@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.2

package/dist/catalog/plugin-install.js

@@ -1,16 +1,36 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomUUID } from "node:crypto";
 import { EXTENSION_POINTS, parseExtensionPoint, parseSkillMd, SKILL_ENTRY_FILE, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { normalizeToolRef } from "../agents/definition.js";
 import { putTemplateVersionIn, revertTemplateVersionIn, softDeleteTemplateIn, } from "../agents/templates.js";
 import { ApiError } from "../errors.js";
 import { isExtensionEnabled } from "../extensions/enabled.js";
+import { OrgExtensionConfigs, } from "../extensions/org-config.js";
+import { ExtensionRegistry } from "../extensions/registry.js";
 import { audit } from "../identity/audit.js";
-import { lockOrg } from "../orgs/org-lock.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { afterCommit } from "../infra/database/after-commit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { packagePath } from "../packages/tgz.js";
-import { skillConflictError, skillConflicts, } from "../skills/skills.service.js";
-import { lockOrgForActions, readCatalogAgentTemplates, readCatalogFiles, readCatalogTemplates, requiredActions, skillOf, templateConnectorInput, templatePluginProblem, } from "./org-catalog.service.js";
-import { assertItemInstallable, disabledPluginItems, pluginItemDisabled, } from "./requests.service.js";
+import { SkillsService, skillConflictError, skillConflicts, } from "../skills/skills.service.js";
+import { StorageService } from "../storage/storage.service.js";
+import { ConnectorsService } from "../tools/connectors.service.js";
+import { findConnectorIn, lockOrgForActions, readCatalogAgentTemplates, readCatalogFiles, readCatalogTemplates, requiredActions, skillOf, templateConnectorInput, templatePluginProblem, } from "./catalog-content.js";
+import { assertItemInstallable, CatalogRequestsService, disabledPluginItems, pluginItemDisabled, } from "./requests.service.js";
 import { upgradeInfo } from "./upgrade-targets.js";
 import { maxSatisfying, satisfiesRange } from "./versions.js";
 /** How deep plugin dependencies may nest (the root plugin's dependencies are level 1). */
@@ -183,14 +203,44 @@ export function under(e, at) {
  * (plugin-upgrade.ts), which reuses the planning, install and ledger methods here (the ones without
  * `private` are internal to the catalog, not an API).
  */
-export class PluginInstaller {
-    d;
-    constructor(d) {
-        this.d = d;
+let PluginInstaller = class PluginInstaller {
+    kdb;
+    orgLock;
+    storage;
+    registry;
+    skills;
+    orgConfigs;
+    requests;
+    config;
+    connectors;
+    log;
+    txHost;
+    constructor(kdb, 
+    /** The org row lock (orgs/org-lock.ts): joins the caller's transaction. */
+    orgLock, storage, 
+    /** The loaded extensions and connectors of this replica (the extension registry). */
+    registry, skills, orgConfigs, requests, config, 
+    /** Org connectors: installs create, upgrade and remove them. */
+    connectors, log, txHost) {
+        this.kdb = kdb;
+        this.orgLock = orgLock;
+        this.storage = storage;
+        this.registry = registry;
+        this.skills = skills;
+        this.orgConfigs = orgConfigs;
+        this.requests = requests;
+        this.config = config;
+        this.connectors = connectors;
+        this.log = log;
+        this.txHost = txHost;
     }
-    /** The installer's dependencies (shared with `PluginUpgrader`). */
-    get deps() {
-        return this.d;
+    /** The kernel-schema handle of the current context (the transaction, else the pool). */
+    get db() {
+        return this.kdb.db;
+    }
+    /** `catalog.staleInstallMinutes`: an install `installing` for longer can be cleaned up by uninstalling it. */
+    staleInstallMinutes() {
+        return this.config.get().catalog.staleInstallMinutes;
     }
     /**
      * The checks an install runs before it creates anything, without the org's input (for the org
@@ -243,14 +293,17 @@ export class PluginInstaller {
      * and a name two plugins of the same plan both bring (the one installed first is the source).
