@capybara-hq/kernel 0.1.0-rc.14 → 0.1.0-rc.16

package/dist/admin/admin.schemas.d.ts

@@ -53,19 +53,11 @@ export declare const DeploymentSettingsBody: z.ZodObject<{
     uiTheme: z.ZodOptional<z.ZodObject<{
         id: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>>;
-    uiArrangement: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
-        "agent.detail.section": "agent.detail.section";
-        "conversation.panel": "conversation.panel";
-        "conversation.properties.section": "conversation.properties.section";
-        "conversation.tool-result.card": "conversation.tool-result.card";
-        "file.preview": "file.preview";
-        "org.page": "org.page";
-        "org.settings.section": "org.settings.section";
-        "platform.page": "platform.page";
-    }> & z.core.$partial, z.ZodNullable<z.ZodObject<{
-        hidden: z.ZodArray<z.ZodString>;
-        order: z.ZodArray<z.ZodString>;
-    }, z.core.$strict>>>>;
+    uiArrangement: z.ZodOptional<z.ZodType<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry | null>>, unknown, z.core.$ZodTypeInternals<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry | null>>, unknown>>>;
+    clientExtensions: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        disabled: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const PurposeParams: z.ZodObject<{
     purpose: z.ZodString;

package/dist/catalog/admin-catalog.controller.d.ts

@@ -1,9 +1,13 @@
+import type { SuggestedAppearance } from "@capybara-hq/plugin-sdk";
 import type { FastifyReply } from "fastify";
 import { z } from "zod";
+import { type ClientBuildSummary, ClientBuilds } from "../client/client-builds.service.js";
 import { PluginGuides, type RenderedSetupGuide } from "../extensions/plugin-guides.js";
 import { PluginIcons } from "../extensions/plugin-icons.js";
 import { type Principal } from "../identity/principal.js";
 import { AdminCatalogGuideQuery, CatalogItemsQuery, CatalogUpdateBody, CatalogUpdatePreviewBody, CatalogDisabledBody as DisabledBody, CatalogGitImportBody as GitBody, CatalogNpmImportBody as NpmBody, CatalogScopeBody as ScopeBody, CatalogScopePreviewBody as ScopePreviewBody, CatalogShownBody as ShownBody } from "./admin-catalog.schemas.js";
+import { AppearanceApplyBody } from "./appearance.schemas.js";
+import { type AppearanceResult, AppearanceService } from "./appearance.service.js";
 import { type CatalogItemDetail, type CatalogItemView, CatalogService, type PermissionsMismatch } from "./catalog.service.js";
 import { CatalogScopeService, type ScopePreview } from "./catalog-scope.service.js";
 import { OrgCatalogService } from "./org-catalog.service.js";
@@ -39,8 +43,10 @@ export declare class AdminCatalogController {
     private readonly scope;
     private readonly updater;
     private readonly icons;
+    private readonly appearance;
+    private readonly clientBuilds;
     private readonly guides;
-    constructor(catalog: CatalogService, pluginImport: PluginImport, orgCatalog: OrgCatalogService, scope: CatalogScopeService, updater: PlatformPluginUpdater, icons: PluginIcons, guides: PluginGuides);
+    constructor(catalog: CatalogService, pluginImport: PluginImport, orgCatalog: OrgCatalogService, scope: CatalogScopeService, updater: PlatformPluginUpdater, icons: PluginIcons, appearance: AppearanceService, clientBuilds: ClientBuilds, guides: PluginGuides);
     /**
      * Prepares the import of an uploaded plugin (an npm-pack tgz as the raw body,
      * `application/octet-stream`, at most `packages.maxBytes`): reads and checks the whole plugin
@@ -115,12 +121,29 @@ export declare class AdminCatalogController {
         nextOffset: number | null;
     }>;
     /**
-     * 条目详情与各版本，另给出 `hasIcon`（最新版本有图标，`GET items/:id/icon` 可取）；不存在 → 404
-     * `catalog.item_not_found`。
+     * The item with its versions, plus `hasIcon` (the latest version has an icon, served by `GET
+     * items/:id/icon`) and `suggestedAppearance` (the platform version's, null without one: the page
+     * offers 应用此插件的外观 when set). Each version carries `client`: its extension package's
+     * client build (files with sizes, total, client API version; null without one), what the
+     * permission confirmation of an org's upload shows in its 客户端代码 group (client extensions spec
+     * §5.4). Unknown -> 404 `catalog.item_not_found`.
