@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.25

package/dist/catalog/catalog-scope.service.js

@@ -8,7 +8,6 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { createHash } from "node:crypto";
-import { getQueueToken } from "@nestjs/bullmq";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ApiError } from "../errors.js";
@@ -19,20 +18,21 @@ import { PluginInstallLock } from "../extensions/locks.js";
 import { audit } from "../identity/audit.js";
 import { SuperAdminLock } from "../identity/super-admin.js";
 import { addOrgNotice, itemDisplayName, notifyItemShared } from "../inbox/org-notices.js";
-import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { OrgLock } from "../orgs/org-lock.js";
-import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
 import { assertNotPlatformDefault, themesPreview, } from "../themes/theme-usage.js";
 import { CatalogService } from "./catalog.service.js";
 import { assertOrgsExist, markVersionApplied } from "./catalog-items.js";
 import { nameConflictError } from "./component-scope.service.js";
 import { agentsUsing, COMPONENT_KINDS, componentOffered, componentOn, listedIn, loadComponents, loadScopeState, pluginFactsOf, skillNameClashes, switchOf, themeIdClashes, } from "./component-state.js";
-import { ownedPluginCleanupJob } from "./job-ids.js";
+import { oweOwnedPluginCleanup } from "./job-ids.js";
+import { CatalogItemLock } from "./locks.js";
 import { assertNotAwaiting, assertOwnerListed, assertShareable, assertShareableTarget, itemRemovedError, newlySharedWith, ownerOf, ownersOf, PLATFORM_OWNER, packageOwner, pendingDigest, releaseExtensionClaim, } from "./ownership.js";
+import { PlanStale, PlatformComponents } from "./platform-components.js";
 import { PluginImport } from "./plugin-import.js";
 import { PluginInstaller } from "./plugin-install.js";
 import { PlatformPluginUpdater } from "./plugin-upgrade.js";
@@ -90,10 +90,10 @@ export function conflictsError(conflicts) {
 }
 /**
  * The super admin's plugin scope and deployment-level disable (plugin and component management
- * spec §4.1, §5 rules 2-4 and 8), and the import confirm that enqueues the scope sync of the item it
+ * spec §4.1, §5 rules 2-4 and 8), and the import confirm that owes the scope sync of the item it
  * wrote. A change is previewed, then confirmed with the preview's `scopeHash`, recomputed under the
  * item row lock (a difference -> 409 `plugin.scope_stale`); it bumps `scope_version`, audits
- * `catalog.scope_changed` and, after the commit, enqueues the item's scope sync, which installs or
+ * `catalog.scope_changed` and owes the item's scope sync in the same transaction, which installs or
  * uninstalls in every org. Disabling keeps the scope, its org list and the org switches, so
  * re-enabling (no hash needed) reinstalls where it was on. Builtin items -> 409 `plugin.builtin`.
  * Stateless, shared by every replica.
