@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.10

package/dist/runtime/providers.js

@@ -1,25 +1,108 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { createHash } from "node:crypto";
 import { assertValidDeclarations, EFFORT_VALUES, parseExtensionPoint, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable, Module, Optional } from "@nestjs/common";
 import { ApiError } from "../errors.js";
+import { deploymentConfigHash } from "../extensions/config-hash.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
+import { missingOverridable } from "../extensions/org-levels.js";
+import { ExtensionRegistry } from "../extensions/registry.js";
+import { ExtensionStateModule } from "../extensions/state.module.js";
+import { CacheService } from "../infra/cache/cache.service.js";
+import { Cacheable } from "../infra/cache/cacheable.decorator.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KERNEL_LOGGER, REDIS } from "../infra/tokens.js";
+import { ModelEnablement, ModelEnablementModule, modelKey } from "../models/enablement.js";
 /** 供应商模型列表在 Redis 中的缓存时长（秒）。 */
 const MODELS_TTL_SECONDS = 600;
-/** 单个供应商 `listModels()` 的时限（毫秒）：一个卡住的供应商不拖住整个列表与解析。 */
-export const LIST_MODELS_TIMEOUT_MS = 10_000;
+/**
+ * Optional provider: the `listModels()` time limit (ms) instead of the config's
+ * `models.listTimeoutMs` (tests).
+ */
+export const LIST_MODELS_TIMEOUT = Symbol("LIST_MODELS_TIMEOUT");
 /**
  * 列表视图（后台模型页、组织模型页）里列模型失败的供应商在这么多秒内直接标 error、不再请求（Redis，多副本共享）。
  * 只用于列表；`resolve`（运行时）照常每次请求，失败由降级梯子重试。
  */
 export const LIST_FAILURE_TTL_SECONDS = 15;
 /**
- * 键带供应商的契约主版本：插件从 `@1` 升级到 `@2` 后不会读到 `@1`（经适配）时写入的列表
- * （两者都是 `@2` 形状，按形状分辨不出来）。
- * 键还带插件版本与部署配置摘要：插件升级（参数声明可能变了）或改部署配置（如增删模型）后，
- * 各副本立即按新声明校验，不必等旧缓存 TTL 到期。摘要只是哈希，不含配置明文（secret 不进键）。
- * 旧键按 TTL 自然过期。没有版本 / 摘要的条目（测试替身）用 `-` 占位。
+ * How long the "model dropped from the list" warn is not repeated for the same (provider, model,
+ * config digest): the list is re-read every {@link MODELS_TTL_SECONDS}, the warn is not.
+ */
+const DROPPED_WARN_TTL_SECONDS = 24 * 3600;
+/**
+ * The shape of a cached model list. 2: every entry carries its normalised `kind` (model platform
+ * providers); a format-1 entry has none, and a kernel reading it found no chat model at all.
+ */
+const MODELS_CACHE_FORMAT = 2;
+/**
+ * The model list's cache key (`@Cacheable` stores it as `cache:<key>`). It carries the provider's
+ * contract major: after a plugin moves from `@1` to `@2` it never reads the list written through
+ * the `@1` adapter (both are `@2`-shaped, the shape cannot tell them apart). It also carries the
+ * plugin version and the digest of the effective config the list was read with (see
+ * {@link ProviderRegistry}): after an upgrade (the parameter declarations may have changed) or a
+ * config change (models added or removed) every replica validates the new list at once instead of
+ * waiting for the old entry's TTL. The digest is only a hash, never config text (no secret in the
+ * key). Old keys expire by TTL. Entries without a version / digest (test doubles) use `-`.
+ * `f<n>` is the shape of the cached entry ({@link MODELS_CACHE_FORMAT}): a kernel that changes what
+ * it caches bumps it, so during a rolling upgrade it never reads a list an older kernel wrote.
