@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/catalog/claude/agents.js

@@ -13,16 +13,19 @@ import { item } from "./report.js";
 export const GENERATED_AGENTS_DIR = ".capybara-generated/agents";
 /** Claude Code tool names -> Capybara tool keys (spec §16.4; anything else is dropped). */
 const TOOL_MAP = {
-    Bash: "sandbox_bash",
-    Read: "sandbox_read",
-    Write: "sandbox_write",
-    Edit: "sandbox_edit",
-    MultiEdit: "sandbox_edit",
-    Glob: "sandbox_glob",
-    Grep: "sandbox_grep",
-    Skill: "skill_load",
-    TodoWrite: "todo__write",
-    ToolSearch: "tool_search",
+    Bash: "Bash",
+    Read: "Read",
+    Write: "Write",
+    Edit: "Edit",
+    MultiEdit: "Edit",
+    Glob: "Glob",
+    Grep: "Grep",
+    Skill: "Skill",
+    AskUserQuestion: "AskUserQuestion",
+    ToolSearch: "ToolSearch",
+    Agent: "Agent",
+    Task: "Agent",
+    TodoWrite: "plugin__todo__write",
 };
 /** Claude ignores these for plugin agents: `not_applicable`. */
 const NOT_APPLICABLE = new Set(["permissionMode", "hooks", "mcpServers"]);

package/dist/catalog/cli.d.ts

@@ -32,8 +32,9 @@ export type CliObjectStore = {
  */
 export declare function loadCliObjectStore(cli: Pick<ExtensionCli, "inspected" | "deploymentConfigs" | "deploymentConfigOf" | "approvals" | "config" | "configIssues" | "installs" | "packageSet" | "readPackage">, log: Pick<KernelLogger, "warn">, syncDir: string): Promise<CliObjectStore>;
 /**
- * The CLI's plugin catalog context (`capybara plugins *`): {@link openExtensionCli} plus
- * {@link PluginImport} and {@link CatalogService}. Imports run with actor `null` (the operator of the
+ * The CLI's plugin catalog context (`capybara plugins *`): {@link openExtensionCli} with the
+ * catalog's {@link CatalogImportModule}, so {@link PluginImport} and {@link CatalogService} are the
+ * kernel's providers. Imports run with actor `null` (the operator of the
  * deployment, like `capybara extensions install`: no enterprise-admin re-check, audits without an
  * actor, permission snapshots written with source `cli`). Files of the plugin (skills, connector
  * templates, icons) go to the deployment's object store, set up in-process from the declared or

