@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.2

package/dist/catalog/org-catalog.service.js

@@ -1,320 +1,32 @@
-import { createHash } from "node:crypto";
-import { parseAgentTemplate, parseConnectorTemplateFile, } from "@capybara-hq/plugin-sdk";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
 import { ApiError } from "../errors.js";
-import { lockOrgAndAuthorize } from "../orgs/org-lock.js";
+import { ExtensionRegistry } from "../extensions/registry.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { can, roleAtLeast } from "../orgs/roles.js";
 import { packagePath } from "../packages/tgz.js";
-import { checkSkillFiles, SkillArchiveError } from "../skills/package.js";
-import { itemView } from "./catalog.service.js";
-import { iconProblem } from "./plugin-package.js";
+import { StorageService } from "../storage/storage.service.js";
+import { catalogHasIcon, findConnectorIn, lockOrgForActions, orgTemplateView, readCatalogIcon, readCatalogTemplates, templatePluginProblem, } from "./catalog-content.js";
+import { itemView } from "./catalog-items.js";
+import { PluginInstaller } from "./plugin-install.js";
+import { PluginUpgrader } from "./plugin-upgrade.js";
+import { CatalogRequestsService } from "./requests.service.js";
 import { upgradeInfo } from "./upgrade-targets.js";
-import { satisfiesRange } from "./versions.js";
-/**
- * A connector template as an org sees it (the install wizard and the upgrade preview's inputs):
- * presets and editable paths, no credentials.
- */
-export function orgTemplateView(id, file) {
-    const t = file.template;
-    return {
-        id,
-        displayName: file.displayName,
-        description: file.description ?? "",
-        plugin: t.plugin,
-        connector: t.connector,
-        endpoint: t.endpoint,
-        editableEndpoint: t.editableEndpoint ?? [],
-        auth: t.auth,
-        ownership: t.ownership ??
-            (typeof t.auth.ownership === "string" ? t.auth.ownership : null),
-    };
-}
-const iconNotFound = () => new ApiError("catalog.icon_not_found", "This catalog item has no icon");
-/**
- * The item's latest version row; item missing, deleted or (when `includeDisabled` is false)
- * disabled -> `catalog.item_not_found`.
- */
-async function latestVersionRow(db, itemId, includeDisabled) {
-    if (!UUID_RE.test(itemId))
-        throw itemNotFound();
-    const item = await db
-        .selectFrom("catalog_items")
-        .select(["latest_version", "policy"])
-        .where("id", "=", itemId)
-        .where("deleted_at", "is", null)
-        .executeTakeFirst();
-    // An item the caller cannot see is "not found" before any version / storage is read, so "no icon"
-    // never reveals that it exists
-    if (!item || (!includeDisabled && item.policy === "disabled"))
-        throw itemNotFound();
-    const v = await db
-        .selectFrom("catalog_item_versions")
-        .select(["manifest", "object_prefix", "files"])
-        .where("item_id", "=", itemId)
-        .where("version", "=", item.latest_version)
-        .executeTakeFirst();
-    if (!v)
-        throw itemNotFound();
-    return { item, v };
-}
-/** The icon's path in the version's files (undefined without an icon). */
-const iconPath = (v) => {
-    const icon = v.manifest.icon;
-    return icon === undefined ? undefined : packagePath(icon);
-};
-/** Whether the item's latest version has an icon; unreadable counts as none. */
-export async function catalogHasIcon(db, itemId) {
-    try {
-        const { v } = await latestVersionRow(db, itemId, true);
-        const path = iconPath(v);
-        return path !== undefined && v.files.some((f) => f.path === path);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Reads the icon of the item's latest version (served only through kernel routes, with nosniff and
- * a CSP sandbox in the response headers; the web only shows it with `<img>`). Item missing, deleted
- * or (when `includeDisabled` is false) disabled -> `catalog.item_not_found` (decided before reading
- * storage); no icon -> `catalog.icon_not_found`; stored content that is not a valid svg / png
- * (checked at import, this guards against tampered storage) -> `internal`.