      */
     async assertNoSkillConflicts(orgId, plan) {
-        const conflicts = await planSkillConflicts(this.d.db, orgId, plan);
+        const conflicts = await planSkillConflicts(this.db, orgId, plan);
         if (conflicts.length > 0)
             throw skillConflictError(conflicts);
     }
     /** The connector checks of templates against what this replica loads right now. */
     templateDeps() {
-        const versions = new Map(this.d.host.manifests().map((m) => [m.name, m.version]));
-        return { findConnector: this.d.findConnector, pluginVersion: (n) => versions.get(n) };
+        const versions = new Map(this.registry.manifests().map((m) => [m.name, m.version]));
+        return {
+            findConnector: (plugin, kind) => findConnectorIn(this.registry, plugin, kind),
+            pluginVersion: (n) => versions.get(n),
+        };
     }
     /**
      * Plans the install of one plugin version and, depth first, of its dependencies not yet
@@ -261,7 +314,7 @@ export class PluginInstaller {
     async plan(orgId, actor, itemId, version, input, at, approvedBy) {
         if (!UUID_RE.test(itemId))
             throw new ApiError("catalog.item_not_found", "Plugin not found");
-        const v = await this.d.db
+        const v = await this.db
             .selectFrom("catalog_item_versions as v")
             .innerJoin("catalog_items as i", "i.id", "v.item_id")
             .select([
@@ -279,11 +332,11 @@ export class PluginInstaller {
         if (!v)
             throw new ApiError("catalog.item_not_found", "Plugin version not found");
         const manifest = v.manifest;
-        const deps = await resolveDependencies(this.d.db, manifest);
+        const deps = await resolveDependencies(this.db, manifest);
         const extension = await this.planExtension(orgId, manifest);
-        const templates = await readCatalogTemplates(this.d.storage, v);
-        const skillNames = await catalogSkillNames(this.d.storage, v, manifest);
-        const agentTemplates = await readCatalogAgentTemplates(this.d.storage, v);
+        const templates = await readCatalogTemplates(this.storage, v);
+        const skillNames = await catalogSkillNames(this.storage, v, manifest);
+        const agentTemplates = await readCatalogAgentTemplates(this.storage, v);
         const connectors = new Map();
         if (input === null) {
             for (const ct of templates) {
@@ -300,7 +353,7 @@ export class PluginInstaller {
         }
         const dependencies = [];
         for (const dep of deps) {
-            if (await this.liveDependency(this.d.db, orgId, dep)) {
+            if (await this.liveDependency(this.db, orgId, dep)) {
                 dependencies.push({ dep, plan: null });
                 continue;
             }
@@ -355,7 +408,7 @@ export class PluginInstaller {
                     : `This connector template needs ${needs}`);
         }
         try {
-            this.d.connectors.checkCreateInput(actor, ci);
+            this.connectors.checkCreateInput(actor, ci);
         }
         catch (e) {
             throw under(e, path);
@@ -397,30 +450,30 @@ export class PluginInstaller {
      * cannot leave the component pointing at a removed install. `created` false: the org's existing
      * install, if any (returns its id, undefined when there is none); it must be `installed`
      * (`installing` -> 409 `plugin.install_in_progress`, retry later) and in range. `created` true:
-     * `child`, the dependency install this install just created, must still exist.
+     * `child`, the dependency install this install just created, must still exist. A step of an
+     * install or upgrade: it commits on its own (`requires_new`), the undo on failure relies on it.
      */
     async recordDependency(orgId, dep, record, child) {
-        return this.d.db.transaction().execute(async (t) => {
-            await lockOrg(t, orgId);
-            const live = await this.findLiveDependency(t, orgId, dep, true);
-            if (child !== undefined) {
-                if (live?.id !== child || live.status !== "installed") {
-                    throw unresolved(dep.name, dep.range, "its install in this organization was removed meanwhile; try again");
-                }
-                await record({ kind: "plugin", ref: child, created: true, skillVersion: null }, t);
-                return child;
-            }
-            if (!live)
-                return undefined;
-            if (!satisfiesRange(live.version, dep.range)) {
-                throw unresolved(dep.name, dep.range, `this organization has version ${live.version} installed; uninstall it to install a matching version`);
-            }
-            if (live.status !== "installed") {
-                throw new ApiError("plugin.install_in_progress", `Dependency ${dep.name} is being installed by another install in this organization; try again when it finishes. An install stuck for longer than catalog.staleInstallMinutes can be removed by uninstalling it`);
+        const t = this.db;
+        await this.orgLock.lock(orgId);
+        const live = await this.findLiveDependency(t, orgId, dep, true);
+        if (child !== undefined) {
+            if (live?.id !== child || live.status !== "installed") {
+                throw unresolved(dep.name, dep.range, "its install in this organization was removed meanwhile; try again");
             }
-            await record({ kind: "plugin", ref: live.id, created: false, skillVersion: null }, t);
-            return live.id;
-        });
+            await record({ kind: "plugin", ref: child, created: true, skillVersion: null });
+            return child;
+        }
+        if (!live)
+            return undefined;
+        if (!satisfiesRange(live.version, dep.range)) {
+            throw unresolved(dep.name, dep.range, `this organization has version ${live.version} installed; uninstall it to install a matching version`);
+        }
+        if (live.status !== "installed") {
+            throw new ApiError("plugin.install_in_progress", `Dependency ${dep.name} is being installed by another install in this organization; try again when it finishes. An install stuck for longer than catalog.staleInstallMinutes can be removed by uninstalling it`);
+        }
+        await record({ kind: "plugin", ref: live.id, created: false, skillVersion: null });
+        return live.id;
     }
     /**
      * Runs a plan: the install row, then the steps (see the class comment). Throws
@@ -432,59 +485,15 @@ export class PluginInstaller {
         // The install row (role and item policy re-checked under the lock; one live install per org
         // and item)
         const installId = randomUUID();
-        await this.d.db.transaction().execute(async (t) => {
-            await lockOrgForActions(t, orgId, actor, ctx.actions);
-            if (ctx.approvedBy !== undefined) {
-                // A dependency disabled (or removed) since it was planned
-                const own = await t
-                    .selectFrom("catalog_items")
-                    .select(["policy", "deleted_at"])
-                    .where("id", "=", itemId)
-                    .forShare()
-                    .executeTakeFirst();
-                if (!own || own.deleted_at !== null) {
-                    throw unresolved(plan.name, plan.version, "it was removed from the enterprise catalog");
-                }
-                if (own.policy === "disabled")
-                    throw dependencyDisabled(plan.name);
-            }
-            await assertItemInstallable(t, orgId, itemId, ctx.approvedBy ?? itemId);
-            const live = await t
-                .selectFrom("plugin_installs")
-                .select("id")
-                .where("org_id", "=", orgId)
-                .where("item_id", "=", itemId)
-                .where("status", "<>", "failed")
-                .executeTakeFirst();
-            if (live)
-                throw alreadyInstalled();
-            try {
-                await t
-                    .insertInto("plugin_installs")
-                    .values({
-                    id: installId,
-                    org_id: orgId,
-                    item_id: itemId,
-                    version,
-                    status: "installing",
