@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.21

package/dist/themes/themes-public.controller.js

@@ -0,0 +1,98 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Get, Header, Inject, Param, Res } from "@nestjs/common";
+import { Public } from "../identity/principal.js";
+import { ThemeDeliveryService } from "./theme-delivery.service.js";
+import { ThemesService } from "./themes.service.js";
+/** A theme version's stylesheet and assets never change (the version is in the URL). */
+const IMMUTABLE = "public, max-age=31536000, immutable";
+/**
+ * Theme delivery (themes spec §8): every theme version's stylesheet and assets, public (styles are
+ * not sensitive; the URLs reveal only that the theme exists) and immutable. The URLs are the ones
+ * `themeUrl` builds; an unknown theme, version or file is 404 `theme.not_found`.
+ */
+let ThemeDeliveryController = class ThemeDeliveryController {
+    delivery;
+    constructor(delivery) {
+        this.delivery = delivery;
+    }
+    /**
+     * The version's stylesheet: scheme overrides, `@font-face` rules and font stacks, in the render
+     * revision `revision` (`r<THEME_CSS_REVISION>`; only the current one is served). The URL without
+     * a revision (before revision 2) has no route: 404, so a browser's cached unlayered copy is never
+     * answered with the new format under an immutable cache.
+     */
+    async css(id, version, revision, reply) {
+        const css = await this.delivery.stylesheet(id, version, revision);
+        await reply
+            .header("content-type", "text/css; charset=utf-8")
+            .header("x-content-type-options", "nosniff")
+            .header("cache-control", IMMUTABLE)
+            .send(css);
+    }
+    /**
+     * A font (`font/woff2`) or logo (`image/svg+xml`, sanitized at import, served under a CSP
+     * sandbox; `image/png`) the version names; `file` is its plugin path as one segment
+     * (`fonts%2FMiSans.woff2`).
+     */
+    async asset(id, version, file, reply) {
+        const a = await this.delivery.asset(id, version, file);
+        reply
+            .header("content-type", a.contentType)
+            .header("x-content-type-options", "nosniff")
+            .header("cache-control", IMMUTABLE);
+        if (a.contentType === "image/svg+xml") {
+            reply.header("content-security-policy", "default-src 'none'; sandbox");
+        }
+        await reply.send(Buffer.from(a.data.buffer, a.data.byteOffset, a.data.byteLength));
+    }
+};
+__decorate([
+    Public(),
+    Get(":revision/theme.css"),
+    __param(0, Param("id")),
+    __param(1, Param("version")),
+    __param(2, Param("revision")),
+    __param(3, Res())
+], ThemeDeliveryController.prototype, "css", null);
+__decorate([
+    Public(),
+    Get("assets/:file"),
+    __param(0, Param("id")),
+    __param(1, Param("version")),
+    __param(2, Param("file")),
+    __param(3, Res())
+], ThemeDeliveryController.prototype, "asset", null);
+ThemeDeliveryController = __decorate([
+    Controller("api/v1/themes/:id/:version"),
+    __param(0, Inject(ThemeDeliveryService))
+], ThemeDeliveryController);
+export { ThemeDeliveryController };
+/** The platform default theme for pages before sign-in (themes spec §8-§9), public. */
+let PlatformThemeController = class PlatformThemeController {
+    themes;
+    constructor(themes) {
+        this.themes = themes;
+    }
+    /** The platform default's reference while it is eligible; null: the built-in theme. */
+    platformTheme() {
+        return this.themes.platformDefault();
+    }
+};
+__decorate([
+    Public(),
+    Get(),
+    Header("cache-control", "no-store")
+], PlatformThemeController.prototype, "platformTheme", null);
+PlatformThemeController = __decorate([
+    Controller("api/v1/platform/theme"),
+    __param(0, Inject(ThemesService))
+], PlatformThemeController);
+export { PlatformThemeController };

