@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.2

package/dist/extensions/cli.js

@@ -1,50 +1,47 @@
 import { SDK_VERSION } from "@capybara-hq/plugin-sdk";
-import { Redis } from "ioredis";
-import { createBus } from "../ctx/bus.js";
-import { createKeyring } from "../ctx/secrets.js";
-import { kernelDb } from "../db/kernel-schema.js";
-import { createDb } from "../db/pool.js";
+import { openKernelCli } from "../infra/cli/kernel-cli.module.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { KERNEL_BUS, KEYRING } from "../infra/tokens.js";
 import { ExtensionAdminOps } from "./admin-ops.js";
 import { ExtensionAdmin } from "./admin-view.js";
 import { ExtensionApprovals } from "./approvals.js";
 import { ExtensionBlobs } from "./blobs.js";
-import { mergeDeploymentConfig, readStoredDeploymentConfig, schemaFields, secretPathsOf, } from "./deployment-config.js";
+import { BootstrapService } from "./bootstrap.js";
+import { toIssues } from "./config-issues.js";
+import { mergeDeploymentConfig, readStoredDeploymentConfig, schemaFields, secretPathsOf, } from "./deployment-config-store.js";
+import { ExtensionsModule } from "./extensions.module.js";
 import { ExtensionHost } from "./host.js";
 import { ExtensionInstalls } from "./installs.js";
-import { PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
-import { toIssues } from "./org-config.js";
+import { PLUGINS_CHANGED_TOPIC } from "./lifecycle-topics.js";
 import { ExtensionPackageError, extensionPackageApiError, permissionSetOfPackage, readExtensionPackage, } from "./package.js";
-/** CLI 发布 bus 消息时连 Redis 的时限（连不上只告警）。 */
-const CLI_REDIS_CONNECT_TIMEOUT_MS = 3_000;
 /**
- * The CLI's extension management context (C18, F-Q): connects only to PG (and Redis for publishing),
- * starts no extension host and runs no extension's `setup` (a catalog import sets up the declared
- * object-store extension itself, see `openCatalogCli`). Packages the CLI imports are always
- * stored in PG (`blob_store = 'pg'`); replicas read by `blob_store`. Install / enable / disable /
- * uninstall share {@link ExtensionAdminOps} with the admin console (actor null, audits without an
- * actor); after writing PG it publishes `kernel.plugins.changed` and running replicas reconcile; a
- * failed publish only warns (the periodic reconcile catches up).
+ * The CLI's extension management context (C18, F-Q): a Nest application context with
+ * the extensions module over the database and a lazy Redis connection used only for publishing
+ * and the bootstrap lock. It loads no extension and runs no extension's `setup` (a catalog import
+ * sets up the declared object-store extension itself, see `openCatalogCli`). Packages the CLI
+ * imports are always stored in PG (`blob_store = 'pg'`); replicas read by `blob_store`. Install /
+ * enable / disable / uninstall share {@link ExtensionAdminOps} with the admin console (actor null,
+ * audits without an actor); after writing PG it publishes `kernel.plugins.changed` and running
+ * replicas reconcile; a failed publish only warns (the periodic reconcile catches up).
