@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.20

package/dist/extensions/admin-ops.d.ts

@@ -1,28 +1,55 @@
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { ApiError } from "../errors.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { ExtensionAdmin, type PublishBus } from "./admin-view.js";
 import { ExtensionBlobs } from "./blobs.js";
 import { ExtensionLifecycle } from "./lifecycle.js";
 import { PluginInstallLock } from "./locks.js";
 import type { AdminExtensionView } from "./permission-view.js";
 import { ExtensionRegistry } from "./registry.js";
+import { SingleProviderGuard, type SingleProviderNote } from "./single-provider.js";
 /**
  * Deployment-level extension install / enable / disable / uninstall (C16 / D15): writes only the PG
  * desired state (`extension_installs`) and the audit, then publishes `kernel.plugins.changed` after
  * the commit (a failure only warns; the periodic reconcile catches up); replicas converge through
  * reconcile, no restart. It does not wait for replicas: the returned view may say `converging`.
  * Stateless, shared by every replica; the CLI uses it too (`actor` is null).
- * Every write runs in a transaction: first `lockEnterpriseAdminsAndAuthorize` (skipped by the CLI),
+ * Every write runs in a transaction: first `lockSuperAdminsAndAuthorize` (skipped by the CLI),
  * then an advisory lock by extension name and a lock on the install record row.
  */
+/**
+ * An operation an org admin runs as the owner of an org plugin (an owner update removing or putting
+ * back its extension, ruling P3-12'): the actor is re-checked as an admin of `orgId`
+ * (`catalog.upload`, under the org row lock) instead of as a super admin, and the audit records
+ * the actor with `ownerOrgId`.
+ */
+export interface ExtensionOpsOwner {
+    orgId: string;
+    /**
+     * Putting the extension back after a failed owner update: the actor was authorized when the
+     * update started, so no role is checked again (a demotion meanwhile must not leave the
+     * deployment without the extension it had); the audit keeps the actor, marked `rollback`.
+     */
+    rollback?: true;
+}
+/**
+ * The admin view after an install; `leftDisabled`: this version change left the enabled extension
+ * disabled because its new version provides a single-provider point another extension holds.
+ */
+export type InstallView = AdminExtensionView & {
+    leftDisabled?: SingleProviderNote;
+};
 export declare class ExtensionAdminOps {
     private readonly kdb;
     readonly txHost: TransactionHost;
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
     private readonly adminLock;
+    /** The owner org's lock: an owner's operation re-checks its admin under it. */
+    private readonly orgLock;
     private readonly installLock;
     /**
      * The admin view after the operation, degraded when the package cannot be read
@@ -44,9 +71,13 @@ export declare class ExtensionAdminOps {
      */
     private readonly lifecycle;
     private readonly log;
+    /** One enabled provider per single-provider extension point (checked in the enable). */
+    private readonly singleProvider;
     constructor(kdb: KernelDb, txHost: TransactionHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
-    adminLock: EnterpriseAdminLock, installLock: PluginInstallLock, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock: SuperAdminLock, 
+    /** The owner org's lock: an owner's operation re-checks its admin under it. */
+    orgLock: OrgLock, installLock: PluginInstallLock, 
     /**
      * The admin view after the operation, degraded when the package cannot be read
      * (`get(name, { allowUnreadable: true })`). If it throws, the operation has already committed:
@@ -64,13 +95,15 @@ export declare class ExtensionAdminOps {
      * When the publish fails this replica reconciles itself (not awaited; other replicas catch up
      * periodically). A no-op where the lifecycle never started (the CLI).
      */
-    lifecycle: ExtensionLifecycle, log: KernelLogger);
+    lifecycle: ExtensionLifecycle, log: KernelLogger, 
+    /** One enabled provider per single-provider extension point (checked in the enable). */
+    singleProvider: SingleProviderGuard);
     private get db();
     /**
      * New install or version change (upgrade / downgrade): the install record points at package
      * `sha256`; the desired state is unchanged (a new install is disabled). Audit `extension.installed`.
