@capybara-hq/kernel 0.1.0-rc.6 → 0.1.0-rc.8

package/dist/evals/sets.controller.js

@@ -8,42 +8,12 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post } from "@nestjs/common";
-import { z } from "zod";
 import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { EvalAddCaseBody as AddCaseBody, EvalSetCreateBody as CreateBody, EvalSetPatchBody as PatchBody, EvalSampleBody as SampleBody, } from "./evals.schemas.js";
 import { EvalSetsService, } from "./sets.service.js";
-const NAME = z.string().trim().min(1).max(200);
-const DESCRIPTION = z.string().max(2000);
-const RUBRIC = z.string().min(1).max(20_000);
-const CreateBody = z
-    .object({
-    agentId: z.string().min(1).max(100),
-    name: NAME,
-    description: DESCRIPTION.optional(),
-    rubric: RUBRIC.optional(),
-})
-    .strict();
-const PatchBody = z
-    .object({
-    name: NAME.optional(),
-    description: DESCRIPTION.optional(),
-    rubric: RUBRIC.nullable().optional(),
-})
-    .strict();
-const AddCaseBody = z
-    .object({ conversationId: z.string().min(1).max(100), runId: z.string().min(1).max(100) })
-    .strict();
-const SampleBody = z
-    .object({
-    from: z.iso.datetime({ offset: true }).optional(),
-    to: z.iso.datetime({ offset: true }).optional(),
-    count: z.number().int().min(1).max(50),
-    status: z.enum(["completed", "failed", "any"]).optional(),
-    minToolCalls: z.number().int().min(0).max(1000).optional(),
-})
-    .strict();
 class CreateBodyDto extends createZodDto(CreateBody, "EvalSetCreateBody") {
 }
 class PatchBodyDto extends createZodDto(PatchBody, "EvalSetPatchBody") {

package/dist/evals/sets.service.d.ts

@@ -91,19 +91,19 @@ export declare class EvalSetsService {
         name: string;
         description?: string;
         rubric?: string;
-    }, actorTokenId?: string): Promise<EvalSetView>;
+    }, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<EvalSetView>;
     list(orgId: string): Promise<EvalSetView[]>;
     get(orgId: string, setId: string): Promise<EvalSetDetail>;
     update(orgId: string, actor: string, setId: string, patch: {
         name?: string;
         description?: string;
         rubric?: string | null;
-    }, actorTokenId?: string): Promise<EvalSetView>;
+    }, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<EvalSetView>;
     /**
      * 删除评测集（Ruling S1-a）：集合行软删除，留作审计存根；用例（含快照）硬删，结果随之级联删除，不留复制来的对话内容；
      * 在执行的运行取消，运行行保留（无入口）。
      */
-    remove(orgId: string, actor: string, setId: string, actorTokenId?: string): Promise<void>;
+    remove(orgId: string, actor: string, setId: string, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<void>;
     private createIn;
     private updateIn;
     private removeIn;
@@ -125,20 +125,20 @@ export declare class EvalSetsService {
     addCase(orgId: string, actor: string, setId: string, input: {
         conversationId: string;
         runId: string;
-    }, actorTokenId?: string): Promise<EvalCaseView>;
+    }, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<EvalCaseView>;
     /**
      * 抽样：从该 agent 的 chat 对话里随机取（`ORDER BY random()`）已终态、尚不在集合里的运行，至多
      * `min(count, 剩余容量)` 个，逐个取快照写入。快照超大（或其间被删除 / 写入时已满 / 并发加入）的计入 `skipped`。
      * 集合已满 → `eval.too_many_cases`。逐个写入，内存里一次只有一份快照。
      */
-    sample(orgId: string, actor: string, setId: string, input: SampleInput, actorTokenId?: string): Promise<{
+    sample(orgId: string, actor: string, setId: string, input: SampleInput, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<{
         added: number;
         skipped: number;
     }>;
-    removeCase(orgId: string, actor: string, setId: string, caseId: string, actorTokenId?: string): Promise<void>;
+    removeCase(orgId: string, actor: string, setId: string, caseId: string, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<void>;
     /**
      * 用例详情：由快照还原轨迹（原对话删除后照常可读）。快照即对话内容，每次查看写审计 `trajectory.viewed`
      * （target = 原对话 id，detail 带 `caseId` / `setId`）。
      */
-    getCase(orgId: string, actor: string, setId: string, caseId: string, actorTokenId?: string): Promise<EvalCaseDetail>;
+    getCase(orgId: string, actor: string, setId: string, caseId: string, actorTokenId?: string, auditDetail?: Record<string, unknown>): Promise<EvalCaseDetail>;
 }

