@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.2

package/dist/catalog/marketplaces.service.js

@@ -1,18 +1,34 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomUUID } from "node:crypto";
 import { CATALOG_ITEM_NAME_RE, marketplaceEntryVersion, PLUGIN_MANIFEST_FILE, parseMarketplaceManifest, parsePluginManifest, SDK_VERSION, SEMVER_VERSION_RE, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import semver from "semver";
 import { MARKETPLACE_MAX_MIRRORS } from "../config/schema.js";
 import { ConfigError } from "../config/types.js";
 import { createSecrets } from "../ctx/secrets.js";
 import { ApiError } from "../errors.js";
-import { DEPLOYMENT_SECRETS_ORG } from "../extensions/deployment-config.js";
+import { DEPLOYMENT_SECRETS_ORG } from "../extensions/deployment-config-store.js";
 import { audit } from "../identity/audit.js";
-import { lockEnterpriseAdminsAndAuthorize } from "../identity/enterprise-admin.js";
+import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER, KEYRING } from "../infra/tokens.js";
 import { KERNEL_VERSION } from "../version.js";
 import { CLAUDE_PLUGIN_FILE } from "./claude/manifest.js";
 import { CLAUDE_MARKETPLACE_FILE, parseClaudeMarketplace, } from "./claude/marketplace.js";
 import { expandGitUrl, GitSourceError, gitErrorDetails, gitLocationIdentity, gitUrlIdentity, normalGitPath, readGitTreeAndOids, resolveGitCommit, } from "./git-source.js";
+import { CatalogSourceLock } from "./locks.js";
 import { fetchMarketplaceManifest, MarketplaceFetchError, MarketplaceInvalidError, marketplaceNetPolicy, marketplaceUrlProblem, } from "./marketplace-fetch.js";
 import { compareVersions, newestFirst, sameRelease } from "./versions.js";
 /** 官方清单来源的 id。 */
@@ -346,10 +362,28 @@ export async function loadMarketplaceEntry(db, config, sourceId, name, version)
  * status `error`. A status change audits `marketplace.refreshed` and logs once. Stateless, shared
  * by every replica.
  */
-export class MarketplacesService {
-    d;
-    constructor(d) {
-        this.d = d;
+let MarketplacesService = class MarketplacesService {
+    kdb;
+    adminLock;
+    sourceLock;
+    config;
+    keyring;
+    log;
+    txHost;
+    constructor(kdb, 
+    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the caller's transaction. */
+    adminLock, sourceLock, config, keyring, log, txHost) {
+        this.kdb = kdb;
+        this.adminLock = adminLock;
+        this.sourceLock = sourceLock;
+        this.config = config;
+        this.keyring = keyring;
+        this.log = log;
+        this.txHost = txHost;
+    }
+    /** The kernel-schema handle of the current context (the transaction, else the pool). */
+    get db() {
+        return this.kdb.db;
     }
     /**
      * Creates / updates the official marketplace from config (name, URL, its form per
@@ -360,14 +394,14 @@ export class MarketplacesService {
      * without the schema).
