@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.21

package/dist/extensions/unavailable.js

@@ -0,0 +1,115 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { STALE_RECONCILE_PERIODS } from "./lifecycle-topics.js";
+import { deriveExtensionStatus } from "./permission-view.js";
+import { ExtensionRegistry } from "./registry.js";
+/** The reason an org or the Platform tool shows for a deployment status of a not-loaded extension. */
+export function unavailableReason(status) {
+    switch (status) {
+        case "pending_config":
+            return "needs_deployment_config";
+        case "pending_approval":
+            return "pending_approval";
+        case "pending_migration":
+            return "pending_migration";
+        case "dependency":
+            return "dependency";
+        case "conflict":
+            return "conflict";
+        case "failed":
+        case "legacy_format":
+            return "failed";
+        case "disabled":
+            return "deployment_disabled";
+        // loaded on another replica, or not yet on this one
+        case "converging":
+        case "enabled":
+            return "loading";
+    }
+}
+/**
+ * The state of extensions that are not loaded on this replica, derived like the admin console's
+ * status ({@link deriveExtensionStatus}) from the install record and the replicas' recent reports,
+ * without reading packages: a pending approval and a pending config come from the replicas' rows
+ * (`pending` with reason `approval` / `config`). Reads PG on every call (no in-process state).
+ *
+ * Its inputs differ slightly from the admin view's (`ExtensionAdmin`): there `pendingApproval`
+ * compares the package's permission set with the snapshot and `configValid` checks the deployment
+ * config, while here both come from what the replicas last reported. They agree once a replica
+ * has tried the current package; until then this view says `loading` where the admin view may
+ * already say `pending_approval` or `pending_config`.
+ *
+ * Which extensions count as loaded is this replica's registry: replica-local and transient. During
+ * a rollout, or right after an enable or upgrade, one replica may answer `loading` while another
+ * has it loaded; the next call (or the next reconcile) converges.
+ */
+let ExtensionAvailability = class ExtensionAvailability {
+    kdb;
+    config;
+    registry;
+    constructor(kdb, config, registry) {
+        this.kdb = kdb;
+        this.config = config;
+        this.registry = registry;
+    }
+    /** For each of `names` not loaded on this replica: its status and reason (loaded ones absent). */
+    async unavailable(names) {
+        const loaded = new Set(this.registry.manifests().map((m) => m.name));
+        const wanted = [...new Set(names)].filter((n) => !loaded.has(n));
+        const out = new Map();
+        if (wanted.length === 0)
+            return out;
+        const db = this.kdb.db;
+        const staleSeconds = STALE_RECONCILE_PERIODS * this.config.get().extensionHost.reconcileIntervalSeconds;
+        const [installs, replicas] = await Promise.all([
+            db
+                .selectFrom("extension_installs")
+                .select(["name", "sha256", "desired_state", "migrated_sha"])
+                .where("name", "in", wanted)
+                .execute(),
+            db
+                .selectFrom("extension_replica_status")
+                .select(["plugin", "state", "reason", "sha256"])
+                .where("plugin", "in", wanted)
+                .where("heartbeat_at", ">", sql `now() - make_interval(secs => ${staleSeconds})`)
+                .execute(),
+        ]);
+        for (const name of wanted) {
+            const install = installs.find((i) => i.name === name);
+            if (install === undefined) {
+                out.set(name, { status: null, reason: "not_deployed" });
+                continue;
+            }
+            const rows = replicas.filter((r) => r.plugin === name);
+            const target = rows.filter((r) => r.sha256 === install.sha256);
+            const status = deriveExtensionStatus({
+                source: "install",
+                desired: { sha256: install.sha256, state: install.desired_state },
+                pendingApproval: target.some((r) => r.state === "pending" && r.reason === "approval"),
+                configValid: !target.some((r) => r.state === "pending" && r.reason === "config"),
+                migratedSha: install.migrated_sha,
+                replicas: rows,
+            });
+            out.set(name, { status, reason: unavailableReason(status) });
+        }
+        return out;
+    }
+};
+ExtensionAvailability = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(KernelConfigService)),
+    __param(2, Inject(ExtensionRegistry))
+], ExtensionAvailability);
+export { ExtensionAvailability };

