@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.10

package/dist/identity/settings.js

@@ -1,7 +1,21 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { audit } from "./audit.js";
-import { lockEnterpriseAdminsAndAuthorize } from "./enterprise-admin.js";
+import { SuperAdminLock } from "./super-admin.js";
 /** 币种代码：ISO 4217 的三位大写字母（如 USD、CNY）。 */
 const CurrencyCode = z.string().regex(/^[A-Z]{3}$/, "must be a 3-letter ISO 4217 currency code");
 /** 沙箱 cpu（核）与内存（MB）覆盖的范围（C19）。 */
@@ -23,23 +37,34 @@ export const SANDBOX_LIMIT_OVERRIDE = z
     message: "give cpu, memoryMb or both",
 });
 /**
- * One organization's sub-agent limits (sub-agents spec §8.2): any of the three `subagents.*`
- * values, within the same bounds; the ones not given use the deployment's config.
+ * One organization's sub-agent limits (sub-agents spec §8.2, agent map spec §6): any of the
+ * `subagents.*` values, within the same bounds (0 for dispatches or tokens: no limit); the ones not
+ * given use the deployment's config.
  */
 export const SUBAGENT_LIMIT_OVERRIDE = z
     .object({
-    maxConcurrentPerRun: z.number().int().min(1).max(20).optional(),
-    maxDispatchesPerRun: z.number().int().min(1).max(500).optional(),
-    maxTokensPerRun: z.number().int().min(10_000).optional(),
+    maxDepth: z.number().int().min(1).max(5).optional(),
+    maxConcurrentPerConversation: z.number().int().min(1).max(20).optional(),
+    maxDispatchesPerRun: z
+        .number()
+        .int()
+        .max(500)
+        .refine((n) => n === 0 || n >= 1, "0 (no limit) or 1 to 500")
+        .optional(),
+    maxTokensPerRun: z
+        .number()
+        .int()
+        .refine((n) => n === 0 || n >= 10_000, "0 (no limit) or at least 10,000")
+        .optional(),
 })
     .strict()
     .refine((o) => Object.values(o).some((v) => v !== undefined), {
-    message: "give maxConcurrentPerRun, maxDispatchesPerRun or maxTokensPerRun",
+    message: "give maxDepth, maxConcurrentPerConversation, maxDispatchesPerRun or maxTokensPerRun",
 });
-/** 组织能否自建连接器 / 技能（C22）：`deny` 时只能从企业目录安装（T26 执行）。 */
+/** 组织能否自建连接器 / 技能（C22）：`deny` 时只能从平台目录安装（T26 执行）。 */
 const CustomPolicy = z.enum(["allow", "deny"]);
 export const DEPLOYMENT_SETTINGS = z.object({
-    orgCreation: z.enum(["anyone", "enterprise_admin"]).default("anyone"),
+    orgCreation: z.enum(["anyone", "super_admin"]).default("anyone"),
     /** 按组织覆盖运行并发上限（orgId → 上限）；未列出的组织用 `runtime.orgConcurrency`。 */
     runConcurrencyOverrides: z.record(z.string().min(1), z.number().int().positive()).default({}),
     /** 模型价格表（`model_prices`）的币种；只用于显示估算成本，不做换算。 */
@@ -51,13 +76,18 @@ export const DEPLOYMENT_SETTINGS = z.object({
      * not given, use `subagents.*`. Read live on every dispatch and tool resolution.
      */
     subagentLimitOverrides: z.record(z.string().min(1), SUBAGENT_LIMIT_OVERRIDE).default({}),
-    /** 组织能否自建连接器（不经企业目录）。 */
+    /** 组织能否自建连接器（不经平台目录）。 */
     customConnectors: CustomPolicy.default("allow"),
     /**
-     * 组织能否自建技能（不经企业目录）：deny 时组织管理员不能上传技能包。agent 自写技能（`skill_write`，私有 agent 的
+     * 组织能否自建技能（不经平台目录）：deny 时组织管理员不能上传技能包。agent 自写技能（`SkillWrite`，私有 agent 的
      * agent 级技能与共享 agent 经负责人审批的变更）不受此开关约束——那是 agent 定义的一部分，由 R3 / R4 把关。
      */
     customSkills: CustomPolicy.default("allow"),
+    /**
+     * Org admins may browse the marketplaces read-only and ask for an entry to be imported (plugin
+     * scope spec §5.1 rule 3). false hides the browse route and refuses those requests.
