@capybara-hq/kernel 0.1.0-rc.3 → 0.1.0-rc.4

package/dist/extensions/point-defaults.controller.js

@@ -0,0 +1,71 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Get, HttpCode, Inject, Put } from "@nestjs/common";
+import { z } from "zod";
+import { CurrentPrincipal, requireUser } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { ExtensionPointDefaults } from "./point-defaults.js";
+const PointParams = z.object({ point: z.string().min(1).max(100) });
+const DefaultBody = z.object({ extension: z.string().min(1).max(214) }).strict();
+class ExtensionPointParamsDto extends createZodDto(PointParams, "ExtensionPointParams") {
+}
+class ExtensionPointDefaultBodyDto extends createZodDto(DefaultBody, "ExtensionPointDefaultBody") {
+}
+/**
+ * The org default provider of `org-default` extension points (web tools spec §6):
+ * - `GET /api/v1/orgs/:orgId/extension-points` (`org.extensions.manage`) → `{ points }`: each
+ *   point with its candidate providers, the stored default and the effective provider;
+ * - `PUT /api/v1/orgs/:orgId/extension-points/:point/default` `{ extension }`
+ *   (`org.extensions.manage`) → 204;
+ * - `GET /api/v1/orgs/:orgId/extension-points/available` (`agents.use`) → `{ points }`: whether
+ *   each point has a provider now, without extension names (for the agent form).
+ */
+let ExtensionPointDefaultsController = class ExtensionPointDefaultsController {
+    points;
+    constructor(points) {
+        this.points = points;
+    }
+    async list(org) {
+        return { points: await this.points.list(org.orgId) };
+    }
+    async available(org) {
+        return { points: await this.points.available(org.orgId) };
+    }
+    async setDefault(principal, org, { point }, body) {
+        const p = requireUser(principal);
+        await this.points.setDefault(org.orgId, point, body.extension, p.account.id);
+    }
+};
+__decorate([
+    Get(),
+    OrgAction("org.extensions.manage"),
+    __param(0, CurrentOrg())
+], ExtensionPointDefaultsController.prototype, "list", null);
+__decorate([
+    Get("available"),
+    OrgAction("agents.use"),
+    __param(0, CurrentOrg())
+], ExtensionPointDefaultsController.prototype, "available", null);
+__decorate([
+    Put(":point/default"),
+    HttpCode(204),
+    OrgAction("org.extensions.manage"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(ExtensionPointParamsDto)),
+    __param(3, ZBody(ExtensionPointDefaultBodyDto))
+], ExtensionPointDefaultsController.prototype, "setDefault", null);
+ExtensionPointDefaultsController = __decorate([
+    Controller("api/v1/orgs/:orgId/extension-points"),
+    __param(0, Inject(ExtensionPointDefaults))
+], ExtensionPointDefaultsController);
+export { ExtensionPointDefaultsController };