package/dist/files/previewers.controller.js

@@ -14,11 +14,10 @@ import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZParam, ZQuery } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
 import { PreviewerRegistry } from "./previewers.js";
+import { FilePreviewersOrderBody } from "./previewers.schemas.js";
 const Id = z.string().min(1).max(100);
 const PreviewQuery = z.object({ locale: z.enum(["zh", "en"]).default("en") });
-const OrderBody = z.object({
-    items: z.array(z.object({ plugin: Id, id: Id, disabled: z.boolean().default(false) })).max(500),
-});
+const OrderBody = FilePreviewersOrderBody;
 /** The previewer named in a preview path (the other path parameters are read as they are). */
 const PreviewParams = z.object({ plugin: Id, previewerId: Id });
 class FilePreviewQueryDto extends createZodDto(PreviewQuery, "FilePreviewQuery") {

package/dist/files/previewers.d.ts

@@ -1,5 +1,6 @@
 import { type FilePreviewer, type Logger, type UiView } from "@capybara-hq/plugin-sdk";
 import { ConversationFiles } from "../conversations/files.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { ExtensionHost } from "../extensions/host.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -39,7 +40,7 @@ export declare class PreviewerRegistry {
     readonly txHost: TransactionHost;
     private readonly timeoutMs;
     private readonly d;
-    constructor(kdb: Pick<KernelDb, "db">, host: Pick<ExtensionHost, "list" | "enabledPlugins">, files: Pick<ConversationFiles, "file">, storage: Pick<StorageService, "kernel">, log: Pick<Logger, "warn">, txHost: TransactionHost, timeoutMs?: number);
+    constructor(kdb: Pick<KernelDb, "db">, host: Pick<ExtensionHost, "list" | "enabledPlugins">, files: Pick<ConversationFiles, "file">, storage: Pick<StorageService, "kernel">, effective: Pick<EffectiveConfigs, "get">, log: Pick<Logger, "warn">, txHost: TransactionHost, timeoutMs?: number);
     /** Every previewer loaded on this replica, in provider order (load order, then list order). */
     private loaded;
     /** The org's previewers (enabled extensions only) in its order, disabled ones included. */
@@ -60,11 +61,17 @@ export declare class PreviewerRegistry {
     }[], actor?: {
         accountId?: string;
         tokenId?: string;
-    }): Promise<OrgPreviewerItem[]>;
+    }, auditDetail?: Record<string, unknown>): Promise<OrgPreviewerItem[]>;
     /** Replaces the org's rows of the previewers this replica knows, in one transaction. */
     private putIn;
     /** Previewers that take this file (viewer must read the conversation), in the org's order. */
     forFile(orgId: string, conversationId: string, viewer: string, fileId: string): Promise<PreviewerItem[]>;
+    /**
+     * The org's enabled previewers that take the file, each with its extension's effective config
+     * for the org. An extension whose effective config is not valid in the org (or cannot be read)
+     * previews nothing there (layering spec A §6): its previewers are left out, so the next one or a
+     * built-in takes the file.
+     */
     private accepting;
     /**
      * Renders a view previewer for one file: 404 `ui.not_found` when it does not take the file (or is
@@ -80,7 +87,7 @@ export declare class PreviewerRegistry {
         locale: "zh" | "en";
     }): Promise<UiView>;
     /**
-     * Whether an embed token for a `file-preview` contribution may be issued for this file: the
+     * Whether an embed token for a `file.preview` contribution may be issued for this file: the
      * viewer reads the conversation, the file is in it, and an enabled previewer of that extension
      * with `embed: contribution` takes it. Conversation / file not found throws 404.
      */