      * - Config-declared -> `extension.config_declared`; a required bootstrap plugin may be
-     *   installed at another version (an enterprise admin upgrades it; `required` is kept);
+     *   installed at another version (a super admin upgrades it; `required` is kept);
      * - package not in the package store -> `extension.package_not_found`; the extension name in the
      *   package is not `name` -> `extension.name_mismatch`;
      * - an install record of the same name exists but comes from another npm package ->
@@ -86,27 +119,56 @@ export declare class ExtensionAdminOps {
      *   go back to a version whose migrations are a subset of those already run).
      * Already pointing at the same package: nothing changes (no audit; for a changed source item only,
      * see below).
-     * `opts.catalogItemId`: the source item when installing through the enterprise catalog, stored
+     * `opts.catalogItemId`: the source item when installing through the platform catalog, stored
      * in `extension_installs.catalog_item_id` (F-AA) and registered in `extension_catalog_sources`;
      * installing outside the catalog (upload / npm / CLI) **keeps** the existing source items (T26
      * fix: clearing them would let org enablement bypass catalog policy, C22). The detail of the
      * `extension.installed` audit carries `catalogItemId`; when it already points at the same package
      * and only the source item changed, only that column changes, audit
-     * `extension.install_source_changed`.
+     * `extension.install_source_changed`. With `opts.liveItem` (an org upload's confirmation) a
+     * source item gone or removed when its row lock is granted -> 409 `catalog.item_removed`, before
+     * anything is written.
+     * A version change of an enabled extension whose new version provides a single-provider
+     * extension point the old one did not, while another extension holds it: the new version is
+     * installed **disabled** (`enabled_at` cleared, audit `extension.disabled` with `singleProvider`)
+     * rather than the upgrade refused, so the package moves and the provider running keeps the point;
+     * the result's `leftDisabled` says why (the shape of `enableUnlessOccupied`'s refusal). Checked
+     * under the point's lock after the install lock (the enable's order).
      */
     install(name: string, sha256: string, actor: string | null, actorTokenId?: string, opts?: {
         catalogItemId?: string;
-    }): Promise<AdminExtensionView>;
+        liveItem?: true;
+        owner?: ExtensionOpsOwner;
+    }): Promise<InstallView>;
     private writeInstall;
-    /** Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org enablement is unchanged. */
-    enable(name: string, actor: string | null, actorTokenId?: string): Promise<AdminExtensionView>;
+    /**
+     * Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org
+     * enablement is unchanged. Another enabled extension providing one of its single-provider
+     * extension points -> 409 `extension.single_provider_enabled` (the super admin disables that one
+     * first; checked under the point's lock, see {@link SingleProviderGuard}).
+     */
+    enable(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner, 
+    /** Merged into the audit detail (a write made through the Platform tool). */
+    auditDetail?: Record<string, unknown>): Promise<AdminExtensionView>;
+    /**
+     * The enable of an install or import path: like {@link enable}, but an occupied single-provider
+     * extension point leaves the extension disabled instead of failing, and returns the refusal
+     * (`enabled: false`) for the caller to report. Every other error is thrown.
+     */
+    enableUnlessOccupied(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner): Promise<{
+        enabled: true;
+    } | {
+        enabled: false;
+        refusal: ApiError;
+        note: SingleProviderNote;
+    }>;
     /**
      * Disables on the deployment (audit `extension.disabled`); no change when already disabled. Every
      * replica unloads it (draining in-flight calls), and the extensions that `requires` it unload with
      * it; the org enablement switch is unchanged and the org page shows it as unavailable. A required
      * bootstrap plugin -> `extension.required`.
      */
-    disable(name: string, actor: string | null, actorTokenId?: string): Promise<AdminExtensionView>;
+    disable(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner, auditDetail?: Record<string, unknown>): Promise<AdminExtensionView>;
     /**
      * Uninstall: a required bootstrap plugin -> `extension.required`; must be disabled first
      * (otherwise `extension.not_disabled`); deletes the install record
@@ -115,7 +177,7 @@ export declare class ExtensionAdminOps {
      * permission snapshot and the package in the package store are untouched (a reinstall picks them
      * up).