+     */
+    orgMarketplaceBrowse: z.boolean().default(true),
 });
 const DEFAULTS = DEPLOYMENT_SETTINGS.parse({});
 /**
@@ -70,7 +100,7 @@ const DEFAULTS = DEPLOYMENT_SETTINGS.parse({});
  */
 export const DEPLOYMENT_SETTINGS_PATCH = z
     .object({
-    orgCreation: z.enum(["anyone", "enterprise_admin"]).optional(),
+    orgCreation: z.enum(["anyone", "super_admin"]).optional(),
     runConcurrencyOverrides: z
         .record(z.string().min(1), z.number().int().positive().nullable())
         .optional(),
@@ -83,6 +113,7 @@ export const DEPLOYMENT_SETTINGS_PATCH = z
         .optional(),
     customConnectors: CustomPolicy.optional(),
     customSkills: CustomPolicy.optional(),
+    orgMarketplaceBrowse: z.boolean().optional(),
 })
     .strict();
 /**
@@ -126,7 +157,7 @@ export async function readSubagentLimitOverride(db, orgId) {
 }
 /**
  * When orgs may not create their own connectors / skills (deployment setting `customConnectors` /
- * `customSkills` is `deny`, C22) throws `catalog.custom_disabled`: install from the enterprise
+ * `customSkills` is `deny`, C22) throws `catalog.custom_disabled`: install from the platform
  * catalog only. Reads PG live every time (can read in the caller's transaction); an invalid stored
  * value counts as allow.
  */
@@ -141,10 +172,25 @@ export async function assertCustomAllowed(db, key) {
     const parsed = CustomPolicy.safeParse(row.value);
     if (parsed.success && parsed.data === "deny") {
         throw new ApiError("catalog.custom_disabled", key === "customConnectors"
-            ? "Custom connectors are disabled in this deployment; install connectors from the enterprise catalog"
-            : "Custom skills are disabled in this deployment; install skills from the enterprise catalog");
+            ? "Custom connectors are disabled in this deployment; install connectors from the platform catalog"
+            : "Custom skills are disabled in this deployment; install skills from the platform catalog");
     }
 }
+/**
+ * The deployment setting `orgMarketplaceBrowse`, read live from PG (in the caller's transaction
+ * when there is one); missing or invalid -> the default, true.
+ */
+export async function readOrgMarketplaceBrowse(db) {
+    const row = await db
+        .selectFrom("deployment_settings")
+        .select("value")
+        .where("key", "=", "orgMarketplaceBrowse")
+        .executeTakeFirst();
+    if (!row)
+        return true;
+    const parsed = z.boolean().safeParse(row.value);
+    return parsed.success ? parsed.data : true;
+}
 /** 按组织合并覆盖：值为 null 删除该组织，其余整项替换；未列出的组织不变。 */
 function mergeByOrg(current, patch) {
     const merged = { ...current };
@@ -156,24 +202,26 @@ function mergeByOrg(current, patch) {
     }
     return merged;
 }
-/** 部署级设置：每个键一行，读时缺省用默认值。 */
-export class SettingsService {
+/** Deployment settings: one row per key, defaults for missing keys. */
+let SettingsService = class SettingsService {
     db;
+    txHost;
+    adminLock;
     log;
-    constructor(db, log) {
+    constructor(db, txHost, adminLock, log) {
         this.db = db;
+        this.txHost = txHost;
+        this.adminLock = adminLock;
         this.log = log;
     }
     /**
-     * 读全部设置；传 `trx` 时在该事务内读（调用方已持有事务连接时不再占用池里的第二个连接）。
-     * 逐个键校验：库里某个键的值非法时该键用默认值并 warn 点名，其余合法的键照常生效；
-     * 不认识的键（如新版本写入的）忽略。
+     * Reads every setting, in the context's transaction when there is one (a caller holding a
+     * transaction connection does not take a second one from the pool). Each key is validated on
+     * its own: an invalid stored value falls back to the default with a warning naming the key, the
+     * valid keys apply; unknown keys (written by a newer version) are ignored.
