@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.11

package/dist/catalog/admin-catalog.controller.d.ts

@@ -1,53 +1,44 @@
 import type { FastifyReply } from "fastify";
 import { z } from "zod";
-import type { AdminExtensionView } from "../extensions/permission-view.js";
+import { PluginIcons } from "../extensions/plugin-icons.js";
 import { type Principal } from "../identity/principal.js";
-import { type CatalogItemDetail, type CatalogItemView, type CatalogService, type PermissionsMismatch } from "./catalog.service.js";
-import type { OrgCatalogService } from "./org-catalog.service.js";
-import type { PluginConfirmResult, PluginImport, PluginReview } from "./plugin-import.js";
-declare const NpmBody: z.ZodObject<{
-    package: z.ZodString;
-    version: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-declare const GitBody: z.ZodObject<{
-    url: z.ZodString;
-    ref: z.ZodOptional<z.ZodString>;
-    path: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-declare const PolicyBody: z.ZodObject<{
-    policy: z.ZodEnum<{
-        allow: "allow";
-        disabled: "disabled";
-        needs_approval: "needs_approval";
-    }>;
-}, z.core.$strip>;
-declare const InstallBody: z.ZodObject<{
-    version: z.ZodString;
-}, z.core.$strip>;
+import { CatalogItemsQuery, CatalogUpdateBody, CatalogUpdatePreviewBody, CatalogDisabledBody as DisabledBody, CatalogGitImportBody as GitBody, CatalogNpmImportBody as NpmBody, CatalogScopeBody as ScopeBody, CatalogScopePreviewBody as ScopePreviewBody, CatalogShownBody as ShownBody } from "./admin-catalog.schemas.js";
+import { type CatalogItemDetail, type CatalogItemView, CatalogService, type PermissionsMismatch } from "./catalog.service.js";
+import { CatalogScopeService, type ScopePreview } from "./catalog-scope.service.js";
+import { OrgCatalogService } from "./org-catalog.service.js";
+import { type PluginConfirmResult, PluginImport, type PluginReview } from "./plugin-import.js";
+import { PlatformPluginUpdater, type PlatformUpdatePreview, type PlatformUpdateResult } from "./plugin-upgrade.js";
 declare const ConfirmBody: z.ZodObject<{
     reviewHash: z.ZodString;
-    deployExtension: z.ZodBoolean;
-    pinnedSuggestions: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-declare const ListQuery: z.ZodObject<{
-    includeDeleted: z.ZodOptional<z.ZodEnum<{
-        false: "false";
-        true: "true";
+    scope: z.ZodOptional<z.ZodEnum<{
+        all: "all";
+        named: "named";
+        optional: "optional";
     }>>;
-    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
-    offset: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
-}, z.core.$strip>;
+    orgs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    pinnedSuggestions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+declare const ConfirmPermissionsBody: z.ZodObject<{
+    permissionsHash: z.ZodString;
+}, z.core.$strict>;
+/** The reason shown to the owner org in its `upload_rejected` notice (optional). */
+declare const RejectBody: z.ZodObject<{
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
 /**
- * The enterprise catalog (`/api/v1/admin/catalog/*`, enterprise admins): plugin import (upload / npm
- * prepare, then confirm), the item list and detail, policy, delete, and installing an item's
- * extension on the deployment. Writes re-check the enterprise admin inside the service's lock and are
+ * The platform catalog (`/api/v1/admin/catalog/*`, super admins): plugin import (upload / npm
+ * prepare, then confirm, which installs the plugin's extension), the item list and detail, scope and
+ * disable (previewed, then confirmed with `scopeHash`), delete. Writes re-check the super admin inside the service's lock and are
  * audited.
