@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.5

package/dist/http/app.js

@@ -3,9 +3,11 @@ import fastifyCookie from "@fastify/cookie";
 import { ApiError, errorBody } from "../errors.js";
 import { AccountsService } from "../identity/accounts.js";
 import { ApiTokenService } from "../identity/api-tokens.js";
-import { authorizeEnterpriseAdmin } from "../identity/auth.guard.js";
+import { authenticateOrgUploader, authorizeSuperAdmin, } from "../identity/auth.guard.js";
 import { SessionService } from "../identity/sessions.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
 import { withLogContext } from "../log-context.js";
+import { authorizeOrgAction } from "../orgs/org.guard.js";
 import { redactPath } from "./error.filter.js";
 import { registerGatewayRoutes } from "./gateway-routes.js";
 import { createPluginRouter, registerPluginDispatch, staticRouteTable, } from "./plugin-dispatch.js";
@@ -13,14 +15,24 @@ import { createPluginRouter, registerPluginDispatch, staticRouteTable, } from ".
 export const EXTENSION_PACKAGE_UPLOAD_ROUTE = "/api/v1/admin/extensions/packages/file";
 /** The plugin package upload route of the catalog import (Fastify route template). */
 export const CATALOG_UPLOAD_ROUTE = "/api/v1/admin/catalog/import/file";
+/** The platform skill version upload route (a skill package zip as the raw body). */
+export const COMPONENT_SKILL_UPLOAD_ROUTE = "/api/v1/admin/components/skill/:id/versions";
 /**
  * The upload routes that take raw bytes (`application/octet-stream`, limit `packages.maxBytes`,
- * the enterprise admin is authenticated before the body is read).
+ * the super admin is authenticated before the body is read).
  */
 export const PACKAGE_UPLOAD_ROUTES = new Set([
     EXTENSION_PACKAGE_UPLOAD_ROUTE,
     CATALOG_UPLOAD_ROUTE,
+    COMPONENT_SKILL_UPLOAD_ROUTE,
 ]);
+/** An org admin's plugin package upload (spec §14, ruling P3-7; a tgz as the raw body). */
+export const ORG_PLUGIN_UPLOAD_ROUTE = "/api/v1/orgs/:orgId/catalog/uploads/file";
+/**
+ * The org routes that take raw package bytes (limit `packages.maxBytes`): before the body is read
+ * the caller is authenticated as a person with the org role of `catalog.upload` (ruling P3-29).
+ */
+export const ORG_PACKAGE_UPLOAD_ROUTES = new Set([ORG_PLUGIN_UPLOAD_ROUTE]);
 /** Paths without an access log line (probes). */
 const QUIET_PATHS = new Set(["/healthz", "/readyz"]);
 /**
@@ -92,11 +104,12 @@ export async function createHttpApp(opts, app) {
         if (LARGE_BODY_ROUTES.has(r.url) && [r.method].flat().includes("POST")) {
             r.bodyLimit = LARGE_BODY_LIMIT;
         }
-        if (PACKAGE_UPLOAD_ROUTES.has(r.url) && opts.packageMaxBytes !== undefined) {
+        const upload = PACKAGE_UPLOAD_ROUTES.has(r.url) || ORG_PACKAGE_UPLOAD_ROUTES.has(r.url);
+        if (upload && opts.packageMaxBytes !== undefined) {
             r.bodyLimit = opts.packageMaxBytes + 1;
         }
     });
-    // 读请求体之前：包上传（插件包、企业目录包）先认证（未认证 / 非企业管理员的大请求体不读进内存）；其余内核路由不收
+    // 读请求体之前：包上传（插件包、平台目录包）先认证（未认证 / 非超级管理员的大请求体不读进内存）；其余内核路由不收
     // application/octet-stream（415）。插件路由 /plugins/* 在自己的作用域里收任何类型，不受影响
     let authServices;
     const services = () => {
@@ -119,7 +132,20 @@ export async function createHttpApp(opts, app) {
             return;
         if (req.method === "POST" && PACKAGE_UPLOAD_ROUTES.has(req.routeOptions.url ?? "")) {
             try {
-                await authorizeEnterpriseAdmin(req, services());
+                await authorizeSuperAdmin(req, services());
+            }
+            catch (e) {
+                return sendError(reply, e, req.method, req.url);
+            }
+            return;
+        }
+        if (req.method === "POST" && ORG_PACKAGE_UPLOAD_ROUTES.has(req.routeOptions.url ?? "")) {
+            try {
+                // the org admin role before the body (ruling P3-29): no one else makes the kernel buffer
+                // a package-sized body
+                const principal = await authenticateOrgUploader(req, services());
+                const orgId = req.params.orgId ?? "";
+                await authorizeOrgAction(app.get(KernelDb, { strict: false }).db, principal, orgId, "catalog.upload");
