@capybara-hq/kernel 0.1.0-rc.13 → 0.1.0-rc.15

package/dist/setup/setup-guides.controller.d.ts

@@ -0,0 +1,18 @@
+import type { z } from "zod";
+import { type Principal } from "../identity/principal.js";
+import { type OrgContext } from "../orgs/org.guard.js";
+import { SetupGuidesQuery } from "./setup-guides.schemas.js";
+import { type SetupGuideListEntry, SetupGuidesService } from "./setup-guides.service.js";
+/**
+ * The org's setup guides as the caller sees them (spec 2026-11-09-setup-guides-v2-design.md §12):
+ * per guide its targets, their drift, a summary of the cached check states and the web page of
+ * each. `catalog.read` here; which guides and targets a role sees is the service's (the guide
+ * route's place and audience actions).
+ */
+export declare class SetupGuidesController {
+    private readonly guides;
+    constructor(guides: SetupGuidesService);
+    list(principal: Principal, org: OrgContext, q: z.infer<typeof SetupGuidesQuery>): Promise<{
+        guides: SetupGuideListEntry[];
+    }>;
+}

package/dist/setup/setup-guides.controller.js

@@ -0,0 +1,48 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Get, Inject } from "@nestjs/common";
+import { CurrentPrincipal, requireUser } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZQuery } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { SetupGuidesQuery } from "./setup-guides.schemas.js";
+import { SetupGuidesService } from "./setup-guides.service.js";
+class SetupGuidesQueryDto extends createZodDto(SetupGuidesQuery, "SetupGuidesQuery") {
+}
+/**
+ * The org's setup guides as the caller sees them (spec 2026-11-09-setup-guides-v2-design.md §12):
+ * per guide its targets, their drift, a summary of the cached check states and the web page of
+ * each. `catalog.read` here; which guides and targets a role sees is the service's (the guide
+ * route's place and audience actions).
+ */
+let SetupGuidesController = class SetupGuidesController {
+    guides;
+    constructor(guides) {
+        this.guides = guides;
+    }
+    async list(principal, org, q) {
+        const p = requireUser(principal);
+        return {
+            guides: await this.guides.list({ orgId: org.orgId, role: org.role, accountId: p.account.id }, q),
+        };
+    }
+};
+__decorate([
+    Get(),
+    OrgAction("catalog.read"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZQuery(SetupGuidesQueryDto))
+], SetupGuidesController.prototype, "list", null);
+SetupGuidesController = __decorate([
+    Controller("api/v1/orgs/:orgId/setup-guides"),
+    __param(0, Inject(SetupGuidesService))
+], SetupGuidesController);
+export { SetupGuidesController };

package/dist/setup/setup-guides.schemas.d.ts

@@ -0,0 +1,10 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** `GET /orgs/:orgId/setup-guides`: the language of the guide titles (zh falls back to en). */
+export declare const SetupGuidesQuery: z.ZodObject<{
+    locale: z.ZodOptional<z.ZodEnum<{
+        en: "en";
+        zh: "zh";
+    }>>;
+}, z.core.$strict>;
+export declare const SETUP_GUIDE_ROUTES: readonly RouteSchemas[];

package/dist/setup/setup-guides.schemas.js

@@ -0,0 +1,6 @@
+import { z } from "zod";
+/** `GET /orgs/:orgId/setup-guides`: the language of the guide titles (zh falls back to en). */
+export const SetupGuidesQuery = z.object({ locale: z.enum(["en", "zh"]).optional() }).strict();
+export const SETUP_GUIDE_ROUTES = [
+    { route: "GET /api/v1/orgs/:orgId/setup-guides", query: SetupGuidesQuery },
+];