      */
     async syncOfficialFromConfig() {
-        const o = this.d.config().marketplaces.official;
+        const o = this.config.get().marketplaces.official;
         const { form, url } = marketplaceForm(o.url);
         if (form === "git" && o.mirrors.length > 0) {
             throw new ConfigError("invalid configuration:\n  - marketplaces.official.mirrors: a git marketplace has no mirrors (point marketplaces.official.url at a mirror repository instead)");
         }
         const mirrors = JSON.stringify(o.mirrors);
         const same = sql `marketplaces.url = excluded.url AND marketplaces.form = excluded.form`;
-        await this.d.db
+        await this.db
             .insertInto("marketplaces")
             .values({
             id: OFFICIAL_MARKETPLACE_ID,
@@ -393,7 +427,7 @@ export class MarketplacesService {
     }
     /** 全部来源（official 在前，其余按创建时间）。 */
     async list() {
-        const rows = (await this.d.db
+        const rows = (await this.db
             .selectFrom("marketplaces")
             .selectAll()
             .orderBy("builtin", "desc")
@@ -403,7 +437,7 @@ export class MarketplacesService {
         return this.views(rows);
     }
     async get(id) {
-        const row = (await this.d.db
+        const row = (await this.db
             .selectFrom("marketplaces")
             .selectAll()
             .where("id", "=", id)
@@ -425,41 +459,44 @@ export class MarketplacesService {
         if (input.token !== undefined)
             this.checkToken(input.token);
         const id = randomUUID();
-        await this.d.db.transaction().execute(async (trx) => {
-            await lockEnterpriseAdminsAndAuthorize(trx, actor);
-            await trx
-                .insertInto("marketplaces")
-                .values({
-                id,
+        await this.writeAdd(actor, id, { ...input, name, form, url }, opts);
+        return this.get(id);
+    }
+    async writeAdd(actor, id, input, opts) {
+        const { name, url, form } = input;
+        const t = this.db;
+        await this.adminLock.lockAndAuthorize(actor);
+        await t
+            .insertInto("marketplaces")
+            .values({
+            id,
+            name,
+            url,
+            form,
+            ref: input.ref ?? null,
+            mirrors: JSON.stringify(input.mirrors ?? []),
+            builtin: false,
+            enabled: true,
+            created_by: actor,
+        })
+            .execute();
+        if (input.token !== undefined) {
+            await this.secrets().set(DEPLOYMENT_SECRETS_ORG, tokenKey(id), input.token);
+        }
+        await audit(t, {
+            actorAccountId: actor,
+            ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+            action: "marketplace.added",
+            target: id,
+            detail: {
                 name,
                 url,
                 form,
-                ref: input.ref ?? null,
-                mirrors: JSON.stringify(input.mirrors ?? []),
-                builtin: false,
-                enabled: true,
-                created_by: actor,
-            })
-                .execute();
-            if (input.token !== undefined) {
-                await this.secrets(trx).set(DEPLOYMENT_SECRETS_ORG, tokenKey(id), input.token);
-            }
-            await audit(trx, {
-                actorAccountId: actor,
-                ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                action: "marketplace.added",
-                target: id,
-                detail: {
-                    name,
-                    url,
-                    form,
-                    ...(input.ref !== undefined && { ref: input.ref }),
-                    mirrors: input.mirrors ?? [],
-                    hasToken: input.token !== undefined,
-                },
-            });
+                ...(input.ref !== undefined && { ref: input.ref }),
+                mirrors: input.mirrors ?? [],
+                hasToken: input.token !== undefined,
+            },
         });
-        return this.get(id);
     }
     /**
      * Updates an enterprise marketplace (audit `marketplace.updated`, listing the changed fields, the
@@ -472,101 +509,103 @@ export class MarketplacesService {
      */
     async update(actor, id, patch, opts = {}) {
         const name = patch.name !== undefined ? this.checkName(patch.name) : undefined;
-        await this.d.db.transaction().execute(async (trx) => {
-            await lockEnterpriseAdminsAndAuthorize(trx, actor);
-            const row = (await trx
-                .selectFrom("marketplaces")
-                .selectAll()
-                .where("id", "=", id)
-                .forUpdate()
-                .executeTakeFirst());
-            if (!row)
-                throw notFound();
-            if (row.builtin &&
-                (name !== undefined ||
-                    patch.url !== undefined ||
