@capybara-hq/kernel 0.1.0-rc.11 → 0.1.0-rc.13

package/dist/tools/policy.js

@@ -2,6 +2,7 @@ import { sql } from "kysely";
 import { roleAtLeast } from "../orgs/roles.js";
 import { readOrgSettings } from "../orgs/settings.service.js";
 import { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS, SANDBOX_ASK_TOOL_NAMES, } from "./builtin-names.js";
+import { personalAuth } from "./connector-account-policies.js";
 import { normalizeStoredDefinitionIn } from "./legacy-data.js";
 export { R3_FIXED_ASK_TOOL_KEYS, R3_SHARED_AGENT_ONLY_TOOL_KEYS } from "./builtin-names.js";
 const RANK = { allow: 0, ask: 1, deny: 2 };
@@ -35,17 +36,51 @@ export function isFixedAsk(tool, visibility, skillWritePolicy) {
     // 私有 agent：缺省 / allow 不问（R4），负责人设为 ask（D10）时与共享 agent 一样固定询问
     return !(builtinOnly && visibility === "private" && skillWritePolicy !== "ask");
 }
-const asOverride = (v) => v === "ask" || v === "deny" ? v : undefined;
+const asSetting = (v) => v === "allow" || v === "ask" || v === "deny" ? v : undefined;
+/** The stricter of the settings that are set (none set: undefined). */
+function combine(...xs) {
+    let out;
+    for (const x of xs)
+        if (x !== undefined)
+            out = out === undefined ? x : stricter(out, x);
+    return out;
+}
 /**
- * An agent's tightening for a call: its policy on the tool key and, for a per-call key
- * (`Platform:<operation>`), on that key, the stricter of the two (a policy can only tighten).
+ * An agent's setting for a call: its policy on the tool key and, for a per-call key
+ * (`Platform:<operation>`), on that key, the stricter of the two; undefined when neither is set.
+ * `allow` counts only for a connector tool ({@link connectorPolicy}); elsewhere an agent's policy
+ * can only tighten ({@link tighteningOf}).
  */
-function overrideOf(policies, toolKey, policyKey) {
-    const own = asOverride(policies?.[toolKey]);
+function settingOf(policies, toolKey, policyKey) {
+    const own = asSetting(policies?.[toolKey]);
     if (policyKey === toolKey)
         return own;
-    const s = stricter(own ?? "allow", asOverride(policies?.[policyKey]));
-    return s === "allow" ? undefined : s;
+    return combine(own, asSetting(policies?.[policyKey]));
+}
+/** An agent setting as a tightening (`allow` tightens nothing). */
+const tighteningOf = (s) => s === "ask" || s === "deny" ? s : undefined;
+/**
+ * A personal-credential connector tool's policy for one call (maintainer decisions 2026-11-09;
+ * an org-credential connector's tool keeps the org default with the agent's tightening only),
+ * highest first:
+ * 1. the org's default `deny` (a tool the org switched off never gets here: it is unavailable);
+ * 2. the member's own `deny` for calls with their connection (`member`): a floor no agent lifts;
+ * 3. the agent's setting (`agent`, from its tools page): `allow` / `ask` / `deny`;
+ * 4. the member's own `allow` / `ask`;
+ * 5. the org's default (`connector_tools.default_policy`, the annotation default unless an org
+ *    admin changed it: `readOnlyHint: true` allows, anything else asks).
+ * Fixed asks (R3, `requiresUserInteraction`), role escalation and grants apply after this.