package/dist/themes/themes.controller.d.ts

@@ -0,0 +1,13 @@
+import { type Principal } from "../identity/principal.js";
+import { type OrgContext } from "../orgs/org.guard.js";
+import { type OrgThemes, ThemesService } from "./themes.service.js";
+/** The org's themes (`/api/v1/orgs/:orgId/themes`, themes spec §9): members only. */
+export declare class OrgThemesController {
+    private readonly themes;
+    constructor(themes: ThemesService);
+    /**
+     * `{ themes, resolved, org }`: the themes on in the org (with swatches), the viewer's resolved
+     * theme (null: the built-in one) and the org's default and personal lock.
+     */
+    list(principal: Principal, org: OrgContext): Promise<OrgThemes>;
+}

package/dist/themes/themes.controller.js

@@ -0,0 +1,38 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Get, Inject } from "@nestjs/common";
+import { CurrentPrincipal } from "../identity/principal.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { ThemesService } from "./themes.service.js";
+/** The org's themes (`/api/v1/orgs/:orgId/themes`, themes spec §9): members only. */
+let OrgThemesController = class OrgThemesController {
+    themes;
+    constructor(themes) {
+        this.themes = themes;
+    }
+    /**
+     * `{ themes, resolved, org }`: the themes on in the org (with swatches), the viewer's resolved
+     * theme (null: the built-in one) and the org's default and personal lock.
+     */
+    async list(principal, org) {
+        return this.themes.forOrg(org.orgId, principal.kind === "user" ? principal.account.id : null);
+    }
+};
+__decorate([
+    Get(),
+    OrgAction("org.read"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg())
+], OrgThemesController.prototype, "list", null);
+OrgThemesController = __decorate([
+    Controller("api/v1/orgs/:orgId/themes"),
+    __param(0, Inject(ThemesService))
+], OrgThemesController);
+export { OrgThemesController };

package/dist/themes/themes.module.d.ts

@@ -0,0 +1,3 @@
+/** Themes (themes spec §7-§9): resolution, the org's theme listing and delivery. */
+export declare class ThemesModule {
+}

package/dist/themes/themes.module.js

@@ -0,0 +1,21 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { StorageModule } from "../storage/storage.module.js";
+import { ThemeDeliveryService } from "./theme-delivery.service.js";
+import { ThemesService } from "./themes.service.js";
+/** Themes (themes spec §7-§9): resolution, the org's theme listing and delivery. */
+let ThemesModule = class ThemesModule {
+};
+ThemesModule = __decorate([
+    Module({
+        imports: [StorageModule],
+        providers: [ThemesService, ThemeDeliveryService],
+        exports: [ThemesService, ThemeDeliveryService],
+    })
+], ThemesModule);
+export { ThemesModule };

package/dist/themes/themes.schemas.d.ts

@@ -0,0 +1,3 @@
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** The theme routes the Platform operations mirror (`check:platform-ops` keys). */
+export declare const THEME_ROUTES: readonly RouteSchemas[];

package/dist/themes/themes.schemas.js

@@ -0,0 +1,2 @@
+/** The theme routes the Platform operations mirror (`check:platform-ops` keys). */
+export const THEME_ROUTES = [{ route: "GET /api/v1/orgs/:orgId/themes" }];

