@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.10

package/dist/extensions/admin-view.d.ts

@@ -1,10 +1,20 @@
-import type { KernelConfig } from "../config/schema.js";
-import type { KernelDb } from "../db/kernel-schema.js";
-import type { ExtensionBlobs } from "./blobs.js";
-import type { DeclaredExtensionInfo } from "./host.js";
-import type { ExtensionInstalls } from "./installs.js";
-import { PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
+import { ExtensionApprovals } from "./approvals.js";
+import { ExtensionBlobs } from "./blobs.js";
+import { ExtensionDeploymentConfigService } from "./deployment-config.js";
+import { ExtensionDisplayNames } from "./display-name.js";
+import { EffectiveConfigs } from "./effective-config.js";
+import { ExtensionHost } from "./host.js";
+import { ExtensionInstalls } from "./installs.js";
+import { ExtensionLifecycle, PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
+import { PluginApproveLock } from "./locks.js";
 import { type AdminExtensionView } from "./permission-view.js";
+import { PluginIcons } from "./plugin-icons.js";
+import { SingleProviderGuard } from "./single-provider.js";
 export { PLUGINS_CHANGED_TOPIC };
 /** The web approval request body (`POST /api/v1/admin/extensions/:name/approve`). */
 export interface ApproveBody {
@@ -12,36 +22,62 @@ export interface ApproveBody {
     sha256: string | null;
     reviewHash: string;
 }
-export interface ExtensionAdminDeps {
-    db: KernelDb;
-    blobs: Pick<ExtensionBlobs, "get">;
-    installs: ExtensionInstalls;
-    config: () => KernelConfig;
-    host: {
-        declaredPlugins(): DeclaredExtensionInfo[];
-    };
-    /**
-     * 本副本 reconcile（批准后等它完成再返回视图；其他副本经 `kernel.plugins.changed` 收敛）。CLI 没有（只发布）。
-     */
-    reconcile?: (reason: string) => Promise<void>;
-    bus: {
-        publish(topic: string, payload: unknown): Promise<void>;
-    };
-    log: {
-        warn(msg: string, fields?: Record<string, unknown>): void;
-        error(msg: string, fields?: Record<string, unknown>): void;
-    };
+/** The kernel bus as the admin operations use it (publish only). */
+export interface PublishBus {
+    publish(topic: string, payload: unknown): Promise<void>;
 }
 /**
- * 部署级插件后台（企业管理员）：列表 / 详情与网页批准权限（D8）。无状态，多副本共用；
+ * 部署级插件后台（超级管理员）：列表 / 详情与网页批准权限（D8）。无状态，多副本共用；
  * 状态由 PG（安装记录、快照、各副本状态行）与本副本宿主（配置声明插件的清单）推出。
  */
 export declare class ExtensionAdmin {
-    private readonly d;
+    private readonly kdb;
+    readonly txHost: TransactionHost;
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    private readonly adminLock;
+    private readonly approveLock;
+    private readonly blobs;
+    private readonly installs;
+    private readonly approvals;
+    /** The config-declared extensions (this replica's host; the CLI fills it from its inspection). */
+    private readonly host;
+    /** This replica's reconcile after an approval (a no-op where the lifecycle never started: the CLI). */
+    private readonly lifecycle;
+    private readonly config;
+    private readonly bus;
+    private readonly log;
+    private readonly displayNames;
+    /** Which required overridable fields the platform left empty (spec A §5.4a). */
+    private readonly deploymentConfig;
+    /** How many orgs still need their own config for such an extension. */
+    private readonly effectiveConfigs;
+    /** Which enabled extension keeps a disabled one from being enabled (`enableBlocked`). */
+    private readonly singleProvider;
+    /** The plugins' icons (admin catalog routes). */
+    private readonly icons;
     private readonly packageSets;
-    constructor(d: ExtensionAdminDeps);
-    /** 全部插件（配置声明 → 安装记录，各自按名字）。 */
-    list(): Promise<AdminExtensionView[]>;
