@capybara-hq/kernel 0.1.0-rc.11 → 0.1.0-rc.13

package/dist/extensions/instance.d.ts

@@ -1,4 +1,4 @@
-import { type ExtensionManifest, type ExtensionPointRef, type StaticExtensionManifest } from "@capybara-hq/plugin-sdk";
+import { type DroppedUiContribution, type ExtensionManifest, type ExtensionPointRef, type ResolvedUiContribution, type StaticExtensionManifest } from "@capybara-hq/plugin-sdk";
 import { type ExtensionPointAccess, type KernelDeps, type KernelExtensionContext, LiveConfig, type RegisteredTool, type Route } from "../ctx/create-ctx.js";
 import type { UiActionHandler, UiRender } from "../ui/registry.js";
 import type { RegisteredHook } from "./hooks.js";
@@ -44,6 +44,17 @@ export declare class ExtensionInstance {
     readonly generation: number;
     readonly manifest: ExtensionManifest;
     readonly permissions: PermissionSet;
+    /** The manifest's UI contributions whose slot the catalog knows (UI slots spec §3.2), in manifest order. */
+    readonly ui: ResolvedUiContribution[];
+    /** The manifest's UI contributions left out at load (unknown slot or slot version). */
+    readonly uiDropped: DroppedUiContribution[];
+    /** `after` values that are not anchors of their slot (the contribution keeps the default position). */
+    readonly uiUnknownAnchors: {
+        id: string;
+        after: string;
+    }[];
+    /** Ids of contributions that still name the deprecated `place`. */
+    readonly uiDeprecatedPlace: string[];
     private hash;
     private readonly live;
     readonly entryUrl: string;

package/dist/extensions/instance.js

@@ -60,6 +60,14 @@ export class ExtensionInstance {
     generation;
     manifest;
     permissions;
+    /** The manifest's UI contributions whose slot the catalog knows (UI slots spec §3.2), in manifest order. */
+    ui;
+    /** The manifest's UI contributions left out at load (unknown slot or slot version). */
+    uiDropped;
+    /** `after` values that are not anchors of their slot (the contribution keeps the default position). */
+    uiUnknownAnchors;
+    /** Ids of contributions that still name the deprecated `place`. */
+    uiDeprecatedPlace;
     hash;
     live;
     entryUrl;
@@ -77,6 +85,11 @@ export class ExtensionInstance {
         this.source = init.source;
         this.generation = init.generation;
         this.permissions = init.permissions;
+        const ui = init.ctx.uiResolution;
+        this.ui = ui.resolved;
+        this.uiDropped = ui.dropped;
+        this.uiUnknownAnchors = ui.unknownAnchors;
+        this.uiDeprecatedPlace = ui.deprecatedPlace;
         this.hash = init.configHash;
         this.live = init.config;
         this.entryUrl = init.entryUrl;

package/dist/extensions/permission-view.d.ts

@@ -1,4 +1,4 @@
-import type { LocalizedName } from "@capybara-hq/plugin-sdk";
+import type { LocalizedName, UiDropReason } from "@capybara-hq/plugin-sdk";
 import type { PluginScope } from "../catalog/scope.js";
 import { type PermissionSet } from "./permission-set.js";
 import type { ExtensionSource } from "./sources.js";
@@ -142,6 +142,15 @@ export interface AdminExtensionView {
     builtin: boolean;
     /** Where the install record came from (`bootstrap` for the bootstrap step); null for config-declared. */
     installSource: "npm" | "file" | "catalog" | "bootstrap" | null;
+    /**
+     * UI contributions this replica's loaded instance left out at load (UI slots spec §3.2): a slot the
+     * catalog does not know, or not at that version. `[]` when the extension is not loaded here.
+     */
+    uiDropped: {
+        id: string;
+        ref: string;
+        reason: UiDropReason;
+    }[];
     /**
      * Only with status `conflict`: the single-provider extension point and the other extensions that
      * provide it (they keep this one from loading; disabling them loads it, no restart).