+ */
+export function connectorPolicy(input) {
+    if (input.orgDefault === "deny")
+        return { policy: "deny", source: "org" };
+    if (input.member === "deny")
+        return { policy: "deny", source: "member" };
+    if (input.agent !== undefined)
+        return { policy: input.agent, source: "agent" };
+    if (input.member !== undefined)
+        return { policy: input.member, source: "member" };
+    return { policy: input.orgDefault, source: "org" };
 }
 /**
  * 执行时的策略判定（spec 3.6 R5：在动作执行那一刻判定）。每次调用都实时读取：
@@ -58,7 +93,7 @@ function overrideOf(policies, toolKey, policyKey) {
  *   parent's current version still tightens it (sub-agents spec §5.3, §9); its "this conversation"
  *   grants are the root conversation's (agent map spec §7); an org agent sub-agent (§5.5): `ctx.agentId` is the
  *   dispatched agent (its current version, its "always" grants) and the parent agent's current
- *   policies apply on top ({@link parentAgentOverride});
+ *   policies apply on top ({@link parentAgentSetting});
  * - 授权表（`conversation_tool_grants` / `tool_grants`），`spec_hash` 与当前定义不一致视为无效（D8），
  *   `connector_id` 与工具的来源连接器不一致也无效（删除后用同一 slug 重新安装的连接器不继承旧授权）；
  * - 工具声明了 `requiredRole`（R1）时，发起人在组织中的当前角色：不是成员 → 拒绝；角色不足 → 按角色升级的审批
@@ -75,11 +110,15 @@ export function createDecidePolicy(db) {
         let connectorDefault = call?.policy ?? tool.defaultPolicy;
         let connectorId = null;
         let hashCurrent = true;
+        /** The member's own setting for a call with their connection (a personal-credential connector). */
+        let memberSetting;
+        /** A personal-credential connector: calls use the acting account's own connection. */
+        let personal = false;
         if (tool.source.kind === "connector") {
             connectorId = tool.source.connectorId;
             const app = await db
                 .selectFrom("connectors")
-                .select(["slug", "status", "deleted_at"])
+                .select(["slug", "status", "deleted_at", "auth"])
                 .where("id", "=", tool.source.connectorId)
                 .where("org_id", "=", ctx.orgId)
                 .executeTakeFirst();
@@ -105,6 +144,19 @@ export function createDecidePolicy(db) {
                 return { unavailable: "Tool is pending review" };
             connectorDefault = row.default_policy;
             hashCurrent = row.spec_hash === tool.specHash;
+            // The call is made with the acting account's own connection (the credential the pipeline
+            // injects for `ctx.accountId`): that account's settings apply, never another's
+            personal = personalAuth(app.auth);
+            if (personal) {
+                const mine = await db
+                    .selectFrom("connector_tool_account_policies")
+                    .select("policy")
+                    .where("connector_id", "=", tool.source.connectorId)
+                    .where("account_id", "=", ctx.accountId)
+                    .where("tool_name", "=", tool.source.name)
+                    .executeTakeFirst();
+                memberSetting = mine?.policy;
+            }
         }
         // 沙箱工具的组织默认（M5 T8）：组织设置 sandboxToolPolicy 为 ask 时，有副作用的沙箱工具至少 ask
         // `orgAsk`: the org setting, not the tool's own default, is what makes it ask
@@ -116,7 +168,7 @@ export function createDecidePolicy(db) {
             }
         }
         // 运行所用版本可能是加 toolPolicies 字段之前保存的：缺省为空
-        const runOverride = overrideOf(agentDef.toolPolicies, tool.key, policyKey);
+        const runSetting = settingOf(agentDef.toolPolicies, tool.key, policyKey);
         const current = await db
             .selectFrom("agents")
             .innerJoin("agent_versions", (j) => j
@@ -130,12 +182,33 @@ export function createDecidePolicy(db) {
             ? undefined
             : await normalizeStoredDefinitionIn(db, ctx.orgId, current.definition);
         const currentPolicies = currentDef?.toolPolicies;
-        const currentOverride = overrideOf(currentPolicies, tool.key, policyKey);
-        let strictest = stricter(runOverride ?? "allow", currentOverride);
+        const currentSetting = settingOf(currentPolicies, tool.key, policyKey);
+        // the run's version, the agent's current version and (a sub-agent) its parent agent's
+        // current version: the stricter of the ones that are set
+        // (an `allow` the owner removed since the run started no longer applies: removing it tightens)
+        const runKept = runSetting === "allow" && current !== undefined && currentSetting === undefined
+            ? undefined
+            : runSetting;
