@capybara-hq/kernel 0.1.0-rc.12 → 0.1.0-rc.14

package/dist/files/previewers.d.ts

@@ -87,7 +87,7 @@ export declare class PreviewerRegistry {
         locale: "zh" | "en";
     }): Promise<UiView>;
     /**
-     * Whether an embed token for a `file-preview` contribution may be issued for this file: the
+     * Whether an embed token for a `file.preview` contribution may be issued for this file: the
      * viewer reads the conversation, the file is in it, and an enabled previewer of that extension
      * with `embed: contribution` takes it. Conversation / file not found throws 404.
      */

package/dist/files/previewers.js

@@ -299,7 +299,7 @@ let PreviewerRegistry = class PreviewerRegistry {
         return view;
     }
     /**
-     * Whether an embed token for a `file-preview` contribution may be issued for this file: the
+     * Whether an embed token for a `file.preview` contribution may be issued for this file: the
      * viewer reads the conversation, the file is in it, and an enabled previewer of that extension
      * with `embed: contribution` takes it. Conversation / file not found throws 404.
      */

package/dist/http/api.module.js

@@ -30,10 +30,8 @@ import { ChannelConnectionsController } from "../channels/connections.controller
 import { AttachmentsController } from "../conversations/attachments.controller.js";
 import { ConversationsController } from "../conversations/conversations.controller.js";
 import { ConversationsModule } from "../conversations/conversations.module.js";
-import { DeviceAuthController } from "../devices/device-auth.controller.js";
-import { DeviceAuthModule } from "../devices/device-auth.module.js";
-import { EnvironmentsController } from "../environments/environments.controller.js";
-import { EnvironmentsModule } from "../environments/environments.module.js";
+import { DevicesController } from "../devices/devices.controller.js";
+import { DevicesModule } from "../devices/devices.module.js";
 import { EvalsModule } from "../evals/evals.module.js";
 import { EvalRunsController } from "../evals/runs.controller.js";
 import { EvalSetsController } from "../evals/sets.controller.js";
@@ -50,6 +48,8 @@ import { MeController } from "../identity/me.controller.js";
 import { BindController, MeIdentitiesController, SsoController, } from "../identity/sso.controller.js";
 import { InboxModule } from "../inbox/inbox.module.js";
 import { PlatformInboxController } from "../inbox/platform-inbox.controller.js";
+import { DeviceAuthController } from "../local-devices/device-auth.controller.js";
+import { DeviceAuthModule } from "../local-devices/device-auth.module.js";
 import { ModelEnablementController } from "../models/enablement.controller.js";
 import { ModelsModule } from "../models/models.module.js";
 import { ModelPurposesController } from "../models/purposes.controller.js";
@@ -60,6 +60,9 @@ import { OrgsModule } from "../orgs/orgs.module.js";
 import { OrgSettingsController } from "../orgs/settings.controller.js";
 import { RuntimeModule } from "../runtime/runtime.module.js";
 import { ConversationStreamController } from "../runtime/stream.controller.js";
+import { SetupModule } from "../setup/setup.module.js";
+import { SetupChecksController } from "../setup/setup-checks.controller.js";
+import { SetupGuidesController } from "../setup/setup-guides.controller.js";
 import { AgentSkillsController, InboxController, SkillChangesController, } from "../skills/changes.controller.js";
 import { InvocableSkillsController } from "../skills/invocable.controller.js";
 import { SkillsController } from "../skills/skills.controller.js";
@@ -75,6 +78,8 @@ import { ExtensionToolsController } from "../tools/extension-tools.controller.js
 import { OAuthCallbackController, OAuthConnectController, } from "../tools/oauth/oauth.controller.js";
 import { QuestionsController } from "../tools/questions.controller.js";
 import { ToolsModule } from "../tools/tools.module.js";
+import { AdminUiController } from "../ui/admin-ui.controller.js";
+import { SlotsController } from "../ui/slots.controller.js";
 import { UiModule } from "../ui/ui.module.js";
 import { UiController } from "../ui/views.controller.js";
 /** Every controller of the kernel API. */
@@ -104,7 +109,7 @@ const CONTROLLERS = [
     ReadinessController,
     ConversationsController,
     BackgroundController,
-    EnvironmentsController,
+    DevicesController,
     AttachmentsController,
     SkillsController,
     SkillChangesController,
@@ -127,6 +132,8 @@ const CONTROLLERS = [
     ChannelConnectionsController,
     DirectorySyncController,
     UiController,
+    AdminUiController,
+    SlotsController,
     FilePreviewersController,
     ExtensionPointDefaultsController,
     TrajectoryController,
@@ -134,6 +141,8 @@ const CONTROLLERS = [
     EvalRunsController,
     ModelPurposesController,
     OrgCatalogController,
+    SetupChecksController,
+    SetupGuidesController,
     OrgPluginUploadsController,
     OrgOwnedPluginsController,
     OrgComponentsController,
@@ -166,7 +175,7 @@ ApiModule = __decorate([
             AgentsModule,
             ConversationsModule,
             BackgroundModule,
-            EnvironmentsModule,
+            DevicesModule,
             DeviceAuthModule,
             RuntimeModule,
             ChannelsModule,
@@ -175,6 +184,7 @@ ApiModule = __decorate([
             UiModule,
             InboxModule,
             ThemesModule,
+            SetupModule,
         ],
         controllers: CONTROLLERS,
         providers: [{ provide: APP_GUARD, useClass: AuthGuard }],

