@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.2

package/dist/catalog/requests.service.d.ts

@@ -1,8 +1,10 @@
 import type { LocalizedName } from "@capybara-hq/plugin-sdk";
-import { type Transaction } from "kysely";
-import type { KernelDatabase, KernelDb } from "../db/kernel-schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import { ApiError } from "../errors.js";
-type Trx = Transaction<KernelDatabase>;
+import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OrgLock } from "../orgs/org-lock.js";
 export type CatalogRequestStage = "org" | "deployment";
 export type CatalogRequestStatus = "pending" | "approved" | "rejected" | "cancelled";
 export type CatalogDecision = "approve" | "reject";
@@ -41,13 +43,13 @@ export declare const CATALOG_REQUESTS_LIST_MAX = 200;
  * installed plugin only): the dependency's own item must still be live and not disabled, and the
  * approval is judged by `approvedBy`.
  */
-export declare function assertItemInstallable(t: Trx, orgId: string, itemId: string, approvedBy?: string): Promise<void>;
+export declare function assertItemInstallable(t: KernelSchemaDb, orgId: string, itemId: string, approvedBy?: string): Promise<void>;
 /**
  * The extensions among `plugins` whose own catalog item (the non-deleted item with the same name) is
  * disabled (FOR SHARE: exclusive with policy changes). A disabled item is a master switch: no path
  * (direct enabling, its item, another plugin) can newly enable its extension (Ruling M-5).
  */
-export declare function disabledPluginItems(db: KernelDb | Trx, plugins: readonly string[]): Promise<string[]>;
+export declare function disabledPluginItems(db: KernelSchemaDb, plugins: readonly string[]): Promise<string[]>;
 /**
  * Throws `catalog.item_disabled` when a plugin's own catalog item is disabled (the message names
  * the plugin).
@@ -62,17 +64,17 @@ export declare function pluginItemDisabled(names: readonly string[]): ApiError;
  * as sources (an enterprise admin deleting an item withdraws its constraint). No source (not
  * installed through the catalog) -> not bound by catalog policy.
  */
-export declare function assertPluginSourcesInstallable(t: Trx, orgId: string, plugin: string): Promise<void>;
+export declare function assertPluginSourcesInstallable(t: KernelSchemaDb, orgId: string, plugin: string): Promise<void>;
 /** 审计里带上 PAT（个人令牌发起时）。 */
 export interface RequestActorOpts {
     actorTokenId?: string;
 }
 /**
- * Cancels catalog requests still pending in the caller's transaction (when the item or the org is
- * deleted), status `cancelled` (the decider is the actor). Each one audits
+ * Cancels catalog requests still pending in the caller's transaction (`db` is its handle; when the
+ * item or the org is deleted), status `cancelled` (the decider is the actor). Each one audits
  * `catalog.request_cancelled` (with the reason). Returns how many were cancelled.
  */
-export declare function cancelPendingRequests(t: Trx, where: {
+export declare function cancelPendingRequests(db: KernelSchemaDb, where: {
     itemId: string;
 } | {
     orgId: string;
@@ -90,8 +92,16 @@ export declare function cancelPendingRequests(t: Trx, where: {
  * org row lock, in order). No in-process state.
  */
 export declare class CatalogRequestsService {
-    private readonly db;
-    constructor(db: KernelDb);
+    private readonly kdb;
+    /** The org row and enterprise admin locks: both join the caller's transaction. */
+    private readonly orgLock;
+    private readonly adminLock;
+    readonly txHost: TransactionHost;
+    constructor(kdb: KernelDb, 
+    /** The org row and enterprise admin locks: both join the caller's transaction. */
+    orgLock: OrgLock, adminLock: EnterpriseAdminLock, txHost: TransactionHost);
+    /** The kernel-schema handle of the current context (the transaction, else the pool). */
+    private get db();
     /**
      * A member request (`catalog.request`, re-checked inside the org row lock). Item missing /
      * deleted -> `catalog.item_not_found`; disabled -> org admins get `catalog.item_disabled`,
@@ -105,6 +115,7 @@ export declare class CatalogRequestsService {
         request: CatalogRequestView;
         created: boolean;
     }>;
+    private writeRequest;
     private pendingRow;
     /**
      * An org admin installing a needs_approval item without a grant: in the caller's transaction (the
@@ -112,7 +123,7 @@ export declare class CatalogRequestsService {
      * existing pending request is moved to deployment (a member request goes to the enterprise admins
      * with it). Returns the request id. Audits `catalog.requested`.
