@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.21

package/dist/catalog/org-plugin-uploads.controller.d.ts

@@ -0,0 +1,77 @@
+import type { z } from "zod";
+import { type Principal } from "../identity/principal.js";
+import { type OrgContext } from "../orgs/org.guard.js";
+import { CatalogScopeService } from "./catalog-scope.service.js";
+import { OrgPluginUploads, type OrgUploadResult, type OrgUploadReview } from "./org-plugin-uploads.js";
+import { OrgUploadConfirmBody as ConfirmBody, OrgOwnedDeleteBody as DeleteBody, OrgOwnedPluginParams as OwnedParams, OrgOwnedShareableBody as ShareableBody, OrgUploadStagingParams as StagingParams } from "./org-plugin-uploads.schemas.js";
+import { type OwnedDeletePreview, OwnedItems } from "./owned-items.js";
+/**
+ * An org admin's plugin uploads (`/api/v1/orgs/:orgId/catalog/uploads/*`, spec §14, rulings P3-7,
+ * P3-8): a `.tgz` without an extension, prepared (one review) and confirmed like the super admin's
+ * import, owned by the org. Writes re-check the org admin under the org row lock.
+ */
+export declare class OrgPluginUploadsController {
+    private readonly uploads;
+    constructor(uploads: OrgPluginUploads);
+    /**
+     * Prepares an upload (the tgz as the raw body, `application/octet-stream`, at most
+     * `packages.maxBytes`): `{ stagingId, review, update }`, the staging kept 24 hours for this org.
+     * The checks of the platform import, plus: `customSkills` = deny with skills or agent templates,
+     * or `customConnectors` = deny with connector templates -> 403 `catalog.custom_disabled`
+     * (ruling P3-15'); a name live for another owner -> 409 `plugin.name_taken` (details
+     * `[{ owner }]`); a dependency the org cannot use -> 409 `plugin.dependency_unavailable`
+     * (details `[{ dependencies }]`).
+     */
+    upload(principal: Principal, org: OrgContext, req: {
+        body?: unknown;
+    }): Promise<OrgUploadReview>;
+    /** The org's staged upload; unknown, expired, confirmed, another org's or the platform's -> 404. */
+    staged(org: OrgContext, params: z.infer<typeof StagingParams>): Promise<OrgUploadReview>;
+    /**
+     * Confirms the org's staged upload (201 `{ item, outcome }`): a new item owned by the org, scope
+     * `named: [org]`, not shown to other orgs, `shareable` as sent (default false), installed in the
+     * org by the scope sync (`installed`); a new version of its own item (`updated`). The checks of
+     * prepare run again under the item name's lock (the first confirm of a name wins). A package
+     * with an extension waits for the super admin (`pending`, ruling P3-10): stored, its extension
+     * name claimed (another package's -> 409 `extension.name_conflict` naming the owner), nothing
+     * installed or usable until confirmed in 待确认; a later upload replaces the pending version
+     * (P3-11). A version without an extension for an item whose first version still waits replaces
+     * that upload and is installed at once (`installed`).
+     */
+    confirm(principal: Principal, org: OrgContext, params: z.infer<typeof StagingParams>, body: z.infer<typeof ConfirmBody>): Promise<OrgUploadResult>;
+}
+/**
+ * The org's own plugins (`/api/v1/orgs/:orgId/owned-plugins/*`, spec §14, P3-17 to P3-19): the
+ * owner org's admin withdraws a pending upload, toggles 可共享 and deletes the plugin after a
+ * preview. Another org's or a platform plugin -> 404. Writes re-check the org admin under the org
+ * row lock.
+ */
+export declare class OrgOwnedPluginsController {
+    private readonly scope;
+    private readonly owned;
+    constructor(scope: CatalogScopeService, owned: OwnedItems);
+    /**
+     * Sets 可共享 (ruling P3-2: the plugin and its component rows in one transaction; turning it
+     * off keeps the orgs already associated and hides it from new ones, ruling P3-25). 204.