      */
-    get(id: string): Promise<CatalogItemDetail & {
+    get(id: string): Promise<Omit<CatalogItemDetail, "versions"> & {
+        versions: (CatalogItemDetail["versions"][number] & {
+            client: ClientBuildSummary | null;
+        })[];
         hasIcon: boolean;
+        suggestedAppearance: SuggestedAppearance | null;
     }>;
+    /**
+     * 应用此插件的外观 (client extensions spec §6.5): sets the plugin's suggested theme as the platform
+     * default theme and each suggested replacement as the platform arrangement's `use` of its slot, in
+     * one transaction. `dryRun: true` answers the same changes and writes nothing. A theme that cannot
+     * be the platform default -> 400 `theme.not_available` (nothing written); a replacement not
+     * available on the platform is skipped. No such item, or no suggestion -> 404
+     * `catalog.item_not_found`.
+     */
+    applyAppearance(principal: Principal, id: string, body: z.infer<typeof AppearanceApplyBody>): Promise<AppearanceResult>;
     /**
      * The item's icon (disabled items included; same response headers as the org side, see
      * `sendCatalogIcon`). No icon -> 404 `catalog.icon_not_found`.

package/dist/catalog/admin-catalog.controller.js

@@ -9,6 +9,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { Controller, Delete, Get, HttpCode, Inject, Param, Post, Put, Req, Res, } from "@nestjs/common";
 import { z } from "zod";
+import { ClientBuilds } from "../client/client-builds.service.js";
 import { ApiError } from "../errors.js";
 import { PluginGuides } from "../extensions/plugin-guides.js";
 import { PluginIcons } from "../extensions/plugin-icons.js";
@@ -16,6 +17,8 @@ import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../ident
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZQuery } from "../infra/validation/zod-params.js";
 import { AdminCatalogGuideQuery, CatalogItemsQuery, CatalogUpdateBody, CatalogUpdatePreviewBody, CatalogDisabledBody as DisabledBody, CatalogGitImportBody as GitBody, CatalogHash as Hash, CatalogNpmImportBody as NpmBody, CatalogScopeOrgs as Orgs, CatalogScope as Scope, CatalogScopeBody as ScopeBody, CatalogScopePreviewBody as ScopePreviewBody, CatalogShownBody as ShownBody, } from "./admin-catalog.schemas.js";
+import { AppearanceApplyBody } from "./appearance.schemas.js";
+import { AppearanceService, suggestedAppearanceOf, } from "./appearance.service.js";
 import { CatalogService, } from "./catalog.service.js";
 import { CatalogScopeService } from "./catalog-scope.service.js";
 import { sendCatalogIcon } from "./org-catalog.controller.js";
@@ -65,6 +68,8 @@ class CatalogUpdatePreviewBodyDto extends createZodDto(CatalogUpdatePreviewBody,
 }
 class CatalogUpdateBodyDto extends createZodDto(CatalogUpdateBody, "CatalogUpdateBody") {
 }
+class AppearanceApplyBodyDto extends createZodDto(AppearanceApplyBody, "AppearanceApplyBody") {
+}
 /**
  * The platform catalog (`/api/v1/admin/catalog/*`, super admins): plugin import (upload / npm
  * prepare, then confirm, which installs the plugin's extension), the item list and detail, scope and
@@ -78,14 +83,18 @@ let AdminCatalogController = class AdminCatalogController {
     scope;
     updater;
     icons;
+    appearance;
+    clientBuilds;
     guides;
-    constructor(catalog, pluginImport, orgCatalog, scope, updater, icons, guides) {
+    constructor(catalog, pluginImport, orgCatalog, scope, updater, icons, appearance, clientBuilds, guides) {
         this.catalog = catalog;
         this.pluginImport = pluginImport;
         this.orgCatalog = orgCatalog;
         this.scope = scope;
         this.updater = updater;
         this.icons = icons;
+        this.appearance = appearance;
+        this.clientBuilds = clientBuilds;
         this.guides = guides;
     }
     /**