package/dist/http/gateway-routes.d.ts

@@ -1,7 +1,7 @@
 import type { Logger } from "@capybara-hq/plugin-sdk";
 import type { FastifyInstance } from "fastify";
 import type { ChannelWebhooks } from "../channels/webhook.js";
-import { type DeviceRoutesOptions } from "../devices/device-routes.js";
+import { type DeviceRoutesOptions } from "../local-devices/device-routes.js";
 /** What the gateway role serves over HTTP besides health and plugin routes. */
 export interface GatewayRoutes {
     webhooks: Pick<ChannelWebhooks, "handle">;

package/dist/http/gateway-routes.js

@@ -1,5 +1,5 @@
 import { registerChannelWebhookRoute } from "../channels/webhook.controller.js";
-import { registerDeviceConnectRoute } from "../devices/device-routes.js";
+import { registerDeviceConnectRoute, } from "../local-devices/device-routes.js";
 /**
  * Registers the gateway role's HTTP routes (`serveGateway = roles.includes("gateway")`): the
  * channel webhook and the device connection WebSocket. These are raw Fastify routes, not a Nest

package/dist/identity/settings.d.ts

@@ -3,6 +3,7 @@ import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
+import { type UiArrangement } from "../ui/arrangement.js";
 import { SuperAdminLock } from "./super-admin.js";
 /** 沙箱 cpu（核）与内存（MB）覆盖的范围（C19）。 */
 export declare const SANDBOX_CPU_RANGE: {
@@ -72,6 +73,19 @@ export declare const DEPLOYMENT_SETTINGS: z.ZodObject<{
     uiTheme: z.ZodDefault<z.ZodObject<{
         id: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
+    uiArrangement: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
+        "agent.detail.section": "agent.detail.section";
+        "conversation.panel": "conversation.panel";
+        "conversation.properties.section": "conversation.properties.section";
+        "conversation.tool-result.card": "conversation.tool-result.card";
+        "file.preview": "file.preview";
+        "org.page": "org.page";
+        "org.settings.section": "org.settings.section";
+        "platform.page": "platform.page";
+    }> & z.core.$partial, z.ZodObject<{
+        hidden: z.ZodArray<z.ZodString>;
+        order: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>;
 }, z.core.$strip>;
 export type DeploymentSettings = z.infer<typeof DEPLOYMENT_SETTINGS>;
 /**
@@ -111,6 +125,19 @@ export declare const DEPLOYMENT_SETTINGS_PATCH: z.ZodObject<{
     uiTheme: z.ZodOptional<z.ZodObject<{
         id: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>>;
+    uiArrangement: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        "agent.detail.section": "agent.detail.section";
+        "conversation.panel": "conversation.panel";
+        "conversation.properties.section": "conversation.properties.section";
+        "conversation.tool-result.card": "conversation.tool-result.card";
+        "file.preview": "file.preview";
+        "org.page": "org.page";
+        "org.settings.section": "org.settings.section";
+        "platform.page": "platform.page";
+    }> & z.core.$partial, z.ZodNullable<z.ZodObject<{
+        hidden: z.ZodArray<z.ZodString>;
+        order: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>>;
 }, z.core.$strict>;
 export type DeploymentSettingsPatch = z.infer<typeof DEPLOYMENT_SETTINGS_PATCH>;
 /**
@@ -145,6 +172,11 @@ export declare function readOrgMarketplaceBrowse(db: KernelSchemaDb): Promise<bo
 export declare function readUiTheme(db: KernelSchemaDb, opts?: {
     lock?: boolean;
 }): Promise<UiTheme>;
+/**
+ * The platform default arrangement of UI slots, read live (the lists apply it). An invalid
+ * stored value reads as `{}` (the same fallback {@link SettingsService.get} uses).
+ */
+export declare function readUiArrangement(db: KernelSchemaDb): Promise<UiArrangement>;
 /** Deployment settings: one row per key, defaults for missing keys. */
 export declare class SettingsService {
     private readonly db;