-                    installed_by: actor,
-                })
-                    .execute();
-            }
-            catch (e) {
-                if (isUniqueViolation(e))
-                    throw alreadyInstalled();
-                throw e;
-            }
-        });
+        await this.createInstallRow(orgId, actor, plan, ctx, installId);
         const done = [];
-        // Records a component in the given transaction (the install row already cleaned up -> the FK
-        // fails, the install aborts and rolls back)
-        const record = async (c, t) => {
+        // Records a component in the transaction of the context (none: on its own; the install row
+        // already cleaned up -> the FK fails, the install aborts and rolls back)
+        const record = async (c) => {
             // Into `done` first: a component that exists is rolled back even when recording it fails
             // (enabling an extension and recording it share one transaction and fail together)
             done.push(c);
-            await (t ?? this.d.db)
+            await this.db
                 .insertInto("plugin_install_components")
                 .values({
                 install_id: installId,
@@ -532,25 +541,17 @@ export class PluginInstaller {
             }
             step = "extension";
             if (plan.extension !== null) {
-                const p = plan.extension;
-                // "Enabled before" is decided under the org row lock (already enabled: put writes nothing,
-                // the config is untouched); the component is recorded in the same transaction
-                await this.d.orgConfigs.put(orgId, p, {
+                await this.enableExtension(orgId, plan.extension, {
                     enabled: true,
                     ...(plan.extensionConfig !== undefined && { config: plan.extensionConfig }),
-                }, actor, opts.actorTokenId, {
-                    viaItem: itemId,
-                    ...(nested && { approvedBy }),
-                    ifDisabled: { skipped: false },
-                    inTransaction: (t, skipped) => record({ kind: "extension", ref: p, created: !skipped, skillVersion: null }, t),
-                });
+                }, actor, opts.actorTokenId, { viaItem: itemId, ...(nested && { approvedBy }) }, record);
             }
             step = "connectors";
             for (const ct of plan.templates) {
                 const ci = plan.connectors.get(ct.id);
                 if (!ci)
                     throw new ApiError("internal", `Connector template ${ct.id} was not planned`);
-                const r = await this.d.connectors.create(orgId, actor, ci, opts.actorTokenId);
+                const r = await this.connectors.create(orgId, actor, ci, opts.actorTokenId);
                 await record({
                     kind: "connector",
                     ref: r.connector.id,
@@ -561,29 +562,12 @@ export class PluginInstaller {
             }
             step = "agent_templates";
             for (const a of plan.agentTemplates) {
-                // Created (or a new version of the org's live template of this plugin and name) and
-                // recorded in one transaction, under the org row lock
-                await this.d.db.transaction().execute(async (t) => {
-                    await lockOrg(t, orgId);
-                    const r = await putTemplateVersionIn(t, {
-                        orgId,
-                        plugin: plan.name,
-                        catalogItemId: itemId,
-                        catalogVersion: version,
-                        sourceFormat: plan.sourceFormat,
-                    }, a.template);
-                    await record({
-                        kind: "agent_template",
-                        ref: r.id,
-                        created: r.created,
-                        skillVersion: !r.created && r.changed ? r.version : null,
-                    }, t);
-                });
+                await this.installAgentTemplate(orgId, plan, a.template, record);
             }
             step = "skills";
             for (const s of manifest.skills ?? []) {
-                const files = await readCatalogFiles(this.d.storage, plan.row.object_prefix, plan.row.files, packagePath(s.path));
-                const r = await this.d.skills.createVersionFromFiles(orgId, actor, { ...skillOf(files), files }, {
+                const files = await readCatalogFiles(this.storage, plan.row.object_prefix, plan.row.files, packagePath(s.path));
+                const r = await this.skills.createVersionFromFiles(orgId, actor, { ...skillOf(files), files }, {
                     catalog: {
                         itemId,
                         version,
@@ -600,68 +584,165 @@ export class PluginInstaller {
                     skillVersion: r.created ? null : r.version,
                 });
             }
-            await this.d.db.transaction().execute(async (t) => {
-                await lockOrg(t, orgId);
-                const updated = await t
-                    .updateTable("plugin_installs")
-                    .set({ status: "installed" })
-                    .where("id", "=", installId)
-                    .where("status", "=", "installing")
-                    .executeTakeFirst();
-                // The install row was already cleaned up as stale: do not audit plugin.org_installed, roll
-                // back
-                if (updated.numUpdatedRows === 0n) {
-                    throw new ApiError("plugin.install_not_found", "The install record was cleaned up as stale while the install was running");
-                }
-                await this.d.requests.resolveByInstall(t, orgId, itemId, actor, opts);
-                await audit(t, {
-                    actorAccountId: actor,
-                    ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                    orgId,
-                    action: "plugin.org_installed",
-                    target: installId,
-                    detail: {
-                        itemId,
-                        name: plan.name,
-                        version,
-                        components: done,
-                        ...(ctx.parent !== undefined && { dependencyOf: ctx.parent }),
-                    },
-                });
-            });
+            await this.markInstalled(orgId, actor, installId, plan, done, ctx, opts);
             return installId;
         }
         catch (e) {
             const failure = e instanceof InstallFailure ? e : undefined;
             const code = failure ? failure.code : e instanceof ApiError ? e.code : "internal";
             const rollbackErrors = await this.rollback(orgId, actor, installId, done, opts);
-            await this.d.db.transaction().execute(async (t) => {
-                await t
-                    .updateTable("plugin_installs")
-                    .set({ status: "failed", error: JSON.stringify({ step, code }) })
-                    .where("id", "=", installId)
-                    .execute();
-                await audit(t, {
-                    actorAccountId: actor,
-                    ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                    orgId,
-                    action: "plugin.org_install_failed",
-                    target: installId,
-                    detail: {
-                        itemId,
-                        name: plan.name,
-                        version,
-                        step,
-                        code,
-                        rolledBack: done,
-                        rollbackErrors,
-                        ...(ctx.parent !== undefined && { dependencyOf: ctx.parent }),
-                    },
-                });
-            });
+            await this.markFailed(orgId, actor, installId, plan, ctx, { step, code, done, rollbackErrors }, opts);
             throw new InstallFailure(failure ? failure.step : step, failure ? failure.cause : e, failure ? failure.dependency : [], rollbackErrors.length === 0 && (failure?.rolledBack ?? true));
         }
     }
+    /**
+     * The install row (role and item policy re-checked under the lock; one live install per org and
+     * item). A step of the install: committed on its own.
