@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.5

package/dist/evals/run-replay.js

@@ -263,13 +263,14 @@ function absorbedByStep(s) {
 }
 /**
  * The replayed run's boundary (`trigger_seq`): a wake run's recorded one (`run_started.triggerSeq`,
- * background Bash spec §3); otherwise the newest message after `consumed`, else the newest finish
+ * background Bash spec §3, agent map spec §5.3); otherwise the newest message after `consumed`, else the newest finish
  * after it that could have woken the run (not reported, no `stoppedBy`), else the last
  * message (old logs, as before).
  */
 function replayTrigger(started, seeds, consumed) {
     const recorded = started;
-    if (recorded.trigger === "background_task" && recorded.triggerSeq !== undefined) {
+    if ((recorded.trigger === "background_task" || recorded.trigger === "subagent") &&
+        recorded.triggerSeq !== undefined) {
         return recorded.triggerSeq;
     }
     const lastMessage = seeds.findLast((e) => e.type === "user_message")?.seq;
@@ -330,6 +331,10 @@ export async function replayRun(d, s, candidate, evalRunId, signal) {
             model: candidate.model,
             modelParams: candidate.params,
         };
+    const triggerEvent = s.events.find((e) => e.seq === trigger);
+    const forkRun = triggerEvent?.type === "user_message" &&
+        triggerEvent.payload.skill !== undefined &&
+        triggerEvent.payload.dispatch !== undefined;
     const conversationId = randomUUID();
     const runId = randomUUID();
     await d.seeder.seed({
@@ -450,7 +455,8 @@ export async function replayRun(d, s, candidate, evalRunId, signal) {
             return "stop";
         },
     });
-    // 插话：原运行开始之后到达、且被原运行某一步吸收的可吸收事件（user_message / background_task_finished）
+    // 插话：原运行开始之后到达、且被原运行某一步吸收的可吸收事件（user_message /
+    // background_task_finished / subagent_delivery）
     const absorbed = absorbedByStep(s);
     const stepsInOrder = [...absorbed.keys()].sort((a, b) => a - b);
     /** 第 k 步（含）之前原运行吸收到的最大位置；原运行没有模型调用时不设限。 */
@@ -465,7 +471,10 @@ export async function replayRun(d, s, candidate, evalRunId, signal) {
         return cap;
     };
     const interjections = s.events
-        .filter((e) => (e.type === "user_message" || e.type === "background_task_finished") && e.seq > R)
+        .filter((e) => (e.type === "user_message" ||
+        e.type === "background_task_finished" ||
+        e.type === "subagent_delivery") &&
+        e.seq > R)
         .flatMap((e) => {
         const step = stepsInOrder.find((k) => absorbed.get(k) >= e.seq);
         return step === undefined ? [] : [{ event: e, step }];
@@ -532,6 +541,9 @@ export async function replayRun(d, s, candidate, evalRunId, signal) {
             },
             // replays never fire plugin hooks (the loop deps omit them too, P-18)
             conversationKind: "eval",
+            // a child case offers a sub-agent's message tools, as its recorded requests did (a fork
+            // invocation's child, whose run a task with the invocation record started, has none)
+            ...(subagent !== undefined && !forkRun && { subagent: true }),
         });
     }
     catch (e) {

package/dist/evals/step-replay.d.ts

@@ -4,7 +4,7 @@ import { type Selection } from "../conversations/selection.js";
 import type { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { type MediaSourceDeps } from "../runtime/model-call.js";
 import type { ProviderRegistry } from "../runtime/providers.js";
-import { type DriftReason } from "./reconstruct.js";
+import { type DriftReason, type SubagentTemplateRef } from "./reconstruct.js";
 import type { CaseSnapshot } from "./snapshot.js";
 /**
  * 单步回放（D2 / C5）：由用例快照还原某一步的模型请求，换成候选（agent 版本 / 模型 / 参数 / 指令）重发，
@@ -33,10 +33,7 @@ export interface ResolvedCandidate {
      * A plugin template's child case: the template's current version (set by the worker), compared
      * with the logged one for `subagent_changed` when the candidate changed.
      */
-    subagentTemplate?: {
-        id: string;
-        version: number;
-    };
+    subagentTemplate?: SubagentTemplateRef;
     /**
      * A child case under another agent version: that version's own definition (with the candidate's
      * instructions), compared with the logged sub-agent for `subagent_changed`. Never rendered.