+        let agentSetting = combine(runKept, currentSetting);
         if (ctx.parentConversationId !== undefined && ctx.parentAgentDiffers !== false) {
-            strictest = stricter(strictest, await parentAgentOverride(db, tool.key, policyKey, ctx));
+            agentSetting = combine(agentSetting, await parentAgentSetting(db, tool.key, policyKey, ctx));
+        }
+        let agentOverride = tighteningOf(agentSetting);
+        // A personal-credential connector's tool: the levels of `connectorPolicy` decide its base
+        // policy (an agent's `allow` counts here, below the org's and the member's deny). A connector
+        // with one org credential has no member level and its calls act as the whole org: there the
+        // agent's setting only tightens the org default, as for every other tool (review 2026-11-09)
+        let decidedBy = null;
+        if (tool.source.kind === "connector" && personal) {
+            const r = connectorPolicy({
+                orgDefault: connectorDefault,
+                member: memberSetting,
+                agent: agentSetting,
+            });
+            connectorDefault = r.policy;
+            decidedBy = r.source;
+            agentOverride = undefined;
         }
-        const agentOverride = strictest === "allow" ? undefined : strictest;
         let escalateTo = null;
         if (tool.requiredRole !== undefined) {
             const m = await db
@@ -184,15 +257,17 @@ export function createDecidePolicy(db) {
             // default
             policy: escalateTo !== null
                 ? "role"
-                : agentOverride === "ask"
+                : agentOverride === "ask" || (decidedBy === "agent" && connectorDefault === "ask")
                     ? "agent"
-                    : tool.source.kind === "connector" && connectorDefault === "ask"
-                        ? "connector"
-                        : fixedAsk
-                            ? "fixed"
-                            : orgAsk
-                                ? "org"
-                                : "default",
+                    : decidedBy === "member" && connectorDefault === "ask"
+                        ? "member"
+                        : tool.source.kind === "connector" && connectorDefault === "ask"
+                            ? "connector"
+                            : fixedAsk
+                                ? "fixed"
+                                : orgAsk
+                                    ? "org"
+                                    : "default",
         };
         return { ask };
     };
@@ -203,7 +278,7 @@ export function createDecidePolicy(db) {
  * policy for the same key applies on top, so the parent's owner can tighten a running child too.
  * For a template or general-purpose child the parent conversation has the same agent, already read.
  */
-async function parentAgentOverride(db, toolKey, policyKey, ctx) {
+async function parentAgentSetting(db, toolKey, policyKey, ctx) {
     const row = await db
         .selectFrom("conversations as c")
         .innerJoin("agents as a", "a.id", "c.agent_id")
@@ -216,7 +291,7 @@ async function parentAgentOverride(db, toolKey, policyKey, ctx) {
     // stored raw: an rc version's keys read as current keys, so its deny keeps applying (§8.3)
     const policies = (await normalizeStoredDefinitionIn(db, ctx.orgId, row.definition))
         .toolPolicies;
-    return overrideOf(policies, toolKey, policyKey);
+    return settingOf(policies, toolKey, policyKey);
 }
 /**
  * A grant matching the current definition hash and source connector, keyed by the call's policy key

package/dist/tools/registry.d.ts

@@ -14,7 +14,7 @@ export { BUILTIN_TOOL_NAMES } from "./builtin-names.js";
 export { canonicalJson } from "./canonical-json.js";
 /**
  * What a tool's `unavailable` is asked with: the org, and for a run's listing the root
- * conversation (`conversationId`; the sandbox tools follow its environment, ruling R8), whether
+ * conversation (`conversationId`; the sandbox tools follow its device, ruling R8), whether
  * the run is an eval replay (`replay`: its tool calls are never executed), and a `memo` shared by
  * the tools of one listing (one answer per question per listing).
  */
@@ -346,7 +346,7 @@ export declare class ToolRegistry {
         forkChild?: boolean;
         /**
          * The root conversation of the run (a sub-agent's tree root): tools whose availability
-         * depends on the conversation's environment (the sandbox tools) are listed by it.
+         * depends on the conversation's device (the sandbox tools) are listed by it.
