@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.20

package/dist/catalog/marketplace-icons.d.ts

@@ -0,0 +1,64 @@
+import { type MarketplaceEntry } from "@capybara-hq/plugin-sdk";
+import { type LookupFn, type NetPolicy } from "../net/public-address.js";
+/**
+ * Marketplace entry icons (maintainer decision 2026-11-08; plugin component management spec §16):
+ * the icon a marketplace entry names for its plugin before it is imported. An entry's `icon` is an
+ * https URL or a path in a git marketplace's repository (SDK `MarketplaceEntry.icon`). The refresh
+ * reads each one (a URL through `net/safeFetch` under the marketplace network rules and
+ * `marketplaces.allowedHosts`, never with the marketplace token; a path from the commit it fetched
+ * anyway), keeps those that really are an svg / png of at most 64 KiB in `marketplace_icons`, and
+ * the admin market list serves them like plugin icons (`sendCatalogIcon`). A failed or invalid
+ * icon is only logged: the entry has no icon and the list shows its initial.
+ */
+/** The timeout of one icon download. */
+export declare const MARKETPLACE_ICON_TIMEOUT_MS = 10000;
+/** At most this many icon URLs are downloaded per refresh (the rest wait for the next one). */
+export declare const MARKETPLACE_ICON_FETCHES_MAX = 100;
+/** How long after a failed download an icon URL is tried again (by a later refresh). */
+export declare const MARKETPLACE_ICON_RETRY_MS: number;
+/** Parallel icon downloads of one refresh. */
+export declare const MARKETPLACE_ICON_CONCURRENCY = 4;
+/** The largest icon (the plugin icon limit). */
+export declare const MARKETPLACE_ICON_MAX_BYTES: number;
+/** A stored icon: its content type and sha256 (the address the admin route serves it at). */
+export interface CheckedIcon {
+    contentType: "image/svg+xml" | "image/png";
+    sha256: string;
+    data: Uint8Array;
+}
+/**
+ * Whether `data` is an icon the kernel serves, by the extension of `name` (a URL's path or a
+ * repository path) and its content, like a plugin icon ({@link iconProblem}): the checked icon, or
+ * the problem (English).
+ */
+export declare function checkMarketplaceIcon(name: string, data: Uint8Array): CheckedIcon | string;
+/**
+ * Downloads one icon URL under the marketplace network rules (https, public addresses or
+ * `allowPrivateHosts`, `net.httpsProxy`, no redirects, {@link MARKETPLACE_ICON_TIMEOUT_MS}, at
+ * most {@link MARKETPLACE_ICON_MAX_BYTES}) and checks it: the icon, or why it was not kept. Never
+ * throws (an abort of `signal` is a problem too).
+ */
+export declare function fetchMarketplaceIcon(url: string, o: {
+    net: NetPolicy;
+    signal: AbortSignal;
+    lookup?: LookupFn;
+}): Promise<CheckedIcon | string>;
+/**
+ * The repository paths (relative to the root, without `./`) of the icons a git marketplace's
+ * manifest names, read leniently (the manifest is validated afterwards); for a single-plugin repo
+ * (no manifest) the root `plugin.json`'s icon. At most `max` paths.
+ */
+export declare function gitIconPaths(files: Map<string, Uint8Array>, manifestPath: string, maxIndexBytes: number, max: number): string[];
+/**
+ * The icons a refresh has to have for `entries` of a marketplace of `form`, as the entries write
+ * them (the stored `ref`): repository paths `./…` (git marketplaces only; an http marketplace has
+ * no repository) and URLs, each once.
