@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.2

package/dist/extensions/deployment-config.js

@@ -1,145 +1,36 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { isDeepStrictEqual } from "node:util";
-import { sql } from "kysely";
+import { Inject, Injectable } from "@nestjs/common";
 import { configFields, describeSchema, getPath, secretValues } from "../config/fields.js";
-import { fieldSource } from "../config/sources.js";
+import { configSourceKind, extensionConfigSources, fieldSource, } from "../config/sources.js";
 import { createSecrets } from "../ctx/secrets.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { lockEnterpriseAdminsAndAuthorize } from "../identity/enterprise-admin.js";
+import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_BUS, KERNEL_LOGGER, KEYRING } from "../infra/tokens.js";
+import { KERNEL_APP_OPTIONS } from "../lifecycle/tokens.js";
+import { toIssues } from "./config-issues.js";
 import { configToJsonSchema } from "./config-json-schema.js";
-import { toIssues } from "./org-config.js";
-/** 部署级插件配置的密钥存在 `capybara.secrets` 的这个 org_id 下（不是真实组织；namespace `kernel`）。 */
-export const DEPLOYMENT_SECRETS_ORG = "_deployment";
-/** 内核自己的 secrets 命名空间（`kernel` 是保留插件名）。 */
-const SECRETS_NAMESPACE = "kernel";
-const SECRET_KEY_PREFIX = "plugin-deployment-config:";
-const secretKey = (plugin, path) => `${SECRET_KEY_PREFIX}${plugin}:${path}`;
-/**
- * 部署配置保存之后（kernel bus 主题，频道 `cap:kernel:plugin-deployment-config`，payload `{ plugin }`）：
- * 各副本重读并校验——只改了 hot 字段就地替换，改了非 hot 字段重新加载实例，不合法保持当前值并告警；
- * 插件此刻待配置时，下一次 reconcile 加载它。
- */
-export const PLUGIN_DEPLOYMENT_CONFIG_TOPIC = "plugin-deployment-config";
-/** 由 zod schema 得出字段清单（`configFields`：对象路径上的叶子，secret 向下继承）。 */
-export function schemaFields(schema) {
-    if (!schema)
-        return [];
-    return configFields(schema).map((f) => ({
-        path: f.path,
-        secret: f.meta?.secret === true,
-        hot: f.meta?.hot === true,
-    }));
-}
-const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-/** 按点路径设值，缺失的中间对象自动创建；中间节点不是对象时放弃。 */
-function setDeep(obj, path, value) {
-    const segs = path.split(".");
-    let node = obj;
-    for (const seg of segs.slice(0, -1)) {
-        const next = node[seg];
-        if (next === undefined)
-            node[seg] = {};
-        else if (!isObj(next))
-            return;
-        node = node[seg];
-    }
-    node[segs[segs.length - 1]] = value;
-}
-/** 按点路径删除键；删完变空的中间对象一并删掉。 */
-function deleteDeep(obj, path) {
-    const segs = path.split(".");
-    const chain = [obj];
-    let node = obj;
-    for (const seg of segs.slice(0, -1)) {
-        if (!isObj(node))
-            return;
-        node = node[seg];
-        if (!isObj(node))
-            return;
-        chain.push(node);
-    }
-    delete chain[chain.length - 1][segs[segs.length - 1]];
-    for (let i = chain.length - 1; i > 0; i--) {
-        if (Object.keys(chain[i]).length > 0)
-            break;
-        delete chain[i - 1][segs[i - 1]];
-    }
-}
-/** 叶子点路径（对象递归；其余都是叶子）。 */
-function leafPaths(value, prefix = "", out = []) {
-    if (isObj(value)) {
-        for (const [k, v] of Object.entries(value))
-            leafPaths(v, prefix ? `${prefix}.${k}` : k, out);
-    }
-    else if (prefix !== "")
-        out.push(prefix);
-    return out;
-}
-/** 启动配置（文件 / 环境变量合并后的值）是否覆盖了这个字段：给了它、它下面的值，或在祖先上给了非对象值。 */
