@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.21

package/dist/catalog/component-state.js

@@ -0,0 +1,484 @@
+import { visibleTo, wantedOn } from "./scope.js";
+/** The kinds the scope, switch, ownership and preview flows (and the component routes) walk. */
+export const COMPONENT_KINDS = [
+    "skill",
+    "agent_template",
+    "connector_template",
+    "theme",
+];
+/** The component or its plugin stops it everywhere: disabled, or the plugin disabled or deleted. */
+function stopped(c, p) {
+    if (c.disabled)
+        return true;
+    if (c.itemId === null)
+        return false;
+    return p === null || !p.live || p.disabled;
+}
+/**
+ * Whether the component is on in the org (`listed`: the org on the component's own `named` list;
+ * `sw`: the org's component switch):
+ * - never when the component or its plugin is disabled, or its plugin is deleted;
+ * - `follow`: its plugin is on in the org (a live install, or builtin) and the switch is not off
+ *   (a `defaultOff` template of a plugin that is not builtin: the switch is on);
+ * - `own`: `wantedOn` over the component's own scope, the list and the switch.
+ */
+export function componentOn(c, p, listed, sw) {
+    if (stopped(c, p))
+        return false;
+    if (c.scopeMode === "follow") {
+        const defaultOff = c.defaultOff === true && p?.builtin !== true;
+        return componentPluginOn(c, p) && (defaultOff ? sw === true : sw !== false);
+    }
+    return wantedOn({ scope: c.scope, disabled: false, builtin: false }, listed, sw);
+}
+/**
+ * Whether the plugin a component follows is on in the org (a live install there, or builtin); a
+ * component with its own scope does not depend on it (true). A `follow` component comes on and off
+ * with its plugin (spec §5 rule 5), so its own switch only matters while this holds.
+ */
+export function componentPluginOn(c, p) {
+    if (c.scopeMode === "own")
+        return true;
+    return p !== null && p.live && (p.installed || p.builtin);
+}
+/**
+ * Whether the component is offered to the org: on, or an org admin could turn it on there (spec
+ * §5 rule 10 refuses an org skill named like one). Not when it or its plugin is stopped; `follow`:
+ * its plugin is visible to the org (builtin, `all`, `optional`, or `named` listing the org); `own`:
+ * its own scope is visible to the org.
+ */
+export function componentOffered(c, p, listed) {
+    if (stopped(c, p))
+        return false;
+    if (c.scopeMode === "follow") {
+        return p !== null && (p.builtin || visibleTo({ scope: p.scope }, p.listed));
+    }
+    return visibleTo({ scope: c.scope }, listed);
+}
+/**
+ * Whether the component belongs to a builtin plugin: an org admin cannot switch it off
+ * (`plugin.scope_locked`, spec §13.5 as amended by the layering spec §4; an effective scope of
+ * `all`, its own or its plugin's, is switchable like a listed `named` one).