@@ -180,12 +189,42 @@ let AdminCatalogController = class AdminCatalogController {
         return { ...page, items: page.items.map((i) => ({ ...i, icon: icons.get(i.id) ?? null })) };
     }
     /**
-     * 条目详情与各版本，另给出 `hasIcon`（最新版本有图标，`GET items/:id/icon` 可取）；不存在 → 404
-     * `catalog.item_not_found`。
+     * The item with its versions, plus `hasIcon` (the latest version has an icon, served by `GET
+     * items/:id/icon`) and `suggestedAppearance` (the platform version's, null without one: the page
+     * offers 应用此插件的外观 when set). Each version carries `client`: its extension package's
+     * client build (files with sizes, total, client API version; null without one), what the
+     * permission confirmation of an org's upload shows in its 客户端代码 group (client extensions spec
+     * §5.4). Unknown -> 404 `catalog.item_not_found`.
      */
     async get(id) {
         const detail = await this.catalog.get(id);
-        return { ...detail, hasIcon: await this.orgCatalog.hasIcon(id) };
+        const platform = detail.versions.find((v) => v.version === detail.item.platformVersion);
+        const [hasIcon, builds] = await Promise.all([
+            this.orgCatalog.hasIcon(id),
+            this.clientBuilds.summaries(detail.versions.flatMap((v) => (v.extensionSha256 === null ? [] : [v.extensionSha256]))),
+        ]);
+        return {
+            ...detail,
+            versions: detail.versions.map((v) => ({
+                ...v,
+                client: v.extensionSha256 === null ? null : (builds.get(v.extensionSha256) ?? null),
+            })),
+            hasIcon,
+            suggestedAppearance: suggestedAppearanceOf(platform?.manifest),
+        };
+    }
+    /**
+     * 应用此插件的外观 (client extensions spec §6.5): sets the plugin's suggested theme as the platform
+     * default theme and each suggested replacement as the platform arrangement's `use` of its slot, in
+     * one transaction. `dryRun: true` answers the same changes and writes nothing. A theme that cannot
+     * be the platform default -> 400 `theme.not_available` (nothing written); a replacement not
+     * available on the platform is skipped. No such item, or no suggestion -> 404
+     * `catalog.item_not_found`.
+     */
+    applyAppearance(principal, id, body) {
+        const actor = requireUser(principal);
+        const tokenId = patTokenId(actor);
+        return this.appearance.apply({ platform: true }, id, { accountId: actor.account.id, ...(tokenId !== undefined && { tokenId }) }, body.dryRun === true);
     }
     /**
      * The item's icon (disabled items included; same response headers as the org side, see
@@ -340,6 +379,13 @@ __decorate([
     Get("items/:id"),
     __param(0, Param("id"))
 ], AdminCatalogController.prototype, "get", null);
+__decorate([
+    Post("items/:id/appearance"),
+    HttpCode(200),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("id")),
+    __param(2, ZBody(AppearanceApplyBodyDto))
+], AdminCatalogController.prototype, "applyAppearance", null);
 __decorate([
     Get("items/:id/icon"),
     __param(0, Param("id")),
@@ -416,6 +462,8 @@ AdminCatalogController = __decorate([
     __param(3, Inject(CatalogScopeService)),
     __param(4, Inject(PlatformPluginUpdater)),
     __param(5, Inject(PluginIcons)),
-    __param(6, Inject(PluginGuides))
+    __param(6, Inject(AppearanceService)),
+    __param(7, Inject(ClientBuilds)),
+    __param(8, Inject(PluginGuides))
 ], AdminCatalogController);
 export { AdminCatalogController };

package/dist/catalog/appearance.schemas.d.ts

@@ -0,0 +1,10 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/**
+ * The body of both "apply this plugin's appearance" routes (client extensions spec §6.5):
+ * `dryRun: true` answers what would change and writes nothing (the confirm dialog's preview).
