@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/ui/embed-token.js

@@ -1,4 +1,15 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { createHmac, timingSafeEqual } from "node:crypto";
+import { Inject, Injectable, Module, Optional } from "@nestjs/common";
+import { KEYRING } from "../infra/tokens.js";
 import { ORG_ROLES } from "../orgs/roles.js";
 /** 嵌入令牌的有效期（秒）。网页在过期前 60 秒续期。 */
 export const EMBED_TOKEN_TTL_SECONDS = 300;
@@ -63,23 +74,26 @@ function parseClaims(v) {
         exp: c.exp,
     };
 }
+/** Optional provider: the clock {@link EmbedTokens} issues and checks with (default `Date.now`; tests). */
+export const EMBED_TOKEN_CLOCK = Symbol("EMBED_TOKEN_CLOCK");
 /**
  * 嵌入令牌：`base64url(JSON 声明).base64url(HMAC-SHA256(key, "capybara-embed/1." + 第一段))`。
  * - 格式固定、没有头（没有 alg 可混淆）；密钥由主密钥环经 HKDF 派生，轮换后上一把主密钥签的令牌仍可校验到过期；
  * - 校验：严格 base64url、常量时间比较签名、逐字段核对声明、`exp` 容许 {@link EMBED_TOKEN_SKEW_SECONDS} 秒偏差、
  *   `exp` 不得超过「现在 + 有效期 + 偏差」、`plugin` 必须是调用方插件；任何一项不过都返回 null（不说明原因）。
- * 无状态（不落库、不进 Redis）：各副本用同一主密钥即可校验，不需要共享状态。
+ * 无状态（不落库、不进 Redis）：各副本用同一主密钥即可校验，不需要共享状态。One provider: the UI
+ * routes issue tokens with it and every extension's `ctx` verifies them with it.
  */
-export class EmbedTokens {
+let EmbedTokens = class EmbedTokens {
+    now;
     current;
     keys;
-    now;
-    constructor(keyring, opts = {}) {
+    constructor(keyring, now = Date.now) {
+        this.now = now;
         const derived = keyring.deriveKey(EMBED_KEY_INFO);
         const ids = [derived.currentId, ...keyring.toJSON().previousIds];
         this.current = derived.current;
         this.keys = ids.map((id) => derived.byId(id)).filter((k) => k !== undefined);
-        this.now = opts.now ?? Date.now;
     }
     /** 签发：`exp` = 现在 + {@link EMBED_TOKEN_TTL_SECONDS}。 */
     issue(c) {
@@ -126,7 +140,21 @@ export class EmbedTokens {
             return null;
         return claims;
     }
-}
+};
+EmbedTokens = __decorate([
+    Injectable(),
+    __param(0, Inject(KEYRING)),
+    __param(1, Optional()),
+    __param(1, Inject(EMBED_TOKEN_CLOCK))
+], EmbedTokens);
+export { EmbedTokens };
 function mac(key, payload) {
     return createHmac("sha256", key).update(`${EMBED_KEY_INFO}.${payload}`).digest();
 }
+/** {@link EmbedTokens} on its own: the extension host (`ctx`) and the UI routes import it. */
+let EmbedTokensModule = class EmbedTokensModule {
+};
+EmbedTokensModule = __decorate([
+    Module({ providers: [EmbedTokens], exports: [EmbedTokens] })
+], EmbedTokensModule);
+export { EmbedTokensModule };

