@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.25

package/dist/extensions/point-defaults.js

@@ -17,7 +17,7 @@ import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { EffectiveConfigs } from "./effective-config.js";
 import { enabledExtensionsQuery, isExtensionEnabled } from "./enabled.js";
-import { OrgExtensionConfigs } from "./org-config.js";
+import { OrgConfigInvalidError, OrgExtensionConfigs } from "./org-config.js";
 import { ExtensionRegistry } from "./registry.js";
 /** The extension points whose provider each org chooses (`selection: "org-default"`). */
 function selectionPoints() {
@@ -58,7 +58,7 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
         if (!hasSelection(point)) {
             throw new Error(`extension point ${point} has no org-default selection`);
         }
-        const candidates = await this.candidates(orgId, point);
+        const { candidates } = await this.candidates(orgId, point);
         const chosen = await this.choose(orgId, point, candidates);
         if (!chosen.ok)
             return chosen;
@@ -71,12 +71,33 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
             config: c.config,
         };
     }
+    /**
+     * Every provider of `point` (the name without the major, e.g. `context`) that could serve
+     * `orgId` now, in extension-name order: the same candidates {@link resolve} chooses from (loaded
+     * here, enabled in the org, valid org and effective config, `configured()` not false), for
+     * points whose every enabled provider is used (no `selection`). `failed`: the providers enabled
+     * in the org whose status could not be read (reading a config or `configured()` threw, e.g. a
+     * transient database error); they are neither serving nor known to be off. An invalid stored
+     * org config ({@link OrgConfigInvalidError}) is not a read error: that provider is off.
+     */
+    async providersFor(orgId, point) {
+        const { candidates, failed } = await this.candidates(orgId, point);
+        return {
+            providers: candidates.map((c) => ({
+                extension: c.extension,
+                impl: c.impl,
+                orgConfig: c.orgConfig,
+                config: c.config,
+            })),
+            failed,
+        };
+    }
     /** Every `org-default` point with its candidates, stored default and effective provider. */
     async list(orgId) {
         const stored = await this.storedDefaults(orgId);
         const out = [];
         for (const point of selectionPoints()) {
-            const candidates = await this.candidates(orgId, point);
+            const { candidates } = await this.candidates(orgId, point);
             const chosen = pick(candidates, stored.get(point));
             out.push({
                 point,
@@ -128,7 +149,11 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
             detail: { point, extension, ...auditDetail },
         });
     }
-    /** The candidates of `point` in `orgId`, by extension name. */
+    /**
+     * The candidates of `point` in `orgId`, by extension name, and the enabled providers whose status
+     * could not be read (a read or `configured()` threw: excluded, logged). A provider whose stored
+     * org config or effective config is invalid is excluded but not `failed`: it is known to be off.
+     */
     async candidates(orgId, point) {
         const db = this.kdb.db;
         const enabled = new Set((await db
@@ -141,18 +166,21 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
                 providers.set(e.plugin, e.impl);
         }
         const out = [];
+        const failed = new Set();
         for (const [extension, impl] of providers) {
             let cfg;
             try {
                 cfg = await this.orgConfigs.get(orgId, extension);
             }
             catch (err) {
-                this.log.warn("org default provider: provider excluded, its org config is invalid", {
-                    orgId,
-                    point,
-                    extension,
-                    err,
-                });
+                // a stored org config that no longer validates is a known state: the provider is off
+                // (as for an invalid effective config below); only a read that failed is `failed`
+                const invalid = err instanceof OrgConfigInvalidError;
+                this.log.warn(invalid
+                    ? "extension point provider excluded, its stored org config is invalid"
+                    : "extension point provider excluded, cannot read its org config", { orgId, point, extension, err });
+                if (!invalid)
+                    failed.add(extension);
                 continue;
             }
             if (!cfg?.enabled)
@@ -163,12 +191,13 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
                 effective = await this.effective.get(orgId, extension);
             }
             catch (err) {
-                this.log.warn("org default provider: provider excluded, cannot read its effective config", {
+                this.log.warn("extension point provider excluded, cannot read its effective config", {
                     orgId,
                     point,
                     extension,
                     err,
                 });
+                failed.add(extension);
                 continue;
             }
             if (!effective.ok)
@@ -181,12 +210,13 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
                     ok = configured.call(impl, cfg.config, effective.config) !== false;
                 }
                 catch (err) {
-                    this.log.warn("org default provider: provider excluded, configured() threw", {
+                    this.log.warn("extension point provider excluded, configured() threw", {
                         orgId,
                         point,
                         extension,
                         err,
                     });
+                    failed.add(extension);
                     continue;
                 }
                 if (!ok)
@@ -194,7 +224,8 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
             }
             out.push({ extension, impl, orgConfig: cfg.config, config: effective.config });
         }
-        return out.sort((a, b) => (a.extension < b.extension ? -1 : a.extension > b.extension ? 1 : 0));
+        out.sort((a, b) => (a.extension < b.extension ? -1 : a.extension > b.extension ? 1 : 0));
+        return { candidates: out, failed };
     }
     async choose(orgId, point, candidates) {
         if (candidates.length < 2)