+ */
+export declare function wantedIcons(entries: Pick<MarketplaceEntry, "icon">[], form: "http" | "git"): {
+    paths: Set<string>;
+    urls: Set<string>;
+};
+/** The admin route of a stored icon (content addressed: the URL changes with the bytes). */
+export declare const marketplaceIconUrl: (sourceId: string, sha256: string) => string;
+/** The org browse route of a stored icon (org admins of `orgId`, like the org browse). */
+export declare const orgMarketplaceIconUrl: (orgId: string) => (sourceId: string, sha256: string) => string;

package/dist/catalog/marketplace-icons.js

@@ -0,0 +1,131 @@
+import { createHash } from "node:crypto";
+import { MARKETPLACE_ICON_RE, MARKETPLACE_LIMITS, marketplaceEntryIcon, PLUGIN_MANIFEST_FILE, } from "@capybara-hq/plugin-sdk";
+import { NetDeniedError } from "../net/public-address.js";
+import { safeFetch } from "../net/safe-fetch.js";
+import { packagePath } from "../packages/tgz.js";
+import { marketplaceUrlProblem } from "./marketplace-fetch.js";
+import { iconProblem } from "./plugin-package.js";
+/**
+ * Marketplace entry icons (maintainer decision 2026-11-08; plugin component management spec §16):
+ * the icon a marketplace entry names for its plugin before it is imported. An entry's `icon` is an
+ * https URL or a path in a git marketplace's repository (SDK `MarketplaceEntry.icon`). The refresh
+ * reads each one (a URL through `net/safeFetch` under the marketplace network rules and
+ * `marketplaces.allowedHosts`, never with the marketplace token; a path from the commit it fetched
+ * anyway), keeps those that really are an svg / png of at most 64 KiB in `marketplace_icons`, and
+ * the admin market list serves them like plugin icons (`sendCatalogIcon`). A failed or invalid
+ * icon is only logged: the entry has no icon and the list shows its initial.
+ */
+/** The timeout of one icon download. */
+export const MARKETPLACE_ICON_TIMEOUT_MS = 10_000;
+/** At most this many icon URLs are downloaded per refresh (the rest wait for the next one). */
+export const MARKETPLACE_ICON_FETCHES_MAX = 100;
+/** How long after a failed download an icon URL is tried again (by a later refresh). */
+export const MARKETPLACE_ICON_RETRY_MS = 6 * 3600_000;
+/** Parallel icon downloads of one refresh. */
+export const MARKETPLACE_ICON_CONCURRENCY = 4;
+/** The largest icon (the plugin icon limit). */
+export const MARKETPLACE_ICON_MAX_BYTES = MARKETPLACE_LIMITS.iconBytes;
+/**
+ * Whether `data` is an icon the kernel serves, by the extension of `name` (a URL's path or a
+ * repository path) and its content, like a plugin icon ({@link iconProblem}): the checked icon, or
+ * the problem (English).
+ */
+export function checkMarketplaceIcon(name, data) {
+    if (!MARKETPLACE_ICON_RE.test(name))
+        return `${name} is not a .svg or .png file`;
+    const problem = iconProblem(name, data);
+    if (problem !== undefined)
+        return problem;
+    return {
+        contentType: /\.svg$/i.test(name) ? "image/svg+xml" : "image/png",
+        sha256: createHash("sha256").update(data).digest("hex"),
+        data,
+    };
+}
+/**
+ * Downloads one icon URL under the marketplace network rules (https, public addresses or
+ * `allowPrivateHosts`, `net.httpsProxy`, no redirects, {@link MARKETPLACE_ICON_TIMEOUT_MS}, at
+ * most {@link MARKETPLACE_ICON_MAX_BYTES}) and checks it: the icon, or why it was not kept. Never
+ * throws (an abort of `signal` is a problem too).