package/dist/files/previewers.js

@@ -12,6 +12,7 @@ import { Inject, Injectable, Optional } from "@nestjs/common";
 import { sql } from "kysely";
 import { ConversationFiles } from "../conversations/files.js";
 import { ApiError } from "../errors.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { ExtensionHost } from "../extensions/host.js";
 import { audit } from "../identity/audit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -71,7 +72,7 @@ let PreviewerRegistry = class PreviewerRegistry {
     txHost;
     timeoutMs;
     d;
-    constructor(kdb, host, files, storage, log, txHost, timeoutMs = FILE_PREVIEW_TIMEOUT_MS) {
+    constructor(kdb, host, files, storage, effective, log, txHost, timeoutMs = FILE_PREVIEW_TIMEOUT_MS) {
         this.txHost = txHost;
         this.timeoutMs = timeoutMs;
         this.d = {
@@ -82,6 +83,7 @@ let PreviewerRegistry = class PreviewerRegistry {
             enabledPlugins: (orgId) => host.enabledPlugins(orgId),
             files,
             storage,
+            effective,
             log,
         };
     }
@@ -139,7 +141,7 @@ let PreviewerRegistry = class PreviewerRegistry {
      * extension that is disabled now (or not loaded here yet) keep their order and `disabled`.
      * Audited as `org.file_previewers.updated`.
      */
-    async put(orgId, items, actor = {}) {
+    async put(orgId, items, actor = {}, auditDetail) {
         const known = new Set((await this.ordered(orgId)).map((l) => `${l.plugin}/${l.previewer.id}`));
         const seen = new Set();
         for (const i of items) {
@@ -149,11 +151,11 @@ let PreviewerRegistry = class PreviewerRegistry {
             }
             seen.add(k);
         }
-        await this.putIn(orgId, items, known, actor);
+        await this.putIn(orgId, items, known, actor, auditDetail);
         return this.list(orgId);
     }
     /** Replaces the org's rows of the previewers this replica knows, in one transaction. */
-    async putIn(orgId, items, known, actor) {
+    async putIn(orgId, items, known, actor, auditDetail) {
         if (known.size > 0) {
             await this.d.db
                 .deleteFrom("file_previewers")
@@ -178,7 +180,7 @@ let PreviewerRegistry = class PreviewerRegistry {
             ...(actor.tokenId !== undefined && { actorTokenId: actor.tokenId }),
             orgId,
             action: "org.file_previewers.updated",
-            detail: { items },
+            detail: { items, ...auditDetail },
         });
     }
     /** Previewers that take this file (viewer must read the conversation), in the org's order. */
@@ -186,8 +188,33 @@ let PreviewerRegistry = class PreviewerRegistry {
         const file = await this.d.files.file(orgId, conversationId, viewer, fileId);
         return (await this.accepting(orgId, file)).map(item);
     }
+    /**
+     * The org's enabled previewers that take the file, each with its extension's effective config
+     * for the org. An extension whose effective config is not valid in the org (or cannot be read)
+     * previews nothing there (layering spec A §6): its previewers are left out, so the next one or a
+     * built-in takes the file.
+     */
     async accepting(orgId, file) {
-        return (await this.ordered(orgId)).filter((l) => !l.disabled && previewerAccepts(l.previewer, file));
+        const taking = (await this.ordered(orgId)).filter((l) => !l.disabled && previewerAccepts(l.previewer, file));
+        const configs = new Map();
+        for (const plugin of new Set(taking.map((l) => l.plugin))) {
+            try {
+                const e = await this.d.effective.get(orgId, plugin);
+                configs.set(plugin, e.ok ? { config: e.config } : null);
+            }
+            catch (err) {
+                this.d.log.warn("file previewer left out: cannot read its effective config", {
+                    orgId,
+                    plugin,
+                    err,
+                });
+                configs.set(plugin, null);
+            }
+        }
+        return taking.flatMap((l) => {
+            const c = configs.get(l.plugin);
+            return c ? [{ ...l, config: c.config }] : [];
+        });
     }
     /**
      * Renders a view previewer for one file: 404 `ui.not_found` when it does not take the file (or is
@@ -224,6 +251,7 @@ let PreviewerRegistry = class PreviewerRegistry {
                             accountId: t.accountId,
                             conversationId: t.conversationId,
                             locale: t.locale,
+                            config: l.config,
                             signal: s,
                             file: {
                                 id: file.id,
@@ -271,7 +299,7 @@ let PreviewerRegistry = class PreviewerRegistry {
         return view;
     }
     /**
-     * Whether an embed token for a `file-preview` contribution may be issued for this file: the
+     * Whether an embed token for a `file.preview` contribution may be issued for this file: the
      * viewer reads the conversation, the file is in it, and an enabled previewer of that extension
      * with `embed: contribution` takes it. Conversation / file not found throws 404.
      */
@@ -289,9 +317,10 @@ PreviewerRegistry = __decorate([
     __param(1, Inject(ExtensionHost)),
     __param(2, Inject(ConversationFiles)),
     __param(3, Inject(StorageService)),
-    __param(4, Inject(KERNEL_LOGGER)),
-    __param(5, Inject(TransactionHost)),
-    __param(6, Optional()),
-    __param(6, Inject(FILE_PREVIEW_TIMEOUT))
+    __param(4, Inject(EffectiveConfigs)),
+    __param(5, Inject(KERNEL_LOGGER)),
+    __param(6, Inject(TransactionHost)),
+    __param(7, Optional()),
+    __param(7, Inject(FILE_PREVIEW_TIMEOUT))
 ], PreviewerRegistry);
 export { PreviewerRegistry };