package/dist/inbox/inbox.service.d.ts

@@ -6,34 +6,20 @@ import { ApprovalsService, type ApprovalView } from "../tools/approvals.service.
 import type { OrgNoticeDetails } from "./org-notices.js";
 /** The most open org notices one inbox read returns. */
 export declare const ORG_NOTICES_LIST_MAX = 100;
-/** The skill the platform components migration renamed (`skill_renamed`). */
-export interface SkillRenamedDetail {
-    skillId: string;
-    from: string;
-    to: string;
-    platformSkillId: string;
-    plugin: string | null;
-}
 /**
- * A notice for the org's admins (`org_notices`), shown until one of them dismisses it; `kind`
- * picks the detail field that is set:
- * - `skill_renamed` (`skillRenamed`): the platform components migration renamed an org skill whose
- *   name a platform skill on in the org has; agents keep it, by id;
- * - `item_shared`, `shared_item_updated`, `upload_confirmed`, `upload_rejected` (`detail`): the
- *   shapes of {@link OrgNoticeDetails} (plugin scope phase 3, P3-22).
+ * A notice for the org's admins (`org_notices`), shown until one of them dismisses it:
+ * `item_shared`, `shared_item_updated`, `upload_confirmed`, `upload_rejected`, `detail` in the
+ * shape of {@link OrgNoticeDetails} (plugin scope phase 3, P3-22).
  */
 export type OrgNoticeView = {
     id: string;
     createdAt: string;
-} & ({
-    kind: "skill_renamed";
-    skillRenamed: SkillRenamedDetail;
-} | {
+} & {
     [K in keyof OrgNoticeDetails]: {
         kind: K;
         detail: OrgNoticeDetails[K];
     };
-}[keyof OrgNoticeDetails]);
+}[keyof OrgNoticeDetails];
 /** 收件箱一次最多返回的事项数。 */
 export declare const INBOX_MAX_ITEMS = 100;
 /**
@@ -51,7 +37,7 @@ export declare const INBOX_MAX_ITEMS = 100;
  * - `schedule_attention`: the current user's own scheduled task that needs them (spec §8): paused
  *   for any reason but their own pause, its latest run failed, or its latest run was refused tools
  *   or connections; derived live, gone once the task is resumed or runs clean;
- * - the org notices (`skill_renamed`, `item_shared`, `shared_item_updated`, `upload_confirmed`,
+ * - the org notices (`item_shared`, `shared_item_updated`, `upload_confirmed`,
  *   `upload_rejected`; `type` = the notice's kind): for org admins, until one dismisses it
  *   (`POST inbox/notices/:id/dismiss`).
  */

package/dist/inbox/inbox.service.js

@@ -112,9 +112,6 @@ let InboxService = class InboxService {
             .execute();
         return rows.map((r) => {
             const base = { id: r.id, createdAt: r.created_at.toISOString() };
-            if (r.kind === "skill_renamed") {
-                return { ...base, kind: r.kind, skillRenamed: r.detail };
-            }
             return { ...base, kind: r.kind, detail: r.detail };
         });
     }

