@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/http/adapter.js

@@ -0,0 +1,25 @@
+import { randomUUID } from "node:crypto";
+import { FastifyAdapter } from "@nestjs/platform-fastify";
+/**
+ * 把 `http.trustProxy` 配置转成 Fastify 的 trustProxy。布尔与 IP / CIDR 列表原样传入；
+ * 跳数转成 `(addr, hop) => hop < n`：Fastify 5.12 起对 number 一律 fail closed（不信任任何一跳），
+ * 所以由这里实现跳数语义——前提是服务只能经由这 n 层代理访问（配置说明里已写明，并推荐 CIDR 列表）。
+ */
+function fastifyTrustProxy(tp) {
+    return typeof tp === "number" ? (_addr, hop) => hop < tp : tp;
+}
+const REQUEST_ID = /^[A-Za-z0-9._-]{1,128}$/;
+/** The request id: a valid incoming `x-request-id`, else a random one. */
+function requestId(req) {
+    const h = req.headers["x-request-id"];
+    return typeof h === "string" && REQUEST_ID.test(h) ? h : randomUUID();
+}
+/** The kernel's Fastify adapter: trusted proxies (`http.trustProxy`) and validated request ids. */
+export function createKernelAdapter(trustProxy = false) {
+    return new FastifyAdapter({
+        trustProxy: fastifyTrustProxy(trustProxy),
+        // x-request-id is read by requestId() (validated), never trusted as is
+        requestIdHeader: false,
+        genReqId: requestId,
+    });
+}

package/dist/http/api.module.d.ts

@@ -1,114 +1,7 @@
-import type { Logger } from "@capybara-hq/plugin-sdk";
-import { type DynamicModule } from "@nestjs/common";
-import type { Redis } from "ioredis";
-import type { CatalogService } from "../catalog/catalog.service.js";
-import type { MarketplacesService } from "../catalog/marketplaces.service.js";
-import type { PluginImport } from "../catalog/plugin-import.js";
-import type { ChannelConnections } from "../channels/connections.service.js";
-import type { KernelConfig } from "../config/schema.js";
-import type { AttachmentsService } from "../conversations/attachments.service.js";
-import { type RunControl } from "../conversations/conversations.service.js";
-import type { EventBus, EventLog } from "../conversations/event-log.js";
-import type { Keyring } from "../ctx/secrets.js";
-import type { KernelDb } from "../db/kernel-schema.js";
-import { type EvalQueue } from "../evals/runs.service.js";
-import type { ExtensionAdminOps } from "../extensions/admin-ops.js";
-import type { ExtensionAdmin } from "../extensions/admin-view.js";
-import type { ExtensionDeploymentConfigService } from "../extensions/deployment-config.js";
-import type { ExtensionHost } from "../extensions/host.js";
-import type { ExtensionInstalls } from "../extensions/installs.js";
-import type { OrgExtensionConfigs } from "../extensions/org-config.js";
-import type { KernelIdentity } from "../kernel.js";
-import type { PricesService } from "../models/prices.js";
-import type { ModelPurposesService } from "../models/purposes.js";
-import type { ProviderRegistry } from "../runtime/providers.js";
-import type { SandboxService } from "../sandbox/sandbox.service.js";
-import type { SkillChangesService } from "../skills/changes.service.js";
-import type { SkillsService } from "../skills/skills.service.js";
-import type { StorageService } from "../storage/storage.service.js";
-import type { ApprovalsService } from "../tools/approvals.service.js";
-import type { ConnectorContent } from "../tools/connector-content.js";
-import type { Credentials } from "../tools/credentials.js";
-import type { ToolDrift } from "../tools/drift.js";
-import type { ToolOutputs } from "../tools/outputs.js";
-import type { QuestionsService } from "../tools/questions.service.js";
-import type { ToolRegistry } from "../tools/registry.js";
-/** 内核 API 的依赖：由 createKernel 传入，ApiModule 据此构造各领域服务。 */
