@capybara-hq/kernel 0.1.0-rc.3 → 0.1.0-rc.5

package/dist/extensions/permission-view.d.ts

@@ -1,3 +1,5 @@
+import type { LocalizedName } from "@capybara-hq/plugin-sdk";
+import type { PluginScope } from "../catalog/scope.js";
 import { type PermissionSet } from "./permission-set.js";
 import type { ExtensionSource } from "./sources.js";
 /**
@@ -35,10 +37,10 @@ export interface PermissionItem {
     reason?: SensitiveReason;
 }
 /**
- * 敏感的能力（D10 + 计划扩展，F-AI）：`sandbox@1` 在部署里执行任意命令、`object-store@1` 保管全部附件与插件包（D10）；
+ * 敏感的能力（D10 + 计划扩展，F-AI）：`sandbox@2` 在部署里执行任意命令、`object-store@1` 保管全部附件与插件包（D10）；
  * `channel@1` 收到组织在 IM 里的对话内容（Ruling A33）、`directory@1` 能把人加进组织（并为其建账号、建身份）、
  * `identity-source@1` 决定谁能登录成哪个账号。插件提供其中任何一个时，「提供」一组标为敏感，
- * 后台插件列表的 `sensitive` 为真，须企业管理员批准。只影响展示，不改权限快照的键。
+ * 后台插件列表的 `sensitive` 为真，须超级管理员批准。只影响展示，不改权限快照的键。
  */
 export declare const SENSITIVE_EXTENSION_POINTS: readonly string[];
 /**
@@ -58,13 +60,15 @@ export type DeploymentExtensionStatus = "enabled" | "disabled" | "pending_approv
 /** The stored package is in the pre-0.1.0 format: reinstall it from a repacked tgz. */
  | "legacy_format";
 /**
- * 需要企业管理员处理的状态（后台概览「需要处理的插件」）：待批准、待配置、失败、依赖缺失，以及副本不一致
+ * 需要超级管理员处理的状态（后台概览「需要处理的插件」）：待批准、待配置、失败、依赖缺失，以及副本不一致
  * （`converging` 收敛中、`pending_migration` 待迁移）。
  */
 export declare function extensionNeedsAction(status: DeploymentExtensionStatus): boolean;
 /** One item of the admin extension list (`GET /api/v1/admin/extensions`). */
 export interface AdminExtensionView {
     name: string;
+    /** The plugin's display name (`ExtensionDisplayNames`); null when it has none. */
+    displayName: LocalizedName | null;
     version: string;
     source: ExtensionSource;
     /** 安装记录的包；配置声明为 null。 */
@@ -111,13 +115,24 @@ export interface AdminExtensionView {
     /** 有部署级配置字段。 */
     configurable: boolean;
     configValid: boolean;
+    /**
+     * Only when the platform config leaves required overridable fields empty (spec A §5.4a; the
+     * extension still runs): the number of orgs where it is on and that still need their own config.
+     */
+    orgsNeedingConfig?: number;
     /** 能从部署卸载（只有安装记录，必需的引导插件除外；卸载前须先停用）。 */
     removable: boolean;
     /**
      * A required bootstrap plugin (package ecosystem spec §7): enabled in every org, cannot be
-     * disabled or uninstalled; an enterprise admin may upgrade it.
+     * disabled or uninstalled; a super admin may upgrade it.
      */
     required: boolean;
+    /** The scope of the catalog plugin the extension ships in (builtin: `all`); null without one. */
+    scope: PluginScope | null;
+    /** Orgs where the extension is enabled (a required plugin: every org). */
+    enabledOrgs: number;
+    /** Shipped with the deployment (a builtin plugin or a required bootstrap plugin). */
+    builtin: boolean;
     /** Where the install record came from (`bootstrap` for the bootstrap step); null for config-declared. */
     installSource: "npm" | "file" | "catalog" | "bootstrap" | null;
     /**