package/dist/extensions/point-defaults.d.ts

@@ -0,0 +1,64 @@
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
+import { OrgExtensionConfigs } from "./org-config.js";
+import { ExtensionRegistry } from "./registry.js";
+/** The outcome of {@link ExtensionPointDefaults.resolve}. */
+export type PointResolution<T> = {
+    ok: true;
+    extension: string;
+    impl: T;
+    orgConfig: unknown;
+} | {
+    ok: false;
+    reason: "none" | "ambiguous";
+};
+/** One `org-default` extension point of an org (the admin view). */
+export interface OrgPointDefaultView {
+    point: string;
+    /** The extensions that could serve the org now, by name. */
+    candidates: string[];
+    /** The stored default, also when it is not a candidate now. */
+    default: string | null;
+    /** The extension a call would use now; null when there is none or the choice is ambiguous. */
+    effective: string | null;
+}
+/**
+ * The org default provider of an `org-default` extension point (web tools spec §6). Per call,
+ * never cached in process: the candidates are the providers loaded on this replica that are
+ * enabled in the org, whose org config is valid and whose `configured()` (when present) does not
+ * return false. One candidate is used as is; several need the org's stored default
+ * (`capybara.org_extension_point_defaults`), else the choice is ambiguous. A stored default that
+ * is not a candidate (disabled, uninstalled, unconfigured) stays and counts again once it is one.
+ */
+export declare class ExtensionPointDefaults {
+    private readonly kdb;
+    readonly txHost: TransactionHost;
+    private readonly registry;
+    private readonly orgConfigs;
+    private readonly log;
+    constructor(kdb: KernelDb, txHost: TransactionHost, registry: Pick<ExtensionRegistry, "list">, orgConfigs: Pick<OrgExtensionConfigs, "get">, log: KernelLogger);
+    /**
+     * The provider of `point` (the name without the major, e.g. `web-search`) for `orgId`, with the
+     * org's decrypted config to pass back to it. Throws when the point has no `selection`.
+     */
+    resolve<T>(orgId: string, point: string): Promise<PointResolution<T>>;
+    /** Every `org-default` point with its candidates, stored default and effective provider. */
+    list(orgId: string): Promise<OrgPointDefaultView[]>;
+    /** Whether each `org-default` point has a provider for the org now (no extension names). */
+    available(orgId: string): Promise<{
+        point: string;
+        available: boolean;
+    }[]>;
+    /**
+     * Stores `extension` as the org's default provider of `point`. 400 `validation_failed` unless
+     * the point is an `org-default` one and the extension provides it (loaded here) and is enabled
+     * in the org. Audited as `extension_point.default_set`.
+     */
+    setDefault(orgId: string, point: string, extension: string, actorId: string): Promise<void>;
+    /** The candidates of `point` in `orgId`, by extension name. */
+    private candidates;
+    private choose;
+    /** The org's stored defaults, point → extension. */
+    private storedDefaults;
+}

