@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.5

package/dist/extensions/hooks.js

@@ -1,4 +1,5 @@
 import { HOOKS_AVAILABLE, POLICY_HOOKS, } from "@capybara-hq/plugin-sdk";
+import { NEEDS_CONFIG_REASON } from "./effective-config.js";
 import { ExtensionUnloadedError } from "./inflight.js";
 /** Default of `hooks.timeoutMs` (used when a host is built without kernel config, e.g. in tests). */
 export const DEFAULT_HOOK_TIMEOUT_MS = 5000;
@@ -13,6 +14,18 @@ export const OBSERVE_INFLIGHT_MAX = 64;
 export const EMPTY_DENY_REASON = "(no reason given)";
 /** Warnings about a plugin's hooks are logged at most once per plugin, mount and kind in this window. */
 const WARN_WINDOW_MS = 60_000;
+/**
+ * Thrown by a `usage.report` handler wrapper (see {@link HookRegistry.handlers}) instead of calling
+ * a handler whose extension's effective config is not valid in the payload's organization.
+ */
+export class HookNeedsConfigError extends Error {
+    plugin;
+    constructor(plugin) {
+        super(`extension ${plugin} ${NEEDS_CONFIG_REASON}`);
+        this.plugin = plugin;
+        this.name = "HookNeedsConfigError";
+    }
+}
 const AVAILABLE = new Set(HOOKS_AVAILABLE);
 const POLICY = new Set(POLICY_HOOKS);
 /** Error text that never throws itself (a hostile `message` getter or `toString`). */
@@ -110,7 +123,12 @@ const clipDetail = (s) => clipText(s, HOOK_DETAIL_MAX_CHARS);
  *    If a plugin the organization enabled is expected to run policy hooks on the mount (deployment
  *    state, `expectedPolicy`) but is not loaded on this replica, deny with a generic reason
  *    (`hook_error`, `notLoaded`) without running any policy hook (M-1: fail closed). Observe hooks
- *    of plugins that are not loaded are simply missing.
+ *    of plugins that are not loaded are simply missing. Then each enabled plugin with a hook on the
+ *    mount gets its effective config for the organization (layering spec A §6; one read per plugin
+ *    and call, failing like the lookup above). A plugin whose config is not valid behaves as one
+ *    that is not loaded: with a policy hook on the mount the call is denied (`hook_error`,
+ *    `needsConfig`) without running any policy hook, and its observe hooks are skipped. Every
+ *    hook is called with `{ config }` as its third argument.
  * 3. Policy hooks run serially by plugin name (registration order within a plugin), each limited
  *    by `hooks.timeoutMs` (read on every run, hot). `{ deny }`, an error or a timeout stops the chain
  *    and denies (`deny` / `hook_error` / `timeout`). A policy hook cut off by its instance being
@@ -156,13 +174,18 @@ export class HookRegistry {
     }
     /**
      * `usage.report` handlers by plugin name (delivered by the usage queue, not by {@link run}); each
-     * call runs through the instance's `inflight.run`.
+     * call runs through the instance's `inflight.run` with the plugin's effective config for the
+     * payload's organization, and throws {@link HookNeedsConfigError} without calling the handler
+     * when that config is not valid (layering spec A §6).
      */
     handlers(mount) {
         return this.entries(mount).map(({ src, hook }) => ({
             plugin: src.name,
             handler: (payload, signal) => src.inflight.run(signal, async (s) => {
-                await hook.handler(payload, s);
+                const effective = await this.d.effectiveConfig(payload.orgId, src.name);
+                if (!effective.ok)
+                    throw new HookNeedsConfigError(src.name);
+                await hook.handler(payload, s, { config: effective.config });
             }),
         }));
     }
@@ -177,6 +200,8 @@ export class HookRegistry {
         let enabled;
         let frozen;
         let missing;
+        /** Effective config per enabled plugin with a hook here; null = not valid in the org. */
+        const configs = new Map();
         try {
             const abort = abortOf(signal);
             try {
@@ -194,6 +219,19 @@ export class HookRegistry {
             }
             if (!all.some((e) => enabled.has(e.src.name)))
                 return { allowed: true };
+            for (const name of new Set(all.map((e) => e.src.name).filter((n) => enabled.has(n)))) {
+                const abortCfg = abortOf(signal);
+                try {
+                    const e = await Promise.race([
+                        this.d.effectiveConfig(payload.orgId, name),
+                        abortCfg.aborted,
+                    ]);
+                    configs.set(name, e.ok ? { config: e.config } : null);
+                }
+                finally {
+                    abortCfg.cleanup();
+                }
+            }
             // Cost: one clone + deep-freeze per call. The model.request payload carries no media bytes
             // (hookRequestOf, I-3), so it stays small. Freezing in place would freeze the logged object.