          */
         sandboxConversationId?: string;
         /** An eval replay's listing: its calls are never executed (the sandbox tools are listed). */

package/dist/tools/tools.module.js

@@ -9,7 +9,7 @@ import { BackgroundModule } from "../background/background.module.js";
 import { ConversationAccessModule } from "../conversations/access.js";
 import { AttachmentsModule } from "../conversations/attachments.module.js";
 import { EventLogModule } from "../conversations/event-log.js";
-import { EnvironmentsModule } from "../environments/environments.module.js";
+import { DevicesModule } from "../devices/devices.module.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { QueueModule } from "../infra/queue/queue.module.js";
 import { ModelsModule } from "../models/models.module.js";
@@ -26,6 +26,7 @@ import { ApprovalsService } from "./approvals.service.js";
 import { Breaker } from "./breaker.js";
 import { BuiltinTools } from "./builtins/builtin-tools.js";
 import { WebPages } from "./builtins/web/page-cache.js";
+import { ConnectorAccountPolicies } from "./connector-account-policies.js";
 import { ConnectorContent } from "./connector-content.js";
 import { ConnectorsService } from "./connectors.service.js";
 import { Credentials } from "./credentials.js";
@@ -58,9 +59,9 @@ ToolsModule = __decorate([
             OrgLockModule,
             // the `Agent` tool's dispatch
             SubagentsModule,
-            // the builtin sandbox and skill tools run in the conversation's environment
+            // the builtin sandbox and skill tools run in the conversation's device
             SandboxModule,
-            EnvironmentsModule,
+            DevicesModule,
             // `Bash` with run_in_background records its task; TaskOutput / TaskStop finish and stop it
             BackgroundModule,
             // the conversation page's tool metadata reads only what the viewer may see
@@ -86,6 +87,7 @@ ToolsModule = __decorate([
             ConnectorContent,
             ToolPipeline,
             ConnectorsService,
+            ConnectorAccountPolicies,
             OAuthFlow,
             ConversationToolInfo,
             OrgExtensionTools,
@@ -103,6 +105,7 @@ ToolsModule = __decorate([
             ConnectorContent,
             ToolPipeline,
             ConnectorsService,
+            ConnectorAccountPolicies,
             OAuthFlow,
             ConversationToolInfo,
             OrgExtensionTools,

package/dist/ui/admin-ui.controller.d.ts

@@ -0,0 +1,56 @@
+import type { UiActionResult, UiView } from "@capybara-hq/plugin-sdk";
+import type { FastifyReply, FastifyRequest } from "fastify";
+import type { z } from "zod";
+import { ApiTokenService } from "../identity/api-tokens.js";
+import { type Principal } from "../identity/principal.js";
+import { SessionService } from "../identity/sessions.js";
+import { EmbedTokens } from "./embed-token.js";
+import { ContributionParams, PlatformActionBody, PlatformViewQuery } from "./ui.schemas.js";
+import { OrgUiStreams } from "./ui-stream.js";
+import { type UiArrangementSlot, type UiContributionItem, UiViews } from "./views.js";
+/**
+ * Extension UI in the admin console (UI slots spec §7, platform scope): the `platform.page`
+ * contributions, for super admins only (`@SuperAdmin`, a person: service tokens are refused), with
+ * no org. A platform contribution needs its extension running (no org enablement applies) and is
+ * given the platform's deployment config; its render args carry `scope: "platform"`, `role:
+ * "superAdmin"` and no `orgId`.
+ * - `GET  /api/v1/admin/ui/contributions` → `{ items }` (`platform.page` only, base order);
+ * - `GET  /api/v1/admin/ui/arrangement` → `{ slots }` over every arrangeable slot, the platform's
+ *   entries only, with every running extension's contributions (hidden ones marked);
+ * - `GET  /api/v1/admin/ui/views/:plugin/:id?locale=` → `{ view }`;
+ * - `POST /api/v1/admin/ui/actions/:plugin/:id` (`{ actionId, payload?, answer?, locale? }`) →
+ *   `{ toast }` | `{ view }`;
+ * - `POST /api/v1/admin/ui/embeds/:plugin/:id/token` → `{ token, src, expiresAt, expiresIn }`: a
+ *   platform embed token (`scope: "platform"`, `role: "superAdmin"`, no `orgId`), which
+ *   `ctx.ui.verifyEmbedToken` accepts only for a `platform.page` contribution while the account is
+ *   still an active super admin;
+ * - `GET  /api/v1/admin/ui/stream`: the platform refresh SSE (`event: ui`, topic `platform-ui`),
+ *   super admin re-checked on the `runtime.sseRecheckMs` interval.
+ * A contribution in any other slot is 404 `ui.not_found`, the same as one that does not exist.
