@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/extensions/admin-ops.js

@@ -1,13 +1,33 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { SDK_VERSION } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import semver from "semver";
 import { pluginSchemaName } from "../ctx/create-ctx.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { lockEnterpriseAdminsAndAuthorize } from "../identity/enterprise-admin.js";
-import { PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
+import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { afterCommit } from "../infra/database/after-commit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
+import { ExtensionAdmin } from "./admin-view.js";
+import { ExtensionBlobs } from "./blobs.js";
+import { ExtensionLifecycle, PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
+import { PluginInstallLock } from "./locks.js";
 import { unrunMigrations } from "./migrate-lock.js";
 import { ExtensionPackageError, extensionPackageApiError, readExtensionPackage, } from "./package.js";
+import { ExtensionRegistry } from "./registry.js";
 /**
  * Deployment-level extension install / enable / disable / uninstall (C16 / D15): writes only the PG
  * desired state (`extension_installs`) and the audit, then publishes `kernel.plugins.changed` after
@@ -17,10 +37,53 @@ import { ExtensionPackageError, extensionPackageApiError, readExtensionPackage,
  * Every write runs in a transaction: first `lockEnterpriseAdminsAndAuthorize` (skipped by the CLI),
  * then an advisory lock by extension name and a lock on the install record row.
  */
-export class ExtensionAdminOps {
-    d;
-    constructor(d) {
-        this.d = d;
+let ExtensionAdminOps = class ExtensionAdminOps {
+    kdb;
+    txHost;
+    adminLock;
+    installLock;
+    admin;
+    registry;
+    blobs;
+    config;
+    bus;
+    lifecycle;
+    log;
+    constructor(kdb, txHost, 
+    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    adminLock, installLock, 
+    /**
+     * The admin view after the operation, degraded when the package cannot be read
+     * (`get(name, { allowUnreadable: true })`). If it throws, the operation has already committed:
+     * ops logs an error and returns {@link fallbackView}, so an operation that took effect is not
+     * reported as failed.
+     */
+    admin, 
+    /** The config-declared extension names (they cannot be installed / disabled / uninstalled, C15). */
+    registry, 
+    /** Reads packages (a downgrade checks the target version's migration files). */
+    blobs, config, 
+    /** Publishes `kernel.plugins.changed`. */
+    bus, 
+    /**
+     * When the publish fails this replica reconciles itself (not awaited; other replicas catch up
+     * periodically). A no-op where the lifecycle never started (the CLI).
+     */
+    lifecycle, log) {
+        this.kdb = kdb;
+        this.txHost = txHost;
+        this.adminLock = adminLock;
+        this.installLock = installLock;
+        this.admin = admin;
+        this.registry = registry;
+        this.blobs = blobs;
+        this.config = config;
+        this.bus = bus;
+        this.lifecycle = lifecycle;
+        this.log = log;
+    }
+    get db() {
+        return this.kdb.db;
     }
     /**
      * New install or version change (upgrade / downgrade): the install record points at package
@@ -52,7 +115,7 @@ export class ExtensionAdminOps {
      */
     async install(name, sha256, actor, actorTokenId, opts = {}) {
         this.assertInstallable(name);
-        const pkg = await this.d.db
+        const pkg = await this.db
             .selectFrom("extension_packages")
             .select(["sha256", "name", "package_name", "version", "source"])
             .where("sha256", "=", sha256)
@@ -66,100 +129,101 @@ export class ExtensionAdminOps {
         // The downgrade check needs the target package's migration files: read and parse the package
         // outside the transaction (inside it only _migrations is compared). A stored package in the
         // pre-0.1.0 format -> extension.legacy_format.