package/dist/setup/setup-guides.service.d.ts

@@ -0,0 +1,126 @@
+import type { SetupGuideAudience, SetupGuideBlock, SetupGuidePlace } from "@capybara-hq/plugin-sdk";
+import { ComponentScopeService } from "../catalog/component-scope.service.js";
+import { type GuideQuery, PluginGuides, type UnresolvedReason } from "../extensions/plugin-guides.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import type { KernelLogger } from "../log.js";
+import { type CheckCaller, SetupChecksService } from "./setup-checks.service.js";
+/** The cached check states of one target, counted (`running` while a run holds the lock). */
+export interface SetupCheckSummary {
+    ok: number;
+    failing: number;
+    unknown: number;
+    running: number;
+    notRun: number;
+}
+/** Something a guide is for: a channel connection, a connector, or a template without one yet. */
+export interface SetupGuideTarget {
+    kind: "channel-connection" | "connector" | "connector-template";
+    /** The connection or connector id; the template id for `connector-template`. */
+    id: string;
+    name: string;
+    /** The guide changed since the target was set up (its ack): the versions; null otherwise. */
+    drift: {
+        from: string;
+        to: string;
+    } | null;
+    /** Null when there is nothing to check yet (a template without a connector) or it is unreadable. */
+    checks: SetupCheckSummary | null;
+    /** The web page where the person does this setup (enters values, acks the guide). */
+    webPath: string;
+}
+/** One guide the caller may see in the org, with its targets (`GET /orgs/:orgId/setup-guides`). */
+export interface SetupGuideListEntry {
+    itemId: string;
+    plugin: string;
+    guideId: string;
+    place: SetupGuidePlace;
+    /** The connector template of a `connector-template` guide; null for other places. */
+    template: string | null;
+    /** The section rendered: org admins get the admin guides, members their member sections. */
+    audience: SetupGuideAudience;
+    title: string;
+    targets: SetupGuideTarget[];
+}
+/** A rendered guide as one Markdown document, for an agent assisting the person (`setup.read`). */
+export interface SetupGuideDocument {
+    itemId: string;
+    plugin: string;
+    guideId: string;
+    place: SetupGuidePlace;
+    title: string;
+    /** Blocks joined; checks as `- [check <id>] <label>` lines. */
+    markdown: string;
+    modes: string[];
+    mode: string | null;
+    audiences: SetupGuideAudience[];
+    audience: SetupGuideAudience;
+    checks: {
+        id: string;
+        label: string;
+    }[];
+    unresolved: {
+        name: string;
+        reason: UnresolvedReason;
+    }[];
+    target: {
+        kind: "channel-connection" | "connector";
+        id: string;
+    } | null;
+    webPath: string;
+    /** What stays with the person, and where they do it. */
+    handover: string;
+}
+/** The web page of a target (`apps/web` routes; the guide sections live there). */
+export declare const setupWebPath: {
+    connection: (id: string) => string;
+    newConnection: () => string;
+    connector: (id: string) => string;
+    /** A member's connector section: the connector's row on their connections page (§9.3). */
+    memberConnections: () => string;
+    template: (itemId: string) => string;
+};
+/** The blocks of a rendered guide as one Markdown document (checks as `- [check <id>]` lines). */
+export declare function guideMarkdown(title: string, blocks: readonly SetupGuideBlock[]): string;
+/**
+ * The setup guides of an org as a person sees them (spec 2026-11-09-setup-guides-v2-design.md §12:
+ * `GET /orgs/:orgId/setup-guides`, the `Platform` tool's `setup.guides` and `setup.read`). Nothing
+ * new is decided here: guides, visibility, drift and actions are `PluginGuides`' (the guide route's
+ * rules), check states are `SetupChecksService.states` (cached, nothing runs), the templates on in
+ * the org are `ComponentScopeService.orgList`'s. Rendered text carries no secret (§6.3) and check
+ * states only their fixed, redacted fields (§10.8). Stateless: everything comes from PG and Redis.
+ */
+export declare class SetupGuidesService {
+    private readonly db;
+    private readonly guides;
+    private readonly checks;
+    private readonly components;
+    private readonly log;
+    constructor(db: KernelDb, guides: Pick<PluginGuides, "render" | "connectionStates" | "connectorStates">, checks: Pick<SetupChecksService, "states">, components: Pick<ComponentScopeService, "orgList">, log: Pick<KernelLogger, "warn">);
+    /**
+     * The guides the caller may see, each with its targets: org admins (`channels.manage`) the
+     * channel connections; org admins (`connectors.manage`) the connectors made from templates and
+     * the templates on in the org without a connector, admin audience; members (`connectors.use`
+     * without `connectors.manage`) the connectors whose template guide has a member section, member
+     * audience, without drift (only an admin acks). Each target carries its cached check summary.
+     * A guide that cannot be rendered (gone, a stored document unreadable) is left out and logged.
+     */
+    list(caller: CheckCaller, q?: {
+        locale?: "en" | "zh" | undefined;
+    }): Promise<SetupGuideListEntry[]>;
+    /** The cached check summary of a target, or null when the guide cannot be read for it. */
+    private summary;
+    private renderOrSkip;
+    /** The org's channel connections whose plugin has a guide the org sees. */
+    private connections;
+    /**
+     * The org's connectors made from a template with a guide; for org admins also the templates on
+     * in the org that have a guide and no connector yet.
+     */
+    private connectors;
+    /**
+     * One guide rendered for the caller as a Markdown document (`setup.read`): the guide route's
+     * rendering (`PluginGuides.render`, its visibility, action and target rules), joined, with the
+     * page where the person enters values and acks.
+     */
+    read(caller: CheckCaller, itemId: string, guideId: string, q: GuideQuery): Promise<SetupGuideDocument>;
+}

