@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.10

package/dist/extensions/admin-ops.js

@@ -1,32 +1,96 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { SDK_VERSION } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import semver from "semver";
 import { pluginSchemaName } from "../ctx/create-ctx.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { lockEnterpriseAdminsAndAuthorize } from "../identity/enterprise-admin.js";
-import { PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { afterCommit } from "../infra/database/after-commit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
+import { OrgLock } from "../orgs/org-lock.js";
+import { ExtensionAdmin } from "./admin-view.js";
+import { ExtensionBlobs } from "./blobs.js";
+import { ExtensionLifecycle, PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
+import { PluginInstallLock } from "./locks.js";
 import { unrunMigrations } from "./migrate-lock.js";
 import { ExtensionPackageError, extensionPackageApiError, readExtensionPackage, } from "./package.js";
-/**
- * Deployment-level extension install / enable / disable / uninstall (C16 / D15): writes only the PG
- * desired state (`extension_installs`) and the audit, then publishes `kernel.plugins.changed` after
- * the commit (a failure only warns; the periodic reconcile catches up); replicas converge through
- * reconcile, no restart. It does not wait for replicas: the returned view may say `converging`.
- * Stateless, shared by every replica; the CLI uses it too (`actor` is null).
- * Every write runs in a transaction: first `lockEnterpriseAdminsAndAuthorize` (skipped by the CLI),
- * then an advisory lock by extension name and a lock on the install record row.
- */
-export class ExtensionAdminOps {
-    d;
-    constructor(d) {
-        this.d = d;
+import { ExtensionRegistry } from "./registry.js";
+import { isSingleProviderCode, SingleProviderGuard, singleProviderNote, } from "./single-provider.js";
+let ExtensionAdminOps = class ExtensionAdminOps {
+    kdb;
+    txHost;
+    adminLock;
+    orgLock;
+    installLock;
+    admin;
+    registry;
+    blobs;
+    config;
+    bus;
+    lifecycle;
+    log;
+    singleProvider;
+    constructor(kdb, txHost, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock, 
+    /** The owner org's lock: an owner's operation re-checks its admin under it. */
+    orgLock, installLock, 
+    /**
+     * The admin view after the operation, degraded when the package cannot be read
+     * (`get(name, { allowUnreadable: true })`). If it throws, the operation has already committed:
+     * ops logs an error and returns {@link fallbackView}, so an operation that took effect is not
+     * reported as failed.
+     */
+    admin, 
+    /** The config-declared extension names (they cannot be installed / disabled / uninstalled, C15). */
+    registry, 
+    /** Reads packages (a downgrade checks the target version's migration files). */
+    blobs, config, 
+    /** Publishes `kernel.plugins.changed`. */
+    bus, 
+    /**
+     * When the publish fails this replica reconciles itself (not awaited; other replicas catch up
+     * periodically). A no-op where the lifecycle never started (the CLI).
+     */
+    lifecycle, log, 
+    /** One enabled provider per single-provider extension point (checked in the enable). */
+    singleProvider) {
+        this.kdb = kdb;
+        this.txHost = txHost;
+        this.adminLock = adminLock;
+        this.orgLock = orgLock;
+        this.installLock = installLock;
+        this.admin = admin;
+        this.registry = registry;
+        this.blobs = blobs;
+        this.config = config;
+        this.bus = bus;
+        this.lifecycle = lifecycle;
+        this.log = log;
+        this.singleProvider = singleProvider;
+    }
+    get db() {
+        return this.kdb.db;
     }
     /**
      * New install or version change (upgrade / downgrade): the install record points at package
      * `sha256`; the desired state is unchanged (a new install is disabled). Audit `extension.installed`.
      * - Config-declared -> `extension.config_declared`; a required bootstrap plugin may be
-     *   installed at another version (an enterprise admin upgrades it; `required` is kept);
+     *   installed at another version (a super admin upgrades it; `required` is kept);
      * - package not in the package store -> `extension.package_not_found`; the extension name in the
      *   package is not `name` -> `extension.name_mismatch`;
      * - an install record of the same name exists but comes from another npm package ->
@@ -42,19 +106,25 @@ export class ExtensionAdminOps {
      *   go back to a version whose migrations are a subset of those already run).
