@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.5

package/dist/catalog/marketplaces.controller.d.ts

@@ -1,6 +1,8 @@
 import { z } from "zod";
 import { type Principal } from "../identity/principal.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { type OrgContext } from "../orgs/org.guard.js";
 import { CatalogService, type MarketplaceImportResult } from "./catalog.service.js";
 import { type MarketplaceEntryView, MarketplacesService, type MarketplaceView } from "./marketplaces.service.js";
 declare const AddBody: z.ZodObject<{
@@ -34,9 +36,9 @@ declare const ImportBody: z.ZodObject<{
     version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /**
- * Marketplaces (`/api/v1/admin/marketplaces/*`, enterprise admins): create, update, delete and
- * refresh the official and enterprise marketplaces, browse entries, import from a marketplace.
- * Writes re-check the enterprise admin inside the service's lock and are audited.
+ * Marketplaces (`/api/v1/admin/marketplaces/*`, super admins): create, update, delete and
+ * refresh the official and custom marketplaces, browse entries, import from a marketplace.
+ * Writes re-check the super admin inside the service's lock and are audited.
  */
 export declare class MarketplacesController {
     private readonly marketplaces;
@@ -49,7 +51,7 @@ export declare class MarketplacesController {
         offline: boolean;
     }>;
     /**
-     * Adds an enterprise marketplace (https URL and mirrors; the token is kept in secrets and sent only
+     * Adds a custom marketplace (https URL and mirrors; the token is kept in secrets and sent only
      * to the URL's origin). A git URL (`…/*.git`, `owner/repo`, or any URL with `form: "git"`) is a
      * git marketplace with an optional `ref`; anything else is a marketplace.json URL.
      */
@@ -71,7 +73,7 @@ export declare class MarketplacesController {
      */
     update(principal: Principal, id: string, body: z.infer<typeof PatchBody>): Promise<MarketplaceView>;
     /**
-     * Deletes an enterprise marketplace (imported catalog items are kept); official -> 409
+     * Deletes a custom marketplace (imported catalog items are kept); official -> 409
      * `marketplace.builtin`.
      */
     remove(principal: Principal, id: string): Promise<void>;
@@ -94,4 +96,19 @@ export declare class MarketplacesController {
      */
     importEntry(principal: Principal, id: string, name: string, body: z.infer<typeof ImportBody>): Promise<MarketplaceImportResult>;
 }
+/**
+ * Org admins browse the marketplaces read-only (`GET /api/v1/orgs/:orgId/marketplaces/entries`,
+ * `catalog.decide`; plugin scope spec §5.1 rule 3) to request an import. The deployment setting
+ * `orgMarketplaceBrowse` off -> 404 `not_found`. An entry imported as an item the org can neither
+ * see nor request (a hidden `named` item) reads as not imported (`adopted: null`).
+ */
+export declare class OrgMarketplacesController {
+    private readonly marketplaces;
+    private readonly kdb;
+    constructor(marketplaces: MarketplacesService, kdb: KernelDb);
+    entries(org: OrgContext, q: z.infer<typeof EntriesQuery>): Promise<{
+        items: MarketplaceEntryView[];
+        truncated: boolean;
+    }>;
+}
 export {};

package/dist/catalog/marketplaces.controller.js

@@ -10,12 +10,17 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post } from "@nestjs/common";
 import { z } from "zod";
 import { MARKETPLACE_MAX_MIRRORS } from "../config/schema.js";
-import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
+import { ApiError } from "../errors.js";
+import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
+import { readOrgMarketplaceBrowse } from "../identity/settings.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZQuery } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
 import { CatalogService } from "./catalog.service.js";
 import { MarketplacesService, } from "./marketplaces.service.js";
+import { itemsSeenBy } from "./scope-state.js";
 const Url = z.string().min(1).max(2000);
 const Form = z.enum(["http", "git"]);
 const Ref = z.string().min(1).max(256);
@@ -58,9 +63,9 @@ class MarketplaceImportBody extends createZodDto(ImportBody, "MarketplaceImportB
 class MarketplacePatchBody extends createZodDto(PatchBody, "MarketplacePatchBody") {
 }
 /**
- * Marketplaces (`/api/v1/admin/marketplaces/*`, enterprise admins): create, update, delete and
- * refresh the official and enterprise marketplaces, browse entries, import from a marketplace.