package/dist/evals/step-replay.js

@@ -2,7 +2,7 @@ import { sanitizeParams, } from "@capybara-hq/plugin-sdk";
 import { effectiveDefinition, NO_SELECTION, sameModel, } from "../conversations/selection.js";
 import { estimateTokens } from "../runtime/context/tokens.js";
 import { consumeModelStream, MediaUnavailableError, } from "../runtime/model-call.js";
-import { loadSnapshotMedia, reconstructRequest } from "./reconstruct.js";
+import { loadSnapshotMedia, reconstructRequest, } from "./reconstruct.js";
 /** 键排序后的 JSON（比较参数是否相同）。 */
 const canonical = (v) => JSON.stringify(Object.keys(v)
     .sort()

package/dist/evals/trajectory.service.d.ts

@@ -58,7 +58,7 @@ export type RunStatus = (typeof RUN_STATUSES)[number];
 /**
  * 轨迹查看器（D6、C1）：只给组织管理员（admin / owner）与 agent 负责人。负责人与角色每次实时读（R5）；
  * 无权查看与不存在一律 `trajectory.not_found`，不泄露对话是否存在。每次查看详情写审计 `trajectory.viewed`。
- * 企业管理员不因身份而能看（不是组织成员时 OrgGuard 已 404）。
+ * 超级管理员不因身份而能看（不是组织成员时 OrgGuard 已 404）。
  *
  * 列表按 `conversations.kind` 过滤，不传时只列 `chat`（评测回放的隐藏对话用 `kind: "eval"` 列出）。
  * 评测对话（`kind = 'eval'`）只给组织管理员（Ruling S1-c）：里面是管理员的候选指令，非管理员的 agent 负责人
@@ -98,8 +98,13 @@ export declare class TrajectoryService {
     get(orgId: string, accountId: string, conversationId: string, actorTokenId?: string, window?: RunWindow): Promise<TrajectoryDetail>;
     /** The parent call that first dispatched a sub-agent conversation. */
     private firstDispatch;
-    /** The agent of a sub-agent conversation's parent conversation, or null. */
-    private parentAgentId;
+    /**
+     * The agent of the root conversation of a sub-agent conversation's tree, from its parent `parentId`
+     * up (the same walk as `conversations/access.ts`: at most 16 levels, every conversation between
+     * a sub-agent conversation of the org, ending at one without a parent), or null when the chain
+     * leaves the org, passes another kind or does not end.
+     */
+    private rootAgentId;
     /**
      * 窗口内已开始（`started_at` 非空，与轨迹只列有 `run_started` 的运行一致）的运行，按 (created_at, id) 倒序取
      * `limit` 次；`before` 是上一页的 `next`（运行 id）。`next`：还有更早的运行时为本页最早一次的 id。

