@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.5

package/dist/extensions/permission-view.d.ts

@@ -1,4 +1,5 @@
 import type { LocalizedName } from "@capybara-hq/plugin-sdk";
+import type { PluginScope } from "../catalog/scope.js";
 import { type PermissionSet } from "./permission-set.js";
 import type { ExtensionSource } from "./sources.js";
 /**
@@ -36,10 +37,10 @@ export interface PermissionItem {
     reason?: SensitiveReason;
 }
 /**
- * 敏感的能力（D10 + 计划扩展，F-AI）：`sandbox@1` 在部署里执行任意命令、`object-store@1` 保管全部附件与插件包（D10）；
+ * 敏感的能力（D10 + 计划扩展，F-AI）：`sandbox@2` 在部署里执行任意命令、`object-store@1` 保管全部附件与插件包（D10）；
  * `channel@1` 收到组织在 IM 里的对话内容（Ruling A33）、`directory@1` 能把人加进组织（并为其建账号、建身份）、
  * `identity-source@1` 决定谁能登录成哪个账号。插件提供其中任何一个时，「提供」一组标为敏感，
- * 后台插件列表的 `sensitive` 为真，须企业管理员批准。只影响展示，不改权限快照的键。
+ * 后台插件列表的 `sensitive` 为真，须超级管理员批准。只影响展示，不改权限快照的键。
  */
 export declare const SENSITIVE_EXTENSION_POINTS: readonly string[];
 /**
@@ -59,7 +60,7 @@ export type DeploymentExtensionStatus = "enabled" | "disabled" | "pending_approv
 /** The stored package is in the pre-0.1.0 format: reinstall it from a repacked tgz. */
  | "legacy_format";
 /**
- * 需要企业管理员处理的状态（后台概览「需要处理的插件」）：待批准、待配置、失败、依赖缺失，以及副本不一致
+ * 需要超级管理员处理的状态（后台概览「需要处理的插件」）：待批准、待配置、失败、依赖缺失，以及副本不一致
  * （`converging` 收敛中、`pending_migration` 待迁移）。
  */
 export declare function extensionNeedsAction(status: DeploymentExtensionStatus): boolean;
@@ -114,13 +115,24 @@ export interface AdminExtensionView {
     /** 有部署级配置字段。 */
     configurable: boolean;
     configValid: boolean;
+    /**
+     * Only when the platform config leaves required overridable fields empty (spec A §5.4a; the
+     * extension still runs): the number of orgs where it is on and that still need their own config.
+     */
+    orgsNeedingConfig?: number;
     /** 能从部署卸载（只有安装记录，必需的引导插件除外；卸载前须先停用）。 */
     removable: boolean;
     /**
      * A required bootstrap plugin (package ecosystem spec §7): enabled in every org, cannot be
-     * disabled or uninstalled; an enterprise admin may upgrade it.
+     * disabled or uninstalled; a super admin may upgrade it.
      */
     required: boolean;
+    /** The scope of the catalog plugin the extension ships in (builtin: `all`); null without one. */
+    scope: PluginScope | null;
+    /** Orgs where the extension is enabled (a required plugin: every org). */
+    enabledOrgs: number;
+    /** Shipped with the deployment (a builtin plugin or a required bootstrap plugin). */
+    builtin: boolean;
     /** Where the install record came from (`bootstrap` for the bootstrap step); null for config-declared. */
     installSource: "npm" | "file" | "catalog" | "bootstrap" | null;
     /**