-export interface ApiDeps {
-    db: KernelDb;
-    redis: Redis;
-    keyring: Keyring;
-    /** 取当前配置（热更新后返回新配置）。 */
-    config: () => KernelConfig;
-    log: Logger;
-    host: ExtensionHost;
-    /** The same instance as `Kernel.orgExtensionConfigs`. */
-    orgExtensionConfigs: OrgExtensionConfigs;
-    /** 内核总线（命名空间 `kernel`，插件名不能取 `kernel`，不会与插件冲突）。 */
-    bus: EventBus;
-    /** 会话事件日志（与运行 worker 共用同一实例）。 */
-    eventLog: EventLog;
-    /** 模型供应商注册表（与运行 worker 共用同一实例）。 */
-    registry: ProviderRegistry;
-    /** 运行投递与中止。 */
-    runs: RunControl;
-    /** 连接器凭据（与 `Kernel.tools.credentials` 同一实例）。 */
-    credentials: Credentials;
-    /** 工具注册表（与 `Kernel.tools.registry` 同一实例）。 */
-    toolRegistry: ToolRegistry;
-    /** 工具调用审批（与 `Kernel.tools.approvals` 同一实例）。 */
-    approvals: ApprovalsService;
-    /** 工具调用的输入请求（与 `Kernel.tools.questions` 同一实例）。 */
-    questions: QuestionsService;
-    /** 工具定义漂移检测（与 `Kernel.tools.drift` 同一实例；手动刷新走同一套比对）。 */
-    drift: ToolDrift;
-    /** 工具输出存档（与 `Kernel.tools.outputs` 同一实例；网页的运行标签读全文）。 */
-    outputs: ToolOutputs;
-    /** 连接器的 prompts / resources（斜杠命令、@ 资源引用与消息附件）。 */
-    connectorContent: ConnectorContent;
-    /** 外部身份、绑定、第三方登录与离职处理（与 `Kernel.identity` 同一组实例）。 */
-    identity: KernelIdentity;
-    /** 渠道连接（与 `Kernel.channels.connections` 同一实例）。 */
-    channels: ChannelConnections;
-    /** 对话附件（与 `Kernel.attachments` 同一实例）。 */
-    attachments: AttachmentsService;
-    /** 对象存储（与 `Kernel.storage` 同一实例；产物下载用）。 */
-    storage: StorageService;
-    /** 按对话的沙箱（与 `Kernel.sandbox` 同一实例；上下文标签读状态）。 */
-    sandbox: SandboxService;
-    /** 技能库（与 `Kernel.skills` 同一实例）。 */
-    skills: SkillsService;
-    /** agent 自写技能与技能变更审批（与 `Kernel.skillChanges` 同一实例）。 */
-    skillChanges: SkillChangesService;
-    /** 模型价格表（与 `Kernel.prices` 同一实例）。 */
-    prices: PricesService;
-    /** 模型用途映射（与 `Kernel.purposes` 同一实例；评测 worker 的评委也用它）。 */
-    purposes: ModelPurposesService;
-    /** Extension package imports and install records (the same instance as `Kernel.extensionInstalls`). */
-    extensionInstalls: ExtensionInstalls;
-    /** Deployment-level extension admin: list and web approval (the same instance as `Kernel.extensionAdmin`). */
-    extensionAdmin: ExtensionAdmin;
-    /** Deployment-level extension install / enable / disable / uninstall (the same instance as `Kernel.extensionAdminOps`). */
-    extensionAdminOps: ExtensionAdminOps;
-    /** Deployment-level extension config (the same instance as `Kernel.extensionDeploymentConfigs`). */
-    extensionDeploymentConfigs: ExtensionDeploymentConfigService;
-    /** The enterprise catalog (the same instance as `Kernel.catalog`). */
-    catalog: CatalogService;
-    /** Plugin (app bundle) import (the same instance as `Kernel.pluginImport`). */
-    pluginImport: PluginImport;
-    /** Marketplaces (the same instance as `Kernel.marketplaces`). */
-    marketplaces: MarketplacesService;
-    /** 评测队列的生产方（与 worker 同一队列名）。 */
-    evalQueue: Pick<EvalQueue, "enqueue">;
-    /** 删除 agent 后投递销毁它各对话的沙箱（一次性维护任务）；不给时留给不活跃销毁扫描。 */
-    sandboxDestroy?: {
-        destroy(conversationIds: string[]): Promise<void>;
-    };
-}
 /**
- * 内核 API 模块（`/api/v1/*`），只在角色含 `api` 时挂载。
- * 全局守卫 `AuthGuard` 默认拒绝：未标注 `@Public()` 的路由一律要求凭据（含根模块的健康检查，它们显式标了 `@Public()`）。
+ * The api role (nest kernel spec §2): the kernel API (`/api/v1/*`), imported by `KernelModule` only
+ * when `roles` includes `api`. The global `AuthGuard` denies by default: every route without
+ * `@Public()` requires credentials (the root module's health endpoints are marked `@Public()`).