@@ -103,6 +103,8 @@ let CatalogScopeService = class CatalogScopeService {
     adminLock;
     catalog;
     pluginImport;
+    platform;
+    itemLock;
     installer;
     extensions;
     ops;
@@ -111,22 +113,28 @@ let CatalogScopeService = class CatalogScopeService {
     orgLock;
     installLock;
     lifecycle;
-    maintenance;
+    outbox;
     log;
     txHost;
-    constructor(kdb, adminLock, catalog, pluginImport, installer, extensions, ops, sync, updater, 
+    constructor(kdb, adminLock, catalog, pluginImport, 
+    /** A confirmed first version's platform components (written in the confirming commit). */
+    platform, 
+    /** The import's item name lock, taken by the confirming commit before the item row. */
+    itemLock, installer, extensions, ops, sync, updater, 
     /** The owner org's lock: an org admin withdrawing its pending upload (ruling P3-10). */
     orgLock, 
     /** The per-name install lock a reject / withdraw releases the name claim under (M1). */
     installLock, 
     /** This replica's reconcile once a confirmed extension is enabled (before the scope sync). */
     lifecycle, 
-    /** The removed org plugin's cleanup job, backing the take-out of P3-21 (pre-flight F9). */
-    maintenance, log, txHost) {
+    /** Owes the scope syncs and the removed org plugin's cleanup (P3-21, pre-flight F9). */
+    outbox, log, txHost) {
         this.kdb = kdb;
         this.adminLock = adminLock;
         this.catalog = catalog;
         this.pluginImport = pluginImport;
+        this.platform = platform;
+        this.itemLock = itemLock;
         this.installer = installer;
         this.extensions = extensions;
         this.ops = ops;
@@ -135,7 +143,7 @@ let CatalogScopeService = class CatalogScopeService {
         this.orgLock = orgLock;
         this.installLock = installLock;
         this.lifecycle = lifecycle;
-        this.maintenance = maintenance;
+        this.outbox = outbox;
         this.log = log;
         this.txHost = txHost;
     }
@@ -144,13 +152,13 @@ let CatalogScopeService = class CatalogScopeService {
     }
     /**
      * Confirms a staged import ({@link PluginImport.confirm}: installs and enables the extension,
-     * writes the new item's scope), then enqueues the item's scope sync when its scope turns it on
+     * writes the new item's scope), then owes the item's scope sync when its scope turns it on
      * by itself (`all` or `named`; an `optional` item is on only where an org admin switches it on).
      */
     async confirmImport(actor, stagingId, input, opts = {}) {
         const r = await this.pluginImport.confirm(actor, stagingId, input, opts);
         if (r.item.scope !== "optional")
-            await this.enqueue(r.item.id);
+            await this.oweSync(r.item.id);
         return r;
     }
     /**
@@ -177,6 +185,7 @@ let CatalogScopeService = class CatalogScopeService {
             "owner_org_id",
             "awaiting_confirmation",
             "pending_version",
+            "scope",
         ])
             .where("id", "=", itemId)
             .where("deleted_at", "is", null)
@@ -223,10 +232,15 @@ let CatalogScopeService = class CatalogScopeService {
             if (!disabled || !(e instanceof ApiError && e.code === "extension.not_pending"))
                 throw e;
         }
+        // The permissions are confirmed (a stale hash refused above): the backstop before the enable
+        // (ruling R24), so a crash before the post-deploy add below still converges the orgs; only
+        // when the item's scope turns it on by itself, as the import's commit
+        if (item.scope !== "optional")
+            await this.oweBackstop(itemId);
         // An occupied single-provider point leaves it installed disabled (the admin view says why)
         if (disabled)
             await this.ops.enableUnlessOccupied(item.name, actor, opts.actorTokenId);
-        await this.enqueue(itemId);
+        await this.oweSync(itemId);
         return (await this.catalog.get(itemId)).item;
     }
     /**
@@ -236,9 +250,10 @@ let CatalogScopeService = class CatalogScopeService {
      * pending version (withdrawn, rejected, replaced by one without an extension) -> 409
      * `extension.not_pending`.
      *
-     * A first version: its extension installed, its permissions approved, enabled, then (one
-     * transaction) the item stops waiting and the owner is told (`upload_confirmed`); after the
-     * commit its platform components are written and the scope sync enqueued. Each step re-reads
+     * A first version: its platform components planned and their files copied (keyed by content),
+     * its extension installed, its permissions approved, enabled, then (one transaction) the item
+     * stops waiting, its platform component rows are written and the owner is told
+     * (`upload_confirmed`); after the commit the scope sync is owed. Each step re-reads
      * the item under its row lock: removed meanwhile -> 409 `catalog.item_removed`, the pending
      * version replaced -> `extension.approval_stale`; the extension this confirmation installed is
      * then taken out again. A new version: the platform update to it
@@ -255,14 +270,13 @@ let CatalogScopeService = class CatalogScopeService {
             // (the enable does not wait for the reconcile); a sync on a replica that has not loaded it
             // yet defers and retries (ruling P3-38)
             await reconcileWithin(this.lifecycle, `confirmed:${item.name}`, CONFIRM_RECONCILE_WAIT_MS, this.log);
-            await this.pluginImport.writePlatformComponents(item.id, first);
-            await this.enqueue(item.id);
+            await this.oweSync(item.id);
         }
         return (await this.catalog.get(item.id)).item;
     }
     /**
-     * {@link confirmOrgUpload} under the item lock; returns the confirmed first version (its
-     * platform components and scope sync follow after), null for a new version.