-function coveredBy(fileValue, path) {
-    let node = fileValue;
-    for (const seg of path.split(".")) {
-        if (node === undefined)
-            return false;
-        if (!isObj(node))
-            return true;
-        node = node[seg];
-    }
-    return node !== undefined;
-}
-/**
- * 合并一个插件的部署配置（C10 的优先级：环境变量 > 文件 / Nacos > PG > schema 默认值）：以启动配置
- * （`fileValue`，已含环境变量）为底，逐字段补上 PG 里保存、而启动配置没有覆盖的值。按字段合并：启动配置给了的字段
- * 整个以它为准（不与 PG 的值深合并）。`fields` 为字段点路径（没有 schema 时用 PG 值的叶子路径）。默认值由校验补上。
- */
-export function mergeDeploymentConfig(stored, fileValue, fields = leafPaths(stored)) {
-    if (fileValue !== undefined && !isObj(fileValue))
-        return fileValue;
-    const out = structuredClone(fileValue ?? {});
-    for (const path of fields) {
-        const v = getPath(stored, path);
-        if (v === undefined || coveredBy(fileValue, path))
-            continue;
-        setDeep(out, path, structuredClone(v));
-    }
-    return out;
-}
-/**
- * PG 里一个插件保存的部署配置（非密钥字段 + 解密的密钥字段，按点路径放回对象）。只并入 `secretPaths`（当前
- * schema 里是密钥的字段）的密钥：旧版本留下、现在已不是密钥或已删掉的字段不解密、不并入（否则会被当成明文回显
- * 或保存）。
- */
-export async function readStoredDeploymentConfig(db, keyring, plugin, opts) {
-    let q = db
-        .selectFrom("extension_deployment_configs")
-        .select("config")
-        .where("plugin", "=", plugin);
-    if (opts.forUpdate)
-        q = q.forUpdate();
-    const row = await q.executeTakeFirst();
-    const out = structuredClone(row?.config ?? {});
-    const prefix = secretKey(plugin, "");
-    const wanted = new Set(opts.secretPaths);
-    if (wanted.size === 0)
-        return out;
-    const keys = await db
-        .selectFrom("secrets")
-        .select("key")
-        .where("namespace", "=", SECRETS_NAMESPACE)
-        .where("org_id", "=", DEPLOYMENT_SECRETS_ORG)
-        .execute();
-    const secrets = createSecrets(db, keyring, SECRETS_NAMESPACE);
-    for (const { key } of keys) {
-        if (!key.startsWith(prefix) || !wanted.has(key.slice(prefix.length)))
-            continue;
-        const v = await secrets.get(DEPLOYMENT_SECRETS_ORG, key);
-        if (v !== null)
-            setDeep(out, key.slice(prefix.length), JSON.parse(v));
-    }
-    return out;
-}
-/** 字段清单里的密钥字段路径。 */
-export const secretPathsOf = (fields) => fields.filter((f) => f.secret).map((f) => f.path);
+import { DEPLOYMENT_SECRETS_ORG, deleteDeep, mergeDeploymentConfig, readStoredDeploymentConfig, SECRETS_NAMESPACE, schemaFields, secretKey, secretPathsOf, setDeep, } from "./deployment-config-store.js";
+import { ExtensionHost } from "./host.js";
+import { ExtensionInstalls } from "./installs.js";
+import { ExtensionLifecycle } from "./lifecycle.js";
+import { PLUGIN_DEPLOYMENT_CONFIG_TOPIC } from "./lifecycle-topics.js";
+import { PluginDeploymentConfigLock } from "./locks.js";
+export { DEPLOYMENT_SECRETS_ORG, mergeDeploymentConfig, readStoredDeploymentConfig, schemaFields, secretPathsOf, };
+export { PLUGIN_DEPLOYMENT_CONFIG_TOPIC };
 /** JSON Schema 转换按 schema 对象缓存（清单不可变）。 */
 const jsonSchemaCache = new WeakMap();
 function jsonSchemaOf(schema) {
@@ -166,31 +57,83 @@ function defaultOf(schema, path) {
  * follows {@link mergeDeploymentConfig}. No in-process state, shared by every replica.
  * Secret values are never echoed: responses only say "set", audits only record which paths changed.