+ */
+export function componentLocked(_c, p) {
+    return p?.builtin === true;
+}
+/** A `{ zh, en }` display name from stored JSON (a template file's), else null. */
+function localizedName(v) {
+    const n = v;
+    return typeof n?.zh === "string" && typeof n.en === "string" ? { zh: n.zh, en: n.en } : null;
+}
+/** The live platform components of `kind` (`ids` / `itemId`: only those). */
+export async function loadComponents(db, kind, filter = {}) {
+    if (filter.ids !== undefined && filter.ids.length === 0)
+        return [];
+    const common = (r) => ({
+        kind,
+        id: r.id,
+        itemId: r.catalog_item_id,
+        scopeMode: r.scope_mode,
+        scope: r.scope,
+        disabled: r.disabled,
+        shownToOthers: r.shown_to_others,
+        ownerOrgId: r.owner_org_id,
+        shareable: r.shareable,
+    });
+    if (kind === "connector_template") {
+        let q = db
+            .selectFrom("platform_connector_templates as p")
+            .leftJoin("catalog_items as c", "c.id", "p.catalog_item_id")
+            .select([
+            "p.id",
+            "p.catalog_item_id",
+            "p.template_id",
+            "p.current_version",
+            "p.scope_mode",
+            "p.scope",
+            "p.disabled",
+            "p.shown_to_others",
+            "p.owner_org_id",
+            "p.shareable",
+            "p.file",
+            "c.name as item_name",
+        ])
+            .where("p.deleted_at", "is", null);
+        if (filter.ids !== undefined)
+            q = q.where("p.id", "in", [...filter.ids]);
+        if (filter.itemId !== undefined)
+            q = q.where("p.catalog_item_id", "=", filter.itemId);
+        if (filter.name !== undefined)
+            q = q.where("p.template_id", "=", filter.name);
+        if (filter.forUpdate)
+            q = q.forUpdate("p");
+        return (await q.orderBy("p.id").execute()).map((r) => {
+            const file = r.file;
+            return {
+                ...common(r),
+                ...(file?.defaultEnabled === false && { defaultOff: true }),
+                name: r.template_id,
+                plugin: r.item_name,
+                version: r.current_version,
+                description: typeof file?.description === "string" ? file.description : null,
+                descriptionZh: null,
+                displayName: localizedName(file?.displayName),
+                originOrgId: null,
+            };
+        });
+    }
+    const table = kind === "skill"
+        ? "platform_skills"
+        : kind === "theme"
+            ? "platform_themes"
+            : "platform_agent_templates";
+    let q = db
+        .selectFrom(`${table} as p`)
+        .select([
+        "p.id",
+        "p.catalog_item_id",
+        "p.plugin_name",
+        "p.name",
+        "p.description",
+        "p.description_zh",
+        "p.current_version",
+        "p.scope_mode",
+        "p.scope",
+        "p.disabled",
+        "p.shown_to_others",
+        "p.owner_org_id",
+        "p.origin_org_id",
+        "p.shareable",
+    ])
+        .where("p.deleted_at", "is", null);
+    if (filter.ids !== undefined)
+        q = q.where("p.id", "in", [...filter.ids]);
+    if (filter.itemId !== undefined)
+        q = q.where("p.catalog_item_id", "=", filter.itemId);
+    if (filter.name !== undefined)
+        q = q.where("p.name", "=", filter.name);
+    if (filter.forUpdate)
+        q = q.forUpdate();
+    return (await q.orderBy("p.id").execute()).map((r) => ({
+        ...common(r),
+        name: r.name,
+        plugin: r.plugin_name,
+        version: String(r.current_version),
+        description: r.description,
+        descriptionZh: r.description_zh,
+        displayName: null,
+        originOrgId: r.origin_org_id,
+    }));
+}
+const LIVE_INSTALL = ["installing", "installed", "upgrading"];
+const groupBy = (rows, key, value) => {
+    const out = new Map();
+    for (const r of rows) {
+        const k = key(r);
+        const s = out.get(k) ?? new Set();
+        out.set(k, s);
+        s.add(value(r));
+    }
+    return out;
+};
+/** Reads the {@link ScopeState} of `comps` (all of one kind), one query after the other. */
+export async function loadScopeState(db, kind, comps) {
+    const itemIds = [...new Set(comps.map((c) => c.itemId).filter((x) => x !== null))];
+    const ids = comps.map((c) => c.id);
+    const state = {
+        plugins: new Map(),
+        pluginListed: new Map(),
+        installed: new Map(),
+        listed: new Map(),
+        switches: new Map(),
+    };
+    if (itemIds.length > 0) {
+        const items = await db
+            .selectFrom("catalog_items")
+            .select(["id", "scope", "builtin", "disabled"])
+            .where("id", "in", itemIds)
+            .where("deleted_at", "is", null)
+            .execute();
+        for (const i of items)
+            state.plugins.set(i.id, i);
+        const listed = await db
+            .selectFrom("catalog_item_scope_orgs")