+     */
+    /**
+     * Enables a plugin's extension for the org and records it as a component of the install, in one
+     * transaction (`put` joins it): "enabled before" is decided under the org row lock (already
+     * enabled: `put` writes nothing, the config is untouched, the component is recorded as not
+     * created), and the ledger row is written before the COMMIT, so no concurrent uninstall fits
+     * between enabling and recording. Used by the install and the upgrade.
+     */
+    async enableExtension(orgId, name, input, actor, actorTokenId, opts, record) {
+        const ifDisabled = { skipped: false };
+        await this.orgConfigs.put(orgId, name, input, actor, actorTokenId, { ...opts, ifDisabled });
+        await record({
+            kind: "extension",
+            ref: name,
+            created: !ifDisabled.skipped,
+            skillVersion: null,
+        });
+    }
+    async createInstallRow(orgId, actor, plan, ctx, installId) {
+        const { itemId, version } = plan;
+        const t = this.db;
+        await lockOrgForActions(this.orgLock, orgId, actor, ctx.actions);
+        if (ctx.approvedBy !== undefined) {
+            // A dependency disabled (or removed) since it was planned
+            const own = await t
+                .selectFrom("catalog_items")
+                .select(["policy", "deleted_at"])
+                .where("id", "=", itemId)
+                .forShare()
+                .executeTakeFirst();
+            if (!own || own.deleted_at !== null) {
+                throw unresolved(plan.name, plan.version, "it was removed from the enterprise catalog");
+            }
+            if (own.policy === "disabled")
+                throw dependencyDisabled(plan.name);
+        }
+        await assertItemInstallable(t, orgId, itemId, ctx.approvedBy ?? itemId);
+        const live = await t
+            .selectFrom("plugin_installs")
+            .select("id")
+            .where("org_id", "=", orgId)
+            .where("item_id", "=", itemId)
+            .where("status", "<>", "failed")
+            .executeTakeFirst();
+        if (live)
+            throw alreadyInstalled();
+        try {
+            await t
+                .insertInto("plugin_installs")
+                .values({
+                id: installId,
+                org_id: orgId,
+                item_id: itemId,
+                version,
+                status: "installing",
+                installed_by: actor,
+            })
+                .execute();
+        }
+        catch (e) {
+            if (isUniqueViolation(e))
+                throw alreadyInstalled();
+            throw e;
+        }
+    }
+    /**
+     * An agent template step: created (or a new version of the org's live template of this plugin and
+     * name) and recorded in one transaction of its own, under the org row lock.
+     */
+    async installAgentTemplate(orgId, plan, template, record) {
+        await this.orgLock.lock(orgId);
+        const r = await putTemplateVersionIn(this.db, {
+            orgId,
+            plugin: plan.name,
+            catalogItemId: plan.itemId,
+            catalogVersion: plan.version,
+            sourceFormat: plan.sourceFormat,
+        }, template);
+        await record({
+            kind: "agent_template",
+            ref: r.id,
+            created: r.created,
+            skillVersion: !r.created && r.changed ? r.version : null,
+        });
+    }
+    /** The install `installed` and its `plugin.org_installed` audit, under the org row lock (its own transaction). */
+    async markInstalled(orgId, actor, installId, plan, done, ctx, opts) {
+        const { itemId, version } = plan;
+        const t = this.db;
+        await this.orgLock.lock(orgId);
+        const updated = await t
+            .updateTable("plugin_installs")
+            .set({ status: "installed" })
+            .where("id", "=", installId)
+            .where("status", "=", "installing")
+            .executeTakeFirst();
+        // The install row was already cleaned up as stale: do not audit plugin.org_installed, roll
+        // back
+        if (updated.numUpdatedRows === 0n) {
+            throw new ApiError("plugin.install_not_found", "The install record was cleaned up as stale while the install was running");
+        }
+        await this.requests.resolveByInstall(orgId, itemId, actor, opts);
+        await audit(t, {
+            actorAccountId: actor,
+            ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+            orgId,
+            action: "plugin.org_installed",
+            target: installId,
+            detail: {
+                itemId,
+                name: plan.name,
+                version,
+                components: done,
+                ...(ctx.parent !== undefined && { dependencyOf: ctx.parent }),
+            },
+        });
+    }
+    /** The install `failed` with `{ step, code }` and its `plugin.org_install_failed` audit (its own transaction). */
+    async markFailed(orgId, actor, installId, plan, ctx, f, opts) {