  */
 export async function openExtensionCli(config, log, opts = {}) {
     const inspected = await ExtensionHost.inspect(config.extensions, {
         ...(opts.resolveFrom !== undefined && { resolveFrom: opts.resolveFrom }),
     });
-    const raw = createDb(config.db.url, 2, (err) => log.error("pg idle client error", { err }), {
-        connectTimeoutMs: config.db.connectTimeoutMs,
+    const app = await openKernelCli(config, {
+        logger: log,
+        ...(opts.resolveFrom !== undefined && { resolveFrom: opts.resolveFrom }),
+        modules: [ExtensionsModule, ...(opts.modules ?? [])],
     });
-    const db = kernelDb(raw);
-    const local = new Map();
-    const stored = new ExtensionBlobs({ db, maxBytes: () => config.packages.maxBytes });
-    const blobs = {
-        get: async (sha256) => local.get(sha256) ?? stored.get(sha256),
-    };
-    const declared = new Map(inspected.map((p) => [p.manifest.name, p.source]));
+    const close = () => app.close().catch(() => { });
+    const db = app.get(KernelDb);
+    const keyring = app.get(KEYRING);
+    const blobs = app.get(ExtensionBlobs);
     // 部署配置 = 启动配置补上后台保存在 PG 的字段（C10）；不合法的插件内核不加载（待配置）
-    const keyring = createKeyring(Buffer.from(config.masterKey, "base64"), config.masterKeyPrevious.map((k) => Buffer.from(k, "base64")));
     const deploymentConfigOf = async (name, schema) => {
         if (!schema)
             return { ok: true, value: {} };
-        const stored = await readStoredDeploymentConfig(db, keyring, name, {
+        const stored = await readStoredDeploymentConfig(db.db, keyring, name, {
             secretPaths: secretPathsOf(schemaFields(schema)),
         });
         const r = schema.safeParse(mergeDeploymentConfig(stored, config.extensionConfig[name], schemaFields(schema).map((f) => f.path)));
@@ -65,77 +62,28 @@ export async function openExtensionCli(config, log, opts = {}) {
         }
     }
     catch (e) {
-        await raw.destroy().catch(() => { });
+        await close();
         throw e;
     }
-    const declaredInfo = inspected.map((p) => ({
-        name: p.manifest.name,
-        source: p.source,
-        version: p.manifest.version,
-        permissions: p.permissions,
-        configurable: p.manifest.config?.deployment !== undefined,
-        configValid: !configIssues.has(p.manifest.name),
-    }));
-    let redis;
-    const publisher = {
-        async publish(topic, payload) {
-            if (!redis) {
-                redis = new Redis(config.redis.url, {
-                    lazyConnect: true,
-                    enableOfflineQueue: false,
-                    maxRetriesPerRequest: 0,
-                    connectTimeout: CLI_REDIS_CONNECT_TIMEOUT_MS,
-                    retryStrategy: () => null,
-                });
-                redis.on("error", () => { });
-            }
-            if (redis.status !== "ready")
-                await redis.connect();
-            // 与内核 bus 同一个频道命名（cap:kernel:<topic>）；CLI 只发布，不订阅
-            const bus = createBus(redis, {
-                subscribe: () => Promise.reject(new Error("the CLI does not subscribe")),
-            }, "kernel", log);
-            await bus.publish(topic, payload);
-        },
-    };
-    const installs = new ExtensionInstalls({
-        db,
-        blobs: stored,
-        config: () => config,
-        declared: () => declared,
-    });
-    const admin = new ExtensionAdmin({
-        db,
-        blobs,
-        installs,
-        config: () => config,
-        host: { declaredPlugins: () => declaredInfo },
-        bus: publisher,
-        log,
-    });
-    const ops = new ExtensionAdminOps({
-        db,
-        view: (name) => admin.get(name, { allowUnreadable: true }),
-        declared: () => declared,
-        blobs,
-        config: () => config,