+     */
+    setShareable(principal: Principal, org: OrgContext, params: z.infer<typeof OwnedParams>, body: z.infer<typeof ShareableBody>): Promise<void>;
+    /**
+     * What deleting the plugin does (P3-19, nothing written): `outcome` `removed` (no other org
+     * uses it) or `transferred` (to the platform), `orgs` the other orgs using it, `agents` the
+     * org's agents that lose it, and the `previewHash` to confirm.
+     */
+    previewDelete(org: OrgContext, params: z.infer<typeof OwnedParams>): Promise<OwnedDeletePreview>;
+    /**
+     * Deletes the plugin after its preview: removed, or transferred to the platform when another
+     * org uses it (platform notice `ownership_transferred`). A preview that changed meanwhile ->
+     * 409 `catalog.preview_stale`. 204.
+     */
+    delete(principal: Principal, org: OrgContext, params: z.infer<typeof OwnedParams>, body: z.infer<typeof DeleteBody>): Promise<void>;
+    /**
+     * Withdraws the org's pending upload of the plugin (ruling P3-10, no notice): a first version
+     * is removed (its name free again), a new version's pending state cleared (the platform version
+     * keeps running). Another org's or a platform plugin -> 404; nothing pending -> 409
+     * `extension.not_pending`. 204.
+     */
+    withdraw(principal: Principal, org: OrgContext, params: z.infer<typeof OwnedParams>): Promise<void>;
+}

package/dist/catalog/org-plugin-uploads.controller.js

@@ -0,0 +1,200 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Delete, Get, HttpCode, Inject, Post, Put, Req } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { CatalogScopeService } from "./catalog-scope.service.js";
+import { OrgPluginUploads, } from "./org-plugin-uploads.js";
+import { OrgUploadConfirmBody as ConfirmBody, OrgOwnedDeleteBody as DeleteBody, OrgOwnedPluginParams as OwnedParams, OrgOwnedShareableBody as ShareableBody, OrgUploadStagingParams as StagingParams, } from "./org-plugin-uploads.schemas.js";
+import { OwnedItems } from "./owned-items.js";
+class OrgUploadStagingParamsDto extends createZodDto(StagingParams, "OrgUploadStagingParams") {
+}
+class OrgUploadConfirmBodyDto extends createZodDto(ConfirmBody, "OrgUploadConfirmBody") {
+}
+class OrgOwnedPluginParamsDto extends createZodDto(OwnedParams, "OrgOwnedPluginParams") {
+}
+class OrgOwnedShareableBodyDto extends createZodDto(ShareableBody, "OrgOwnedShareableBody") {
+}
+class OrgOwnedDeleteBodyDto extends createZodDto(DeleteBody, "OrgOwnedDeleteBody") {
+}
+const actorOpts = (actor) => {
+    const tokenId = patTokenId(actor);
+    return tokenId !== undefined ? { actorTokenId: tokenId } : {};
+};
+/**
+ * An org admin's plugin uploads (`/api/v1/orgs/:orgId/catalog/uploads/*`, spec §14, rulings P3-7,
+ * P3-8): a `.tgz` without an extension, prepared (one review) and confirmed like the super admin's
+ * import, owned by the org. Writes re-check the org admin under the org row lock.
+ */
+let OrgPluginUploadsController = class OrgPluginUploadsController {
+    uploads;
+    constructor(uploads) {
+        this.uploads = uploads;
+    }
+    /**
+     * Prepares an upload (the tgz as the raw body, `application/octet-stream`, at most
+     * `packages.maxBytes`): `{ stagingId, review, update }`, the staging kept 24 hours for this org.
+     * The checks of the platform import, plus: `customSkills` = deny with skills or agent templates,
+     * or `customConnectors` = deny with connector templates -> 403 `catalog.custom_disabled`
+     * (ruling P3-15'); a name live for another owner -> 409 `plugin.name_taken` (details
+     * `[{ owner }]`); a dependency the org cannot use -> 409 `plugin.dependency_unavailable`
+     * (details `[{ dependencies }]`).
