@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.10

package/dist/orgs/members.service.js

@@ -1,6 +1,21 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { lockOrg, lockOrgAndAuthorize } from "./org-lock.js";
+import { afterCommit } from "../infra/database/after-commit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { Offboarding } from "./offboarding.js";
+import { OrgLock } from "./org-lock.js";
 /**
  * 账号是不是某个组织的匿名访客（`org_anonymous_accounts`）。匿名访客没有登录方式，只能以 guest 身份
  * 代表 IM 里未绑定的人：不能被授予别的角色、成为 owner、指派为 agent 负责人、加入别的组织或被移出。
@@ -22,14 +37,18 @@ export async function rejectAnonymousGuest(db, accountId) {
 /**
  * 成员服务。发起人只传账号 id，角色由服务在组织行锁内实时读取，调用方无法传入过期角色。所有写操作在事务内先 `SELECT … FROM orgs WHERE id = $1 FOR NO KEY UPDATE`，
  * 把同一组织的成员变更串行化（多副本下两个 owner 并发互相降级也恰好剩一个 owner）。
- * 框架无关，由调用方注入 db。
  */
-export class MembersService {
+let MembersService = class MembersService {
     db;
+    txHost;
+    orgLock;
     offboarding;
-    /** `offboarding`：移出与离开走的离职处理（内核用 `Kernel.identity.offboarding`）。 */
-    constructor(db, offboarding) {
+    constructor(db, txHost, orgLock, 
+    /** Removing and leaving go through offboarding. */
+    offboarding) {
         this.db = db;
+        this.txHost = txHost;
+        this.orgLock = orgLock;
         this.offboarding = offboarding;
     }
     async list(orgId) {
@@ -61,33 +80,30 @@ export class MembersService {
     /**
      * 加入成员（邀请接受等，手动加入的唯一入口）；已是成员 → `member.already_exists`；匿名访客 → `member.anonymous_guest`。
      * 同一事务删除此人在该组织的通讯录排除（Ruling A20：手动重新加入后，通讯录同步恢复照常管理此人）。
-     * `actorAccountId` 仅用于审计。
+     * `actorAccountId` 仅用于审计。In the caller's transaction when there is one.
      */
-    async add(orgId, accountId, role, actorAccountId, trx) {
-        const run = async (t) => {
-            await lockOrg(t, orgId);
-            await rejectAnonymousGuest(t, accountId);
-            if (await this.roleIn(t, orgId, accountId)) {
-                throw new ApiError("member.already_exists", "Account is already a member");
-            }
-            await t
-                .insertInto("memberships")
-                .values({ org_id: orgId, account_id: accountId, role })
-                .execute();
-            await t
-                .deleteFrom("directory_exclusions")
-                .where("org_id", "=", orgId)
-                .where("account_id", "=", accountId)
-                .execute();
-            await audit(t, {
-                actorAccountId,
-                orgId,
-                action: "org.member.added",
-                target: accountId,
-                detail: { role },
-            });
-        };
-        return trx ? run(trx) : this.db.transaction().execute(run);
+    async add(orgId, accountId, role, actorAccountId) {
+        await this.orgLock.lock(orgId);
+        await rejectAnonymousGuest(this.db.db, accountId);
+        if (await this.roleIn(orgId, accountId)) {
+            throw new ApiError("member.already_exists", "Account is already a member");
+        }
+        await this.db
+            .insertInto("memberships")
+            .values({ org_id: orgId, account_id: accountId, role })
+            .execute();
+        await this.db
+            .deleteFrom("directory_exclusions")
+            .where("org_id", "=", orgId)
+            .where("account_id", "=", accountId)
+            .execute();
+        await audit(this.db.db, {
+            actorAccountId,
+            orgId,
+            action: "org.member.added",
+            target: accountId,
+            detail: { role },
+        });
     }
     /**
      * 改角色：授予或撤销 owner、或改动一个 owner，只有 owner 能做（`org.owner_required`）；
@@ -96,25 +112,26 @@ export class MembersService {
      * 目标是匿名访客 → `member.anonymous_guest`。
      */
     async changeRole(orgId, targetId, role, actorAccountId, actorTokenId) {
-        await this.db.transaction().execute(async (t) => {
-            const { role: actorRole } = await lockOrgAndAuthorize(t, orgId, actorAccountId, "org.members.manage");