-                    patch.form !== undefined ||
-                    patch.ref !== undefined ||
-                    patch.mirrors !== undefined ||
-                    patch.token !== undefined)) {
-                throw builtinErr("changed");
-            }
-            const target = patch.url !== undefined || patch.form !== undefined
-                ? marketplaceForm(patch.url ?? row.url, patch.form)
-                : { form: row.form, url: row.url };
-            // Switching form clears the other form's fields unless the patch sets them: the ref when
-            // becoming http, the mirrors when becoming git
-            const switched = target.form !== row.form;
-            const ref = patch.ref !== undefined ? patch.ref : switched && target.form === "http" ? null : row.ref;
-            const mirrors = patch.mirrors ?? (switched && target.form === "git" ? [] : row.mirrors);
-            this.checkUrls(target.url, mirrors);
-            this.checkGitFields(target.form, ref, mirrors);
-            if (typeof patch.token === "string")
-                this.checkToken(patch.token);
-            const changed = [];
-            const set = {};
-            if (name !== undefined && name !== row.name) {
-                set.name = name;
-                changed.push("name");
-            }
-            if (target.url !== row.url) {
-                set.url = target.url;
-                changed.push("url");
-            }
-            if (target.form !== row.form) {
-                set.form = target.form;
-                changed.push("form");
-            }
-            if (ref !== row.ref) {
-                set.ref = ref;
-                changed.push("ref");
-            }
-            if (set.url !== undefined || set.form !== undefined || set.ref !== undefined) {
-                set.etag = null;
-                set.last_commit = null;
-            }
-            if (JSON.stringify(mirrors) !== JSON.stringify(row.mirrors)) {
-                set.mirrors = JSON.stringify(mirrors);
-                changed.push("mirrors");
-            }
-            if (patch.enabled !== undefined && patch.enabled !== row.enabled) {
-                set.enabled = patch.enabled;
-                changed.push("enabled");
-            }
-            if (Object.keys(set).length > 0) {
-                await trx.updateTable("marketplaces").set(set).where("id", "=", id).execute();
-            }
-            if (patch.token !== undefined) {
-                const secrets = this.secrets(trx);
-                const had = (await secrets.get(DEPLOYMENT_SECRETS_ORG, tokenKey(id))) !== null;
-                if (patch.token === null) {
-                    if (had) {
-                        await secrets.delete(DEPLOYMENT_SECRETS_ORG, tokenKey(id));
-                        changed.push("token");
-                    }
-                }
-                else {
-                    await secrets.set(DEPLOYMENT_SECRETS_ORG, tokenKey(id), patch.token);
+        await this.writeUpdate(actor, id, name, patch, opts);
+        return this.get(id);
+    }
+    async writeUpdate(actor, id, name, patch, opts) {
+        const t = this.db;
+        await this.adminLock.lockAndAuthorize(actor);
+        const row = (await t
+            .selectFrom("marketplaces")
+            .selectAll()
+            .where("id", "=", id)
+            .forUpdate()
+            .executeTakeFirst());
+        if (!row)
+            throw notFound();
+        if (row.builtin &&
+            (name !== undefined ||
+                patch.url !== undefined ||
+                patch.form !== undefined ||
+                patch.ref !== undefined ||
+                patch.mirrors !== undefined ||
+                patch.token !== undefined)) {
+            throw builtinErr("changed");
+        }
+        const target = patch.url !== undefined || patch.form !== undefined
+            ? marketplaceForm(patch.url ?? row.url, patch.form)
+            : { form: row.form, url: row.url };
+        // Switching form clears the other form's fields unless the patch sets them: the ref when
+        // becoming http, the mirrors when becoming git
+        const switched = target.form !== row.form;
+        const ref = patch.ref !== undefined ? patch.ref : switched && target.form === "http" ? null : row.ref;
+        const mirrors = patch.mirrors ?? (switched && target.form === "git" ? [] : row.mirrors);
+        this.checkUrls(target.url, mirrors);
+        this.checkGitFields(target.form, ref, mirrors);
+        if (typeof patch.token === "string")
+            this.checkToken(patch.token);
+        const changed = [];
+        const set = {};
+        if (name !== undefined && name !== row.name) {
+            set.name = name;
+            changed.push("name");
+        }
+        if (target.url !== row.url) {
+            set.url = target.url;
+            changed.push("url");
+        }
