@capybara-hq/kernel 0.1.0-rc.6 → 0.1.0-rc.8

package/dist/catalog/org-extension.schemas.d.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** Route parameters of the overrides and tool switch routes (decision R20). */
+export declare const OrgExtensionParams: z.ZodObject<{
+    extension: z.ZodString;
+}, z.core.$strip>;
+export declare const OrgExtensionToolParams: z.ZodObject<{
+    extension: z.ZodString;
+    tool: z.ZodString;
+}, z.core.$strip>;
+export declare const OrgToolSwitchPut: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    confirm: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const ORG_EXTENSION_ROUTES: readonly RouteSchemas[];

package/dist/catalog/org-extension.schemas.js

@@ -0,0 +1,22 @@
+import { z } from "zod";
+/** Route parameters of the overrides and tool switch routes (decision R20). */
+export const OrgExtensionParams = z.object({ extension: z.string().min(1).max(64) });
+export const OrgExtensionToolParams = OrgExtensionParams.extend({
+    tool: z.string().min(1).max(64),
+});
+export const OrgToolSwitchPut = z
+    .object({
+    enabled: z.boolean(),
+    /** The hash of the switch-off preview, to confirm turning the tool off. */
+    confirm: z.string().min(1).max(128).optional(),
+})
+    .strict();
+export const ORG_EXTENSION_ROUTES = [
+    { route: "GET /api/v1/orgs/:orgId/extensions" },
+    { route: "GET /api/v1/orgs/:orgId/extensions/:extension/tools", params: OrgExtensionParams },
+    {
+        route: "PUT /api/v1/orgs/:orgId/extensions/:extension/tools/:tool",
+        params: OrgExtensionToolParams,
+        body: OrgToolSwitchPut,
+    },
+];

package/dist/catalog/org-plugin-uploads.controller.d.ts

@@ -1,27 +1,11 @@
-import { z } from "zod";
+import type { z } from "zod";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
 import type { CatalogItemView } from "./catalog.service.js";
 import { CatalogScopeService } from "./catalog-scope.service.js";
 import { OrgPluginUploads, type OrgUploadOutcome, type OrgUploadReview } from "./org-plugin-uploads.js";
+import { OrgUploadConfirmBody as ConfirmBody, OrgOwnedDeleteBody as DeleteBody, OrgOwnedPluginParams as OwnedParams, OrgOwnedShareableBody as ShareableBody, OrgUploadStagingParams as StagingParams } from "./org-plugin-uploads.schemas.js";
 import { type OwnedDeletePreview, OwnedItems } from "./owned-items.js";
-declare const StagingParams: z.ZodObject<{
-    stagingId: z.ZodString;
-}, z.core.$strip>;
-declare const OwnedParams: z.ZodObject<{
-    id: z.ZodString;
-}, z.core.$strip>;
-declare const ConfirmBody: z.ZodObject<{
-    reviewHash: z.ZodString;
-    shareable: z.ZodOptional<z.ZodBoolean>;
-    pinnedSuggestions: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
-declare const ShareableBody: z.ZodObject<{
-    shareable: z.ZodBoolean;
-}, z.core.$strict>;
-declare const DeleteBody: z.ZodObject<{
-    previewHash: z.ZodString;
-}, z.core.$strict>;
 /**
  * An org admin's plugin uploads (`/api/v1/orgs/:orgId/catalog/uploads/*`, spec §14, rulings P3-7,
  * P3-8): a `.tgz` without an extension, prepared (one review) and confirmed like the super admin's
@@ -95,4 +79,3 @@ export declare class OrgOwnedPluginsController {
      */
     withdraw(principal: Principal, org: OrgContext, params: z.infer<typeof OwnedParams>): Promise<void>;
 }
-export {};