+    constructor(kdb: KernelDb, txHost: TransactionHost, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock: SuperAdminLock, approveLock: PluginApproveLock, blobs: ExtensionBlobs, installs: ExtensionInstalls, approvals: ExtensionApprovals, 
+    /** The config-declared extensions (this replica's host; the CLI fills it from its inspection). */
+    host: ExtensionHost, 
+    /** This replica's reconcile after an approval (a no-op where the lifecycle never started: the CLI). */
+    lifecycle: ExtensionLifecycle, config: KernelConfigService, bus: PublishBus, log: KernelLogger, displayNames: ExtensionDisplayNames, 
+    /** Which required overridable fields the platform left empty (spec A §5.4a). */
+    deploymentConfig: ExtensionDeploymentConfigService, 
+    /** How many orgs still need their own config for such an extension. */
+    effectiveConfigs: EffectiveConfigs, 
+    /** Which enabled extension keeps a disabled one from being enabled (`enableBlocked`). */
+    singleProvider: SingleProviderGuard, 
+    /** The plugins' icons (admin catalog routes). */
+    icons: PluginIcons);
+    private get db();
+    /**
+     * Every extension (config-declared, then install records, each by name). With `names`, only
+     * those: no other package is read, so a caller that needs a few items (the catalog's pending
+     * check) neither pays for nor logs about the packages of unrelated extensions.
+     */
+    list(names?: ReadonlySet<string>): Promise<AdminExtensionView[]>;
     /**
      * A single extension; unknown -> `extension.not_found`; package unreadable ->
      * `extension.package_unavailable`. With `allowUnreadable` an unreadable package returns the same
@@ -54,7 +90,12 @@ export declare class ExtensionAdmin {
         allowUnreadable?: boolean;
     }): Promise<AdminExtensionView>;
     /**
-     * Web approval: re-checks the enterprise admin under the lock, compares the reviewed package
+     * The review digest of a stored package (the `reviewHash` its extension would show once
+     * installed); null when the package cannot be read.
+     */
+    packageReviewHash(sha256: string): Promise<string | null>;
+    /**
+     * Web approval: re-checks the super admin under the lock, compares the reviewed package
      * (`sha256`) and permission digest (`reviewHash`), writes the snapshot (source web) and the
      * `extension.permissions_approved` audit; after the commit publishes `kernel.plugins.changed` (a
      * failure only warns) and waits for one reconcile on this replica (other replicas converge through
@@ -64,16 +105,25 @@ export declare class ExtensionAdmin {
      *   recomputed now -> `extension.approval_stale`; a config-declared extension's `sha256` must be
      *   null (otherwise `validation_failed`);
      * - the snapshot already covers the current permission set (nothing to approve, F-N) ->
-     *   `extension.not_pending`.
+     *   `extension.not_pending`, except with `confirmBootstrap` when the snapshot is the bootstrap
+     *   step's (the catalog's confirm re-writes it with source web).
      */
     approve(actor: string, name: string, body: ApproveBody, opts?: {
         actorTokenId?: string;
+        confirmBootstrap?: boolean;
     }): Promise<AdminExtensionView>;
+    private writeApproval;
     /** 配置声明 → 安装记录（与配置声明重名的安装记录不生效，不单列）。`only` 给出时只取这一个。 */
     private subjects;
     /**
      * 包的权限集合（静态清单 + 迁移 SQL，与上传时的审阅相同）、迁移审阅警告与是否有部署级配置字段；按 sha256 缓存。
      */
     private packageInfo;
+    /**
+     * For each configurable, readable extension whose platform config leaves required overridable
+     * fields empty (spec A §5.4a): the number of orgs still needing their own config. Extensions
+     * without overridable fields cost no read.
