@capybara-hq/kernel 0.1.0-rc.23 → 0.1.0-rc.25

package/dist/orgs/orgs.service.d.ts

@@ -1,6 +1,7 @@
 import { OwnedItems } from "../catalog/owned-items.js";
 import { PluginScopeSync } from "../catalog/scope-sync.js";
 import { EvalBudget } from "../evals/budget.js";
+import { LifecycleHooks } from "../extensions/lifecycle-hooks.js";
 import type { Account } from "../identity/accounts.js";
 import { ApiTokenService } from "../identity/api-tokens.js";
 import { SettingsService } from "../identity/settings.js";
@@ -32,17 +33,21 @@ export declare class OrgsService {
     private readonly events;
     /** Cancels the deleted org's running eval runs (in the delete's transaction). */
     private readonly evalBudget;
-    /** A new org gets the plugins its scope offers it (the scope sync, after the commit). */
+    /** A new org gets the plugins its scope offers it (the scope sync, owed with the org). */
     private readonly scopeSync;
     /** What the deleted org owns is transferred or removed in the delete's transaction (P3-20). */
     private readonly ownedItems;
+    /** Records `org.deleted` for the subscribing plugins in the delete's transaction. */
+    private readonly lifecycle;
     constructor(db: KernelDb, txHost: TransactionHost, settings: SettingsService, apiTokens: ApiTokenService, orgLock: OrgLock, events: KernelEvents, 
     /** Cancels the deleted org's running eval runs (in the delete's transaction). */
     evalBudget: Pick<EvalBudget, "cancelRuns">, 
-    /** A new org gets the plugins its scope offers it (the scope sync, after the commit). */
+    /** A new org gets the plugins its scope offers it (the scope sync, owed with the org). */
     scopeSync: Pick<PluginScopeSync, "enqueueOrg">, 
     /** What the deleted org owns is transferred or removed in the delete's transaction (P3-20). */
-    ownedItems: Pick<OwnedItems, "onOrgDeleted">);
+    ownedItems: Pick<OwnedItems, "onOrgDeleted">, 
+    /** Records `org.deleted` for the subscribing plugins in the delete's transaction. */
+    lifecycle: Pick<LifecycleHooks, "recordIn">);
     /**
      * Creates an org with the actor as owner, in the caller's transaction when there is one (the
      * setup wizard creates it with the account); a slug conflict is `org.slug_taken` either way, but
@@ -79,8 +84,9 @@ export declare class OrgsService {
      * sessions' current org pointing at it, and transfers or removes the plugins and promoted
      * components it owns ({@link OwnedItems.onOrgDeleted}, P3-20: shared ones become the platform's,
      * the others are removed, a removed plugin's extension taken out by its cleanup job after the
-     * commit); after the commit emits `org.deleted` (channel connections go with the org: the
-     * runtime's connection reads filter deleted orgs).
+     * commit) and owes the `org.deleted` lifecycle hook deliveries (outbox jobs); after the commit
+     * emits `org.deleted` (channel connections go with the org: the runtime's connection reads filter
+     * deleted orgs).
      */
     softDelete(orgId: string, actor: Account, actorTokenId?: string): Promise<void>;
     private softDeleteIn;