- * Writes re-check the enterprise admin inside the service's lock and are audited.
+ * Marketplaces (`/api/v1/admin/marketplaces/*`, super admins): create, update, delete and
+ * refresh the official and custom marketplaces, browse entries, import from a marketplace.
+ * Writes re-check the super admin inside the service's lock and are audited.
  */
 let MarketplacesController = class MarketplacesController {
     marketplaces;
@@ -79,7 +84,7 @@ let MarketplacesController = class MarketplacesController {
         };
     }
     /**
-     * Adds an enterprise marketplace (https URL and mirrors; the token is kept in secrets and sent only
+     * Adds a custom marketplace (https URL and mirrors; the token is kept in secrets and sent only
      * to the URL's origin). A git URL (`…/*.git`, `owner/repo`, or any URL with `form: "git"`) is a
      * git marketplace with an optional `ref`; anything else is a marketplace.json URL.
      */
@@ -124,7 +129,7 @@ let MarketplacesController = class MarketplacesController {
         }, actorOpts(actor));
     }
     /**
-     * Deletes an enterprise marketplace (imported catalog items are kept); official -> 409
+     * Deletes a custom marketplace (imported catalog items are kept); official -> 409
      * `marketplace.builtin`.
      */
     async remove(principal, id) {
@@ -200,9 +205,53 @@ __decorate([
 ], MarketplacesController.prototype, "importEntry", null);
 MarketplacesController = __decorate([
     Controller("api/v1/admin/marketplaces"),
-    EnterpriseAdmin(),
+    SuperAdmin(),
     __param(0, Inject(MarketplacesService)),
     __param(1, Inject(CatalogService)),
     __param(2, Inject(KernelConfigService))
 ], MarketplacesController);
 export { MarketplacesController };
+/**
+ * Org admins browse the marketplaces read-only (`GET /api/v1/orgs/:orgId/marketplaces/entries`,
+ * `catalog.decide`; plugin scope spec §5.1 rule 3) to request an import. The deployment setting
+ * `orgMarketplaceBrowse` off -> 404 `not_found`. An entry imported as an item the org can neither
+ * see nor request (a hidden `named` item) reads as not imported (`adopted: null`).
+ */
+let OrgMarketplacesController = class OrgMarketplacesController {
+    marketplaces;
+    kdb;
+    constructor(marketplaces, kdb) {
+        this.marketplaces = marketplaces;
+        this.kdb = kdb;
+    }
+    async entries(org, q) {
+        if (!(await readOrgMarketplaceBrowse(this.kdb.db))) {
+            throw new ApiError("not_found", "Marketplace browsing is off for organizations");
+        }
+        const r = await this.marketplaces.entries({
+            ...(q.sourceId !== undefined && { marketplaceId: q.sourceId }),
+            ...(q.q !== undefined && { q: q.q }),
+        });
+        // A hidden `named` item the org is not listed on stays unknown to it: the entry reads as not
+        // imported
+        const seen = await itemsSeenBy(this.kdb.db, org.orgId, r.items.flatMap((e) => (e.adopted ? [e.adopted.itemId] : [])));
+        return {
+            ...r,
+            items: r.items.map((e) => e.adopted === null || seen.has(e.adopted.itemId)
+                ? e
+                : { ...e, adopted: null, newerAvailable: false, contentChanged: false }),
+        };
+    }
+};
+__decorate([
+    Get("entries"),
+    OrgAction("catalog.decide"),
+    __param(0, CurrentOrg()),
+    __param(1, ZQuery(MarketplaceEntriesQuery))
+], OrgMarketplacesController.prototype, "entries", null);
+OrgMarketplacesController = __decorate([
+    Controller("api/v1/orgs/:orgId/marketplaces"),
+    __param(0, Inject(MarketplacesService)),
+    __param(1, Inject(KernelDb))
+], OrgMarketplacesController);
+export { OrgMarketplacesController };

package/dist/catalog/marketplaces.service.d.ts

@@ -2,7 +2,7 @@ import { type MarketplaceEntry, type MarketplaceSource } from "@capybara-hq/plug
 import { type KernelConfig } from "../config/schema.js";
 import { type Keyring } from "../ctx/secrets.js";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -74,6 +74,11 @@ export interface MarketplaceEntryView {
         en: string;
         zh?: string;
     };
+    /** The entry's display name (copied from the plugin's `plugin.json`); null without one. */
+    displayName: {
+        zh: string;
+        en: string;
+    } | null;
     minKernel: string | null;
     homepage: string | null;
     permissions: {
@@ -83,6 +88,13 @@ export interface MarketplaceEntryView {
     source: MarketplaceSource;
     /** `claude-code` for an entry of a Claude Code marketplace (`.claude-plugin/marketplace.json`). */
     format: "capybara" | "claude-code";
+    /**
+     * The marketplace deprecates this version (`deprecated`, spec ruling Task 13): its reason, `null`
+     * without one; `null` when not deprecated. Importing it is refused (`marketplace.entry_deprecated`).