package/dist/themes/themes.service.d.ts

@@ -0,0 +1,50 @@
+import type { LocalizedName } from "@capybara-hq/plugin-sdk";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { type ListedTheme, type ThemeRef } from "./theme-state.js";
+/** `GET /api/v1/orgs/:orgId/themes` (themes spec §9). */
+export interface OrgThemes {
+    /** The themes on in the org, by English name. */
+    themes: ListedTheme[];
+    /** The viewer's theme ({@link ThemesService.resolve}); null: the built-in theme. */
+    resolved: ThemeRef | null;
+    /**
+     * The org's setting as stored: its default (null: follow the platform) and the personal lock.
+     * The stored id may name a theme absent from `themes` (it went off in the org after it was
+     * chosen; resolution skips it): the UI shows it as unavailable, not as selected.
+     */
+    org: {
+        id: string | null;
+        personal: "allowed" | "locked";
+    };
+}
+/**
+ * Which theme applies (themes spec §7) and the org's theme listing. Read-only; the levels are
+ * written by their settings services (deployment, org, person), which check availability with the
+ * same predicates (`theme-state.ts`).
+ */
+export declare class ThemesService {
+    private readonly db;
+    constructor(db: KernelDb);
+    /** The themes on in the org with their references and swatches, by English name then id. */
+    listForOrg(orgId: string): Promise<ListedTheme[]>;
+    /**
+     * The theme of a signed-in page in the org (spec §7): the person's pick if it is on in the org
+     * and the org does not lock; else the org's default if on; else the platform default if on in
+     * the org; else null (the built-in theme). An unavailable choice is skipped, never an error.
+     * `accountId` null (a service token): no personal pick.
+     */
+    resolve(orgId: string, accountId: string | null): Promise<ThemeRef | null>;
+    /** The platform default for pages before sign-in, when it is still eligible (spec §7); else null. */
+    platformDefault(): Promise<ThemeRef | null>;
+    /**
+     * The listing, the viewer's resolved theme and the org's setting. Separate reads, not one
+     * snapshot: a change committed between them shows at the next read.
+     */
+    forOrg(orgId: string, accountId: string | null): Promise<OrgThemes>;
+    /** A live theme's name (the super admin's summaries); null when there is no such theme. */
+    nameOf(id: string): Promise<LocalizedName | null>;
+    /** Theme `id`'s name if it is on in the org, else null (a summary never names another org's theme). */
+    nameIn(orgId: string, id: string): Promise<LocalizedName | null>;
+    /** Theme `id`'s name if it is on in one of the person's orgs, else null (same reason). */
+    nameForAccount(accountId: string, id: string): Promise<LocalizedName | null>;
+}

package/dist/themes/themes.service.js

@@ -0,0 +1,99 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { readUiTheme } from "../identity/settings.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { DEFAULT_ORG_THEME, readOrgSettings } from "../orgs/settings.service.js";
+import { eligiblePlatformDefault, themeDefinitions, themeOnForAccount, themeOnIn, themeRefOf, themeSwatches, themesOnIn, } from "./theme-state.js";
+/**
+ * Which theme applies (themes spec §7) and the org's theme listing. Read-only; the levels are
+ * written by their settings services (deployment, org, person), which check availability with the
+ * same predicates (`theme-state.ts`).
+ */
+let ThemesService = class ThemesService {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** The themes on in the org with their references and swatches, by English name then id. */
+    async listForOrg(orgId) {
+        const on = await themesOnIn(this.db.db, orgId);
+        const defs = await themeDefinitions(this.db.db, on.map((c) => c.id));
+        const out = [];
+        for (const c of on) {
+            const d = defs.get(c.id);
+            if (!d)
+                continue;
+            out.push({
+                ...themeRefOf(c.id, d.version, d.definition, d.plugin),
+                swatches: themeSwatches(d.definition),
+            });
+        }
+        return out.sort((a, b) => a.name.en < b.name.en ? -1 : a.name.en > b.name.en ? 1 : a.id < b.id ? -1 : 1);
+    }
+    /**
+     * The theme of a signed-in page in the org (spec §7): the person's pick if it is on in the org
+     * and the org does not lock; else the org's default if on; else the platform default if on in
+     * the org; else null (the built-in theme). An unavailable choice is skipped, never an error.
+     * `accountId` null (a service token): no personal pick.
+     */
+    async resolve(orgId, accountId) {
+        return (await this.forOrg(orgId, accountId)).resolved;
+    }
+    /** The platform default for pages before sign-in, when it is still eligible (spec §7); else null. */
+    async platformDefault() {
+        const { id } = await readUiTheme(this.db.db);
+        if (id === null || (await eligiblePlatformDefault(this.db.db, id)) === null)
+            return null;
+        const d = (await themeDefinitions(this.db.db, [id])).get(id);
+        return d ? themeRefOf(id, d.version, d.definition, d.plugin) : null;
+    }
+    /**
+     * The listing, the viewer's resolved theme and the org's setting. Separate reads, not one
+     * snapshot: a change committed between them shows at the next read.
+     */
+    async forOrg(orgId, accountId) {
+        const themes = await this.listForOrg(orgId);
+        const org = (await readOrgSettings(this.db.db, orgId)).theme ?? DEFAULT_ORG_THEME;
+        const pick = accountId === null || org.personal === "locked"
+            ? null
+            : ((await this.db
+                .selectFrom("accounts")
+                .select("theme")
+                .where("id", "=", accountId)
+                .executeTakeFirst())?.theme ?? null);
+        const platform = (await readUiTheme(this.db.db)).id;
+        const on = (id) => (id === null ? undefined : themes.find((t) => t.id === id));
+        const hit = on(pick) ?? on(org.id) ?? on(platform);
+        let resolved = null;
+        if (hit) {
+            const { swatches: _swatches, ...ref } = hit;
+            resolved = ref;
+        }
+        return { themes, resolved, org: { id: org.id, personal: org.personal } };
+    }
+    /** A live theme's name (the super admin's summaries); null when there is no such theme. */
+    async nameOf(id) {
+        return (await themeDefinitions(this.db.db, [id])).get(id)?.definition.name ?? null;
+    }
+    /** Theme `id`'s name if it is on in the org, else null (a summary never names another org's theme). */
+    async nameIn(orgId, id) {
+        return (await themeOnIn(this.db.db, orgId, id)) ? this.nameOf(id) : null;
+    }
+    /** Theme `id`'s name if it is on in one of the person's orgs, else null (same reason). */
+    async nameForAccount(accountId, id) {
+        return (await themeOnForAccount(this.db.db, accountId, id)) ? this.nameOf(id) : null;
+    }
+};
+ThemesService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb))
+], ThemesService);
+export { ThemesService };