+ */
+export declare const AppearanceApplyBody: z.ZodObject<{
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const APPEARANCE_ROUTES: readonly RouteSchemas[];

package/dist/catalog/appearance.schemas.js

@@ -0,0 +1,20 @@
+import { z } from "zod";
+import { CatalogIdPathParams } from "./admin-catalog.schemas.js";
+import { OrgExtensionParams } from "./org-extension.schemas.js";
+/**
+ * The body of both "apply this plugin's appearance" routes (client extensions spec §6.5):
+ * `dryRun: true` answers what would change and writes nothing (the confirm dialog's preview).
+ */
+export const AppearanceApplyBody = z.object({ dryRun: z.boolean().optional() }).strict();
+export const APPEARANCE_ROUTES = [
+    {
+        route: "POST /api/v1/admin/catalog/items/:id/appearance",
+        params: CatalogIdPathParams,
+        body: AppearanceApplyBody,
+    },
+    {
+        route: "POST /api/v1/orgs/:orgId/extensions/:extension/appearance",
+        params: OrgExtensionParams,
+        body: AppearanceApplyBody,
+    },
+];

package/dist/catalog/appearance.service.d.ts

@@ -0,0 +1,105 @@
+import { type SuggestedAppearance } from "@capybara-hq/plugin-sdk";
+import { ExtensionHost } from "../extensions/host.js";
+import { SettingsService } from "../identity/settings.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OrgLock } from "../orgs/org-lock.js";
+import { OrgSettingsService } from "../orgs/settings.service.js";
+/** Where the suggestion is applied: the platform defaults, or one org's. */
+export type AppearanceLevel = {
+    platform: true;
+} | {
+    orgId: string;
+};
+/** Why a replacement of the suggestion was left out (client extensions spec §6.5). */
+export type AppearanceSkipReason = "unknown-slot" | "not-available" | "not-eligible";
+/**
+ * What applying a suggestion changes at its level: the default theme (`from`: the theme in effect,
+ * null for none; `to`: the `platform_themes` id; null when the plugin suggests no theme or it is
+ * in effect already), each replacement slot's `use` (`to`: the contribution key
+ * `<extension>/<contribution>`; `from`: the key in effect, null for the built-in; a slot that
+ * already uses it is not listed) and what was skipped, in plugin.json order. At org level `from`
+ * is the org's own entry, else the platform's: `followsPlatform` says which (absent at platform
+ * level), and when the org follows a platform that already uses the suggestion nothing is pinned.
+ */
+export interface AppearanceResult {
+    theme: {
+        from: string | null;
+        to: string;
+        followsPlatform?: boolean;
+    } | null;
+    replacements: {
+        slot: string;
+        from: string | null;
+        to: string;
+        followsPlatform?: boolean;
+    }[];
+    skipped: {
+        what: string;
+        reason: AppearanceSkipReason;
+    }[];
+}
+/** Who applies it: the account, the PAT when one made the call, and extra audit detail. */
+export interface AppearanceActor {
+    accountId: string;
+    tokenId?: string;
+    /** Merged into the settings writer's audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail?: Record<string, unknown>;
+}
+/** The suggestion of a plugin's catalog version, or null (none, or not an object). */
+export declare function suggestedAppearanceOf(manifest: unknown): SuggestedAppearance | null;
+/**
+ * "Apply this plugin's appearance" (client extensions spec §6.5): one step that sets the plugin's
+ * suggested theme as the level's default theme and each suggested replacement as the level's `use`
+ * of its single slot. The writes go through the settings writers (`SettingsService.update` for the
+ * platform, `OrgSettingsService.update` for an org), so their validation, theme checks, lock order
+ * (the level's lock, then catalog item, theme row, `uiTheme` row) and audit apply, both settings in
+ * one call and one transaction: a theme that cannot be set (`theme.not_available`) refuses the
+ * whole call; a replacement that cannot be used where it is set is skipped, never refused (the
+ * arrangement keeps unknown keys anyway). A dry run computes the same answer and writes nothing.
