@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.20

package/dist/extensions/plugin-icons.js

@@ -0,0 +1,125 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { requestable } from "../catalog/scope.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { roleAtLeast } from "../orgs/roles.js";
+import { packagePath } from "../packages/tgz.js";
+/** The icon scope of an org route's caller (its org and role). */
+export const orgIconScope = (org) => ({
+    kind: "org",
+    orgId: org.orgId,
+    isAdmin: roleAtLeast(org.role, "admin"),
+});
+const enc = encodeURIComponent;
+/**
+ * The rows of live catalog items the org's catalog shows (one query for the org's list rows):
+ * members never see disabled items, an upload waiting for confirmation only its owner, another
+ * org's item only when shareable or listed here (the share gate), a `named` item only its listed
+ * orgs or as requestable. Shared by the plugin icons and the setup guides.
+ */
+export async function orgVisibleItems(db, rows, orgId, isAdmin) {
+    if (rows.length === 0)
+        return [];
+    const listed = new Set((await db
+        .selectFrom("catalog_item_scope_orgs")
+        .select("item_id")
+        .where("org_id", "=", orgId)
+        .where("item_id", "in", rows.map((r) => r.id))
+        .execute()).map((r) => r.item_id));
+    return rows.filter((r) => {
+        const inList = listed.has(r.id);
+        const own = r.owner_org_id === orgId;
+        return ((isAdmin || !r.disabled) &&
+            (!r.awaiting_confirmation || own) &&
+            // the share gate: another org's item reaches this org only when shareable or listed here
+            (r.owner_org_id === null || own || r.shareable || inList) &&
+            (r.builtin || r.scope !== "named" || inList || requestable(r, inList)));
+    });
+}
+/**
+ * Plugin icons for the things a plugin brings (channels, extensions, model providers; maintainer
+ * decision 2026-11-08): extension name -> the URL of its plugin's icon, the catalog item of the
+ * same name (one live item per name). A name is present only when the item's latest version has
+ * an icon and the reader may load it: the admin scope gets `GET /api/v1/admin/catalog/items/:id/icon`
+ * for every live item; an org gets `GET /api/v1/orgs/:orgId/catalog/:itemId/icon` only for items
+ * its catalog shows (members never see disabled items, a `named` item only for its listed orgs or
+ * as requestable, an org-owned item only for its owner or through the share gate, an upload
+ * waiting for confirmation only for its owner). The URL carries the version, so a new icon is not
+ * hidden by the browser cache. Stateless; one query per call (two for an org: its list rows).
+ */
+let PluginIcons = class PluginIcons {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** Extension (plugin) name -> its icon's URL; names without one are absent. */
+    async many(names, scope) {
+        const icons = await this.resolve("name", names, scope);
+        return new Map(icons.map((i) => [i.name, i.url]));
+    }
+    /** Catalog item id -> its icon's URL (a list of items); items without one are absent. */
+    async ofItems(ids, scope) {
+        const icons = await this.resolve("id", ids, scope);
+        return new Map(icons.map((i) => [i.id, i.url]));
+    }
+    async resolve(by, keys, scope) {
+        const out = [];
+        const unique = [...new Set(keys)];
+        if (unique.length === 0)
+            return out;
+        const rows = await this.db
+            .selectFrom("catalog_items as i")
+            .innerJoin("catalog_item_versions as v", (j) => j.onRef("v.item_id", "=", "i.id").onRef("v.version", "=", "i.latest_version"))
+            .select([
+            "i.id",
+            "i.name",
+            "i.scope",
+            "i.builtin",
+            "i.disabled",
+            "i.shown_to_others",
+            "i.owner_org_id",
+            "i.shareable",
+            "i.awaiting_confirmation",
+            "i.latest_version",
+            sql `v.manifest->>'icon'`.as("icon"),
+            "v.files",
+        ])
+            .where(by === "name" ? "i.name" : "i.id", "in", unique)
+            .where("i.deleted_at", "is", null)
+            .execute();
+        const withIcon = rows.filter((r) => {
+            if (r.icon === null)
+                return false;
+            const path = packagePath(r.icon);
+            return r.files.some((f) => f.path === path);
+        });
+        if (withIcon.length === 0)
+            return out;
+        if (scope.kind === "admin") {
+            for (const r of withIcon) {
+                const url = `/api/v1/admin/catalog/items/${enc(r.id)}/icon?v=${enc(r.latest_version)}`;
+                out.push({ id: r.id, name: r.name, url });
+            }
+            return out;
+        }
+        for (const r of await orgVisibleItems(this.db, withIcon, scope.orgId, scope.isAdmin)) {
+            const url = `/api/v1/orgs/${enc(scope.orgId)}/catalog/${enc(r.id)}/icon?v=${enc(r.latest_version)}`;
+            out.push({ id: r.id, name: r.name, url });
+        }
+        return out;
+    }
+};
+PluginIcons = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb))
+], PluginIcons);
+export { PluginIcons };