- */
-export async function readCatalogIcon(db, storage, itemId, includeDisabled) {
-    const { item, v } = await latestVersionRow(db, itemId, includeDisabled);
-    const path = iconPath(v);
-    const f = path === undefined ? undefined : v.files.find((x) => x.path === path);
-    if (path === undefined || !f)
-        throw iconNotFound();
-    const [file] = await readCatalogFiles(storage, v.object_prefix, [f]);
-    if (!file)
-        throw iconNotFound();
-    const problem = iconProblem(path, file.data);
-    if (problem !== undefined)
-        throw new ApiError("internal", `Stored icon is invalid: ${problem}`);
-    return {
-        data: file.data,
-        contentType: /\.svg$/i.test(path) ? "image/svg+xml" : "image/png",
-        policy: item.policy,
-    };
-}
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const itemNotFound = () => new ApiError("catalog.item_not_found", "Catalog item not found");
 const itemDisabled = () => new ApiError("catalog.item_disabled", "This catalog item is disabled by the enterprise admin and cannot be newly installed");
-const fail = (path, message) => new ApiError("validation_failed", "Request validation failed", [{ path, message }]);
-/**
- * The org actions installing / uninstalling a plugin needs: the union over its components (an
- * extension -> `org.extensions.manage`, skills -> `skills.manage`, connector templates ->
- * `connectors.manage`, agent templates -> `agents.manage`), re-checked inside the org row lock.
- */
-export function requiredActions(m) {
-    const out = [];
-    if (m.extension)
-        out.push("org.extensions.manage");
-    if ((m.connectorTemplates ?? []).length > 0)
-        out.push("connectors.manage");
-    if ((m.skills ?? []).length > 0)
-        out.push("skills.manage");
-    if ((m.agents ?? []).length > 0)
-        out.push("agents.manage");
-    return out.length > 0 ? out : ["org.extensions.manage"];
-}
-/** Locks the org row in the caller's transaction and re-checks the actor can do every action (else `forbidden`). */
-export async function lockOrgForActions(t, orgId, actor, actions) {
-    const [first, ...rest] = actions;
-    const { role } = await lockOrgAndAuthorize(t, orgId, actor, first);
-    for (const a of rest) {
-        if (!can(role, a))
-            throw new ApiError("forbidden", "Insufficient organization role");
-    }
-}
-const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-const UNSAFE_KEYS = new Set(["__proto__", "prototype", "constructor"]);
-/** 对象的全部叶子点路径（数组与非对象值算叶子）。 */
-function leafPaths(v, base = "") {
-    const out = [];
-    for (const [k, x] of Object.entries(v)) {
-        const p = base ? `${base}.${k}` : k;
-        if (isObj(x) && Object.keys(x).length > 0)
-            out.push(...leafPaths(x, p));
-        else
-            out.push(p);
-    }
-    return out;
-}
-/** The value at a dot path of `v` (own keys only), undefined when absent. */
-export function getPath(v, path) {
-    let node = v;
-    for (const seg of path.split(".")) {
-        if (!isObj(node) || !Object.hasOwn(node, seg))
-            return undefined;
-        node = node[seg];
-    }
-    return node;
-}
-/** Sets the value at a dot path of `obj`, creating the objects on the way. */
-export function setPath(obj, path, value) {
-    const segs = path.split(".");
-    let node = obj;
-    for (const seg of segs.slice(0, -1)) {
-        if (!isObj(node[seg]))
-            node[seg] = {};
-        node = node[seg];
-    }
-    node[segs[segs.length - 1]] = value;
-}
-/**
- * 模板的连接器插件此刻是否可用：插件加载且提供该 kind，并满足 `pluginVersion`（若写了）；不可用返回原因
- * （模型不可见，给管理员看的英文）。
- */
-export function templatePluginProblem(d, template) {
-    if (!d.findConnector(template.plugin, template.connector)) {
-        return `Connector extension ${template.plugin} providing "${template.connector}" is not deployed; ask the enterprise admin to install and enable it`;
-    }
-    const range = template.pluginVersion;
-    const version = d.pluginVersion(template.plugin);
-    if (range !== undefined && version !== undefined && !satisfiesRange(version, range)) {
-        return `Connector extension ${template.plugin} is deployed at version ${version}, but the template needs ${range}; ask the enterprise admin to upgrade it`;
-    }
-    return undefined;
-}
-/**
- * Builds the connector install input from a connector template plus what the org filled in (C30):
- * the endpoint comes from the template, only paths listed in `editableEndpoint` (or fields under
- * them) may be changed by the org, changing another path -> `validation_failed`; the auth method
- * comes from the template, the org only gives credentials (static credentials via `credential`,
- * OAuth via `client`). Re-checks the template's plugin, kind and `pluginVersion` against the
- * connectors loaded on this replica right now (unmet -> `catalog.not_deployed`); the endpoint
- * (merged as a whole) schema check, credential pattern check and OAuth URL policy are re-checked by
- * `ConnectorsService.create`.
