@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.10

package/dist/platform/ops/models.ops.js

@@ -0,0 +1,232 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { z } from "zod";
+import { ModelsQuery } from "../../agents/models.controller.js";
+import { ExtensionDisplayNames } from "../../extensions/display-name.js";
+import { ExtensionRegistry } from "../../extensions/registry.js";
+import { ModelDisabledPatch, ModelProviderParams } from "../../models/enablement.controller.js";
+import { ModelEnablement } from "../../models/enablement.js";
+import { ModelPurposePathParams } from "../../models/org-models.schemas.js";
+import { ModelPurposesService, withDeclaredByNames } from "../../models/purposes.js";
+import { ProviderRegistry } from "../../runtime/providers.js";
+import { defineOperation } from "../operation.js";
+import { PlatformOperations } from "../registry.js";
+import { precheckBy, viaAgent } from "./errors.js";
+import { Cursor, pageOf, startOf } from "./paging.js";
+import { named } from "./summary.js";
+const Purpose = ModelPurposePathParams.shape.purpose.max(100);
+const Provider = ModelProviderParams.shape.provider;
+const ModelIds = ModelDisabledPatch.shape.disable.unwrap().max(500);
+/** A purpose's target as the operation takes it: the route's, with every string bounded. */
+const Target = z
+    .object({
+    model: z
+        .object({ provider: z.string().min(1).max(200), model: z.string().min(1).max(200) })
+        .strict(),
+    params: z
+        .record(z.string().min(1).max(100), z.union([z.string().max(1000), z.number(), z.boolean()]))
+        .optional(),
+})
+    .strict()
+    .nullable();
+/** Up to ten model ids for a card, the rest as "…". */
+const few = (ids, sep) => ids.slice(0, 10).map(named).join(sep) + (ids.length > 10 ? `${sep}…` : "");
+/** `provider/model`, as a card names a model. */
+const ref = (m) => `${m.provider}/${m.model}`;
+/**
+ * The org's model operations of the `Platform` tool (spec §14.2): the model per purpose (the
+ * platform default, the org's override, the effective one) and setting or clearing the override,
+ * and the org's switched-off models of one provider. Org admins (`org.models.manage`). The
+ * platform's defaults and model list are the admin console's (platform-admin operations).
+ */
+let ModelsOperations = class ModelsOperations {
+    registry;
+    purposes;
+    enablement;
+    displayNames;
+    extensions;
+    providers;
+    constructor(registry, purposes, enablement, displayNames, extensions, providers) {
+        this.registry = registry;
+        this.purposes = purposes;
+        this.enablement = enablement;
+        this.displayNames = displayNames;
+        this.extensions = extensions;
+        this.providers = providers;
+    }
+    /** The precheck refusal of a provider that is not a running model-provider extension. */
+    providerPrecheck(provider) {
+        return this.extensions.list("model-provider").some((e) => e.plugin === provider)
+            ? { ok: true }
+            : {
+                ok: false,
+                code: "model.provider_not_found",
+                message: `Model provider ${provider} is not installed`,
+            };
+    }
+    onModuleInit() {
+        this.registry.register([
+            defineOperation({
+                id: "models.purposes",
+                description: "List the model purposes of this org (org admins): each purpose (such as chat, title, compaction, embedding) with its label, the platform default, the org's override and the effective model.",
+                input: z.object({}).strict(),
+                example: {},
+                authz: { orgAction: "org.models.manage" },
+                mirrors: ["GET /api/v1/orgs/:orgId/model-purposes"],
+                confirm: "read",
+                run: async (_input, ctx) => ({
+                    purposes: await withDeclaredByNames(await this.purposes.list(ctx.orgId), this.displayNames),
+                }),
+            }),
+            defineOperation({
+                id: "models.set-purpose",
+                description: "Set the org's model for one purpose (org admins): target.model is { provider, model } with optional params, or target null to clear the override and fall back to the platform default. The model must be usable in the org and of the purpose's kind.",
+                input: z.object({ purpose: Purpose, target: Target }).strict(),
+                example: {
+                    purpose: "title",
+                    target: { model: { provider: "model-anthropic", model: "claude-haiku-4-5" } },
+                },
+                authz: { orgAction: "org.models.manage" },
+                mirrors: ["PUT /api/v1/orgs/:orgId/model-purposes/:purpose"],