-        const target = await readExtensionPackage(await this.d.blobs.get(sha256), {
-            maxBytes: this.d.config().packages.maxBytes,
+        const target = await readExtensionPackage(await this.blobs.get(sha256), {
+            maxBytes: this.config.get().packages.maxBytes,
             hostSdkVersion: SDK_VERSION,
         }).catch((e) => {
             throw e instanceof ExtensionPackageError ? extensionPackageApiError(e) : e;
         });
-        const changed = await this.d.db.transaction().execute(async (trx) => {
-            if (actor !== null)
-                await lockEnterpriseAdminsAndAuthorize(trx, actor);
-            const row = await this.lockRow(trx, name);
-            // 不经目录重装时保留原来的来源条目（不清空，C22）
-            const catalogItemId = opts.catalogItemId ?? row?.catalog_item_id ?? null;
-            if (opts.catalogItemId !== undefined) {
-                await trx
-                    .insertInto("extension_catalog_sources")
-                    .values({ plugin: name, item_id: opts.catalogItemId })
-                    .onConflict((oc) => oc.columns(["plugin", "item_id"]).doNothing())
-                    .execute();
-            }
-            if (row && row.package_name !== pkg.package_name) {
-                throw new ApiError("extension.name_conflict", `Extension ${name} is already installed from package ${row.package_name}; package ${pkg.package_name} uses the same extension name`);
-            }
-            // Ruling P3：插件名归第一次安装它的 npm 包（卸载不删），别的包不能接手（数据、密钥与批准都还在）。
-            // 还没有归属、却已有这个名字留下的快照 / 部署配置 / 组织配置（I4：如归属表之前就有的配置声明插件）：
-            // 不知道它们属于哪个包，同样拒绝
-            const owned = await trx
-                .selectFrom("extension_name_owners")
-                .select("package_name")
-                .where("name", "=", name)
-                .executeTakeFirst();
-            if (!owned && (await hasRetainedData(trx, name))) {
-                throw new ApiError("extension.name_conflict", `Extension name ${name} already has retained data (permission approval, deployment config or organization settings) from an extension that is not installed here, and no package owns the name; package ${pkg.package_name} cannot take it over. Remove that data or use a different extension name`);
-            }
-            await trx
-                .insertInto("extension_name_owners")
-                .values({ name, package_name: pkg.package_name })
-                .onConflict((oc) => oc.column("name").doNothing())
+        const changed = await this.writeInstall(name, sha256, pkg, target, actor, actorTokenId, opts);
+        return this.viewAfterCommit(name, { version: pkg.version, sha256, state: changed.state });
+    }
+    async writeInstall(name, sha256, pkg, target, actor, actorTokenId, opts) {
+        const db = this.db;
+        if (actor !== null)
+            await this.adminLock.lockAndAuthorize(actor);
+        const row = await this.lockRow(name);
+        // 不经目录重装时保留原来的来源条目（不清空，C22）
+        const catalogItemId = opts.catalogItemId ?? row?.catalog_item_id ?? null;
+        if (opts.catalogItemId !== undefined) {
+            await db
+                .insertInto("extension_catalog_sources")
+                .values({ plugin: name, item_id: opts.catalogItemId })
+                .onConflict((oc) => oc.columns(["plugin", "item_id"]).doNothing())
                 .execute();
-            const owner = await trx
-                .selectFrom("extension_name_owners")
-                .select("package_name")
-                .where("name", "=", name)
-                .executeTakeFirstOrThrow();
-            if (owner.package_name !== pkg.package_name) {
-                throw new ApiError("extension.name_conflict", `Extension name ${name} was previously used by package ${owner.package_name}; its data, secrets and permission approval are retained for that package, so package ${pkg.package_name} cannot take over the name`);
-            }
-            // 已指向同一个包：什么都不改，降级视图仍给出真实的期望状态
-            if (row?.sha256 === sha256) {
-                if (row.catalog_item_id !== catalogItemId) {
-                    // 包没变、只有来源条目变了：照样留审计（来源变化影响 T26 的目录策略约束）
-                    await trx
-                        .updateTable("extension_installs")
-                        .set({ catalog_item_id: catalogItemId })
-                        .where("name", "=", name)
-                        .execute();
-                    await this.audit(trx, actor, actorTokenId, "extension.install_source_changed", name, pkg.version, sha256, { catalogItemId, previousCatalogItemId: row.catalog_item_id });
-                }
-                return { changed: false, state: row.desired_state };
+        }
