@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.10

package/dist/catalog/catalog.module.d.ts

@@ -0,0 +1,12 @@
+import { CatalogImportModule } from "./catalog-import.module.js";
+export { CatalogImportModule };
+/**
+ * The plugin catalog (spec §4, §10): {@link CatalogImportModule}, catalog requests, org installs
+ * with their dependencies, the platform plugin update (`PlatformPluginUpdater`), the admin's scope
+ * and disable
+ * (`CatalogScopeService`), org admins' plugin uploads (`OrgPluginUploads`) and their own plugins (`OwnedItems`), and the producer of the plugin scope sync
+ * (`PluginScopeSync`; its consumer is the worker role's `PluginScopeWorkersModule`). The catalog's periodic jobs (`CatalogJobs`) are
+ * the worker role's (`WorkerModule`).
+ */
+export declare class CatalogModule {
+}

package/dist/catalog/catalog.module.js

@@ -0,0 +1,81 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { SuperAdminLockModule } from "../identity/super-admin.js";
+import { QueueModule } from "../infra/queue/queue.module.js";
+import { OrgLockModule } from "../orgs/org-lock.js";
+import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
+import { SkillsModule } from "../skills/skills.module.js";
+import { StorageModule } from "../storage/storage.module.js";
+import { ToolsModule } from "../tools/tools.module.js";
+import { CatalogImportModule } from "./catalog-import.module.js";
+import { CatalogScopeService } from "./catalog-scope.service.js";
+import { ComponentScopeService } from "./component-scope.service.js";
+import { OrgCatalogService } from "./org-catalog.service.js";
+import { OrgExtensionSwitch } from "./org-extension-switch.js";
+import { OrgPluginUploads } from "./org-plugin-uploads.js";
+import { OwnedItems } from "./owned-items.js";
+import { PluginInstaller } from "./plugin-install.js";
+import { PlatformPluginUpdater } from "./plugin-upgrade.js";
+import { CatalogRequestsService } from "./requests.service.js";
+import { PLUGIN_SCOPE_QUEUE, PluginScopeSync } from "./scope-sync.js";
+export { CatalogImportModule };
+/**
+ * The plugin catalog (spec §4, §10): {@link CatalogImportModule}, catalog requests, org installs
+ * with their dependencies, the platform plugin update (`PlatformPluginUpdater`), the admin's scope
+ * and disable
+ * (`CatalogScopeService`), org admins' plugin uploads (`OrgPluginUploads`) and their own plugins (`OwnedItems`), and the producer of the plugin scope sync
+ * (`PluginScopeSync`; its consumer is the worker role's `PluginScopeWorkersModule`). The catalog's periodic jobs (`CatalogJobs`) are
+ * the worker role's (`WorkerModule`).
+ */
+let CatalogModule = class CatalogModule {
+};
+CatalogModule = __decorate([
+    Module({
+        imports: [
+            CatalogImportModule,
+            ExtensionsModule,
+            SuperAdminLockModule,
+            OrgLockModule,
+            StorageModule,
+            SkillsModule,
+            ToolsModule,
+            // the producer side of the plugin scope sync (`PluginScopeWorkersModule` consumes it)
+            QueueModule.registerQueue(PLUGIN_SCOPE_QUEUE),
+            // a removed org plugin's cleanup job (`OwnedItems`, `CatalogScopeService`; consumed by the
+            // worker role's `MaintenanceProcessor`)
+            QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME),
+        ],
+        providers: [
+            CatalogRequestsService,
+            PluginInstaller,
+            PlatformPluginUpdater,
+            OrgCatalogService,
+            OrgExtensionSwitch,
+            PluginScopeSync,
+            CatalogScopeService,
+            ComponentScopeService,
+            OrgPluginUploads,
+            OwnedItems,
+        ],
+        exports: [
+            CatalogImportModule,
+            CatalogRequestsService,
+            PluginInstaller,
+            PlatformPluginUpdater,
+            OrgCatalogService,
+            OrgExtensionSwitch,
+            PluginScopeSync,
+            CatalogScopeService,
+            ComponentScopeService,
+            OrgPluginUploads,
+            OwnedItems,
+        ],
+    })
+], CatalogModule);
+export { CatalogModule };

package/dist/catalog/catalog.service.d.ts

@@ -1,13 +1,17 @@
-import { type Connector, type ConnectorTemplateSpec, type LocalizedName, type PluginManifest } from "@capybara-hq/plugin-sdk";
-import { type Transaction } from "kysely";
-import type { KernelConfig } from "../config/schema.js";
-import type { KernelDatabase, KernelDb, SourceFormat } from "../db/kernel-schema.js";