package/dist/evals/trajectory.service.js

@@ -34,7 +34,7 @@ const notFound = () => new ApiError("trajectory.not_found", "Trajectory not foun
 /**
  * 轨迹查看器（D6、C1）：只给组织管理员（admin / owner）与 agent 负责人。负责人与角色每次实时读（R5）；
  * 无权查看与不存在一律 `trajectory.not_found`，不泄露对话是否存在。每次查看详情写审计 `trajectory.viewed`。
- * 企业管理员不因身份而能看（不是组织成员时 OrgGuard 已 404）。
+ * 超级管理员不因身份而能看（不是组织成员时 OrgGuard 已 404）。
  *
  * 列表按 `conversations.kind` 过滤，不传时只列 `chat`（评测回放的隐藏对话用 `kind: "eval"` 列出）。
  * 评测对话（`kind = 'eval'`）只给组织管理员（Ruling S1-c）：里面是管理员的候选指令，非管理员的 agent 负责人
@@ -180,11 +180,13 @@ let TrajectoryService = TrajectoryService_1 = class TrajectoryService {
             .where("id", "=", conversationId)
             .where("org_id", "=", orgId)
             .executeTakeFirst();
-        // A sub-agent's trajectory is part of its parent conversation's: authorized by the parent
-        // conversation's agent, never by the dispatched agent (an org agent's owner must not read a
-        // child drawn from someone else's conversation; batch 9 review I1)
+        // A sub-agent's trajectory is part of its tree's: authorized by the ROOT conversation's agent
+        // (the rule `parentReachable` applies to the conversation itself), never by the dispatched
+        // agent nor by the direct parent's, which below an org agent's child is that org agent (an org
+        // agent's owner must not read work drawn from someone else's conversation; batch 9 review I1,
+        // agent map final review: depth 2 and below)
         const authAgentId = conv?.kind === "subagent"
-            ? await this.parentAgentId(orgId, conv.parent_conversation_id)
+            ? await this.rootAgentId(orgId, conv.parent_conversation_id)
             : conv?.agent_id;
         if (!conv || authAgentId === null || authAgentId === undefined)
             throw notFound();
@@ -276,17 +278,27 @@ let TrajectoryService = TrajectoryService_1 = class TrajectoryService {
                 callId: row.parent_call_id,
             };
     }
-    /** The agent of a sub-agent conversation's parent conversation, or null. */
-    async parentAgentId(orgId, parentId) {
+    /**
+     * The agent of the root conversation of a sub-agent conversation's tree, from its parent `parentId`
+     * up (the same walk as `conversations/access.ts`: at most 16 levels, every conversation between
+     * a sub-agent conversation of the org, ending at one without a parent), or null when the chain
+     * leaves the org, passes another kind or does not end.
+     */
+    async rootAgentId(orgId, parentId) {
         if (parentId === null)
             return null;
-        const p = await this.db
-            .selectFrom("conversations")
-            .select("agent_id")
-            .where("id", "=", parentId)
-            .where("org_id", "=", orgId)
-            .executeTakeFirst();
-        return p?.agent_id ?? null;
+        const row = await sql `
+      WITH RECURSIVE up(id, parent, kind, agent_id, n) AS (
+        SELECT c.id, c.parent_conversation_id, c.kind, c.agent_id, 0
+        FROM capybara.conversations c
+        WHERE c.id = ${parentId} AND c.org_id = ${orgId}
+        UNION ALL
+        SELECT c.id, c.parent_conversation_id, c.kind, c.agent_id, up.n + 1
+        FROM capybara.conversations c JOIN up ON c.id = up.parent
+        WHERE up.kind = 'subagent' AND up.n < 16 AND c.org_id = ${orgId}
+      )
+      SELECT agent_id FROM up WHERE parent IS NULL LIMIT 1`.execute(this.db.db);
+        return row.rows[0]?.agent_id ?? null;
     }
     /**
      * 窗口内已开始（`started_at` 非空，与轨迹只列有 `run_started` 的运行一致）的运行，按 (created_at, id) 倒序取

package/dist/evals/worker.d.ts

@@ -13,6 +13,7 @@ import { RunFinish } from "../runtime/run-finish.js";
 import { AgentLoops, RunSteps } from "../runtime/run-steps.js";
 import { EvalBudget } from "./budget.js";
 import { type EvalJobData } from "./jobs.js";
+import { type SubagentTemplateRef } from "./reconstruct.js";
 import { type EvalReplayHooks, EvalReplaySeeder } from "./run-replay.js";
 import { type CaseSnapshot } from "./snapshot.js";
 /**
@@ -110,9 +111,8 @@ export declare class EvalWorker {
 }
 /**
  * A plugin template's child case: the template's current version, which a new dispatch would use
- * (a template removed since gets version 0, so it always differs). Undefined for other cases.
+ * (a template removed since gets version 0, so it always differs), with the platform template
+ * whose content that is (absent: the org's own; a link or pin change under a copy's id changes
+ * it). Undefined for other cases.
  */
-export declare function currentTemplate(db: KernelSchemaDb, s: CaseSnapshot): Promise<{
-    id: string;
-    version: number;
-} | undefined>;
+export declare function currentTemplate(db: KernelSchemaDb, s: CaseSnapshot): Promise<SubagentTemplateRef | undefined>;