package/dist/identity/settings.js

@@ -15,6 +15,7 @@ import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { assertPlatformDefaultEligible, lockThemeShared } from "../themes/theme-state.js";
+import { mergeArrangement, UiArrangementPatchSchema, UiArrangementSchema, } from "../ui/arrangement.js";
 import { audit } from "./audit.js";
 import { SuperAdminLock } from "./super-admin.js";
 /** 币种代码：ISO 4217 的三位大写字母（如 USD、CNY）。 */
@@ -100,6 +101,8 @@ export const DEPLOYMENT_SETTINGS = z.object({
     orgMarketplaceBrowse: z.boolean().default(true),
     /** The platform default theme (themes spec §7); `{ id: null }`: the built-in theme. */
     uiTheme: UiThemeSetting.default({ id: null }),
+    /** The platform default arrangement of UI slots (UI slots spec §5); orgs override per slot. */
+    uiArrangement: UiArrangementSchema.default({}),
 });
 const DEFAULTS = DEPLOYMENT_SETTINGS.parse({});
 /**
@@ -131,6 +134,8 @@ export const DEPLOYMENT_SETTINGS_PATCH = z
      * disabled (else 400 `theme.not_available`), or `{ id: null }` for the built-in theme.
      */
     uiTheme: UiThemeSetting.strict().optional(),
+    /** Per slot, the entry to hide / order contributions with; null removes a slot's entry. */
+    uiArrangement: UiArrangementPatchSchema.optional(),
 })
     .strict();
 /**
@@ -240,6 +245,19 @@ async function lockUiThemeRow(db) {
         .forUpdate()
         .execute();
 }
+/**
+ * The platform default arrangement of UI slots, read live (the lists apply it). An invalid
+ * stored value reads as `{}` (the same fallback {@link SettingsService.get} uses).
+ */
+export async function readUiArrangement(db) {
+    const row = await db
+        .selectFrom("deployment_settings")
+        .select("value")
+        .where("key", "=", "uiArrangement")
+        .executeTakeFirst();
+    const parsed = UiArrangementSchema.safeParse(row?.value);
+    return parsed.success ? parsed.data : {};
+}
 /** 按组织合并覆盖：值为 null 删除该组织，其余整项替换；未列出的组织不变。 */
 function mergeByOrg(current, patch) {
     const merged = { ...current };
@@ -331,9 +349,15 @@ let SettingsService = class SettingsService {
             }
             next.uiTheme = { id: patch.uiTheme.id };
         }
-        const { runConcurrencyOverrides: runPatch, sandboxLimitOverrides: sandboxPatch, subagentLimitOverrides: subagentPatch, } = patch;
-        if (runPatch !== undefined || sandboxPatch !== undefined || subagentPatch !== undefined) {
+        const { runConcurrencyOverrides: runPatch, sandboxLimitOverrides: sandboxPatch, subagentLimitOverrides: subagentPatch, uiArrangement: arrangementPatch, } = patch;
+        if (runPatch !== undefined ||
+            sandboxPatch !== undefined ||
+            subagentPatch !== undefined ||
+            arrangementPatch !== undefined) {
             const current = await this.get();
+            if (arrangementPatch !== undefined) {
+                next.uiArrangement = mergeArrangement(current.uiArrangement, arrangementPatch);
+            }
             if (runPatch !== undefined) {
                 next.runConcurrencyOverrides = mergeByOrg(current.runConcurrencyOverrides, runPatch);
             }