      */
-    uninstall(name: string, actor: string | null, actorTokenId?: string): Promise<void>;
+    uninstall(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner, auditDetail?: Record<string, unknown>): Promise<void>;
     private writeUninstall;
     private setState;
     private writeState;
@@ -123,6 +185,11 @@ export declare class ExtensionAdminOps {
      * 提交后的视图：拼视图失败（读包、查状态行出错）时操作已经生效，不能再报失败——记 error，返回降级视图。
      */
     private viewAfterCommit;
+    /**
+     * Re-checks the actor in the operation's transaction: a super admin, or for an owner's operation
+     * an admin of the owner org; no account (the CLI, the kernel itself) is not checked.
+     */
+    private authorize;
     /** 配置声明的插件不经安装记录管理。 */
     private assertInstallable;
     /** 按插件名串行（`PluginInstallLock`，覆盖「还没有行」的新装），再锁住已有的安装记录行。 */

package/dist/extensions/admin-ops.js

@@ -14,13 +14,14 @@ import semver from "semver";
 import { pluginSchemaName } from "../ctx/create-ctx.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { ExtensionAdmin } from "./admin-view.js";
 import { ExtensionBlobs } from "./blobs.js";
 import { ExtensionLifecycle, PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
@@ -28,19 +29,12 @@ import { PluginInstallLock } from "./locks.js";
 import { unrunMigrations } from "./migrate-lock.js";
 import { ExtensionPackageError, extensionPackageApiError, readExtensionPackage, } from "./package.js";
 import { ExtensionRegistry } from "./registry.js";
-/**
- * Deployment-level extension install / enable / disable / uninstall (C16 / D15): writes only the PG
- * desired state (`extension_installs`) and the audit, then publishes `kernel.plugins.changed` after
- * the commit (a failure only warns; the periodic reconcile catches up); replicas converge through
- * reconcile, no restart. It does not wait for replicas: the returned view may say `converging`.
- * Stateless, shared by every replica; the CLI uses it too (`actor` is null).
- * Every write runs in a transaction: first `lockEnterpriseAdminsAndAuthorize` (skipped by the CLI),
- * then an advisory lock by extension name and a lock on the install record row.
- */
+import { isSingleProviderCode, SingleProviderGuard, singleProviderNote, } from "./single-provider.js";
 let ExtensionAdminOps = class ExtensionAdminOps {
     kdb;
     txHost;
     adminLock;
+    orgLock;
     installLock;
     admin;
     registry;
@@ -49,9 +43,12 @@ let ExtensionAdminOps = class ExtensionAdminOps {
     bus;
     lifecycle;
     log;
+    singleProvider;
     constructor(kdb, txHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
-    adminLock, installLock, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock, 
+    /** The owner org's lock: an owner's operation re-checks its admin under it. */
+    orgLock, installLock, 
     /**
      * The admin view after the operation, degraded when the package cannot be read
      * (`get(name, { allowUnreadable: true })`). If it throws, the operation has already committed:
@@ -69,10 +66,13 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * When the publish fails this replica reconciles itself (not awaited; other replicas catch up
      * periodically). A no-op where the lifecycle never started (the CLI).
      */
-    lifecycle, log) {
+    lifecycle, log, 
+    /** One enabled provider per single-provider extension point (checked in the enable). */
+    singleProvider) {
         this.kdb = kdb;
         this.txHost = txHost;
         this.adminLock = adminLock;
+        this.orgLock = orgLock;
         this.installLock = installLock;
         this.admin = admin;
         this.registry = registry;
@@ -81,6 +81,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         this.bus = bus;
         this.lifecycle = lifecycle;
         this.log = log;
+        this.singleProvider = singleProvider;
     }
     get db() {
         return this.kdb.db;
@@ -89,7 +90,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * New install or version change (upgrade / downgrade): the install record points at package
      * `sha256`; the desired state is unchanged (a new install is disabled). Audit `extension.installed`.