      * Already pointing at the same package: nothing changes (no audit; for a changed source item only,
      * see below).
-     * `opts.catalogItemId`: the source item when installing through the enterprise catalog, stored
+     * `opts.catalogItemId`: the source item when installing through the platform catalog, stored
      * in `extension_installs.catalog_item_id` (F-AA) and registered in `extension_catalog_sources`;
      * installing outside the catalog (upload / npm / CLI) **keeps** the existing source items (T26
      * fix: clearing them would let org enablement bypass catalog policy, C22). The detail of the
      * `extension.installed` audit carries `catalogItemId`; when it already points at the same package
      * and only the source item changed, only that column changes, audit
      * `extension.install_source_changed`.
+     * A version change of an enabled extension whose new version provides a single-provider
+     * extension point the old one did not, while another extension holds it: the new version is
+     * installed **disabled** (`enabled_at` cleared, audit `extension.disabled` with `singleProvider`)
+     * rather than the upgrade refused, so the package moves and the provider running keeps the point;
+     * the result's `leftDisabled` says why (the shape of `enableUnlessOccupied`'s refusal). Checked
+     * under the point's lock after the install lock (the enable's order).
      */
     async install(name, sha256, actor, actorTokenId, opts = {}) {
         this.assertInstallable(name);
-        const pkg = await this.d.db
+        const pkg = await this.db
             .selectFrom("extension_packages")
-            .select(["sha256", "name", "package_name", "version", "source"])
+            .select(["sha256", "name", "package_name", "version", "source", "section"])
             .where("sha256", "=", sha256)
             .executeTakeFirst();
         if (!pkg) {
@@ -66,104 +136,166 @@ export class ExtensionAdminOps {
         // The downgrade check needs the target package's migration files: read and parse the package
         // outside the transaction (inside it only _migrations is compared). A stored package in the
         // pre-0.1.0 format -> extension.legacy_format.
-        const target = await readExtensionPackage(await this.d.blobs.get(sha256), {
-            maxBytes: this.d.config().packages.maxBytes,
+        const target = await readExtensionPackage(await this.blobs.get(sha256), {
+            maxBytes: this.config.get().packages.maxBytes,
             hostSdkVersion: SDK_VERSION,
         }).catch((e) => {
             throw e instanceof ExtensionPackageError ? extensionPackageApiError(e) : e;
         });
-        const changed = await this.d.db.transaction().execute(async (trx) => {
-            if (actor !== null)
-                await lockEnterpriseAdminsAndAuthorize(trx, actor);
-            const row = await this.lockRow(trx, name);
-            // 不经目录重装时保留原来的来源条目（不清空，C22）
-            const catalogItemId = opts.catalogItemId ?? row?.catalog_item_id ?? null;
-            if (opts.catalogItemId !== undefined) {
-                await trx
-                    .insertInto("extension_catalog_sources")
-                    .values({ plugin: name, item_id: opts.catalogItemId })
-                    .onConflict((oc) => oc.columns(["plugin", "item_id"]).doNothing())
-                    .execute();
-            }
-            if (row && row.package_name !== pkg.package_name) {
-                throw new ApiError("extension.name_conflict", `Extension ${name} is already installed from package ${row.package_name}; package ${pkg.package_name} uses the same extension name`);
-            }
-            // Ruling P3：插件名归第一次安装它的 npm 包（卸载不删），别的包不能接手（数据、密钥与批准都还在）。
-            // 还没有归属、却已有这个名字留下的快照 / 部署配置 / 组织配置（I4：如归属表之前就有的配置声明插件）：
-            // 不知道它们属于哪个包，同样拒绝
-            const owned = await trx
-                .selectFrom("extension_name_owners")
-                .select("package_name")
-                .where("name", "=", name)
-                .executeTakeFirst();
-            if (!owned && (await hasRetainedData(trx, name))) {