      */
-    requestDeployment(t: Trx, orgId: string, actor: string, item: {
+    requestDeployment(orgId: string, actor: string, item: {
         id: string;
         name: string;
     }, version: string | null, opts?: RequestActorOpts): Promise<string>;
@@ -121,7 +132,7 @@ export declare class CatalogRequestsService {
      * 申请——条目之后改成 allow 再装的就不会一直挂着）标为 approved（安装者即决定人），收件箱与企业管理员列表随之清空。
      * 在调用方事务里执行。
      */
-    resolveByInstall(t: Trx, orgId: string, itemId: string, actor: string, opts?: RequestActorOpts): Promise<void>;
+    resolveByInstall(orgId: string, itemId: string, actor: string, opts?: RequestActorOpts): Promise<void>;
     /**
      * An org admin decides a member request (`catalog.decide`, re-checked inside the org row lock;
      * the request row FOR UPDATE). Not this org's request -> `catalog.request_not_found`; already
@@ -130,6 +141,7 @@ export declare class CatalogRequestsService {
      * deployment (still pending); otherwise approved. Audits `catalog.request_decided`.
      */
     decideOrg(orgId: string, actor: string, requestId: string, decision: CatalogDecision, opts?: RequestActorOpts): Promise<CatalogRequestView>;
+    private writeDecideOrg;
     /**
      * An enterprise admin decides a stage deployment request (re-checked inside the enterprise admin
      * lock; the request row FOR UPDATE). Missing or still at the org stage ->
@@ -139,6 +151,7 @@ export declare class CatalogRequestsService {
      * `catalog.request_decided` (with orgId).
      */
     decideDeployment(actor: string, requestId: string, decision: CatalogDecision, opts?: RequestActorOpts): Promise<CatalogRequestView>;
+    private writeDecideDeployment;
     /** 企业管理员的申请列表（stage deployment；`status` 缺省 pending），新的在前。 */
     listDeployment(q?: {
         status?: CatalogRequestStatus;
@@ -156,7 +169,6 @@ export declare class CatalogRequestsService {
         stage: CatalogRequestStage;
         status: string;
     }>>;
-    view(db: KernelDb | Trx, id: string): Promise<CatalogRequestView>;
+    view(id: string): Promise<CatalogRequestView>;
     private baseQuery;
 }
-export {};

package/dist/catalog/requests.service.js

@@ -1,9 +1,22 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomUUID } from "node:crypto";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { lockEnterpriseAdminsAndAuthorize } from "../identity/enterprise-admin.js";
-import { lockOrgAndAuthorize } from "../orgs/org-lock.js";
+import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { roleAtLeast } from "../orgs/roles.js";
 /** 申请列表一次最多返回的条数。 */
 export const CATALOG_REQUESTS_LIST_MAX = 200;
@@ -107,12 +120,12 @@ export async function assertPluginSourcesInstallable(t, orgId, plugin) {
     }
 }
 /**
- * Cancels catalog requests still pending in the caller's transaction (when the item or the org is
- * deleted), status `cancelled` (the decider is the actor). Each one audits
+ * Cancels catalog requests still pending in the caller's transaction (`db` is its handle; when the
+ * item or the org is deleted), status `cancelled` (the decider is the actor). Each one audits
  * `catalog.request_cancelled` (with the reason). Returns how many were cancelled.