      * - Config-declared -> `extension.config_declared`; a required bootstrap plugin may be
-     *   installed at another version (an enterprise admin upgrades it; `required` is kept);
+     *   installed at another version (a super admin upgrades it; `required` is kept);
      * - package not in the package store -> `extension.package_not_found`; the extension name in the
      *   package is not `name` -> `extension.name_mismatch`;
      * - an install record of the same name exists but comes from another npm package ->
@@ -105,19 +106,27 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      *   go back to a version whose migrations are a subset of those already run).
      * Already pointing at the same package: nothing changes (no audit; for a changed source item only,
      * see below).
-     * `opts.catalogItemId`: the source item when installing through the enterprise catalog, stored
+     * `opts.catalogItemId`: the source item when installing through the platform catalog, stored
      * in `extension_installs.catalog_item_id` (F-AA) and registered in `extension_catalog_sources`;
      * installing outside the catalog (upload / npm / CLI) **keeps** the existing source items (T26
      * fix: clearing them would let org enablement bypass catalog policy, C22). The detail of the
      * `extension.installed` audit carries `catalogItemId`; when it already points at the same package
      * and only the source item changed, only that column changes, audit
-     * `extension.install_source_changed`.
+     * `extension.install_source_changed`. With `opts.liveItem` (an org upload's confirmation) a
+     * source item gone or removed when its row lock is granted -> 409 `catalog.item_removed`, before
+     * anything is written.
+     * A version change of an enabled extension whose new version provides a single-provider
+     * extension point the old one did not, while another extension holds it: the new version is
+     * installed **disabled** (`enabled_at` cleared, audit `extension.disabled` with `singleProvider`)
+     * rather than the upgrade refused, so the package moves and the provider running keeps the point;
+     * the result's `leftDisabled` says why (the shape of `enableUnlessOccupied`'s refusal). Checked
+     * under the point's lock after the install lock (the enable's order).
      */
     async install(name, sha256, actor, actorTokenId, opts = {}) {
         this.assertInstallable(name);
         const pkg = await this.db
             .selectFrom("extension_packages")
-            .select(["sha256", "name", "package_name", "version", "source"])
+            .select(["sha256", "name", "package_name", "version", "source", "section"])
             .where("sha256", "=", sha256)
             .executeTakeFirst();
         if (!pkg) {
@@ -136,12 +145,39 @@ let ExtensionAdminOps = class ExtensionAdminOps {
             throw e instanceof ExtensionPackageError ? extensionPackageApiError(e) : e;
         });
         const changed = await this.writeInstall(name, sha256, pkg, target, actor, actorTokenId, opts);
-        return this.viewAfterCommit(name, { version: pkg.version, sha256, state: changed.state });
+        const view = await this.viewAfterCommit(name, {
+            version: pkg.version,
+            sha256,
+            state: changed.state,
+        });
+        if (changed.leftDisabled === undefined)
+            return view;
+        this.log.info("extension upgraded but left disabled: its single-provider extension point is taken", {
+            plugin: name,
+            details: changed.leftDisabled.singleProvider,
+        });
+        return { ...view, leftDisabled: changed.leftDisabled };
     }
     async writeInstall(name, sha256, pkg, target, actor, actorTokenId, opts) {
         const db = this.db;
-        if (actor !== null)
-            await this.adminLock.lockAndAuthorize(actor);
+        await this.authorize(actor, opts.owner);
+        // The source item's row before the install lock (the global lock order: the item, then the
+        // install lock; ruling P3-50): the catalog source and install rows written below check it by
+        // foreign key (FOR KEY SHARE), and an org deletion or an item removal holds it FOR UPDATE
+        // while it waits for the install lock (CatalogService.removeIn). Taken after the install lock
+        // instead, the two deadlock (40P01).