package/dist/evals/sets.service.js

@@ -152,8 +152,8 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
             throw setNotFound();
         return EvalSetsService_1.toView(r);
     }
-    async create(orgId, actor, input, actorTokenId) {
-        const id = await this.createIn(orgId, actor, input, actorTokenId);
+    async create(orgId, actor, input, actorTokenId, auditDetail) {
+        const id = await this.createIn(orgId, actor, input, actorTokenId, auditDetail);
         return this.view(orgId, id);
     }
     async list(orgId) {
@@ -175,22 +175,22 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
             .execute();
         return { ...set, cases: cases.map(toCaseView) };
     }
-    async update(orgId, actor, setId, patch, actorTokenId) {
+    async update(orgId, actor, setId, patch, actorTokenId, auditDetail) {
         if (!UUID.test(setId))
             throw setNotFound();
-        await this.updateIn(orgId, actor, setId, patch, actorTokenId);
+        await this.updateIn(orgId, actor, setId, patch, actorTokenId, auditDetail);
         return this.view(orgId, setId);
     }
     /**
      * 删除评测集（Ruling S1-a）：集合行软删除，留作审计存根；用例（含快照）硬删，结果随之级联删除，不留复制来的对话内容；
      * 在执行的运行取消，运行行保留（无入口）。
      */
-    async remove(orgId, actor, setId, actorTokenId) {
+    async remove(orgId, actor, setId, actorTokenId, auditDetail) {
         if (!UUID.test(setId))
             throw setNotFound();
-        await this.removeIn(orgId, actor, setId, actorTokenId);
+        await this.removeIn(orgId, actor, setId, actorTokenId, auditDetail);
     }
-    async createIn(orgId, actor, input, actorTokenId) {
+    async createIn(orgId, actor, input, actorTokenId, auditDetail) {
         await this.orgLock.lockAndAuthorize(orgId, actor, "evals.manage");
         const agent = await this.db
             .selectFrom("agents")
@@ -219,11 +219,11 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
             orgId,
             action: "eval.set_created",
             target: row.id,
-            detail: { agentId: input.agentId, name: input.name },
+            detail: { agentId: input.agentId, name: input.name, ...auditDetail },
         });
         return row.id;
     }
-    async updateIn(orgId, actor, setId, patch, actorTokenId) {
+    async updateIn(orgId, actor, setId, patch, actorTokenId, auditDetail) {
         await this.orgLock.lockAndAuthorize(orgId, actor, "evals.manage");
         const r = await this.db
             .updateTable("eval_sets")
@@ -248,10 +248,11 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
             // 只记改了哪些字段（评分标准可能很长，不进审计）
             detail: {
                 fields: ["name", "description", "rubric"].filter((f) => patch[f] !== undefined),
+                ...auditDetail,
             },
         });
     }
-    async removeIn(orgId, actor, setId, actorTokenId) {
+    async removeIn(orgId, actor, setId, actorTokenId, auditDetail) {
         await this.orgLock.lockAndAuthorize(orgId, actor, "evals.manage");
         const r = await this.db
             .updateTable("eval_sets")
@@ -269,6 +270,7 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
             orgId,
             action: "eval.set_deleted",
             target: setId,
+            ...(auditDetail !== undefined && { detail: auditDetail }),
         });
     }
     async insertCaseIn(orgId, actor, setId, snapshot, extra, prepared) {
@@ -319,11 +321,12 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
                 conversationId: snapshot.conversationId,
                 runId: snapshot.runId,
                 ...(extra.sampled && { sampled: true }),
+                ...extra.auditDetail,
             },
         });
         return toCaseView(row);
     }
-    async removeCaseIn(orgId, actor, setId, caseId, actorTokenId) {