package/dist/catalog/cli.js

@@ -9,7 +9,8 @@ import { assertSecretsReachable } from "../extensions/host.js";
 import { importExtensionModule, matchesSection } from "../extensions/instance.js";
 import { packageRootOf, syncPackage } from "../extensions/sync.js";
 import { packagePath } from "../packages/tgz.js";
-import { StorageService } from "../storage/storage.service.js";
+import { PrefixedStorage } from "../storage/storage.service.js";
+import { CatalogImportModule } from "./catalog.module.js";
 import { CatalogService } from "./catalog.service.js";
 import { PluginImport } from "./plugin-import.js";
 /**
@@ -131,7 +132,7 @@ export async function loadCliObjectStore(cli, log, syncDir) {
     return { store: undefined, reason: reasons.join("; ") };
 }
 /** `storage.unavailable` with the CLI's constraint spelled out (the generic text points to a plugin install). */
-class CliStorage extends StorageService {
+class CliStorage extends PrefixedStorage {
     reason;
     constructor(deps, reason) {
         super(deps);
@@ -144,8 +145,9 @@ class CliStorage extends StorageService {
     }
 }
 /**
- * The CLI's plugin catalog context (`capybara plugins *`): {@link openExtensionCli} plus
- * {@link PluginImport} and {@link CatalogService}. Imports run with actor `null` (the operator of the
+ * The CLI's plugin catalog context (`capybara plugins *`): {@link openExtensionCli} with the
+ * catalog's {@link CatalogImportModule}, so {@link PluginImport} and {@link CatalogService} are the
+ * kernel's providers. Imports run with actor `null` (the operator of the
  * deployment, like `capybara extensions install`: no enterprise-admin re-check, audits without an
  * actor, permission snapshots written with source `cli`). Files of the plugin (skills, connector
  * templates, icons) go to the deployment's object store, set up in-process from the declared or
@@ -154,7 +156,7 @@ class CliStorage extends StorageService {
  * plugin does not bring are checked statically only (the CLI loads no connector).
  */
 export async function openCatalogCli(config, log, opts = {}) {
-    const cli = await openExtensionCli(config, log, opts);
+    const cli = await openExtensionCli(config, log, { ...opts, modules: [CatalogImportModule] });
     let syncDir;
     const removeSyncDir = async () => {
         if (syncDir !== undefined)
@@ -167,32 +169,12 @@ export async function openCatalogCli(config, log, opts = {}) {
             provider: () => store,
             plugins: async () => cli.inspected.map((p) => p.manifest.name),
         }, "reason" in rest ? rest.reason : undefined);
-        const declared = new Map(cli.inspected.map((p) => [p.manifest.name, p.source]));
-        const imports = new PluginImport({
-            db: cli.db,
-            config: () => config,
-            storage,
-            installs: cli.installs,
-            ops: cli.ops,
-            blobs: { get: (sha256) => cli.readPackage(sha256) },
-            declared: () => declared,
-            // The CLI loads no connectors: templates get static checks only (the org install re-checks)
-            findConnector: () => undefined,
-            connectorsLoaded: false,
-            log,
-        });
-        const catalog = new CatalogService({
-            db: cli.db,
-            config: () => config,
-            installs: cli.installs,
-            ops: cli.ops,
-            pluginImport: imports,
-            // Unreachable from the CLI: only marketplace imports (CatalogService.importFromMarketplace)
-            // download archives, and the CLI offers file, npm and direct git imports only.
-            fetchArchive: () => Promise.reject(new ApiError("internal", "marketplace imports are not available in the CLI")),
-            // Only marketplace imports send a marketplace token; a direct git import has none
-            marketplaceToken: async () => undefined,
-        });
+        // Plugin files go to that store; connector templates get static checks only (the CLI loads
+        // no connector; the org install re-checks them). Config-declared names come from the
+        // inspection (the registry), marketplace imports are not offered by the CLI.
+        const imports = cli.app.get(PluginImport);
+        imports.useCliStorage(storage);
+        const catalog = cli.app.get(CatalogService);
         return {
             ...cli,
             catalog,

package/dist/catalog/job-ids.d.ts

@@ -0,0 +1,15 @@
+/** The catalog's periodic jobs (a leaf module: no imports). */
+/**
+ * Periodic marketplace refresh (C26), every `marketplaces.refreshIntervalMinutes` (a
+ * `@LockedInterval`, once per tick across replicas): refreshes each enabled marketplace in turn.
+ */
+export declare const MARKETPLACES_REFRESH_JOB = "catalogs-refresh";
+/** The BullMQ repeatable scheduler the refresh had before it became `@LockedInterval` (retired). */
+export declare const MARKETPLACES_REFRESH_SCHEDULER_ID = "catalogs-refresh-every";
+/**
+ * Hourly cleanup of plugin import staging (T25, F-AE; a `@LockedCron`): deletes expired (24-hour)
+ * staging rows and their object storage prefixes (`PluginImport.cleanupExpired`).
+ */
+export declare const PLUGIN_STAGING_CLEANUP_JOB = "app-staging-cleanup";
+/** The BullMQ repeatable scheduler the cleanup had before it became `@LockedCron` (retired). */
+export declare const PLUGIN_STAGING_CLEANUP_SCHEDULER_ID = "app-staging-cleanup-hourly";

package/dist/catalog/job-ids.js

@@ -0,0 +1,15 @@
+/** The catalog's periodic jobs (a leaf module: no imports). */
+/**
+ * Periodic marketplace refresh (C26), every `marketplaces.refreshIntervalMinutes` (a
+ * `@LockedInterval`, once per tick across replicas): refreshes each enabled marketplace in turn.
+ */
+export const MARKETPLACES_REFRESH_JOB = "catalogs-refresh";
+/** The BullMQ repeatable scheduler the refresh had before it became `@LockedInterval` (retired). */
+export const MARKETPLACES_REFRESH_SCHEDULER_ID = "catalogs-refresh-every";
+/**
+ * Hourly cleanup of plugin import staging (T25, F-AE; a `@LockedCron`): deletes expired (24-hour)
+ * staging rows and their object storage prefixes (`PluginImport.cleanupExpired`).
+ */
+export const PLUGIN_STAGING_CLEANUP_JOB = "app-staging-cleanup";
+/** The BullMQ repeatable scheduler the cleanup had before it became `@LockedCron` (retired). */
+export const PLUGIN_STAGING_CLEANUP_SCHEDULER_ID = "app-staging-cleanup-hourly";

