@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/catalog/plugin-upgrade.js

@@ -1,16 +1,34 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { createHash, randomUUID } from "node:crypto";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { putTemplateVersionIn } from "../agents/templates.js";
 import { ApiError } from "../errors.js";
 import { isExtensionEnabled } from "../extensions/enabled.js";
+import { OrgExtensionConfigs } from "../extensions/org-config.js";
+import { ExtensionRegistry } from "../extensions/registry.js";
 import { audit } from "../identity/audit.js";
-import { lockOrg } from "../orgs/org-lock.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { packagePath } from "../packages/tgz.js";
-import { skillConflictError } from "../skills/skills.service.js";
+import { SkillsService, skillConflictError } from "../skills/skills.service.js";
+import { StorageService } from "../storage/storage.service.js";
+import { ConnectorsService } from "../tools/connectors.service.js";
 import { canonicalJson } from "../tools/registry.js";
-import { getPath, lockOrgForActions, orgTemplateView, readCatalogAgentTemplates, readCatalogFiles, readCatalogTemplates, requiredActions, setPath, skillOf, templatePluginProblem, } from "./org-catalog.service.js";
-import { catalogSkillNames, InstallFailure, journalEntries, missingTemplateInput, planActions, planSkillConflicts, resolveDependencies, under, } from "./plugin-install.js";
-import { assertItemInstallable } from "./requests.service.js";
+import { getPath, lockOrgForActions, orgTemplateView, readCatalogAgentTemplates, readCatalogFiles, readCatalogTemplates, requiredActions, setPath, skillOf, templatePluginProblem, } from "./catalog-content.js";
+import { catalogSkillNames, InstallFailure, journalEntries, missingTemplateInput, PluginInstaller, planActions, planSkillConflicts, resolveDependencies, under, } from "./plugin-install.js";
+import { assertItemInstallable, CatalogRequestsService } from "./requests.service.js";
 import { deployedExtension, deploymentTarget } from "./upgrade-targets.js";
 import { satisfiesRange } from "./versions.js";
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -78,18 +96,46 @@ function dirDigest(row, dir) {
  * Approval follows the item's policy (the org catalog service creates the request). No in-process
  * state.
  */
-export class PluginUpgrader {
+let PluginUpgrader = class PluginUpgrader {
     installer;
-    d;
-    constructor(installer) {
+    kdb;
+    orgLock;
+    storage;
+    registry;
+    skills;
+    orgConfigs;
+    requests;
+    connectors;
+    log;
+    txHost;
+    constructor(
+    /** Planning, installs, the ledger and the uninstall rules are the installer's. */
+    installer, kdb, 
+    /** The org row lock (orgs/org-lock.ts): joins the caller's transaction. */
+    orgLock, storage, registry, skills, orgConfigs, requests, 
+    /** Org connectors: installs create, upgrade and remove them. */
+    connectors, log, txHost) {
         this.installer = installer;
-        this.d = installer.deps;
+        this.kdb = kdb;
+        this.orgLock = orgLock;
+        this.storage = storage;
+        this.registry = registry;
+        this.skills = skills;
+        this.orgConfigs = orgConfigs;
+        this.requests = requests;
+        this.connectors = connectors;
+        this.log = log;
+        this.txHost = txHost;
+    }
+    /** The kernel-schema handle of the current context (the transaction, else the pool). */
+    get db() {
+        return this.kdb.db;
     }
     /** The upgrade preview (see the class comment). */
     async preview(orgId, actor, installId, version) {
         await this.recoverInterrupted(orgId, actor, installId);
         const diff = await this.diff(orgId, actor, installId, version, null);
-        await this.d.db.transaction().execute((t) => lockOrgForActions(t, orgId, actor, diff.actions));
+        await this.authorizeActions(orgId, actor, diff.actions);
         return {
             from: diff.from.version,
             to: diff.to.version,
@@ -102,6 +148,10 @@ export class PluginUpgrader {
                 : []),
         };
     }
+    /** Re-checks the actor's org actions under the org row lock (a transaction of its own). */
+    async authorizeActions(orgId, actor, actions) {
+        await lockOrgForActions(this.orgLock, orgId, actor, actions);
+    }
     /**
      * The checks of {@link upgrade} before an approval request (the org catalog service creates one
      * for a needs_approval item without a grant): the diff with the input, the `diffHash`. Returns
@@ -136,41 +186,16 @@ export class PluginUpgrader {
         const { itemId } = diff;
         const upgradeId = randomUUID();
         // Start: the install `upgrading`, under the org lock (one upgrade or uninstall at a time)
-        await this.d.db.transaction().execute(async (t) => {
-            await lockOrgForActions(t, orgId, actor, diff.actions);
-            const row = await t
-                .selectFrom("plugin_installs")
-                .select(["status", "version"])
-                .where("id", "=", installId)
-                .where("org_id", "=", orgId)
-                .forUpdate()
-                .executeTakeFirst();
-            if (!row || row.status === "failed")