+        if (row && row.package_name !== pkg.package_name) {
+            throw new ApiError("extension.name_conflict", `Extension ${name} is already installed from package ${row.package_name}; package ${pkg.package_name} uses the same extension name`);
+        }
+        // Ruling P3：插件名归第一次安装它的 npm 包（卸载不删），别的包不能接手（数据、密钥与批准都还在）。
+        // 还没有归属、却已有这个名字留下的快照 / 部署配置 / 组织配置（I4：如归属表之前就有的配置声明插件）：
+        // 不知道它们属于哪个包，同样拒绝
+        const owned = await db
+            .selectFrom("extension_name_owners")
+            .select("package_name")
+            .where("name", "=", name)
+            .executeTakeFirst();
+        if (!owned && (await hasRetainedData(db, name))) {
+            throw new ApiError("extension.name_conflict", `Extension name ${name} already has retained data (permission approval, deployment config or organization settings) from an extension that is not installed here, and no package owns the name; package ${pkg.package_name} cannot take it over. Remove that data or use a different extension name`);
+        }
+        await db
+            .insertInto("extension_name_owners")
+            .values({ name, package_name: pkg.package_name })
+            .onConflict((oc) => oc.column("name").doNothing())
+            .execute();
+        const owner = await db
+            .selectFrom("extension_name_owners")
+            .select("package_name")
+            .where("name", "=", name)
+            .executeTakeFirstOrThrow();
+        if (owner.package_name !== pkg.package_name) {
+            throw new ApiError("extension.name_conflict", `Extension name ${name} was previously used by package ${owner.package_name}; its data, secrets and permission approval are retained for that package, so package ${pkg.package_name} cannot take over the name`);
+        }
+        // 已指向同一个包：什么都不改，降级视图仍给出真实的期望状态
+        if (row?.sha256 === sha256) {
+            if (row.catalog_item_id !== catalogItemId) {
+                // 包没变、只有来源条目变了：照样留审计（来源变化影响 T26 的目录策略约束）
+                await db
+                    .updateTable("extension_installs")
+                    .set({ catalog_item_id: catalogItemId })
+                    .where("name", "=", name)
+                    .execute();
+                await this.audit(actor, actorTokenId, "extension.install_source_changed", name, pkg.version, sha256, { catalogItemId, previousCatalogItemId: row.catalog_item_id });
             }
-            if (row && isDowngrade(pkg.version, row.version)) {
-                const unrun = await unrunMigrations(trx, name, target.migrationSql);
-                if (unrun.length > 0) {
-                    throw new ApiError("extension.downgrade_unsupported", `Extension ${name} ${pkg.version} has migrations that were never run here (${unrun.join(", ")}); extension migrations only expand, so downgrade only to a version whose migrations have all been applied`, unrun.map((file) => ({ file })));
-                }
+            return { changed: false, state: row.desired_state };
+        }
+        if (row && isDowngrade(pkg.version, row.version)) {
+            const unrun = await unrunMigrations(db, name, target.migrationSql);
+            if (unrun.length > 0) {
+                throw new ApiError("extension.downgrade_unsupported", `Extension ${name} ${pkg.version} has migrations that were never run here (${unrun.join(", ")}); extension migrations only expand, so downgrade only to a version whose migrations have all been applied`, unrun.map((file) => ({ file })));
             }
-            await trx
-                .insertInto("extension_installs")
-                .values({
-                name,
-                sha256,
-                version: pkg.version,
-                source: pkg.source,
-                desired_state: "disabled",
-                installed_by: actor,
-                updated_by: actor,
-                catalog_item_id: catalogItemId,
-            })
-                .onConflict((oc) => oc.column("name").doUpdateSet({
-                sha256,
-                version: pkg.version,
-                source: pkg.source,
-                updated_by: actor,
-                catalog_item_id: catalogItemId,
-                updated_at: sql `now()`,
-            }))
-                .execute();
-            await this.audit(trx, actor, actorTokenId, "extension.installed", name, pkg.version, sha256, {
-                catalogItemId,
-            });
-            return { changed: true, state: row?.desired_state ?? "disabled" };
+        }
+        await db
+            .insertInto("extension_installs")
+            .values({
+            name,
+            sha256,
+            version: pkg.version,
+            source: pkg.source,
+            desired_state: "disabled",