+    async removeCaseIn(orgId, actor, setId, caseId, actorTokenId, auditDetail) {
         await this.orgLock.lockAndAuthorize(orgId, actor, "evals.manage");
         const set = await this.db
             .selectFrom("eval_sets")
@@ -354,6 +357,7 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
                 caseId,
                 conversationId: r.source_conversation_id,
                 runId: r.source_run_id,
+                ...auditDetail,
             },
         });
     }
@@ -402,7 +406,7 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
      * `eval.agent_mismatch`；已在集合里 → `eval.case_exists`；集合满了 → `eval.too_many_cases`；
      * 运行未终态 / 快照超大 → `eval.run_not_finished` / `eval.case_too_large`（`takeSnapshot`）。
      */
-    async addCase(orgId, actor, setId, input, actorTokenId) {
+    async addCase(orgId, actor, setId, input, actorTokenId, auditDetail) {
         const set = await this.liveSet(orgId, setId);
         const conv = await this.db
             .selectFrom("conversations")
@@ -434,6 +438,7 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
         const r = await this.insertCase(orgId, actor, setId, snapshot, {
             sampled: false,
             ...(actorTokenId !== undefined && { actorTokenId }),
+            ...(auditDetail !== undefined && { auditDetail }),
         });
         if (r === "exists")
             throw caseExists();
@@ -446,7 +451,7 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
      * `min(count, 剩余容量)` 个，逐个取快照写入。快照超大（或其间被删除 / 写入时已满 / 并发加入）的计入 `skipped`。
      * 集合已满 → `eval.too_many_cases`。逐个写入，内存里一次只有一份快照。
      */
-    async sample(orgId, actor, setId, input, actorTokenId) {
+    async sample(orgId, actor, setId, input, actorTokenId, auditDetail) {
         const set = await this.liveSet(orgId, setId);
         const { maxCasesPerSet, maxCaseBytes } = this.config.get().evals;
         const room = maxCasesPerSet - (await this.caseCount(this.db, setId));
@@ -497,6 +502,7 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
             const r = await this.insertCase(orgId, actor, setId, snapshot, {
                 sampled: true,
                 ...(actorTokenId !== undefined && { actorTokenId }),
+                ...(auditDetail !== undefined && { auditDetail }),
             });
             if (typeof r === "string")
                 skipped++;
@@ -505,18 +511,18 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
         }
         return { added, skipped };
     }
-    async removeCase(orgId, actor, setId, caseId, actorTokenId) {
+    async removeCase(orgId, actor, setId, caseId, actorTokenId, auditDetail) {
         if (!UUID.test(setId))
             throw setNotFound();
         if (!UUID.test(caseId))
             throw caseNotFound();
-        await this.removeCaseIn(orgId, actor, setId, caseId, actorTokenId);
+        await this.removeCaseIn(orgId, actor, setId, caseId, actorTokenId, auditDetail);
     }
     /**
      * 用例详情：由快照还原轨迹（原对话删除后照常可读）。快照即对话内容，每次查看写审计 `trajectory.viewed`
      * （target = 原对话 id，detail 带 `caseId` / `setId`）。
      */
-    async getCase(orgId, actor, setId, caseId, actorTokenId) {
+    async getCase(orgId, actor, setId, caseId, actorTokenId, auditDetail) {
         await this.liveSet(orgId, setId);
         if (!UUID.test(caseId))
             throw caseNotFound();
@@ -537,7 +543,7 @@ let EvalSetsService = EvalSetsService_1 = class EvalSetsService {
             orgId,
             action: "trajectory.viewed",
             target: row.source_conversation_id,
-            detail: { agentId: snapshot.agentId, caseId, setId },
+            detail: { agentId: snapshot.agentId, caseId, setId, ...auditDetail },
         });
         return {
             case: toCaseView(row),