package/dist/files/previewers.schemas.d.ts

@@ -0,0 +1,10 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+export declare const FilePreviewersOrderBody: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        plugin: z.ZodString;
+        id: z.ZodString;
+        disabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const FILE_PREVIEWER_ROUTES: readonly RouteSchemas[];

package/dist/files/previewers.schemas.js

@@ -0,0 +1,9 @@
+import { z } from "zod";
+const Id = z.string().min(1).max(100);
+export const FilePreviewersOrderBody = z.object({
+    items: z.array(z.object({ plugin: Id, id: Id, disabled: z.boolean().default(false) })).max(500),
+});
+export const FILE_PREVIEWER_ROUTES = [
+    { route: "GET /api/v1/orgs/:orgId/file-previewers" },
+    { route: "PUT /api/v1/orgs/:orgId/file-previewers", body: FilePreviewersOrderBody },
+];

package/dist/http/api.module.js

@@ -8,35 +8,57 @@ import { Module } from "@nestjs/common";
 import { APP_GUARD } from "@nestjs/core";
 import { AdminController } from "../admin/admin.controller.js";
 import { AdminModule } from "../admin/admin.module.js";
+import { AdminAgentsController } from "../admin/admin-agents.controller.js";
+import { AdminConnectorsController } from "../admin/admin-connectors.controller.js";
+import { AdminAuditController } from "../admin/audit.controller.js";
 import { AdminExtensionsController } from "../admin/extensions.controller.js";
+import { AdminOverviewController } from "../admin/overview.controller.js";
 import { SetupController } from "../admin/setup.controller.js";
 import { AgentsController } from "../agents/agents.controller.js";
 import { AgentsModule } from "../agents/agents.module.js";
 import { ModelsController } from "../agents/models.controller.js";
-import { AgentTemplatesController } from "../agents/templates.controller.js";
+import { PendingConnectorsController } from "../agents/pending-connectors.controller.js";
+import { ReadinessController } from "../agents/readiness.controller.js";
+import { AgentSaveAsTemplateController, AgentTemplatesController, } from "../agents/templates.controller.js";
+import { BackgroundController } from "../background/background.controller.js";
+import { BackgroundModule } from "../background/background.module.js";
 import { AdminCatalogController } from "../catalog/admin-catalog.controller.js";
+import { AppearanceModule } from "../catalog/appearance.service.js";
 import { CatalogModule } from "../catalog/catalog.module.js";
-import { MarketplacesController } from "../catalog/marketplaces.controller.js";
+import { AdminComponentsController, OrgComponentsController, } from "../catalog/component-scope.controller.js";
+import { MarketplacesController, OrgMarketplacesController, } from "../catalog/marketplaces.controller.js";
 import { AdminCatalogRequestsController, OrgCatalogController, } from "../catalog/org-catalog.controller.js";
+import { OrgExtensionConfigsController, OrgExtensionOverridesController, OrgExtensionToolSwitchesController, } from "../catalog/org-extension.controller.js";
+import { OrgOwnedPluginsController, OrgPluginUploadsController, } from "../catalog/org-plugin-uploads.controller.js";
 import { ChannelsModule } from "../channels/channels.module.js";
 import { ChannelConnectionsController } from "../channels/connections.controller.js";
+import { AdminClientController, OrgClientController } from "../client/client.controller.js";
+import { ClientModule } from "../client/client.module.js";
+import { ClientDeliveryController } from "../client/client-delivery.controller.js";
 import { AttachmentsController } from "../conversations/attachments.controller.js";
 import { ConversationsController } from "../conversations/conversations.controller.js";
 import { ConversationsModule } from "../conversations/conversations.module.js";
+import { DevicesController } from "../devices/devices.controller.js";
+import { DevicesModule } from "../devices/devices.module.js";
 import { EvalsModule } from "../evals/evals.module.js";
 import { EvalRunsController } from "../evals/runs.controller.js";
 import { EvalSetsController } from "../evals/sets.controller.js";
 import { TrajectoryController } from "../evals/trajectory.controller.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
-import { OrgExtensionConfigsController } from "../extensions/org-config.controller.js";
+import { ExtensionPointDefaultsController } from "../extensions/point-defaults.controller.js";
 import { FilesModule } from "../files/files.module.js";
 import { FilePreviewersController } from "../files/previewers.controller.js";
 import { AuthController } from "../identity/auth.controller.js";
 import { AuthGuard } from "../identity/auth.guard.js";
 import { IdentityModule } from "../identity/identity.module.js";
+import { InitialPasswordsController } from "../identity/initial-passwords.controller.js";
 import { MeController } from "../identity/me.controller.js";
 import { BindController, MeIdentitiesController, SsoController, } from "../identity/sso.controller.js";
 import { InboxModule } from "../inbox/inbox.module.js";
+import { PlatformInboxController } from "../inbox/platform-inbox.controller.js";
+import { DeviceAuthController } from "../local-devices/device-auth.controller.js";
+import { DeviceAuthModule } from "../local-devices/device-auth.module.js";
+import { ModelEnablementController } from "../models/enablement.controller.js";