  */
-const modelsKey = (p) => `capk:models:${p.plugin}:v${p.major}:${p.version ?? "-"}:${p.configHash ?? "-"}`;
+const modelsKey = (p, hash) => `capk:models:${p.plugin}:v${p.major}:f${MODELS_CACHE_FORMAT}:${p.version ?? "-"}:${hash ?? "-"}`;
 /** 列表视图的失败标记（{@link LIST_FAILURE_TTL_SECONDS}），与模型列表同样按版本与配置摘要区分。 */
-const listFailedKey = (p) => `capk:models-failed:${p.plugin}:v${p.major}:${p.version ?? "-"}:${p.configHash ?? "-"}`;
+const listFailedKey = (p, hash) => `capk:models-failed:${p.plugin}:v${p.major}:${p.version ?? "-"}:${hash ?? "-"}`;
+const droppedKey = (plugin, hash, model) => `capk:models-dropped:${plugin}:${hash ?? "-"}:${model}`;
+/**
+ * The digest of an org's own copy of the config. `deploymentConfigHash` masks secrets, and a copy
+ * usually differs from the platform only by its key, so the org id goes into the digest: a copy
+ * never shares the platform's list (or another org's), whose key may see other models.
+ */
+const copyHash = (orgId, schema, config) => createHash("sha256")
+    .update(`${orgId}\0${deploymentConfigHash(schema, config)}`)
+    .digest("hex")
+    .slice(0, 16);
 const CAPABILITY = "model-provider";
+/** The model kinds this kernel knows; another kind (a newer plugin) is listed as `other`. */
+const KNOWN_KINDS = new Set([
+    "chat",
+    "embedding",
+    "rerank",
+    "image_generation",
+    "video_generation",
+    "speech_to_text",
+    "text_to_speech",
+]);
+function bindProvider(impl, call) {
+    const bound = {
+        stream: (req, opts) => impl.stream(req, { signal: opts.signal, ...call }),
+    };
+    if (typeof impl.embed === "function") {
+        bound.embed = (req, opts) => impl.embed(req, { signal: opts.signal, ...call });
+    }
+    return bound;
+}
+const positiveInt = (n) => typeof n === "number" && Number.isInteger(n) && n > 0;
+/**
+ * Whether an embedding model's info is usable: at least one dimension, every dimension and the
+ * limits positive integers, and `defaultDimensions` one of `dimensions`. A model failing this is
+ * dropped from the list (every default call on it would fail validation).
+ */
+function isValidEmbeddingInfo(e) {
+    return (Array.isArray(e.dimensions) &&
+        e.dimensions.length > 0 &&
+        e.dimensions.every(positiveInt) &&
+        positiveInt(e.defaultDimensions) &&
+        e.dimensions.includes(e.defaultDimensions) &&
+        positiveInt(e.maxInputTokens) &&
+        positiveInt(e.maxBatch));
+}
 /**
  * 供应商的 `listModels()` 失败（上游不可用等）。仍是 `agent.model_unavailable`，HTTP 调用方照常
  * 得到该错误码；运行时（`runModelStep`）据此类型把它当作可重试的失败交给降级梯子，
@@ -47,14 +130,16 @@ const V1_EFFORT_KNOB = {
 /**
  * 把 `model-provider@1` 实现包成 `@2`：
  * - `listModels`：`parameters` 由 `capabilities.effort` 推导（为真时只有 effort 旋钮，否则为空）；
+ *   an `@1` model is always a chat model: `kind` and `embedding` are dropped (an `@1` provider has
+ *   no `embed`); the per-call options are not passed (an `@1` provider reads `ctx.config`);
  * - `stream`：`params.effort` 映射为 `req.effort`，其余参数丢弃（`@1` 没有对应字段）；
- *   没有 `params.effort` 时保留请求自带的 `effort`。
+ *   没有 `params.effort` 时保留请求自带的 `effort`；only the signal is passed.
