@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.2

package/dist/extensions/host.js

@@ -1,25 +1,43 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { dirname, isAbsolute, join, resolve as resolvePath } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { EXTENSION_POINT_CARDINALITY, parseExtensionPoint, SDK_VERSION, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { changedPaths, configFields, getPath, secretValues, setPath, unreachableSecrets, } from "../config/fields.js";
 import { pluginSchemaName, queryEnabledPlugins, } from "../ctx/create-ctx.js";
 import { kernelDb } from "../db/kernel-schema.js";
 import { migrate } from "../db/migrator.js";
 import { createDb } from "../db/pool.js";
+import { waitWithin } from "../infra/close-within.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { LockService } from "../infra/lock/lock.service.js";
+import { KERNEL_LOGGER, KEYRING, REDIS, REDIS_SUBSCRIBER } from "../infra/tokens.js";
+import { KERNEL_APP_OPTIONS } from "../lifecycle/tokens.js";
 import { packagePath } from "../packages/tgz.js";
-import { ExtensionApprovals, planApprovals, withPreApproved, } from "./approvals.js";
+import { EmbedTokens } from "../ui/embed-token.js";
+import { ExtensionApprovals, planApprovals, readSnapshots, withPreApproved, } from "./approvals.js";
 import { ExtensionBlobIntegrityError } from "./blobs.js";
-import { DEFAULT_HOOK_TIMEOUT_MS, HookRegistry } from "./hooks.js";
-import { trackCalls } from "./inflight.js";
-import { DEFAULT_DISPOSE_TIMEOUT_MS, ImportTracker, importExtensionModule, ManifestMismatchError, matchesSection, setupInstance, warnUpgrades, } from "./instance.js";
-import { toIssues } from "./org-config.js";
+import { toIssues } from "./config-issues.js";
+import { HookRegistry } from "./hooks.js";
+import { ExtensionInstalls } from "./installs.js";
+import { ImportTracker, importExtensionModule, ManifestMismatchError, matchesSection, setupInstance, warnUpgrades, } from "./instance.js";
 import { permissionSetOfSection, readMigrationSql } from "./package.js";
 import { blockingKeys, computePermissionSet, UI_VIEW_KEY_PREFIX, } from "./permission-set.js";
 import { ExtensionRegistry } from "./registry.js";
 import { ExtensionResolveError, resolveExtensions } from "./resolve.js";
+import { ReplicaStatusStore, } from "./sources.js";
 import { PackageShaMismatchError, packageRootOf } from "./sync.js";
 /** 键排序后的 JSON（对象键顺序不影响结果）；undefined 字段与 JSON.stringify 一样省略。 */
 const canonicalJson = (v) => {
@@ -58,10 +76,6 @@ export function deploymentConfigHash(schema, config) {
     return createHash("sha256").update(canonicalJson(redacted)).digest("hex").slice(0, 16);
 }
 const CLOSED_DURING_LOAD = "plugin host closed during load";
-/** 撤销实例时在途调用的默认排空时限（`extensionHost.drainSeconds` 的默认值）。 */
-const DEFAULT_DRAIN_MS = 30_000;
-/** 运行中重新加载时 setup 的默认时限（`extensionHost.reloadSetupTimeoutSeconds` 的默认值）。 */
-const DEFAULT_RELOAD_SETUP_TIMEOUT_MS = 60_000;
 /** 停机时等进行中的 unload / reload 的上限（之后直接关闭 setup 中的 ctx、撤销其余实例）。 */
 const CLOSE_LIFECYCLE_WAIT_MS = 2_000;
 /** 部署已知插件名（配置声明 / 安装记录）缓存的有效期：路由闸门 503 / 404 用，跨副本靠它收敛。 */
@@ -212,16 +226,14 @@ function manifestOfSection(m) {
         },
     };
 }
-/** 内核消费的提供方能力：调用计入提供方实例的在途计数（撤销 / 升级时排空，C17）。 */
-const TRACKED_EXTENSION_POINTS = {
-    connector: { sessions: ["open"] },
-    sandbox: {},
-    "model-provider": {},
-};
 /** 插件宿主：解析、校验配置、迁移、setup，并登记插件提供的能力与路由。 */
-export class ExtensionHost {
-    deps;
-    extensionConfig;
+let ExtensionHost = class ExtensionHost {
+    registry;
+    installs;
+    approvals;
+    status;
+    config;
+    log;
     /**
      * Only resolves extensions and runs migrations in dependency order: no deployment config check, no
      * setup, no Redis (for `capybara migrate`). Like `load()` it checks secret markers first
@@ -245,7 +257,7 @@ export class ExtensionHost {
             const raw = createDb(opts.dbUrl, 1, () => { }, { connectTimeoutMs: opts.connectTimeoutMs });
             let decisions;
             try {
-                decisions = planApprovals(ordered, sets, await new ExtensionApprovals(kernelDb(raw)).all());
+                decisions = planApprovals(ordered, sets, await readSnapshots(kernelDb(raw)));
             }
             finally {
                 await raw.destroy();
@@ -293,8 +305,6 @@ export class ExtensionHost {
             permissions: sets.get(manifest.name),
         }));
     }
-    /** 本进程生效的插件实例（C17）：消费方每次实时取，不缓存实现对象。 */
-    registry = new ExtensionRegistry();
     /**
      * M-1: plugin → mount points where deployment state expects `policy` hooks. A per-replica copy of PG
      * deployment state (like the registry), rebuilt on every load / converge, never written elsewhere.