package/dist/time-zone.d.ts

@@ -0,0 +1,5 @@
+import { z } from "zod";
+/** Whether `tz` is an IANA time zone this runtime knows (run context spec §3.3, §3.4). */
+export declare function isTimeZone(tz: string): boolean;
+/** An IANA time zone name, checked with `Intl.DateTimeFormat`. */
+export declare const IanaTimeZone: z.ZodString;

package/dist/time-zone.js

@@ -0,0 +1,19 @@
+import { z } from "zod";
+/** Whether `tz` is an IANA time zone this runtime knows (run context spec §3.3, §3.4). */
+export function isTimeZone(tz) {
+    if (tz === "" || tz.length > 64)
+        return false;
+    try {
+        new Intl.DateTimeFormat("en", { timeZone: tz });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** An IANA time zone name, checked with `Intl.DateTimeFormat`. */
+export const IanaTimeZone = z
+    .string()
+    .min(1)
+    .max(64)
+    .refine(isTimeZone, "must be an IANA time zone name, such as Asia/Shanghai");

package/dist/tools/admin-connectors.d.ts

@@ -0,0 +1,69 @@
+import { KernelDb } from "../infra/database/kernel-db.js";
+import type { ToolPolicy } from "./registry.js";
+/** One connector in the super admin's cross-org list (no endpoint, auth or credential). */
+export interface AdminConnectorRow {
+    id: string;
+    orgId: string;
+    orgName: string;
+    name: string;
+    slug: string;
+    /** The connector extension (e.g. `mcp`, `openapi`). */
+    connector: string;
+    status: "active" | "disabled";
+    platformTemplateId: string | null;
+    /** The platform connector template's name (its template id in the plugin), when it exists. */
+    templateName: string | null;
+    catalogItemId: string | null;
+    /** Counts every tool row of the connector, pending and missing ones included. */
+    toolCount: number;
+    toolsSyncedAt: Date | null;
+    createdBy: string;
+    createdByName: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/**
+ * The super admin's read-only connector detail. Never a credential, token or secret value, and
+ * not whether any member has a credential: `auth` is the type and ownership only.
+ */
+export interface AdminConnectorDetail extends AdminConnectorRow {
+    /** Through {@link endpointView}: large text fields as their size and sha256 only. */
+    endpoint: unknown;
+    auth: {
+        type: string;
+        ownership: "org" | "personal" | null;
+    };
+    tools: {
+        name: string;
+        title: string | null;
+        status: "enabled" | "disabled" | "pending_review";
+        defaultPolicy: ToolPolicy;
+    }[];
+}
+export interface AdminConnectorQuery {
+    orgId?: string | undefined;
+    status?: "active" | "disabled" | undefined;
+    /** A case-insensitive substring of the connector name. */
+    q?: string | undefined;
+    /** The last id of the previous page. */
+    after?: string | undefined;
+    limit: number;
+}
+/**
+ * Cross-org reads of connectors for the super admin (spec
+ * 2026-11-10-admin-agents-connectors-design.md §3.4, §3.5). Only live connectors of live orgs;
+ * the caller checks the super admin.
+ */
+export declare class AdminConnectors {
+    private readonly kdb;
+    constructor(kdb: KernelDb);
+    private get db();
+    private base;
+    /** Live connectors of every live org by id, filtered; `next` is the last id when more follow. */
+    list(q: AdminConnectorQuery): Promise<{
+        connectors: AdminConnectorRow[];
+        next: string | null;
+    }>;
+    /** One live connector of a live org; else `connector.not_found`. */
+    get(connectorId: string): Promise<AdminConnectorDetail>;
+}

