@capybara-hq/kernel 0.1.0-rc.10 → 0.1.0-rc.11

package/dist/catalog/component-scope.service.d.ts

@@ -1,8 +1,11 @@
+import type { LocalizedName, ThemeScheme } from "@capybara-hq/plugin-sdk";
 import { ApiError } from "../errors.js";
 import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { OrgLock } from "../orgs/org-lock.js";
+import { type ThemeSwatch } from "../themes/theme-state.js";
+import { type ThemePreview } from "../themes/theme-usage.js";
 import type { ActorOpts } from "./catalog.service.js";
 import { ComponentPromotion } from "./component-promotion.js";
 import { type ComponentKind } from "./component-state.js";
@@ -38,7 +41,14 @@ export interface ComponentScopePreview {
         plugins: string[];
         /** An agent template's: the owner of each clashing template, in `skills`' order. */
         owners?: Owner[];
+        /** A theme's: the clashing themes on in the org (`skills` then empty). */
+        themes?: string[];
     }[];
+    /**
+     * A theme the change takes away from some orgs (themes spec §6): the orgs among them whose
+     * default it is and how many people picked it. Absent when no theme is taken away.
+     */
+    themes?: ThemePreview[];
     scopeHash: string;
 }
 /** A component's own scope (`orgs` only with `named`), a disable, or following its plugin again. */
@@ -91,6 +101,11 @@ export interface ComponentView {
      * other scopes, builtin plugins and orgs' own rows.
      */
     offCount: number;
+    /** A theme: its name and swatches from its current version (absent for other kinds). */
+    theme?: {
+        name: LocalizedName;
+        swatches: Partial<Record<ThemeScheme, ThemeSwatch>>;
+    };
 }
 /** One version of a platform component (`GET admin/components/:kind/:id/versions`). */
 export interface ComponentVersionView {
@@ -111,7 +126,10 @@ export interface OrgComponentView {
     /** The org's switch (null: never switched). */
     switch: boolean | null;
     on: boolean;
-    /** Of a builtin plugin: it cannot be switched off (an `all` one can, layering spec §4). */
+    /**
+     * Of a builtin plugin, or the platform default theme (themes spec §7): it cannot be switched off
+     * (an `all` one can, layering spec §4).
+     */
     locked: boolean;
 }
 /**
@@ -157,6 +175,11 @@ export type ComponentSwitchResult = {
             refs: string[];
         }[];
         connectorsKept: number;
+        /**
+         * A theme: whether it is the org's default and how many of its members picked it (themes
+         * spec §6). Absent for other kinds and for a theme nobody there chose.
+         */
+        themes?: ThemePreview[];
     };
     confirm: string;
 };
@@ -166,6 +189,8 @@ type AuditOpts = ActorOpts & {
 };
 /**
  * 409 `plugin.skill_conflict` listing the orgs whose own skills use a component's name (rule 10);
+ * for a theme 409 `theme.id_taken` listing the orgs where another theme with its id is on (details
+ * `[{ theme, orgId, themes, plugins }]`);
  * for an agent template 409 `agent_template.name_taken` listing the orgs that already use its
  * roster type (ruling P4-13; details `[{ orgId, type, templateId, owner }]`, one per clashing
  * template, `owner` as save-as names it).
@@ -181,10 +206,11 @@ export declare function nameConflictError(conflicts: ComponentScopePreview["conf
  * An org admin switches one component on or off in the org (only that component, rule 5); one of a
  * builtin plugin -> 409 `plugin.scope_locked` (an `all` one may go off, layering spec §4); switching
  * off something in use is previewed with its agents first.
- * Name clashes are checked for skills only: an org agent template always carries its plugin's
- * type, so one with a platform template's type is a copy of it. Components are resolved at read
- * time (skills/usable.ts, agents/templates.ts), so nothing is enqueued. Stateless, shared by every
- * replica.
+ * Name clashes are checked for skills, agent templates by their roster type, and themes by their
+ * id among the themes on in an org (themes spec §6). A change that would take the platform default
+ * theme away from an org is refused (409 `theme.platform_default`, themes spec §7). Components are
+ * resolved at read time (skills/usable.ts, agents/templates.ts), so nothing is enqueued.
+ * Stateless, shared by every replica.