+        if (opts.catalogItemId !== undefined) {
+            const item = await db
+                .selectFrom("catalog_items")
+                .select("deleted_at")
+                .where("id", "=", opts.catalogItemId)
+                .forKeyShare()
+                .executeTakeFirst();
+            // The lock waits out a removal holding the row; the row read then is the removed one
+            if (opts.liveItem && (item === undefined || item.deleted_at !== null)) {
+                throw new ApiError("catalog.item_removed", `${name} was removed while its confirmation was running; nothing of it stays installed`);
+            }
+        }
         const row = await this.lockRow(name);
         // 不经目录重装时保留原来的来源条目（不清空，C22）
         const catalogItemId = opts.catalogItemId ?? row?.catalog_item_id ?? null;
@@ -198,6 +234,26 @@ let ExtensionAdminOps = class ExtensionAdminOps {
                 throw new ApiError("extension.downgrade_unsupported", `Extension ${name} ${pkg.version} has migrations that were never run here (${unrun.join(", ")}); extension migrations only expand, so downgrade only to a version whose migrations have all been applied`, unrun.map((file) => ({ file })));
             }
         }
+        // An enabled extension whose new version newly provides a single-provider point another one
+        // holds: installed disabled (the provider running keeps the point), and the result says why
+        let leftDisabled;
+        if (row?.desired_state === "enabled") {
+            const before = new Set(providesOf(row.section));
+            const added = providesOf(pkg.section).filter((p) => !before.has(p));
+            const block = await this.singleProvider.lockedOccupant(name, added);
+            if (block) {
+                leftDisabled = await this.singleProvider.note(block, name);
+                await db
+                    .updateTable("extension_installs")
+                    .set({ desired_state: "disabled", enabled_at: null })
+                    .where("name", "=", name)
+                    .execute();
+                await this.audit(actor, actorTokenId, "extension.disabled", name, row.version, row.sha256, {
+                    singleProvider: block,
+                    ...ownerDetail(opts.owner),
+                });
+            }
+        }
         await db
             .insertInto("extension_installs")
             .values({
@@ -221,13 +277,44 @@ let ExtensionAdminOps = class ExtensionAdminOps {
             .execute();
         await this.audit(actor, actorTokenId, "extension.installed", name, pkg.version, sha256, {
             catalogItemId,
+            ...ownerDetail(opts.owner),
         });
         afterCommit(() => this.notify(name));
+        if (leftDisabled !== undefined)
+            return { changed: true, state: "disabled", leftDisabled };
         return { changed: true, state: row?.desired_state ?? "disabled" };
     }
-    /** Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org enablement is unchanged. */
-    enable(name, actor, actorTokenId) {
-        return this.setState(name, "enabled", actor, actorTokenId);
+    /**
+     * Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org
+     * enablement is unchanged. Another enabled extension providing one of its single-provider
+     * extension points -> 409 `extension.single_provider_enabled` (the super admin disables that one
+     * first; checked under the point's lock, see {@link SingleProviderGuard}).
+     */
+    enable(name, actor, actorTokenId, owner, 
+    /** Merged into the audit detail (a write made through the Platform tool). */
+    auditDetail) {
+        return this.setState(name, "enabled", actor, actorTokenId, owner, auditDetail);
+    }
+    /**
+     * The enable of an install or import path: like {@link enable}, but an occupied single-provider
+     * extension point leaves the extension disabled instead of failing, and returns the refusal
+     * (`enabled: false`) for the caller to report. Every other error is thrown.
+     */
+    async enableUnlessOccupied(name, actor, actorTokenId, owner) {
+        try {
+            await this.enable(name, actor, actorTokenId, owner);
+            return { enabled: true };
+        }
+        catch (e) {
+            if (e instanceof ApiError && isSingleProviderCode(e.code)) {
+                this.log.info("extension installed disabled: its single-provider extension point is taken", {
+                    plugin: name,
+                    details: e.details,
+                });
+                return { enabled: false, refusal: e, note: singleProviderNote(e) };
+            }
+            throw e;
+        }
     }
     /**
      * Disables on the deployment (audit `extension.disabled`); no change when already disabled. Every
@@ -235,8 +322,8 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * it; the org enablement switch is unchanged and the org page shows it as unavailable. A required
      * bootstrap plugin -> `extension.required`.