package/dist/files/previewers.d.ts

@@ -87,7 +87,7 @@ export declare class PreviewerRegistry {
         locale: "zh" | "en";
     }): Promise<UiView>;
     /**
-     * Whether an embed token for a `file-preview` contribution may be issued for this file: the
+     * Whether an embed token for a `file.preview` contribution may be issued for this file: the
      * viewer reads the conversation, the file is in it, and an enabled previewer of that extension
      * with `embed: contribution` takes it. Conversation / file not found throws 404.
      */

package/dist/files/previewers.js

@@ -299,7 +299,7 @@ let PreviewerRegistry = class PreviewerRegistry {
         return view;
     }
     /**
-     * Whether an embed token for a `file-preview` contribution may be issued for this file: the
+     * Whether an embed token for a `file.preview` contribution may be issued for this file: the
      * viewer reads the conversation, the file is in it, and an enabled previewer of that extension
      * with `embed: contribution` takes it. Conversation / file not found throws 404.
      */

package/dist/http/api.module.js

@@ -30,10 +30,8 @@ import { ChannelConnectionsController } from "../channels/connections.controller
 import { AttachmentsController } from "../conversations/attachments.controller.js";
 import { ConversationsController } from "../conversations/conversations.controller.js";
 import { ConversationsModule } from "../conversations/conversations.module.js";
-import { DeviceAuthController } from "../devices/device-auth.controller.js";
-import { DeviceAuthModule } from "../devices/device-auth.module.js";
-import { EnvironmentsController } from "../environments/environments.controller.js";
-import { EnvironmentsModule } from "../environments/environments.module.js";
+import { DevicesController } from "../devices/devices.controller.js";
+import { DevicesModule } from "../devices/devices.module.js";
 import { EvalsModule } from "../evals/evals.module.js";
 import { EvalRunsController } from "../evals/runs.controller.js";
 import { EvalSetsController } from "../evals/sets.controller.js";
@@ -50,6 +48,8 @@ import { MeController } from "../identity/me.controller.js";
 import { BindController, MeIdentitiesController, SsoController, } from "../identity/sso.controller.js";
 import { InboxModule } from "../inbox/inbox.module.js";
 import { PlatformInboxController } from "../inbox/platform-inbox.controller.js";
+import { DeviceAuthController } from "../local-devices/device-auth.controller.js";
+import { DeviceAuthModule } from "../local-devices/device-auth.module.js";
 import { ModelEnablementController } from "../models/enablement.controller.js";
 import { ModelsModule } from "../models/models.module.js";
 import { ModelPurposesController } from "../models/purposes.controller.js";
@@ -75,6 +75,8 @@ import { ExtensionToolsController } from "../tools/extension-tools.controller.js
 import { OAuthCallbackController, OAuthConnectController, } from "../tools/oauth/oauth.controller.js";
 import { QuestionsController } from "../tools/questions.controller.js";
 import { ToolsModule } from "../tools/tools.module.js";
+import { AdminUiController } from "../ui/admin-ui.controller.js";
+import { SlotsController } from "../ui/slots.controller.js";
 import { UiModule } from "../ui/ui.module.js";
 import { UiController } from "../ui/views.controller.js";
 /** Every controller of the kernel API. */
@@ -104,7 +106,7 @@ const CONTROLLERS = [
     ReadinessController,
     ConversationsController,
     BackgroundController,
-    EnvironmentsController,
+    DevicesController,
     AttachmentsController,
     SkillsController,
     SkillChangesController,
@@ -127,6 +129,8 @@ const CONTROLLERS = [
     ChannelConnectionsController,
     DirectorySyncController,
     UiController,
+    AdminUiController,
+    SlotsController,
     FilePreviewersController,
     ExtensionPointDefaultsController,
     TrajectoryController,
@@ -166,7 +170,7 @@ ApiModule = __decorate([
             AgentsModule,
             ConversationsModule,
             BackgroundModule,
-            EnvironmentsModule,
+            DevicesModule,
             DeviceAuthModule,
             RuntimeModule,
             ChannelsModule,

package/dist/http/gateway-routes.d.ts

@@ -1,7 +1,7 @@
 import type { Logger } from "@capybara-hq/plugin-sdk";
 import type { FastifyInstance } from "fastify";
 import type { ChannelWebhooks } from "../channels/webhook.js";
-import { type DeviceRoutesOptions } from "../devices/device-routes.js";
+import { type DeviceRoutesOptions } from "../local-devices/device-routes.js";
 /** What the gateway role serves over HTTP besides health and plugin routes. */
 export interface GatewayRoutes {
     webhooks: Pick<ChannelWebhooks, "handle">;