+ */
+export declare class AdminUiController {
+    private readonly views;
+    private readonly streams;
+    private readonly sessions;
+    private readonly tokens;
+    private readonly embeds;
+    constructor(views: UiViews, streams: OrgUiStreams, sessions: SessionService, tokens: ApiTokenService, embeds: EmbedTokens);
+    contributions(principal: Principal): Promise<{
+        items: UiContributionItem[];
+    }>;
+    arrangement(principal: Principal): Promise<{
+        slots: UiArrangementSlot[];
+    }>;
+    view(principal: Principal, { plugin, id }: z.infer<typeof ContributionParams>, q: z.infer<typeof PlatformViewQuery>): Promise<{
+        view: UiView;
+    }>;
+    action(principal: Principal, { plugin, id }: z.infer<typeof ContributionParams>, body: z.infer<typeof PlatformActionBody>): Promise<UiActionResult>;
+    embedToken(principal: Principal, { plugin, id }: z.infer<typeof ContributionParams>): Promise<{
+        token: string;
+        src: string;
+        expiresAt: string;
+        expiresIn: number;
+    }>;
+    /** The platform refresh stream: written on the raw response (`reply.hijack()`) like the org one. */
+    stream(principal: Principal, req: FastifyRequest, reply: FastifyReply): Promise<void>;
+}

package/dist/ui/admin-ui.controller.js

@@ -0,0 +1,192 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Get, HttpCode, Inject, Post, Req, Res } from "@nestjs/common";
+import { ApiTokenService } from "../identity/api-tokens.js";
+import { credentialCheck } from "../identity/credential-check.js";
+import { CurrentPrincipal, requireUser, SuperAdmin, } from "../identity/principal.js";
+import { SessionService } from "../identity/sessions.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam, ZQuery } from "../infra/validation/zod-params.js";
+import { EMBED_TOKEN_TTL_SECONDS, EmbedTokens } from "./embed-token.js";
+import { ContributionParams, PlatformActionBody, PlatformViewQuery } from "./ui.schemas.js";
+import { OrgUiStreams } from "./ui-stream.js";
+import { BEARER_RE, embedSrc } from "./views.controller.js";
+import { UiViews } from "./views.js";
+class AdminUiContributionParamsDto extends createZodDto(ContributionParams, "AdminUiContributionParams") {
+}
+class AdminUiViewQueryDto extends createZodDto(PlatformViewQuery, "AdminUiViewQuery") {
+}
+class AdminUiActionBodyDto extends createZodDto(PlatformActionBody, "AdminUiActionBody") {
+}
+/**
+ * Extension UI in the admin console (UI slots spec §7, platform scope): the `platform.page`
+ * contributions, for super admins only (`@SuperAdmin`, a person: service tokens are refused), with
+ * no org. A platform contribution needs its extension running (no org enablement applies) and is
+ * given the platform's deployment config; its render args carry `scope: "platform"`, `role:
+ * "superAdmin"` and no `orgId`.
+ * - `GET  /api/v1/admin/ui/contributions` → `{ items }` (`platform.page` only, base order);
+ * - `GET  /api/v1/admin/ui/arrangement` → `{ slots }` over every arrangeable slot, the platform's
+ *   entries only, with every running extension's contributions (hidden ones marked);
+ * - `GET  /api/v1/admin/ui/views/:plugin/:id?locale=` → `{ view }`;
+ * - `POST /api/v1/admin/ui/actions/:plugin/:id` (`{ actionId, payload?, answer?, locale? }`) →
+ *   `{ toast }` | `{ view }`;
+ * - `POST /api/v1/admin/ui/embeds/:plugin/:id/token` → `{ token, src, expiresAt, expiresIn }`: a
+ *   platform embed token (`scope: "platform"`, `role: "superAdmin"`, no `orgId`), which
+ *   `ctx.ui.verifyEmbedToken` accepts only for a `platform.page` contribution while the account is
+ *   still an active super admin;
+ * - `GET  /api/v1/admin/ui/stream`: the platform refresh SSE (`event: ui`, topic `platform-ui`),
+ *   super admin re-checked on the `runtime.sseRecheckMs` interval.
+ * A contribution in any other slot is 404 `ui.not_found`, the same as one that does not exist.