package/dist/catalog/jobs.d.ts

@@ -0,0 +1,27 @@
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { LockService } from "../infra/lock/lock.service.js";
+import type { KernelLogger } from "../log.js";
+import { MarketplacesService } from "./marketplaces.service.js";
+import { PluginImport } from "./plugin-import.js";
+/**
+ * The catalog's periodic jobs, each run once per tick across replicas: the marketplace refresh
+ * (`catalogs-refresh`, every `marketplaces.refreshIntervalMinutes` and once after the start:
+ * `@LockedInterval` with `runOnStart`) and the
+ * hourly cleanup of expired plugin import staging (`app-staging-cleanup`: `@LockedCron`).
+ */
+export declare class CatalogJobs {
+    private readonly marketplaces;
+    private readonly imports;
+    readonly config: KernelConfigService;
+    readonly lockService: LockService;
+    readonly log: KernelLogger;
+    constructor(marketplaces: MarketplacesService, imports: PluginImport, config: KernelConfigService, lockService: LockService, log: KernelLogger);
+    /**
+     * Refreshes every enabled marketplace in turn (overall deadline
+     * {@link MARKETPLACES_REFRESH_DEADLINE_MS}; the job's signal aborts it: the stop, or the run
+     * lock lost).
+     */
+    refreshMarketplaces(stop?: AbortSignal): Promise<void>;
+    /** Deletes expired staging rows and their objects. */
+    cleanupStaging(): Promise<void>;
+}

package/dist/catalog/jobs.js

@@ -0,0 +1,70 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { LockService } from "../infra/lock/lock.service.js";
+import { LockedCron } from "../infra/schedule/locked-cron.decorator.js";
+import { LockedInterval } from "../infra/schedule/locked-interval.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { MARKETPLACES_REFRESH_JOB, PLUGIN_STAGING_CLEANUP_JOB } from "./job-ids.js";
+import { MARKETPLACES_REFRESH_DEADLINE_MS, MarketplacesService } from "./marketplaces.service.js";
+import { PluginImport } from "./plugin-import.js";
+/**
+ * The catalog's periodic jobs, each run once per tick across replicas: the marketplace refresh
+ * (`catalogs-refresh`, every `marketplaces.refreshIntervalMinutes` and once after the start:
+ * `@LockedInterval` with `runOnStart`) and the
+ * hourly cleanup of expired plugin import staging (`app-staging-cleanup`: `@LockedCron`).
+ */
+let CatalogJobs = class CatalogJobs {
+    marketplaces;
+    imports;
+    config;
+    lockService;
+    log;
+    constructor(marketplaces, imports, config, lockService, log) {
+        this.marketplaces = marketplaces;
+        this.imports = imports;
+        this.config = config;
+        this.lockService = lockService;
+        this.log = log;
+    }
+    /**
+     * Refreshes every enabled marketplace in turn (overall deadline
+     * {@link MARKETPLACES_REFRESH_DEADLINE_MS}; the job's signal aborts it: the stop, or the run
+     * lock lost).
+     */
+    async refreshMarketplaces(stop) {
+        const deadline = AbortSignal.timeout(MARKETPLACES_REFRESH_DEADLINE_MS);
+        await this.marketplaces.refreshAll(stop ? AbortSignal.any([deadline, stop]) : deadline);
+    }
+    /** Deletes expired staging rows and their objects. */
+    async cleanupStaging() {
+        const n = await this.imports.cleanupExpired();
+        if (n > 0)
+            this.log.info("expired plugin imports cleaned up", { count: n });
+    }
+};
+__decorate([
+    LockedInterval(MARKETPLACES_REFRESH_JOB, (c) => c.marketplaces.refreshIntervalMinutes * 60_000, 
+    // a fresh deployment's marketplaces are refreshed right after the start
+    { runOnStart: true })
+], CatalogJobs.prototype, "refreshMarketplaces", null);
+__decorate([
+    LockedCron("0 * * * *", { name: PLUGIN_STAGING_CLEANUP_JOB })
+], CatalogJobs.prototype, "cleanupStaging", null);
+CatalogJobs = __decorate([
+    Injectable(),
+    __param(0, Inject(MarketplacesService)),
+    __param(1, Inject(PluginImport)),
+    __param(2, Inject(KernelConfigService)),
+    __param(3, Inject(LockService)),
+    __param(4, Inject(KERNEL_LOGGER))
+], CatalogJobs);
+export { CatalogJobs };