package/dist/extensions/permission-view.js

@@ -18,16 +18,16 @@ export function reviewHash(set, warnings = []) {
     return h.digest("hex").slice(0, 16);
 }
 /**
- * 敏感的能力（D10 + 计划扩展，F-AI）：`sandbox@1` 在部署里执行任意命令、`object-store@1` 保管全部附件与插件包（D10）；
+ * 敏感的能力（D10 + 计划扩展，F-AI）：`sandbox@2` 在部署里执行任意命令、`object-store@1` 保管全部附件与插件包（D10）；
  * `channel@1` 收到组织在 IM 里的对话内容（Ruling A33）、`directory@1` 能把人加进组织（并为其建账号、建身份）、
  * `identity-source@1` 决定谁能登录成哪个账号。插件提供其中任何一个时，「提供」一组标为敏感，
- * 后台插件列表的 `sensitive` 为真，须企业管理员批准。只影响展示，不改权限快照的键。
+ * 后台插件列表的 `sensitive` 为真，须超级管理员批准。只影响展示，不改权限快照的键。
  */
 export const SENSITIVE_EXTENSION_POINTS = [
     "channel@1",
     "directory@1",
     "identity-source@1",
-    "sandbox@1",
+    "sandbox@2",
     "object-store@1",
 ];
 /** 总是敏感的类别。 */
@@ -159,7 +159,7 @@ export function permissionGroups(set) {
     });
 }
 /**
- * 需要企业管理员处理的状态（后台概览「需要处理的插件」）：待批准、待配置、失败、依赖缺失，以及副本不一致
+ * 需要超级管理员处理的状态（后台概览「需要处理的插件」）：待批准、待配置、失败、依赖缺失，以及副本不一致
  * （`converging` 收敛中、`pending_migration` 待迁移）。
  */
 export function extensionNeedsAction(status) {

package/dist/extensions/plugin-items.d.ts

@@ -0,0 +1,21 @@
+import type { PluginScope } from "../catalog/scope.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+/** The catalog item (the plugin) an extension ships in. */
+export interface ExtensionPluginItem {
+    id: string;
+    scope: PluginScope;
+    builtin: boolean;
+    disabled: boolean;
+}
+/**
+ * The live catalog items of each extension in `names`, the one recorded on its install
+ * (`extension_installs.catalog_item_id`) first, then its other `extension_catalog_sources` by id.
+ * An extension without a live item (declared in the startup config, or its items deleted) is absent.
+ * `db` may be a transaction.
+ */
+export declare function pluginItemsOf(db: KernelSchemaDb, names: readonly string[]): Promise<Map<string, ExtensionPluginItem[]>>;
+/**
+ * Whether an item keeps its plugin on in every org (builtin only: an org may switch off an `all`
+ * one, layering spec §4): its switch cannot go off.
+ */
+export declare const itemLocked: (i: ExtensionPluginItem) => boolean;

package/dist/extensions/plugin-items.js

@@ -0,0 +1,42 @@
+/**
+ * The live catalog items of each extension in `names`, the one recorded on its install
+ * (`extension_installs.catalog_item_id`) first, then its other `extension_catalog_sources` by id.
+ * An extension without a live item (declared in the startup config, or its items deleted) is absent.
+ * `db` may be a transaction.
+ */
+export async function pluginItemsOf(db, names) {
+    const out = new Map();
+    if (names.length === 0)
+        return out;
+    const add = (plugin, item) => {
+        const list = out.get(plugin) ?? [];
+        if (!list.some((i) => i.id === item.id))
+            list.push(item);
+        out.set(plugin, list);
+    };
+    const own = await db
+        .selectFrom("extension_installs as e")
+        .innerJoin("catalog_items as i", "i.id", "e.catalog_item_id")
+        .select(["e.name as plugin", "i.id", "i.scope", "i.builtin", "i.disabled"])
+        .where("e.name", "in", [...names])
+        .where("i.deleted_at", "is", null)
+        .execute();
+    for (const r of own)
+        add(r.plugin, r);
+    const sources = await db
+        .selectFrom("extension_catalog_sources as s")
+        .innerJoin("catalog_items as i", "i.id", "s.item_id")
+        .select(["s.plugin", "i.id", "i.scope", "i.builtin", "i.disabled"])
+        .where("s.plugin", "in", [...names])
+        .where("i.deleted_at", "is", null)
+        .orderBy("i.id")
+        .execute();
+    for (const r of sources)
+        add(r.plugin, r);
+    return out;
+}
+/**
+ * Whether an item keeps its plugin on in every org (builtin only: an org may switch off an `all`
+ * one, layering spec §4): its switch cannot go off.
+ */
+export const itemLocked = (i) => i.builtin;