+        const { itemId, version } = plan;
+        const { step, code, done, rollbackErrors } = f;
+        const t = this.db;
+        await t
+            .updateTable("plugin_installs")
+            .set({ status: "failed", error: JSON.stringify({ step, code }) })
+            .where("id", "=", installId)
+            .execute();
+        await audit(t, {
+            actorAccountId: actor,
+            ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+            orgId,
+            action: "plugin.org_install_failed",
+            target: installId,
+            detail: {
+                itemId,
+                name: plan.name,
+                version,
+                step,
+                code,
+                rolledBack: done,
+                rollbackErrors,
+                ...(ctx.parent !== undefined && { dependencyOf: ctx.parent }),
+            },
+        });
+    }
     /**
      * The extension to enable: the plugin's own, when it has one. Not loaded on this replica ->
      * `catalog.not_deployed`; not yet enabled in this org while its own catalog item is disabled ->
@@ -672,11 +753,11 @@ export class PluginInstaller {
         if (!manifest.extension)
             return null;
         const name = manifest.name;
-        if (!this.d.host.manifests().some((m) => m.name === name)) {
+        if (!this.registry.manifests().some((m) => m.name === name)) {
             throw new ApiError("catalog.not_deployed", `The extension of plugin ${name} is not deployed; ask the enterprise admin to install and enable it`);
         }
-        const enabled = await isExtensionEnabled(this.d.db, orgId, name);
-        if (!enabled && (await disabledPluginItems(this.d.db, [name])).length > 0) {
+        const enabled = await isExtensionEnabled(this.db, orgId, name);
+        if (!enabled && (await disabledPluginItems(this.db, [name])).length > 0) {
             throw pluginItemDisabled([name]);
         }
         return name;
@@ -705,46 +786,13 @@ export class PluginInstaller {
             if (!c.created && c.skillVersion === null)
                 continue;
             try {
-                const disabled = [];
-                await this.d.db.transaction().execute(async (t) => {
-                    await lockOrg(t, orgId);
-                    if (c.kind === "plugin") {
-                        // A dependency install this install created: uninstalled by the usual rules
-                        const sub = { removed: [], kept: [] };
-                        await this.uninstallIn(t, orgId, actor, c.ref, {
-                            report: sub,
-                            removing: new Set([installId]),
-                            from: installId,
-                            authorize: false,
-                            reason: "plugin_install_rollback",
-                            opts,
-                        });
-                        disabled.push(...sub.removed.filter((r) => r.kind === "extension").map((r) => r.ref));
-                    }
-                    else {
-                        // Another enabled extension depends on it (only it provides what that one needs in this
-                        // org): kept (its component row too), so the other does not lose its dependency
-                        if (c.kind === "extension" &&
-                            (await this.d.orgConfigs.enabledDependents(t, orgId, c.ref)).length > 0) {
-                            return;
-                        }
-                        const removed = await this.removeComponent(t, orgId, actor, c, "plugin_install_rollback");
-                        if (removed && c.kind === "extension")
-                            disabled.push(c.ref);
-                    }
-                    await t
-                        .deleteFrom("plugin_install_components")
-                        .where("install_id", "=", installId)
-                        .where("kind", "=", c.kind)
-                        .where("ref", "=", c.ref)
-                        .execute();
-                });
+                const disabled = await this.rollbackOne(orgId, actor, installId, c, opts);
                 for (const p of disabled)
-                    await this.d.orgConfigs.afterDisable(orgId, p);
+                    await this.orgConfigs.afterDisable(orgId, p);
             }
             catch (e) {
                 errors.push({ kind: c.kind, ref: c.ref });
-                this.d.log?.warn("plugin install rollback step failed", {
+                this.log.warn("plugin install rollback step failed", {
                     orgId,
                     kind: c.kind,
                     ref: c.ref,
@@ -754,11 +802,53 @@ export class PluginInstaller {
         }
         return errors;
     }
+    /**
+     * Undoes one component of a failed install and deletes its component row, under the org row lock,
+     * in a transaction of its own (committed when it returns); returns the extensions it disabled
+     * (the caller notifies them).