package/dist/extensions/plugin-items.d.ts

@@ -0,0 +1,21 @@
+import type { PluginScope } from "../catalog/scope.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+/** The catalog item (the plugin) an extension ships in. */
+export interface ExtensionPluginItem {
+    id: string;
+    scope: PluginScope;
+    builtin: boolean;
+    disabled: boolean;
+}
+/**
+ * The live catalog items of each extension in `names`, the one recorded on its install
+ * (`extension_installs.catalog_item_id`) first, then its other `extension_catalog_sources` by id.
+ * An extension without a live item (declared in the startup config, or its items deleted) is absent.
+ * `db` may be a transaction.
+ */
+export declare function pluginItemsOf(db: KernelSchemaDb, names: readonly string[]): Promise<Map<string, ExtensionPluginItem[]>>;
+/**
+ * Whether an item keeps its plugin on in every org (builtin only: an org may switch off an `all`
+ * one, layering spec §4): its switch cannot go off.
+ */
+export declare const itemLocked: (i: ExtensionPluginItem) => boolean;

package/dist/extensions/plugin-items.js

@@ -0,0 +1,42 @@
+/**
+ * The live catalog items of each extension in `names`, the one recorded on its install
+ * (`extension_installs.catalog_item_id`) first, then its other `extension_catalog_sources` by id.
+ * An extension without a live item (declared in the startup config, or its items deleted) is absent.
+ * `db` may be a transaction.
+ */
+export async function pluginItemsOf(db, names) {
+    const out = new Map();
+    if (names.length === 0)
+        return out;
+    const add = (plugin, item) => {
+        const list = out.get(plugin) ?? [];
+        if (!list.some((i) => i.id === item.id))
+            list.push(item);
+        out.set(plugin, list);
+    };
+    const own = await db
+        .selectFrom("extension_installs as e")
+        .innerJoin("catalog_items as i", "i.id", "e.catalog_item_id")
+        .select(["e.name as plugin", "i.id", "i.scope", "i.builtin", "i.disabled"])
+        .where("e.name", "in", [...names])
+        .where("i.deleted_at", "is", null)
+        .execute();
+    for (const r of own)
+        add(r.plugin, r);
+    const sources = await db
+        .selectFrom("extension_catalog_sources as s")
+        .innerJoin("catalog_items as i", "i.id", "s.item_id")
+        .select(["s.plugin", "i.id", "i.scope", "i.builtin", "i.disabled"])
+        .where("s.plugin", "in", [...names])
+        .where("i.deleted_at", "is", null)
+        .orderBy("i.id")
+        .execute();
+    for (const r of sources)
+        add(r.plugin, r);
+    return out;
+}
+/**
+ * Whether an item keeps its plugin on in every org (builtin only: an org may switch off an `all`
+ * one, layering spec §4): its switch cannot go off.
+ */
+export const itemLocked = (i) => i.builtin;