-                throw installNotFound();
-            if (row.status !== "installed")
-                throw inProgress();
-            if (row.version !== diff.from.version ||
-                ledgerHash(await ledgerOf(t, installId)) !== diff.ledgerHash) {
-                throw stale();
-            }
-            await assertItemInstallable(t, orgId, itemId);
-            await t
-                .updateTable("plugin_installs")
-                .set({
-                status: "upgrading",
-                upgrade: sql `jsonb_build_object('id', ${upgradeId}::text, 'from', ${diff.from.version}::text, 'to', ${diff.to.version}::text, 'startedAt', now(), 'done', '[]'::jsonb)`,
-            })
-                .where("id", "=", installId)
-                .execute();
-        });
+        await this.start(orgId, actor, installId, diff, upgradeId);
         const done = [];
         /** The step whose journal write found the journal gone (cleaned up as interrupted meanwhile). */
         let unjournaled;
-        // Appends a step to the journal (the journal gone: the upgrade was cleaned up as interrupted)
-        const journal = async (s, t) => {
+        // Appends a step to the journal in the transaction of the context (the journal gone: the
+        // upgrade was cleaned up as interrupted)
+        const journal = async (s) => {
             done.push(s);
             unjournaled = s;
-            const r = await t
+            const r = await this.db
                 .updateTable("plugin_installs")
                 .set({
                 upgrade: sql `jsonb_set(upgrade, '{done}', (upgrade->'done') || ${JSON.stringify([s])}::jsonb)`,
@@ -182,32 +207,14 @@ export class PluginUpgrader {
                 throw cleanedUp();
             unjournaled = undefined;
         };
-        // Records a component in the ledger and the journal, in the given transaction
-        const record = async (c, t) => {
-            const inserted = await t
-                .insertInto("plugin_install_components")
-                .values({
-                install_id: installId,
-                kind: c.kind,
-                ref: c.ref,
-                created: c.created,
-                skill_version: c.skillVersion,
-                template_id: c.templateId ?? null,
-            })
-                .onConflict((oc) => oc.columns(["install_id", "kind", "ref"]).doNothing())
-                .returning("ref")
-                .executeTakeFirst();
-            if (c.created)
-                await journal({ op: "created", kind: c.kind, ref: c.ref }, t);
-            else if (inserted)
-                await journal({ op: "recorded", kind: c.kind, ref: c.ref }, t);
-        };
+        // Records a component in the ledger and the journal, in the transaction of the context
+        const record = (c) => this.recordIn(installId, journal, c);
         let step = "dependencies";
         const disabled = [];
         try {
             for (const dep of diff.dependencies.filter((x) => x.change === "added")) {
                 const resolved = dep.resolved;
-                const rec = (c, t) => record(c, t);
+                const rec = (c) => record(c);
                 if ((await this.installer.recordDependency(orgId, resolved, rec)) !== undefined)
                     continue;
                 if (!dep.plan) {
@@ -236,22 +243,17 @@ export class PluginUpgrader {
             }
             step = "extension";
             if (diff.extension?.change === "added") {
-                const name = diff.extension.name;
-                await this.d.orgConfigs.put(orgId, name, {
+                await this.installer.enableExtension(orgId, diff.extension.name, {
                     enabled: true,
                     ...(input.extensionConfig !== undefined && { config: input.extensionConfig }),
-                }, actor, opts.actorTokenId, {
-                    viaItem: itemId,
-                    ifDisabled: { skipped: false },
-                    inTransaction: (t, skipped) => record({ kind: "extension", ref: name, created: !skipped, skillVersion: null }, t),
-                });
+                }, actor, opts.actorTokenId, { viaItem: itemId }, record);
             }
             step = "skills";
             for (const s of diff.skills) {
                 if (s.change !== "added" && s.change !== "changed")
                     continue;
-                const files = await readCatalogFiles(this.d.storage, diff.to.object_prefix, diff.to.files, s.dir);
-                const r = await this.d.skills.createVersionFromFiles(orgId, actor, { ...skillOf(files), files }, {
+                const files = await readCatalogFiles(this.storage, diff.to.object_prefix, diff.to.files, s.dir);
+                const r = await this.skills.createVersionFromFiles(orgId, actor, { ...skillOf(files), files }, {
                     catalog: {
                         itemId,
                         version: diff.to.version,
@@ -260,52 +262,24 @@ export class PluginUpgrader {
                     },
                     ...opts,
                 });
-                await this.d.db.transaction().execute(async (t) => {
-                    if (r.created) {