package/dist/orgs/orgs.service.js

@@ -15,6 +15,7 @@ import { cancelPendingRequests } from "../catalog/request-rules.js";
 import { PluginScopeSync } from "../catalog/scope-sync.js";
 import { ApiError } from "../errors.js";
 import { EvalBudget } from "../evals/budget.js";
+import { LifecycleHooks } from "../extensions/lifecycle-hooks.js";
 import { ApiTokenService } from "../identity/api-tokens.js";
 import { audit } from "../identity/audit.js";
 import { SettingsService } from "../identity/settings.js";
@@ -85,13 +86,16 @@ let OrgsService = class OrgsService {
     evalBudget;
     scopeSync;
     ownedItems;
+    lifecycle;
     constructor(db, txHost, settings, apiTokens, orgLock, events, 
     /** Cancels the deleted org's running eval runs (in the delete's transaction). */
     evalBudget, 
-    /** A new org gets the plugins its scope offers it (the scope sync, after the commit). */
+    /** A new org gets the plugins its scope offers it (the scope sync, owed with the org). */
     scopeSync, 
     /** What the deleted org owns is transferred or removed in the delete's transaction (P3-20). */
-    ownedItems) {
+    ownedItems, 
+    /** Records `org.deleted` for the subscribing plugins in the delete's transaction. */
+    lifecycle) {
         this.db = db;
         this.txHost = txHost;
         this.settings = settings;
@@ -101,6 +105,7 @@ let OrgsService = class OrgsService {
         this.evalBudget = evalBudget;
         this.scopeSync = scopeSync;
         this.ownedItems = ownedItems;
+        this.lifecycle = lifecycle;
     }
     /**
      * Creates an org with the actor as owner, in the caller's transaction when there is one (the
@@ -137,7 +142,7 @@ let OrgsService = class OrgsService {
             target: row.id,
             detail: { slug, name },
         });
-        afterCommit(() => this.scopeSync.enqueueOrg(row.id));
+        await this.scopeSync.enqueueOrg(row.id);
         return toOrg(row);
     }
     /** 账号所属的（未软删除的）组织及其角色，按创建时间升序。 */
@@ -222,8 +227,9 @@ let OrgsService = class OrgsService {
      * sessions' current org pointing at it, and transfers or removes the plugins and promoted
      * components it owns ({@link OwnedItems.onOrgDeleted}, P3-20: shared ones become the platform's,
      * the others are removed, a removed plugin's extension taken out by its cleanup job after the
-     * commit); after the commit emits `org.deleted` (channel connections go with the org: the
-     * runtime's connection reads filter deleted orgs).
+     * commit) and owes the `org.deleted` lifecycle hook deliveries (outbox jobs); after the commit
+     * emits `org.deleted` (channel connections go with the org: the runtime's connection reads filter
+     * deleted orgs).
      */
     async softDelete(orgId, actor, actorTokenId) {
         await this.softDeleteIn(orgId, actor, actorTokenId);
@@ -235,6 +241,13 @@ let OrgsService = class OrgsService {
             .set({ deleted_at: sql `now()` })
             .where("id", "=", orgId)
             .execute();
+        // the org's owed jobs go with it; dead letters stay for the overview, and the deletion's own
+        // cleanup work carries no org_id (transactional outbox spec §9)
+        await this.db
+            .deleteFrom("outbox")
+            .where("org_id", "=", orgId)
+            .where("dead_at", "is", null)
+            .execute();
         // after the org is marked deleted, so it counts as no user of what it shared (P3-18)
         await this.ownedItems.onOrgDeleted(orgId, actor.id, {
             ...(actorTokenId !== undefined && { actorTokenId }),
@@ -256,6 +269,8 @@ let OrgsService = class OrgsService {
             action: "org.deleted",
             target: orgId,
         });
+        // owed with the delete, carrying no org id, so the org's own outbox cleanup keeps them
+        await this.lifecycle.recordIn("org.deleted", { orgId });
         // channel connections follow the org after the root commit (none after a rollback)
         afterCommit(() => this.events.emit("org.deleted", { orgId }));
     }
@@ -279,6 +294,7 @@ OrgsService = __decorate([
     __param(5, Inject(KernelEvents)),
     __param(6, Inject(EvalBudget)),
     __param(7, Inject(PluginScopeSync)),
-    __param(8, Inject(OwnedItems))
+    __param(8, Inject(OwnedItems)),
+    __param(9, Inject(LifecycleHooks))
 ], OrgsService);
 export { OrgsService };