  */
 export declare class AdminCatalogController {
     private readonly catalog;
     private readonly pluginImport;
     private readonly orgCatalog;
-    constructor(catalog: CatalogService, pluginImport: PluginImport, orgCatalog: OrgCatalogService);
+    private readonly scope;
+    private readonly updater;
+    private readonly icons;
+    constructor(catalog: CatalogService, pluginImport: PluginImport, orgCatalog: OrgCatalogService, scope: CatalogScopeService, updater: PlatformPluginUpdater, icons: PluginIcons);
     /**
      * Prepares the import of an uploaded plugin (an npm-pack tgz as the raw body,
      * `application/octet-stream`, at most `packages.maxBytes`): reads and checks the whole plugin
@@ -97,11 +88,13 @@ export declare class AdminCatalogController {
         permissionsMismatch?: PermissionsMismatch;
     }>;
     /**
-     * Confirms a staged import: approves the plugin's extension when this import installs it (writes
-     * its snapshot) and creates the item or adds the version; with `deployExtension` it installs and
-     * enables the plugin's own extension after the commit and returns `{ item, deploy }`, where
-     * `deploy` says enabled / failed (+ code); a failed deploy does not make the committed import fail
-     * (retry from the extension admin by sha256). A foreseeable failure (a downgrade to a version with
+     * Confirms a staged import: approves the plugin's extension when this import installs or upgrades
+     * it (writes its snapshot), creates the item (with `scope`, default `optional`; `orgs` only with
+     * `named`, each an existing org, else 400 `validation_failed`) or adds the version, installs and
+     * enables the plugin's own extension after the commit and enqueues the item's scope sync; returns
+     * `{ item, deploy }`, where `deploy` says enabled / failed (+ code), null without an extension to
+     * deploy; a failed deploy does not make the committed import fail (retry from the extension admin
+     * by sha256). An unknown field (the removed `deployExtension`) -> 400 `validation_failed`. A foreseeable failure (a downgrade to a version with
      * unrun migrations) is a 409 `extension.downgrade_unsupported` before anything is written.
      * Staging missing or expired -> 404 `plugin.staging_not_found`; `reviewHash` differs or the
      * extension on the deployment changed -> 409 `plugin.review_stale`. `pinnedSuggestions` (skill
@@ -113,8 +106,10 @@ export declare class AdminCatalogController {
      * The item list (`includeDeleted=true` includes deleted items). Paging: `limit` (default 200, at
      * most 1000) and `offset`; `nextOffset` is the next page's offset, null when there is none.
      */
-    list(q: z.infer<typeof ListQuery>): Promise<{
-        items: CatalogItemView[];
+    list(q: z.infer<typeof CatalogItemsQuery>): Promise<{
+        items: (CatalogItemView & {
+            icon: string | null;
+        })[];
         nextOffset: number | null;
     }>;
     /**
@@ -129,15 +124,70 @@ export declare class AdminCatalogController {
      * `sendCatalogIcon`). No icon -> 404 `catalog.icon_not_found`.
      */
     icon(id: string, reply: FastifyReply): Promise<void>;
-    /** 改策略（allow / needs_approval / disabled）。 */
-    setPolicy(principal: Principal, id: string, body: z.infer<typeof PolicyBody>): Promise<CatalogItemView>;
-    /** 删除条目（软删除，已安装的组件不受影响）。 */
-    remove(principal: Principal, id: string): Promise<void>;
     /**
-     * Installs the extension of a version of an item on the deployment (a new install starts disabled;
-     * unapproved permissions still need approval). A version without an extension -> 409
-     * `catalog.no_extension`.
+     * What a scope change (`{ scope, orgs? }`, `orgs` only with `named`) or a disable
+     * (`{ disabled: true }`) would take away: `{ affected: [{ orgId, orgName, agents,
+     * connectorsKept }], needsConfig, scopeHash }` (spec §5 rule 8; nothing written; the connectors
+     * stay as the orgs' own). A builtin item -> 409 `plugin.builtin`; unknown
+     * orgs -> 400 `validation_failed`.
+     */
+    previewScope(id: string, body: z.infer<typeof ScopePreviewBody>): Promise<ScopePreview>;
+    /**
+     * Changes the scope, confirmed with the preview's `scopeHash` (recomputed under the item row lock;
+     * a difference -> 409 `plugin.scope_stale`); bumps the scope version, audits
+     * `catalog.scope_changed` and enqueues the scope sync. Builtin -> 409 `plugin.builtin`.