package/dist/catalog/org-plugin-uploads.controller.js

@@ -8,7 +8,6 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Controller, Delete, Get, HttpCode, Inject, Post, Put, Req } from "@nestjs/common";
-import { z } from "zod";
 import { ApiError } from "../errors.js";
 import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
@@ -16,29 +15,17 @@ import { ZBody, ZParam } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
 import { CatalogScopeService } from "./catalog-scope.service.js";
 import { OrgPluginUploads, } from "./org-plugin-uploads.js";
+import { OrgUploadConfirmBody as ConfirmBody, OrgOwnedDeleteBody as DeleteBody, OrgOwnedPluginParams as OwnedParams, OrgOwnedShareableBody as ShareableBody, OrgUploadStagingParams as StagingParams, } from "./org-plugin-uploads.schemas.js";
 import { OwnedItems } from "./owned-items.js";
-const StagingParams = z.object({ stagingId: z.string().min(1).max(100) });
-const OwnedParams = z.object({ id: z.string().min(1).max(100) });
-const ConfirmBody = z
-    .object({
-    reviewHash: z.string().min(1).max(128),
-    /** The org shares the new item with other orgs (default false, P3-16). */
-    shareable: z.boolean().optional(),
-    /** Skill names suggested as pinned (spec §9.1); omitted keeps the plugin's flags. */
-    pinnedSuggestions: z.array(z.string().min(1).max(64)).max(50).optional(),
-})
-    .strict();
-class OrgUploadStagingParams extends createZodDto(StagingParams, "OrgUploadStagingParams") {
+class OrgUploadStagingParamsDto extends createZodDto(StagingParams, "OrgUploadStagingParams") {
 }
-class OrgUploadConfirmBody extends createZodDto(ConfirmBody, "OrgUploadConfirmBody") {
+class OrgUploadConfirmBodyDto extends createZodDto(ConfirmBody, "OrgUploadConfirmBody") {
 }
-class OrgOwnedPluginParams extends createZodDto(OwnedParams, "OrgOwnedPluginParams") {
+class OrgOwnedPluginParamsDto extends createZodDto(OwnedParams, "OrgOwnedPluginParams") {
 }
-const ShareableBody = z.object({ shareable: z.boolean() }).strict();
-const DeleteBody = z.object({ previewHash: z.string().min(1).max(128) }).strict();
-class OrgOwnedShareableBody extends createZodDto(ShareableBody, "OrgOwnedShareableBody") {
+class OrgOwnedShareableBodyDto extends createZodDto(ShareableBody, "OrgOwnedShareableBody") {
 }
-class OrgOwnedDeleteBody extends createZodDto(DeleteBody, "OrgOwnedDeleteBody") {
+class OrgOwnedDeleteBodyDto extends createZodDto(DeleteBody, "OrgOwnedDeleteBody") {
 }
 const actorOpts = (actor) => {
     const tokenId = patTokenId(actor);
@@ -107,7 +94,7 @@ __decorate([
     Get(":stagingId"),
     OrgAction("catalog.upload"),
     __param(0, CurrentOrg()),
-    __param(1, ZParam(OrgUploadStagingParams))
+    __param(1, ZParam(OrgUploadStagingParamsDto))
 ], OrgPluginUploadsController.prototype, "staged", null);
 __decorate([
     Post(":stagingId/confirm"),
@@ -115,8 +102,8 @@ __decorate([
     OrgAction("catalog.upload"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, ZParam(OrgUploadStagingParams)),
-    __param(3, ZBody(OrgUploadConfirmBody))
+    __param(2, ZParam(OrgUploadStagingParamsDto)),
+    __param(3, ZBody(OrgUploadConfirmBodyDto))
 ], OrgPluginUploadsController.prototype, "confirm", null);
 OrgPluginUploadsController = __decorate([
     Controller("api/v1/orgs/:orgId/catalog/uploads"),
@@ -178,15 +165,15 @@ __decorate([
     OrgAction("catalog.upload"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, ZParam(OrgOwnedPluginParams)),
-    __param(3, ZBody(OrgOwnedShareableBody))
+    __param(2, ZParam(OrgOwnedPluginParamsDto)),
+    __param(3, ZBody(OrgOwnedShareableBodyDto))
 ], OrgOwnedPluginsController.prototype, "setShareable", null);
 __decorate([
     Post(":id/delete/preview"),
     HttpCode(200),
     OrgAction("catalog.upload"),
     __param(0, CurrentOrg()),
-    __param(1, ZParam(OrgOwnedPluginParams))
+    __param(1, ZParam(OrgOwnedPluginParamsDto))
 ], OrgOwnedPluginsController.prototype, "previewDelete", null);
 __decorate([
     Post(":id/delete"),
@@ -194,8 +181,8 @@ __decorate([
     OrgAction("catalog.upload"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, ZParam(OrgOwnedPluginParams)),
-    __param(3, ZBody(OrgOwnedDeleteBody))
+    __param(2, ZParam(OrgOwnedPluginParamsDto)),
+    __param(3, ZBody(OrgOwnedDeleteBodyDto))
 ], OrgOwnedPluginsController.prototype, "delete", null);
 __decorate([
     Delete(":id/pending"),
@@ -203,7 +190,7 @@ __decorate([
     OrgAction("catalog.upload"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, ZParam(OrgOwnedPluginParams))
+    __param(2, ZParam(OrgOwnedPluginParamsDto))
 ], OrgOwnedPluginsController.prototype, "withdraw", null);
 OrgOwnedPluginsController = __decorate([
     Controller("api/v1/orgs/:orgId/owned-plugins"),