             }
             catch (e) {
                 return sendError(reply, e, req.method, req.url);

package/dist/identity/accounts.d.ts

@@ -3,31 +3,31 @@ import { SetupLock } from "../admin/setup-lock.js";
 import type { AccountsTable } from "../db/kernel-schema.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
-import { EnterpriseAdminLock } from "./enterprise-admin.js";
+import { SuperAdminLock } from "./super-admin.js";
 export interface Account {
     id: string;
     displayName: string;
     email: string | null;
     status: "active" | "disabled";
-    isEnterpriseAdmin: boolean;
+    isSuperAdmin: boolean;
     createdAt: Date;
 }
-/** 企业管理员可改的账号字段。 */
+/** 超级管理员可改的账号字段。 */
 export type AccountPatch = {
     displayName?: string;
     status?: "active" | "disabled";
-    isEnterpriseAdmin?: boolean;
+    isSuperAdmin?: boolean;
 };
 /** 构造 `Account` 所需的 accounts 列（供跨表查询 select 使用）。 */
-export declare const ACCOUNT_COLUMNS: readonly ["accounts.id", "accounts.display_name", "accounts.email", "accounts.status", "accounts.is_enterprise_admin", "accounts.created_at"];
-type AccountRow = Pick<Selectable<AccountsTable>, "id" | "display_name" | "email" | "status" | "is_enterprise_admin" | "created_at">;
+export declare const ACCOUNT_COLUMNS: readonly ["accounts.id", "accounts.display_name", "accounts.email", "accounts.status", "accounts.is_super_admin", "accounts.created_at"];
+type AccountRow = Pick<Selectable<AccountsTable>, "id" | "display_name" | "email" | "status" | "is_super_admin" | "created_at">;
 export declare function toAccount(r: AccountRow): Account;
 export interface LocalAccountInput {
     login: string;
     password: string;
     displayName: string;
     email?: string;
-    enterpriseAdmin?: boolean;
+    superAdmin?: boolean;
 }
 /**
  * Accounts: local account creation, authentication and administration. Every write is
@@ -39,7 +39,7 @@ export declare class AccountsService {
     readonly txHost: TransactionHost;
     private readonly adminLock;
     private readonly setupLock;
-    constructor(db: KernelDb, txHost: TransactionHost, adminLock: EnterpriseAdminLock, setupLock: SetupLock);
+    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock, setupLock: SetupLock);
     /** Checks the password length and hashes it (scrypt, slow): for callers that hash before their transaction opens. */
     hashNewPassword(password: string): Promise<string>;
     /**
@@ -49,28 +49,28 @@ export declare class AccountsService {
      */
     createLocal(input: LocalAccountInput, passwordHash?: string): Promise<Account>;
     /**
-     * An enterprise admin creates a local account (optionally an enterprise admin): under the
-     * enterprise admin lock, re-checks that the actor is still an active enterprise admin (else
+     * A super admin creates a local account (optionally a super admin): under the
+     * super admin lock, re-checks that the actor is still an active super admin (else
      * `forbidden`), creates the account and audits `account.created`. The hash is computed before
      * the lock.
      */
     createByAdmin(input: LocalAccountInput, actorAccountId: string, actorTokenId?: string): Promise<Account>;
     private createByAdminIn;
     /**
-     * CLI: creates an enterprise admin without checking whether the deployment is set up; a taken
+     * CLI: creates a super admin without checking whether the deployment is set up; a taken
      * login → `account.login_taken`.
      */
-    createEnterpriseAdmin(input: EnterpriseAdminInput): Promise<Account>;
+    createSuperAdmin(input: SuperAdminInput): Promise<Account>;
     /**
-     * CLI `admin create --if-none`: creates an enterprise admin only when no active one exists. The
+     * CLI `admin create --if-none`: creates a super admin only when no active one exists. The
      * check and the insert run in one transaction under {@link SetupLock}, the lock the web setup
      * takes, so concurrent runs (and a concurrent web setup) create exactly one. Returns undefined
-     * when an active enterprise admin already exists; a taken login still throws
+     * when an active super admin already exists; a taken login still throws
      * `account.login_taken`.