+        if (target.form !== row.form) {
+            set.form = target.form;
+            changed.push("form");
+        }
+        if (ref !== row.ref) {
+            set.ref = ref;
+            changed.push("ref");
+        }
+        if (set.url !== undefined || set.form !== undefined || set.ref !== undefined) {
+            set.etag = null;
+            set.last_commit = null;
+        }
+        if (JSON.stringify(mirrors) !== JSON.stringify(row.mirrors)) {
+            set.mirrors = JSON.stringify(mirrors);
+            changed.push("mirrors");
+        }
+        if (patch.enabled !== undefined && patch.enabled !== row.enabled) {
+            set.enabled = patch.enabled;
+            changed.push("enabled");
+        }
+        if (Object.keys(set).length > 0) {
+            await t.updateTable("marketplaces").set(set).where("id", "=", id).execute();
+        }
+        if (patch.token !== undefined) {
+            const secrets = this.secrets();
+            const had = (await secrets.get(DEPLOYMENT_SECRETS_ORG, tokenKey(id))) !== null;
+            if (patch.token === null) {
+                if (had) {
+                    await secrets.delete(DEPLOYMENT_SECRETS_ORG, tokenKey(id));
                     changed.push("token");
                 }
             }
-            if (changed.length === 0)
-                return;
-            await audit(trx, {
-                actorAccountId: actor,
-                ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                action: "marketplace.updated",
-                target: id,
-                detail: {
-                    changed,
-                    ...(set.enabled !== undefined && { enabled: set.enabled }),
-                    ...(set.url !== undefined && { url: set.url }),
-                    ...(set.form !== undefined && { form: set.form }),
-                    ...(set.ref !== undefined && { ref: set.ref }),
-                },
-            });
+            else {
+                await secrets.set(DEPLOYMENT_SECRETS_ORG, tokenKey(id), patch.token);
+                changed.push("token");
+            }
+        }
+        if (changed.length === 0)
+            return;
+        await audit(t, {
+            actorAccountId: actor,
+            ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+            action: "marketplace.updated",
+            target: id,
+            detail: {
+                changed,
+                ...(set.enabled !== undefined && { enabled: set.enabled }),
+                ...(set.url !== undefined && { url: set.url }),
+                ...(set.form !== undefined && { form: set.form }),
+                ...(set.ref !== undefined && { ref: set.ref }),
+            },
         });
-        return this.get(id);
     }
     /**
      * Deletes an enterprise marketplace (audit `marketplace.removed`): its cached entries and token
@@ -574,27 +613,26 @@ export class MarketplacesService {
      * only be disabled -> `marketplace.builtin`.
      */
     async remove(actor, id, opts = {}) {
-        await this.d.db.transaction().execute(async (trx) => {
-            await lockEnterpriseAdminsAndAuthorize(trx, actor);
-            const row = await trx
-                .selectFrom("marketplaces")
-                .select(["builtin", "name", "url"])
-                .where("id", "=", id)
-                .forUpdate()
-                .executeTakeFirst();
-            if (!row)
-                throw notFound();
-            if (row.builtin)
-                throw builtinErr("deleted");
-            await trx.deleteFrom("marketplaces").where("id", "=", id).execute();
-            await this.secrets(trx).delete(DEPLOYMENT_SECRETS_ORG, tokenKey(id));
-            await audit(trx, {
-                actorAccountId: actor,
-                ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                action: "marketplace.removed",
-                target: id,
-                detail: { name: row.name, url: row.url },
-            });
+        const t = this.db;
+        await this.adminLock.lockAndAuthorize(actor);
+        const row = await t
+            .selectFrom("marketplaces")
+            .select(["builtin", "name", "url"])
+            .where("id", "=", id)
+            .forUpdate()
+            .executeTakeFirst();
+        if (!row)
+            throw notFound();
+        if (row.builtin)
+            throw builtinErr("deleted");
+        await t.deleteFrom("marketplaces").where("id", "=", id).execute();
+        await this.secrets().delete(DEPLOYMENT_SECRETS_ORG, tokenKey(id));
+        await audit(t, {
+            actorAccountId: actor,
+            ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+            action: "marketplace.removed",
+            target: id,
+            detail: { name: row.name, url: row.url },
         });
     }
     /**
@@ -609,8 +647,8 @@ export class MarketplacesService {
      * (the message gives each URL's failure).