package/dist/catalog/org-plugin-uploads.schemas.d.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+export declare const OrgUploadStagingParams: z.ZodObject<{
+    stagingId: z.ZodString;
+}, z.core.$strip>;
+export declare const OrgOwnedPluginParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const OrgUploadConfirmBody: z.ZodObject<{
+    reviewHash: z.ZodString;
+    shareable: z.ZodOptional<z.ZodBoolean>;
+    pinnedSuggestions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export declare const OrgOwnedShareableBody: z.ZodObject<{
+    shareable: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const OrgOwnedDeleteBody: z.ZodObject<{
+    previewHash: z.ZodString;
+}, z.core.$strict>;
+export declare const ORG_PLUGIN_UPLOAD_ROUTES: readonly RouteSchemas[];

package/dist/catalog/org-plugin-uploads.schemas.js

@@ -0,0 +1,32 @@
+import { z } from "zod";
+export const OrgUploadStagingParams = z.object({ stagingId: z.string().min(1).max(100) });
+export const OrgOwnedPluginParams = z.object({ id: z.string().min(1).max(100) });
+export const OrgUploadConfirmBody = z
+    .object({
+    reviewHash: z.string().min(1).max(128),
+    /** The org shares the new item with other orgs (default false, P3-16). */
+    shareable: z.boolean().optional(),
+    /** Skill names suggested as pinned (spec §9.1); omitted keeps the plugin's flags. */
+    pinnedSuggestions: z.array(z.string().min(1).max(64)).max(50).optional(),
+})
+    .strict();
+export const OrgOwnedShareableBody = z.object({ shareable: z.boolean() }).strict();
+export const OrgOwnedDeleteBody = z.object({ previewHash: z.string().min(1).max(128) }).strict();
+export const ORG_PLUGIN_UPLOAD_ROUTES = [
+    { route: "GET /api/v1/orgs/:orgId/catalog/uploads/:stagingId", params: OrgUploadStagingParams },
+    {
+        route: "PUT /api/v1/orgs/:orgId/owned-plugins/:id/shareable",
+        params: OrgOwnedPluginParams,
+        body: OrgOwnedShareableBody,
+    },
+    {
+        route: "POST /api/v1/orgs/:orgId/owned-plugins/:id/delete/preview",
+        params: OrgOwnedPluginParams,
+    },
+    {
+        route: "POST /api/v1/orgs/:orgId/owned-plugins/:id/delete",
+        params: OrgOwnedPluginParams,
+        body: OrgOwnedDeleteBody,
+    },
+    { route: "DELETE /api/v1/orgs/:orgId/owned-plugins/:id/pending", params: OrgOwnedPluginParams },
+];