@@ -316,10 +326,6 @@ export class ExtensionHost {
     imports = new ImportTracker();
     /** 串行化 unload / reload（同一时刻只做一件，依赖方的连锁处理不交错）。 */
     lifecycle = Promise.resolve();
-    drainMs;
-    disposeTimeoutMs;
-    reloadSetupTimeoutMs;
-    installedNames;
     /** 安装记录里的插件名缓存（TTL + 注册表变化时作废）。 */
     installedCache;
     /** 本次因权限待批准（或依赖待批准插件）而未加载的插件。 */
@@ -358,53 +364,108 @@ export class ExtensionHost {
     /** 已创建、尚未登记（setup 进行中）的 ctx：close() 时立即关闭，不等 setup 返回。 */
     settingUp;
     resolveFrom;
-    onSecrets;
-    autoApprove;
-    status;
-    storedConfig;
+    /** What every extension's `ctx` is built from (kernel side only; nothing Nest crosses into `ctx`). */
+    deps;
     /** 配置声明插件的部署配置最近一次判定是否合法（后台列表用；没判定过时按启动配置校验）。 */
     configValidity = new Map();
     /** 已告警过的「部署配置不合法」（插件名 → 说明；每个周期都会重新判定，同一说明只告警一次）。 */
     configWarned = new Map();
     /**
-     * @param opts.resolveFrom The directory bare package names are resolved from, default
-     * `process.cwd()`; a relative path is made absolute against the cwd at construction.
-     * Absolute paths and `file:` URL extension specifiers are used as they are;
-     * bare package names are resolved with `createRequire(<resolveFrom>/noop.js).resolve`, so an
-     * extension package's exports must expose the `default` (or `require`) condition.
-     * @param opts.autoApprove Approve extension permissions automatically (config
-     * `extensionPermissions.autoApprove`, development and trials only): extensions needing approval write a
-     * snapshot with source auto and load as usual. Default false: extensions pending approval do not
-     * load (see {@link pending}).
-     * @param opts.status This replica's load status table (`extension_replica_status`): every
-     * extension's load result writes a row.
+     * The host builds each extension's `ctx` from the injected kernel services: the pool for
+     * `ctx.db` on the extension's schema, Redis for `kv` / `lock` / `bus` and the queues, the
+     * keyring for `secrets`. The config is read per call (`extensionConfig`, the drain and setup
+     * time limits, `extensionPermissions.autoApprove`).
+     *
+     * `KERNEL_APP_OPTIONS.resolveFrom`: the directory bare package names are resolved from, default
+     * `process.cwd()`; a relative path is made absolute against the cwd at construction. Absolute
+     * paths and `file:` URL extension specifiers are used as they are; bare package names are
+     * resolved with `createRequire(<resolveFrom>/noop.js).resolve`, so an extension package's exports
+     * must expose the `default` (or `require`) condition.
+     */
+    constructor(
+    /** The process's extension registry (one provider, shared with other domains). */
+    registry, 
+    /**
+     * The deployment's desired state (one way, spec §3): install record names (with the
+     * config-declared ones the extensions "known to the deployment": routes of one not active on
+     * this replica answer 503, an unknown name 404; cached {@link KNOWN_NAMES_TTL_MS}) and each
+     * extension's effective deployment config (the startup config plus the fields stored in PG, C10).