      */
     async refresh(id, signal, actor, opts = {}) {
-        const config = this.d.config();
-        const row = (await this.d.db
+        const config = this.config.get();
+        const row = (await this.db
             .selectFrom("marketplaces")
             .selectAll()
             .where("id", "=", id)
@@ -624,7 +662,7 @@ export class MarketplacesService {
         }
         const token = row.builtin
             ? undefined
-            : ((await this.secrets(this.d.db).get(DEPLOYMENT_SECRETS_ORG, tokenKey(id))) ?? undefined);
+            : ((await this.secrets().get(DEPLOYMENT_SECRETS_ORG, tokenKey(id))) ?? undefined);
         const tokenOrigin = new URL(row.url).origin;
         const errors = [];
         // the API code of each failed URL (undefined: an ordinary fetch failure)
@@ -660,7 +698,7 @@ export class MarketplacesService {
                     etag: row.etag,
                     ...(token !== undefined && { token, tokenOrigin }),
                     maxBytes: config.marketplaces.maxIndexBytes,
-                    timeoutMs: this.d.fetchTimeoutMs ?? MARKETPLACE_FETCH_TIMEOUT_MS,
+                    timeoutMs: MARKETPLACE_FETCH_TIMEOUT_MS,
                     net: marketplaceNetPolicy(config),
                     signal,
                 });
@@ -688,89 +726,17 @@ export class MarketplacesService {
             ? new Map()
             : await this.resolveHeads(id, outcome === "not_modified" ? undefined : outcome.manifest.plugins, { url: row.url, token }, signal);
         const lastError = status === "error" ? errors.join("\n").slice(0, MAX_ERROR_CHARS) : null;
-        const from = await this.d.db.transaction().execute(async (trx) => {
-            await sql `SELECT pg_advisory_xact_lock(hashtext(${`capybara.catalog-source:${id}`}))`.execute(trx);
-            const cur = await trx
-                .selectFrom("marketplaces")
-                .select(["last_status", "url", "mirrors", "form", "ref", "last_commit"])
-                .where("id", "=", id)
-                .forUpdate()
-                .executeTakeFirst();
-            if (!cur)
-                throw notFound();
-            // The admin changed the URL / mirrors during the fetch: what we fetched is the old address's
-            // content, so write no entries, ETag or status (the next refresh uses the new address)
-            if (cur.url !== row.url ||
-                cur.form !== row.form ||
-                cur.ref !== row.ref ||
-                // another refresh wrote a commit meanwhile: ours may be older, never move it back
-                cur.last_commit !== row.last_commit ||
-                JSON.stringify(cur.mirrors) !== JSON.stringify(row.mirrors)) {
-                return "stale";
-            }
-            if (outcome !== undefined && outcome !== "not_modified") {
-                await this.replaceEntries(trx, id, outcome.manifest.plugins, outcome.trees, outcome.overlays);
-            }
-            if (outcome !== undefined) {
-                // heads not resolved this time are unknown again (never a stale head)
-                await trx
-                    .updateTable("marketplace_entries")
-                    .set({ head_commit: null, tree_oid: null })
-                    .where("source_id", "=", id)
-                    .where("head_commit", "is not", null)
-                    .execute();
-            }
-            for (const [key, head] of heads) {
-                const [name, version] = key.split("\0");
-                await trx
-                    .updateTable("marketplace_entries")
-                    .set({ head_commit: head.commit, tree_oid: head.tree })
-                    .where("source_id", "=", id)
-                    .where("name", "=", name)
-                    .where("version", "=", version)
-                    .execute();
-            }
-            await trx
-                .updateTable("marketplaces")
-                .set({
-                last_status: status,
-                last_error: lastError,
-                last_refreshed_at: sql `now()`,
-                ...(outcome !== undefined &&
-                    outcome !== "not_modified" && {
-                    etag: outcome.etag,
-                    last_commit: outcome.commit ?? null,
-                    owner_name: outcome.manifest.owner?.name ?? null,
-                    skipped: JSON.stringify(outcome.skipped ?? []),
-                }),
-            })
-                .where("id", "=", id)
-                .execute();
-            if (cur.last_status !== status) {
-                await audit(trx, {
-                    ...(actor !== undefined && { actorAccountId: actor }),
-                    ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                    action: "marketplace.refreshed",
-                    target: id,
-                    detail: {
-                        from: cur.last_status,
-                        to: status,