package/dist/catalog/owned-items.d.ts

@@ -65,7 +65,9 @@ export declare class OwnedItems {
      * 409 `catalog.not_owned`); one it promoted writes its platform row too (pre-flight F16). Audits
      * `catalog.shareable_changed`.
      */
-    setShareable(orgId: string, actor: string, ref: OwnedRef, shareable: boolean, opts?: ActorOpts): Promise<void>;
+    setShareable(orgId: string, actor: string, ref: OwnedRef, shareable: boolean, opts?: ActorOpts & {
+        auditDetail?: Record<string, unknown>;
+    }): Promise<void>;
     /** {@link setShareable} of an org skill or agent template (named by the org row's id). */
     private setComponentShareable;
     /** The other live orgs the item is on in (P3-18, {@link orgsUsing}), by name. */
@@ -86,7 +88,9 @@ export declare class OwnedItems {
      * `owner_deleted` (another org using it keeps it, now the platform's), then the org row is
      * soft-deleted as before (audit `skill.deleted`). Not an org-scope skill of the org -> 404.
      */
-    deleteSkill(orgId: string, actor: string, skillId: string, opts?: ActorOpts): Promise<"transferred" | "removed">;
+    deleteSkill(orgId: string, actor: string, skillId: string, opts?: ActorOpts & {
+        auditDetail?: Record<string, unknown>;
+    }): Promise<"transferred" | "removed">;
     /**
      * What deleting the org's own agent template `id` does (ruling P4-12, as
      * {@link previewSkillDelete}): one it promoted that another org uses is `transferred` (`orgs`:

package/dist/catalog/owned-items.js

@@ -121,7 +121,7 @@ let OwnedItems = class OwnedItems {
             orgId,
             action: "catalog.shareable_changed",
             target: item.id,
-            detail: { name: item.name, shareable },
+            detail: { name: item.name, shareable, ...opts.auditDetail },
         });
     }
     /** {@link setShareable} of an org skill or agent template (named by the org row's id). */
@@ -165,6 +165,7 @@ let OwnedItems = class OwnedItems {
                 name: row.name,
                 shareable,
                 ...(row.link !== null && { platformId: row.link }),
+                ...opts.auditDetail,
             },
         });
     }
@@ -221,7 +222,7 @@ let OwnedItems = class OwnedItems {
         const outcome = row.link === null
             ? "removed"
             : await this.transferOrRemove({ kind: "skill", id: row.link }, "owner_deleted", actor, opts);
-        await this.skills.deleteOrgSkillIn(orgId, row.id, actor, opts.actorTokenId);
+        await this.skills.deleteOrgSkillIn(orgId, row.id, actor, opts.actorTokenId, opts.auditDetail);
         return outcome;
     }
     /**
@@ -266,7 +267,12 @@ let OwnedItems = class OwnedItems {
             orgId,
             action: "agent_template.deleted",
             target: row.id,
-            detail: { name: row.name, outcome, ...(row.link !== null && { platformId: row.link }) },
+            detail: {
+                name: row.name,
+                outcome,
+                ...(row.link !== null && { platformId: row.link }),
+                ...opts.auditDetail,
+            },
         });
         return outcome;
     }
@@ -510,7 +516,13 @@ let OwnedItems = class OwnedItems {
             orgId: owner,
             action: "catalog.ownership_transferred",
             target: item.id,
-            detail: { name: item.name, fromOrgId: owner, reason, usedBy: others.map((o) => o.id) },
+            detail: {
+                name: item.name,
+                fromOrgId: owner,
+                reason,
+                usedBy: others.map((o) => o.id),
+                ...opts.auditDetail,
+            },
         });
         afterCommit(() => this.scope.enqueueSync(item.id));
         return "transferred";