package/dist/setup/setup-guides.service.js

@@ -0,0 +1,315 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { ComponentScopeService } from "../catalog/component-scope.service.js";
+import { ApiError } from "../errors.js";
+import { PluginGuides, } from "../extensions/plugin-guides.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { can } from "../orgs/roles.js";
+import { SetupChecksService } from "./setup-checks.service.js";
+const enc = encodeURIComponent;
+/** The web page of a target (`apps/web` routes; the guide sections live there). */
+export const setupWebPath = {
+    connection: (id) => `/channels/${enc(id)}`,
+    newConnection: () => "/channels/new",
+    connector: (id) => `/connectors/${enc(id)}?tab=guide`,
+    /** A member's connector section: the connector's row on their connections page (§9.3). */
+    memberConnections: () => "/account/connections",
+    template: (itemId) => `/connectors/install?template=${enc(itemId)}`,
+};
+/**
+ * The page a rendered guide belongs on: a member's connections page for the member audience, else
+ * its target's, else where a target is created.
+ */
+function webPathOf(g) {
+    if (g.audience === "member")
+        return setupWebPath.memberConnections();
+    if (g.target?.kind === "channel-connection")
+        return setupWebPath.connection(g.target.id);
+    if (g.target?.kind === "connector")
+        return setupWebPath.connector(g.target.id);
+    return g.place === "channel-connection"
+        ? setupWebPath.newConnection()
+        : setupWebPath.template(g.itemId);
+}
+/** A fence longer than any run of backticks in the text. */
+function fenceFor(text) {
+    const longest = Math.max(0, ...[...text.matchAll(/`+/g)].map((m) => m[0].length));
+    return "`".repeat(Math.max(3, longest + 1));
+}
+/** The blocks of a rendered guide as one Markdown document (checks as `- [check <id>]` lines). */
+export function guideMarkdown(title, blocks) {
+    const parts = [`# ${title}`];
+    for (const b of blocks) {
+        if (b.kind === "markdown")
+            parts.push(b.text.trimEnd());
+        else if (b.kind === "check")
+            parts.push(`- [check ${b.id}] ${b.label}`);
+        else {
+            const fence = fenceFor(b.text);
+            const code = `${fence}${b.language}\n${b.text.replace(/\n$/, "")}\n${fence}`;
+            parts.push(b.title === null ? code : `**${b.title}**\n\n${code}`);
+        }
+    }
+    return `${parts.join("\n\n")}\n`;
+}
+function summarize(states) {
+    const out = { ok: 0, failing: 0, unknown: 0, running: 0, notRun: 0 };
+    for (const s of Object.values(states)) {
+        if (s.status === "ok")
+            out.ok += 1;
+        else if (s.status === "failing")
+            out.failing += 1;
+        else if (s.status === "running")
+            out.running += 1;
+        else if (s.status === "not_run")
+            out.notRun += 1;
+        else
+            out.unknown += 1;
+    }
+    return out;
+}
+/**
+ * The setup guides of an org as a person sees them (spec 2026-11-09-setup-guides-v2-design.md §12:
+ * `GET /orgs/:orgId/setup-guides`, the `Platform` tool's `setup.guides` and `setup.read`). Nothing
+ * new is decided here: guides, visibility, drift and actions are `PluginGuides`' (the guide route's
+ * rules), check states are `SetupChecksService.states` (cached, nothing runs), the templates on in
+ * the org are `ComponentScopeService.orgList`'s. Rendered text carries no secret (§6.3) and check
+ * states only their fixed, redacted fields (§10.8). Stateless: everything comes from PG and Redis.
+ */
+let SetupGuidesService = class SetupGuidesService {
+    db;
+    guides;
+    checks;
+    components;
+    log;
+    constructor(db, guides, checks, components, log) {
+        this.db = db;
+        this.guides = guides;
+        this.checks = checks;
+        this.components = components;
+        this.log = log;
+    }
+    /**
+     * The guides the caller may see, each with its targets: org admins (`channels.manage`) the
+     * channel connections; org admins (`connectors.manage`) the connectors made from templates and
+     * the templates on in the org without a connector, admin audience; members (`connectors.use`
+     * without `connectors.manage`) the connectors whose template guide has a member section, member