  */
-export class ExtensionDeploymentConfigService {
-    d;
-    constructor(d) {
-        this.d = d;
+let ExtensionDeploymentConfigService = class ExtensionDeploymentConfigService {
+    kdb;
+    txHost;
+    adminLock;
+    configLock;
+    keyring;
+    config;
+    host;
+    installs;
+    lifecycle;
+    bus;
+    log;
+    /** Where each startup-config field comes from (see `extensionConfigSources`); those fields are read-only. */
+    sources;
+    constructor(kdb, txHost, 
+    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    adminLock, configLock, keyring, config, 
+    /** This replica's extension schemas (loaded, config-declared or prepared install records). */
+    host, 
+    /** The effective (stored plus startup) deployment config. */
+    installs, 
+    /** Applies a saved config on this replica at once (other replicas through the bus). */
+    lifecycle, 
+    /** Publishes {@link PLUGIN_DEPLOYMENT_CONFIG_TOPIC} after a save (a failure only warns). */
+    bus, log, options) {
+        this.kdb = kdb;
+        this.txHost = txHost;
+        this.adminLock = adminLock;
+        this.configLock = configLock;
+        this.keyring = keyring;
+        this.config = config;
+        this.host = host;
+        this.installs = installs;
+        this.lifecycle = lifecycle;
+        this.bus = bus;
+        this.log = log;
+        const env = options.env ?? process.env;
+        this.sources =
+            options.extensionConfigSources ??
+                extensionConfigSources({ extensionConfig: config.get().extensionConfig }, env, configSourceKind(env));
+    }
+    get db() {
+        return this.kdb.db;
+    }
+    /** The startup config's `extensionConfig` (file / Nacos merged with env). */
+    fileConfig() {
+        return this.config.get().extensionConfig;
+    }
+    /**
+     * The extension's deployment config description; undefined when the deployment does not know
+     * the extension (`extension.not_found`). Public for tests only.
+     */
+    async schemaOf(plugin) {
+        const local = this.host.deploymentSchema(plugin);
+        if (local)
+            return { ...local, fields: schemaFields(local.schema) };
+        // 与配置声明重名的安装记录不生效
+        if (this.host.declared().has(plugin))
+            return undefined;
+        return staticDeploymentSchema(this.db, plugin);
     }
     /** 插件的生效部署配置（未校验）：启动配置为底，补上 PG 里保存的字段。`schema` 给出时按它的字段合并。 */
-    async effective(plugin, fileValue, schema) {
-        const stored = await readStoredDeploymentConfig(this.d.db, this.d.keyring, plugin, {
-            secretPaths: secretPathsOf(schemaFields(schema)),
-        });
-        const fields = schema ? configFields(schema).map((f) => f.path) : undefined;
-        return mergeDeploymentConfig(stored, fileValue, fields);
+    effective(plugin, fileValue, schema) {
+        return this.installs.effectiveDeploymentConfig(plugin, fileValue, schema);
     }
     /** Admin view; an extension unknown to the deployment -> `extension.not_found`. */
     async view(plugin) {
         const info = await this.info(plugin);
-        const stored = await this.d.db
-            .transaction()
-            .setIsolationLevel("repeatable read")
-            .setAccessMode("read only")
-            .execute((t) => readStoredDeploymentConfig(t, this.d.keyring, plugin, {
-            secretPaths: secretPathsOf(info.fields),
-        }));
+        const stored = await this.readStored(plugin, info);
         return this.render(plugin, info, stored);
     }
+    /** `REPEATABLE READ` read-only: every stored field from one snapshot. */
+    readStored(plugin, info) {
+        return readStoredDeploymentConfig(this.db, this.keyring, plugin, {
+            secretPaths: secretPathsOf(info.fields),
+        });
+    }
     /**
      * Saves some fields: `values` keyed by field dot path, `null` = clear (back to the default),
      * omitted = unchanged.