package/dist/extensions/point-defaults.controller.d.ts

@@ -0,0 +1,28 @@
+import type { z } from "zod";
+import { type Principal } from "../identity/principal.js";
+import { type OrgContext } from "../orgs/org.guard.js";
+import { ExtensionPointDefaults, type OrgPointDefaultView } from "./point-defaults.js";
+import { ExtensionPointDefaultBody as DefaultBody, ExtensionPointParams as PointParams } from "./point-defaults.schemas.js";
+/**
+ * The org default provider of `org-default` extension points (web tools spec §6):
+ * - `GET /api/v1/orgs/:orgId/extension-points` (`org.extensions.manage`) → `{ points }`: each
+ *   point with its candidate providers, the stored default and the effective provider;
+ * - `PUT /api/v1/orgs/:orgId/extension-points/:point/default` `{ extension }`
+ *   (`org.extensions.manage`) → 204;
+ * - `GET /api/v1/orgs/:orgId/extension-points/available` (`agents.use`) → `{ points }`: whether
+ *   each point has a provider now, without extension names (for the agent form).
+ */
+export declare class ExtensionPointDefaultsController {
+    private readonly points;
+    constructor(points: ExtensionPointDefaults);
+    list(org: OrgContext): Promise<{
+        points: OrgPointDefaultView[];
+    }>;
+    available(org: OrgContext): Promise<{
+        points: {
+            point: string;
+            available: boolean;
+        }[];
+    }>;
+    setDefault(principal: Principal, org: OrgContext, { point }: z.infer<typeof PointParams>, body: z.infer<typeof DefaultBody>): Promise<void>;
+}

package/dist/extensions/point-defaults.controller.js

@@ -0,0 +1,69 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Get, HttpCode, Inject, Put } from "@nestjs/common";
+import { CurrentPrincipal, requireUser } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { ExtensionPointDefaults } from "./point-defaults.js";
+import { ExtensionPointDefaultBody as DefaultBody, ExtensionPointParams as PointParams, } from "./point-defaults.schemas.js";
+class ExtensionPointParamsDto extends createZodDto(PointParams, "ExtensionPointParams") {
+}
+class ExtensionPointDefaultBodyDto extends createZodDto(DefaultBody, "ExtensionPointDefaultBody") {
+}
+/**
+ * The org default provider of `org-default` extension points (web tools spec §6):
+ * - `GET /api/v1/orgs/:orgId/extension-points` (`org.extensions.manage`) → `{ points }`: each
+ *   point with its candidate providers, the stored default and the effective provider;
+ * - `PUT /api/v1/orgs/:orgId/extension-points/:point/default` `{ extension }`
+ *   (`org.extensions.manage`) → 204;
+ * - `GET /api/v1/orgs/:orgId/extension-points/available` (`agents.use`) → `{ points }`: whether
+ *   each point has a provider now, without extension names (for the agent form).
+ */
+let ExtensionPointDefaultsController = class ExtensionPointDefaultsController {
+    points;
+    constructor(points) {
+        this.points = points;
+    }
+    async list(org) {
+        return { points: await this.points.list(org.orgId) };
+    }
+    async available(org) {
+        return { points: await this.points.available(org.orgId) };
+    }
+    async setDefault(principal, org, { point }, body) {
+        const p = requireUser(principal);
+        await this.points.setDefault(org.orgId, point, body.extension, p.account.id);
+    }
+};
+__decorate([
+    Get(),
+    OrgAction("org.extensions.manage"),
+    __param(0, CurrentOrg())
+], ExtensionPointDefaultsController.prototype, "list", null);
+__decorate([
+    Get("available"),
+    OrgAction("agents.use"),
+    __param(0, CurrentOrg())
+], ExtensionPointDefaultsController.prototype, "available", null);
+__decorate([
+    Put(":point/default"),
+    HttpCode(204),
+    OrgAction("org.extensions.manage"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(ExtensionPointParamsDto)),
+    __param(3, ZBody(ExtensionPointDefaultBodyDto))
+], ExtensionPointDefaultsController.prototype, "setDefault", null);
+ExtensionPointDefaultsController = __decorate([
+    Controller("api/v1/orgs/:orgId/extension-points"),
+    __param(0, Inject(ExtensionPointDefaults))
+], ExtensionPointDefaultsController);
+export { ExtensionPointDefaultsController };