package/dist/catalog/locks.d.ts

@@ -0,0 +1,24 @@
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { XactLock } from "../infra/database/xact-lock.js";
+/**
+ * Serializes the writes of one marketplace's cached entries and refresh status (a refresh's
+ * result against concurrent refreshes and the admin's changes). Joins the caller's transaction
+ * (`mandatory`), which holds the lock until it ends.
+ */
+export declare class CatalogSourceLock {
+    private readonly xactLock;
+    readonly txHost: TransactionHost;
+    constructor(xactLock: XactLock, txHost: TransactionHost);
+    lock(marketplaceId: string): Promise<void>;
+}
+/**
+ * Serializes the imports of one catalog item name (the conflict re-check and the item / version
+ * write of a confirm), including a first import that has no item row to lock yet. Joins the
+ * caller's transaction (`mandatory`).
+ */
+export declare class CatalogItemLock {
+    private readonly xactLock;
+    readonly txHost: TransactionHost;
+    constructor(xactLock: XactLock, txHost: TransactionHost);
+    lock(name: string): Promise<void>;
+}

package/dist/catalog/locks.js

@@ -0,0 +1,63 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { XactLock } from "../infra/database/xact-lock.js";
+/**
+ * Serializes the writes of one marketplace's cached entries and refresh status (a refresh's
+ * result against concurrent refreshes and the admin's changes). Joins the caller's transaction
+ * (`mandatory`), which holds the lock until it ends.
+ */
+let CatalogSourceLock = class CatalogSourceLock {
+    xactLock;
+    txHost;
+    constructor(xactLock, txHost) {
+        this.xactLock = xactLock;
+        this.txHost = txHost;
+    }
+    async lock(marketplaceId) {
+        await this.xactLock.lock(`capybara.catalog-source:${marketplaceId}`);
+    }
+};
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], CatalogSourceLock.prototype, "lock", null);
+CatalogSourceLock = __decorate([
+    Injectable(),
+    __param(0, Inject(XactLock)),
+    __param(1, Inject(TransactionHost))
+], CatalogSourceLock);
+export { CatalogSourceLock };
+/**
+ * Serializes the imports of one catalog item name (the conflict re-check and the item / version
+ * write of a confirm), including a first import that has no item row to lock yet. Joins the
+ * caller's transaction (`mandatory`).
+ */
+let CatalogItemLock = class CatalogItemLock {
+    xactLock;
+    txHost;
+    constructor(xactLock, txHost) {
+        this.xactLock = xactLock;
+        this.txHost = txHost;
+    }
+    async lock(name) {
+        await this.xactLock.lock(`capybara.directory-item:${name}`);
+    }
+};
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], CatalogItemLock.prototype, "lock", null);
+CatalogItemLock = __decorate([
+    Injectable(),
+    __param(0, Inject(XactLock)),
+    __param(1, Inject(TransactionHost))
+], CatalogItemLock);
+export { CatalogItemLock };

package/dist/catalog/marketplaces.controller.d.ts

@@ -1,8 +1,8 @@
 import { z } from "zod";
-import { type KernelConfig } from "../config/schema.js";
 import { type Principal } from "../identity/principal.js";
-import type { CatalogService, MarketplaceImportResult } from "./catalog.service.js";
-import type { MarketplaceEntryView, MarketplacesService, MarketplaceView } from "./marketplaces.service.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { CatalogService, type MarketplaceImportResult } from "./catalog.service.js";
+import { type MarketplaceEntryView, MarketplacesService, type MarketplaceView } from "./marketplaces.service.js";
 declare const AddBody: z.ZodObject<{
     name: z.ZodString;
     url: z.ZodString;
@@ -42,7 +42,7 @@ export declare class MarketplacesController {
     private readonly marketplaces;
     private readonly catalog;
     private readonly config;
-    constructor(marketplaces: MarketplacesService, catalog: CatalogService, config: () => KernelConfig);
+    constructor(marketplaces: MarketplacesService, catalog: CatalogService, config: KernelConfigService);
     /** 全部来源；`offline` 为 true 表示 `marketplaces.official.enabled` 为 false（界面显示「离线模式」）。 */
     list(): Promise<{
         items: MarketplaceView[];