package/dist/extensions/point-defaults.d.ts

@@ -1,14 +1,19 @@
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
+import { EffectiveConfigs } from "./effective-config.js";
 import { OrgExtensionConfigs } from "./org-config.js";
 import { ExtensionRegistry } from "./registry.js";
-/** The outcome of {@link ExtensionPointDefaults.resolve}. */
+/**
+ * The outcome of {@link ExtensionPointDefaults.resolve}: the provider with its org config and its
+ * effective deployment config for the org (layering spec A §6), both to pass back to it.
+ */
 export type PointResolution<T> = {
     ok: true;
     extension: string;
     impl: T;
     orgConfig: unknown;
+    config: unknown;
 } | {
     ok: false;
     reason: "none" | "ambiguous";
@@ -26,8 +31,8 @@ export interface OrgPointDefaultView {
 /**
  * The org default provider of an `org-default` extension point (web tools spec §6). Per call,
  * never cached in process: the candidates are the providers loaded on this replica that are
- * enabled in the org, whose org config is valid and whose `configured()` (when present) does not
- * return false. One candidate is used as is; several need the org's stored default
+ * enabled in the org, whose org config and effective deployment config for the org (layering spec
+ * A §6) are valid, and whose `configured()` (when present) does not return false. One candidate is used as is; several need the org's stored default
  * (`capybara.org_extension_point_defaults`), else the choice is ambiguous. A stored default that
  * is not a candidate (disabled, uninstalled, unconfigured) stays and counts again once it is one.
  */
@@ -36,11 +41,13 @@ export declare class ExtensionPointDefaults {
     readonly txHost: TransactionHost;
     private readonly registry;
     private readonly orgConfigs;
+    private readonly effective;
     private readonly log;
-    constructor(kdb: KernelDb, txHost: TransactionHost, registry: Pick<ExtensionRegistry, "list">, orgConfigs: Pick<OrgExtensionConfigs, "get">, log: KernelLogger);
+    constructor(kdb: KernelDb, txHost: TransactionHost, registry: Pick<ExtensionRegistry, "list">, orgConfigs: Pick<OrgExtensionConfigs, "get">, effective: Pick<EffectiveConfigs, "get">, log: KernelLogger);
     /**
      * The provider of `point` (the name without the major, e.g. `web-search`) for `orgId`, with the
-     * org's decrypted config to pass back to it. Throws when the point has no `selection`.
+     * org's decrypted config and the effective deployment config to pass back to it. Throws when the
+     * point has no `selection`.
      */
     resolve<T>(orgId: string, point: string): Promise<PointResolution<T>>;
     /** Every `org-default` point with its candidates, stored default and effective provider. */