-        bus: publisher,
-        log,
-    });
+    // The admin view, the operations and the bootstrap step see the declared extensions as a
+    // replica would (the CLI checked their deployment config above)
+    app
+        .get(ExtensionHost)
+        .noteInspected(inspected, new Map(inspected.map((p) => [p.manifest.name, !configIssues.has(p.manifest.name)])));
+    const bus = app.get(KERNEL_BUS);
     return {
         config,
-        db,
+        app,
         inspected,
         configIssues,
         deploymentConfigs,
         deploymentConfigOf,
-        installs,
-        admin,
-        ops,
-        approvals: new ExtensionApprovals(db),
-        remember: (sha256, bytes) => {
-            local.set(sha256, bytes);
-        },
+        installs: app.get(ExtensionInstalls),
+        admin: app.get(ExtensionAdmin),
+        ops: app.get(ExtensionAdminOps),
+        approvals: app.get(ExtensionApprovals),
+        bootstrap: app.get(BootstrapService),
+        remember: (sha256, bytes) => blobs.remember(sha256, bytes),
         readPackage: (sha256) => blobs.get(sha256),
         async packageSet(sha256) {
             // a stored package in the pre-0.1.0 format -> extension.legacy_format
@@ -149,7 +97,7 @@ export async function openExtensionCli(config, log, opts = {}) {
         },
         async publishChanged(plugin) {
             try {
-                await publisher.publish(PLUGINS_CHANGED_TOPIC, { plugin });
+                await bus.publish(PLUGINS_CHANGED_TOPIC, { plugin });
                 return true;
             }
             catch (err) {
@@ -157,9 +105,6 @@ export async function openExtensionCli(config, log, opts = {}) {
                 return false;
             }
         },
-        async close() {
-            redis?.disconnect();
-            await raw.destroy().catch(() => { });
-        },
+        close,
     };
 }

package/dist/extensions/config-issues.d.ts

@@ -0,0 +1,7 @@
+import type { z } from "zod";
+/** 校验失败的单条原因：只含路径与按 issue 类型生成的说明，不回显字段值。 */
+export interface ConfigIssue {
+    path: string;
+    message: string;
+}
+export declare function toIssues(error: z.ZodError): ConfigIssue[];

package/dist/extensions/config-issues.js

@@ -0,0 +1,31 @@
+/** 由 issue 类型与结构字段生成说明；不用 zod 的 message（自定义消息可能拼入输入值）。 */
+function issueMessage(i) {
+    switch (i.code) {
+        case "invalid_type":
+            return `expected ${i.expected}`;
+        case "too_small":
+            return `too small (minimum ${String(i.minimum)})`;
+        case "too_big":
+            return `too big (maximum ${String(i.maximum)})`;
+        case "invalid_format":
+            return `invalid ${i.format}`;
+        case "not_multiple_of":
+            return `not a multiple of ${String(i.divisor)}`;
+        case "unrecognized_keys":
+            return "unrecognized keys";
+        case "invalid_union":
+            return "no union member matched";
+        case "invalid_key":
+            return "invalid key";
+        case "invalid_element":
+            return "invalid element";
+        default:
+            return "invalid value";
+    }
+}
+export function toIssues(error) {
+    return error.issues.map((i) => ({
+        path: i.path.map(String).join("."),
+        message: issueMessage(i),
+    }));
+}

package/dist/extensions/deployment-config-store.d.ts

@@ -0,0 +1,49 @@
+import type { core } from "zod";
+import { type Keyring } from "../ctx/secrets.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+type Obj = Record<string, unknown>;
+/**
+ * The stored half of the deployment-level extension config (C10): where PG keeps it, how it is read
+ * back and merged under the startup config. Pure helpers shared by the extension installs (the
+ * desired state the host loads with), the admin service and the CLI.