package/dist/catalog/marketplaces.controller.js

@@ -7,12 +7,15 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post, Query, } from "@nestjs/common";
+import { Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post } from "@nestjs/common";
 import { z } from "zod";
 import { MARKETPLACE_MAX_MIRRORS } from "../config/schema.js";
-import { CATALOG, KERNEL_CONFIG, MARKETPLACES } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
 import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZQuery } from "../infra/validation/zod-params.js";
+import { CatalogService } from "./catalog.service.js";
+import { MarketplacesService, } from "./marketplaces.service.js";
 const Url = z.string().min(1).max(2000);
 const Form = z.enum(["http", "git"]);
 const Ref = z.string().min(1).max(256);
@@ -46,6 +49,14 @@ const actorOpts = (actor) => {
     const tokenId = patTokenId(actor);
     return tokenId !== undefined ? { actorTokenId: tokenId } : {};
 };
+class MarketplaceAddBody extends createZodDto(AddBody, "MarketplaceAddBody") {
+}
+class MarketplaceEntriesQuery extends createZodDto(EntriesQuery, "MarketplaceEntriesQuery") {
+}
+class MarketplaceImportBody extends createZodDto(ImportBody, "MarketplaceImportBody") {
+}
+class MarketplacePatchBody extends createZodDto(PatchBody, "MarketplacePatchBody") {
+}
 /**
  * Marketplaces (`/api/v1/admin/marketplaces/*`, enterprise admins): create, update, delete and
  * refresh the official and enterprise marketplaces, browse entries, import from a marketplace.
@@ -64,7 +75,7 @@ let MarketplacesController = class MarketplacesController {
     async list() {
         return {
             items: await this.marketplaces.list(),
-            offline: !this.config().marketplaces.official.enabled,
+            offline: !this.config.get().marketplaces.official.enabled,
         };
     }
     /**
@@ -155,17 +166,17 @@ __decorate([
     Post(),
     HttpCode(201),
     __param(0, CurrentPrincipal()),
-    __param(1, Body(new ZodPipe(AddBody)))
+    __param(1, ZBody(MarketplaceAddBody))
 ], MarketplacesController.prototype, "add", null);
 __decorate([
     Get("entries"),
-    __param(0, Query(new ZodPipe(EntriesQuery)))
+    __param(0, ZQuery(MarketplaceEntriesQuery))
 ], MarketplacesController.prototype, "entries", null);
 __decorate([
     Patch(":id"),
     __param(0, CurrentPrincipal()),
     __param(1, Param("id")),
-    __param(2, Body(new ZodPipe(PatchBody)))
+    __param(2, ZBody(MarketplacePatchBody))
 ], MarketplacesController.prototype, "update", null);
 __decorate([
     Delete(":id"),
@@ -185,13 +196,13 @@ __decorate([
     __param(0, CurrentPrincipal()),
     __param(1, Param("id")),
     __param(2, Param("name")),
-    __param(3, Body(new ZodPipe(ImportBody)))
+    __param(3, ZBody(MarketplaceImportBody))
 ], MarketplacesController.prototype, "importEntry", null);
 MarketplacesController = __decorate([
     Controller("api/v1/admin/marketplaces"),
     EnterpriseAdmin(),
-    __param(0, Inject(MARKETPLACES)),
-    __param(1, Inject(CATALOG)),
-    __param(2, Inject(KERNEL_CONFIG))
+    __param(0, Inject(MarketplacesService)),
+    __param(1, Inject(CatalogService)),
+    __param(2, Inject(KernelConfigService))
 ], MarketplacesController);
 export { MarketplacesController };