+ */
+export async function fetchMarketplaceIcon(url, o) {
+    const problem = marketplaceUrlProblem(url, o.net.allowInsecureLoopback);
+    if (problem !== null)
+        return `invalid icon URL: ${problem}`;
+    const target = new URL(url);
+    const signal = AbortSignal.any([o.signal, AbortSignal.timeout(MARKETPLACE_ICON_TIMEOUT_MS)]);
+    try {
+        const res = await safeFetch(target.href, { signal }, o.net, {
+            maxBytes: MARKETPLACE_ICON_MAX_BYTES,
+            ...(o.lookup !== undefined && { lookup: o.lookup }),
+        });
+        if (!res.ok) {
+            await res.body?.cancel().catch(() => { });
+            return `the icon URL responded with HTTP ${res.status}`;
+        }
+        const data = new Uint8Array(await res.arrayBuffer());
+        return checkMarketplaceIcon(target.pathname, data);
+    }
+    catch (e) {
+        if (e instanceof NetDeniedError)
+            return `icon download refused: ${e.message}`;
+        return `cannot fetch the icon: ${e instanceof Error ? e.message : String(e)}`;
+    }
+}
+/**
+ * The repository paths (relative to the root, without `./`) of the icons a git marketplace's
+ * manifest names, read leniently (the manifest is validated afterwards); for a single-plugin repo
+ * (no manifest) the root `plugin.json`'s icon. At most `max` paths.
+ */
+export function gitIconPaths(files, manifestPath, maxIndexBytes, max) {
+    const json = (raw) => {
+        if (raw === undefined || raw.byteLength > maxIndexBytes)
+            return undefined;
+        try {
+            return JSON.parse(new TextDecoder().decode(raw));
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const paths = new Set();
+    const manifest = json(files.get(manifestPath));
+    if (files.has(manifestPath)) {
+        if (!Array.isArray(manifest?.plugins))
+            return [];
+        for (const p of manifest.plugins) {
+            const icon = p?.icon;
+            if (typeof icon === "string" && icon.startsWith("./") && MARKETPLACE_ICON_RE.test(icon)) {
+                paths.add(icon.slice(2));
+            }
+            if (paths.size >= max)
+                break;
+        }
+        return [...paths];
+    }
+    const icon = json(files.get(PLUGIN_MANIFEST_FILE))?.icon;
+    return typeof icon === "string" && MARKETPLACE_ICON_RE.test(icon) ? [packagePath(icon)] : [];
+}
+/**
+ * The icons a refresh has to have for `entries` of a marketplace of `form`, as the entries write
+ * them (the stored `ref`): repository paths `./…` (git marketplaces only; an http marketplace has
+ * no repository) and URLs, each once.
+ */
+export function wantedIcons(entries, form) {
+    const paths = new Set();
+    const urls = new Set();
+    for (const e of entries) {
+        const icon = marketplaceEntryIcon(e);
+        if (icon === null)
+            continue;
+        if ("url" in icon)
+            urls.add(icon.url);
+        else if (form === "git")
+            paths.add(`./${icon.path}`);
+    }
+    return { paths, urls };
+}
+/** The admin route of a stored icon (content addressed: the URL changes with the bytes). */
+export const marketplaceIconUrl = (sourceId, sha256) => `/api/v1/admin/marketplaces/${encodeURIComponent(sourceId)}/icons/${sha256}`;
+/** The org browse route of a stored icon (org admins of `orgId`, like the org browse). */
+export const orgMarketplaceIconUrl = (orgId) => (sourceId, sha256) => `/api/v1/orgs/${encodeURIComponent(orgId)}/marketplaces/${encodeURIComponent(sourceId)}/icons/${sha256}`;

package/dist/catalog/marketplaces.controller.d.ts

@@ -1,77 +1,61 @@
-import { z } from "zod";
+import type { FastifyReply } from "fastify";
+import type { z } from "zod";
+import { PluginIcons } from "../extensions/plugin-icons.js";
 import { type Principal } from "../identity/principal.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { type OrgContext } from "../orgs/org.guard.js";
 import { CatalogService, type MarketplaceImportResult } from "./catalog.service.js";
+import { MarketplaceImportBody as ImportBody, MarketplaceAddBody, MarketplaceEntriesQuery, MarketplacePatchBody as PatchBody } from "./marketplaces.schemas.js";
 import { type MarketplaceEntryView, MarketplacesService, type MarketplaceView } from "./marketplaces.service.js";
-declare const AddBody: z.ZodObject<{
-    name: z.ZodString;
-    url: z.ZodString;
-    form: z.ZodOptional<z.ZodEnum<{
-        git: "git";
-        http: "http";
-    }>>;
-    ref: z.ZodOptional<z.ZodString>;
-    mirrors: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    token: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-declare const PatchBody: z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
-    url: z.ZodOptional<z.ZodString>;
-    form: z.ZodOptional<z.ZodEnum<{
-        git: "git";
-        http: "http";
-    }>>;
-    ref: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    mirrors: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    enabled: z.ZodOptional<z.ZodBoolean>;
-    token: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-}, z.core.$strict>;
-declare const EntriesQuery: z.ZodObject<{
-    sourceId: z.ZodOptional<z.ZodString>;
-    q: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-declare const ImportBody: z.ZodObject<{
-    version: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
 /**
- * Marketplaces (`/api/v1/admin/marketplaces/*`, enterprise admins): create, update, delete and
- * refresh the official and enterprise marketplaces, browse entries, import from a marketplace.