  */
 export declare class ApiModule {
-    static register(deps: ApiDeps): DynamicModule;
 }

package/dist/http/api.module.js

@@ -4,86 +4,62 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var ApiModule_1;
 import { Module } from "@nestjs/common";
 import { APP_GUARD } from "@nestjs/core";
 import { AdminController } from "../admin/admin.controller.js";
+import { AdminModule } from "../admin/admin.module.js";
 import { AdminExtensionsController } from "../admin/extensions.controller.js";
 import { SetupController } from "../admin/setup.controller.js";
-import { SetupService } from "../admin/setup.service.js";
 import { AgentsController } from "../agents/agents.controller.js";
-import { AgentsService } from "../agents/agents.service.js";
+import { AgentsModule } from "../agents/agents.module.js";
 import { ModelsController } from "../agents/models.controller.js";
 import { AgentTemplatesController } from "../agents/templates.controller.js";
-import { AgentTemplatesService } from "../agents/templates.js";
 import { AdminCatalogController } from "../catalog/admin-catalog.controller.js";
+import { CatalogModule } from "../catalog/catalog.module.js";
 import { MarketplacesController } from "../catalog/marketplaces.controller.js";
 import { AdminCatalogRequestsController, OrgCatalogController, } from "../catalog/org-catalog.controller.js";
-import { OrgCatalogService } from "../catalog/org-catalog.service.js";
-import { PluginInstaller } from "../catalog/plugin-install.js";
-import { PluginUpgrader } from "../catalog/plugin-upgrade.js";
-import { CatalogRequestsService } from "../catalog/requests.service.js";
+import { ChannelsModule } from "../channels/channels.module.js";
 import { ChannelConnectionsController } from "../channels/connections.controller.js";
-import { ConversationArtifacts } from "../conversations/artifacts.js";
 import { AttachmentsController } from "../conversations/attachments.controller.js";
 import { ConversationsController } from "../conversations/conversations.controller.js";
-import { ConversationsService } from "../conversations/conversations.service.js";
-import { ConversationFiles } from "../conversations/files.js";
-import { ConversationOutputs } from "../conversations/outputs-read.js";
-import { ConversationQueue } from "../conversations/queue.js";
-import { ConversationSandboxStatus } from "../conversations/sandbox-status.js";
+import { ConversationsModule } from "../conversations/conversations.module.js";
+import { EvalsModule } from "../evals/evals.module.js";
 import { EvalRunsController } from "../evals/runs.controller.js";
-import { EvalRunsService } from "../evals/runs.service.js";
 import { EvalSetsController } from "../evals/sets.controller.js";
-import { EvalSetsService } from "../evals/sets.service.js";
 import { TrajectoryController } from "../evals/trajectory.controller.js";
-import { TrajectoryService } from "../evals/trajectory.service.js";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { OrgExtensionConfigsController } from "../extensions/org-config.controller.js";
+import { FilesModule } from "../files/files.module.js";
 import { FilePreviewersController } from "../files/previewers.controller.js";
-import { PreviewerRegistry } from "../files/previewers.js";
-import { AccountsService } from "../identity/accounts.js";
-import { ApiTokenService } from "../identity/api-tokens.js";
 import { AuthController } from "../identity/auth.controller.js";
 import { AuthGuard } from "../identity/auth.guard.js";
+import { IdentityModule } from "../identity/identity.module.js";
 import { MeController } from "../identity/me.controller.js";
-import { LoginRateLimiter } from "../identity/rate-limit.js";
-import { SessionService } from "../identity/sessions.js";
-import { SettingsService } from "../identity/settings.js";
 import { BindController, MeIdentitiesController, SsoController, } from "../identity/sso.controller.js";
-import { InboxService } from "../inbox/inbox.service.js";
+import { InboxModule } from "../inbox/inbox.module.js";
+import { ModelsModule } from "../models/models.module.js";