+     */
+    async rollbackOne(orgId, actor, installId, c, opts) {
+        const disabled = [];
+        const t = this.db;
+        await this.orgLock.lock(orgId);
+        if (c.kind === "plugin") {
+            // A dependency install this install created: uninstalled by the usual rules
+            const sub = { removed: [], kept: [] };
+            await this.uninstallIn(orgId, actor, c.ref, {
+                report: sub,
+                removing: new Set([installId]),
+                from: installId,
+                authorize: false,
+                reason: "plugin_install_rollback",
+                opts,
+            });
+            disabled.push(...sub.removed.filter((r) => r.kind === "extension").map((r) => r.ref));
+        }
+        else {
+            // Another enabled extension depends on it (only it provides what that one needs in this
+            // org): kept (its component row too), so the other does not lose its dependency
+            if (c.kind === "extension" &&
+                (await this.orgConfigs.enabledDependents(orgId, c.ref)).length > 0) {
+                return [];
+            }
+            const removed = await this.removeComponent(orgId, actor, c, "plugin_install_rollback");
+            if (removed && c.kind === "extension")
+                disabled.push(c.ref);
+        }
+        await t
+            .deleteFrom("plugin_install_components")
+            .where("install_id", "=", installId)
+            .where("kind", "=", c.kind)
+            .where("ref", "=", c.ref)
+            .execute();
+        return disabled;
+    }
     /** Removes one component (one already gone is no error); returns whether anything changed. */
-    async removeComponent(t, orgId, actor, c, reason) {
+    async removeComponent(orgId, actor, c, reason) {
         if (c.kind === "extension") {
-            return this.d.orgConfigs.disableIn(t, orgId, c.ref, actor, reason);
+            return this.orgConfigs.disableIn(orgId, c.ref, actor, reason);
         }
+        const t = this.db;
         if (c.kind === "connector") {
             const live = await t
                 .selectFrom("connectors")
@@ -769,7 +859,7 @@ export class PluginInstaller {
                 .executeTakeFirst();
             if (!live)
                 return false;
-            await this.d.connectors.removeIn(t, orgId, c.ref, actor, undefined, reason);
+            await this.connectors.removeIn(orgId, c.ref, actor, undefined, reason);
             return true;
         }
         if (c.kind === "plugin")
@@ -783,9 +873,9 @@ export class PluginInstaller {
             return false;
         }
         if (c.created)
-            return this.d.skills.softDeleteIn(t, orgId, c.ref, actor, reason);
+            return this.skills.softDeleteIn(orgId, c.ref, actor, reason);
         if (c.skillVersion !== null) {
-            return this.d.skills.revertVersionIn(t, orgId, c.ref, c.skillVersion, actor, reason);
+            return this.skills.revertVersionIn(orgId, c.ref, c.skillVersion, actor, reason);
         }
         return false;
     }
@@ -814,32 +904,36 @@ export class PluginInstaller {
     async uninstall(orgId, actor, installId, opts = {}) {
         if (!UUID_RE.test(installId))
             throw installNotFound();
+        return this.writeUninstall(orgId, actor, installId, opts);
+    }
+    /** The uninstall's one transaction; the extensions it disabled are notified once it commits. */
+    async writeUninstall(orgId, actor, installId, opts) {
         const report = { removed: [], kept: [] };
-        await this.d.db.transaction().execute(async (t) => {
-            const outcome = await this.uninstallIn(t, orgId, actor, installId, {
-                report,
-                removing: new Set(),
-                authorize: true,
-                opts,
-            });
-            if (outcome === "missing")
-                throw installNotFound();
-            if (outcome === "kept") {
-                report.kept.push({ kind: "plugin", ref: installId, reason: "used_by_other_install" });
-            }
+        const outcome = await this.uninstallIn(orgId, actor, installId, {
+            report,
+            removing: new Set(),
+            authorize: true,
+            opts,
         });
-        for (const r of report.removed) {
-            if (r.kind === "extension")
-                await this.d.orgConfigs.afterDisable(orgId, r.ref);
+        if (outcome === "missing")
+            throw installNotFound();
+        if (outcome === "kept") {
+            report.kept.push({ kind: "plugin", ref: installId, reason: "used_by_other_install" });
         }
+        afterCommit(async () => {
+            for (const r of report.removed) {
+                if (r.kind === "extension")
+                    await this.orgConfigs.afterDisable(orgId, r.ref);
+            }
+        });
         return report;
     }
     /**
      * The oldest other live install (not in `removing`) that has component `kind` / `ref`, or
      * undefined.
      */
-    async heir(t, orgId, removing, kind, ref) {
-        let q = t
+    async heir(orgId, removing, kind, ref) {
+        let q = this.db
             .selectFrom("plugin_install_components as c")
             .innerJoin("plugin_installs as a", "a.id", "c.install_id")
             .select("a.id")
@@ -853,8 +947,8 @@ export class PluginInstaller {
         return row?.id;
     }
     /** Passes ownership of a component to `heir` (its component row becomes created=true). */
-    async handOver(t, heir, kind, ref) {
-        await t
+    async handOver(heir, kind, ref) {
+        await this.db
             .updateTable("plugin_install_components")
             .set({ created: true })
             .where("install_id", "=", heir)
@@ -868,7 +962,8 @@ export class PluginInstaller {
      * outcome of the install itself is returned for the caller to report: `missing`, `kept` (another
      * install outside this uninstall depends on it) or `removed`.
      */
-    async uninstallIn(t, orgId, actor, installId, ctx) {
+    async uninstallIn(orgId, actor, installId, ctx) {
+        const t = this.db;
         const { removing } = ctx;
         if (removing.has(installId))
             return "removed";
@@ -882,7 +977,7 @@ export class PluginInstaller {
             mine.kept.push(x);
             ctx.report.kept.push(x);
         };
-        const staleMinutes = this.d.staleInstallMinutes();
+        const staleMinutes = this.staleInstallMinutes();
         if (ctx.authorize) {
             const target = await t
                 .selectFrom("plugin_installs as a")
@@ -891,7 +986,7 @@ export class PluginInstaller {
                 .where("a.id", "=", installId)
                 .where("a.org_id", "=", orgId)
                 .executeTakeFirst();
-            await lockOrgForActions(t, orgId, actor, target ? requiredActions(target.manifest) : ALL_ACTIONS);
+            await lockOrgForActions(this.orgLock, orgId, actor, target ? requiredActions(target.manifest) : ALL_ACTIONS);
         }
         const row = await t
             .selectFrom("plugin_installs as a")
@@ -914,10 +1009,10 @@ export class PluginInstaller {