- */
-export function templateConnectorInput(deps, template, ref, input, defaultName, at = "connector") {
-    const problem = templatePluginProblem(deps, template);
-    if (problem !== undefined)
-        throw new ApiError("catalog.not_deployed", problem);
-    const given = input ?? {};
-    const editable = template.editableEndpoint ?? [];
-    const endpoint = structuredClone(template.endpoint);
-    if (given.endpoint !== undefined) {
-        if (!isObj(given.endpoint))
-            throw fail(`${at}.endpoint`, "Expected an object");
-        for (const p of leafPaths(given.endpoint)) {
-            const segs = p.split(".");
-            if (segs.some((s) => UNSAFE_KEYS.has(s))) {
-                throw fail(`${at}.endpoint.${p}`, "Invalid key");
-            }
-            const allowed = editable.some((e) => p === e || p.startsWith(`${e}.`));
-            if (!allowed) {
-                throw fail(`${at}.endpoint.${p}`, "This endpoint field is set by the template and cannot be changed");
-            }
-        }
-        for (const e of editable) {
-            const v = getPath(given.endpoint, e);
-            if (v !== undefined)
-                setPath(endpoint, e, v);
-        }
-    }
-    const auth = template.auth;
-    const oauth = auth.type === "oauth_code" || auth.type === "oauth_client";
-    if (oauth && given.credential !== undefined) {
-        throw fail(`${at}.credential`, "This connector uses OAuth; provide client instead");
-    }
-    if (!oauth && given.client !== undefined) {
-        throw fail(`${at}.client`, "This connector does not use OAuth; provide credential instead");
-    }
-    const credential = oauth ? given.client : given.credential;
-    return {
-        name: given.name ?? defaultName,
-        ...(given.slug !== undefined && { slug: given.slug }),
-        connector: template.connector,
-        endpoint,
-        auth,
-        ...(credential !== undefined && { credential }),
-        template: {
-            ...ref,
-            ...(template.defaultToolPolicies !== undefined && {
-                defaultToolPolicies: template.defaultToolPolicies,
-            }),
-        },
-    };
-}
-/** 从部署存储读目录版本里的文件（按版本行的 sha256 校验）；`under` 给出时只读该目录下的文件，路径去掉该前缀。 */
-export async function readCatalogFiles(storage, objectPrefix, files, under) {
-    storage.assertAvailable();
-    if (objectPrefix === null)
-        return [];
-    const store = storage.deployment();
-    const dir = under === undefined ? "" : `${under}/`;
-    const out = [];
-    for (const f of files) {
-        if (!f.path.startsWith(dir))
-            continue;
-        const got = await store.get(`${objectPrefix}${f.path}`);
-        if (!got) {
-            throw new ApiError("storage.unavailable", `Catalog file ${f.path} is missing from object storage`);
-        }
-        const data = new Uint8Array(await new Response(got.body).arrayBuffer());
-        if (createHash("sha256").update(data).digest("hex") !== f.sha256) {
-            throw new ApiError("internal", `Catalog file ${f.path} does not match its recorded hash`);
-        }
-        out.push({ path: f.path.slice(dir.length), size: data.byteLength, sha256: f.sha256, data });
-    }
-    return out;
-}
-/** 校验技能文件并取名字与描述（导入时已校验过；这里防存储被改）。 */
-export function skillOf(files) {
-    try {
-        // Stored files: a version imported before phase D keeps installing (its invocation keys are
-        // read leniently; `skillInvocation` ignores values of the wrong type)
-        return checkSkillFiles(files, { invocationKeys: false });
-    }
-    catch (e) {
-        if (e instanceof SkillArchiveError) {
-            throw new ApiError("internal", `Stored skill is invalid: ${e.problems.join("; ")}`);
-        }
-        throw e;
-    }
-}
-/** The connector templates of a catalog version, read from storage (id = the file's base name). */
-export async function readCatalogTemplates(storage, v) {
-    const refs = v.manifest.connectorTemplates ?? [];
-    if (refs.length === 0)
-        return [];
-    const paths = refs.map((r) => packagePath(r.path));
-    const files = await readCatalogFiles(storage, v.object_prefix, v.files.filter((f) => paths.includes(f.path)));
-    return paths.map((path) => {
-        const f = files.find((x) => x.path === path);
-        let parsed;
-        try {
-            parsed = f && parseConnectorTemplateFile(JSON.parse(new TextDecoder().decode(f.data)));
-        }
-        catch {
-            parsed = undefined;
-        }
-        if (!parsed || "errors" in parsed) {
-            throw new ApiError("internal", `Stored connector template ${path} is missing or invalid`);
-        }
-        return { id: path.split("/").pop().replace(/\.json$/, ""), file: parsed };
-    });
-}
-/**
- * The agent templates of a catalog version (`manifest.agents`, listed explicitly since import),
- * parsed from storage (checked at import; parsed again in case storage was changed).