package/dist/tools/admin-connectors.js

@@ -0,0 +1,135 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { ApiError } from "../errors.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { endpointView } from "./endpoint.js";
+const notFound = () => new ApiError("connector.not_found", "Connector not found");
+/**
+ * Cross-org reads of connectors for the super admin (spec
+ * 2026-11-10-admin-agents-connectors-design.md §3.4, §3.5). Only live connectors of live orgs;
+ * the caller checks the super admin.
+ */
+let AdminConnectors = class AdminConnectors {
+    kdb;
+    constructor(kdb) {
+        this.kdb = kdb;
+    }
+    get db() {
+        return this.kdb.db;
+    }
+    base() {
+        return this.db
+            .selectFrom("connectors as c")
+            .innerJoin("orgs as o", "o.id", "c.org_id")
+            .innerJoin("accounts as a", "a.id", "c.created_by")
+            .leftJoin("platform_connector_templates as pt", "pt.id", "c.platform_template_id")
+            .select([
+            "c.id",
+            "c.org_id",
+            "o.name as org_name",
+            "c.name",
+            "c.slug",
+            "c.connector",
+            "c.status",
+            "c.platform_template_id",
+            "pt.template_id as template_name",
+            "c.catalog_item_id",
+            "c.tools_synced_at",
+            "c.created_by",
+            "a.display_name as created_by_name",
+            "c.created_at",
+            "c.updated_at",
+            sql `(SELECT count(*)::int FROM capybara.connector_tools t
+          WHERE t.connector_id = c.id)`.as("tool_count"),
+        ])
+            .where("c.deleted_at", "is", null)
+            .where("o.deleted_at", "is", null);
+    }
+    /** Live connectors of every live org by id, filtered; `next` is the last id when more follow. */
+    async list(q) {
+        let query = this.base();
+        if (q.orgId !== undefined)
+            query = query.where("c.org_id", "=", q.orgId);
+        if (q.status !== undefined)
+            query = query.where("c.status", "=", q.status);
+        if (q.q !== undefined && q.q !== "") {
+            const like = `%${q.q.replace(/[\\%_]/g, (ch) => `\\${ch}`)}%`;
+            query = query.where(sql `c.name ILIKE ${like} ESCAPE '\\'`);
+        }
+        if (q.after !== undefined)
+            query = query.where("c.id", ">", q.after);
+        const rows = await query
+            .orderBy("c.id")
+            .limit(q.limit + 1)
+            .execute();
+        const page = rows.slice(0, q.limit).map(toRow);
+        return {
+            connectors: page,
+            next: rows.length > q.limit ? (page[page.length - 1]?.id ?? null) : null,
+        };
+    }
+    /** One live connector of a live org; else `connector.not_found`. */
+    async get(connectorId) {
+        const r = await this.base()
+            .select(["c.endpoint", "c.auth"])
+            .where("c.id", "=", connectorId)
+            .executeTakeFirst();
+        if (!r)
+            throw notFound();
+        const tools = await this.db
+            .selectFrom("connector_tools")
+            .select(["name", "spec", "status", "default_policy"])
+            .where("connector_id", "=", connectorId)
+            .orderBy("name")
+            .execute();
+        const auth = r.auth;
+        return {
+            ...toRow(r),
+            endpoint: endpointView(r.endpoint),
+            auth: { type: auth.type, ownership: auth.type === "none" ? null : auth.ownership },
+            tools: tools.map((t) => {
+                const title = t.spec.title;
+                return {
+                    name: t.name,
+                    title: typeof title === "string" ? title : null,
+                    status: t.status,
+                    defaultPolicy: t.default_policy,
+                };
+            }),
+        };
+    }
+};
+AdminConnectors = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb))
+], AdminConnectors);
+export { AdminConnectors };
+function toRow(r) {
+    return {
+        id: r.id,
+        orgId: r.org_id,
+        orgName: r.org_name,
+        name: r.name,
+        slug: r.slug,
+        connector: r.connector,
+        status: r.status,
+        platformTemplateId: r.platform_template_id ?? null,
+        templateName: r.template_name ?? null,
+        catalogItemId: r.catalog_item_id ?? null,
+        toolCount: r.tool_count,
+        toolsSyncedAt: r.tools_synced_at,
+        createdBy: r.created_by,
+        createdByName: r.created_by_name,
+        createdAt: r.created_at,
+        updatedAt: r.updated_at,
+    };
+}