package/dist/http/gateway-routes.js

@@ -1,5 +1,5 @@
 import { registerChannelWebhookRoute } from "../channels/webhook.controller.js";
-import { registerDeviceConnectRoute } from "../devices/device-routes.js";
+import { registerDeviceConnectRoute, } from "../local-devices/device-routes.js";
 /**
  * Registers the gateway role's HTTP routes (`serveGateway = roles.includes("gateway")`): the
  * channel webhook and the device connection WebSocket. These are raw Fastify routes, not a Nest

package/dist/identity/settings.d.ts

@@ -3,6 +3,7 @@ import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
+import { type UiArrangement } from "../ui/arrangement.js";
 import { SuperAdminLock } from "./super-admin.js";
 /** 沙箱 cpu（核）与内存（MB）覆盖的范围（C19）。 */
 export declare const SANDBOX_CPU_RANGE: {
@@ -72,6 +73,19 @@ export declare const DEPLOYMENT_SETTINGS: z.ZodObject<{
     uiTheme: z.ZodDefault<z.ZodObject<{
         id: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
+    uiArrangement: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
+        "agent.detail.section": "agent.detail.section";
+        "conversation.panel": "conversation.panel";
+        "conversation.properties.section": "conversation.properties.section";
+        "conversation.tool-result.card": "conversation.tool-result.card";
+        "file.preview": "file.preview";
+        "org.page": "org.page";
+        "org.settings.section": "org.settings.section";
+        "platform.page": "platform.page";
+    }> & z.core.$partial, z.ZodObject<{
+        hidden: z.ZodArray<z.ZodString>;
+        order: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>;
 }, z.core.$strip>;
 export type DeploymentSettings = z.infer<typeof DEPLOYMENT_SETTINGS>;
 /**
@@ -111,6 +125,19 @@ export declare const DEPLOYMENT_SETTINGS_PATCH: z.ZodObject<{
     uiTheme: z.ZodOptional<z.ZodObject<{
         id: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>>;
+    uiArrangement: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        "agent.detail.section": "agent.detail.section";
+        "conversation.panel": "conversation.panel";
+        "conversation.properties.section": "conversation.properties.section";
+        "conversation.tool-result.card": "conversation.tool-result.card";
+        "file.preview": "file.preview";
+        "org.page": "org.page";
+        "org.settings.section": "org.settings.section";
+        "platform.page": "platform.page";
+    }> & z.core.$partial, z.ZodNullable<z.ZodObject<{
+        hidden: z.ZodArray<z.ZodString>;
+        order: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>>;
 }, z.core.$strict>;
 export type DeploymentSettingsPatch = z.infer<typeof DEPLOYMENT_SETTINGS_PATCH>;
 /**
@@ -145,6 +172,11 @@ export declare function readOrgMarketplaceBrowse(db: KernelSchemaDb): Promise<bo
 export declare function readUiTheme(db: KernelSchemaDb, opts?: {
     lock?: boolean;
 }): Promise<UiTheme>;
+/**
+ * The platform default arrangement of UI slots, read live (the lists apply it). An invalid
+ * stored value reads as `{}` (the same fallback {@link SettingsService.get} uses).
+ */
+export declare function readUiArrangement(db: KernelSchemaDb): Promise<UiArrangement>;
 /** Deployment settings: one row per key, defaults for missing keys. */
 export declare class SettingsService {
     private readonly db;