- */
-export async function readCatalogAgentTemplates(storage, v) {
-    const refs = v.manifest.agents ?? [];
-    if (refs.length === 0)
-        return [];
-    const paths = refs.map((r) => packagePath(r.path));
-    const files = await readCatalogFiles(storage, v.object_prefix, v.files.filter((f) => paths.includes(f.path)));
-    return paths.map((path) => {
-        const f = files.find((x) => x.path === path);
-        const parsed = f && parseAgentTemplate(new TextDecoder().decode(f.data));
-        if (!parsed || "errors" in parsed) {
-            throw new ApiError("internal", `Stored agent template ${path} is missing or invalid`);
-        }
-        return { path, template: parsed.template };
-    });
-}
 /**
  * Organizations browse and install from the enterprise catalog (C22): members browse (without
  * disabled items) and request, org admins install. Every item is a plugin, installed with its
@@ -325,21 +37,43 @@ export async function readCatalogAgentTemplates(storage, v) {
  * `catalog.not_deployed`; needs_approval without a grant -> a stage deployment request (HTTP 202;
  * dependencies are not approved separately, spec §10). No in-process state.
  */
-export class OrgCatalogService {
-    d;
-    constructor(d) {
-        this.d = d;
+let OrgCatalogService = class OrgCatalogService {
+    kdb;
+    orgLock;
+    storage;
+    registry;
+    requests;
+    pluginInstaller;
+    pluginUpgrader;
+    log;
+    txHost;
+    constructor(kdb, 
+    /** The org row lock (orgs/org-lock.ts): joins the caller's transaction. */
+    orgLock, storage, registry, requests, pluginInstaller, pluginUpgrader, log, txHost) {
+        this.kdb = kdb;
+        this.orgLock = orgLock;
+        this.storage = storage;
+        this.registry = registry;
+        this.requests = requests;
+        this.pluginInstaller = pluginInstaller;
+        this.pluginUpgrader = pluginUpgrader;
+        this.log = log;
+        this.txHost = txHost;
+    }
+    /** The kernel-schema handle of the current context (the transaction, else the pool). */
+    get db() {
+        return this.kdb.db;
     }
     /** The org's view of the items; members (not admins) don't see disabled items. */
     async list(orgId, accountId, itemId) {
-        const m = await this.d.db
+        const m = await this.db
             .selectFrom("memberships")
             .select("role")
             .where("org_id", "=", orgId)
             .where("account_id", "=", accountId)
             .executeTakeFirst();
         const isAdmin = m !== undefined && roleAtLeast(m.role, "admin");
-        let q = this.d.db
+        let q = this.db
             .selectFrom("catalog_items")
             .selectAll()
             .where("deleted_at", "is", null)
@@ -354,25 +88,25 @@ export class OrgCatalogService {
             return [];
         const ids = items.map((i) => i.id);
         const [versions, grants, requests, pluginInstalls] = await Promise.all([
-            this.d.db
+            this.db
                 .selectFrom("catalog_item_versions")
                 .select(["item_id", "version", "source", "manifest", "object_prefix", "files"])
                 .where("item_id", "in", ids)
                 .execute(),
-            this.d.db
+            this.db
                 .selectFrom("catalog_org_grants")
                 .select("item_id")
                 .where("org_id", "=", orgId)
                 .execute(),
-            this.d.requests.latestByItem(orgId),
-            this.d.db
+            this.requests.latestByItem(orgId),
+            this.db
                 .selectFrom("plugin_installs")
                 .select(["id", "item_id", "version"])
                 .where("org_id", "=", orgId)
                 .where("status", "in", ["installing", "installed", "upgrading"])
                 .execute(),
         ]);
-        const upgrades = await upgradeInfo(this.d.db, this.d.host, pluginInstalls.flatMap((a) => {
+        const upgrades = await upgradeInfo(this.db, this.registry, pluginInstalls.flatMap((a) => {
             const item = items.find((i) => i.id === a.item_id);
             return item ? [{ itemId: a.item_id, name: item.name, version: a.version }] : [];
         }));
@@ -425,7 +159,7 @@ export class OrgCatalogService {
         const [item] = await this.list(orgId, accountId, itemId);
         if (!item)
             throw itemNotFound();
-        const v = await this.d.db
+        const v = await this.db