package/dist/extensions/permission-view.js

@@ -18,16 +18,16 @@ export function reviewHash(set, warnings = []) {
     return h.digest("hex").slice(0, 16);
 }
 /**
- * 敏感的能力（D10 + 计划扩展，F-AI）：`sandbox@1` 在部署里执行任意命令、`object-store@1` 保管全部附件与插件包（D10）；
+ * 敏感的能力（D10 + 计划扩展，F-AI）：`sandbox@2` 在部署里执行任意命令、`object-store@1` 保管全部附件与插件包（D10）；
  * `channel@1` 收到组织在 IM 里的对话内容（Ruling A33）、`directory@1` 能把人加进组织（并为其建账号、建身份）、
  * `identity-source@1` 决定谁能登录成哪个账号。插件提供其中任何一个时，「提供」一组标为敏感，
- * 后台插件列表的 `sensitive` 为真，须企业管理员批准。只影响展示，不改权限快照的键。
+ * 后台插件列表的 `sensitive` 为真，须超级管理员批准。只影响展示，不改权限快照的键。
  */
 export const SENSITIVE_EXTENSION_POINTS = [
     "channel@1",
     "directory@1",
     "identity-source@1",
-    "sandbox@1",
+    "sandbox@2",
     "object-store@1",
 ];
 /** 总是敏感的类别。 */
@@ -159,7 +159,7 @@ export function permissionGroups(set) {
     });
 }
 /**
- * 需要企业管理员处理的状态（后台概览「需要处理的插件」）：待批准、待配置、失败、依赖缺失，以及副本不一致
+ * 需要超级管理员处理的状态（后台概览「需要处理的插件」）：待批准、待配置、失败、依赖缺失，以及副本不一致
  * （`converging` 收敛中、`pending_migration` 待迁移）。
  */
 export function extensionNeedsAction(status) {

package/dist/extensions/plugin-items.d.ts

@@ -0,0 +1,21 @@
+import type { PluginScope } from "../catalog/scope.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+/** The catalog item (the plugin) an extension ships in. */
+export interface ExtensionPluginItem {
+    id: string;
+    scope: PluginScope;
+    builtin: boolean;
+    disabled: boolean;
+}
+/**
+ * The live catalog items of each extension in `names`, the one recorded on its install
+ * (`extension_installs.catalog_item_id`) first, then its other `extension_catalog_sources` by id.
+ * An extension without a live item (declared in the startup config, or its items deleted) is absent.
+ * `db` may be a transaction.
+ */
+export declare function pluginItemsOf(db: KernelSchemaDb, names: readonly string[]): Promise<Map<string, ExtensionPluginItem[]>>;
+/**
+ * Whether an item keeps its plugin on in every org (builtin only: an org may switch off an `all`
+ * one, layering spec §4): its switch cannot go off.
+ */
+export declare const itemLocked: (i: ExtensionPluginItem) => boolean;

package/dist/extensions/plugin-items.js

@@ -0,0 +1,42 @@
+/**
+ * The live catalog items of each extension in `names`, the one recorded on its install
+ * (`extension_installs.catalog_item_id`) first, then its other `extension_catalog_sources` by id.
+ * An extension without a live item (declared in the startup config, or its items deleted) is absent.
+ * `db` may be a transaction.
+ */
+export async function pluginItemsOf(db, names) {
+    const out = new Map();
+    if (names.length === 0)
+        return out;
+    const add = (plugin, item) => {
+        const list = out.get(plugin) ?? [];
+        if (!list.some((i) => i.id === item.id))
+            list.push(item);
+        out.set(plugin, list);
+    };
+    const own = await db
+        .selectFrom("extension_installs as e")
+        .innerJoin("catalog_items as i", "i.id", "e.catalog_item_id")
+        .select(["e.name as plugin", "i.id", "i.scope", "i.builtin", "i.disabled"])
+        .where("e.name", "in", [...names])
+        .where("i.deleted_at", "is", null)
+        .execute();
+    for (const r of own)
+        add(r.plugin, r);
+    const sources = await db
+        .selectFrom("extension_catalog_sources as s")
+        .innerJoin("catalog_items as i", "i.id", "s.item_id")
+        .select(["s.plugin", "i.id", "i.scope", "i.builtin", "i.disabled"])
+        .where("s.plugin", "in", [...names])
+        .where("i.deleted_at", "is", null)
+        .orderBy("i.id")
+        .execute();
+    for (const r of sources)
+        add(r.plugin, r);
+    return out;
+}
+/**
+ * Whether an item keeps its plugin on in every org (builtin only: an org may switch off an `all`
+ * one, layering spec §4): its switch cannot go off.
+ */
+export const itemLocked = (i) => i.builtin;