-                        await record({ kind: "skill", ref: r.skill.id, created: true, skillVersion: null }, t);
-                        return;
-                    }
-                    await journal({ op: "skill_version", ref: r.skill.id, version: r.version }, t);
-                    await record({ kind: "skill", ref: r.skill.id, created: false, skillVersion: r.version }, t);
-                });
+                await this.journalSkill(r, record, journal);
             }
             step = "agent_templates";
             for (const a of diff.agentTemplates) {
                 if (a.change !== "added" && a.change !== "changed")
                     continue;
-                await this.d.db.transaction().execute(async (t) => {
-                    await lockOrg(t, orgId);
-                    const r = await putTemplateVersionIn(t, {
-                        orgId,
-                        plugin: diff.name,
-                        catalogItemId: itemId,
-                        catalogVersion: diff.to.version,
-                        sourceFormat: diff.to.source_format,
-                    }, a.template);
-                    if (r.created) {
-                        await record({ kind: "agent_template", ref: r.id, created: true, skillVersion: null }, t);
-                        return;
-                    }
-                    if (r.changed)
-                        await journal({ op: "template_version", ref: r.id, version: r.version }, t);
-                    await record({
-                        kind: "agent_template",
-                        ref: r.id,
-                        created: false,
-                        skillVersion: r.changed ? r.version : null,
-                    }, t);
-                });
+                await this.upgradeAgentTemplate(orgId, diff, a.template, record, journal);
             }
             step = "connectors";
             for (const [templateId, ci] of diff.creates) {
-                const r = await this.d.connectors.create(orgId, actor, ci, opts.actorTokenId);
-                await this.d.db.transaction().execute((t) => record({
+                const r = await this.connectors.create(orgId, actor, ci, opts.actorTokenId);
+                await this.recordStep(installId, journal, {
                     kind: "connector",
                     ref: r.connector.id,
                     created: true,
                     skillVersion: null,
                     templateId,
-                }, t));
+                });
             }
             const prepared = [];
             for (const tpl of diff.templates) {
@@ -315,7 +289,7 @@ export class PluginUpgrader {
                 try {
                     prepared.push({
                         connectorId: tpl.connector.id,
-                        p: await this.d.connectors.prepareTemplateUpdate(actor, tpl.connector.connector, update),
+                        p: await this.connectors.prepareTemplateUpdate(actor, tpl.connector.connector, update),
                     });
                 }
                 catch (e) {
@@ -323,81 +297,15 @@ export class PluginUpgrader {
                 }
             }
             // Finish, in one transaction: changed connectors, removals, the version switch
-            await this.d.db.transaction().execute(async (t) => {
-                await lockOrgForActions(t, orgId, actor, diff.actions);
-                const row = await t
-                    .selectFrom("plugin_installs")
-                    .select(["status", sql `upgrade->>'id'`.as("upgradeId")])
-                    .where("id", "=", installId)
-                    .forUpdate()
-                    .executeTakeFirst();
-                if (row?.status !== "upgrading" || row.upgradeId !== upgradeId)
-                    throw cleanedUp();
-                await assertItemInstallable(t, orgId, itemId);
-                for (const c of prepared) {
-                    await this.d.connectors.applyTemplateIn(t, orgId, c.connectorId, actor, c.p, opts.actorTokenId);
-                }
+            await this.finish(orgId, actor, installId, upgradeId, diff, prepared, disabled, opts, () => {
                 step = "finish";
-                for (const dep of diff.dependencies) {
-                    if (dep.change !== "changed" || !dep.child)
-                        continue;
-                    const live = await t
-                        .selectFrom("plugin_installs")
-                        .select("version")
-                        .where("id", "=", dep.child.installId)
-                        .forShare()
-                        .executeTakeFirst();
-                    if (!live || !satisfiesRange(live.version, dep.range)) {
-                        throw new ApiError("catalog.dependency_unresolved", `Dependency ${dep.name}@${dep.range} cannot be resolved: its install in this organization changed meanwhile; preview the upgrade again`, [{ dependency: dep.name, range: dep.range }]);
-                    }
-                }
-                const report = await this.removeIn(t, orgId, actor, diff, disabled);
-                // An unchanged skill gets no new version, so the target's pinned suggestion goes onto its
-                // current version (when that version is this plugin's) here, with the version switch.