package/dist/extensions/point-defaults.js

@@ -15,6 +15,7 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { EffectiveConfigs } from "./effective-config.js";
 import { enabledExtensionsQuery, isExtensionEnabled } from "./enabled.js";
 import { OrgExtensionConfigs } from "./org-config.js";
 import { ExtensionRegistry } from "./registry.js";
@@ -28,8 +29,8 @@ const hasSelection = (point) => EXTENSION_POINTS[point]?.selection === "org-defa
 /**
  * The org default provider of an `org-default` extension point (web tools spec §6). Per call,
  * never cached in process: the candidates are the providers loaded on this replica that are
- * enabled in the org, whose org config is valid and whose `configured()` (when present) does not
- * return false. One candidate is used as is; several need the org's stored default
+ * enabled in the org, whose org config and effective deployment config for the org (layering spec
+ * A §6) are valid, and whose `configured()` (when present) does not return false. One candidate is used as is; several need the org's stored default
  * (`capybara.org_extension_point_defaults`), else the choice is ambiguous. A stored default that
  * is not a candidate (disabled, uninstalled, unconfigured) stays and counts again once it is one.
  */
@@ -38,17 +39,20 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
     txHost;
     registry;
     orgConfigs;
+    effective;
     log;
-    constructor(kdb, txHost, registry, orgConfigs, log) {
+    constructor(kdb, txHost, registry, orgConfigs, effective, log) {
         this.kdb = kdb;
         this.txHost = txHost;
         this.registry = registry;
         this.orgConfigs = orgConfigs;
+        this.effective = effective;
         this.log = log;
     }
     /**
      * The provider of `point` (the name without the major, e.g. `web-search`) for `orgId`, with the
-     * org's decrypted config to pass back to it. Throws when the point has no `selection`.
+     * org's decrypted config and the effective deployment config to pass back to it. Throws when the
+     * point has no `selection`.
      */
     async resolve(orgId, point) {
         if (!hasSelection(point)) {
@@ -59,7 +63,13 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
         if (!chosen.ok)
             return chosen;
         const c = chosen.candidate;
-        return { ok: true, extension: c.extension, impl: c.impl, orgConfig: c.orgConfig };
+        return {
+            ok: true,
+            extension: c.extension,
+            impl: c.impl,
+            orgConfig: c.orgConfig,
+            config: c.config,
+        };
     }
     /** Every `org-default` point with its candidates, stored default and effective provider. */
     async list(orgId) {
@@ -145,11 +155,28 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
             }
             if (!cfg?.enabled)
                 continue;
-            const configured = impl.configured;
+            // spec A §6: an org whose effective config is not valid gets no call from this extension
+            let effective;
+            try {
+                effective = await this.effective.get(orgId, extension);
+            }
+            catch (err) {
+                this.log.warn("org default provider: provider excluded, cannot read its effective config", {
+                    orgId,
+                    point,
+                    extension,
+                    err,
+                });
+                continue;
+            }
+            if (!effective.ok)
+                continue;
+            const configured = impl
+                .configured;
             if (typeof configured === "function") {
                 let ok;
                 try {
-                    ok = configured.call(impl, cfg.config) !== false;
+                    ok = configured.call(impl, cfg.config, effective.config) !== false;
                 }
                 catch (err) {
                     this.log.warn("org default provider: provider excluded, configured() threw", {
@@ -163,7 +190,7 @@ let ExtensionPointDefaults = class ExtensionPointDefaults {
                 if (!ok)
                     continue;
             }
-            out.push({ extension, impl, orgConfig: cfg.config });
+            out.push({ extension, impl, orgConfig: cfg.config, config: effective.config });
         }
         return out.sort((a, b) => (a.extension < b.extension ? -1 : a.extension > b.extension ? 1 : 0));
     }
@@ -191,7 +218,8 @@ ExtensionPointDefaults = __decorate([
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(ExtensionRegistry)),
     __param(3, Inject(OrgExtensionConfigs)),
-    __param(4, Inject(KERNEL_LOGGER))
+    __param(4, Inject(EffectiveConfigs)),
+    __param(5, Inject(KERNEL_LOGGER))
 ], ExtensionPointDefaults);
 export { ExtensionPointDefaults };
 /** Rules 2-4 of spec §6: one candidate → it; several → the stored default if a candidate. */

package/dist/extensions/resolve.d.ts

@@ -1,7 +1,11 @@
 import { type ExtensionManifest } from "@capybara-hq/plugin-sdk";
 /** 插件依赖解析失败（信息列出插件名与能力名）。 */
 export declare class ExtensionResolveError extends Error {
-    constructor(message: string);
+    /** Error code of the failure, when it has one. */
+    readonly code?: string | undefined;
+    constructor(message: string, 
+    /** Error code of the failure, when it has one. */
+    code?: string | undefined);
 }
 /**
  * 校验 sdk 范围、依赖满足度、单选能力唯一性与无环，返回按依赖拓扑排序后的列表（同层保持输入顺序）。