package/dist/extensions/point-defaults.controller.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import { type Principal } from "../identity/principal.js";
+import { type OrgContext } from "../orgs/org.guard.js";
+import { ExtensionPointDefaults, type OrgPointDefaultView } from "./point-defaults.js";
+declare const PointParams: z.ZodObject<{
+    point: z.ZodString;
+}, z.core.$strip>;
+declare const DefaultBody: z.ZodObject<{
+    extension: z.ZodString;
+}, z.core.$strict>;
+/**
+ * The org default provider of `org-default` extension points (web tools spec §6):
+ * - `GET /api/v1/orgs/:orgId/extension-points` (`org.extensions.manage`) → `{ points }`: each
+ *   point with its candidate providers, the stored default and the effective provider;
+ * - `PUT /api/v1/orgs/:orgId/extension-points/:point/default` `{ extension }`
+ *   (`org.extensions.manage`) → 204;
+ * - `GET /api/v1/orgs/:orgId/extension-points/available` (`agents.use`) → `{ points }`: whether
+ *   each point has a provider now, without extension names (for the agent form).
+ */
+export declare class ExtensionPointDefaultsController {
+    private readonly points;
+    constructor(points: ExtensionPointDefaults);
+    list(org: OrgContext): Promise<{
+        points: OrgPointDefaultView[];
+    }>;
+    available(org: OrgContext): Promise<{
+        points: {
+            point: string;
+            available: boolean;
+        }[];
+    }>;
+    setDefault(principal: Principal, org: OrgContext, { point }: z.infer<typeof PointParams>, body: z.infer<typeof DefaultBody>): Promise<void>;
+}
+export {};

package/dist/extensions/point-defaults.controller.js

@@ -0,0 +1,71 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Get, HttpCode, Inject, Put } from "@nestjs/common";
+import { z } from "zod";
+import { CurrentPrincipal, requireUser } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { ExtensionPointDefaults } from "./point-defaults.js";
+const PointParams = z.object({ point: z.string().min(1).max(100) });
+const DefaultBody = z.object({ extension: z.string().min(1).max(214) }).strict();
+class ExtensionPointParamsDto extends createZodDto(PointParams, "ExtensionPointParams") {
+}
+class ExtensionPointDefaultBodyDto extends createZodDto(DefaultBody, "ExtensionPointDefaultBody") {
+}
+/**
+ * The org default provider of `org-default` extension points (web tools spec §6):
+ * - `GET /api/v1/orgs/:orgId/extension-points` (`org.extensions.manage`) → `{ points }`: each
+ *   point with its candidate providers, the stored default and the effective provider;
+ * - `PUT /api/v1/orgs/:orgId/extension-points/:point/default` `{ extension }`
+ *   (`org.extensions.manage`) → 204;
+ * - `GET /api/v1/orgs/:orgId/extension-points/available` (`agents.use`) → `{ points }`: whether
+ *   each point has a provider now, without extension names (for the agent form).
+ */
+let ExtensionPointDefaultsController = class ExtensionPointDefaultsController {
+    points;
+    constructor(points) {
+        this.points = points;
+    }
+    async list(org) {
+        return { points: await this.points.list(org.orgId) };
+    }
+    async available(org) {
+        return { points: await this.points.available(org.orgId) };
+    }
+    async setDefault(principal, org, { point }, body) {
+        const p = requireUser(principal);
+        await this.points.setDefault(org.orgId, point, body.extension, p.account.id);
+    }
+};
+__decorate([
+    Get(),
+    OrgAction("org.extensions.manage"),
+    __param(0, CurrentOrg())
+], ExtensionPointDefaultsController.prototype, "list", null);
+__decorate([
+    Get("available"),
+    OrgAction("agents.use"),
+    __param(0, CurrentOrg())
+], ExtensionPointDefaultsController.prototype, "available", null);
+__decorate([
+    Put(":point/default"),
+    HttpCode(204),
+    OrgAction("org.extensions.manage"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(ExtensionPointParamsDto)),
+    __param(3, ZBody(ExtensionPointDefaultBodyDto))
+], ExtensionPointDefaultsController.prototype, "setDefault", null);
+ExtensionPointDefaultsController = __decorate([
+    Controller("api/v1/orgs/:orgId/extension-points"),
+    __param(0, Inject(ExtensionPointDefaults))
+], ExtensionPointDefaultsController);
+export { ExtensionPointDefaultsController };