+     */
+    private orgsNeedingConfig;
     private views;
 }

package/dist/extensions/admin-view.js

@@ -1,12 +1,39 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { SDK_VERSION } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ApiError } from "../errors.js";
-import { lockEnterpriseAdminsAndAuthorize } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
 import { ExtensionApprovals, snapshotCovers, writeSnapshot, } from "./approvals.js";
-import { PLUGINS_CHANGED_TOPIC, STALE_RECONCILE_PERIODS } from "./lifecycle.js";
+import { ExtensionBlobs } from "./blobs.js";
+import { ExtensionDeploymentConfigService } from "./deployment-config.js";
+import { ExtensionDisplayNames } from "./display-name.js";
+import { EffectiveConfigs } from "./effective-config.js";
+import { enabledExtensionsByOrg } from "./enabled.js";
+import { ExtensionHost } from "./host.js";
+import { ExtensionInstalls } from "./installs.js";
+import { ExtensionLifecycle, PLUGINS_CHANGED_TOPIC, STALE_RECONCILE_PERIODS } from "./lifecycle.js";
+import { PluginApproveLock } from "./locks.js";
 import { ExtensionPackageError, permissionSetOfPackage, readExtensionPackage } from "./package.js";
 import { buildPermissionSet, diffPermissions } from "./permission-set.js";
 import { deriveExtensionStatus, migrationWarnings, permissionGroups, permissionKeyItems, reviewHash, } from "./permission-view.js";
+import { PluginIcons } from "./plugin-icons.js";
+import { pluginItemsOf } from "./plugin-items.js";
+import { parseProviderConflict } from "./resolve.js";
+import { SingleProviderGuard } from "./single-provider.js";
 export { PLUGINS_CHANGED_TOPIC };
 /** 内容寻址的包 → 权限集合（包不可变，缓存安全；只作缓存，不是跨副本状态）。 */
 const PACKAGE_SET_CACHE_MAX = 256;
@@ -28,18 +55,71 @@ function assertReadable(s) {
     }
 }
 /**
- * 部署级插件后台（企业管理员）：列表 / 详情与网页批准权限（D8）。无状态，多副本共用；
+ * 部署级插件后台（超级管理员）：列表 / 详情与网页批准权限（D8）。无状态，多副本共用；
  * 状态由 PG（安装记录、快照、各副本状态行）与本副本宿主（配置声明插件的清单）推出。
  */
-export class ExtensionAdmin {
-    d;
+let ExtensionAdmin = class ExtensionAdmin {
+    kdb;
+    txHost;
+    adminLock;
+    approveLock;
+    blobs;
+    installs;
+    approvals;
+    host;
+    lifecycle;
+    config;
+    bus;
+    log;
+    displayNames;
+    deploymentConfig;
+    effectiveConfigs;
+    singleProvider;
+    icons;
     packageSets = new Map();
-    constructor(d) {
-        this.d = d;
+    constructor(kdb, txHost, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock, approveLock, blobs, installs, approvals, 
+    /** The config-declared extensions (this replica's host; the CLI fills it from its inspection). */
+    host, 
+    /** This replica's reconcile after an approval (a no-op where the lifecycle never started: the CLI). */
+    lifecycle, config, bus, log, displayNames, 
+    /** Which required overridable fields the platform left empty (spec A §5.4a). */
+    deploymentConfig, 
+    /** How many orgs still need their own config for such an extension. */
+    effectiveConfigs, 
+    /** Which enabled extension keeps a disabled one from being enabled (`enableBlocked`). */
+    singleProvider, 
+    /** The plugins' icons (admin catalog routes). */
+    icons) {
+        this.kdb = kdb;
+        this.txHost = txHost;
+        this.adminLock = adminLock;
+        this.approveLock = approveLock;
+        this.blobs = blobs;
+        this.installs = installs;
+        this.approvals = approvals;
+        this.host = host;
+        this.lifecycle = lifecycle;
+        this.config = config;
+        this.bus = bus;
+        this.log = log;
+        this.displayNames = displayNames;
+        this.deploymentConfig = deploymentConfig;
+        this.effectiveConfigs = effectiveConfigs;
+        this.singleProvider = singleProvider;
+        this.icons = icons;
     }
-    /** 全部插件（配置声明 → 安装记录，各自按名字）。 */
-    async list() {
-        const subjects = await this.subjects();
+    get db() {
+        return this.kdb.db;
+    }
+    /**
+     * Every extension (config-declared, then install records, each by name). With `names`, only
+     * those: no other package is read, so a caller that needs a few items (the catalog's pending
+     * check) neither pays for nor logs about the packages of unrelated extensions.