 import { ModelPurposesController } from "../models/purposes.controller.js";
 import { DirectorySyncController } from "../orgs/directory-sync.controller.js";
 import { InvitationsController } from "../orgs/invitations.controller.js";
-import { InvitationsService } from "../orgs/invitations.service.js";
-import { MembersService } from "../orgs/members.service.js";
 import { OrgsController } from "../orgs/orgs.controller.js";
-import { OrgsService } from "../orgs/orgs.service.js";
+import { OrgsModule } from "../orgs/orgs.module.js";
 import { OrgSettingsController } from "../orgs/settings.controller.js";
-import { OrgSettingsService } from "../orgs/settings.service.js";
+import { RuntimeModule } from "../runtime/runtime.module.js";
 import { ConversationStreamController } from "../runtime/stream.controller.js";
-import { ConversationStreams } from "../runtime/stream.js";
 import { AgentSkillsController, InboxController, SkillChangesController, } from "../skills/changes.controller.js";
 import { InvocableSkillsController } from "../skills/invocable.controller.js";
-import { SkillInvoker } from "../skills/invoke.js";
 import { SkillsController } from "../skills/skills.controller.js";
+import { SkillsModule } from "../skills/skills.module.js";
+import { StorageModule } from "../storage/storage.module.js";
 import { ApprovalsController, ToolGrantsController } from "../tools/approvals.controller.js";
 import { ConnectorContentController } from "../tools/connector-content.controller.js";
 import { ConnectorsController } from "../tools/connectors.controller.js";
-import { ConnectorsService } from "../tools/connectors.service.js";
-import { ConversationToolInfo } from "../tools/info.js";
-import { OAuthFlow } from "../tools/oauth/flow.js";
 import { OAuthCallbackController, OAuthConnectController, } from "../tools/oauth/oauth.controller.js";
 import { QuestionsController } from "../tools/questions.controller.js";
-import { EmbedTokens } from "../ui/embed-token.js";
-import { OrgUiStreams, orgMembership } from "../ui/ui-stream.js";
+import { ToolsModule } from "../tools/tools.module.js";
+import { UiModule } from "../ui/ui.module.js";
 import { UiController } from "../ui/views.controller.js";
-import { recordedCard, UiViews } from "../ui/views.js";
-import { ACCOUNTS, AGENT_TEMPLATES, AGENTS, API_TOKENS, APPROVALS, ATTACHMENTS, CATALOG, CATALOG_REQUESTS, CHANNEL_CONNECTIONS, CONNECTOR_CONTENT, CONNECTORS, CONVERSATION_ARTIFACTS, CONVERSATION_FILES, CONVERSATION_OUTPUTS, CONVERSATION_QUEUE, CONVERSATION_SANDBOX, CONVERSATION_STREAMS, CONVERSATION_TOOLS, CONVERSATIONS, CREDENTIALS, DIRECTORY_SYNC, EMBED_TOKENS, EVAL_RUNS, EVAL_SETS, EVENT_LOG, EXTENSION_ADMIN, EXTENSION_ADMIN_OPS, EXTENSION_DEPLOYMENT_CONFIGS, EXTENSION_INSTALLS, EXTERNAL_IDENTITIES, FILE_PREVIEWERS, IDENTITY_BINDING, INBOX, INVITATIONS, KERNEL_BUS, KERNEL_CONFIG, KERNEL_DB, KERNEL_LOG, KERNEL_REDIS, MARKETPLACES, MEMBERS, MODEL_PURPOSES, OAUTH_FLOW, OFFBOARDING, ORG_CATALOG, ORG_EXTENSION_CONFIGS, ORG_SETTINGS, ORG_UI_STREAMS, ORGS, PLUGIN_IMPORT, PLUGIN_INSTALLER, PRICES, PROVIDER_REGISTRY, QUESTIONS, RATE_LIMITER, SESSIONS, SETTINGS, SETUP, SKILL_CHANGES, SKILL_INVOKER, SKILLS, SSO_FLOW, TOOL_REGISTRY, TRAJECTORIES, UI_VIEWS, } from "./tokens.js";
-/** 本副本已加载的连接器：插件 `plugin` 提供的 `Connector.kind === kind`。 */
-const findConnectorOf = (host) => (plugin, kind) => host
-    .list("connector")
-    .find((e) => e.plugin === plugin && e.impl?.kind === kind)?.impl;
-/** 内核 API 的全部 controller；后续任务往这里追加。 */
+/** Every controller of the kernel API. */
 const CONTROLLERS = [
     AuthController,
     MeController,
@@ -129,320 +105,36 @@ const CONTROLLERS = [
     AdminCatalogRequestsController,
 ];
 /**
- * 领域服务 provider：领域类保持框架无关（不加装饰器），一律用 `useFactory` 构造。
- * 后续任务往这里追加。
+ * The api role (nest kernel spec §2): the kernel API (`/api/v1/*`), imported by `KernelModule` only
+ * when `roles` includes `api`. The global `AuthGuard` denies by default: every route without
+ * `@Public()` requires credentials (the root module's health endpoints are marked `@Public()`).