      */
-    disable(name, actor, actorTokenId) {
-        return this.setState(name, "disabled", actor, actorTokenId);
+    disable(name, actor, actorTokenId, owner, auditDetail) {
+        return this.setState(name, "disabled", actor, actorTokenId, owner, auditDetail);
     }
     /**
      * Uninstall: a required bootstrap plugin -> `extension.required`; must be disabled first
@@ -246,14 +333,13 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * permission snapshot and the package in the package store are untouched (a reinstall picks them
      * up).
      */
-    async uninstall(name, actor, actorTokenId) {
+    async uninstall(name, actor, actorTokenId, owner, auditDetail) {
         this.assertInstallable(name);
-        await this.writeUninstall(name, actor, actorTokenId);
+        await this.writeUninstall(name, actor, actorTokenId, owner, auditDetail);
     }
-    async writeUninstall(name, actor, actorTokenId) {
+    async writeUninstall(name, actor, actorTokenId, owner, auditDetail) {
         const db = this.db;
-        if (actor !== null)
-            await this.adminLock.lockAndAuthorize(actor);
+        await this.authorize(actor, owner);
         const row = await this.lockRow(name);
         if (!row)
             throw notFound(name);
@@ -265,22 +351,24 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         await db.deleteFrom("extension_installs").where("name", "=", name).execute();
         // 来源条目随安装记录一起删：之后不经目录重新安装时不再受旧条目的策略约束（T26 裁决）
         await db.deleteFrom("extension_catalog_sources").where("plugin", "=", name).execute();
-        await this.audit(actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256);
+        await this.audit(actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256, {
+            ...ownerDetail(owner),
+            ...auditDetail,
+        });
         afterCommit(() => this.notify(name));
     }
-    async setState(name, state, actor, actorTokenId) {
+    async setState(name, state, actor, actorTokenId, owner, auditDetail) {
         this.assertInstallable(name);
-        const result = await this.writeState(name, state, actor, actorTokenId);
+        const result = await this.writeState(name, state, actor, actorTokenId, owner, auditDetail);
         return this.viewAfterCommit(name, {
             version: result.row.version,
             sha256: result.row.sha256,
             state,
         });
     }
-    async writeState(name, state, actor, actorTokenId) {
+    async writeState(name, state, actor, actorTokenId, owner, auditDetail) {
         const db = this.db;
-        if (actor !== null)
-            await this.adminLock.lockAndAuthorize(actor);
+        await this.authorize(actor, owner);
         const row = await this.lockRow(name);
         if (!row)
             throw notFound(name);
@@ -288,16 +376,22 @@ let ExtensionAdminOps = class ExtensionAdminOps {
             throw required(name);
         if (row.desired_state === state)
             return { row, changed: false };
+        if (state === "enabled") {
+            await this.singleProvider.assertFree(name, providesOf(row.section));
+        }
         await db
             .updateTable("extension_installs")
             .set({
             desired_state: state,
+            // When it became enabled: the earliest enabled of two providers of a single-provider point
+            // is the one replicas load (only state left from before a second enable was refused)
+            enabled_at: state === "enabled" ? sql `now()` : null,
             updated_by: actor,
             updated_at: sql `now()`,
         })
             .where("name", "=", name)
             .execute();
-        await this.audit(actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256);
+        await this.audit(actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256, { ...ownerDetail(owner), ...auditDetail });
         afterCommit(() => this.notify(name));
         return { row, changed: true };
     }
@@ -316,6 +410,22 @@ let ExtensionAdminOps = class ExtensionAdminOps {
             return fallbackView(name, known, err);
         }
     }
+    /**
+     * Re-checks the actor in the operation's transaction: a super admin, or for an owner's operation
+     * an admin of the owner org; no account (the CLI, the kernel itself) is not checked.