+ */
+/** 部署级插件配置的密钥存在 `capybara.secrets` 的这个 org_id 下（不是真实组织；namespace `kernel`）。 */
+export declare const DEPLOYMENT_SECRETS_ORG = "_deployment";
+/** 内核自己的 secrets 命名空间（`kernel` 是保留插件名）。 */
+export declare const SECRETS_NAMESPACE = "kernel";
+export declare const secretKey: (plugin: string, path: string) => string;
+/** 一个插件的部署级配置描述：真实模块的 zod schema（有的话）与字段清单。 */
+export interface DeploymentSchemaInfo {
+    version: string;
+    schema?: core.$ZodType | undefined;
+    fields: {
+        path: string;
+        secret: boolean;
+        hot: boolean;
+    }[];
+}
+/** 由 zod schema 得出字段清单（`configFields`：对象路径上的叶子，secret 向下继承）。 */
+export declare function schemaFields(schema: core.$ZodType | undefined): DeploymentSchemaInfo["fields"];
+export declare const isObj: (v: unknown) => v is Obj;
+/** 按点路径设值，缺失的中间对象自动创建；中间节点不是对象时放弃。 */
+export declare function setDeep(obj: Obj, path: string, value: unknown): void;
+/** 按点路径删除键；删完变空的中间对象一并删掉。 */
+export declare function deleteDeep(obj: Obj, path: string): void;
+/**
+ * 合并一个插件的部署配置（C10 的优先级：环境变量 > 文件 / Nacos > PG > schema 默认值）：以启动配置
+ * （`fileValue`，已含环境变量）为底，逐字段补上 PG 里保存、而启动配置没有覆盖的值。按字段合并：启动配置给了的字段
+ * 整个以它为准（不与 PG 的值深合并）。`fields` 为字段点路径（没有 schema 时用 PG 值的叶子路径）。默认值由校验补上。
+ */
+export declare function mergeDeploymentConfig(stored: Obj, fileValue: unknown, fields?: string[]): unknown;
+/**
+ * PG 里一个插件保存的部署配置（非密钥字段 + 解密的密钥字段，按点路径放回对象）。只并入 `secretPaths`（当前
+ * schema 里是密钥的字段）的密钥：旧版本留下、现在已不是密钥或已删掉的字段不解密、不并入（否则会被当成明文回显
+ * 或保存）。
+ */
+export declare function readStoredDeploymentConfig(db: KernelSchemaDb, keyring: Keyring, plugin: string, opts: {
+    forUpdate?: boolean;
+    secretPaths: readonly string[];
+}): Promise<Obj>;
+/** 字段清单里的密钥字段路径。 */
+export declare const secretPathsOf: (fields: DeploymentSchemaInfo["fields"]) => string[];
+export {};

package/dist/extensions/deployment-config-store.js

@@ -0,0 +1,133 @@
+import { configFields, getPath } from "../config/fields.js";
+import { createSecrets } from "../ctx/secrets.js";
+/**
+ * The stored half of the deployment-level extension config (C10): where PG keeps it, how it is read
+ * back and merged under the startup config. Pure helpers shared by the extension installs (the
+ * desired state the host loads with), the admin service and the CLI.
+ */
+/** 部署级插件配置的密钥存在 `capybara.secrets` 的这个 org_id 下（不是真实组织；namespace `kernel`）。 */
+export const DEPLOYMENT_SECRETS_ORG = "_deployment";
+/** 内核自己的 secrets 命名空间（`kernel` 是保留插件名）。 */
+export const SECRETS_NAMESPACE = "kernel";
+const SECRET_KEY_PREFIX = "plugin-deployment-config:";
+export const secretKey = (plugin, path) => `${SECRET_KEY_PREFIX}${plugin}:${path}`;
+/** 由 zod schema 得出字段清单（`configFields`：对象路径上的叶子，secret 向下继承）。 */
+export function schemaFields(schema) {
+    if (!schema)
+        return [];
+    return configFields(schema).map((f) => ({
+        path: f.path,
+        secret: f.meta?.secret === true,
+        hot: f.meta?.hot === true,
+    }));
+}
+export const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/** 按点路径设值，缺失的中间对象自动创建；中间节点不是对象时放弃。 */
+export function setDeep(obj, path, value) {
+    const segs = path.split(".");
+    let node = obj;
+    for (const seg of segs.slice(0, -1)) {
+        const next = node[seg];
+        if (next === undefined)
+            node[seg] = {};
+        else if (!isObj(next))
+            return;
+        node = node[seg];
+    }
+    node[segs[segs.length - 1]] = value;
+}
+/** 按点路径删除键；删完变空的中间对象一并删掉。 */
+export function deleteDeep(obj, path) {
+    const segs = path.split(".");
+    const chain = [obj];
+    let node = obj;
+    for (const seg of segs.slice(0, -1)) {
+        if (!isObj(node))
+            return;
+        node = node[seg];
+        if (!isObj(node))
+            return;
+        chain.push(node);
+    }