package/dist/extensions/resolve.js

@@ -1,9 +1,13 @@
-import { EXTENSION_POINT_CARDINALITY, OBJECT_STORE_EXTENSION_POINT, parseExtensionPoint, } from "@capybara-hq/plugin-sdk";
+import { EXTENSION_POINT_CARDINALITY, EXTENSION_POINTS, OBJECT_STORE_EXTENSION_POINT, parseExtensionPoint, } from "@capybara-hq/plugin-sdk";
 import semver from "semver";
 /** 插件依赖解析失败（信息列出插件名与能力名）。 */
 export class ExtensionResolveError extends Error {
-    constructor(message) {
+    code;
+    constructor(message, 
+    /** Error code of the failure, when it has one. */
+    code) {
         super(message);
+        this.code = code;
         this.name = "ExtensionResolveError";
     }
 }
@@ -23,6 +27,15 @@ export function resolveExtensions(manifests, sdkVersion) {
             throw new ExtensionResolveError(`plugin ${m.name}: sdk range "${m.sdk}" is not satisfied by SDK_VERSION ${sdkVersion}`);
         }
     }
+    for (const m of manifests) {
+        for (const ref of m.provides) {
+            const { name, major } = parseExtensionPoint(ref);
+            const majors = EXTENSION_POINTS[name]?.majors;
+            if (majors && !majors.includes(major)) {
+                throw new ExtensionResolveError(`Plugin ${m.name} provides ${ref}, which this kernel no longer supports; upgrade it to a version that provides ${name}@${Math.max(...majors)}.`, "extension.unsupported_extension_point");
+            }
+        }
+    }
     const providers = new Map();
     for (const m of manifests) {
         for (const cap of m.provides)

package/dist/files/previewers.d.ts

@@ -1,5 +1,6 @@
 import { type FilePreviewer, type Logger, type UiView } from "@capybara-hq/plugin-sdk";
 import { ConversationFiles } from "../conversations/files.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { ExtensionHost } from "../extensions/host.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -39,7 +40,7 @@ export declare class PreviewerRegistry {
     readonly txHost: TransactionHost;
     private readonly timeoutMs;
     private readonly d;
-    constructor(kdb: Pick<KernelDb, "db">, host: Pick<ExtensionHost, "list" | "enabledPlugins">, files: Pick<ConversationFiles, "file">, storage: Pick<StorageService, "kernel">, log: Pick<Logger, "warn">, txHost: TransactionHost, timeoutMs?: number);
+    constructor(kdb: Pick<KernelDb, "db">, host: Pick<ExtensionHost, "list" | "enabledPlugins">, files: Pick<ConversationFiles, "file">, storage: Pick<StorageService, "kernel">, effective: Pick<EffectiveConfigs, "get">, log: Pick<Logger, "warn">, txHost: TransactionHost, timeoutMs?: number);
     /** Every previewer loaded on this replica, in provider order (load order, then list order). */
     private loaded;
     /** The org's previewers (enabled extensions only) in its order, disabled ones included. */
@@ -65,6 +66,12 @@ export declare class PreviewerRegistry {
     private putIn;
     /** Previewers that take this file (viewer must read the conversation), in the org's order. */
     forFile(orgId: string, conversationId: string, viewer: string, fileId: string): Promise<PreviewerItem[]>;
+    /**
+     * The org's enabled previewers that take the file, each with its extension's effective config
+     * for the org. An extension whose effective config is not valid in the org (or cannot be read)
+     * previews nothing there (layering spec A §6): its previewers are left out, so the next one or a
+     * built-in takes the file.
+     */
     private accepting;
     /**
      * Renders a view previewer for one file: 404 `ui.not_found` when it does not take the file (or is