  */
-function serviceProviders(deps) {
-    return [
-        { provide: KERNEL_LOG, useValue: deps.log },
-        { provide: KERNEL_DB, useValue: deps.db },
-        { provide: KERNEL_REDIS, useValue: deps.redis },
-        { provide: KERNEL_CONFIG, useValue: deps.config },
-        { provide: ORG_EXTENSION_CONFIGS, useValue: deps.orgExtensionConfigs },
-        {
-            provide: ACCOUNTS,
-            useFactory: (db) => new AccountsService(db),
-            inject: [KERNEL_DB],
-        },
-        {
-            provide: SESSIONS,
-            useFactory: (db, redis, config) => {
-                const { accessTokenTtlSeconds, refreshTokenTtlDays } = config().auth;
-                return new SessionService(db, redis, deps.keyring, {
-                    accessTtlSeconds: accessTokenTtlSeconds,
-                    refreshTtlDays: refreshTokenTtlDays,
-                });
-            },
-            inject: [KERNEL_DB, KERNEL_REDIS, KERNEL_CONFIG],
-        },
-        {
-            provide: API_TOKENS,
-            useFactory: (db) => new ApiTokenService(db),
-            inject: [KERNEL_DB],
-        },
-        {
-            provide: SETTINGS,
-            useFactory: (db) => new SettingsService(db, deps.log),
-            inject: [KERNEL_DB],
-        },
-        {
-            provide: ORGS,
-            useFactory: (db, settings, tokens) => new OrgsService(db, settings, tokens, {
-                afterDelete: (orgId) => deps.channels.notifyOrgChanged(orgId),
-            }),
-            inject: [KERNEL_DB, SETTINGS, API_TOKENS],
-        },
-        {
-            provide: ORG_SETTINGS,
-            useFactory: (db, config) => new OrgSettingsService(db, config),
-            inject: [KERNEL_DB, KERNEL_CONFIG],
-        },
-        {
-            provide: MEMBERS,
-            useFactory: (db) => new MembersService(db, deps.identity.offboarding),
-            inject: [KERNEL_DB],
-        },
-        {
-            provide: INVITATIONS,
-            useFactory: (db, accounts, members) => new InvitationsService(db, accounts, members),
-            inject: [KERNEL_DB, ACCOUNTS, MEMBERS],
-        },
-        {
-            provide: SETUP,
-            useFactory: (db, accounts, orgs) => new SetupService(db, accounts, orgs),
-            inject: [KERNEL_DB, ACCOUNTS, ORGS],
-        },
-        {
-            provide: RATE_LIMITER,
-            useFactory: (redis) => new LoginRateLimiter(redis),
-            inject: [KERNEL_REDIS],
-        },
-        { provide: PROVIDER_REGISTRY, useValue: deps.registry },
-        {
-            provide: AGENT_TEMPLATES,
-            useFactory: (db) => new AgentTemplatesService(db),
-            inject: [KERNEL_DB],
-        },
-        {
-            provide: AGENTS,
-            useFactory: (db, registry, tools) => new AgentsService(db, registry, tools, deps.skillChanges, deps.sandboxDestroy, deps.log),
-            inject: [KERNEL_DB, PROVIDER_REGISTRY, TOOL_REGISTRY],
-        },
-        { provide: PRICES, useValue: deps.prices },
-        { provide: MODEL_PURPOSES, useValue: deps.purposes },
-        { provide: EXTENSION_INSTALLS, useValue: deps.extensionInstalls },
-        { provide: EXTENSION_ADMIN, useValue: deps.extensionAdmin },
-        { provide: EXTENSION_ADMIN_OPS, useValue: deps.extensionAdminOps },
-        { provide: EXTENSION_DEPLOYMENT_CONFIGS, useValue: deps.extensionDeploymentConfigs },
-        { provide: CATALOG, useValue: deps.catalog },
-        { provide: PLUGIN_IMPORT, useValue: deps.pluginImport },
-        { provide: MARKETPLACES, useValue: deps.marketplaces },
-        {
-            provide: TRAJECTORIES,
-            useFactory: (db, eventLog, prices, settings) => new TrajectoryService(db, eventLog, prices, settings),
-            inject: [KERNEL_DB, EVENT_LOG, PRICES, SETTINGS],
-        },
-        {
-            provide: EVAL_SETS,
-            useFactory: (db, config, prices, settings) => new EvalSetsService(db, config, prices, settings),
-            inject: [KERNEL_DB, KERNEL_CONFIG, PRICES, SETTINGS],
-        },
-        {
-            provide: EVAL_RUNS,
-            useFactory: (db, config, registry, prices, settings, redis) => new EvalRunsService({
-                db,
-                redis,
-                config,
-                registry,
-                prices,
-                settings,
