@capybara-hq/kernel 0.0.0-stage → 0.1.0-rc.1

package/dist/agents/templates.js

@@ -0,0 +1,173 @@
+import { randomUUID } from "node:crypto";
+import { canonicalJson } from "../tools/registry.js";
+const baseQuery = (db, orgId) => db
+    .selectFrom("agent_templates as t")
+    .innerJoin("agent_template_versions as v", (j) => j.onRef("v.template_id", "=", "t.id").onRef("v.version", "=", "t.current_version"))
+    .select([
+    "t.id",
+    "t.name",
+    "t.plugin_name",
+    "t.current_version",
+    "t.catalog_item_id",
+    "v.definition",
+    "v.source_format",
+    "v.catalog_version",
+])
+    .where("t.org_id", "=", orgId)
+    .where("t.deleted_at", "is", null);
+const rowOf = (r) => ({
+    id: r.id,
+    name: r.name,
+    plugin: r.plugin_name,
+    version: r.current_version,
+    template: r.definition,
+    sourceFormat: r.source_format,
+    catalogItemId: r.catalog_item_id,
+    catalogVersion: r.catalog_version,
+});
+/** The live templates of `ids` in the org (deleted and foreign ids are left out), by id. */
+export async function loadTemplates(db, orgId, ids) {
+    if (ids.length === 0)
+        return new Map();
+    const rows = await baseQuery(db, orgId)
+        .where("t.id", "in", [...ids])
+        .execute();
+    return new Map(rows.map((r) => [r.id, rowOf(r)]));
+}
+/** Reads the org's agent templates (consumed by the roster, the agent page and Task 19's API). */
+export class AgentTemplatesService {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** Every live template of the org, by plugin then name. */
+    async listForOrg(orgId) {
+        const rows = await baseQuery(this.db, orgId)
+            .orderBy("t.plugin_name")
+            .orderBy("t.name")
+            .execute();
+        return rows.map((r) => {
+            const t = rowOf(r);
+            return {
+                id: t.id,
+                name: t.name,
+                plugin: t.plugin,
+                type: `${t.plugin}:${t.name}`,
+                description: typeof t.template.description === "string" ? t.template.description : "",
+                model: t.template.model ?? "inherit",
+                version: t.version,
+                sourceFormat: t.sourceFormat,
+                catalogItemId: t.catalogItemId,
+                catalogVersion: t.catalogVersion,
+            };
+        });
+    }
+    /** A live template by id or by `<plugin>:<name>`; null when there is none. */
+    async resolve(orgId, ref) {
+        const i = ref.indexOf(":");
+        let q = baseQuery(this.db, orgId);
+        q =
+            i < 0
+                ? q.where("t.id", "=", ref)
+                : q.where("t.plugin_name", "=", ref.slice(0, i)).where("t.name", "=", ref.slice(i + 1));
+        const r = await q.executeTakeFirst();
+        if (!r)
+            return null;
+        const t = rowOf(r);
+        return { id: t.id, version: t.version, plugin: t.plugin, template: t.template };
+    }
+}
+/**
+ * Writes `template` as the org's live template `<plugin>:<name>` in the caller's transaction (the
+ * caller holds the org row lock): a new template (version 1, `created`), a new version of the live
+ * one when its definition differs (`changed`, the version added), or nothing when it is equal.