-                throw new ApiError("extension.name_conflict", `Extension name ${name} already has retained data (permission approval, deployment config or organization settings) from an extension that is not installed here, and no package owns the name; package ${pkg.package_name} cannot take it over. Remove that data or use a different extension name`);
-            }
-            await trx
-                .insertInto("extension_name_owners")
-                .values({ name, package_name: pkg.package_name })
-                .onConflict((oc) => oc.column("name").doNothing())
+        const changed = await this.writeInstall(name, sha256, pkg, target, actor, actorTokenId, opts);
+        const view = await this.viewAfterCommit(name, {
+            version: pkg.version,
+            sha256,
+            state: changed.state,
+        });
+        if (changed.leftDisabled === undefined)
+            return view;
+        this.log.info("extension upgraded but left disabled: its single-provider extension point is taken", {
+            plugin: name,
+            details: changed.leftDisabled.singleProvider,
+        });
+        return { ...view, leftDisabled: changed.leftDisabled };
+    }
+    async writeInstall(name, sha256, pkg, target, actor, actorTokenId, opts) {
+        const db = this.db;
+        await this.authorize(actor, opts.owner);
+        const row = await this.lockRow(name);
+        // 不经目录重装时保留原来的来源条目（不清空，C22）
+        const catalogItemId = opts.catalogItemId ?? row?.catalog_item_id ?? null;
+        if (opts.catalogItemId !== undefined) {
+            await db
+                .insertInto("extension_catalog_sources")
+                .values({ plugin: name, item_id: opts.catalogItemId })
+                .onConflict((oc) => oc.columns(["plugin", "item_id"]).doNothing())
                 .execute();
-            const owner = await trx
-                .selectFrom("extension_name_owners")
-                .select("package_name")
-                .where("name", "=", name)
-                .executeTakeFirstOrThrow();
-            if (owner.package_name !== pkg.package_name) {
-                throw new ApiError("extension.name_conflict", `Extension name ${name} was previously used by package ${owner.package_name}; its data, secrets and permission approval are retained for that package, so package ${pkg.package_name} cannot take over the name`);
+        }
+        if (row && row.package_name !== pkg.package_name) {
+            throw new ApiError("extension.name_conflict", `Extension ${name} is already installed from package ${row.package_name}; package ${pkg.package_name} uses the same extension name`);
+        }
+        // Ruling P3：插件名归第一次安装它的 npm 包（卸载不删），别的包不能接手（数据、密钥与批准都还在）。
+        // 还没有归属、却已有这个名字留下的快照 / 部署配置 / 组织配置（I4：如归属表之前就有的配置声明插件）：
+        // 不知道它们属于哪个包，同样拒绝
+        const owned = await db
+            .selectFrom("extension_name_owners")
+            .select("package_name")
+            .where("name", "=", name)
+            .executeTakeFirst();
+        if (!owned && (await hasRetainedData(db, name))) {
+            throw new ApiError("extension.name_conflict", `Extension name ${name} already has retained data (permission approval, deployment config or organization settings) from an extension that is not installed here, and no package owns the name; package ${pkg.package_name} cannot take it over. Remove that data or use a different extension name`);
+        }
+        await db
+            .insertInto("extension_name_owners")
+            .values({ name, package_name: pkg.package_name })
+            .onConflict((oc) => oc.column("name").doNothing())
+            .execute();
+        const owner = await db
+            .selectFrom("extension_name_owners")
+            .select("package_name")
+            .where("name", "=", name)
+            .executeTakeFirstOrThrow();
+        if (owner.package_name !== pkg.package_name) {
+            throw new ApiError("extension.name_conflict", `Extension name ${name} was previously used by package ${owner.package_name}; its data, secrets and permission approval are retained for that package, so package ${pkg.package_name} cannot take over the name`);
+        }
+        // 已指向同一个包：什么都不改，降级视图仍给出真实的期望状态