-import type { ExtensionAdminOps } from "../extensions/admin-ops.js";
-import type { ExtensionInstalls } from "../extensions/installs.js";
-import type { AdminExtensionView } from "../extensions/permission-view.js";
-import type { StorageService } from "../storage/storage.service.js";
+import { type LocalizedName, type PluginManifest } from "@capybara-hq/plugin-sdk";
+import type { SourceFormat } from "../db/kernel-schema.js";
+import { ExtensionAdmin } from "../extensions/admin-view.js";
+import { ExtensionInstalls } from "../extensions/installs.js";
+import { PluginInstallLock } from "../extensions/locks.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { TranslationReport } from "./claude/report.js";
-import type { PluginImport, PluginReview } from "./plugin-import.js";
+import { MarketplacesService } from "./marketplaces.service.js";
+import { type Owner } from "./ownership.js";
+import { PluginImport, type PluginReview } from "./plugin-import.js";
+import type { PluginScope } from "./scope.js";
 /** Item policy (C22): allow (default for new imports) / needs_approval / disabled (no new installs; existing ones stay). */
 export type CatalogPolicy = "allow" | "needs_approval" | "disabled";
 /** A catalog item (list entry). Every item is a plugin. */
@@ -16,8 +20,54 @@ export interface CatalogItemView {
     name: string;
     publisher: string;
     displayName: LocalizedName | null;
+    /** The English description (the plugin.json description's `en`, or the plain string). */
     description: string;
+    /**
+     * The Chinese description of the latest version (its plugin.json `description.zh`, read from the
+     * stored manifest); null without one. The UI shows it in Chinese, else `description`.
+     */
+    descriptionZh: string | null;
+    /** The old item policy, kept for reading only (scope and `disabled` replaced it). */
     policy: CatalogPolicy;
+    /** Who the plugin is offered to (`all` for a builtin plugin). */
+    scope: PluginScope;
+    /** The orgs of a `named` scope (empty otherwise). */
+    scopeOrgs: string[];
+    /** Shipped with the deployment (a required bootstrap plugin): scope `all`, never changed. */
+    builtin: boolean;
+    /** Stopped on the whole deployment by the super admin (its scope is kept). */
+    disabled: boolean;
+    /**
+     * Orgs outside a `named` item's list see it as requestable (`not_offered`); false hides it from
+     * them (spec §5.1 rule 1). Irrelevant for other scopes.
+     */
+    shownToOthers: boolean;
+    /** The platform, or the org that owns it (ruling P3-1; deleted orgs by their name). */
+    owner: Owner;
+    /**
+     * An org-owned item's owner shares it with other orgs (the share gate `owner = platform OR
+     * shareable`, P3-1); false for platform items, which pass the gate anyway.
+     */
+    shareable: boolean;
+    /** An org's upload carrying an extension waits for the super admin's confirmation (P3-9). */
+    awaitingConfirmation: boolean;
+    /** The org-uploaded version that waits for that confirmation (null: none). */
+    pendingVersion: string | null;
+    /** Orgs it is on in: orgs with a live plugin install of it (every org for a builtin plugin). */
+    enabledOrgs: number;
+    /**
+     * Orgs whose admin switched it off while its scope is `all` (layering spec §4: on in every org
+     * unless an org turned it off); 0 for other scopes and for builtin items.
+     */
+    offCount: number;
+    /**
+     * Its extension waits for a person's confirmation: not installed on the deployment, its
+     * permission set not covered by the approved snapshot, or (builtin) only approved by the
+     * bootstrap step. Confirm with `POST items/:id/confirm`.
+     */
+    pending: boolean;
+    /** The digest to send with the confirmation; null unless `pending` and the package is readable. */
+    permissionsHash: string | null;
     latestVersion: string;
     /** Every version, newest first (semver; equal but for build metadata: the later import first). */
     versions: string[];
@@ -29,7 +79,7 @@ export interface CatalogItemView {
     /** The latest version's source (file / npm / marketplace). */
     source: string;
     /**
-     * The marketplace an item was imported from (`official` or an enterprise marketplace id); null
+     * The marketplace an item was imported from (`official` or a custom marketplace id); null
      * when imported by hand or when that marketplace was deleted.