package/dist/files/previewers.js

@@ -12,6 +12,7 @@ import { Inject, Injectable, Optional } from "@nestjs/common";
 import { sql } from "kysely";
 import { ConversationFiles } from "../conversations/files.js";
 import { ApiError } from "../errors.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { ExtensionHost } from "../extensions/host.js";
 import { audit } from "../identity/audit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -71,7 +72,7 @@ let PreviewerRegistry = class PreviewerRegistry {
     txHost;
     timeoutMs;
     d;
-    constructor(kdb, host, files, storage, log, txHost, timeoutMs = FILE_PREVIEW_TIMEOUT_MS) {
+    constructor(kdb, host, files, storage, effective, log, txHost, timeoutMs = FILE_PREVIEW_TIMEOUT_MS) {
         this.txHost = txHost;
         this.timeoutMs = timeoutMs;
         this.d = {
@@ -82,6 +83,7 @@ let PreviewerRegistry = class PreviewerRegistry {
             enabledPlugins: (orgId) => host.enabledPlugins(orgId),
             files,
             storage,
+            effective,
             log,
         };
     }
@@ -186,8 +188,33 @@ let PreviewerRegistry = class PreviewerRegistry {
         const file = await this.d.files.file(orgId, conversationId, viewer, fileId);
         return (await this.accepting(orgId, file)).map(item);
     }
+    /**
+     * The org's enabled previewers that take the file, each with its extension's effective config
+     * for the org. An extension whose effective config is not valid in the org (or cannot be read)
+     * previews nothing there (layering spec A §6): its previewers are left out, so the next one or a
+     * built-in takes the file.
+     */
     async accepting(orgId, file) {
-        return (await this.ordered(orgId)).filter((l) => !l.disabled && previewerAccepts(l.previewer, file));
+        const taking = (await this.ordered(orgId)).filter((l) => !l.disabled && previewerAccepts(l.previewer, file));
+        const configs = new Map();
+        for (const plugin of new Set(taking.map((l) => l.plugin))) {
+            try {
+                const e = await this.d.effective.get(orgId, plugin);
+                configs.set(plugin, e.ok ? { config: e.config } : null);
+            }
+            catch (err) {
+                this.d.log.warn("file previewer left out: cannot read its effective config", {
+                    orgId,
+                    plugin,
+                    err,
+                });
+                configs.set(plugin, null);
+            }
+        }
+        return taking.flatMap((l) => {
+            const c = configs.get(l.plugin);
+            return c ? [{ ...l, config: c.config }] : [];
+        });
     }
     /**
      * Renders a view previewer for one file: 404 `ui.not_found` when it does not take the file (or is
@@ -224,6 +251,7 @@ let PreviewerRegistry = class PreviewerRegistry {
                             accountId: t.accountId,
                             conversationId: t.conversationId,
                             locale: t.locale,
+                            config: l.config,
                             signal: s,
                             file: {
                                 id: file.id,
@@ -289,9 +317,10 @@ PreviewerRegistry = __decorate([
     __param(1, Inject(ExtensionHost)),
     __param(2, Inject(ConversationFiles)),
     __param(3, Inject(StorageService)),
-    __param(4, Inject(KERNEL_LOGGER)),
-    __param(5, Inject(TransactionHost)),
-    __param(6, Optional()),
-    __param(6, Inject(FILE_PREVIEW_TIMEOUT))
+    __param(4, Inject(EffectiveConfigs)),
+    __param(5, Inject(KERNEL_LOGGER)),
+    __param(6, Inject(TransactionHost)),
+    __param(7, Optional()),
+    __param(7, Inject(FILE_PREVIEW_TIMEOUT))
 ], PreviewerRegistry);
 export { PreviewerRegistry };