      */
-    createEnterpriseAdminIfNone(input: EnterpriseAdminInput): Promise<Account | undefined>;
-    private createEnterpriseAdminIfNoneIn;
-    private insertEnterpriseAdmin;
+    createSuperAdminIfNone(input: SuperAdminInput): Promise<Account | undefined>;
+    private createSuperAdminIfNoneIn;
+    private insertSuperAdmin;
     authenticateLocal(login: string, password: string): Promise<Account | null>;
     /** 按账号 id 校验本地密码（改密码时核对旧密码）；没有本地密码、超长或不符 → false。 */
     verifyPassword(accountId: string, password: string): Promise<boolean>;
@@ -92,7 +92,7 @@ export declare class AccountsService {
     private changePasswordIn;
     update(id: string, patch: AccountPatch, actorAccountId: string, actorTokenId?: string): Promise<Account>;
     /**
-     * An enterprise admin changes an account. Disabling (`status: "disabled"`) revokes the
+     * A super admin changes an account. Disabling (`status: "disabled"`) revokes the
      * account's sessions (`sessions.revoked_at`) and personal tokens in **the same PG transaction**,
      * all or nothing; returns the revoked session ids, whose Redis markers the caller writes after
      * the commit (the fast path; a failure is only a warning: auth reads PG).
@@ -102,35 +102,35 @@ export declare class AccountsService {
         revokedSessionIds: string[];
     }>;
     /**
-     * The CLI's `capybara admin grant|revoke <login>` (no actor account): changes the enterprise
-     * admin flag by local login under the enterprise admin lock; revoking keeps the
-     * {@link updateAccount} "last active enterprise admin" check (`account.last_enterprise_admin`),
+     * The CLI's `capybara admin grant|revoke <login>` (no actor account): changes the super
+     * admin flag by local login under the super admin lock; revoking keeps the
+     * {@link updateAccount} "last active super admin" check (`account.last_super_admin`),
      * decided under the lock, so it cannot race a web revoke into none. Audit `account.updated`
      * without an actor, `detail.via = "cli"`. Already in the target state → no change and no audit
      * (`changed: false`). Unknown login → `account.not_found`.
      */
-    setEnterpriseAdminByLogin(login: string, isEnterpriseAdmin: boolean): Promise<{
+    setSuperAdminByLogin(login: string, isSuperAdmin: boolean): Promise<{
         account: Account;
         changed: boolean;
     }>;
-    private setEnterpriseAdminIn;
+    private setSuperAdminIn;
     /** 全部账号数（含停用的；后台概览）。 */
     count(): Promise<number>;
-    /** Active (status = active) enterprise admins, in the context's transaction when there is one. */
-    countEnterpriseAdmins(): Promise<number>;
+    /** Active (status = active) super admins, in the context's transaction when there is one. */
+    countSuperAdmins(): Promise<number>;
     /** Inserts the account, its local identity and password; a taken login → `account.login_taken`. */
     private insertLocal;
     /** Writes (or replaces) the local password hash; a missing account → `account.not_found`. */
     private writePassword;
     /**
-     * Changes the account under the enterprise admin lock the caller holds: updates the row,
-     * re-checks "the last active enterprise admin", audits `account.updated`; disabling revokes the
+     * Changes the account under the super admin lock the caller holds: updates the row,
+     * re-checks "the last active super admin", audits `account.updated`; disabling revokes the
      * account's sessions and personal tokens.