  */
-export async function cancelPendingRequests(t, where, actor, reason, opts = {}) {
-    let q = t
+export async function cancelPendingRequests(db, where, actor, reason, opts = {}) {
+    let q = db
         .updateTable("catalog_requests")
         .set({ status: "cancelled", decided_by: actor, decided_at: sql `now()` })
         .where("status", "=", "pending");
@@ -120,7 +133,7 @@ export async function cancelPendingRequests(t, where, actor, reason, opts = {})
         "itemId" in where ? q.where("item_id", "=", where.itemId) : q.where("org_id", "=", where.orgId);
     const rows = await q.returning(["id", "org_id", "item_id", "stage"]).execute();
     for (const r of rows) {
-        await audit(t, {
+        await audit(db, {
             actorAccountId: actor,
             ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
             orgId: r.org_id,
@@ -143,10 +156,22 @@ export async function cancelPendingRequests(t, where, actor, reason, opts = {})
  * One pending request per org and item (partial unique index; org-side writes all run inside the
  * org row lock, in order). No in-process state.
  */
-export class CatalogRequestsService {
-    db;
-    constructor(db) {
-        this.db = db;
+let CatalogRequestsService = class CatalogRequestsService {
+    kdb;
+    orgLock;
+    adminLock;
+    txHost;
+    constructor(kdb, 
+    /** The org row and enterprise admin locks: both join the caller's transaction. */
+    orgLock, adminLock, txHost) {
+        this.kdb = kdb;
+        this.orgLock = orgLock;
+        this.adminLock = adminLock;
+        this.txHost = txHost;
+    }
+    /** The kernel-schema handle of the current context (the transaction, else the pool). */
+    get db() {
+        return this.kdb.db;
     }
     /**
      * A member request (`catalog.request`, re-checked inside the org row lock). Item missing /
@@ -155,45 +180,47 @@ export class CatalogRequestsService {
      * request is returned as is (`created: false`), no new one. Audits `catalog.requested`.
      */
     async request(orgId, actor, itemId, input, opts = {}) {
-        const r = await this.db.transaction().execute(async (t) => {
-            const { role } = await lockOrgAndAuthorize(t, orgId, actor, "catalog.request");
-            const item = await lockItem(t, itemId);
-            if (!item || item.deleted_at !== null)
-                throw itemNotFound();
-            // 成员看不到 disabled 的条目（列表、详情、图标一致）：同样答 not found，不暴露条目存在
-            if (item.policy === "disabled") {
-                throw roleAtLeast(role, "admin") ? itemDisabled() : itemNotFound();
-            }
-            const existing = await this.pendingRow(t, orgId, itemId);
-            if (existing)
-                return { id: existing.id, created: false };
-            const id = randomUUID();
-            await t
-                .insertInto("catalog_requests")
-                .values({
-                id,
-                org_id: orgId,
-                item_id: itemId,
-                version: input.version ?? null,
-                stage: "org",
-                requested_by: actor,
-                note: input.note ?? "",
-            })
-                .execute();
-            await audit(t, {
-                actorAccountId: actor,
-                ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                orgId,
-                action: "catalog.requested",
-                target: id,
-                detail: { itemId, name: item.name, stage: "org" },
-            });
-            return { id, created: true };
+        const r = await this.writeRequest(orgId, actor, itemId, input, opts);
+        return { request: await this.view(r.id), created: r.created };
+    }
+    async writeRequest(orgId, actor, itemId, input, opts) {
+        const t = this.db;
+        const { role } = await this.orgLock.lockAndAuthorize(orgId, actor, "catalog.request");
+        const item = await lockItem(t, itemId);
+        if (!item || item.deleted_at !== null)
+            throw itemNotFound();
+        // 成员看不到 disabled 的条目（列表、详情、图标一致）：同样答 not found，不暴露条目存在
+        if (item.policy === "disabled") {
+            throw roleAtLeast(role, "admin") ? itemDisabled() : itemNotFound();
+        }
+        const existing = await this.pendingRow(orgId, itemId);
+        if (existing)
+            return { id: existing.id, created: false };
+        const id = randomUUID();
+        await t
+            .insertInto("catalog_requests")
+            .values({
+            id,
+            org_id: orgId,
+            item_id: itemId,
+            version: input.version ?? null,
+            stage: "org",
+            requested_by: actor,
+            note: input.note ?? "",
+        })
+            .execute();
+        await audit(t, {
+            actorAccountId: actor,
+            ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+            orgId,
+            action: "catalog.requested",
+            target: id,
+            detail: { itemId, name: item.name, stage: "org" },
         });
-        return { request: await this.view(this.db, r.id), created: r.created };
+        return { id, created: true };
     }
-    pendingRow(t, orgId, itemId) {
-        return t
+    pendingRow(orgId, itemId) {
+        return this.db
             .selectFrom("catalog_requests")
             .select(["id", "stage"])
             .where("org_id", "=", orgId)
@@ -207,8 +234,9 @@ export class CatalogRequestsService {
      * existing pending request is moved to deployment (a member request goes to the enterprise admins
      * with it). Returns the request id. Audits `catalog.requested`.