+            .select(["item_id", "org_id"])
+            .where("item_id", "in", itemIds)
+            .execute();
+        state.pluginListed = groupBy(listed, (r) => r.item_id, (r) => r.org_id);
+        const installs = await db
+            .selectFrom("plugin_installs")
+            .select(["item_id", "org_id"])
+            .where("item_id", "in", itemIds)
+            .where("status", "in", [...LIVE_INSTALL])
+            .execute();
+        state.installed = groupBy(installs, (r) => r.item_id, (r) => r.org_id);
+    }
+    if (ids.length > 0) {
+        const listed = await db
+            .selectFrom("component_scope_orgs")
+            .select(["component_id", "org_id"])
+            .where("kind", "=", kind)
+            .where("component_id", "in", ids)
+            .execute();
+        state.listed = groupBy(listed, (r) => r.component_id, (r) => r.org_id);
+        const switches = await db
+            .selectFrom("component_org_switches")
+            .select(["component_id", "org_id", "enabled"])
+            .where("kind", "=", kind)
+            .where("component_id", "in", ids)
+            .execute();
+        for (const s of switches) {
+            const m = state.switches.get(s.component_id) ?? new Map();
+            state.switches.set(s.component_id, m);
+            m.set(s.org_id, s.enabled);
+        }
+    }
+    return state;
+}
+/** The plugin facts of `itemId` for one org from a {@link ScopeState} (null: no plugin). */
+export function pluginFactsOf(st, itemId, orgId) {
+    if (itemId === null)
+        return null;
+    const p = st.plugins.get(itemId);
+    if (!p)
+        return {
+            live: false,
+            disabled: false,
+            builtin: false,
+            scope: "optional",
+            listed: false,
+            installed: false,
+        };
+    return {
+        live: true,
+        disabled: p.disabled,
+        builtin: p.builtin,
+        scope: p.scope,
+        listed: st.pluginListed.get(itemId)?.has(orgId) ?? false,
+        installed: st.installed.get(itemId)?.has(orgId) ?? false,
+    };
+}
+/** The org's switch of a component from a {@link ScopeState}. */
+export const switchOf = (st, id, orgId) => st.switches.get(id)?.get(orgId) ?? null;
+/** Whether the org is on a component's own `named` list in a {@link ScopeState}. */
+export const listedIn = (st, id, orgId) => st.listed.get(id)?.has(orgId) ?? false;
+/**
+ * The ids an agent definition references (see {@link DefinitionRefs}); `orgConnectors` are the
+ * ids of the org's live connectors.
+ */
+export function definitionRefs(definition, orgConnectors = []) {
+    const def = definition;
+    const connectors = new Set();
+    const skills = new Set();
+    const templates = new Set();
+    const off = new Set();
+    for (const ref of Array.isArray(def?.disabledTools) ? def.disabledTools : []) {
+        const n = ref;
+        if (n?.kind === "connector" && typeof n.connectorId === "string" && n.tools === "all") {
+            off.add(n.connectorId);
+        }
+    }
+    for (const id of orgConnectors)
+        if (!off.has(id))
+            connectors.add(id);
+    const strings = (xs, into) => {
+        if (Array.isArray(xs))
+            for (const x of xs)
+                if (typeof x === "string")
+                    into.add(x);
+    };
+    strings(def?.skills?.orgSkills, skills);
+    strings(def?.skills?.pinned, skills);
+    const inline = def?.subagents?.inline;
+    if (Array.isArray(inline))
+        for (const t of inline)
+            strings(t?.skills, skills);
+    strings(def?.subagents?.templates, templates);
+    return { connectors, skills, templates };
+}
+/** The org's live agents with their current definitions' references, sorted by id. */
+export async function agentDefinitionRefs(db, orgId) {
+    const rows = await db
+        .selectFrom("agents as a")
+        .innerJoin("agent_versions as v", (j) => j.onRef("v.agent_id", "=", "a.id").onRef("v.version", "=", "a.current_version"))
+        .select(["a.id", "v.definition"])
+        .where("a.org_id", "=", orgId)
+        .where("a.deleted_at", "is", null)
+        .orderBy("a.id")
+        .execute();
+    const connectors = (await db
+        .selectFrom("connectors")
+        .select("id")
+        .where("org_id", "=", orgId)
+        .where("deleted_at", "is", null)
+        .orderBy("id")
+        .execute()).map((c) => c.id);
+    return rows.map((r) => {
+        const name = r.definition?.name;
+        return {
+            id: r.id,
+            name: typeof name === "string" ? name : r.id,
+            ...definitionRefs(r.definition, connectors),
+        };
+    });
+}
+/**
+ * The ids an org's agents may reference a platform component by: its own id and the org's copies
+ * linked to it (ruling B2: unpinned ones resolve to it; ruling P2-18: pinned ones follow its
+ * availability). Connector templates: none (connectors made from one stay the org's own); themes:
+ * none (no agent references a theme, and a theme has no org copies).