      */
     private applyUpdate;
 }
-/** Input of the CLI enterprise admin creation. */
-export interface EnterpriseAdminInput {
+/** Input of the CLI super admin creation. */
+export interface SuperAdminInput {
     login: string;
     password: string;
     displayName: string;

package/dist/identity/accounts.js

@@ -16,16 +16,16 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { audit } from "./audit.js";
-import { EnterpriseAdminLock, EnterpriseAdminLockModule } from "./enterprise-admin.js";
 import { MAX_PASSWORD_LENGTH, normalizeLogin, validatePassword } from "./login.js";
 import { DUMMY_PASSWORD_HASH, hashPassword, verifyPassword } from "./passwords.js";
+import { SuperAdminLock, SuperAdminLockModule } from "./super-admin.js";
 /** 构造 `Account` 所需的 accounts 列（供跨表查询 select 使用）。 */
 export const ACCOUNT_COLUMNS = [
     "accounts.id",
     "accounts.display_name",
     "accounts.email",
     "accounts.status",
-    "accounts.is_enterprise_admin",
+    "accounts.is_super_admin",
     "accounts.created_at",
 ];
 export function toAccount(r) {
@@ -34,7 +34,7 @@ export function toAccount(r) {
         displayName: r.display_name,
         email: r.email,
         status: r.status,
-        isEnterpriseAdmin: r.is_enterprise_admin,
+        isSuperAdmin: r.is_super_admin,
         createdAt: r.created_at,
     };
 }
@@ -82,8 +82,8 @@ let AccountsService = class AccountsService {
         return this.insertLocal(await prepareLocal(input, passwordHash));
     }
     /**
-     * An enterprise admin creates a local account (optionally an enterprise admin): under the
-     * enterprise admin lock, re-checks that the actor is still an active enterprise admin (else
+     * A super admin creates a local account (optionally a super admin): under the
+     * super admin lock, re-checks that the actor is still an active super admin (else
      * `forbidden`), creates the account and audits `account.created`. The hash is computed before
      * the lock.
      */
@@ -98,45 +98,45 @@ let AccountsService = class AccountsService {
             ...(actorTokenId !== undefined && { actorTokenId }),
             action: "account.created",
             target: a.id,
-            detail: { enterpriseAdmin: a.isEnterpriseAdmin },
+            detail: { superAdmin: a.isSuperAdmin },
         });
         return a;
     }
     /**
-     * CLI: creates an enterprise admin without checking whether the deployment is set up; a taken
+     * CLI: creates a super admin without checking whether the deployment is set up; a taken
      * login → `account.login_taken`.
      */
-    async createEnterpriseAdmin(input) {
-        return this.insertEnterpriseAdmin(input, await this.hashNewPassword(input.password));
+    async createSuperAdmin(input) {
+        return this.insertSuperAdmin(input, await this.hashNewPassword(input.password));
     }
     /**
-     * CLI `admin create --if-none`: creates an enterprise admin only when no active one exists. The
+     * CLI `admin create --if-none`: creates a super admin only when no active one exists. The
      * check and the insert run in one transaction under {@link SetupLock}, the lock the web setup
      * takes, so concurrent runs (and a concurrent web setup) create exactly one. Returns undefined
-     * when an active enterprise admin already exists; a taken login still throws
+     * when an active super admin already exists; a taken login still throws
      * `account.login_taken`.
      */
-    async createEnterpriseAdminIfNone(input) {
-        return this.createEnterpriseAdminIfNoneIn(input, await this.hashNewPassword(input.password));
+    async createSuperAdminIfNone(input) {
+        return this.createSuperAdminIfNoneIn(input, await this.hashNewPassword(input.password));
     }
-    async createEnterpriseAdminIfNoneIn(input, passwordHash) {
+    async createSuperAdminIfNoneIn(input, passwordHash) {
         await this.setupLock.lock();
-        if ((await this.countEnterpriseAdmins()) > 0)
+        if ((await this.countSuperAdmins()) > 0)
             return undefined;
-        return this.insertEnterpriseAdmin(input, passwordHash);
+        return this.insertSuperAdmin(input, passwordHash);
     }
-    async insertEnterpriseAdmin(input, passwordHash) {
+    async insertSuperAdmin(input, passwordHash) {
         const account = await this.createLocal({
             login: input.login,
             password: input.password,
             displayName: input.displayName,
-            enterpriseAdmin: true,
+            superAdmin: true,
             ...(input.email !== undefined && { email: input.email }),
         }, passwordHash);
         await audit(this.db.db, {
             action: "account.created",
             target: account.id,
-            detail: { enterpriseAdmin: true, via: "cli" },
+            detail: { superAdmin: true, via: "cli" },
         });
         return account;
     }
@@ -163,7 +163,7 @@ let AccountsService = class AccountsService {
             "accounts.email",
             "accounts.email_verified",
             "accounts.status",
-            "accounts.is_enterprise_admin",
+            "accounts.is_super_admin",
             "accounts.created_at",
             "accounts.updated_at",
             "local_passwords.password_hash",
@@ -245,13 +245,13 @@ let AccountsService = class AccountsService {
         return (await this.updateAccount(id, patch, actorAccountId, actorTokenId)).account;
     }
     /**
-     * An enterprise admin changes an account. Disabling (`status: "disabled"`) revokes the
+     * A super admin changes an account. Disabling (`status: "disabled"`) revokes the
      * account's sessions (`sessions.revoked_at`) and personal tokens in **the same PG transaction**,
      * all or nothing; returns the revoked session ids, whose Redis markers the caller writes after
      * the commit (the fast path; a failure is only a warning: auth reads PG).