+        if (row?.sha256 === sha256) {
+            if (row.catalog_item_id !== catalogItemId) {
+                // 包没变、只有来源条目变了：照样留审计（来源变化影响 T26 的目录策略约束）
+                await db
+                    .updateTable("extension_installs")
+                    .set({ catalog_item_id: catalogItemId })
+                    .where("name", "=", name)
+                    .execute();
+                await this.audit(actor, actorTokenId, "extension.install_source_changed", name, pkg.version, sha256, { catalogItemId, previousCatalogItemId: row.catalog_item_id });
             }
-            // 已指向同一个包：什么都不改，降级视图仍给出真实的期望状态
-            if (row?.sha256 === sha256) {
-                if (row.catalog_item_id !== catalogItemId) {
-                    // 包没变、只有来源条目变了：照样留审计（来源变化影响 T26 的目录策略约束）
-                    await trx
-                        .updateTable("extension_installs")
-                        .set({ catalog_item_id: catalogItemId })
-                        .where("name", "=", name)
-                        .execute();
-                    await this.audit(trx, actor, actorTokenId, "extension.install_source_changed", name, pkg.version, sha256, { catalogItemId, previousCatalogItemId: row.catalog_item_id });
-                }
-                return { changed: false, state: row.desired_state };
+            return { changed: false, state: row.desired_state };
+        }
+        if (row && isDowngrade(pkg.version, row.version)) {
+            const unrun = await unrunMigrations(db, name, target.migrationSql);
+            if (unrun.length > 0) {
+                throw new ApiError("extension.downgrade_unsupported", `Extension ${name} ${pkg.version} has migrations that were never run here (${unrun.join(", ")}); extension migrations only expand, so downgrade only to a version whose migrations have all been applied`, unrun.map((file) => ({ file })));
             }
-            if (row && isDowngrade(pkg.version, row.version)) {
-                const unrun = await unrunMigrations(trx, name, target.migrationSql);
-                if (unrun.length > 0) {
-                    throw new ApiError("extension.downgrade_unsupported", `Extension ${name} ${pkg.version} has migrations that were never run here (${unrun.join(", ")}); extension migrations only expand, so downgrade only to a version whose migrations have all been applied`, unrun.map((file) => ({ file })));
-                }
+        }
+        // An enabled extension whose new version newly provides a single-provider point another one
+        // holds: installed disabled (the provider running keeps the point), and the result says why
+        let leftDisabled;
+        if (row?.desired_state === "enabled") {
+            const before = new Set(providesOf(row.section));
+            const added = providesOf(pkg.section).filter((p) => !before.has(p));
+            const block = await this.singleProvider.lockedOccupant(name, added);
+            if (block) {
+                leftDisabled = await this.singleProvider.note(block, name);
+                await db
+                    .updateTable("extension_installs")
+                    .set({ desired_state: "disabled", enabled_at: null })
+                    .where("name", "=", name)
+                    .execute();
+                await this.audit(actor, actorTokenId, "extension.disabled", name, row.version, row.sha256, {
+                    singleProvider: block,
+                    ...ownerDetail(opts.owner),
+                });
             }
-            await trx
-                .insertInto("extension_installs")
-                .values({
-                name,
-                sha256,
-                version: pkg.version,
-                source: pkg.source,
-                desired_state: "disabled",
-                installed_by: actor,
-                updated_by: actor,
-                catalog_item_id: catalogItemId,
-            })
-                .onConflict((oc) => oc.column("name").doUpdateSet({
-                sha256,
-                version: pkg.version,
-                source: pkg.source,
-                updated_by: actor,
-                catalog_item_id: catalogItemId,
-                updated_at: sql `now()`,