             // The clone is skipped when has() is false or no enabled plugin has a hook on this mount.
@@ -207,7 +245,7 @@ export class HookRegistry {
             if (firstPolicy !== undefined) {
                 // R10: no plugin ran; the named plugin is only the first policy plugin on this mount, so
                 // the detail says so instead of blaming it
-                const detail = clipDetail(`Hooks could not run (organization lookup or payload copy failed) before any plugin was called; ${firstPolicy} is named only as the first policy plugin on ${mount}: ${raw}`);
+                const detail = clipDetail(`Hooks could not run (organization lookup, config read or payload copy failed) before any plugin was called; ${firstPolicy} is named only as the first policy plugin on ${mount}: ${raw}`);
                 this.d.log.warn("plugin hooks could not run; denying the call", {
                     mount,
                     firstPolicyPlugin: firstPolicy,
@@ -227,9 +265,19 @@ export class HookRegistry {
             }
             return { allowed: true };
         }
-        const active = all.filter((e) => enabled.has(e.src.name));
+        const active = all.filter((e) => enabled.has(e.src.name) && configs.get(e.src.name));
         const timeoutMs = this.d.config().hooks.timeoutMs;
-        let outcome = missing.length > 0 ? this.notLoadedDenial(mount, missing) : { allowed: true };
+        // spec A §6: a policy plugin without a valid config in the org behaves as one not loaded
+        const needy = [
+            ...new Set(all
+                .filter((e) => e.hook.mode === "policy" && configs.get(e.src.name) === null)
+                .map((e) => e.src.name)),
+        ];
+        let outcome = missing.length > 0
+            ? this.notLoadedDenial(mount, missing)
+            : needy.length > 0
+                ? this.needsConfigDenial(mount, needy)
+                : { allowed: true };
         // policy hooks grouped per plugin (entries are sorted, so groups are contiguous)
         const groups = [];
         for (const e of active) {
@@ -242,7 +290,8 @@ export class HookRegistry {
                 groups.push({ src: e.src, hooks: [e.hook] });
         }
         for (const g of outcome.allowed ? groups : []) {
-            const denied = await this.runPolicies(mount, g.src, g.hooks, frozen, signal, timeoutMs);
+            const call = configs.get(g.src.name);
+            const denied = await this.runPolicies(mount, g.src, g.hooks, frozen, call, signal, timeoutMs);
             if (denied) {
                 outcome = denied;
                 break;
@@ -251,8 +300,10 @@ export class HookRegistry {
         // observe hooks are resolved again now: if the plugin was upgraded while the policy hooks ran,
         // the current generation observes (the retiring one no longer accepts calls)
         for (const e of this.entries(mount)) {
-            if (e.hook.mode === "observe" && enabled.has(e.src.name)) {
-                this.dispatchObserve(mount, e.src, e.hook, frozen, signal);
+            const call = configs.get(e.src.name);
+            // no config read for it (not valid in the org, or a plugin that appeared meanwhile): skipped
+            if (e.hook.mode === "observe" && enabled.has(e.src.name) && call) {
+                this.dispatchObserve(mount, e.src, e.hook, frozen, call, signal);
             }
         }
         return outcome;
@@ -277,6 +328,21 @@ export class HookRegistry {
             notLoaded: true,
         };
     }
+    /**
+     * The layering spec A §6 denial: `needy` (sorted) are enabled policy plugins whose effective
+     * config is not valid in the organization. Generic model-visible reason, as for M-1.