      */
     async updateAccount(id, patch, actorAccountId, actorTokenId) {
-        // Every enterprise admin write is serialized by one lock and re-checks the actor under it: two
+        // Every super admin write is serialized by one lock and re-checks the actor under it: two
         // admins revoking each other concurrently cannot leave none, and a just-revoked admin's
         // request in flight fails
         await this.adminLock.lockAndAuthorize(actorAccountId);
@@ -269,14 +269,14 @@ let AccountsService = class AccountsService {
         });
     }
     /**
-     * The CLI's `capybara admin grant|revoke <login>` (no actor account): changes the enterprise
-     * admin flag by local login under the enterprise admin lock; revoking keeps the
-     * {@link updateAccount} "last active enterprise admin" check (`account.last_enterprise_admin`),
+     * The CLI's `capybara admin grant|revoke <login>` (no actor account): changes the super
+     * admin flag by local login under the super admin lock; revoking keeps the
+     * {@link updateAccount} "last active super admin" check (`account.last_super_admin`),
      * decided under the lock, so it cannot race a web revoke into none. Audit `account.updated`
      * without an actor, `detail.via = "cli"`. Already in the target state → no change and no audit
      * (`changed: false`). Unknown login → `account.not_found`.
      */
-    async setEnterpriseAdminByLogin(login, isEnterpriseAdmin) {
+    async setSuperAdminByLogin(login, isSuperAdmin) {
         let external;
         try {
             external = normalizeLogin(login);
@@ -284,9 +284,9 @@ let AccountsService = class AccountsService {
         catch {
             throw new ApiError("account.not_found", "Account not found");
         }
-        return this.setEnterpriseAdminIn(external, isEnterpriseAdmin);
+        return this.setSuperAdminIn(external, isSuperAdmin);
     }
-    async setEnterpriseAdminIn(external, isEnterpriseAdmin) {
+    async setSuperAdminIn(external, isSuperAdmin) {
         await this.adminLock.lock();
         const before = await this.db
             .selectFrom("identities")
@@ -297,10 +297,10 @@ let AccountsService = class AccountsService {
             .executeTakeFirst();
         if (!before)
             throw new ApiError("account.not_found", "Account not found");
-        if (before.is_enterprise_admin === isEnterpriseAdmin) {
+        if (before.is_super_admin === isSuperAdmin) {
             return { account: toAccount(before), changed: false };
         }
-        const patch = { isEnterpriseAdmin };
+        const patch = { isSuperAdmin };
         const { account } = await this.applyUpdate(before, patch, {
             detail: { ...patch, via: "cli" },
         });
@@ -314,12 +314,12 @@ let AccountsService = class AccountsService {
             .executeTakeFirstOrThrow();
         return Number(r.n);
     }
-    /** Active (status = active) enterprise admins, in the context's transaction when there is one. */
-    async countEnterpriseAdmins() {
+    /** Active (status = active) super admins, in the context's transaction when there is one. */
+    async countSuperAdmins() {
         const r = await this.db
             .selectFrom("accounts")
             .select((eb) => eb.fn.countAll().as("n"))
-            .where("is_enterprise_admin", "=", true)
+            .where("is_super_admin", "=", true)
             .where("status", "=", "active")
             .executeTakeFirstOrThrow();
         return Number(r.n);
@@ -334,7 +334,7 @@ let AccountsService = class AccountsService {
             id,
             display_name: input.displayName,
             email: input.email ?? null,
-            is_enterprise_admin: input.enterpriseAdmin ?? false,
+            is_super_admin: input.superAdmin ?? false,
         })
             .returningAll()
             .executeTakeFirstOrThrow();
@@ -380,8 +380,8 @@ let AccountsService = class AccountsService {
             .execute();
     }
     /**
-     * Changes the account under the enterprise admin lock the caller holds: updates the row,
-     * re-checks "the last active enterprise admin", audits `account.updated`; disabling revokes the
+     * Changes the account under the super admin lock the caller holds: updates the row,
+     * re-checks "the last active super admin", audits `account.updated`; disabling revokes the
      * account's sessions and personal tokens.