package/dist/overrides.d.ts

@@ -1,18 +1,24 @@
 import type { NestInterceptor } from "@nestjs/common";
 import { APP_INTERCEPTOR } from "@nestjs/core";
 import { ADMIN_USAGE_TIMINGS, type AdminUsageTimings } from "./admin/usage.service.js";
+import { SCOPE_BACKSTOP_DELAY } from "./catalog/scope-jobs.js";
 import { CHANNEL_WEBHOOK_TIMINGS, type ChannelWebhookTimings } from "./channels/webhook.js";
 import type { EvalReplayHooks } from "./evals/run-replay.js";
 import { EVAL_REPLAY_HOOKS } from "./evals/worker.js";
 import { BOOTSTRAP_LOCK_TTL } from "./extensions/bootstrap.js";
+import { USAGE_SUBSCRIBERS_CLOCK } from "./extensions/usage-subscribers.js";
 import { FILE_PREVIEW_TIMEOUT } from "./files/previewers.js";
+import { OUTBOX_DISPATCH_FAILS } from "./infra/outbox/outbox.dispatcher.js";
+import { OUTBOX_FAST_PATH_SETTLED } from "./infra/outbox/outbox.module.js";
+import { OUTBOX_STRICT_CONFLICTS } from "./infra/outbox/outbox.service.js";
 import { PRESENCE_INTERVAL_MS } from "./infra/presence/replica-presence.js";
+import type { KernelQueueName } from "./infra/queue/queue-names.js";
 import { LIST_MODELS_TIMEOUT } from "./runtime/providers.js";
 import { RUN_CONTEXT_CLOCK } from "./runtime/run-context.service.js";
+import { ENSURE_RUN_FAILS } from "./runtime/run-queue.js";
 import { AGENT_LOOP_FACTORY, type AgentLoopFactory } from "./runtime/run-steps.js";
 import { RUN_HOOKS, type RunHooks } from "./runtime/run-worker.js";
 import { SUBAGENT_MESSAGES_HOOKS, type SubagentMessagesHooks } from "./runtime/subagents/messages.js";
-import { USAGE_REPORT_RETRY, type UsageReportRetry } from "./runtime/usage-report.js";
 import { SANDBOX_LEASE_TIMINGS, type SandboxLeaseTimings } from "./sandbox/leases.js";
 import { SETUP_CHECK_TIMEOUT } from "./setup/setup-checks.service.js";
 import { TOOL_PIPELINE_HOOKS, type ToolPipelineHooks } from "./tools/pipeline.js";
@@ -26,13 +32,22 @@ import { EMBED_TOKEN_CLOCK } from "./ui/embed-token.js";
  * - `EVAL_REPLAY_HOOKS`: the hooks of the eval full-run replay and the judge;
  * - `TOOL_PIPELINE_HOOKS`: the tool pipeline's hooks and policy decision;
  * - `SUBAGENT_MESSAGES_HOOKS`: the sub-agent message tools' hooks (a send raced by a run's end);
- * - `BOOTSTRAP_LOCK_TTL`, `FILE_PREVIEW_TIMEOUT`, `LIST_MODELS_TIMEOUT`, `USAGE_REPORT_RETRY`,
+ * - `BOOTSTRAP_LOCK_TTL`, `FILE_PREVIEW_TIMEOUT`, `LIST_MODELS_TIMEOUT`,
  *   `SANDBOX_LEASE_TIMINGS`, `CHANNEL_WEBHOOK_TIMINGS`, `SETUP_CHECK_TIMEOUT`,
  *   `PRESENCE_INTERVAL_MS`: shorter timings;
  * - `ADMIN_USAGE_TIMINGS`: the usage aggregate's statement timeout and clock;
  * - `EMBED_TOKEN_CLOCK`: the clock embed tokens are issued and checked with;
  * - `RUN_CONTEXT_CLOCK`: the clock run start reads the run context's date from, and the
  *   `CurrentTime` builtin the time;
+ * - `OUTBOX_STRICT_CONFLICTS`: a reused outbox job id with different data throws (tests) instead
+ *   of logging an error;
+ * - `OUTBOX_DISPATCH_FAILS`: returns true to make the outbox dispatcher's adds to the given queue
+ *   fail (a Redis outage);
+ * - `USAGE_SUBSCRIBERS_CLOCK`: the clock the `usage.report` subscriber cache ages with;
+ * - `OUTBOX_FAST_PATH_SETTLED`: receives each detached outbox fast-path pass (a test awaits them);
+ * - `ENSURE_RUN_FAILS`: returns true to make `RunQueue.ensureRun` throw (Redis unreachable, or the
+ *   direct call after a commit skipped by a crash);
+ * - `SCOPE_BACKSTOP_DELAY`: the delay of a confirmation's scope sync backstop (ruling R24);
  * - `APP_INTERCEPTOR`: one more global interceptor (a probe of the matched routes).
  */
 interface KernelSeams {
@@ -44,7 +59,6 @@ interface KernelSeams {
     [BOOTSTRAP_LOCK_TTL]: number;
     [FILE_PREVIEW_TIMEOUT]: number;
     [LIST_MODELS_TIMEOUT]: number;
-    [USAGE_REPORT_RETRY]: UsageReportRetry;
     [SANDBOX_LEASE_TIMINGS]: Partial<SandboxLeaseTimings>;
     [CHANNEL_WEBHOOK_TIMINGS]: Partial<ChannelWebhookTimings>;
     [SETUP_CHECK_TIMEOUT]: number;
@@ -52,6 +66,12 @@ interface KernelSeams {
     [ADMIN_USAGE_TIMINGS]: Partial<AdminUsageTimings>;
     [EMBED_TOKEN_CLOCK]: () => number;
     [RUN_CONTEXT_CLOCK]: () => number;
+    [OUTBOX_STRICT_CONFLICTS]: boolean;
+    [OUTBOX_DISPATCH_FAILS]: (queue: KernelQueueName) => boolean;
+    [USAGE_SUBSCRIBERS_CLOCK]: () => number;
+    [OUTBOX_FAST_PATH_SETTLED]: (pass: Promise<void>) => void;
+    [ENSURE_RUN_FAILS]: () => boolean;
+    [SCOPE_BACKSTOP_DELAY]: number;
     [APP_INTERCEPTOR]: NestInterceptor;
 }
 /**