      */
-    constructor(deps, extensionConfig = {}, opts = {}) {
-        this.deps = deps;
-        this.extensionConfig = extensionConfig;
-        this.storedConfig = opts.deploymentConfig;
-        this.drainMs = opts.drainMs ?? (() => DEFAULT_DRAIN_MS);
-        this.disposeTimeoutMs = opts.disposeTimeoutMs ?? (() => DEFAULT_DISPOSE_TIMEOUT_MS);
-        this.reloadSetupTimeoutMs =
-            opts.reloadSetupTimeoutMs ?? (() => DEFAULT_RELOAD_SETUP_TIMEOUT_MS);
-        this.installedNames = opts.installedNames;
-        const hookTimeoutMs = opts.hookTimeoutMs ?? (() => DEFAULT_HOOK_TIMEOUT_MS);
+    installs, approvals, 
+    /** This replica's load status table (`extension_replica_status`): every load result writes a row. */
+    status, config, kdb, redis, busSubscriber, keyring, embedTokens, locks, log, options) {
+        this.registry = registry;
+        this.installs = installs;
+        this.approvals = approvals;
+        this.status = status;
+        this.config = config;
+        this.log = log;
+        const c = config.get();
+        this.deps = {
+            db: kdb.pool,
+            dbUrl: c.db.url,
+            connectTimeoutMs: c.db.connectTimeoutMs,
+            redis,
+            busSubscriber,
+            redisUrl: c.redis.url,
+            keyring,
+            embedTokens,
+            locks,
+            runWorkers: c.roles.includes("worker"),
+            log,
+        };
         this.hooks = new HookRegistry({
             instances: () => this.registry.all(),
             current: (plugin) => this.registry.current(plugin),
             expectedPolicy: (mount) => this.expectedPolicy(mount),
             enabledPlugins: (orgId) => this.enabledPlugins(orgId),
-            redis: deps.redis,
-            config: () => ({ hooks: { timeoutMs: hookTimeoutMs() } }),
-            log: deps.log,
+            locks,
+            config: () => ({ hooks: { timeoutMs: this.config.get().hooks.timeoutMs } }),
+            log,
         });
         this.registry.onChange(() => {
             this.installedCache = undefined;
         });
-        this.onSecrets = opts.onSecrets;
-        this.autoApprove = opts.autoApprove === true;
-        this.resolveFrom = resolvePath(opts.resolveFrom ?? process.cwd());
-        this.status = opts.status;
+        this.resolveFrom = resolvePath(options.resolveFrom ?? process.cwd());
+    }
+    /** The startup config's `extensionConfig` (file / Nacos merged with env). */
+    get extensionConfig() {
+        return this.config.get().extensionConfig;
+    }
+    /** `extensionPermissions.autoApprove` (development and trials only; see `planApprovals`). */
+    get autoApprove() {
+        return this.config.get().extensionPermissions.autoApprove;
+    }
+    /** In-flight calls of a revoked instance are drained within this (`extensionHost.drainSeconds`). */
+    drainMs() {
+        return this.config.get().extensionHost.drainSeconds * 1000;
+    }
+    /** An extension's `dispose()` time limit (`extensionHost.disposeTimeoutSeconds`). */
+    disposeTimeoutMs() {
+        return this.config.get().extensionHost.disposeTimeoutSeconds * 1000;
+    }
+    /** `setup` time limit of a reload in a running process (`extensionHost.reloadSetupTimeoutSeconds`). */
+    reloadSetupTimeoutMs() {
+        return this.config.get().extensionHost.reloadSetupTimeoutSeconds * 1000;
+    }
+    /**
+     * Records the config-declared extensions the CLI inspected (the CLI loads none): their names,
+     * manifests and permission sets for {@link declared} / {@link declaredPlugins}, and whether
+     * their deployment config is valid (the CLI merges and checks it like a replica would).
