@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.10

package/dist/extensions/sources.d.ts

@@ -1,4 +1,6 @@
-import type { KernelDb } from "../db/kernel-schema.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import type { KernelLogger } from "../log.js";
 /**
  * Where an extension comes from (C15 / C13):
  * - `config`: the startup config's `extensions` list (development mode and existing deployments),
@@ -12,8 +14,13 @@ import type { KernelDb } from "../db/kernel-schema.js";
 export type ExtensionSource = "config" | "install";
 /** 副本（进程）id：`<hostname>-<pid>-<6 位随机>`，每个进程唯一（`http.replicaId` 可能跨重启不变或多副本相同）。 */
 export declare function newReplicaId(): string;
-/** Why `extension_replica_status.state = pending` (F-I: the admin view derives pending_config and so on from it). */
-export type PendingReason = "config" | "approval" | "migration" | "dependency";
+/**
+ * Why `extension_replica_status.state = pending` (F-I: the admin view derives pending_config and so
+ * on from it). `dependency`: an extension point it requires has no provider; `conflict`: it
+ * provides a single-provider extension point another loaded extension already provides (it loads
+ * once that one is disabled or uninstalled, no restart).
+ */
+export type PendingReason = "config" | "approval" | "migration" | "dependency" | "conflict";
 /** One load result (written to `extension_replica_status`). */
 export interface ExtensionLoadStatus {
     plugin: string;
@@ -33,15 +40,17 @@ export interface ExtensionLoadStatus {
 /** This replica's extension load status (PG `extension_replica_status`; each replica writes only its own rows). */
 export declare class ReplicaStatusStore {
     private readonly db;
-    readonly replicaId: string;
-    private readonly httpReplicaId?;
-    private readonly redact;
+    /** Its `redact` masks `detail` before it is written (an error may carry a secret an extension put in it). */
+    private readonly log;
     /** 本进程写过行（停机时才需要删；没写过时不碰数据库，例如启动在迁移前就失败）。 */
     private wrote;
-    /**
-     * @param redact 写 `detail` 之前打码（内核传 logger 的 `redact`：报错信息里可能带着插件拼进去的密钥）。
-     */
-    constructor(db: KernelDb, replicaId: string, httpReplicaId?: string | undefined, redact?: (text: string) => string);
+    /** This process's replica id ({@link newReplicaId}; one store per process). */
+    readonly replicaId: string;
+    /** `http.replicaId` of the startup config (recorded with each row). */
+    private readonly httpReplicaId;
+    constructor(db: KernelDb, config: KernelConfigService, 
+    /** Its `redact` masks `detail` before it is written (an error may carry a secret an extension put in it). */
+    log: Pick<KernelLogger, "redact">);
     /** 打码后截断到 {@link MAX_DETAIL}。 */
     private cleanDetail;
     /** 写入（覆盖）本副本该插件的一行，心跳取当前时间。 */