      */
     marketplaceId: string | null;
@@ -49,8 +99,19 @@ export interface CatalogItemView {
      * §5.3). Importing it again records `<version>+git.<sha12>` / `+sha256.<12>`.
      */
     contentChanged: boolean;
+    /** What the latest version's plugin.json brings (read-only; dependencies are not components). */
+    componentCounts: ComponentCounts;
+    /** The format the latest version was read from (`claude-code`: translated from Claude Code). */
+    sourceFormat: SourceFormat;
     updatedAt: string;
 }
+/** The components of a plugin version, by kind (spec §3). */
+export interface ComponentCounts {
+    extension: 0 | 1;
+    skills: number;
+    connectorTemplates: number;
+    agentTemplates: number;
+}
 /**
  * A git source as recorded (spec §5.1: the actual host, repo and commit, and whether it follows a
  * branch, i.e. no commit was pinned). `path` is `.` for the repo root.
@@ -114,32 +175,20 @@ export interface CatalogItemDetail {
     item: CatalogItemView & {
         packageName: string | null;
         deletedAt: string | null;
+        /**
+         * The version the platform's components come from (spec §7.1): set by the import that created
+         * the item and by each platform update; importing a newer version does not move it.
+         */
+        platformVersion: string;
     };
     versions: CatalogItemVersionView[];
 }
-export interface CatalogServiceDeps {
-    db: KernelDb;
-    config: () => KernelConfig;
-    installs: Pick<ExtensionInstalls, "fetchMarketplacePackage" | "fetchProvenance">;
-    ops: Pick<ExtensionAdminOps, "install">;
-    /** Plugin import (a marketplace entry goes through its prepare). */
-    pluginImport: Pick<PluginImport, "prepare" | "prepareGit">;
-    /** The token of an enterprise marketplace (sent only to its URL's origin). */
-    marketplaceToken: (marketplaceId: string) => Promise<string | undefined>;
-    /** Downloads a marketplace archive source, verified against its integrity. */
-    fetchArchive: (archive: {
-        url: string;
-        integrity: string;
-    }, signal?: AbortSignal) => Promise<{
-        bytes: Uint8Array;
-        integrity: string;
-    }>;
-}
 /** Audits carry the PAT when a personal token made the call. */
 export interface ActorOpts {
     actorTokenId?: string;
+    /** Merged into the audit detail (a write made through the Platform tool: `via`, …). */
+    auditDetail?: Record<string, unknown>;
 }
-type Trx = Transaction<KernelDatabase>;
 /**
  * The marketplace's permission summary differs from the keys computed from the package (a warning,
  * never a refusal; C26): `missing` = asked by the package, not listed; `extra` = listed, not asked.
@@ -168,30 +217,51 @@ export declare function repoOwner(url: string): string;
  * leading zero are not valid semver.
  */
 export declare const gitFallbackVersion: (commit: string) => string;
-/**
- * The object storage prefix of one import (relative to `deployment/`):
- * `directory/<itemId>/<version>/<importId>/`. Each import gets a new `importId`, so the losing one of
- * two concurrent imports of the same version never overwrites the committed version's files; reads
- * always go through the `object_prefix` stored on the version row. Build metadata's `+` is written
- * as `_` (a `+` in a key can turn into a space through URL query encoding).
- */
-export declare const catalogObjectPrefix: (itemId: string, version: string, importId: string) => string;
 /** Default / largest page size of the list. */
 export declare const CATALOG_LIST_DEFAULT_LIMIT = 200;
 export declare const CATALOG_LIST_MAX_LIMIT = 1000;
 /**
- * Enterprise catalog items (D9 / C21 / C22, `/api/v1/admin/catalog/*`, enterprise admins only). One
+ * Platform catalog items (D9 / C21 / C22, `/api/v1/admin/catalog/*`, super admins only). One
  * kind: every item is a plugin (spec §4), imported through {@link PluginImport} (prepare -> confirm,
- * one review); this service lists and shows items, changes policy, deletes, installs an item's
- * extension on the deployment, and prepares marketplace imports. Stateless, shared by every replica.