package/dist/evals/snapshot.d.ts

@@ -59,8 +59,9 @@ export interface CaseSnapshot {
  */
 export declare function takeSnapshot(db: KernelSchemaDb, orgId: string, conversationId: string, runId: string, maxBytes: number): Promise<CaseSnapshot>;
 /**
- * 读出库里存的快照（`eval_cases.snapshot`）：把各版本定义里改名前（D17）的 `{ kind: "app" }` 工具引用规范化为
- * connector 形（C27）。整轮回放会把定义交给实时注册表，不规范化的话连接器工具全部失效。其余字段原样。
+ * Reads a stored snapshot (`eval_cases.snapshot`): each version's definition goes through
+ * `normalizeStoredDefinition` (rc tool keys, and an enabled tool list read as nothing turned off).
+ * Other fields as they are.
  */
 export declare function readSnapshot(raw: unknown): CaseSnapshot;
 /** 快照事件还原为日志事件（`createdAt` 转回 Date）。 */

package/dist/evals/snapshot.js

@@ -97,7 +97,7 @@ export async function takeSnapshot(db, orgId, conversationId, runId, maxBytes) {
         .orderBy("version")
         .execute();
     for (const r of defRows) {
-        definitions[String(r.version)] = normalizeStoredDefinition(r.definition);
+        definitions[String(r.version)] = snapshotDefinition(r.definition);
     }
     const toolSpecs = {};
     if (hashes.size > 0) {
@@ -151,14 +151,27 @@ export async function takeSnapshot(db, orgId, conversationId, runId, maxBytes) {
     return snapshot;
 }
 /**
- * 读出库里存的快照（`eval_cases.snapshot`）：把各版本定义里改名前（D17）的 `{ kind: "app" }` 工具引用规范化为
- * connector 形（C27）。整轮回放会把定义交给实时注册表，不规范化的话连接器工具全部失效。其余字段原样。
+ * A definition as a snapshot holds it: normalized (`normalizeStoredDefinition`), and one from
+ * before tools were on by default keeps its enabled list next to it: rc tool keys are read by its
+ * extension refs (`legacyScopeOf`); the runtime ignores it (tools default-on spec §2).
+ */
+function snapshotDefinition(d) {
+    const enabled = d?.tools;
+    return {
+        ...normalizeStoredDefinition(d),
+        ...(Array.isArray(enabled) && { tools: enabled }),
+    };
+}
+/**
+ * Reads a stored snapshot (`eval_cases.snapshot`): each version's definition goes through
+ * `normalizeStoredDefinition` (rc tool keys, and an enabled tool list read as nothing turned off).
+ * Other fields as they are.
  */
 export function readSnapshot(raw) {
     const s = raw;
     const definitions = {};
     for (const [v, d] of Object.entries(s.definitions ?? {})) {
-        definitions[v] = normalizeStoredDefinition(d);
+        definitions[v] = snapshotDefinition(d);
     }
     return {
         ...s,