-                for (const sk of diff.skills) {
-                    if (sk.change !== "unchanged" || !sk.ledger)
-                        continue;
-                    await t
-                        .updateTable("skill_versions as v")
-                        .set({ suggest_pinned: sk.suggestPinned === true })
-                        .from("skills as s")
-                        .whereRef("s.id", "=", "v.skill_id")
-                        .whereRef("s.current_version", "=", "v.version")
-                        .where("s.id", "=", sk.ledger.ref)
-                        .where("s.org_id", "=", orgId)
-                        .where("v.catalog_item_id", "=", itemId)
-                        .where("v.suggest_pinned", "<>", sk.suggestPinned === true)
-                        .execute();
-                }
-                await t
-                    .updateTable("plugin_installs")
-                    .set({ version: diff.to.version, status: "installed", upgrade: null, error: null })
-                    .where("id", "=", installId)
-                    .execute();
-                await this.d.requests.resolveByInstall(t, orgId, itemId, actor, opts);
-                await audit(t, {
-                    actorAccountId: actor,
-                    ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                    orgId,
-                    action: "plugin.org_upgraded",
-                    target: installId,
-                    detail: {
-                        itemId,
-                        name: diff.name,
-                        from: diff.from.version,
-                        to: diff.to.version,
-                        components: diff.components,
-                        removed: report.removed,
-                        kept: report.kept,
-                    },
-                });
             });
         }
         catch (e) {
             throw await this.failed(orgId, actor, installId, upgradeId, diff, { done, unjournaled }, step, e, opts);
         }
         for (const p of disabled)
-            await this.d.orgConfigs.afterDisable(orgId, p);
+            await this.orgConfigs.afterDisable(orgId, p);
         const [view] = await this.installer.list(orgId, installId);
         if (!view)
             throw installNotFound();
@@ -418,55 +326,16 @@ export class PluginUpgrader {
         const at = failure ? failure.step : step;
         let rolledBack = failure?.rolledBack ?? true;
         try {
-            const removed = await this.d.db.transaction().execute(async (t) => {
-                await lockOrg(t, orgId);
-                const row = await t
-                    .selectFrom("plugin_installs")
-                    .select(sql `upgrade->>'id'`.as("upgradeId"))
-                    .where("id", "=", installId)
-                    .forUpdate()
-                    .executeTakeFirst();
-                const ours = row?.upgradeId === upgradeId;
-                // Cleaned up meanwhile: only the step whose journal write found the journal gone is ours to
-                // undo. When that step ran in the same transaction as its journal write (the extension
-                // enable, the ledger rows), the transaction rolled back with the failed write, so undoing
-                // it is a no-op (a never-enabled extension, a never-inserted row); undoing is still safe.
-                const undo = ours ? steps.done : steps.unjournaled ? [steps.unjournaled] : [];
-                const out = await this.installer.undoUpgradeIn(t, orgId, actor, installId, undo, "plugin_upgrade_rollback");
-                await t
-                    .updateTable("plugin_installs")
-                    .set({ status: "installed", upgrade: null, error: JSON.stringify({ step: at, code }) })
-                    .where("id", "=", installId)
-                    .where(sql `upgrade->>'id'`, "=", upgradeId)
-                    .execute();
-                await audit(t, {
-                    actorAccountId: actor,
-                    ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
-                    orgId,
-                    action: "plugin.org_upgrade_failed",
-                    target: installId,
-                    detail: {
-                        itemId: diff.itemId,
-                        name: diff.name,
-                        from: diff.from.version,
-                        to: diff.to.version,
-                        step: at,
-                        code,
-                        rolledBack: undo,
-                        ...(!ours && { cleanedUpMeanwhile: true }),
-                    },
-                });
-                return out;
-            });
+            const removed = await this.undoFailed(orgId, actor, installId, upgradeId, diff, steps, { at, code }, opts);
             for (const r of removed) {
                 if (r.kind === "extension")
-                    await this.d.orgConfigs.afterDisable(orgId, r.ref);
+                    await this.orgConfigs.afterDisable(orgId, r.ref);
             }
         }
         catch (u) {