  */
 export function adaptModelProviderV1(impl) {
     return {
         async listModels() {
             const models = await impl.listModels();
-            return models.map((m) => ({
+            return models.map(({ kind: _kind, embedding: _embedding, ...m }) => ({
                 ...m,
                 parameters: m.capabilities.effort ? [structuredClone(V1_EFFORT_KNOB)] : [],
             }));
@@ -67,41 +152,61 @@ export function adaptModelProviderV1(impl) {
             if (typeof effort === "string" && EFFORT_VALUES.includes(effort)) {
                 out.effort = effort;
             }
-            return impl.stream(out, opts);
+            return impl.stream(out, { signal: opts.signal });
         },
     };
 }
-/** 缓存里的条目必须是 `@2` 形状（旧版本内核写入的 `@1` 原始结果没有 `parameters`，视为未命中）。 */
-const isCurrentShape = (models) => Array.isArray(models) &&
-    models.every((m) => typeof m === "object" && m !== null && Array.isArray(m.parameters));
 /**
  * 模型供应商注册表：供应商即提供 `model-provider` 能力的插件（以插件名为供应商名）。
  * 同时支持 `model-provider@1`（经 {@link adaptModelProviderV1} 适配）与 `@2`；
- * 同一插件两者都提供时用 `@2`。`@2` 的 `listModels()` 结果先过 `assertValidDeclarations`，
- * 不合规的供应商不可用（不可重试）。
- * 每个供应商的模型列表（`@2` 形状）缓存在 Redis `capk:models:<provider>:v<主版本>:<插件版本>:<部署配置摘要>`（EX 600），不放进程内存，
- * 多副本共享同一份缓存。
+ * 同一插件两者都提供时用 `@2`。
+ *
+ * Org-bound (spec B §5.5, A §6): every list and call is made for an org with the provider's
+ * effective config there (`EffectiveConfigs.get`), passed as `{ orgId, config }`; a provider whose
+ * effective config is not valid in the org offers no models there, and neither does one the org
+ * explicitly turned off (its own extension switch row off, spec A §8; a provider with no switch row
+ * stays usable). The admin view (no org) lists with the platform config.
+ *
+ * Each list is validated per model (spec B §5.1): kinds are normalised (absent = `chat`, unknown =
+ * `other`); a chat model failing `assertValidDeclarations`, or an `embedding` model without
+ * `embedding` info or from a provider without `embed`, is dropped with a warn, the rest of the
+ * provider stays usable. Only `chat` and `embedding` models resolve.
+ *
+ * Each list (`@2`-shaped) is cached in Redis (`@Cacheable`, key
+ * `cache:capk:models:<provider>:v<major>:<plugin version>:<config digest>`, 600 s), never in
+ * process memory: every replica shares it. The digest is the platform config's for every org that
+ * follows the platform (one shared list), and a per-org digest for an org's own copy.
  */
-export class ProviderRegistry {
+let ProviderRegistry = class ProviderRegistry {
     host;
+    effective;
+    cacheService;
     kv;
+    config;
+    enablement;
     log;
-    opts;
-    constructor(host, kv, log, opts = {}) {
+    listTimeoutOverride;
+    constructor(host, effective, cacheService, kv, config, enablement, log, 
+    /** Overrides `models.listTimeoutMs` (tests). */
+    listTimeoutOverride) {
         this.host = host;
+        this.effective = effective;
+        this.cacheService = cacheService;
         this.kv = kv;
+        this.config = config;
+        this.enablement = enablement;
         this.log = log;
-        this.opts = opts;
+        this.listTimeoutOverride = listTimeoutOverride;
     }
     /** `listModels()` 加时限（到时按失败处理，供应商的调用留在后台、结果丢弃）。 */
-    async listModelsWithTimeout(impl) {
-        const ms = this.opts.listTimeoutMs ?? LIST_MODELS_TIMEOUT_MS;
+    async listModelsWithTimeout(impl, call) {
+        const ms = this.listTimeoutOverride ?? this.config.get().models.listTimeoutMs;
         let timer;
-        const call = Promise.resolve().then(() => impl.listModels());
-        call.catch(() => { });
+        const call$ = Promise.resolve().then(() => impl.listModels(call));
+        call$.catch(() => { });
         try {
             return await Promise.race([
-                call,
+                call$,
                 new Promise((_, reject) => {
                     timer = setTimeout(() => reject(new Error(`listModels timed out after ${ms}ms`)), ms);
                 }),
@@ -111,6 +216,20 @@ export class ProviderRegistry {
             clearTimeout(timer);
         }
     }
+    /**
+     * Whether at least one model-provider extension is loaded on this replica (enabled, configured,
+     * set up) with a valid effective config in `orgId`. Read from extension state and the org's
+     * config only: never calls a vendor, so a provider whose vendor is down still counts (org
+     * readiness, web-order spec §3.8).