+ */
+let AdminUiController = class AdminUiController {
+    views;
+    streams;
+    sessions;
+    tokens;
+    embeds;
+    constructor(views, streams, sessions, tokens, embeds) {
+        this.views = views;
+        this.streams = streams;
+        this.sessions = sessions;
+        this.tokens = tokens;
+        this.embeds = embeds;
+    }
+    async contributions(principal) {
+        requireUser(principal);
+        return { items: await this.views.platformContributions() };
+    }
+    async arrangement(principal) {
+        requireUser(principal);
+        return { slots: await this.views.platformArrangementView() };
+    }
+    async view(principal, { plugin, id }, q) {
+        const p = requireUser(principal);
+        const view = await this.views.render({
+            scope: "platform",
+            accountId: p.account.id,
+            plugin,
+            id,
+            locale: q.locale,
+        });
+        return { view };
+    }
+    async action(principal, { plugin, id }, body) {
+        const p = requireUser(principal);
+        return this.views.act({ scope: "platform", accountId: p.account.id, plugin, id, locale: body.locale }, {
+            actionId: body.actionId,
+            ...(body.payload !== undefined && { payload: body.payload }),
+            ...(body.answer !== undefined && { answer: body.answer }),
+        });
+    }
+    async embedToken(principal, { plugin, id }) {
+        const p = requireUser(principal);
+        const target = await this.views.embed({
+            scope: "platform",
+            accountId: p.account.id,
+            plugin,
+            id,
+        });
+        const { token, expiresAt } = this.embeds.issue({
+            plugin: target.plugin,
+            scope: "platform",
+            accountId: p.account.id,
+            role: "superAdmin",
+            contribution: target.contribution,
+        });
+        return {
+            token,
+            src: embedSrc(target.plugin, target.path),
+            expiresAt: expiresAt.toISOString(),
+            expiresIn: EMBED_TOKEN_TTL_SECONDS,
+        };
+    }
+    /** The platform refresh stream: written on the raw response (`reply.hijack()`) like the org one. */
+    async stream(principal, req, reply) {
+        const p = requireUser(principal);
+        const res = reply.raw;
+        const handle = await this.streams.open({
+            scope: "platform",
+            viewerAccountId: p.account.id,
+            credential: credentialCheck(p, BEARER_RE.exec(req.headers.authorization ?? "")?.[1], {
+                sessions: this.sessions,
+                tokens: this.tokens,
+            }),
+        }, {
+            write: (chunk) => {
+                res.write(chunk);
+            },
+            backlog: () => res.writableLength,
+            end: () => {
+                res.end();
+            },
+            abort: () => {
+                res.destroy();
+            },
+        });
+        reply.hijack();
+        res.on("close", () => handle.close());
+        if (res.destroyed || !res.socket || res.socket.destroyed) {
+            handle.close();
+            res.destroy();
+            return;
+        }
+        res.writeHead(200, {
+            "content-type": "text/event-stream; charset=utf-8",
+            "cache-control": "no-cache",
+            "x-accel-buffering": "no",
+            connection: "keep-alive",
+        });
+        res.flushHeaders();
+        handle.begin();
+    }
+};
+__decorate([
+    Get("contributions"),
+    __param(0, CurrentPrincipal())
+], AdminUiController.prototype, "contributions", null);
+__decorate([
+    Get("arrangement"),
+    __param(0, CurrentPrincipal())
+], AdminUiController.prototype, "arrangement", null);
+__decorate([
+    Get("views/:plugin/:id"),
+    __param(0, CurrentPrincipal()),
+    __param(1, ZParam(AdminUiContributionParamsDto)),
+    __param(2, ZQuery(AdminUiViewQueryDto))
+], AdminUiController.prototype, "view", null);
+__decorate([
+    Post("actions/:plugin/:id"),
+    HttpCode(200),
+    __param(0, CurrentPrincipal()),
+    __param(1, ZParam(AdminUiContributionParamsDto)),
+    __param(2, ZBody(AdminUiActionBodyDto))
+], AdminUiController.prototype, "action", null);
+__decorate([
+    Post("embeds/:plugin/:id/token"),
+    HttpCode(200),
+    __param(0, CurrentPrincipal()),
+    __param(1, ZParam(AdminUiContributionParamsDto))
+], AdminUiController.prototype, "embedToken", null);
+__decorate([
+    Get("stream"),
+    __param(0, CurrentPrincipal()),
+    __param(1, Req()),
+    __param(2, Res())