             // Left `upgrading` with its journal: undone once it is older than catalog.staleInstallMinutes
             rolledBack = false;
-            this.d.log?.warn("plugin upgrade rollback failed", {
+            this.log.warn("plugin upgrade rollback failed", {
                 orgId,
                 installId,
                 error: u instanceof Error ? u.message : String(u),
@@ -499,66 +368,279 @@ export class PluginUpgrader {
     async recoverInterrupted(orgId, actor, installId) {
         if (!UUID_RE.test(installId))
             throw installNotFound();
-        const staleMinutes = this.d.staleInstallMinutes();
-        const removed = await this.d.db.transaction().execute(async (t) => {
-            const peek = await t
+        const removed = await this.undoInterrupted(orgId, actor, installId);
+        for (const r of removed) {
+            if (r.kind === "extension")
+                await this.orgConfigs.afterDisable(orgId, r.ref);
+        }
+    }
+    /** The upgrade's start: the install `upgrading` with an empty journal (a transaction of its own). */
+    async start(orgId, actor, installId, diff, upgradeId) {
+        const { itemId } = diff;
+        const t = this.db;
+        await lockOrgForActions(this.orgLock, orgId, actor, diff.actions);
+        const row = await t
+            .selectFrom("plugin_installs")
+            .select(["status", "version"])
+            .where("id", "=", installId)
+            .where("org_id", "=", orgId)
+            .forUpdate()
+            .executeTakeFirst();
+        if (!row || row.status === "failed")
+            throw installNotFound();
+        if (row.status !== "installed")
+            throw inProgress();
+        if (row.version !== diff.from.version ||
+            ledgerHash(await ledgerOf(t, installId)) !== diff.ledgerHash) {
+            throw stale();
+        }
+        await assertItemInstallable(t, orgId, itemId);
+        await t
+            .updateTable("plugin_installs")
+            .set({
+            status: "upgrading",
+            upgrade: sql `jsonb_build_object('id', ${upgradeId}::text, 'from', ${diff.from.version}::text, 'to', ${diff.to.version}::text, 'startedAt', now(), 'done', '[]'::jsonb)`,
+        })
+            .where("id", "=", installId)
+            .execute();
+    }
+    /** A skill step's ledger and journal rows, in a transaction of their own. */
+    async journalSkill(r, record, journal) {
+        if (r.created) {
+            await record({ kind: "skill", ref: r.skill.id, created: true, skillVersion: null });
+            return;
+        }
+        await journal({ op: "skill_version", ref: r.skill.id, version: r.version });
+        await record({ kind: "skill", ref: r.skill.id, created: false, skillVersion: r.version });
+    }
+    /**
+     * An agent template step: the new version (or template) and its ledger and journal rows, under
+     * the org row lock, in a transaction of their own.
+     */
+    async upgradeAgentTemplate(orgId, diff, template, record, journal) {
+        const { itemId } = diff;
+        const t = this.db;
+        await this.orgLock.lock(orgId);
+        const r = await putTemplateVersionIn(t, {
+            orgId,
+            plugin: diff.name,
+            catalogItemId: itemId,
+            catalogVersion: diff.to.version,
+            sourceFormat: diff.to.source_format,
+        }, template);
+        if (r.created) {
+            await record({ kind: "agent_template", ref: r.id, created: true, skillVersion: null });
+            return;
+        }
+        if (r.changed)
+            await journal({ op: "template_version", ref: r.id, version: r.version });
+        await record({
+            kind: "agent_template",
+            ref: r.id,
+            created: false,
+            skillVersion: r.changed ? r.version : null,
+        });
+    }
+    /** One ledger record (and its journal row) in a transaction of its own. */
+    async recordStep(installId, journal, c) {
+        await this.recordIn(installId, journal, c);
+    }
+    /** A component's ledger row and its journal step, in the transaction of the context. */
+    async recordIn(installId, journal, c) {
+        const inserted = await this.db
+            .insertInto("plugin_install_components")
+            .values({
+            install_id: installId,
+            kind: c.kind,
+            ref: c.ref,
+            created: c.created,
+            skill_version: c.skillVersion,
+            template_id: c.templateId ?? null,
+        })
+            .onConflict((oc) => oc.columns(["install_id", "kind", "ref"]).doNothing())
+            .returning("ref")
+            .executeTakeFirst();
+        if (c.created)
+            await journal({ op: "created", kind: c.kind, ref: c.ref });
+        else if (inserted)
+            await journal({ op: "recorded", kind: c.kind, ref: c.ref });
+    }
+    /**
+     * The upgrade's last transaction (under the org row lock): the changed connectors, the removals,
+     * the pinned suggestions and the version switch, `plugin.org_upgraded`. `onFinish` marks the step
+     * once the connectors are applied.