+     * {@link confirmOrgUpload} under the item lock; returns the confirmed first version (its scope
+     * sync follows after), null for a new version.
      */
     async confirmLocked(actor, itemId, name, permissionsHash, opts) {
         // Read again under the lock (the caller's read was outside it)
@@ -358,6 +372,8 @@ let CatalogScopeService = class CatalogScopeService {
         await this.stillPending(itemId, name, version);
         let installedHere = false;
         try {
+            // Planned and copied before any transaction; the rows are written by the confirming commit
+            const components = await this.platform.prepareSync(itemId, version, { confirming: true });
             if (install?.sha256 !== sha) {
                 await this.ops.install(name, sha, actor, opts.actorTokenId, {
                     catalogItemId: itemId,
@@ -370,7 +386,7 @@ let CatalogScopeService = class CatalogScopeService {
             await this.stillPending(itemId, name, version);
             // An occupied single-provider point leaves it installed disabled (the admin view says why)
             await this.ops.enableUnlessOccupied(name, actor, opts.actorTokenId);
-            await this.finishFirstVersion(actor, itemId, version, opts);
+            await this.finishFirstVersion(actor, itemId, version, components, opts);
         }
         catch (e) {
             // Taken out only when this confirmation did not win: the item gone or still waiting
@@ -466,47 +482,62 @@ let CatalogScopeService = class CatalogScopeService {
     /**
      * An extension a confirmation installed whose item was removed or replaced meanwhile is taken
      * out again (disabled, uninstalled; P3-21), and the name claim released when the item is gone
-     * (ruling P3-37). Inline and best effort (a failure is logged); a removed item's cleanup job
-     * (`owned-plugin-cleanup-<itemId>`, idempotent) is enqueued as well, so a failed take-out is
-     * retried (pre-flight F9).
+     * (ruling P3-37), in one transaction ({@link takeOutIn}). Inline (a failure is logged): when the
+     * take-out fails, a removed item's cleanup job (`owned-plugin-cleanup-<itemId>`, idempotent) is
+     * owed instead, so the job retries it (pre-flight F9). That owe is the last resort: when it
+     * fails too (PG unavailable) nothing retries the take-out, and it is logged as an error.
      */
     async takeOut(itemId, name, actor, opts) {
         try {
-            await this.ops.disable(name, actor, opts.actorTokenId);
-            await this.ops.uninstall(name, actor, opts.actorTokenId);
-            await this.releaseIfGone(itemId, name);
+            await this.takeOutIn(itemId, name, actor, opts);
+            return;
         }
         catch (err) {
             this.log.error("taking out the extension of a removed org upload failed", { name, err });
         }
-        const gone = await this.db
-            .selectFrom("catalog_items")
-            .select("id")
-            .where("id", "=", itemId)
-            .where("deleted_at", "is not", null)
-            .executeTakeFirst();
-        if (gone === undefined)
-            return;
-        const job = ownedPluginCleanupJob(itemId);
         try {
-            await this.maintenance.add(job.name, job.data, job.opts);
+            await this.oweCleanupIfGone(itemId);
         }
         catch (err) {
-            this.log.warn("enqueueing the owned plugin cleanup failed", { itemId, err });
+            this.log.error("owing the owned plugin cleanup failed; the take-out is not retried", {
+                itemId,
+                err,
+            });
         }
     }
-    /** Releases the name claim of a removed item (nothing installed under it any more). */
-    async releaseIfGone(itemId, name) {
+    /**
+     * {@link takeOut}'s transaction, in the global lock order (ruling P3-50): the super admin lock,
+     * the item row, then the extension's install lock (taken by the disable): disabled,
+     * uninstalled, and the name claim released when the item is gone.