package/dist/inbox/org-notices.d.ts

@@ -1,7 +1,7 @@
 import { type OwnedRef, type Owner } from "../catalog/ownership.js";
 import type { KernelSchemaDb, OrgNoticeKind } from "../db/kernel-schema.js";
 export type { OrgNoticeKind };
-/** The `detail` of each notice kind except `skill_renamed` (written by the platform migration). */
+/** The `detail` of each notice kind. */
 export interface OrgNoticeDetails {
     /** An org was added to the item's list, or its scope widened (`all_orgs`). */
     /** `displayName`: a plugin's display name, which the inbox names it by (null otherwise). */

package/dist/inbox/platform-inbox.service.d.ts

@@ -8,11 +8,6 @@ import type { PlatformNoticeDetails } from "./platform-notices.js";
 export declare const PLATFORM_INBOX_MAX_ITEMS = 100;
 /** The most open scope sync failures one read takes. */
 export declare const SCOPE_SYNC_FAILURES_LIST_MAX = 200;
-/**
- * A platform components migration run unfinished this long after its start is stuck (its worker
- * stopped mid-run; a run takes seconds, and the next one starts at the next worker start or day).
- */
-export declare const MIGRATION_RUN_STUCK_MS: number;
 /**
  * An open failure of the plugin scope sync: its last attempt to install the plugin in the org, to
  * uninstall it, or to install the dependencies a platform update added (`dependencies`) failed,
@@ -34,18 +29,6 @@ export interface ScopeSyncFailureView {
     message: string;
     failedAt: string;
 }
-/**
- * The latest platform components migration run (`platform_migration_runs`) when it needs a look:
- * finished with catalog items whose components could not be written (`itemsFailed`,
- * `<name>@<version>`), or `stuck` (unfinished {@link MIGRATION_RUN_STUCK_MS} after its start).
- */
-export interface MigrationRunView {
-    id: string;
-    startedAt: string;
-    finishedAt: string | null;
-    stuck: boolean;
-    itemsFailed: string[];
-}
 /**
  * One item of the super admin's inbox (by `type`). Nothing is decided in the inbox: each item is
  * acted on where it lives (the web links to it).
@@ -56,7 +39,6 @@ export interface MigrationRunView {
  * - `org_upload_pending`: an org-owned plugin whose uploaded version (with an extension) waits for
  *   the super admin in 待确认 (ruling P3-22; confirmed or rejected there), `id` = the item's;
  * - `scope_sync_failed`: an open scope sync failure, `id` = `<itemId>/<orgId>`;
- * - `platform_migration`: the latest migration run, failed items or stuck, `id` = the run's;
  * - `ownership_transferred`: a deleted org's shared item now belongs to the platform, until a
  *   super admin dismisses it (`POST admin/inbox/notices/:id/dismiss`).
  */
@@ -80,11 +62,6 @@ export type PlatformInboxItem = {
     id: string;
     createdAt: string;
     failure: ScopeSyncFailureView;
-} | {
-    type: "platform_migration";
-    id: string;
-    createdAt: string;
-    run: MigrationRunView;
 } | {
     type: "ownership_transferred";
     id: string;
@@ -92,7 +69,7 @@ export type PlatformInboxItem = {
     notice: PlatformNoticeView;
 };
 /** Every {@link PlatformInboxItem} type, in the order the admin overview lists them. */
-export declare const PLATFORM_INBOX_TYPES: readonly ["catalog_request", "permission_confirmation", "org_upload_pending", "scope_sync_failed", "platform_migration", "ownership_transferred"];
+export declare const PLATFORM_INBOX_TYPES: readonly ["catalog_request", "permission_confirmation", "org_upload_pending", "scope_sync_failed", "ownership_transferred"];
 /** How many items of each type wait: every type, zeros included. */
 export type PlatformInboxCounts = Record<PlatformInboxItem["type"], number>;
 /** An open platform notice (`platform_notices`, kind `ownership_transferred`). */
@@ -116,8 +93,8 @@ export interface PlatformInboxView {
 /**
  * The super admin's inbox (plugin scope spec §5.1 rule 5, §13.5): what waits on the platform,
  * gathered from the sources the admin pages read (the 待确认 tab's requests and permission
- * confirmations), plus the scope sync's open failures and the platform components migration's
- * latest run. Stateless, read live from PG.
+ * confirmations), plus the scope sync's open failures and the platform notices. Stateless, read
+ * live from PG.
  */
 export declare class PlatformInboxService {
     private readonly requests;
@@ -148,10 +125,4 @@ export declare class PlatformInboxService {
     private countScopeSyncFailures;
     /** The open scope sync failures ({@link failureRows}), newest first. */
     private scopeSyncFailures;
-    /**
-     * The latest migration run when it needs a look (see {@link MigrationRunView}); null when it
-     * finished without failed items, is still running, or there was none. An earlier run's failure
-     * is not shown: each run tries every unwritten item again.
-     */
-    private migrationRun;
 }