+     * audience, without drift (only an admin acks). Each target carries its cached check summary.
+     * A guide that cannot be rendered (gone, a stored document unreadable) is left out and logged.
+     */
+    async list(caller, q = {}) {
+        const org = { orgId: caller.orgId, role: caller.role };
+        const pending = [
+            ...(can(caller.role, "channels.manage") ? await this.connections(org) : []),
+            ...(await this.connectors(org)),
+        ];
+        const entries = new Map();
+        for (const p of pending) {
+            const key = `${p.itemId}/${p.guideId}/${p.audience}`;
+            let entry = entries.get(key);
+            if (entry === undefined) {
+                const g = await this.renderOrSkip(org, p.itemId, p.guideId, {
+                    audience: p.audience,
+                    locale: q.locale ?? "en",
+                });
+                // members get a guide only when it has a member section (the web's How to connect rule, §9.3);
+                // text outside every section applies to all audiences, so admins need no section
+                if (g === null || (p.audience === "member" && !g.audiences.includes("member")))
+                    continue;
+                entry = {
+                    itemId: g.itemId,
+                    plugin: g.plugin,
+                    guideId: g.id,
+                    place: g.place,
+                    template: g.template,
+                    audience: p.audience,
+                    title: g.title,
+                    targets: [],
+                };
+                entries.set(key, entry);
+            }
+            const { checked, ...target } = p.target;
+            entry.targets.push({
+                ...target,
+                checks: checked ? await this.summary(caller, p) : null,
+            });
+        }
+        return [...entries.values()];
+    }
+    /** The cached check summary of a target, or null when the guide cannot be read for it. */
+    async summary(caller, p) {
+        try {
+            return summarize(await this.checks.states(caller, p.itemId, p.guideId, {
+                audience: p.audience,
+                connectionId: p.query.connectionId,
+                connectorId: p.query.connectorId,
+            }));
+        }
+        catch (err) {
+            if (err instanceof ApiError)
+                return null;
+            throw err;
+        }
+    }
+    async renderOrSkip(org, itemId, guideId, q) {
+        try {
+            return await this.guides.render(org, itemId, guideId, q);
+        }
+        catch (err) {
+            if (!(err instanceof ApiError))
+                throw err;
+            this.log.warn("setup guide left out of the list", { itemId, guideId, code: err.code });
+            return null;
+        }
+    }
+    /** The org's channel connections whose plugin has a guide the org sees. */
+    async connections(org) {
+        const rows = await this.db
+            .selectFrom("channel_connections")
+            .select(["id", "plugin", "name", "guide_ack"])
+            .where("org_id", "=", org.orgId)
+            .where("deleted_at", "is", null)
+            .orderBy("created_at")
+            .orderBy("id")
+            .execute();
+        const states = await this.guides.connectionStates(rows.map((r) => ({ id: r.id, plugin: r.plugin, guideAck: r.guide_ack ?? null })), org);
+        return rows.flatMap((r) => pendingOf(states.get(r.id), "admin", {
+            kind: "channel-connection",
+            id: r.id,
+            name: r.name,
+            query: { connectionId: r.id },
+            webPath: setupWebPath.connection(r.id),
+        }));
+    }
+    /**
+     * The org's connectors made from a template with a guide; for org admins also the templates on
+     * in the org that have a guide and no connector yet.
+     */
+    async connectors(org) {
+        const admin = can(org.role, "connectors.manage");
+        if (!admin && !can(org.role, "connectors.use"))
+            return [];
+        const audience = admin ? "admin" : "member";
+        const rows = await this.db
+            .selectFrom("connectors as c")
+            .leftJoin("platform_connector_templates as t", "t.id", "c.platform_template_id")
