@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.11

package/dist/catalog/upgrade-targets.js

@@ -1,90 +0,0 @@
-import { compareVersions } from "./versions.js";
-/**
- * The deployment's extension for plugin `name`: its install record (`extension_installs`, the
- * deployment's desired package; disabled on the deployment counts as none), else the extension
- * this replica loaded from the startup config; undefined when the deployment runs none (then no
- * upgrade target and no "upgrade pending").
- */
-export async function deployedExtension(db, host, name) {
-    const row = await db
-        .selectFrom("extension_installs")
-        .select(["sha256", "version", "desired_state"])
-        .where("name", "=", name)
-        .executeTakeFirst();
-    if (row) {
-        return row.desired_state === "enabled"
-            ? { sha256: row.sha256, version: row.version }
-            : undefined;
-    }
-    const loaded = host.manifests().find((m) => m.name === name);
-    return loaded ? { sha256: null, version: loaded.version } : undefined;
-}
-const extensionVersionOf = (v) => v.manifest.extension?.manifest.version;
-/** Whether catalog version `v` carries the deployment's extension `d`. */
-export const runsDeployed = (v, d) => d.sha256 !== null
-    ? v.extension_sha256 === d.sha256
-    : v.manifest.extension !== undefined && extensionVersionOf(v) === d.version;
-/**
- * The catalog version an org install of an extension-bearing plugin may move to: the one carrying
- * the deployment's extension, the newest import on ties; undefined when none does.
- */
-export function deploymentTarget(versions, d) {
-    if (d === undefined)
-        return undefined;
-    let best;
-    for (const v of versions) {
-        if (!runsDeployed(v, d))
-            continue;
-        if (best === undefined ||
-            v.imported_at.getTime() > best.imported_at.getTime() ||
-            (v.imported_at.getTime() === best.imported_at.getTime() && compareVersions(v, best) > 0)) {
-            best = v;
-        }
-    }
-    return best;
-}
-/**
- * The upgrade info of org installs (`itemId`, `name`, `version`), keyed by `itemId@version`; reads
- * the items' catalog versions and the deployment's extensions in a few queries.
- */
-export async function upgradeInfo(db, host, installs) {
-    const out = new Map();
-    if (installs.length === 0)
-        return out;
-    const rows = await db
-        .selectFrom("catalog_item_versions")
-        .select(["item_id", "version", "manifest", "extension_sha256", "imported_at"])
-        .where("item_id", "in", [...new Set(installs.map((i) => i.itemId))])
-        .execute();
-    const deployed = new Map();
-    for (const i of installs) {
-        const versions = rows.filter((r) => r.item_id === i.itemId);
-        const current = versions.find((v) => v.version === i.version);
-        if (current && current.manifest.extension !== undefined) {
-            if (!deployed.has(i.name))
-                deployed.set(i.name, await deployedExtension(db, host, i.name));
-            const d = deployed.get(i.name);
-            const target = deploymentTarget(versions, d);
-            out.set(`${i.itemId}@${i.version}`, {
-                upgradeAvailable: target && target.version !== i.version ? target.version : null,
-                deploymentPending: d !== undefined && !runsDeployed(current, d),
-            });
-            continue;
-        }
-        let newest;
-        for (const v of versions) {
-            if (newest === undefined || compareVersions(v, newest) > 0)
-                newest = v;
-        }
-        const newer = newest !== undefined &&
-            newest.version !== i.version &&
-            (current === undefined
-                ? compareVersions(newest.version, i.version) > 0
-                : compareVersions(newest, current) > 0);
-        out.set(`${i.itemId}@${i.version}`, {
-            upgradeAvailable: newer ? newest.version : null,
-            deploymentPending: false,
-        });
-    }
-    return out;
-}

package/dist/conversations/sandbox-status.d.ts

@@ -1,21 +0,0 @@
-import type { SandboxService } from "../sandbox/sandbox.service.js";
-export interface SandboxStatusView {
-    status: "running" | "suspended";
-    lastUsedAt: string;
-}
-export interface ConversationSandboxStatusDeps {
-    sandbox: Pick<SandboxService, "status">;
-    /** 会话可见性（与会话 SSE 流同一判定：`ConversationsService.isAccessible`）。 */
-    isAccessible(orgId: string, conversationId: string, viewerAccountId: string): Promise<boolean>;
-    /** The conversation whose sandbox it works in: a sub-agent's parent, else itself. */
-    sandboxConversationOf(orgId: string, conversationId: string): Promise<string>;
-}
-/**
- * 对话沙箱的状态（网页上下文标签，M5 T11）：会话不可见 → `conversation.not_found`；
- * 没有可用的沙箱（未创建、已销毁、正在创建）→ `sandbox.not_found`（界面显示「未创建」）。
- */
-export declare class ConversationSandboxStatus {
-    private readonly d;
-    constructor(d: ConversationSandboxStatusDeps);
-    get(orgId: string, conversationId: string, viewerAccountId: string): Promise<SandboxStatusView>;
-}