package/dist/inbox/platform-inbox.service.js

@@ -17,11 +17,6 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 export const PLATFORM_INBOX_MAX_ITEMS = 100;
 /** The most open scope sync failures one read takes. */
 export const SCOPE_SYNC_FAILURES_LIST_MAX = 200;
-/**
- * A platform components migration run unfinished this long after its start is stuck (its worker
- * stopped mid-run; a run takes seconds, and the next one starts at the next worker start or day).
- */
-export const MIGRATION_RUN_STUCK_MS = 60 * 60_000;
 /** Plugin install statuses of a plugin that is on in the org. */
 const LIVE_INSTALL = ["installing", "installed", "upgrading"];
 /** Every {@link PlatformInboxItem} type, in the order the admin overview lists them. */
@@ -30,14 +25,13 @@ export const PLATFORM_INBOX_TYPES = [
     "permission_confirmation",
     "org_upload_pending",
     "scope_sync_failed",
-    "platform_migration",
     "ownership_transferred",
 ];
 /**
  * The super admin's inbox (plugin scope spec §5.1 rule 5, §13.5): what waits on the platform,
  * gathered from the sources the admin pages read (the 待确认 tab's requests and permission
- * confirmations), plus the scope sync's open failures and the platform components migration's
- * latest run. Stateless, read live from PG.
+ * confirmations), plus the scope sync's open failures and the platform notices. Stateless, read
+ * live from PG.
  */
 let PlatformInboxService = class PlatformInboxService {
     requests;
@@ -49,13 +43,12 @@ let PlatformInboxService = class PlatformInboxService {
         this.kdb = kdb;
     }
     async list() {
-        const [requests, requestCount, pending, failures, failureCount, run, notices, noticeCount] = await Promise.all([
+        const [requests, requestCount, pending, failures, failureCount, notices, noticeCount] = await Promise.all([
             this.requests.listDeployment(),
             this.requests.countPendingDeployment(),
             this.catalog.list({ pending: true }),
             this.scopeSyncFailures(),
             this.countScopeSyncFailures(),
-            this.migrationRun(),
             this.notices(),
             this.countNotices(),
         ]);
@@ -84,16 +77,6 @@ let PlatformInboxService = class PlatformInboxService {
                 createdAt: n.createdAt,
                 notice: n,
             })),
-            ...(run === null
-                ? []
-                : [
-                    {
-                        type: "platform_migration",
-                        id: run.id,
-                        createdAt: run.finishedAt ?? run.startedAt,
-                        run,
-                    },
-                ]),
         ];
         // newest first; equal times by id (a stable order)
         all.sort((a, b) => a.createdAt !== b.createdAt
@@ -111,7 +94,6 @@ let PlatformInboxService = class PlatformInboxService {
             permission_confirmation: pending.length - orgUploads,
             org_upload_pending: orgUploads,
             scope_sync_failed: failureCount,
-            platform_migration: run === null ? 0 : 1,
             ownership_transferred: noticeCount,
         };
         const total = Object.values(byType).reduce((a, b) => a + b, 0);
@@ -123,14 +105,13 @@ let PlatformInboxService = class PlatformInboxService {
      * requests and the failures; the permission confirmations are the catalog's pending list).
      */
     async count() {
-        const [requests, pending, failures, run, notices] = await Promise.all([
+        const [requests, pending, failures, notices] = await Promise.all([
             this.requests.countPendingDeployment(),
             this.catalog.list({ pending: true }),
             this.countScopeSyncFailures(),
-            this.migrationRun(),
             this.countNotices(),
         ]);
-        return requests + pending.length + failures + (run === null ? 0 : 1) + notices;
+        return requests + pending.length + failures + notices;
     }
     async countNotices() {
         const r = await this.kdb.db
@@ -240,36 +221,6 @@ let PlatformInboxService = class PlatformInboxService {
             failedAt: r.failed_at.toISOString(),
         }));
     }
-    /**
-     * The latest migration run when it needs a look (see {@link MigrationRunView}); null when it
-     * finished without failed items, is still running, or there was none. An earlier run's failure
-     * is not shown: each run tries every unwritten item again.
-     */
-    async migrationRun() {
-        const run = await this.kdb.db
-            .selectFrom("platform_migration_runs")
-            .select(["id", "started_at", "finished_at", "stats"])
-            .orderBy("started_at", "desc")
-            .orderBy("id", "desc")
-            .limit(1)
-            .executeTakeFirst();
-        if (run === undefined)
-            return null;
-        const failed = run.stats.itemsFailed;
-        const itemsFailed = Array.isArray(failed)
-            ? failed.filter((x) => typeof x === "string")
-            : [];
-        const stuck = run.finished_at === null && run.started_at.getTime() < Date.now() - MIGRATION_RUN_STUCK_MS;
-        if (!stuck && (run.finished_at === null || itemsFailed.length === 0))
-            return null;
-        return {
-            id: run.id,
-            startedAt: run.started_at.toISOString(),
-            finishedAt: run.finished_at?.toISOString() ?? null,
-            stuck,
-            itemsFailed,
-        };
-    }
 };
 PlatformInboxService = __decorate([
     Injectable(),