+     */
+    async finish(orgId, actor, installId, upgradeId, diff, prepared, disabled, opts, onFinish) {
+        const { itemId } = diff;
+        const t = this.db;
+        await lockOrgForActions(this.orgLock, orgId, actor, diff.actions);
+        const row = await t
+            .selectFrom("plugin_installs")
+            .select(["status", sql `upgrade->>'id'`.as("upgradeId")])
+            .where("id", "=", installId)
+            .forUpdate()
+            .executeTakeFirst();
+        if (row?.status !== "upgrading" || row.upgradeId !== upgradeId)
+            throw cleanedUp();
+        await assertItemInstallable(t, orgId, itemId);
+        for (const c of prepared) {
+            await this.connectors.applyTemplateIn(orgId, c.connectorId, actor, c.p, opts.actorTokenId);
+        }
+        onFinish();
+        for (const dep of diff.dependencies) {
+            if (dep.change !== "changed" || !dep.child)
+                continue;
+            const live = await t
                 .selectFrom("plugin_installs")
-                .select("status")
-                .where("id", "=", installId)
-                .where("org_id", "=", orgId)
+                .select("version")
+                .where("id", "=", dep.child.installId)
+                .forShare()
                 .executeTakeFirst();
-            if (peek?.status !== "upgrading")
-                return [];
-            await lockOrg(t, orgId);
-            const row = await t
-                .selectFrom("plugin_installs as a")
-                .innerJoin("catalog_items as i", "i.id", "a.item_id")
-                .select([
-                "a.status",
-                "a.upgrade",
-                "a.item_id",
-                "i.name",
-                sql `coalesce((a.upgrade->>'startedAt')::timestamptz < now() - make_interval(mins => ${staleMinutes}), false)`.as("stale"),
-            ])
-                .where("a.id", "=", installId)
-                .where("a.org_id", "=", orgId)
-                .forUpdate("a")
-                .executeTakeFirst();
-            if (row?.status !== "upgrading" || !row.stale)
-                return [];
-            const steps = journalEntries(row.upgrade);
-            const out = await this.installer.undoUpgradeIn(t, orgId, actor, installId, steps, "plugin_upgrade_cleanup");
+            if (!live || !satisfiesRange(live.version, dep.range)) {
+                throw new ApiError("catalog.dependency_unresolved", `Dependency ${dep.name}@${dep.range} cannot be resolved: its install in this organization changed meanwhile; preview the upgrade again`, [{ dependency: dep.name, range: dep.range }]);
+            }
+        }
+        const report = await this.removeIn(orgId, actor, diff, disabled);
+        // An unchanged skill gets no new version, so the target's pinned suggestion goes onto its
+        // current version (when that version is this plugin's) here, with the version switch.
+        for (const sk of diff.skills) {
+            if (sk.change !== "unchanged" || !sk.ledger)
+                continue;
             await t
-                .updateTable("plugin_installs")
-                .set({
-                status: "installed",
-                upgrade: null,
-                error: JSON.stringify({ step: "interrupted", code: "internal" }),
-            })
-                .where("id", "=", installId)
+                .updateTable("skill_versions as v")
+                .set({ suggest_pinned: sk.suggestPinned === true })
+                .from("skills as s")
+                .whereRef("s.id", "=", "v.skill_id")
+                .whereRef("s.current_version", "=", "v.version")
+                .where("s.id", "=", sk.ledger.ref)
+                .where("s.org_id", "=", orgId)
+                .where("v.catalog_item_id", "=", itemId)
+                .where("v.suggest_pinned", "<>", sk.suggestPinned === true)
                 .execute();
-            const j = row.upgrade;
-            await audit(t, {
-                actorAccountId: actor,
-                orgId,
-                action: "plugin.org_upgrade_failed",
-                target: installId,
-                detail: {
-                    itemId: row.item_id,
-                    name: row.name,
-                    from: j?.from ?? null,
-                    to: j?.to ?? null,
-                    step: "interrupted",
-                    code: "internal",
-                    rolledBack: steps,
-                },
-            });
-            return out;
-        });
-        for (const r of removed) {
-            if (r.kind === "extension")
-                await this.d.orgConfigs.afterDisable(orgId, r.ref);
         }
+        await t
+            .updateTable("plugin_installs")
+            .set({ version: diff.to.version, status: "installed", upgrade: null, error: null })
+            .where("id", "=", installId)
+            .execute();
+        await this.requests.resolveByInstall(orgId, itemId, actor, opts);
+        await audit(t, {
+            actorAccountId: actor,
+            ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+            orgId,
+            action: "plugin.org_upgraded",
+            target: installId,
+            detail: {
+                itemId,
+                name: diff.name,
+                from: diff.from.version,
+                to: diff.to.version,
+                components: diff.components,
+                removed: report.removed,
+                kept: report.kept,
+            },
+        });
+    }
+    /** Undoes a failed upgrade's journal (see {@link failed}) in a transaction of its own. */
+    async undoFailed(orgId, actor, installId, upgradeId, diff, steps, f, opts) {
+        const { at, code } = f;
+        const t = this.db;
+        await this.orgLock.lock(orgId);
+        const row = await t
+            .selectFrom("plugin_installs")
+            .select(sql `upgrade->>'id'`.as("upgradeId"))
+            .where("id", "=", installId)
+            .forUpdate()
+            .executeTakeFirst();
+        const ours = row?.upgradeId === upgradeId;
+        // Cleaned up meanwhile: only the step whose journal write found the journal gone is ours to
+        // undo. When that step ran in the same transaction as its journal write (the extension
+        // enable, the ledger rows), the transaction rolled back with the failed write, so undoing
+        // it is a no-op (a never-enabled extension, a never-inserted row); undoing is still safe.