+ * one review, whose confirm installs the plugin's extension); this service lists and shows items,
+ * deletes, and prepares marketplace imports (scope and disable: `CatalogScopeService`). Stateless,
+ * shared by every replica.
  */
 export declare class CatalogService {
-    private readonly d;
-    constructor(d: CatalogServiceDeps);
+    private readonly kdb;
+    /** The super admin lock (identity/super-admin.ts): joins the caller's transaction. */
+    private readonly adminLock;
+    private readonly config;
+    private readonly installs;
+    /** The deployment's extensions with their approvals (what is pending confirmation). */
+    private readonly admin;
+    /** Plugin import (a marketplace entry goes through its prepare). */
+    private readonly pluginImport;
+    /** The token of a custom marketplace (sent only to its URL's origin). */
+    private readonly marketplaces;
+    /** Serializes a claim release with an install of that name still committing (F10). */
+    private readonly installLock;
+    readonly txHost: TransactionHost;
+    constructor(kdb: KernelDb, 
+    /** The super admin lock (identity/super-admin.ts): joins the caller's transaction. */
+    adminLock: SuperAdminLock, config: KernelConfigService, installs: ExtensionInstalls, 
+    /** The deployment's extensions with their approvals (what is pending confirmation). */
+    admin: ExtensionAdmin, 
+    /** Plugin import (a marketplace entry goes through its prepare). */
+    pluginImport: PluginImport, 
+    /** The token of a custom marketplace (sent only to its URL's origin). */
+    marketplaces: MarketplacesService, 
+    /** Serializes a claim release with an install of that name still committing (F10). */
+    installLock: PluginInstallLock, txHost: TransactionHost);
+    /** The kernel-schema handle of the current context (the transaction, else the pool). */
+    private get db();
+    /** Downloads a marketplace archive source, verified against its integrity. */
+    private fetchArchive;
     /**
      * Prepares the import of one marketplace entry (C25 / C26, spec §5.2): `version` defaults to the
      * newest compatible version the marketplace lists for `name`; the entry must be compatible with
-     * the host (`marketplace.incompatible`); an npm source is downloaded from the configured registry
+     * the host (`marketplace.incompatible`) and not deprecated (`marketplace.entry_deprecated`, 409; the
+     * confirm does not read the marketplace again); an npm source is downloaded from the configured registry
      * and an archive source from its URL, both always verified against the marketplace's integrity
      * (`marketplace.integrity_mismatch`, nothing written). A `path` source is read from the git
      * marketplace's repository at its last refreshed commit (an http marketplace has none:
@@ -242,189 +312,54 @@ export declare class CatalogService {
         includeDeleted?: boolean;
         limit?: number;
         offset?: number;
+        pending?: boolean;
     }): Promise<CatalogItemView[]>;
     /** Same as {@link list}, plus the offset of the next page (null when there is none). */
     page(q?: {
         includeDeleted?: boolean;
         limit?: number;
         offset?: number;
+        pending?: boolean;
     }): Promise<{
         items: CatalogItemView[];
         nextOffset: number | null;
     }>;
     /** Item detail (with every version; deleted items too). Missing -> `catalog.item_not_found`. */
     get(itemId: string): Promise<CatalogItemDetail>;
-    /**
-     * Changes the policy (audit `catalog.policy_changed`, not written when unchanged). Deleted /
-     * missing -> `catalog.item_not_found`.
-     */
-    setPolicy(actor: string, itemId: string, policy: CatalogPolicy, opts?: ActorOpts): Promise<CatalogItemView>;
     /**
      * Deletes the item (soft delete, audit `catalog.removed`; requests still pending are cancelled in
      * the same transaction): versions and stored files are kept (installed components still refer to
      * them), organizations no longer see it; the same name can later be imported again as a new
-     * item. Deleted / missing -> `catalog.item_not_found`.
+     * item. Deleted / missing -> `catalog.item_not_found`. A platform plugin whose extension is
+     * still enabled on the deployment -> 409 `catalog.extension_enabled` (details
+     * `[{ extension, displayName }]`): disable it on the Extensions page first, as an uninstall
+     * requires. A disabled extension keeps its install record (the super admin uninstalls it on the
+     * Extensions page); an org-owned item's extension is taken out by `OwnedPluginCleanup`.