+                confirm: "org",
+                errors: [
+                    { code: "model.purpose_unknown", next: "Check the purpose with models.purposes." },
+                    {
+                        code: "agent.model_unavailable",
+                        next: "The model is not usable in this org (off, not listed, or its provider needs config); pick another one.",
+                    },
+                    {
+                        code: "validation_failed",
+                        next: "The model is of another kind than the purpose, or a param is invalid; fix it as the message says.",
+                    },
+                ],
+                // the service's own checks (purpose, model usable in the org, kind, params), read-only
+                precheck: (i, ctx) => precheckBy(() => this.purposes.validate(ctx.orgId, i.purpose, i.target === null ? null : { model: i.target.model, params: i.target.params ?? {} })),
+                summary: async (i, ctx) => {
+                    const p = (await this.purposes.list(ctx.orgId)).find((x) => x.purpose === i.purpose);
+                    const label = p?.label ?? { zh: i.purpose, en: i.purpose };
+                    return i.target === null
+                        ? {
+                            zh: `清除本组织「${label.zh}」用途的模型覆盖（改用平台默认）`,
+                            en: `Clear the org's model for purpose "${label.en}" (use the platform default)`,
+                        }
+                        : {
+                            zh: `把本组织「${label.zh}」用途的模型设为 ${ref(i.target.model)}`,
+                            en: `Set the org's model for purpose "${label.en}" to ${ref(i.target.model)}`,
+                        };
+                },
+                run: async (input, ctx) => {
+                    const view = await this.purposes.setOrg(ctx.orgId, input.purpose, input.target === null
+                        ? null
+                        : { model: input.target.model, params: input.target.params ?? {} }, ctx.actorAccountId, undefined, viaAgent("models.set-purpose", ctx));
+                    const [listing] = await withDeclaredByNames([view], this.displayNames);
+                    return { purpose: listing };
+                },
+            }),
+            defineOperation({
+                id: "models.set-disabled",
+                description: "Switch models of one provider off or back on in this org (org admins): disable and enable list model ids; ids in neither keep their state. Returns the org's agents and purposes that now point at a newly switched-off model (the change is not refused for them).",
+                input: z
+                    .object({
+                    provider: Provider,
+                    disable: ModelIds.default([]),
+                    enable: ModelIds.default([]),
+                })
+                    .strict()
+                    .refine((v) => !v.enable.some((m) => v.disable.includes(m)), {
+                    message: "A model cannot be both disabled and enabled",
+                    path: ["enable"],
+                }),
+                example: { provider: "model-anthropic", disable: ["claude-opus-4-1"], enable: [] },
+                authz: { orgAction: "org.models.manage" },
+                mirrors: ["PATCH /api/v1/orgs/:orgId/models/:provider/disabled"],
+                confirm: "org",
+                errors: [
+                    {
+                        code: "model.provider_not_found",
+                        next: "Check the provider (the model-provider extension's name) with models.purposes or extensions.list.",
+                    },
+                ],
+                precheck: async (i) => this.providerPrecheck(i.provider),
+                summary: (i) => ({
+                    zh: `在本组织调整提供者 ${i.provider} 的模型：停用 ${i.disable.length} 个（${few(i.disable, "、") || "无"}），恢复 ${i.enable.length} 个（${few(i.enable, "、") || "无"}）`,
+                    en: `Change models of provider ${i.provider} in the org: switch off ${i.disable.length} (${few(i.disable, ", ") || "none"}), back on ${i.enable.length} (${few(i.enable, ", ") || "none"})`,
+                }),
+                run: async (input, ctx) => this.enablement.setOrg(ctx.orgId, input.provider, { disable: input.disable, enable: input.enable }, { accountId: ctx.actorAccountId, auditDetail: viaAgent("models.set-disabled", ctx) }),
+            }),
+            defineOperation({
+                id: "models.available",
+                description: "List the models agents of this org can use now: the models of the installed model providers that neither the platform nor the org switched off, one row per model with its provider, kind and context window. Optionally only one kind (chat, embedding, ...). Pages by 50: pass the returned next as params.cursor. An empty list means no model provider is set up for this org.",