package/dist/infra/outbox/registry.d.ts

@@ -66,6 +66,37 @@ export declare const OUTBOX_JOBS: {
             readonly removeOnFail: true;
         };
     };
+    readonly "run-stop": {
+        readonly queue: "cap-kernel-maintenance";
+        readonly idempotent: "stopping a finished run is a no-op";
+        readonly processedIn: "packages/kernel/src/runtime/maintenance.ts";
+        readonly opts: {
+            readonly attempts: 5;
+            readonly backoff: {
+                readonly type: "exponential";
+                readonly delay: 5000;
+            };
+            readonly removeOnComplete: true;
+            readonly removeOnFail: {
+                readonly age: number;
+                readonly count: 1000;
+            };
+        };
+    };
+    readonly "sandbox-destroy-for": {
+        readonly queue: "cap-kernel-maintenance";
+        readonly idempotent: "destroying a destroyed device is a no-op";
+        readonly processedIn: "packages/kernel/src/runtime/maintenance.ts";
+        readonly opts: {
+            readonly attempts: 5;
+            readonly backoff: {
+                readonly type: "exponential";
+                readonly delay: 30000;
+            };
+            readonly removeOnComplete: true;
+            readonly removeOnFail: 100;
+        };
+    };
     readonly "deliver-to-parent": {
         readonly queue: "cap-kernel-maintenance";
         readonly idempotent: "the delivery's idempotency key is the child run id";
@@ -114,6 +145,99 @@ export declare const OUTBOX_JOBS: {
             readonly removeOnFail: true;
         };
     };
+    readonly "scope-item": {
+        readonly queue: "cap-kernel-plugin-scope";
+        readonly idempotent: "the sync converges each (item, org) from the scope, switches and installs it reads under the org's lock, and the installer re-checks under the org row lock, so a second run changes nothing";
+        readonly processedIn: "packages/kernel/src/catalog/scope-sync-workers.ts";
+        readonly opts: {
+            readonly attempts: 1;
+            readonly removeOnComplete: true;
+            readonly removeOnFail: true;
+        };
+    };
+    readonly "scope-item-backstop": {
+        readonly queue: "cap-kernel-plugin-scope";
+        readonly idempotent: "the sync converges each (item, org) from what it reads, as a scope-item job does, so a run after the immediate job changes nothing";
+        readonly processedIn: "packages/kernel/src/catalog/scope-sync-workers.ts";
+        readonly opts: {
+            readonly attempts: 5;
+            readonly backoff: {
+                readonly type: "exponential";
+                readonly delay: 60000;
+            };
+            readonly removeOnComplete: true;
+            readonly removeOnFail: true;
+        };
+    };
+    readonly "scope-org": {
+        readonly queue: "cap-kernel-plugin-scope";
+        readonly idempotent: "the sync converges each (item, org) of the org from what it reads, so a second run changes nothing";