+     */
+    noteInspected(inspected, configValid) {
+        for (const p of inspected) {
+            this.sources.set(p.manifest.name, { source: "config", sha256: null });
+            this.declaredInfo.set(p.manifest.name, {
+                source: "config",
+                manifest: p.manifest,
+                set: p.permissions,
+            });
+            const valid = configValid.get(p.manifest.name);
+            if (valid !== undefined)
+                this.configValidity.set(p.manifest.name, valid);
+        }
+        this.registry.declare(inspected.map((p) => p.manifest.name));
     }
     /**
      * Imports each extension module (default export) and initializes them in dependency order; may be
@@ -464,13 +525,14 @@ export class ExtensionHost {
         const ordered = resolveExtensions(ready, SDK_VERSION);
         for (const e of entries)
             this.sources.set(e.manifest.name, { source: "config", sha256: null });
+        this.registry.declare(entries.map((e) => e.manifest.name));
         for (const e of entries)
             assertSecretsReachable(e.manifest);
         const sets = await permissionSets(ordered, dirs);
         this.noteDeclared(ordered, sets);
-        const approvals = new ExtensionApprovals(kernelDb(this.deps.db));
+        const approvals = this.approvals;
         if (this.autoApprove) {
-            this.deps.log.warn("extensionPermissions.autoApprove is ON: plugin permissions are approved automatically without review; never enable this in production");
+            this.log.warn("extensionPermissions.autoApprove is ON: plugin permissions are approved automatically without review; never enable this in production");
         }
         const snapshots = ordered.length > 0 || p.installs ? await approvals.all() : new Map();
         const decisions = new Map(planApprovals(ordered, sets, snapshots, {
@@ -496,7 +558,7 @@ export class ExtensionHost {
                 desired = await p.installs.desired();
             }
             catch (e) {
-                this.deps.log.error("cannot read extension install records; installed extensions are not loaded", {
+                this.log.error("cannot read extension install records; installed extensions are not loaded", {
                     err: e,
                 });
             }
@@ -517,7 +579,7 @@ export class ExtensionHost {
         await this.refreshPolicyExpectations(p.installs ? desired : []);
         const orphans = Object.keys(this.extensionConfig).filter((k) => !this.sources.has(k));
         if (orphans.length > 0) {
-            this.deps.log.warn("extensionConfig has keys for extensions that are not loaded", {
+            this.log.warn("extensionConfig has keys for extensions that are not loaded", {
                 keys: orphans,
             });
         }
@@ -533,7 +595,7 @@ export class ExtensionHost {
         for (const e of entries) {
             const pkg = await packageNameOf(e.dir);
             if (pkg === undefined) {
-                this.deps.log.warn("plugin module has no package.json name; its plugin name is not claimed", {
+                this.log.warn("plugin module has no package.json name; its plugin name is not claimed", {
                     plugin: e.manifest.name,
                 });
                 continue;
@@ -557,12 +619,12 @@ export class ExtensionHost {
             for (const o of owners) {
                 const mine = rows.find((r) => r.name === o.name);
                 if (mine && mine.package_name !== o.package_name) {
-                    this.deps.log.warn("plugin name is owned by a different npm package; the data, secrets and approval kept under this name came from that package", { plugin: o.name, owner: o.package_name, package: mine.package_name });
+                    this.log.warn("plugin name is owned by a different npm package; the data, secrets and approval kept under this name came from that package", { plugin: o.name, owner: o.package_name, package: mine.package_name });
                 }
             }
         }
         catch (err) {
-            this.deps.log.warn("cannot record plugin name owners", { err });
+            this.log.warn("cannot record plugin name owners", { err });
         }
     }
     /**
@@ -598,18 +660,15 @@ export class ExtensionHost {
      * 插件此刻的部署配置（未校验）：启动配置补上 PG 里保存的字段（C10，见构造参数 `deploymentConfig`）。
      */
     async rawConfigOf(name, schema) {
-        const fileValue = this.extensionConfig[name];
-        if (!this.storedConfig)
-            return fileValue ?? {};
-        return this.storedConfig(name, fileValue, schema);
+        return this.installs.effectiveDeploymentConfig(name, this.extensionConfig[name], schema);
     }
-    /** 把一份已校验部署配置里的密钥值交给 onSecrets（日志打码）。 */
+    /** 把一份已校验部署配置里的密钥值登记到日志打码。 */
     reportSecrets(schema, config) {
-        if (!schema || !this.onSecrets)
+        if (!schema)
             return;
         const values = secretValues(schema, config);
         if (values.length > 0)
-            this.onSecrets(values);
+            this.log.addSecrets(values);
     }
     /**
      * 安装记录收敛到 PG 期望状态（启动第 3 步与运行中的 {@link converge} 共用，C16）；`desired` 为期望启用的记录。
@@ -633,7 +692,7 @@ export class ExtensionHost {
             if (taken) {
                 if (!this.warnedConflicts.has(d.name)) {
                     this.warnedConflicts.add(d.name);
-                    this.deps.log.warn("plugin is both installed and declared in the extensions config list; using the config plugin", { plugin: d.name, installedVersion: d.version });
+                    this.log.warn("plugin is both installed and declared in the extensions config list; using the config plugin", { plugin: d.name, installedVersion: d.version });
                     // 该名字的状态行属于生效的一方，不覆盖；在它的 detail 里记下冲突（后台能看到）
                     await this.noteStatus(d.name, `name_conflict: install record ${d.version} (${d.sha256.slice(0, 16)}) ignored; the ${taken} plugin of the same name is used`);