+     */
+    deprecated: {
+        reason: string | null;
+    } | null;
     /** `minKernel` is satisfied by this deployment. */
     compatible: boolean;
     /** The kernel can import this entry's source now. */
@@ -93,7 +105,10 @@ export interface MarketplaceEntryView {
         itemId: string;
         versions: string[];
     } | null;
-    /** Adopted, and this compatible entry is newer than the newest imported version (never automatic). */
+    /**
+     * Adopted, and this compatible entry, not deprecated, is newer than the newest imported version
+     * (never automatic).
+     */
     newerAvailable: boolean;
     /**
      * "Content changed at the same version" (spec §5.3): a version of this entry's release is
@@ -106,6 +121,8 @@ export interface MarketplaceEntryView {
 }
 export interface ActorOpts {
     actorTokenId?: string;
+    /** Merged into the audit detail (a write made through the Platform tool: `via`, …). */
+    auditDetail?: Record<string, unknown>;
 }
 /** A plugin name from a repo URL or path segment (lower case, invalid characters as `-`). */
 export declare function pluginNameFrom(segment: string): string;
@@ -164,10 +181,17 @@ export declare function headsToResolve(entries: readonly MarketplaceEntry[], imp
 /** The host versions (an entry's `minKernel` is judged against them). */
 export declare const HOST_VERSIONS: {
     readonly kernel: string;
-    readonly sdk: "0.1.0-rc.2";
+    readonly sdk: "0.1.0-rc.3";
 };
 /** Whether this deployment satisfies the entry's `minKernel`. */
 export declare const entryCompatible: (e: Pick<MarketplaceEntry, "minKernel">) => boolean;
+/** Whether the marketplace marks the entry deprecated (`deprecated: true` or with a reason). */
+export declare const entryDeprecated: (e: MarketplaceEntry) => boolean;
+/**
+ * Refuses importing (or requesting) a deprecated marketplace entry: 409
+ * `marketplace.entry_deprecated`, its reason in the message and details.
+ */
+export declare function assertEntryNotDeprecated(e: MarketplaceEntry): void;
 /**
  * The form of a marketplace address (spec §5.1): `owner/repo` (expanded to GitHub), an https URL
  * whose path ends in `.git`, or any URL with `form: "git"` is a git repository; anything else
@@ -181,6 +205,8 @@ export declare function marketplaceForm(url: string, form?: MarketplaceForm): {
 export declare function entrySourceHost(e: Pick<MarketplaceEntry, "source">): string | undefined;
 /** Whether `marketplaces.allowedHosts` lets an entry download from `host` (empty: any host). */
 export declare function hostAllowed(host: string, config: KernelConfig): boolean;
+/** Why an entry is not importable from a marketplace of `form`, or undefined when it is. */
+export declare function unimportable(e: MarketplaceEntry, form: MarketplaceForm, config: KernelConfig): MarketplaceEntryUnimportable | undefined;
 /** What an import needs to know about the marketplace of an entry. */
 export interface MarketplaceOfEntry {
     url: string;
@@ -195,10 +221,24 @@ export declare const sourceEffective: (row: {
     builtin: boolean;
     enabled: boolean;
 }, config: KernelConfig) => boolean;
+/**
+ * The default entry of a marketplace plugin (`version` `""`: the entry without a version), the
+ * same order as the web's market row (`groupMarketplaceEntries`, apps/web/src/lib/catalog.ts):
+ * the newest `usable` versioned entry, a stable version before a prerelease; else the entry
+ * without a version that is not deprecated; else the newest versioned one that is not deprecated;
+ * else the entry without a version; else the newest.