package/dist/extensions/point-defaults.js

@@ -0,0 +1,206 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { EXTENSION_POINTS } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { audit } from "../identity/audit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { enabledExtensionsQuery, isExtensionEnabled } from "./enabled.js";
+import { OrgExtensionConfigs } from "./org-config.js";
+import { ExtensionRegistry } from "./registry.js";
+/** The extension points whose provider each org chooses (`selection: "org-default"`). */
+function selectionPoints() {
+    return Object.entries(EXTENSION_POINTS)
+        .filter(([, info]) => info.selection === "org-default")
+        .map(([name]) => name);
+}
+const hasSelection = (point) => EXTENSION_POINTS[point]?.selection === "org-default";
+/**
+ * The org default provider of an `org-default` extension point (web tools spec §6). Per call,
+ * never cached in process: the candidates are the providers loaded on this replica that are
+ * enabled in the org, whose org config is valid and whose `configured()` (when present) does not
+ * return false. One candidate is used as is; several need the org's stored default
+ * (`capybara.org_extension_point_defaults`), else the choice is ambiguous. A stored default that
+ * is not a candidate (disabled, uninstalled, unconfigured) stays and counts again once it is one.
+ */
+let ExtensionPointDefaults = class ExtensionPointDefaults {
+    kdb;
+    txHost;
+    registry;
+    orgConfigs;
+    log;
+    constructor(kdb, txHost, registry, orgConfigs, log) {
+        this.kdb = kdb;
+        this.txHost = txHost;
+        this.registry = registry;
+        this.orgConfigs = orgConfigs;
+        this.log = log;
+    }
+    /**
+     * The provider of `point` (the name without the major, e.g. `web-search`) for `orgId`, with the
+     * org's decrypted config to pass back to it. Throws when the point has no `selection`.
+     */
+    async resolve(orgId, point) {
+        if (!hasSelection(point)) {
+            throw new Error(`extension point ${point} has no org-default selection`);
+        }
+        const candidates = await this.candidates(orgId, point);
+        const chosen = await this.choose(orgId, point, candidates);
+        if (!chosen.ok)
+            return chosen;
+        const c = chosen.candidate;
+        return { ok: true, extension: c.extension, impl: c.impl, orgConfig: c.orgConfig };
+    }
+    /** Every `org-default` point with its candidates, stored default and effective provider. */
+    async list(orgId) {
+        const stored = await this.storedDefaults(orgId);
+        const out = [];
+        for (const point of selectionPoints()) {
+            const candidates = await this.candidates(orgId, point);
+            const chosen = pick(candidates, stored.get(point));
+            out.push({
+                point,
+                candidates: candidates.map((c) => c.extension),
+                default: stored.get(point) ?? null,
+                effective: chosen.ok ? chosen.candidate.extension : null,
+            });
+        }
+        return out;
+    }
+    /** Whether each `org-default` point has a provider for the org now (no extension names). */
+    async available(orgId) {
+        const out = [];
+        for (const point of selectionPoints()) {
+            out.push({ point, available: (await this.resolve(orgId, point)).ok });
+        }
+        return out;
+    }
+    /**
+     * Stores `extension` as the org's default provider of `point`. 400 `validation_failed` unless
+     * the point is an `org-default` one and the extension provides it (loaded here) and is enabled
+     * in the org. Audited as `extension_point.default_set`.
+     */
+    async setDefault(orgId, point, extension, actorId) {
+        const db = this.kdb.db;
+        if (!hasSelection(point)) {
+            throw new ApiError("validation_failed", `${point} is not an extension point with an organization default`);
+        }
+        const provides = this.registry.list(point).some((e) => e.plugin === extension);
+        if (!provides || !(await isExtensionEnabled(db, orgId, extension))) {
+            throw new ApiError("validation_failed", `Extension ${extension} does not provide ${point} or is not enabled in this organization`);
+        }
+        await db
+            .insertInto("org_extension_point_defaults")
+            .values({ org_id: orgId, point, extension, updated_by: actorId })
+            .onConflict((oc) => oc.columns(["org_id", "point"]).doUpdateSet({
+            extension,
+            updated_by: actorId,
+            updated_at: new Date(),
+        }))
+            .execute();
+        await audit(db, {
+            actorAccountId: actorId,
+            orgId,
+            action: "extension_point.default_set",
+            target: point,
+            detail: { point, extension },
+        });
+    }
+    /** The candidates of `point` in `orgId`, by extension name. */
+    async candidates(orgId, point) {
+        const db = this.kdb.db;
+        const enabled = new Set((await db
+            .selectFrom(enabledExtensionsQuery(db, orgId).as("en"))
+            .select("en.plugin")
+            .execute()).map((r) => r.plugin));
+        const providers = new Map();
+        for (const e of this.registry.list(point)) {
+            if (enabled.has(e.plugin) && !providers.has(e.plugin))
+                providers.set(e.plugin, e.impl);
+        }
+        const out = [];
+        for (const [extension, impl] of providers) {
+            let cfg;
+            try {
+                cfg = await this.orgConfigs.get(orgId, extension);
+            }
+            catch (err) {
+                this.log.warn("org default provider: provider excluded, its org config is invalid", {
+                    orgId,
+                    point,
+                    extension,
+                    err,
+                });
+                continue;
+            }
+            if (!cfg?.enabled)
+                continue;
+            const configured = impl.configured;
+            if (typeof configured === "function") {
+                let ok;
+                try {
+                    ok = configured.call(impl, cfg.config) !== false;
+                }
+                catch (err) {
+                    this.log.warn("org default provider: provider excluded, configured() threw", {
+                        orgId,
+                        point,
+                        extension,
+                        err,
+                    });
+                    continue;
+                }
+                if (!ok)
+                    continue;
+            }
+            out.push({ extension, impl, orgConfig: cfg.config });
+        }
+        return out.sort((a, b) => (a.extension < b.extension ? -1 : a.extension > b.extension ? 1 : 0));
+    }
+    async choose(orgId, point, candidates) {
+        if (candidates.length < 2)
+            return pick(candidates, undefined);
+        return pick(candidates, (await this.storedDefaults(orgId)).get(point));
+    }
+    /** The org's stored defaults, point → extension. */
+    async storedDefaults(orgId) {
+        const rows = await this.kdb.db
+            .selectFrom("org_extension_point_defaults")
+            .select(["point", "extension"])
+            .where("org_id", "=", orgId)
+            .execute();
+        return new Map(rows.map((r) => [r.point, r.extension]));
+    }
+};
+__decorate([
+    Transactional()
+], ExtensionPointDefaults.prototype, "setDefault", null);
+ExtensionPointDefaults = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(ExtensionRegistry)),
+    __param(3, Inject(OrgExtensionConfigs)),
+    __param(4, Inject(KERNEL_LOGGER))
+], ExtensionPointDefaults);
+export { ExtensionPointDefaults };
+/** Rules 2-4 of spec §6: one candidate → it; several → the stored default if a candidate. */
+function pick(candidates, stored) {
+    const [only] = candidates;
+    if (only === undefined)
+        return { ok: false, reason: "none" };
+    if (candidates.length === 1)
+        return { ok: true, candidate: only };
+    const chosen = candidates.find((c) => c.extension === stored);
+    return chosen ? { ok: true, candidate: chosen } : { ok: false, reason: "ambiguous" };
+}