                 }
@@ -752,7 +811,7 @@ export class ExtensionHost {
         // 4. 按拓扑序逐个：权限闸门 → 配置 → 迁移 → setup → 登记（替换旧实例）
         const order = resolveExtensions([...base(), ...accepted.map((a) => a.manifest)], SDK_VERSION);
         const byName = new Map(accepted.map((c) => [c.d.name, c]));
-        const approvals = new ExtensionApprovals(kernelDb(this.deps.db));
+        const approvals = this.approvals;
         const snapshots = await approvals.all();
         const activated = new Set();
         for (const m of order) {
@@ -873,7 +932,7 @@ export class ExtensionHost {
         if (this.loggedFailures.get(plugin) === key)
             return;
         this.loggedFailures.set(plugin, key);
-        this.deps.log.error("installed extension not loaded", {
+        this.log.error("installed extension not loaded", {
             plugin,
             sha256,
             reason,
@@ -975,13 +1034,11 @@ export class ExtensionHost {
     }
     /** 给已有状态行补说明；失败只记 warn。 */
     async noteStatus(plugin, detail) {
-        if (!this.status)
-            return;
         try {
             await this.status.note(plugin, detail);
         }
         catch (e) {
-            this.deps.log.warn("cannot write plugin replica status", { plugin, err: e });
+            this.log.warn("cannot write plugin replica status", { plugin, err: e });
         }
     }
     /**
@@ -1002,13 +1059,11 @@ export class ExtensionHost {
             else
                 this.installRows.set(s.plugin, { version: s.version, sha256: s.sha256 });
         }
-        if (!this.status)
-            return;
         try {
             await this.status.write(s);
         }
         catch (e) {
-            this.deps.log.warn("cannot write plugin replica status", { plugin: s.plugin, err: e });
+            this.log.warn("cannot write plugin replica status", { plugin: s.plugin, err: e });
         }
     }
     /**
@@ -1054,7 +1109,7 @@ export class ExtensionHost {
             if (this.closed)
                 throw new Error(CLOSED_DURING_LOAD, { cause: e });
             // 读不到 PG 里保存的部署配置：按待配置处理，下次 reconcile 再试
-            this.deps.log.error("cannot read the stored deployment config of plugin", {
+            this.log.error("cannot read the stored deployment config of plugin", {
                 plugin: name,
                 err: e,
             });
@@ -1081,7 +1136,7 @@ export class ExtensionHost {
             // 每个周期都会重新判定：同一版本、同一原因只告警一次
             if (before?.version !== decision.pending.version ||
                 before.reason !== decision.pending.reason) {
-                warnPending(this.deps.log, decision.pending);
+                warnPending(this.log, decision.pending);
             }
             const reason = decision.pending.reason === "dependency" ? "dependency" : "approval";
             await this.writeStatus({ ...base, state: "pending", reason, detail: null });
@@ -1092,7 +1147,7 @@ export class ExtensionHost {
         if (decision.changed) {
             if (decision.autoApprove) {
                 await approvals.approve(name, manifest.version, a.set, { source: "auto" });
-                this.deps.log.warn("plugin permissions auto-approved (extensionPermissions.autoApprove)", {
+                this.log.warn("plugin permissions auto-approved (extensionPermissions.autoApprove)", {
                     plugin: name,
                     version: manifest.version,
                     added: decision.added,
@@ -1104,7 +1159,7 @@ export class ExtensionHost {
                 const updated = await approvals.refresh(name, manifest.version, a.set);
                 const merged = decision.added.filter((k) => k.startsWith(UI_VIEW_KEY_PREFIX));
                 if (updated && merged.length > 0 && blockingKeys(decision.added).length === 0) {
-                    this.deps.log.info("plugin ui views merged into the permission snapshot", {
+                    this.log.info("plugin ui views merged into the permission snapshot", {
                         plugin: name,
                         version: manifest.version,
                         merged,
@@ -1121,7 +1176,7 @@ export class ExtensionHost {
                 // 待配置（C10）：配置声明与安装记录都一样，内核照常启动；配置改好后下一次 reconcile 加载
                 if (this.configWarned.get(name) !== detail) {
                     this.configWarned.set(name, detail);
-                    this.deps.log.warn("extension not loaded: its deployment config is missing or invalid (set it in the admin console or the startup config; it loads without a restart)", { plugin: name, source: a.source, detail });
+                    this.log.warn("extension not loaded: its deployment config is missing or invalid (set it in the admin console or the startup config; it loads without a restart)", { plugin: name, source: a.source, detail });
                 }
                 retryLater();
                 await this.writeStatus({ ...base, state: "pending", reason: "config", detail });
@@ -1183,7 +1238,7 @@ export class ExtensionHost {
         }
         if (this.closed) {
             await inst.dispose({ drainMs: 0 }).catch((err) => {
-                this.deps.log.warn("plugin context close failed", { plugin: name, err });
+                this.log.warn("plugin context close failed", { plugin: name, err });
             });
             throw new Error(CLOSED_DURING_LOAD);
         }
@@ -1204,7 +1259,7 @@ export class ExtensionHost {
     retire(old) {
         const p = this.disposeQuietly(old, this.drainMs()).finally(() => {
             this.retiring.delete(old);
-            this.deps.log.info("previous plugin instance retired", {
+            this.log.info("previous plugin instance retired", {
                 plugin: old.name,
                 generation: old.generation,
             });
@@ -1281,7 +1336,7 @@ export class ExtensionHost {
      * `shrinkOnly`: only remove entries (a plugin no longer desired or approved), never add new ones.