+ */
+export declare function pickDefaultEntry<T extends {
+    version: string;
+}>(entries: readonly T[], o: {
+    usable: (e: T) => boolean;
+    deprecated: (e: T) => boolean;
+}): T | undefined;
 /**
  * Reads a marketplace entry for import: `version` given -> the entry listing that version; omitted
- * -> the newest compatible versioned entry, else the entry without a version, else the newest
- * versioned one (refused later as incompatible). Marketplace missing -> `marketplace.not_found`;
+ * -> {@link pickDefaultEntry} over the compatible, importable entries that are not deprecated
+ * (a fallback is refused later as incompatible or deprecated). Marketplace missing ->
+ * `marketplace.not_found`;
  * marketplace disabled (official offline included), entry or version missing ->
  * `marketplace.entry_not_found`.
  */
@@ -209,9 +249,9 @@ export declare function loadMarketplaceEntry(db: KernelSchemaDb, config: KernelC
     claude?: ClaudeEntryOverlay;
 }>;
 /**
- * Marketplaces (D16 / C25 / C26, `/api/v1/admin/marketplaces/*`, enterprise admins only): the official
+ * Marketplaces (D16 / C25 / C26, `/api/v1/admin/marketplaces/*`, super admins only): the official
  * marketplace (config `marketplaces.official.*`, synced at startup into the marketplace with id
- * `official`) and enterprise marketplaces (PG, optional token in secrets). A refresh (maintenance
+ * `official`) and custom marketplaces (PG, optional token in secrets). A refresh (maintenance
  * job `catalogs-refresh` every `marketplaces.refreshIntervalMinutes` minutes, or manual) tries the main
  * URL and then the mirrors with If-None-Match; on success it replaces that marketplace's cached
  * entries as a whole, when all fail (an invalid manifest included) it keeps the previous ones with
@@ -220,7 +260,7 @@ export declare function loadMarketplaceEntry(db: KernelSchemaDb, config: KernelC
  */
 export declare class MarketplacesService {
     private readonly kdb;
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the caller's transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the caller's transaction. */
     private readonly adminLock;
     private readonly sourceLock;
     private readonly config;
@@ -228,8 +268,8 @@ export declare class MarketplacesService {
     private readonly log;
     readonly txHost: TransactionHost;
     constructor(kdb: KernelDb, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the caller's transaction. */
-    adminLock: EnterpriseAdminLock, sourceLock: CatalogSourceLock, config: KernelConfigService, keyring: Keyring, log: KernelLogger, txHost: TransactionHost);
+    /** The super admin lock (identity/super-admin.ts): joins the caller's transaction. */
+    adminLock: SuperAdminLock, sourceLock: CatalogSourceLock, config: KernelConfigService, keyring: Keyring, log: KernelLogger, txHost: TransactionHost);
     /** The kernel-schema handle of the current context (the transaction, else the pool). */
     private get db();
     /**
@@ -245,7 +285,7 @@ export declare class MarketplacesService {
     list(): Promise<MarketplaceView[]>;
     get(id: string): Promise<MarketplaceView>;
     /**
-     * Adds an enterprise marketplace (audit `marketplace.added`). URL and mirrors must be https,
+     * Adds a custom marketplace (audit `marketplace.added`). URL and mirrors must be https,
      * without user info. The form follows {@link marketplaceForm}; a git marketplace may name a `ref`
      * (branch or tag, default the remote HEAD) and has no mirrors.
      */
@@ -259,7 +299,7 @@ export declare class MarketplacesService {
     }, opts?: ActorOpts): Promise<MarketplaceView>;
     private writeAdd;
     /**
-     * Updates an enterprise marketplace (audit `marketplace.updated`, listing the changed fields, the
+     * Updates a custom marketplace (audit `marketplace.updated`, listing the changed fields, the
      * token's value never recorded; not written when unchanged). `token: null` clears the token.