      */
     async applyUpdate(before, patch, auditAs) {
@@ -391,18 +391,18 @@ let AccountsService = class AccountsService {
             values.display_name = patch.displayName;
         if (patch.status !== undefined)
             values.status = patch.status;
-        if (patch.isEnterpriseAdmin !== undefined)
-            values.is_enterprise_admin = patch.isEnterpriseAdmin;
+        if (patch.isSuperAdmin !== undefined)
+            values.is_super_admin = patch.isSuperAdmin;
         const row = await this.db
             .updateTable("accounts")
             .set(values)
             .where("id", "=", id)
             .returningAll()
             .executeTakeFirstOrThrow();
-        const wasActiveAdmin = before.is_enterprise_admin && before.status === "active";
-        const isActiveAdmin = row.is_enterprise_admin && row.status === "active";
-        if (wasActiveAdmin && !isActiveAdmin && (await this.countEnterpriseAdmins()) === 0) {
-            throw new ApiError("account.last_enterprise_admin", "Cannot remove the last active enterprise admin");
+        const wasActiveAdmin = before.is_super_admin && before.status === "active";
+        const isActiveAdmin = row.is_super_admin && row.status === "active";
+        if (wasActiveAdmin && !isActiveAdmin && (await this.countSuperAdmins()) === 0) {
+            throw new ApiError("account.last_super_admin", "Cannot remove the last active super admin");
         }
         await audit(this.db.db, {
             ...(auditAs.actorAccountId !== undefined && { actorAccountId: auditAs.actorAccountId }),
@@ -439,10 +439,10 @@ __decorate([
 ], AccountsService.prototype, "createByAdminIn", null);
 __decorate([
     Transactional()
-], AccountsService.prototype, "createEnterpriseAdminIfNoneIn", null);
+], AccountsService.prototype, "createSuperAdminIfNoneIn", null);
 __decorate([
     Transactional()
-], AccountsService.prototype, "insertEnterpriseAdmin", null);
+], AccountsService.prototype, "insertSuperAdmin", null);
 __decorate([
     Transactional()
 ], AccountsService.prototype, "changePasswordIn", null);
@@ -451,7 +451,7 @@ __decorate([
 ], AccountsService.prototype, "updateAccount", null);
 __decorate([
     Transactional()
-], AccountsService.prototype, "setEnterpriseAdminIn", null);
+], AccountsService.prototype, "setSuperAdminIn", null);
 __decorate([
     Transactional()
 ], AccountsService.prototype, "insertLocal", null);
@@ -465,7 +465,7 @@ AccountsService = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
-    __param(2, Inject(EnterpriseAdminLock)),
+    __param(2, Inject(SuperAdminLock)),
     __param(3, Inject(SetupLock))
 ], AccountsService);
 export { AccountsService };
@@ -478,7 +478,7 @@ let AccountsModule = class AccountsModule {
 };
 AccountsModule = __decorate([
     Module({
-        imports: [SetupLockModule, EnterpriseAdminLockModule],
+        imports: [SetupLockModule, SuperAdminLockModule],
         providers: [AccountsService],
         exports: [AccountsService],
     })

package/dist/identity/audit.d.ts

@@ -5,7 +5,8 @@ import type { KernelSchemaDb } from "../db/kernel-schema.js";
  * so the event commits or rolls back with the write it records.