-            }))
-                .execute();
-            await this.audit(trx, actor, actorTokenId, "extension.installed", name, pkg.version, sha256, {
-                catalogItemId,
-            });
-            return { changed: true, state: row?.desired_state ?? "disabled" };
+        }
+        await db
+            .insertInto("extension_installs")
+            .values({
+            name,
+            sha256,
+            version: pkg.version,
+            source: pkg.source,
+            desired_state: "disabled",
+            installed_by: actor,
+            updated_by: actor,
+            catalog_item_id: catalogItemId,
+        })
+            .onConflict((oc) => oc.column("name").doUpdateSet({
+            sha256,
+            version: pkg.version,
+            source: pkg.source,
+            updated_by: actor,
+            catalog_item_id: catalogItemId,
+            updated_at: sql `now()`,
+        }))
+            .execute();
+        await this.audit(actor, actorTokenId, "extension.installed", name, pkg.version, sha256, {
+            catalogItemId,
+            ...ownerDetail(opts.owner),
         });
-        if (changed.changed)
-            await this.notify(name);
-        return this.viewAfterCommit(name, { version: pkg.version, sha256, state: changed.state });
+        afterCommit(() => this.notify(name));
+        if (leftDisabled !== undefined)
+            return { changed: true, state: "disabled", leftDisabled };
+        return { changed: true, state: row?.desired_state ?? "disabled" };
     }
-    /** Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org enablement is unchanged. */
-    enable(name, actor, actorTokenId) {
-        return this.setState(name, "enabled", actor, actorTokenId);
+    /**
+     * Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org
+     * enablement is unchanged. Another enabled extension providing one of its single-provider
+     * extension points -> 409 `extension.single_provider_enabled` (the super admin disables that one
+     * first; checked under the point's lock, see {@link SingleProviderGuard}).
+     */
+    enable(name, actor, actorTokenId, owner, 
+    /** Merged into the audit detail (a write made through the Platform tool). */
+    auditDetail) {
+        return this.setState(name, "enabled", actor, actorTokenId, owner, auditDetail);
+    }
+    /**
+     * The enable of an install or import path: like {@link enable}, but an occupied single-provider
+     * extension point leaves the extension disabled instead of failing, and returns the refusal
+     * (`enabled: false`) for the caller to report. Every other error is thrown.
+     */
+    async enableUnlessOccupied(name, actor, actorTokenId, owner) {
+        try {
+            await this.enable(name, actor, actorTokenId, owner);
+            return { enabled: true };
+        }
+        catch (e) {
+            if (e instanceof ApiError && isSingleProviderCode(e.code)) {
+                this.log.info("extension installed disabled: its single-provider extension point is taken", {
+                    plugin: name,
+                    details: e.details,
+                });
+                return { enabled: false, refusal: e, note: singleProviderNote(e) };
+            }
+            throw e;
+        }
     }
     /**
      * Disables on the deployment (audit `extension.disabled`); no change when already disabled. Every
@@ -171,8 +303,8 @@ export class ExtensionAdminOps {
      * it; the org enablement switch is unchanged and the org page shows it as unavailable. A required
      * bootstrap plugin -> `extension.required`.
      */
-    disable(name, actor, actorTokenId) {
-        return this.setState(name, "disabled", actor, actorTokenId);
+    disable(name, actor, actorTokenId, owner, auditDetail) {
+        return this.setState(name, "disabled", actor, actorTokenId, owner, auditDetail);
     }
     /**
      * Uninstall: a required bootstrap plugin -> `extension.required`; must be disabled first
@@ -182,84 +314,110 @@ export class ExtensionAdminOps {
      * permission snapshot and the package in the package store are untouched (a reinstall picks them
      * up).