+            installed_by: actor,
+            updated_by: actor,
+            catalog_item_id: catalogItemId,
+        })
+            .onConflict((oc) => oc.column("name").doUpdateSet({
+            sha256,
+            version: pkg.version,
+            source: pkg.source,
+            updated_by: actor,
+            catalog_item_id: catalogItemId,
+            updated_at: sql `now()`,
+        }))
+            .execute();
+        await this.audit(actor, actorTokenId, "extension.installed", name, pkg.version, sha256, {
+            catalogItemId,
         });
-        if (changed.changed)
-            await this.notify(name);
-        return this.viewAfterCommit(name, { version: pkg.version, sha256, state: changed.state });
+        afterCommit(() => this.notify(name));
+        return { changed: true, state: row?.desired_state ?? "disabled" };
     }
     /** Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org enablement is unchanged. */
     enable(name, actor, actorTokenId) {
@@ -184,65 +248,68 @@ export class ExtensionAdminOps {
      */
     async uninstall(name, actor, actorTokenId) {
         this.assertInstallable(name);
-        await this.d.db.transaction().execute(async (trx) => {
-            if (actor !== null)
-                await lockEnterpriseAdminsAndAuthorize(trx, actor);
-            const row = await this.lockRow(trx, name);
-            if (!row)
-                throw notFound(name);
-            if (row.required)
-                throw required(name);
-            if (row.desired_state !== "disabled") {
-                throw new ApiError("extension.not_disabled", `Extension ${name} is enabled; disable it before uninstalling`);
-            }
-            await trx.deleteFrom("extension_installs").where("name", "=", name).execute();
-            // 来源条目随安装记录一起删：之后不经目录重新安装时不再受旧条目的策略约束（T26 裁决）
-            await trx.deleteFrom("extension_catalog_sources").where("plugin", "=", name).execute();
-            await this.audit(trx, actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256);
-        });
-        await this.notify(name);
+        await this.writeUninstall(name, actor, actorTokenId);
+    }
+    async writeUninstall(name, actor, actorTokenId) {
+        const db = this.db;
+        if (actor !== null)
+            await this.adminLock.lockAndAuthorize(actor);
+        const row = await this.lockRow(name);
+        if (!row)
+            throw notFound(name);
+        if (row.required)
+            throw required(name);
+        if (row.desired_state !== "disabled") {
+            throw new ApiError("extension.not_disabled", `Extension ${name} is enabled; disable it before uninstalling`);
+        }
+        await db.deleteFrom("extension_installs").where("name", "=", name).execute();
+        // 来源条目随安装记录一起删：之后不经目录重新安装时不再受旧条目的策略约束（T26 裁决）
+        await db.deleteFrom("extension_catalog_sources").where("plugin", "=", name).execute();
+        await this.audit(actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256);
+        afterCommit(() => this.notify(name));
     }
     async setState(name, state, actor, actorTokenId) {
         this.assertInstallable(name);
-        const result = await this.d.db.transaction().execute(async (trx) => {
-            if (actor !== null)
-                await lockEnterpriseAdminsAndAuthorize(trx, actor);
-            const row = await this.lockRow(trx, name);
-            if (!row)
-                throw notFound(name);
-            if (state === "disabled" && row.required)
-                throw required(name);
-            if (row.desired_state === state)
-                return { row, changed: false };
-            await trx
-                .updateTable("extension_installs")
-                .set({
-                desired_state: state,
-                updated_by: actor,
-                updated_at: sql `now()`,
-            })
-                .where("name", "=", name)
-                .execute();
-            await this.audit(trx, actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256);
-            return { row, changed: true };
-        });
-        if (result.changed)
-            await this.notify(name);
+        const result = await this.writeState(name, state, actor, actorTokenId);
         return this.viewAfterCommit(name, {
             version: result.row.version,
             sha256: result.row.sha256,
             state,
         });
     }
+    async writeState(name, state, actor, actorTokenId) {
+        const db = this.db;
+        if (actor !== null)
+            await this.adminLock.lockAndAuthorize(actor);
+        const row = await this.lockRow(name);
+        if (!row)
+            throw notFound(name);