package/dist/conversations/sandbox-status.js

@@ -1,24 +0,0 @@
-import { ApiError } from "../errors.js";
-import { UUID_RE } from "../ui/registry.js";
-/**
- * 对话沙箱的状态（网页上下文标签，M5 T11）：会话不可见 → `conversation.not_found`；
- * 没有可用的沙箱（未创建、已销毁、正在创建）→ `sandbox.not_found`（界面显示「未创建」）。
- */
-export class ConversationSandboxStatus {
-    d;
-    constructor(d) {
-        this.d = d;
-    }
-    async get(orgId, conversationId, viewerAccountId) {
-        if (!UUID_RE.test(conversationId) ||
-            !(await this.d.isAccessible(orgId, conversationId, viewerAccountId))) {
-            throw new ApiError("conversation.not_found", "Conversation not found");
-        }
-        // a sub-agent works in its parent conversation's sandbox (sub-agents spec §10.1)
-        const sandboxConv = await this.d.sandboxConversationOf(orgId, conversationId);
-        const s = await this.d.sandbox.status(orgId, sandboxConv);
-        if (!s)
-            throw new ApiError("sandbox.not_found", "This conversation has no sandbox");
-        return { status: s.status, lastUsedAt: s.lastUsedAt.toISOString() };
-    }
-}

package/dist/extensions/org-config.controller.d.ts

@@ -1,24 +0,0 @@
-import { z } from "zod";
-import { type Principal } from "../identity/principal.js";
-import { type OrgContext } from "../orgs/org.guard.js";
-import type { OrgExtensionConfigs, OrgExtensionView } from "./org-config.js";
-declare const PutBody: z.ZodObject<{
-    enabled: z.ZodOptional<z.ZodBoolean>;
-    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    force: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strict>;
-/**
- * Org-level extension enablement and config (`/api/v1/orgs/:orgId/extensions`); responses echo only
- * non-secret config and whether each secret is set.
- */
-export declare class OrgExtensionConfigsController {
-    private readonly configs;
-    constructor(configs: OrgExtensionConfigs);
-    list(org: OrgContext): Promise<{
-        extensions: OrgExtensionView[];
-    }>;
-    put(principal: Principal, org: OrgContext, extension: string, body: z.infer<typeof PutBody>): Promise<{
-        extension: OrgExtensionView;
-    }>;
-}
-export {};

package/dist/extensions/org-config.controller.js

@@ -1,59 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { Body, Controller, Get, Inject, Param, Put } from "@nestjs/common";
-import { z } from "zod";
-import { ORG_EXTENSION_CONFIGS } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
-import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
-import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
-const PutBody = z
-    .object({
-    enabled: z.boolean().optional(),
-    config: z.record(z.string(), z.unknown()).optional(),
-    force: z.boolean().optional(),
-})
-    .strict();
-/**
- * Org-level extension enablement and config (`/api/v1/orgs/:orgId/extensions`); responses echo only
- * non-secret config and whether each secret is set.
- */
-let OrgExtensionConfigsController = class OrgExtensionConfigsController {
-    configs;
-    constructor(configs) {
-        this.configs = configs;
-    }
-    async list(org) {
-        return { extensions: await this.configs.list(org.orgId) };
-    }
-    async put(principal, org, extension, body) {
-        const p = requireUser(principal);
-        return {
-            extension: await this.configs.put(org.orgId, extension, body, p.account.id, patTokenId(p)),
-        };
-    }
-};
-__decorate([
-    Get(),
-    OrgAction("org.extensions.manage"),
-    __param(0, CurrentOrg())
-], OrgExtensionConfigsController.prototype, "list", null);
-__decorate([
-    Put(":extension"),
-    OrgAction("org.extensions.manage"),
-    __param(0, CurrentPrincipal()),
-    __param(1, CurrentOrg()),
-    __param(2, Param("extension")),
-    __param(3, Body(new ZodPipe(PutBody)))
-], OrgExtensionConfigsController.prototype, "put", null);
-OrgExtensionConfigsController = __decorate([
-    Controller("api/v1/orgs/:orgId/extensions"),
-    __param(0, Inject(ORG_EXTENSION_CONFIGS))
-], OrgExtensionConfigsController);
-export { OrgExtensionConfigsController };