@@ -213,94 +156,32 @@ export class ExtensionDeploymentConfigService {
         if (unknown.length > 0) {
             throw new ApiError("extension.config_invalid", `Unknown deployment config fields for extension ${plugin}`, unknown.map((path) => ({ path, message: "unknown field" })));
         }
-        const sources = this.d.sources[plugin];
+        const sources = this.sources[plugin];
         const readonly = Object.keys(values).filter((p) => fieldSource(sources, p) !== undefined);
         if (readonly.length > 0) {
             throw new ApiError("extension.config_readonly", `These deployment config fields of extension ${plugin} are set in the startup config (file, Nacos or environment) and are read-only here: ${readonly.join(", ")}`, readonly.map((path) => ({ path, source: fieldSource(sources, path) })));
         }
-        const fileValue = this.d.fileConfig()[plugin];
+        const fileValue = this.fileConfig()[plugin];
         const fieldPaths = info.fields.map((f) => f.path);
-        let saved;
-        let changed = [];
-        await this.d.db.transaction().execute(async (t) => {
-            await lockEnterpriseAdminsAndAuthorize(t, actor);
-            await sql `SELECT pg_advisory_xact_lock(hashtext(${`capybara.plugin-deployment-config:${plugin}`}))`.execute(t);
-            const before = await readStoredDeploymentConfig(t, this.d.keyring, plugin, {
-                forUpdate: true,
-                secretPaths: secretPathsOf(info.fields),
-            });
-            const next = structuredClone(before);
-            for (const [path, v] of Object.entries(values)) {
-                if (v === null)
-                    deleteDeep(next, path);
-                else
-                    setDeep(next, path, structuredClone(v));
-            }
-            if (info.schema) {
-                const r = info.schema.safeParse(mergeDeploymentConfig(next, fileValue, fieldPaths));
-                if (!r.success) {
-                    // 启动配置里只读字段自己的问题这里改不了（照样保存，插件保持待配置），其余拒绝
-                    const issues = toIssues(r.error).filter((i) => i.path === "" || fieldSource(sources, i.path) === undefined);
-                    if (issues.length > 0) {
-                        throw new ApiError("extension.config_invalid", `Invalid deployment config for extension ${plugin}`, issues);
-                    }
-                }
-            }
-            changed = Object.keys(values)
-                .filter((p) => !isDeepStrictEqual(getPath(before, p), getPath(next, p)))
-                .sort();
-            saved = next;
-            if (changed.length === 0)
-                return;
-            const plain = structuredClone(next);
-            const secrets = createSecrets(t, this.d.keyring, SECRETS_NAMESPACE);
-            for (const f of info.fields) {
-                if (!f.secret)
-                    continue;
-                deleteDeep(plain, f.path);
-                if (!(f.path in values))
-                    continue;
-                const v = getPath(next, f.path);
-                if (v === undefined)
-                    await secrets.delete(DEPLOYMENT_SECRETS_ORG, secretKey(plugin, f.path));
-                else
-                    await secrets.set(DEPLOYMENT_SECRETS_ORG, secretKey(plugin, f.path), JSON.stringify(v));
-            }
-            await t
-                .insertInto("extension_deployment_configs")
-                .values({ plugin, config: JSON.stringify(plain), updated_by: actor })
-                .onConflict((oc) => oc.column("plugin").doUpdateSet({
-                config: JSON.stringify(plain),
-                updated_by: actor,
-                updated_at: new Date(),
-            }))
-                .execute();
-            await audit(t, {
-                actorAccountId: actor,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-                action: "extension.deployment_config_updated",
-                target: plugin,
-                detail: { changedPaths: changed },
-            });
-        });
+        const { saved, changed } = await this.write(plugin, values, actor, actorTokenId, info, sources, fileValue);
         const stored = saved ?? {};
-        if (info.schema && this.d.onSecrets) {
-            const values = secretValues(info.schema, mergeDeploymentConfig(stored, fileValue, fieldPaths));
-            if (values.length > 0)