package/dist/ui/ui-stream.d.ts

@@ -1,37 +1,42 @@
 import type { Logger } from "@capybara-hq/plugin-sdk";
-import type { KernelConfig } from "../config/schema.js";
-import type { KernelDb } from "../db/kernel-schema.js";
 import type { CredentialCheck } from "../identity/credential-check.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { GracefulShutdown } from "../infra/lifecycle/graceful-shutdown.service.js";
 import { type OrgRole } from "../orgs/roles.js";
-import type { SseOutput, StreamBus, StreamHandle } from "../runtime/stream.js";
-export interface OrgUiStreamsDeps {
-    bus: StreamBus;
-    /**
-     * 调用者此刻的组织角色（组织未删除、账号 active、仍有成员关系，否则 undefined）：
-     * 连接建立时与每 `sseRecheckMs` 复核一次；组织级刷新只服务组织页面，要 member 以上（A38）。
-     */
-    memberRole(orgId: string, accountId: string): Promise<OrgRole | undefined>;
-    config: () => KernelConfig;
-    log: Pick<Logger, "warn">;
-}
+import { type SseOutput, type StreamBus, type StreamHandle } from "../runtime/stream.js";
 export interface OrgUiStreamParams {
     orgId: string;
     viewerAccountId: string;
     credential: CredentialCheck;
 }
-/** 组织成员角色（一条查询）：组织未删除、账号 active、仍有成员关系。 */
-export declare function orgMembership(db: KernelDb): OrgUiStreamsDeps["memberRole"];
+/** The org role the org UI stream re-checks. */
+export declare class UiStreamMembership {
+    private readonly db;
+    constructor(db: KernelDb);
+    /** 组织成员角色（一条查询）：组织未删除、账号 active、仍有成员关系。 */
+    role(orgId: string, accountId: string): Promise<OrgRole | undefined>;
+}
 /**
  * 组织级界面刷新流（SSE）：订阅内核主题 `org-ui.<orgId>`，把插件 `ctx.ui.invalidate`（不带对话）的刷新
  * 转发为 `event: ui`（`data: {"plugin","contribution"}`）。跨副本只经 Redis bus；进程内只持有连接本身的资源
  * （订阅、心跳与复核定时器），停机时一并关闭。
  */
 export declare class OrgUiStreams {
-    private readonly d;
     private readonly active;
-    constructor(d: OrgUiStreamsDeps);
+    /** Set by {@link closeAll}: streams opened afterwards end as soon as they begin. */
+    private closing;
+    private readonly d;
+    /**
+     * Closes the streams when the shutdown begins (readiness answers 503 from that moment) and
+     * latches: streams opened afterwards end at once, so the HTTP phase of the stop never waits on
+     * an event stream. Without `GracefulShutdown` (a standalone HTTP application, tests only) the
+     * streams end with their connections.
+     */
+    constructor(bus: StreamBus, membership: Pick<UiStreamMembership, "role">, config: Pick<KernelConfigService, "get">, log: Pick<Logger, "warn">, shutdown?: Pick<GracefulShutdown, "signal">);
     /** 复核凭据与成员关系并订阅；失败时尚未写响应，调用方按普通错误返回。 */
     open(p: OrgUiStreamParams, out: SseOutput): Promise<StreamHandle>;
+    /** Closes every stream of this process (at shutdown) and latches, like `ConversationStreams`. */
     closeAll(): void;
     get size(): number;
 }