package/dist/infra/config/kernel-config.service.js

@@ -33,10 +33,10 @@ const HOT_APPLIERS = {
     "models.embedTimeoutMs": () => { },
     // SandboxService reads the shared-lease cap at every acquisition.
     "sandbox.maxConcurrentCommands": () => { },
-    // The environments service reads the personal limit at every create.
-    "environments.maxPersonal": () => { },
-    // The device relay reads the reconnect grace at every disconnect and token response.
-    "environments.device.reconnectGraceSeconds": () => { },
+    // The devices service reads the personal limit at every create.
+    "devices.maxPersonal": () => { },
+    // The local device relay reads the reconnect grace at every disconnect and token response.
+    "devices.local.reconnectGraceSeconds": () => { },
     // Sub-agent limits are read at every dispatch, child step and tool resolution.
     "subagents.maxDepth": () => { },
     "subagents.maxConcurrentPerConversation": () => { },

package/dist/infra/lock/lock.service.d.ts

@@ -74,6 +74,14 @@ export declare class LockService {
     holderOf(key: string): Promise<string | null>;
     /** Deletes `key` when `holder` still owns it. */
     releaseIf(key: string, holder: string): Promise<boolean>;
+    /**
+     * Takes one of `limit` slots of the counting semaphore `key` for `holder` (a unique token), for at
+     * most `ttlMs` (a crashed holder's slot frees itself then; no renewal). False when every slot is
+     * taken. Release with {@link releaseSlot}.
+     */
+    takeSlot(key: string, holder: string, limit: number, ttlMs: number): Promise<boolean>;
+    /** Gives back `holder`'s slot of the semaphore `key` (nothing when it already expired). */
+    releaseSlot(key: string, holder: string): Promise<void>;
     /**
      * Takes `key` (no `lock:` prefix) with the caller's `holder` value for `ttlMs`, unless it is
      * held, and renews it every TTL/3 like {@link acquire} (a run longer than the TTL keeps it, a

package/dist/infra/lock/lock.service.js

@@ -20,6 +20,20 @@ import { ACQUIRE_EXCLUSIVE, ACQUIRE_SHARED, COUNT_SHARED_LEASES, DOWNGRADE_SHARE
 const RELEASE_IF = `if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end`;
 /** Extends the key only while it holds our token. */
 const RENEW_IF = `if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('pexpire', KEYS[1], tonumber(ARGV[2])) else return 0 end`;
+/**
+ * Takes a slot of a counting semaphore: a sorted set of holder tokens scored by expiry time. Expired
+ * holders (a crashed replica's) drop out first, so a slot is never lost for longer than its TTL;
+ * then the token is added when fewer than ARGV[2] slots are taken. The set itself expires with
+ * its last slot. KEYS[1] the set; ARGV: token, limit, ttl ms. Returns 1 when taken.
+ */
+const TAKE_SLOT = `local now = redis.call('time')
+local ms = tonumber(now[1]) * 1000 + math.floor(tonumber(now[2]) / 1000)
+redis.call('zremrangebyscore', KEYS[1], '-inf', ms)
+if redis.call('zcard', KEYS[1]) >= tonumber(ARGV[2]) then return 0 end
+redis.call('zadd', KEYS[1], ms + tonumber(ARGV[3]), ARGV[1])
+local last = redis.call('zrange', KEYS[1], -1, -1, 'withscores')
+redis.call('pexpireat', KEYS[1], tonumber(last[2]))
+return 1`;
 /** Resolves after `ms`; rejects with the abort reason when `signal` aborts first. */
 function sleep(ms, signal) {
     return new Promise((resolve, reject) => {
@@ -117,6 +131,19 @@ let LockService = class LockService {
     async releaseIf(key, holder) {
         return (await this.redis.eval(RELEASE_IF, 1, key, holder)) === 1;
     }
+    /**
+     * Takes one of `limit` slots of the counting semaphore `key` for `holder` (a unique token), for at
+     * most `ttlMs` (a crashed holder's slot frees itself then; no renewal). False when every slot is
+     * taken. Release with {@link releaseSlot}.
+     */
+    async takeSlot(key, holder, limit, ttlMs) {
+        assertNoTransaction("takeSlot");
+        return ((await this.redis.eval(TAKE_SLOT, 1, key, holder, String(limit), String(Math.ceil(ttlMs)))) === 1);
+    }
+    /** Gives back `holder`'s slot of the semaphore `key` (nothing when it already expired). */
+    async releaseSlot(key, holder) {
+        await this.redis.zrem(key, holder);
+    }
     /**
      * Takes `key` (no `lock:` prefix) with the caller's `holder` value for `ttlMs`, unless it is
      * held, and renews it every TTL/3 like {@link acquire} (a run longer than the TTL keeps it, a