package/dist/extensions/point-defaults.d.ts

@@ -0,0 +1,73 @@
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
+import { EffectiveConfigs } from "./effective-config.js";
+import { OrgExtensionConfigs } from "./org-config.js";
+import { ExtensionRegistry } from "./registry.js";
+/**
+ * The outcome of {@link ExtensionPointDefaults.resolve}: the provider with its org config and its
+ * effective deployment config for the org (layering spec A §6), both to pass back to it.
+ */
+export type PointResolution<T> = {
+    ok: true;
+    extension: string;
+    impl: T;
+    orgConfig: unknown;
+    config: unknown;
+} | {
+    ok: false;
+    reason: "none" | "ambiguous";
+};
+/** One `org-default` extension point of an org (the admin view). */
+export interface OrgPointDefaultView {
+    point: string;
+    /** The extensions that could serve the org now, by name. */
+    candidates: string[];
+    /** The stored default, also when it is not a candidate now. */
+    default: string | null;
+    /** The extension a call would use now; null when there is none or the choice is ambiguous. */
+    effective: string | null;
+}
+/**
+ * The org default provider of an `org-default` extension point (web tools spec §6). Per call,
+ * never cached in process: the candidates are the providers loaded on this replica that are
+ * enabled in the org, whose org config and effective deployment config for the org (layering spec
+ * A §6) are valid, and whose `configured()` (when present) does not return false. One candidate is used as is; several need the org's stored default
+ * (`capybara.org_extension_point_defaults`), else the choice is ambiguous. A stored default that
+ * is not a candidate (disabled, uninstalled, unconfigured) stays and counts again once it is one.
+ */
+export declare class ExtensionPointDefaults {
+    private readonly kdb;
+    readonly txHost: TransactionHost;
+    private readonly registry;
+    private readonly orgConfigs;
+    private readonly effective;
+    private readonly log;
+    constructor(kdb: KernelDb, txHost: TransactionHost, registry: Pick<ExtensionRegistry, "list">, orgConfigs: Pick<OrgExtensionConfigs, "get">, effective: Pick<EffectiveConfigs, "get">, log: KernelLogger);
+    /**
+     * The provider of `point` (the name without the major, e.g. `web-search`) for `orgId`, with the
+     * org's decrypted config and the effective deployment config to pass back to it. Throws when the
+     * point has no `selection`.
+     */
+    resolve<T>(orgId: string, point: string): Promise<PointResolution<T>>;
+    /** Every `org-default` point with its candidates, stored default and effective provider. */
+    list(orgId: string): Promise<OrgPointDefaultView[]>;
+    /** Whether each `org-default` point has a provider for the org now (no extension names). */
+    available(orgId: string): Promise<{
+        point: string;
+        available: boolean;
+    }[]>;
+    /**
+     * Stores `extension` as the org's default provider of `point`. 400 `validation_failed` unless
+     * the point is an `org-default` one and the extension provides it (loaded here) and is enabled
+     * in the org. Audited as `extension_point.default_set`.
+     */
+    setDefault(orgId: string, point: string, extension: string, actorId: string, 
+    /** Merged into the audit detail (a write made through the Platform tool). */
+    auditDetail?: Record<string, unknown>): Promise<void>;
+    /** The candidates of `point` in `orgId`, by extension name. */
+    private candidates;
+    private choose;
+    /** The org's stored defaults, point → extension. */
+    private storedDefaults;
+}