- * Writes re-check the enterprise admin inside the service's lock and are audited.
+ * Marketplaces (`/api/v1/admin/marketplaces/*`, super admins): create, update, delete and
+ * refresh the official and custom marketplaces, browse entries, import from a marketplace.
+ * Writes re-check the super admin inside the service's lock and are audited.
  */
 export declare class MarketplacesController {
     private readonly marketplaces;
     private readonly catalog;
     private readonly config;
-    constructor(marketplaces: MarketplacesService, catalog: CatalogService, config: KernelConfigService);
+    private readonly icons;
+    constructor(marketplaces: MarketplacesService, catalog: CatalogService, config: KernelConfigService, icons: PluginIcons);
     /** 全部来源；`offline` 为 true 表示 `marketplaces.official.enabled` 为 false（界面显示「离线模式」）。 */
     list(): Promise<{
         items: MarketplaceView[];
         offline: boolean;
     }>;
     /**
-     * Adds an enterprise marketplace (https URL and mirrors; the token is kept in secrets and sent only
+     * Adds a custom marketplace (https URL and mirrors; the token is kept in secrets and sent only
      * to the URL's origin). A git URL (`…/*.git`, `owner/repo`, or any URL with `form: "git"`) is a
      * git marketplace with an optional `ref`; anything else is a marketplace.json URL.
      */
-    add(principal: Principal, body: z.infer<typeof AddBody>): Promise<MarketplaceView>;
+    add(principal: Principal, body: z.infer<typeof MarketplaceAddBody>): Promise<MarketplaceView>;
     /**
      * Browses entries (enabled marketplaces only, `sourceId` filters by marketplace; at most
      * `MARKETPLACE_ENTRIES_MAX`, `truncated` true means there are more). An entry that cannot be
      * imported has `importable: false` and a `reason`: `host_not_allowed` (its git / archive host is
      * outside `marketplaces.allowedHosts`) or `path_needs_git_marketplace` (a path entry of an http
-     * marketplace).
+     * marketplace). `icon`: an imported plugin's catalog icon (its current version's, the one the
+     * 已安装 list shows, also on an entry of a newer version), else the marketplace icon the last
+     * refresh stored, else null.
      */
-    entries(q: z.infer<typeof EntriesQuery>): Promise<{
+    entries(q: z.infer<typeof MarketplaceEntriesQuery>): Promise<{
         items: MarketplaceEntryView[];
         truncated: boolean;
     }>;
+    /**
+     * A marketplace entry icon the last refresh stored (`icon` of the entries), from PG with the
+     * plugin icon response headers (`sendCatalogIcon`: nosniff, CSP sandbox). Not stored -> 404
+     * `catalog.icon_not_found`.