+ */
+export async function putTemplateVersionIn(t, s, template) {
+    const live = await t
+        .selectFrom("agent_templates as a")
+        .innerJoin("agent_template_versions as v", (j) => j.onRef("v.template_id", "=", "a.id").onRef("v.version", "=", "a.current_version"))
+        .select(["a.id", "a.current_version", "v.definition"])
+        .where("a.org_id", "=", s.orgId)
+        .where("a.plugin_name", "=", s.plugin)
+        .where("a.name", "=", template.name)
+        .where("a.deleted_at", "is", null)
+        .forUpdate("a")
+        .executeTakeFirst();
+    if (live && canonicalJson(live.definition) === canonicalJson(template)) {
+        return { id: live.id, version: live.current_version, created: false, changed: false };
+    }
+    const id = live?.id ?? randomUUID();
+    const version = live ? live.current_version + 1 : 1;
+    if (!live) {
+        await t
+            .insertInto("agent_templates")
+            .values({
+            id,
+            org_id: s.orgId,
+            name: template.name,
+            catalog_item_id: s.catalogItemId,
+            plugin_name: s.plugin,
+            current_version: 1,
+        })
+            .execute();
+    }
+    await t
+        .insertInto("agent_template_versions")
+        .values({
+        template_id: id,
+        version,
+        definition: JSON.stringify(template),
+        source_format: s.sourceFormat,
+        catalog_version: s.catalogVersion,
+    })
+        .execute();
+    if (live) {
+        await t
+            .updateTable("agent_templates")
+            .set({ current_version: version, catalog_item_id: s.catalogItemId, updated_at: new Date() })
+            .where("id", "=", id)
+            .execute();
+    }
+    return { id, version, created: !live, changed: true };
+}
+/**
+ * Undoes `version` of a live template when it is still the current one (an install or upgrade
+ * rolled back): the version row goes and the template is back at the version before. Returns
+ * whether anything changed.
+ */
+export async function revertTemplateVersionIn(t, orgId, id, version) {
+    if (version <= 1)
+        return false;
+    // catalog_item_id is not restored (skills.revertVersionIn does restore its own): a template's
+    // versions all come from the one catalog item of its plugin name, so it never changes
+    const r = await t
+        .updateTable("agent_templates")
+        .set({ current_version: version - 1, updated_at: new Date() })
+        .where("id", "=", id)
+        .where("org_id", "=", orgId)
+        .where("current_version", "=", version)
+        .where("deleted_at", "is", null)
+        .executeTakeFirst();
+    if (r.numUpdatedRows === 0n)
+        return false;
+    await t
+        .deleteFrom("agent_template_versions")
+        .where("template_id", "=", id)
+        .where("version", "=", version)
+        .execute();
+    return true;
+}
+/**
+ * Removes a template (soft delete: sub-agents already started keep their frozen definition, and
+ * the roster skips it). Returns whether it was live.
+ */
+export async function softDeleteTemplateIn(t, orgId, id) {
+    const r = await t
+        .updateTable("agent_templates")
+        .set({ deleted_at: new Date(), updated_at: new Date() })
+        .where("id", "=", id)
+        .where("org_id", "=", orgId)
+        .where("deleted_at", "is", null)
+        .executeTakeFirst();
+    return r.numUpdatedRows > 0n;
+}

package/dist/catalog/admin-catalog.controller.d.ts

@@ -0,0 +1,143 @@
+import type { FastifyReply } from "fastify";
+import { z } from "zod";
+import type { AdminExtensionView } from "../extensions/permission-view.js";
+import { type Principal } from "../identity/principal.js";
+import { type CatalogItemDetail, type CatalogItemView, type CatalogService, type PermissionsMismatch } from "./catalog.service.js";
+import type { OrgCatalogService } from "./org-catalog.service.js";
+import type { PluginConfirmResult, PluginImport, PluginReview } from "./plugin-import.js";
+declare const NpmBody: z.ZodObject<{
+    package: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const GitBody: z.ZodObject<{
+    url: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+    path: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const PolicyBody: z.ZodObject<{
+    policy: z.ZodEnum<{
+        allow: "allow";
+        disabled: "disabled";
+        needs_approval: "needs_approval";
+    }>;
+}, z.core.$strip>;
+declare const InstallBody: z.ZodObject<{
+    version: z.ZodString;
+}, z.core.$strip>;
+declare const ConfirmBody: z.ZodObject<{
+    reviewHash: z.ZodString;
+    deployExtension: z.ZodBoolean;
+    pinnedSuggestions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+declare const ListQuery: z.ZodObject<{
+    includeDeleted: z.ZodOptional<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>;
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    offset: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+/**
+ * The enterprise catalog (`/api/v1/admin/catalog/*`, enterprise admins): plugin import (upload / npm
+ * prepare, then confirm), the item list and detail, policy, delete, and installing an item's
+ * extension on the deployment. Writes re-check the enterprise admin inside the service's lock and are
+ * audited.