package/dist/extensions/point-defaults.d.ts

@@ -0,0 +1,71 @@
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
+import { EffectiveConfigs } from "./effective-config.js";
+import { OrgExtensionConfigs } from "./org-config.js";
+import { ExtensionRegistry } from "./registry.js";
+/**
+ * The outcome of {@link ExtensionPointDefaults.resolve}: the provider with its org config and its
+ * effective deployment config for the org (layering spec A §6), both to pass back to it.
+ */
+export type PointResolution<T> = {
+    ok: true;
+    extension: string;
+    impl: T;
+    orgConfig: unknown;
+    config: unknown;
+} | {
+    ok: false;
+    reason: "none" | "ambiguous";
+};
+/** One `org-default` extension point of an org (the admin view). */
+export interface OrgPointDefaultView {
+    point: string;
+    /** The extensions that could serve the org now, by name. */
+    candidates: string[];
+    /** The stored default, also when it is not a candidate now. */
+    default: string | null;
+    /** The extension a call would use now; null when there is none or the choice is ambiguous. */
+    effective: string | null;
+}
+/**
+ * The org default provider of an `org-default` extension point (web tools spec §6). Per call,
+ * never cached in process: the candidates are the providers loaded on this replica that are
+ * enabled in the org, whose org config and effective deployment config for the org (layering spec
+ * A §6) are valid, and whose `configured()` (when present) does not return false. One candidate is used as is; several need the org's stored default
+ * (`capybara.org_extension_point_defaults`), else the choice is ambiguous. A stored default that
+ * is not a candidate (disabled, uninstalled, unconfigured) stays and counts again once it is one.
+ */
+export declare class ExtensionPointDefaults {
+    private readonly kdb;
+    readonly txHost: TransactionHost;
+    private readonly registry;
+    private readonly orgConfigs;
+    private readonly effective;
+    private readonly log;
+    constructor(kdb: KernelDb, txHost: TransactionHost, registry: Pick<ExtensionRegistry, "list">, orgConfigs: Pick<OrgExtensionConfigs, "get">, effective: Pick<EffectiveConfigs, "get">, log: KernelLogger);
+    /**
+     * The provider of `point` (the name without the major, e.g. `web-search`) for `orgId`, with the
+     * org's decrypted config and the effective deployment config to pass back to it. Throws when the
+     * point has no `selection`.
+     */
+    resolve<T>(orgId: string, point: string): Promise<PointResolution<T>>;
+    /** Every `org-default` point with its candidates, stored default and effective provider. */
+    list(orgId: string): Promise<OrgPointDefaultView[]>;
+    /** Whether each `org-default` point has a provider for the org now (no extension names). */
+    available(orgId: string): Promise<{
+        point: string;
+        available: boolean;
+    }[]>;
+    /**
+     * Stores `extension` as the org's default provider of `point`. 400 `validation_failed` unless
+     * the point is an `org-default` one and the extension provides it (loaded here) and is enabled
+     * in the org. Audited as `extension_point.default_set`.
+     */
+    setDefault(orgId: string, point: string, extension: string, actorId: string): Promise<void>;
+    /** The candidates of `point` in `orgId`, by extension name. */
+    private candidates;
+    private choose;
+    /** The org's stored defaults, point → extension. */
+    private storedDefaults;
+}