+     */
+    async takeOutIn(itemId, name, actor, opts) {
+        await this.adminLock.lockAndAuthorize(actor);
         const row = await this.db
             .selectFrom("catalog_items")
             .select(["deleted_at", "package_name"])
             .where("id", "=", itemId)
             .forUpdate()
             .executeTakeFirst();
+        await this.ops.disable(name, actor, opts.actorTokenId);
+        await this.ops.uninstall(name, actor, opts.actorTokenId);
         if (row === undefined || row.deleted_at !== null) {
             await releaseExtensionClaim(this.db, name, row?.package_name ?? null);
         }
     }
+    /**
+     * Owes the cleanup of a removed item; a live item owes nothing (a removal committing later owes
+     * its own).
+     */
+    async oweCleanupIfGone(itemId) {
+        const gone = await this.db
+            .selectFrom("catalog_items")
+            .select("id")
+            .where("id", "=", itemId)
+            .where("deleted_at", "is not", null)
+            .executeTakeFirst();
+        if (gone !== undefined)
+            await oweOwnedPluginCleanup(this.outbox, itemId);
+    }
     /** The item is still live and pending with `version` (row lock), else 409 (P3-21). */
     async stillPending(itemId, name, version) {
         await this.pendingRow(itemId, name, version);
@@ -526,14 +557,20 @@ let CatalogScopeService = class CatalogScopeService {
             throw pendingStale(name);
         return row.owner_org_id;
     }
-    /** A confirmed first version: the item stops waiting, the owner is told (`upload_confirmed`). */
-    async finishFirstVersion(actor, itemId, version, opts) {
+    /**
+     * A confirmed first version: the item stops waiting, its platform component rows are written
+     * from `components` (a component changed since they were planned -> 409
+     * `extension.approval_stale`: confirm again), the owner is told (`upload_confirmed`). The
+     * import's item name lock before the item row, as an import's commit takes them (ruling P3-50).
+     */
+    async finishFirstVersion(actor, itemId, version, components, opts) {
         await this.adminLock.lockAndAuthorize(actor);
         const named = await this.db
             .selectFrom("catalog_items")
             .select("name")
             .where("id", "=", itemId)
             .executeTakeFirstOrThrow();
+        await this.itemLock.lock(named.name);
         const owner = await this.pendingRow(itemId, named.name, version);
         await this.db
             .updateTable("catalog_items")
@@ -549,6 +586,14 @@ let CatalogScopeService = class CatalogScopeService {
             .where("id", "=", itemId)
             .execute();
         await markVersionApplied(this.db, itemId, version);
+        try {
+            await this.platform.applySyncIn(components);
+        }
+        catch (e) {
+            if (e instanceof PlanStale)
+                throw pendingStale(named.name);
+            throw e;
+        }
         await addOrgNotice(this.db, owner, "upload_confirmed", {
             itemId,
             name: named.name,
@@ -562,6 +607,9 @@ let CatalogScopeService = class CatalogScopeService {
             target: itemId,
             detail: { name: named.name, version, ownerOrgId: owner },
         });
+        // The confirmation's commit owes the sync's backstop (ruling R24); the immediate sync follows
+        // the commit
+        await this.sync.enqueueBackstop(itemId);
     }
     /**
      * The super admin rejects an org upload's pending version (ruling P3-10, `reason` shown to the
@@ -781,7 +829,7 @@ let CatalogScopeService = class CatalogScopeService {
                 ...opts.auditDetail,
             },
         });
-        afterCommit(() => this.enqueue(itemId));
+        await this.enqueue(itemId);
     }
     async writeDisabled(actor, itemId, disabled, hash, opts) {
         await this.adminLock.lockAndAuthorize(actor);
@@ -817,13 +865,13 @@ let CatalogScopeService = class CatalogScopeService {
                 ...opts.auditDetail,
             },
         });
-        afterCommit(() => this.enqueue(itemId));
+        await this.enqueue(itemId);
     }
     /**
      * Writes an org-owned plugin's 可共享 flag and copies it to its component rows (ruling P3-2).