+ */
+export declare class AdminCatalogController {
+    private readonly catalog;
+    private readonly pluginImport;
+    private readonly orgCatalog;
+    constructor(catalog: CatalogService, pluginImport: PluginImport, orgCatalog: OrgCatalogService);
+    /**
+     * Prepares the import of an uploaded plugin (an npm-pack tgz as the raw body,
+     * `application/octet-stream`, at most `packages.maxBytes`): reads and checks the whole plugin
+     * (extension, skills, connector templates; dependencies resolved for the review), stages it for 24
+     * hours and returns one review `{ stagingId, review }`, confirmed with `imports/:stagingId/confirm`.
+     * A pre-0.1.0 package -> 422 `catalog.legacy_format`; an invalid plugin -> 422
+     * `catalog.invalid_manifest` (details list each problem); version already imported -> 409
+     * `catalog.version_exists`; an item with the same name from another npm package -> 409
+     * `catalog.name_conflict`; an extension named like a config-declared one -> 409.
+     */
+    importFile(principal: Principal, req: {
+        body?: unknown;
+    }): Promise<{
+        stagingId: string;
+        review: PluginReview;
+    }>;
+    /**
+     * Prepares the import of a plugin from the configured npm registry (`version` may be a version, a
+     * dist-tag or a range, default latest; verified by `dist.integrity`), as `import/file`. Download
+     * failure -> 502.
+     */
+    importNpm(principal: Principal, body: z.infer<typeof NpmBody>): Promise<{
+        stagingId: string;
+        review: PluginReview;
+    }>;
+    /**
+     * Prepares the import of a plugin straight from git (a one-off: no marketplace is created and no
+     * updates are tracked): `url` is an https git URL or `owner/repo`, `ref` a branch / tag / commit
+     * (default the remote HEAD), `path` the plugin's directory in the repo (default the root). The
+     * commit is resolved and recorded with host, repo and path; then as `import/file`. Git failures:
+     * 502 `marketplace.git_failed`, 422 `marketplace.git_too_large` / `git_unsupported_entry`, 422
+     * `marketplace.private_address` / `marketplace.redirect`.
+     */
+    importGit(principal: Principal, body: z.infer<typeof GitBody>): Promise<{
+        stagingId: string;
+        review: PluginReview;
+    }>;
+    /**
+     * A staged import's review `{ stagingId, review, permissionsMismatch? }` (the mismatch only for
+     * a marketplace import whose permission summary differs from the package; the web's import page
+     * loads `?staging=<id>` with it). Unknown, expired or already confirmed -> 404
+     * `plugin.staging_not_found`.
+     */
+    staged(stagingId: string): Promise<{
+        stagingId: string;
+        review: PluginReview;
+        permissionsMismatch?: PermissionsMismatch;
+    }>;
+    /**
+     * Confirms a staged import: approves the plugin's extension when this import installs it (writes
+     * its snapshot) and creates the item or adds the version; with `deployExtension` it installs and
+     * enables the plugin's own extension after the commit and returns `{ item, deploy }`, where
+     * `deploy` says enabled / failed (+ code); a failed deploy does not make the committed import fail
+     * (retry from the extension admin by sha256). A foreseeable failure (a downgrade to a version with
+     * unrun migrations) is a 409 `extension.downgrade_unsupported` before anything is written.
+     * Staging missing or expired -> 404 `plugin.staging_not_found`; `reviewHash` differs or the
+     * extension on the deployment changed -> 409 `plugin.review_stale`. `pinnedSuggestions` (skill
+     * names of the review) replaces the plugin's suggested pinning; an unknown name -> 400
+     * `validation_failed`.
+     */
+    confirm(principal: Principal, stagingId: string, body: z.infer<typeof ConfirmBody>): Promise<PluginConfirmResult>;
+    /**
+     * The item list (`includeDeleted=true` includes deleted items). Paging: `limit` (default 200, at
+     * most 1000) and `offset`; `nextOffset` is the next page's offset, null when there is none.