-                queue: deps.evalQueue,
-                purposes: deps.purposes,
-            }),
-            inject: [KERNEL_DB, KERNEL_CONFIG, PROVIDER_REGISTRY, PRICES, SETTINGS, KERNEL_REDIS],
-        },
-        { provide: KERNEL_BUS, useValue: deps.bus },
-        { provide: EVENT_LOG, useValue: deps.eventLog },
-        { provide: CONNECTOR_CONTENT, useValue: deps.connectorContent },
-        { provide: ATTACHMENTS, useValue: deps.attachments },
-        { provide: SKILLS, useValue: deps.skills },
-        { provide: SKILL_CHANGES, useValue: deps.skillChanges },
-        {
-            provide: SKILL_INVOKER,
-            useFactory: (db, agents) => new SkillInvoker({ db, storage: deps.storage, agents, log: deps.log }),
-            inject: [KERNEL_DB, AGENTS],
-        },
-        {
-            provide: CATALOG_REQUESTS,
-            useFactory: (db) => new CatalogRequestsService(db),
-            inject: [KERNEL_DB],
-        },
-        {
-            provide: INBOX,
-            useFactory: (requests) => new InboxService({
-                approvals: deps.approvals,
-                skillChanges: deps.skillChanges,
-                catalogRequests: requests,
-            }),
-            inject: [CATALOG_REQUESTS],
-        },
-        {
-            provide: PLUGIN_INSTALLER,
-            useFactory: (db, connectors, requests) => new PluginInstaller({
-                db,
-                storage: deps.storage,
-                host: deps.host,
-                findConnector: findConnectorOf(deps.host),
-                connectors,
-                skills: deps.skills,
-                orgConfigs: deps.orgExtensionConfigs,
-                requests,
-                log: deps.log,
-                staleInstallMinutes: () => deps.config().catalog.staleInstallMinutes,
-            }),
-            inject: [KERNEL_DB, CONNECTORS, CATALOG_REQUESTS],
-        },
-        {
-            provide: ORG_CATALOG,
-            useFactory: (db, requests, pluginInstaller) => new OrgCatalogService({
-                db,
-                storage: deps.storage,
-                host: deps.host,
-                findConnector: findConnectorOf(deps.host),
-                requests,
-                pluginInstaller,
-                pluginUpgrader: new PluginUpgrader(pluginInstaller),
-                log: deps.log,
-            }),
-            inject: [KERNEL_DB, CATALOG_REQUESTS, PLUGIN_INSTALLER],
-        },
-        {
-            provide: CONVERSATIONS,
-            useFactory: (db, eventLog, agents, content, attachments, invoker) => new ConversationsService(db, eventLog, agents, deps.runs, deps.log, (orgId, accountId, refs) => content.resolveAttachments(orgId, accountId, refs), (trx, orgId, conversationId, accountId, ids) => attachments.bindForMessage(trx, orgId, conversationId, accountId, ids), deps.registry, invoker),
-            inject: [KERNEL_DB, EVENT_LOG, AGENTS, CONNECTOR_CONTENT, ATTACHMENTS, SKILL_INVOKER],
-        },
-        {
-            provide: CONVERSATION_OUTPUTS,
-            useFactory: (conversations) => new ConversationOutputs({
-                isAccessible: (orgId, id, viewer) => conversations.isAccessible(orgId, id, viewer),
-                load: (scope, id) => deps.outputs.load(scope, id),
-            }),
-            inject: [CONVERSATIONS],
-        },
-        {
-            provide: CONVERSATION_ARTIFACTS,
-            useFactory: (db, conversations) => new ConversationArtifacts({
-                db,
-                storage: deps.storage,
-                isAccessible: (orgId, id, viewer) => conversations.isAccessible(orgId, id, viewer),
-            }),
-            inject: [KERNEL_DB, CONVERSATIONS],
-        },
-        {
-            provide: CONVERSATION_FILES,
-            useFactory: (db, conversations) => new ConversationFiles({
-                db,
-                storage: deps.storage,
-                isAccessible: (orgId, id, viewer) => conversations.isAccessible(orgId, id, viewer),
-            }),
-            inject: [KERNEL_DB, CONVERSATIONS],
-        },
-        {
-            provide: CONVERSATION_QUEUE,
-            useFactory: (db, eventLog, conversations) => new ConversationQueue({ db, eventLog, conversations, runs: deps.runs }),
-            inject: [KERNEL_DB, EVENT_LOG, CONVERSATIONS],
-        },
-        {