+ */
+export async function referenceIds(db, orgId, kind, ids) {
+    const out = new Map();
+    if (kind === "connector_template" || kind === "theme" || ids.length === 0)
+        return out;
+    for (const id of ids)
+        out.set(id, id);
+    const copies = kind === "skill"
+        ? await db
+            .selectFrom("skills")
+            .select(["id", "platform_skill_id as platform_id"])
+            .where("org_id", "=", orgId)
+            .where("deleted_at", "is", null)
+            .where("platform_skill_id", "in", [...ids])
+            .execute()
+        : await db
+            .selectFrom("agent_templates")
+            .select(["id", "platform_template_id as platform_id"])
+            .where("org_id", "=", orgId)
+            .where("deleted_at", "is", null)
+            .where("platform_template_id", "in", [...ids])
+            .execute();
+    for (const c of copies)
+        if (c.platform_id !== null)
+            out.set(c.id, c.platform_id);
+    return out;
+}
+/**
+ * The org's agents that use any of the components `ids` of `kind`, each with the references it
+ * uses (`ref`: the id in its definition), sorted by id.
+ */
+export async function agentsUsing(db, orgId, kind, ids) {
+    const refs = await referenceIds(db, orgId, kind, ids);
+    if (refs.size === 0)
+        return [];
+    const out = [];
+    for (const a of await agentDefinitionRefs(db, orgId)) {
+        const used = kind === "skill" ? a.skills : a.templates;
+        const hit = [...used].filter((r) => refs.has(r)).sort();
+        if (hit.length > 0)
+            out.push({ id: a.id, name: a.name, refs: hit });
+    }
+    return out;
+}
+/**
+ * The org's own skills (live, `scope = 'org'`, unlinked or pinned) named `name` that are not a copy
+ * of platform skill `component` (linked to it, or from its plugin): a clash under rule 10.
+ */
+export async function clashingOrgSkills(db, orgId, component, name) {
+    const rows = await db
+        .selectFrom("skills")
+        .select(["id", "platform_skill_id", "catalog_item_id"])
+        .where("org_id", "=", orgId)
+        .where("scope", "=", "org")
+        .where("deleted_at", "is", null)
+        .where("name", "=", name)
+        .where((eb) => eb.or([eb("platform_skill_id", "is", null), eb("pinned_version", "is not", null)]))
+        .execute();
+    return rows
+        .filter((r) => r.platform_skill_id !== component.id &&
+        !(r.catalog_item_id !== null && r.catalog_item_id === component.itemId))
+        .map((r) => r.id);
+}
+/** The platform components of `kind` named `name` that are offered to the org ({@link componentOffered}). */
+export async function offeredNamed(db, orgId, kind, name) {
+    const comps = await loadComponents(db, kind, { name });
+    if (comps.length === 0)
+        return [];
+    const st = await loadScopeState(db, kind, comps);
+    return comps.filter((c) => componentOffered(c, pluginFactsOf(st, c.itemId, orgId), listedIn(st, c.id, orgId)));
+}
+/** The other platform skills named `name` that are on in the org (rule 10). */
+export async function clashingPlatformSkills(db, orgId, component, name) {
+    const others = (await loadComponents(db, "skill", { name })).filter((c) => c.id !== component.id);
+    if (others.length === 0)
+        return [];
+    const st = await loadScopeState(db, "skill", others);
+    return others.filter((c) => componentOn(c, pluginFactsOf(st, c.itemId, orgId), listedIn(st, c.id, orgId), switchOf(st, c.id, orgId)));
+}
+/**
+ * The skills that already use the name of platform skill `component` in the org (rule 10): the
+ * org's own ({@link clashingOrgSkills}) and other platform skills on there (`plugins`: theirs).