+     */
+    needsConfigDenial(mount, needy) {
+        const plugin = needy[0];
+        return {
+            allowed: false,
+            plugin,
+            reason: unavailableReason(plugin),
+            cause: "hook_error",
+            detail: `extension ${needy.join(", ")} declares a policy hook on ${mount} but ${NEEDS_CONFIG_REASON}; the call was denied without running any policy hook`,
+            needsConfig: true,
+        };
+    }
     /** Active entries of a mount point, sorted by plugin name (stable: registration order within). */
     entries(mount) {
         return this.d
@@ -285,14 +351,14 @@ export class HookRegistry {
             .sort((a, b) => (a.src.name < b.src.name ? -1 : a.src.name > b.src.name ? 1 : 0));
     }
     /** One plugin's policy hooks in registration order; reruns once on a newer generation if revoked. */
-    async runPolicies(mount, src, hooks, payload, signal, timeoutMs, rerun = false) {
+    async runPolicies(mount, src, hooks, payload, call, signal, timeoutMs, rerun = false) {
         const plugin = src.name;
         for (const hook of hooks) {
             if (signal.aborted)
                 throw signal.reason;
             let r;
             try {
-                r = await src.inflight.run(signal, (s) => this.call(hook, payload, s, timeoutMs));
+                r = await src.inflight.run(signal, (s) => this.call(hook, payload, call, s, timeoutMs));
             }
             catch (err) {
                 if (signal.aborted)
@@ -301,7 +367,7 @@ export class HookRegistry {
                     const cur = this.d.current(plugin);
                     if (!rerun && cur && cur !== src) {
                         const again = cur.hooks.filter((h) => h.mount === mount && h.mode === "policy");
-                        return this.runPolicies(mount, cur, again, payload, signal, timeoutMs, true);
+                        return this.runPolicies(mount, cur, again, payload, call, signal, timeoutMs, true);
                     }
                 }
                 r = { kind: "error", message: errMsg(err) };
@@ -338,7 +404,7 @@ export class HookRegistry {
         return undefined;
     }
     /** Fire-and-forget observe call through the instance's in-flight tracker, capped per plugin. */
-    dispatchObserve(mount, src, hook, payload, signal) {
+    dispatchObserve(mount, src, hook, payload, call, signal) {
         const plugin = src.name;
         const n = this.observing.get(plugin) ?? 0;
         if (n >= OBSERVE_INFLIGHT_MAX) {
@@ -349,7 +415,7 @@ export class HookRegistry {
         this.observing.set(plugin, n + 1);
         void (async () => {
             try {
-                const r = await src.inflight.run(signal, (s) => this.call(hook, payload, s, timeoutMs));
+                const r = await src.inflight.run(signal, (s) => this.call(hook, payload, call, s, timeoutMs));
                 if (r.kind === "error" || r.kind === "timeout") {
                     await this.warnOnce(plugin, mount, "failed", "plugin observe hook failed; the call continued", r.kind === "timeout" ? `timed out after ${timeoutMs} ms` : r.message);
                 }
@@ -371,7 +437,7 @@ export class HookRegistry {
      * Calls one handler with its own signal (aborted on timeout or when `s` aborts). Rejects with
      * `s.reason` when `s` aborts first, so callers can tell an abort from a hook failure.
      */
-    async call(hook, payload, s, timeoutMs) {
+    async call(hook, payload, call, s, timeoutMs) {
         const ac = new AbortController();
         const onAbort = () => ac.abort(s.reason);
         if (s.aborted)
@@ -385,7 +451,7 @@ export class HookRegistry {
                 timer = setTimeout(() => resolve("timeout"), timeoutMs);
             });
             const handled = Promise.resolve()
-                .then(() => hook.handler(payload, ac.signal))
+                .then(() => hook.handler(payload, ac.signal, { config: call.config }))
                 .then((v) => ({ v }), (err) => ({ err }));
             const result = await Promise.race([handled, timedOut, abort.aborted]);
             if (result === "timeout") {

package/dist/extensions/host.d.ts

@@ -13,6 +13,7 @@ import type { KernelLogger } from "../log.js";
 import { EmbedTokens } from "../ui/embed-token.js";
 import type { UiActionHandler, UiRender } from "../ui/registry.js";
 import { ExtensionApprovals, type PendingExtension } from "./approvals.js";
+import { EffectiveConfigs } from "./effective-config.js";
 import { HookRegistry } from "./hooks.js";
 import type { InflightTracker } from "./inflight.js";
 import { type DesiredExtension, ExtensionInstalls } from "./installs.js";
@@ -112,6 +113,11 @@ export declare class ExtensionHost {
     private readonly status;
     private readonly config;
     private readonly log;
+    /**
+     * Each hook call's effective config for its organization, and the providers excluded from an
+     * org's point resolution (layering spec A §6).