package/dist/http/gateway.module.js

@@ -1,13 +0,0 @@
-import { registerChannelWebhookRoute } from "../channels/webhook.controller.js";
-/**
- * Registers the gateway role's HTTP routes (`serveGateway = roles.includes("gateway")`): today the
- * channel webhook. These are raw Fastify routes, not a Nest module, so the API's global guard and
- * CSRF check do not apply (P-4); each route does its own (plugin-side) verification.
- */
-export async function registerGatewayRoutes(fastify, routes, log) {
-    await registerChannelWebhookRoute(fastify, {
-        webhooks: routes.webhooks,
-        maxBodyBytes: routes.webhookMaxBodyBytes,
-        log,
-    });
-}

package/dist/http/health.controller.d.ts

@@ -1,26 +0,0 @@
-import type { Logger } from "@capybara-hq/plugin-sdk";
-import type { FastifyReply } from "fastify";
-/** 一项就绪检查：成功 resolve，失败 reject。 */
-export type ReadinessCheck = () => Promise<void>;
-/** 健康检查参数。 */
-export interface HealthOptions {
-    checks: Record<string, ReadinessCheck>;
-    isStopping: () => boolean;
-    log: Logger;
-    /** 单项检查超时，默认 2s。 */
-    timeoutMs?: number;
-}
-/**
- * `GET /healthz`（进程存活，恒 200）与 `GET /readyz`（依赖就绪）。
- * readyz 的 body 只给出每项检查的 `"ok"` / `"error"`，失败原因只进日志（已打码），不进响应——
- * 驱动的错误信息可能带连接串。停机开始后 readyz 立即 503，不再执行检查。
- * 标为 `@Public()`：挂载内核 API 时全局 AuthGuard 也作用于这里。
- */
-export declare class HealthController {
-    private readonly opts;
-    constructor(opts: HealthOptions);
-    healthz(): {
-        ok: true;
-    };
-    readyz(reply: FastifyReply): Promise<Record<string, unknown>>;
-}

package/dist/http/health.controller.js

@@ -1,79 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { Controller, Get, Inject, Res } from "@nestjs/common";
-import { Public } from "../identity/principal.js";
-import { HEALTH_OPTIONS } from "./tokens.js";
-/** 单项检查的超时：依赖挂起（如 Redis 正在重连、命令进了离线队列）时也要尽快给出 503。 */
-const CHECK_TIMEOUT_MS = 2_000;
-function withTimeout(p, ms) {
-    let timer;
-    const timeout = new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error(`timed out after ${ms}ms`)), ms);
-        timer.unref();
-    });
-    return Promise.race([p, timeout]).finally(() => clearTimeout(timer));
-}
-/**
- * `GET /healthz`（进程存活，恒 200）与 `GET /readyz`（依赖就绪）。
- * readyz 的 body 只给出每项检查的 `"ok"` / `"error"`，失败原因只进日志（已打码），不进响应——
- * 驱动的错误信息可能带连接串。停机开始后 readyz 立即 503，不再执行检查。
- * 标为 `@Public()`：挂载内核 API 时全局 AuthGuard 也作用于这里。
- */
-let HealthController = class HealthController {
-    opts;
-    constructor(opts) {
-        this.opts = opts;
-    }
-    healthz() {
-        return { ok: true };
-    }
-    async readyz(reply) {
-        const { opts } = this;
-        const stopping = () => {
-            reply.code(503);
-            return { ok: false, stopping: true };
-        };
-        if (opts.isStopping())
-            return stopping();
-        const timeoutMs = opts.timeoutMs ?? CHECK_TIMEOUT_MS;
-        const names = Object.keys(opts.checks);
-        const results = await Promise.allSettled(names.map((n) => withTimeout(opts.checks[n](), timeoutMs)));
-        const body = {};
-        let ok = true;
-        results.forEach((r, i) => {
-            const name = names[i];
-            if (r.status === "fulfilled") {
-                body[name] = "ok";
-            }
-            else {
-                ok = false;
-                body[name] = "error";
-                opts.log.warn("readiness check failed", { check: name, err: r.reason });
-            }
-        });
-        if (opts.isStopping())
-            return stopping();
-        reply.code(ok ? 200 : 503);
-        return { ok, ...body };
-    }
-};
-__decorate([
-    Get("healthz")
-], HealthController.prototype, "healthz", null);
-__decorate([
-    Get("readyz"),
-    __param(0, Res({ passthrough: true }))
-], HealthController.prototype, "readyz", null);
-HealthController = __decorate([
-    Controller(),
-    Public(),
-    __param(0, Inject(HEALTH_OPTIONS))
-], HealthController);
-export { HealthController };