+     */
+    async upload(principal, org, req) {
+        const actor = requireUser(principal);
+        const body = req.body;
+        if (!Buffer.isBuffer(body) || body.byteLength === 0) {
+            throw new ApiError("unsupported_media_type", "Send the plugin package (.tgz) as the request body with content-type application/octet-stream");
+        }
+        return this.uploads.prepare(actor.account.id, org.orgId, new Uint8Array(body.buffer, body.byteOffset, body.byteLength), actorOpts(actor));
+    }
+    /** The org's staged upload; unknown, expired, confirmed, another org's or the platform's -> 404. */
+    staged(org, params) {
+        return this.uploads.staged(org.orgId, params.stagingId);
+    }
+    /**
+     * Confirms the org's staged upload (201 `{ item, outcome }`): a new item owned by the org, scope
+     * `named: [org]`, not shown to other orgs, `shareable` as sent (default false), installed in the
+     * org by the scope sync (`installed`); a new version of its own item (`updated`). The checks of
+     * prepare run again under the item name's lock (the first confirm of a name wins). A package
+     * with an extension waits for the super admin (`pending`, ruling P3-10): stored, its extension
+     * name claimed (another package's -> 409 `extension.name_conflict` naming the owner), nothing
+     * installed or usable until confirmed in 待确认; a later upload replaces the pending version
+     * (P3-11). A version without an extension for an item whose first version still waits replaces
+     * that upload and is installed at once (`installed`).
+     */
+    confirm(principal, org, params, body) {
+        const actor = requireUser(principal);
+        return this.uploads.confirm(actor.account.id, org.orgId, params.stagingId, {
+            reviewHash: body.reviewHash,
+            ...(body.shareable !== undefined && { shareable: body.shareable }),
+            ...(body.pinnedSuggestions !== undefined && { pinnedSuggestions: body.pinnedSuggestions }),
+        }, actorOpts(actor));
+    }
+};
+__decorate([
+    Post("file"),
+    HttpCode(200),
+    OrgAction("catalog.upload"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, Req())
+], OrgPluginUploadsController.prototype, "upload", null);
+__decorate([
+    Get(":stagingId"),
+    OrgAction("catalog.upload"),
+    __param(0, CurrentOrg()),
+    __param(1, ZParam(OrgUploadStagingParamsDto))
+], OrgPluginUploadsController.prototype, "staged", null);
+__decorate([
+    Post(":stagingId/confirm"),
+    HttpCode(201),
+    OrgAction("catalog.upload"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(OrgUploadStagingParamsDto)),
+    __param(3, ZBody(OrgUploadConfirmBodyDto))
+], OrgPluginUploadsController.prototype, "confirm", null);
+OrgPluginUploadsController = __decorate([
+    Controller("api/v1/orgs/:orgId/catalog/uploads"),
+    __param(0, Inject(OrgPluginUploads))
+], OrgPluginUploadsController);
+export { OrgPluginUploadsController };
+/**
+ * The org's own plugins (`/api/v1/orgs/:orgId/owned-plugins/*`, spec §14, P3-17 to P3-19): the
+ * owner org's admin withdraws a pending upload, toggles 可共享 and deletes the plugin after a
+ * preview. Another org's or a platform plugin -> 404. Writes re-check the org admin under the org
+ * row lock.
+ */
+let OrgOwnedPluginsController = class OrgOwnedPluginsController {
+    scope;
+    owned;
+    constructor(scope, owned) {
+        this.scope = scope;
+        this.owned = owned;
+    }
+    /**
+     * Sets 可共享 (ruling P3-2: the plugin and its component rows in one transaction; turning it
+     * off keeps the orgs already associated and hides it from new ones, ruling P3-25). 204.