+     */
+    private readonly effective;
     /**
      * Only resolves extensions and runs migrations in dependency order: no deployment config check, no
      * setup, no Redis (for `capybara migrate`). Like `load()` it checks secret markers first
@@ -244,7 +250,12 @@ export declare class ExtensionHost {
      */
     installs: ExtensionInstalls, approvals: ExtensionApprovals, 
     /** This replica's load status table (`extension_replica_status`): every load result writes a row. */
-    status: ReplicaStatusStore, config: KernelConfigService, kdb: KernelDb, redis: Redis, busSubscriber: BusSubscriber, keyring: Keyring, embedTokens: EmbedTokens, locks: LockService, log: KernelLogger, options: Pick<KernelAppOptions, "resolveFrom">);
+    status: ReplicaStatusStore, config: KernelConfigService, kdb: KernelDb, redis: Redis, busSubscriber: BusSubscriber, keyring: Keyring, embedTokens: EmbedTokens, locks: LockService, log: KernelLogger, options: Pick<KernelAppOptions, "resolveFrom">, 
+    /**
+     * Each hook call's effective config for its organization, and the providers excluded from an
+     * org's point resolution (layering spec A §6).
+     */
+    effective: Pick<EffectiveConfigs, "get">);
     /** The startup config's `extensionConfig` (file / Nacos merged with env). */
     private get extensionConfig();
     /** `extensionPermissions.autoApprove` (development and trials only; see `planApprovals`). */
@@ -489,6 +500,13 @@ export declare class ExtensionHost {
      * （如 `identity-source@1` 的登录配置）；未加载返回 undefined。不得回显到响应或日志。
      */
     deploymentConfig(plugin: string): unknown;
+    /**
+     * The raw (unparsed) deployment config of a running extension: the startup config merged with
+     * the PG values, as the host reads it before parsing (secrets included; never echo it). An org
+     * copy is applied to this and parsed once (layering spec A §6), so schema transforms are not
+     * run twice. Without a running instance, the stored values without a schema.
+     */
+    rawDeploymentConfig(plugin: string): Promise<unknown>;
     /**
      * 本副本拿得到的插件清单里的部署级 schema（生效实例 → 配置声明 → 安装记录准备好的候选）；
      * 都没有返回 undefined（如未加载的安装记录：调用方改用包内静态清单）。

package/dist/extensions/host.js

@@ -31,9 +31,11 @@ import { ExtensionApprovals, planApprovals, readSnapshots, withPreApproved, } fr
 import { ExtensionBlobIntegrityError } from "./blobs.js";
 import { toIssues } from "./config-issues.js";
 import { configFormSchema, describeConfigUiProblems } from "./config-json-schema.js";
+import { EffectiveConfigs } from "./effective-config.js";
 import { HookRegistry } from "./hooks.js";
 import { ExtensionInstalls } from "./installs.js";
 import { ImportTracker, importExtensionModule, ManifestMismatchError, matchesSection, setupInstance, warnUpgrades, } from "./instance.js";
+import { parseLoadGate } from "./org-levels.js";
 import { declaredDisplayName, permissionSetOfSection, readMigrationSql } from "./package.js";
 import { blockingKeys, computePermissionSet, UI_VIEW_KEY_PREFIX, } from "./permission-set.js";
 import { ExtensionRegistry } from "./registry.js";
@@ -172,7 +174,7 @@ function warnPending(log, p) {
             : "extension not loaded: a required extension point is only provided by extensions awaiting permission approval", { plugin: p.plugin, version: p.version, blockedBy: p.blockedBy });
         return;
     }
-    log.warn("extension not loaded: permissions awaiting approval (an enterprise admin approves it in the admin console, or run `capybara extensions review`, then `capybara extensions approve <name>`; running replicas load it without a restart)", { plugin: p.plugin, version: p.version, reason: p.reason, added: p.added, removed: p.removed });
+    log.warn("extension not loaded: permissions awaiting approval (a super admin approves it in the admin console, or run `capybara extensions review`, then `capybara extensions approve <name>`; running replicas load it without a restart)", { plugin: p.plugin, version: p.version, reason: p.reason, added: p.added, removed: p.removed });