-            provide: CONVERSATION_SANDBOX,
-            useFactory: (conversations) => new ConversationSandboxStatus({
-                sandbox: deps.sandbox,
-                isAccessible: (orgId, id, viewer) => conversations.isAccessible(orgId, id, viewer),
-                sandboxConversationOf: (orgId, id) => conversations.sandboxConversationOf(orgId, id),
-            }),
-            inject: [CONVERSATIONS],
-        },
-        {
-            provide: CONVERSATION_TOOLS,
-            useFactory: (db, conversations) => new ConversationToolInfo({
-                db,
-                registry: deps.toolRegistry,
-                isAccessible: (orgId, id, viewer) => conversations.isAccessible(orgId, id, viewer),
-            }),
-            inject: [KERNEL_DB, CONVERSATIONS],
-        },
-        {
-            provide: CONVERSATION_STREAMS,
-            useFactory: (eventLog, bus, conversations, config) => new ConversationStreams({
-                eventLog,
-                bus,
-                access: (orgId, id, viewer) => conversations.isAccessible(orgId, id, viewer),
-                config,
-                log: deps.log,
-            }),
-            inject: [EVENT_LOG, KERNEL_BUS, CONVERSATIONS, KERNEL_CONFIG],
-        },
-        {
-            provide: FILE_PREVIEWERS,
-            useFactory: (db, files) => new PreviewerRegistry({
-                db,
-                host: deps.host,
-                enabledPlugins: (orgId) => deps.host.enabledPlugins(orgId),
-                files,
-                storage: deps.storage,
-                log: deps.log,
-            }),
-            inject: [KERNEL_DB, CONVERSATION_FILES],
-        },
-        {
-            provide: UI_VIEWS,
-            useFactory: (conversations, previewers, db) => new UiViews({
-                host: deps.host,
-                // org config rows plus the required bootstrap plugins
-                enabledPlugins: (orgId) => deps.host.enabledPlugins(orgId),
-                canAccessConversation: (orgId, id, accountId) => conversations.isAccessible(orgId, id, accountId),
-                checkWritable: async (orgId, id, accountId) => {
-                    await conversations.writable(orgId, id, accountId);
-                },
-                previewEmbedAllowed: (t) => previewers.embedAllowed(t),
-                recordedCard: (conversationId, callId) => recordedCard(db, conversationId, callId),
-                log: deps.log,
-            }),
-            inject: [CONVERSATIONS, FILE_PREVIEWERS, KERNEL_DB],
-        },
-        { provide: EMBED_TOKENS, useFactory: () => new EmbedTokens(deps.keyring) },
-        {
-            provide: ORG_UI_STREAMS,
-            useFactory: (db, bus, config) => new OrgUiStreams({ bus, memberRole: orgMembership(db), config, log: deps.log }),
-            inject: [KERNEL_DB, KERNEL_BUS, KERNEL_CONFIG],
-        },
-        { provide: CREDENTIALS, useValue: deps.credentials },
-        { provide: EXTERNAL_IDENTITIES, useValue: deps.identity.external },
-        { provide: IDENTITY_BINDING, useValue: deps.identity.binding },
-        { provide: SSO_FLOW, useValue: deps.identity.sso },
-        { provide: OFFBOARDING, useValue: deps.identity.offboarding },
-        { provide: CHANNEL_CONNECTIONS, useValue: deps.channels },
-        { provide: DIRECTORY_SYNC, useValue: deps.identity.directory },
-        { provide: TOOL_REGISTRY, useValue: deps.toolRegistry },
-        { provide: APPROVALS, useValue: deps.approvals },
-        { provide: QUESTIONS, useValue: deps.questions },
-        {
-            provide: CONNECTORS,
-            useFactory: (db, registry, credentials, config) => new ConnectorsService(db, registry, deps.host, credentials, config, deps.drift),
-            inject: [KERNEL_DB, TOOL_REGISTRY, CREDENTIALS, KERNEL_CONFIG],
-        },
-        {
-            provide: OAUTH_FLOW,
-            useFactory: (db, redis, credentials, config, connectors) => new OAuthFlow({
-                db,
-                redis,
-                credentials,
-                config,
-                log: deps.log,
-                onFirstConnect: async (orgId, connectorId, accountId) => {
-                    await connectors.refresh(orgId, connectorId, accountId, undefined, {
-                        trigger: "first_connect",
-                    });
-                },