+     */
+    async hasProvider(orgId) {
+        const off = await this.enablement.switchedOff(orgId);
+        for (const p of this.providers()) {
+            if ((await this.target(p, orgId, off)).ok)
+                return true;
+        }
+        return false;
+    }
     /** 每个插件取一个实现（`@2` 优先），按插件首次出现的顺序；不支持的主版本记 warn 后忽略。 */
     providers() {
         const chosen = new Map();
@@ -141,57 +260,174 @@ export class ProviderRegistry {
             impl: major === 2 ? impl : adaptModelProviderV1(impl),
         }));
     }
-    async models(p) {
-        const { plugin: provider, major, impl } = p;
-        const key = modelsKey(p);
-        const cached = await this.kv.get(key);
-        if (cached !== null) {
-            const parsed = JSON.parse(cached);
-            if (isCurrentShape(parsed))
-                return parsed;
+    /**
+     * The call options and list digest of `p` for `orgId`, or for the platform when `orgId` is
+     * undefined (the admin view). An org: its effective config (not valid -> `needs_config`); the
+     * platform's digest while it follows the platform, a per-org one for its copy. The platform: its
+     * own config (a required overridable field left empty -> `org_configured`). `off`: the
+     * extensions the org explicitly turned off (`ModelEnablement.switchedOff`) -> `switched_off`.
+     */
+    async target(p, orgId, off = new Set()) {
+        const inst = this.host.current?.(p.plugin);
+        const schema = inst?.manifest.config?.deployment;
+        if (orgId === undefined) {
+            if (schema && missingOverridable(schema, inst?.config).length > 0) {
+                return { ok: false, reason: "org_configured" };
+            }
+            return { ok: true, call: { config: inst?.config }, hash: p.configHash };
         }
+        if (off.has(p.plugin))
+            return { ok: false, reason: "switched_off" };
+        const eff = await this.effective.get(orgId, p.plugin);
+        if (!eff.ok)
+            return { ok: false, reason: "needs_config" };
+        // an `@1` provider ignores the per-call options (it reads `ctx.config`): the org's own copy
+        // could not be honoured, its calls would go out with the platform's config
+        if (eff.source === "copy" && p.major === 1)
+            return { ok: false, reason: "needs_config" };
+        return {
+            ok: true,
+            call: { orgId, config: eff.config },
+            hash: eff.source === "platform" ? p.configHash : copyHash(orgId, schema, eff.config),
+        };
+    }
+    models(p, t) {
+        return this.validatedModels(modelsKey(p, t.hash), p, t.call, t.hash);
+    }
+    /** The provider's validated model list, cached under `key` (see {@link modelsKey}). */
+    async validatedModels(_key, p, call, hash) {
+        const { plugin: provider, impl } = p;
         let models;
         try {
-            models = await this.listModelsWithTimeout(impl);
+            models = await this.listModelsWithTimeout(impl, call);
         }
         catch (err) {
             throw new ProviderListError(provider, err);
         }
-        if (major === 2) {
-            try {
-                for (const m of models)
+        const out = [];
+        for (const m of models) {
+            const kind = m.kind === undefined ? "chat" : KNOWN_KINDS.has(m.kind) ? m.kind : "other";
+            let problem;
+            let cause;
+            if (kind === "chat") {
+                try {
                     assertValidDeclarations(provider, m.parameters);
+                }
+                catch (err) {
+                    problem = "invalid parameter declarations";
+                    cause = err;
+                }
             }
-            catch (err) {
-                const e = new ApiError("agent.model_unavailable", `Model provider ${provider} declared invalid model parameters`);
-                e.cause = err;
-                throw e;
+            else if (kind === "embedding") {
+                if (!m.embedding)
+                    problem = "an embedding model without embedding info";
+                else if (!isValidEmbeddingInfo(m.embedding))
+                    problem = "malformed embedding info";
+                else if (typeof impl.embed !== "function") {
+                    problem = "an embedding model from a provider without embed";
+                }
+            }
+            if (problem !== undefined) {
+                await this.warnDropped(provider, m.id, hash, problem, cause);
+                continue;
             }
+            out.push({ ...m, kind });
         }
-        await this.kv.set(key, JSON.stringify(models), "EX", MODELS_TTL_SECONDS);
-        return models;
+        return out;
+    }
+    /** One warn per (provider, model, config digest) within {@link DROPPED_WARN_TTL_SECONDS}. */
+    async warnDropped(provider, model, hash, problem, cause) {
+        const key = droppedKey(provider, hash, model);
+        if ((await this.kv.get(key)) !== null)
+            return;
+        await this.kv.set(key, "1", "EX", DROPPED_WARN_TTL_SECONDS);
+        this.log?.warn("model dropped from the provider's list", {
+            provider,
+            model,
+            problem,
+            ...(cause !== undefined && { err: cause }),
+        });
+    }
+    /**
+     * 每个供应商及其模型（按插件加载顺序），for `orgId`：列模型失败或在该组织需要配置的供应商跳过。Only
+     * enabled models (neither the platform nor the org disabled them, spec B §5.3), optionally of
+     * one `kind`.