 }
 /**
  * 跑单个插件的迁移（`migrationsDir` 为迁移目录的绝对路径；没有迁移时为 undefined）；返回已应用的文件，
@@ -235,6 +237,7 @@ let ExtensionHost = class ExtensionHost {
     status;
     config;
     log;
+    effective;
     /**
      * Only resolves extensions and runs migrations in dependency order: no deployment config check, no
      * setup, no Redis (for `capybara migrate`). Like `load()` it checks secret markers first
@@ -407,13 +410,19 @@ let ExtensionHost = class ExtensionHost {
      */
     installs, approvals, 
     /** This replica's load status table (`extension_replica_status`): every load result writes a row. */
-    status, config, kdb, redis, busSubscriber, keyring, embedTokens, locks, log, options) {
+    status, config, kdb, redis, busSubscriber, keyring, embedTokens, locks, log, options, 
+    /**
+     * Each hook call's effective config for its organization, and the providers excluded from an
+     * org's point resolution (layering spec A §6).
+     */
+    effective) {
         this.registry = registry;
         this.installs = installs;
         this.approvals = approvals;
         this.status = status;
         this.config = config;
         this.log = log;
+        this.effective = effective;
         const c = config.get();
         this.deps = {
             db: kdb.pool,
@@ -433,6 +442,7 @@ let ExtensionHost = class ExtensionHost {
             current: (plugin) => this.registry.current(plugin),
             expectedPolicy: (mount) => this.expectedPolicy(mount),
             enabledPlugins: (orgId) => this.enabledPlugins(orgId),
+            effectiveConfig: (orgId, plugin) => effective.get(orgId, plugin),
             locks,
             config: () => ({ hooks: { timeoutMs: this.config.get().hooks.timeoutMs } }),
             log,
@@ -1190,7 +1200,9 @@ let ExtensionHost = class ExtensionHost {
             return undefined;
         }
         let config = raw;
-        const parsed = readConfig ? schema?.safeParse(raw) : undefined;
+        // the load gate (spec A §5.4a): overridable fields may stay empty on the platform, so
+        // `ctx.config` may lack them; hidden and read-only fields must be complete
+        const parsed = readConfig && schema ? parseLoadGate(schema, raw) : undefined;
         if (a.source !== "install")
             this.configValidity.set(name, parsed?.success ?? true);
         if (decision.action === "pending") {
@@ -1365,7 +1377,7 @@ let ExtensionHost = class ExtensionHost {
                 permissions: d.set,
                 configurable: schema !== undefined,
                 configValid: this.configValidity.get(name) ??
-                    (schema ? schema.safeParse(this.extensionConfig[name] ?? {}).success : true),
+                    (schema ? parseLoadGate(schema, this.extensionConfig[name] ?? {}).success : true),
                 displayName: this.declaredDisplayNames.get(name) ?? null,
             };
         });
@@ -1604,6 +1616,7 @@ let ExtensionHost = class ExtensionHost {
             .all()
             .flatMap((i) => i.provided.has(ref) ? [{ plugin: i.name, impl: i.provided.get(ref) }] : []),
         enabledPlugins: (orgId) => this.enabledPlugins(orgId),
+        configOk: async (orgId, plugin) => (await this.effective.get(orgId, plugin)).ok,
     };
     get loadDeps() {
         return {
@@ -1711,6 +1724,15 @@ let ExtensionHost = class ExtensionHost {
     deploymentConfig(plugin) {
         return this.registry.deploymentConfig(plugin);
     }
+    /**
+     * The raw (unparsed) deployment config of a running extension: the startup config merged with
+     * the PG values, as the host reads it before parsing (secrets included; never echo it). An org
+     * copy is applied to this and parsed once (layering spec A §6), so schema transforms are not
+     * run twice. Without a running instance, the stored values without a schema.