      * Turning it off narrows an `optional` / `all` plugin, and each component with its own such
-     * scope, to the owner plus the orgs where it is on now (ruling P3-25), and enqueues the item's
-     * scope sync after the commit. The caller authorizes (the owner org's admin, Task 7). A platform
+     * scope, to the owner plus the orgs where it is on now (ruling P3-25), and owes the item's
+     * scope sync with it. The caller authorizes (the owner org's admin, Task 7). A platform
      * item (no owner) or a missing one -> 404.
      */
     async setShareable(itemId, shareable, actor = null) {
@@ -865,13 +913,13 @@ let CatalogScopeService = class CatalogScopeService {
             }
         }
         if (narrowed)
-            afterCommit(() => this.enqueue(itemId));
+            await this.enqueue(itemId);
     }
     /**
      * Adds one org to a `named` item's list in the caller's transaction (an approved `access`
      * request, spec §5.1 rule 2): nobody loses access, so no preview. The item row is locked; it
      * must be live and not builtin (404 / `plugin.builtin`). Bumps `scope_version`, audits
-     * `catalog.scope_changed` and enqueues the item's scope sync after the commit. Returns whether
+     * `catalog.scope_changed` and owes the item's scope sync in that transaction. Returns whether
      * the list changed (false: not `named`, or listed already).
      */
     async addOrg(actor, itemId, orgId, opts = {}) {
@@ -879,24 +927,34 @@ let CatalogScopeService = class CatalogScopeService {
         assertNotAwaiting(item);
         const changed = await addScopeOrg(this.db, actor, item, orgId, opts);
         if (changed)
-            afterCommit(() => this.enqueue(itemId));
+            await this.enqueue(itemId);
         return changed;
     }
     /**
-     * Enqueues the item's scope sync after a commit made elsewhere (an org upload's confirm,
-     * `OrgPluginUploads`); a failure only warns.
+     * Owes the item's scope sync in the caller's transaction (an ownership transfer, an org upload's
+     * confirm in `OrgPluginUploads`).
      */
     async enqueueSync(itemId) {
         await this.enqueue(itemId);
     }
-    /** Enqueues the item's scope sync; a failure only warns (the next change or org sync converges). */
+    /** Owes the item's scope sync in the transaction that changes its scope (outbox spec §8.1). */
     async enqueue(itemId) {
-        try {
-            await this.sync.enqueueItem(itemId);
-        }
-        catch (err) {
-            this.log.warn("enqueueing the plugin scope sync failed", { itemId, err });
-        }
+        await this.sync.enqueueItem(itemId);
+    }
+    /**
+     * Owes the item's scope sync in a transaction of its own, after a confirmation whose last write
+     * (the extension's deploy, or the platform components) committed outside the scope service: the
+     * sync must not run before the extension it installs is enabled.
+     */
+    async oweSync(itemId) {
+        await this.enqueue(itemId);
+    }
+    /**
+     * Owes the delayed backstop of the item's sync in a transaction of its own (ruling R24): a
+     * permissions confirm writes nothing of the scope service's before its enable.