package/dist/evals/worker.js

@@ -34,7 +34,7 @@ import { replyParts, structuralDiff } from "./diff.js";
 import { evalJobId } from "./jobs.js";
 import { JUDGE_PROVIDER_UNAVAILABLE, judge } from "./judge.js";
 import { userRequestOf } from "./plan.js";
-import { subagentCaseChanged, subagentStartedOf } from "./reconstruct.js";
+import { subagentCaseChanged, subagentStartedOf, } from "./reconstruct.js";
 import { deleteEvalConversation, EvalReplaySeeder, ReplayClaimLost, replayRun, runBaseline, } from "./run-replay.js";
 import { caseBase, versionDefinition } from "./runs.service.js";
 import { readSnapshot, replayableCalls, toEvents } from "./snapshot.js";
@@ -878,12 +878,18 @@ EvalWorker = __decorate([
 export { EvalWorker };
 /**
  * A plugin template's child case: the template's current version, which a new dispatch would use
- * (a template removed since gets version 0, so it always differs). Undefined for other cases.
+ * (a template removed since gets version 0, so it always differs), with the platform template
+ * whose content that is (absent: the org's own; a link or pin change under a copy's id changes
+ * it). Undefined for other cases.
  */
 export async function currentTemplate(db, s) {
     const t = subagentStartedOf(toEvents(s))?.template;
     if (t?.source !== "plugin" || t.id === undefined)
         return undefined;
     const row = (await loadTemplates(db, s.orgId, [t.id])).get(t.id);
-    return { id: t.id, version: row?.version ?? 0 };
+    return {
+        id: t.id,
+        version: row?.version ?? 0,
+        ...(row?.platformTemplateId !== undefined && { platformTemplateId: row.platformTemplateId }),
+    };
 }