package/dist/extensions/sources.js

@@ -1,6 +1,19 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomBytes } from "node:crypto";
 import { hostname } from "node:os";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
 /** 副本（进程）id：`<hostname>-<pid>-<6 位随机>`，每个进程唯一（`http.replicaId` 可能跨重启不变或多副本相同）。 */
 export function newReplicaId() {
     return `${hostname()}-${process.pid}-${randomBytes(3).toString("hex")}`;
@@ -8,25 +21,26 @@ export function newReplicaId() {
 /** detail 的长度上限（报错信息可能很长）。 */
 const MAX_DETAIL = 2000;
 /** This replica's extension load status (PG `extension_replica_status`; each replica writes only its own rows). */
-export class ReplicaStatusStore {
+let ReplicaStatusStore = class ReplicaStatusStore {
     db;
-    replicaId;
-    httpReplicaId;
-    redact;
+    log;
     /** 本进程写过行（停机时才需要删；没写过时不碰数据库，例如启动在迁移前就失败）。 */
     wrote = false;
-    /**
-     * @param redact 写 `detail` 之前打码（内核传 logger 的 `redact`：报错信息里可能带着插件拼进去的密钥）。
-     */
-    constructor(db, replicaId, httpReplicaId, redact = (t) => t) {
+    /** This process's replica id ({@link newReplicaId}; one store per process). */
+    replicaId = newReplicaId();
+    /** `http.replicaId` of the startup config (recorded with each row). */
+    httpReplicaId;
+    constructor(db, config, 
+    /** Its `redact` masks `detail` before it is written (an error may carry a secret an extension put in it). */
+    log) {
         this.db = db;
-        this.replicaId = replicaId;
-        this.httpReplicaId = httpReplicaId;
-        this.redact = redact;
+        this.log = log;
+        const id = config.get().http.replicaId;
+        this.httpReplicaId = id === undefined ? undefined : String(id);
     }
     /** 打码后截断到 {@link MAX_DETAIL}。 */
     cleanDetail(detail) {
-        return this.redact(detail).slice(0, MAX_DETAIL);
+        return this.log.redact(detail).slice(0, MAX_DETAIL);
     }
     /** 写入（覆盖）本副本该插件的一行，心跳取当前时间。 */
     async write(s) {
@@ -117,4 +131,11 @@ export class ReplicaStatusStore {
             .where("replica_id", "=", this.replicaId)
             .execute();
     }
-}
+};
+ReplicaStatusStore = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(KernelConfigService)),
+    __param(2, Inject(KERNEL_LOGGER))
+], ReplicaStatusStore);
+export { ReplicaStatusStore };

package/dist/extensions/state.module.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The extension state the model domain reads below the host: the install records with their
+ * packages and approvals, and each extension's effective config per org. Apart from
+ * `ExtensionsModule` so the model provider registry (and the `ctx.models` broker the host injects)
+ * can depend on it without a module cycle (writing-kernel-api: a cycle is cut by moving the shared
+ * part into its own provider both sides inject). `ExtensionsModule` re-exports it.
+ */
+export declare class ExtensionStateModule {
+}

package/dist/extensions/state.module.js

@@ -0,0 +1,38 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { SuperAdminLockModule } from "../identity/super-admin.js";
+import { OrgLockModule } from "../orgs/org-lock.js";
+import { StorageModule } from "../storage/storage.module.js";
+import { ExtensionApprovals } from "./approvals.js";
+import { ExtensionBlobs } from "./blobs.js";
+import { EffectiveConfigs } from "./effective-config.js";
+import { ExtensionInstalls } from "./installs.js";
+import { ExtensionRegistryModule } from "./registry.js";
+/**
+ * The extension state the model domain reads below the host: the install records with their
+ * packages and approvals, and each extension's effective config per org. Apart from
+ * `ExtensionsModule` so the model provider registry (and the `ctx.models` broker the host injects)
+ * can depend on it without a module cycle (writing-kernel-api: a cycle is cut by moving the shared
+ * part into its own provider both sides inject). `ExtensionsModule` re-exports it.
+ */
+let ExtensionStateModule = class ExtensionStateModule {
+};
+ExtensionStateModule = __decorate([
+    Module({
+        imports: [ExtensionRegistryModule, SuperAdminLockModule, OrgLockModule, StorageModule],
+        providers: [ExtensionApprovals, ExtensionBlobs, ExtensionInstalls, EffectiveConfigs],
+        exports: [
+            ExtensionRegistryModule,
+            ExtensionApprovals,
+            ExtensionBlobs,
+            ExtensionInstalls,
+            EffectiveConfigs,
+        ],
+    })
+], ExtensionStateModule);
+export { ExtensionStateModule };