  */
 export declare class ComponentScopeService {
     private readonly kdb;
@@ -203,7 +229,7 @@ export declare class ComponentScopeService {
     /**
      * What the admin routes act on (ruling P3-23): the platform component `id`, an org row the org
      * promoted already (its platform row), or an org's own row not promoted yet. A connector
-     * template has no org rows; anything else -> 404 `component.not_found`.
+     * template or a theme has no org rows; anything else -> 404 `component.not_found`.
      */
     private resolve;
     /**
@@ -224,12 +250,13 @@ export declare class ComponentScopeService {
     /**
      * The org's copies of platform skills or agent templates linked without a pin (ruling B2), by
      * platform id: they resolve to it, so agents that select them use it (none for connector
-     * templates).
+     * templates and themes).
      */
     private linkedCopies;
     /**
      * The orgs' own skills (org scope) and agent templates, not linked to a platform component
-     * (ruling P2-11): listed read-only, on in their org only. Connector templates have none.
+     * (ruling P2-11): listed read-only, on in their org only. Connector templates have none; an
+     * org's own theme is a platform_themes row with its org as owner, listed with the platform ones.
      */
     private orgOwned;
     /** The preview of a scope change, a disable or a return to following the plugin (nothing written). */
@@ -257,7 +284,8 @@ export declare class ComponentScopeService {
      * The org admin's switch of one component (`PUT orgs/:orgId/components/:kind/:id/switch`): only
      * this component (rule 5). A component not offered to the org -> 404. On: refused while the
      * component or its plugin is disabled (`plugin.disabled`) or an own skill of the org has its name
-     * (`plugin.skill_conflict`, rule 10). Off: of a builtin plugin -> `plugin.scope_locked`; while it
+     * (`plugin.skill_conflict`, rule 10; a theme: `theme.id_taken`). Off: the platform default theme
+     * while it is on -> `theme.platform_default`; of a builtin plugin -> `plugin.scope_locked`; while it
      * is on, without `confirm` the preview (agents that use it) and its hash are returned, with the
      * current hash the switch is written (a changed preview -> `plugin.switch_stale`).
      */
@@ -314,6 +342,17 @@ export declare class ComponentScopeService {
      * (an org row not promoted yet: `[owner]`), else read.
      */
     private targetOf;
+    /**
+     * 409 `theme.platform_default` when theme `c` is the platform default and `t` would leave it
+     * narrower than `all` or gone (themes spec §7), in the caller's transaction, before any write.
+     */
+    private assertKeepsPlatformDefault;
+    /**
+     * Theme `c`'s availability under `t`: gone when disabled (or its plugin is disabled or deleted
+     * while it follows it), else `all` when its effective scope (its own, or its plugin's; builtin:
+     * `all`) is `all`, else narrower.
+     */
+    private themeAfter;
     /** Live orgs (`only`: that one), sorted by id. */
     private liveOrgs;
     private on;

package/dist/catalog/component-scope.service.js

@@ -19,9 +19,11 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { OrgLock } from "../orgs/org-lock.js";
+import { themeDefinitions, themeSwatches } from "../themes/theme-state.js";
+import { assertNotPlatformDefault, platformDefaultThemeId, themesPreview, } from "../themes/theme-usage.js";
 import { assertOrgsExist } from "./catalog-items.js";
 import { ComponentPromotion, notOwnedError, PROMOTION_ATTEMPTS, PromotionStale, promotionStaleError, } from "./component-promotion.js";
-import { agentsUsing, COMPONENT_KINDS, componentLocked, componentOffered, componentOn, componentPluginOn, connectorsMadeFrom, listedIn, loadComponents, loadScopeState, pluginFactsOf, skillNameClashes, switchOf, } from "./component-state.js";
+import { agentsUsing, COMPONENT_KINDS, componentLocked, componentOffered, componentOn, componentPluginOn, connectorsMadeFrom, listedIn, loadComponents, loadScopeState, pluginFactsOf, skillNameClashes, switchOf, themeIdClashes, } from "./component-state.js";
 import { assertOwnerListed, assertShareable, assertShareableTarget, newlySharedWith, ownerOf, ownersOf, } from "./ownership.js";
 const notFound = () => new ApiError("component.not_found", "Component not found");
 const staleError = () => new ApiError("plugin.scope_stale", "What this change affects has changed since the preview; preview it again and confirm the new hash");
@@ -31,14 +33,27 @@ const ACTION = {
     skill: "skills.manage",
     agent_template: "agents.manage",
     connector_template: "connectors.manage",
+    theme: "org.update",
 };
 /**
  * 409 `plugin.skill_conflict` listing the orgs whose own skills use a component's name (rule 10);
+ * for a theme 409 `theme.id_taken` listing the orgs where another theme with its id is on (details
+ * `[{ theme, orgId, themes, plugins }]`);
  * for an agent template 409 `agent_template.name_taken` listing the orgs that already use its
  * roster type (ruling P4-13; details `[{ orgId, type, templateId, owner }]`, one per clashing
  * template, `owner` as save-as names it).