package/dist/overrides.js

@@ -1,16 +1,21 @@
 import { APP_INTERCEPTOR } from "@nestjs/core";
 import { ADMIN_USAGE_TIMINGS } from "./admin/usage.service.js";
+import { SCOPE_BACKSTOP_DELAY } from "./catalog/scope-jobs.js";
 import { CHANNEL_WEBHOOK_TIMINGS } from "./channels/webhook.js";
 import { EVAL_REPLAY_HOOKS } from "./evals/worker.js";
 import { BOOTSTRAP_LOCK_TTL } from "./extensions/bootstrap.js";
+import { USAGE_SUBSCRIBERS_CLOCK } from "./extensions/usage-subscribers.js";
 import { FILE_PREVIEW_TIMEOUT } from "./files/previewers.js";
+import { OUTBOX_DISPATCH_FAILS } from "./infra/outbox/outbox.dispatcher.js";
+import { OUTBOX_FAST_PATH_SETTLED } from "./infra/outbox/outbox.module.js";
+import { OUTBOX_STRICT_CONFLICTS } from "./infra/outbox/outbox.service.js";
 import { PRESENCE_INTERVAL_MS } from "./infra/presence/replica-presence.js";
 import { LIST_MODELS_TIMEOUT } from "./runtime/providers.js";
 import { RUN_CONTEXT_CLOCK } from "./runtime/run-context.service.js";
+import { ENSURE_RUN_FAILS } from "./runtime/run-queue.js";
 import { AGENT_LOOP_FACTORY } from "./runtime/run-steps.js";
 import { RUN_HOOKS } from "./runtime/run-worker.js";
 import { SUBAGENT_MESSAGES_HOOKS, } from "./runtime/subagents/messages.js";
-import { USAGE_REPORT_RETRY } from "./runtime/usage-report.js";
 import { SANDBOX_LEASE_TIMINGS } from "./sandbox/leases.js";
 import { SETUP_CHECK_TIMEOUT } from "./setup/setup-checks.service.js";
 import { TOOL_PIPELINE_HOOKS } from "./tools/pipeline.js";
@@ -24,7 +29,7 @@ const SEAM_TOKENS = [
     BOOTSTRAP_LOCK_TTL,
     FILE_PREVIEW_TIMEOUT,
     LIST_MODELS_TIMEOUT,
-    USAGE_REPORT_RETRY,
+    USAGE_SUBSCRIBERS_CLOCK,
     SANDBOX_LEASE_TIMINGS,
     CHANNEL_WEBHOOK_TIMINGS,
     SETUP_CHECK_TIMEOUT,
@@ -32,6 +37,11 @@ const SEAM_TOKENS = [
     ADMIN_USAGE_TIMINGS,
     EMBED_TOKEN_CLOCK,
     RUN_CONTEXT_CLOCK,
+    OUTBOX_STRICT_CONFLICTS,
+    OUTBOX_DISPATCH_FAILS,
+    OUTBOX_FAST_PATH_SETTLED,
+    ENSURE_RUN_FAILS,
+    SCOPE_BACKSTOP_DELAY,
     APP_INTERCEPTOR,
 ];
 const allSeamsListed = true;

package/dist/platform/exclusions.js

@@ -95,6 +95,11 @@ export const PLATFORM_EXCLUSIONS = [
         category: "human-only",
         reason: "Confirms an import review, an approval decision by the super admin",
     },
+    {
+        route: "POST /api/v1/admin/catalog/imports/:stagingId/update",
+        category: "human-only",
+        reason: "Confirms an import review together with the platform update it applies, an approval decision by the super admin",
+    },
     {
         route: "GET /api/v1/admin/catalog/items/:id/icon",
         category: "transport",