+     */
+    async oweBackstop(itemId) {
+        await this.sync.enqueueBackstop(itemId);
     }
     /**
      * 409 `theme.platform_default` when a live theme of the item is the platform default and `after`
@@ -1190,7 +1248,10 @@ __decorate([
 ], CatalogScopeService.prototype, "restorePending", null);
 __decorate([
     Transactional()
-], CatalogScopeService.prototype, "releaseIfGone", null);
+], CatalogScopeService.prototype, "takeOutIn", null);
+__decorate([
+    Transactional()
+], CatalogScopeService.prototype, "oweCleanupIfGone", null);
 __decorate([
     Transactional()
 ], CatalogScopeService.prototype, "stillPending", null);
@@ -1215,22 +1276,36 @@ __decorate([
 __decorate([
     Transactional({ propagation: "mandatory" })
 ], CatalogScopeService.prototype, "addOrg", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], CatalogScopeService.prototype, "enqueueSync", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], CatalogScopeService.prototype, "enqueue", null);
+__decorate([
+    Transactional()
+], CatalogScopeService.prototype, "oweSync", null);
+__decorate([
+    Transactional()
+], CatalogScopeService.prototype, "oweBackstop", null);
 CatalogScopeService = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(SuperAdminLock)),
     __param(2, Inject(CatalogService)),
     __param(3, Inject(PluginImport)),
-    __param(4, Inject(PluginInstaller)),
-    __param(5, Inject(ExtensionAdmin)),
-    __param(6, Inject(ExtensionAdminOps)),
-    __param(7, Inject(PluginScopeSync)),
-    __param(8, Inject(PlatformPluginUpdater)),
-    __param(9, Inject(OrgLock)),
-    __param(10, Inject(PluginInstallLock)),
-    __param(11, Inject(ExtensionLifecycle)),
-    __param(12, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME))),
-    __param(13, Inject(KERNEL_LOGGER)),
-    __param(14, Inject(TransactionHost))
+    __param(4, Inject(PlatformComponents)),
+    __param(5, Inject(CatalogItemLock)),
+    __param(6, Inject(PluginInstaller)),
+    __param(7, Inject(ExtensionAdmin)),
+    __param(8, Inject(ExtensionAdminOps)),
+    __param(9, Inject(PluginScopeSync)),
+    __param(10, Inject(PlatformPluginUpdater)),
+    __param(11, Inject(OrgLock)),
+    __param(12, Inject(PluginInstallLock)),
+    __param(13, Inject(ExtensionLifecycle)),
+    __param(14, Inject(OutboxService)),
+    __param(15, Inject(KERNEL_LOGGER)),
+    __param(16, Inject(TransactionHost))
 ], CatalogScopeService);
 export { CatalogScopeService };

package/dist/catalog/catalog.module.js

@@ -54,10 +54,11 @@ CatalogModule = __decorate([
             StorageModule,
             SkillsModule,
             ToolsModule,
-            // the producer side of the plugin scope sync (`PluginScopeWorkersModule` consumes it)
+            // the plugin scope sync's queue: the outbox dispatcher adds the owed jobs through it
+            // (`PluginScopeWorkersModule` consumes it)
             PLUGIN_SCOPE_QUEUE_MODULE,
-            // a removed org plugin's cleanup job (`OwnedItems`, `CatalogScopeService`; consumed by the
-            // worker role's `MaintenanceProcessor`)
+            // the queue of a removed org plugin's owed cleanup job (`OwnedItems`, `CatalogScopeService`;
+            // consumed by the worker role's `MaintenanceProcessor`)
             MAINTENANCE_QUEUE_MODULE,
         ],
         providers: [

package/dist/catalog/catalog.service.d.ts

@@ -7,6 +7,7 @@ import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import type { TranslationReport } from "./claude/report.js";
 import { MarketplacesService } from "./marketplaces.service.js";
 import { type Owner } from "./ownership.js";
@@ -242,6 +243,8 @@ export declare class CatalogService {
     private readonly marketplaces;
     /** Serializes a claim release with an install of that name still committing (F10). */
     private readonly installLock;
+    /** A removed org-owned plugin's cleanup job, owed by the removal (transactional outbox §8.1). */
+    private readonly outbox;
     readonly txHost: TransactionHost;
     constructor(kdb: KernelDb, 
     /** The super admin lock (identity/super-admin.ts): joins the caller's transaction. */
@@ -253,7 +256,9 @@ export declare class CatalogService {
     /** The token of a custom marketplace (sent only to its URL's origin). */
     marketplaces: MarketplacesService, 
     /** Serializes a claim release with an install of that name still committing (F10). */
-    installLock: PluginInstallLock, txHost: TransactionHost);
+    installLock: PluginInstallLock, 
+    /** A removed org-owned plugin's cleanup job, owed by the removal (transactional outbox §8.1). */
+    outbox: Pick<OutboxService, "add">, txHost: TransactionHost);
     /** The kernel-schema handle of the current context (the transaction, else the pool). */
     private get db();
     /** Downloads a marketplace archive source, verified against its integrity. */
@@ -335,7 +340,8 @@ export declare class CatalogService {
      * still enabled on the deployment -> 409 `catalog.extension_enabled` (details
      * `[{ extension, displayName }]`): disable it on the Extensions page first, as an uninstall
      * requires. A disabled extension keeps its install record (the super admin uninstalls it on the
-     * Extensions page); an org-owned item's extension is taken out by `OwnedPluginCleanup`.