package/dist/ui/ui-stream.js

@@ -1,10 +1,30 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable, Optional } from "@nestjs/common";
 import { ApiError } from "../errors.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { GracefulShutdown } from "../infra/lifecycle/graceful-shutdown.service.js";
+import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
 import { roleAtLeast } from "../orgs/roles.js";
+import { endedStream, } from "../runtime/stream.js";
 import { isUiBusMessage, orgUiTopic, PAGE_MIN_ROLE, uiFrame } from "./registry.js";
-/** 组织成员角色（一条查询）：组织未删除、账号 active、仍有成员关系。 */
-export function orgMembership(db) {
-    return async (orgId, accountId) => {
-        const row = await db
+/** The org role the org UI stream re-checks. */
+let UiStreamMembership = class UiStreamMembership {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** 组织成员角色（一条查询）：组织未删除、账号 active、仍有成员关系。 */
+    async role(orgId, accountId) {
+        const row = await this.db
             .selectFrom("memberships")
             .innerJoin("orgs", "orgs.id", "memberships.org_id")
             .innerJoin("accounts", "accounts.id", "memberships.account_id")
@@ -15,8 +35,13 @@ export function orgMembership(db) {
             .where("accounts.status", "=", "active")
             .executeTakeFirst();
         return row?.role;
-    };
-}
+    }
+};
+UiStreamMembership = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb))
+], UiStreamMembership);
+export { UiStreamMembership };
 async function authorize(d, p) {
     const denied = await p.credential();
     if (denied !== null)
@@ -33,17 +58,36 @@ const MAX_BACKLOG_BYTES = 1024 * 1024;
  * 转发为 `event: ui`（`data: {"plugin","contribution"}`）。跨副本只经 Redis bus；进程内只持有连接本身的资源
  * （订阅、心跳与复核定时器），停机时一并关闭。
  */
-export class OrgUiStreams {
-    d;
+let OrgUiStreams = class OrgUiStreams {
     active = new Set();
-    constructor(d) {
-        this.d = d;
+    /** Set by {@link closeAll}: streams opened afterwards end as soon as they begin. */
+    closing = false;
+    d;
+    /**
+     * Closes the streams when the shutdown begins (readiness answers 503 from that moment) and
+     * latches: streams opened afterwards end at once, so the HTTP phase of the stop never waits on
+     * an event stream. Without `GracefulShutdown` (a standalone HTTP application, tests only) the
+     * streams end with their connections.
+     */
+    constructor(bus, membership, config, log, shutdown) {
+        this.d = {
+            bus,
+            memberRole: (orgId, accountId) => membership.role(orgId, accountId),
+            config,
+            log,
+        };
+        if (shutdown?.signal.aborted)
+            this.closeAll();
+        else
+            shutdown?.signal.addEventListener("abort", () => this.closeAll(), { once: true });
     }
     /** 复核凭据与成员关系并订阅；失败时尚未写响应，调用方按普通错误返回。 */
     async open(p, out) {
         const denied = await authorize(this.d, p);
         if (denied !== null)
             throw new ApiError(denied, "Access denied");
+        if (this.closing)
+            return endedStream(out);
         const conn = new OrgUiConnection(this.d, p, out, () => this.active.delete(conn));
         this.active.add(conn);
         try {
@@ -53,16 +97,32 @@ export class OrgUiStreams {
             conn.close();
             throw e;
         }
+        if (this.closing) {
+            conn.close();
+            return endedStream(out);
+        }
         return conn;
     }
+    /** Closes every stream of this process (at shutdown) and latches, like `ConversationStreams`. */
     closeAll() {
+        this.closing = true;
         for (const c of [...this.active])
             c.close();
     }
     get size() {
         return this.active.size;
     }
-}
+};
+OrgUiStreams = __decorate([
+    Injectable(),
+    __param(0, Inject(KERNEL_BUS)),
+    __param(1, Inject(UiStreamMembership)),
+    __param(2, Inject(KernelConfigService)),
+    __param(3, Inject(KERNEL_LOGGER)),
+    __param(4, Optional()),
+    __param(4, Inject(GracefulShutdown))
+], OrgUiStreams);
+export { OrgUiStreams };
 class OrgUiConnection {
     d;
     p;
@@ -94,7 +154,7 @@ class OrgUiConnection {
         if (this.closed)
             return;
         this.begun = true;
-        const { sseHeartbeatMs, sseRecheckMs } = this.d.config().runtime;
+        const { sseHeartbeatMs, sseRecheckMs } = this.d.config.get().runtime;
         this.timers.push(setInterval(() => this.write(": ping\n\n"), sseHeartbeatMs), setInterval(() => void this.recheck(), sseRecheckMs));
     }
     close(mode = "end") {

package/dist/ui/ui.module.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Extension UI on the kernel side: the views and actions (`ctx.ui`), the embed tokens
+ * ({@link EmbedTokensModule}, re-exported; the extension host verifies them with the same
+ * provider) and the org UI refresh stream.
+ */
+export declare class UiModule {
+}