package/dist/tools/approvals.controller.js

@@ -14,10 +14,9 @@ import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZQuery } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
 import { CONTROL_OR_HIDDEN_RE } from "../text.js";
+import { ApprovalsListQuerySchema } from "./approvals.schemas.js";
 import { APPROVAL_DENY_REASON_MAX_CHARS, ApprovalsService, } from "./approvals.service.js";
-const ListQuery = z
-    .object({ status: z.enum(["pending", "approved", "denied", "expired", "cancelled"]).optional() })
-    .strict();
+const ListQuery = ApprovalsListQuerySchema;
 const DecisionBody = z
     .object({
     decision: z.enum(["approve", "deny"]),

package/dist/tools/approvals.schemas.d.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** `GET /approvals?status=`: absent lists every status. */
+export declare const ApprovalsListQuerySchema: z.ZodObject<{
+    status: z.ZodOptional<z.ZodEnum<{
+        approved: "approved";
+        cancelled: "cancelled";
+        denied: "denied";
+        expired: "expired";
+        pending: "pending";
+    }>>;
+}, z.core.$strict>;
+/** `:id` of `GET /approvals/:id`, as the route takes it (`@Param`). */
+export declare const ApprovalPathParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The approval reads a Platform operation mirrors. Deciding (`POST /approvals/:id/decision`) is a
+ * person's act and stays excluded (spec §6.4, §14.1 item 2), so it has no entry here.
+ */
+export declare const APPROVAL_ROUTES: readonly RouteSchemas[];

package/dist/tools/approvals.schemas.js

@@ -0,0 +1,15 @@
+import { z } from "zod";
+/** `GET /approvals?status=`: absent lists every status. */
+export const ApprovalsListQuerySchema = z
+    .object({ status: z.enum(["pending", "approved", "denied", "expired", "cancelled"]).optional() })
+    .strict();
+/** `:id` of `GET /approvals/:id`, as the route takes it (`@Param`). */
+export const ApprovalPathParams = z.object({ id: z.string() });
+/**
+ * The approval reads a Platform operation mirrors. Deciding (`POST /approvals/:id/decision`) is a
+ * person's act and stays excluded (spec §6.4, §14.1 item 2), so it has no entry here.
+ */
+export const APPROVAL_ROUTES = [
+    { route: "GET /api/v1/orgs/:orgId/approvals", query: ApprovalsListQuerySchema },
+    { route: "GET /api/v1/orgs/:orgId/approvals/:id", params: ApprovalPathParams },
+];