-                        ...(lastError !== null && { error: lastError }),
-                    },
-                });
-            }
-            return cur.last_status;
-        });
+        const from = await this.recordRefresh(row, { outcome, heads, status, lastError }, actor, opts);
         if (from === "stale") {
-            this.d.log.info("marketplace changed during refresh; result discarded", { marketplace: id });
+            this.log.info("marketplace changed during refresh; result discarded", { marketplace: id });
             return this.get(id);
         }
         if (from !== status) {
             if (status === "error") {
-                this.d.log.warn("marketplace refresh failed", { marketplace: id, error: lastError });
+                this.log.warn("marketplace refresh failed", { marketplace: id, error: lastError });
             }
             else {
-                this.d.log.info("marketplace refreshed", { marketplace: id });
+                this.log.info("marketplace refreshed", { marketplace: id });
             }
         }
         if (status === "error" && opts.throwOnError) {
@@ -794,7 +760,7 @@ export class MarketplacesService {
      * (Decision 3). Throws {@link GitSourceError} or {@link MarketplaceInvalidError}.
      */
     async fetchGit(row, token, signal) {
-        const config = this.d.config();
+        const config = this.config.get();
         const options = {
             net: marketplaceNetPolicy(config),
             maxBytes: config.packages.maxBytes,
@@ -914,9 +880,9 @@ export class MarketplacesService {
      * entry unknown (never fails the refresh). Returns `name\0version` -> head.
      */
     async resolveHeads(id, fresh, m, signal) {
-        const config = this.d.config();
+        const config = this.config.get();
         const listed = fresh ??
-            (await this.d.db
+            (await this.db
                 .selectFrom("marketplace_entries")
                 .select("entry")
                 .where("source_id", "=", id)
@@ -925,7 +891,7 @@ export class MarketplacesService {
         const names = [...new Set(listed.filter((e) => "git" in e.source).map((e) => e.name))];
         if (names.length === 0)
             return out;
-        const imported = await this.d.db
+        const imported = await this.db
             .selectFrom("catalog_items as i")
             .innerJoin("catalog_item_versions as v", "v.item_id", "i.id")
             .select(["i.name", "v.version", "v.source", "v.source_ref", "v.integrity", "v.source_detail"])
@@ -933,7 +899,7 @@ export class MarketplacesService {
             .where("i.name", "in", names)
             .execute();
         const todo = headsToResolve(listed, imported, config, MARKETPLACE_HEADS_MAX);
-        const timeoutMs = this.d.fetchTimeoutMs ?? MARKETPLACE_FETCH_TIMEOUT_MS;
+        const timeoutMs = MARKETPLACE_FETCH_TIMEOUT_MS;
         const queue = [...todo];
         await Promise.all(Array.from({ length: Math.min(HEADS_CONCURRENCY, queue.length) }, async () => {
             for (let e = queue.shift(); e !== undefined; e = queue.shift()) {
@@ -959,7 +925,7 @@ export class MarketplacesService {
                 }
                 catch (err) {
                     // a head lookup never fails the refresh: that entry stays unknown
-                    this.d.log.warn("cannot resolve the branch head of a marketplace entry", {
+                    this.log.warn("cannot resolve the branch head of a marketplace entry", {
                         marketplace: id,
                         entry: e.name,
                         error: err instanceof Error ? err.message : String(err),
@@ -971,12 +937,12 @@ export class MarketplacesService {
     }
     /** The token of an enterprise marketplace (undefined without one; official never has one). */
     async token(id) {
-        return (await this.secrets(this.d.db).get(DEPLOYMENT_SECRETS_ORG, tokenKey(id))) ?? undefined;
+        return (await this.secrets().get(DEPLOYMENT_SECRETS_ORG, tokenKey(id))) ?? undefined;
     }
     /** Refreshes every effective marketplace (maintenance job `catalogs-refresh`), one failing not stopping the rest. */
     async refreshAll(signal) {
-        const config = this.d.config();
-        const rows = await this.d.db
+        const config = this.config.get();
+        const rows = await this.db
             .selectFrom("marketplaces")
             .select(["id", "builtin", "enabled"])
             .orderBy("id")
@@ -990,7 +956,7 @@ export class MarketplacesService {
                 await this.refresh(r.id, signal);
             }
             catch (err) {
-                this.d.log.error("marketplace refresh crashed", { marketplace: r.id, err });
+                this.log.error("marketplace refresh crashed", { marketplace: r.id, err });
             }
         }
     }
@@ -1001,8 +967,8 @@ export class MarketplacesService {
      * (the UI suggests narrowing the filter).