  */
 export function nameConflictError(conflicts, kind = "skill") {
+    if (kind === "theme") {
+        return new ApiError("theme.id_taken", conflicts
+            .map((c) => `A theme with id ${c.name} is already on in organization ${c.orgName} (plugin "${c.plugins.join('", "')}"); one theme id cannot be on there twice. Switch that theme off there first.`)
+            .join("\n"), conflicts.map((c) => ({
+            theme: c.name,
+            orgId: c.orgId,
+            themes: c.themes ?? [],
+            plugins: c.plugins,
+        })));
+    }
     if (kind === "agent_template") {
         // the save-as wording (ruling P4-9), naming each clashing template's owner
         const whose = (o, orgId) => o === undefined || o.kind === "platform"
@@ -76,6 +91,8 @@ function previewHash(c, target, p) {
             .sort((a, b) => a.orgId.localeCompare(b.orgId))
             .map((a) => ({ ...a, agents: [...a.agents].sort((x, y) => x.id.localeCompare(y.id)) })),
         conflicts: [...p.conflicts].sort((a, b) => a.orgId.localeCompare(b.orgId)),
+        // only when present: a preview without themes keeps the hash it had before themes
+        ...(p.themes !== undefined && { themes: p.themes }),
     }))
         .digest("hex");
 }
@@ -95,10 +112,11 @@ function switchHash(orgId, c, preview) {
  * An org admin switches one component on or off in the org (only that component, rule 5); one of a
  * builtin plugin -> 409 `plugin.scope_locked` (an `all` one may go off, layering spec §4); switching
  * off something in use is previewed with its agents first.
- * Name clashes are checked for skills only: an org agent template always carries its plugin's
- * type, so one with a platform template's type is a copy of it. Components are resolved at read
- * time (skills/usable.ts, agents/templates.ts), so nothing is enqueued. Stateless, shared by every
- * replica.
+ * Name clashes are checked for skills, agent templates by their roster type, and themes by their
+ * id among the themes on in an org (themes spec §6). A change that would take the platform default
+ * theme away from an org is refused (409 `theme.platform_default`, themes spec §7). Components are
+ * resolved at read time (skills/usable.ts, agents/templates.ts), so nothing is enqueued.
+ * Stateless, shared by every replica.
  */
 let ComponentScopeService = class ComponentScopeService {
     kdb;
@@ -123,13 +141,13 @@ let ComponentScopeService = class ComponentScopeService {
     /**
      * What the admin routes act on (ruling P3-23): the platform component `id`, an org row the org
      * promoted already (its platform row), or an org's own row not promoted yet. A connector
-     * template has no org rows; anything else -> 404 `component.not_found`.
+     * template or a theme has no org rows; anything else -> 404 `component.not_found`.