package/dist/extensions/point-defaults.js

@@ -0,0 +1,234 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { EXTENSION_POINTS } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { audit } from "../identity/audit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { EffectiveConfigs } from "./effective-config.js";
+import { enabledExtensionsQuery, isExtensionEnabled } from "./enabled.js";
+import { OrgExtensionConfigs } from "./org-config.js";
+import { ExtensionRegistry } from "./registry.js";
+/** The extension points whose provider each org chooses (`selection: "org-default"`). */
+function selectionPoints() {
+    return Object.entries(EXTENSION_POINTS)
+        .filter(([, info]) => info.selection === "org-default")
+        .map(([name]) => name);
+}
+const hasSelection = (point) => EXTENSION_POINTS[point]?.selection === "org-default";
+/**
+ * The org default provider of an `org-default` extension point (web tools spec §6). Per call,
+ * never cached in process: the candidates are the providers loaded on this replica that are
+ * enabled in the org, whose org config and effective deployment config for the org (layering spec
+ * A §6) are valid, and whose `configured()` (when present) does not return false. One candidate is used as is; several need the org's stored default
+ * (`capybara.org_extension_point_defaults`), else the choice is ambiguous. A stored default that
+ * is not a candidate (disabled, uninstalled, unconfigured) stays and counts again once it is one.
+ */
+let ExtensionPointDefaults = class ExtensionPointDefaults {
+    kdb;
+    txHost;
+    registry;
+    orgConfigs;
+    effective;
+    log;
+    constructor(kdb, txHost, registry, orgConfigs, effective, log) {
+        this.kdb = kdb;
+        this.txHost = txHost;
+        this.registry = registry;
+        this.orgConfigs = orgConfigs;
+        this.effective = effective;
+        this.log = log;
+    }
+    /**
+     * The provider of `point` (the name without the major, e.g. `web-search`) for `orgId`, with the
+     * org's decrypted config and the effective deployment config to pass back to it. Throws when the
+     * point has no `selection`.
+     */
+    async resolve(orgId, point) {
+        if (!hasSelection(point)) {
+            throw new Error(`extension point ${point} has no org-default selection`);
+        }
+        const candidates = await this.candidates(orgId, point);
+        const chosen = await this.choose(orgId, point, candidates);
+        if (!chosen.ok)
+            return chosen;
+        const c = chosen.candidate;
+        return {
+            ok: true,
+            extension: c.extension,
+            impl: c.impl,
+            orgConfig: c.orgConfig,
+            config: c.config,
+        };
+    }
+    /** Every `org-default` point with its candidates, stored default and effective provider. */
+    async list(orgId) {
+        const stored = await this.storedDefaults(orgId);
+        const out = [];
+        for (const point of selectionPoints()) {
+            const candidates = await this.candidates(orgId, point);
+            const chosen = pick(candidates, stored.get(point));
+            out.push({
+                point,
+                candidates: candidates.map((c) => c.extension),
+                default: stored.get(point) ?? null,
+                effective: chosen.ok ? chosen.candidate.extension : null,
+            });
+        }
+        return out;
+    }
+    /** Whether each `org-default` point has a provider for the org now (no extension names). */
+    async available(orgId) {
+        const out = [];
+        for (const point of selectionPoints()) {
+            out.push({ point, available: (await this.resolve(orgId, point)).ok });
+        }
+        return out;
+    }
+    /**
+     * Stores `extension` as the org's default provider of `point`. 400 `validation_failed` unless
+     * the point is an `org-default` one and the extension provides it (loaded here) and is enabled
+     * in the org. Audited as `extension_point.default_set`.
+     */
+    async setDefault(orgId, point, extension, actorId) {
+        const db = this.kdb.db;
+        if (!hasSelection(point)) {
+            throw new ApiError("validation_failed", `${point} is not an extension point with an organization default`);
+        }
+        const provides = this.registry.list(point).some((e) => e.plugin === extension);
+        if (!provides || !(await isExtensionEnabled(db, orgId, extension))) {
+            throw new ApiError("validation_failed", `Extension ${extension} does not provide ${point} or is not enabled in this organization`);
+        }
+        await db