-                this.d.onSecrets(values);
+        if (info.schema) {
+            const secrets = secretValues(info.schema, mergeDeploymentConfig(stored, fileValue, fieldPaths));
+            if (secrets.length > 0)
+                this.log.addSecrets(secrets);
         }
         if (changed.length > 0) {
             try {
-                await this.d.bus?.publish(PLUGIN_DEPLOYMENT_CONFIG_TOPIC, { plugin });
+                await this.bus.publish(PLUGIN_DEPLOYMENT_CONFIG_TOPIC, { plugin });
             }
             catch (err) {
-                this.d.log.warn("cannot publish plugin-deployment-config after saving", { plugin, err });
+                this.log.warn("cannot publish plugin-deployment-config after saving", { plugin, err });
             }
             try {
-                await this.d.applyLocal?.(plugin);
+                await this.lifecycle.applyConfig(plugin);
             }
             catch (err) {
-                this.d.log.error("applying the plugin deployment config on this replica failed", {
+                this.log.error("applying the plugin deployment config on this replica failed", {
                     plugin,
                     err,
                 });
@@ -308,16 +189,81 @@ export class ExtensionDeploymentConfigService {
         }
         return this.render(plugin, info, stored);
     }
+    async write(plugin, values, actor, actorTokenId, info, sources, fileValue) {
+        const fieldPaths = info.fields.map((f) => f.path);
+        let changed = [];
+        const t = this.db;
+        await this.adminLock.lockAndAuthorize(actor);
+        await this.configLock.lock(plugin);
+        const before = await readStoredDeploymentConfig(t, this.keyring, plugin, {
+            forUpdate: true,
+            secretPaths: secretPathsOf(info.fields),
+        });
+        const next = structuredClone(before);
+        for (const [path, v] of Object.entries(values)) {
+            if (v === null)
+                deleteDeep(next, path);
+            else
+                setDeep(next, path, structuredClone(v));
+        }
+        if (info.schema) {
+            const r = info.schema.safeParse(mergeDeploymentConfig(next, fileValue, fieldPaths));
+            if (!r.success) {
+                // 启动配置里只读字段自己的问题这里改不了（照样保存，插件保持待配置），其余拒绝
+                const issues = toIssues(r.error).filter((i) => i.path === "" || fieldSource(sources, i.path) === undefined);
+                if (issues.length > 0) {
+                    throw new ApiError("extension.config_invalid", `Invalid deployment config for extension ${plugin}`, issues);
+                }
+            }
+        }
+        changed = Object.keys(values)
+            .filter((p) => !isDeepStrictEqual(getPath(before, p), getPath(next, p)))
+            .sort();
+        const saved = next;
+        if (changed.length === 0)
+            return { saved, changed };
+        const plain = structuredClone(next);
+        const secrets = createSecrets(t, this.keyring, SECRETS_NAMESPACE);
+        for (const f of info.fields) {
+            if (!f.secret)
+                continue;
+            deleteDeep(plain, f.path);
+            if (!(f.path in values))
+                continue;
+            const v = getPath(next, f.path);
+            if (v === undefined)
+                await secrets.delete(DEPLOYMENT_SECRETS_ORG, secretKey(plugin, f.path));
+            else
+                await secrets.set(DEPLOYMENT_SECRETS_ORG, secretKey(plugin, f.path), JSON.stringify(v));
+        }
+        await t
+            .insertInto("extension_deployment_configs")
+            .values({ plugin, config: JSON.stringify(plain), updated_by: actor })
+            .onConflict((oc) => oc.column("plugin").doUpdateSet({
+            config: JSON.stringify(plain),
+            updated_by: actor,
+            updated_at: new Date(),
+        }))
+            .execute();
+        await audit(t, {
+            actorAccountId: actor,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            action: "extension.deployment_config_updated",
+            target: plugin,
+            detail: { changedPaths: changed },
+        });
+        return { saved, changed };
+    }
     async info(plugin) {
-        const info = await this.d.schemaOf(plugin);
+        const info = await this.schemaOf(plugin);
         if (!info) {