+ */
+export declare class AppearanceService {
+    private readonly db;
+    readonly txHost: TransactionHost;
+    private readonly settings;
+    private readonly orgSettings;
+    private readonly adminLock;
+    private readonly orgLock;
+    private readonly host;
+    constructor(db: KernelDb, txHost: TransactionHost, settings: SettingsService, orgSettings: OrgSettingsService, adminLock: SuperAdminLock, orgLock: OrgLock, host: ExtensionHost);
+    /**
+     * The suggestions of the live plugins named `names`, from the version their components come from
+     * (`platform_synced_version`, else the latest); a plugin without one maps to null.
+     */
+    suggestions(names: readonly string[]): Promise<Map<string, SuggestedAppearance | null>>;
+    /** The live catalog item `itemId` with its suggestion; else `catalog.item_not_found`. */
+    private platformItem;
+    /**
+     * The live plugin of extension `extension`, which must be on in the org, with its suggestion;
+     * else `extension.not_found`.
+     */
+    private orgItem;
+    /**
+     * Applies (or, with `dryRun`, previews) the suggestion of `item` at `level`: for the platform,
+     * `item` is the catalog item id (`POST /api/v1/admin/catalog/items/:id/appearance`, super
+     * admin); for an org, the extension name (`POST /api/v1/orgs/:orgId/extensions/:extension/
+     * appearance`, `org.update`). The writers re-check the actor under their lock.
+     */
+    apply(level: AppearanceLevel, item: string, actor: AppearanceActor, dryRun: boolean): Promise<AppearanceResult>;
+    /** Refuses (`theme.not_available`) a theme the level's writer would refuse; reads only. */
+    private assertThemeSettable;
+    private applyPlatform;
+    private applyOrg;
+    /**
+     * What applying `found` at `level` changes, from the stored settings (no writes): the level's
+     * own, and at org level the platform's it follows where it stores nothing.
+     */
+    private plan;
+}
+/**
+ * The suggested appearance action: its own module, since it writes through the org settings
+ * writer (`OrgsModule`, which imports `CatalogModule`) and the deployment settings writer.
+ */
+export declare class AppearanceModule {
+}

package/dist/catalog/appearance.service.js

@@ -0,0 +1,306 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { parseSlotRef, UI_ARRANGEABLE_SLOTS, uiSlot, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable, Module } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { ExtensionHost } from "../extensions/host.js";
+import { IdentityModule } from "../identity/identity.module.js";
+import { readUiArrangement, readUiTheme, SettingsService } from "../identity/settings.js";
+import { SuperAdminLock, SuperAdminLockModule } from "../identity/super-admin.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OrgLock, OrgLockModule } from "../orgs/org-lock.js";
+import { OrgsModule } from "../orgs/orgs.module.js";
+import { OrgSettingsService, readOrgSettings } from "../orgs/settings.service.js";
+import { assertPlatformDefaultEligible, eligiblePlatformDefault, themeNotAvailable, themeOnIn, } from "../themes/theme-state.js";
+import { ORG_ARRANGEABLE } from "../ui/arrangement.js";
+import { inAuthorOrder } from "./catalog-items.js";
+/** The suggestion of a plugin's catalog version, or null (none, or not an object). */
+export function suggestedAppearanceOf(manifest) {
+    const sa = manifest?.suggestedAppearance;
+    return sa !== null && typeof sa === "object" ? sa : null;
+}
+const itemNotFound = () => new ApiError("catalog.item_not_found", "No such plugin, or it suggests no appearance");
+const extensionNotFound = () => new ApiError("extension.not_found", "No such extension on in this organization, or its plugin suggests no appearance");
+const useOf = (e) => e !== undefined && "use" in e ? e.use : null;
+/**
+ * "Apply this plugin's appearance" (client extensions spec §6.5): one step that sets the plugin's
+ * suggested theme as the level's default theme and each suggested replacement as the level's `use`
+ * of its single slot. The writes go through the settings writers (`SettingsService.update` for the
+ * platform, `OrgSettingsService.update` for an org), so their validation, theme checks, lock order
+ * (the level's lock, then catalog item, theme row, `uiTheme` row) and audit apply, both settings in
+ * one call and one transaction: a theme that cannot be set (`theme.not_available`) refuses the
+ * whole call; a replacement that cannot be used where it is set is skipped, never refused (the
+ * arrangement keeps unknown keys anyway). A dry run computes the same answer and writes nothing.