+                input: z.object({ kind: ModelsQuery.shape.kind, cursor: Cursor.optional() }).strict(),
+                example: { kind: "chat" },
+                authz: { orgAction: "agents.use" },
+                mirrors: ["GET /api/v1/orgs/:orgId/models"],
+                extras: ["cursor"],
+                confirm: "read",
+                run: async (input, ctx) => {
+                    const providers = await this.providers.list(ctx.orgId, input.kind === undefined ? {} : { kind: input.kind });
+                    const names = await this.displayNames.many(providers.map((p) => p.provider));
+                    const rows = providers.flatMap((p) => p.models.map((m) => ({
+                        id: `${p.provider}/${m.id}`,
+                        name: m.displayName,
+                        state: "enabled",
+                        provider: names.get(p.provider)?.en ?? p.provider,
+                        kind: m.kind,
+                        contextWindow: m.contextWindow,
+                    })));
+                    return pageOf(rows, startOf(input.cursor), 50);
+                },
+            }),
+            defineOperation({
+                id: "models.catalog",
+                description: "Read the org's model catalog (org admins): every installed model provider with its status for this org and the models the platform left on, each marked enabled or disabled by the org's own list. Use it before models.set-disabled. Optionally one provider. Pages by 50 providers: pass the returned next as params.cursor.",
+                input: z.object({ provider: Provider.optional(), cursor: Cursor.optional() }).strict(),
+                example: {},
+                authz: { orgAction: "org.models.manage" },
+                mirrors: ["GET /api/v1/orgs/:orgId/models/catalog"],
+                extras: ["provider", "cursor"],
+                confirm: "read",
+                run: async (input, ctx) => {
+                    const all = await this.providers.catalog(ctx.orgId);
+                    const names = await this.displayNames.many(all.map((p) => p.plugin));
+                    const rows = all
+                        .filter((p) => input.provider === undefined || p.plugin === input.provider)
+                        .map((p) => ({
+                        id: p.plugin,
+                        name: names.get(p.plugin)?.en ?? p.plugin,
+                        state: p.status,
+                        ...(p.error !== undefined && { reason: p.error.slice(0, 300) }),
+                        ...(p.status === "org_configured" && {
+                            next: "The platform left this provider without a key, so this org needs its own: configure it on the org's models settings page of the web app.",
+                        }),
+                        models: p.models.map((m) => ({
+                            id: m.id,
+                            name: m.displayName,
+                            state: m.disabled === true ? "disabled" : "enabled",
+                            kind: m.kind,
+                        })),
+                    }));
+                    return pageOf(rows, startOf(input.cursor), 50);
+                },
+            }),
+        ]);
+    }
+};
+ModelsOperations = __decorate([
+    Injectable(),
+    __param(0, Inject(PlatformOperations)),
+    __param(1, Inject(ModelPurposesService)),
+    __param(2, Inject(ModelEnablement)),
+    __param(3, Inject(ExtensionDisplayNames)),
+    __param(4, Inject(ExtensionRegistry)),
+    __param(5, Inject(ProviderRegistry))
+], ModelsOperations);
+export { ModelsOperations };

package/dist/platform/ops/org-plugins.ops.d.ts

@@ -0,0 +1,29 @@
+import { type OnModuleInit } from "@nestjs/common";
+import { CatalogScopeService } from "../../catalog/catalog-scope.service.js";
+import { OrgCatalogService } from "../../catalog/org-catalog.service.js";
+import { OrgPluginUploads } from "../../catalog/org-plugin-uploads.js";
+import { OwnedItems } from "../../catalog/owned-items.js";
+import { PluginInstaller } from "../../catalog/plugin-install.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
+import { PlatformOperations } from "../registry.js";
+/**
+ * The org's own plugin operations of the `Platform` tool (spec §14.2): the org's plugin installs
+ * (list, uninstall), its staged uploads (read; uploading is a byte transport and confirming is done
+ * by a person on the web), and the plugins it owns (share, delete after a preview, withdraw a
+ * pending upload). Org admins; the services re-check the role under the org lock.