+     * Extensions page); an org-owned item's extension is taken out by `OwnedPluginCleanup`, the job
+     * the removal owes ({@link removeIn}).
      */
     remove(actor: string, itemId: string, opts?: ActorOpts): Promise<void>;
     /**
@@ -356,8 +362,9 @@ export declare class CatalogService {
      * `OwnedItems.transferOrRemove`, share it): `deleted_at` set, a pending version cleared, the
      * extension name claim of a first upload still waiting released (ruling P3-37, F10), its themes
      * soft-deleted (refused with 409 `theme.platform_default` while one is the platform default),
-     * pending requests cancelled, audit `catalog.removed` (`actor` null: the kernel). Returns the
-     * removed item's name, or null when it is gone already.
+     * pending requests cancelled, an org-owned item's cleanup job owed
+     * (`owned-plugin-cleanup-<itemId>`), audit `catalog.removed` (`actor` null: the kernel). Returns
+     * the removed item's name, or null when it is gone already.
      */
     removeIn(actor: string | null, itemId: string, opts?: ActorOpts & {
         reason?: string;

package/dist/catalog/catalog.service.js

@@ -20,10 +20,12 @@ import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { sameRepository } from "../packages/provenance.js";
 import { assertNotPlatformDefault } from "../themes/theme-usage.js";
 import { countInstalls, inAuthorOrder, itemConfirmations, itemScopeFacts, itemView, marketplaceLatest, versionUsable, } from "./catalog-items.js";
 import { expandGitUrl, GitSourceError, gitErrorDetails, normalGitPath, readGitTreeAndOids, resolveGitCommit, } from "./git-source.js";
+import { oweOwnedPluginCleanup } from "./job-ids.js";
 import { fetchMarketplaceArchive, marketplaceNetPolicy, marketplaceUrlProblem, } from "./marketplace-fetch.js";
 import { assertEntryNotDeprecated, entryCompatible, entrySourceHost, HOST_VERSIONS, hostAllowed, loadMarketplaceEntry, MarketplacesService, pluginNameFrom, } from "./marketplaces.service.js";
 import { releaseExtensionClaim } from "./ownership.js";
@@ -95,6 +97,7 @@ let CatalogService = class CatalogService {
     pluginImport;
     marketplaces;
     installLock;
+    outbox;
     txHost;
     constructor(kdb, 
     /** The super admin lock (identity/super-admin.ts): joins the caller's transaction. */
@@ -106,7 +109,9 @@ let CatalogService = class CatalogService {
     /** The token of a custom marketplace (sent only to its URL's origin). */
     marketplaces, 
     /** Serializes a claim release with an install of that name still committing (F10). */
-    installLock, txHost) {
+    installLock, 
+    /** A removed org-owned plugin's cleanup job, owed by the removal (transactional outbox §8.1). */
+    outbox, txHost) {
         this.kdb = kdb;
         this.adminLock = adminLock;
         this.config = config;
@@ -115,6 +120,7 @@ let CatalogService = class CatalogService {
         this.pluginImport = pluginImport;
         this.marketplaces = marketplaces;
         this.installLock = installLock;
+        this.outbox = outbox;
         this.txHost = txHost;
     }
     /** The kernel-schema handle of the current context (the transaction, else the pool). */
@@ -469,7 +475,8 @@ let CatalogService = class CatalogService {
      * still enabled on the deployment -> 409 `catalog.extension_enabled` (details
      * `[{ extension, displayName }]`): disable it on the Extensions page first, as an uninstall
      * requires. A disabled extension keeps its install record (the super admin uninstalls it on the
-     * Extensions page); an org-owned item's extension is taken out by `OwnedPluginCleanup`.