-            const before = await this.requireMember(t, orgId, targetId);
-            await rejectAnonymousGuest(t, targetId);
-            if ((role === "owner" || before === "owner") && actorRole !== "owner") {
-                throw new ApiError("org.owner_required", "Only an owner can change owner roles");
-            }
-            if (before === role)
-                return;
-            await this.setRole(t, orgId, targetId, role);
-            await this.assertHasOwner(t, orgId);
-            await audit(t, {
-                actorAccountId,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-                orgId,
-                action: "org.member.role_changed",
-                target: targetId,
-                detail: { from: before, to: role },
-            });
+        await this.changeRoleIn(orgId, targetId, role, actorAccountId, actorTokenId);
+    }
+    async changeRoleIn(orgId, targetId, role, actorAccountId, actorTokenId) {
+        const { role: actorRole } = await this.orgLock.lockAndAuthorize(orgId, actorAccountId, "org.members.manage");
+        const before = await this.requireMember(orgId, targetId);
+        await rejectAnonymousGuest(this.db.db, targetId);
+        if ((role === "owner" || before === "owner") && actorRole !== "owner") {
+            throw new ApiError("org.owner_required", "Only an owner can change owner roles");
+        }
+        if (before === role)
+            return;
+        await this.setRole(orgId, targetId, role);
+        await this.assertHasOwner(orgId);
+        await audit(this.db.db, {
+            actorAccountId,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            orgId,
+            action: "org.member.role_changed",
+            target: targetId,
+            detail: { from: before, to: role },
         });
     }
     /**
@@ -123,46 +140,49 @@ export class MembersService {
      * 匿名访客不能移出（`member.anonymous_guest`；不再需要匿名访问时把渠道连接改回绑定策略）。
      */
     async remove(orgId, targetId, actorAccountId, actorTokenId) {
-        const r = await this.db.transaction().execute(async (t) => {
-            const { role: actorRole } = await lockOrgAndAuthorize(t, orgId, actorAccountId, "org.members.manage");
-            const before = await this.requireMember(t, orgId, targetId);
-            await rejectAnonymousGuest(t, targetId);
-            if (before === "owner" && actorRole !== "owner") {
-                throw new ApiError("org.owner_required", "Only an owner can remove an owner");
-            }
-            const actor = { actorAccountId, ...(actorTokenId !== undefined && { actorTokenId }) };
-            const res = await this.offboarding.offboard(t, orgId, targetId, "removed", actor);
-            await audit(t, {
-                ...actor,
-                orgId,
-                action: "org.member.removed",
-                target: targetId,
-                detail: { role: before },
-            });
-            return res;
+        await this.removeIn(orgId, targetId, actorAccountId, actorTokenId);
+    }
+    async removeIn(orgId, targetId, actorAccountId, actorTokenId) {
+        const { role: actorRole } = await this.orgLock.lockAndAuthorize(orgId, actorAccountId, "org.members.manage");
+        const before = await this.requireMember(orgId, targetId);
+        await rejectAnonymousGuest(this.db.db, targetId);
+        if (before === "owner" && actorRole !== "owner") {
+            throw new ApiError("org.owner_required", "Only an owner can remove an owner");
+        }
+        const actor = { actorAccountId, ...(actorTokenId !== undefined && { actorTokenId }) };
+        const res = await this.offboarding.offboard(orgId, targetId, "removed", actor);
+        // the markers, events and run stops follow the root commit (none after a rollback)
+        afterCommit(() => this.offboarding.afterOffboard(res));
+        await audit(this.db.db, {
+            ...actor,
+            orgId,
+            action: "org.member.removed",