+     */
+    async list(names) {
+        const subjects = await this.subjects(undefined, names);
         return this.views(subjects);
     }
     /**
@@ -59,7 +139,20 @@ export class ExtensionAdmin {
         return (await this.views([s]))[0];
     }
     /**
-     * Web approval: re-checks the enterprise admin under the lock, compares the reviewed package
+     * The review digest of a stored package (the `reviewHash` its extension would show once
+     * installed); null when the package cannot be read.
+     */
+    async packageReviewHash(sha256) {
+        try {
+            const { set, warnings } = await this.packageInfo(sha256);
+            return reviewHash(set, warnings);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Web approval: re-checks the super admin under the lock, compares the reviewed package
      * (`sha256`) and permission digest (`reviewHash`), writes the snapshot (source web) and the
      * `extension.permissions_approved` audit; after the commit publishes `kernel.plugins.changed` (a
      * failure only warns) and waits for one reconcile on this replica (other replicas converge through
@@ -69,7 +162,8 @@ export class ExtensionAdmin {
      *   recomputed now -> `extension.approval_stale`; a config-declared extension's `sha256` must be
      *   null (otherwise `validation_failed`);
      * - the snapshot already covers the current permission set (nothing to approve, F-N) ->
-     *   `extension.not_pending`.
+     *   `extension.not_pending`, except with `confirmBootstrap` when the snapshot is the bootstrap
+     *   step's (the catalog's confirm re-writes it with source web).
      */
     async approve(actor, name, body, opts = {}) {
         const s = (await this.subjects(name))[0];
@@ -84,62 +178,65 @@ export class ExtensionAdmin {
             throw stale();
         if (body.reviewHash !== reviewHash(s.set, s.warnings))
             throw stale();
-        await this.d.db.transaction().execute(async (trx) => {
-            await lockEnterpriseAdminsAndAuthorize(trx, actor);
-            await sql `SELECT pg_advisory_xact_lock(hashtext(${`capybara.plugin-approve:${name}`}))`.execute(trx);
-            if (s.install !== null) {
-                // 审阅之后安装记录可能已换包（T14 升级）：锁行复核
-                const row = await trx
-                    .selectFrom("extension_installs")
-                    .select("sha256")
-                    .where("name", "=", name)
-                    .forUpdate()
-                    .executeTakeFirst();
-                if (row?.sha256 !== s.install.sha256)
-                    throw stale();
-            }
-            const snapRow = await trx
-                .selectFrom("extension_permission_snapshots")
-                .select(["version", "permissions"])
-                .where("plugin", "=", name)
-                .forUpdate()
-                .executeTakeFirst();
-            const snap = snapRow && {
-                version: snapRow.version,
-                permissions: snapRow.permissions,
-            };
-            if (snapshotCovers(snap, s.set)) {
-                throw new ApiError("extension.not_pending", `Extension ${name} ${s.version} has no new permissions awaiting approval`);
-            }
-            const { added, removed } = diffPermissions(snap?.permissions, s.set);
-            await writeSnapshot(trx, name, s.version, s.set, {
-                source: "web",
-                approvedBy: actor,
-                ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                audit: { added, removed, sha256: s.install?.sha256 ?? null },
-            });
-        });
+        await this.writeApproval(actor, name, s, opts.actorTokenId, stale, opts.confirmBootstrap === true);
         try {
-            await this.d.bus.publish(PLUGINS_CHANGED_TOPIC, { plugin: name });
+            await this.bus.publish(PLUGINS_CHANGED_TOPIC, { plugin: name });
         }
         catch (err) {
             // 快照已写入；其他副本由周期 reconcile（T14）兜底
-            this.d.log.warn("cannot publish plugins.changed after approval", { plugin: name, err });
+            this.log.warn("cannot publish plugins.changed after approval", { plugin: name, err });
         }
         try {
-            await this.d.reconcile?.(`approved:${name}`);
+            await this.lifecycle.reconcile(`approved:${name}`);
         }
         catch (err) {
-            this.d.log.error("loading approved plugins on this replica failed", { plugin: name, err });
+            this.log.error("loading approved plugins on this replica failed", { plugin: name, err });
         }