package/dist/extensions/unavailable.d.ts

@@ -0,0 +1,50 @@
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { type DeploymentExtensionStatus } from "./permission-view.js";
+import { ExtensionRegistry } from "./registry.js";
+/**
+ * Why an extension cannot be used right now (Platform tool spec §14.2 problem 1, §14.5 item 4):
+ * - `not_deployed`: no install record on the platform (a catalog plugin whose extension was never
+ *   installed);
+ * - `needs_deployment_config`: installed, its deployment config is missing or invalid;
+ * - `pending_approval`: its permissions wait for the super admin's approval;
+ * - `pending_migration` / `loading`: the platform is still bringing it up;
+ * - `dependency`: an extension point it requires has no loaded provider;
+ * - `conflict`: it provides a single-provider extension point another loaded extension provides;
+ * - `failed`: it failed to load (or its package cannot be read);
+ * - `deployment_disabled`: the super admin disabled it on the platform.
+ * State only: never a config value or field name.
+ */
+export type ExtensionUnavailableReason = "not_deployed" | "needs_deployment_config" | "pending_approval" | "pending_migration" | "loading" | "dependency" | "conflict" | "failed" | "deployment_disabled";
+/** The deployment status of an extension that is not loaded, and the reason it shows for it. */
+export interface ExtensionUnavailability {
+    /** Null when it has no install record (`not_deployed`). */
+    status: DeploymentExtensionStatus | null;
+    reason: ExtensionUnavailableReason;
+}
+/** The reason an org or the Platform tool shows for a deployment status of a not-loaded extension. */
+export declare function unavailableReason(status: DeploymentExtensionStatus): ExtensionUnavailableReason;
+/**
+ * The state of extensions that are not loaded on this replica, derived like the admin console's
+ * status ({@link deriveExtensionStatus}) from the install record and the replicas' recent reports,
+ * without reading packages: a pending approval and a pending config come from the replicas' rows
+ * (`pending` with reason `approval` / `config`). Reads PG on every call (no in-process state).
+ *
+ * Its inputs differ slightly from the admin view's (`ExtensionAdmin`): there `pendingApproval`
+ * compares the package's permission set with the snapshot and `configValid` checks the deployment
+ * config, while here both come from what the replicas last reported. They agree once a replica
+ * has tried the current package; until then this view says `loading` where the admin view may
+ * already say `pending_approval` or `pending_config`.
+ *
+ * Which extensions count as loaded is this replica's registry: replica-local and transient. During
+ * a rollout, or right after an enable or upgrade, one replica may answer `loading` while another
+ * has it loaded; the next call (or the next reconcile) converges.
+ */
+export declare class ExtensionAvailability {
+    private readonly kdb;
+    private readonly config;
+    private readonly registry;
+    constructor(kdb: KernelDb, config: KernelConfigService, registry: ExtensionRegistry);
+    /** For each of `names` not loaded on this replica: its status and reason (loaded ones absent). */
+    unavailable(names: readonly string[]): Promise<Map<string, ExtensionUnavailability>>;
+}