package/dist/infra/throttler/named-throttlers.d.ts

@@ -8,6 +8,8 @@ export interface NamedThrottler {
     ttl: number;
     /** The 429 message (today's text of the route that used the limiter). */
     message: string;
+    /** The 429 error code; default `auth.rate_limited` (the credential routes'). */
+    code?: "auth.rate_limited" | "rate_limited";
     /** The credential group: throttlers of one group are reserved together (one Redis hash tag). */
     group: string;
     /** What a successful attempt does to this counter: delete it, or give one attempt back. */
@@ -29,7 +31,8 @@ export interface NamedThrottler {
  *
  * `POST /api/v1/device/authorize` and `POST /api/v1/device/token` opt in to `device-authorize-ip`
  * and `device-token-ip` with `@Throttled` (every request counts; neither checks a guessable
- * credential: the device code is 32 random bytes).
+ * credential: the device code is 32 random bytes). `POST …/guides/:guideId/checks/:checkId/run`
+ * opts in to `setup-check` (setup guides v2 §10.3: each run may call a third party).
  */
 export declare const NAMED_THROTTLERS: readonly NamedThrottler[];
 /** The storage key of a named throttler's counter for a tracker (shared by the guard and success paths). */

package/dist/infra/throttler/named-throttlers.js

@@ -32,7 +32,8 @@ const LOGIN_MSG = "Too many failed login attempts; try again later";
  *
  * `POST /api/v1/device/authorize` and `POST /api/v1/device/token` opt in to `device-authorize-ip`
  * and `device-token-ip` with `@Throttled` (every request counts; neither checks a guessable
- * credential: the device code is 32 random bytes).
+ * credential: the device code is 32 random bytes). `POST …/guides/:guideId/checks/:checkId/run`
+ * opts in to `setup-check` (setup guides v2 §10.3: each run may call a third party).
  */
 export const NAMED_THROTTLERS = [
     // (login, IP): 10; an attacker filling one login from one IP leaves the owner's other IPs alone (R25)
@@ -152,6 +153,20 @@ export const NAMED_THROTTLERS = [
         message: "Too many device code attempts; try again later",
         getTracker: (req) => sha256(principalAccountId(req)),
     },
+    // setup check runs per signed-in person (setup guides v2 §10.5): 30 a minute, every request
+    // counts (@Throttled); a cached answer costs no third-party call but still counts, as the page
+    // asks at most once per row and stale result. The edge of the route (with `retry-after`): the
+    // budget shared with the Platform tool's setup.check is SetupChecksService's own counter
+    {
+        name: "setup-check",
+        group: "setup-check",
+        onSuccess: "clear",
+        limit: 30,
+        ttl: 60_000,
+        message: "Too many setup check runs; try again in a minute",
+        code: "rate_limited",
+        getTracker: (req) => sha256(principalAccountId(req)),
+    },
 ];
 /** The storage key of a named throttler's counter for a tracker (shared by the guard and success paths). */
 export const throttlerKey = (name, tracker) => sha256(`${name}:${tracker}`);

package/dist/infra/throttler/throttler.guard.js

@@ -56,7 +56,7 @@ let KernelThrottlerGuard = class KernelThrottlerGuard extends ThrottlerGuard {
         const known = NAMED_THROTTLERS.find((t) => t.name === name);
         if (!known)
             throw new Error(`unknown throttler "${name}"`);
-        throw new ApiError("auth.rate_limited", known.message);
+        throw new ApiError(known.code ?? "auth.rate_limited", known.message);
     }
 };
 KernelThrottlerGuard = __decorate([