+     */
+    async list(orgId, opts = {}) {
+        return (await this.listWithStatus(orgId)).flatMap((p) => p.status === "ok"
+            ? [
+                {
+                    provider: p.provider,
+                    models: opts.kind === undefined ? p.models : p.models.filter((m) => m.kind === opts.kind),
+                },
+            ]
+            : []);
     }
-    /** 每个已安装供应商及其模型（按插件加载顺序）；列模型失败或声明不合规的供应商跳过并记 warn。 */
-    async list() {
-        return (await this.listWithStatus()).flatMap((p) => p.status === "ok" ? [{ provider: p.provider, models: p.models }] : []);
+    /**
+     * An org's catalog (the org settings page, spec B §5.3): every provider as in
+     * {@link listWithStatus} for the org, with every model the platform left on, each carrying
+     * `disabled` for the org's own list. Reads the same cached lists (no extra provider call).
+     */
+    async catalog(orgId) {
+        const [statuses, platform, org] = await Promise.all([
+            this.statuses(orgId),
+            this.enablement.disabled(null),
+            this.enablement.disabled(orgId),
+        ]);
+        return statuses.map((p) => ({
+            ...p,
+            models: p.models
+                .filter((m) => !platform.has(modelKey(p.provider, m.id)))
+                .map((m) => ({ ...m, disabled: org.has(modelKey(p.provider, m.id)) })),
+        }));
+    }
+    /**
+     * 每个已安装供应商及其状态（按插件加载顺序），for `orgId` (enabled models only), or the platform
+     * view when undefined (`/admin/models`: every model, `disabled` from the platform's list only).
+     * See {@link statuses} for the statuses.
+     */
+    async listWithStatus(orgId) {
+        const [statuses, platform, org] = await Promise.all([
+            this.statuses(orgId),
+            this.enablement.disabled(null),
+            orgId === undefined ? Promise.resolve(new Set()) : this.enablement.disabled(orgId),
+        ]);
+        return statuses.map((p) => ({
+            ...p,
+            models: orgId === undefined
+                ? p.models.map((m) => ({ ...m, disabled: platform.has(modelKey(p.provider, m.id)) }))
+                : p.models.filter((m) => {
+                    const key = modelKey(p.provider, m.id);
+                    return !platform.has(key) && !org.has(key);
+                }),
+        }));
     }
     /**
-     * 每个已安装供应商及其状态（按插件加载顺序，后台用）：列模型失败（含超过 {@link LIST_MODELS_TIMEOUT_MS}）或声明
-     * 不合规的标 `error`、`models` 为空，不影响其他供应商；列模型失败的在 {@link LIST_FAILURE_TTL_SECONDS} 秒内不再请求。`error` 只是内核自己的英文说明（不透出上游错误原文，原文记 warn 日志）。
+     * 每个已安装供应商的完整列表与状态，for `orgId` or the platform: 列模型失败（含超过
+     * `models.listTimeoutMs`）的标 `error`、`models` 为空，不影响其他供应商；列模型失败的在
+     * {@link LIST_FAILURE_TTL_SECONDS} 秒内不再请求。An org where the provider needs configuration gets
+     * `error`; the platform view of a provider whose platform config leaves a required overridable
+     * field empty gets `org_configured`. `error` 只是内核自己的英文说明（不透出上游错误原文，原文记 warn
+     * 日志）。No disabled list applied.