package/dist/identity/settings.js

@@ -15,6 +15,7 @@ import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { assertPlatformDefaultEligible, lockThemeShared } from "../themes/theme-state.js";
+import { mergeArrangement, UiArrangementPatchSchema, UiArrangementSchema, } from "../ui/arrangement.js";
 import { audit } from "./audit.js";
 import { SuperAdminLock } from "./super-admin.js";
 /** 币种代码：ISO 4217 的三位大写字母（如 USD、CNY）。 */
@@ -100,6 +101,8 @@ export const DEPLOYMENT_SETTINGS = z.object({
     orgMarketplaceBrowse: z.boolean().default(true),
     /** The platform default theme (themes spec §7); `{ id: null }`: the built-in theme. */
     uiTheme: UiThemeSetting.default({ id: null }),
+    /** The platform default arrangement of UI slots (UI slots spec §5); orgs override per slot. */
+    uiArrangement: UiArrangementSchema.default({}),
 });
 const DEFAULTS = DEPLOYMENT_SETTINGS.parse({});
 /**
@@ -131,6 +134,8 @@ export const DEPLOYMENT_SETTINGS_PATCH = z
      * disabled (else 400 `theme.not_available`), or `{ id: null }` for the built-in theme.
      */
     uiTheme: UiThemeSetting.strict().optional(),
+    /** Per slot, the entry to hide / order contributions with; null removes a slot's entry. */
+    uiArrangement: UiArrangementPatchSchema.optional(),
 })
     .strict();
 /**
@@ -240,6 +245,19 @@ async function lockUiThemeRow(db) {
         .forUpdate()
         .execute();
 }
+/**
+ * The platform default arrangement of UI slots, read live (the lists apply it). An invalid
+ * stored value reads as `{}` (the same fallback {@link SettingsService.get} uses).
+ */
+export async function readUiArrangement(db) {
+    const row = await db
+        .selectFrom("deployment_settings")
+        .select("value")
+        .where("key", "=", "uiArrangement")
+        .executeTakeFirst();
+    const parsed = UiArrangementSchema.safeParse(row?.value);
+    return parsed.success ? parsed.data : {};
+}
 /** 按组织合并覆盖：值为 null 删除该组织，其余整项替换；未列出的组织不变。 */
 function mergeByOrg(current, patch) {
     const merged = { ...current };
@@ -331,9 +349,15 @@ let SettingsService = class SettingsService {
             }
             next.uiTheme = { id: patch.uiTheme.id };
         }
-        const { runConcurrencyOverrides: runPatch, sandboxLimitOverrides: sandboxPatch, subagentLimitOverrides: subagentPatch, } = patch;
-        if (runPatch !== undefined || sandboxPatch !== undefined || subagentPatch !== undefined) {
+        const { runConcurrencyOverrides: runPatch, sandboxLimitOverrides: sandboxPatch, subagentLimitOverrides: subagentPatch, uiArrangement: arrangementPatch, } = patch;
+        if (runPatch !== undefined ||
+            sandboxPatch !== undefined ||
+            subagentPatch !== undefined ||
+            arrangementPatch !== undefined) {
             const current = await this.get();
+            if (arrangementPatch !== undefined) {
+                next.uiArrangement = mergeArrangement(current.uiArrangement, arrangementPatch);
+            }
             if (runPatch !== undefined) {
                 next.runConcurrencyOverrides = mergeByOrg(current.runConcurrencyOverrides, runPatch);
             }

package/dist/infra/config/kernel-config.service.js

@@ -33,10 +33,10 @@ const HOT_APPLIERS = {
     "models.embedTimeoutMs": () => { },
     // SandboxService reads the shared-lease cap at every acquisition.
     "sandbox.maxConcurrentCommands": () => { },
-    // The environments service reads the personal limit at every create.
-    "environments.maxPersonal": () => { },
-    // The device relay reads the reconnect grace at every disconnect and token response.
-    "environments.device.reconnectGraceSeconds": () => { },
+    // The devices service reads the personal limit at every create.
+    "devices.maxPersonal": () => { },
+    // The local device relay reads the reconnect grace at every disconnect and token response.
+    "devices.local.reconnectGraceSeconds": () => { },
     // Sub-agent limits are read at every dispatch, child step and tool resolution.
     "subagents.maxDepth": () => { },
     "subagents.maxConcurrentPerConversation": () => { },