+ */
+let AppearanceService = class AppearanceService {
+    db;
+    txHost;
+    settings;
+    orgSettings;
+    adminLock;
+    orgLock;
+    host;
+    constructor(db, txHost, settings, orgSettings, adminLock, orgLock, host) {
+        this.db = db;
+        this.txHost = txHost;
+        this.settings = settings;
+        this.orgSettings = orgSettings;
+        this.adminLock = adminLock;
+        this.orgLock = orgLock;
+        this.host = host;
+    }
+    /**
+     * The suggestions of the live plugins named `names`, from the version their components come from
+     * (`platform_synced_version`, else the latest); a plugin without one maps to null.
+     */
+    async suggestions(names) {
+        const out = new Map(names.map((n) => [n, null]));
+        if (names.length === 0)
+            return out;
+        const rows = await this.db
+            .selectFrom("catalog_items as i")
+            .innerJoin("catalog_item_versions as v", (j) => j
+            .onRef("v.item_id", "=", "i.id")
+            .on((eb) => eb("v.version", "=", eb.fn.coalesce("i.platform_synced_version", "i.latest_version"))))
+            .select(["i.name", "v.manifest", "v.appearance_order"])
+            .where("i.name", "in", [...names])
+            .where("i.deleted_at", "is", null)
+            .execute();
+        for (const r of rows) {
+            out.set(r.name, suggestedAppearanceOf(inAuthorOrder(r.manifest, r.appearance_order)));
+        }
+        return out;
+    }
+    /** The live catalog item `itemId` with its suggestion; else `catalog.item_not_found`. */
+    async platformItem(itemId) {
+        if (!/^[0-9a-f-]{36}$/i.test(itemId))
+            throw itemNotFound();
+        const row = await this.db
+            .selectFrom("catalog_items")
+            .select(["id", "name"])
+            .where("id", "=", itemId)
+            .where("deleted_at", "is", null)
+            .executeTakeFirst();
+        const suggestion = row && (await this.suggestions([row.name])).get(row.name);
+        if (!row || !suggestion)
+            throw itemNotFound();
+        return { id: row.id, name: row.name, suggestion };
+    }
+    /**
+     * The live plugin of extension `extension`, which must be on in the org, with its suggestion;
+     * else `extension.not_found`.
+     */
+    async orgItem(orgId, extension) {
+        if (!(await this.host.enabledPlugins(orgId)).has(extension))
+            throw extensionNotFound();
+        const row = await this.db
+            .selectFrom("catalog_items")
+            .select(["id", "name"])
+            .where("name", "=", extension)
+            .where("deleted_at", "is", null)
+            .executeTakeFirst();
+        const suggestion = row && (await this.suggestions([row.name])).get(row.name);
+        if (!row || !suggestion)
+            throw extensionNotFound();
+        return { id: row.id, name: row.name, suggestion };
+    }
+    /**
+     * Applies (or, with `dryRun`, previews) the suggestion of `item` at `level`: for the platform,
+     * `item` is the catalog item id (`POST /api/v1/admin/catalog/items/:id/appearance`, super
+     * admin); for an org, the extension name (`POST /api/v1/orgs/:orgId/extensions/:extension/
+     * appearance`, `org.update`). The writers re-check the actor under their lock.