+     */
+    list(q: z.infer<typeof ListQuery>): Promise<{
+        items: CatalogItemView[];
+        nextOffset: number | null;
+    }>;
+    /**
+     * 条目详情与各版本，另给出 `hasIcon`（最新版本有图标，`GET items/:id/icon` 可取）；不存在 → 404
+     * `catalog.item_not_found`。
+     */
+    get(id: string): Promise<CatalogItemDetail & {
+        hasIcon: boolean;
+    }>;
+    /**
+     * The item's icon (disabled items included; same response headers as the org side, see
+     * `sendCatalogIcon`). No icon -> 404 `catalog.icon_not_found`.
+     */
+    icon(id: string, reply: FastifyReply): Promise<void>;
+    /** 改策略（allow / needs_approval / disabled）。 */
+    setPolicy(principal: Principal, id: string, body: z.infer<typeof PolicyBody>): Promise<CatalogItemView>;
+    /** 删除条目（软删除，已安装的组件不受影响）。 */
+    remove(principal: Principal, id: string): Promise<void>;
+    /**
+     * Installs the extension of a version of an item on the deployment (a new install starts disabled;
+     * unapproved permissions still need approval). A version without an extension -> 409
+     * `catalog.no_extension`.
+     */
+    installToDeployment(principal: Principal, id: string, body: z.infer<typeof InstallBody>): Promise<AdminExtensionView>;
+}
+export {};

package/dist/catalog/admin-catalog.controller.js

@@ -0,0 +1,245 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Body, Controller, Delete, Get, HttpCode, Inject, Param, Post, Put, Query, Req, Res, } from "@nestjs/common";
+import { z } from "zod";
+import { ApiError } from "../errors.js";
+import { CATALOG, ORG_CATALOG, PLUGIN_IMPORT } from "../http/tokens.js";
+import { ZodPipe } from "../http/zod.pipe.js";
+import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
+import { CATALOG_LIST_MAX_LIMIT, } from "./catalog.service.js";
+import { sendCatalogIcon } from "./org-catalog.controller.js";
+const NpmBody = z.object({
+    package: z.string().min(1).max(214),
+    version: z.string().min(1).max(256).optional(),
+});
+const GitBody = z
+    .object({
+    url: z.string().min(1).max(2000),
+    ref: z.string().min(1).max(256).optional(),
+    path: z.string().min(1).max(512).optional(),
+})
+    .strict();
+const PolicyBody = z.object({ policy: z.enum(["allow", "needs_approval", "disabled"]) });
+const InstallBody = z.object({ version: z.string().min(1).max(256) });
+const ConfirmBody = z.object({
+    reviewHash: z.string().min(1).max(128),
+    deployExtension: z.boolean(),
+    /** Skill names suggested as pinned (spec §9.1); omitted keeps the plugin's flags. */
+    pinnedSuggestions: z.array(z.string().min(1).max(64)).max(50).optional(),
+});
+const ListQuery = z.object({
+    includeDeleted: z.enum(["true", "false"]).optional(),
+    limit: z.coerce.number().int().min(1).max(CATALOG_LIST_MAX_LIMIT).optional(),
+    offset: z.coerce.number().int().min(0).max(1_000_000).optional(),
+});
+const actorOpts = (actor) => {
+    const tokenId = patTokenId(actor);
+    return tokenId !== undefined ? { actorTokenId: tokenId } : {};
+};
+/**
+ * The enterprise catalog (`/api/v1/admin/catalog/*`, enterprise admins): plugin import (upload / npm
+ * prepare, then confirm), the item list and detail, policy, delete, and installing an item's
+ * extension on the deployment. Writes re-check the enterprise admin inside the service's lock and are
+ * audited.
+ */
+let AdminCatalogController = class AdminCatalogController {
+    catalog;
+    pluginImport;
+    orgCatalog;
+    constructor(catalog, pluginImport, orgCatalog) {
+        this.catalog = catalog;
+        this.pluginImport = pluginImport;
+        this.orgCatalog = orgCatalog;
+    }
+    /**
+     * Prepares the import of an uploaded plugin (an npm-pack tgz as the raw body,
+     * `application/octet-stream`, at most `packages.maxBytes`): reads and checks the whole plugin
+     * (extension, skills, connector templates; dependencies resolved for the review), stages it for 24
+     * hours and returns one review `{ stagingId, review }`, confirmed with `imports/:stagingId/confirm`.