package/dist/kernel.module.js

@@ -10,7 +10,6 @@ import { APP_INTERCEPTOR } from "@nestjs/core";
 import { CatalogModule } from "./catalog/catalog.module.js";
 import { ChannelsModule } from "./channels/channels.module.js";
 import { TitlesModule } from "./conversations/titles.js";
-import { DevicesModule } from "./devices/devices.module.js";
 import { ExtensionsModule } from "./extensions/extensions.module.js";
 import { ApiModule } from "./http/api.module.js";
 import { ErrorFilterModule } from "./http/error-filter.module.js";
@@ -32,6 +31,7 @@ import { KERNEL_POOL, REDIS } from "./infra/tokens.js";
 import { ValidationModule } from "./infra/validation/validation.module.js";
 import { KernelLifecycle } from "./lifecycle/kernel-lifecycle.js";
 import { KERNEL_APP_OPTIONS } from "./lifecycle/tokens.js";
+import { LocalDevicesModule } from "./local-devices/local-devices.module.js";
 import { createConfiguredLogger } from "./log-config.js";
 import { KERNEL_OVERRIDE_TOKENS } from "./overrides.js";
 import { PlatformModule } from "./platform/platform.module.js";
@@ -111,8 +111,8 @@ let KernelModule = KernelModule_1 = class KernelModule {
                 TitlesModule,
                 UsageReportModule,
                 ChannelsModule,
-                // the @device sandbox provider, registered on every role (any replica may relay to a machine)
-                DevicesModule,
+                // the @local sandbox provider, registered on every role (any replica may relay to a machine)
+                LocalDevicesModule,
                 // the Platform tool's operation registry and actor facts
                 PlatformModule,
                 // its operations (skills, agents, ...), registered at start on every role

package/dist/{devices → local-devices}/device-auth.controller.d.ts

@@ -11,15 +11,15 @@ import { type DeviceAuthorizeBody, type DeviceConfirmBody, type DeviceTokenBody,
  * they need `X-Capybara-Csrf: 1`, which `capybara-device` sends:
  * - `POST /authorize { name, os, arch, programVersion }` → `{ deviceCode, userCode,
  *   verificationUri, verificationUriComplete, interval, expiresIn }` (`device-authorize-ip`);
- * - `POST /token { deviceCode }` → `{ credential, orgId, environmentId, connectUrl,
- *   reconnectGraceSeconds, maxFrameBytes }` once, else `device.authorization_pending` / `device.slow_down` /
- *   `device.denied` / `device.expired` (`device-token-ip`).
+ * - `POST /token { deviceCode }` → `{ credential, orgId, deviceId, connectUrl,
+ *   reconnectGraceSeconds, maxFrameBytes }` once, else `device_sign_in.authorization_pending` / `device_sign_in.slow_down` /
+ *   `device_sign_in.denied` / `device_sign_in.expired` (`device-token-ip`).
  *
  * The person's routes need a web session (the confirmation page `/device`); each try of a user
  * code counts on `device-code-account` (refunded on success):
  * - `GET /pending/:userCode` → `{ machine, expiresAt }`;
- * - `POST /confirm { userCode, orgId, environmentId | name }` → `{ environmentId }`
- *   (`device.expired` / `device.unavailable` when the credential could not be handed over: the
+ * - `POST /confirm { userCode, orgId, deviceId | name }` → `{ deviceId }`
+ *   (`device_sign_in.expired` / `device_sign_in.unavailable` when the credential could not be handed over: the
  *   machine is revoked again and the person runs login again);
  * - `POST /deny { userCode }` → 204.
  */
@@ -34,7 +34,7 @@ export declare class DeviceAuthController {
         expiresAt: string;
     }>;
     confirm(principal: Principal, body: z.infer<typeof DeviceConfirmBody>, req: FastifyRequest, reply: FastifyReply): Promise<{
-        environmentId: string;
+        deviceId: string;
     }>;
     deny(principal: Principal, body: z.infer<typeof DeviceUserCodeBody>, req: FastifyRequest, reply: FastifyReply): Promise<void>;
     /** Runs `fn` as one counted try of a user code; a success gives the try back. */