 import { ModelsModule } from "../models/models.module.js";
 import { ModelPurposesController } from "../models/purposes.controller.js";
 import { DirectorySyncController } from "../orgs/directory-sync.controller.js";
@@ -46,48 +68,75 @@ import { OrgsModule } from "../orgs/orgs.module.js";
 import { OrgSettingsController } from "../orgs/settings.controller.js";
 import { RuntimeModule } from "../runtime/runtime.module.js";
 import { ConversationStreamController } from "../runtime/stream.controller.js";
-import { AgentSkillsController, InboxController, SkillChangesController, } from "../skills/changes.controller.js";
+import { SetupModule } from "../setup/setup.module.js";
+import { SetupChecksController } from "../setup/setup-checks.controller.js";
+import { SetupGuidesController } from "../setup/setup-guides.controller.js";
+import { AgentSkillsController } from "../skills/agent-skills.controller.js";
+import { InboxController, SkillChangesController } from "../skills/changes.controller.js";
 import { InvocableSkillsController } from "../skills/invocable.controller.js";
 import { SkillsController } from "../skills/skills.controller.js";
 import { SkillsModule } from "../skills/skills.module.js";
 import { StorageModule } from "../storage/storage.module.js";
+import { OrgThemesController } from "../themes/themes.controller.js";
+import { ThemesModule } from "../themes/themes.module.js";
+import { PlatformThemeController, ThemeDeliveryController, } from "../themes/themes-public.controller.js";
 import { ApprovalsController, ToolGrantsController } from "../tools/approvals.controller.js";
 import { ConnectorContentController } from "../tools/connector-content.controller.js";
 import { ConnectorsController } from "../tools/connectors.controller.js";
+import { ExtensionToolsController } from "../tools/extension-tools.controller.js";
 import { OAuthCallbackController, OAuthConnectController, } from "../tools/oauth/oauth.controller.js";
 import { QuestionsController } from "../tools/questions.controller.js";
 import { ToolsModule } from "../tools/tools.module.js";
+import { AdminUiController } from "../ui/admin-ui.controller.js";
+import { SlotsController } from "../ui/slots.controller.js";
 import { UiModule } from "../ui/ui.module.js";
 import { UiController } from "../ui/views.controller.js";
 /** Every controller of the kernel API. */
 const CONTROLLERS = [
     AuthController,
     MeController,
+    InitialPasswordsController,
     OrgsController,
     OrgSettingsController,
     InvitationsController,
     SetupController,
     AdminController,
+    AdminAgentsController,
+    AdminConnectorsController,
+    AdminAuditController,
+    AdminOverviewController,
     AdminExtensionsController,
     AdminCatalogController,
+    AdminComponentsController,
     MarketplacesController,
+    OrgMarketplacesController,
     OrgExtensionConfigsController,
+    OrgExtensionOverridesController,
+    OrgExtensionToolSwitchesController,
     AgentsController,
     AgentTemplatesController,
+    AgentSaveAsTemplateController,
+    PendingConnectorsController,
     ModelsController,
+    ModelEnablementController,
+    ReadinessController,
     ConversationsController,
+    BackgroundController,
+    DevicesController,
     AttachmentsController,
     SkillsController,
     SkillChangesController,
     AgentSkillsController,
     InvocableSkillsController,
     InboxController,
+    PlatformInboxController,
     ConversationStreamController,
     ConnectorContentController,
     ConnectorsController,
     ApprovalsController,
     ToolGrantsController,
     QuestionsController,
+    ExtensionToolsController,
     OAuthConnectController,
     OAuthCallbackController,
     SsoController,
@@ -96,13 +145,28 @@ const CONTROLLERS = [
     ChannelConnectionsController,
     DirectorySyncController,
     UiController,
+    AdminUiController,
+    SlotsController,
     FilePreviewersController,
+    ExtensionPointDefaultsController,
     TrajectoryController,
     EvalSetsController,
     EvalRunsController,
     ModelPurposesController,
     OrgCatalogController,
+    SetupChecksController,
+    SetupGuidesController,
+    OrgPluginUploadsController,
+    OrgOwnedPluginsController,
+    OrgComponentsController,
     AdminCatalogRequestsController,
+    OrgThemesController,
+    ThemeDeliveryController,
+    PlatformThemeController,
+    DeviceAuthController,
+    ClientDeliveryController,
+    OrgClientController,
+    AdminClientController,
 ];
 /**
  * The api role (nest kernel spec §2): the kernel API (`/api/v1/*`), imported by `KernelModule` only
@@ -123,15 +187,23 @@ ApiModule = __decorate([
             AdminModule,
             ExtensionsModule,
             CatalogModule,
+            // a plugin's suggested appearance (its own module: it writes through the org settings)
+            AppearanceModule,
             ToolsModule,
             AgentsModule,
             ConversationsModule,
+            BackgroundModule,
+            DevicesModule,
+            DeviceAuthModule,
             RuntimeModule,
             ChannelsModule,
             EvalsModule,
             FilesModule,
             UiModule,
             InboxModule,
+            ThemesModule,
+            ClientModule,
+            SetupModule,
         ],
         controllers: CONTROLLERS,
         providers: [{ provide: APP_GUARD, useClass: AuthGuard }],