+     */
+    rawDeploymentConfig(plugin) {
+        return this.rawConfigOf(plugin, this.registry.current(plugin)?.manifest.config?.deployment);
+    }
     /**
      * 本副本拿得到的插件清单里的部署级 schema（生效实例 → 配置声明 → 安装记录准备好的候选）；
      * 都没有返回 undefined（如未加载的安装记录：调用方改用包内静态清单）。
@@ -1746,7 +1768,7 @@ let ExtensionHost = class ExtensionHost {
                 if (schema) {
                     try {
                         const raw = await this.rawConfigOf(plugin, schema);
-                        this.configValidity.set(plugin, schema.safeParse(raw).success);
+                        this.configValidity.set(plugin, parseLoadGate(schema, raw).success);
                     }
                     catch (err) {
                         this.log.warn("cannot read the stored deployment config of plugin", {
@@ -1768,7 +1790,7 @@ let ExtensionHost = class ExtensionHost {
                 this.log.error("cannot read the stored deployment config of plugin; keeping its current config", { plugin, err });
                 return "invalid";
             }
-            const r = schema.safeParse(raw);
+            const r = parseLoadGate(schema, raw);
             if (!r.success) {
                 this.log.warn("plugin deployment config changed but is invalid on this replica; keeping the current config", {
                     plugin,
@@ -2178,6 +2200,7 @@ ExtensionHost = __decorate([
     __param(9, Inject(EmbedTokens)),
     __param(10, Inject(LockService)),
     __param(11, Inject(KERNEL_LOGGER)),
-    __param(12, Inject(KERNEL_APP_OPTIONS))
+    __param(12, Inject(KERNEL_APP_OPTIONS)),
+    __param(13, Inject(EffectiveConfigs))
 ], ExtensionHost);
 export { ExtensionHost };

package/dist/extensions/installs.d.ts

@@ -1,10 +1,11 @@
 import { type PluginExtensionSection } from "@capybara-hq/plugin-sdk";
 import type { core } from "zod";
 import type { Keyring } from "../ctx/secrets.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { type ProvenanceResult } from "../packages/provenance.js";
 import { ExtensionApprovals } from "./approvals.js";
 import { ExtensionBlobs } from "./blobs.js";
@@ -83,7 +84,7 @@ export interface IngestSource {
 export declare class ExtensionInstalls {
     private readonly db;
     readonly txHost: TransactionHost;
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
     private readonly adminLock;
     private readonly blobs;
     private readonly approvals;
@@ -91,11 +92,15 @@ export declare class ExtensionInstalls {
     private readonly registry;
     private readonly config;
     private readonly keyring;
+    /** The owner org's lock: an org upload re-checks its org admin instead (ruling P3-10). */
+    private readonly orgLock;
     constructor(db: KernelDb, txHost: TransactionHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
-    adminLock: EnterpriseAdminLock, blobs: ExtensionBlobs, approvals: ExtensionApprovals, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock: SuperAdminLock, blobs: ExtensionBlobs, approvals: ExtensionApprovals, 
     /** The config-declared extension names (an install cannot take them, C15). */
-    registry: ExtensionRegistry, config: KernelConfigService, keyring: Keyring);
+    registry: ExtensionRegistry, config: KernelConfigService, keyring: Keyring, 
+    /** The owner org's lock: an org upload re-checks its org admin instead (ruling P3-10). */
+    orgLock: OrgLock);
     /**
      * An extension's effective deployment config, not validated yet (C10): the startup config
      * (`fileValue`, file / Nacos merged with env) completed by the fields stored in PG; merged by
@@ -112,19 +117,26 @@ export declare class ExtensionInstalls {
      * - extension name equal to a config-declared one -> `extension.config_declared`;
      * - an install record of the same name comes from another npm package -> `extension.name_conflict`
      *   (a new version of the same package is an upgrade, handled elsewhere).
-     * `actor` null means the CLI (no enterprise admin re-check, audit without an actor).