+     */
+    setScope(principal: Principal, id: string, body: z.infer<typeof ScopeBody>): Promise<CatalogItemView>;
+    /**
+     * Disables the plugin on the whole deployment (`scopeHash` of the `{ disabled: true }` preview
+     * required; the scope sync then uninstalls it everywhere, its scope and the org switches are kept)
+     * or enables it again (no hash; the sync reinstalls where it is wanted). Builtin -> 409
+     * `plugin.builtin`; a stale hash -> 409 `plugin.scope_stale`.
      */
-    installToDeployment(principal: Principal, id: string, body: z.infer<typeof InstallBody>): Promise<AdminExtensionView>;
+    setDisabled(principal: Principal, id: string, body: z.infer<typeof DisabledBody>): Promise<CatalogItemView>;
+    /**
+     * Confirms the item's extension permissions (the admin's 待确认; body `{ permissionsHash }` from
+     * the item view): approves the current permission set (snapshot source `web`) and installs and
+     * enables an extension that was never deployed. A changed set -> 409 `extension.approval_stale`;
+     * nothing to confirm -> 409 `extension.not_pending`. Returns the item. An org's upload
+     * (`owner.kind` org, ruling P3-10): the digest of its pending version's package; a first version
+     * is installed, approved, enabled and synced, a new version applied by the platform update
+     * (the item removed meanwhile -> 409 `catalog.item_removed`, P3-21).
+     */
+    confirmPermissions(principal: Principal, id: string, body: z.infer<typeof ConfirmPermissionsBody>): Promise<CatalogItemView>;
+    /**
+     * Rejects an org upload's pending version (ruling P3-10; body `{ reason? }`, told to the owner
+     * org in `upload_rejected`): a first version is removed (its name free again), a new version's
+     * pending state cleared. Nothing pending, or a platform item (pre-flight F11) -> 409
+     * `extension.not_pending`. 204.
+     */
+    reject(principal: Principal, id: string, body: z.infer<typeof RejectBody>): Promise<void>;
+    /**
+     * Whether orgs outside a `named` item's list see it as requestable (spec §5.1 rule 1). Hiding it
+     * keeps pending requests as they are; new requests from unlisted orgs are then 404. Never makes
+     * anything usable, so no preview and no scope sync. Audits `catalog.shown_changed`.
+     */
+    setShown(principal: Principal, id: string, body: z.infer<typeof ShownBody>): Promise<CatalogItemView>;
+    /**
+     * What updating the platform plugin to `version` would do (spec §7.1, `PlatformPluginUpdater`):
+     * `{ itemId, name, from, to, components: [{ kind, id, name, change: added | removed | upgrade |
+     * downgrade | same, from, to, updatedOnOwn, ownScope, pinnedOrgs, kept? }], extension,
+     * connectorOrgs: [{ orgId, connectors, needsConfig }], diffHash }`. Nothing written. The same
+     * version, a target the deployment's extension or a dependent plugin cannot take -> 409
+     * `plugin.upgrade_target_invalid`; an added skill named like one in use where the plugin is on
+     * -> 409 `plugin.skill_conflict`; disabled -> 403 `catalog.item_disabled`.
+     */
+    previewUpdate(id: string, body: z.infer<typeof CatalogUpdatePreviewBody>): Promise<PlatformUpdatePreview>;
+    /**
+     * Updates the platform plugin, confirmed with the preview's `diffHash` (recomputed under the item
+     * lock; a difference -> 409 `plugin.upgrade_stale`; another update running -> 409
+     * `plugin.install_in_progress`). A failure undoes everything -> 502 `plugin.upgrade_failed`.
+     * Audits `plugin.platform_updated`. A version an org upload waits with (or an item whose first
+     * version waits) -> 409 `catalog.item_pending`: confirm it in 待确认 (pre-flight F8); the
+     * preview answers the same.