package/dist/http/app.d.ts

@@ -45,7 +45,7 @@ export interface CreateHttpAppOptions {
     replicaId?: string | undefined;
     /**
      * The size limit for package uploads ({@link PACKAGE_UPLOAD_ROUTES}: extension packages and
-     * enterprise catalog packages, `application/octet-stream`), i.e. `packages.maxBytes`. The route
+     * platform catalog packages, `application/octet-stream`), i.e. `packages.maxBytes`. The route
      * bodyLimit is one byte more: a package exactly one byte over reaches the handler and returns
      * `extension.package_too_large`; larger ones are refused by Fastify itself (413
      * `payload_too_large`).
@@ -56,11 +56,20 @@ export interface CreateHttpAppOptions {
 export declare const EXTENSION_PACKAGE_UPLOAD_ROUTE = "/api/v1/admin/extensions/packages/file";
 /** The plugin package upload route of the catalog import (Fastify route template). */
 export declare const CATALOG_UPLOAD_ROUTE = "/api/v1/admin/catalog/import/file";
+/** The platform skill version upload route (a skill package zip as the raw body). */
+export declare const COMPONENT_SKILL_UPLOAD_ROUTE = "/api/v1/admin/components/skill/:id/versions";
 /**
  * The upload routes that take raw bytes (`application/octet-stream`, limit `packages.maxBytes`,
- * the enterprise admin is authenticated before the body is read).
+ * the super admin is authenticated before the body is read).
  */
 export declare const PACKAGE_UPLOAD_ROUTES: ReadonlySet<string>;
+/** An org admin's plugin package upload (spec §14, ruling P3-7; a tgz as the raw body). */
+export declare const ORG_PLUGIN_UPLOAD_ROUTE = "/api/v1/orgs/:orgId/catalog/uploads/file";
+/**
+ * The org routes that take raw package bytes (limit `packages.maxBytes`): before the body is read
+ * the caller is authenticated as a person with the org role of `catalog.upload` (ruling P3-29).
+ */
+export declare const ORG_PACKAGE_UPLOAD_ROUTES: ReadonlySet<string>;
 /**
  * Sets up the Fastify side of the kernel's Nest application (built by `buildKernelApp` from
  * `KernelModule`, which provides the health endpoints and the API) without connecting to anything,