             throw new ApiError("extension.not_found", `Extension ${plugin} is not known to this deployment`);
         }
         return info;
     }
     render(plugin, info, stored) {
-        const fileValue = this.d.fileConfig()[plugin];
-        const sources = this.d.sources[plugin];
+        const fileValue = this.fileConfig()[plugin];
+        const sources = this.sources[plugin];
         const raw = mergeDeploymentConfig(stored, fileValue, info.fields.map((f) => f.path));
         let effective = raw;
         let valid = true;
@@ -367,7 +313,33 @@ export class ExtensionDeploymentConfigService {
             issues,
         };
     }
-}
+};
+__decorate([
+    Transactional({
+        propagation: "requires_new",
+        isolationLevel: "repeatable read",
+        accessMode: "read only",
+    })
+], ExtensionDeploymentConfigService.prototype, "readStored", null);
+__decorate([
+    Transactional()
+], ExtensionDeploymentConfigService.prototype, "write", null);
+ExtensionDeploymentConfigService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(EnterpriseAdminLock)),
+    __param(3, Inject(PluginDeploymentConfigLock)),
+    __param(4, Inject(KEYRING)),
+    __param(5, Inject(KernelConfigService)),
+    __param(6, Inject(ExtensionHost)),
+    __param(7, Inject(ExtensionInstalls)),
+    __param(8, Inject(ExtensionLifecycle)),
+    __param(9, Inject(KERNEL_BUS)),
+    __param(10, Inject(KERNEL_LOGGER)),
+    __param(11, Inject(KERNEL_APP_OPTIONS))
+], ExtensionDeploymentConfigService);
+export { ExtensionDeploymentConfigService };
 /**
  * 本副本拿不到模块时（未加载的安装记录）按包内审阅过的静态清单给出字段（没有 zod schema：不校验，加载时再校验）。
  */

package/dist/extensions/enabled.d.ts

@@ -1,4 +1,4 @@
-import type { KernelDb } from "../db/kernel-schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
 /**
  * Which extensions an organization has enabled. Two sources, and every reader goes through these
  * helpers so none of them misses one:
@@ -9,7 +9,7 @@ import type { KernelDb } from "../db/kernel-schema.js";
  * that need that check it themselves, as before. `db` may be a transaction.
  */
 /** The names of the extensions enabled in `orgId` (a subquery with one column, `plugin`). */
-export declare function enabledExtensionsQuery(db: KernelDb, orgId: string): import("kysely").SelectQueryBuilder<import("../db/kernel-schema.js").KernelDatabase & {
+export declare function enabledExtensionsQuery(db: KernelSchemaDb, orgId: string): import("kysely").SelectQueryBuilder<import("../db/kernel-schema.js").KernelDatabase & {
     eoc: import("../db/kernel-schema.js").ExtensionOrgConfigsTable;
 }, "eoc", {
     plugin: string;
@@ -19,13 +19,13 @@ export declare function enabledExtensionsQuery(db: KernelDb, orgId: string): imp
  * `plugin`): `.innerJoin(enabledExtensionsByOrg(db).as("en"), (j) => j.onRef("en.org_id", …)…)`.
  * Soft-deleted orgs are included, as their org config rows are; callers filter `orgs.deleted_at`.
  */
-export declare function enabledExtensionsByOrg(db: KernelDb): import("kysely").SelectQueryBuilder<import("../db/kernel-schema.js").KernelDatabase & {
+export declare function enabledExtensionsByOrg(db: KernelSchemaDb): import("kysely").SelectQueryBuilder<import("../db/kernel-schema.js").KernelDatabase & {
     eoc: import("../db/kernel-schema.js").ExtensionOrgConfigsTable;
 }, "eoc", {
     org_id: string;
     plugin: string;
 }>;
 /** Whether `plugin` is enabled in `orgId` (see the file header). */
-export declare function isExtensionEnabled(db: KernelDb, orgId: string, plugin: string): Promise<boolean>;
+export declare function isExtensionEnabled(db: KernelSchemaDb, orgId: string, plugin: string): Promise<boolean>;
 /** The names of the required bootstrap plugins (installed with `required`). */
-export declare function requiredExtensions(db: KernelDb): Promise<Set<string>>;
+export declare function requiredExtensions(db: KernelSchemaDb): Promise<Set<string>>;

package/dist/extensions/extensions.module.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The extensions domain: the extension host (it builds each `ctx` from the injected kernel
+ * services), the package store and install records (the desired state the host converges to, one
+ * way: spec §3), the per-replica lifecycle and its periodic reconcile, the admin operations,
+ * deployment and org configs, the bootstrap step, and the shared {@link ExtensionRegistry}.