+     * A pre-0.1.0 package -> 422 `catalog.legacy_format`; an invalid plugin -> 422
+     * `catalog.invalid_manifest` (details list each problem); version already imported -> 409
+     * `catalog.version_exists`; an item with the same name from another npm package -> 409
+     * `catalog.name_conflict`; an extension named like a config-declared one -> 409.
+     */
+    async importFile(principal, req) {
+        const actor = requireUser(principal);
+        const body = req.body;
+        if (!Buffer.isBuffer(body) || body.byteLength === 0) {
+            throw new ApiError("unsupported_media_type", "Send the plugin package (.tgz) as the request body with content-type application/octet-stream");
+        }
+        const r = await this.pluginImport.prepare(actor.account.id, new Uint8Array(body.buffer, body.byteOffset, body.byteLength), { kind: "file", ref: "upload" }, actorOpts(actor));
+        return { stagingId: r.stagingId, review: r.review };
+    }
+    /**
+     * Prepares the import of a plugin from the configured npm registry (`version` may be a version, a
+     * dist-tag or a range, default latest; verified by `dist.integrity`), as `import/file`. Download
+     * failure -> 502.
+     */
+    importNpm(principal, body) {
+        const actor = requireUser(principal);
+        return this.pluginImport.prepareNpm(actor.account.id, { package: body.package, ...(body.version !== undefined && { version: body.version }) }, actorOpts(actor));
+    }
+    /**
+     * Prepares the import of a plugin straight from git (a one-off: no marketplace is created and no
+     * updates are tracked): `url` is an https git URL or `owner/repo`, `ref` a branch / tag / commit
+     * (default the remote HEAD), `path` the plugin's directory in the repo (default the root). The
+     * commit is resolved and recorded with host, repo and path; then as `import/file`. Git failures:
+     * 502 `marketplace.git_failed`, 422 `marketplace.git_too_large` / `git_unsupported_entry`, 422
+     * `marketplace.private_address` / `marketplace.redirect`.
+     */
+    importGit(principal, body) {
+        const actor = requireUser(principal);
+        return this.catalog.importFromGit(actor.account.id, {
+            url: body.url,
+            ...(body.ref !== undefined && { ref: body.ref }),
+            ...(body.path !== undefined && { path: body.path }),
+        }, actorOpts(actor));
+    }
+    /**
+     * A staged import's review `{ stagingId, review, permissionsMismatch? }` (the mismatch only for
+     * a marketplace import whose permission summary differs from the package; the web's import page
+     * loads `?staging=<id>` with it). Unknown, expired or already confirmed -> 404
+     * `plugin.staging_not_found`.
+     */
+    staged(stagingId) {
+        return this.pluginImport.staged(stagingId);
+    }
+    /**
+     * Confirms a staged import: approves the plugin's extension when this import installs it (writes
+     * its snapshot) and creates the item or adds the version; with `deployExtension` it installs and
+     * enables the plugin's own extension after the commit and returns `{ item, deploy }`, where
+     * `deploy` says enabled / failed (+ code); a failed deploy does not make the committed import fail
+     * (retry from the extension admin by sha256). A foreseeable failure (a downgrade to a version with
+     * unrun migrations) is a 409 `extension.downgrade_unsupported` before anything is written.
+     * Staging missing or expired -> 404 `plugin.staging_not_found`; `reviewHash` differs or the
+     * extension on the deployment changed -> 409 `plugin.review_stale`. `pinnedSuggestions` (skill
+     * names of the review) replaces the plugin's suggested pinning; an unknown name -> 400
+     * `validation_failed`.
+     */
+    confirm(principal, stagingId, body) {
+        const actor = requireUser(principal);
+        const { pinnedSuggestions, ...rest } = body;
+        return this.pluginImport.confirm(actor.account.id, stagingId, { ...rest, ...(pinnedSuggestions !== undefined && { pinnedSuggestions }) }, actorOpts(actor));
+    }
+    /**
+     * The item list (`includeDeleted=true` includes deleted items). Paging: `limit` (default 200, at
+     * most 1000) and `offset`; `nextOffset` is the next page's offset, null when there is none.