package/dist/kernel.module.js

@@ -10,7 +10,6 @@ import { APP_INTERCEPTOR } from "@nestjs/core";
 import { CatalogModule } from "./catalog/catalog.module.js";
 import { ChannelsModule } from "./channels/channels.module.js";
 import { TitlesModule } from "./conversations/titles.js";
-import { DevicesModule } from "./devices/devices.module.js";
 import { ExtensionsModule } from "./extensions/extensions.module.js";
 import { ApiModule } from "./http/api.module.js";
 import { ErrorFilterModule } from "./http/error-filter.module.js";
@@ -32,6 +31,7 @@ import { KERNEL_POOL, REDIS } from "./infra/tokens.js";
 import { ValidationModule } from "./infra/validation/validation.module.js";
 import { KernelLifecycle } from "./lifecycle/kernel-lifecycle.js";
 import { KERNEL_APP_OPTIONS } from "./lifecycle/tokens.js";
+import { LocalDevicesModule } from "./local-devices/local-devices.module.js";
 import { createConfiguredLogger } from "./log-config.js";
 import { KERNEL_OVERRIDE_TOKENS } from "./overrides.js";
 import { PlatformModule } from "./platform/platform.module.js";
@@ -111,8 +111,8 @@ let KernelModule = KernelModule_1 = class KernelModule {
                 TitlesModule,
                 UsageReportModule,
                 ChannelsModule,
-                // the @device sandbox provider, registered on every role (any replica may relay to a machine)
-                DevicesModule,
+                // the @local sandbox provider, registered on every role (any replica may relay to a machine)
+                LocalDevicesModule,
                 // the Platform tool's operation registry and actor facts
                 PlatformModule,
                 // its operations (skills, agents, ...), registered at start on every role

package/dist/{devices → local-devices}/device-auth.controller.d.ts

@@ -11,15 +11,15 @@ import { type DeviceAuthorizeBody, type DeviceConfirmBody, type DeviceTokenBody,
  * they need `X-Capybara-Csrf: 1`, which `capybara-device` sends:
  * - `POST /authorize { name, os, arch, programVersion }` → `{ deviceCode, userCode,
  *   verificationUri, verificationUriComplete, interval, expiresIn }` (`device-authorize-ip`);
- * - `POST /token { deviceCode }` → `{ credential, orgId, environmentId, connectUrl,
- *   reconnectGraceSeconds, maxFrameBytes }` once, else `device.authorization_pending` / `device.slow_down` /
- *   `device.denied` / `device.expired` (`device-token-ip`).
+ * - `POST /token { deviceCode }` → `{ credential, orgId, deviceId, connectUrl,
+ *   reconnectGraceSeconds, maxFrameBytes }` once, else `device_sign_in.authorization_pending` / `device_sign_in.slow_down` /
+ *   `device_sign_in.denied` / `device_sign_in.expired` (`device-token-ip`).
  *
  * The person's routes need a web session (the confirmation page `/device`); each try of a user
  * code counts on `device-code-account` (refunded on success):
  * - `GET /pending/:userCode` → `{ machine, expiresAt }`;
- * - `POST /confirm { userCode, orgId, environmentId | name }` → `{ environmentId }`
- *   (`device.expired` / `device.unavailable` when the credential could not be handed over: the
+ * - `POST /confirm { userCode, orgId, deviceId | name }` → `{ deviceId }`
+ *   (`device_sign_in.expired` / `device_sign_in.unavailable` when the credential could not be handed over: the
  *   machine is revoked again and the person runs login again);
  * - `POST /deny { userCode }` → 204.
  */
@@ -34,7 +34,7 @@ export declare class DeviceAuthController {
         expiresAt: string;
     }>;
     confirm(principal: Principal, body: z.infer<typeof DeviceConfirmBody>, req: FastifyRequest, reply: FastifyReply): Promise<{
-        environmentId: string;
+        deviceId: string;
     }>;
     deny(principal: Principal, body: z.infer<typeof DeviceUserCodeBody>, req: FastifyRequest, reply: FastifyReply): Promise<void>;
     /** Runs `fn` as one counted try of a user code; a success gives the try back. */