+    delete chain[chain.length - 1][segs[segs.length - 1]];
+    for (let i = chain.length - 1; i > 0; i--) {
+        if (Object.keys(chain[i]).length > 0)
+            break;
+        delete chain[i - 1][segs[i - 1]];
+    }
+}
+/** 叶子点路径（对象递归；其余都是叶子）。 */
+function leafPaths(value, prefix = "", out = []) {
+    if (isObj(value)) {
+        for (const [k, v] of Object.entries(value))
+            leafPaths(v, prefix ? `${prefix}.${k}` : k, out);
+    }
+    else if (prefix !== "")
+        out.push(prefix);
+    return out;
+}
+/** 启动配置（文件 / 环境变量合并后的值）是否覆盖了这个字段：给了它、它下面的值，或在祖先上给了非对象值。 */
+function coveredBy(fileValue, path) {
+    let node = fileValue;
+    for (const seg of path.split(".")) {
+        if (node === undefined)
+            return false;
+        if (!isObj(node))
+            return true;
+        node = node[seg];
+    }
+    return node !== undefined;
+}
+/**
+ * 合并一个插件的部署配置（C10 的优先级：环境变量 > 文件 / Nacos > PG > schema 默认值）：以启动配置
+ * （`fileValue`，已含环境变量）为底，逐字段补上 PG 里保存、而启动配置没有覆盖的值。按字段合并：启动配置给了的字段
+ * 整个以它为准（不与 PG 的值深合并）。`fields` 为字段点路径（没有 schema 时用 PG 值的叶子路径）。默认值由校验补上。
+ */
+export function mergeDeploymentConfig(stored, fileValue, fields = leafPaths(stored)) {
+    if (fileValue !== undefined && !isObj(fileValue))
+        return fileValue;
+    const out = structuredClone(fileValue ?? {});
+    for (const path of fields) {
+        const v = getPath(stored, path);
+        if (v === undefined || coveredBy(fileValue, path))
+            continue;
+        setDeep(out, path, structuredClone(v));
+    }
+    return out;
+}
+/**
+ * PG 里一个插件保存的部署配置（非密钥字段 + 解密的密钥字段，按点路径放回对象）。只并入 `secretPaths`（当前
+ * schema 里是密钥的字段）的密钥：旧版本留下、现在已不是密钥或已删掉的字段不解密、不并入（否则会被当成明文回显
+ * 或保存）。
+ */
+export async function readStoredDeploymentConfig(db, keyring, plugin, opts) {
+    let q = db
+        .selectFrom("extension_deployment_configs")
+        .select("config")
+        .where("plugin", "=", plugin);
+    if (opts.forUpdate)
+        q = q.forUpdate();
+    const row = await q.executeTakeFirst();
+    const out = structuredClone(row?.config ?? {});
+    const prefix = secretKey(plugin, "");
+    const wanted = new Set(opts.secretPaths);
+    if (wanted.size === 0)
+        return out;
+    const keys = await db
+        .selectFrom("secrets")
+        .select("key")
+        .where("namespace", "=", SECRETS_NAMESPACE)
+        .where("org_id", "=", DEPLOYMENT_SECRETS_ORG)
+        .execute();
+    const secrets = createSecrets(db, keyring, SECRETS_NAMESPACE);
+    for (const { key } of keys) {
+        if (!key.startsWith(prefix) || !wanted.has(key.slice(prefix.length)))
+            continue;
+        const v = await secrets.get(DEPLOYMENT_SECRETS_ORG, key);
+        if (v !== null)
+            setDeep(out, key.slice(prefix.length), JSON.parse(v));
+    }
+    return out;
+}
+/** 字段清单里的密钥字段路径。 */
+export const secretPathsOf = (fields) => fields.filter((f) => f.secret).map((f) => f.path);

package/dist/extensions/deployment-config.d.ts

@@ -1,21 +1,25 @@
-import { type Transaction } from "kysely";
 import type { core } from "zod";
+import type { KernelAppOptions } from "../app.js";
 import { type ConfigSourceKind } from "../config/sources.js";
 import { type Keyring } from "../ctx/secrets.js";
-import type { KernelDatabase, KernelDb } from "../db/kernel-schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
+import type { PublishBus } from "./admin-view.js";
+import { type ConfigIssue } from "./config-issues.js";
 import { type JsonSchema } from "./config-json-schema.js";
-import { type ConfigIssue } from "./org-config.js";
-type Trx = Transaction<KernelDatabase>;
-type Obj = Record<string, unknown>;
-/** 部署级插件配置的密钥存在 `capybara.secrets` 的这个 org_id 下（不是真实组织；namespace `kernel`）。 */
-export declare const DEPLOYMENT_SECRETS_ORG = "_deployment";
-/**