package/dist/extensions/registry.d.ts

@@ -11,7 +11,7 @@ export interface ExtensionPointEntry {
     version: string;
     /** 部署配置摘要，见 `deploymentConfigHash`。 */
     configHash: string;
-    /** 提供方实例的在途计数（connector / sandbox / model-provider 的 `impl` 已经包成计入它的代理）。 */
+    /** The provider instance's in-flight tracker (a tracked point's `impl`: connector, sandbox, model-provider, web-search, web-fetch, is already a proxy counted in it). */
     inflight: InflightTracker;
 }
 /**

package/dist/extensions/registry.js

@@ -12,6 +12,8 @@ const TRACKED_EXTENSION_POINTS = {
     connector: { sessions: ["open"] },
     sandbox: {},
     "model-provider": {},
+    "web-search": {},
+    "web-fetch": {},
 };
 /**
  * The extension instances in effect in this process (by extension name, one each). One provider

package/dist/http/api.module.js

@@ -13,7 +13,10 @@ import { SetupController } from "../admin/setup.controller.js";
 import { AgentsController } from "../agents/agents.controller.js";
 import { AgentsModule } from "../agents/agents.module.js";
 import { ModelsController } from "../agents/models.controller.js";
+import { ReadinessController } from "../agents/readiness.controller.js";
 import { AgentTemplatesController } from "../agents/templates.controller.js";
+import { BackgroundController } from "../background/background.controller.js";
+import { BackgroundModule } from "../background/background.module.js";
 import { AdminCatalogController } from "../catalog/admin-catalog.controller.js";
 import { CatalogModule } from "../catalog/catalog.module.js";
 import { MarketplacesController } from "../catalog/marketplaces.controller.js";
@@ -29,6 +32,7 @@ import { EvalSetsController } from "../evals/sets.controller.js";
 import { TrajectoryController } from "../evals/trajectory.controller.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
 import { OrgExtensionConfigsController } from "../extensions/org-config.controller.js";
+import { ExtensionPointDefaultsController } from "../extensions/point-defaults.controller.js";
 import { FilesModule } from "../files/files.module.js";
 import { FilePreviewersController } from "../files/previewers.controller.js";
 import { AuthController } from "../identity/auth.controller.js";
@@ -75,7 +79,9 @@ const CONTROLLERS = [
     AgentsController,
     AgentTemplatesController,
     ModelsController,
+    ReadinessController,
     ConversationsController,
+    BackgroundController,
     AttachmentsController,
     SkillsController,
     SkillChangesController,
@@ -97,6 +103,7 @@ const CONTROLLERS = [
     DirectorySyncController,
     UiController,
     FilePreviewersController,
+    ExtensionPointDefaultsController,
     TrajectoryController,
     EvalSetsController,
     EvalRunsController,
@@ -126,6 +133,7 @@ ApiModule = __decorate([
             ToolsModule,
             AgentsModule,
             ConversationsModule,
+            BackgroundModule,
             RuntimeModule,
             ChannelsModule,
             EvalsModule,