+     */
+    async setShareable(principal, org, params, body) {
+        const actor = requireUser(principal);
+        await this.owned.setShareable(org.orgId, actor.account.id, { kind: "plugin", id: params.id }, body.shareable, actorOpts(actor));
+    }
+    /**
+     * What deleting the plugin does (P3-19, nothing written): `outcome` `removed` (no other org
+     * uses it) or `transferred` (to the platform), `orgs` the other orgs using it, `agents` the
+     * org's agents that lose it, and the `previewHash` to confirm.
+     */
+    previewDelete(org, params) {
+        return this.owned.previewDelete(org.orgId, params.id);
+    }
+    /**
+     * Deletes the plugin after its preview: removed, or transferred to the platform when another
+     * org uses it (platform notice `ownership_transferred`). A preview that changed meanwhile ->
+     * 409 `catalog.preview_stale`. 204.
+     */
+    async delete(principal, org, params, body) {
+        const actor = requireUser(principal);
+        await this.owned.delete(org.orgId, actor.account.id, params.id, body.previewHash, actorOpts(actor));
+    }
+    /**
+     * Withdraws the org's pending upload of the plugin (ruling P3-10, no notice): a first version
+     * is removed (its name free again), a new version's pending state cleared (the platform version
+     * keeps running). Another org's or a platform plugin -> 404; nothing pending -> 409
+     * `extension.not_pending`. 204.
+     */
+    async withdraw(principal, org, params) {
+        const actor = requireUser(principal);
+        await this.scope.withdraw(org.orgId, actor.account.id, params.id, actorOpts(actor));
+    }
+};
+__decorate([
+    Put(":id/shareable"),
+    HttpCode(204),
+    OrgAction("catalog.upload"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(OrgOwnedPluginParamsDto)),
+    __param(3, ZBody(OrgOwnedShareableBodyDto))
+], OrgOwnedPluginsController.prototype, "setShareable", null);
+__decorate([
+    Post(":id/delete/preview"),
+    HttpCode(200),
+    OrgAction("catalog.upload"),
+    __param(0, CurrentOrg()),
+    __param(1, ZParam(OrgOwnedPluginParamsDto))
+], OrgOwnedPluginsController.prototype, "previewDelete", null);
+__decorate([
+    Post(":id/delete"),
+    HttpCode(204),
+    OrgAction("catalog.upload"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(OrgOwnedPluginParamsDto)),
+    __param(3, ZBody(OrgOwnedDeleteBodyDto))
+], OrgOwnedPluginsController.prototype, "delete", null);
+__decorate([
+    Delete(":id/pending"),
+    HttpCode(204),
+    OrgAction("catalog.upload"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(OrgOwnedPluginParamsDto))
+], OrgOwnedPluginsController.prototype, "withdraw", null);
+OrgOwnedPluginsController = __decorate([
+    Controller("api/v1/orgs/:orgId/owned-plugins"),
+    __param(0, Inject(CatalogScopeService)),
+    __param(1, Inject(OwnedItems))
+], OrgOwnedPluginsController);
+export { OrgOwnedPluginsController };

package/dist/catalog/org-plugin-uploads.d.ts

@@ -0,0 +1,71 @@
+import type { SingleProviderNote } from "../extensions/single-provider.js";
+import type { ActorOpts, CatalogItemView } from "./catalog.service.js";
+import { CatalogScopeService } from "./catalog-scope.service.js";
+import { PluginImport, type PluginReview } from "./plugin-import.js";
+import { PlatformPluginUpdater, type PlatformUpdatePreview } from "./plugin-upgrade.js";
+/** A staged org upload: the review, and the update preview of a new version (null: none). */
+export interface OrgUploadReview {
+    stagingId: string;
+    /**
+     * The review. For a new version of the org's own plugin its `reviewHash` covers the update
+     * preview too (one hash, ruling P3-12): confirm with it.
+     */
+    review: PluginReview;
+    /**
+     * The platform update a new version of the org's own plugin without an extension applies at
+     * once (ruling P3-12); null for a first upload and for a version with an extension (it waits for
+     * the super admin, plan Task 6).