+ */
+export declare class OrgPluginsOperations implements OnModuleInit {
+    private readonly registry;
+    private readonly installer;
+    private readonly orgCatalog;
+    private readonly uploads;
+    private readonly owned;
+    private readonly scope;
+    private readonly kdb;
+    constructor(registry: PlatformOperations, installer: PluginInstaller, orgCatalog: OrgCatalogService, uploads: OrgPluginUploads, owned: OwnedItems, scope: CatalogScopeService, kdb: KernelDb);
+    /** The org's own live plugin `id`, or null (another org's, a platform one, deleted, unknown). */
+    private ownedItem;
+    /** The precheck refusal of a plugin the org does not own. */
+    private ownedPrecheck;
+    onModuleInit(): void;
+}

package/dist/platform/ops/org-plugins.ops.js

@@ -0,0 +1,329 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { z } from "zod";
+import { CatalogScopeService } from "../../catalog/catalog-scope.service.js";
+import { PluginInstallPathParams } from "../../catalog/org-catalog.schemas.js";
+import { OrgCatalogService } from "../../catalog/org-catalog.service.js";
+import { OrgPluginUploads } from "../../catalog/org-plugin-uploads.js";
+import { OrgOwnedDeleteBody, OrgOwnedPluginParams, OrgOwnedShareableBody, OrgUploadStagingParams, } from "../../catalog/org-plugin-uploads.schemas.js";
+import { OwnedItems } from "../../catalog/owned-items.js";
+import { PluginInstaller } from "../../catalog/plugin-install.js";
+import { KernelDb } from "../../infra/database/kernel-db.js";
+import { defineOperation } from "../operation.js";
+import { PlatformOperations } from "../registry.js";
+import { reviewBrief } from "./catalog-admin.ops.js";
+import { precheckBy, viaAgent } from "./errors.js";
+import { Cursor, pageOf, startOf } from "./paging.js";
+import { named } from "./summary.js";
+const InstallId = PluginInstallPathParams.shape.installId.max(100);
+/** An org-owned plugin's catalog item id (`:id` of the owned-plugins routes). */
+const OwnedId = OrgOwnedPluginParams.shape.id;
+const EXAMPLE_ID = "3f1c2a9e-5b7d-4e21-9c0a-1d2e3f4a5b6c";
+/** One of the org's plugin installs as `plugins.installs` shows it: a compact row. */
+const installRow = (i) => ({
+    id: i.id,
+    name: i.name,
+    state: i.status,
+    ...(i.error !== null && { reason: `${i.error.step}: ${i.error.code}` }),
+    itemId: i.itemId,
+    version: i.version,
+    components: i.components.length,
+});
+/**
+ * The org's own plugin operations of the `Platform` tool (spec §14.2): the org's plugin installs
+ * (list, uninstall), its staged uploads (read; uploading is a byte transport and confirming is done
+ * by a person on the web), and the plugins it owns (share, delete after a preview, withdraw a
+ * pending upload). Org admins; the services re-check the role under the org lock.
+ */
+let OrgPluginsOperations = class OrgPluginsOperations {
+    registry;
+    installer;
+    orgCatalog;
+    uploads;
+    owned;
+    scope;
+    kdb;
+    constructor(registry, installer, orgCatalog, uploads, owned, scope, kdb) {
+        this.registry = registry;
+        this.installer = installer;
+        this.orgCatalog = orgCatalog;
+        this.uploads = uploads;
+        this.owned = owned;
+        this.scope = scope;
+        this.kdb = kdb;
+    }
+    /** The org's own live plugin `id`, or null (another org's, a platform one, deleted, unknown). */
+    async ownedItem(orgId, id) {
+        const row = await this.kdb.db
+            .selectFrom("catalog_items")
+            .select(["id", "name", "shareable", "awaiting_confirmation", "pending_version"])
+            .where("id", "=", id)
+            .where("owner_org_id", "=", orgId)
+            .where("deleted_at", "is", null)
+            .executeTakeFirst()
+            .catch(() => undefined);
+        return row ?? null;
+    }
+    /** The precheck refusal of a plugin the org does not own. */
+    async ownedPrecheck(orgId, id) {
+        return (await this.ownedItem(orgId, id)) === null
+            ? { ok: false, code: "catalog.item_not_found", message: "Catalog item not found" }
+            : { ok: true };
+    }
+    onModuleInit() {
+        this.registry.register([
+            defineOperation({
+                id: "plugins.installs",
+                description: "List the plugin installs of this org (org admins), one compact row each: the plugin, the install state (installing, installed, failed, uninstalling, upgrading), a failure's step and code (reason), the version and how many components it brought. Pages by 50: pass the returned next as params.cursor.",
+                input: z.object({ cursor: Cursor.optional() }).strict(),
+                example: {},
+                authz: { orgAction: "org.extensions.manage" },
+                mirrors: ["GET /api/v1/orgs/:orgId/plugin-installs"],
+                extras: ["cursor"],
+                confirm: "read",