package/dist/http/nest-logger.d.ts

@@ -1,12 +1,13 @@
 import type { Logger } from "@capybara-hq/plugin-sdk";
 import type { LoggerService } from "@nestjs/common";
-/** 可选带 debug 的 logger（内核 logger 有 debug；插件契约的 Logger 没有）。 */
+/** A logger with an optional debug (the kernel logger has one; the SDK Logger does not). */
 type MaybeDebugLogger = Logger & {
     debug?: (msg: string, fields?: Record<string, unknown>) => void;
 };
 /**
- * 把 Nest 自身的日志转给内核 logger：`log`（启动时的模块加载、路由映射等，每次启动几十行）降为 debug，
- * `warn` / `error` 原级别转发，`debug` / `verbose` 丢弃。logger 没有 debug 时 `log` 也丢弃。
+ * Forwards Nest's own log lines to the kernel logger, as octok does: `log` (module loading,
+ * the `Mapped {/api/v1/…, GET} route` lines at startup) at info, `warn` / `error` as they are,
+ * `debug` / `verbose` at debug. Nest's context name becomes the record's `context`.
  */
 export declare class NestLogAdapter implements LoggerService {
     private readonly logger;
@@ -14,7 +15,7 @@ export declare class NestLogAdapter implements LoggerService {
     log(message: unknown, ...params: unknown[]): void;
     warn(message: unknown, ...params: unknown[]): void;
     error(message: unknown, ...params: unknown[]): void;
-    debug(): void;
-    verbose(): void;
+    debug(message: unknown, ...params: unknown[]): void;
+    verbose(message: unknown, ...params: unknown[]): void;
 }
 export {};

package/dist/http/nest-logger.js

@@ -1,6 +1,7 @@
 /**
- * 把 Nest 自身的日志转给内核 logger：`log`（启动时的模块加载、路由映射等，每次启动几十行）降为 debug，
- * `warn` / `error` 原级别转发，`debug` / `verbose` 丢弃。logger 没有 debug 时 `log` 也丢弃。
+ * Forwards Nest's own log lines to the kernel logger, as octok does: `log` (module loading,
+ * the `Mapped {/api/v1/…, GET} route` lines at startup) at info, `warn` / `error` as they are,
+ * `debug` / `verbose` at debug. Nest's context name becomes the record's `context`.
  */
 export class NestLogAdapter {
     logger;
@@ -8,7 +9,7 @@ export class NestLogAdapter {
         this.logger = logger;
     }
     log(message, ...params) {
-        this.logger.debug?.(String(message), fields(params));
+        this.logger.info(String(message), fields(params));
     }
     warn(message, ...params) {
         this.logger.warn(String(message), fields(params));
@@ -16,13 +17,26 @@ export class NestLogAdapter {
     error(message, ...params) {
         this.logger.error(String(message), fields(params));
     }
-    debug() { }
-    verbose() { }
+    debug(message, ...params) {
+        this.logger.debug?.(String(message), fields(params));
+    }
+    verbose(message, ...params) {
+        this.logger.debug?.(String(message), fields(params));
+    }
 }
-/** Nest 把上下文名（如 `RoutesResolver`）、错误堆栈作为额外参数传入。 */
+/**
+ * Nest passes its context name (e.g. `RoutesResolver`) last and, for errors, the stack before it. The
+ * name becomes `context` (the pretty `[context=…]`), anything else `nest`.
+ */
 function fields(params) {
-    const ctx = params.filter((p) => p !== undefined);
-    if (ctx.length === 0)
-        return undefined;
-    return { nest: ctx.length === 1 ? ctx[0] : ctx };
+    const rest = params.filter((p) => p !== undefined);
+    const last = rest.at(-1);
+    const out = {};
+    if (typeof last === "string" && /^[A-Za-z][\w.-]*$/.test(last)) {
+        out.context = last;
+        rest.pop();
+    }
+    if (rest.length > 0)
+        out.nest = rest.length === 1 ? rest[0] : rest;
+    return Object.keys(out).length > 0 ? out : undefined;
 }