      */
-    async get(trx) {
-        const rows = await (trx ?? this.db)
-            .selectFrom("deployment_settings")
-            .select(["key", "value"])
-            .execute();
+    async get() {
+        const rows = await this.db.selectFrom("deployment_settings").select(["key", "value"]).execute();
         const stored = new Map(rows.map((r) => [r.key, r.value]));
         const out = { ...DEFAULTS };
         for (const [key, field] of Object.entries(DEPLOYMENT_SETTINGS.shape)) {
@@ -184,7 +232,7 @@ export class SettingsService {
                 out[key] = parsed.data;
             }
             else {
-                this.log?.warn("invalid deployment setting; using default", {
+                this.log.warn("invalid deployment setting; using default", {
                     key,
                     issues: parsed.error.issues.map((i) => i.message),
                 });
@@ -192,57 +240,74 @@ export class SettingsService {
         }
         return out;
     }
-    /** 更新设置：事务内取企业管理员锁并复核发起人仍是活跃企业管理员（否则 `forbidden`）。 */
-    async update(patch, actorAccountId, actorTokenId) {
+    /** Updates settings under the super admin lock, re-checking the actor (else `forbidden`). */
+    async update(patch, actorAccountId, actorTokenId, 
+    /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail) {
         const check = DEPLOYMENT_SETTINGS_PATCH.safeParse(patch);
         if (!check.success) {
             throw new ApiError("validation_failed", "Invalid deployment settings", check.error.issues.map((i) => ({ path: i.path.join("."), message: i.message })));
         }
-        await this.db.transaction().execute(async (trx) => {
-            await lockEnterpriseAdminsAndAuthorize(trx, actorAccountId);
-            // 企业管理员锁串行化所有设置修改：在锁内读当前覆盖再合并，不会丢失并发修改。
-            const next = {};
-            if (check.data.orgCreation !== undefined)
-                next.orgCreation = check.data.orgCreation;
-            if (check.data.priceCurrency !== undefined)
-                next.priceCurrency = check.data.priceCurrency;
-            if (check.data.customConnectors !== undefined) {
-                next.customConnectors = check.data.customConnectors;
+        await this.write(check.data, actorAccountId, actorTokenId, auditDetail);
+        return this.get();
+    }
+    async write(patch, actorAccountId, actorTokenId, auditDetail) {
+        await this.adminLock.lockAndAuthorize(actorAccountId);
+        // The super admin lock serializes every settings write: the current overrides are read
+        // and merged under it, so no concurrent change is lost
+        const next = {};
+        if (patch.orgCreation !== undefined)
+            next.orgCreation = patch.orgCreation;
+        if (patch.priceCurrency !== undefined)
+            next.priceCurrency = patch.priceCurrency;
+        if (patch.customConnectors !== undefined)
+            next.customConnectors = patch.customConnectors;
+        if (patch.customSkills !== undefined)
+            next.customSkills = patch.customSkills;
+        if (patch.orgMarketplaceBrowse !== undefined) {
+            next.orgMarketplaceBrowse = patch.orgMarketplaceBrowse;
+        }
+        const { runConcurrencyOverrides: runPatch, sandboxLimitOverrides: sandboxPatch, subagentLimitOverrides: subagentPatch, } = patch;
+        if (runPatch !== undefined || sandboxPatch !== undefined || subagentPatch !== undefined) {
+            const current = await this.get();
+            if (runPatch !== undefined) {
+                next.runConcurrencyOverrides = mergeByOrg(current.runConcurrencyOverrides, runPatch);
             }
-            if (check.data.customSkills !== undefined)
-                next.customSkills = check.data.customSkills;
-            const { runConcurrencyOverrides: runPatch, sandboxLimitOverrides: sandboxPatch, subagentLimitOverrides: subagentPatch, } = check.data;
-            if (runPatch !== undefined || sandboxPatch !== undefined || subagentPatch !== undefined) {
-                const current = await this.get(trx);
-                if (runPatch !== undefined) {
-                    next.runConcurrencyOverrides = mergeByOrg(current.runConcurrencyOverrides, runPatch);
-                }
-                if (sandboxPatch !== undefined) {