+            .insertInto("org_extension_point_defaults")
+            .values({ org_id: orgId, point, extension, updated_by: actorId })
+            .onConflict((oc) => oc.columns(["org_id", "point"]).doUpdateSet({
+            extension,
+            updated_by: actorId,
+            updated_at: new Date(),
+        }))
+            .execute();
+        await audit(db, {
+            actorAccountId: actorId,
+            orgId,
+            action: "extension_point.default_set",
+            target: point,
+            detail: { point, extension },
+        });
+    }
+    /** The candidates of `point` in `orgId`, by extension name. */
+    async candidates(orgId, point) {
+        const db = this.kdb.db;
+        const enabled = new Set((await db
+            .selectFrom(enabledExtensionsQuery(db, orgId).as("en"))
+            .select("en.plugin")
+            .execute()).map((r) => r.plugin));
+        const providers = new Map();
+        for (const e of this.registry.list(point)) {
+            if (enabled.has(e.plugin) && !providers.has(e.plugin))
+                providers.set(e.plugin, e.impl);
+        }
+        const out = [];
+        for (const [extension, impl] of providers) {
+            let cfg;
+            try {
+                cfg = await this.orgConfigs.get(orgId, extension);
+            }
+            catch (err) {
+                this.log.warn("org default provider: provider excluded, its org config is invalid", {
+                    orgId,
+                    point,
+                    extension,
+                    err,
+                });
+                continue;
+            }
+            if (!cfg?.enabled)
+                continue;
+            // spec A §6: an org whose effective config is not valid gets no call from this extension
+            let effective;
+            try {
+                effective = await this.effective.get(orgId, extension);
+            }
+            catch (err) {
+                this.log.warn("org default provider: provider excluded, cannot read its effective config", {
+                    orgId,
+                    point,
+                    extension,
+                    err,
+                });
+                continue;
+            }
+            if (!effective.ok)
+                continue;
+            const configured = impl
+                .configured;
+            if (typeof configured === "function") {
+                let ok;
+                try {
+                    ok = configured.call(impl, cfg.config, effective.config) !== false;
+                }
+                catch (err) {
+                    this.log.warn("org default provider: provider excluded, configured() threw", {
+                        orgId,
+                        point,
+                        extension,
+                        err,
+                    });
+                    continue;
+                }
+                if (!ok)
+                    continue;
+            }
+            out.push({ extension, impl, orgConfig: cfg.config, config: effective.config });
+        }
+        return out.sort((a, b) => (a.extension < b.extension ? -1 : a.extension > b.extension ? 1 : 0));
+    }
+    async choose(orgId, point, candidates) {
+        if (candidates.length < 2)
+            return pick(candidates, undefined);
+        return pick(candidates, (await this.storedDefaults(orgId)).get(point));
+    }
+    /** The org's stored defaults, point → extension. */
+    async storedDefaults(orgId) {
+        const rows = await this.kdb.db
+            .selectFrom("org_extension_point_defaults")
+            .select(["point", "extension"])
+            .where("org_id", "=", orgId)
+            .execute();
+        return new Map(rows.map((r) => [r.point, r.extension]));
+    }
+};
+__decorate([
+    Transactional()
+], ExtensionPointDefaults.prototype, "setDefault", null);
+ExtensionPointDefaults = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(ExtensionRegistry)),
+    __param(3, Inject(OrgExtensionConfigs)),
+    __param(4, Inject(EffectiveConfigs)),
+    __param(5, Inject(KERNEL_LOGGER))
+], ExtensionPointDefaults);
+export { ExtensionPointDefaults };
+/** Rules 2-4 of spec §6: one candidate → it; several → the stored default if a candidate. */
+function pick(candidates, stored) {
+    const [only] = candidates;
+    if (only === undefined)
+        return { ok: false, reason: "none" };
+    if (candidates.length === 1)
+        return { ok: true, candidate: only };
+    const chosen = candidates.find((c) => c.extension === stored);
+    return chosen ? { ok: true, candidate: chosen } : { ok: false, reason: "ambiguous" };
+}