      * Official only takes `enabled`, any other field -> `marketplace.builtin`. Changing the URL, form
      * or ref clears the ETag and the last commit (the next refresh reads everything again); a new URL
@@ -278,7 +318,7 @@ export declare class MarketplacesService {
     }, opts?: ActorOpts): Promise<MarketplaceView>;
     private writeUpdate;
     /**
-     * Deletes an enterprise marketplace (audit `marketplace.removed`): its cached entries and token
+     * Deletes a custom marketplace (audit `marketplace.removed`): its cached entries and token
      * are deleted; imported catalog items are kept (their marketplace becomes null). Official can
      * only be disabled -> `marketplace.builtin`.
      */
@@ -318,7 +358,7 @@ export declare class MarketplacesService {
      * entry unknown (never fails the refresh). Returns `name\0version` -> head.
      */
     private resolveHeads;
-    /** The token of an enterprise marketplace (undefined without one; official never has one). */
+    /** The token of a custom marketplace (undefined without one; official never has one). */
     token(id: string): Promise<string | undefined>;
     /** Refreshes every effective marketplace (maintenance job `catalogs-refresh`), one failing not stopping the rest. */
     refreshAll(signal: AbortSignal): Promise<void>;

package/dist/catalog/marketplaces.service.js

@@ -8,7 +8,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { randomUUID } from "node:crypto";
-import { CATALOG_ITEM_NAME_RE, marketplaceEntryVersion, PLUGIN_MANIFEST_FILE, parseMarketplaceManifest, parsePluginManifest, SDK_VERSION, SEMVER_VERSION_RE, } from "@capybara-hq/plugin-sdk";
+import { CATALOG_ITEM_NAME_RE, marketplaceEntryDeprecation, marketplaceEntryVersion, PLUGIN_MANIFEST_FILE, parseMarketplaceManifest, parsePluginManifest, pluginDescription, SDK_VERSION, SEMVER_VERSION_RE, } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import semver from "semver";
@@ -18,7 +18,7 @@ import { createSecrets } from "../ctx/secrets.js";
 import { ApiError } from "../errors.js";
 import { DEPLOYMENT_SECRETS_ORG } from "../extensions/deployment-config-store.js";
 import { audit } from "../identity/audit.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -243,6 +243,20 @@ export function headsToResolve(entries, imported, config, max) {
 export const HOST_VERSIONS = { kernel: KERNEL_VERSION, sdk: SDK_VERSION };
 /** Whether this deployment satisfies the entry's `minKernel`. */
 export const entryCompatible = (e) => e.minKernel === undefined || semver.gte(HOST_VERSIONS.kernel, e.minKernel);
+/** Whether the marketplace marks the entry deprecated (`deprecated: true` or with a reason). */
+export const entryDeprecated = (e) => marketplaceEntryDeprecation(e) !== null;
+/**
+ * Refuses importing (or requesting) a deprecated marketplace entry: 409
+ * `marketplace.entry_deprecated`, its reason in the message and details.
+ */
+export function assertEntryNotDeprecated(e) {
+    const d = marketplaceEntryDeprecation(e);
+    if (d === null)
+        return;
+    const version = marketplaceEntryVersion(e);
+    throw new ApiError("marketplace.entry_deprecated", `${e.name}${version !== null ? `@${version}` : ""} is deprecated by its marketplace` +
+        `${d.reason !== null ? `: ${d.reason}` : ""}; import another version`, [{ entry: e.name, version, reason: d.reason }]);
+}
 /**
  * The form of a marketplace address (spec §5.1): `owner/repo` (expanded to GitHub), an https URL
  * whose path ends in `.git`, or any URL with `form: "git"` is a git repository; anything else
@@ -282,7 +296,7 @@ export function hostAllowed(host, config) {
     return allowed.length === 0 || allowed.includes(host.toLowerCase());
 }
 /** Why an entry is not importable from a marketplace of `form`, or undefined when it is. */
-function unimportable(e, form, config) {
+export function unimportable(e, form, config) {
     if ("path" in e.source && form !== "git")
         return "path_needs_git_marketplace";
     const host = entrySourceHost(e);
@@ -292,10 +306,30 @@ function unimportable(e, form, config) {
 }
 /** 来源是否生效：本身启用，official 还要配置没关。 */
 export const sourceEffective = (row, config) => row.enabled && (!row.builtin || config.marketplaces.official.enabled);
+/**
+ * The default entry of a marketplace plugin (`version` `""`: the entry without a version), the
+ * same order as the web's market row (`groupMarketplaceEntries`, apps/web/src/lib/catalog.ts):
+ * the newest `usable` versioned entry, a stable version before a prerelease; else the entry
+ * without a version that is not deprecated; else the newest versioned one that is not deprecated;
+ * else the entry without a version; else the newest.