package/dist/ui/ui.module.js

@@ -0,0 +1,28 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { ConversationsModule } from "../conversations/conversations.module.js";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { FilesModule } from "../files/files.module.js";
+import { EmbedTokensModule } from "./embed-token.js";
+import { OrgUiStreams, UiStreamMembership } from "./ui-stream.js";
+import { UiViews } from "./views.js";
+/**
+ * Extension UI on the kernel side: the views and actions (`ctx.ui`), the embed tokens
+ * ({@link EmbedTokensModule}, re-exported; the extension host verifies them with the same
+ * provider) and the org UI refresh stream.
+ */
+let UiModule = class UiModule {
+};
+UiModule = __decorate([
+    Module({
+        imports: [ExtensionsModule, ConversationsModule, FilesModule, EmbedTokensModule],
+        providers: [UiViews, UiStreamMembership, OrgUiStreams],
+        exports: [UiViews, OrgUiStreams, EmbedTokensModule],
+    })
+], UiModule);
+export { UiModule };

package/dist/ui/views.controller.d.ts

@@ -1,14 +1,18 @@
 import { type UiActionResult, type UiView } from "@capybara-hq/plugin-sdk";
-import { type OnModuleDestroy } from "@nestjs/common";
 import type { FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
-import type { ApiTokenService } from "../identity/api-tokens.js";
+import { ApiTokenService } from "../identity/api-tokens.js";
 import { type Principal } from "../identity/principal.js";
-import type { SessionService } from "../identity/sessions.js";
+import { SessionService } from "../identity/sessions.js";
 import { type OrgContext } from "../orgs/org.guard.js";
-import { type EmbedTokens } from "./embed-token.js";
-import type { OrgUiStreams } from "./ui-stream.js";
-import type { UiContributionItem, UiViews } from "./views.js";
+import { EmbedTokens } from "./embed-token.js";
+import { OrgUiStreams } from "./ui-stream.js";
+import { type UiContributionItem, UiViews } from "./views.js";
+/** The contribution named in a view / action / embed path (`:plugin/:id`). */
+declare const ContributionParams: z.ZodObject<{
+    plugin: z.ZodString;
+    id: z.ZodString;
+}, z.core.$strip>;
 declare const ViewQuery: z.ZodObject<{
     conversationId: z.ZodOptional<z.ZodString>;
     locale: z.ZodDefault<z.ZodEnum<{
@@ -53,7 +57,7 @@ declare const EmbedTokenBody: z.ZodDefault<z.ZodObject<{
  * 角色（A38）：组织页面（`place: "page"`，含组织级刷新流）只给 member 以上，guest 一律 404 `ui.not_found`、
  * 列表里也不出现；对话位置的贡献给能访问该对话的任何成员。插件收到的 `role` 来自 OrgGuard 查出的成员关系。
  */
-export declare class UiController implements OnModuleDestroy {
+export declare class UiController {
     private readonly views;
     private readonly streams;
     private readonly sessions;
@@ -63,11 +67,11 @@ export declare class UiController implements OnModuleDestroy {
     contributions(principal: Principal, org: OrgContext): Promise<{
         items: UiContributionItem[];
     }>;
-    view(principal: Principal, org: OrgContext, plugin: string, id: string, q: z.infer<typeof ViewQuery>): Promise<{
+    view(principal: Principal, org: OrgContext, { plugin, id }: z.infer<typeof ContributionParams>, q: z.infer<typeof ViewQuery>): Promise<{
         view: UiView;
     }>;
-    action(principal: Principal, org: OrgContext, plugin: string, id: string, body: z.infer<typeof ActionBody>): Promise<UiActionResult>;
-    embedToken(principal: Principal, org: OrgContext, plugin: string, id: string, body: z.infer<typeof EmbedTokenBody>): Promise<{
+    action(principal: Principal, org: OrgContext, { plugin, id }: z.infer<typeof ContributionParams>, body: z.infer<typeof ActionBody>): Promise<UiActionResult>;
+    embedToken(principal: Principal, org: OrgContext, { plugin, id }: z.infer<typeof ContributionParams>, body: z.infer<typeof EmbedTokenBody>): Promise<{
         token: string;
         src: string;
         expiresAt: string;
@@ -75,7 +79,5 @@ export declare class UiController implements OnModuleDestroy {
     }>;
     /** 组织级刷新流：与会话流一样用 `reply.hijack()` 直接写原始响应；心跳与复核间隔同 `runtime.sse*`。 */
     stream(principal: Principal, org: OrgContext, req: FastifyRequest, reply: FastifyReply): Promise<void>;
-    /** 停机：关闭本进程的全部组织刷新流。 */
-    onModuleDestroy(): void;
 }
 export {};