      */
     async refreshPolicyExpectations(desired, opts = {}) {
-        const snapshots = await new ExtensionApprovals(kernelDb(this.deps.db)).all();
+        const snapshots = await this.approvals.all();
         const next = new Map();
         const add = (name, set) => {
             const mounts = set?.permissions?.policyHooks ?? [];
@@ -1330,7 +1385,7 @@ export class ExtensionHost {
     async activatePendingNow() {
         if (this.pendingActivations.size === 0)
             return [];
-        const approvals = new ExtensionApprovals(kernelDb(this.deps.db));
+        const approvals = this.approvals;
         const snapshots = await approvals.all();
         const activated = [];
         /** 本次已经试过且失败的：同一次不再重试（下一次 converge 再试）。 */
@@ -1356,7 +1411,7 @@ export class ExtensionHost {
                     if (this.closed)
                         throw e;
                     // 配置声明的插件迁移 / setup 出错时 activate 抛错（启动时内核失败）；运行中只记 failed
-                    this.deps.log.error("approved plugin not loaded", { plugin: name, err: e });
+                    this.log.error("approved plugin not loaded", { plugin: name, err: e });
                     await this.writeStatus({
                         plugin: name,
                         version: a.manifest.version,
@@ -1370,7 +1425,7 @@ export class ExtensionHost {
                 if (this.registry.current(name)) {
                     activated.push(name);
                     progress = true;
-                    this.deps.log.info("approved plugin loaded", { plugin: name });
+                    this.log.info("approved plugin loaded", { plugin: name });
                 }
                 else {
                     // 加载失败（迁移、setup）或待配置：留着，下一次 converge 重试（同一次不再试）
@@ -1453,7 +1508,7 @@ export class ExtensionHost {
     }
     /** 配置声明的插件名 → 来源（安装包不能与它们重名）。 */
     declared() {
-        return new Map([...this.sources].flatMap(([n, s]) => s.source === "install" ? [] : [[n, s.source]]));
+        return this.registry.declared();
     }
     /**
      * Extensions enabled in the org: `extension_org_configs.enabled` plus every required bootstrap
@@ -1496,7 +1551,7 @@ export class ExtensionHost {
      */
     async setup(spec, timeoutMs) {
         if (this.imports.record(spec.manifest.name, spec.entryUrl)) {
-            warnUpgrades(this.deps.log, this.imports);
+            warnUpgrades(this.log, this.imports);
         }
         let ctx;
         const p = setupInstance(this.loadDeps, spec.manifest, {
@@ -1534,7 +1589,7 @@ export class ExtensionHost {
             if (this.settingUp === ctx)
                 this.settingUp = undefined;
             await ctx?.close().catch((err) => {
-                this.deps.log.warn("plugin context close failed", { plugin: spec.manifest.name, err });
+                this.log.warn("plugin context close failed", { plugin: spec.manifest.name, err });
             });
             if (r === "closed")
                 throw new Error(CLOSED_DURING_LOAD);
@@ -1574,33 +1629,14 @@ export class ExtensionHost {
      * 实时取自注册表：调用方不要缓存实现对象（插件撤销 / 升级后旧实现不再有效）。
      */
     list(extensionPointName) {
-        const out = [];
-        const tracked = TRACKED_EXTENSION_POINTS[extensionPointName];
-        for (const i of this.registry.all()) {
-            for (const [cap, impl] of i.provided) {
-                if (parseExtensionPoint(cap).name === extensionPointName) {
-                    out.push({
-                        plugin: i.name,
-                        capability: cap,
-                        // 内核消费的提供方调用计入实例在途计数：停用 / 升级时先排空、到时限中止（C17）
-                        impl: tracked && typeof impl === "object" && impl !== null
-                            ? trackCalls(impl, i.inflight, tracked)
-                            : impl,
-                        version: i.version,
-                        configHash: i.configHash,
-                        inflight: i.inflight,
-                    });
-                }
-            }
-        }
-        return out;
+        return this.registry.list(extensionPointName);
     }
     /**
      * 已加载插件的部署配置（已按清单 schema 校验，含密钥），供内核调用该插件的能力时作为 `config` 传回
      * （如 `identity-source@1` 的登录配置）；未加载返回 undefined。不得回显到响应或日志。
      */
     deploymentConfig(plugin) {
-        return this.registry.current(plugin)?.config;
+        return this.registry.deploymentConfig(plugin);
     }
     /**
      * 本副本拿得到的插件清单里的部署级 schema（生效实例 → 配置声明 → 安装记录准备好的候选）；
@@ -1640,7 +1676,7 @@ export class ExtensionHost {