package/dist/extensions/admin-ops.d.ts

@@ -120,14 +120,16 @@ export declare class ExtensionAdminOps {
     }): Promise<AdminExtensionView>;
     private writeInstall;
     /** Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org enablement is unchanged. */
-    enable(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner): Promise<AdminExtensionView>;
+    enable(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner, 
+    /** Merged into the audit detail (a write made through the Platform tool). */
+    auditDetail?: Record<string, unknown>): Promise<AdminExtensionView>;
     /**
      * Disables on the deployment (audit `extension.disabled`); no change when already disabled. Every
      * replica unloads it (draining in-flight calls), and the extensions that `requires` it unload with
      * it; the org enablement switch is unchanged and the org page shows it as unavailable. A required
      * bootstrap plugin -> `extension.required`.
      */
-    disable(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner): Promise<AdminExtensionView>;
+    disable(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner, auditDetail?: Record<string, unknown>): Promise<AdminExtensionView>;
     /**
      * Uninstall: a required bootstrap plugin -> `extension.required`; must be disabled first
      * (otherwise `extension.not_disabled`); deletes the install record
@@ -136,7 +138,7 @@ export declare class ExtensionAdminOps {
      * permission snapshot and the package in the package store are untouched (a reinstall picks them
      * up).
      */
-    uninstall(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner): Promise<void>;
+    uninstall(name: string, actor: string | null, actorTokenId?: string, owner?: ExtensionOpsOwner, auditDetail?: Record<string, unknown>): Promise<void>;
     private writeUninstall;
     private setState;
     private writeState;

package/dist/extensions/admin-ops.js

@@ -222,8 +222,10 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         return { changed: true, state: row?.desired_state ?? "disabled" };
     }
     /** Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org enablement is unchanged. */
-    enable(name, actor, actorTokenId, owner) {
-        return this.setState(name, "enabled", actor, actorTokenId, owner);
+    enable(name, actor, actorTokenId, owner, 
+    /** Merged into the audit detail (a write made through the Platform tool). */
+    auditDetail) {
+        return this.setState(name, "enabled", actor, actorTokenId, owner, auditDetail);
     }
     /**
      * Disables on the deployment (audit `extension.disabled`); no change when already disabled. Every
@@ -231,8 +233,8 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * it; the org enablement switch is unchanged and the org page shows it as unavailable. A required
      * bootstrap plugin -> `extension.required`.
      */
-    disable(name, actor, actorTokenId, owner) {
-        return this.setState(name, "disabled", actor, actorTokenId, owner);
+    disable(name, actor, actorTokenId, owner, auditDetail) {
+        return this.setState(name, "disabled", actor, actorTokenId, owner, auditDetail);
     }
     /**
      * Uninstall: a required bootstrap plugin -> `extension.required`; must be disabled first
@@ -242,11 +244,11 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * permission snapshot and the package in the package store are untouched (a reinstall picks them
      * up).
      */
-    async uninstall(name, actor, actorTokenId, owner) {
+    async uninstall(name, actor, actorTokenId, owner, auditDetail) {
         this.assertInstallable(name);
-        await this.writeUninstall(name, actor, actorTokenId, owner);
+        await this.writeUninstall(name, actor, actorTokenId, owner, auditDetail);
     }
-    async writeUninstall(name, actor, actorTokenId, owner) {
+    async writeUninstall(name, actor, actorTokenId, owner, auditDetail) {
         const db = this.db;
         await this.authorize(actor, owner);
         const row = await this.lockRow(name);
@@ -260,19 +262,22 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         await db.deleteFrom("extension_installs").where("name", "=", name).execute();
         // 来源条目随安装记录一起删：之后不经目录重新安装时不再受旧条目的策略约束（T26 裁决）
         await db.deleteFrom("extension_catalog_sources").where("plugin", "=", name).execute();
-        await this.audit(actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256, ownerDetail(owner));
+        await this.audit(actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256, {
+            ...ownerDetail(owner),
+            ...auditDetail,
+        });
         afterCommit(() => this.notify(name));
     }
-    async setState(name, state, actor, actorTokenId, owner) {
+    async setState(name, state, actor, actorTokenId, owner, auditDetail) {
         this.assertInstallable(name);
-        const result = await this.writeState(name, state, actor, actorTokenId, owner);
+        const result = await this.writeState(name, state, actor, actorTokenId, owner, auditDetail);
         return this.viewAfterCommit(name, {
             version: result.row.version,
             sha256: result.row.sha256,
             state,
         });
     }
-    async writeState(name, state, actor, actorTokenId, owner) {
+    async writeState(name, state, actor, actorTokenId, owner, auditDetail) {
         const db = this.db;
         await this.authorize(actor, owner);
         const row = await this.lockRow(name);
@@ -291,7 +296,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         })
             .where("name", "=", name)
             .execute();
-        await this.audit(actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256, ownerDetail(owner));
+        await this.audit(actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256, { ...ownerDetail(owner), ...auditDetail });
         afterCommit(() => this.notify(name));
         return { row, changed: true };
     }