+     */
+    icon(id: string, sha256: string, reply: FastifyReply): Promise<void>;
     /**
      * Updates a marketplace (official only takes `enabled`, anything else -> 409
      * `marketplace.builtin`; `token: null` clears the token).
      */
     update(principal: Principal, id: string, body: z.infer<typeof PatchBody>): Promise<MarketplaceView>;
     /**
-     * Deletes an enterprise marketplace (imported catalog items are kept); official -> 409
+     * Deletes a custom marketplace (imported catalog items are kept); official -> 409
      * `marketplace.builtin`.
      */
     remove(principal: Principal, id: string): Promise<void>;
@@ -94,4 +78,29 @@ export declare class MarketplacesController {
      */
     importEntry(principal: Principal, id: string, name: string, body: z.infer<typeof ImportBody>): Promise<MarketplaceImportResult>;
 }
-export {};
+/**
+ * Org admins browse the marketplaces read-only (`GET /api/v1/orgs/:orgId/marketplaces/entries`,
+ * `catalog.decide`; plugin scope spec §5.1 rule 3) to request an import. The deployment setting
+ * `orgMarketplaceBrowse` off -> 404 `not_found`. An entry imported as an item the org can neither
+ * see nor request (a hidden `named` item) reads as not imported (`adopted: null`). `icon`: the
+ * catalog item's org icon route when the org's catalog shows the item (the share gate,
+ * `PluginIcons`), else the marketplace icon on this controller's icon route, else null.
+ */
+export declare class OrgMarketplacesController {
+    private readonly marketplaces;
+    private readonly kdb;
+    private readonly icons;
+    constructor(marketplaces: MarketplacesService, kdb: KernelDb, icons: PluginIcons);
+    /** The org browse is off (`orgMarketplaceBrowse`) -> 404, like the entries. */
+    private assertBrowse;
+    /**
+     * A marketplace entry icon for the org browse (`catalog.decide`, the org admins), gated like the
+     * entries: browsing on, the marketplace enabled; served like plugin icons (`sendCatalogIcon`).
+     * Not stored -> 404 `catalog.icon_not_found`.
+     */
+    icon(id: string, sha256: string, reply: FastifyReply): Promise<void>;
+    entries(org: OrgContext, q: z.infer<typeof MarketplaceEntriesQuery>): Promise<{
+        items: MarketplaceEntryView[];
+        truncated: boolean;
+    }>;
+}

package/dist/catalog/marketplaces.controller.js

@@ -7,69 +7,51 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post } from "@nestjs/common";
-import { z } from "zod";
-import { MARKETPLACE_MAX_MIRRORS } from "../config/schema.js";
-import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
+import { Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post, Res } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { orgIconScope, PluginIcons } from "../extensions/plugin-icons.js";
+import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
+import { readOrgMarketplaceBrowse } from "../identity/settings.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZQuery } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
 import { CatalogService } from "./catalog.service.js";
+import { orgMarketplaceIconUrl } from "./marketplace-icons.js";
+import { MarketplaceImportBody as ImportBody, MarketplaceAddBody, MarketplaceEntriesQuery, MarketplacePatchBody as PatchBody, } from "./marketplaces.schemas.js";
 import { MarketplacesService, } from "./marketplaces.service.js";
-const Url = z.string().min(1).max(2000);
-const Form = z.enum(["http", "git"]);
-const Ref = z.string().min(1).max(256);
-const AddBody = z.object({
-    name: z.string().min(1).max(100),
-    url: Url,
-    form: Form.optional(),
-    ref: Ref.optional(),
-    mirrors: z.array(Url).max(MARKETPLACE_MAX_MIRRORS).optional(),