+     */
+    async apply(level, item, actor, dryRun) {
+        if (dryRun) {
+            const found = "orgId" in level ? await this.orgItem(level.orgId, item) : await this.platformItem(item);
+            const plan = await this.plan(level, found);
+            if (plan.theme !== undefined)
+                await this.assertThemeSettable(level, plan.theme);
+            return plan.result;
+        }
+        return "orgId" in level
+            ? this.applyOrg(level.orgId, item, actor)
+            : this.applyPlatform(item, actor);
+    }
+    /** Refuses (`theme.not_available`) a theme the level's writer would refuse; reads only. */
+    async assertThemeSettable(level, themeId) {
+        if ("orgId" in level) {
+            if (!(await themeOnIn(this.db.db, level.orgId, themeId))) {
+                throw themeNotAvailable(themeId, "in this organization");
+            }
+        }
+        else {
+            await assertPlatformDefaultEligible(this.db.db, themeId);
+        }
+    }
+    async applyPlatform(itemId, actor) {
+        // The writer's own lock first, so what the plan reads (the stored theme and arrangement) is
+        // what the write replaces; the writer takes it again (re-entrant) and then the theme rows
+        await this.adminLock.lockAndAuthorize(actor.accountId);
+        const found = await this.platformItem(itemId);
+        const plan = await this.plan({ platform: true }, found);
+        if (plan.theme === undefined && Object.keys(plan.arrangement).length === 0)
+            return plan.result;
+        await this.settings.update({
+            ...(plan.theme !== undefined && { uiTheme: { id: plan.theme } }),
+            ...(Object.keys(plan.arrangement).length > 0 && { uiArrangement: plan.arrangement }),
+        }, actor.accountId, actor.tokenId, { ...actor.auditDetail, appearance: { itemId: found.id, plugin: found.name } });
+        return plan.result;
+    }
+    async applyOrg(orgId, extension, actor) {
+        // The org lock first (as the writer takes it): `personal` and the stored arrangement are read
+        // under it, so the write keeps the lock setting it read
+        await this.orgLock.lockAndAuthorize(orgId, actor.accountId, "org.update");
+        const found = await this.orgItem(orgId, extension);
+        const plan = await this.plan({ orgId }, found);
+        if (plan.theme === undefined && Object.keys(plan.arrangement).length === 0)
+            return plan.result;
+        const stored = await readOrgSettings(this.db.db, orgId);
+        await this.orgSettings.update(orgId, {
+            ...(plan.theme !== undefined && {
+                theme: { id: plan.theme, personal: stored.theme?.personal ?? "allowed" },
+            }),
+            ...(Object.keys(plan.arrangement).length > 0 && { uiArrangement: plan.arrangement }),
+        }, actor.accountId, actor.tokenId, { ...actor.auditDetail, appearance: { itemId: found.id, plugin: found.name } });
+        return plan.result;
+    }
+    /**
+     * What applying `found` at `level` changes, from the stored settings (no writes): the level's
+     * own, and at org level the platform's it follows where it stores nothing.
+     */
+    async plan(level, found) {
+        const { suggestion } = found;
+        const [platformTheme, platformArrangement] = await Promise.all([
+            readUiTheme(this.db.db).then((t) => t.id),
+            readUiArrangement(this.db.db),
+        ]);
+        const org = "orgId" in level ? await readOrgSettings(this.db.db, level.orgId) : null;
+        // the theme in effect: an org without its own theme (id null) follows the platform default,
+        // which renders only while it is eligible (else the org sees the built-in, as ThemesService
+        // resolves it)
+        const orgTheme = org === null ? undefined : (org.theme?.id ?? null);
+        const themeFollows = orgTheme === null;
+        const followed = themeFollows && platformTheme !== null
+            ? (await eligiblePlatformDefault(this.db.db, platformTheme)) !== null
+                ? platformTheme
+                : null
+            : platformTheme;
+        const themeInEffect = orgTheme ?? followed;
+        /** The `use` in effect for a single slot, and whether an org follows the platform's. */
+        const inEffect = (slot) => {
+            if (org === null)
+                return { use: useOf(platformArrangement[slot]) };
+            const own = org.uiArrangement?.[slot];