package/dist/extensions/deployment-config.d.ts

@@ -59,7 +59,7 @@ export interface SecretEntry {
     value?: string | null | undefined;
     renameFrom?: string | undefined;
 }
-/** The response of `GET / PUT /api/v1/admin/extensions/:name/config`. */
+/** The response of `GET / PUT / DELETE /api/v1/admin/extensions/:name/config`. */
 export interface DeploymentConfigView {
     plugin: string;
     /** The plugin's display name (`ExtensionDisplayNames`); null when it has none. */
@@ -159,6 +159,21 @@ export declare class ExtensionDeploymentConfigService {
      * applies it on this replica right away.
      */
     put(plugin: string, values: Record<string, unknown>, actor: string, actorTokenId?: string, secretEntries?: readonly SecretEntry[]): Promise<DeploymentConfigView>;
+    /**
+     * Clears the deployment config stored in PG: the `extension_deployment_configs` row and every
+     * secret stored for the extension (any path, also ones an older version declared). Fields from
+     * the startup config (file / Nacos / env) are untouched and stay in effect (they stay
+     * `readonly` in the view; only the startup config changes them). Unknown to the deployment ->
+     * `extension.not_found`.
+     * In a transaction: `lockAndAuthorize` (re-checks the super admin under the lock), the advisory
+     * lock per extension, audit `extension.config_cleared` (detail `clearedPaths`: the stored field
+     * paths, never values; nothing stored -> no audit, no publish). After the commit publishes
+     * {@link PLUGIN_DEPLOYMENT_CONFIG_TOPIC} and applies it on this replica: every replica re-reads,
+     * and the extension loads from what remains, or is unloaded and becomes pending configuration
+     * when that is missing or invalid (`ExtensionHost.applyDeploymentConfig`), without a restart.
+     */
+    clear(plugin: string, actor: string, actorTokenId?: string): Promise<DeploymentConfigView>;
+    private clearStored;
     /**
      * Secret entries name a secret record field some hint names (else 400 `validation_failed`, also
      * for a path given in `values` too, an entry with neither `value` nor `renameFrom`, or a key