-    token: z.string().min(1).max(4096).optional(),
-});
-const PatchBody = z
-    .object({
-    name: z.string().min(1).max(100).optional(),
-    url: Url.optional(),
-    form: Form.optional(),
-    ref: Ref.nullable().optional(),
-    mirrors: z.array(Url).max(MARKETPLACE_MAX_MIRRORS).optional(),
-    enabled: z.boolean().optional(),
-    token: z.string().min(1).max(4096).nullable().optional(),
-})
-    .strict();
-const EntriesQuery = z.object({
-    sourceId: z.string().min(1).max(100).optional(),
-    q: z.string().max(200).optional(),
-});
-const ImportBody = z.object({ version: z.string().min(1).max(256).optional() });
+import { sendCatalogIcon } from "./org-catalog.controller.js";
+import { itemsSeenBy } from "./scope-state.js";
 /** 手动刷新的总时限（每个地址另有 30 秒超时）。 */
 const REFRESH_DEADLINE_MS = 300_000;
 const actorOpts = (actor) => {
     const tokenId = patTokenId(actor);
     return tokenId !== undefined ? { actorTokenId: tokenId } : {};
 };
-class MarketplaceAddBody extends createZodDto(AddBody, "MarketplaceAddBody") {
+class MarketplaceAddBodyDto extends createZodDto(MarketplaceAddBody, "MarketplaceAddBody") {
 }
-class MarketplaceEntriesQuery extends createZodDto(EntriesQuery, "MarketplaceEntriesQuery") {
+class MarketplaceEntriesQueryDto extends createZodDto(MarketplaceEntriesQuery, "MarketplaceEntriesQuery") {
 }
 class MarketplaceImportBody extends createZodDto(ImportBody, "MarketplaceImportBody") {
 }
 class MarketplacePatchBody extends createZodDto(PatchBody, "MarketplacePatchBody") {
 }
 /**
- * Marketplaces (`/api/v1/admin/marketplaces/*`, enterprise admins): create, update, delete and
- * refresh the official and enterprise marketplaces, browse entries, import from a marketplace.
- * Writes re-check the enterprise admin inside the service's lock and are audited.
+ * Marketplaces (`/api/v1/admin/marketplaces/*`, super admins): create, update, delete and
+ * refresh the official and custom marketplaces, browse entries, import from a marketplace.
+ * Writes re-check the super admin inside the service's lock and are audited.
  */
 let MarketplacesController = class MarketplacesController {
     marketplaces;
     catalog;
     config;
-    constructor(marketplaces, catalog, config) {
+    icons;
+    constructor(marketplaces, catalog, config, icons) {
         this.marketplaces = marketplaces;
         this.catalog = catalog;
         this.config = config;
+        this.icons = icons;
     }
     /** 全部来源；`offline` 为 true 表示 `marketplaces.official.enabled` 为 false（界面显示「离线模式」）。 */
     async list() {
@@ -79,7 +61,7 @@ let MarketplacesController = class MarketplacesController {
         };
     }
     /**
-     * Adds an enterprise marketplace (https URL and mirrors; the token is kept in secrets and sent only
+     * Adds a custom marketplace (https URL and mirrors; the token is kept in secrets and sent only
      * to the URL's origin). A git URL (`…/*.git`, `owner/repo`, or any URL with `form: "git"`) is a
      * git marketplace with an optional `ref`; anything else is a marketplace.json URL.
      */
@@ -99,13 +81,31 @@ let MarketplacesController = class MarketplacesController {
      * `MARKETPLACE_ENTRIES_MAX`, `truncated` true means there are more). An entry that cannot be
      * imported has `importable: false` and a `reason`: `host_not_allowed` (its git / archive host is
      * outside `marketplaces.allowedHosts`) or `path_needs_git_marketplace` (a path entry of an http
-     * marketplace).
+     * marketplace). `icon`: an imported plugin's catalog icon (its current version's, the one the
+     * 已安装 list shows, also on an entry of a newer version), else the marketplace icon the last
+     * refresh stored, else null.