package/dist/extensions/registry.d.ts

@@ -11,7 +11,7 @@ export interface ExtensionPointEntry {
     version: string;
     /** 部署配置摘要，见 `deploymentConfigHash`。 */
     configHash: string;
-    /** 提供方实例的在途计数（connector / sandbox / model-provider 的 `impl` 已经包成计入它的代理）。 */
+    /** The provider instance's in-flight tracker (a tracked point's `impl`: connector, sandbox, model-provider, web-search, web-fetch, is already a proxy counted in it). */
     inflight: InflightTracker;
 }
 /**

package/dist/extensions/registry.js

@@ -12,6 +12,8 @@ const TRACKED_EXTENSION_POINTS = {
     connector: { sessions: ["open"] },
     sandbox: {},
     "model-provider": {},
+    "web-search": {},
+    "web-fetch": {},
 };
 /**
  * The extension instances in effect in this process (by extension name, one each). One provider

package/dist/extensions/resolve.d.ts

@@ -1,7 +1,11 @@
 import { type ExtensionManifest } from "@capybara-hq/plugin-sdk";
 /** 插件依赖解析失败（信息列出插件名与能力名）。 */
 export declare class ExtensionResolveError extends Error {
-    constructor(message: string);
+    /** Error code of the failure, when it has one. */
+    readonly code?: string | undefined;
+    constructor(message: string, 
+    /** Error code of the failure, when it has one. */
+    code?: string | undefined);
 }
 /**
  * 校验 sdk 范围、依赖满足度、单选能力唯一性与无环，返回按依赖拓扑排序后的列表（同层保持输入顺序）。

package/dist/extensions/resolve.js

@@ -1,9 +1,13 @@
-import { EXTENSION_POINT_CARDINALITY, OBJECT_STORE_EXTENSION_POINT, parseExtensionPoint, } from "@capybara-hq/plugin-sdk";
+import { EXTENSION_POINT_CARDINALITY, EXTENSION_POINTS, OBJECT_STORE_EXTENSION_POINT, parseExtensionPoint, } from "@capybara-hq/plugin-sdk";
 import semver from "semver";
 /** 插件依赖解析失败（信息列出插件名与能力名）。 */
 export class ExtensionResolveError extends Error {
-    constructor(message) {
+    code;
+    constructor(message, 
+    /** Error code of the failure, when it has one. */
+    code) {
         super(message);
+        this.code = code;
         this.name = "ExtensionResolveError";
     }
 }
@@ -23,6 +27,15 @@ export function resolveExtensions(manifests, sdkVersion) {
             throw new ExtensionResolveError(`plugin ${m.name}: sdk range "${m.sdk}" is not satisfied by SDK_VERSION ${sdkVersion}`);
         }
     }
+    for (const m of manifests) {
+        for (const ref of m.provides) {
+            const { name, major } = parseExtensionPoint(ref);
+            const majors = EXTENSION_POINTS[name]?.majors;
+            if (majors && !majors.includes(major)) {
+                throw new ExtensionResolveError(`Plugin ${m.name} provides ${ref}, which this kernel no longer supports; upgrade it to a version that provides ${name}@${Math.max(...majors)}.`, "extension.unsupported_extension_point");
+            }
+        }
+    }
     const providers = new Map();
     for (const m of manifests) {
         for (const cap of m.provides)

package/dist/files/previewers.d.ts

@@ -1,5 +1,6 @@
 import { type FilePreviewer, type Logger, type UiView } from "@capybara-hq/plugin-sdk";
 import { ConversationFiles } from "../conversations/files.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { ExtensionHost } from "../extensions/host.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -39,7 +40,7 @@ export declare class PreviewerRegistry {
     readonly txHost: TransactionHost;
     private readonly timeoutMs;
     private readonly d;
-    constructor(kdb: Pick<KernelDb, "db">, host: Pick<ExtensionHost, "list" | "enabledPlugins">, files: Pick<ConversationFiles, "file">, storage: Pick<StorageService, "kernel">, log: Pick<Logger, "warn">, txHost: TransactionHost, timeoutMs?: number);
+    constructor(kdb: Pick<KernelDb, "db">, host: Pick<ExtensionHost, "list" | "enabledPlugins">, files: Pick<ConversationFiles, "file">, storage: Pick<StorageService, "kernel">, effective: Pick<EffectiveConfigs, "get">, log: Pick<Logger, "warn">, txHost: TransactionHost, timeoutMs?: number);
     /** Every previewer loaded on this replica, in provider order (load order, then list order). */
     private loaded;
     /** The org's previewers (enabled extensions only) in its order, disabled ones included. */
@@ -65,6 +66,12 @@ export declare class PreviewerRegistry {
     private putIn;
     /** Previewers that take this file (viewer must read the conversation), in the org's order. */
     forFile(orgId: string, conversationId: string, viewer: string, fileId: string): Promise<PreviewerItem[]>;
+    /**
+     * The org's enabled previewers that take the file, each with its extension's effective config
+     * for the org. An extension whose effective config is not valid in the org (or cannot be read)
+     * previews nothing there (layering spec A §6): its previewers are left out, so the next one or a
+     * built-in takes the file.
+     */
     private accepting;
     /**
      * Renders a view previewer for one file: 404 `ui.not_found` when it does not take the file (or is