package/dist/extensions/unavailable.js

@@ -0,0 +1,115 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { STALE_RECONCILE_PERIODS } from "./lifecycle-topics.js";
+import { deriveExtensionStatus } from "./permission-view.js";
+import { ExtensionRegistry } from "./registry.js";
+/** The reason an org or the Platform tool shows for a deployment status of a not-loaded extension. */
+export function unavailableReason(status) {
+    switch (status) {
+        case "pending_config":
+            return "needs_deployment_config";
+        case "pending_approval":
+            return "pending_approval";
+        case "pending_migration":
+            return "pending_migration";
+        case "dependency":
+            return "dependency";
+        case "conflict":
+            return "conflict";
+        case "failed":
+        case "legacy_format":
+            return "failed";
+        case "disabled":
+            return "deployment_disabled";
+        // loaded on another replica, or not yet on this one
+        case "converging":
+        case "enabled":
+            return "loading";
+    }
+}
+/**
+ * The state of extensions that are not loaded on this replica, derived like the admin console's
+ * status ({@link deriveExtensionStatus}) from the install record and the replicas' recent reports,
+ * without reading packages: a pending approval and a pending config come from the replicas' rows
+ * (`pending` with reason `approval` / `config`). Reads PG on every call (no in-process state).
+ *
+ * Its inputs differ slightly from the admin view's (`ExtensionAdmin`): there `pendingApproval`
+ * compares the package's permission set with the snapshot and `configValid` checks the deployment
+ * config, while here both come from what the replicas last reported. They agree once a replica
+ * has tried the current package; until then this view says `loading` where the admin view may
+ * already say `pending_approval` or `pending_config`.
+ *
+ * Which extensions count as loaded is this replica's registry: replica-local and transient. During
+ * a rollout, or right after an enable or upgrade, one replica may answer `loading` while another
+ * has it loaded; the next call (or the next reconcile) converges.
+ */
+let ExtensionAvailability = class ExtensionAvailability {
+    kdb;
+    config;
+    registry;
+    constructor(kdb, config, registry) {
+        this.kdb = kdb;
+        this.config = config;
+        this.registry = registry;
+    }
+    /** For each of `names` not loaded on this replica: its status and reason (loaded ones absent). */
+    async unavailable(names) {
+        const loaded = new Set(this.registry.manifests().map((m) => m.name));
+        const wanted = [...new Set(names)].filter((n) => !loaded.has(n));
+        const out = new Map();
+        if (wanted.length === 0)
+            return out;
+        const db = this.kdb.db;
+        const staleSeconds = STALE_RECONCILE_PERIODS * this.config.get().extensionHost.reconcileIntervalSeconds;
+        const [installs, replicas] = await Promise.all([
+            db
+                .selectFrom("extension_installs")
+                .select(["name", "sha256", "desired_state", "migrated_sha"])
+                .where("name", "in", wanted)
+                .execute(),
+            db
+                .selectFrom("extension_replica_status")
+                .select(["plugin", "state", "reason", "sha256"])
+                .where("plugin", "in", wanted)
+                .where("heartbeat_at", ">", sql `now() - make_interval(secs => ${staleSeconds})`)
+                .execute(),
+        ]);
+        for (const name of wanted) {
+            const install = installs.find((i) => i.name === name);
+            if (install === undefined) {
+                out.set(name, { status: null, reason: "not_deployed" });
+                continue;
+            }
+            const rows = replicas.filter((r) => r.plugin === name);
+            const target = rows.filter((r) => r.sha256 === install.sha256);
+            const status = deriveExtensionStatus({
+                source: "install",
+                desired: { sha256: install.sha256, state: install.desired_state },
+                pendingApproval: target.some((r) => r.state === "pending" && r.reason === "approval"),
+                configValid: !target.some((r) => r.state === "pending" && r.reason === "config"),
+                migratedSha: install.migrated_sha,
+                replicas: rows,
+            });
+            out.set(name, { status, reason: unavailableReason(status) });
+        }
+        return out;
+    }
+};
+ExtensionAvailability = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(KernelConfigService)),
+    __param(2, Inject(ExtensionRegistry))
+], ExtensionAvailability);
+export { ExtensionAvailability };

package/dist/files/files.module.d.ts

@@ -0,0 +1,3 @@
+/** File previewers (`file-preview@1`): which previewers take a file, the org's order, rendering. */
+export declare class FilesModule {
+}

package/dist/files/files.module.js

@@ -0,0 +1,22 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { ConversationsModule } from "../conversations/conversations.module.js";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { StorageModule } from "../storage/storage.module.js";
+import { PreviewerRegistry } from "./previewers.js";
+/** File previewers (`file-preview@1`): which previewers take a file, the org's order, rendering. */
+let FilesModule = class FilesModule {
+};
+FilesModule = __decorate([
+    Module({
+        imports: [ExtensionsModule, ConversationsModule, StorageModule],
+        providers: [PreviewerRegistry],
+        exports: [PreviewerRegistry],
+    })
+], FilesModule);
+export { FilesModule };