      */
     async resolve(kind, id) {
         const [c] = await loadComponents(this.db, kind, { ids: [id] });
         if (c)
             return { c };
-        if (kind === "connector_template")
+        if (kind === "connector_template" || kind === "theme")
             throw notFound();
         const org = await this.promotion.orgRow(kind, id);
         if (!org)
@@ -166,7 +184,12 @@ let ComponentScopeService = class ComponentScopeService {
         const st = await loadScopeState(this.db, kind, comps);
         const orgs = await this.liveOrgs();
         const owners = await ownersOf(this.db, comps.flatMap((c) => (c.ownerOrgId === null ? [] : [c.ownerOrgId])));
+        // a theme's name and swatches come from its current definition (the admin pickers, §10)
+        const defs = kind === "theme"
+            ? await themeDefinitions(this.db, comps.map((c) => c.id))
+            : null;
         const platform = comps.map((c) => {
+            const def = defs?.get(c.id)?.definition;
             const plugin = c.itemId === null ? undefined : st.plugins.get(c.itemId);
             const follow = c.scopeMode === "follow" && c.itemId !== null;
             const scope = follow
@@ -202,6 +225,7 @@ let ComponentScopeService = class ComponentScopeService {
                 offCount: scope === "all" && plugin?.builtin !== true
                     ? orgs.filter((o) => switchOf(st, c.id, o.id) === false).length
                     : 0,
+                ...(def !== undefined && { theme: { name: def.name, swatches: themeSwatches(def) } }),
             };
         });
         const owned = await this.orgOwned(kind, orgs);
@@ -213,6 +237,8 @@ let ComponentScopeService = class ComponentScopeService {
      */
     async orgList(orgId, filter) {
         const out = [];
+        // the platform default theme is locked on in every org (themes spec §7)
+        const uiTheme = await platformDefaultThemeId(this.db);
         for (const kind of filter.kind !== undefined ? [filter.kind] : COMPONENT_KINDS) {
             const comps = await loadComponents(this.db, kind, filter.itemId !== undefined ? { itemId: filter.itemId } : {});
             const st = await loadScopeState(this.db, kind, comps);
@@ -226,7 +252,7 @@ let ComponentScopeService = class ComponentScopeService {
                 const on = componentOn(c, p, listed, sw);
                 if (!on && !componentOffered(c, p, listed))
                     continue;
-                const locked = componentLocked(c, p);
+                const locked = componentLocked(c, p) || isUiTheme(c, uiTheme);
                 const pluginOn = componentPluginOn(c, p);
                 rows.push({
                     kind,
@@ -255,11 +281,11 @@ let ComponentScopeService = class ComponentScopeService {
     /**
      * The org's copies of platform skills or agent templates linked without a pin (ruling B2), by
      * platform id: they resolve to it, so agents that select them use it (none for connector
-     * templates).
+     * templates and themes).
      */
     async linkedCopies(orgId, kind) {
         const out = new Map();
-        if (kind === "connector_template")
+        if (kind === "connector_template" || kind === "theme")
             return out;
         const rows = kind === "skill"
             ? await this.db
@@ -289,10 +315,11 @@ let ComponentScopeService = class ComponentScopeService {
     }
     /**
      * The orgs' own skills (org scope) and agent templates, not linked to a platform component
-     * (ruling P2-11): listed read-only, on in their org only. Connector templates have none.
+     * (ruling P2-11): listed read-only, on in their org only. Connector templates have none; an
+     * org's own theme is a platform_themes row with its org as owner, listed with the platform ones.
      */
     async orgOwned(kind, orgs) {
-        if (kind === "connector_template")
+        if (kind === "connector_template" || kind === "theme")
             return [];
         const live = new Set(orgs.map((o) => o.id));
         const rows = kind === "skill"
@@ -428,7 +455,8 @@ let ComponentScopeService = class ComponentScopeService {
      * The org admin's switch of one component (`PUT orgs/:orgId/components/:kind/:id/switch`): only
      * this component (rule 5). A component not offered to the org -> 404. On: refused while the
      * component or its plugin is disabled (`plugin.disabled`) or an own skill of the org has its name
-     * (`plugin.skill_conflict`, rule 10). Off: of a builtin plugin -> `plugin.scope_locked`; while it
+     * (`plugin.skill_conflict`, rule 10; a theme: `theme.id_taken`). Off: the platform default theme
+     * while it is on -> `theme.platform_default`; of a builtin plugin -> `plugin.scope_locked`; while it
      * is on, without `confirm` the preview (agents that use it) and its hash are returned, with the
      * current hash the switch is written (a changed preview -> `plugin.switch_stale`).