+            target: targetId,
+            detail: { role: before },
         });
-        await this.offboarding.afterCommit(r);
+        return res;
     }
     /** 主动离开：走离职处理（原因 `left`）；最后一个 owner → `org.last_owner`。 */
     async leave(orgId, accountId, actorTokenId) {
-        const r = await this.db.transaction().execute(async (t) => {
-            await lockOrg(t, orgId);
-            const before = await this.requireMember(t, orgId, accountId);
-            const actor = {
-                actorAccountId: accountId,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-            };
-            const res = await this.offboarding.offboard(t, orgId, accountId, "left", actor);
-            await audit(t, {
-                ...actor,
-                orgId,
-                action: "org.member.left",
-                target: accountId,
-                detail: { role: before },
-            });
-            return res;
+        await this.leaveIn(orgId, accountId, actorTokenId);
+    }
+    async leaveIn(orgId, accountId, actorTokenId) {
+        await this.orgLock.lock(orgId);
+        const before = await this.requireMember(orgId, accountId);
+        const actor = {
+            actorAccountId: accountId,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+        };
+        const res = await this.offboarding.offboard(orgId, accountId, "left", actor);
+        afterCommit(() => this.offboarding.afterOffboard(res));
+        await audit(this.db.db, {
+            ...actor,
+            orgId,
+            action: "org.member.left",
+            target: accountId,
+            detail: { role: before },
         });
-        await this.offboarding.afterCommit(r);
+        return res;
     }
     /**
      * 转让所有权：from 必须是 owner（`org.owner_required`）；to 必须是成员（`member.not_found`）且不是匿名访客
@@ -172,33 +192,34 @@ export class MembersService {
         if (fromAccountId === toAccountId) {
             throw new ApiError("validation_failed", "Cannot transfer ownership to yourself");
         }
-        await this.db.transaction().execute(async (t) => {
-            await lockOrg(t, orgId);
-            const fromRole = await this.roleIn(t, orgId, fromAccountId);
-            if (fromRole !== "owner") {
-                throw new ApiError("org.owner_required", "Only an owner can transfer ownership");
-            }
-            const toRole = await this.requireMember(t, orgId, toAccountId);
-            await rejectAnonymousGuest(t, toAccountId);
-            await this.setRole(t, orgId, toAccountId, "owner");
-            await this.setRole(t, orgId, fromAccountId, "admin");
-            await audit(t, {
-                actorAccountId: fromAccountId,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-                orgId,
-                action: "org.ownership_transferred",
-                target: toAccountId,
-                detail: {
-                    from: fromAccountId,
-                    to: toAccountId,
-                    fromRole: { before: fromRole, after: "admin" },
-                    toRole: { before: toRole, after: "owner" },
-                },
-            });
+        await this.transferIn(orgId, fromAccountId, toAccountId, actorTokenId);
+    }
+    async transferIn(orgId, fromAccountId, toAccountId, actorTokenId) {
+        await this.orgLock.lock(orgId);
+        const fromRole = await this.roleIn(orgId, fromAccountId);
+        if (fromRole !== "owner") {
+            throw new ApiError("org.owner_required", "Only an owner can transfer ownership");
+        }
+        const toRole = await this.requireMember(orgId, toAccountId);
+        await rejectAnonymousGuest(this.db.db, toAccountId);
+        await this.setRole(orgId, toAccountId, "owner");
+        await this.setRole(orgId, fromAccountId, "admin");
+        await audit(this.db.db, {
+            actorAccountId: fromAccountId,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            orgId,