  */
 export declare function audit(db: KernelSchemaDb, e: {
-    actorAccountId?: string;
+    /** The acting account; absent or null for the kernel itself (a job such as the scope sync). */
+    actorAccountId?: string | null;
     actorTokenId?: string;
     orgId?: string;
     action: string;

package/dist/identity/auth.guard.d.ts

@@ -3,21 +3,29 @@ import { Reflector } from "@nestjs/core";
 import type { FastifyRequest } from "fastify";
 import { AccountsService } from "./accounts.js";
 import { ApiTokenService } from "./api-tokens.js";
+import { type Principal } from "./principal.js";
 import { SessionService } from "./sessions.js";
 /** CSRF 头：Cookie 认证的非安全请求（及所有公开路由的非安全请求）必须带 `X-Capybara-Csrf: 1`。 */
 export declare const CSRF_HEADER = "x-capybara-csrf";
-/** 解析凭据要用的服务（{@link AuthGuard} 与 {@link authorizeEnterpriseAdmin} 共用）。 */
+/** 解析凭据要用的服务（{@link AuthGuard} 与 {@link authorizeSuperAdmin} 共用）。 */
 export interface AuthServices {
     accounts: AccountsService;
     sessions: SessionService;
     tokens: ApiTokenService;
 }
 /**
- * 在读请求体之前（Fastify `onRequest`）按 `@EnterpriseAdmin` 路由的规则认证：无凭据 / 凭据无效 → `auth.required`
- * 等，Cookie 认证的非安全请求要求 CSRF 头，服务令牌与非企业管理员 → `forbidden`。插件包上传用它：
+ * 在读请求体之前（Fastify `onRequest`）按 `@SuperAdmin` 路由的规则认证：无凭据 / 凭据无效 → `auth.required`
+ * 等，Cookie 认证的非安全请求要求 CSRF 头，服务令牌与非超级管理员 → `forbidden`。插件包上传用它：
  * 未认证的大请求体不被读入内存。之后 {@link AuthGuard} 照常再判一次。
  */
-export declare function authorizeEnterpriseAdmin(req: FastifyRequest, s: AuthServices): Promise<void>;
+export declare function authorizeSuperAdmin(req: FastifyRequest, s: AuthServices): Promise<void>;
+/**
+ * Before the body is read (Fastify `onRequest`), for an org's package upload (an `@OrgAction`
+ * route of a human-only action): authenticated like {@link authorizeSuperAdmin}, a person (service
+ * tokens -> `forbidden`), CSRF for cookies. Returns the principal for the org role check that also
+ * runs before the body (ruling P3-29); `OrgGuard` and the service's lock re-check it afterwards.
+ */
+export declare function authenticateOrgUploader(req: FastifyRequest, s: AuthServices): Promise<Principal>;
 /**
  * 全局守卫（`APP_GUARD`），默认拒绝：
  * 1. `Authorization: Bearer cap_pat_…|cap_svc_…` → API 令牌；个人令牌再实时读账号状态。不做 CSRF 检查。
@@ -27,7 +35,7 @@ export declare function authorizeEnterpriseAdmin(req: FastifyRequest, s: AuthSer
  *    （便于登出 / 刷新）；PG / Redis 故障等其他异常照常抛出。
  * 4. 路由约束：service principal 只能访问 `@AllowService` 路由（否则 `forbidden`）；
  *    `@SessionOnly` 要求 Web 会话：个人令牌 → `auth.session_required`，服务令牌（即使路由经 `@OrgAction`
- *    隐含 `@AllowService`）→ `forbidden`；`@EnterpriseAdmin` 要求企业管理员（`forbidden`）。
+ *    隐含 `@AllowService`）→ `forbidden`；`@SuperAdmin` 要求超级管理员（`forbidden`）。
  * 5. `@Public` 路由的非安全方法无论是否带 Cookie 都要求 CSRF 头。
  * 账号状态每个请求都从 PG 实时读取，不在进程内缓存。插件路由 `/plugins/*` 不经过 Nest，不受此守卫约束。
  */

package/dist/identity/auth.guard.js

@@ -13,7 +13,7 @@ import { ApiError } from "../errors.js";
 import { AccountsService } from "./accounts.js";
 import { ApiTokenService } from "./api-tokens.js";
 import { ACCESS_COOKIE } from "./cookies.js";
-import { ALLOW_SERVICE_KEY, ENTERPRISE_ADMIN_KEY, PUBLIC_KEY, SESSION_ONLY_KEY, } from "./principal.js";
+import { ALLOW_SERVICE_KEY, PUBLIC_KEY, SESSION_ONLY_KEY, SUPER_ADMIN_KEY, } from "./principal.js";
 import { SessionService } from "./sessions.js";
 /** CSRF 头：Cookie 认证的非安全请求（及所有公开路由的非安全请求）必须带 `X-Capybara-Csrf: 1`。 */
 export const CSRF_HEADER = "x-capybara-csrf";
@@ -62,11 +62,11 @@ async function resolvePrincipal(req, s) {