package/dist/identity/auth.controller.js

@@ -15,7 +15,7 @@ import { CredentialThrottler } from "../infra/throttler/credential-throttler.js"
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody } from "../infra/validation/zod-params.js";
 import { AccountsService } from "./accounts.js";
-import { ACCESS_COOKIE, clearSessionCookies, REFRESH_COOKIE, setSessionCookies, } from "./cookies.js";
+import { ACCESS_COOKIE, clearSessionCookies, refreshCookieValues, setSessionCookies, } from "./cookies.js";
 import { Public } from "./principal.js";
 import { SessionService } from "./sessions.js";
 const LoginBodySchema = z.object({ login: z.string().max(256), password: z.string() });
@@ -74,9 +74,13 @@ let AuthController = class AuthController {
      */
     async refresh(req, reply) {
         try {
-            const rt = req.cookies[REFRESH_COOKIE];
-            if (!rt)
+            // the header may carry several cap_rt (legacy Path and Path=/): the current one of a live session wins
+            const candidates = refreshCookieValues(req.headers.cookie);
+            if (candidates.length === 0) {
                 throw new ApiError("auth.refresh_invalid", "Refresh token is missing");
+            }
+            // none is current: the last one (the Path=/ cookie) goes through the usual replay handling
+            const rt = (await this.sessions.pickCurrentRefresh(candidates)) ?? candidates.at(-1);
             const session = await this.sessions.refresh(rt, clientMeta(req));
             const account = await this.accounts.get(session.accountId);
             if (!account)
@@ -94,13 +98,13 @@ let AuthController = class AuthController {
     async logout(req, reply) {
         clearSessionCookies(reply);
         const at = req.cookies[ACCESS_COOKIE];
-        const rt = req.cookies[REFRESH_COOKIE];
+        const rts = refreshCookieValues(req.headers.cookie);
         if (at) {
             const sid = await this.sessions.sessionIdFromAccess(at);
             if (sid !== undefined)
                 await this.sessions.revoke(sid);
         }
-        if (rt)
+        for (const rt of rts)
             await this.sessions.revokeByRefresh(rt);
     }
 };

package/dist/identity/cookies.d.ts

@@ -3,14 +3,29 @@ import type { KernelConfig } from "../config/schema.js";
 import type { IssuedSession } from "./sessions.js";
 /** access token Cookie：随所有请求发送。 */
 export declare const ACCESS_COOKIE = "cap_at";
-/** refresh token Cookie：只发往认证端点。 */
+/**
+ * The refresh-token cookie: SameSite=Lax so a top-level navigation from another site (an IM card
+ * link, an email, an OAuth return) carries it and the web tier can renew the session. The refresh
+ * endpoint is POST-only and requires `X-Capybara-Csrf`, and Lax cookies are not sent on cross-site
+ * POSTs, so this does not widen CSRF exposure.
+ */
 export declare const REFRESH_COOKIE = "cap_rt";
-/** refresh Cookie 的 Path。 */
-export declare const REFRESH_COOKIE_PATH = "/api/v1/auth";
 /**
- * 写会话 Cookie。两个 Cookie 都 HttpOnly、都**不设 Domain**（只属于当前主机）；
- * `cap_at` 为 SameSite=Lax、Path=/；`cap_rt` 为 SameSite=Strict、只发往 `/api/v1/auth`。
+ * Path of the refresh Cookie: `/`, so the web tier sees it on page requests and can renew the
+ * session while rendering on the server.
+ */
+export declare const REFRESH_COOKIE_PATH = "/";
+/** The Path earlier releases set `cap_rt` on; browsers may still hold it, so it is cleared too. */
+export declare const LEGACY_REFRESH_COOKIE_PATH = "/api/v1/auth";
+/**
+ * Writes the session cookies. Both are HttpOnly, host-only (no Domain), SameSite=Lax and Path=/;
+ * the `cap_rt` on the legacy Path is cleared at the same time.
  */
 export declare function setSessionCookies(reply: FastifyReply, s: IssuedSession, cfg: KernelConfig): void;
 /** 清除会话 Cookie（Path 必须与设置时一致才能覆盖）。 */
 export declare function clearSessionCookies(reply: FastifyReply): void;
+/**
+ * Every `cap_rt` value of a raw `cookie` header, in header order. A browser holding the legacy
+ * Path cookie and the new one sends both, the more specific Path first.
+ */
+export declare function refreshCookieValues(header: string | undefined): string[];