+            return own !== undefined
+                ? { use: useOf(own), follows: false }
+                : { use: useOf(platformArrangement[slot]), follows: true };
+        };
+        const follows = (f) => (f === undefined ? {} : { followsPlatform: f });
+        const result = { theme: null, replacements: [], skipped: [] };
+        const plan = { result, arrangement: {} };
+        if (suggestion.theme !== undefined) {
+            const row = await this.db
+                .selectFrom("platform_themes")
+                .select("id")
+                .where("catalog_item_id", "=", found.id)
+                .where("name", "=", suggestion.theme)
+                .where("deleted_at", "is", null)
+                .executeTakeFirst();
+            if (!row) {
+                throw themeNotAvailable(suggestion.theme, "orgId" in level ? "in this organization" : "as the platform default");
+            }
+            if (row.id !== themeInEffect) {
+                plan.theme = row.id;
+                result.theme = {
+                    from: themeInEffect,
+                    to: row.id,
+                    ...follows(org === null ? undefined : themeFollows),
+                };
+            }
+        }
+        // in plugin.json order (`suggestions` restores it from `appearance_order`)
+        const entries = Object.entries(suggestion.replacements ?? {});
+        if (entries.length === 0)
+            return plan;
+        const enabled = "orgId" in level ? await this.host.enabledPlugins(level.orgId) : null;
+        const loaded = this.host
+            .uiContributions()
+            .filter((c) => c.plugin === found.name &&
+            c.contribution.aliasOf === undefined &&
+            (enabled === null || enabled.has(c.plugin)));
+        const arrangeable = "orgId" in level ? ORG_ARRANGEABLE : UI_ARRANGEABLE_SLOTS;
+        const planned = new Set();
+        for (const [ref, id] of entries) {
+            const parsed = parseSlotRef(ref);
+            const known = parsed === null ? undefined : uiSlot(parsed.id);
+            if (parsed === null || known === undefined || parsed.version > known.version) {
+                result.skipped.push({ what: ref, reason: "unknown-slot" });
+                continue;
+            }
+            const slot = known.id;
+            // a second ref to one slot (`shell.brand` and `shell.brand@1`; the SDK refuses it at parse)
+            if (known.cardinality !== "single" || !arrangeable.includes(slot) || planned.has(slot)) {
+                result.skipped.push({ what: ref, reason: "not-eligible" });
+                continue;
+            }
+            const c = loaded.find((l) => l.slot.id === slot && l.contribution.id === id);
+            if (c === undefined) {
+                result.skipped.push({ what: ref, reason: "not-available" });
+                continue;
+            }
+            if (c.contribution.kind !== "component") {
+                result.skipped.push({ what: ref, reason: "not-eligible" });
+                continue;
+            }
+            planned.add(slot);
+            const key = `${found.name}/${id}`;
+            const now = inEffect(slot);
+            if (now.use === key)
+                continue;
+            plan.arrangement[slot] = { use: key };
+            result.replacements.push({ slot, from: now.use, to: key, ...follows(now.follows) });
+        }
+        return plan;
+    }
+};
+__decorate([
+    Transactional()
+], AppearanceService.prototype, "applyPlatform", null);
+__decorate([
+    Transactional()
+], AppearanceService.prototype, "applyOrg", null);
+AppearanceService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(SettingsService)),
+    __param(3, Inject(OrgSettingsService)),
+    __param(4, Inject(SuperAdminLock)),
+    __param(5, Inject(OrgLock)),
+    __param(6, Inject(ExtensionHost))
+], AppearanceService);
+export { AppearanceService };
+/**
+ * The suggested appearance action: its own module, since it writes through the org settings
+ * writer (`OrgsModule`, which imports `CatalogModule`) and the deployment settings writer.
+ */
+let AppearanceModule = class AppearanceModule {
+};
+AppearanceModule = __decorate([
+    Module({
+        imports: [IdentityModule, OrgsModule, SuperAdminLockModule, OrgLockModule, ExtensionsModule],
+        providers: [AppearanceService],
+        exports: [AppearanceService],
+    })
+], AppearanceModule);
+export { AppearanceModule };