             .selectFrom("catalog_item_versions")
             .select(["manifest", "object_prefix", "files"])
             .where("item_id", "=", itemId)
@@ -438,7 +172,7 @@ export class OrgCatalogService {
             item,
             hasIcon: m.icon !== undefined,
             extension: m.extension ? m.name : null,
-            templates: (await readCatalogTemplates(this.d.storage, v)).map((t) => orgTemplateView(t.id, t.file)),
+            templates: (await readCatalogTemplates(this.storage, v)).map((t) => orgTemplateView(t.id, t.file)),
             dependencies: (m.dependencies ?? []).map((d) => ({ name: d.name, range: d.version })),
             skills: (m.skills ?? []).map((s) => packagePath(s.path)),
             agents: (m.agents ?? []).map((a) => packagePath(a.path)),
@@ -449,11 +183,11 @@ export class OrgCatalogService {
      * reading storage).
      */
     icon(itemId, isAdmin) {
-        return readCatalogIcon(this.d.db, this.d.storage, itemId, isAdmin);
+        return readCatalogIcon(this.db, this.storage, itemId, isAdmin);
     }
     /** For the admin item detail: whether the latest version has an icon. */
     hasIcon(itemId) {
-        return catalogHasIcon(this.d.db, itemId);
+        return catalogHasIcon(this.db, itemId);
     }
     /**
      * The items (latest versions) this replica cannot install now: the plugin's extension is not
@@ -462,9 +196,9 @@ export class OrgCatalogService {
      * deployed here (the install reads it again).
      */
     async undeployed(versions) {
-        const loaded = new Map(this.d.host.manifests().map((m) => [m.name, m.version]));
+        const loaded = new Map(this.registry.manifests().map((m) => [m.name, m.version]));
         const deps = {
-            findConnector: this.d.findConnector,
+            findConnector: (plugin, kind) => findConnectorIn(this.registry, plugin, kind),
             pluginVersion: (n) => loaded.get(n),
         };
         const out = new Set();
@@ -477,14 +211,14 @@ export class OrgCatalogService {
             if ((m.connectorTemplates ?? []).length === 0)
                 return;
             try {
-                const templates = await readCatalogTemplates(this.d.storage, v);
+                const templates = await readCatalogTemplates(this.storage, v);
                 if (templates.some((t) => templatePluginProblem(deps, t.file.template) !== undefined)) {
                     out.add(v.item_id);
                 }
             }
             catch (e) {
                 // Unreadable here: counted as deployed, the install reports it
-                this.d.log?.warn("catalog template read failed in the org list", {
+                this.log.warn("catalog template read failed in the org list", {
                     itemId: v.item_id,
                     error: e instanceof Error ? e.message : String(e),
                 });
@@ -498,13 +232,8 @@ export class OrgCatalogService {
             throw itemNotFound();
         // The role first (forbidden when it can install nothing), then item errors: a member cannot
         // probe the existence or versions of a disabled item through error codes
-        await this.d.db.transaction().execute(async (t) => {
-            const { role } = await lockOrgAndAuthorize(t, orgId, actor, "catalog.read");
-            const canAny = ["org.extensions.manage", "connectors.manage", "skills.manage"].some((a) => can(role, a));
-            if (!canAny)
-                throw new ApiError("forbidden", "Insufficient organization role");
-        });
-        const item = await this.d.db
+        await this.assertCanInstall(orgId, actor);
+        const item = await this.db
             .selectFrom("catalog_items")
             .selectAll()
             .where("id", "=", itemId)
@@ -513,7 +242,7 @@ export class OrgCatalogService {
         if (!item)
             throw itemNotFound();
         const version = body.version ?? item.latest_version;
-        const v = await this.d.db
+        const v = await this.db
             .selectFrom("catalog_item_versions")
             .select("version")
             .where("item_id", "=", itemId)
@@ -526,50 +255,57 @@ export class OrgCatalogService {
             throw itemDisabled();
         // Dependencies resolved, extensions deployed, template connectors available: before a request
         // is created. The actions are the union over the plugins the install brings in