      */
-    async uninstall(name, actor, actorTokenId) {
+    async uninstall(name, actor, actorTokenId, owner, auditDetail) {
         this.assertInstallable(name);
-        await this.d.db.transaction().execute(async (trx) => {
-            if (actor !== null)
-                await lockEnterpriseAdminsAndAuthorize(trx, actor);
-            const row = await this.lockRow(trx, name);
-            if (!row)
-                throw notFound(name);
-            if (row.required)
-                throw required(name);
-            if (row.desired_state !== "disabled") {
-                throw new ApiError("extension.not_disabled", `Extension ${name} is enabled; disable it before uninstalling`);
-            }
-            await trx.deleteFrom("extension_installs").where("name", "=", name).execute();
-            // 来源条目随安装记录一起删：之后不经目录重新安装时不再受旧条目的策略约束（T26 裁决）
-            await trx.deleteFrom("extension_catalog_sources").where("plugin", "=", name).execute();
-            await this.audit(trx, actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256);
+        await this.writeUninstall(name, actor, actorTokenId, owner, auditDetail);
+    }
+    async writeUninstall(name, actor, actorTokenId, owner, auditDetail) {
+        const db = this.db;
+        await this.authorize(actor, owner);
+        const row = await this.lockRow(name);
+        if (!row)
+            throw notFound(name);
+        if (row.required)
+            throw required(name);
+        if (row.desired_state !== "disabled") {
+            throw new ApiError("extension.not_disabled", `Extension ${name} is enabled; disable it before uninstalling`);
+        }
+        await db.deleteFrom("extension_installs").where("name", "=", name).execute();
+        // 来源条目随安装记录一起删：之后不经目录重新安装时不再受旧条目的策略约束（T26 裁决）
+        await db.deleteFrom("extension_catalog_sources").where("plugin", "=", name).execute();
+        await this.audit(actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256, {
+            ...ownerDetail(owner),
+            ...auditDetail,
         });
-        await this.notify(name);
+        afterCommit(() => this.notify(name));
     }
-    async setState(name, state, actor, actorTokenId) {
+    async setState(name, state, actor, actorTokenId, owner, auditDetail) {
         this.assertInstallable(name);
-        const result = await this.d.db.transaction().execute(async (trx) => {
-            if (actor !== null)
-                await lockEnterpriseAdminsAndAuthorize(trx, actor);
-            const row = await this.lockRow(trx, name);
-            if (!row)
-                throw notFound(name);
-            if (state === "disabled" && row.required)
-                throw required(name);
-            if (row.desired_state === state)
-                return { row, changed: false };
-            await trx
-                .updateTable("extension_installs")
-                .set({
-                desired_state: state,
-                updated_by: actor,
-                updated_at: sql `now()`,
-            })
-                .where("name", "=", name)
-                .execute();
-            await this.audit(trx, actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256);
-            return { row, changed: true };
-        });
-        if (result.changed)
-            await this.notify(name);
+        const result = await this.writeState(name, state, actor, actorTokenId, owner, auditDetail);
         return this.viewAfterCommit(name, {
             version: result.row.version,
             sha256: result.row.sha256,
             state,
         });
     }
+    async writeState(name, state, actor, actorTokenId, owner, auditDetail) {
+        const db = this.db;
+        await this.authorize(actor, owner);
+        const row = await this.lockRow(name);
+        if (!row)
+            throw notFound(name);
+        if (state === "disabled" && row.required)
+            throw required(name);
+        if (row.desired_state === state)
+            return { row, changed: false };
+        if (state === "enabled") {
+            await this.singleProvider.assertFree(name, providesOf(row.section));
+        }
+        await db
+            .updateTable("extension_installs")
+            .set({
+            desired_state: state,
+            // When it became enabled: the earliest enabled of two providers of a single-provider point
+            // is the one replicas load (only state left from before a second enable was refused)
+            enabled_at: state === "enabled" ? sql `now()` : null,
+            updated_by: actor,
+            updated_at: sql `now()`,
+        })
+            .where("name", "=", name)
+            .execute();
+        await this.audit(actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256, { ...ownerDetail(owner), ...auditDetail });
+        afterCommit(() => this.notify(name));
+        return { row, changed: true };
+    }
     /**
      * 提交后的视图：拼视图失败（读包、查状态行出错）时操作已经生效，不能再报失败——记 error，返回降级视图。
      */
     async viewAfterCommit(name, known) {
         try {
-            return await this.d.view(name);
+            return await this.admin.get(name, { allowUnreadable: true });
         }
         catch (err) {
-            this.d.log.error("plugin change committed, but its admin view cannot be built", {
+            this.log.error("plugin change committed, but its admin view cannot be built", {
                 plugin: name,
                 err,
             });
             return fallbackView(name, known, err);
         }
     }
+    /**
+     * Re-checks the actor in the operation's transaction: a super admin, or for an owner's operation
+     * an admin of the owner org; no account (the CLI, the kernel itself) is not checked.