+     * `actor` null means the CLI (no super admin re-check, audit without an actor). `owner`: an org
+     * upload (spec §14, P3-10): the actor is re-checked as an org admin of that org (`catalog.upload`)
+     * instead of a super admin; the package is only stored, as always (nothing runs, no install).
      */
     ingest(actor: string | null, bytes: Uint8Array, src: IngestSource, opts?: {
         actorTokenId?: string;
         store?: "object" | "pg";
         expectPackageName?: string;
+        owner?: {
+            orgId: string;
+        };
     }): Promise<PackageReview>;
     /**
-     * The enterprise admin re-check under its lock, in a transaction of its own (`requires_new`, as
+     * The super admin re-check under its lock, in a transaction of its own (`requires_new`, as
      * before the conversion): the package write that follows never runs inside a caller's
      * transaction holding the lock.
      */
     private authorize;
+    /** The super admin, or for an org upload the owner org's admin, re-checked under its lock. */
+    private authorizeIn;
     /**
      * The `extension.package_uploaded` audit, re-checking the actor under the lock, committed on its
      * own (`requires_new`): the stored package it records is not rolled back by a caller either.
@@ -138,7 +150,7 @@ export declare class ExtensionInstalls {
     /**
      * Fetches one package from the configured npm registry (verified by `dist.integrity`, see
      * packages/npm.ts), downloading only, not storing: download failure -> `packages.npm_failed` (502);
-     * over `packages.maxBytes` -> `extension.package_too_large`. Enterprise catalog npm imports use it
+     * over `packages.maxBytes` -> `extension.package_too_large`. Platform catalog npm imports use it
      * too.
      */
     fetchNpm(input: {

package/dist/extensions/installs.js

@@ -12,12 +12,13 @@ import { Inject, Injectable } from "@nestjs/common";
 import { configFields } from "../config/fields.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KEYRING } from "../infra/tokens.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { fetchNpmPackage, IntegrityMismatchError, NpmFetchError, PackageTooLargeError, } from "../packages/npm.js";
 import { fetchProvenance, PROVENANCE_TIMEOUT_MS, } from "../packages/provenance.js";
 import { ExtensionApprovals } from "./approvals.js";
@@ -45,11 +46,14 @@ let ExtensionInstalls = class ExtensionInstalls {
     registry;
     config;
     keyring;
+    orgLock;
     constructor(db, txHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
     adminLock, blobs, approvals, 
     /** The config-declared extension names (an install cannot take them, C15). */
-    registry, config, keyring) {
+    registry, config, keyring, 
+    /** The owner org's lock: an org upload re-checks its org admin instead (ruling P3-10). */
+    orgLock) {
         this.db = db;
         this.txHost = txHost;
         this.adminLock = adminLock;
@@ -58,6 +62,7 @@ let ExtensionInstalls = class ExtensionInstalls {
         this.registry = registry;
         this.config = config;
         this.keyring = keyring;
+        this.orgLock = orgLock;
     }
     /**
      * An extension's effective deployment config, not validated yet (C10): the startup config
@@ -84,9 +89,14 @@ let ExtensionInstalls = class ExtensionInstalls {
      * - extension name equal to a config-declared one -> `extension.config_declared`;
      * - an install record of the same name comes from another npm package -> `extension.name_conflict`
      *   (a new version of the same package is an upgrade, handled elsewhere).
-     * `actor` null means the CLI (no enterprise admin re-check, audit without an actor).
+     * `actor` null means the CLI (no super admin re-check, audit without an actor). `owner`: an org
+     * upload (spec §14, P3-10): the actor is re-checked as an org admin of that org (`catalog.upload`)
+     * instead of a super admin; the package is only stored, as always (nothing runs, no install).