+     */
+    update(principal: Principal, id: string, body: z.infer<typeof CatalogUpdateBody>): Promise<PlatformUpdateResult>;
+    /** 删除条目（软删除，已安装的组件不受影响）。 */
+    remove(principal: Principal, id: string): Promise<void>;
 }
 export {};

package/dist/catalog/admin-catalog.controller.js

@@ -7,56 +7,81 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Controller, Delete, Get, HttpCode, Inject, Param, Post, Put, Query, Req, Res, } from "@nestjs/common";
+import { Controller, Delete, Get, HttpCode, Inject, Param, Post, Put, Req, Res, } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
-import { CATALOG, ORG_CATALOG, PLUGIN_IMPORT } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
-import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
-import { CATALOG_LIST_MAX_LIMIT, } from "./catalog.service.js";
+import { PluginIcons } from "../extensions/plugin-icons.js";
+import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZQuery } from "../infra/validation/zod-params.js";
+import { CatalogItemsQuery, CatalogUpdateBody, CatalogUpdatePreviewBody, CatalogDisabledBody as DisabledBody, CatalogGitImportBody as GitBody, CatalogHash as Hash, CatalogNpmImportBody as NpmBody, CatalogScopeOrgs as Orgs, CatalogScope as Scope, CatalogScopeBody as ScopeBody, CatalogScopePreviewBody as ScopePreviewBody, CatalogShownBody as ShownBody, } from "./admin-catalog.schemas.js";
+import { CatalogService, } from "./catalog.service.js";
+import { CatalogScopeService } from "./catalog-scope.service.js";
 import { sendCatalogIcon } from "./org-catalog.controller.js";
-const NpmBody = z.object({
-    package: z.string().min(1).max(214),
-    version: z.string().min(1).max(256).optional(),
-});
-const GitBody = z
+import { OrgCatalogService } from "./org-catalog.service.js";
+import { PluginImport } from "./plugin-import.js";
+import { PlatformPluginUpdater, } from "./plugin-upgrade.js";
+const ConfirmBody = z
     .object({
-    url: z.string().min(1).max(2000),
-    ref: z.string().min(1).max(256).optional(),
-    path: z.string().min(1).max(512).optional(),
-})
-    .strict();
-const PolicyBody = z.object({ policy: z.enum(["allow", "needs_approval", "disabled"]) });
-const InstallBody = z.object({ version: z.string().min(1).max(256) });
-const ConfirmBody = z.object({
-    reviewHash: z.string().min(1).max(128),
-    deployExtension: z.boolean(),
+    reviewHash: Hash,
+    /** The new item's scope (default `optional`); `orgs` only with `named`. */
+    scope: Scope.optional(),
+    orgs: Orgs.optional(),
     /** Skill names suggested as pinned (spec §9.1); omitted keeps the plugin's flags. */
     pinnedSuggestions: z.array(z.string().min(1).max(64)).max(50).optional(),
-});
-const ListQuery = z.object({
-    includeDeleted: z.enum(["true", "false"]).optional(),
-    limit: z.coerce.number().int().min(1).max(CATALOG_LIST_MAX_LIMIT).optional(),
-    offset: z.coerce.number().int().min(0).max(1_000_000).optional(),
-});
+})
+    .strict();
+const ConfirmPermissionsBody = z.object({ permissionsHash: Hash }).strict();
+/** The reason shown to the owner org in its `upload_rejected` notice (optional). */
+const RejectBody = z.object({ reason: z.string().trim().min(1).max(1000).optional() }).strict();
 const actorOpts = (actor) => {
     const tokenId = patTokenId(actor);
     return tokenId !== undefined ? { actorTokenId: tokenId } : {};
 };
+class CatalogImportConfirmBody extends createZodDto(ConfirmBody, "CatalogImportConfirmBody") {
+}
+class CatalogGitImportBody extends createZodDto(GitBody, "CatalogGitImportBody") {
+}
+class CatalogItemsQueryDto extends createZodDto(CatalogItemsQuery, "CatalogItemsQuery") {
+}
+class CatalogNpmImportBody extends createZodDto(NpmBody, "CatalogNpmImportBody") {
+}
+class CatalogScopePreviewBody extends createZodDto(ScopePreviewBody, "CatalogScopePreviewBody") {
+}
+class CatalogScopeBody extends createZodDto(ScopeBody, "CatalogScopeBody") {
+}
+class CatalogConfirmPermissionsBody extends createZodDto(ConfirmPermissionsBody, "CatalogConfirmPermissionsBody") {
+}
+class CatalogShownBody extends createZodDto(ShownBody, "CatalogShownBody") {
+}
+class CatalogRejectBody extends createZodDto(RejectBody, "CatalogRejectBody") {
+}
+class CatalogDisabledBody extends createZodDto(DisabledBody, "CatalogDisabledBody") {
+}
+class CatalogUpdatePreviewBodyDto extends createZodDto(CatalogUpdatePreviewBody, "CatalogUpdatePreviewBody") {
+}
+class CatalogUpdateBodyDto extends createZodDto(CatalogUpdateBody, "CatalogUpdateBody") {
+}
 /**
- * The enterprise catalog (`/api/v1/admin/catalog/*`, enterprise admins): plugin import (upload / npm
- * prepare, then confirm), the item list and detail, policy, delete, and installing an item's
- * extension on the deployment. Writes re-check the enterprise admin inside the service's lock and are
+ * The platform catalog (`/api/v1/admin/catalog/*`, super admins): plugin import (upload / npm
+ * prepare, then confirm, which installs the plugin's extension), the item list and detail, scope and
+ * disable (previewed, then confirmed with `scopeHash`), delete. Writes re-check the super admin inside the service's lock and are
  * audited.