+     */
+    async authorize(actor, owner) {
+        if (owner?.rollback === true)
+            return;
+        if (owner !== undefined) {
+            if (actor === null)
+                throw new Error("an owner's extension operation has an actor");
+            await this.orgLock.lockAndAuthorize(owner.orgId, actor, "catalog.upload");
+        }
+        else if (actor !== null) {
+            await this.adminLock.lockAndAuthorize(actor);
+        }
+    }
     /** 配置声明的插件不经安装记录管理。 */
     assertInstallable(name) {
-        const declared = this.d.declared().get(name);
+        const declared = this.registry.declared().get(name);
         if (declared === "config") {
             throw new ApiError("extension.config_declared", `Extension ${name} is declared in the startup config (extensions); change that list and restart instead`);
         }
     }
-    /** 按插件名串行（咨询锁，覆盖「还没有行」的新装），再锁住已有的安装记录行。 */
-    async lockRow(trx, name) {
-        await sql `SELECT pg_advisory_xact_lock(hashtext(${`capybara.plugin-install:${name}`}))`.execute(trx);
-        return trx
+    /** 按插件名串行（`PluginInstallLock`，覆盖「还没有行」的新装），再锁住已有的安装记录行。 */
+    async lockRow(name) {
+        await this.installLock.lock(name);
+        return this.db
             .selectFrom("extension_installs")
             .innerJoin("extension_packages", "extension_packages.sha256", "extension_installs.sha256")
             .select([
@@ -269,13 +427,14 @@ export class ExtensionAdminOps {
             "extension_installs.catalog_item_id",
             "extension_installs.required",
             "extension_packages.package_name",
+            "extension_packages.section",
         ])
             .where("extension_installs.name", "=", name)
             .forUpdate("extension_installs")
             .executeTakeFirst();
     }
-    async audit(trx, actor, actorTokenId, action, name, version, sha256, extra = {}) {
-        await audit(trx, {
+    async audit(actor, actorTokenId, action, name, version, sha256, extra = {}) {
+        await audit(this.db, {
             ...(actor !== null && { actorAccountId: actor }),
             ...(actorTokenId !== undefined && { actorTokenId }),
             action,
@@ -286,22 +445,56 @@ export class ExtensionAdminOps {
     /** 提交后通知各副本；发布失败只告警（周期 reconcile 兜底），本副本自己先 reconcile。 */
     async notify(name) {
         try {
-            await this.d.bus.publish(PLUGINS_CHANGED_TOPIC, { plugin: name });
+            await this.bus.publish(PLUGINS_CHANGED_TOPIC, { plugin: name });
         }
         catch (err) {
-            this.d.log.warn("cannot publish plugins.changed; replicas converge on the next periodic reconcile", { plugin: name, err });
-            this.d
-                .reconcile?.(`changed:${name}`)
-                .catch((e) => this.d.log.error("plugin reconcile failed", { plugin: name, err: e }));
+            this.log.warn("cannot publish plugins.changed; replicas converge on the next periodic reconcile", { plugin: name, err });
+            this.lifecycle
+                .reconcile(`changed:${name}`)
+                .catch((e) => this.log.error("plugin reconcile failed", { plugin: name, err: e }));
         }
     }
-}
+};
+__decorate([
+    Transactional()
+], ExtensionAdminOps.prototype, "writeInstall", null);
+__decorate([
+    Transactional()
+], ExtensionAdminOps.prototype, "writeUninstall", null);
+__decorate([
+    Transactional()
+], ExtensionAdminOps.prototype, "writeState", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ExtensionAdminOps.prototype, "authorize", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ExtensionAdminOps.prototype, "lockRow", null);