+            .select([
+            "c.id",
+            "c.name",
+            "c.guide_ack",
+            "c.platform_template_id",
+            "t.catalog_item_id",
+            "t.template_id",
+        ])
+            .where("c.org_id", "=", org.orgId)
+            .where("c.deleted_at", "is", null)
+            .orderBy("c.created_at")
+            .orderBy("c.id")
+            .execute();
+        const states = await this.guides.connectorStates(rows.map((r) => ({
+            id: r.id,
+            itemId: r.catalog_item_id ?? null,
+            templateId: r.template_id ?? null,
+            guideAck: r.guide_ack ?? null,
+        })), org);
+        const out = rows.flatMap((r) => {
+            const state = states.get(r.id);
+            return pendingOf(state && (admin ? state : { ...state, guideDrift: null }), audience, {
+                kind: "connector",
+                id: r.id,
+                name: r.name,
+                query: { connectorId: r.id },
+                webPath: admin ? setupWebPath.connector(r.id) : setupWebPath.memberConnections(),
+            });
+        });
+        if (!admin)
+            return out;
+        const made = new Set(rows.flatMap((r) => (r.platform_template_id ? [r.platform_template_id] : [])));
+        const templates = await this.components.orgList(org.orgId, { kind: "connector_template" });
+        for (const t of templates) {
+            if (!t.on || made.has(t.id) || !t.guide || t.itemId === null)
+                continue;
+            out.push({
+                itemId: t.guide.itemId,
+                guideId: t.guide.guideId,
+                audience,
+                query: {},
+                target: {
+                    kind: "connector-template",
+                    id: t.name,
+                    name: t.displayName?.en ?? t.name,
+                    drift: null,
+                    webPath: setupWebPath.template(t.itemId),
+                    checked: false,
+                },
+            });
+        }
+        return out;
+    }
+    /**
+     * One guide rendered for the caller as a Markdown document (`setup.read`): the guide route's
+     * rendering (`PluginGuides.render`, its visibility, action and target rules), joined, with the
+     * page where the person enters values and acks.
+     */
+    async read(caller, itemId, guideId, q) {
+        const g = await this.guides.render({ orgId: caller.orgId, role: caller.role }, itemId, guideId, q);
+        const webPath = webPathOf(g);
+        return {
+            itemId: g.itemId,
+            plugin: g.plugin,
+            guideId: g.id,
+            place: g.place,
+            title: g.title,
+            markdown: guideMarkdown(g.title, g.blocks),
+            modes: g.modes,
+            mode: g.mode,
+            audiences: g.audiences,
+            audience: g.audience,
+            checks: g.checks.map((c) => ({ id: c.id, label: c.label })),
+            unresolved: g.unresolved,
+            target: g.target,
+            webPath,
+            handover: `Secrets (tokens, signing secrets, client secrets) are typed by the person into their fields on ${webPath}; never ask for one in the conversation. Connecting a personal account and confirming the app was updated (the guide acknowledgement) also happen on that page.`,
+        };
+    }
+};
+SetupGuidesService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(PluginGuides)),
+    __param(2, Inject(SetupChecksService)),
+    __param(3, Inject(ComponentScopeService)),
+    __param(4, Inject(KERNEL_LOGGER))
+], SetupGuidesService);
+export { SetupGuidesService };
+/** A pending target from a guide state; none when the target has no guide the org sees. */
+function pendingOf(state, audience, t) {
+    const ref = state?.setupGuide;
+    if (!ref)
+        return [];
+    return [
+        {
+            itemId: ref.itemId,
+            guideId: ref.guideId,
+            audience,
+            query: t.query,
+            target: {
+                kind: t.kind,
+                id: t.id,
+                name: t.name,
+                drift: state.guideDrift,
+                webPath: t.webPath,
+                checked: true,
+            },
+        },
+    ];
+}