      */
@@ -459,7 +487,26 @@ let ComponentScopeService = class ComponentScopeService {
             throw new ApiError("plugin.disabled", "This component is disabled by the super admin and cannot be switched on");
         }
         if (body.enabled) {
-            if (kind !== "connector_template" && !on) {
+            if (kind === "theme") {
+                // theme ids are unique among the themes on in the org (themes spec §6)
+                if (!on && componentOn(c, p, listed, true)) {
+                    const clash = await themeIdClashes(this.db, orgId, c, c.name);
+                    if (clash.length > 0) {
+                        const [org] = await this.liveOrgs(orgId);
+                        throw nameConflictError([
+                            {
+                                orgId,
+                                orgName: org?.name ?? orgId,
+                                name: c.name,
+                                skills: [],
+                                themes: clash.map((x) => x.id),
+                                plugins: clash.map((x) => x.plugin ?? "platform"),
+                            },
+                        ], kind);
+                    }
+                }
+            }
+            else if (kind !== "connector_template" && !on) {
                 const clash = kind === "skill"
                     ? await skillNameClashes(this.db, orgId, c, c.name)
                     : await templateTypeClashes(this.db, orgId, c);
@@ -471,13 +518,22 @@ let ComponentScopeService = class ComponentScopeService {
             }
         }
         else {
+            // The platform default theme is locked on in every org (themes spec §7): refused before the
+            // preview, inside this transaction
+            if (kind === "theme" && on)
+                await assertNotPlatformDefault(this.db, [c.id], () => "narrower");
             if (componentLocked(c, p)) {
                 throw new ApiError("plugin.scope_locked", "This component belongs to a built-in plugin: it is on for every organization and cannot be switched off here");
             }
             if (on) {
+                const themes = kind === "theme"
+                    ? await themesPreview(this.db, new Map([[c.id, new Set([orgId])]]))
+                    : undefined;
                 const preview = {
                     agents: await agentsUsing(this.db, orgId, kind, [c.id]),
                     connectorsKept: kind === "connector_template" ? await connectorsMadeFrom(this.db, orgId, c.id) : 0,
+                    // a theme only: other kinds keep the preview (and the hash) they had before themes
+                    ...(themes !== undefined && { themes }),
                 };
                 const confirm = switchHash(orgId, c, preview);
                 if (body.confirm === undefined)
@@ -528,7 +584,7 @@ let ComponentScopeService = class ComponentScopeService {
                 plugin: c.plugin,
                 switch: body.enabled,
                 on: componentOn(c, p, listed, body.enabled),
-                locked: componentLocked(c, p),
+                locked: componentLocked(c, p) || isUiTheme(c, await platformDefaultThemeId(this.db)),
             },
         };
     }
@@ -551,7 +607,7 @@ let ComponentScopeService = class ComponentScopeService {
         const offered = componentOffered({ ...c, disabled: false }, p && { ...p, disabled: false }, listed);
         if (!on && !offered)
             throw notFound();
-        const locked = componentLocked(c, p);
+        const locked = componentLocked(c, p) || isUiTheme(c, await platformDefaultThemeId(this.db));
         let preview = null;
         let confirm = null;
         if (on && !locked) {
@@ -578,6 +634,8 @@ let ComponentScopeService = class ComponentScopeService {
             id = await this.promotion.promote(x.promote, actor);
         const c = await this.component(kind, id, true);
         const t = await this.targetOf(c, target);
+        if (kind === "theme")
+            await this.assertKeepsPlatformDefault(c, t);
         const from = await this.listed(kind, id);
         // Its own scope: the owner stays listed (P3-17), widening goes through the share gate (P3-16);
         // following the plugin again takes the plugin's scope, which its own writer gates
@@ -615,8 +673,9 @@ let ComponentScopeService = class ComponentScopeService {
                 .values(t.orgs.map((org_id) => ({ kind, component_id: id, org_id })))
                 .execute();
         }
-        // An own scope that newly shows an org-owned component tells its owner (P3-22)
-        if (t.scopeMode === "own" && kind !== "connector_template") {
+        // An own scope that newly shows an org-owned component tells its owner (P3-22); not a theme:
+        // the `item_shared` notice names plugins, skills and agent templates only
+        if (t.scopeMode === "own" && kind !== "connector_template" && kind !== "theme") {
             const shared = newlySharedWith(before, t);
             if (shared === "all_orgs" || shared.length > 0) {
                 await notifyItemShared(this.db, c.ownerOrgId, { kind, id }, c.name, shared);
@@ -643,7 +702,10 @@ let ComponentScopeService = class ComponentScopeService {
         const c = await this.component(kind, id, true);
         if (c.disabled === disabled)
             return;
-        const p = await this.compute(c, await this.targetOf(c, { disabled }));
+        const t = await this.targetOf(c, { disabled });
+        if (kind === "theme")
+            await this.assertKeepsPlatformDefault(c, t);
+        const p = await this.compute(c, t);
         if (disabled && p.scopeHash !== hash)
             throw staleError();
         if (p.conflicts.length > 0)
@@ -737,12 +799,19 @@ let ComponentScopeService = class ComponentScopeService {
                 .where("skill_id", "=", id)
                 .orderBy("version", "desc")
                 .execute()
-            : await this.db
-                .selectFrom("platform_agent_template_versions")
-                .select(["version", "catalog_version", "updated_on_own", "created_at"])
-                .where("template_id", "=", id)
-                .orderBy("version", "desc")
-                .execute();
+            : kind === "theme"
+                ? await this.db
+                    .selectFrom("platform_theme_versions")
+                    .select(["version", "catalog_version", "updated_on_own", "created_at"])
+                    .where("theme_id", "=", id)
+                    .orderBy("version", "desc")
+                    .execute()
+                : await this.db
+                    .selectFrom("platform_agent_template_versions")
+                    .select(["version", "catalog_version", "updated_on_own", "created_at"])
+                    .where("template_id", "=", id)
+                    .orderBy("version", "desc")
+                    .execute();
         return rows.map((r) => ({
             version: String(r.version),
             catalogVersion: r.catalog_version,
@@ -860,6 +929,36 @@ let ComponentScopeService = class ComponentScopeService {
         await assertOrgsExist(this.db, orgs);
         return { scopeMode: "own", scope: target.scope, orgs, disabled: c.disabled };
     }
+    /**
+     * 409 `theme.platform_default` when theme `c` is the platform default and `t` would leave it
+     * narrower than `all` or gone (themes spec §7), in the caller's transaction, before any write.
+     */
+    async assertKeepsPlatformDefault(c, t) {
+        const after = await this.themeAfter(c, t);
+        await assertNotPlatformDefault(this.db, [c.id], () => after);
+    }
+    /**
+     * Theme `c`'s availability under `t`: gone when disabled (or its plugin is disabled or deleted
+     * while it follows it), else `all` when its effective scope (its own, or its plugin's; builtin:
+     * `all`) is `all`, else narrower.
+     */
+    async themeAfter(c, t) {
+        if (t.disabled)
+            return "gone";
+        if (t.scopeMode === "own")
+            return t.scope === "all" ? "all" : "narrower";
+        if (c.itemId === null)
+            return "gone";
+        const item = await this.db
+            .selectFrom("catalog_items")
+            .select(["scope", "builtin", "disabled"])
+            .where("id", "=", c.itemId)
+            .where("deleted_at", "is", null)
+            .executeTakeFirst();
+        if (!item || item.disabled)
+            return "gone";
+        return item.builtin || item.scope === "all" ? "all" : "narrower";
+    }
     /** Live orgs (`only`: that one), sorted by id. */
     async liveOrgs(only) {
         let q = this.db
@@ -894,11 +993,16 @@ let ComponentScopeService = class ComponentScopeService {
         const listedAfter = new Set(target.orgs);
         const affected = [];
         const conflicts = [];
+        /** A theme: the orgs it is on in now and would be off in. */
+        const lost = new Set();
         for (const org of await this.liveOrgs()) {
             const p = pluginFactsOf(st, c.itemId, org.id);
             const listed = listedIn(st, c.id, org.id);
             const sw = switchOf(st, c.id, org.id);
-            if (componentOn(c, p, listed, sw) && !componentOn(after, p, listedAfter.has(org.id), sw)) {
+            const onNow = componentOn(c, p, listed, sw);
+            const onAfter = componentOn(after, p, listedAfter.has(org.id), sw);
+            if (onNow && !onAfter) {
+                lost.add(org.id);
                 const agents = await agentsUsing(this.db, org.id, c.kind, [c.id]);