package/dist/extensions/deployment-config.js

@@ -16,6 +16,7 @@ import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
 import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
@@ -193,6 +194,85 @@ let ExtensionDeploymentConfigService = class ExtensionDeploymentConfigService {
         }
         return this.render(plugin, info, stored, await this.displayNames.get(plugin));
     }
+    /**
+     * Clears the deployment config stored in PG: the `extension_deployment_configs` row and every
+     * secret stored for the extension (any path, also ones an older version declared). Fields from
+     * the startup config (file / Nacos / env) are untouched and stay in effect (they stay
+     * `readonly` in the view; only the startup config changes them). Unknown to the deployment ->
+     * `extension.not_found`.
+     * In a transaction: `lockAndAuthorize` (re-checks the super admin under the lock), the advisory
+     * lock per extension, audit `extension.config_cleared` (detail `clearedPaths`: the stored field
+     * paths, never values; nothing stored -> no audit, no publish). After the commit publishes
+     * {@link PLUGIN_DEPLOYMENT_CONFIG_TOPIC} and applies it on this replica: every replica re-reads,
+     * and the extension loads from what remains, or is unloaded and becomes pending configuration
+     * when that is missing or invalid (`ExtensionHost.applyDeploymentConfig`), without a restart.
+     */
+    async clear(plugin, actor, actorTokenId) {
+        const info = await this.info(plugin);
+        await this.clearStored(plugin, info.fields.map((f) => f.path), actor, actorTokenId);
+        return this.render(plugin, info, {}, await this.displayNames.get(plugin));
+    }
+    async clearStored(plugin, fieldPaths, actor, actorTokenId) {
+        const t = this.db;
+        await this.adminLock.lockAndAuthorize(actor);
+        await this.configLock.lock(plugin);
+        const row = await t
+            .selectFrom("extension_deployment_configs")
+            .select("config")
+            .where("plugin", "=", plugin)
+            .forUpdate()
+            .executeTakeFirst();
+        const prefix = secretKey(plugin, "");
+        const secretKeys = (await t
+            .selectFrom("secrets")
+            .select("key")
+            .where("namespace", "=", SECRETS_NAMESPACE)
+            .where("org_id", "=", DEPLOYMENT_SECRETS_ORG)
+            .execute())
+            .map((r) => r.key)
+            .filter((k) => k.startsWith(prefix));
+        if (row === undefined && secretKeys.length === 0)
+            return;
+        if (secretKeys.length > 0) {
+            await t
+                .deleteFrom("secrets")
+                .where("namespace", "=", SECRETS_NAMESPACE)
+                .where("org_id", "=", DEPLOYMENT_SECRETS_ORG)
+                .where("key", "in", secretKeys)
+                .execute();
+        }
+        await t.deleteFrom("extension_deployment_configs").where("plugin", "=", plugin).execute();
+        const clearedPaths = [
+            ...new Set([
+                ...fieldPaths.filter((p) => getPath(row?.config ?? {}, p) !== undefined),
+                ...secretKeys.map((k) => k.slice(prefix.length)),
+            ]),
+        ].sort();
+        await audit(t, {
+            actorAccountId: actor,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            action: "extension.config_cleared",
+            target: plugin,
+            detail: { clearedPaths },
+        });
+        afterCommit(async () => {
+            try {
+                await this.bus.publish(PLUGIN_DEPLOYMENT_CONFIG_TOPIC, { plugin });
+            }
+            catch (err) {
+                this.log.warn("cannot publish plugin-deployment-config after clearing", { plugin, err });
+            }
+            try {
+                await this.lifecycle.applyConfig(plugin);
+            }
+            catch (err) {
+                this.log.error("applying the cleared plugin deployment config on this replica failed", {
+                    plugin,
+                    err,
+                });
+            }
+        });
+    }
     /**
      * Secret entries name a secret record field some hint names (else 400 `validation_failed`, also
      * for a path given in `values` too, an entry with neither `value` nor `renameFrom`, or a key
@@ -405,6 +485,9 @@ __decorate([
         accessMode: "read only",
     })
 ], ExtensionDeploymentConfigService.prototype, "readStored", null);
+__decorate([
+    Transactional()
+], ExtensionDeploymentConfigService.prototype, "clearStored", null);
 __decorate([
     Transactional()
 ], ExtensionDeploymentConfigService.prototype, "write", null);

package/dist/extensions/extensions.module.js

@@ -24,6 +24,7 @@ import { ExtensionPointDefaults } from "./point-defaults.js";
 import { ExtensionRegistryModule } from "./registry.js";
 import { ReplicaStatusStore } from "./sources.js";
 import { ExtensionStateModule } from "./state.module.js";
+import { ExtensionAvailability } from "./unavailable.js";
 /**
  * The extensions domain: the extension host (it builds each `ctx` from the injected kernel
  * services), the package store and install records (the desired state the host converges to, one
@@ -60,6 +61,7 @@ ExtensionsModule = __decorate([
             OrgOverrides,
             ExtensionPointDefaults,
             BootstrapService,
+            ExtensionAvailability,
         ],
         exports: [
             ExtensionRegistryModule,
@@ -77,6 +79,7 @@ ExtensionsModule = __decorate([
             OrgOverrides,
             ExtensionPointDefaults,
             BootstrapService,
+            ExtensionAvailability,
         ],
     })
 ], ExtensionsModule);