+        if (state === "disabled" && row.required)
+            throw required(name);
+        if (row.desired_state === state)
+            return { row, changed: false };
+        await db
+            .updateTable("extension_installs")
+            .set({
+            desired_state: state,
+            updated_by: actor,
+            updated_at: sql `now()`,
+        })
+            .where("name", "=", name)
+            .execute();
+        await this.audit(actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256);
+        afterCommit(() => this.notify(name));
+        return { row, changed: true };
+    }
     /**
      * 提交后的视图：拼视图失败（读包、查状态行出错）时操作已经生效，不能再报失败——记 error，返回降级视图。
      */
     async viewAfterCommit(name, known) {
         try {
-            return await this.d.view(name);
+            return await this.admin.get(name, { allowUnreadable: true });
         }
         catch (err) {
-            this.d.log.error("plugin change committed, but its admin view cannot be built", {
+            this.log.error("plugin change committed, but its admin view cannot be built", {
                 plugin: name,
                 err,
             });
@@ -251,15 +318,15 @@ export class ExtensionAdminOps {
     }
     /** 配置声明的插件不经安装记录管理。 */
     assertInstallable(name) {
-        const declared = this.d.declared().get(name);
+        const declared = this.registry.declared().get(name);
         if (declared === "config") {
             throw new ApiError("extension.config_declared", `Extension ${name} is declared in the startup config (extensions); change that list and restart instead`);
         }
     }
-    /** 按插件名串行（咨询锁，覆盖「还没有行」的新装），再锁住已有的安装记录行。 */
-    async lockRow(trx, name) {
-        await sql `SELECT pg_advisory_xact_lock(hashtext(${`capybara.plugin-install:${name}`}))`.execute(trx);
-        return trx
+    /** 按插件名串行（`PluginInstallLock`，覆盖「还没有行」的新装），再锁住已有的安装记录行。 */
+    async lockRow(name) {
+        await this.installLock.lock(name);
+        return this.db
             .selectFrom("extension_installs")
             .innerJoin("extension_packages", "extension_packages.sha256", "extension_installs.sha256")
             .select([
@@ -274,8 +341,8 @@ export class ExtensionAdminOps {
             .forUpdate("extension_installs")
             .executeTakeFirst();
     }
-    async audit(trx, actor, actorTokenId, action, name, version, sha256, extra = {}) {
-        await audit(trx, {
+    async audit(actor, actorTokenId, action, name, version, sha256, extra = {}) {
+        await audit(this.db, {
             ...(actor !== null && { actorAccountId: actor }),
             ...(actorTokenId !== undefined && { actorTokenId }),
             action,
@@ -286,16 +353,43 @@ export class ExtensionAdminOps {
     /** 提交后通知各副本；发布失败只告警（周期 reconcile 兜底），本副本自己先 reconcile。 */
     async notify(name) {
         try {
-            await this.d.bus.publish(PLUGINS_CHANGED_TOPIC, { plugin: name });
+            await this.bus.publish(PLUGINS_CHANGED_TOPIC, { plugin: name });
         }
         catch (err) {
-            this.d.log.warn("cannot publish plugins.changed; replicas converge on the next periodic reconcile", { plugin: name, err });
-            this.d
-                .reconcile?.(`changed:${name}`)
-                .catch((e) => this.d.log.error("plugin reconcile failed", { plugin: name, err: e }));
+            this.log.warn("cannot publish plugins.changed; replicas converge on the next periodic reconcile", { plugin: name, err });
+            this.lifecycle
+                .reconcile(`changed:${name}`)
+                .catch((e) => this.log.error("plugin reconcile failed", { plugin: name, err: e }));
         }
     }
-}
+};
+__decorate([
+    Transactional()
+], ExtensionAdminOps.prototype, "writeInstall", null);
+__decorate([
+    Transactional()
+], ExtensionAdminOps.prototype, "writeUninstall", null);
+__decorate([
+    Transactional()
+], ExtensionAdminOps.prototype, "writeState", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ExtensionAdminOps.prototype, "lockRow", null);
+ExtensionAdminOps = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(EnterpriseAdminLock)),
+    __param(3, Inject(PluginInstallLock)),
+    __param(4, Inject(ExtensionAdmin)),
+    __param(5, Inject(ExtensionRegistry)),
+    __param(6, Inject(ExtensionBlobs)),
+    __param(7, Inject(KernelConfigService)),
+    __param(8, Inject(KERNEL_BUS)),
+    __param(9, Inject(ExtensionLifecycle)),
+    __param(10, Inject(KERNEL_LOGGER))
+], ExtensionAdminOps);
+export { ExtensionAdminOps };
 /**
  * 拼不出视图时的降级项（与后台列表里包读不到的项同形：status failed、权限为空、带 `error`）。
  */
@@ -327,19 +421,19 @@ function fallbackView(name, known, err) {
     };
 }
 /** 插件名已留下的数据：权限快照、部署配置、任一组织的配置，或插件 schema（`plugin_<name>`）。 */