package/dist/http/api.module.js

@@ -13,25 +13,30 @@ import { SetupController } from "../admin/setup.controller.js";
 import { AgentsController } from "../agents/agents.controller.js";
 import { AgentsModule } from "../agents/agents.module.js";
 import { ModelsController } from "../agents/models.controller.js";
+import { PendingConnectorsController } from "../agents/pending-connectors.controller.js";
 import { ReadinessController } from "../agents/readiness.controller.js";
-import { AgentTemplatesController } from "../agents/templates.controller.js";
+import { AgentSaveAsTemplateController, AgentTemplatesController, } from "../agents/templates.controller.js";
 import { BackgroundController } from "../background/background.controller.js";
 import { BackgroundModule } from "../background/background.module.js";
 import { AdminCatalogController } from "../catalog/admin-catalog.controller.js";
 import { CatalogModule } from "../catalog/catalog.module.js";
-import { MarketplacesController } from "../catalog/marketplaces.controller.js";
+import { AdminComponentsController, OrgComponentsController, } from "../catalog/component-scope.controller.js";
+import { MarketplacesController, OrgMarketplacesController, } from "../catalog/marketplaces.controller.js";
 import { AdminCatalogRequestsController, OrgCatalogController, } from "../catalog/org-catalog.controller.js";
+import { OrgExtensionConfigsController, OrgExtensionOverridesController, OrgExtensionToolSwitchesController, } from "../catalog/org-extension.controller.js";
+import { OrgOwnedPluginsController, OrgPluginUploadsController, } from "../catalog/org-plugin-uploads.controller.js";
 import { ChannelsModule } from "../channels/channels.module.js";
 import { ChannelConnectionsController } from "../channels/connections.controller.js";
 import { AttachmentsController } from "../conversations/attachments.controller.js";
 import { ConversationsController } from "../conversations/conversations.controller.js";
 import { ConversationsModule } from "../conversations/conversations.module.js";
+import { EnvironmentsController } from "../environments/environments.controller.js";
+import { EnvironmentsModule } from "../environments/environments.module.js";
 import { EvalsModule } from "../evals/evals.module.js";
 import { EvalRunsController } from "../evals/runs.controller.js";
 import { EvalSetsController } from "../evals/sets.controller.js";
 import { TrajectoryController } from "../evals/trajectory.controller.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
-import { OrgExtensionConfigsController } from "../extensions/org-config.controller.js";
 import { ExtensionPointDefaultsController } from "../extensions/point-defaults.controller.js";
 import { FilesModule } from "../files/files.module.js";
 import { FilePreviewersController } from "../files/previewers.controller.js";
@@ -41,6 +46,7 @@ import { IdentityModule } from "../identity/identity.module.js";
 import { MeController } from "../identity/me.controller.js";
 import { BindController, MeIdentitiesController, SsoController, } from "../identity/sso.controller.js";
 import { InboxModule } from "../inbox/inbox.module.js";
+import { PlatformInboxController } from "../inbox/platform-inbox.controller.js";
 import { ModelsModule } from "../models/models.module.js";
 import { ModelPurposesController } from "../models/purposes.controller.js";
 import { DirectorySyncController } from "../orgs/directory-sync.controller.js";
@@ -58,6 +64,7 @@ import { StorageModule } from "../storage/storage.module.js";
 import { ApprovalsController, ToolGrantsController } from "../tools/approvals.controller.js";
 import { ConnectorContentController } from "../tools/connector-content.controller.js";
 import { ConnectorsController } from "../tools/connectors.controller.js";
+import { ExtensionToolsController } from "../tools/extension-tools.controller.js";
 import { OAuthCallbackController, OAuthConnectController, } from "../tools/oauth/oauth.controller.js";
 import { QuestionsController } from "../tools/questions.controller.js";
 import { ToolsModule } from "../tools/tools.module.js";
@@ -74,26 +81,35 @@ const CONTROLLERS = [
     AdminController,
     AdminExtensionsController,
     AdminCatalogController,
+    AdminComponentsController,
     MarketplacesController,
+    OrgMarketplacesController,
     OrgExtensionConfigsController,
+    OrgExtensionOverridesController,
+    OrgExtensionToolSwitchesController,
     AgentsController,
     AgentTemplatesController,
+    AgentSaveAsTemplateController,
+    PendingConnectorsController,
     ModelsController,
     ReadinessController,
     ConversationsController,
     BackgroundController,
+    EnvironmentsController,
     AttachmentsController,
     SkillsController,
     SkillChangesController,
     AgentSkillsController,
     InvocableSkillsController,
     InboxController,
+    PlatformInboxController,
     ConversationStreamController,
     ConnectorContentController,
     ConnectorsController,
     ApprovalsController,
     ToolGrantsController,
     QuestionsController,
+    ExtensionToolsController,
     OAuthConnectController,
     OAuthCallbackController,
     SsoController,
@@ -109,6 +125,9 @@ const CONTROLLERS = [
     EvalRunsController,
     ModelPurposesController,
     OrgCatalogController,
+    OrgPluginUploadsController,
+    OrgOwnedPluginsController,
+    OrgComponentsController,
     AdminCatalogRequestsController,
 ];
 /**
@@ -134,6 +153,7 @@ ApiModule = __decorate([
             AgentsModule,
             ConversationsModule,
             BackgroundModule,
+            EnvironmentsModule,
             RuntimeModule,
             ChannelsModule,
             EvalsModule,