package/dist/http/app.js

@@ -3,9 +3,11 @@ import fastifyCookie from "@fastify/cookie";
 import { ApiError, errorBody } from "../errors.js";
 import { AccountsService } from "../identity/accounts.js";
 import { ApiTokenService } from "../identity/api-tokens.js";
-import { authorizeEnterpriseAdmin } from "../identity/auth.guard.js";
+import { authenticateOrgUploader, authorizeSuperAdmin, } from "../identity/auth.guard.js";
 import { SessionService } from "../identity/sessions.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
 import { withLogContext } from "../log-context.js";
+import { authorizeOrgAction } from "../orgs/org.guard.js";
 import { redactPath } from "./error.filter.js";
 import { registerGatewayRoutes } from "./gateway-routes.js";
 import { createPluginRouter, registerPluginDispatch, staticRouteTable, } from "./plugin-dispatch.js";
@@ -13,14 +15,24 @@ import { createPluginRouter, registerPluginDispatch, staticRouteTable, } from ".
 export const EXTENSION_PACKAGE_UPLOAD_ROUTE = "/api/v1/admin/extensions/packages/file";
 /** The plugin package upload route of the catalog import (Fastify route template). */
 export const CATALOG_UPLOAD_ROUTE = "/api/v1/admin/catalog/import/file";
+/** The platform skill version upload route (a skill package zip as the raw body). */
+export const COMPONENT_SKILL_UPLOAD_ROUTE = "/api/v1/admin/components/skill/:id/versions";
 /**
  * The upload routes that take raw bytes (`application/octet-stream`, limit `packages.maxBytes`,
- * the enterprise admin is authenticated before the body is read).
+ * the super admin is authenticated before the body is read).
  */
 export const PACKAGE_UPLOAD_ROUTES = new Set([
     EXTENSION_PACKAGE_UPLOAD_ROUTE,
     CATALOG_UPLOAD_ROUTE,
+    COMPONENT_SKILL_UPLOAD_ROUTE,
 ]);
+/** An org admin's plugin package upload (spec §14, ruling P3-7; a tgz as the raw body). */
+export const ORG_PLUGIN_UPLOAD_ROUTE = "/api/v1/orgs/:orgId/catalog/uploads/file";
+/**
+ * The org routes that take raw package bytes (limit `packages.maxBytes`): before the body is read
+ * the caller is authenticated as a person with the org role of `catalog.upload` (ruling P3-29).
+ */
+export const ORG_PACKAGE_UPLOAD_ROUTES = new Set([ORG_PLUGIN_UPLOAD_ROUTE]);
 /** Paths without an access log line (probes). */
 const QUIET_PATHS = new Set(["/healthz", "/readyz"]);
 /**
@@ -92,11 +104,12 @@ export async function createHttpApp(opts, app) {
         if (LARGE_BODY_ROUTES.has(r.url) && [r.method].flat().includes("POST")) {
             r.bodyLimit = LARGE_BODY_LIMIT;
         }
-        if (PACKAGE_UPLOAD_ROUTES.has(r.url) && opts.packageMaxBytes !== undefined) {
+        const upload = PACKAGE_UPLOAD_ROUTES.has(r.url) || ORG_PACKAGE_UPLOAD_ROUTES.has(r.url);
+        if (upload && opts.packageMaxBytes !== undefined) {
             r.bodyLimit = opts.packageMaxBytes + 1;