+        readonly processedIn: "packages/kernel/src/catalog/scope-sync-workers.ts";
+        readonly opts: {
+            readonly attempts: 1;
+            readonly removeOnComplete: true;
+            readonly removeOnFail: true;
+        };
+    };
+    readonly "owned-plugin-cleanup": {
+        readonly queue: "cap-kernel-maintenance";
+        readonly idempotent: "the cleanup takes the extension out only while no live item uses it, and a missing install or a released claim changes nothing";
+        readonly processedIn: "packages/kernel/src/runtime/maintenance.ts";
+        readonly opts: {
+            readonly attempts: 3;
+            readonly backoff: {
+                readonly type: "exponential";
+                readonly delay: 5000;
+            };
+            readonly removeOnComplete: true;
+            readonly removeOnFail: true;
+        };
+    };
+    readonly "sched-fire": {
+        readonly queue: "cap-kernel-maintenance";
+        readonly idempotent: "a fire acts only on a pending task run, under its row lock; a retried start reuses what the first one made";
+        readonly processedIn: "packages/kernel/src/runtime/maintenance.ts";
+        readonly opts: {
+            readonly attempts: 3;
+            readonly backoff: {
+                readonly type: "exponential";
+                readonly delay: 2000;
+            };
+            readonly removeOnComplete: true;
+            readonly removeOnFail: true;
+        };
+    };
+    readonly "sched-settle": {
+        readonly queue: "cap-kernel-maintenance";
+        readonly idempotent: "a check acts only on a task run still pending (claimed for the claimed check, unclaimed for the unfired one), under the task and run row locks, so a run claimed, started, ended or skipped since is left as it is";
+        readonly processedIn: "packages/kernel/src/runtime/maintenance.ts";
+        readonly opts: {
+            readonly attempts: 5;
+            readonly backoff: {
+                readonly type: "exponential";
+                readonly delay: 5000;
+            };
+            readonly removeOnComplete: true;
+            readonly removeOnFail: true;
+        };
+    };
+    readonly lifecycle: {
+        readonly queue: "cap-kernel-lifecycle";
+        readonly idempotent: "lifecycle handlers must be idempotent (the SDK contract): they delete what the plugin holds for the removed member, agent or org, and deleting it again is a no-op";
+        readonly processedIn: "packages/kernel/src/extensions/lifecycle-hooks.ts";
+        readonly opts: {
+            readonly attempts: 15;
+            readonly backoff: {
+                readonly type: "exponential";
+                readonly delay: 2000;
+            };
+            readonly removeOnComplete: true;
+            readonly removeOnFail: {
+                readonly age: number;
+                readonly count: 1000;
+            };
+        };
+    };
 };
 export type OutboxJobName = keyof typeof OUTBOX_JOBS;
 /** The registry's BullMQ options of a job name (none for a name it does not list). */