             return "missing";
         // Another install outside this uninstall depends on it: kept (a dependency uninstall hands
         // ownership over)
-        const user = await this.heir(t, orgId, new Set([...removing, installId]), "plugin", installId);
+        const user = await this.heir(orgId, new Set([...removing, installId]), "plugin", installId);
         if (user !== undefined) {
             if (ctx.from !== undefined)
-                await this.handOver(t, user, "plugin", installId);
+                await this.handOver(user, "plugin", installId);
             return "kept";
         }
         if (row.status === "uninstalling" ||
@@ -927,7 +1022,7 @@ export class PluginInstaller {
         }
         if (row.status === "upgrading") {
             // An upgrade interrupted midway (a replica crashed): undone first, back at the old version
-            const undone = await this.undoUpgradeIn(t, orgId, actor, installId, journalEntries(row.upgrade), "plugin_upgrade_cleanup");
+            const undone = await this.undoUpgradeIn(orgId, actor, installId, journalEntries(row.upgrade), "plugin_upgrade_cleanup");
             for (const x of undone)
                 addRemoved(x);
         }
@@ -953,7 +1048,7 @@ export class PluginInstaller {
                     ? 2 + extensionOrder.indexOf(c.ref)
                     : 1000 + (c.created ? 0 : 1);
         comps.sort((a, b) => rank(a) - rank(b));
-        const agentRefs = await this.agentRefs(t, orgId);
+        const agentRefs = await this.agentRefs(orgId);
         for (const c of comps) {
             const keep = (reason) => addKept({ kind: c.kind, ref: c.ref, reason });
             let created = c.created;
@@ -983,7 +1078,7 @@ export class PluginInstaller {
                 if (rollbackMode &&
                     (c.kind === "skill" || c.kind === "agent_template") &&
                     c.skill_version !== null &&
-                    (await this.removeComponent(t, orgId, actor, comp, "plugin_install_cleanup"))) {
+                    (await this.removeComponent(orgId, actor, comp, "plugin_install_cleanup"))) {
                     addRemoved({ kind: c.kind, ref: c.ref });
                     continue;
                 }
@@ -991,7 +1086,7 @@ export class PluginInstaller {
                 continue;
             }
             if (c.kind === "plugin") {
-                const outcome = await this.uninstallIn(t, orgId, actor, c.ref, { ...ctx, from: installId });
+                const outcome = await this.uninstallIn(orgId, actor, c.ref, { ...ctx, from: installId });
                 if (outcome === "removed")
                     addRemoved({ kind: "plugin", ref: c.ref });
                 else if (outcome === "kept")
@@ -999,7 +1094,7 @@ export class PluginInstaller {
                 continue;
             }
             const reason = rollbackMode ? "plugin_install_cleanup" : (ctx.reason ?? "plugin_uninstall");
-            const outcome = await this.decideRemovalIn(t, orgId, actor, comp, removing, agentRefs, reason);
+            const outcome = await this.decideRemovalIn(orgId, actor, comp, removing, agentRefs, reason);
             if (outcome === "removed")
                 addRemoved({ kind: c.kind, ref: c.ref });
             else if (outcome !== "gone")
@@ -1034,7 +1129,7 @@ export class PluginInstaller {
      * (`used_by_plugins`); otherwise removed (`removed`, or `gone` when it no longer existed). Used
      * by uninstall and by an upgrade's removals.
      */
-    async decideRemovalIn(t, orgId, actor, c, removing, agentRefs, reason) {
+    async decideRemovalIn(orgId, actor, c, removing, agentRefs, reason) {
         if (c.kind === "skill" && agentRefs.skills.has(c.ref))
             return "used_by_agents";
         if (c.kind === "agent_template" && agentRefs.templates.has(c.ref))
@@ -1042,16 +1137,16 @@ export class PluginInstaller {
         if (c.kind === "connector" && agentRefs.connectors.has(c.ref))
             return "used_by_agents";
         if (c.kind !== "connector") {
-            const heir = await this.heir(t, orgId, removing, c.kind, c.ref);
+            const heir = await this.heir(orgId, removing, c.kind, c.ref);
             if (heir !== undefined) {
-                await this.handOver(t, heir, c.kind, c.ref);
+                await this.handOver(heir, c.kind, c.ref);
                 return "used_by_other_install";
             }
         }
         if (c.kind === "extension") {
             const kinds = this.connectorKindsOf(c.ref);
             if (kinds.length > 0) {
-                const used = await t
+                const used = await this.db
                     .selectFrom("connectors")
                     .select("id")
                     .where("org_id", "=", orgId)
@@ -1061,21 +1156,21 @@ export class PluginInstaller {
                 if (used)
                     return "used_by_connectors";
             }
-            if ((await this.d.orgConfigs.enabledDependents(t, orgId, c.ref)).length > 0) {
+            if ((await this.orgConfigs.enabledDependents(orgId, c.ref)).length > 0) {
                 return "used_by_plugins";
             }
         }
-        return (await this.removeComponent(t, orgId, actor, c, reason)) ? "removed" : "gone";
+        return (await this.removeComponent(orgId, actor, c, reason)) ? "removed" : "gone";
     }
     /** The order extensions are uninstalled in: the reverse of the install (requires) order; extensions not loaded on this replica last. */
     uninstallExtensionOrder(refs) {
-        const loaded = new Map(this.d.host.manifests().map((m) => [m.name, m]));
+        const loaded = new Map(this.registry.manifests().map((m) => [m.name, m]));
         const known = refs.filter((r) => loaded.has(r)).map((r) => loaded.get(r));
         return [...orderByRequires(known).reverse(), ...refs.filter((r) => !loaded.has(r))];
     }
     /** The org's plugin installs (failed ones included), newest first; `installId` picks one. */
     async list(orgId, installId) {
-        let q = this.d.db
+        let q = this.db
             .selectFrom("plugin_installs as a")
             .innerJoin("catalog_items as i", "i.id", "a.item_id")
             .select([
@@ -1094,8 +1189,8 @@ export class PluginInstaller {
         const rows = await q.orderBy("a.installed_at", "desc").orderBy("a.id").execute();
         if (rows.length === 0)
             return [];
-        const info = await upgradeInfo(this.d.db, this.d.host, rows.map((r) => ({ itemId: r.item_id, name: r.name, version: r.version })));
-        const comps = await this.d.db
+        const info = await upgradeInfo(this.db, this.registry, rows.map((r) => ({ itemId: r.item_id, name: r.name, version: r.version })));
+        const comps = await this.db
             .selectFrom("plugin_install_components")
             .select(["install_id", "kind", "ref", "created", "skill_version", "dropped"])
             .where("install_id", "in", rows.map((r) => r.id))
@@ -1131,9 +1226,9 @@ export class PluginInstaller {
      * extension among them needs `afterDisable` once committed). Used when an upgrade fails and when
      * an interrupted one is cleaned up.