+ExtensionAdminOps = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(SuperAdminLock)),
+    __param(3, Inject(OrgLock)),
+    __param(4, Inject(PluginInstallLock)),
+    __param(5, Inject(ExtensionAdmin)),
+    __param(6, Inject(ExtensionRegistry)),
+    __param(7, Inject(ExtensionBlobs)),
+    __param(8, Inject(KernelConfigService)),
+    __param(9, Inject(KERNEL_BUS)),
+    __param(10, Inject(ExtensionLifecycle)),
+    __param(11, Inject(KERNEL_LOGGER)),
+    __param(12, Inject(SingleProviderGuard))
+], ExtensionAdminOps);
+export { ExtensionAdminOps };
 /**
  * 拼不出视图时的降级项（与后台列表里包读不到的项同形：status failed、权限为空、带 `error`）。
  */
 function fallbackView(name, known, err) {
     return {
         name,
+        // the degraded item reads nothing more (the read that failed may be the database)
+        displayName: null,
         version: known.version,
         source: "install",
         sha256: known.sha256,
@@ -322,24 +515,27 @@ function fallbackView(name, known, err) {
         configValid: true,
         removable: true,
         required: false,
+        scope: null,
+        enabledOrgs: 0,
+        builtin: false,
         installSource: null,
         error: `the change was saved, but its current status cannot be read: ${err instanceof Error ? err.message : String(err)}`,
     };
 }
 /** 插件名已留下的数据：权限快照、部署配置、任一组织的配置，或插件 schema（`plugin_<name>`）。 */
-async function hasRetainedData(trx, name) {
-    const schema = await sql `SELECT 1 AS x FROM pg_namespace WHERE nspname = ${pluginSchemaName(name)}`.execute(trx);
+async function hasRetainedData(db, name) {
+    const schema = await sql `SELECT 1 AS x FROM pg_namespace WHERE nspname = ${pluginSchemaName(name)}`.execute(db);
     if (schema.rows.length > 0)
         return true;
-    const hit = await trx
+    const hit = await db
         .selectFrom("extension_permission_snapshots")
         .select(sql `1`.as("x"))
         .where("plugin", "=", name)
-        .union(trx
+        .union(db
         .selectFrom("extension_deployment_configs")
         .select(sql `1`.as("x"))
         .where("plugin", "=", name))
-        .union(trx
+        .union(db
         .selectFrom("extension_org_configs")
         .select(sql `1`.as("x"))
         .where("plugin", "=", name))
@@ -347,7 +543,17 @@ async function hasRetainedData(trx, name) {
         .executeTakeFirst();
     return hit !== undefined;
 }
-const required = (name) => new ApiError("extension.required", `Extension ${name} is required by this deployment (a bootstrap plugin): it is enabled in every organization and cannot be disabled or uninstalled; an enterprise admin can upgrade it`);
+const required = (name) => new ApiError("extension.required", `Extension ${name} is required by this deployment (a bootstrap plugin): it is enabled in every organization and cannot be disabled or uninstalled; a super admin can upgrade it`);
 const notFound = (name) => new ApiError("extension.not_found", `Extension ${name} is not installed in this deployment`);
 /** `to` 比 `from` 旧（任一方不是合法 semver 时不算降级）。 */
 const isDowngrade = (to, from) => semver.valid(to) !== null && semver.valid(from) !== null && semver.lt(to, from);
+/** The extension points a stored package's reviewed manifest provides. */
+function providesOf(section) {
+    return section?.manifest?.provides ?? [];
+}
+/** The audit detail of an owner's operation. */
+function ownerDetail(owner) {
+    if (owner === undefined)
+        return {};
+    return { ownerOrgId: owner.orgId, ...(owner.rollback === true && { rollback: true }) };
+}