+ */
+export async function skillNameClashes(db, orgId, component, name) {
+    const platform = await clashingPlatformSkills(db, orgId, component, name);
+    return {
+        skills: [
+            ...(await clashingOrgSkills(db, orgId, component, name)),
+            ...platform.map((c) => c.id),
+        ],
+        plugins: platform.map((c) => c.plugin ?? "platform"),
+    };
+}
+/**
+ * The live themes with id `name` that are on in the org (themes spec §6: theme ids are unique in an
+ * org's usable set, rule 10), except `self` (null: a theme with no row yet, e.g. one an update adds).
+ */
+export async function themeIdClashes(db, orgId, self, name) {
+    const others = (await loadComponents(db, "theme", { name })).filter((c) => c.id !== self?.id);
+    if (others.length === 0)
+        return [];
+    const st = await loadScopeState(db, "theme", others);
+    return others.filter((c) => componentOn(c, pluginFactsOf(st, c.itemId, orgId), listedIn(st, c.id, orgId), switchOf(st, c.id, orgId)));
+}
+/** A connector template's id from its manifest path (`./connectors/<id>.json`). */
+export const templateIdOfPath = (path) => (path.split("/").pop() ?? path).replace(/\.json$/, "");
+/**
+ * The connector templates among `ids` (of catalog item `itemId`) that are on in the org once the
+ * plugin is on there (ruling P2-6): the component switch, its own scope and disabled flags decide;
+ * a template without a platform row counts as on. Installs create connectors only from these, and
+ * only these need the org's input (`needs_config`). `defaultOff`: by template id, whether another
+ * version's file (an update's target) ships it off, in place of the platform row's.
+ */
+export async function connectorTemplatesOn(db, orgId, itemId, ids, defaultOff) {
+    if (ids.length === 0)
+        return new Set();
+    const comps = await loadComponents(db, "connector_template", { itemId });
+    const st = await loadScopeState(db, "connector_template", comps);
+    const off = new Set(comps
+        .filter((c) => {
+        const p = pluginFactsOf(st, c.itemId, orgId);
+        const shipped = defaultOff?.get(c.name);
+        return !componentOn(shipped === undefined ? c : { ...c, defaultOff: shipped }, p && { ...p, installed: true }, listedIn(st, c.id, orgId), switchOf(st, c.id, orgId));
+    })
+        .map((c) => c.name));
+    return new Set(ids.filter((id) => !off.has(id)));
+}
+/** The org's live connectors made from platform connector template `id` (they stay its own). */
+export async function connectorsMadeFrom(db, orgId, id) {
+    const r = await db
+        .selectFrom("connectors")
+        .select((eb) => eb.fn.countAll().as("n"))
+        .where("org_id", "=", orgId)
+        .where("platform_template_id", "=", id)
+        .where("deleted_at", "is", null)
+        .executeTakeFirstOrThrow();
+    return Number(r.n);
+}
+/**
+ * Whether platform connector template `id` is on in the org (`on`), offered to it but off
+ * (`off`: its plugin not installed for a `follow` template, or switched off there), or neither
+ * (`absent`: missing, deleted, without a plugin, stopped or not offered). One more connector from a
+ * template needs `on` (ruling P4-T6-8), read before and again under the org lock.