package/dist/catalog/platform-components.d.ts

@@ -122,6 +122,8 @@ export interface OwnerVersion {
 export interface UploadActor {
     accountId: string;
     actorTokenId?: string;
+    /** Added to the audit detail (the Platform tool's `via`). */
+    auditDetail?: Record<string, unknown>;
 }
 /**
  * Writes the platform rows of a catalog version's components. Called by the import confirm that

package/dist/catalog/platform-components.js

@@ -346,6 +346,7 @@ let PlatformComponents = class PlatformComponents {
                 plugin: live.plugin_name,
                 from: live.current_version,
                 to,
+                ...actor.auditDetail,
             },
         });
     }
@@ -400,6 +401,7 @@ let PlatformComponents = class PlatformComponents {
                 plugin: live.plugin_name,
                 from: live.current_version,
                 to,
+                ...actor.auditDetail,
             },
         });
     }

package/dist/catalog/plugin-import.js

@@ -511,6 +511,7 @@ let PluginImport = class PluginImport {
                     extension: { sha256: extension.sha256, action: extension.action },
                 }),
                 ...(owner !== undefined && { orgId: owner.orgId }),
+                ...opts.auditDetail,
             },
         });
     }

package/dist/catalog/plugin-install.js

@@ -896,7 +896,7 @@ let PluginInstaller = class PluginInstaller {
             return null;
         const name = manifest.name;
         if (!this.registry.manifests().some((m) => m.name === name)) {
-            throw new ApiError("catalog.not_deployed", `The extension of plugin ${name} is not deployed; ask the super admin to install and enable it`);
+            throw new ApiError("catalog.not_deployed", `The extension of plugin ${name} is not running on the platform (not installed, waiting for its deployment config or permission approval, disabled, or failed to load); the org cannot switch it on until it runs`);
         }
         const enabled = await isExtensionEnabled(this.db, orgId, name);
         if (!enabled && (await disabledPluginItems(this.db, [name])).length > 0) {

package/dist/catalog/requests.service.d.ts

@@ -143,7 +143,8 @@ export declare class CatalogRequestsService {
      * A request for a catalog item (`POST /orgs/:orgId/catalog/:itemId/requests`): `enable`
      * (`catalog.request`, members and up) or `access` (`catalog.decide`, org admins), checked first.
      * The item as the org sees it: absent (missing, deleted, hidden, disabled for a member) ->
-     * `catalog.item_not_found`; disabled -> `catalog.item_disabled` for an org admin; `access` needs
+     * `catalog.item_not_found`; disabled -> `catalog.item_disabled` for an org admin; its extension
+     * unable to run on the platform -> `catalog.request_invalid`; `access` needs
      * `not_offered`, `enable` needs `off` (else `catalog.request_invalid`); a pending request of the
      * kind -> `catalog.request_pending`. Audits `catalog.requested`.
      */

package/dist/catalog/requests.service.js

@@ -95,7 +95,8 @@ let CatalogRequestsService = class CatalogRequestsService {
      * A request for a catalog item (`POST /orgs/:orgId/catalog/:itemId/requests`): `enable`
      * (`catalog.request`, members and up) or `access` (`catalog.decide`, org admins), checked first.
      * The item as the org sees it: absent (missing, deleted, hidden, disabled for a member) ->
-     * `catalog.item_not_found`; disabled -> `catalog.item_disabled` for an org admin; `access` needs
+     * `catalog.item_not_found`; disabled -> `catalog.item_disabled` for an org admin; its extension
+     * unable to run on the platform -> `catalog.request_invalid`; `access` needs
      * `not_offered`, `enable` needs `off` (else `catalog.request_invalid`); a pending request of the
      * kind -> `catalog.request_pending`. Audits `catalog.requested`.
      */
@@ -107,8 +108,11 @@ let CatalogRequestsService = class CatalogRequestsService {
         const [item] = await this.orgCatalog.list(orgId, actor, itemId);
         if (!item)
             throw itemNotFound();
-        if (item.state === "unavailable")
+        if (item.state === "unavailable" && item.reason === "plugin_disabled")
             throw itemDisabled();
+        if (item.state === "unavailable") {
+            throw new ApiError("catalog.request_invalid", `This plugin's extension cannot run on the platform now (${item.reason ?? "unavailable"}); only the super admin can fix that`);
+        }
         const want = input.kind === "access" ? "not_offered" : "off";
         if (item.state !== want) {
             throw new ApiError("catalog.request_invalid", input.kind === "access"