+                run: async (input, ctx) => pageOf((await this.installer.list(ctx.orgId)).map(installRow), startOf(input.cursor), 50),
+            }),
+            defineOperation({
+                id: "plugins.uninstall",
+                description: "Uninstall one plugin install from this org (org admins): removes the components it brought (agents using them lose them). Usually switch the plugin off with plugins.set-enabled instead; this one also cleans up a failed or stuck install.",
+                input: z.object({ installId: InstallId }).strict(),
+                example: { installId: EXAMPLE_ID },
+                // the route needs org.extensions.manage; the service re-checks the plugin's component actions
+                authz: { orgAction: "org.extensions.manage" },
+                mirrors: ["DELETE /api/v1/orgs/:orgId/plugin-installs/:installId"],
+                confirm: "org",
+                errors: [
+                    { code: "plugin.install_not_found", next: "Check the install id with plugins.installs." },
+                    {
+                        code: "plugin.scope_locked",
+                        next: "The plugin is on for every org (or built in) and cannot be uninstalled in one org.",
+                    },
+                ],
+                precheck: (i, ctx) => precheckBy(() => this.installer.previewUninstall(ctx.orgId, i.installId)),
+                summary: async (i, ctx) => {
+                    const p = await this.installer.previewUninstall(ctx.orgId, i.installId);
+                    return {
+                        zh: `从本组织卸载插件「${named(p.name)}」${p.version}：移除 ${p.components.length} 个组件，${p.agents.length} 个智能体在用`,
+                        en: `Uninstall plugin "${named(p.name)}" ${p.version} from the org: removes ${p.components.length} components; ${p.agents.length} agents use it`,
+                    };
+                },
+                run: async (input, ctx) => this.orgCatalog.uninstall(ctx.orgId, ctx.actorAccountId, input.installId, undefined, viaAgent("plugins.uninstall", ctx)),
+            }),
+            defineOperation({
+                id: "plugins.upload-review",
+                description: "Read one of this org's staged plugin uploads (org admins): what the plugin brings, and for a new version of the org's own plugin the update it applies. Uploading the package and confirming it are done by a person on the web (插件 page).",
+                input: z.object({ stagingId: OrgUploadStagingParams.shape.stagingId }).strict(),
+                example: { stagingId: EXAMPLE_ID },
+                authz: { orgAction: "catalog.upload" },
+                mirrors: ["GET /api/v1/orgs/:orgId/catalog/uploads/:stagingId"],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "plugin.staging_not_found",
+                        next: "The staged upload expired (24 hours), was confirmed, or is not this org's; the person uploads it again on the 插件 page.",
+                    },
+                ],
+                run: async (input, ctx) => {
+                    const r = await this.uploads.staged(ctx.orgId, input.stagingId);
+                    return {
+                        stagingId: r.stagingId,
+                        review: reviewBrief(r.review),
+                        update: r.update === null
+                            ? null
+                            : {
+                                from: r.update.from,
+                                to: r.update.to,
+                                components: r.update.components.filter((c) => c.change !== "same").length,
+                            },
+                        next: "The person confirms the upload on the web (插件 page).",
+                    };
+                },
+            }),
+            defineOperation({
+                id: "plugins.set-shareable",
+                description: "Share one of this org's own plugins with other orgs, or stop sharing it (org admins). Stopping keeps the orgs that already use it and hides it from new ones; the super admin decides where a shared plugin is offered.",
+                input: z.object({ itemId: OwnedId, ...OrgOwnedShareableBody.shape }).strict(),
+                example: { itemId: EXAMPLE_ID, shareable: true },
+                authz: { orgAction: "catalog.upload" },
+                mirrors: ["PUT /api/v1/orgs/:orgId/owned-plugins/:id/shareable"],
+                renames: { itemId: "id" },
+                confirm: "org",
+                errors: [
+                    {
+                        code: "catalog.item_not_found",
+                        next: "Only the org's own uploaded plugins qualify; check the id with plugins.list (owner: this org).",
+                    },
+                    {
+                        code: "catalog.item_pending",
+                        next: "The plugin's first version waits for the super admin's confirmation; share it once it is confirmed.",
+                    },