  */
 let AdminCatalogController = class AdminCatalogController {
     catalog;
     pluginImport;
     orgCatalog;
-    constructor(catalog, pluginImport, orgCatalog) {
+    scope;
+    updater;
+    icons;
+    constructor(catalog, pluginImport, orgCatalog, scope, updater, icons) {
         this.catalog = catalog;
         this.pluginImport = pluginImport;
         this.orgCatalog = orgCatalog;
+        this.scope = scope;
+        this.updater = updater;
+        this.icons = icons;
     }
     /**
      * Prepares the import of an uploaded plugin (an npm-pack tgz as the raw body,
@@ -112,11 +137,13 @@ let AdminCatalogController = class AdminCatalogController {
         return this.pluginImport.staged(stagingId);
     }
     /**
-     * Confirms a staged import: approves the plugin's extension when this import installs it (writes
-     * its snapshot) and creates the item or adds the version; with `deployExtension` it installs and
-     * enables the plugin's own extension after the commit and returns `{ item, deploy }`, where
-     * `deploy` says enabled / failed (+ code); a failed deploy does not make the committed import fail
-     * (retry from the extension admin by sha256). A foreseeable failure (a downgrade to a version with
+     * Confirms a staged import: approves the plugin's extension when this import installs or upgrades
+     * it (writes its snapshot), creates the item (with `scope`, default `optional`; `orgs` only with
+     * `named`, each an existing org, else 400 `validation_failed`) or adds the version, installs and
+     * enables the plugin's own extension after the commit and enqueues the item's scope sync; returns
+     * `{ item, deploy }`, where `deploy` says enabled / failed (+ code), null without an extension to
+     * deploy; a failed deploy does not make the committed import fail (retry from the extension admin
+     * by sha256). An unknown field (the removed `deployExtension`) -> 400 `validation_failed`. A foreseeable failure (a downgrade to a version with
      * unrun migrations) is a 409 `extension.downgrade_unsupported` before anything is written.
      * Staging missing or expired -> 404 `plugin.staging_not_found`; `reviewHash` differs or the
      * extension on the deployment changed -> 409 `plugin.review_stale`. `pinnedSuggestions` (skill
@@ -125,19 +152,27 @@ let AdminCatalogController = class AdminCatalogController {
      */
     confirm(principal, stagingId, body) {
         const actor = requireUser(principal);
-        const { pinnedSuggestions, ...rest } = body;
-        return this.pluginImport.confirm(actor.account.id, stagingId, { ...rest, ...(pinnedSuggestions !== undefined && { pinnedSuggestions }) }, actorOpts(actor));
+        return this.scope.confirmImport(actor.account.id, stagingId, {
+            reviewHash: body.reviewHash,
+            ...(body.scope !== undefined && { scope: body.scope }),
+            ...(body.orgs !== undefined && { orgs: body.orgs }),
+            ...(body.pinnedSuggestions !== undefined && { pinnedSuggestions: body.pinnedSuggestions }),
+        }, actorOpts(actor));
     }
     /**
      * The item list (`includeDeleted=true` includes deleted items). Paging: `limit` (default 200, at
      * most 1000) and `offset`; `nextOffset` is the next page's offset, null when there is none.