      */
-    async requestDeployment(t, orgId, actor, item, version, opts = {}) {
-        const existing = await this.pendingRow(t, orgId, item.id);
+    async requestDeployment(orgId, actor, item, version, opts = {}) {
+        const t = this.db;
+        const existing = await this.pendingRow(orgId, item.id);
         if (existing) {
             if (existing.stage === "org") {
                 await t
@@ -254,7 +282,8 @@ export class CatalogRequestsService {
      * 申请——条目之后改成 allow 再装的就不会一直挂着）标为 approved（安装者即决定人），收件箱与企业管理员列表随之清空。
      * 在调用方事务里执行。
      */
-    async resolveByInstall(t, orgId, itemId, actor, opts = {}) {
+    async resolveByInstall(orgId, itemId, actor, opts = {}) {
+        const t = this.db;
         const rows = await t
             .updateTable("catalog_requests")
             .set({ status: "approved", decided_by: actor, decided_at: sql `now()` })
@@ -284,50 +313,52 @@ export class CatalogRequestsService {
     async decideOrg(orgId, actor, requestId, decision, opts = {}) {
         if (!UUID_RE.test(requestId))
             throw requestNotFound();
-        await this.db.transaction().execute(async (t) => {
-            await lockOrgAndAuthorize(t, orgId, actor, "catalog.decide");
-            const row = await t
-                .selectFrom("catalog_requests")
-                .select(["id", "item_id", "stage", "status"])
-                .where("id", "=", requestId)
-                .where("org_id", "=", orgId)
-                .forUpdate()
-                .executeTakeFirst();
-            if (!row)
-                throw requestNotFound();
-            if (row.status !== "pending" || row.stage !== "org") {
-                throw new ApiError("catalog.request_decided", row.status === "pending"
-                    ? "This request is waiting for the enterprise admin"
-                    : "This request has already been decided");
-            }
-            let escalated = false;
-            if (decision === "approve") {
-                const item = await lockItem(t, row.item_id);
-                if (!item || item.deleted_at !== null || item.policy === "disabled")
-                    throw itemDisabled();
-                escalated = item.policy === "needs_approval" && !(await hasGrant(t, orgId, row.item_id));
-            }
-            await t
-                .updateTable("catalog_requests")
-                .set(escalated
-                ? { stage: "deployment", org_decided_by: actor, org_decided_at: sql `now()` }
-                : {
-                    status: decision === "approve" ? "approved" : "rejected",
-                    decided_by: actor,
-                    decided_at: sql `now()`,
-                })
-                .where("id", "=", requestId)
-                .execute();
-            await audit(t, {
-                actorAccountId: actor,
-                ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                orgId,
-                action: "catalog.request_decided",
-                target: requestId,
-                detail: { itemId: row.item_id, decision, stage: "org", escalated },
-            });
+        await this.writeDecideOrg(orgId, actor, requestId, decision, opts);
+        return this.view(requestId);
+    }
+    async writeDecideOrg(orgId, actor, requestId, decision, opts) {
+        const t = this.db;
+        await this.orgLock.lockAndAuthorize(orgId, actor, "catalog.decide");
+        const row = await t
+            .selectFrom("catalog_requests")
+            .select(["id", "item_id", "stage", "status"])
+            .where("id", "=", requestId)
+            .where("org_id", "=", orgId)
+            .forUpdate()
+            .executeTakeFirst();
+        if (!row)
+            throw requestNotFound();
+        if (row.status !== "pending" || row.stage !== "org") {
+            throw new ApiError("catalog.request_decided", row.status === "pending"
+                ? "This request is waiting for the enterprise admin"
+                : "This request has already been decided");
+        }
+        let escalated = false;
+        if (decision === "approve") {
+            const item = await lockItem(t, row.item_id);
+            if (!item || item.deleted_at !== null || item.policy === "disabled")
+                throw itemDisabled();