      */
     remove(actor: string, itemId: string, opts?: ActorOpts): Promise<void>;
     /**
-     * Installs the extension of one version of an item on the deployment
-     * (`ExtensionAdminOps.install`: a new install is disabled, a version change keeps the desired
-     * state; audit `extension.installed`), with the install record linked to the item (F-AA). The
-     * returned status may be `pending_approval` when the version's permissions are not approved yet.
-     * A version without an extension -> `catalog.no_extension`; item or version missing ->
-     * `catalog.item_not_found`.
+     * The precheck of {@link remove} (the Platform tool's `plugins.delete`): throws what the delete
+     * would throw for an enabled extension; read-only, no locks.
      */
-    installToDeployment(actor: string, itemId: string, version: string, opts?: ActorOpts): Promise<AdminExtensionView>;
-    private view;
-}
-/**
- * Checks a connector template against the loaded connector `c` (problem paths start with `at`): the
- * endpoint matches its `endpointSchema` and carries no credential-like headers / query / URL user
- * info (the same rule as connector installs); every `editableEndpoint` path exists in the endpoint
- * schema.
- */
-export declare function templateProblems(c: Connector, t: ConnectorTemplateSpec, at: string): string[];
-/** Writes the files to `deployment/<prefix><path>` ({@link PUT_CONCURRENCY} at a time). */
-export declare function putCatalogFiles(storage: StorageService, prefix: string, files: {
-    path: string;
-    size: number;
-    data: Uint8Array;
-}[]): Promise<void>;
-/** Compares the marketplace's permission summary with the computed keys ({@link PermissionsMismatch}). */
-export declare function permissionsMismatch(declared: string[] | undefined, actual: string[] | undefined): PermissionsMismatch;
-/** The fields the list shows (the item's publisher / description / displayName). */
-export interface CatalogListing {
-    publisher: string;
-    description: string;
-    displayName: LocalizedName | null;
-}
-/** Input of {@link writeCatalogVersion}. */
-export interface CatalogVersionWrite {
-    /** null: the CLI (no account). */
-    actor: string | null;
-    actorTokenId?: string;
-    name: string;
-    /** null: a git plugin without package.json. */
-    packageName: string | null;
+    assertRemovable(itemId: string): Promise<void>;
+    private writeRemove;
     /**
-     * The version recorded (from {@link precheckCatalogImport}: the plugin's own, or with build
-     * metadata when that release was imported with other content).
+     * A live platform item whose extension (the install of the item's name from its package) is
+     * enabled -> 409 `catalog.extension_enabled`. With `lock`, under the per-name install lock an
+     * enable takes too (the caller's transaction), so no enable slips in between.
      */
-    version: string;
-    /** The content digest of the plugin's files. */
-    contentDigest: string;
-    /** The normalized plugin.json. */
-    manifest: PluginManifest;
-    listing: CatalogListing;
-    /** The id of the item to create when there is none yet (the one the storage prefix used). */
-    newItemId: string;
-    source: {
-        source: CatalogVersionSource;
-        ref: string;
-        integrity?: string;
-        detail?: SourceDetail;
-    };
-    /** Imported from a marketplace: the item records it. */
-    marketplaceId?: string;
-    objectPrefix: string | null;
-    extensionSha256: string | null;
-    files: {
-        path: string;
-        size: number;
-        sha256: string;
-    }[];
-    size: number;
-    /** The format the plugin was read from (default `capybara`). */
-    sourceFormat?: SourceFormat;
-    /** The translation report of a Claude Code plugin. */
-    translation?: TranslationReport | null;
-    /** The root LICENSE text. */
-    licenseText?: string | null;
-    /** The root LICENSE was too long (or not UTF-8) to store. */
-    licenseTruncated?: boolean;
-    /** Merged into the detail of the `catalog.imported` audit. */
-    auditDetail?: Record<string, unknown>;
-}
-/** Takes the transaction-level advisory lock of an item name (concurrent imports of it serialize). */
-export declare function lockCatalogName(trx: Trx, name: string): Promise<void>;
-/**
- * The identity of a git source, `<host>/<repo>:<path>` (host lower case, no `.git`), or null when
- * the source is not git. An item without package.json is identified by it instead of a package name.