      */
-    entries(q) {
-        return this.marketplaces.entries({
+    async entries(q) {
+        const r = await this.marketplaces.entries({
             ...(q.sourceId !== undefined && { marketplaceId: q.sourceId }),
             ...(q.q !== undefined && { q: q.q }),
         });
+        const installed = await this.icons.ofItems(r.items.flatMap((e) => (e.adopted ? [e.adopted.itemId] : [])), { kind: "admin" });
+        return {
+            ...r,
+            items: r.items.map((e) => {
+                const own = e.adopted ? installed.get(e.adopted.itemId) : undefined;
+                return own === undefined ? e : { ...e, icon: own };
+            }),
+        };
+    }
+    /**
+     * A marketplace entry icon the last refresh stored (`icon` of the entries), from PG with the
+     * plugin icon response headers (`sendCatalogIcon`: nosniff, CSP sandbox). Not stored -> 404
+     * `catalog.icon_not_found`.
+     */
+    async icon(id, sha256, reply) {
+        await sendCatalogIcon(reply, await this.marketplaces.icon(id, sha256));
     }
     /**
      * Updates a marketplace (official only takes `enabled`, anything else -> 409
@@ -124,7 +124,7 @@ let MarketplacesController = class MarketplacesController {
         }, actorOpts(actor));
     }
     /**
-     * Deletes an enterprise marketplace (imported catalog items are kept); official -> 409
+     * Deletes a custom marketplace (imported catalog items are kept); official -> 409
      * `marketplace.builtin`.
      */
     async remove(principal, id) {
@@ -166,12 +166,18 @@ __decorate([
     Post(),
     HttpCode(201),
     __param(0, CurrentPrincipal()),
-    __param(1, ZBody(MarketplaceAddBody))
+    __param(1, ZBody(MarketplaceAddBodyDto))
 ], MarketplacesController.prototype, "add", null);
 __decorate([
     Get("entries"),
-    __param(0, ZQuery(MarketplaceEntriesQuery))
+    __param(0, ZQuery(MarketplaceEntriesQueryDto))
 ], MarketplacesController.prototype, "entries", null);
+__decorate([
+    Get(":id/icons/:sha256"),
+    __param(0, Param("id")),
+    __param(1, Param("sha256")),
+    __param(2, Res())
+], MarketplacesController.prototype, "icon", null);
 __decorate([
     Patch(":id"),
     __param(0, CurrentPrincipal()),
@@ -200,9 +206,87 @@ __decorate([
 ], MarketplacesController.prototype, "importEntry", null);
 MarketplacesController = __decorate([
     Controller("api/v1/admin/marketplaces"),
-    EnterpriseAdmin(),
+    SuperAdmin(),
     __param(0, Inject(MarketplacesService)),
     __param(1, Inject(CatalogService)),
-    __param(2, Inject(KernelConfigService))
+    __param(2, Inject(KernelConfigService)),
+    __param(3, Inject(PluginIcons))
 ], MarketplacesController);
 export { MarketplacesController };
+/**
+ * Org admins browse the marketplaces read-only (`GET /api/v1/orgs/:orgId/marketplaces/entries`,
+ * `catalog.decide`; plugin scope spec §5.1 rule 3) to request an import. The deployment setting
+ * `orgMarketplaceBrowse` off -> 404 `not_found`. An entry imported as an item the org can neither
+ * see nor request (a hidden `named` item) reads as not imported (`adopted: null`). `icon`: the
+ * catalog item's org icon route when the org's catalog shows the item (the share gate,
+ * `PluginIcons`), else the marketplace icon on this controller's icon route, else null.
+ */
+let OrgMarketplacesController = class OrgMarketplacesController {
+    marketplaces;
+    kdb;
+    icons;
+    constructor(marketplaces, kdb, icons) {
+        this.marketplaces = marketplaces;
+        this.kdb = kdb;
+        this.icons = icons;
+    }
+    /** The org browse is off (`orgMarketplaceBrowse`) -> 404, like the entries. */
+    async assertBrowse() {
+        if (!(await readOrgMarketplaceBrowse(this.kdb.db))) {
+            throw new ApiError("not_found", "Marketplace browsing is off for organizations");
+        }
+    }
+    /**
+     * A marketplace entry icon for the org browse (`catalog.decide`, the org admins), gated like the
+     * entries: browsing on, the marketplace enabled; served like plugin icons (`sendCatalogIcon`).