      */
     async entries(q = {}) {
-        const config = this.d.config();
-        let query = this.d.db
+        const config = this.config.get();
+        let query = this.db
             .selectFrom("marketplace_entries as e")
             .innerJoin("marketplaces as s", "s.id", "e.source_id")
             .select([
@@ -1043,7 +1009,7 @@ export class MarketplacesService {
             a.source_id.localeCompare(b.source_id));
         if (rows.length === 0)
             return { items: [], truncated: false };
-        const items = await this.d.db
+        const items = await this.db
             .selectFrom("catalog_items as i")
             .leftJoin("catalog_item_versions as v", "v.item_id", "i.id")
             .select([
@@ -1114,14 +1080,95 @@ export class MarketplacesService {
         });
         return { items: views, truncated };
     }
+    /**
+     * Writes a refresh's result under the marketplace's lock (entries, heads, status, the status
+     * change audit); `stale` when the marketplace changed during the fetch (nothing is written).
+     */
+    async recordRefresh(row, r, actor, opts) {
+        const { id } = row;
+        const { outcome, heads, status, lastError } = r;
+        await this.sourceLock.lock(id);
+        const t = this.db;
+        const cur = await t
+            .selectFrom("marketplaces")
+            .select(["last_status", "url", "mirrors", "form", "ref", "last_commit"])
+            .where("id", "=", id)
+            .forUpdate()
+            .executeTakeFirst();
+        if (!cur)
+            throw notFound();
+        // The admin changed the URL / mirrors during the fetch: what we fetched is the old address's
+        // content, so write no entries, ETag or status (the next refresh uses the new address)
+        if (cur.url !== row.url ||
+            cur.form !== row.form ||
+            cur.ref !== row.ref ||
+            // another refresh wrote a commit meanwhile: ours may be older, never move it back
+            cur.last_commit !== row.last_commit ||
+            JSON.stringify(cur.mirrors) !== JSON.stringify(row.mirrors)) {
+            return "stale";
+        }
+        if (outcome !== undefined && outcome !== "not_modified") {
+            await this.replaceEntries(id, outcome.manifest.plugins, outcome.trees, outcome.overlays);
+        }
+        if (outcome !== undefined) {
+            // heads not resolved this time are unknown again (never a stale head)
+            await t
+                .updateTable("marketplace_entries")
+                .set({ head_commit: null, tree_oid: null })
+                .where("source_id", "=", id)
+                .where("head_commit", "is not", null)
+                .execute();
+        }
+        for (const [key, head] of heads) {
+            const [name, version] = key.split("\0");
+            await t
+                .updateTable("marketplace_entries")
+                .set({ head_commit: head.commit, tree_oid: head.tree })
+                .where("source_id", "=", id)
+                .where("name", "=", name)
+                .where("version", "=", version)
+                .execute();
+        }
+        await t
+            .updateTable("marketplaces")
+            .set({
+            last_status: status,
+            last_error: lastError,
+            last_refreshed_at: sql `now()`,
+            ...(outcome !== undefined &&
+                outcome !== "not_modified" && {
+                etag: outcome.etag,
+                last_commit: outcome.commit ?? null,
+                owner_name: outcome.manifest.owner?.name ?? null,
+                skipped: JSON.stringify(outcome.skipped ?? []),
+            }),
+        })
+            .where("id", "=", id)
+            .execute();
+        if (cur.last_status !== status) {
+            await audit(t, {
+                ...(actor !== undefined && { actorAccountId: actor }),
+                ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+                action: "marketplace.refreshed",
+                target: id,
+                detail: {
+                    from: cur.last_status,
+                    to: status,
+                    ...(lastError !== null && { error: lastError }),
+                },
+            });
+        }
+        return cur.last_status;
+    }
     /**
      * Replaces the entries of a marketplace; `trees` (a git marketplace) gives each path entry the
      * tree oid of its directory.