+ */
+export function pickDefaultEntry(entries, o) {
+    const versioned = entries
+        .filter((e) => e.version !== "")
+        .sort((a, b) => newestFirst(a.version, b.version));
+    const bare = entries.filter((e) => e.version === "");
+    return (versioned.find((e) => o.usable(e) && semver.prerelease(e.version) === null) ??
+        versioned.find(o.usable) ??
+        bare.find((e) => !o.deprecated(e)) ??
+        versioned.find((e) => !o.deprecated(e)) ??
+        bare[0] ??
+        versioned[0]);
+}
 /**
  * Reads a marketplace entry for import: `version` given -> the entry listing that version; omitted
- * -> the newest compatible versioned entry, else the entry without a version, else the newest
- * versioned one (refused later as incompatible). Marketplace missing -> `marketplace.not_found`;
+ * -> {@link pickDefaultEntry} over the compatible, importable entries that are not deprecated
+ * (a fallback is refused later as incompatible or deprecated). Marketplace missing ->
+ * `marketplace.not_found`;
  * marketplace disabled (official offline included), entry or version missing ->
  * `marketplace.entry_not_found`.
  */
@@ -325,13 +359,13 @@ export async function loadMarketplaceEntry(db, config, sourceId, name, version)
         pickedRow = entries.find((e) => e.version === version);
     }
     else {
-        const versioned = entries
-            .filter((e) => e.version !== "")
-            .sort((a, b) => newestFirst(a.version, b.version));
-        pickedRow =
-            versioned.find((e) => entryCompatible(e.entry)) ??
-                entries.find((e) => e.version === "") ??
-                versioned[0];
+        pickedRow = pickDefaultEntry(entries, {
+            // compatible, importable, not deprecated
+            usable: (e) => entryCompatible(e.entry) &&
+                unimportable(e.entry, src.form, config) === undefined &&
+                !entryDeprecated(e.entry),
+            deprecated: (e) => entryDeprecated(e.entry),
+        });
     }
     const picked = pickedRow?.entry;
     if (!picked) {
@@ -353,9 +387,9 @@ export async function loadMarketplaceEntry(db, config, sourceId, name, version)
     };
 }
 /**
- * Marketplaces (D16 / C25 / C26, `/api/v1/admin/marketplaces/*`, enterprise admins only): the official
+ * Marketplaces (D16 / C25 / C26, `/api/v1/admin/marketplaces/*`, super admins only): the official
  * marketplace (config `marketplaces.official.*`, synced at startup into the marketplace with id
- * `official`) and enterprise marketplaces (PG, optional token in secrets). A refresh (maintenance
+ * `official`) and custom marketplaces (PG, optional token in secrets). A refresh (maintenance
  * job `catalogs-refresh` every `marketplaces.refreshIntervalMinutes` minutes, or manual) tries the main
  * URL and then the mirrors with If-None-Match; on success it replaces that marketplace's cached
  * entries as a whole, when all fail (an invalid manifest included) it keeps the previous ones with
@@ -371,7 +405,7 @@ let MarketplacesService = class MarketplacesService {
     log;
     txHost;
     constructor(kdb, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the caller's transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the caller's transaction. */
     adminLock, sourceLock, config, keyring, log, txHost) {
         this.kdb = kdb;
         this.adminLock = adminLock;
@@ -447,7 +481,7 @@ let MarketplacesService = class MarketplacesService {
         return (await this.views([row]))[0];
     }
     /**
-     * Adds an enterprise marketplace (audit `marketplace.added`). URL and mirrors must be https,
+     * Adds a custom marketplace (audit `marketplace.added`). URL and mirrors must be https,
      * without user info. The form follows {@link marketplaceForm}; a git marketplace may name a `ref`
      * (branch or tag, default the remote HEAD) and has no mirrors.