         return this.get(name);
     }
+    async writeApproval(actor, name, s, actorTokenId, stale, confirmBootstrap) {
+        const db = this.db;
+        await this.adminLock.lockAndAuthorize(actor);
+        await this.approveLock.lock(name);
+        if (s.install !== null) {
+            // 审阅之后安装记录可能已换包（T14 升级）：锁行复核
+            const row = await db
+                .selectFrom("extension_installs")
+                .select("sha256")
+                .where("name", "=", name)
+                .forUpdate()
+                .executeTakeFirst();
+            if (row?.sha256 !== s.install.sha256)
+                throw stale();
+        }
+        const snapRow = await db
+            .selectFrom("extension_permission_snapshots")
+            .select(["version", "permissions", "source"])
+            .where("plugin", "=", name)
+            .forUpdate()
+            .executeTakeFirst();
+        const snap = snapRow && {
+            version: snapRow.version,
+            permissions: snapRow.permissions,
+        };
+        // `confirmBootstrap` (the catalog's confirm): a snapshot the bootstrap step wrote was never
+        // confirmed by a person, so a covered one is still taken over
+        if (snapshotCovers(snap, s.set) && !(confirmBootstrap && snapRow?.source === "bootstrap")) {
+            throw new ApiError("extension.not_pending", `Extension ${name} ${s.version} has no new permissions awaiting approval`);
+        }
+        const { added, removed } = diffPermissions(snap?.permissions, s.set);
+        await writeSnapshot(db, name, s.version, s.set, {
+            source: "web",
+            approvedBy: actor,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            audit: { added, removed, sha256: s.install?.sha256 ?? null },
+        });
+    }
     /** 配置声明 → 安装记录（与配置声明重名的安装记录不生效，不单列）。`only` 给出时只取这一个。 */
-    async subjects(only) {
-        const declared = this.d.host
-            .declaredPlugins()
-            .filter((p) => only === undefined || p.name === only);
-        const taken = new Set(this.d.host.declaredPlugins().map((p) => p.name));
+    async subjects(only, names) {
+        const wanted = (name) => (only === undefined || name === only) && (names === undefined || names.has(name));
+        const declared = this.host.declaredPlugins().filter((p) => wanted(p.name));
+        const taken = new Set(this.host.declaredPlugins().map((p) => p.name));
         const out = [...declared]
             .sort((a, b) => a.name.localeCompare(b.name))
             .map((p) => ({
@@ -154,7 +251,7 @@ export class ExtensionAdmin {
         }));
         if (only !== undefined && out.length > 0)
             return out;
-        const rows = (await this.d.installs.list()).filter((r) => !taken.has(r.name) && (only === undefined || r.name === only));
+        const rows = (await this.installs.list()).filter((r) => !taken.has(r.name) && wanted(r.name));
         for (const r of rows) {
             let info;
             try {
@@ -168,7 +265,7 @@ export class ExtensionAdmin {
                     ? err.message
                     : `package ${r.name} ${r.version} (${r.sha256}) cannot be read: ${err instanceof Error ? err.message : String(err)}`;
                 // A pre-0.1.0 package is an expected state (repack needed), logged without a stack trace.
-                this.d.log.warn("plugin package unreadable for the admin view", {
+                this.log.warn("plugin package unreadable for the admin view", {
                     plugin: r.name,
                     sha256: r.sha256,
                     ...(legacy ? { reason: detail } : { err }),
@@ -207,8 +304,8 @@ export class ExtensionAdmin {
     async packageInfo(sha256) {
         let cached = this.packageSets.get(sha256);
         if (!cached) {
-            const pkg = await readExtensionPackage(await this.d.blobs.get(sha256), {
-                maxBytes: this.d.config().packages.maxBytes,
+            const pkg = await readExtensionPackage(await this.blobs.get(sha256), {
+                maxBytes: this.config.get().packages.maxBytes,
                 hostSdkVersion: SDK_VERSION,
             });
             cached = {
@@ -221,20 +318,90 @@ export class ExtensionAdmin {
         }
         return { ...cached, configurable: cached.set.config.deployment.length > 0 };
     }
+    /**
+     * For each configurable, readable extension whose platform config leaves required overridable
+     * fields empty (spec A §5.4a): the number of orgs still needing their own config. Extensions
+     * without overridable fields cost no read.