package/dist/http/tokens.d.ts

@@ -1,131 +0,0 @@
-/** 内核 logger（`Logger`）的注入令牌。 */
-export declare const KERNEL_LOG: unique symbol;
-/** 健康检查参数（`HealthOptions`）的注入令牌。 */
-export declare const HEALTH_OPTIONS: unique symbol;
-/** 内核 schema 视图（`KernelDb`）的注入令牌。 */
-export declare const KERNEL_DB: unique symbol;
-/** 内核共享 Redis 连接（ioredis `Redis`）的注入令牌。 */
-export declare const KERNEL_REDIS: unique symbol;
-/** 当前配置的取值函数（`() => KernelConfig`，热更新后返回新配置）的注入令牌。 */
-export declare const KERNEL_CONFIG: unique symbol;
-/** `AccountsService` 的注入令牌。 */
-export declare const ACCOUNTS: unique symbol;
-/** `SessionService` 的注入令牌。 */
-export declare const SESSIONS: unique symbol;
-/** `ApiTokenService` 的注入令牌。 */
-export declare const API_TOKENS: unique symbol;
-/** `SettingsService` 的注入令牌。 */
-export declare const SETTINGS: unique symbol;
-/** `LoginRateLimiter` 的注入令牌。 */
-export declare const RATE_LIMITER: unique symbol;
-/** `OrgsService` 的注入令牌。 */
-export declare const ORGS: unique symbol;
-/** `OrgSettingsService`（组织设置）的注入令牌。 */
-export declare const ORG_SETTINGS: unique symbol;
-/** `MembersService` 的注入令牌。 */
-export declare const MEMBERS: unique symbol;
-/** `InvitationsService` 的注入令牌。 */
-export declare const INVITATIONS: unique symbol;
-/** `SetupService` 的注入令牌。 */
-export declare const SETUP: unique symbol;
-/** Injection token for `OrgExtensionConfigs`. */
-export declare const ORG_EXTENSION_CONFIGS: unique symbol;
-/** `ProviderRegistry` 的注入令牌。 */
-export declare const PROVIDER_REGISTRY: unique symbol;
-/** `AgentsService` 的注入令牌。 */
-export declare const AGENTS: unique symbol;
-/** `AgentTemplatesService` (agent templates from plugins). */
-export declare const AGENT_TEMPLATES: unique symbol;
-/** 内核总线（`createBus(..., "kernel")`，`ExtensionContext["bus"]`）的注入令牌。 */
-export declare const KERNEL_BUS: unique symbol;
-/** `EventLog` 的注入令牌。 */
-export declare const EVENT_LOG: unique symbol;
-/** `ConversationsService` 的注入令牌。 */
-export declare const CONVERSATIONS: unique symbol;
-/** `AttachmentsService`（对话附件）的注入令牌。 */
-export declare const ATTACHMENTS: unique symbol;
-/** `SkillsService`（技能库）的注入令牌。 */
-export declare const SKILLS: unique symbol;
-/** `SkillInvoker` (a person's skill invocation, phase D). */
-export declare const SKILL_INVOKER: unique symbol;
-/** `SkillChangesService`（agent 自写技能与技能变更审批）的注入令牌。 */
-export declare const SKILL_CHANGES: unique symbol;
-/** `InboxService`（收件箱汇总）的注入令牌。 */
-export declare const INBOX: unique symbol;
-/** `ConversationOutputs`（网页读工具输出存档）的注入令牌。 */
-export declare const CONVERSATION_OUTPUTS: unique symbol;
-/** `ConversationArtifacts`（产物下载）的注入令牌。 */
-export declare const CONVERSATION_ARTIFACTS: unique symbol;
-/** `ConversationFiles` (file outputs list and text content, UI refresh B). */
-export declare const CONVERSATION_FILES: unique symbol;
-export declare const FILE_PREVIEWERS: unique symbol;
-/** `ConversationQueue` (queued messages, UI refresh B). */
-export declare const CONVERSATION_QUEUE: unique symbol;
-/** `ConversationSandboxStatus`（对话沙箱状态）的注入令牌。 */
-export declare const CONVERSATION_SANDBOX: unique symbol;
-/** `ConversationToolInfo` (tool titles, kinds and key arguments for the conversation page). */
-export declare const CONVERSATION_TOOLS: unique symbol;
-/** `ConversationStreams`（本进程持有的会话 SSE 连接）的注入令牌。 */
-export declare const CONVERSATION_STREAMS: unique symbol;