+     */
+    list(q) {
+        return this.catalog.page({
+            includeDeleted: q.includeDeleted === "true",
+            ...(q.limit !== undefined && { limit: q.limit }),
+            ...(q.offset !== undefined && { offset: q.offset }),
+        });
+    }
+    /**
+     * 条目详情与各版本，另给出 `hasIcon`（最新版本有图标，`GET items/:id/icon` 可取）；不存在 → 404
+     * `catalog.item_not_found`。
+     */
+    async get(id) {
+        const detail = await this.catalog.get(id);
+        return { ...detail, hasIcon: await this.orgCatalog.hasIcon(id) };
+    }
+    /**
+     * The item's icon (disabled items included; same response headers as the org side, see
+     * `sendCatalogIcon`). No icon -> 404 `catalog.icon_not_found`.
+     */
+    async icon(id, reply) {
+        await sendCatalogIcon(reply, await this.orgCatalog.icon(id, true));
+    }
+    /** 改策略（allow / needs_approval / disabled）。 */
+    setPolicy(principal, id, body) {
+        const actor = requireUser(principal);
+        return this.catalog.setPolicy(actor.account.id, id, body.policy, actorOpts(actor));
+    }
+    /** 删除条目（软删除，已安装的组件不受影响）。 */
+    async remove(principal, id) {
+        const actor = requireUser(principal);
+        await this.catalog.remove(actor.account.id, id, actorOpts(actor));
+    }
+    /**
+     * Installs the extension of a version of an item on the deployment (a new install starts disabled;
+     * unapproved permissions still need approval). A version without an extension -> 409
+     * `catalog.no_extension`.
+     */
+    installToDeployment(principal, id, body) {
+        const actor = requireUser(principal);
+        return this.catalog.installToDeployment(actor.account.id, id, body.version, actorOpts(actor));
+    }
+};
+__decorate([
+    Post("import/file"),
+    HttpCode(200),
+    __param(0, CurrentPrincipal()),
+    __param(1, Req())
+], AdminCatalogController.prototype, "importFile", null);
+__decorate([
+    Post("import/npm"),
+    HttpCode(200),
+    __param(0, CurrentPrincipal()),
+    __param(1, Body(new ZodPipe(NpmBody)))
+], AdminCatalogController.prototype, "importNpm", null);
+__decorate([
+    Post("import/git"),
+    HttpCode(200),
+    __param(0, CurrentPrincipal()),
+    __param(1, Body(new ZodPipe(GitBody)))
+], AdminCatalogController.prototype, "importGit", null);
+__decorate([
+    Get("imports/:stagingId"),
+    __param(0, Param("stagingId"))
+], AdminCatalogController.prototype, "staged", null);
+__decorate([
+    Post("imports/:stagingId/confirm"),
+    HttpCode(201),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("stagingId")),
+    __param(2, Body(new ZodPipe(ConfirmBody)))
+], AdminCatalogController.prototype, "confirm", null);
+__decorate([
+    Get("items"),
+    __param(0, Query(new ZodPipe(ListQuery)))
+], AdminCatalogController.prototype, "list", null);
+__decorate([
+    Get("items/:id"),
+    __param(0, Param("id"))
+], AdminCatalogController.prototype, "get", null);
+__decorate([
+    Get("items/:id/icon"),
+    __param(0, Param("id")),
+    __param(1, Res())
+], AdminCatalogController.prototype, "icon", null);
+__decorate([
+    Put("items/:id/policy"),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("id")),
+    __param(2, Body(new ZodPipe(PolicyBody)))
+], AdminCatalogController.prototype, "setPolicy", null);
+__decorate([
+    Delete("items/:id"),
+    HttpCode(204),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("id"))
+], AdminCatalogController.prototype, "remove", null);
+__decorate([
+    Post("items/:id/install-deployment"),
+    HttpCode(200),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("id")),
+    __param(2, Body(new ZodPipe(InstallBody)))
+], AdminCatalogController.prototype, "installToDeployment", null);
+AdminCatalogController = __decorate([
+    Controller("api/v1/admin/catalog"),
+    EnterpriseAdmin(),
+    __param(0, Inject(CATALOG)),
+    __param(1, Inject(PLUGIN_IMPORT)),
+    __param(2, Inject(ORG_CATALOG))
+], AdminCatalogController);
+export { AdminCatalogController };