package/dist/{devices → local-devices}/device-auth.controller.js

@@ -23,15 +23,15 @@ const CODE_THROTTLER = ["device-code-account"];
  * they need `X-Capybara-Csrf: 1`, which `capybara-device` sends:
  * - `POST /authorize { name, os, arch, programVersion }` → `{ deviceCode, userCode,
  *   verificationUri, verificationUriComplete, interval, expiresIn }` (`device-authorize-ip`);
- * - `POST /token { deviceCode }` → `{ credential, orgId, environmentId, connectUrl,
- *   reconnectGraceSeconds, maxFrameBytes }` once, else `device.authorization_pending` / `device.slow_down` /
- *   `device.denied` / `device.expired` (`device-token-ip`).
+ * - `POST /token { deviceCode }` → `{ credential, orgId, deviceId, connectUrl,
+ *   reconnectGraceSeconds, maxFrameBytes }` once, else `device_sign_in.authorization_pending` / `device_sign_in.slow_down` /
+ *   `device_sign_in.denied` / `device_sign_in.expired` (`device-token-ip`).
  *
  * The person's routes need a web session (the confirmation page `/device`); each try of a user
  * code counts on `device-code-account` (refunded on success):
  * - `GET /pending/:userCode` → `{ machine, expiresAt }`;
- * - `POST /confirm { userCode, orgId, environmentId | name }` → `{ environmentId }`
- *   (`device.expired` / `device.unavailable` when the credential could not be handed over: the
+ * - `POST /confirm { userCode, orgId, deviceId | name }` → `{ deviceId }`
+ *   (`device_sign_in.expired` / `device_sign_in.unavailable` when the credential could not be handed over: the
  *   machine is revoked again and the person runs login again);
  * - `POST /deny { userCode }` → 204.
  */