package/dist/files/previewers.controller.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
-import type { OrgPreviewerItem, PreviewerItem, PreviewerRegistry } from "./previewers.js";
+import { type OrgPreviewerItem, type PreviewerItem, PreviewerRegistry } from "./previewers.js";
 declare const PreviewQuery: z.ZodObject<{
     locale: z.ZodDefault<z.ZodEnum<{
         en: "en";
@@ -15,6 +15,11 @@ declare const OrderBody: z.ZodObject<{
         disabled: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/** The previewer named in a preview path (the other path parameters are read as they are). */
+declare const PreviewParams: z.ZodObject<{
+    plugin: z.ZodString;
+    previewerId: z.ZodString;
+}, z.core.$strip>;
 /**
  * `file-preview@1` (UI refresh B Task 11):
  * - `GET /api/v1/orgs/:orgId/conversations/:id/files/:fileId/previewers` → `{ previewers }`: the
@@ -33,7 +38,7 @@ export declare class FilePreviewersController {
     forFile(principal: Principal, org: OrgContext, id: string, fileId: string): Promise<{
         previewers: PreviewerItem[];
     }>;
-    preview(principal: Principal, org: OrgContext, id: string, fileId: string, plugin: string, previewerId: string, q: z.infer<typeof PreviewQuery>): Promise<{
+    preview(principal: Principal, org: OrgContext, id: string, fileId: string, { plugin, previewerId }: z.infer<typeof PreviewParams>, q: z.infer<typeof PreviewQuery>): Promise<{
         view: import("@capybara-hq/plugin-sdk").UiView;
     }>;
     list(org: OrgContext): Promise<{

package/dist/files/previewers.controller.js

@@ -7,17 +7,25 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Controller, Get, Header, Inject, Param, Put, Query } from "@nestjs/common";
+import { Controller, Get, Header, Inject, Param, Put } from "@nestjs/common";
 import { z } from "zod";
-import { FILE_PREVIEWERS } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
 import { CurrentPrincipal, requireUser } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam, ZQuery } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { PreviewerRegistry } from "./previewers.js";
+import { FilePreviewersOrderBody } from "./previewers.schemas.js";
 const Id = z.string().min(1).max(100);
 const PreviewQuery = z.object({ locale: z.enum(["zh", "en"]).default("en") });
-const OrderBody = z.object({
-    items: z.array(z.object({ plugin: Id, id: Id, disabled: z.boolean().default(false) })).max(500),
-});
+const OrderBody = FilePreviewersOrderBody;
+/** The previewer named in a preview path (the other path parameters are read as they are). */
+const PreviewParams = z.object({ plugin: Id, previewerId: Id });
+class FilePreviewQueryDto extends createZodDto(PreviewQuery, "FilePreviewQuery") {
+}
+class FilePreviewParamsDto extends createZodDto(PreviewParams, "FilePreviewParams") {
+}
+class FilePreviewersOrderBodyDto extends createZodDto(OrderBody, "FilePreviewersOrderBody") {
+}
 /**
  * `file-preview@1` (UI refresh B Task 11):
  * - `GET /api/v1/orgs/:orgId/conversations/:id/files/:fileId/previewers` → `{ previewers }`: the
@@ -39,7 +47,7 @@ let FilePreviewersController = class FilePreviewersController {
         const p = requireUser(principal);
         return { previewers: await this.previewers.forFile(org.orgId, id, p.account.id, fileId) };
     }
-    async preview(principal, org, id, fileId, plugin, previewerId, q) {
+    async preview(principal, org, id, fileId, { plugin, previewerId }, q) {
         const p = requireUser(principal);
         const view = await this.previewers.render({
             orgId: org.orgId,
@@ -82,9 +90,8 @@ __decorate([
     __param(1, CurrentOrg()),
     __param(2, Param("id")),
     __param(3, Param("fileId")),
-    __param(4, Param("plugin", new ZodPipe(Id))),
-    __param(5, Param("previewerId", new ZodPipe(Id))),
-    __param(6, Query(new ZodPipe(PreviewQuery)))
+    __param(4, ZParam(FilePreviewParamsDto)),
+    __param(5, ZQuery(FilePreviewQueryDto))
 ], FilePreviewersController.prototype, "preview", null);
 __decorate([
     Get("file-previewers"),
@@ -96,10 +103,10 @@ __decorate([
     OrgAction("org.extensions.manage"),
     __param(0, CurrentOrg()),
     __param(1, CurrentPrincipal()),
-    __param(2, Body(new ZodPipe(OrderBody)))
+    __param(2, ZBody(FilePreviewersOrderBodyDto))
 ], FilePreviewersController.prototype, "put", null);
 FilePreviewersController = __decorate([
     Controller("api/v1/orgs/:orgId"),
-    __param(0, Inject(FILE_PREVIEWERS))
+    __param(0, Inject(PreviewerRegistry))
 ], FilePreviewersController);
 export { FilePreviewersController };