package/dist/platform/ops/admin.ops.js

@@ -78,6 +78,22 @@ function attentionRows(a) {
                     ? `Check the provider's deployment config and connection on its extension page (/admin/extensions/${p.plugin}); the models page (/admin/models) shows the list.`
                     : "The provider lists no chat model that is switched on: switch one on in the admin console (/admin/models) or check the provider's config.",
             })),
+            ...a.outbox.map((o) => ({
+                kind: "outbox",
+                id: o.kind,
+                name: "Background work that could not be queued",
+                state: "dead",
+                reason: `${o.count} dead outbox row(s), the oldest dead since ${o.oldestAt}`,
+                next: "List them with admin.outbox-list-dead, then retry each with admin.outbox-retry or drop it with admin.outbox-discard.",
+            })),
+            ...a.queue.map((q) => ({
+                kind: "queue",
+                id: q.kind,
+                name: "The queue lost background jobs",
+                state: "lost_jobs",
+                reason: `${q.count} queued run job(s) were missing from the queue, the last at ${q.lastAt}; they were queued again`,
+                next: "Redis lost data: check its persistence (AOF or snapshots) and whether it restarted or evicted keys. Nothing to do per run; the item clears a week after the last loss.",
+            })),
         ],
         more: a.more,
         unavailable: a.unavailable,
@@ -127,7 +143,7 @@ let AdminOperations = class AdminOperations {
         this.registry.register([
             defineOperation({
                 id: "admin.overview",
-                description: "The admin console's dashboard numbers (super admin): orgs, accounts and attentionTotal, everything waiting for a super admin (the platform inbox total plus the extensions, plugin updates and model providers admin.attention lists); partial is true when one of those lists could not be read right now (attentionTotal then leaves it out).",
+                description: "The admin console's dashboard numbers (super admin): orgs, accounts and attentionTotal, everything waiting for a super admin (the platform inbox total plus the extensions, plugin updates and model providers admin.attention lists, every dead outbox row and the lost-jobs item of the run queue); partial is true when one of those lists could not be read right now (attentionTotal then leaves it out).",
                 input: z.object({}).strict(),
                 example: {},
                 authz: { superAdmin: true },
@@ -137,7 +153,7 @@ let AdminOperations = class AdminOperations {
             }),
             defineOperation({
                 id: "admin.attention",
-                description: "What needs the super admin besides the platform inbox (super admin), one compact row each (kind, id, name, state, reason, next step): extensions (reason config, load_failed, approval, dependency, conflict, converging or legacy_format), platform plugins with a newer marketplace version (reason names both versions) and model providers (reason list_failed or no_chat_model). Each kind lists at most 20 rows; more counts the rest per kind. unavailable names a kind that could not be read right now (try again later). The platform inbox itself is inbox.platform-list.",
+                description: "What needs the super admin besides the platform inbox (super admin), one compact row each (kind, id, name, state, reason, next step): extensions (reason config, load_failed, approval, dependency, conflict, converging or legacy_format), platform plugins with a newer marketplace version (reason names both versions) model providers (reason list_failed or no_chat_model) background work the kernel could not queue (kind outbox: how many outbox rows are dead and since when) and run jobs the queue lost (kind queue: Redis lost data; the runs were queued again). Each kind lists at most 20 rows; more counts the rest per kind. unavailable names a kind that could not be read right now (try again later). The platform inbox itself is inbox.platform-list.",
                 input: z.object({}).strict(),
                 example: {},
                 authz: { superAdmin: true },

package/dist/platform/ops/catalog-admin.ops.d.ts

@@ -2,6 +2,7 @@ import { type OnModuleInit } from "@nestjs/common";
 import { type AppearanceResult, AppearanceService } from "../../catalog/appearance.service.js";
 import { CatalogService } from "../../catalog/catalog.service.js";
 import { CatalogScopeService } from "../../catalog/catalog-scope.service.js";
+import { PlatformImportUpdate } from "../../catalog/platform-import-update.js";
 import { PluginImport, type PluginReview } from "../../catalog/plugin-import.js";
 import { KernelDb } from "../../infra/database/kernel-db.js";
 import { ThemesService } from "../../themes/themes.service.js";
@@ -70,10 +71,11 @@ export declare class CatalogAdminOperations implements OnModuleInit {
     private readonly catalog;
     private readonly scope;
     private readonly pluginImport;
+    private readonly importUpdate;
     private readonly kdb;
     private readonly appearance;
     private readonly themes;
-    constructor(registry: PlatformOperations, catalog: CatalogService, scope: CatalogScopeService, pluginImport: PluginImport, kdb: KernelDb, appearance: AppearanceService, themes: ThemesService);
+    constructor(registry: PlatformOperations, catalog: CatalogService, scope: CatalogScopeService, pluginImport: PluginImport, importUpdate: PlatformImportUpdate, kdb: KernelDb, appearance: AppearanceService, themes: ThemesService);
     /** The precheck refusal of another org's private plugin (the phase-1 rule), else null. */
     private otherOrgs;
     /** Whether an org owns the item (its owner org manages it, not the super admin's agent). */