         }
     });
-    // 读请求体之前：包上传（插件包、企业目录包）先认证（未认证 / 非企业管理员的大请求体不读进内存）；其余内核路由不收
+    // 读请求体之前：包上传（插件包、平台目录包）先认证（未认证 / 非超级管理员的大请求体不读进内存）；其余内核路由不收
     // application/octet-stream（415）。插件路由 /plugins/* 在自己的作用域里收任何类型，不受影响
     let authServices;
     const services = () => {
@@ -119,7 +132,20 @@ export async function createHttpApp(opts, app) {
             return;
         if (req.method === "POST" && PACKAGE_UPLOAD_ROUTES.has(req.routeOptions.url ?? "")) {
             try {
-                await authorizeEnterpriseAdmin(req, services());
+                await authorizeSuperAdmin(req, services());
+            }
+            catch (e) {
+                return sendError(reply, e, req.method, req.url);
+            }
+            return;
+        }
+        if (req.method === "POST" && ORG_PACKAGE_UPLOAD_ROUTES.has(req.routeOptions.url ?? "")) {
+            try {
+                // the org admin role before the body (ruling P3-29): no one else makes the kernel buffer
+                // a package-sized body
+                const principal = await authenticateOrgUploader(req, services());
+                const orgId = req.params.orgId ?? "";
+                await authorizeOrgAction(app.get(KernelDb, { strict: false }).db, principal, orgId, "catalog.upload");
             }
             catch (e) {
                 return sendError(reply, e, req.method, req.url);

package/dist/http/gateway-routes.d.ts

@@ -1,15 +1,19 @@
 import type { Logger } from "@capybara-hq/plugin-sdk";
 import type { FastifyInstance } from "fastify";
 import type { ChannelWebhooks } from "../channels/webhook.js";
+import { type DeviceRoutesOptions } from "../local-devices/device-routes.js";
 /** What the gateway role serves over HTTP besides health and plugin routes. */
 export interface GatewayRoutes {
     webhooks: Pick<ChannelWebhooks, "handle">;
     /** `channels.webhookMaxBodyBytes`. */
     webhookMaxBodyBytes: number;
+    /** The device connection route (`GET /device/connect`, environments spec §13.4). */
+    devices: DeviceRoutesOptions;
 }
 /**
- * Registers the gateway role's HTTP routes (`serveGateway = roles.includes("gateway")`): today the
- * channel webhook. These are raw Fastify routes, not a Nest module, so the API's global guard and
- * CSRF check do not apply (P-4); each route does its own (plugin-side) verification.
+ * Registers the gateway role's HTTP routes (`serveGateway = roles.includes("gateway")`): the
+ * channel webhook and the device connection WebSocket. These are raw Fastify routes, not a Nest
+ * module, so the API's global guard and CSRF check do not apply (P-4); each route does its own
+ * verification (the channel plugin's signature check, the machine credential).
  */
 export declare function registerGatewayRoutes(fastify: FastifyInstance, routes: GatewayRoutes, log: Pick<Logger, "error">): Promise<void>;