Open the library with the right grant
EPAdmin Software & Extensions → Manage Plugins uses GET /v1/plugins/library with installation:manage. The source validates a fixed component catalogue and an unconfigured signed-extension library. A catalogue card never selects an arbitrary URL, command, executable or permission.
Every fixed component
| Component | Existing destination and inspection |
|---|---|
| Nginx | Stack Builder and GET /v1/website-capabilities; requires hosting:read. |
| Apache compatibility | Stack Builder and website capability; per-site supported compatibility is separate from arbitrary Apache configuration. |
| PHP-FPM | Server Installer management and website capability; advertised runtime only. |
| MariaDB | Databases and GET /v1/database-capabilities; checks separate-instance capability. |
| phpMyAdmin | Explicitly not implemented; no workspace or inspection action. |
Search and filter by server component/web application. A component detail shows declared dependencies and prerequisite codes. Check this server reads actual capability and observation time; evidence older than five minutes expires and must be checked again. Capability is not a live website, database transaction or public network acceptance test.
Installation limits
All individual component installers are unavailable in this checkpoint. The library does not reinstall the server, add/remove packages, install phpMyAdmin or silently purchase anything. Existing service management remains separate and protected. A missing/malformed catalogue is refused rather than treated as installation readiness.
Signed extensions
The current native library reports not configured, no items, no purchase availability and no installation availability. Its declared architecture requires signed manifests, version constraints, explicit permissions and an unprivileged runner; it permits no privileged execution. The public Orbit premium Addons page is a separate purchase/history entry, and no genuine premium Panel package is currently published.
Verify and troubleshoot
Check current local grant, API version and host capability rather than assuming a newer UI changed the installed service. An old API without component metadata shows the explicit upgrade-needed notice. An unavailable service remains unavailable; do not force package installation through an extension or import a package-selected trust root. Follow the signed extension and main-licence guides only after exact installed/operator acceptance.