package/dist/platform/ops/catalog-admin.ops.js

@@ -14,6 +14,7 @@ import { CatalogDisabledBody, CatalogGitImportBody, CatalogIdPathParams, Catalog
 import { AppearanceService } from "../../catalog/appearance.service.js";
 import { CatalogService } from "../../catalog/catalog.service.js";
 import { CatalogScopeService } from "../../catalog/catalog-scope.service.js";
+import { PlatformImportUpdate } from "../../catalog/platform-import-update.js";
 import { PluginImport } from "../../catalog/plugin-import.js";
 import { ApiError } from "../../errors.js";
 import { KernelDb } from "../../infra/database/kernel-db.js";
@@ -125,14 +126,16 @@ let CatalogAdminOperations = class CatalogAdminOperations {
     catalog;
     scope;
     pluginImport;
+    importUpdate;
     kdb;
     appearance;
     themes;
-    constructor(registry, catalog, scope, pluginImport, kdb, appearance, themes) {
+    constructor(registry, catalog, scope, pluginImport, importUpdate, kdb, appearance, themes) {
         this.registry = registry;
         this.catalog = catalog;
         this.scope = scope;
         this.pluginImport = pluginImport;
+        this.importUpdate = importUpdate;
         this.kdb = kdb;
         this.appearance = appearance;
         this.themes = themes;
@@ -313,6 +316,30 @@ let CatalogAdminOperations = class CatalogAdminOperations {
                     };
                 },
             }),
+            defineOperation({
+                id: "plugins.import-update-preview",
+                description: "Preview what a staged new version of an installed platform plugin does as the platform update (super admin): every component's change, the extension step and the org connectors it touches. Nothing is imported or changed; the person confirms the review and the update together on the web (reviewUrl).",
+                input: z.object({ stagingId: StagingId }).strict(),
+                example: { stagingId: "3f1c2a9e-5b7d-4e21-9c0a-1d2e3f4a5b6c" },
+                authz: { superAdmin: true },
+                mirrors: ["GET /api/v1/admin/catalog/imports/:stagingId/update-preview"],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "plugin.staging_not_found",
+                        next: "The staged import expired (24 hours) or was confirmed already: prepare it again with plugins.import-npm or plugins.import-git.",
+                    },
+                    {
+                        code: "plugin.upgrade_target_invalid",
+                        next: "The plugin is not installed on the platform yet (reason not_installed: the review installs it), or the platform cannot move to this version (the details say why).",
+                    },
+                ],
+                run: async (input) => ({
+                    preview: await this.importUpdate.preview(input.stagingId),
+                    reviewUrl: reviewUrl(input.stagingId),
+                    next: CONFIRM_ON_WEB,
+                }),
+            }),
             defineOperation({
                 id: "plugins.scope-preview",
                 description: "Preview changing where a platform plugin is on (super admin): a scope (all: every org; optional: orgs switch it on; named: only the orgs listed, with orgs) or disabled: true (off everywhere). Returns the orgs that lose it (with the agents there), the components it takes back, name conflicts, and the scopeHash plugins.set-scope or plugins.set-disabled needs. Nothing is written; show the preview to the person first.",
@@ -675,8 +702,9 @@ CatalogAdminOperations = __decorate([
     __param(1, Inject(CatalogService)),
     __param(2, Inject(CatalogScopeService)),
     __param(3, Inject(PluginImport)),
-    __param(4, Inject(KernelDb)),
-    __param(5, Inject(AppearanceService)),
-    __param(6, Inject(ThemesService))
+    __param(4, Inject(PlatformImportUpdate)),
+    __param(5, Inject(KernelDb)),
+    __param(6, Inject(AppearanceService)),
+    __param(7, Inject(ThemesService))
 ], CatalogAdminOperations);
 export { CatalogAdminOperations };