-/** 连接器凭据（`Credentials`）的注入令牌。 */
-export declare const CREDENTIALS: unique symbol;
-/** `ToolRegistry` 的注入令牌。 */
-export declare const TOOL_REGISTRY: unique symbol;
-/** `ConnectorsService` 的注入令牌。 */
-export declare const CONNECTORS: unique symbol;
-/** `ConnectorContent`（连接器的 prompts / resources，供斜杠命令与 @ 引用）的注入令牌。 */
-export declare const CONNECTOR_CONTENT: unique symbol;
-/** `ApprovalsService`（工具调用审批与授权）的注入令牌。 */
-export declare const APPROVALS: unique symbol;
-/** `QuestionsService`（工具调用的输入请求）的注入令牌。 */
-export declare const QUESTIONS: unique symbol;
-/** `OAuthFlow`（OAuth 授权码连接流程）的注入令牌。 */
-export declare const OAUTH_FLOW: unique symbol;
-/** `ExternalIdentities`（外部身份 ↔ 账号）的注入令牌。 */
-export declare const EXTERNAL_IDENTITIES: unique symbol;
-/** `IdentityBinding`（IM 身份的一次性绑定链接）的注入令牌。 */
-export declare const IDENTITY_BINDING: unique symbol;
-/** `SsoFlow`（第三方登录）的注入令牌。 */
-export declare const SSO_FLOW: unique symbol;
-/** `Offboarding`（成员离职处理）的注入令牌。 */
-export declare const OFFBOARDING: unique symbol;
-/** `ChannelConnections`（组织的渠道连接）的注入令牌。 */
-export declare const CHANNEL_CONNECTIONS: unique symbol;
-/** `DirectorySync`（通讯录同步）的注入令牌。 */
-export declare const DIRECTORY_SYNC: unique symbol;
-/** `UiViews`（插件视图：列出贡献、render / action）的注入令牌。 */
-export declare const UI_VIEWS: unique symbol;
-/** `EmbedTokens`（嵌入应用的短期令牌，签发 / 校验）的注入令牌。 */
-export declare const EMBED_TOKENS: unique symbol;
-/** `OrgUiStreams`（组织级界面刷新 SSE）的注入令牌。 */
-export declare const ORG_UI_STREAMS: unique symbol;
-/** `PricesService`（模型价格表）的注入令牌。 */
-export declare const PRICES: unique symbol;
-/** `TrajectoryService`（轨迹查看器）的注入令牌。 */
-export declare const TRAJECTORIES: unique symbol;
-/** `EvalSetsService`（评测集与用例）的注入令牌。 */
-export declare const EVAL_SETS: unique symbol;
-/** `EvalRunsService`（评测运行）的注入令牌。 */
-export declare const EVAL_RUNS: unique symbol;
-/** `ModelPurposesService`（模型用途映射）的注入令牌。 */
-export declare const MODEL_PURPOSES: unique symbol;
-/** Injection token for `ExtensionInstalls` (extension package imports and install records). */
-export declare const EXTENSION_INSTALLS: unique symbol;
-/** Injection token for `ExtensionAdmin` (deployment-level extension list, status and web approval, enterprise admins). */
-export declare const EXTENSION_ADMIN: unique symbol;
-/** Deployment-level extension install / enable / disable / uninstall (`ExtensionAdminOps`). */
-export declare const EXTENSION_ADMIN_OPS: unique symbol;
-/** Deployment-level extension config (`ExtensionDeploymentConfigService`). */
-export declare const EXTENSION_DEPLOYMENT_CONFIGS: unique symbol;
-/** The enterprise catalog (`CatalogService`). */
-export declare const CATALOG: unique symbol;
-/** Plugin (app bundle) import: prepare / confirm and staging cleanup (`PluginImport`). */
-export declare const PLUGIN_IMPORT: unique symbol;
-/** Marketplaces (`MarketplacesService`). */
-export declare const MARKETPLACES: unique symbol;
-/** Organizations browse and install from the enterprise catalog (`OrgCatalogService`). */
-export declare const ORG_CATALOG: unique symbol;
-/** Catalog requests and approvals (`CatalogRequestsService`). */
-export declare const CATALOG_REQUESTS: unique symbol;
-/** Org install and uninstall of plugins (app bundles) (`PluginInstaller`). */
-export declare const PLUGIN_INSTALLER: unique symbol;