-                    next.sandboxLimitOverrides = mergeByOrg(current.sandboxLimitOverrides, sandboxPatch);
-                }
-                if (subagentPatch !== undefined) {
-                    next.subagentLimitOverrides = mergeByOrg(current.subagentLimitOverrides, subagentPatch);
-                }
+            if (sandboxPatch !== undefined) {
+                next.sandboxLimitOverrides = mergeByOrg(current.sandboxLimitOverrides, sandboxPatch);
             }
-            for (const [key, value] of Object.entries(next)) {
-                if (value === undefined)
-                    continue;
-                const json = JSON.stringify(value);
-                await trx
-                    .insertInto("deployment_settings")
-                    .values({ key, value: json, updated_by: actorAccountId })
-                    .onConflict((oc) => oc
-                    .column("key")
-                    .doUpdateSet({ value: json, updated_by: actorAccountId, updated_at: new Date() }))
-                    .execute();
+            if (subagentPatch !== undefined) {
+                next.subagentLimitOverrides = mergeByOrg(current.subagentLimitOverrides, subagentPatch);
             }
-            await audit(trx, {
-                actorAccountId,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-                action: "deployment.settings.updated",
-                detail: check.data,
-            });
+        }
+        for (const [key, value] of Object.entries(next)) {
+            if (value === undefined)
+                continue;
+            const json = JSON.stringify(value);
+            await this.db
+                .insertInto("deployment_settings")
+                .values({ key, value: json, updated_by: actorAccountId })
+                .onConflict((oc) => oc
+                .column("key")
+                .doUpdateSet({ value: json, updated_by: actorAccountId, updated_at: new Date() }))
+                .execute();
+        }
+        await audit(this.db.db, {
+            actorAccountId,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            action: "deployment.settings.updated",
+            detail: { ...patch, ...auditDetail },
         });
-        return this.get();
     }
-}
+};
+__decorate([
+    Transactional()
+], SettingsService.prototype, "write", null);
+SettingsService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(SuperAdminLock)),
+    __param(3, Inject(KERNEL_LOGGER))
+], SettingsService);
+export { SettingsService };

package/dist/identity/sso.controller.d.ts

@@ -1,11 +1,11 @@
 import type { FastifyReply, FastifyRequest } from "fastify";
-import type { KernelConfig } from "../config/schema.js";
-import type { AccountsService } from "./accounts.js";
-import type { IdentityBinding, PendingBinding } from "./binding.js";
-import type { ExternalIdentities, LinkedIdentity } from "./external.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { AccountsService } from "./accounts.js";
+import { IdentityBinding, type PendingBinding } from "./binding.js";
+import { ExternalIdentities, type LinkedIdentity } from "./external.js";
 import { type Principal } from "./principal.js";
-import type { SessionService } from "./sessions.js";
-import { type SsoFlow } from "./sso.js";
+import { SessionService } from "./sessions.js";
+import { SsoFlow } from "./sso.js";
 /**
  * 第三方登录（`/api/v1/auth/sources`、`/api/v1/auth/sso/:plugin/*`，均为公开路由）。浏览器整页跳转，
  * 发起与回调都以 302 结束；失败回登录页并带原因码（`/login?error=<code>`），不回显身份源文本。
@@ -15,7 +15,7 @@ export declare class SsoController {
     private readonly sessions;
     private readonly accounts;
     private readonly config;
-    constructor(flow: SsoFlow, sessions: SessionService, accounts: AccountsService, config: () => KernelConfig);
+    constructor(flow: SsoFlow, sessions: SessionService, accounts: AccountsService, config: KernelConfigService);
     sources(): {
         sources: {
             plugin: string;

package/dist/identity/sso.controller.js

@@ -8,11 +8,15 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Controller, Delete, Get, HttpCode, Inject, Param, Post, Query, Req, Res, } from "@nestjs/common";
-import { ACCOUNTS, EXTERNAL_IDENTITIES, IDENTITY_BINDING, KERNEL_CONFIG, SESSIONS, SSO_FLOW, } from "../http/tokens.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { AccountsService } from "./accounts.js";