      */
@@ -495,11 +529,12 @@ let MarketplacesService = class MarketplacesService {
                 ...(input.ref !== undefined && { ref: input.ref }),
                 mirrors: input.mirrors ?? [],
                 hasToken: input.token !== undefined,
+                ...opts.auditDetail,
             },
         });
     }
     /**
-     * Updates an enterprise marketplace (audit `marketplace.updated`, listing the changed fields, the
+     * Updates a custom marketplace (audit `marketplace.updated`, listing the changed fields, the
      * token's value never recorded; not written when unchanged). `token: null` clears the token.
      * Official only takes `enabled`, any other field -> `marketplace.builtin`. Changing the URL, form
      * or ref clears the ETag and the last commit (the next refresh reads everything again); a new URL
@@ -608,7 +643,7 @@ let MarketplacesService = class MarketplacesService {
         });
     }
     /**
-     * Deletes an enterprise marketplace (audit `marketplace.removed`): its cached entries and token
+     * Deletes a custom marketplace (audit `marketplace.removed`): its cached entries and token
      * are deleted; imported catalog items are kept (their marketplace becomes null). Official can
      * only be disabled -> `marketplace.builtin`.
      */
@@ -847,9 +882,14 @@ let MarketplacesService = class MarketplacesService {
                 if ("errors" in m) {
                     throw new MarketplaceInvalidError(`the repository is a single plugin, but its ${PLUGIN_MANIFEST_FILE} is invalid: ${m.errors.slice(0, 5).join("; ")}`, m.errors);
                 }
+                const d = pluginDescription(m.description);
                 entry = {
                     name: m.name,
-                    summary: { en: m.description.slice(0, SUMMARY_MAX) },
+                    summary: {
+                        en: d.en.slice(0, SUMMARY_MAX),
+                        ...(d.zh !== undefined && { zh: d.zh.slice(0, SUMMARY_MAX) }),
+                    },
+                    ...(m.displayName !== undefined && { displayName: m.displayName }),
                     version: m.version,
                     source: { path: "." },
                 };
@@ -935,7 +975,7 @@ let MarketplacesService = class MarketplacesService {
         }));
         return out;
     }
-    /** The token of an enterprise marketplace (undefined without one; official never has one). */
+    /** The token of a custom marketplace (undefined without one; official never has one). */
     async token(id) {
         return (await this.secrets().get(DEPLOYMENT_SECRETS_ORG, tokenKey(id))) ?? undefined;
     }
@@ -1000,6 +1040,8 @@ let MarketplacesService = class MarketplacesService {
                 eb(sql `coalesce(e.npm, '')`, "ilike", like),
                 eb(sql `e.entry->'summary'->>'en'`, "ilike", like),
                 eb(sql `coalesce(e.entry->'summary'->>'zh', '')`, "ilike", like),
+                eb(sql `coalesce(e.entry->'displayName'->>'en', '')`, "ilike", like),
+                eb(sql `coalesce(e.entry->'displayName'->>'zh', '')`, "ilike", like),
             ]));
         }
         const fetched = await query.execute();
@@ -1058,17 +1100,24 @@ let MarketplacesService = class MarketplacesService {
                 name: r.name,
                 version,
                 summary: e.summary,
+                displayName: e.displayName ?? null,
                 minKernel: e.minKernel ?? null,
                 homepage: e.homepage ?? null,
                 permissions: e.permissions ?? null,
                 source: e.source,
+                deprecated: marketplaceEntryDeprecation(e),
                 format: r.claude === null ? "capybara" : "claude-code",
                 compatible,
                 importable,
                 ...(reason !== undefined && { reason }),
                 adopted: adopted ? { itemId: adopted.itemId, versions: [...adopted.versions] } : null,
-                newerAvailable: compatible && version !== null && top !== undefined && compareVersions(version, top) > 0,
+                newerAvailable: compatible &&
+                    !entryDeprecated(e) &&
+                    version !== null &&
+                    top !== undefined &&
+                    compareVersions(version, top) > 0,
                 contentChanged: adopted !== null &&
+                    !entryDeprecated(e) &&
                     entryContentChanged(e, {
                         marketplaceId: r.source_id,
                         headCommit: r.head_commit,
@@ -1281,7 +1330,7 @@ __decorate([
 MarketplacesService = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
-    __param(1, Inject(EnterpriseAdminLock)),
+    __param(1, Inject(SuperAdminLock)),
     __param(2, Inject(CatalogSourceLock)),
     __param(3, Inject(KernelConfigService)),
     __param(4, Inject(KEYRING)),