package/dist/channels/channels.schemas.d.ts

@@ -0,0 +1,33 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+export declare const ChannelCreateSchema: z.ZodObject<{
+    plugin: z.ZodString;
+    name: z.ZodString;
+    agentId: z.ZodString;
+    config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    unboundPolicy: z.ZodOptional<z.ZodEnum<{
+        anonymous: "anonymous";
+        bind: "bind";
+    }>>;
+}, z.core.$strict>;
+export declare const ChannelPatchSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    agentId: z.ZodOptional<z.ZodString>;
+    unboundPolicy: z.ZodOptional<z.ZodEnum<{
+        anonymous: "anonymous";
+        bind: "bind";
+    }>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>>;
+    inboundMode: z.ZodOptional<z.ZodEnum<{
+        long_connection: "long_connection";
+        webhook: "webhook";
+    }>>;
+    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export declare const ChannelPathParams: z.ZodObject<{
+    connectionId: z.ZodString;
+}, z.core.$strip>;
+export declare const CHANNEL_ROUTES: readonly RouteSchemas[];

package/dist/channels/channels.schemas.js

@@ -0,0 +1,34 @@
+import { z } from "zod";
+const Config = z.record(z.string().max(200), z.unknown());
+const Policy = z.enum(["bind", "anonymous"]);
+export const ChannelCreateSchema = z
+    .object({
+    plugin: z.string().min(1).max(214),
+    name: z.string().trim().min(1).max(100),
+    agentId: z.string().min(1).max(100),
+    config: Config,
+    unboundPolicy: Policy.optional(),
+})
+    .strict();
+export const ChannelPatchSchema = z
+    .object({
+    name: z.string().trim().min(1).max(100).optional(),
+    agentId: z.string().min(1).max(100).optional(),
+    unboundPolicy: Policy.optional(),
+    status: z.enum(["active", "disabled"]).optional(),
+    // webhook needs plugin support and channels.webhookBaseUrl (409 channel.webhook_unavailable)
+    inboundMode: z.enum(["long_connection", "webhook"]).optional(),
+    config: Config.optional(),
+})
+    .strict();
+export const ChannelPathParams = z.object({ connectionId: z.string().min(1).max(100) });
+export const CHANNEL_ROUTES = [
+    { route: "GET /api/v1/orgs/:orgId/channels" },
+    { route: "GET /api/v1/orgs/:orgId/channels/:connectionId", params: ChannelPathParams },
+    {
+        route: "PATCH /api/v1/orgs/:orgId/channels/:connectionId",
+        params: ChannelPathParams,
+        body: ChannelPatchSchema,
+    },
+    { route: "DELETE /api/v1/orgs/:orgId/channels/:connectionId", params: ChannelPathParams },
+];