+            action: "org.ownership_transferred",
+            target: toAccountId,
+            detail: {
+                from: fromAccountId,
+                to: toAccountId,
+                fromRole: { before: fromRole, after: "admin" },
+                toRole: { before: toRole, after: "owner" },
+            },
         });
     }
-    async roleIn(t, orgId, accountId) {
-        const r = await t
+    async roleIn(orgId, accountId) {
+        const r = await this.db
             .selectFrom("memberships")
             .select("role")
             .where("org_id", "=", orgId)
@@ -206,22 +227,22 @@ export class MembersService {
             .executeTakeFirst();
         return r?.role;
     }
-    async requireMember(t, orgId, accountId) {
-        const role = await this.roleIn(t, orgId, accountId);
+    async requireMember(orgId, accountId) {
+        const role = await this.roleIn(orgId, accountId);
         if (!role)
             throw new ApiError("member.not_found", "Member not found");
         return role;
     }
-    async setRole(t, orgId, accountId, role) {
-        await t
+    async setRole(orgId, accountId, role) {
+        await this.db
             .updateTable("memberships")
             .set({ role, updated_at: new Date() })
             .where("org_id", "=", orgId)
             .where("account_id", "=", accountId)
             .execute();
     }
-    async assertHasOwner(t, orgId) {
-        const r = await t
+    async assertHasOwner(orgId) {
+        const r = await this.db
             .selectFrom("memberships")
             .select((eb) => eb.fn.countAll().as("n"))
             .where("org_id", "=", orgId)
@@ -231,4 +252,27 @@ export class MembersService {
             throw new ApiError("org.last_owner", "An organization must keep at least one owner");
         }
     }
-}
+};
+__decorate([
+    Transactional()
+], MembersService.prototype, "add", null);
+__decorate([
+    Transactional()
+], MembersService.prototype, "changeRoleIn", null);
+__decorate([
+    Transactional()
+], MembersService.prototype, "removeIn", null);
+__decorate([
+    Transactional()
+], MembersService.prototype, "leaveIn", null);
+__decorate([
+    Transactional()
+], MembersService.prototype, "transferIn", null);
+MembersService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(OrgLock)),
+    __param(3, Inject(Offboarding))
+], MembersService);
+export { MembersService };

package/dist/orgs/offboarding.d.ts

@@ -1,15 +1,16 @@
-import type { Logger } from "@capybara-hq/plugin-sdk";
 import type { Redis } from "ioredis";
-import { type Transaction } from "kysely";
-import type { EventLog } from "../conversations/event-log.js";
-import type { KernelDatabase, KernelDb } from "../db/kernel-schema.js";
-import type { SessionService } from "../identity/sessions.js";
-import type { Maintenance } from "../runtime/maintenance.js";
-import type { ApprovalsService } from "../tools/approvals.service.js";
-import type { Credentials } from "../tools/credentials.js";
-import type { QuestionsService } from "../tools/questions.service.js";
+import { EventLog } from "../conversations/event-log.js";
+import { ExtensionRegistry } from "../extensions/registry.js";
+import { SessionService } from "../identity/sessions.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { LockService } from "../infra/lock/lock.service.js";
+import type { KernelLogger } from "../log.js";
+import { SandboxJobs } from "../sandbox/jobs.js";
+import { ApprovalsService } from "../tools/approvals.service.js";
+import { Credentials } from "../tools/credentials.js";
+import { QuestionsService } from "../tools/questions.service.js";
 import type { OrgRole } from "./roles.js";
-type Trx = Transaction<KernelDatabase>;
 /** 离职原因：管理员移出、本人离开、通讯录同步判定离职。 */
 export type OffboardReason = "removed" | "left" | "directory";
 /** 一个进行中的运行。 */
@@ -18,7 +19,7 @@ export interface InFlightRun {
     runId: string;
     status: "queued" | "running" | "waiting";
 }