      */
     async ingest(actor, bytes, src, opts = {}) {
+        if (opts.owner !== undefined && actor === null) {
+            throw new Error("an org upload has an actor");
+        }
         const maxBytes = this.config.get().packages.maxBytes;
         if (bytes.byteLength > maxBytes) {
             throw new ApiError("extension.package_too_large", `The extension package is larger than ${maxBytes} bytes`);
@@ -121,9 +131,9 @@ let ExtensionInstalls = class ExtensionInstalls {
         if (installed && installed.package_name !== packageName) {
             throw new ApiError("extension.name_conflict", `Extension ${m.name} is already installed from package ${installed.package_name}; package ${packageName} uses the same extension name`);
         }
-        // 写包之前在锁内复核发起人仍是企业管理员（守卫读到的身份可能已过期）；审计在写完后同样复核
+        // 写包之前在锁内复核发起人仍是超级管理员（守卫读到的身份可能已过期）；审计在写完后同样复核
         if (actor !== null)
-            await this.authorize(actor);
+            await this.authorize(actor, opts.owner);
         await this.blobs.put(pkg, bytes, {
             source: src.source,
             ref: src.ref,
@@ -135,7 +145,8 @@ let ExtensionInstalls = class ExtensionInstalls {
             version: m.version,
             sha256: pkg.sha256,
             source: src.source,
-        });
+            ...(opts.owner !== undefined && { orgId: opts.owner.orgId }),
+        }, opts.owner);
         const set = permissionSetOfPackage(pkg);
         const snapshot = (await this.approvals.all()).get(m.name);
         const { added, removed } = diffPermissions(snapshot?.permissions, set);
@@ -153,20 +164,27 @@ let ExtensionInstalls = class ExtensionInstalls {
         };
     }
     /**
-     * The enterprise admin re-check under its lock, in a transaction of its own (`requires_new`, as
+     * The super admin re-check under its lock, in a transaction of its own (`requires_new`, as
      * before the conversion): the package write that follows never runs inside a caller's
      * transaction holding the lock.
      */
-    async authorize(actor) {
-        await this.adminLock.lockAndAuthorize(actor);
+    async authorize(actor, owner) {
+        await this.authorizeIn(actor, owner);
+    }
+    /** The super admin, or for an org upload the owner org's admin, re-checked under its lock. */
+    async authorizeIn(actor, owner) {
+        if (owner !== undefined)
+            await this.orgLock.lockAndAuthorize(owner.orgId, actor, "catalog.upload");
+        else
+            await this.adminLock.lockAndAuthorize(actor);
     }
     /**
      * The `extension.package_uploaded` audit, re-checking the actor under the lock, committed on its
      * own (`requires_new`): the stored package it records is not rolled back by a caller either.
      */
-    async auditUpload(actor, actorTokenId, detail) {
+    async auditUpload(actor, actorTokenId, detail, owner) {
         if (actor !== null)
-            await this.adminLock.lockAndAuthorize(actor);
+            await this.authorizeIn(actor, owner);
         await audit(this.db.db, {
             ...(actor !== null && { actorAccountId: actor }),
             ...(actorTokenId !== undefined && { actorTokenId }),
@@ -182,7 +200,7 @@ let ExtensionInstalls = class ExtensionInstalls {
     /**
      * Fetches one package from the configured npm registry (verified by `dist.integrity`, see
      * packages/npm.ts), downloading only, not storing: download failure -> `packages.npm_failed` (502);
-     * over `packages.maxBytes` -> `extension.package_too_large`. Enterprise catalog npm imports use it
+     * over `packages.maxBytes` -> `extension.package_too_large`. Platform catalog npm imports use it
      * too.
      */
     async fetchNpm(input, signal) {
@@ -332,6 +350,9 @@ let ExtensionInstalls = class ExtensionInstalls {
 __decorate([
     Transactional({ propagation: "requires_new" })
 ], ExtensionInstalls.prototype, "authorize", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ExtensionInstalls.prototype, "authorizeIn", null);
 __decorate([
     Transactional({ propagation: "requires_new" })
 ], ExtensionInstalls.prototype, "auditUpload", null);
@@ -339,11 +360,12 @@ ExtensionInstalls = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
-    __param(2, Inject(EnterpriseAdminLock)),
+    __param(2, Inject(SuperAdminLock)),
     __param(3, Inject(ExtensionBlobs)),
     __param(4, Inject(ExtensionApprovals)),
     __param(5, Inject(ExtensionRegistry)),
     __param(6, Inject(KernelConfigService)),
-    __param(7, Inject(KEYRING))
+    __param(7, Inject(KEYRING)),
+    __param(8, Inject(OrgLock))
 ], ExtensionInstalls);
 export { ExtensionInstalls };