package/dist/platform/ops/inbox.ops.js

@@ -34,12 +34,10 @@ const ADMIN_CONSOLE_PENDING = "Review it in the admin console (plugins, pending
 const requestName = (r) => r.item?.name ?? r.entry?.name ?? r.agent?.name ?? r.kind;
 const requester = (r) => r.requestedByName ?? "a deleted account";
 /** The name an org notice is about. */
-const orgNoticeName = (n) => n.kind === "skill_renamed" ? n.skillRenamed.to : n.detail.name;
+const orgNoticeName = (n) => n.detail.name;
 /** An org notice in one English sentence, as the inbox tells it. */
 function orgNoticeSummary(n) {
     switch (n.kind) {
-        case "skill_renamed":
-            return `Skill "${n.skillRenamed.from}" was renamed to "${n.skillRenamed.to}": a platform skill on in this org has its name; agents keep it.`;
         case "item_shared": {
             const d = n.detail;
             return `${d.ref.kind} ${d.name} was shared with ${d.org === "all_orgs" ? "every org" : d.org.name}.`;
@@ -182,18 +180,6 @@ function platformRow(i) {
                 next: "Open the plugin in the admin console to see the error and retry.",
             };
         }
-        case "platform_migration": {
-            const r = i.run;
-            const failed = r.itemsFailed.slice(0, 5).join(", ");
-            return {
-                ...base,
-                name: "platform components migration",
-                state: r.stuck ? "stuck" : "failed",
-                summary: r.stuck
-                    ? "The platform components migration run has not finished for over an hour; its worker stopped. The next run starts at the next worker start or day."
-                    : `The platform components migration could not write ${r.itemsFailed.length} catalog item(s): ${failed}${r.itemsFailed.length > 5 ? ", …" : ""}. The next run tries them again.`,
-            };
-        }
         case "ownership_transferred":
             return {
                 ...base,
@@ -243,9 +229,7 @@ let InboxOperations = class InboxOperations {
         if (row === undefined)
             return null;
         const base = { id: row.id, createdAt: row.created_at.toISOString() };
-        return (row.kind === "skill_renamed"
-            ? { ...base, kind: row.kind, skillRenamed: row.detail }
-            : { ...base, kind: row.kind, detail: row.detail });
+        return { ...base, kind: row.kind, detail: row.detail };
     }
     /** A platform notice by id (dismissed or not), or null. */
     async platformNotice(id) {
@@ -292,7 +276,7 @@ let InboxOperations = class InboxOperations {
             }),
             defineOperation({
                 id: "inbox.dismiss-notice",
-                description: "Dismiss an org notice from the inbox for every org admin (org admins): the id of a notice row from inbox.list (types skill_renamed, item_shared, shared_item_updated, upload_confirmed, upload_rejected). Approvals and requests are not dismissed here: they are decided on the web.",
+                description: "Dismiss an org notice from the inbox for every org admin (org admins): the id of a notice row from inbox.list (types item_shared, shared_item_updated, upload_confirmed, upload_rejected). Approvals and requests are not dismissed here: they are decided on the web.",
                 input: NoticeInput,
                 example: NOTICE_EXAMPLE,
                 authz: { orgAction: "catalog.decide" },
@@ -323,7 +307,7 @@ let InboxOperations = class InboxOperations {
             }),
             defineOperation({
                 id: "inbox.platform-list",
-                description: "List the platform inbox (super admin), newest first, one compact row each (type, what, state, summary, next step): orgs' requests to the platform, plugins waiting for a permission confirmation, this org's uploads waiting for you, failed scope syncs, a failed or stuck components migration and ownership notices. Only the newest 100 items are read (truncated: more wait); listed is how many of them are shown, otherOrgItems how many are items of plugins other orgs own (only counted). total counts everything waiting on the platform, other orgs' items included, as the admin console does; byType splits total by type (everything waiting, not the listed page). Nothing is decided here: requests and confirmations are done in the admin console. Pages by 50: pass the returned next as params.cursor.",
+                description: "List the platform inbox (super admin), newest first, one compact row each (type, what, state, summary, next step): orgs' requests to the platform, plugins waiting for a permission confirmation, this org's uploads waiting for you, failed scope syncs and ownership notices. Only the newest 100 items are read (truncated: more wait); listed is how many of them are shown, otherOrgItems how many are items of plugins other orgs own (only counted). total counts everything waiting on the platform, other orgs' items included, as the admin console does; byType splits total by type (everything waiting, not the listed page). Nothing is decided here: requests and confirmations are done in the admin console. Pages by 50: pass the returned next as params.cursor.",
                 input: z.object({ cursor: Cursor.optional() }).strict(),
                 example: {},
                 authz: { superAdmin: true },

package/dist/platform/ops/outbox.ops.d.ts

@@ -0,0 +1,21 @@
+import { type OnModuleInit } from "@nestjs/common";
+import { OutboxDeadService } from "../../admin/outbox-dead.service.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
+import { PlatformOperations } from "../registry.js";
+/**
+ * The super admin's dead outbox rows through the `Platform` tool (transactional outbox spec
+ * §3.4): the list, retry and discard of `/api/v1/admin/outbox/dead*`, run through the same
+ * service. Dead rows are the deployment's, not an org's: the operations act on all of them.
+ */
+export declare class OutboxOperations implements OnModuleInit {
+    private readonly registry;
+    private readonly dead;
+    private readonly kdb;
+    constructor(registry: PlatformOperations, dead: OutboxDeadService, kdb: KernelDb);
+    /** The dead row's job (queue and name) for a card, or null when no dead row has the id. */
+    private jobOf;
+    private precheck;
+    /** "job-name on queue" for a card, or the bare id when the row is gone. */
+    private label;
+    onModuleInit(): void;
+}