package/dist/ui/views.controller.js

@@ -8,17 +8,23 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { UI_LIMITS } from "@capybara-hq/plugin-sdk";
-import { Body, Controller, Get, HttpCode, Inject, Param, Post, Query, Req, Res, } from "@nestjs/common";
+import { Controller, Get, HttpCode, Inject, Post, Req, Res } from "@nestjs/common";
 import { z } from "zod";
-import { API_TOKENS, EMBED_TOKENS, ORG_UI_STREAMS, SESSIONS, UI_VIEWS } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
+import { ApiTokenService } from "../identity/api-tokens.js";
 import { credentialCheck } from "../identity/credential-check.js";
 import { CurrentPrincipal, requireUser } from "../identity/principal.js";
+import { SessionService } from "../identity/sessions.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam, ZQuery } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
-import { EMBED_TOKEN_TTL_SECONDS } from "./embed-token.js";
+import { EMBED_TOKEN_TTL_SECONDS, EmbedTokens } from "./embed-token.js";
+import { OrgUiStreams } from "./ui-stream.js";
+import { UiViews } from "./views.js";
 const BEARER_RE = /^Bearer\s+(\S+)$/i;
 const Locale = z.enum(["zh", "en"]).default("en");
 const Id = z.string().min(1).max(100);
+/** The contribution named in a view / action / embed path (`:plugin/:id`). */
+const ContributionParams = z.object({ plugin: Id, id: Id });
 const ViewQuery = z
     .object({
     conversationId: z.string().min(1).max(100).optional(),
@@ -65,6 +71,14 @@ const EmbedTokenBody = z
     .default({});
 /** 嵌入页的同源代理前缀（网页 `/plugin-ui/<plugin>/<rest>` → 内核 `/plugins/<plugin>/ui/<rest>`）。 */
 const embedSrc = (plugin, path) => `/plugin-ui/${plugin}/${path.replace(/^\/ui\//, "")}`;
+class UiContributionParamsDto extends createZodDto(ContributionParams, "UiContributionParams") {
+}
+class UiViewQueryDto extends createZodDto(ViewQuery, "UiViewQuery") {
+}
+class UiActionBodyDto extends createZodDto(ActionBody, "UiActionBody") {
+}
+class UiEmbedTokenBodyDto extends createZodDto(EmbedTokenBody, "UiEmbedTokenBody") {
+}
 /**
  * 插件界面（第一档：渲染 schema；第二档：嵌入应用），会话鉴权、`ui.use`（只给人用，服务令牌 403）：
  * - `GET  /api/v1/orgs/:orgId/ui/contributions` → `{ items: { plugin, id, title, place, legacyPlace?, kind, path?, icon }[] }`
@@ -102,7 +116,7 @@ let UiController = class UiController {
         requireUser(principal);
         return { items: await this.views.contributions(org.orgId, org.role) };
     }
-    async view(principal, org, plugin, id, q) {
+    async view(principal, org, { plugin, id }, q) {
         const p = requireUser(principal);
         const view = await this.views.render({
             orgId: org.orgId,
@@ -119,7 +133,7 @@ let UiController = class UiController {
         });
         return { view };