      */
-    async listWithStatus() {
+    async statuses(orgId) {
         const providers = this.providers();
+        const off = orgId === undefined ? new Set() : await this.enablement.switchedOff(orgId);
         const settled = await Promise.allSettled(providers.map(async (p) => {
+            const t = await this.target(p, orgId, off);
+            if (!t.ok)
+                return t.reason;
+            const failed = listFailedKey(p, t.hash);
             // 刚失败过的供应商：短时间内直接标 error，不再等它（每个供应商另有时限）
-            if ((await this.kv.get(listFailedKey(p))) !== null) {
+            if ((await this.kv.get(failed)) !== null) {
                 throw new ProviderListError(p.plugin, new Error("listModels failed recently"));
             }
             try {
-                return await this.models(p);
+                return await this.models(p, t);
             }
             catch (err) {
                 if (err instanceof ProviderListError) {
-                    await this.kv.set(listFailedKey(p), "1", "EX", LIST_FAILURE_TTL_SECONDS);
+                    await this.kv.set(failed, "1", "EX", LIST_FAILURE_TTL_SECONDS);
                 }
                 throw err;
             }
@@ -199,6 +435,17 @@ export class ProviderRegistry {
         return settled.map((r, i) => {
             const provider = providers[i].plugin;
             if (r.status === "fulfilled") {
+                if (r.value === "org_configured") {
+                    return { provider, plugin: provider, status: "org_configured", models: [] };
+                }
+                if (r.value === "needs_config") {
+                    const error = `Model provider ${provider} needs configuration in this organization`;
+                    return { provider, plugin: provider, status: "error", error, models: [] };
+                }
+                if (r.value === "switched_off") {
+                    const error = `Model provider ${provider} is turned off in this organization`;
+                    return { provider, plugin: provider, status: "error", error, models: [] };
+                }
                 return { provider, plugin: provider, status: "ok", models: r.value };
             }
             this.log?.warn("model provider listModels failed; skipped", { provider, err: r.reason });
@@ -209,16 +456,79 @@ export class ProviderRegistry {
         });
     }
     /**
-     * 解析模型引用，返回 `@2` 形状的供应商实现（`@1` 已适配）与模型信息。
-     * 供应商未安装、模型不存在或参数声明不合规 → `agent.model_unavailable`；
+     * 解析模型引用 for `orgId`，返回绑定到该组织调用选项的供应商与模型信息。
+     * 供应商未安装、在该组织需要配置、模型不存在（或被丢弃）、不是 `opts.kind`（default `chat`: a
+     * streaming caller never gets an embedding model）或被平台 / 该组织停用 → `agent.model_unavailable`；
      * 供应商 `listModels()` 失败 → `ProviderListError`（同一错误码，运行时视为可重试）。
      */
-    async resolve(ref) {
+    async resolve(orgId, ref, opts = {}) {
+        const { p, t, info } = await this.lookup(orgId, ref, opts.kind ?? "chat");
+        return { provider: bindProvider(p.impl, t.call), info };
+    }
+    /**
+     * The model's info in the platform view (deployment-level settings such as a purpose's
+     * deployment default; no call is ever made there), by {@link resolve}'s rules. A provider each
+     * org configures itself has no platform list: `agent.model_unavailable`. Only the platform's
+     * disabled list applies.