+        const undo = ours ? steps.done : steps.unjournaled ? [steps.unjournaled] : [];
+        const out = await this.installer.undoUpgradeIn(orgId, actor, installId, undo, "plugin_upgrade_rollback");
+        await t
+            .updateTable("plugin_installs")
+            .set({ status: "installed", upgrade: null, error: JSON.stringify({ step: at, code }) })
+            .where("id", "=", installId)
+            .where(sql `upgrade->>'id'`, "=", upgradeId)
+            .execute();
+        await audit(t, {
+            actorAccountId: actor,
+            ...(opts.actorTokenId !== undefined && { actorTokenId: opts.actorTokenId }),
+            orgId,
+            action: "plugin.org_upgrade_failed",
+            target: installId,
+            detail: {
+                itemId: diff.itemId,
+                name: diff.name,
+                from: diff.from.version,
+                to: diff.to.version,
+                step: at,
+                code,
+                rolledBack: undo,
+                ...(!ours && { cleanedUpMeanwhile: true }),
+            },
+        });
+        return out;
+    }
+    /** Undoes an interrupted upgrade (see {@link recoverInterrupted}) in a transaction of its own. */
+    async undoInterrupted(orgId, actor, installId) {
+        const staleMinutes = this.installer.staleInstallMinutes();
+        const t = this.db;
+        const peek = await t
+            .selectFrom("plugin_installs")
+            .select("status")
+            .where("id", "=", installId)
+            .where("org_id", "=", orgId)
+            .executeTakeFirst();
+        if (peek?.status !== "upgrading")
+            return [];
+        await this.orgLock.lock(orgId);
+        const row = await t
+            .selectFrom("plugin_installs as a")
+            .innerJoin("catalog_items as i", "i.id", "a.item_id")
+            .select([
+            "a.status",
+            "a.upgrade",
+            "a.item_id",
+            "i.name",
+            sql `coalesce((a.upgrade->>'startedAt')::timestamptz < now() - make_interval(mins => ${staleMinutes}), false)`.as("stale"),
+        ])
+            .where("a.id", "=", installId)
+            .where("a.org_id", "=", orgId)
+            .forUpdate("a")
+            .executeTakeFirst();
+        if (row?.status !== "upgrading" || !row.stale)
+            return [];
+        const steps = journalEntries(row.upgrade);
+        const out = await this.installer.undoUpgradeIn(orgId, actor, installId, steps, "plugin_upgrade_cleanup");
+        await t
+            .updateTable("plugin_installs")
+            .set({
+            status: "installed",
+            upgrade: null,
+            error: JSON.stringify({ step: "interrupted", code: "internal" }),
+        })
+            .where("id", "=", installId)
+            .execute();
+        const j = row.upgrade;
+        await audit(t, {
+            actorAccountId: actor,
+            orgId,
+            action: "plugin.org_upgrade_failed",
+            target: installId,
+            detail: {
+                itemId: row.item_id,
+                name: row.name,
+                from: j?.from ?? null,
+                to: j?.to ?? null,
+                step: "interrupted",
+                code: "internal",
+                rolledBack: steps,
+            },
+        });
+        return out;
     }
     /**
      * The removals of an upgrade, in the final transaction, by the uninstall rules
@@ -569,9 +651,10 @@ export class PluginUpgrader {
      * install is uninstalled by the same rules (another install using it takes it over). Skills ->
      * connectors -> extension -> dependencies.
      */
-    async removeIn(t, orgId, actor, diff, disabled) {
+    async removeIn(orgId, actor, diff, disabled) {
         const report = { removed: [], kept: [] };
         const reason = "plugin_upgrade";
+        const t = this.db;
         const keep = (kind, ref, why) => report.kept.push({ kind, ref, reason: why });
         const row = (kind, ref) => t
             .updateTable("plugin_install_components")
@@ -592,7 +675,7 @@ export class PluginUpgrader {
                 ? diff.ledger.filter((l) => l.kind === "extension" && l.ref === diff.extension?.name)
                 : []),
         ];
-        const agentRefs = await this.installer.agentRefs(t, orgId);
+        const agentRefs = await this.installer.agentRefs(orgId);
         const self = new Set([diff.installId]);
         for (const l of removed) {
             if (!l.created) {
@@ -600,7 +683,7 @@ export class PluginUpgrader {
                 keep(l.kind, l.ref, "pre_existing");
                 continue;
             }
-            const outcome = await this.installer.decideRemovalIn(t, orgId, actor, { kind: l.kind, ref: l.ref, created: true, skillVersion: null }, self, agentRefs, reason);
+            const outcome = await this.installer.decideRemovalIn(orgId, actor, { kind: l.kind, ref: l.ref, created: true, skillVersion: null }, self, agentRefs, reason);
             if (outcome === "used_by_agents" ||
                 outcome === "used_by_connectors" ||
                 outcome === "used_by_plugins") {
@@ -648,7 +731,7 @@ export class PluginUpgrader {
                 continue;
             }
             const sub = { removed: [], kept: [] };
-            const outcome = await this.installer.uninstallIn(t, orgId, actor, ref, {
+            const outcome = await this.installer.uninstallIn(orgId, actor, ref, {
                 report: sub,
                 removing: new Set(),
                 from: diff.installId,
@@ -671,7 +754,7 @@ export class PluginUpgrader {
      * otherwise the connector inputs are built and checked as at install.