package/dist/{devices → local-devices}/device-auth.controller.js

@@ -23,15 +23,15 @@ const CODE_THROTTLER = ["device-code-account"];
  * they need `X-Capybara-Csrf: 1`, which `capybara-device` sends:
  * - `POST /authorize { name, os, arch, programVersion }` → `{ deviceCode, userCode,
  *   verificationUri, verificationUriComplete, interval, expiresIn }` (`device-authorize-ip`);
- * - `POST /token { deviceCode }` → `{ credential, orgId, environmentId, connectUrl,
- *   reconnectGraceSeconds, maxFrameBytes }` once, else `device.authorization_pending` / `device.slow_down` /
- *   `device.denied` / `device.expired` (`device-token-ip`).
+ * - `POST /token { deviceCode }` → `{ credential, orgId, deviceId, connectUrl,
+ *   reconnectGraceSeconds, maxFrameBytes }` once, else `device_sign_in.authorization_pending` / `device_sign_in.slow_down` /
+ *   `device_sign_in.denied` / `device_sign_in.expired` (`device-token-ip`).
  *
  * The person's routes need a web session (the confirmation page `/device`); each try of a user
  * code counts on `device-code-account` (refunded on success):
  * - `GET /pending/:userCode` → `{ machine, expiresAt }`;
- * - `POST /confirm { userCode, orgId, environmentId | name }` → `{ environmentId }`
- *   (`device.expired` / `device.unavailable` when the credential could not be handed over: the
+ * - `POST /confirm { userCode, orgId, deviceId | name }` → `{ deviceId }`
+ *   (`device_sign_in.expired` / `device_sign_in.unavailable` when the credential could not be handed over: the
  *   machine is revoked again and the person runs login again);
  * - `POST /deny { userCode }` → 204.
  */