package/dist/channels/connections.controller.d.ts

@@ -1,35 +1,9 @@
-import { z } from "zod";
+import type { z } from "zod";
 import type { JsonSchema } from "../extensions/config-json-schema.js";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
+import { ChannelCreateSchema as CreateBody, ChannelPatchSchema as PatchBody } from "./channels.schemas.js";
 import { ChannelConnections, type ChannelConnectionView } from "./connections.service.js";
-declare const CreateBody: z.ZodObject<{
-    plugin: z.ZodString;
-    name: z.ZodString;
-    agentId: z.ZodString;
-    config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    unboundPolicy: z.ZodOptional<z.ZodEnum<{
-        anonymous: "anonymous";
-        bind: "bind";
-    }>>;
-}, z.core.$strict>;
-declare const PatchBody: z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
-    agentId: z.ZodOptional<z.ZodString>;
-    unboundPolicy: z.ZodOptional<z.ZodEnum<{
-        anonymous: "anonymous";
-        bind: "bind";
-    }>>;
-    status: z.ZodOptional<z.ZodEnum<{
-        active: "active";
-        disabled: "disabled";
-    }>>;
-    inboundMode: z.ZodOptional<z.ZodEnum<{
-        long_connection: "long_connection";
-        webhook: "webhook";
-    }>>;
-    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, z.core.$strict>;
 /**
  * 组织的渠道连接（`/api/v1/orgs/:orgId/channels`），全部需要 `channels.manage`（admin，仅限人）。
  * 响应只回显非密钥配置与密钥是否已设置。
@@ -56,4 +30,3 @@ export declare class ChannelConnectionsController {
     }>;
     remove(principal: Principal, org: OrgContext, id: string): Promise<void>;
 }
-export {};

package/dist/channels/connections.controller.js

@@ -8,34 +8,12 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post } from "@nestjs/common";
-import { z } from "zod";
 import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { ChannelCreateSchema as CreateBody, ChannelPatchSchema as PatchBody, } from "./channels.schemas.js";
 import { ChannelConnections } from "./connections.service.js";
-const Config = z.record(z.string().max(200), z.unknown());
-const Policy = z.enum(["bind", "anonymous"]);
-const CreateBody = z
-    .object({
-    plugin: z.string().min(1).max(214),
-    name: z.string().trim().min(1).max(100),
-    agentId: z.string().min(1).max(100),
-    config: Config,
-    unboundPolicy: Policy.optional(),
-})
-    .strict();
-const PatchBody = z
-    .object({
-    name: z.string().trim().min(1).max(100).optional(),
-    agentId: z.string().min(1).max(100).optional(),
-    unboundPolicy: Policy.optional(),
-    status: z.enum(["active", "disabled"]).optional(),
-    // webhook needs plugin support and channels.webhookBaseUrl (409 channel.webhook_unavailable)
-    inboundMode: z.enum(["long_connection", "webhook"]).optional(),
-    config: Config.optional(),
-})
-    .strict();
 class ChannelCreateBody extends createZodDto(CreateBody, "ChannelCreateBody") {
 }
 class ChannelPatchBody extends createZodDto(PatchBody, "ChannelPatchBody") {

package/dist/channels/connections.service.d.ts

@@ -159,18 +159,24 @@ export declare class ChannelConnections implements OnApplicationShutdown {
     create(orgId: string, input: CreateChannelInput, actorAccountId: string, actorTokenId?: string): Promise<ChannelConnectionView>;
     /** The rows of {@link create}, in their own transaction (the caller publishes after the commit). */
     private insertIn;
+    /** The read-only refusals of {@link update} that need no write (the Platform tool's precheck). */
+    checkUpdate(orgId: string, id: string, patch: UpdateChannelInput): Promise<void>;
     /**
      * 修改名称、agent、未绑定策略、启停，或轮换凭据（新配置同样先 `verify`，失败什么都不改）。
      * 插件在该组织停用时仍可轮换凭据，此时不 verify，返回 `verifySkipped: true`。
      */
-    update(orgId: string, id: string, patch: UpdateChannelInput, actorAccountId: string, actorTokenId?: string): Promise<{
+    update(orgId: string, id: string, patch: UpdateChannelInput, actorAccountId: string, actorTokenId?: string, 
+    /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail?: Record<string, unknown>): Promise<{
         channel: ChannelConnectionView;
         verifySkipped: boolean;
     }>;
     /** The rows of {@link update}, in their own transaction (the caller publishes after the commit). */
     private updateIn;
     /** 删除（软删除，同一事务删掉密钥）；持有长连接的副本收到广播后断开。 */
-    remove(orgId: string, id: string, actorAccountId: string, actorTokenId?: string): Promise<void>;
+    remove(orgId: string, id: string, actorAccountId: string, actorTokenId?: string, 
+    /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail?: Record<string, unknown>): Promise<void>;
     /** The rows of {@link remove}, in their own transaction (the caller publishes after the commit). */
     private removeIn;
     /** 提交后广播；失败只记日志（持有方每轮续租时也会复核连接状态）。 */