      */
     async diff(orgId, actor, installId, version, input) {
-        const db = this.d.db;
+        const db = this.db;
         if (!UUID_RE.test(installId))
             throw installNotFound();
         const install = await db
@@ -725,7 +808,7 @@ export class PluginUpgrader {
         }
         // Target rules (Decision 10)
         if (to.manifest.extension) {
-            const deployed = await deployedExtension(db, this.d.host, name);
+            const deployed = await deployedExtension(db, this.registry, name);
             const allowed = deploymentTarget(versions, deployed);
             if (allowed?.version !== to.version) {
                 throw targetInvalid(deployed === undefined
@@ -856,8 +939,8 @@ export class PluginUpgrader {
             });
         }
         // Skills (by name)
-        const fromNames = await catalogSkillNames(this.d.storage, from, from.manifest);
-        const toNames = await catalogSkillNames(this.d.storage, to, to.manifest);
+        const fromNames = await catalogSkillNames(this.storage, from, from.manifest);
+        const toNames = await catalogSkillNames(this.storage, to, to.manifest);
         const dirOf = (m, i) => packagePath((m.skills ?? [])[i]?.path);
         const fromSkills = new Map(fromNames.map((n, i) => [n, dirOf(from.manifest, i)]));
         const toSkills = new Map(toNames.map((n, i) => [n, dirOf(to.manifest, i)]));
@@ -914,8 +997,8 @@ export class PluginUpgrader {
         if (conflicts.length > 0)
             throw skillConflictError(conflicts);
         // Agent templates (by name; phase C)
-        const fromAgents = await readCatalogAgentTemplates(this.d.storage, from);
-        const toAgents = await readCatalogAgentTemplates(this.d.storage, to);
+        const fromAgents = await readCatalogAgentTemplates(this.storage, from);
+        const toAgents = await readCatalogAgentTemplates(this.storage, to);
         const templateRefs = ledger.filter((l) => l.kind === "agent_template").map((l) => l.ref);
         const liveTemplates = templateRefs.length === 0
             ? []
@@ -953,8 +1036,8 @@ export class PluginUpgrader {
             components.push({ kind: "agent_template", ref: a.name, change: a.change });
         }
         // Connector templates (by id)
-        const fromTemplates = await readCatalogTemplates(this.d.storage, from);
-        const toTemplates = await readCatalogTemplates(this.d.storage, to);
+        const fromTemplates = await readCatalogTemplates(this.storage, from);
+        const toTemplates = await readCatalogTemplates(this.storage, to);
         // The install's connectors by template; a dropped one (kept only for the agents using it) counts
         // only while its connector is live, so a template the target brings back maps onto it
         const connectorRows = ledger.filter((l) => l.kind === "connector" && l.template_id !== null);
@@ -1198,7 +1281,49 @@ export class PluginUpgrader {
             ...(c.credentialsChanged && credential !== undefined && { credential }),
         };
     }
-}
+};
+__decorate([
+    Transactional()
+], PluginUpgrader.prototype, "authorizeActions", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginUpgrader.prototype, "start", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginUpgrader.prototype, "journalSkill", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginUpgrader.prototype, "upgradeAgentTemplate", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginUpgrader.prototype, "recordStep", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginUpgrader.prototype, "finish", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginUpgrader.prototype, "undoFailed", null);
+__decorate([
+    Transactional({ propagation: "requires_new" })
+], PluginUpgrader.prototype, "undoInterrupted", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], PluginUpgrader.prototype, "removeIn", null);
+PluginUpgrader = __decorate([
+    Injectable(),
+    __param(0, Inject(PluginInstaller)),
+    __param(1, Inject(KernelDb)),
+    __param(2, Inject(OrgLock)),
+    __param(3, Inject(StorageService)),
+    __param(4, Inject(ExtensionRegistry)),
+    __param(5, Inject(SkillsService)),
+    __param(6, Inject(OrgExtensionConfigs)),
+    __param(7, Inject(CatalogRequestsService)),
+    __param(8, Inject(ConnectorsService)),
+    __param(9, Inject(KERNEL_LOGGER)),
+    __param(10, Inject(TransactionHost))
+], PluginUpgrader);
+export { PluginUpgrader };
 const cleanedUp = () => new ApiError("plugin.install_not_found", "The upgrade was cleaned up as interrupted while it was running");
 /** The install's ledger rows. */
 function ledgerOf(db, installId) {