package/dist/platform/ops/outbox.ops.js

@@ -0,0 +1,125 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { z } from "zod";
+import { OutboxDeadParams } from "../../admin/outbox-dead.schemas.js";
+import { OutboxDeadService } from "../../admin/outbox-dead.service.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
+import { defineOperation } from "../operation.js";
+import { PlatformOperations } from "../registry.js";
+import { viaAgent } from "./errors.js";
+const DeadIdInput = OutboxDeadParams.strict();
+/**
+ * The super admin's dead outbox rows through the `Platform` tool (transactional outbox spec
+ * §3.4): the list, retry and discard of `/api/v1/admin/outbox/dead*`, run through the same
+ * service. Dead rows are the deployment's, not an org's: the operations act on all of them.
+ */
+let OutboxOperations = class OutboxOperations {
+    registry;
+    dead;
+    kdb;
+    constructor(registry, dead, kdb) {
+        this.registry = registry;
+        this.dead = dead;
+        this.kdb = kdb;
+    }
+    /** The dead row's job (queue and name) for a card, or null when no dead row has the id. */
+    async jobOf(id) {
+        const row = await this.kdb.db
+            .selectFrom("outbox")
+            .select(["queue", "job_name"])
+            .where("id", "=", id)
+            .where("dead_at", "is not", null)
+            .executeTakeFirst();
+        return row ?? null;
+    }
+    async precheck(id) {
+        return (await this.jobOf(id)) === null
+            ? { ok: false, code: "outbox.not_found", message: `No dead outbox row ${id}.` }
+            : { ok: true };
+    }
+    /** "job-name on queue" for a card, or the bare id when the row is gone. */
+    async label(id) {
+        const job = await this.jobOf(id);
+        return job === null ? `#${id}` : `${job.job_name} (${job.queue}, #${id})`;
+    }
+    onModuleInit() {
+        this.registry.register([
+            defineOperation({
+                id: "admin.outbox-list-dead",
+                description: "List background work the kernel could not queue (super admin): outbox rows dead after their last delivery attempt, oldest first (at most 200), each with its id, queue, job name, job id, org (null for platform work), attempts, last error and when it died. Retry one with admin.outbox-retry or drop it with admin.outbox-discard.",
+                input: z.object({}).strict(),
+                example: {},
+                authz: { superAdmin: true },
+                mirrors: ["GET /api/v1/admin/outbox/dead"],
+                confirm: "read",
+                run: () => this.dead.list(),
+            }),
+            defineOperation({
+                id: "admin.outbox-retry",
+                description: "Queue a dead outbox row again (super admin): it gets fresh attempts and is delivered right away. When the same job is already owed by a pending row, the dead copy is discarded instead; outcome says which (retried or already_owed). A job whose subject is gone since is harmless: it finds nothing to do. The platform audit log records it.",
+                input: DeadIdInput,
+                example: { id: "42" },
+                authz: { superAdmin: true },
+                mirrors: ["POST /api/v1/admin/outbox/dead/:id/retry"],
+                confirm: "platform",
+                errors: [
+                    {
+                        code: "outbox.not_found",
+                        next: "The row is no longer dead (retried, discarded or delivered): list the dead rows again with admin.outbox-list-dead.",
+                    },
+                ],
+                precheck: (i) => this.precheck(i.id),
+                summary: async (i) => {
+                    const job = await this.label(i.id);
+                    return {
+                        zh: `重新排入无法排入队列的后台任务 ${job}`,
+                        en: `Queue background work that could not be queued again: ${job}`,
+                    };
+                },
+                run: (input, ctx) => this.dead.retry(input.id, { accountId: ctx.actorAccountId }, viaAgent("admin.outbox-retry", ctx)),
+            }),
+            defineOperation({
+                id: "admin.outbox-discard",
+                description: "Discard a dead outbox row (super admin): its job is never run. Use it only when the work is no longer wanted; to run it, use admin.outbox-retry. The platform audit log records it.",
+                input: DeadIdInput,
+                example: { id: "42" },
+                authz: { superAdmin: true },
+                mirrors: ["DELETE /api/v1/admin/outbox/dead/:id"],
+                confirm: "platform",
+                errors: [
+                    {
+                        code: "outbox.not_found",
+                        next: "The row is no longer dead (retried, discarded or delivered): list the dead rows again with admin.outbox-list-dead.",
+                    },
+                ],
+                precheck: (i) => this.precheck(i.id),
+                summary: async (i) => {
+                    const job = await this.label(i.id);
+                    return {
+                        zh: `丢弃无法排入队列的后台任务 ${job}，它不会再运行`,
+                        en: `Discard background work that could not be queued: ${job}; it will never run`,
+                    };
+                },
+                run: async (input, ctx) => {
+                    await this.dead.discard(input.id, { accountId: ctx.actorAccountId }, viaAgent("admin.outbox-discard", ctx));
+                    return { id: input.id, discarded: true };
+                },
+            }),
+        ]);
+    }
+};
+OutboxOperations = __decorate([
+    Injectable(),
+    __param(0, Inject(PlatformOperations)),
+    __param(1, Inject(OutboxDeadService)),
+    __param(2, Inject(KernelDb))
+], OutboxOperations);
+export { OutboxOperations };

package/dist/platform/ops/platform.ops.d.ts

@@ -32,6 +32,7 @@ export declare class PlatformOperationsProvider implements OnModuleInit {
      * default-on spec §8): every tool the org offers that the definition does not turn off, builtins
      * by name, extension tools as `plugin__<plugin>__<tool>`, connector tools as
      * `mcp__<slug>__<tool>`; the ones that cannot load now are listed with the registry's reason.
+     * Listed for the source of the conversation the operation runs in (memory plugin spec §6.2).
      */
     private toolKeys;
     onModuleInit(): void;