package/dist/http/app.d.ts

@@ -45,7 +45,7 @@ export interface CreateHttpAppOptions {
     replicaId?: string | undefined;
     /**
      * The size limit for package uploads ({@link PACKAGE_UPLOAD_ROUTES}: extension packages and
-     * enterprise catalog packages, `application/octet-stream`), i.e. `packages.maxBytes`. The route
+     * platform catalog packages, `application/octet-stream`), i.e. `packages.maxBytes`. The route
      * bodyLimit is one byte more: a package exactly one byte over reaches the handler and returns
      * `extension.package_too_large`; larger ones are refused by Fastify itself (413
      * `payload_too_large`).
@@ -56,11 +56,20 @@ export interface CreateHttpAppOptions {
 export declare const EXTENSION_PACKAGE_UPLOAD_ROUTE = "/api/v1/admin/extensions/packages/file";
 /** The plugin package upload route of the catalog import (Fastify route template). */
 export declare const CATALOG_UPLOAD_ROUTE = "/api/v1/admin/catalog/import/file";
+/** The platform skill version upload route (a skill package zip as the raw body). */
+export declare const COMPONENT_SKILL_UPLOAD_ROUTE = "/api/v1/admin/components/skill/:id/versions";
 /**
  * The upload routes that take raw bytes (`application/octet-stream`, limit `packages.maxBytes`,
- * the enterprise admin is authenticated before the body is read).
+ * the super admin is authenticated before the body is read).
  */
 export declare const PACKAGE_UPLOAD_ROUTES: ReadonlySet<string>;
+/** An org admin's plugin package upload (spec §14, ruling P3-7; a tgz as the raw body). */
+export declare const ORG_PLUGIN_UPLOAD_ROUTE = "/api/v1/orgs/:orgId/catalog/uploads/file";
+/**
+ * The org routes that take raw package bytes (limit `packages.maxBytes`): before the body is read
+ * the caller is authenticated as a person with the org role of `catalog.upload` (ruling P3-29).
+ */
+export declare const ORG_PACKAGE_UPLOAD_ROUTES: ReadonlySet<string>;
 /**
  * Sets up the Fastify side of the kernel's Nest application (built by `buildKernelApp` from
  * `KernelModule`, which provides the health endpoints and the API) without connecting to anything,