package/dist/extensions/point-defaults.js

@@ -0,0 +1,236 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { EXTENSION_POINTS } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { audit } from "../identity/audit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { EffectiveConfigs } from "./effective-config.js";
+import { enabledExtensionsQuery, isExtensionEnabled } from "./enabled.js";
+import { OrgExtensionConfigs } from "./org-config.js";
+import { ExtensionRegistry } from "./registry.js";
+/** The extension points whose provider each org chooses (`selection: "org-default"`). */
+function selectionPoints() {
+    return Object.entries(EXTENSION_POINTS)
+        .filter(([, info]) => info.selection === "org-default")
+        .map(([name]) => name);
+}
+const hasSelection = (point) => EXTENSION_POINTS[point]?.selection === "org-default";
+/**
+ * The org default provider of an `org-default` extension point (web tools spec §6). Per call,
+ * never cached in process: the candidates are the providers loaded on this replica that are
+ * enabled in the org, whose org config and effective deployment config for the org (layering spec
+ * A §6) are valid, and whose `configured()` (when present) does not return false. One candidate is used as is; several need the org's stored default
+ * (`capybara.org_extension_point_defaults`), else the choice is ambiguous. A stored default that
+ * is not a candidate (disabled, uninstalled, unconfigured) stays and counts again once it is one.
+ */
+let ExtensionPointDefaults = class ExtensionPointDefaults {
+    kdb;
+    txHost;
+    registry;
+    orgConfigs;
+    effective;
+    log;
+    constructor(kdb, txHost, registry, orgConfigs, effective, log) {
+        this.kdb = kdb;
+        this.txHost = txHost;
+        this.registry = registry;
+        this.orgConfigs = orgConfigs;
+        this.effective = effective;
+        this.log = log;
+    }
+    /**
+     * The provider of `point` (the name without the major, e.g. `web-search`) for `orgId`, with the
+     * org's decrypted config and the effective deployment config to pass back to it. Throws when the
+     * point has no `selection`.
+     */
+    async resolve(orgId, point) {
+        if (!hasSelection(point)) {
+            throw new Error(`extension point ${point} has no org-default selection`);
+        }
+        const candidates = await this.candidates(orgId, point);
+        const chosen = await this.choose(orgId, point, candidates);
+        if (!chosen.ok)
+            return chosen;
+        const c = chosen.candidate;
+        return {
+            ok: true,
+            extension: c.extension,
+            impl: c.impl,
+            orgConfig: c.orgConfig,
+            config: c.config,
+        };
+    }
+    /** Every `org-default` point with its candidates, stored default and effective provider. */
+    async list(orgId) {
+        const stored = await this.storedDefaults(orgId);
+        const out = [];
+        for (const point of selectionPoints()) {
+            const candidates = await this.candidates(orgId, point);
+            const chosen = pick(candidates, stored.get(point));
+            out.push({
+                point,
+                candidates: candidates.map((c) => c.extension),
+                default: stored.get(point) ?? null,
+                effective: chosen.ok ? chosen.candidate.extension : null,
+            });
+        }
+        return out;
+    }
+    /** Whether each `org-default` point has a provider for the org now (no extension names). */
+    async available(orgId) {
+        const out = [];
+        for (const point of selectionPoints()) {
+            out.push({ point, available: (await this.resolve(orgId, point)).ok });
+        }
+        return out;
+    }
+    /**
+     * Stores `extension` as the org's default provider of `point`. 400 `validation_failed` unless
+     * the point is an `org-default` one and the extension provides it (loaded here) and is enabled
+     * in the org. Audited as `extension_point.default_set`.
+     */
+    async setDefault(orgId, point, extension, actorId, 
+    /** Merged into the audit detail (a write made through the Platform tool). */
+    auditDetail) {
+        const db = this.kdb.db;
+        if (!hasSelection(point)) {
+            throw new ApiError("validation_failed", `${point} is not an extension point with an organization default`);
+        }
+        const provides = this.registry.list(point).some((e) => e.plugin === extension);
+        if (!provides || !(await isExtensionEnabled(db, orgId, extension))) {
+            throw new ApiError("validation_failed", `Extension ${extension} does not provide ${point} or is not enabled in this organization`);
+        }
+        await db
+            .insertInto("org_extension_point_defaults")
+            .values({ org_id: orgId, point, extension, updated_by: actorId })
+            .onConflict((oc) => oc.columns(["org_id", "point"]).doUpdateSet({
+            extension,
+            updated_by: actorId,
+            updated_at: new Date(),
+        }))
+            .execute();
+        await audit(db, {
+            actorAccountId: actorId,
+            orgId,
+            action: "extension_point.default_set",
+            target: point,
+            detail: { point, extension, ...auditDetail },
+        });
+    }
+    /** The candidates of `point` in `orgId`, by extension name. */
+    async candidates(orgId, point) {
+        const db = this.kdb.db;
+        const enabled = new Set((await db
+            .selectFrom(enabledExtensionsQuery(db, orgId).as("en"))
+            .select("en.plugin")
+            .execute()).map((r) => r.plugin));
+        const providers = new Map();
+        for (const e of this.registry.list(point)) {
+            if (enabled.has(e.plugin) && !providers.has(e.plugin))
+                providers.set(e.plugin, e.impl);
+        }
+        const out = [];
+        for (const [extension, impl] of providers) {
+            let cfg;
+            try {
+                cfg = await this.orgConfigs.get(orgId, extension);
+            }
+            catch (err) {
+                this.log.warn("org default provider: provider excluded, its org config is invalid", {
+                    orgId,
+                    point,
+                    extension,
+                    err,
+                });
+                continue;
+            }
+            if (!cfg?.enabled)
+                continue;
+            // spec A §6: an org whose effective config is not valid gets no call from this extension
+            let effective;
+            try {
+                effective = await this.effective.get(orgId, extension);
+            }
+            catch (err) {
+                this.log.warn("org default provider: provider excluded, cannot read its effective config", {
+                    orgId,
+                    point,
+                    extension,
+                    err,
+                });
+                continue;
+            }
+            if (!effective.ok)
+                continue;
+            const configured = impl
+                .configured;
+            if (typeof configured === "function") {
+                let ok;
+                try {
+                    ok = configured.call(impl, cfg.config, effective.config) !== false;
+                }
+                catch (err) {
+                    this.log.warn("org default provider: provider excluded, configured() threw", {
+                        orgId,
+                        point,
+                        extension,
+                        err,
+                    });
+                    continue;
+                }
+                if (!ok)
+                    continue;
+            }
+            out.push({ extension, impl, orgConfig: cfg.config, config: effective.config });
+        }
+        return out.sort((a, b) => (a.extension < b.extension ? -1 : a.extension > b.extension ? 1 : 0));
+    }
+    async choose(orgId, point, candidates) {
+        if (candidates.length < 2)
+            return pick(candidates, undefined);
+        return pick(candidates, (await this.storedDefaults(orgId)).get(point));
+    }
+    /** The org's stored defaults, point → extension. */
+    async storedDefaults(orgId) {
+        const rows = await this.kdb.db
+            .selectFrom("org_extension_point_defaults")
+            .select(["point", "extension"])
+            .where("org_id", "=", orgId)
+            .execute();
+        return new Map(rows.map((r) => [r.point, r.extension]));
+    }
+};
+__decorate([
+    Transactional()
+], ExtensionPointDefaults.prototype, "setDefault", null);
+ExtensionPointDefaults = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(ExtensionRegistry)),
+    __param(3, Inject(OrgExtensionConfigs)),
+    __param(4, Inject(EffectiveConfigs)),
+    __param(5, Inject(KERNEL_LOGGER))
+], ExtensionPointDefaults);
+export { ExtensionPointDefaults };
+/** Rules 2-4 of spec §6: one candidate → it; several → the stored default if a candidate. */
+function pick(candidates, stored) {
+    const [only] = candidates;
+    if (only === undefined)
+        return { ok: false, reason: "none" };
+    if (candidates.length === 1)
+        return { ok: true, candidate: only };
+    const chosen = candidates.find((c) => c.extension === stored);
+    return chosen ? { ok: true, candidate: chosen } : { ok: false, reason: "ambiguous" };
+}