package/dist/catalog/marketplaces.service.d.ts

@@ -1,9 +1,15 @@
-import { type Logger, type MarketplaceEntry, type MarketplaceSource } from "@capybara-hq/plugin-sdk";
+import { type MarketplaceEntry, type MarketplaceSource } from "@capybara-hq/plugin-sdk";
 import { type KernelConfig } from "../config/schema.js";
 import { type Keyring } from "../ctx/secrets.js";
-import type { KernelDb } from "../db/kernel-schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
 import { type ClaudeEntryOverlay } from "./claude/manifest.js";
 import { type MarketplaceSkipReason } from "./claude/marketplace.js";
+import { CatalogSourceLock } from "./locks.js";
 /** 官方清单来源的 id。 */
 export declare const OFFICIAL_MARKETPLACE_ID = "official";
 /** 拉取一份清单的超时。 */
@@ -98,14 +104,6 @@ export interface MarketplaceEntryView {
      */
     contentChanged: boolean;
 }
-export interface MarketplacesServiceDeps {
-    db: KernelDb;
-    config: () => KernelConfig;
-    keyring: Keyring;
-    log: Pick<Logger, "info" | "warn" | "error">;
-    /** 测试可调短。 */
-    fetchTimeoutMs?: number;
-}
 export interface ActorOpts {
     actorTokenId?: string;
 }
@@ -166,7 +164,7 @@ export declare function headsToResolve(entries: readonly MarketplaceEntry[], imp
 /** The host versions (an entry's `minKernel` is judged against them). */
 export declare const HOST_VERSIONS: {
     readonly kernel: string;
-    readonly sdk: "0.1.0-rc.0";
+    readonly sdk: "0.1.0-rc.1";
 };
 /** Whether this deployment satisfies the entry's `minKernel`. */
 export declare const entryCompatible: (e: Pick<MarketplaceEntry, "minKernel">) => boolean;
@@ -204,7 +202,7 @@ export declare const sourceEffective: (row: {
  * marketplace disabled (official offline included), entry or version missing ->
  * `marketplace.entry_not_found`.
  */
-export declare function loadMarketplaceEntry(db: KernelDb, config: KernelConfig, sourceId: string, name: string, version?: string): Promise<{
+export declare function loadMarketplaceEntry(db: KernelSchemaDb, config: KernelConfig, sourceId: string, name: string, version?: string): Promise<{
     entry: MarketplaceEntry;
     marketplace: MarketplaceOfEntry;
     /** The overlay of an entry of a Claude Code marketplace. */
@@ -221,8 +219,19 @@ export declare function loadMarketplaceEntry(db: KernelDb, config: KernelConfig,
  * by every replica.
  */
 export declare class MarketplacesService {
-    private readonly d;
-    constructor(d: MarketplacesServiceDeps);
+    private readonly kdb;
+    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the caller's transaction. */
+    private readonly adminLock;
+    private readonly sourceLock;
+    private readonly config;
+    private readonly keyring;
+    private readonly log;
+    readonly txHost: TransactionHost;
+    constructor(kdb: KernelDb, 
+    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the caller's transaction. */
+    adminLock: EnterpriseAdminLock, sourceLock: CatalogSourceLock, config: KernelConfigService, keyring: Keyring, log: KernelLogger, txHost: TransactionHost);
+    /** The kernel-schema handle of the current context (the transaction, else the pool). */
+    private get db();
     /**
      * Creates / updates the official marketplace from config (name, URL, its form per
      * {@link marketplaceForm}, mirrors; the admin's enable switch is left alone). Called by every
@@ -248,6 +257,7 @@ export declare class MarketplacesService {
         mirrors?: string[];
         token?: string;
     }, opts?: ActorOpts): Promise<MarketplaceView>;
+    private writeAdd;
     /**
      * Updates an enterprise marketplace (audit `marketplace.updated`, listing the changed fields, the
      * token's value never recorded; not written when unchanged). `token: null` clears the token.
@@ -266,6 +276,7 @@ export declare class MarketplacesService {
         enabled?: boolean;
         token?: string | null;
     }, opts?: ActorOpts): Promise<MarketplaceView>;
+    private writeUpdate;
     /**
      * Deletes an enterprise marketplace (audit `marketplace.removed`): its cached entries and token
      * are deleted; imported catalog items are kept (their marketplace becomes null). Official can
@@ -324,12 +335,18 @@ export declare class MarketplacesService {
         items: MarketplaceEntryView[];
         truncated: boolean;
     }>;
+    /**
+     * Writes a refresh's result under the marketplace's lock (entries, heads, status, the status
+     * change audit); `stale` when the marketplace changed during the fetch (nothing is written).
+     */
+    private recordRefresh;
     /**
      * Replaces the entries of a marketplace; `trees` (a git marketplace) gives each path entry the
      * tree oid of its directory.
      */
     private replaceEntries;
     private views;
+    /** The deployment secrets on the current context's handle (the transaction, else the pool). */
     private secrets;
     private checkName;
     private checkUrls;