+ */
+export async function connectorTemplateState(db, orgId, id) {
+    const [c] = await loadComponents(db, "connector_template", { ids: [id] });
+    if (!c || c.itemId === null)
+        return "absent";
+    const st = await loadScopeState(db, "connector_template", [c]);
+    const p = pluginFactsOf(st, c.itemId, orgId);
+    const listed = listedIn(st, c.id, orgId);
+    if (componentOn(c, p, listed, switchOf(st, c.id, orgId)))
+        return "on";
+    return componentOffered(c, p, listed) ? "off" : "absent";
+}

package/dist/catalog/git-source.d.ts

@@ -115,13 +115,21 @@ export type ReadGitTreeOptions = GitOptions & {
  * {@link readGitTree}, plus the git tree oids of directories at the same commit: `trees` gets the
  * files read and returns directory paths relative to the repository root (`.` is the root); each
  * one that exists and is a directory gets its tree oid (equal oids mean equal contents, so a
- * plugin directory that did not change keeps its oid across commits).
+ * plugin directory that did not change keeps its oid across commits). `blobs` likewise names more
+ * files (paths relative to the root, from the same fetched commit, nothing else is downloaded):
+ * each that exists as a plain file of at most `maxBytes` is in `blobs` of the result; a missing
+ * path, a directory, a symlink, a submodule or a larger file is left out (never an error).
  */
 export declare function readGitTreeAndOids(loc: GitLocation & {
     commit: string;
 }, o: ReadGitTreeOptions & {
     trees?: (files: Map<string, Uint8Array>) => string[];
+    blobs?: {
+        paths: (files: Map<string, Uint8Array>) => string[];
+        maxBytes: number;
+    };
 }): Promise<{
     files: Map<string, Uint8Array>;
     trees: Map<string, string>;
+    blobs: Map<string, Uint8Array>;
 }>;

package/dist/catalog/git-source.js

@@ -373,7 +373,10 @@ export async function readGitTree(loc, o) {
  * {@link readGitTree}, plus the git tree oids of directories at the same commit: `trees` gets the
  * files read and returns directory paths relative to the repository root (`.` is the root); each
  * one that exists and is a directory gets its tree oid (equal oids mean equal contents, so a
- * plugin directory that did not change keeps its oid across commits).
+ * plugin directory that did not change keeps its oid across commits). `blobs` likewise names more
+ * files (paths relative to the root, from the same fetched commit, nothing else is downloaded):
+ * each that exists as a plain file of at most `maxBytes` is in `blobs` of the result; a missing
+ * path, a directory, a symlink, a submodule or a larger file is left out (never an error).
  */
 export async function readGitTreeAndOids(loc, o) {
     if (!SHA_RE.test(loc.commit))
@@ -509,7 +512,31 @@ export async function readGitTreeAndOids(loc, o) {
             if (oid !== undefined)
                 trees.set(dir, oid);
         }
-        return { files: sorted, trees };
+        const blobs = new Map();
+        const wanted = o.blobs;
+        for (const path of wanted?.paths(sorted).slice(0, GIT_LIMITS.maxFiles) ?? []) {
+            const want = pathSegments(path);
+            if (want === undefined || want.length === 0 || blobs.has(path))
+                continue;
+            let oid = c.tree;
+            for (const [i, seg] of want.entries()) {
+                const { tree: entries } = await git.readTree({ fs, gitdir, oid, cache });
+                const e = entries.find((x) => x.path === seg);
+                const last = i === want.length - 1;
+                oid =
+                    e !== undefined && e.mode !== "120000" && e.type === (last ? "blob" : "tree")
+                        ? e.oid
+                        : undefined;
+                if (oid === undefined)
+                    break;
+            }
+            if (oid === undefined)
+                continue;
+            const { blob } = await git.readBlob({ fs, gitdir, oid, cache });
+            if (wanted !== undefined && blob.byteLength <= wanted.maxBytes)
+                blobs.set(path, blob);
+        }
+        return { files: sorted, trees, blobs };
     }
     catch (e) {
         throw mapError(e, op, o, what);

package/dist/catalog/job-ids.d.ts

@@ -13,3 +13,33 @@ export declare const MARKETPLACES_REFRESH_SCHEDULER_ID = "catalogs-refresh-every
 export declare const PLUGIN_STAGING_CLEANUP_JOB = "app-staging-cleanup";
 /** The BullMQ repeatable scheduler the cleanup had before it became `@LockedCron` (retired). */
 export declare const PLUGIN_STAGING_CLEANUP_SCHEDULER_ID = "app-staging-cleanup-hourly";
+/**
+ * The one-off job that takes out the extension of a removed org-owned plugin (spec §14, P3-20,
+ * P3-21; `OwnedPluginCleanup.run`), on `cap-kernel-maintenance`.