package/dist/identity/cookies.js

@@ -1,12 +1,22 @@
 /** access token Cookie：随所有请求发送。 */
 export const ACCESS_COOKIE = "cap_at";
-/** refresh token Cookie：只发往认证端点。 */
+/**
+ * The refresh-token cookie: SameSite=Lax so a top-level navigation from another site (an IM card
+ * link, an email, an OAuth return) carries it and the web tier can renew the session. The refresh
+ * endpoint is POST-only and requires `X-Capybara-Csrf`, and Lax cookies are not sent on cross-site
+ * POSTs, so this does not widen CSRF exposure.
+ */
 export const REFRESH_COOKIE = "cap_rt";
-/** refresh Cookie 的 Path。 */
-export const REFRESH_COOKIE_PATH = "/api/v1/auth";
 /**
- * 写会话 Cookie。两个 Cookie 都 HttpOnly、都**不设 Domain**（只属于当前主机）；
- * `cap_at` 为 SameSite=Lax、Path=/；`cap_rt` 为 SameSite=Strict、只发往 `/api/v1/auth`。
+ * Path of the refresh Cookie: `/`, so the web tier sees it on page requests and can renew the
+ * session while rendering on the server.
+ */
+export const REFRESH_COOKIE_PATH = "/";
+/** The Path earlier releases set `cap_rt` on; browsers may still hold it, so it is cleared too. */
+export const LEGACY_REFRESH_COOKIE_PATH = "/api/v1/auth";
+/**
+ * Writes the session cookies. Both are HttpOnly, host-only (no Domain), SameSite=Lax and Path=/;
+ * the `cap_rt` on the legacy Path is cleared at the same time.
  */
 export function setSessionCookies(reply, s, cfg) {
     const secure = cfg.auth.cookieSecure;
@@ -20,13 +30,41 @@ export function setSessionCookies(reply, s, cfg) {
     reply.setCookie(REFRESH_COOKIE, s.refreshToken, {
         path: REFRESH_COOKIE_PATH,
         httpOnly: true,
-        sameSite: "strict",
+        sameSite: "lax",
         secure,
         maxAge: cfg.auth.refreshTokenTtlDays * 86400,
     });
+    reply.clearCookie(REFRESH_COOKIE, { path: LEGACY_REFRESH_COOKIE_PATH });
 }
 /** 清除会话 Cookie（Path 必须与设置时一致才能覆盖）。 */
 export function clearSessionCookies(reply) {
     reply.clearCookie(ACCESS_COOKIE, { path: "/" });
     reply.clearCookie(REFRESH_COOKIE, { path: REFRESH_COOKIE_PATH });
+    reply.clearCookie(REFRESH_COOKIE, { path: LEGACY_REFRESH_COOKIE_PATH });
+}
+/**
+ * Every `cap_rt` value of a raw `cookie` header, in header order. A browser holding the legacy
+ * Path cookie and the new one sends both, the more specific Path first.
+ */
+export function refreshCookieValues(header) {
+    if (!header)
+        return [];
+    const out = [];
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq < 0 || part.slice(0, eq).trim() !== REFRESH_COOKIE)
+            continue;
+        let v = part.slice(eq + 1).trim();
+        if (v.startsWith('"') && v.endsWith('"') && v.length >= 2)
+            v = v.slice(1, -1);
+        try {
+            v = decodeURIComponent(v);
+        }
+        catch {
+            // keep the raw value
+        }
+        if (v)
+            out.push(v);
+    }
+    return out;
 }

package/dist/identity/me.controller.d.ts

@@ -8,6 +8,7 @@ import { type Account, AccountsService } from "./accounts.js";
 import { type ApiTokenRecord, ApiTokenService } from "./api-tokens.js";
 import { type Principal } from "./principal.js";
 import { SessionService } from "./sessions.js";
+import { SettingsService } from "./settings.js";
 declare const ChangePasswordSchema: z.ZodObject<{
     currentPassword: z.ZodString;
     newPassword: z.ZodString;
@@ -33,12 +34,15 @@ export declare class MeController {
     private readonly tokens;
     private readonly throttler;
     private readonly log;
-    constructor(accounts: AccountsService, sessions: SessionService, orgs: OrgsService, tokens: ApiTokenService, throttler: CredentialThrottler, log: Logger);
+    private readonly settings;
+    constructor(accounts: AccountsService, sessions: SessionService, orgs: OrgsService, tokens: ApiTokenService, throttler: CredentialThrottler, log: Logger, settings: SettingsService);
     me(principal: Principal): Promise<{
         account: Account;
         via: "session" | "pat";
         currentOrgId: string | null;
         memberships: MembershipView[];
+        /** Whether `POST /api/v1/orgs` would accept this account (the `orgCreation` setting). */
+        canCreateOrg: boolean;
     }>;
     /** 切换当前组织（仅 Web 会话）；`null` 清空。非成员或已软删除的组织 → `org.not_found`。 */
     setCurrentOrg(principal: Principal, body: z.infer<typeof CurrentOrgSchema>): Promise<void>;