-        const { actions } = await this.d.pluginInstaller.preflight(orgId, actor, itemId, version);
+        const { actions } = await this.pluginInstaller.preflight(orgId, actor, itemId, version);
         // 1. Role and policy under the lock; needs_approval without a grant -> a request (202). Approval
         //    follows this plugin's policy only, not its dependencies' (spec §10)
-        const pending = await this.d.db.transaction().execute(async (t) => {
-            await lockOrgForActions(t, orgId, actor, actions);
-            const locked = await t
-                .selectFrom("catalog_items")
-                .select(["policy", "deleted_at"])
-                .where("id", "=", itemId)
-                .forShare()
-                .executeTakeFirst();
-            if (!locked || locked.deleted_at !== null)
-                throw itemNotFound();
-            if (locked.policy === "disabled")
-                throw itemDisabled();
-            if (locked.policy === "needs_approval") {
-                const grant = await t
-                    .selectFrom("catalog_org_grants")
-                    .select("item_id")
-                    .where("item_id", "=", itemId)
-                    .where("org_id", "=", orgId)
-                    .executeTakeFirst();
-                if (!grant) {
-                    return this.d.requests.requestDeployment(t, orgId, actor, item, version, opts);
-                }
-            }
-            return undefined;
-        });
+        const pending = await this.requestIfNeeded(orgId, actor, item, version, actions, opts);
         if (pending !== undefined) {
-            return { status: 202, request: await this.d.requests.view(this.d.db, pending) };
+            return { status: 202, request: await this.requests.view(pending) };
         }
         // 2. Install (each step re-checks the item policy in its own transaction)
         const { version: _version, ...input } = body;
-        const view = await this.d.pluginInstaller.install(orgId, actor, itemId, version, input, opts);
+        const view = await this.pluginInstaller.install(orgId, actor, itemId, version, input, opts);
         return {
             status: 201,
             installed: { itemId, version, pluginInstallId: view.id },
             install: view,
         };
     }
+    /**
+     * Role and policy under the org row lock; needs_approval without a grant -> a stage deployment
+     * request (its id). Approval follows this plugin's policy only, not its dependencies' (spec §10).
+     */
+    async requestIfNeeded(orgId, actor, item, version, actions, opts) {
+        const itemId = item.id;
+        const t = this.db;
+        await lockOrgForActions(this.orgLock, orgId, actor, actions);
+        const locked = await t
+            .selectFrom("catalog_items")
+            .select(["policy", "deleted_at"])
+            .where("id", "=", itemId)
+            .forShare()
+            .executeTakeFirst();
+        if (!locked || locked.deleted_at !== null)
+            throw itemNotFound();
+        if (locked.policy === "disabled")
+            throw itemDisabled();
+        if (locked.policy === "needs_approval") {
+            const grant = await t
+                .selectFrom("catalog_org_grants")
+                .select("item_id")
+                .where("item_id", "=", itemId)
+                .where("org_id", "=", orgId)
+                .executeTakeFirst();
+            if (!grant) {
+                return this.requests.requestDeployment(orgId, actor, item, version, opts);
+            }
+        }
+        return undefined;
+    }
     /** The upgrade preview of an org install (spec §10, see `PluginUpgrader`). */
     async upgradePreview(orgId, actor, installId, version) {
         await this.assertCanInstall(orgId, actor);
-        return this.d.pluginUpgrader.preview(orgId, actor, installId, version);
+        return this.pluginUpgrader.preview(orgId, actor, installId, version);
     }
     /**
      * Upgrades an org install in place (spec §10, Decision 11): the preview's `diffHash` is checked
@@ -580,46 +316,69 @@ export class OrgCatalogService {
     async upgrade(orgId, actor, installId, body, actorTokenId) {
         await this.assertCanInstall(orgId, actor);
         const opts = actorTokenId !== undefined ? { actorTokenId } : {};
-        const { itemId, actions, diff } = await this.d.pluginUpgrader.check(orgId, actor, installId, body);