+     */
+    async orgsNeedingConfig(subjects) {
+        const out = new Map();
+        for (const s of subjects) {
+            if (!s.configurable || s.broken !== undefined)
+                continue;
+            try {
+                const missing = await this.deploymentConfig.orgMustConfigure(s.name);
+                if (missing.length > 0) {
+                    out.set(s.name, await this.effectiveConfigs.countNeedingConfig(s.name));
+                }
+            }
+            catch (err) {
+                // the list never fails for one extension's config; the field is then left out
+                this.log.warn("cannot tell whether orgs must configure the extension", {
+                    plugin: s.name,
+                    err,
+                });
+            }
+        }
+        return out;
+    }
     async views(subjects) {
         if (subjects.length === 0)
             return [];
         const names = subjects.map((s) => s.name);
-        const snapshots = await new ExtensionApprovals(this.d.db).all();
-        const staleSeconds = STALE_RECONCILE_PERIODS * this.d.config().extensionHost.reconcileIntervalSeconds;
-        const rows = await this.d.db
+        const snapshots = await this.approvals.all();
+        const [displayNames, icons] = await Promise.all([
+            this.displayNames.many(names),
+            this.icons.many(names, { kind: "admin" }),
+        ]);
+        const staleSeconds = STALE_RECONCILE_PERIODS * this.config.get().extensionHost.reconcileIntervalSeconds;
+        const rows = await this.db
             .selectFrom("extension_replica_status")
             .selectAll()
             .where("plugin", "in", names)
             .where("heartbeat_at", ">", sql `now() - make_interval(secs => ${staleSeconds})`)
             .orderBy("replica_id")
             .execute();
+        const items = await pluginItemsOf(this.db, names);
+        // The other providers named by a `conflict` row, for their display names.
+        const conflicts = new Map(rows.flatMap((r) => {
+            const c = r.state === "pending" && r.reason === "conflict" && parseProviderConflict(r.detail);
+            return c ? [[r.plugin, c]] : [];
+        }));
+        const otherNames = [
+            ...new Set([...conflicts].flatMap(([n, c]) => c.providers.filter((p) => p !== n))),
+        ];
+        const otherDisplay = otherNames.length > 0 ? await this.displayNames.many(otherNames) : null;
+        const needing = await this.orgsNeedingConfig(subjects);
+        // A disabled install whose single-provider point another enabled extension provides: enabling
+        // it would be refused, so the view says which one to disable first.
+        const blocked = new Map();
+        for (const s of subjects) {
+            if (s.install?.desiredState !== "disabled" || s.broken !== undefined)
+                continue;
+            const block = await this.singleProvider.occupant(s.name, s.set.provides);
+            if (block)
+                blocked.set(s.name, block);
+        }
+        const counts = new Map((await this.db
+            .selectFrom(enabledExtensionsByOrg(this.db).as("en"))
+            .innerJoin("orgs", "orgs.id", "en.org_id")
+            .select(["en.plugin", (eb) => eb.fn.countAll().as("n")])
+            .where("orgs.deleted_at", "is", null)
+            .where("en.plugin", "in", names)
+            .groupBy("en.plugin")
+            .execute()).map((r) => [r.plugin, Number(r.n)]));
         return subjects.map((s) => {
+            const of = items.get(s.name);
+            const builtin = of?.some((i) => i.builtin) === true || s.install?.required === true;
+            const scopeInfo = {
+                scope: of?.[0]
+                    ? builtin || of.some((i) => i.scope === "all")
+                        ? "all"
+                        : of[0].scope
+                    : null,
+                enabledOrgs: counts.get(s.name) ?? 0,
+                builtin,
+            };
             const replicas = rows.filter((r) => r.plugin === s.name);
             const snap = snapshots.get(s.name);
             const { added, removed } = diffPermissions(snap?.permissions, s.set);
@@ -242,9 +409,13 @@ export class ExtensionAdmin {
             const configValid = s.configValid ??