+                ],
+                precheck: (i, ctx) => this.ownedPrecheck(ctx.orgId, i.itemId),
+                summary: async (i, ctx) => {
+                    const name = named((await this.ownedItem(ctx.orgId, i.itemId))?.name ?? i.itemId);
+                    return i.shareable
+                        ? {
+                            zh: `把本组织的插件「${name}」设为可共享`,
+                            en: `Share the org's plugin "${name}" with other orgs`,
+                        }
+                        : {
+                            zh: `停止共享本组织的插件「${name}」`,
+                            en: `Stop sharing the org's plugin "${name}"`,
+                        };
+                },
+                run: async (input, ctx) => {
+                    await this.owned.setShareable(ctx.orgId, ctx.actorAccountId, { kind: "plugin", id: input.itemId }, input.shareable, { auditDetail: viaAgent("plugins.set-shareable", ctx) });
+                    return { itemId: input.itemId, shareable: input.shareable };
+                },
+            }),
+            defineOperation({
+                id: "plugins.owned-delete-preview",
+                description: "Preview deleting one of this org's own plugins (org admins): removed, or transferred to the platform when other orgs use it (those orgs), the org's agents that lose it, and the previewHash plugins.owned-delete needs. Nothing is written; show it to the person first.",
+                input: z.object({ itemId: OwnedId }).strict(),
+                example: { itemId: EXAMPLE_ID },
+                authz: { orgAction: "catalog.upload" },
+                mirrors: ["POST /api/v1/orgs/:orgId/owned-plugins/:id/delete/preview"],
+                renames: { itemId: "id" },
+                confirm: "read",
+                errors: [
+                    {
+                        code: "catalog.item_not_found",
+                        next: "Only the org's own uploaded plugins qualify; check the id with plugins.list (owner: this org).",
+                    },
+                ],
+                run: async (input, ctx) => this.owned.previewDelete(ctx.orgId, input.itemId),
+            }),
+            defineOperation({
+                id: "plugins.owned-delete",
+                description: "Delete one of this org's own plugins after its preview (org admins): pass the previewHash plugins.owned-delete-preview returned. It is removed, or transferred to the platform when other orgs use it; a preview that is out of date is refused.",
+                input: z.object({ itemId: OwnedId, ...OrgOwnedDeleteBody.shape }).strict(),
+                example: {
+                    itemId: EXAMPLE_ID,
+                    previewHash: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                },
+                authz: { orgAction: "catalog.upload" },
+                mirrors: ["POST /api/v1/orgs/:orgId/owned-plugins/:id/delete"],
+                renames: { itemId: "id" },
+                confirm: "org",
+                errors: [
+                    {
+                        code: "catalog.item_not_found",
+                        next: "Only the org's own uploaded plugins qualify; check the id with plugins.list (owner: this org).",
+                    },
+                    {
+                        code: "catalog.preview_stale",
+                        next: "Call plugins.owned-delete-preview again, show it, and call again with the new previewHash.",
+                    },
+                ],
+                precheck: async (i, ctx) => {
+                    let hash = "";
+                    const r = await precheckBy(async () => {
+                        hash = (await this.owned.previewDelete(ctx.orgId, i.itemId)).previewHash;
+                    });
+                    if (!r.ok)
+                        return r;
+                    return hash === i.previewHash
+                        ? { ok: true }
+                        : {
+                            ok: false,
+                            code: "catalog.preview_stale",
+                            message: "What deleting this plugin does has changed since the preview",
+                        };
+                },
+                summary: async (i, ctx) => {
+                    const [row, p] = await Promise.all([
+                        this.ownedItem(ctx.orgId, i.itemId),
+                        this.owned.previewDelete(ctx.orgId, i.itemId),
+                    ]);
+                    const name = named(row?.name ?? i.itemId);
+                    return p.outcome === "transferred"
+                        ? {
+                            zh: `删除本组织的插件「${name}」：${p.orgs.length} 个其他组织在用，转交平台；本组织 ${p.agents.length} 个智能体失去它`,
+                            en: `Delete the org's plugin "${name}": ${p.orgs.length} other orgs use it, so it moves to the platform; ${p.agents.length} agents here lose it`,
+                        }
+                        : {