      */
-    list(q) {
-        return this.catalog.page({
+    async list(q) {
+        const page = await this.catalog.page({
             includeDeleted: q.includeDeleted === "true",
+            ...(q.pending === "true" && { pending: true }),
             ...(q.limit !== undefined && { limit: q.limit }),
             ...(q.offset !== undefined && { offset: q.offset }),
         });
+        // Each item's icon (admin route; a deleted item has none)
+        const icons = await this.icons.ofItems(page.items.map((i) => i.id), { kind: "admin" });
+        return { ...page, items: page.items.map((i) => ({ ...i, icon: icons.get(i.id) ?? null })) };
     }
     /**
      * 条目详情与各版本，另给出 `hasIcon`（最新版本有图标，`GET items/:id/icon` 可取）；不存在 → 404
@@ -154,24 +189,104 @@ let AdminCatalogController = class AdminCatalogController {
     async icon(id, reply) {
         await sendCatalogIcon(reply, await this.orgCatalog.icon(id, true));
     }
-    /** 改策略（allow / needs_approval / disabled）。 */
-    setPolicy(principal, id, body) {
+    /**
+     * What a scope change (`{ scope, orgs? }`, `orgs` only with `named`) or a disable
+     * (`{ disabled: true }`) would take away: `{ affected: [{ orgId, orgName, agents,
+     * connectorsKept }], needsConfig, scopeHash }` (spec §5 rule 8; nothing written; the connectors
+     * stay as the orgs' own). A builtin item -> 409 `plugin.builtin`; unknown
+     * orgs -> 400 `validation_failed`.
+     */
+    previewScope(id, body) {
+        return this.scope.preview(id, body.scope === undefined
+            ? { disabled: true }
+            : { scope: body.scope, ...(body.orgs !== undefined && { orgs: body.orgs }) });
+    }
+    /**
+     * Changes the scope, confirmed with the preview's `scopeHash` (recomputed under the item row lock;
+     * a difference -> 409 `plugin.scope_stale`); bumps the scope version, audits
+     * `catalog.scope_changed` and enqueues the scope sync. Builtin -> 409 `plugin.builtin`.
+     */
+    setScope(principal, id, body) {
         const actor = requireUser(principal);
-        return this.catalog.setPolicy(actor.account.id, id, body.policy, actorOpts(actor));
+        return this.scope.setScope(actor.account.id, id, {
+            scope: body.scope,
+            scopeHash: body.scopeHash,
+            ...(body.orgs !== undefined && { orgs: body.orgs }),
+        }, actorOpts(actor));
     }
-    /** 删除条目（软删除，已安装的组件不受影响）。 */
-    async remove(principal, id) {
+    /**
+     * Disables the plugin on the whole deployment (`scopeHash` of the `{ disabled: true }` preview
+     * required; the scope sync then uninstalls it everywhere, its scope and the org switches are kept)
+     * or enables it again (no hash; the sync reinstalls where it is wanted). Builtin -> 409
+     * `plugin.builtin`; a stale hash -> 409 `plugin.scope_stale`.
+     */
+    setDisabled(principal, id, body) {
         const actor = requireUser(principal);
-        await this.catalog.remove(actor.account.id, id, actorOpts(actor));
+        return this.scope.setDisabled(actor.account.id, id, {
+            disabled: body.disabled,
+            ...(body.scopeHash !== undefined && { scopeHash: body.scopeHash }),
+        }, actorOpts(actor));
+    }
+    /**
+     * Confirms the item's extension permissions (the admin's 待确认; body `{ permissionsHash }` from
+     * the item view): approves the current permission set (snapshot source `web`) and installs and
+     * enables an extension that was never deployed. A changed set -> 409 `extension.approval_stale`;
+     * nothing to confirm -> 409 `extension.not_pending`. Returns the item. An org's upload
+     * (`owner.kind` org, ruling P3-10): the digest of its pending version's package; a first version
+     * is installed, approved, enabled and synced, a new version applied by the platform update
+     * (the item removed meanwhile -> 409 `catalog.item_removed`, P3-21).