package/dist/extensions/admin-ops.d.ts

@@ -1,8 +1,9 @@
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { ExtensionAdmin, type PublishBus } from "./admin-view.js";
 import { ExtensionBlobs } from "./blobs.js";
 import { ExtensionLifecycle } from "./lifecycle.js";
@@ -15,14 +16,31 @@ import { ExtensionRegistry } from "./registry.js";
  * the commit (a failure only warns; the periodic reconcile catches up); replicas converge through
  * reconcile, no restart. It does not wait for replicas: the returned view may say `converging`.
  * Stateless, shared by every replica; the CLI uses it too (`actor` is null).
- * Every write runs in a transaction: first `lockEnterpriseAdminsAndAuthorize` (skipped by the CLI),
+ * Every write runs in a transaction: first `lockSuperAdminsAndAuthorize` (skipped by the CLI),
  * then an advisory lock by extension name and a lock on the install record row.
  */
+/**
+ * An operation an org admin runs as the owner of an org plugin (an owner update removing or putting
+ * back its extension, ruling P3-12'): the actor is re-checked as an admin of `orgId`
+ * (`catalog.upload`, under the org row lock) instead of as a super admin, and the audit records
+ * the actor with `ownerOrgId`.
+ */
+export interface ExtensionOpsOwner {
+    orgId: string;
+    /**
+     * Putting the extension back after a failed owner update: the actor was authorized when the
+     * update started, so no role is checked again (a demotion meanwhile must not leave the
+     * deployment without the extension it had); the audit keeps the actor, marked `rollback`.
+     */
+    rollback?: true;
+}
 export declare class ExtensionAdminOps {
     private readonly kdb;
     readonly txHost: TransactionHost;
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
     private readonly adminLock;
+    /** The owner org's lock: an owner's operation re-checks its admin under it. */
+    private readonly orgLock;
     private readonly installLock;
     /**
      * The admin view after the operation, degraded when the package cannot be read
@@ -45,8 +63,10 @@ export declare class ExtensionAdminOps {
     private readonly lifecycle;
     private readonly log;
     constructor(kdb: KernelDb, txHost: TransactionHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
-    adminLock: EnterpriseAdminLock, installLock: PluginInstallLock, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock: SuperAdminLock, 
+    /** The owner org's lock: an owner's operation re-checks its admin under it. */
+    orgLock: OrgLock, installLock: PluginInstallLock, 
     /**
      * The admin view after the operation, degraded when the package cannot be read
      * (`get(name, { allowUnreadable: true })`). If it throws, the operation has already committed:
@@ -70,7 +90,7 @@ export declare class ExtensionAdminOps {
      * New install or version change (upgrade / downgrade): the install record points at package
      * `sha256`; the desired state is unchanged (a new install is disabled). Audit `extension.installed`.
      * - Config-declared -> `extension.config_declared`; a required bootstrap plugin may be
-     *   installed at another version (an enterprise admin upgrades it; `required` is kept);
+     *   installed at another version (a super admin upgrades it; `required` is kept);
      * - package not in the package store -> `extension.package_not_found`; the extension name in the
      *   package is not `name` -> `extension.name_mismatch`;
      * - an install record of the same name exists but comes from another npm package ->
@@ -86,7 +106,7 @@ export declare class ExtensionAdminOps {
      *   go back to a version whose migrations are a subset of those already run).
      * Already pointing at the same package: nothing changes (no audit; for a changed source item only,
      * see below).
-     * `opts.catalogItemId`: the source item when installing through the enterprise catalog, stored
+     * `opts.catalogItemId`: the source item when installing through the platform catalog, stored
      * in `extension_installs.catalog_item_id` (F-AA) and registered in `extension_catalog_sources`;
      * installing outside the catalog (upload / npm / CLI) **keeps** the existing source items (T26
      * fix: clearing them would let org enablement bypass catalog policy, C22). The detail of the
@@ -96,17 +116,18 @@ export declare class ExtensionAdminOps {
      */
     install(name: string, sha256: string, actor: string | null, actorTokenId?: string, opts?: {
         catalogItemId?: string;
+        owner?: ExtensionOpsOwner;
     }): Promise<AdminExtensionView>;
     private writeInstall;
     /** Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org enablement is unchanged. */
-    enable(name: string, actor: string | null, actorTokenId?: string): Promise<AdminExtensionView>;
+    enable(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner): Promise<AdminExtensionView>;
     /**
      * Disables on the deployment (audit `extension.disabled`); no change when already disabled. Every
      * replica unloads it (draining in-flight calls), and the extensions that `requires` it unload with
      * it; the org enablement switch is unchanged and the org page shows it as unavailable. A required
      * bootstrap plugin -> `extension.required`.
      */
-    disable(name: string, actor: string | null, actorTokenId?: string): Promise<AdminExtensionView>;
+    disable(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner): Promise<AdminExtensionView>;
     /**
      * Uninstall: a required bootstrap plugin -> `extension.required`; must be disabled first
      * (otherwise `extension.not_disabled`); deletes the install record
@@ -115,7 +136,7 @@ export declare class ExtensionAdminOps {
      * permission snapshot and the package in the package store are untouched (a reinstall picks them
      * up).
      */
-    uninstall(name: string, actor: string | null, actorTokenId?: string): Promise<void>;
+    uninstall(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner): Promise<void>;
     private writeUninstall;
     private setState;
     private writeState;
@@ -123,6 +144,11 @@ export declare class ExtensionAdminOps {
      * 提交后的视图：拼视图失败（读包、查状态行出错）时操作已经生效，不能再报失败——记 error，返回降级视图。
      */
     private viewAfterCommit;
+    /**
+     * Re-checks the actor in the operation's transaction: a super admin, or for an owner's operation
+     * an admin of the owner org; no account (the CLI, the kernel itself) is not checked.
+     */
+    private authorize;
     /** 配置声明的插件不经安装记录管理。 */
     private assertInstallable;
     /** 按插件名串行（`PluginInstallLock`，覆盖「还没有行」的新装），再锁住已有的安装记录行。 */