                         this.configValidity.set(plugin, schema.safeParse(raw).success);
                     }
                     catch (err) {
-                        this.deps.log.warn("cannot read the stored deployment config of plugin", {
+                        this.log.warn("cannot read the stored deployment config of plugin", {
                             plugin,
                             err,
                         });
@@ -1656,12 +1692,12 @@ export class ExtensionHost {
                 raw = await this.rawConfigOf(plugin, schema);
             }
             catch (err) {
-                this.deps.log.error("cannot read the stored deployment config of plugin; keeping its current config", { plugin, err });
+                this.log.error("cannot read the stored deployment config of plugin; keeping its current config", { plugin, err });
                 return "invalid";
             }
             const r = schema.safeParse(raw);
             if (!r.success) {
-                this.deps.log.warn("plugin deployment config changed but is invalid on this replica; keeping the current config", {
+                this.log.warn("plugin deployment config changed but is invalid on this replica; keeping the current config", {
                     plugin,
                     detail: toIssues(r.error)
                         .map((i) => `${i.path || "<root>"}: ${i.message}`)
@@ -1684,7 +1720,7 @@ export class ExtensionHost {
             this.specs.set(plugin, { ...spec, config: next, configHash });
             if (changed.every((p) => hot.has(p))) {
                 inst.updateConfig(next, configHash);
-                this.deps.log.info("plugin deployment config updated in place (hot fields)", {
+                this.log.info("plugin deployment config updated in place (hot fields)", {
                     plugin,
                     changed,
                 });
@@ -1702,11 +1738,11 @@ export class ExtensionHost {
                     this.specs.set(plugin, spec);
                 if (this.closed)
                     throw err;
-                this.deps.log.error("plugin reload after a deployment config change failed; it keeps its previous instance", { plugin, changed, err });
+                this.log.error("plugin reload after a deployment config change failed; it keeps its previous instance", { plugin, changed, err });
                 return "reload_failed";
             }
             await this.cascade(fresh.manifest.provides, drainMs);
-            this.deps.log.info("plugin reloaded after a deployment config change", { plugin, changed });
+            this.log.info("plugin reloaded after a deployment config change", { plugin, changed });
             return "reload";
         });
     }
@@ -1716,7 +1752,7 @@ export class ExtensionHost {
     }
     /** 已加载插件的清单（按加载顺序，即依赖拓扑序）。 */
     manifests() {
-        return this.registry.all().map((i) => i.manifest);
+        return this.registry.manifests();
     }
     /** 已加载插件的权限集合（加载时计算，清单不可变）；未加载返回 undefined。 */
     permissionSet(plugin) {
@@ -1756,15 +1792,13 @@ export class ExtensionHost {
     }
     /** 安装记录里的插件名（缓存，见 {@link unavailable}）。 */
     installed() {
-        const load = this.installedNames;
-        if (!load)
-            return Promise.resolve(new Set());
         const now = Date.now();
         if (!this.installedCache || now - this.installedCache.at > KNOWN_NAMES_TTL_MS) {
-            const names = load()
+            const names = this.installs
+                .installedNames()
                 .then((xs) => new Set(xs))
                 .catch((err) => {
-                this.deps.log.warn("cannot read plugin install records for the route gate", { err });
+                this.log.warn("cannot read plugin install records for the route gate", { err });
                 this.installedCache = undefined;
                 return new Set();
             });
@@ -1881,7 +1915,7 @@ export class ExtensionHost {
             reason,
             detail: null,
         });
-        this.deps.log.info("plugin unloaded", { plugin, generation: inst.generation, reason });
+        this.log.info("plugin unloaded", { plugin, generation: inst.generation, reason });
         return inst;
     }
     /** 新建实例并原子替换、撤销旧实例（不做连锁）。 */
@@ -1917,7 +1951,7 @@ export class ExtensionHost {
         });
         if (old)
             await this.disposeQuietly(old, drainMs);
-        this.deps.log.info("plugin reloaded", { plugin, generation: inst.generation });