package/dist/http/tokens.js

@@ -1,131 +0,0 @@
-/** 内核 logger（`Logger`）的注入令牌。 */
-export const KERNEL_LOG = Symbol("KERNEL_LOG");
-/** 健康检查参数（`HealthOptions`）的注入令牌。 */
-export const HEALTH_OPTIONS = Symbol("HEALTH_OPTIONS");
-/** 内核 schema 视图（`KernelDb`）的注入令牌。 */
-export const KERNEL_DB = Symbol("KERNEL_DB");
-/** 内核共享 Redis 连接（ioredis `Redis`）的注入令牌。 */
-export const KERNEL_REDIS = Symbol("KERNEL_REDIS");
-/** 当前配置的取值函数（`() => KernelConfig`，热更新后返回新配置）的注入令牌。 */
-export const KERNEL_CONFIG = Symbol("KERNEL_CONFIG");
-/** `AccountsService` 的注入令牌。 */
-export const ACCOUNTS = Symbol("ACCOUNTS");
-/** `SessionService` 的注入令牌。 */
-export const SESSIONS = Symbol("SESSIONS");
-/** `ApiTokenService` 的注入令牌。 */
-export const API_TOKENS = Symbol("API_TOKENS");
-/** `SettingsService` 的注入令牌。 */
-export const SETTINGS = Symbol("SETTINGS");
-/** `LoginRateLimiter` 的注入令牌。 */
-export const RATE_LIMITER = Symbol("RATE_LIMITER");
-/** `OrgsService` 的注入令牌。 */
-export const ORGS = Symbol("ORGS");
-/** `OrgSettingsService`（组织设置）的注入令牌。 */
-export const ORG_SETTINGS = Symbol("ORG_SETTINGS");
-/** `MembersService` 的注入令牌。 */
-export const MEMBERS = Symbol("MEMBERS");
-/** `InvitationsService` 的注入令牌。 */
-export const INVITATIONS = Symbol("INVITATIONS");
-/** `SetupService` 的注入令牌。 */
-export const SETUP = Symbol("SETUP");
-/** Injection token for `OrgExtensionConfigs`. */
-export const ORG_EXTENSION_CONFIGS = Symbol("ORG_EXTENSION_CONFIGS");
-/** `ProviderRegistry` 的注入令牌。 */
-export const PROVIDER_REGISTRY = Symbol("PROVIDER_REGISTRY");
-/** `AgentsService` 的注入令牌。 */
-export const AGENTS = Symbol("AGENTS");
-/** `AgentTemplatesService` (agent templates from plugins). */
-export const AGENT_TEMPLATES = Symbol("AGENT_TEMPLATES");
-/** 内核总线（`createBus(..., "kernel")`，`ExtensionContext["bus"]`）的注入令牌。 */
-export const KERNEL_BUS = Symbol("KERNEL_BUS");
-/** `EventLog` 的注入令牌。 */
-export const EVENT_LOG = Symbol("EVENT_LOG");
-/** `ConversationsService` 的注入令牌。 */
-export const CONVERSATIONS = Symbol("CONVERSATIONS");
-/** `AttachmentsService`（对话附件）的注入令牌。 */
-export const ATTACHMENTS = Symbol("ATTACHMENTS");
-/** `SkillsService`（技能库）的注入令牌。 */
-export const SKILLS = Symbol("SKILLS");
-/** `SkillInvoker` (a person's skill invocation, phase D). */
-export const SKILL_INVOKER = Symbol("SKILL_INVOKER");
-/** `SkillChangesService`（agent 自写技能与技能变更审批）的注入令牌。 */
-export const SKILL_CHANGES = Symbol("SKILL_CHANGES");
-/** `InboxService`（收件箱汇总）的注入令牌。 */
-export const INBOX = Symbol("INBOX");
-/** `ConversationOutputs`（网页读工具输出存档）的注入令牌。 */
-export const CONVERSATION_OUTPUTS = Symbol("CONVERSATION_OUTPUTS");
-/** `ConversationArtifacts`（产物下载）的注入令牌。 */
-export const CONVERSATION_ARTIFACTS = Symbol("CONVERSATION_ARTIFACTS");
-/** `ConversationFiles` (file outputs list and text content, UI refresh B). */
-export const CONVERSATION_FILES = Symbol("CONVERSATION_FILES");
-export const FILE_PREVIEWERS = Symbol("FILE_PREVIEWERS");
-/** `ConversationQueue` (queued messages, UI refresh B). */
-export const CONVERSATION_QUEUE = Symbol("CONVERSATION_QUEUE");
-/** `ConversationSandboxStatus`（对话沙箱状态）的注入令牌。 */
-export const CONVERSATION_SANDBOX = Symbol("CONVERSATION_SANDBOX");
-/** `ConversationToolInfo` (tool titles, kinds and key arguments for the conversation page). */
-export const CONVERSATION_TOOLS = Symbol("CONVERSATION_TOOLS");
-/** `ConversationStreams`（本进程持有的会话 SSE 连接）的注入令牌。 */
-export const CONVERSATION_STREAMS = Symbol("CONVERSATION_STREAMS");