package/dist/extensions/admin-ops.js

@@ -14,13 +14,14 @@ import semver from "semver";
 import { pluginSchemaName } from "../ctx/create-ctx.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { ExtensionAdmin } from "./admin-view.js";
 import { ExtensionBlobs } from "./blobs.js";
 import { ExtensionLifecycle, PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
@@ -28,19 +29,11 @@ import { PluginInstallLock } from "./locks.js";
 import { unrunMigrations } from "./migrate-lock.js";
 import { ExtensionPackageError, extensionPackageApiError, readExtensionPackage, } from "./package.js";
 import { ExtensionRegistry } from "./registry.js";
-/**
- * Deployment-level extension install / enable / disable / uninstall (C16 / D15): writes only the PG
- * desired state (`extension_installs`) and the audit, then publishes `kernel.plugins.changed` after
- * the commit (a failure only warns; the periodic reconcile catches up); replicas converge through
- * reconcile, no restart. It does not wait for replicas: the returned view may say `converging`.
- * Stateless, shared by every replica; the CLI uses it too (`actor` is null).
- * Every write runs in a transaction: first `lockEnterpriseAdminsAndAuthorize` (skipped by the CLI),
- * then an advisory lock by extension name and a lock on the install record row.
- */
 let ExtensionAdminOps = class ExtensionAdminOps {
     kdb;
     txHost;
     adminLock;
+    orgLock;
     installLock;
     admin;
     registry;
@@ -50,8 +43,10 @@ let ExtensionAdminOps = class ExtensionAdminOps {
     lifecycle;
     log;
     constructor(kdb, txHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
-    adminLock, installLock, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock, 
+    /** The owner org's lock: an owner's operation re-checks its admin under it. */
+    orgLock, installLock, 
     /**
      * The admin view after the operation, degraded when the package cannot be read
      * (`get(name, { allowUnreadable: true })`). If it throws, the operation has already committed:
@@ -73,6 +68,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         this.kdb = kdb;
         this.txHost = txHost;
         this.adminLock = adminLock;
+        this.orgLock = orgLock;
         this.installLock = installLock;
         this.admin = admin;
         this.registry = registry;
@@ -89,7 +85,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * New install or version change (upgrade / downgrade): the install record points at package
      * `sha256`; the desired state is unchanged (a new install is disabled). Audit `extension.installed`.
      * - Config-declared -> `extension.config_declared`; a required bootstrap plugin may be
-     *   installed at another version (an enterprise admin upgrades it; `required` is kept);
+     *   installed at another version (a super admin upgrades it; `required` is kept);
      * - package not in the package store -> `extension.package_not_found`; the extension name in the
      *   package is not `name` -> `extension.name_mismatch`;
      * - an install record of the same name exists but comes from another npm package ->
@@ -105,7 +101,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      *   go back to a version whose migrations are a subset of those already run).
      * Already pointing at the same package: nothing changes (no audit; for a changed source item only,
      * see below).
-     * `opts.catalogItemId`: the source item when installing through the enterprise catalog, stored
+     * `opts.catalogItemId`: the source item when installing through the platform catalog, stored
      * in `extension_installs.catalog_item_id` (F-AA) and registered in `extension_catalog_sources`;
      * installing outside the catalog (upload / npm / CLI) **keeps** the existing source items (T26
      * fix: clearing them would let org enablement bypass catalog policy, C22). The detail of the
@@ -140,8 +136,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
     }
     async writeInstall(name, sha256, pkg, target, actor, actorTokenId, opts) {
         const db = this.db;