- * 部署配置保存之后（kernel bus 主题，频道 `cap:kernel:plugin-deployment-config`，payload `{ plugin }`）：
- * 各副本重读并校验——只改了 hot 字段就地替换，改了非 hot 字段重新加载实例，不合法保持当前值并告警；
- * 插件此刻待配置时，下一次 reconcile 加载它。
- */
-export declare const PLUGIN_DEPLOYMENT_CONFIG_TOPIC = "plugin-deployment-config";
+import { DEPLOYMENT_SECRETS_ORG, type DeploymentSchemaInfo, mergeDeploymentConfig, readStoredDeploymentConfig, schemaFields, secretPathsOf } from "./deployment-config-store.js";
+import { ExtensionHost } from "./host.js";
+import { ExtensionInstalls } from "./installs.js";
+import { ExtensionLifecycle } from "./lifecycle.js";
+import { PLUGIN_DEPLOYMENT_CONFIG_TOPIC } from "./lifecycle-topics.js";
+import { PluginDeploymentConfigLock } from "./locks.js";
+export { DEPLOYMENT_SECRETS_ORG, type DeploymentSchemaInfo, mergeDeploymentConfig, readStoredDeploymentConfig, schemaFields, secretPathsOf, };
 export type { ConfigIssue };
+export { PLUGIN_DEPLOYMENT_CONFIG_TOPIC };
 /** 后台一个部署配置字段：来源、是否只读；非密钥字段给出生效值，密钥字段只给 `set`。 */
 export interface DeploymentConfigField {
     path: string;
@@ -50,57 +54,6 @@ export interface DeploymentConfigView {
     /** 校验失败的原因（只有路径与说明，不含值）。 */
     issues: ConfigIssue[];
 }
-/** 一个插件的部署级配置描述：真实模块的 zod schema（有的话）与字段清单。 */
-export interface DeploymentSchemaInfo {
-    version: string;
-    schema?: core.$ZodType | undefined;
-    fields: {
-        path: string;
-        secret: boolean;
-        hot: boolean;
-    }[];
-}
-/** 由 zod schema 得出字段清单（`configFields`：对象路径上的叶子，secret 向下继承）。 */
-export declare function schemaFields(schema: core.$ZodType | undefined): DeploymentSchemaInfo["fields"];
-/**
- * 合并一个插件的部署配置（C10 的优先级：环境变量 > 文件 / Nacos > PG > schema 默认值）：以启动配置
- * （`fileValue`，已含环境变量）为底，逐字段补上 PG 里保存、而启动配置没有覆盖的值。按字段合并：启动配置给了的字段
- * 整个以它为准（不与 PG 的值深合并）。`fields` 为字段点路径（没有 schema 时用 PG 值的叶子路径）。默认值由校验补上。
- */
-export declare function mergeDeploymentConfig(stored: Obj, fileValue: unknown, fields?: string[]): unknown;
-/**
- * PG 里一个插件保存的部署配置（非密钥字段 + 解密的密钥字段，按点路径放回对象）。只并入 `secretPaths`（当前
- * schema 里是密钥的字段）的密钥：旧版本留下、现在已不是密钥或已删掉的字段不解密、不并入（否则会被当成明文回显
- * 或保存）。
- */
-export declare function readStoredDeploymentConfig(db: KernelDb | Trx, keyring: Keyring, plugin: string, opts: {
-    forUpdate?: boolean;
-    secretPaths: readonly string[];
-}): Promise<Obj>;
-/** 字段清单里的密钥字段路径。 */
-export declare const secretPathsOf: (fields: DeploymentSchemaInfo["fields"]) => string[];
-export interface ExtensionDeploymentConfigDeps {
-    db: KernelDb;
-    keyring: Keyring;
-    /** 启动配置里的 `extensionConfig`（文件 / Nacos 与环境变量合并后）。 */
-    fileConfig: () => Record<string, unknown>;
-    /** 启动配置各字段的来源（见 `extensionConfigSources`）；这些字段只读。 */
-    sources: Record<string, Record<string, ConfigSourceKind>>;
-    /** The extension's deployment config description; undefined when the deployment does not know the extension (`extension.not_found`). */
-    schemaOf: (plugin: string) => Promise<DeploymentSchemaInfo | undefined>;
-    /** 保存提交后发布 {@link PLUGIN_DEPLOYMENT_CONFIG_TOPIC}；失败只告警（各副本的周期 reconcile 会重读生效插件的部署配置兜底）。 */
-    bus?: {
-        publish(topic: string, payload: unknown): Promise<void>;
-    };
-    /** 本副本立即应用（不等 bus 消息回到自己；其他副本经 bus）。失败只记 error。 */
-    applyLocal?: (plugin: string) => Promise<unknown>;
-    /** 经手的密钥值（提交后），内核传 `log.addSecrets`。 */
-    onSecrets?: (values: string[]) => void;
-    log: {
-        warn(msg: string, fields?: Record<string, unknown>): void;
-        error(msg: string, fields?: Record<string, unknown>): void;
-    };
-}
 /**
  * Deployment-level extension config (D8 / C10): non-secret fields are stored in
  * `extension_deployment_configs`, each secret field encrypted in `capybara.secrets` (namespace
@@ -110,12 +63,49 @@ export interface ExtensionDeploymentConfigDeps {
  * Secret values are never echoed: responses only say "set", audits only record which paths changed.