+        this.log.info("plugin reloaded", { plugin, generation: inst.generation });
         return inst;
     }
     /** 生效实例按依赖拓扑排序（解析不了时退回注册表顺序）。 */
@@ -1971,7 +2005,7 @@ export class ExtensionHost {
             catch (err) {
                 if (this.closed)
                     throw err;
-                this.deps.log.error("dependent plugin reload failed; it keeps its previous instance", {
+                this.log.error("dependent plugin reload failed; it keeps its previous instance", {
                     plugin: name,
                     err,
                 });
@@ -1996,7 +2030,7 @@ export class ExtensionHost {
                 catch (err) {
                     if (this.closed)
                         throw err;
-                    this.deps.log.error("plugin reload after its dependency came back failed", {
+                    this.log.error("plugin reload after its dependency came back failed", {
                         plugin: name,
                         err,
                     });
@@ -2012,7 +2046,7 @@ export class ExtensionHost {
             await inst.dispose({ drainMs, disposeTimeoutMs: this.disposeTimeoutMs() });
         }
         catch (err) {
-            this.deps.log.error("plugin dispose failed", { plugin: inst.name, err });
+            this.log.error("plugin dispose failed", { plugin: inst.name, err });
         }
     }
     /**
@@ -2026,32 +2060,20 @@ export class ExtensionHost {
         this.closed = true;
         this.abort.abort();
         await this.migrating?.catch(() => { });
-        let timer;
-        await Promise.race([
-            this.lifecycle.catch(() => { }),
-            new Promise((resolve) => {
-                timer = setTimeout(resolve, opts.lifecycleWaitMs ?? CLOSE_LIFECYCLE_WAIT_MS);
-            }),
-        ]);
-        clearTimeout(timer);
+        const lifecycleWaitMs = opts.lifecycleWaitMs ?? CLOSE_LIFECYCLE_WAIT_MS;
+        await waitWithin(this.lifecycle.catch(() => { }), lifecycleWaitMs);
         // 升级时被替换、后台排空中的旧实例：同样最多等 lifecycleWaitMs，之后强制撤销（中止在途调用、不再排空），
         // 赶在共用资源（Redis / PG）关闭之前
         if (this.retiring.size > 0) {
-            await Promise.race([
-                Promise.allSettled([...this.retiring.values()]),
-                new Promise((resolve) => {
-                    timer = setTimeout(resolve, opts.lifecycleWaitMs ?? CLOSE_LIFECYCLE_WAIT_MS);
-                }),
-            ]);
-            clearTimeout(timer);
+            await waitWithin(Promise.allSettled([...this.retiring.values()]), lifecycleWaitMs);
             await Promise.allSettled([...this.retiring.keys()].map((old) => old.hurry().catch((err) => {
-                this.deps.log.warn("plugin close failed", { plugin: old.name, err });
+                this.log.warn("plugin close failed", { plugin: old.name, err });
             })));
         }
         const settingUp = this.settingUp;
         this.settingUp = undefined;
         await settingUp?.close().catch((e) => {
-            this.deps.log.error("plugin close failed", { err: e });
+            this.log.error("plugin close failed", { err: e });
         });
         for (const inst of this.registry.all().reverse()) {
             this.registry.deactivate(inst.name);
@@ -2061,11 +2083,28 @@ export class ExtensionHost {
                     waitQueueJobs: true,
                     disposeTimeoutMs: this.disposeTimeoutMs(),
                 });
-                this.deps.log.info("plugin closed", { plugin: inst.name });
+                this.log.info("plugin closed", { plugin: inst.name });
             }
             catch (e) {
-                this.deps.log.error("plugin close failed", { plugin: inst.name, err: e });
+                this.log.error("plugin close failed", { plugin: inst.name, err: e });
             }
         }
     }
-}
+};
+ExtensionHost = __decorate([
+    Injectable(),
+    __param(0, Inject(ExtensionRegistry)),
+    __param(1, Inject(ExtensionInstalls)),
+    __param(2, Inject(ExtensionApprovals)),
+    __param(3, Inject(ReplicaStatusStore)),
+    __param(4, Inject(KernelConfigService)),
+    __param(5, Inject(KernelDb)),
+    __param(6, Inject(REDIS)),
+    __param(7, Inject(REDIS_SUBSCRIBER)),
+    __param(8, Inject(KEYRING)),
+    __param(9, Inject(EmbedTokens)),
+    __param(10, Inject(LockService)),
+    __param(11, Inject(KERNEL_LOGGER)),
+    __param(12, Inject(KERNEL_APP_OPTIONS))
+], ExtensionHost);
+export { ExtensionHost };