package/dist/files/previewers.d.ts

@@ -1,8 +1,10 @@
 import { type FilePreviewer, type Logger, type UiView } from "@capybara-hq/plugin-sdk";
-import type { ConversationFiles } from "../conversations/files.js";
-import type { KernelDb } from "../db/kernel-schema.js";
-import type { ExtensionHost } from "../extensions/host.js";
-import type { StorageService } from "../storage/storage.service.js";
+import { ConversationFiles } from "../conversations/files.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
+import { ExtensionHost } from "../extensions/host.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { StorageService } from "../storage/storage.service.js";
 /** Time limit of a previewer's render (UI refresh spec §5.3: 10 s on the conversation page). */
 export declare const FILE_PREVIEW_TIMEOUT_MS = 10000;
 /** A previewer that takes a file, as listed for the conversation page. */
@@ -24,29 +26,21 @@ export interface OrgPreviewerItem extends PreviewerItem {
     position: number;
     disabled: boolean;
 }
-export interface PreviewerRegistryDeps {
-    db: KernelDb;
-    host: Pick<ExtensionHost, "list">;
-    /** Extensions enabled in the org (queried every time). */
-    enabledPlugins(orgId: string): Promise<Set<string>>;
-    files: Pick<ConversationFiles, "file">;
-    storage: Pick<StorageService, "kernel">;
-    log: Pick<Logger, "warn">;
-    /** Default {@link FILE_PREVIEW_TIMEOUT_MS}. */
-    timeoutMs?: number;
-}
+/** Optional provider: a view previewer's render time limit (ms) instead of {@link FILE_PREVIEW_TIMEOUT_MS} (tests). */
+export declare const FILE_PREVIEW_TIMEOUT: unique symbol;
 /**
  * `file-preview@1` (UI refresh spec §5.8): which previewers take a file, in the org's order
  * (`capybara.file_previewers` rows first by position, then the rest in provider order; disabled ones
  * dropped; only extensions enabled in the org), and rendering a view previewer through a read grant
  * for that one file (valid only during the call, capped at the previewer's `maxBytes`; the extension
  * never gets a storage key or URL). Providers are validated when they are provided (`ctx.provide`).
- * Not Nest-dependent; no state across requests.
+ * No state across requests.
  */
 export declare class PreviewerRegistry {
-    private readonly d;
+    readonly txHost: TransactionHost;
     private readonly timeoutMs;
-    constructor(d: PreviewerRegistryDeps);
+    private readonly d;
+    constructor(kdb: Pick<KernelDb, "db">, host: Pick<ExtensionHost, "list" | "enabledPlugins">, files: Pick<ConversationFiles, "file">, storage: Pick<StorageService, "kernel">, effective: Pick<EffectiveConfigs, "get">, log: Pick<Logger, "warn">, txHost: TransactionHost, timeoutMs?: number);
     /** Every previewer loaded on this replica, in provider order (load order, then list order). */
     private loaded;
     /** The org's previewers (enabled extensions only) in its order, disabled ones included. */
@@ -67,9 +61,17 @@ export declare class PreviewerRegistry {
     }[], actor?: {
         accountId?: string;
         tokenId?: string;
-    }): Promise<OrgPreviewerItem[]>;
+    }, auditDetail?: Record<string, unknown>): Promise<OrgPreviewerItem[]>;
+    /** Replaces the org's rows of the previewers this replica knows, in one transaction. */
+    private putIn;
     /** Previewers that take this file (viewer must read the conversation), in the org's order. */
     forFile(orgId: string, conversationId: string, viewer: string, fileId: string): Promise<PreviewerItem[]>;
+    /**
+     * The org's enabled previewers that take the file, each with its extension's effective config
+     * for the org. An extension whose effective config is not valid in the org (or cannot be read)
+     * previews nothing there (layering spec A §6): its previewers are left out, so the next one or a
+     * built-in takes the file.
+     */
     private accepting;
     /**
      * Renders a view previewer for one file: 404 `ui.not_found` when it does not take the file (or is