+     */
+    update: PlatformUpdatePreview | null;
+}
+/**
+ * What a confirmed org upload did: `installed` (a new item, installed in the owner org by the scope
+ * sync), `pending` (waiting for the super admin: an extension, plan Task 6), `updated` (a new
+ * version of the org's own item, applied through the platform updater).
+ */
+export type OrgUploadOutcome = "installed" | "pending" | "updated";
+/** An org upload's confirmation. */
+export interface OrgUploadResult {
+    item: CatalogItemView;
+    outcome: OrgUploadOutcome;
+    /**
+     * The update installed the plugin's extension but left it disabled (a single-provider extension
+     * point another enabled extension holds; `PlatformUpdateResult.extensionLeftDisabled`).
+     */
+    extensionLeftDisabled?: SingleProviderNote;
+}
+/** The hash an org confirms a new version with: the review's and the update's (P3-12). */
+export declare function ownerUpdateHash(reviewHash: string, diffHash: string): string;
+/**
+ * An org admin's plugin upload (spec §14.1 item 1, rulings P3-7, P3-8, P3-12, P3-13 to P3-15'): a
+ * `.tgz` prepared and confirmed through {@link PluginImport} in owner mode (the org's own staging,
+ * its admin re-checked under the org row lock), owned by the org with scope `named: [owner]`. After
+ * the confirm's commit the item's scope sync is enqueued here (as `CatalogScopeService.confirmImport`
+ * does; `PluginImport` cannot reach the scope service, which depends on it), and installs it in the
+ * owner org.
+ *
+ * A new version of the org's own plugin without an extension (P3-12, P3-12') is reviewed with the
+ * platform update it applies (`PlatformPluginUpdater.previewForOwner` on the staged target,
+ * pre-flight F3) and one hash ({@link ownerUpdateHash}); the confirm checks it, commits the version,
+ * then runs `updateAsOwner` with that diff. A failed update leaves the version imported; the same
+ * tgz uploaded again gets an update-only review (F4) whose confirm retries the update. Pinned
+ * suggestions are the plugin's own on a new version (they would change the reviewed update).
+ */
+export declare class OrgPluginUploads {
+    private readonly pluginImport;
+    private readonly scope;
+    private readonly updater;
+    constructor(pluginImport: PluginImport, scope: CatalogScopeService, updater: PlatformPluginUpdater);
+    /** Reads, checks and stages the uploaded tgz for the org (see `PluginImport.prepare`). */
+    prepare(actor: string, orgId: string, bytes: Uint8Array, opts?: ActorOpts): Promise<OrgUploadReview>;
+    /** The org's own staged upload; another org's or the platform's -> 404 `plugin.staging_not_found`. */
+    staged(orgId: string, stagingId: string): Promise<OrgUploadReview>;
+    /** Confirms the org's staged upload (applying a new version), then enqueues the scope sync. */
+    confirm(actor: string, orgId: string, stagingId: string, input: {
+        reviewHash: string;
+        shareable?: boolean;
+        pinnedSuggestions?: string[];
+    }, opts?: ActorOpts): Promise<OrgUploadResult>;
+    /** The review with the update preview of a new version and the combined hash (P3-12). */
+    private withUpdate;
+}

package/dist/catalog/org-plugin-uploads.js

@@ -0,0 +1,122 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { createHash } from "node:crypto";
+import { Inject, Injectable } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { canonicalJson } from "../tools/canonical-json.js";
+import { CatalogScopeService } from "./catalog-scope.service.js";
+import { PluginImport } from "./plugin-import.js";
+import { PlatformPluginUpdater } from "./plugin-upgrade.js";
+/** The hash an org confirms a new version with: the review's and the update's (P3-12). */
+export function ownerUpdateHash(reviewHash, diffHash) {
+    return createHash("sha256")
+        .update(canonicalJson({ reviewHash, diffHash }))
+        .digest("hex")
+        .slice(0, 32);
+}
+const reviewStale = (name, version) => new ApiError("plugin.review_stale", `The review of plugin ${name} ${version} is out of date (it changed, or its extension on this deployment changed since it was prepared); review it again`);
+/**
+ * An org admin's plugin upload (spec §14.1 item 1, rulings P3-7, P3-8, P3-12, P3-13 to P3-15'): a
+ * `.tgz` prepared and confirmed through {@link PluginImport} in owner mode (the org's own staging,
+ * its admin re-checked under the org row lock), owned by the org with scope `named: [owner]`. After
+ * the confirm's commit the item's scope sync is enqueued here (as `CatalogScopeService.confirmImport`
+ * does; `PluginImport` cannot reach the scope service, which depends on it), and installs it in the
+ * owner org.