-/** 连接器凭据（`Credentials`）的注入令牌。 */
-export const CREDENTIALS = Symbol("CREDENTIALS");
-/** `ToolRegistry` 的注入令牌。 */
-export const TOOL_REGISTRY = Symbol("TOOL_REGISTRY");
-/** `ConnectorsService` 的注入令牌。 */
-export const CONNECTORS = Symbol("CONNECTORS");
-/** `ConnectorContent`（连接器的 prompts / resources，供斜杠命令与 @ 引用）的注入令牌。 */
-export const CONNECTOR_CONTENT = Symbol("CONNECTOR_CONTENT");
-/** `ApprovalsService`（工具调用审批与授权）的注入令牌。 */
-export const APPROVALS = Symbol("APPROVALS");
-/** `QuestionsService`（工具调用的输入请求）的注入令牌。 */
-export const QUESTIONS = Symbol("QUESTIONS");
-/** `OAuthFlow`（OAuth 授权码连接流程）的注入令牌。 */
-export const OAUTH_FLOW = Symbol("OAUTH_FLOW");
-/** `ExternalIdentities`（外部身份 ↔ 账号）的注入令牌。 */
-export const EXTERNAL_IDENTITIES = Symbol("EXTERNAL_IDENTITIES");
-/** `IdentityBinding`（IM 身份的一次性绑定链接）的注入令牌。 */
-export const IDENTITY_BINDING = Symbol("IDENTITY_BINDING");
-/** `SsoFlow`（第三方登录）的注入令牌。 */
-export const SSO_FLOW = Symbol("SSO_FLOW");
-/** `Offboarding`（成员离职处理）的注入令牌。 */
-export const OFFBOARDING = Symbol("OFFBOARDING");
-/** `ChannelConnections`（组织的渠道连接）的注入令牌。 */
-export const CHANNEL_CONNECTIONS = Symbol("CHANNEL_CONNECTIONS");
-/** `DirectorySync`（通讯录同步）的注入令牌。 */
-export const DIRECTORY_SYNC = Symbol("DIRECTORY_SYNC");
-/** `UiViews`（插件视图：列出贡献、render / action）的注入令牌。 */
-export const UI_VIEWS = Symbol("UI_VIEWS");
-/** `EmbedTokens`（嵌入应用的短期令牌，签发 / 校验）的注入令牌。 */
-export const EMBED_TOKENS = Symbol("EMBED_TOKENS");
-/** `OrgUiStreams`（组织级界面刷新 SSE）的注入令牌。 */
-export const ORG_UI_STREAMS = Symbol("ORG_UI_STREAMS");
-/** `PricesService`（模型价格表）的注入令牌。 */
-export const PRICES = Symbol("PRICES");
-/** `TrajectoryService`（轨迹查看器）的注入令牌。 */
-export const TRAJECTORIES = Symbol("TRAJECTORIES");
-/** `EvalSetsService`（评测集与用例）的注入令牌。 */
-export const EVAL_SETS = Symbol("EVAL_SETS");
-/** `EvalRunsService`（评测运行）的注入令牌。 */
-export const EVAL_RUNS = Symbol("EVAL_RUNS");
-/** `ModelPurposesService`（模型用途映射）的注入令牌。 */
-export const MODEL_PURPOSES = Symbol("MODEL_PURPOSES");
-/** Injection token for `ExtensionInstalls` (extension package imports and install records). */
-export const EXTENSION_INSTALLS = Symbol("EXTENSION_INSTALLS");
-/** Injection token for `ExtensionAdmin` (deployment-level extension list, status and web approval, enterprise admins). */
-export const EXTENSION_ADMIN = Symbol("EXTENSION_ADMIN");
-/** Deployment-level extension install / enable / disable / uninstall (`ExtensionAdminOps`). */
-export const EXTENSION_ADMIN_OPS = Symbol("EXTENSION_ADMIN_OPS");
-/** Deployment-level extension config (`ExtensionDeploymentConfigService`). */
-export const EXTENSION_DEPLOYMENT_CONFIGS = Symbol("EXTENSION_DEPLOYMENT_CONFIGS");
-/** The enterprise catalog (`CatalogService`). */
-export const CATALOG = Symbol("CATALOG");
-/** Plugin (app bundle) import: prepare / confirm and staging cleanup (`PluginImport`). */
-export const PLUGIN_IMPORT = Symbol("PLUGIN_IMPORT");
-/** Marketplaces (`MarketplacesService`). */
-export const MARKETPLACES = Symbol("MARKETPLACES");
-/** Organizations browse and install from the enterprise catalog (`OrgCatalogService`). */
-export const ORG_CATALOG = Symbol("ORG_CATALOG");
-/** Catalog requests and approvals (`CatalogRequestsService`). */
-export const CATALOG_REQUESTS = Symbol("CATALOG_REQUESTS");
-/** Org install and uninstall of plugins (app bundles) (`PluginInstaller`). */
-export const PLUGIN_INSTALLER = Symbol("PLUGIN_INSTALLER");