package/dist/extensions/point-defaults.schemas.d.ts

@@ -0,0 +1,9 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+export declare const ExtensionPointParams: z.ZodObject<{
+    point: z.ZodString;
+}, z.core.$strip>;
+export declare const ExtensionPointDefaultBody: z.ZodObject<{
+    extension: z.ZodString;
+}, z.core.$strict>;
+export declare const EXTENSION_POINT_ROUTES: readonly RouteSchemas[];

package/dist/extensions/point-defaults.schemas.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+export const ExtensionPointParams = z.object({ point: z.string().min(1).max(100) });
+export const ExtensionPointDefaultBody = z
+    .object({ extension: z.string().min(1).max(214) })
+    .strict();
+export const EXTENSION_POINT_ROUTES = [
+    { route: "GET /api/v1/orgs/:orgId/extension-points" },
+    { route: "GET /api/v1/orgs/:orgId/extension-points/available" },
+    {
+        route: "PUT /api/v1/orgs/:orgId/extension-points/:point/default",
+        params: ExtensionPointParams,
+        body: ExtensionPointDefaultBody,
+    },
+];

package/dist/extensions/registry.d.ts

@@ -11,7 +11,7 @@ export interface ExtensionPointEntry {
     version: string;
     /** 部署配置摘要，见 `deploymentConfigHash`。 */
     configHash: string;
-    /** 提供方实例的在途计数（connector / sandbox / model-provider 的 `impl` 已经包成计入它的代理）。 */
+    /** The provider instance's in-flight tracker (a tracked point's `impl`: connector, sandbox, model-provider, web-search, web-fetch, is already a proxy counted in it). */
     inflight: InflightTracker;
 }
 /**

package/dist/extensions/registry.js

@@ -12,6 +12,8 @@ const TRACKED_EXTENSION_POINTS = {
     connector: { sessions: ["open"] },
     sandbox: {},
     "model-provider": {},
+    "web-search": {},
+    "web-fetch": {},
 };
 /**
  * The extension instances in effect in this process (by extension name, one each). One provider