+            escalated = item.policy === "needs_approval" && !(await hasGrant(t, orgId, row.item_id));
+        }
+        await t
+            .updateTable("catalog_requests")
+            .set(escalated
+            ? { stage: "deployment", org_decided_by: actor, org_decided_at: sql `now()` }
+            : {
+                status: decision === "approve" ? "approved" : "rejected",
+                decided_by: actor,
+                decided_at: sql `now()`,
+            })
+            .where("id", "=", requestId)
+            .execute();
+        await audit(t, {
+            actorAccountId: actor,
+            ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+            orgId,
+            action: "catalog.request_decided",
+            target: requestId,
+            detail: { itemId: row.item_id, decision, stage: "org", escalated },
         });
-        return this.view(this.db, requestId);
     }
     /**
      * An enterprise admin decides a stage deployment request (re-checked inside the enterprise admin
@@ -340,59 +371,61 @@ export class CatalogRequestsService {
     async decideDeployment(actor, requestId, decision, opts = {}) {
         if (!UUID_RE.test(requestId))
             throw requestNotFound();
-        await this.db.transaction().execute(async (t) => {
-            await lockEnterpriseAdminsAndAuthorize(t, actor);
-            const row = await t
-                .selectFrom("catalog_requests")
-                .select(["id", "org_id", "item_id", "stage", "status"])
-                .where("id", "=", requestId)
-                .forUpdate()
+        await this.writeDecideDeployment(actor, requestId, decision, opts);
+        return this.view(requestId);
+    }
+    async writeDecideDeployment(actor, requestId, decision, opts) {
+        const t = this.db;
+        await this.adminLock.lockAndAuthorize(actor);
+        const row = await t
+            .selectFrom("catalog_requests")
+            .select(["id", "org_id", "item_id", "stage", "status"])
+            .where("id", "=", requestId)
+            .forUpdate()
+            .executeTakeFirst();
+        if (row?.stage !== "deployment")
+            throw requestNotFound();
+        if (row.status !== "pending") {
+            throw new ApiError("catalog.request_decided", "This request has already been decided");
+        }
+        if (decision === "approve") {
+            const item = await lockItem(t, row.item_id);
+            if (!item || item.deleted_at !== null || item.policy === "disabled")
+                throw itemDisabled();
+            const org = await t
+                .selectFrom("orgs")
+                .select("deleted_at")
+                .where("id", "=", row.org_id)
                 .executeTakeFirst();
-            if (row?.stage !== "deployment")
+            if (!org || org.deleted_at !== null)
                 throw requestNotFound();
-            if (row.status !== "pending") {
-                throw new ApiError("catalog.request_decided", "This request has already been decided");
-            }
-            if (decision === "approve") {
-                const item = await lockItem(t, row.item_id);
-                if (!item || item.deleted_at !== null || item.policy === "disabled")
-                    throw itemDisabled();
-                const org = await t
-                    .selectFrom("orgs")
-                    .select("deleted_at")
-                    .where("id", "=", row.org_id)
-                    .executeTakeFirst();
-                if (!org || org.deleted_at !== null)
-                    throw requestNotFound();
-                await t
-                    .insertInto("catalog_org_grants")
-                    .values({ item_id: row.item_id, org_id: row.org_id, granted_by: actor })
-                    .onConflict((oc) => oc.columns(["item_id", "org_id"]).doNothing())
-                    .execute();
-            }
             await t
-                .updateTable("catalog_requests")
-                .set({
-                status: decision === "approve" ? "approved" : "rejected",
-                decided_by: actor,
-                decided_at: sql `now()`,
-            })
-                .where("id", "=", requestId)
+                .insertInto("catalog_org_grants")
+                .values({ item_id: row.item_id, org_id: row.org_id, granted_by: actor })