package/dist/{devices → local-devices}/device-auth.d.ts

@@ -1,5 +1,5 @@
 import type { Redis } from "ioredis";
-import { EnvironmentsService } from "../environments/environments.service.js";
+import { DevicesService } from "../devices/devices.service.js";
 import type { UserPrincipal } from "../identity/principal.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -10,8 +10,8 @@ import { MachinesService } from "./machines.js";
 export declare const USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
 /** What `slow_down` adds to the poll interval (RFC 8628 §3.5). */
 export declare const SLOW_DOWN_STEP_SECONDS = 5;
-/** The web page that confirms a code: `<http.publicUrl>/device`. */
-export declare const DEVICE_PAGE_PATH = "/device";
+/** The web page that confirms a code: `<http.publicUrl>/devices/link`. */
+export declare const DEVICE_PAGE_PATH = "/devices/link";
 /** The machine's WebSocket route: `ws(s)://<http.publicUrl host>/device/connect`. */
 export declare const DEVICE_CONNECT_PATH = "/device/connect";
 /** The sign-in state of one device code: `capk:device-auth:<sha256(deviceCode)>` (a hash). */
@@ -28,7 +28,7 @@ export interface DeviceMachineInfo {
 interface Grant {
     credential: string;
     orgId: string;
-    environmentId: string;
+    deviceId: string;
 }
 export interface DeviceAuthorization {
     deviceCode: string;
@@ -41,7 +41,7 @@ export interface DeviceAuthorization {
 export interface DeviceGrant extends Grant {
     connectUrl: string;
     reconnectGraceSeconds: number;
-    /** `environments.device.maxFrameBytes`: the program never sends a larger frame (ruling R26). */
+    /** `devices.local.maxFrameBytes`: the program never sends a larger frame (ruling R26). */
     maxFrameBytes: number;
 }
 /** A user code as typed → `XXXX-XXXX`, or null when it cannot be one. */
@@ -51,7 +51,7 @@ export declare function normalizeUserCode(input: string): string | null;
  * for a code pair (`authorize`), the signed-in person confirms the user code on the web page
  * `/device` (`pending`, `confirm` or `deny`), and the program polls `token` until it gets the
  * machine credential, once. State lives only in Redis, both keys with the code's TTL
- * (`environments.device.authCodeTtlSeconds`): `capk:device-auth:<sha256(deviceCode)>` (a hash:
+ * (`devices.local.authCodeTtlSeconds`): `capk:device-auth:<sha256(deviceCode)>` (a hash:
  * `info` JSON, `status`, `interval`, `lastPollAt`, the parked `grant`) and
  * `capk:device-user:<userCode>` → the device code's hash. The device code itself is never stored.
  */
@@ -60,16 +60,16 @@ export declare class DeviceAuthService {
     readonly txHost: TransactionHost;
     private readonly redis;
     private readonly config;
-    private readonly environments;
+    private readonly devices;
     private readonly machines;
     private readonly log;
-    constructor(db: KernelDb, txHost: TransactionHost, redis: Redis, config: Pick<KernelConfigService, "get">, environments: Pick<EnvironmentsService, "createDevice">, machines: Pick<MachinesService, "issue" | "revokeMachine">, log: Pick<KernelLogger, "warn">);
+    constructor(db: KernelDb, txHost: TransactionHost, redis: Redis, config: Pick<KernelConfigService, "get">, devices: Pick<DevicesService, "createLocal">, machines: Pick<MachinesService, "issue" | "revokeMachine">, log: Pick<KernelLogger, "warn">);
     /** A new code pair for a machine. Needs `http.publicUrl` (the page and the connection URL). */
     authorize(machine: DeviceMachineInfo): Promise<DeviceAuthorization>;
     /**
      * The program's poll: the grant once the person confirmed (the code is consumed), else
-     * `device.authorization_pending`, `device.slow_down` (details `[{ interval }]`, the grown
-     * interval), `device.denied` or `device.expired` (also for an unknown code).
+     * `device_sign_in.authorization_pending`, `device_sign_in.slow_down` (details `[{ interval }]`, the grown
+     * interval), `device_sign_in.denied` or `device_sign_in.expired` (also for an unknown code).
      */
     token(deviceCode: string): Promise<DeviceGrant>;
     /** The machine waiting behind a user code, for the confirmation page. */
@@ -79,10 +79,10 @@ export declare class DeviceAuthService {
     }>;
     /**
      * The person confirms a user code: in an org where they may use agents (`agents.use`), into
-     * one of their own live device environments or a new one named `name` (` 2`, ` 3`, … appended
-     * while the name is taken). One transaction creates the environment if needed, issues the
-     * machine (revoking the environment's previous one) and audits
-     * `environment.machine_connected` (retried once when a concurrent confirmation took the new
+     * one of their own live local devices or a new one named `name` (` 2`, ` 3`, … appended
+     * while the name is taken). One transaction creates the device if needed, issues the
+     * machine (revoking the device's previous one) and audits
+     * `device.machine_connected` (retried once when a concurrent confirmation took the new
      * name); after the commit the credential is parked for the poll ({@link park}). The code is
      * claimed first, so two confirmations of one code cannot both issue a machine; a confirmation
      * that fails before the commit leaves it pending.
@@ -90,28 +90,28 @@ export declare class DeviceAuthService {
     confirm(principal: UserPrincipal, input: {
         userCode: string;
         orgId: string;
-        environmentId?: string | undefined;
+        deviceId?: string | undefined;
         name?: string | undefined;
     }): Promise<{
-        environmentId: string;
+        deviceId: string;
     }>;
     /**
      * Parks the committed machine's credential for the poll. When that fails (the code expired
      * meanwhile, or Redis failed) the machine is revoked again, so no credential nobody holds stays
-     * valid, and the person is told to start over: `device.expired` / `device.unavailable`.
+     * valid, and the person is told to start over: `device_sign_in.expired` / `device_sign_in.unavailable`.
      */
     private park;
     /** Revokes a machine whose credential never reached the program (see {@link park}). */
     private abandon;
-    /** The person refuses a user code: the program's next poll gets `device.denied`. */
+    /** The person refuses a user code: the program's next poll gets `device_sign_in.denied`. */
     deny(userCode: string): Promise<void>;
     private confirmIn;
     /** `name`, or `name 2`, `name 3`, … : the first that is none of the person's live names. */
     private freeName;
-    /** The code behind a user code with status `status`, else `device.code_invalid`. */
+    /** The code behind a user code with status `status`, else `device_sign_in.code_invalid`. */
     private lookup;
     private transition;
-    /** `http.publicUrl` without trailing slashes; unset → `environment.unavailable`. */
+    /** `http.publicUrl` without trailing slashes; unset → `device.unavailable`. */
     private publicUrl;
     /** The machine's WebSocket URL: the public URL with `ws` / `wss` and `/device/connect`. */
     private connectUrl;