                 affected.push({
                     orgId: org.id,
@@ -907,6 +1011,23 @@ let ComponentScopeService = class ComponentScopeService {
                     connectorsKept: c.kind === "connector_template" ? await connectorsMadeFrom(this.db, org.id, c.id) : 0,
                 });
             }
+            if (c.kind === "theme") {
+                // theme ids are unique among the themes on in an org (themes spec §6)
+                if (onAfter && !onNow) {
+                    const clash = await themeIdClashes(this.db, org.id, c, c.name);
+                    if (clash.length > 0) {
+                        conflicts.push({
+                            orgId: org.id,
+                            orgName: org.name,
+                            name: c.name,
+                            skills: [],
+                            themes: clash.map((x) => x.id),
+                            plugins: clash.map((x) => x.plugin ?? "platform"),
+                        });
+                    }
+                }
+                continue;
+            }
             if (c.kind !== "connector_template" &&
                 componentOffered(after, p, listedAfter.has(org.id)) &&
                 !componentOffered(c, p, listed)) {
@@ -920,7 +1041,8 @@ let ComponentScopeService = class ComponentScopeService {
                 }
             }
         }
-        const p = { affected, conflicts };
+        const themes = c.kind === "theme" ? await themesPreview(this.db, new Map([[c.id, lost]])) : undefined;
+        const p = { affected, conflicts, ...(themes !== undefined && { themes }) };
         return { ...p, scopeHash: previewHash({ kind: c.kind, id: x.hashId ?? c.id }, target, p) };
     }
 };
@@ -945,6 +1067,8 @@ ComponentScopeService = __decorate([
     __param(4, Inject(TransactionHost))
 ], ComponentScopeService);
 export { ComponentScopeService };
+/** Whether `c` is the platform default theme `uiTheme` (locked on in every org, themes spec §7). */
+const isUiTheme = (c, uiTheme) => c.kind === "theme" && c.id === uiTheme;
 /** The plugin row FOR SHARE (exclusive with its scope writers and an unshare, which hold it FOR UPDATE). */
 async function lockItemShared(db, itemId) {
     await db.selectFrom("catalog_items").select("id").where("id", "=", itemId).forShare().execute();
@@ -987,4 +1111,5 @@ const TABLE = {
     skill: "platform_skills",
     agent_template: "platform_agent_templates",
     connector_template: "platform_connector_templates",
+    theme: "platform_themes",
 };

package/dist/catalog/component-state.d.ts

@@ -1,7 +1,8 @@
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import { type PluginScope } from "./scope.js";
 /** The kinds of platform components. */
-export type ComponentKind = "skill" | "agent_template" | "connector_template";
+export type ComponentKind = "skill" | "agent_template" | "connector_template" | "theme";
+/** The kinds the scope, switch, ownership and preview flows (and the component routes) walk. */
 export declare const COMPONENT_KINDS: readonly ComponentKind[];
 /** A component's own scope settings (ruling C2). */
 export interface ComponentScopeFacts {
@@ -70,7 +71,7 @@ export interface ComponentRow extends ComponentScopeFacts {
     shownToOthers: boolean;
     /** The owning org (null: the platform; ruling P3-1). */
     ownerOrgId: string | null;
-    /** The org it was created in (skills, agent templates; null: the platform, F27). */
+    /** The org it was created in (skills, agent templates, themes; null: the platform, F27). */
     originOrgId: string | null;
     /** Its owner shares it with other orgs (the share gate, P3-1). */
     shareable: boolean;
@@ -130,7 +131,8 @@ export declare function agentDefinitionRefs(db: KernelSchemaDb, orgId: string):
 /**
  * The ids an org's agents may reference a platform component by: its own id and the org's copies
  * linked to it (ruling B2: unpinned ones resolve to it; ruling P2-18: pinned ones follow its
- * availability). Connector templates: none (connectors made from one stay the org's own).
+ * availability). Connector templates: none (connectors made from one stay the org's own); themes:
+ * none (no agent references a theme, and a theme has no org copies).
  */
 export declare function referenceIds(db: KernelSchemaDb, orgId: string, kind: ComponentKind, ids: readonly string[]): Promise<Map<string, string>>;
 /**
@@ -167,6 +169,13 @@ export declare function skillNameClashes(db: KernelSchemaDb, orgId: string, comp
     skills: string[];
     plugins: string[];
 }>;
+/**
+ * The live themes with id `name` that are on in the org (themes spec §6: theme ids are unique in an
+ * org's usable set, rule 10), except `self` (null: a theme with no row yet, e.g. one an update adds).