+     */
+    confirmPermissions(principal, id, body) {
+        const actor = requireUser(principal);
+        return this.scope.confirmPermissions(actor.account.id, id, body.permissionsHash, actorOpts(actor));
+    }
+    /**
+     * Rejects an org upload's pending version (ruling P3-10; body `{ reason? }`, told to the owner
+     * org in `upload_rejected`): a first version is removed (its name free again), a new version's
+     * pending state cleared. Nothing pending, or a platform item (pre-flight F11) -> 409
+     * `extension.not_pending`. 204.
+     */
+    async reject(principal, id, body) {
+        const actor = requireUser(principal);
+        await this.scope.reject(actor.account.id, id, body.reason ?? null, actorOpts(actor));
+    }
+    /**
+     * Whether orgs outside a `named` item's list see it as requestable (spec §5.1 rule 1). Hiding it
+     * keeps pending requests as they are; new requests from unlisted orgs are then 404. Never makes
+     * anything usable, so no preview and no scope sync. Audits `catalog.shown_changed`.
+     */
+    setShown(principal, id, body) {
+        const actor = requireUser(principal);
+        return this.scope.setShown(actor.account.id, id, body.shownToOthers, actorOpts(actor));
+    }
+    /**
+     * What updating the platform plugin to `version` would do (spec §7.1, `PlatformPluginUpdater`):
+     * `{ itemId, name, from, to, components: [{ kind, id, name, change: added | removed | upgrade |
+     * downgrade | same, from, to, updatedOnOwn, ownScope, pinnedOrgs, kept? }], extension,
+     * connectorOrgs: [{ orgId, connectors, needsConfig }], diffHash }`. Nothing written. The same
+     * version, a target the deployment's extension or a dependent plugin cannot take -> 409
+     * `plugin.upgrade_target_invalid`; an added skill named like one in use where the plugin is on
+     * -> 409 `plugin.skill_conflict`; disabled -> 403 `catalog.item_disabled`.
+     */
+    previewUpdate(id, body) {
+        return this.updater.preview(id, body.version);
     }
     /**
-     * Installs the extension of a version of an item on the deployment (a new install starts disabled;
-     * unapproved permissions still need approval). A version without an extension -> 409
-     * `catalog.no_extension`.
+     * Updates the platform plugin, confirmed with the preview's `diffHash` (recomputed under the item
+     * lock; a difference -> 409 `plugin.upgrade_stale`; another update running -> 409
+     * `plugin.install_in_progress`). A failure undoes everything -> 502 `plugin.upgrade_failed`.
+     * Audits `plugin.platform_updated`. A version an org upload waits with (or an item whose first
+     * version waits) -> 409 `catalog.item_pending`: confirm it in 待确认 (pre-flight F8); the
+     * preview answers the same.
