feat(app-shell): offer Disable / Enable on a suite's module rows from the served disableable verdict - #28903

Requested by Steedos · project thread

Fixes #28118

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：软件包详情面板的「禁用 / 启用」按钮改为只看服务端下发的 disableable 判定（不再看 writable）。套件里 type: 'module' 的模块包（对创作只读、但服务端允许禁用）现在会出现「禁用」，走原有确认对话框；禁用后出现「启用」。编辑、发布、还原、复制、收编、删除仍然只看 writable，在模块行上继续隐藏。模块行的只读提示改为说明「不能编辑或删除，但可以禁用并重新启用」（新增两个 studio 文案，en / zh）。市场手册补充了这个按钮和 disableable 键。
• 为什么改：packages: an admin cannot disable a type:module sub-package of an installed app (422 WRITABLE_PACKAGE_REQUIRED), and a disabled package's nav contributions stay in the app #28117 让管理员可以禁用已安装应用的模块，packages: the served package row carries no "may be disabled" verdict, so the Console cannot offer Disable on a suite module the server now accepts #28318 在 GET /packages 上下发了 disableable。裁决「最小做法」：不加新页面，就在现有的软件包页给开关。
• 风险与回滚：按钮只在服务端说 disableable: true 时出现，没有新的写入路径，也没有新权限（仍是 manage_metadata）。可写包的服务端判定同样是 disableable: true，所以它们的「禁用」不变。缺少该键的行不会出现「禁用」（失败即关闭）。落地顺序受 app: the HotCRM app's UI-side reads of a disabled module (lookups, add-to-campaign / quote actions, the revenue dashboard tile) meet 404 OBJECT_PACKAGE_DISABLED instead of hiding (objectstack#28117 ruling A) hotcrm#2383 约束：在它落地前本 PR 保持草稿，不对客户可见。回滚就是 revert 本 PR。
• 先看：ui/packages/app-shell/src/views/metadata-admin/PackagesPage.tsx（disableable 读取、按钮门槛、只读提示的分支）、PackagesPage.moduleDisable-28118.test.tsx（新测试）、content/docs/deployment/marketplace-handbook.mdx（手册两处）。
• 两分钟验证：pnpm --dir ui exec vitest run packages/app-shell/src/views/metadata-admin/PackagesPage.moduleDisable-28118.test.tsx，预期 10 个用例全绿：模块行有「禁用」且需确认、其余写操作隐藏、无判定的只读行没有「禁用」、已禁用的模块行有「启用」、Installed Apps 视图里模块是单独一行。
• 需要你做的：无，席位在 app: the HotCRM app's UI-side reads of a disabled module (lookups, add-to-campaign / quote actions, the revenue dashboard tile) meet 404 OBJECT_PACKAGE_DISABLED instead of hiding (objectstack#28117 ruling A) hotcrm#2383 落地后落地。

What changes

• Disable reads the served verdict. PackageDetailSheet gates its Disable / Enable button on the row's disableable (the disable door's own verdict, package-api-assembled.zod.ts SERVED_ROW_VERDICTS, served by GET /api/v1/packages and GET /api/v1/packages/:id), not on writable. It is read the way the sheet reads writable: anything but true offers no Disable. ⛔ Nothing is re-derived from manifest.type, scope or writable. Enable is still offered on any disabled package, as before (the enable door has no writability gate).
• Every other write stays on writable. Edit, Publish, Revert, Duplicate, Adopt loose items and Delete are unchanged, so a module row (writable: false, disableable: true) offers only Disable / Enable beside the reads.
• The read-only note. A read-only row that is disableable no longer says it "cannot be edited, disabled or deleted": two studio keys, engine.packages.detail.readOnlyDisableable and engine.packages.detail.codeReadOnlyDisableable (en, zh), say it cannot be edited or deleted but can be disabled and enabled again. The confirm dialog's consequence sentence (disableDescription) already reads right for a module and is unchanged.
• Type. InstalledPackageRow gains disableable?: InstalledPackageAtEitherStage['disableable'], taken from the spec's served row. It is optional on the row type so that a row without the key types and renders as "not disableable".
• Docs (doc rider 6540426908). content/docs/deployment/marketplace-handbook.mdx: step 7 says each package of a suite is its own row in Installed Apps and the sheet offers Disable where the runtime allows it; "Disabling a module" names the Console path and the disableable key.

Where module rows appear, measured before coding (reported on the card): install-local registers every package of the artifact with source: 'marketplace', so a marketplace suite's modules are their own rows in Setup → Installed Apps (?source=marketplace). A suite booted from code has source: 'code'; its modules are on the unfiltered Setup → Packages page, with the same button.

Tests

• New PackagesPage.moduleDisable-28118.test.tsx (10 cases, real PackageDetailSheet and real PackagesPage):
  • (1) a module row with disableable: true shows Disable; it opens the confirm with the consequence copy, sends nothing until confirmed, then sends the one PATCH /api/v1/packages/:id/disable;
  • (2) every other write action is hidden on it; its read-only note is the disableable one, scope-less and project-scoped;
  • (3) disableable: false and a row with no key offer no Disable and keep the plain read-only note;
  • (4) a disabled module row shows Enable, which runs at once with no dialog;
  • (5) a non-module row served disableable: true offers Disable: the verdict decides, not manifest.type;
  • the Installed Apps view lists a marketplace module as its own row and its sheet offers Disable; control: the suite's app row (disableable: false) offers none.
• Existing fixtures in readOnlyActions-13157, readOnlyReasonAndDisableConfirm-27521, adoptLooseItems-13339 and confirmFlows-11784 now carry disableable as the server serves it for a non-module package (equal to writable).
• Ablation, once, on commit 2d45950f: node scripts/ablation-replace.mjs put the gate back to writable || !enabled (anchor 1 → 0, blob 93d7556c → 7ebf253c). The new file went red, 3 failed / 7 passed: (1), (5) and the Installed Apps case. Restored blob 93d7556c equals HEAD and git diff HEAD is empty. Case (4) and the controls stay green both ways, as expected: Enable does not change.

Acceptance notes

• disableable is optional on the row type and the list does not refuse a row without it, unlike source and writable. A missing key fails closed (no Disable, the door's own answer) instead of refusing the whole list. Making it a refused key would touch every page-level fixture; noted, not done.
• The landing waits on app: the HotCRM app's UI-side reads of a disabled module (lookups, add-to-campaign / quote actions, the revenue dashboard tile) meet 404 OBJECT_PACKAGE_DISABLED instead of hiding (objectstack#28117 ruling A) hotcrm#2383 (the card's Blocked-by:), per the ordering addendum 6523692915. The PR stays draft until then.
• A code-booted suite's modules are not in Installed Apps (they are source: 'code'); that is the existing Source filter's meaning and is unchanged here.

Verification

Generated by Claude Code