-/** 一次离职处理的结果；调用方提交事务后交给 {@link Offboarding.afterCommit}。 */
+/** The result of one offboarding; the caller registers {@link Offboarding.afterOffboard} with the infra `afterCommit`. */
 export interface OffboardResult {
     role: OrgRole;
     /** 在 PG 中被吊销的会话（提交后写 Redis 吊销标记）。 */
@@ -29,8 +30,8 @@ export interface OffboardResult {
     runs: InFlightRun[];
     /** 负责的 agent 转交给的所有者；没有转交时为 null。 */
     newOwnerId: string | null;
-    /** 此人在该组织的对话里还没销毁的沙箱（按对话 id），提交后交给 {@link OffboardingDeps.sandboxes} 销毁。 */
-    sandboxConversations: string[];
+    /** The person's environments in the org, soft-deleted here; destroyed by a job after commit. */
+    environments: string[];
     /** Conversations whose queued messages were deleted (`changed: queue` after commit). */
     queueConversations: string[];
 }
@@ -40,10 +41,8 @@ export interface OffboardingRunControl {
     abortIfOrphaned(conversationId: string, runId: string, byAccountId: string | null): Promise<boolean>;
     requestAbort(runId: string, byAccountId: string | null): Promise<void>;
 }
-/** 兜底扫描：维护队列任务名、job scheduler id（不含 `:`）、周期与每次条数。 */
+/** The safety-net sweep: cron job name (no `:`), every 10 minutes, and the rows per page. */
 export declare const OFFBOARD_SWEEP_JOB = "offboard-sweep";
-export declare const OFFBOARD_SWEEP_SCHEDULER_ID = "offboard-sweep-every-10m";
-export declare const OFFBOARD_SWEEP_EVERY_MS = 600000;
 export declare const OFFBOARD_SWEEP_BATCH = 500;
 /** 一次兜底扫描最多翻的页数（每页 {@link OFFBOARD_SWEEP_BATCH} 条），防止单次任务无限长。 */
 export declare const OFFBOARD_SWEEP_MAX_PAGES = 20;
@@ -51,41 +50,9 @@ export declare const OFFBOARD_SWEEP_MAX_PAGES = 20;
 export declare const OFFBOARD_ABORT_MARK_TTL_SECONDS = 1800;
 /** 「已请求中止」标记（Redis 键）。 */
 export declare const offboardAbortKey: (runId: string) => string;
-export interface OffboardingDeps {
-    credentials: Pick<Credentials, "clearAccount">;
-    approvals: Pick<ApprovalsService, "cancelPendingFor">;
-    questions: Pick<QuestionsService, "cancelPendingFor">;
-    /** 提交后写会话吊销标记（快速路径；鉴权以 PG `revoked_at` 为准）。 */
-    sessions?: Pick<SessionService, "markRevoked">;
-    /** 提交后发布 cancelled 事件。 */
-    eventLog?: Pick<EventLog, "notify"> & Partial<Pick<EventLog, "publishChanged">>;
-    /** 提交后中止此人在该组织进行中的运行（Ruling A7）。 */
-    runs?: OffboardingRunControl;
-    /** 兜底扫描用：读「发起人已不是成员」的进行中运行。 */
-    db?: KernelDb;
-    /** 给了就登记兜底扫描（每 10 分钟，worker 角色执行）。 */
-    maintenance?: Pick<Maintenance, "handle" | "schedule">;
-    log?: Pick<Logger, "warn">;
-    /** 记「已请求中止」标记（提交后的中止与兜底扫描都写；扫描跳过仍带标记的运行）。 */
-    redis?: Pick<Redis, "set" | "exists">;
-    /**
-     * 已加载、提供 `directory@1` 的插件名（Ruling A24：手动移出 / 离开时对其中在该组织启用的每一个写通讯录排除）。
-     * 不给时只按成员关系自身的 `directory:<插件>` 来源写。
-     */
-    directoryPlugins?: () => string[];
-    /** 兜底扫描每页条数（默认 {@link OFFBOARD_SWEEP_BATCH}，测试用）。 */
-    sweepBatch?: number;
-    /**
-     * 提交后销毁此人对话的沙箱（内核投递维护任务，由 worker 逐个 `SandboxService.destroyFor`）。不给时不销毁，
-     * 留给不活跃销毁扫描（`sandbox.limits.destroyAfterInactiveDays`）。
-     */
-    sandboxes?: {
-        destroy(conversationIds: string[]): Promise<void>;
-    };
-}
 /**
  * 成员离职（spec 3.3）：管理员移出、本人离开与通讯录同步共用这一条路径，全部写入在调用方的同一个事务内，
- * 要么都生效要么都不生效。Redis 吊销标记、事件发布与中止进行中的运行是提交后的尽力而为（{@link afterCommit}），
+ * 要么都生效要么都不生效。Redis 吊销标记、事件发布与中止进行中的运行是提交后的尽力而为（{@link afterOffboard}），
  * 漏掉的运行由兜底扫描（{@link sweep}：发起人已不是该组织成员的进行中运行）中止。框架无关。
  *
  * 已接受的窄窗口：离职提交时正在进行的 OAuth token 刷新（`Credentials` 刷新锁内）可能在提交之后把此人的
@@ -93,12 +60,32 @@ export interface OffboardingDeps {
  * 残留的凭据不会被使用；重新加入组织后会被新的连接覆盖。
  */
 export declare class Offboarding {
-    private readonly deps;
-    constructor(deps: OffboardingDeps);
+    private readonly db;
+    readonly txHost: TransactionHost;
+    private readonly sessions;
+    private readonly redis;
+    private readonly registry;
+    private readonly eventLog;
+    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
+    private readonly sandboxJobs;
+    /** Stops the departed member's runs (`by: null`, a system action). */