-        const pending = await this.d.db.transaction().execute(async (t) => {
-            await lockOrgForActions(t, orgId, actor, actions);
-            const locked = await t
-                .selectFrom("catalog_items")
-                .select(["id", "name", "policy", "deleted_at"])
-                .where("id", "=", itemId)
-                .forShare()
-                .executeTakeFirst();
-            if (!locked || locked.deleted_at !== null)
-                throw itemNotFound();
-            if (locked.policy === "disabled")
-                throw itemDisabled();
-            if (locked.policy !== "needs_approval")
-                return undefined;
-            const grant = await t
-                .selectFrom("catalog_org_grants")
-                .select("item_id")
-                .where("item_id", "=", itemId)
-                .where("org_id", "=", orgId)
-                .executeTakeFirst();
-            if (grant)
-                return undefined;
-            return this.d.requests.requestDeployment(t, orgId, actor, locked, body.version, opts);
-        });
+        const { itemId, actions, diff } = await this.pluginUpgrader.check(orgId, actor, installId, body);
+        const pending = await this.upgradeRequestIfNeeded(orgId, actor, itemId, body, actions, opts);
         if (pending !== undefined) {
-            return { status: 202, request: await this.d.requests.view(this.d.db, pending) };
+            return { status: 202, request: await this.requests.view(pending) };
         }
         return {
             status: 200,
-            install: await this.d.pluginUpgrader.upgrade(orgId, actor, installId, body, opts, diff),
+            install: await this.pluginUpgrader.upgrade(orgId, actor, installId, body, opts, diff),
         };
     }
+    /** Like {@link requestIfNeeded}, for an upgrade's target version. */
+    async upgradeRequestIfNeeded(orgId, actor, itemId, body, actions, opts) {
+        const t = this.db;
+        await lockOrgForActions(this.orgLock, orgId, actor, actions);
+        const locked = await t
+            .selectFrom("catalog_items")
+            .select(["id", "name", "policy", "deleted_at"])
+            .where("id", "=", itemId)
+            .forShare()
+            .executeTakeFirst();
+        if (!locked || locked.deleted_at !== null)
+            throw itemNotFound();
+        if (locked.policy === "disabled")
+            throw itemDisabled();
+        if (locked.policy !== "needs_approval")
+            return undefined;
+        const grant = await t
+            .selectFrom("catalog_org_grants")
+            .select("item_id")
+            .where("item_id", "=", itemId)
+            .where("org_id", "=", orgId)
+            .executeTakeFirst();
+        if (grant)
+            return undefined;
+        return this.requests.requestDeployment(orgId, actor, locked, body.version, opts);
+    }
     /** The actor can install something in the org (forbidden otherwise), checked before item errors. */
     async assertCanInstall(orgId, actor) {
-        await this.d.db.transaction().execute(async (t) => {
-            const { role } = await lockOrgAndAuthorize(t, orgId, actor, "catalog.read");
-            const canAny = ["org.extensions.manage", "connectors.manage", "skills.manage"].some((a) => can(role, a));
-            if (!canAny)
-                throw new ApiError("forbidden", "Insufficient organization role");
-        });
+        const { role } = await this.orgLock.lockAndAuthorize(orgId, actor, "catalog.read");
+        const canAny = ["org.extensions.manage", "connectors.manage", "skills.manage"].some((a) => can(role, a));
+        if (!canAny)
+            throw new ApiError("forbidden", "Insufficient organization role");
     }
-}
+};
+__decorate([
+    Transactional()
+], OrgCatalogService.prototype, "requestIfNeeded", null);
+__decorate([
+    Transactional()
+], OrgCatalogService.prototype, "upgradeRequestIfNeeded", null);
+__decorate([
+    Transactional()
+], OrgCatalogService.prototype, "assertCanInstall", null);
+OrgCatalogService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(OrgLock)),
+    __param(2, Inject(StorageService)),
+    __param(3, Inject(ExtensionRegistry)),
+    __param(4, Inject(CatalogRequestsService)),
+    __param(5, Inject(PluginInstaller)),
+    __param(6, Inject(PluginUpgrader)),
+    __param(7, Inject(KERNEL_LOGGER)),
+    __param(8, Inject(TransactionHost))
+], OrgCatalogService);
+export { OrgCatalogService };