-        if (actor !== null)
-            await this.adminLock.lockAndAuthorize(actor);
+        await this.authorize(actor, opts.owner);
         const row = await this.lockRow(name);
         // 不经目录重装时保留原来的来源条目（不清空，C22）
         const catalogItemId = opts.catalogItemId ?? row?.catalog_item_id ?? null;
@@ -221,13 +216,14 @@ let ExtensionAdminOps = class ExtensionAdminOps {
             .execute();
         await this.audit(actor, actorTokenId, "extension.installed", name, pkg.version, sha256, {
             catalogItemId,
+            ...ownerDetail(opts.owner),
         });
         afterCommit(() => this.notify(name));
         return { changed: true, state: row?.desired_state ?? "disabled" };
     }
     /** Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org enablement is unchanged. */
-    enable(name, actor, actorTokenId) {
-        return this.setState(name, "enabled", actor, actorTokenId);
+    enable(name, actor, actorTokenId, owner) {
+        return this.setState(name, "enabled", actor, actorTokenId, owner);
     }
     /**
      * Disables on the deployment (audit `extension.disabled`); no change when already disabled. Every
@@ -235,8 +231,8 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * it; the org enablement switch is unchanged and the org page shows it as unavailable. A required
      * bootstrap plugin -> `extension.required`.
      */
-    disable(name, actor, actorTokenId) {
-        return this.setState(name, "disabled", actor, actorTokenId);
+    disable(name, actor, actorTokenId, owner) {
+        return this.setState(name, "disabled", actor, actorTokenId, owner);
     }
     /**
      * Uninstall: a required bootstrap plugin -> `extension.required`; must be disabled first
@@ -246,14 +242,13 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * permission snapshot and the package in the package store are untouched (a reinstall picks them
      * up).
      */
-    async uninstall(name, actor, actorTokenId) {
+    async uninstall(name, actor, actorTokenId, owner) {
         this.assertInstallable(name);
-        await this.writeUninstall(name, actor, actorTokenId);
+        await this.writeUninstall(name, actor, actorTokenId, owner);
     }
-    async writeUninstall(name, actor, actorTokenId) {
+    async writeUninstall(name, actor, actorTokenId, owner) {
         const db = this.db;
-        if (actor !== null)
-            await this.adminLock.lockAndAuthorize(actor);
+        await this.authorize(actor, owner);
         const row = await this.lockRow(name);
         if (!row)
             throw notFound(name);
@@ -265,22 +260,21 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         await db.deleteFrom("extension_installs").where("name", "=", name).execute();
         // 来源条目随安装记录一起删：之后不经目录重新安装时不再受旧条目的策略约束（T26 裁决）
         await db.deleteFrom("extension_catalog_sources").where("plugin", "=", name).execute();
-        await this.audit(actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256);
+        await this.audit(actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256, ownerDetail(owner));
         afterCommit(() => this.notify(name));
     }
-    async setState(name, state, actor, actorTokenId) {
+    async setState(name, state, actor, actorTokenId, owner) {
         this.assertInstallable(name);
-        const result = await this.writeState(name, state, actor, actorTokenId);
+        const result = await this.writeState(name, state, actor, actorTokenId, owner);
         return this.viewAfterCommit(name, {
             version: result.row.version,
             sha256: result.row.sha256,
             state,
         });
     }
-    async writeState(name, state, actor, actorTokenId) {
+    async writeState(name, state, actor, actorTokenId, owner) {
         const db = this.db;
-        if (actor !== null)
-            await this.adminLock.lockAndAuthorize(actor);
+        await this.authorize(actor, owner);
         const row = await this.lockRow(name);
         if (!row)
             throw notFound(name);
@@ -297,7 +291,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         })