+     */
+    async authorize(actor, owner) {
+        if (owner?.rollback === true)
+            return;
+        if (owner !== undefined) {
+            if (actor === null)
+                throw new Error("an owner's extension operation has an actor");
+            await this.orgLock.lockAndAuthorize(owner.orgId, actor, "catalog.upload");
+        }
+        else if (actor !== null) {
+            await this.adminLock.lockAndAuthorize(actor);
+        }
+    }
     /** 配置声明的插件不经安装记录管理。 */
     assertInstallable(name) {
         const declared = this.registry.declared().get(name);
@@ -336,6 +446,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
             "extension_installs.catalog_item_id",
             "extension_installs.required",
             "extension_packages.package_name",
+            "extension_packages.section",
         ])
             .where("extension_installs.name", "=", name)
             .forUpdate("extension_installs")
@@ -372,6 +483,9 @@ __decorate([
 __decorate([
     Transactional()
 ], ExtensionAdminOps.prototype, "writeState", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ExtensionAdminOps.prototype, "authorize", null);
 __decorate([
     Transactional({ propagation: "mandatory" })
 ], ExtensionAdminOps.prototype, "lockRow", null);
@@ -379,15 +493,17 @@ ExtensionAdminOps = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
-    __param(2, Inject(EnterpriseAdminLock)),
-    __param(3, Inject(PluginInstallLock)),
-    __param(4, Inject(ExtensionAdmin)),
-    __param(5, Inject(ExtensionRegistry)),
-    __param(6, Inject(ExtensionBlobs)),
-    __param(7, Inject(KernelConfigService)),
-    __param(8, Inject(KERNEL_BUS)),
-    __param(9, Inject(ExtensionLifecycle)),
-    __param(10, Inject(KERNEL_LOGGER))
+    __param(2, Inject(SuperAdminLock)),
+    __param(3, Inject(OrgLock)),
+    __param(4, Inject(PluginInstallLock)),
+    __param(5, Inject(ExtensionAdmin)),
+    __param(6, Inject(ExtensionRegistry)),
+    __param(7, Inject(ExtensionBlobs)),
+    __param(8, Inject(KernelConfigService)),
+    __param(9, Inject(KERNEL_BUS)),
+    __param(10, Inject(ExtensionLifecycle)),
+    __param(11, Inject(KERNEL_LOGGER)),
+    __param(12, Inject(SingleProviderGuard))
 ], ExtensionAdminOps);
 export { ExtensionAdminOps };
 /**
@@ -396,6 +512,8 @@ export { ExtensionAdminOps };
 function fallbackView(name, known, err) {
     return {
         name,
+        // the degraded item reads nothing more (the read that failed may be the database)
+        displayName: null,
         version: known.version,
         source: "install",
         sha256: known.sha256,
@@ -416,7 +534,13 @@ function fallbackView(name, known, err) {
         configValid: true,
         removable: true,
         required: false,
+        scope: null,
+        enabledOrgs: 0,
+        builtin: false,
         installSource: null,
+        uiDropped: [],
+        client: null,
+        clientReports: [],
         error: `the change was saved, but its current status cannot be read: ${err instanceof Error ? err.message : String(err)}`,
     };
 }
@@ -441,7 +565,17 @@ async function hasRetainedData(db, name) {
         .executeTakeFirst();
     return hit !== undefined;
 }
-const required = (name) => new ApiError("extension.required", `Extension ${name} is required by this deployment (a bootstrap plugin): it is enabled in every organization and cannot be disabled or uninstalled; an enterprise admin can upgrade it`);
+const required = (name) => new ApiError("extension.required", `Extension ${name} is required by this deployment (a bootstrap plugin): it is enabled in every organization and cannot be disabled or uninstalled; a super admin can upgrade it`);
 const notFound = (name) => new ApiError("extension.not_found", `Extension ${name} is not installed in this deployment`);
 /** `to` 比 `from` 旧（任一方不是合法 semver 时不算降级）。 */
 const isDowngrade = (to, from) => semver.valid(to) !== null && semver.valid(from) !== null && semver.lt(to, from);
+/** The extension points a stored package's reviewed manifest provides. */
+function providesOf(section) {
+    return section?.manifest?.provides ?? [];
+}
+/** The audit detail of an owner's operation. */
+function ownerDetail(owner) {
+    if (owner === undefined)
+        return {};
+    return { ownerOrgId: owner.orgId, ...(owner.rollback === true && { rollback: true }) };
+}