- */
-export declare function gitIdentity(detail: SourceDetail | undefined): string | null;
-/** What is being imported, as far as the version conflict rules need it. */
-export interface ImportIdentity {
-    packageName: string | null;
-    /** The plugin's own version (plugin.json, else the fallback of spec §5.3). */
-    version: string;
-    contentDigest: string;
-    integrity?: string;
-    detail?: SourceDetail;
-    marketplaceId?: string;
-}
-type ExistingVersion = {
-    version: string;
-    content_digest: string | null;
-    integrity: string | null;
-};
-/**
- * The version a new import records (Decision 6, spec §5.3): the plugin's own version, unless that
- * release is already imported. A version of the same release (equal but for build metadata) with
- * the same content (digest; for versions without one, the same integrity) -> `catalog.version_exists`
- * "already imported"; other content -> `<version>+git.<sha12>` (git) or `+sha256.<12>` (any other
- * source, the digest's first 12 hex), never overwriting the imported version. A git commit already
- * recorded with other content (a Claude Code plugin whose marketplace entry changed while its own
- * commit did not, see `claudeContentDigest`) falls back to `+sha256.<12>`.
- */
-export declare function recordedVersion(existing: ExistingVersion[], p: ImportIdentity): string;
-/**
- * Conflict precheck before writing (no lock; {@link writeCatalogVersion}'s re-check inside the
- * transaction is final): an item with the same name from another npm package (or, without one,
- * another git source) -> `catalog.name_conflict`; the release already imported with the same
- * content -> `catalog.version_exists`. Returns the existing item (undefined when there is none) and
- * the version to record ({@link recordedVersion}).
- */
-export declare function precheckCatalogImport(db: KernelDb, name: string, p: ImportIdentity): Promise<{
-    existing: {
-        id: string;
-    } | undefined;
-    version: string;
-}>;
-/**
- * Writes a catalog version in the caller's transaction (the caller has re-checked the enterprise
- * admin): takes the name's advisory lock, checks conflicts again (the same source; no version of
- * the release with the same content; `version` not taken meanwhile), creates the item when there is
- * none or adds the version (latest and display fields change only for a newer version, a version
- * equal but for build metadata being newer as the later import), and writes the version row (with
- * its content digest) and the `catalog.imported` audit. Returns the item id.
- */
-export declare function writeCatalogVersion(trx: Trx, w: CatalogVersionWrite): Promise<string>;
-/**
- * An extension name belongs to the npm package that first installed it (`extension_name_owners`,
- * Ruling P3): when another package owns it, the import is refused right away with
- * `extension.name_conflict` (the same code as at install), instead of failing only at deploy time.
- */
-export declare function assertPluginNameOwner(db: KernelDb | Trx, name: string, packageName: string | null): Promise<void>;
-/** What the marketplace says about a marketplace-imported item. */
-export interface MarketplaceStatus {
-    /** See {@link CatalogItemView.latestMarketplaceVersion}. */
-    latest: string | null;
-    /** See {@link CatalogItemView.contentChanged}. */
-    contentChanged: boolean;
+    private assertExtensionDisabled;
+    /**
+     * The soft delete of {@link remove} in the caller's transaction, without its super admin check
+     * (pre-flight F14: the super admin's remove and an owner's delete or an org deletion,
+     * `OwnedItems.transferOrRemove`, share it): `deleted_at` set, a pending version cleared, the
+     * extension name claim of a first upload still waiting released (ruling P3-37, F10), pending
+     * requests cancelled, audit `catalog.removed` (`actor` null: the kernel). Returns the removed
+     * item's name, or null when it is gone already.
+     */
+    removeIn(actor: string | null, itemId: string, opts?: ActorOpts & {
+        reason?: string;
+    }): Promise<{
+        name: string;
+    } | null>;
 }
-export declare function itemView(i: {
-    id: string;
-    name: string;
-    publisher: string;
-    display_name: LocalizedName | null;
-    description: string;
-    policy: CatalogPolicy;
-    latest_version: string;
-    marketplace_id?: string | null;
-    updated_at: Date;
-}, versions: {
-    version: string;
-    source: string;
-    imported_at?: Date;
-}[], installs?: number, marketplace?: MarketplaceStatus): CatalogItemView;
-export {};