 import { clientMeta } from "./auth.controller.js";
+import { IdentityBinding } from "./binding.js";
 import { setSessionCookies } from "./cookies.js";
+import { ExternalIdentities } from "./external.js";
 import { CurrentPrincipal, Public, requireUser, SessionOnly } from "./principal.js";
-import { SSO_BINDING_COOKIE, SSO_COOKIE_PATH, SSO_STATE_TTL_SECONDS, ssoBrowserBinding, } from "./sso.js";
+import { SessionService } from "./sessions.js";
+import { SSO_BINDING_COOKIE, SSO_COOKIE_PATH, SSO_STATE_TTL_SECONDS, SsoFlow, ssoBrowserBinding, } from "./sso.js";
 const MAX_QUERY_KEYS = 50;
 const MAX_QUERY_VALUE = 4096;
 /** 查询参数只取单值字符串（重复参数 / 数组 / 超长值丢弃）。 */
@@ -78,7 +82,7 @@ let SsoController = class SsoController {
             }
             else {
                 const session = await this.sessions.create(account.id, clientMeta(req));
-                setSessionCookies(reply, session, this.config());
+                setSessionCookies(reply, session, this.config.get());
                 location = this.flow.webUrl(r.returnTo);
             }
         }
@@ -110,10 +114,10 @@ __decorate([
 ], SsoController.prototype, "callback", null);
 SsoController = __decorate([
     Controller("api/v1/auth"),
-    __param(0, Inject(SSO_FLOW)),
-    __param(1, Inject(SESSIONS)),
-    __param(2, Inject(ACCOUNTS)),
-    __param(3, Inject(KERNEL_CONFIG))
+    __param(0, Inject(SsoFlow)),
+    __param(1, Inject(SessionService)),
+    __param(2, Inject(AccountsService)),
+    __param(3, Inject(KernelConfigService))
 ], SsoController);
 export { SsoController };
 /**
@@ -155,7 +159,7 @@ __decorate([
 ], BindController.prototype, "bind", null);
 BindController = __decorate([
     Controller("api/v1/bind"),
-    __param(0, Inject(IDENTITY_BINDING))
+    __param(0, Inject(IdentityBinding))
 ], BindController);
 export { BindController };
 /** 本人绑定的外部身份（`/api/v1/me/identities`）：列出、解除。 */
@@ -187,6 +191,6 @@ __decorate([
 ], MeIdentitiesController.prototype, "unlink", null);
 MeIdentitiesController = __decorate([
     Controller("api/v1/me/identities"),
-    __param(0, Inject(EXTERNAL_IDENTITIES))
+    __param(0, Inject(ExternalIdentities))
 ], MeIdentitiesController);
 export { MeIdentitiesController };

package/dist/identity/sso.d.ts

@@ -1,8 +1,8 @@
 import { type Logger } from "@capybara-hq/plugin-sdk";
 import type { Redis } from "ioredis";
-import type { KernelConfig } from "../config/schema.js";
-import type { ExtensionHost } from "../extensions/host.js";
-import { type ExternalIdentities } from "./external.js";
+import { ExtensionRegistry } from "../extensions/registry.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { ExternalIdentities } from "./external.js";
 /** state 的有效期（秒）。 */
 export declare const SSO_STATE_TTL_SECONDS = 600;
 /** 浏览器绑定 Cookie：回调必须来自发起登录的同一个浏览器（防登录 CSRF / 把回跳链接转给别人）。 */
@@ -22,13 +22,6 @@ export type SsoLoginError = "sso.unavailable" | "sso.state_invalid" | "sso.sessi
 export declare function ssoBrowserBinding(existing: string | undefined): string;
 /** 回跳页面：站内相对路径（以单个 `/` 开头，非 `//`），否则 `/`（防开放重定向）。 */
 export declare function safeReturnTo(p: string | undefined): string;
-export interface SsoFlowDeps {
-    redis: Redis;
-    config: () => KernelConfig;
-    host: Pick<ExtensionHost, "list" | "deploymentConfig">;
-    external: ExternalIdentities;
-    log: Pick<Logger, "warn">;
-}
 /** 回调结果：成功给账号与回跳页面，失败给原因码。 */
 export type SsoCallbackResult = {
     ok: true;
@@ -48,8 +41,12 @@ export type SsoCallbackResult = {
  * 由此证明本人控制该外部身份，升级为可登录（Ruling A18，见 `ExternalIdentities.resolve`）。
  */
 export declare class SsoFlow {
-    private readonly deps;
-    constructor(deps: SsoFlowDeps);
+    private readonly redis;
+    private readonly config;
+    private readonly registry;
+    private readonly external;
+    private readonly log;
+    constructor(redis: Redis, config: Pick<KernelConfigService, "get">, registry: Pick<ExtensionRegistry, "list" | "deploymentConfig">, external: ExternalIdentities, log: Pick<Logger, "warn">);
     /** 已启用的登录方式：`auth.loginSources` 中（按其顺序）且已加载、提供 `identity-source@1` 的插件。 */
     sources(): {
         plugin: string;

package/dist/identity/sso.js

@@ -1,8 +1,21 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { IDENTITY_SOURCE_EXTENSION_POINT, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { ApiError } from "../errors.js";