+ */
+export declare class ExtensionsModule {
+}

package/dist/extensions/extensions.module.js

@@ -0,0 +1,77 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { EnterpriseAdminLockModule } from "../identity/enterprise-admin.js";
+import { OrgLockModule } from "../orgs/org-lock.js";
+import { StorageModule } from "../storage/storage.module.js";
+import { EmbedTokensModule } from "../ui/embed-token.js";
+import { ExtensionAdminOps } from "./admin-ops.js";
+import { ExtensionAdmin } from "./admin-view.js";
+import { ExtensionApprovals } from "./approvals.js";
+import { ExtensionBlobs } from "./blobs.js";
+import { BootstrapService } from "./bootstrap.js";
+import { ExtensionDeploymentConfigService } from "./deployment-config.js";
+import { ExtensionHost } from "./host.js";
+import { ExtensionInstalls } from "./installs.js";
+import { ExtensionLifecycle } from "./lifecycle.js";
+import { PluginApproveLock, PluginDeploymentConfigLock, PluginInstallLock } from "./locks.js";
+import { OrgExtensionConfigs } from "./org-config.js";
+import { ExtensionRegistryModule } from "./registry.js";
+import { ReplicaStatusStore } from "./sources.js";
+/**
+ * The extensions domain: the extension host (it builds each `ctx` from the injected kernel
+ * services), the package store and install records (the desired state the host converges to, one
+ * way: spec §3), the per-replica lifecycle and its periodic reconcile, the admin operations,
+ * deployment and org configs, the bootstrap step, and the shared {@link ExtensionRegistry}.
+ */
+let ExtensionsModule = class ExtensionsModule {
+};
+ExtensionsModule = __decorate([
+    Module({
+        imports: [
+            ExtensionRegistryModule,
+            EnterpriseAdminLockModule,
+            OrgLockModule,
+            StorageModule,
+            // ctx.ui verifies embed tokens with the one provider the UI routes issue them with
+            EmbedTokensModule,
+        ],
+        providers: [
+            PluginInstallLock,
+            PluginApproveLock,
+            PluginDeploymentConfigLock,
+            ExtensionApprovals,
+            ExtensionBlobs,
+            ExtensionInstalls,
+            ReplicaStatusStore,
+            ExtensionHost,
+            ExtensionLifecycle,
+            ExtensionAdmin,
+            ExtensionAdminOps,
+            ExtensionDeploymentConfigService,
+            OrgExtensionConfigs,
+            BootstrapService,
+        ],
+        exports: [
+            ExtensionRegistryModule,
+            PluginInstallLock,
+            PluginApproveLock,
+            ExtensionApprovals,
+            ExtensionBlobs,
+            ExtensionInstalls,
+            ReplicaStatusStore,
+            ExtensionHost,
+            ExtensionLifecycle,
+            ExtensionAdmin,
+            ExtensionAdminOps,
+            ExtensionDeploymentConfigService,
+            OrgExtensionConfigs,
+            BootstrapService,
+        ],
+    })
+], ExtensionsModule);
+export { ExtensionsModule };

package/dist/extensions/hooks.d.ts

@@ -1,6 +1,6 @@
 import { type AvailableHook, type HookHandler, type HookOptions, type HookPayloads, type Logger, type PolicyHook } from "@capybara-hq/plugin-sdk";
-import type { Redis } from "ioredis";
 import type { KernelConfig } from "../config/schema.js";
+import type { LockService } from "../infra/lock/lock.service.js";
 import { type InflightTracker } from "./inflight.js";
 /** Default of `hooks.timeoutMs` (used when a host is built without kernel config, e.g. in tests). */
 export declare const DEFAULT_HOOK_TIMEOUT_MS = 5000;
@@ -112,7 +112,8 @@ export declare class HookRegistry {
          */
         expectedPolicy?(mount: PolicyHook): readonly string[];
         enabledPlugins(orgId: string): Promise<Set<string>>;
-        redis: Redis;
+        /** The warn-once markers (`lease`: set unless present, with a TTL). */
+        locks: Pick<LockService, "lease">;
         config: () => {
             hooks: Pick<KernelConfig["hooks"], "timeoutMs">;
         };

package/dist/extensions/hooks.js

@@ -414,7 +414,7 @@ export class HookRegistry {
         const key = `capk:hook-warn:${plugin}:${mount}:${kind}`;
         let first = true;
         try {
-            first = (await this.d.redis.set(key, "1", "PX", WARN_WINDOW_MS, "NX")) === "OK";
+            first = await this.d.locks.lease(key, "1", WARN_WINDOW_MS);
         }
         catch {
             // Redis unavailable: log anyway rather than hiding the failure