-async function hasRetainedData(trx, name) {
-    const schema = await sql `SELECT 1 AS x FROM pg_namespace WHERE nspname = ${pluginSchemaName(name)}`.execute(trx);
+async function hasRetainedData(db, name) {
+    const schema = await sql `SELECT 1 AS x FROM pg_namespace WHERE nspname = ${pluginSchemaName(name)}`.execute(db);
     if (schema.rows.length > 0)
         return true;
-    const hit = await trx
+    const hit = await db
         .selectFrom("extension_permission_snapshots")
         .select(sql `1`.as("x"))
         .where("plugin", "=", name)
-        .union(trx
+        .union(db
         .selectFrom("extension_deployment_configs")
         .select(sql `1`.as("x"))
         .where("plugin", "=", name))
-        .union(trx
+        .union(db
         .selectFrom("extension_org_configs")
         .select(sql `1`.as("x"))
         .where("plugin", "=", name))

package/dist/extensions/admin-view.d.ts

@@ -1,9 +1,14 @@
-import type { KernelConfig } from "../config/schema.js";
-import type { KernelDb } from "../db/kernel-schema.js";
-import type { ExtensionBlobs } from "./blobs.js";
-import type { DeclaredExtensionInfo } from "./host.js";
-import type { ExtensionInstalls } from "./installs.js";
-import { PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
+import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
+import { ExtensionApprovals } from "./approvals.js";
+import { ExtensionBlobs } from "./blobs.js";
+import { ExtensionHost } from "./host.js";
+import { ExtensionInstalls } from "./installs.js";
+import { ExtensionLifecycle, PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
+import { PluginApproveLock } from "./locks.js";
 import { type AdminExtensionView } from "./permission-view.js";
 export { PLUGINS_CHANGED_TOPIC };
 /** The web approval request body (`POST /api/v1/admin/extensions/:name/approve`). */
@@ -12,34 +17,39 @@ export interface ApproveBody {
     sha256: string | null;
     reviewHash: string;
 }
-export interface ExtensionAdminDeps {
-    db: KernelDb;
-    blobs: Pick<ExtensionBlobs, "get">;
-    installs: ExtensionInstalls;
-    config: () => KernelConfig;
-    host: {
-        declaredPlugins(): DeclaredExtensionInfo[];
-    };
-    /**
-     * 本副本 reconcile（批准后等它完成再返回视图；其他副本经 `kernel.plugins.changed` 收敛）。CLI 没有（只发布）。
-     */
-    reconcile?: (reason: string) => Promise<void>;
-    bus: {
-        publish(topic: string, payload: unknown): Promise<void>;
-    };
-    log: {
-        warn(msg: string, fields?: Record<string, unknown>): void;
-        error(msg: string, fields?: Record<string, unknown>): void;
-    };
+/** The kernel bus as the admin operations use it (publish only). */
+export interface PublishBus {
+    publish(topic: string, payload: unknown): Promise<void>;
 }
 /**
  * 部署级插件后台（企业管理员）：列表 / 详情与网页批准权限（D8）。无状态，多副本共用；
  * 状态由 PG（安装记录、快照、各副本状态行）与本副本宿主（配置声明插件的清单）推出。
  */
 export declare class ExtensionAdmin {
-    private readonly d;
+    private readonly kdb;
+    readonly txHost: TransactionHost;
+    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    private readonly adminLock;
+    private readonly approveLock;
+    private readonly blobs;
+    private readonly installs;
+    private readonly approvals;
+    /** The config-declared extensions (this replica's host; the CLI fills it from its inspection). */
+    private readonly host;
+    /** This replica's reconcile after an approval (a no-op where the lifecycle never started: the CLI). */
+    private readonly lifecycle;
+    private readonly config;
+    private readonly bus;
+    private readonly log;
     private readonly packageSets;
-    constructor(d: ExtensionAdminDeps);
+    constructor(kdb: KernelDb, txHost: TransactionHost, 
+    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    adminLock: EnterpriseAdminLock, approveLock: PluginApproveLock, blobs: ExtensionBlobs, installs: ExtensionInstalls, approvals: ExtensionApprovals, 
+    /** The config-declared extensions (this replica's host; the CLI fills it from its inspection). */
+    host: ExtensionHost, 
+    /** This replica's reconcile after an approval (a no-op where the lifecycle never started: the CLI). */
+    lifecycle: ExtensionLifecycle, config: KernelConfigService, bus: PublishBus, log: KernelLogger);
+    private get db();
     /** 全部插件（配置声明 → 安装记录，各自按名字）。 */
     list(): Promise<AdminExtensionView[]>;
     /**
@@ -69,6 +79,7 @@ export declare class ExtensionAdmin {
     approve(actor: string, name: string, body: ApproveBody, opts?: {
         actorTokenId?: string;
     }): Promise<AdminExtensionView>;
+    private writeApproval;
     /** 配置声明 → 安装记录（与配置声明重名的安装记录不生效，不单列）。`only` 给出时只取这一个。 */
     private subjects;
     /**