package/dist/{devices → local-devices}/device-auth.d.ts

@@ -1,5 +1,5 @@
 import type { Redis } from "ioredis";
-import { EnvironmentsService } from "../environments/environments.service.js";
+import { DevicesService } from "../devices/devices.service.js";
 import type { UserPrincipal } from "../identity/principal.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -10,8 +10,8 @@ import { MachinesService } from "./machines.js";
 export declare const USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
 /** What `slow_down` adds to the poll interval (RFC 8628 §3.5). */
 export declare const SLOW_DOWN_STEP_SECONDS = 5;
-/** The web page that confirms a code: `<http.publicUrl>/device`. */
-export declare const DEVICE_PAGE_PATH = "/device";
+/** The web page that confirms a code: `<http.publicUrl>/devices/link`. */
+export declare const DEVICE_PAGE_PATH = "/devices/link";
 /** The machine's WebSocket route: `ws(s)://<http.publicUrl host>/device/connect`. */
 export declare const DEVICE_CONNECT_PATH = "/device/connect";
 /** The sign-in state of one device code: `capk:device-auth:<sha256(deviceCode)>` (a hash). */
@@ -28,7 +28,7 @@ export interface DeviceMachineInfo {
 interface Grant {
     credential: string;
     orgId: string;
-    environmentId: string;
+    deviceId: string;
 }
 export interface DeviceAuthorization {
     deviceCode: string;
@@ -41,7 +41,7 @@ export interface DeviceAuthorization {
 export interface DeviceGrant extends Grant {
     connectUrl: string;
     reconnectGraceSeconds: number;
-    /** `environments.device.maxFrameBytes`: the program never sends a larger frame (ruling R26). */
+    /** `devices.local.maxFrameBytes`: the program never sends a larger frame (ruling R26). */
     maxFrameBytes: number;
 }
 /** A user code as typed → `XXXX-XXXX`, or null when it cannot be one. */
@@ -51,7 +51,7 @@ export declare function normalizeUserCode(input: string): string | null;
  * for a code pair (`authorize`), the signed-in person confirms the user code on the web page
  * `/device` (`pending`, `confirm` or `deny`), and the program polls `token` until it gets the
  * machine credential, once. State lives only in Redis, both keys with the code's TTL
- * (`environments.device.authCodeTtlSeconds`): `capk:device-auth:<sha256(deviceCode)>` (a hash:
+ * (`devices.local.authCodeTtlSeconds`): `capk:device-auth:<sha256(deviceCode)>` (a hash:
  * `info` JSON, `status`, `interval`, `lastPollAt`, the parked `grant`) and
  * `capk:device-user:<userCode>` → the device code's hash. The device code itself is never stored.
  */
@@ -60,16 +60,16 @@ export declare class DeviceAuthService {
     readonly txHost: TransactionHost;
     private readonly redis;
     private readonly config;
-    private readonly environments;
+    private readonly devices;
     private readonly machines;
     private readonly log;
-    constructor(db: KernelDb, txHost: TransactionHost, redis: Redis, config: Pick<KernelConfigService, "get">, environments: Pick<EnvironmentsService, "createDevice">, machines: Pick<MachinesService, "issue" | "revokeMachine">, log: Pick<KernelLogger, "warn">);
+    constructor(db: KernelDb, txHost: TransactionHost, redis: Redis, config: Pick<KernelConfigService, "get">, devices: Pick<DevicesService, "createLocal">, machines: Pick<MachinesService, "issue" | "revokeMachine">, log: Pick<KernelLogger, "warn">);
     /** A new code pair for a machine. Needs `http.publicUrl` (the page and the connection URL). */
     authorize(machine: DeviceMachineInfo): Promise<DeviceAuthorization>;
     /**
      * The program's poll: the grant once the person confirmed (the code is consumed), else
-     * `device.authorization_pending`, `device.slow_down` (details `[{ interval }]`, the grown
-     * interval), `device.denied` or `device.expired` (also for an unknown code).
+     * `device_sign_in.authorization_pending`, `device_sign_in.slow_down` (details `[{ interval }]`, the grown
+     * interval), `device_sign_in.denied` or `device_sign_in.expired` (also for an unknown code).
      */
     token(deviceCode: string): Promise<DeviceGrant>;
     /** The machine waiting behind a user code, for the confirmation page. */
@@ -79,10 +79,10 @@ export declare class DeviceAuthService {
     }>;
     /**
      * The person confirms a user code: in an org where they may use agents (`agents.use`), into
-     * one of their own live device environments or a new one named `name` (` 2`, ` 3`, … appended
-     * while the name is taken). One transaction creates the environment if needed, issues the
-     * machine (revoking the environment's previous one) and audits
-     * `environment.machine_connected` (retried once when a concurrent confirmation took the new
+     * one of their own live local devices or a new one named `name` (` 2`, ` 3`, … appended
+     * while the name is taken). One transaction creates the device if needed, issues the
+     * machine (revoking the device's previous one) and audits
+     * `device.machine_connected` (retried once when a concurrent confirmation took the new
      * name); after the commit the credential is parked for the poll ({@link park}). The code is
      * claimed first, so two confirmations of one code cannot both issue a machine; a confirmation
      * that fails before the commit leaves it pending.
@@ -90,28 +90,28 @@ export declare class DeviceAuthService {
     confirm(principal: UserPrincipal, input: {
         userCode: string;
         orgId: string;
-        environmentId?: string | undefined;
+        deviceId?: string | undefined;
         name?: string | undefined;
     }): Promise<{
-        environmentId: string;
+        deviceId: string;
     }>;
     /**
      * Parks the committed machine's credential for the poll. When that fails (the code expired
      * meanwhile, or Redis failed) the machine is revoked again, so no credential nobody holds stays
-     * valid, and the person is told to start over: `device.expired` / `device.unavailable`.
+     * valid, and the person is told to start over: `device_sign_in.expired` / `device_sign_in.unavailable`.
      */
     private park;
     /** Revokes a machine whose credential never reached the program (see {@link park}). */
     private abandon;
-    /** The person refuses a user code: the program's next poll gets `device.denied`. */
+    /** The person refuses a user code: the program's next poll gets `device_sign_in.denied`. */
     deny(userCode: string): Promise<void>;
     private confirmIn;
     /** `name`, or `name 2`, `name 3`, … : the first that is none of the person's live names. */
     private freeName;
-    /** The code behind a user code with status `status`, else `device.code_invalid`. */
+    /** The code behind a user code with status `status`, else `device_sign_in.code_invalid`. */
     private lookup;
     private transition;
-    /** `http.publicUrl` without trailing slashes; unset → `environment.unavailable`. */
+    /** `http.publicUrl` without trailing slashes; unset → `device.unavailable`. */
     private publicUrl;
     /** The machine's WebSocket URL: the public URL with `ws` / `wss` and `/device/connect`. */
     private connectUrl;