  */
 export declare class ExtensionDeploymentConfigService {
-    private readonly d;
-    constructor(d: ExtensionDeploymentConfigDeps);
+    private readonly kdb;
+    readonly txHost: TransactionHost;
+    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    private readonly adminLock;
+    private readonly configLock;
+    private readonly keyring;
+    private readonly config;
+    /** This replica's extension schemas (loaded, config-declared or prepared install records). */
+    private readonly host;
+    /** The effective (stored plus startup) deployment config. */
+    private readonly installs;
+    /** Applies a saved config on this replica at once (other replicas through the bus). */
+    private readonly lifecycle;
+    /** Publishes {@link PLUGIN_DEPLOYMENT_CONFIG_TOPIC} after a save (a failure only warns). */
+    private readonly bus;
+    private readonly log;
+    /** Where each startup-config field comes from (see `extensionConfigSources`); those fields are read-only. */
+    private readonly sources;
+    constructor(kdb: KernelDb, txHost: TransactionHost, 
+    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    adminLock: EnterpriseAdminLock, configLock: PluginDeploymentConfigLock, keyring: Keyring, config: KernelConfigService, 
+    /** This replica's extension schemas (loaded, config-declared or prepared install records). */
+    host: ExtensionHost, 
+    /** The effective (stored plus startup) deployment config. */
+    installs: ExtensionInstalls, 
+    /** Applies a saved config on this replica at once (other replicas through the bus). */
+    lifecycle: ExtensionLifecycle, 
+    /** Publishes {@link PLUGIN_DEPLOYMENT_CONFIG_TOPIC} after a save (a failure only warns). */
+    bus: PublishBus, log: KernelLogger, options: Pick<KernelAppOptions, "env" | "extensionConfigSources">);
+    private get db();
+    /** The startup config's `extensionConfig` (file / Nacos merged with env). */
+    private fileConfig;
+    /**
+     * The extension's deployment config description; undefined when the deployment does not know
+     * the extension (`extension.not_found`). Public for tests only.
+     */
+    schemaOf(plugin: string): Promise<DeploymentSchemaInfo | undefined>;
     /** 插件的生效部署配置（未校验）：启动配置为底，补上 PG 里保存的字段。`schema` 给出时按它的字段合并。 */
     effective(plugin: string, fileValue: unknown, schema?: core.$ZodType): Promise<unknown>;
     /** Admin view; an extension unknown to the deployment -> `extension.not_found`. */
     view(plugin: string): Promise<DeploymentConfigView>;
+    /** `REPEATABLE READ` read-only: every stored field from one snapshot. */
+    private readStored;
     /**
      * Saves some fields: `values` keyed by field dot path, `null` = clear (back to the default),
      * omitted = unchanged.
@@ -129,10 +119,11 @@ export declare class ExtensionDeploymentConfigService {
      * applies it on this replica right away.
      */
     put(plugin: string, values: Record<string, unknown>, actor: string, actorTokenId?: string): Promise<DeploymentConfigView>;
+    private write;
     private info;
     private render;
 }
 /**
  * 本副本拿不到模块时（未加载的安装记录）按包内审阅过的静态清单给出字段（没有 zod schema：不校验，加载时再校验）。
  */
-export declare function staticDeploymentSchema(db: KernelDb, plugin: string): Promise<DeploymentSchemaInfo | undefined>;
+export declare function staticDeploymentSchema(db: KernelSchemaDb, plugin: string): Promise<DeploymentSchemaInfo | undefined>;