+     * Extensions page); an org-owned item's extension is taken out by `OwnedPluginCleanup`, the job
+     * the removal owes ({@link removeIn}).
      */
     async remove(actor, itemId, opts = {}) {
         if (!UUID_RE.test(itemId))
@@ -533,8 +540,9 @@ let CatalogService = class CatalogService {
      * `OwnedItems.transferOrRemove`, share it): `deleted_at` set, a pending version cleared, the
      * extension name claim of a first upload still waiting released (ruling P3-37, F10), its themes
      * soft-deleted (refused with 409 `theme.platform_default` while one is the platform default),
-     * pending requests cancelled, audit `catalog.removed` (`actor` null: the kernel). Returns the
-     * removed item's name, or null when it is gone already.
+     * pending requests cancelled, an org-owned item's cleanup job owed
+     * (`owned-plugin-cleanup-<itemId>`), audit `catalog.removed` (`actor` null: the kernel). Returns
+     * the removed item's name, or null when it is gone already.
      */
     async removeIn(actor, itemId, opts = {}) {
         const t = this.db;
@@ -572,6 +580,13 @@ let CatalogService = class CatalogService {
             await this.installLock.lock(row.name);
             await releaseExtensionClaim(t, row.name, row.package_name);
         }
+        // An org-owned plugin: its extension is taken out (and its name claim released) by the cleanup
+        // job the removal owes, whoever removes it (the super admin, its owner, an org deletion). Also
+        // while its first upload still waits: a confirmation may have committed its install and not
+        // reached its take-out yet (the job is idempotent; nothing installed changes nothing)
+        if (row.owner_org_id !== null) {
+            await oweOwnedPluginCleanup(this.outbox, itemId);
+        }
         // Its themes go with it (themes spec §6): nothing refers to a theme row (a theme picked by an
         // org or a person is an id that falls back once no live theme has it)
         await t
@@ -615,6 +630,7 @@ CatalogService = __decorate([
     __param(5, Inject(PluginImport)),
     __param(6, Inject(MarketplacesService)),
     __param(7, Inject(PluginInstallLock)),
-    __param(8, Inject(TransactionHost))
+    __param(8, Inject(OutboxService)),
+    __param(9, Inject(TransactionHost))
 ], CatalogService);
 export { CatalogService };

package/dist/catalog/cli.d.ts

@@ -11,9 +11,10 @@ export interface CatalogCli extends ExtensionCli {
     /** Plugin import (prepare / confirm). The CLI acts without an account (actor `null`). */
     imports: PluginImport;
     /**
-     * After an import's confirm: enqueues the item's plugin scope sync, as the admin console's
-     * confirm does, when its scope turns it on by itself (`all` or `named`). A failure only warns
-     * (the next worker start enqueues every item); returns whether it was enqueued.
+     * After an import's confirm (and its deploy): owes the item's plugin scope sync in the outbox, as
+     * the admin console's confirm does, when its scope turns it on by itself (`all` or `named`); a
+     * worker's relay delivers it. A failure only warns (the confirm's commit owed a backstop that
+     * converges the orgs a few minutes later); returns whether it was owed.
      */
     enqueueScopeSync(item: {
         id: string;