+                .onConflict((oc) => oc.columns(["item_id", "org_id"]).doNothing())
                 .execute();
-            await audit(t, {
-                actorAccountId: actor,
-                ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                orgId: row.org_id,
-                action: "catalog.request_decided",
-                target: requestId,
-                detail: { itemId: row.item_id, decision, stage: "deployment" },
-            });
+        }
+        await t
+            .updateTable("catalog_requests")
+            .set({
+            status: decision === "approve" ? "approved" : "rejected",
+            decided_by: actor,
+            decided_at: sql `now()`,
+        })
+            .where("id", "=", requestId)
+            .execute();
+        await audit(t, {
+            actorAccountId: actor,
+            ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+            orgId: row.org_id,
+            action: "catalog.request_decided",
+            target: requestId,
+            detail: { itemId: row.item_id, decision, stage: "deployment" },
         });
-        return this.view(this.db, requestId);
     }
     /** 企业管理员的申请列表（stage deployment；`status` 缺省 pending），新的在前。 */
     async listDeployment(q = {}) {
-        const rows = await this.baseQuery(this.db)
+        const rows = await this.baseQuery()
             .where("r.stage", "=", "deployment")
             .where("r.status", "=", q.status ?? "pending")
             .where("o.deleted_at", "is", null)
@@ -427,7 +460,7 @@ export class CatalogRequestsService {
             .executeTakeFirst();
         if (!m || !roleAtLeast(m.role, "admin"))
             return [];
-        const rows = await this.baseQuery(this.db)
+        const rows = await this.baseQuery()
             .where("r.org_id", "=", orgId)
             .where("r.stage", "=", "org")
             .where("r.status", "=", "pending")
@@ -450,14 +483,14 @@ export class CatalogRequestsService {
             out.set(r.item_id, { id: r.id, stage: r.stage, status: r.status });
         return out;
     }
-    async view(db, id) {
-        const row = await this.baseQuery(db).where("r.id", "=", id).executeTakeFirst();
+    async view(id) {
+        const row = await this.baseQuery().where("r.id", "=", id).executeTakeFirst();
         if (!row)
             throw requestNotFound();
         return toView(row);
     }
-    baseQuery(db) {
-        return db
+    baseQuery() {
+        return this.db
             .selectFrom("catalog_requests as r")
             .innerJoin("catalog_items as i", "i.id", "r.item_id")
             .innerJoin("orgs as o", "o.id", "r.org_id")
@@ -482,7 +515,30 @@ export class CatalogRequestsService {
             "r.created_at",
         ]);
     }
-}
+};
+__decorate([
+    Transactional()
+], CatalogRequestsService.prototype, "writeRequest", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], CatalogRequestsService.prototype, "requestDeployment", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], CatalogRequestsService.prototype, "resolveByInstall", null);
+__decorate([
+    Transactional()
+], CatalogRequestsService.prototype, "writeDecideOrg", null);
+__decorate([
+    Transactional()
+], CatalogRequestsService.prototype, "writeDecideDeployment", null);
+CatalogRequestsService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(OrgLock)),
+    __param(2, Inject(EnterpriseAdminLock)),
+    __param(3, Inject(TransactionHost))
+], CatalogRequestsService);
+export { CatalogRequestsService };
 function toView(r) {
     return {
         id: r.id,

package/dist/catalog/upgrade-targets.d.ts

@@ -1,7 +1,5 @@
-import type { Transaction } from "kysely";
-import type { KernelDatabase, KernelDb } from "../db/kernel-schema.js";
-import type { ExtensionHost } from "../extensions/host.js";
-type Trx = Transaction<KernelDatabase>;
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import type { ExtensionRegistry } from "../extensions/registry.js";
 /**
  * Which versions an org may upgrade an installed plugin to (package ecosystem spec §10, Decision
  * 10, Ruling 8):
@@ -32,7 +30,7 @@ export interface TargetVersion {
  * this replica loaded from the startup config; undefined when the deployment runs none (then no
  * upgrade target and no "upgrade pending").