     }
-    async action(principal, org, plugin, id, body) {
+    async action(principal, org, { plugin, id }, body) {
         const p = requireUser(principal);
         return this.views.act({
             orgId: org.orgId,
@@ -135,7 +149,7 @@ let UiController = class UiController {
             ...(body.answer !== undefined && { answer: body.answer }),
         });
     }
-    async embedToken(principal, org, plugin, id, body) {
+    async embedToken(principal, org, { plugin, id }, body) {
         const p = requireUser(principal);
         const target = await this.views.embed({
             orgId: org.orgId,
@@ -202,10 +216,6 @@ let UiController = class UiController {
         res.flushHeaders();
         handle.begin();
     }
-    /** 停机：关闭本进程的全部组织刷新流。 */
-    onModuleDestroy() {
-        this.streams.closeAll();
-    }
 };
 __decorate([
     Get("contributions"),
@@ -218,9 +228,8 @@ __decorate([
     OrgAction("ui.use"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, Param("plugin", new ZodPipe(Id))),
-    __param(3, Param("id", new ZodPipe(Id))),
-    __param(4, Query(new ZodPipe(ViewQuery)))
+    __param(2, ZParam(UiContributionParamsDto)),
+    __param(3, ZQuery(UiViewQueryDto))
 ], UiController.prototype, "view", null);
 __decorate([
     Post("actions/:plugin/:id"),
@@ -228,9 +237,8 @@ __decorate([
     OrgAction("ui.use"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, Param("plugin", new ZodPipe(Id))),
-    __param(3, Param("id", new ZodPipe(Id))),
-    __param(4, Body(new ZodPipe(ActionBody)))
+    __param(2, ZParam(UiContributionParamsDto)),
+    __param(3, ZBody(UiActionBodyDto))
 ], UiController.prototype, "action", null);
 __decorate([
     Post("embeds/:plugin/:id/token"),
@@ -238,9 +246,8 @@ __decorate([
     OrgAction("ui.use"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, Param("plugin", new ZodPipe(Id))),
-    __param(3, Param("id", new ZodPipe(Id))),
-    __param(4, Body(new ZodPipe(EmbedTokenBody)))
+    __param(2, ZParam(UiContributionParamsDto)),
+    __param(3, ZBody(UiEmbedTokenBodyDto))
 ], UiController.prototype, "embedToken", null);
 __decorate([
     Get("stream"),
@@ -252,10 +259,10 @@ __decorate([
 ], UiController.prototype, "stream", null);
 UiController = __decorate([
     Controller("api/v1/orgs/:orgId/ui"),
-    __param(0, Inject(UI_VIEWS)),
-    __param(1, Inject(ORG_UI_STREAMS)),
-    __param(2, Inject(SESSIONS)),
-    __param(3, Inject(API_TOKENS)),
-    __param(4, Inject(EMBED_TOKENS))
+    __param(0, Inject(UiViews)),
+    __param(1, Inject(OrgUiStreams)),
+    __param(2, Inject(SessionService)),
+    __param(3, Inject(ApiTokenService)),
+    __param(4, Inject(EmbedTokens))
 ], UiController);
 export { UiController };