-            }),
-            inject: [KERNEL_DB, KERNEL_REDIS, CREDENTIALS, KERNEL_CONFIG, CONNECTORS],
-        },
-    ];
-}
-/**
- * 内核 API 模块（`/api/v1/*`），只在角色含 `api` 时挂载。
- * 全局守卫 `AuthGuard` 默认拒绝：未标注 `@Public()` 的路由一律要求凭据（含根模块的健康检查，它们显式标了 `@Public()`）。
- */
-let ApiModule = ApiModule_1 = class ApiModule {
-    static register(deps) {
-        return {
-            module: ApiModule_1,
-            controllers: CONTROLLERS,
-            providers: [...serviceProviders(deps), { provide: APP_GUARD, useClass: AuthGuard }],
-        };
-    }
+let ApiModule = class ApiModule {
 };
-ApiModule = ApiModule_1 = __decorate([
-    Module({})
-    // biome-ignore lint/complexity/noStaticOnlyClass: Nest 动态模块约定（`Module.register()` 返回 DynamicModule）
+ApiModule = __decorate([
+    Module({
+        // Every domain module the controllers' services come from
+        imports: [
+            StorageModule,
+            ModelsModule,
+            SkillsModule,
+            IdentityModule,
+            OrgsModule,
+            AdminModule,
+            ExtensionsModule,
+            CatalogModule,
+            ToolsModule,
+            AgentsModule,
+            ConversationsModule,
+            RuntimeModule,
+            ChannelsModule,
+            EvalsModule,
+            FilesModule,
+            UiModule,
+            InboxModule,
+        ],
+        controllers: CONTROLLERS,
+        providers: [{ provide: APP_GUARD, useClass: AuthGuard }],
+    })
 ], ApiModule);
 export { ApiModule };

package/dist/http/app.d.ts

@@ -1,12 +1,10 @@
 import "reflect-metadata";
 import type { Logger } from "@capybara-hq/plugin-sdk";
-import { type DynamicModule } from "@nestjs/common";
+import type { NestFastifyApplication } from "@nestjs/platform-fastify";
 import type { InjectOptions, LightMyRequestResponse } from "fastify";
 import type { Route } from "../ctx/create-ctx.js";
-import { type GatewayRoutes } from "./gateway.module.js";
-import { type HealthOptions } from "./health.controller.js";
+import { type GatewayRoutes } from "./gateway-routes.js";
 import { type PluginRouteTable } from "./plugin-dispatch.js";
-export type { HealthOptions } from "./health.controller.js";
 /** 内核 HTTP 的只读视图：进程内注入请求与列出路由（测试与元测试用）。 */
 export interface KernelHttp {
     inject(opts: InjectOptions): Promise<LightMyRequestResponse>;
@@ -36,19 +34,13 @@ export interface KernelHttpApp extends KernelHttp {
 }
 export interface CreateHttpAppOptions {
     log: Logger;
-    health: HealthOptions;
-    /** 是否提供内核 API（`apiModule`）。 */
-    serveApi: boolean;
-    /** 是否转发 `/plugins/*` 到插件路由。 */
+    /** Whether `/plugins/*` is dispatched to extension routes. */
     servePlugins: boolean;
     /**
      * Gateway-role routes (the channel webhook), registered only when given: the kernel passes them
      * when `roles` includes `gateway` (`serveGateway`).
      */
     gateway?: GatewayRoutes;
-    apiModule?: DynamicModule;
-    /** 信任哪些代理跳：false、跳数，或受信代理 IP / CIDR 列表（见 `http.trustProxy` 配置）。 */
-    trustProxy?: boolean | number | string[];
     /** 副本标识（`http.replicaId`）：设置时每个响应带 `x-capybara-replica` 头。 */
     replicaId?: string | undefined;
     /**
@@ -70,8 +62,12 @@ export declare const CATALOG_UPLOAD_ROUTE = "/api/v1/admin/catalog/import/file";
  */
 export declare const PACKAGE_UPLOAD_ROUTES: ReadonlySet<string>;
 /**
- * 创建并初始化内核 HTTP 应用（NestJS + Fastify），不连接任何外部资源。
- * 插件路由不经过 Nest：在 Fastify 的独立作用域里统一转发 `/plugins/*`（见 plugin-dispatch.ts）；
- * 插件加载前 `/plugins/*` 一律 404。未匹配的内核路由同样返回 404 错误信封。
+ * Sets up the Fastify side of the kernel's Nest application (built by `buildKernelApp` from
+ * `KernelModule`, which provides the health endpoints and the API) without connecting to anything,
+ * and returns it uninitialized: `init()` is the caller's (it runs the start sequence), `close()`
+ * closes only the HTTP server (the rest of the application is closed by the caller's shutdown).
+ * Extension routes do not go through Nest: `/plugins/*` is dispatched in its own Fastify scope
+ * (see plugin-dispatch.ts) and answers 404 until extensions are loaded. Unmatched kernel routes
+ * answer the 404 error envelope as well.
  */
-export declare function createHttpApp(opts: CreateHttpAppOptions): Promise<KernelHttpApp>;
+export declare function createHttpApp(opts: CreateHttpAppOptions, app: NestFastifyApplication): Promise<KernelHttpApp>;