+                            zh: `删除本组织的插件「${name}」：${p.agents.length} 个智能体失去它`,
+                            en: `Delete the org's plugin "${name}": ${p.agents.length} agents lose it`,
+                        };
+                },
+                run: async (input, ctx) => {
+                    await this.owned.delete(ctx.orgId, ctx.actorAccountId, input.itemId, input.previewHash, {
+                        auditDetail: viaAgent("plugins.owned-delete", ctx),
+                    });
+                    return { deleted: input.itemId };
+                },
+            }),
+            defineOperation({
+                id: "plugins.withdraw-upload",
+                description: "Withdraw this org's upload of one of its plugins that waits for the super admin (org admins): a first version is removed (its name is free again); a new version's pending state is cleared and the current version keeps running.",
+                input: z.object({ itemId: OwnedId }).strict(),
+                example: { itemId: EXAMPLE_ID },
+                authz: { orgAction: "catalog.upload" },
+                mirrors: ["DELETE /api/v1/orgs/:orgId/owned-plugins/:id/pending"],
+                renames: { itemId: "id" },
+                confirm: "org",
+                errors: [
+                    {
+                        code: "catalog.item_not_found",
+                        next: "Only the org's own uploaded plugins qualify; check the id with plugins.list (owner: this org).",
+                    },
+                    {
+                        code: "extension.not_pending",
+                        next: "Nothing of this plugin waits for the super admin; there is nothing to withdraw.",
+                    },
+                ],
+                precheck: async (i, ctx) => {
+                    const row = await this.ownedItem(ctx.orgId, i.itemId);
+                    if (row === null) {
+                        return { ok: false, code: "catalog.item_not_found", message: "Catalog item not found" };
+                    }
+                    return row.awaiting_confirmation || row.pending_version !== null
+                        ? { ok: true }
+                        : {
+                            ok: false,
+                            code: "extension.not_pending",
+                            message: `Plugin ${row.name} has no upload waiting for the super admin`,
+                        };
+                },
+                summary: async (i, ctx) => {
+                    const row = await this.ownedItem(ctx.orgId, i.itemId);
+                    const name = named(row?.name ?? i.itemId);
+                    return row?.awaiting_confirmation
+                        ? {
+                            zh: `撤回本组织插件「${name}」待确认的首个版本（插件随之移除）`,
+                            en: `Withdraw the pending first version of the org's plugin "${name}" (the plugin is removed)`,
+                        }
+                        : {
+                            zh: `撤回本组织插件「${name}」待确认的新版本 ${row?.pending_version ?? ""}`,
+                            en: `Withdraw the pending new version ${row?.pending_version ?? ""} of the org's plugin "${name}"`,
+                        };
+                },
+                run: async (input, ctx) => {
+                    await this.scope.withdraw(ctx.orgId, ctx.actorAccountId, input.itemId, {
+                        auditDetail: viaAgent("plugins.withdraw-upload", ctx),
+                    });
+                    return { withdrawn: input.itemId };
+                },
+            }),
+        ]);
+    }
+};
+OrgPluginsOperations = __decorate([
+    Injectable(),
+    __param(0, Inject(PlatformOperations)),
+    __param(1, Inject(PluginInstaller)),
+    __param(2, Inject(OrgCatalogService)),
+    __param(3, Inject(OrgPluginUploads)),
+    __param(4, Inject(OwnedItems)),
+    __param(5, Inject(CatalogScopeService)),
+    __param(6, Inject(KernelDb))
+], OrgPluginsOperations);
+export { OrgPluginsOperations };

package/dist/platform/ops/org-settings.ops.d.ts

@@ -0,0 +1,16 @@
+import { type OnModuleInit } from "@nestjs/common";
+import { OrgSettingsService } from "../../orgs/settings.service.js";
+import { PlatformOperations } from "../registry.js";
+/**
+ * Org settings operations of the `Platform` tool (spec §14): read the settings every member sees,
+ * and change them (org admins). The `platformTool` setting is included. A write that turns it
+ * off or to read-only is allowed once the person confirms it, and it applies to later calls: the
+ * tool reads the setting on every call, so the current run is cut off from the next call on. The
+ * result and the card say so.
+ */
+export declare class OrgSettingsOperations implements OnModuleInit {
+    private readonly registry;
+    private readonly settings;
+    constructor(registry: PlatformOperations, settings: OrgSettingsService);
+    onModuleInit(): void;
+}