  */
-export declare function deployedExtension(db: KernelDb | Trx, host: Pick<ExtensionHost, "manifests">, name: string): Promise<DeployedExtension | undefined>;
+export declare function deployedExtension(db: KernelSchemaDb, host: Pick<ExtensionRegistry, "manifests">, name: string): Promise<DeployedExtension | undefined>;
 /** Whether catalog version `v` carries the deployment's extension `d`. */
 export declare const runsDeployed: (v: TargetVersion, d: DeployedExtension) => boolean;
 /**
@@ -51,9 +49,8 @@ export interface UpgradeInfo {
  * The upgrade info of org installs (`itemId`, `name`, `version`), keyed by `itemId@version`; reads
  * the items' catalog versions and the deployment's extensions in a few queries.
  */
-export declare function upgradeInfo(db: KernelDb, host: Pick<ExtensionHost, "manifests">, installs: readonly {
+export declare function upgradeInfo(db: KernelSchemaDb, host: Pick<ExtensionRegistry, "manifests">, installs: readonly {
     itemId: string;
     name: string;
     version: string;
 }[]): Promise<Map<string, UpgradeInfo>>;
-export {};

package/dist/channels/actions.d.ts

@@ -1,9 +1,9 @@
 import type { ChannelCard, InboundEvent, InboundSender } from "@capybara-hq/plugin-sdk";
-import type { KernelDb } from "../db/kernel-schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import type { ApprovalsService } from "../tools/approvals.service.js";
 import type { QuestionsService } from "../tools/questions.service.js";
 import type { ChannelConnectionRow, ChannelConnections } from "./connections.service.js";
-import type { ChannelOutboundScheduler } from "./inbound.js";
+import { type ChannelJobs } from "./jobs.js";
 import { type ChannelLocale, type ChannelPhrase } from "./phrases.js";
 type CardActionEvent = Extract<InboundEvent, {
     type: "card_action";
@@ -14,11 +14,13 @@ export type SpeakerResolver = (connectionId: string, row: ChannelConnectionRow,
     threadAccount: string | null;
 } | undefined>;
 export interface ChannelCardActionsDeps {
-    db: KernelDb;
+    /** The context-aware kernel-schema handle (read at call time). */
+    readonly db: KernelSchemaDb;
     connections: Pick<ChannelConnections, "row" | "send">;
     approvals: Pick<ApprovalsService, "decide">;
     questions: Pick<QuestionsService, "answer">;
-    outbound: ChannelOutboundScheduler;
+    /** The delivery of the card's conversation. */
+    outbound: Pick<ChannelJobs, "enqueue">;
     resolveSpeaker: SpeakerResolver;
 }
 /**

package/dist/channels/actions.js

@@ -1,6 +1,6 @@
 import { ApiError } from "../errors.js";
 import { readOrgSettings } from "../orgs/settings.service.js";
-import { idempotencyKey } from "./outbound.js";
+import { idempotencyKey } from "./jobs.js";
 import { phrase } from "./phrases.js";
 import { findThread, threadKeyOf } from "./threads.js";
 /** 授权 / 状态类失败 → 回给点击者的一句话（不改卡片）；其余错误照常抛出。 */