      */
-    installToDeployment(principal, id, body) {
+    update(principal, id, body) {
+        const actor = requireUser(principal);
+        return this.updater.update(actor.account.id, id, body, actorOpts(actor));
+    }
+    /** 删除条目（软删除，已安装的组件不受影响）。 */
+    async remove(principal, id) {
         const actor = requireUser(principal);
-        return this.catalog.installToDeployment(actor.account.id, id, body.version, actorOpts(actor));
+        await this.catalog.remove(actor.account.id, id, actorOpts(actor));
     }
 };
 __decorate([
@@ -184,13 +299,13 @@ __decorate([
     Post("import/npm"),
     HttpCode(200),
     __param(0, CurrentPrincipal()),
-    __param(1, Body(new ZodPipe(NpmBody)))
+    __param(1, ZBody(CatalogNpmImportBody))
 ], AdminCatalogController.prototype, "importNpm", null);
 __decorate([
     Post("import/git"),
     HttpCode(200),
     __param(0, CurrentPrincipal()),
-    __param(1, Body(new ZodPipe(GitBody)))
+    __param(1, ZBody(CatalogGitImportBody))
 ], AdminCatalogController.prototype, "importGit", null);
 __decorate([
     Get("imports/:stagingId"),
@@ -201,11 +316,11 @@ __decorate([
     HttpCode(201),
     __param(0, CurrentPrincipal()),
     __param(1, Param("stagingId")),
-    __param(2, Body(new ZodPipe(ConfirmBody)))
+    __param(2, ZBody(CatalogImportConfirmBody))
 ], AdminCatalogController.prototype, "confirm", null);
 __decorate([
     Get("items"),
-    __param(0, Query(new ZodPipe(ListQuery)))
+    __param(0, ZQuery(CatalogItemsQueryDto))
 ], AdminCatalogController.prototype, "list", null);
 __decorate([
     Get("items/:id"),
@@ -217,29 +332,69 @@ __decorate([
     __param(1, Res())
 ], AdminCatalogController.prototype, "icon", null);
 __decorate([
-    Put("items/:id/policy"),
+    Post("items/:id/scope/preview"),
+    HttpCode(200),
+    __param(0, Param("id")),
+    __param(1, ZBody(CatalogScopePreviewBody))
+], AdminCatalogController.prototype, "previewScope", null);
+__decorate([
+    Put("items/:id/scope"),
     __param(0, CurrentPrincipal()),
     __param(1, Param("id")),
-    __param(2, Body(new ZodPipe(PolicyBody)))
-], AdminCatalogController.prototype, "setPolicy", null);
+    __param(2, ZBody(CatalogScopeBody))
+], AdminCatalogController.prototype, "setScope", null);
 __decorate([
-    Delete("items/:id"),
+    Put("items/:id/disabled"),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("id")),
+    __param(2, ZBody(CatalogDisabledBody))
+], AdminCatalogController.prototype, "setDisabled", null);
+__decorate([
+    Post("items/:id/confirm"),
+    HttpCode(200),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("id")),
+    __param(2, ZBody(CatalogConfirmPermissionsBody))
+], AdminCatalogController.prototype, "confirmPermissions", null);
+__decorate([
+    Post("items/:id/reject"),
     HttpCode(204),
     __param(0, CurrentPrincipal()),
-    __param(1, Param("id"))
-], AdminCatalogController.prototype, "remove", null);
+    __param(1, Param("id")),
+    __param(2, ZBody(CatalogRejectBody))
+], AdminCatalogController.prototype, "reject", null);
 __decorate([
-    Post("items/:id/install-deployment"),
+    Put("items/:id/shown"),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("id")),
+    __param(2, ZBody(CatalogShownBody))
+], AdminCatalogController.prototype, "setShown", null);
+__decorate([
+    Post("items/:id/update/preview"),
     HttpCode(200),
+    __param(0, Param("id")),
+    __param(1, ZBody(CatalogUpdatePreviewBodyDto))
+], AdminCatalogController.prototype, "previewUpdate", null);
+__decorate([
+    Put("items/:id/update"),
     __param(0, CurrentPrincipal()),
     __param(1, Param("id")),
-    __param(2, Body(new ZodPipe(InstallBody)))
-], AdminCatalogController.prototype, "installToDeployment", null);
+    __param(2, ZBody(CatalogUpdateBodyDto))
+], AdminCatalogController.prototype, "update", null);
+__decorate([
+    Delete("items/:id"),
+    HttpCode(204),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("id"))
+], AdminCatalogController.prototype, "remove", null);
 AdminCatalogController = __decorate([
     Controller("api/v1/admin/catalog"),
-    EnterpriseAdmin(),
-    __param(0, Inject(CATALOG)),
-    __param(1, Inject(PLUGIN_IMPORT)),
-    __param(2, Inject(ORG_CATALOG))
+    SuperAdmin(),
+    __param(0, Inject(CatalogService)),
+    __param(1, Inject(PluginImport)),
+    __param(2, Inject(OrgCatalogService)),
+    __param(3, Inject(CatalogScopeService)),
+    __param(4, Inject(PlatformPluginUpdater)),
+    __param(5, Inject(PluginIcons))
 ], AdminCatalogController);
 export { AdminCatalogController };