package/dist/setup/setup.module.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Setup guide checks (spec 2026-11-09-setup-guides-v2-design.md §10): the registry of kernel and
+ * extension checks, the kernel's own `capybara:*` checks (registered on init) and the service that runs them (cache, single flight, cooldown, the org's
+ * concurrency cap, the time limit, redaction), and the org's guide list (`SetupGuidesService`). Its
+ * controllers are the api role's; the `Platform` tool's `setup` operations use the same services.
+ */
+export declare class SetupModule {
+}

package/dist/setup/setup.module.js

@@ -0,0 +1,31 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { CatalogModule } from "../catalog/catalog.module.js";
+import { ChannelsModule } from "../channels/channels.module.js";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { ToolsModule } from "../tools/tools.module.js";
+import { KernelChecks } from "./kernel-checks.js";
+import { SetupCheckRegistry } from "./setup-check-registry.js";
+import { SetupChecksService } from "./setup-checks.service.js";
+import { SetupGuidesService } from "./setup-guides.service.js";
+/**
+ * Setup guide checks (spec 2026-11-09-setup-guides-v2-design.md §10): the registry of kernel and
+ * extension checks, the kernel's own `capybara:*` checks (registered on init) and the service that runs them (cache, single flight, cooldown, the org's
+ * concurrency cap, the time limit, redaction), and the org's guide list (`SetupGuidesService`). Its
+ * controllers are the api role's; the `Platform` tool's `setup` operations use the same services.
+ */
+let SetupModule = class SetupModule {
+};
+SetupModule = __decorate([
+    Module({
+        imports: [ExtensionsModule, ChannelsModule, ToolsModule, CatalogModule],
+        providers: [SetupCheckRegistry, SetupChecksService, SetupGuidesService, KernelChecks],
+        exports: [SetupCheckRegistry, SetupChecksService, SetupGuidesService],
+    })
+], SetupModule);
+export { SetupModule };

package/dist/themes/render-css.d.ts

@@ -7,6 +7,7 @@ import { type ParsedTheme } from "@capybara-hq/plugin-sdk";
  * the theme's families first, then the built-in stack. Every stored value is re-validated (token
  * names against the overridable list, values against the SDK grammar, radius 0-16, families,
  * paths, weights, styles, roles); one that fails is left out, and `onSkipped` (when given and
- * something was skipped) is called once with the paths of every skipped value.
+ * something was skipped) is called once with the paths of every skipped value. The whole
+ * stylesheet is one `@layer theme { … }` block (client extensions spec §7.2).
  */
 export declare function renderThemeCss(theme: ParsedTheme, assetUrl: (pluginPath: string) => string, onSkipped?: (paths: string[]) => void): string;