+ */
+export declare function themeIdClashes(db: KernelSchemaDb, orgId: string, self: {
+    id: string;
+} | null, name: string): Promise<ComponentRow[]>;
 /** A connector template's id from its manifest path (`./connectors/<id>.json`). */
 export declare const templateIdOfPath: (path: string) => string;
 /**

package/dist/catalog/component-state.js

@@ -1,8 +1,10 @@
 import { visibleTo, wantedOn } from "./scope.js";
+/** The kinds the scope, switch, ownership and preview flows (and the component routes) walk. */
 export const COMPONENT_KINDS = [
     "skill",
     "agent_template",
     "connector_template",
+    "theme",
 ];
 /** The component or its plugin stops it everywhere: disabled, or the plugin disabled or deleted. */
 function stopped(c, p) {
@@ -115,7 +117,11 @@ export async function loadComponents(db, kind, filter = {}) {
             originOrgId: null,
         }));
     }
-    const table = kind === "skill" ? "platform_skills" : "platform_agent_templates";
+    const table = kind === "skill"
+        ? "platform_skills"
+        : kind === "theme"
+            ? "platform_themes"
+            : "platform_agent_templates";
     let q = db
         .selectFrom(`${table} as p`)
         .select([
@@ -308,11 +314,12 @@ export async function agentDefinitionRefs(db, orgId) {
 /**
  * The ids an org's agents may reference a platform component by: its own id and the org's copies
  * linked to it (ruling B2: unpinned ones resolve to it; ruling P2-18: pinned ones follow its
- * availability). Connector templates: none (connectors made from one stay the org's own).
+ * availability). Connector templates: none (connectors made from one stay the org's own); themes:
+ * none (no agent references a theme, and a theme has no org copies).
  */
 export async function referenceIds(db, orgId, kind, ids) {
     const out = new Map();
-    if (kind === "connector_template" || ids.length === 0)
+    if (kind === "connector_template" || kind === "theme" || ids.length === 0)
         return out;
     for (const id of ids)
         out.set(id, id);
@@ -402,6 +409,17 @@ export async function skillNameClashes(db, orgId, component, name) {
         plugins: platform.map((c) => c.plugin ?? "platform"),
     };
 }
+/**
+ * The live themes with id `name` that are on in the org (themes spec §6: theme ids are unique in an
+ * org's usable set, rule 10), except `self` (null: a theme with no row yet, e.g. one an update adds).
+ */
+export async function themeIdClashes(db, orgId, self, name) {
+    const others = (await loadComponents(db, "theme", { name })).filter((c) => c.id !== self?.id);
+    if (others.length === 0)
+        return [];
+    const st = await loadScopeState(db, "theme", others);
+    return others.filter((c) => componentOn(c, pluginFactsOf(st, c.itemId, orgId), listedIn(st, c.id, orgId), switchOf(st, c.id, orgId)));
+}
 /** A connector template's id from its manifest path (`./connectors/<id>.json`). */
 export const templateIdOfPath = (path) => (path.split("/").pop() ?? path).replace(/\.json$/, "");
 /**

package/dist/catalog/marketplaces.service.d.ts

@@ -188,7 +188,7 @@ export declare function headsToResolve(entries: readonly MarketplaceEntry[], imp
 /** The host versions (an entry's `minKernel` is judged against them). */
 export declare const HOST_VERSIONS: {
     readonly kernel: string;
-    readonly sdk: "0.1.0-rc.7";
+    readonly sdk: "0.1.0-rc.8";
 };
 /** Whether this deployment satisfies the entry's `minKernel`. */
 export declare const entryCompatible: (e: Pick<MarketplaceEntry, "minKernel">) => boolean;

package/dist/catalog/org-catalog.service.js

@@ -479,6 +479,9 @@ let OrgCatalogService = class OrgCatalogService {
             await this.recordSwitch(orgId, actor, itemId, false);
             return { kind: "done", item: await this.itemOf(orgId, actor, itemId) };
         }
+        // The platform default theme is locked on (themes spec §7): refused at the preview already;
+        // the uninstall's transaction checks again before it writes
+        await this.pluginInstaller.assertKeepsPlatformDefault(orgId, live.id);
         const preview = await this.pluginInstaller.previewUninstall(orgId, live.id);
         const confirm = uninstallPreviewHash(preview);
         if (body.confirm === undefined)