             .where("name", "=", name)
             .execute();
-        await this.audit(actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256);
+        await this.audit(actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256, ownerDetail(owner));
         afterCommit(() => this.notify(name));
         return { row, changed: true };
     }
@@ -316,6 +310,22 @@ let ExtensionAdminOps = class ExtensionAdminOps {
             return fallbackView(name, known, err);
         }
     }
+    /**
+     * Re-checks the actor in the operation's transaction: a super admin, or for an owner's operation
+     * an admin of the owner org; no account (the CLI, the kernel itself) is not checked.
+     */
+    async authorize(actor, owner) {
+        if (owner?.rollback === true)
+            return;
+        if (owner !== undefined) {
+            if (actor === null)
+                throw new Error("an owner's extension operation has an actor");
+            await this.orgLock.lockAndAuthorize(owner.orgId, actor, "catalog.upload");
+        }
+        else if (actor !== null) {
+            await this.adminLock.lockAndAuthorize(actor);
+        }
+    }
     /** 配置声明的插件不经安装记录管理。 */
     assertInstallable(name) {
         const declared = this.registry.declared().get(name);
@@ -372,6 +382,9 @@ __decorate([
 __decorate([
     Transactional()
 ], ExtensionAdminOps.prototype, "writeState", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ExtensionAdminOps.prototype, "authorize", null);
 __decorate([
     Transactional({ propagation: "mandatory" })
 ], ExtensionAdminOps.prototype, "lockRow", null);
@@ -379,15 +392,16 @@ ExtensionAdminOps = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
-    __param(2, Inject(EnterpriseAdminLock)),
-    __param(3, Inject(PluginInstallLock)),
-    __param(4, Inject(ExtensionAdmin)),
-    __param(5, Inject(ExtensionRegistry)),
-    __param(6, Inject(ExtensionBlobs)),
-    __param(7, Inject(KernelConfigService)),
-    __param(8, Inject(KERNEL_BUS)),
-    __param(9, Inject(ExtensionLifecycle)),
-    __param(10, Inject(KERNEL_LOGGER))
+    __param(2, Inject(SuperAdminLock)),
+    __param(3, Inject(OrgLock)),
+    __param(4, Inject(PluginInstallLock)),
+    __param(5, Inject(ExtensionAdmin)),
+    __param(6, Inject(ExtensionRegistry)),
+    __param(7, Inject(ExtensionBlobs)),
+    __param(8, Inject(KernelConfigService)),
+    __param(9, Inject(KERNEL_BUS)),
+    __param(10, Inject(ExtensionLifecycle)),
+    __param(11, Inject(KERNEL_LOGGER))
 ], ExtensionAdminOps);
 export { ExtensionAdminOps };
 /**
@@ -418,6 +432,9 @@ function fallbackView(name, known, err) {
         configValid: true,
         removable: true,
         required: false,
+        scope: null,
+        enabledOrgs: 0,
+        builtin: false,
         installSource: null,
         error: `the change was saved, but its current status cannot be read: ${err instanceof Error ? err.message : String(err)}`,
     };
@@ -443,7 +460,13 @@ async function hasRetainedData(db, name) {
         .executeTakeFirst();
     return hit !== undefined;
 }
-const required = (name) => new ApiError("extension.required", `Extension ${name} is required by this deployment (a bootstrap plugin): it is enabled in every organization and cannot be disabled or uninstalled; an enterprise admin can upgrade it`);
+const required = (name) => new ApiError("extension.required", `Extension ${name} is required by this deployment (a bootstrap plugin): it is enabled in every organization and cannot be disabled or uninstalled; a super admin can upgrade it`);
 const notFound = (name) => new ApiError("extension.not_found", `Extension ${name} is not installed in this deployment`);
 /** `to` 比 `from` 旧（任一方不是合法 semver 时不算降级）。 */
 const isDowngrade = (to, from) => semver.valid(to) !== null && semver.valid(from) !== null && semver.lt(to, from);
+/** The audit detail of an owner's operation. */
+function ownerDetail(owner) {
+    if (owner === undefined)
+        return {};
+    return { ownerOrgId: owner.orgId, ...(owner.rollback === true && { rollback: true }) };
+}