package/dist/channels/connections.service.js

@@ -376,11 +376,24 @@ let ChannelConnections = class ChannelConnections {
         });
         return inserted;
     }
+    /** The read-only refusals of {@link update} that need no write (the Platform tool's precheck). */
+    async checkUpdate(orgId, id, patch) {
+        const current = await this.live(orgId).where("id", "=", id).executeTakeFirst();
+        if (!current)
+            throw notFound();
+        if (patch.agentId !== undefined)
+            await this.assertAgent(orgId, patch.agentId);
+        if (patch.inboundMode === "webhook" && patch.inboundMode !== current.inbound_mode) {
+            this.assertWebhookAvailable(current.plugin);
+        }
+    }
     /**
      * 修改名称、agent、未绑定策略、启停，或轮换凭据（新配置同样先 `verify`，失败什么都不改）。
      * 插件在该组织停用时仍可轮换凭据，此时不 verify，返回 `verifySkipped: true`。
      */
-    async update(orgId, id, patch, actorAccountId, actorTokenId) {
+    async update(orgId, id, patch, actorAccountId, actorTokenId, 
+    /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail) {
         const current = await this.live(orgId).where("id", "=", id).executeTakeFirst();
         if (!current)
             throw notFound();
@@ -421,6 +434,7 @@ let ChannelConnections = class ChannelConnections {
             verified,
             actorAccountId,
             actorTokenId,
+            auditDetail,
         });
         if (rotated)
             this.reportSecrets(rotated.schema, rotated.full);
@@ -443,7 +457,7 @@ let ChannelConnections = class ChannelConnections {
     }
     /** The rows of {@link update}, in their own transaction (the caller publishes after the commit). */
     async updateIn(a) {
-        const { orgId, id, patch, rotated, verified, actorAccountId, actorTokenId } = a;
+        const { orgId, id, patch, rotated, verified, actorAccountId, actorTokenId, auditDetail } = a;
         await this.orgLock.lockAndAuthorize(orgId, actorAccountId, "channels.manage");
         if (patch.agentId !== undefined)
             await this.assertAgent(orgId, patch.agentId);
@@ -488,17 +502,20 @@ let ChannelConnections = class ChannelConnections {
                     ...Object.keys(patch).filter((k) => k !== "config" && patch[k] !== undefined),
                     ...(rotated ? ["config"] : []),
                 ],
+                ...auditDetail,
             },
         });
         return updated;
     }
     /** 删除（软删除，同一事务删掉密钥）；持有长连接的副本收到广播后断开。 */
-    async remove(orgId, id, actorAccountId, actorTokenId) {
-        await this.removeIn(orgId, id, actorAccountId, actorTokenId);
+    async remove(orgId, id, actorAccountId, actorTokenId, 
+    /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail) {
+        await this.removeIn(orgId, id, actorAccountId, actorTokenId, auditDetail);
         await this.changed(id, true);
     }
     /** The rows of {@link remove}, in their own transaction (the caller publishes after the commit). */
-    async removeIn(orgId, id, actorAccountId, actorTokenId) {
+    async removeIn(orgId, id, actorAccountId, actorTokenId, auditDetail) {
         await this.orgLock.lockAndAuthorize(orgId, actorAccountId, "channels.manage");
         const r = await this.db
             .updateTable("channel_connections")
@@ -516,6 +533,7 @@ let ChannelConnections = class ChannelConnections {
             orgId,
             action: "channel.deleted",
             target: id,
+            ...(auditDetail !== undefined && { detail: auditDetail }),
         });
     }
     /** 提交后广播；失败只记日志（持有方每轮续租时也会复核连接状态）。 */