package/dist/extensions/host.d.ts

@@ -179,6 +179,11 @@ export declare class ExtensionHost {
      * 安装记录不在这里：每次 converge 都按 PG 期望状态重新判定。
      */
     private readonly pendingActivations;
+    /**
+     * The load parameters of each config-declared extension that loaded: when its deployment config
+     * is cleared and the rest is invalid it goes back to {@link pendingActivations} (pending config).
+     */
+    private readonly declaredActivations;
     /** 安装记录准备好的候选（按插件名；sha 变了就作废）。 */
     private readonly prepared;
     /** 闸门放行后导入过的安装记录真实清单（按插件名；部署配置 schema 用，含待配置而未加载的）。 */
@@ -516,12 +521,38 @@ export declare class ExtensionHost {
     /**
      * 部署配置保存后（`kernel.plugin-deployment-config`）本副本重读并校验（C10；与 unload / reload 串行）：
      * - 插件没在本副本生效 → `not_loaded`（配置声明的刷新后台的合法性判定；待配置的由 reconcile 加载）；
-     * - 不合法 → `invalid`：保持当前值，告警；
+     * - 不合法 → `invalid`：保持当前值，告警；但 PG 里已没有保存的配置（超级管理员清空了，`DELETE
+     *   /api/v1/admin/extensions/:name/config`）、剩下的来源（启动配置、默认值）又不够时 → `unloaded`：卸下实例、
+     *   记为待配置（pending / config），依赖方连锁；重新配好后由 reconcile 加载；
      * - 没变 → `unchanged`；只改了 hot 字段 → `hot`：就地替换，插件经 `ctx.config` 读到新值，不重新 setup；
      * - 改了非 hot 字段 → `reload`：用新配置重新加载实例（先新后旧，排空在途调用），依赖方连锁；
      *   重新加载失败旧实例保留（`reload_failed`，记 error）。
      */
-    applyDeploymentConfig(plugin: string): Promise<"not_loaded" | "invalid" | "unchanged" | "hot" | "reload" | "reload_failed">;
+    applyDeploymentConfig(plugin: string): Promise<"not_loaded" | "invalid" | "unloaded" | "unchanged" | "hot" | "reload" | "reload_failed">;
+    /** PG holds no deployment config for the plugin (it was cleared); a read error counts as no. */
+    private clearedInPg;
+    /**
+     * Unloads an extension whose deployment config was cleared and is now missing or invalid (in
+     * the host's serial queue): drains it, records pending / config (a config-declared one goes back
+     * to {@link pendingActivations}; an install record is decided again on every converge) and
+     * cascades to its dependents. It loads again without a restart once it is configured.
+     */
+    private unloadForMissingConfig;
+    /**
+     * Records an extension that is not loaded as pending configuration: a config-declared one goes
+     * back to {@link pendingActivations} (a later save loads it); an install record is decided again
+     * on every converge.
+     */
+    private markPendingConfig;
+    /**
+     * Before an extension unloaded for a dependency comes back ({@link cascade}): re-reads its
+     * deployment config, which may have been saved or cleared while it was down (applyDeploymentConfig
+     * only records validity then), and refreshes its load parameters, so it never returns on a stale
+     * config or revoked secrets. Returns false when the config is now missing or invalid and PG holds
+     * none: the extension is left pending configuration instead. A read error, or an invalid config
+     * that is still stored, keeps the previous config (as for a loaded extension).
+     */
+    private refreshConfigForRestore;
     /** 本次未加载、等待批准权限的插件（含因 `requires` 只能由它们满足而未加载的插件），按依赖拓扑序。 */
     pending(): PendingExtension[];
     /** 已加载插件的清单（按加载顺序，即依赖拓扑序）。 */