package/dist/http/zod.pipe.d.ts

@@ -1,8 +0,0 @@
-import type { PipeTransform } from "@nestjs/common";
-import type { z } from "zod";
-/** 用 Zod schema 校验请求参数（通常是 body）；失败抛 `validation_failed`，details 逐条给出路径与原因。 */
-export declare class ZodPipe<S extends z.ZodType> implements PipeTransform<unknown, z.infer<S>> {
-    private readonly schema;
-    constructor(schema: S);
-    transform(value: unknown): z.infer<S>;
-}

package/dist/http/zod.pipe.js

@@ -1,14 +0,0 @@
-import { ApiError } from "../errors.js";
-/** 用 Zod schema 校验请求参数（通常是 body）；失败抛 `validation_failed`，details 逐条给出路径与原因。 */
-export class ZodPipe {
-    schema;
-    constructor(schema) {
-        this.schema = schema;
-    }
-    transform(value) {
-        const r = this.schema.safeParse(value);
-        if (r.success)
-            return r.data;
-        throw new ApiError("validation_failed", "Request validation failed", r.error.issues.map((i) => ({ path: i.path.map(String).join("."), message: i.message })));
-    }
-}

package/dist/identity/enterprise-admin.d.ts

@@ -1,14 +0,0 @@
-import { type Transaction } from "kysely";
-import type { KernelDatabase } from "../db/kernel-schema.js";
-/**
- * 在调用方事务内取 `capybara.enterprise_admins` 咨询锁（事务结束释放），串行化所有企业管理员写操作
- * （撤销 / 停用 / 新建管理员 / 改部署设置 / CLI 的 `capybara admin grant|revoke`）。只加锁、不鉴权：
- * 没有发起账号的调用方（CLI）用它；有发起账号的用 {@link lockEnterpriseAdminsAndAuthorize}。
- */
-export declare function lockEnterpriseAdmins(trx: Transaction<KernelDatabase>): Promise<void>;
-/**
- * 企业管理员写操作的执行期复核（spec 3.6 R5）：{@link lockEnterpriseAdmins} 后在锁内实时确认发起人仍是
- * 活跃企业管理员，否则 `forbidden`。鉴权守卫在请求开头读到的身份可能已过期（另一个管理员刚撤销了他），
- * 必须在锁内重读。
- */
-export declare function lockEnterpriseAdminsAndAuthorize(trx: Transaction<KernelDatabase>, actorAccountId: string): Promise<void>;