                 !replicas.some((r) => r.state === "pending" && r.reason === "config" && r.sha256 === target);
             const install = s.install;
+            const displayName = displayNames.get(s.name) ?? null;
+            const icon = icons.get(s.name) ?? null;
             if (s.broken !== undefined) {
                 return {
                     name: s.name,
+                    displayName,
+                    icon,
                     version: s.version,
                     source: s.source,
                     sha256: target,
@@ -267,24 +438,40 @@ export class ExtensionAdmin {
                     configValid,
                     removable: install?.required !== true,
                     required: install?.required === true,
+                    ...scopeInfo,
                     installSource: install?.source ?? null,
                     error: s.broken,
                 };
             }
             const permissions = permissionGroups(s.set);
+            const status = deriveExtensionStatus({
+                source: s.source,
+                desired: install && { sha256: install.sha256, state: install.desiredState },
+                pendingApproval: !snapshotCovers(snap, s.set),
+                configValid,
+                migratedSha: install?.migratedSha ?? null,
+                replicas: replicas.map((r) => ({ state: r.state, reason: r.reason, sha256: r.sha256 })),
+            });
+            const conflict = status === "conflict" ? conflicts.get(s.name) : undefined;
+            const enableBlocked = blocked.get(s.name);
             return {
                 name: s.name,
+                displayName,
+                icon,
                 version: s.version,
                 source: s.source,
                 sha256: target,
-                status: deriveExtensionStatus({
-                    source: s.source,
-                    desired: install && { sha256: install.sha256, state: install.desiredState },
-                    pendingApproval: !snapshotCovers(snap, s.set),
-                    configValid,
-                    migratedSha: install?.migratedSha ?? null,
-                    replicas: replicas.map((r) => ({ state: r.state, reason: r.reason, sha256: r.sha256 })),
+                status,
+                ...(conflict && {
+                    conflict: {
+                        extensionPoint: conflict.extensionPoint,
+                        providers: conflict.providers
+                            .filter((p) => p !== s.name)
+                            .map((p) => ({ name: p, displayName: otherDisplay?.get(p) ?? null })),
+                        ...(conflict.unprovided && { unprovided: true }),
+                    },
                 }),
+                ...(enableBlocked && { enableBlocked }),
                 desired: install && {
                     version: install.version,
                     sha256: install.sha256,
@@ -301,13 +488,39 @@ export class ExtensionAdmin {
                 snapshot: snapshotView(snap),
                 configurable: s.configurable,
                 configValid,
+                ...(needing.has(s.name) && { orgsNeedingConfig: needing.get(s.name) }),
                 removable: s.source === "install" && install?.required !== true,
                 required: install?.required === true,
+                ...scopeInfo,
                 installSource: install?.source ?? null,
             };
         });
     }
-}
+};
+__decorate([
+    Transactional()
+], ExtensionAdmin.prototype, "writeApproval", null);
+ExtensionAdmin = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(SuperAdminLock)),
+    __param(3, Inject(PluginApproveLock)),
+    __param(4, Inject(ExtensionBlobs)),
+    __param(5, Inject(ExtensionInstalls)),
+    __param(6, Inject(ExtensionApprovals)),
+    __param(7, Inject(ExtensionHost)),
+    __param(8, Inject(ExtensionLifecycle)),
+    __param(9, Inject(KernelConfigService)),
+    __param(10, Inject(KERNEL_BUS)),
+    __param(11, Inject(KERNEL_LOGGER)),
+    __param(12, Inject(ExtensionDisplayNames)),
+    __param(13, Inject(ExtensionDeploymentConfigService)),
+    __param(14, Inject(EffectiveConfigs)),
+    __param(15, Inject(SingleProviderGuard)),
+    __param(16, Inject(PluginIcons))
+], ExtensionAdmin);
+export { ExtensionAdmin };
 const replicaView = (r) => ({
     replicaId: r.replica_id,
     version: r.version,