec = JSON.parse(raw);
@@ -154,7 +175,7 @@ export class SsoFlow {
         let identity;
         try {
             identity = await src.callback({
-                config: this.deps.host.deploymentConfig(plugin),
+                config: this.registry.deploymentConfig(plugin),
                 redirectUri: rec.redirectUri,
                 query,
                 nonce: rec.nonce,
@@ -163,13 +184,13 @@ export class SsoFlow {
             });
         }
         catch (err) {
-            this.deps.log.warn("identity source callback failed", { plugin, err });
+            this.log.warn("identity source callback failed", { plugin, err });
             return { ok: false, error: "sso.provider_error" };
         }
         // 身份源键由内核推导（Ruling A19）：插件只能为自己、为它报出的租户声明身份
         if (typeof identity?.tenantId !== "string" ||
             identity.source !== `${plugin}:${identity.tenantId}`) {
-            this.deps.log.warn("identity source returned a source key that does not match its tenant", {
+            this.log.warn("identity source returned a source key that does not match its tenant", {
                 plugin,
             });
             return { ok: false, error: "sso.provider_error" };
@@ -181,7 +202,7 @@ export class SsoFlow {
         let accountId;
         try {
             // 只有登录路径允许按已验证邮箱合并（Ruling A9）
-            accountId = (await this.deps.external.resolve(identity, undefined, {
+            accountId = (await this.external.resolve(identity, {
                 allowMerge: true,
                 linkedVia: "sso",
                 login: provedBy === undefined ? {} : { sessionAccountId: provedBy },
@@ -189,14 +210,23 @@ export class SsoFlow {
         }
         catch (err) {
             if (err instanceof IdentityNotVerified) {
-                this.deps.log.warn("sign-in with an unverified linked identity refused", { plugin });
+                this.log.warn("sign-in with an unverified linked identity refused", { plugin });
                 return { ok: false, error: "sso.identity_not_verified" };
             }
             if (!(err instanceof ApiError))
                 throw err;
-            this.deps.log.warn("external identity rejected", { plugin, err });
+            this.log.warn("external identity rejected", { plugin, err });
             return { ok: false, error: "sso.provider_error" };
         }
         return { ok: true, accountId, returnTo: rec.returnTo };
     }
-}
+};
+SsoFlow = __decorate([
+    Injectable(),
+    __param(0, Inject(REDIS)),
+    __param(1, Inject(KernelConfigService)),
+    __param(2, Inject(ExtensionRegistry)),
+    __param(3, Inject(ExternalIdentities)),
+    __param(4, Inject(KERNEL_LOGGER))
+], SsoFlow);
+export { SsoFlow };

package/dist/inbox/inbox.module.d.ts

@@ -0,0 +1,3 @@
+/** The inbox: pending tool approvals, skill changes and catalog requests, read live from PG. */
+export declare class InboxModule {
+}

package/dist/inbox/inbox.module.js

@@ -0,0 +1,22 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { CatalogModule } from "../catalog/catalog.module.js";
+import { SkillsModule } from "../skills/skills.module.js";
+import { ToolsModule } from "../tools/tools.module.js";
+import { InboxService } from "./inbox.service.js";
+/** The inbox: pending tool approvals, skill changes and catalog requests, read live from PG. */
+let InboxModule = class InboxModule {
+};
+InboxModule = __decorate([
+    Module({
+        imports: [ToolsModule, SkillsModule, CatalogModule],
+        providers: [InboxService],
+        exports: [InboxService],
+    })
+], InboxModule);
+export { InboxModule };

package/dist/inbox/inbox.service.d.ts

@@ -1,6 +1,6 @@
-import { type CatalogRequestsService, type CatalogRequestView } from "../catalog/requests.service.js";
-import { type SkillChangesService, type SkillChangeView } from "../skills/changes.service.js";
-import { type ApprovalsService, type ApprovalView } from "../tools/approvals.service.js";
+import { CatalogRequestsService, type CatalogRequestView } from "../catalog/requests.service.js";
+import { SkillChangesService, type SkillChangeView } from "../skills/changes.service.js";
+import { ApprovalsService, type ApprovalView } from "../tools/approvals.service.js";
 /** 收件箱一次最多返回的事项数。 */
 export declare const INBOX_MAX_ITEMS = 100;
 /**
@@ -33,11 +33,9 @@ export interface InboxView {
 }
 /** 收件箱（计划取舍 C6）：按类型汇总各来源的待处理事项。无状态，每次实时读 PG。 */
 export declare class InboxService {
-    private readonly d;
-    constructor(d: {
-        approvals: Pick<ApprovalsService, "list">;
-        skillChanges: Pick<SkillChangesService, "listPending">;
-        catalogRequests?: Pick<CatalogRequestsService, "listForOrgAdmin">;
-    });
+    private readonly approvals;
+    private readonly skillChanges;
+    private readonly catalogRequests;
+    constructor(approvals: Pick<ApprovalsService, "list">, skillChanges: Pick<SkillChangesService, "listPending">, catalogRequests: Pick<CatalogRequestsService, "listForOrgAdmin">);
     list(orgId: string, accountId: string): Promise<InboxView>;
 }

package/dist/inbox/inbox.service.js

@@ -1,19 +1,33 @@
-import { CATALOG_REQUESTS_LIST_MAX, } from "../catalog/requests.service.js";
-import { SKILL_CHANGES_LIST_MAX, } from "../skills/changes.service.js";
-import { APPROVALS_LIST_MAX, } from "../tools/approvals.service.js";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { CATALOG_REQUESTS_LIST_MAX, CatalogRequestsService, } from "../catalog/requests.service.js";
+import { SKILL_CHANGES_LIST_MAX, SkillChangesService, } from "../skills/changes.service.js";
+import { APPROVALS_LIST_MAX, ApprovalsService, } from "../tools/approvals.service.js";
 /** 收件箱一次最多返回的事项数。 */
 export const INBOX_MAX_ITEMS = 100;
 /** 收件箱（计划取舍 C6）：按类型汇总各来源的待处理事项。无状态，每次实时读 PG。 */
-export class InboxService {
-    d;
-    constructor(d) {
-        this.d = d;
+let InboxService = class InboxService {
+    approvals;
+    skillChanges;
+    catalogRequests;
+    constructor(approvals, skillChanges, catalogRequests) {
+        this.approvals = approvals;
+        this.skillChanges = skillChanges;
+        this.catalogRequests = catalogRequests;
     }
     async list(orgId, accountId) {
         const [approvals, changes, requests] = await Promise.all([
-            this.d.approvals.list(orgId, accountId, "pending"),
-            this.d.skillChanges.listPending(orgId, accountId),
-            this.d.catalogRequests?.listForOrgAdmin(orgId, accountId) ?? [],
+            this.approvals.list(orgId, accountId, "pending"),
+            this.skillChanges.listPending(orgId, accountId),
+            this.catalogRequests.listForOrgAdmin(orgId, accountId),
         ]);
         const all = [
             ...approvals.map((a) => ({
@@ -54,4 +68,11 @@ export class InboxService {
             truncated: full || all.length > INBOX_MAX_ITEMS,
         };
     }
-}
+};
+InboxService = __decorate([
+    Injectable(),
+    __param(0, Inject(ApprovalsService)),
+    __param(1, Inject(SkillChangesService)),
+    __param(2, Inject(CatalogRequestsService))
+], InboxService);
+export { InboxService };