package/dist/themes/render-css.js

@@ -73,7 +73,8 @@ const declarations = (d, extra = []) => [...extra, ...[...d].map(([k, v]) => `${
  * the theme's families first, then the built-in stack. Every stored value is re-validated (token
  * names against the overridable list, values against the SDK grammar, radius 0-16, families,
  * paths, weights, styles, roles); one that fails is left out, and `onSkipped` (when given and
- * something was skipped) is called once with the paths of every skipped value.
+ * something was skipped) is called once with the paths of every skipped value. The whole
+ * stylesheet is one `@layer theme { … }` block (client extensions spec §7.2).
  */
 export function renderThemeCss(theme, assetUrl, onSkipped) {
     const skipped = [];
@@ -128,5 +129,7 @@ export function renderThemeCss(theme, assetUrl, onSkipped) {
         rules.push(`:root { ${stacks.join(" ")} }`);
     if (skipped.length > 0)
         onSkipped?.(skipped);
-    return `${rules.join("\n")}\n`;
+    // One block in the `theme` cascade layer (client extensions spec §7.2): the design stylesheet
+    // declares the order design, theme, extensions; an unlayered theme would beat plugin CSS.
+    return `@layer theme {\n${rules.join("\n")}\n}\n`;
 }

package/dist/themes/theme-delivery.service.d.ts

@@ -22,9 +22,11 @@ export declare class ThemeDeliveryService {
     /**
      * The stylesheet of version `version` of theme `id` ({@link renderThemeCss}, asset URLs from
      * {@link themeUrl}); a stored value that fails re-validation is left out with one warning per
-     * render naming every skipped value. Unknown theme or version: 404 `theme.not_found`.
+     * render naming every skipped value. Unknown theme or version, or a `revision` other than the
+     * current `r<THEME_CSS_REVISION>` (an older one promised another format; a later one belongs to a
+     * newer replica): 404 `theme.not_found`, never cached.
      */
-    stylesheet(id: string, version: string): Promise<string>;
+    stylesheet(id: string, version: string, revision: string): Promise<string>;
     /**
      * Asset `file` (a path inside the plugin, as stored: `fonts/MiSans.woff2`) of version `version`
      * of theme `id`: only a font or logo the version's definition names. Unknown theme, version or

package/dist/themes/theme-delivery.service.js

@@ -15,7 +15,7 @@ import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { packagePath } from "../packages/tgz.js";
 import { StorageService } from "../storage/storage.service.js";
 import { renderThemeCss } from "./render-css.js";
-import { themeUrl } from "./theme-state.js";
+import { THEME_CSS_REVISION, themeUrl } from "./theme-state.js";
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /** A version number as it appears in a delivery URL: a positive int4. */
 const VERSION_RE = /^[1-9]\d{0,9}$/;
@@ -61,9 +61,14 @@ let ThemeDeliveryService = class ThemeDeliveryService {
     /**
      * The stylesheet of version `version` of theme `id` ({@link renderThemeCss}, asset URLs from
      * {@link themeUrl}); a stored value that fails re-validation is left out with one warning per
-     * render naming every skipped value. Unknown theme or version: 404 `theme.not_found`.
+     * render naming every skipped value. Unknown theme or version, or a `revision` other than the
+     * current `r<THEME_CSS_REVISION>` (an older one promised another format; a later one belongs to a
+     * newer replica): 404 `theme.not_found`, never cached.
      */
-    async stylesheet(id, version) {
+    async stylesheet(id, version, revision) {
+        if (revision !== `r${THEME_CSS_REVISION}`) {
+            throw notFound(`Theme ${id} version ${version} stylesheet revision ${revision}`);
+        }
         const { definition } = await this.version(id, version);
         return renderThemeCss(definition, (path) => themeUrl(id, version, path), (skipped) => this.log.warn("theme stylesheet: stored values failed re-validation and were left out", {
             themeId: id,