+ */
+export declare const OWNED_PLUGIN_CLEANUP_JOB = "owned-plugin-cleanup";
+/** The daily `@LockedCron` repairing lost {@link OWNED_PLUGIN_CLEANUP_JOB} enqueues. */
+export declare const OWNED_PLUGIN_CLEANUP_SWEEP_JOB = "owned-plugin-cleanup-sweep";
+/** The data of an {@link OWNED_PLUGIN_CLEANUP_JOB}. */
+export interface OwnedPluginCleanupData {
+    itemId: string;
+}
+/**
+ * The cleanup job of one removed item: id `owned-plugin-cleanup-<itemId>` (no `:`: item ids are
+ * UUIDs), removed when done so a later enqueue of the same item is not swallowed; the job is
+ * idempotent, so a few retries are safe.
+ */
+export declare function ownedPluginCleanupJob(itemId: string): {
+    name: string;
+    data: OwnedPluginCleanupData;
+    opts: {
+        jobId: string;
+        attempts: number;
+        backoff: {
+            type: "exponential";
+            delay: number;
+        };
+        removeOnComplete: true;
+        removeOnFail: true;
+    };
+};

package/dist/catalog/job-ids.js

@@ -13,3 +13,28 @@ export const MARKETPLACES_REFRESH_SCHEDULER_ID = "catalogs-refresh-every";
 export const PLUGIN_STAGING_CLEANUP_JOB = "app-staging-cleanup";
 /** The BullMQ repeatable scheduler the cleanup had before it became `@LockedCron` (retired). */
 export const PLUGIN_STAGING_CLEANUP_SCHEDULER_ID = "app-staging-cleanup-hourly";
+/**
+ * The one-off job that takes out the extension of a removed org-owned plugin (spec §14, P3-20,
+ * P3-21; `OwnedPluginCleanup.run`), on `cap-kernel-maintenance`.
+ */
+export const OWNED_PLUGIN_CLEANUP_JOB = "owned-plugin-cleanup";
+/** The daily `@LockedCron` repairing lost {@link OWNED_PLUGIN_CLEANUP_JOB} enqueues. */
+export const OWNED_PLUGIN_CLEANUP_SWEEP_JOB = "owned-plugin-cleanup-sweep";
+/**
+ * The cleanup job of one removed item: id `owned-plugin-cleanup-<itemId>` (no `:`: item ids are
+ * UUIDs), removed when done so a later enqueue of the same item is not swallowed; the job is
+ * idempotent, so a few retries are safe.
+ */
+export function ownedPluginCleanupJob(itemId) {
+    return {
+        name: OWNED_PLUGIN_CLEANUP_JOB,
+        data: { itemId },
+        opts: {
+            jobId: `${OWNED_PLUGIN_CLEANUP_JOB}-${itemId}`,
+            attempts: 3,
+            backoff: { type: "exponential", delay: 5_000 },
+            removeOnComplete: true,
+            removeOnFail: true,
+        },
+    };
+}

package/dist/catalog/marketplace-fetch.d.ts

@@ -3,7 +3,7 @@ import type { KernelConfig } from "../config/schema.js";
 import { type LookupFn, NetDeniedError, type NetPolicy } from "../net/public-address.js";
 /**
  * Fetching a marketplace manifest `marketplace.json` (C26, spec §5.2) and a marketplace's archive
- * sources. The URLs come from an enterprise admin or the config, but responses are always hostile
+ * sources. The URLs come from a super admin or the config, but responses are always hostile
  * input:
  * - https only (`allowInsecureLoopback`, tests only, allows http on loopback addresses), no user
  *   info in the URL;