      */
-    async replaceEntries(trx, id, entries, trees, overlays) {
-        await trx.deleteFrom("marketplace_entries").where("source_id", "=", id).execute();
+    async replaceEntries(id, entries, trees, overlays) {
+        const t = this.db;
+        await t.deleteFrom("marketplace_entries").where("source_id", "=", id).execute();
         for (let i = 0; i < entries.length; i += INSERT_BATCH) {
-            await trx
+            await t
                 .insertInto("marketplace_entries")
                 .values(entries.slice(i, i + INSERT_BATCH).map((e) => ({
                 source_id: id,
@@ -1138,15 +1185,15 @@ export class MarketplacesService {
     async views(rows) {
         if (rows.length === 0)
             return [];
-        const config = this.d.config();
+        const config = this.config.get();
         const ids = rows.map((r) => r.id);
-        const counts = await this.d.db
+        const counts = await this.db
             .selectFrom("marketplace_entries")
             .select(["source_id", (eb) => eb.fn.countAll().as("n")])
             .where("source_id", "in", ids)
             .groupBy("source_id")
             .execute();
-        const tokens = await this.d.db
+        const tokens = await this.db
             .selectFrom("secrets")
             .select("key")
             .where("namespace", "=", SECRETS_NAMESPACE)
@@ -1176,8 +1223,9 @@ export class MarketplacesService {
             createdAt: r.created_at.toISOString(),
         }));
     }
-    secrets(db) {
-        return createSecrets(db, this.d.keyring, SECRETS_NAMESPACE);
+    /** The deployment secrets on the current context's handle (the transaction, else the pool). */
+    secrets() {
+        return createSecrets(this.db, this.keyring, SECRETS_NAMESPACE);
     }
     checkName(name) {
         const n = name.trim();
@@ -1187,7 +1235,7 @@ export class MarketplacesService {
         return n;
     }
     checkUrls(url, mirrors) {
-        const allow = this.d.config().marketplaces.allowInsecureLoopback;
+        const allow = this.config.get().marketplaces.allowInsecureLoopback;
         if (mirrors.length > MARKETPLACE_MAX_MIRRORS) {
             throw new ApiError("validation_failed", `at most ${MARKETPLACE_MAX_MIRRORS} mirrors`);
         }
@@ -1214,4 +1262,30 @@ export class MarketplacesService {
             throw new ApiError("validation_failed", `token must be 1–${MAX_TOKEN_CHARS} characters without line breaks`);
         }
     }
-}
+};
+__decorate([
+    Transactional()
+], MarketplacesService.prototype, "writeAdd", null);
+__decorate([
+    Transactional()
+], MarketplacesService.prototype, "writeUpdate", null);
+__decorate([
+    Transactional()
+], MarketplacesService.prototype, "remove", null);
+__decorate([
+    Transactional()
+], MarketplacesService.prototype, "recordRefresh", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], MarketplacesService.prototype, "replaceEntries", null);
+MarketplacesService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(EnterpriseAdminLock)),
+    __param(2, Inject(CatalogSourceLock)),
+    __param(3, Inject(KernelConfigService)),
+    __param(4, Inject(KEYRING)),
+    __param(5, Inject(KERNEL_LOGGER)),
+    __param(6, Inject(TransactionHost))
+], MarketplacesService);
+export { MarketplacesService };