+ *
+ * A new version of the org's own plugin without an extension (P3-12, P3-12') is reviewed with the
+ * platform update it applies (`PlatformPluginUpdater.previewForOwner` on the staged target,
+ * pre-flight F3) and one hash ({@link ownerUpdateHash}); the confirm checks it, commits the version,
+ * then runs `updateAsOwner` with that diff. A failed update leaves the version imported; the same
+ * tgz uploaded again gets an update-only review (F4) whose confirm retries the update. Pinned
+ * suggestions are the plugin's own on a new version (they would change the reviewed update).
+ */
+let OrgPluginUploads = class OrgPluginUploads {
+    pluginImport;
+    scope;
+    updater;
+    constructor(pluginImport, scope, updater) {
+        this.pluginImport = pluginImport;
+        this.scope = scope;
+        this.updater = updater;
+    }
+    /** Reads, checks and stages the uploaded tgz for the org (see `PluginImport.prepare`). */
+    async prepare(actor, orgId, bytes, opts = {}) {
+        const r = await this.pluginImport.prepare(actor, bytes, { kind: "file", ref: "upload" }, { ...opts, owner: { orgId } });
+        return this.withUpdate(orgId, r.stagingId, r.review);
+    }
+    /** The org's own staged upload; another org's or the platform's -> 404 `plugin.staging_not_found`. */
+    async staged(orgId, stagingId) {
+        const r = await this.pluginImport.staged(stagingId, { orgId });
+        return this.withUpdate(orgId, r.stagingId, r.review);
+    }
+    /** Confirms the org's staged upload (applying a new version), then enqueues the scope sync. */
+    async confirm(actor, orgId, stagingId, input, opts = {}) {
+        const st = await this.pluginImport.stagedTarget(stagingId, { orgId });
+        if (!appliesAtOnce(st)) {
+            const r = await this.pluginImport.confirm(actor, stagingId, input, {
+                ...opts,
+                owner: { orgId },
+            });
+            // A version waiting for the super admin is synced by their confirmation (P3-10)
+            if (r.pending)
+                return { item: r.item, outcome: "pending" };
+            await this.scope.enqueueSync(r.item.id);
+            return { item: r.item, outcome: r.firstVersion ? "installed" : "updated" };
+        }
+        if (input.pinnedSuggestions !== undefined) {
+            throw new ApiError("validation_failed", "pinnedSuggestions: a new version keeps the plugin's own pinned suggestions", [{ path: "pinnedSuggestions", message: "not allowed for a new version" }]);
+        }
+        // The one hash covers the review and the update (P3-12): both recomputed now
+        const preview = await this.updater.previewForOwner(orgId, st.itemId, st.version, st.target);
+        if (input.reviewHash !== ownerUpdateHash(st.reviewHash, preview.diffHash)) {
+            throw reviewStale(preview.name, st.version);
+        }
+        const r = await this.pluginImport.confirm(actor, stagingId, {
+            reviewHash: st.reviewHash,
+            ...(input.shareable !== undefined && { shareable: input.shareable }),
+        }, { ...opts, owner: { orgId } });
+        // The version is committed; a failed update leaves it imported (uploading it again retries)
+        const u = await this.updater.updateAsOwner(orgId, actor, r.item.id, st.version, preview.diffHash, opts);
+        return {
+            item: await this.pluginImport.view(r.item.id),
+            outcome: "updated",
+            ...(u.extensionLeftDisabled !== undefined && {
+                extensionLeftDisabled: u.extensionLeftDisabled,
+            }),