     return undefined;
 }
 /**
- * 在读请求体之前（Fastify `onRequest`）按 `@EnterpriseAdmin` 路由的规则认证：无凭据 / 凭据无效 → `auth.required`
- * 等，Cookie 认证的非安全请求要求 CSRF 头，服务令牌与非企业管理员 → `forbidden`。插件包上传用它：
+ * 在读请求体之前（Fastify `onRequest`）按 `@SuperAdmin` 路由的规则认证：无凭据 / 凭据无效 → `auth.required`
+ * 等，Cookie 认证的非安全请求要求 CSRF 头，服务令牌与非超级管理员 → `forbidden`。插件包上传用它：
  * 未认证的大请求体不被读入内存。之后 {@link AuthGuard} 照常再判一次。
  */
-export async function authorizeEnterpriseAdmin(req, s) {
+export async function authorizeSuperAdmin(req, s) {
     const resolved = await resolvePrincipal(req, s);
     if (!resolved)
         throw new ApiError("auth.required", "Authentication required");
@@ -76,8 +76,25 @@ export async function authorizeEnterpriseAdmin(req, s) {
     if (p.kind === "service") {
         throw new ApiError("forbidden", "Service tokens cannot access this endpoint");
     }
-    if (!p.account.isEnterpriseAdmin)
-        throw new ApiError("forbidden", "Enterprise admin required");
+    if (!p.account.isSuperAdmin)
+        throw new ApiError("forbidden", "Super admin required");
+}
+/**
+ * Before the body is read (Fastify `onRequest`), for an org's package upload (an `@OrgAction`
+ * route of a human-only action): authenticated like {@link authorizeSuperAdmin}, a person (service
+ * tokens -> `forbidden`), CSRF for cookies. Returns the principal for the org role check that also
+ * runs before the body (ruling P3-29); `OrgGuard` and the service's lock re-check it afterwards.
+ */
+export async function authenticateOrgUploader(req, s) {
+    const resolved = await resolvePrincipal(req, s);
+    if (!resolved)
+        throw new ApiError("auth.required", "Authentication required");
+    if (resolved.cookie && !SAFE_METHODS.has(req.method.toUpperCase()))
+        requireCsrf(req);
+    if (resolved.principal.kind === "service") {
+        throw new ApiError("forbidden", "Service tokens cannot access this endpoint");
+    }
+    return resolved.principal;
 }
 /**
  * 全局守卫（`APP_GUARD`），默认拒绝：
@@ -88,7 +105,7 @@ export async function authorizeEnterpriseAdmin(req, s) {
  *    （便于登出 / 刷新）；PG / Redis 故障等其他异常照常抛出。
  * 4. 路由约束：service principal 只能访问 `@AllowService` 路由（否则 `forbidden`）；
  *    `@SessionOnly` 要求 Web 会话：个人令牌 → `auth.session_required`，服务令牌（即使路由经 `@OrgAction`
- *    隐含 `@AllowService`）→ `forbidden`；`@EnterpriseAdmin` 要求企业管理员（`forbidden`）。
+ *    隐含 `@AllowService`）→ `forbidden`；`@SuperAdmin` 要求超级管理员（`forbidden`）。
  * 5. `@Public` 路由的非安全方法无论是否带 Cookie 都要求 CSRF 头。
  * 账号状态每个请求都从 PG 实时读取，不在进程内缓存。插件路由 `/plugins/*` 不经过 Nest，不受此守卫约束。
  */
@@ -142,8 +159,8 @@ let AuthGuard = class AuthGuard {
         if (flag(SESSION_ONLY_KEY) && !(p.kind === "user" && p.via === "session")) {
             throw new ApiError("auth.session_required", "This endpoint requires a web session");
         }
-        if (flag(ENTERPRISE_ADMIN_KEY) && !(p.kind === "user" && p.account.isEnterpriseAdmin)) {
-            throw new ApiError("forbidden", "Enterprise admin required");
+        if (flag(SUPER_ADMIN_KEY) && !(p.kind === "user" && p.account.isSuperAdmin)) {
+            throw new ApiError("forbidden", "Super admin required");
         }
         return true;
     }

package/dist/identity/identity.module.d.ts

@@ -1,5 +1,5 @@
 /**
- * Identity: accounts, sessions, API tokens, deployment settings and the enterprise admin lock,
+ * Identity: accounts, sessions, API tokens, deployment settings and the super admin lock,
  * external identities with IM binding and third-party sign-in.
  */
 export declare class IdentityModule {