+], AdminUiController.prototype, "stream", null);
+AdminUiController = __decorate([
+    Controller("api/v1/admin/ui"),
+    SuperAdmin(),
+    __param(0, Inject(UiViews)),
+    __param(1, Inject(OrgUiStreams)),
+    __param(2, Inject(SessionService)),
+    __param(3, Inject(ApiTokenService)),
+    __param(4, Inject(EmbedTokens))
+], AdminUiController);
+export { AdminUiController };

package/dist/ui/arrangement.d.ts

@@ -0,0 +1,74 @@
+import { type UiSlotId } from "@capybara-hq/plugin-sdk";
+import { z } from "zod";
+import type { UiContributionItem } from "./views.js";
+export declare const UiArrangementEntrySchema: z.ZodObject<{
+    hidden: z.ZodArray<z.ZodString>;
+    order: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type UiArrangementEntry = z.infer<typeof UiArrangementEntrySchema>;
+export declare const UiArrangementSchema: z.ZodRecord<z.ZodEnum<{
+    "agent.detail.section": "agent.detail.section";
+    "conversation.panel": "conversation.panel";
+    "conversation.properties.section": "conversation.properties.section";
+    "conversation.tool-result.card": "conversation.tool-result.card";
+    "file.preview": "file.preview";
+    "org.page": "org.page";
+    "org.settings.section": "org.settings.section";
+    "platform.page": "platform.page";
+}> & z.core.$partial, z.ZodObject<{
+    hidden: z.ZodArray<z.ZodString>;
+    order: z.ZodArray<z.ZodString>;
+}, z.core.$strict>>;
+export type UiArrangement = z.infer<typeof UiArrangementSchema>;
+/** The slots an org arranges: every arrangeable slot but the platform's own. */
+export declare const ORG_ARRANGEABLE: readonly UiSlotId[];
+/** An org's patch: a slot's entry replaces the stored one, null removes it. */
+export declare const OrgUiArrangementPatchSchema: z.ZodRecord<z.ZodEnum<{
+    "agent.detail.section": "agent.detail.section";
+    "conversation.panel": "conversation.panel";
+    "conversation.properties.section": "conversation.properties.section";
+    "conversation.tool-result.card": "conversation.tool-result.card";
+    "file.preview": "file.preview";
+    "org.page": "org.page";
+    "org.settings.section": "org.settings.section";
+    "platform.page": "platform.page";
+}> & z.core.$partial, z.ZodNullable<z.ZodObject<{
+    hidden: z.ZodArray<z.ZodString>;
+    order: z.ZodArray<z.ZodString>;
+}, z.core.$strict>>>;
+/** A deployment patch: like {@link OrgUiArrangementPatchSchema} over every arrangeable slot. */
+export declare const UiArrangementPatchSchema: z.ZodRecord<z.ZodEnum<{
+    "agent.detail.section": "agent.detail.section";
+    "conversation.panel": "conversation.panel";
+    "conversation.properties.section": "conversation.properties.section";
+    "conversation.tool-result.card": "conversation.tool-result.card";
+    "file.preview": "file.preview";
+    "org.page": "org.page";
+    "org.settings.section": "org.settings.section";
+    "platform.page": "platform.page";
+}> & z.core.$partial, z.ZodNullable<z.ZodObject<{
+    hidden: z.ZodArray<z.ZodString>;
+    order: z.ZodArray<z.ZodString>;
+}, z.core.$strict>>>;
+/** Merges a per-slot patch into the stored arrangement (null removes the slot's entry). */
+export declare function mergeArrangement(current: UiArrangement | undefined, patch: Partial<Record<UiSlotId, UiArrangementEntry | null>>): UiArrangement;
+/** The entry that applies to a slot: the org's if it arranged the slot, else the platform's. */
+export declare function effectiveEntry(org: UiArrangement | undefined, platform: UiArrangement, slot: UiSlotId): {
+    entry: UiArrangementEntry;
+    source: "org" | "platform" | "none";
+};
+/**
+ * Orders the items of one slot (hidden ones stay in place): grouped by anchor in the slot's anchor
+ * order, also without an entry (the lists match what the page renders per anchor); within a group
+ * the keys of `entry.order` come first in that order, the rest in base order. Unknown keys are
+ * ignored, so an order never moves an item across anchors.
+ */
+export declare function orderItems(items: UiContributionItem[], entry: UiArrangementEntry): UiContributionItem[];
+/** {@link orderItems} without the hidden keys. */
+export declare function arrange(items: UiContributionItem[], entry: UiArrangementEntry): UiContributionItem[];
+/**
+ * Applies the per-slot entries to a mixed list: each slot's items are arranged and written back
+ * into the positions that slot occupied (a slot without an entry: its base order, grouped by
+ * anchor).
+ */
+export declare function arrangeBySlot(items: UiContributionItem[], entryOf: (slot: UiSlotId) => UiArrangementEntry): UiContributionItem[];