+     * Not stored -> 404 `catalog.icon_not_found`.
+     */
+    async icon(id, sha256, reply) {
+        await this.assertBrowse();
+        await sendCatalogIcon(reply, await this.marketplaces.icon(id, sha256, { browsable: true }));
+    }
+    async entries(org, q) {
+        await this.assertBrowse();
+        const r = await this.marketplaces.entries({
+            ...(q.sourceId !== undefined && { marketplaceId: q.sourceId }),
+            ...(q.q !== undefined && { q: q.q }),
+        }, orgMarketplaceIconUrl(org.orgId));
+        // A hidden `named` item the org is not listed on stays unknown to it: the entry reads as not
+        // imported (and shows the marketplace icon, never the item's)
+        const adoptedIds = r.items.flatMap((e) => (e.adopted ? [e.adopted.itemId] : []));
+        const seen = await itemsSeenBy(this.kdb.db, org.orgId, adoptedIds);
+        const own = await this.icons.ofItems(adoptedIds.filter((id) => seen.has(id)), orgIconScope(org));
+        return {
+            ...r,
+            items: r.items.map((e) => {
+                if (e.adopted === null)
+                    return e;
+                if (!seen.has(e.adopted.itemId)) {
+                    return { ...e, adopted: null, newerAvailable: false, contentChanged: false };
+                }
+                const icon = own.get(e.adopted.itemId);
+                return icon === undefined ? e : { ...e, icon };
+            }),
+        };
+    }
+};
+__decorate([
+    Get(":id/icons/:sha256"),
+    OrgAction("catalog.decide"),
+    __param(0, Param("id")),
+    __param(1, Param("sha256")),
+    __param(2, Res())
+], OrgMarketplacesController.prototype, "icon", null);
+__decorate([
+    Get("entries"),
+    OrgAction("catalog.decide"),
+    __param(0, CurrentOrg()),
+    __param(1, ZQuery(MarketplaceEntriesQueryDto))
+], OrgMarketplacesController.prototype, "entries", null);
+OrgMarketplacesController = __decorate([
+    Controller("api/v1/orgs/:orgId/marketplaces"),
+    __param(0, Inject(MarketplacesService)),
+    __param(1, Inject(KernelDb)),
+    __param(2, Inject(PluginIcons))
+], OrgMarketplacesController);
+export { OrgMarketplacesController };

package/dist/catalog/marketplaces.schemas.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+export declare const MarketplaceUrl: z.ZodString;
+export declare const MarketplaceForm: z.ZodEnum<{
+    git: "git";
+    http: "http";
+}>;
+export declare const MarketplaceRef: z.ZodString;
+export declare const MarketplaceAddBody: z.ZodObject<{
+    name: z.ZodString;
+    url: z.ZodString;
+    form: z.ZodOptional<z.ZodEnum<{
+        git: "git";
+        http: "http";
+    }>>;
+    ref: z.ZodOptional<z.ZodString>;
+    mirrors: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const MarketplaceEntriesQuery: z.ZodObject<{
+    sourceId: z.ZodOptional<z.ZodString>;
+    q: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const MarketplacePatchBody: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
+    form: z.ZodOptional<z.ZodEnum<{
+        git: "git";
+        http: "http";
+    }>>;
+    ref: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    mirrors: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    token: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strict>;
+export declare const MarketplaceImportBody: z.ZodObject<{
+    version: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** `:id` of a marketplace as the routes take it (`@Param`). */
+export declare const MarketplaceIdPathParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+/** `:id` and the entry `:name` of the import route (`@Param`). */
+export declare const MarketplaceEntryPathParams: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+export declare const MARKETPLACE_ROUTES: readonly RouteSchemas[];