package/dist/ui/views.d.ts

@@ -1,7 +1,11 @@
 import { type FormAnswer, type Logger, type UiActionResult, type UiContribution, type UiIcon, type UiView } from "@capybara-hq/plugin-sdk";
-import type { KernelDb } from "../db/kernel-schema.js";
-import type { ExtensionHost } from "../extensions/host.js";
+import { ConversationsService } from "../conversations/conversations.service.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { ExtensionHost } from "../extensions/host.js";
+import { PreviewerRegistry } from "../files/previewers.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
 import type { OrgRole } from "../orgs/roles.js";
+export { callExtension } from "./call-extension.js";
 /** 插件 render / action 的时限（spec §4.2：慢的插件只让那个标签失败）。 */
 export declare const UI_CALL_TIMEOUT_MS = 5000;
 /** 列出贡献接口的一项。 */
@@ -29,42 +33,6 @@ export interface UiEmbedTarget {
     /** Only a `file-preview` embed: the one file the token is for. */
     fileId?: string;
 }
-export interface UiViewsDeps {
-    host: Pick<ExtensionHost, "uiContributions">;
-    /** Names of the extensions enabled in the organization (`extension_org_configs.enabled` plus required bootstrap plugins, `enabled.ts`), queried every time, not cached. */
-    enabledPlugins(orgId: string): Promise<Set<string>>;
-    /** 调用者能否访问这个对话（与会话 SSE 流同一判定）。 */
-    canAccessConversation(orgId: string, conversationId: string, accountId: string): Promise<boolean>;
-    /**
-     * Throws unless the caller may write to the conversation: a sub-agent's is read-only (409
-     * `conversation.read_only`, sub-agents spec §6.1). Checked before an action (final review m3).
-     */
-    checkWritable?(orgId: string, conversationId: string, accountId: string): Promise<void>;
-    /**
-     * A `file-preview` embed token: whether that extension's previewer with `embed: contribution`
-     * takes this file of the conversation (the viewer must read it; not found throws 404).
-     */
-    previewEmbedAllowed?(t: {
-        orgId: string;
-        accountId: string;
-        conversationId: string;
-        fileId: string;
-        plugin: string;
-        contribution: string;
-    }): Promise<boolean>;
-    /**
-     * The `card` a `tool_result` of this conversation recorded for `callId` (`ToolResult.card`), or
-     * null. An inline card request is served only when it matches (the card is attested by the log).
-     */
-    recordedCard?(conversationId: string, callId: string): Promise<{
-        plugin: string;
-        view: string;
-        key?: string;
-    } | null>;
-    log: Pick<Logger, "warn">;
-    /** 默认 {@link UI_CALL_TIMEOUT_MS}（测试可调小）。 */
-    timeoutMs?: number;
-}
 /** 取视图 / 执行动作的调用者与目标（身份来自内核鉴权）。 */
 export interface UiTarget {
     orgId: string;
@@ -87,7 +55,7 @@ export interface UiTarget {
  * The card a `tool_result` of the conversation recorded for `callId`, or null (the inline-card
  * attestation of {@link UiViewsDeps.recordedCard}). Scans one conversation's tool results.
  */
-export declare function recordedCard(db: KernelDb, conversationId: string, callId: string): Promise<{
+export declare function recordedCard(db: KernelSchemaDb, conversationId: string, callId: string): Promise<{
     plugin: string;
     view: string;
     key?: string;
@@ -106,12 +74,11 @@ export declare function dropForeignOpens(view: UiView, panels: ReadonlySet<strin
  * - 调用带 5 秒时限与中止信号：render 抛错 502 `ui.render_failed`、action 抛错 502 `ui.action_failed`、
  *   超时 504 `ui.timeout`、返回非法视图 502
  *   `ui.invalid_view`，都记告警日志、不写对话日志（这些不是模型可见的内容）。
- * 不依赖 Nest；不保存跨请求状态。
+ * 不保存跨请求状态。
  */
 export declare class UiViews {
     private readonly d;
-    private readonly timeoutMs;
-    constructor(d: UiViewsDeps);
+    constructor(host: ExtensionHost, conversations: ConversationsService, previewers: PreviewerRegistry, db: KernelDb, log: Pick<Logger, "warn">);
     /** 该组织、该角色可见的界面贡献：插件已启用且已加载；kind view 的要求插件注册了 render；组织页面要 member 以上。 */
     contributions(orgId: string, role: OrgRole): Promise<UiContributionItem[]>;
     /**
@@ -138,18 +105,3 @@ export declare class UiViews {
     /** 非法结果：记告警（列出前几条问题）并 502 `ui.invalid_view`。 */
     private check;
 }
-/**
- * Calls an extension with a time limit and an abort signal (plugin views, actions and file
- * previewers): over the limit the signal aborts and the call is 504 `ui.timeout`; a throw is
- * `failCode` (502) without echoing the extension's message. An `ApiError` thrown by `fn` passes.
- */
-export declare function callExtension<T>(o: {
-    log: Pick<Logger, "warn">;
-    plugin: string;
-    what: string;
-    fields: Record<string, unknown>;
-    timeoutMs: number;
-    failCode: "ui.render_failed" | "ui.action_failed";
-    failMessage: string;
-    fn: (signal: AbortSignal) => Promise<T>;
-}): Promise<T>;