-import { isSafeReturnPath } from "../tools/oauth/flow.js";
-import { IdentityNotVerified } from "./external.js";
+import { ExtensionRegistry } from "../extensions/registry.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KERNEL_LOGGER, REDIS } from "../infra/tokens.js";
+import { isSafeReturnPath } from "../tools/oauth/flow-paths.js";
+import { ExternalIdentities, IdentityNotVerified } from "./external.js";
 /** state 的有效期（秒）。 */
 export const SSO_STATE_TTL_SECONDS = 600;
 /** 浏览器绑定 Cookie：回调必须来自发起登录的同一个浏览器（防登录 CSRF / 把回跳链接转给别人）。 */
@@ -41,38 +54,46 @@ export function safeReturnTo(p) {
  * 已登录的用户也可以发起（「登录状态下绑定」）：回调请求带着同一账号的 Web 会话时，经 IM 绑定链接建立的身份
  * 由此证明本人控制该外部身份，升级为可登录（Ruling A18，见 `ExternalIdentities.resolve`）。
  */
-export class SsoFlow {
-    deps;
-    constructor(deps) {
-        this.deps = deps;
+let SsoFlow = class SsoFlow {
+    redis;
+    config;
+    registry;
+    external;
+    log;
+    constructor(redis, config, registry, external, log) {
+        this.redis = redis;
+        this.config = config;
+        this.registry = registry;
+        this.external = external;
+        this.log = log;
     }
     /** 已启用的登录方式：`auth.loginSources` 中（按其顺序）且已加载、提供 `identity-source@1` 的插件。 */
     sources() {
-        return this.deps.config().auth.loginSources.flatMap((plugin) => {
+        return this.config.get().auth.loginSources.flatMap((plugin) => {
             const src = this.provider(plugin);
             return src ? [{ plugin, label: { zh: src.label.zh, en: src.label.en } }] : [];
         });
     }
     provider(plugin) {
-        if (!this.deps.config().auth.loginSources.includes(plugin))
+        if (!this.config.get().auth.loginSources.includes(plugin))
             return undefined;
-        const entry = this.deps.host
+        const entry = this.registry
             .list("identity-source")
             .find((e) => e.plugin === plugin && e.capability === IDENTITY_SOURCE_EXTENSION_POINT);
         return entry?.impl;
     }
     redirectUri(plugin) {
-        const base = (this.deps.config().http.publicUrl ?? "").replace(/\/+$/, "");
+        const base = (this.config.get().http.publicUrl ?? "").replace(/\/+$/, "");
         return `${base}/api/v1/auth/sso/${encodeURIComponent(plugin)}/callback`;
     }
     /** 绑定 Cookie 是否加 Secure：`auth.cookieSecure`，或 `http.publicUrl` 是 https（浏览器经 https 访问）。 */
     cookieSecure() {
-        const cfg = this.deps.config();
+        const cfg = this.config.get();
         return cfg.auth.cookieSecure || (cfg.http.publicUrl ?? "").startsWith("https:");
     }
     /** 网页地址：`http.publicUrl` + 站内路径（未配置 publicUrl 时为相对地址）。 */
     webUrl(path) {
-        const base = (this.deps.config().http.publicUrl ?? "").replace(/\/+$/, "");
+        const base = (this.config.get().http.publicUrl ?? "").replace(/\/+$/, "");
         return `${base}${path}`;
     }
     /** 登录页并带原因码。 */
@@ -85,7 +106,7 @@ export class SsoFlow {
      */
     async start(plugin, returnTo, binding, sessionAccountId) {
         const src = this.provider(plugin);
-        if (!src || !this.deps.config().http.publicUrl)
+        if (!src || !this.config.get().http.publicUrl)
             return this.loginError("sso.unavailable");
         const state = b64url();
         const nonce = b64url();
@@ -94,7 +115,7 @@ export class SsoFlow {
         let url;
         try {
             url = src.authorizeUrl({
-                config: this.deps.host.deploymentConfig(plugin),
+                config: this.registry.deploymentConfig(plugin),
                 redirectUri,
                 state,
                 nonce,
@@ -106,7 +127,7 @@ export class SsoFlow {
                 throw new Error("authorize URL must be http(s)");
         }
         catch (err) {
-            this.deps.log.warn("identity source authorizeUrl failed", { plugin, err });
+            this.log.warn("identity source authorizeUrl failed", { plugin, err });
             return this.loginError("sso.unavailable");
         }
         const rec = {
@@ -118,7 +139,7 @@ export class SsoFlow {
             codeVerifier,
             ...(sessionAccountId !== undefined && { sessionAccountId }),
         };
-        await this.deps.redis.set(stateKey(state), JSON.stringify(rec), "EX", SSO_STATE_TTL_SECONDS);