+    private readonly runs;
+    private readonly credentials;
+    private readonly approvals;
+    private readonly questions;
+    readonly log: KernelLogger;
+    constructor(db: KernelDb, txHost: TransactionHost, sessions: Pick<SessionService, "markRevoked">, redis: Pick<Redis, "set" | "exists">, registry: Pick<ExtensionRegistry, "list">, eventLog: Pick<EventLog, "notify" | "publishChanged">, 
+    /** The departed member's environments: one-off maintenance jobs, destroyed by a worker. */
+    sandboxJobs: Pick<SandboxJobs, "destroy">, 
+    /** Stops the departed member's runs (`by: null`, a system action). */
+    runs: OffboardingRunControl, credentials: Pick<Credentials, "clearAccount">, approvals: Pick<ApprovalsService, "cancelPendingFor">, questions: Pick<QuestionsService, "cancelPendingFor">, log: KernelLogger);
     /**
-     * 在事务 `t` 内（调用方应已锁组织行——顺序：组织行 → 成员关系，并完成「最后一个 owner」等前置检查）：
+     * In the caller's transaction (`mandatory`: the caller holds the org row lock, order org row →
+     * membership, and did the "last owner" checks)：
      * 1. 删除成员关系（非成员 → `member.not_found`；删后组织没有 owner → `org.last_owner`），清空指向该组织的会话当前组织；
-     * 2. 吊销该账号**全部**会话与个人令牌（令牌与会话是账号级的，无法只吊销「该组织下」的，按保守处理）；
+     * 2. Removal and directory offboarding revoke **every** session and personal token of the
+     *    account (both are account-wide, so conservatively all); a person who leaves (`left`) keeps
+     *    them, and the session's current org is cleared (the membership check ends the access);
      * 3. 删除其在该组织所有连接器上的个人凭据；
      * 4. 取消其作为处理人的 pending 审批与提问（写 cancelled 事件），记下此人在该组织进行中的运行（提交后中止）；
      * 5. 其负责的该组织 agent 转给组织所有者（最早加入的 owner）并置 `needs_reassignment = true`；
@@ -108,19 +95,23 @@ export declare class Offboarding {
      *    以及成员关系自身的 `directory:<插件>` 来源，不论此人当初是不是由通讯录加入（手动重新加入后再被移出也不会被同步加回）；
      *    同步不再把此人加回，直到有人手动重新加入（{@link MembersService.add} 删除排除）；
      * 8. 审计 `org.member.offboarded`；
-     * 9. 记下此人在该组织对话里还没销毁的沙箱（提交后销毁，尽力而为）。
+     * 9. Soft-deletes the person's environments in the org and clears their default row (the
+     *    instances and files are destroyed after the commit, best effort; the hourly sweep finishes
+     *    any left).
      */
-    offboard(t: Trx, orgId: string, accountId: string, reason: OffboardReason, actor?: {
+    offboard(orgId: string, accountId: string, reason: OffboardReason, actor?: {
         actorAccountId?: string;
         actorTokenId?: string;
     }): Promise<OffboardResult>;
     /** 要写排除的通讯录插件：该组织启用的已加载通讯录插件 ∪ 成员关系自身的 `directory:<插件>` 来源，去重排序。 */
     private exclusionPlugins;
     /**
-     * 提交之后：写会话吊销标记、发布 cancelled 事件、中止此人在该组织进行中的运行、投递销毁其对话沙箱的任务。
-     * 每步失败只记 warn。
+     * After the commit (callers register it with the infra `afterCommit` inside their transaction):
+     * writes the session revocation markers, publishes the cancelled events, stops the person's
+     * runs in the org and schedules destroying their environments. A failing step only logs a
+     * warning.
      */
-    afterCommit(r: OffboardResult): Promise<void>;
+    afterOffboard(r: OffboardResult): Promise<void>;
     /**
      * 中止一个运行，顺序同会话中止接口：waiting → 直接取消等待并写终态；孤儿 → 直接写终态；
      * 否则经 Redis 广播中止（运行所在副本收到后结束；尚未开始的运行开始时补查中止标记）。失败只记 warn。
@@ -135,7 +126,17 @@ export declare class Offboarding {
      * 不每轮重复广播；标记过期仍未结束的再处理一次。返回本次处理（未跳过）的运行数。
      * 现任成员（含匿名访客这样的 guest 成员）发起的运行不受影响。
      */
-    sweep(): Promise<number>;
+    sweep(batch?: number): Promise<number>;
     private recentlyAborted;
 }
-export {};
+/**
+ * The offboarding safety-net sweep ({@link Offboarding.sweep}) every 10 minutes, once per tick
+ * across replicas; a worker-role job (`WorkerModule`).
+ */
+export declare class OffboardSweepJob {
+    private readonly offboarding;
+    readonly lockService: LockService;
+    readonly log: KernelLogger;
+    constructor(offboarding: Pick<Offboarding, "sweep">, lockService: LockService, log: KernelLogger);
+    run(): Promise<void>;
+}