      */
-    async undoUpgradeIn(t, orgId, actor, installId, steps, reason) {
+    async undoUpgradeIn(orgId, actor, installId, steps, reason) {
         const removed = [];
-        const dropRow = (kind, ref) => t
+        const dropRow = (kind, ref) => this.db
             .deleteFrom("plugin_install_components")
             .where("install_id", "=", installId)
             .where("kind", "=", kind)
@@ -1141,11 +1236,11 @@ export class PluginInstaller {
             .execute();
         for (const s of [...steps].reverse()) {
             if (s.op === "skill_version") {
-                await this.d.skills.revertVersionIn(t, orgId, s.ref, s.version, actor, reason);
+                await this.skills.revertVersionIn(orgId, s.ref, s.version, actor, reason);
                 continue;
             }
             if (s.op === "template_version") {
-                await revertTemplateVersionIn(t, orgId, s.ref, s.version);
+                await revertTemplateVersionIn(this.db, orgId, s.ref, s.version);
                 continue;
             }
             if (s.op === "recorded") {
@@ -1155,7 +1250,7 @@ export class PluginInstaller {
             if (s.kind === "plugin") {
                 const sub = { removed: [], kept: [] };
                 await dropRow(s.kind, s.ref);
-                const outcome = await this.uninstallIn(t, orgId, actor, s.ref, {
+                const outcome = await this.uninstallIn(orgId, actor, s.ref, {
                     report: sub,
                     removing: new Set([installId]),
                     from: installId,
@@ -1169,12 +1264,12 @@ export class PluginInstaller {
                 continue;
             }
             if (s.kind === "extension" &&
-                (await this.d.orgConfigs.enabledDependents(t, orgId, s.ref)).length > 0) {
+                (await this.orgConfigs.enabledDependents(orgId, s.ref)).length > 0) {
                 // Another enabled extension needs it: kept, and stays this install's component
                 continue;
             }
             const c = { kind: s.kind, ref: s.ref, created: true, skillVersion: null };
-            if (await this.removeComponent(t, orgId, actor, c, reason)) {
+            if (await this.removeComponent(orgId, actor, c, reason)) {
                 removed.push({ kind: s.kind, ref: s.ref });
             }
             await dropRow(s.kind, s.ref);
@@ -1183,7 +1278,7 @@ export class PluginInstaller {
     }
     /** The connector kinds an extension provides (the `connector@1` implementations loaded on this replica). */
     connectorKindsOf(plugin) {
-        return this.d.host
+        return this.registry
             .list("connector")
             .filter((e) => e.plugin === plugin)
             .map((e) => e.impl?.kind)
@@ -1193,8 +1288,8 @@ export class PluginInstaller {
      * The connectors, org skills and agent templates (`subagents.templates`) referenced by the
      * current definitions of the org's live agents.
      */
-    async agentRefs(t, orgId) {
-        const rows = await t
+    async agentRefs(orgId) {
+        const rows = await this.db
             .selectFrom("agents as a")
             .innerJoin("agent_versions as v", (j) => j.onRef("v.agent_id", "=", "a.id").onRef("v.version", "=", "a.current_version"))
             .select("v.definition")
@@ -1221,7 +1316,64 @@ export class PluginInstaller {
         }
         return { connectors, skills, templates };
     }
-}
+};
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginInstaller.prototype, "recordDependency", null);
+__decorate([
+    Transactional()
+], PluginInstaller.prototype, "enableExtension", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginInstaller.prototype, "createInstallRow", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginInstaller.prototype, "installAgentTemplate", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginInstaller.prototype, "markInstalled", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginInstaller.prototype, "markFailed", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginInstaller.prototype, "rollbackOne", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], PluginInstaller.prototype, "removeComponent", null);
+__decorate([
+    Transactional()
+], PluginInstaller.prototype, "writeUninstall", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], PluginInstaller.prototype, "heir", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], PluginInstaller.prototype, "handOver", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], PluginInstaller.prototype, "uninstallIn", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], PluginInstaller.prototype, "decideRemovalIn", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], PluginInstaller.prototype, "undoUpgradeIn", null);
+PluginInstaller = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(OrgLock)),
+    __param(2, Inject(StorageService)),
+    __param(3, Inject(ExtensionRegistry)),
+    __param(4, Inject(SkillsService)),
+    __param(5, Inject(OrgExtensionConfigs)),
+    __param(6, Inject(CatalogRequestsService)),
+    __param(7, Inject(KernelConfigService)),
+    __param(8, Inject(ConnectorsService)),
+    __param(9, Inject(KERNEL_LOGGER)),
+    __param(10, Inject(TransactionHost))
+], PluginInstaller);
+export { PluginInstaller };
 /**
  * The skill names of a catalog version, read from each skill's SKILL.md in storage (the names are
  * not in plugin.json). Used by install planning and the upgrade preview.