+        await this.redis.set(stateKey(state), JSON.stringify(rec), "EX", SSO_STATE_TTL_SECONDS);
         return url;
     }
     /**
@@ -133,7 +154,7 @@ export class SsoFlow {
         const state = query.state;
         if (state === undefined || !STATE_RE.test(state))
             return { ok: false, error: "sso.state_invalid" };
-        const raw = await this.deps.redis.getdel(stateKey(state));
+        const raw = await this.redis.getdel(stateKey(state));
         if (raw === null)
             return { ok: false, error: "sso.state_invalid" };
         const rec = JSON.parse(raw);
@@ -154,7 +175,7 @@ export class SsoFlow {
         let identity;
         try {
             identity = await src.callback({
-                config: this.deps.host.deploymentConfig(plugin),
+                config: this.registry.deploymentConfig(plugin),
                 redirectUri: rec.redirectUri,
                 query,
                 nonce: rec.nonce,
@@ -163,13 +184,13 @@ export class SsoFlow {
             });
         }
         catch (err) {
-            this.deps.log.warn("identity source callback failed", { plugin, err });
+            this.log.warn("identity source callback failed", { plugin, err });
             return { ok: false, error: "sso.provider_error" };
         }
         // 身份源键由内核推导（Ruling A19）：插件只能为自己、为它报出的租户声明身份
         if (typeof identity?.tenantId !== "string" ||
             identity.source !== `${plugin}:${identity.tenantId}`) {
-            this.deps.log.warn("identity source returned a source key that does not match its tenant", {
+            this.log.warn("identity source returned a source key that does not match its tenant", {
                 plugin,
             });
             return { ok: false, error: "sso.provider_error" };
@@ -181,7 +202,7 @@ export class SsoFlow {
         let accountId;
         try {
             // 只有登录路径允许按已验证邮箱合并（Ruling A9）
-            accountId = (await this.deps.external.resolve(identity, undefined, {
+            accountId = (await this.external.resolve(identity, {
                 allowMerge: true,
                 linkedVia: "sso",
                 login: provedBy === undefined ? {} : { sessionAccountId: provedBy },
@@ -189,14 +210,23 @@ export class SsoFlow {
         }
         catch (err) {
             if (err instanceof IdentityNotVerified) {
-                this.deps.log.warn("sign-in with an unverified linked identity refused", { plugin });
+                this.log.warn("sign-in with an unverified linked identity refused", { plugin });
                 return { ok: false, error: "sso.identity_not_verified" };
             }
             if (!(err instanceof ApiError))
                 throw err;
-            this.deps.log.warn("external identity rejected", { plugin, err });
+            this.log.warn("external identity rejected", { plugin, err });
             return { ok: false, error: "sso.provider_error" };
         }
         return { ok: true, accountId, returnTo: rec.returnTo };
     }
-}
+};
+SsoFlow = __decorate([
+    Injectable(),
+    __param(0, Inject(REDIS)),
+    __param(1, Inject(KernelConfigService)),
+    __param(2, Inject(ExtensionRegistry)),
+    __param(3, Inject(ExternalIdentities)),
+    __param(4, Inject(KERNEL_LOGGER))
+], SsoFlow);
+export { SsoFlow };

package/dist/identity/super-admin.d.ts

@@ -0,0 +1,20 @@
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { XactLock } from "../infra/database/xact-lock.js";
+/**
+ * The super admin lock, the one implementation of "lock, then re-check the actor":
+ * both methods join the caller's transaction (`mandatory`), which holds the lock until it ends.
+ */
+export declare class SuperAdminLock {
+    private readonly db;
+    private readonly xactLock;
+    readonly txHost: TransactionHost;
+    constructor(db: KernelDb, xactLock: XactLock, txHost: TransactionHost);
+    /** Only the lock (callers without an actor: the CLI, bootstrap). */
+    lock(): Promise<void>;
+    /** The lock, then {@link assertActiveSuperAdmin} under it. */
+    lockAndAuthorize(actorAccountId: string): Promise<void>;
+}
+/** The one {@link SuperAdminLock}: identity, models, the extensions and the catalog import it. */
+export declare class SuperAdminLockModule {
+}