+        };
+    }
+    /** The review with the update preview of a new version and the combined hash (P3-12). */
+    async withUpdate(orgId, stagingId, review) {
+        const st = await this.pluginImport.stagedTarget(stagingId, { orgId });
+        if (!appliesAtOnce(st))
+            return { stagingId, review, update: null };
+        const update = await this.updater.previewForOwner(orgId, st.itemId, st.version, st.target);
+        return {
+            stagingId,
+            review: { ...review, reviewHash: ownerUpdateHash(review.reviewHash, update.diffHash) },
+            update,
+        };
+    }
+};
+OrgPluginUploads = __decorate([
+    Injectable(),
+    __param(0, Inject(PluginImport)),
+    __param(1, Inject(CatalogScopeService)),
+    __param(2, Inject(PlatformPluginUpdater))
+], OrgPluginUploads);
+export { OrgPluginUploads };
+/**
+ * A new version of the org's own plugin without an extension: applied at once through the
+ * platform updater (P3-12). Not while the item's first version still waits for the super admin:
+ * such an upload replaces that first version instead (`PluginImport.commit`, plan Task 6).
+ */
+function appliesAtOnce(st) {
+    return st.existing && !st.extension && !st.awaiting;
+}

package/dist/catalog/org-plugin-uploads.schemas.d.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+export declare const OrgUploadStagingParams: z.ZodObject<{
+    stagingId: z.ZodString;
+}, z.core.$strip>;
+export declare const OrgOwnedPluginParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const OrgUploadConfirmBody: z.ZodObject<{
+    reviewHash: z.ZodString;
+    shareable: z.ZodOptional<z.ZodBoolean>;
+    pinnedSuggestions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export declare const OrgOwnedShareableBody: z.ZodObject<{
+    shareable: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const OrgOwnedDeleteBody: z.ZodObject<{
+    previewHash: z.ZodString;
+}, z.core.$strict>;
+export declare const ORG_PLUGIN_UPLOAD_ROUTES: readonly RouteSchemas[];

package/dist/catalog/org-plugin-uploads.schemas.js

@@ -0,0 +1,32 @@
+import { z } from "zod";
+export const OrgUploadStagingParams = z.object({ stagingId: z.string().min(1).max(100) });
+export const OrgOwnedPluginParams = z.object({ id: z.string().min(1).max(100) });
+export const OrgUploadConfirmBody = z
+    .object({
+    reviewHash: z.string().min(1).max(128),
+    /** The org shares the new item with other orgs (default false, P3-16). */
+    shareable: z.boolean().optional(),
+    /** Skill names suggested as pinned (spec §9.1); omitted keeps the plugin's flags. */
+    pinnedSuggestions: z.array(z.string().min(1).max(64)).max(50).optional(),
+})
+    .strict();
+export const OrgOwnedShareableBody = z.object({ shareable: z.boolean() }).strict();
+export const OrgOwnedDeleteBody = z.object({ previewHash: z.string().min(1).max(128) }).strict();
+export const ORG_PLUGIN_UPLOAD_ROUTES = [
+    { route: "GET /api/v1/orgs/:orgId/catalog/uploads/:stagingId", params: OrgUploadStagingParams },
+    {
+        route: "PUT /api/v1/orgs/:orgId/owned-plugins/:id/shareable",
+        params: OrgOwnedPluginParams,
+        body: OrgOwnedShareableBody,
+    },
+    {
+        route: "POST /api/v1/orgs/:orgId/owned-plugins/:id/delete/preview",
+        params: OrgOwnedPluginParams,
+    },
+    {
+        route: "POST /api/v1/orgs/:orgId/owned-plugins/:id/delete",
+        params: OrgOwnedPluginParams,
+        body: OrgOwnedDeleteBody,
+    },
+    { route: "DELETE /api/v1/orgs/:orgId/owned-plugins/:id/pending", params: OrgOwnedPluginParams },
+];