+     */
+    async platformInfo(ref, opts = {}) {
+        return (await this.lookup(undefined, ref, opts.kind ?? "chat")).info;
+    }
+    async lookup(orgId, ref, kind) {
+        const unavailable = () => new ApiError("agent.model_unavailable", `Model ${ref.provider}/${ref.model} is not available`);
         const p = this.providers().find((x) => x.plugin === ref.provider);
-        const info = p && (await this.models(p)).find((m) => m.id === ref.model);
-        if (!p || !info) {
-            throw new ApiError("agent.model_unavailable", `Model ${ref.provider}/${ref.model} is not available`);
+        if (!p)
+            throw unavailable();
+        const off = orgId === undefined ? new Set() : await this.enablement.switchedOff(orgId);
+        const t = await this.target(p, orgId, off);
+        if (!t.ok) {
+            throw new ApiError("agent.model_unavailable", t.reason === "org_configured"
+                ? `Model provider ${ref.provider} is configured by each organization`
+                : t.reason === "switched_off"
+                    ? `Model provider ${ref.provider} is turned off in this organization`
+                    : `Model provider ${ref.provider} needs configuration in this organization`);
+        }
+        const info = (await this.models(p, t)).find((m) => m.id === ref.model);
+        if (!info || (info.kind !== "chat" && info.kind !== "embedding"))
+            throw unavailable();
+        if (kind !== "callable" && info.kind !== kind) {
+            throw new ApiError("agent.model_unavailable", `Model ${ref.provider}/${ref.model} is not ${kind === "embedding" ? "an" : "a"} ${kind} model`);
+        }
+        const key = modelKey(ref.provider, ref.model);
+        const [platform, org] = await Promise.all([
+            this.enablement.disabled(null),
+            orgId === undefined ? Promise.resolve(new Set()) : this.enablement.disabled(orgId),
+        ]);
+        if (platform.has(key) || org.has(key)) {
+            throw new ApiError("agent.model_unavailable", `Model ${ref.provider}/${ref.model} is disabled`);
         }
-        return { provider: p.impl, info };
+        return { p, t, info: info };
     }
-}
+};
+__decorate([
+    Cacheable({ key: "#{0}", ttl: MODELS_TTL_SECONDS })
+], ProviderRegistry.prototype, "validatedModels", null);
+ProviderRegistry = __decorate([
+    Injectable(),
+    __param(0, Inject(ExtensionRegistry)),
+    __param(1, Inject(EffectiveConfigs)),
+    __param(2, Inject(CacheService)),
+    __param(3, Inject(REDIS)),
+    __param(4, Inject(KernelConfigService)),
+    __param(5, Inject(ModelEnablement)),
+    __param(6, Inject(KERNEL_LOGGER)),
+    __param(7, Optional()),
+    __param(7, Inject(LIST_MODELS_TIMEOUT))
+], ProviderRegistry);
+export { ProviderRegistry };
+/** The model provider registry (one instance; the models and agents domains read it). */
+let ProvidersModule = class ProvidersModule {
+};
+ProvidersModule = __decorate([
+    Module({
+        imports: [ExtensionStateModule, ModelEnablementModule],
+        providers: [ProviderRegistry],
+        exports: [ProviderRegistry],
+    })
+], ProvidersModule);
+export { ProvidersModule };

package/dist/runtime/quota.d.ts

@@ -1,6 +1,7 @@
 import type { Redis } from "ioredis";
-import type { KernelConfig } from "../config/schema.js";
 import type { SettingsService } from "../identity/settings.js";
+import type { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import type { LeaseHandle, LockService } from "../infra/lock/lock.service.js";
 /** 组织配额租约的默认时长（毫秒）：持有方每 `leaseMs / 3` 续租一次。 */
 export declare const ORG_QUOTA_LEASE_MS = 60000;
 /** 运行配额的键前缀（`capk:org-runs:<orgId>`）；评测运行用 {@link EVAL_QUOTA_PREFIX}。 */
@@ -11,19 +12,32 @@ export declare const EVAL_QUOTA_PREFIX = "capk:org-evals:";
  * 组织级运行并发配额（spec 4.3）：Redis ZSET `<keyPrefix><orgId>`（默认 `capk:org-runs:<orgId>`），
  * 成员 runId（评测为 jobId）、分数为租约到期时间。
  * 持有方崩溃时不 `leave`，成员在租约到期后被下一次 `tryEnter` 清理，名额不泄漏。
+ * One instance per key prefix, provided under {@link RUN_QUOTA} / {@link EVAL_QUOTA}.
  */
 export declare class OrgQuota {
     private readonly redis;
     private readonly keyPrefix;
-    constructor(redis: Redis, keyPrefix?: string);
+    private readonly locks?;
+    constructor(redis: Redis, keyPrefix?: string, locks?: LockService | undefined);
     private key;
     tryEnter(orgId: string, runId: string, limit: number, leaseMs?: number): Promise<boolean>;
     /** 续期；成员已过期被清理 → false。 */
     renew(orgId: string, runId: string, leaseMs?: number): Promise<boolean>;
     leave(orgId: string, runId: string): Promise<void>;
+    /**
+     * Takes a slot ({@link tryEnter}) and keeps it while held: renewed every `leaseMs / 3` by the
+     * lock service's watchdog; `release()` leaves. Undefined when the organization is at its limit.
+     * A slot that could not be renewed (it expired meanwhile) aborts `lost` with one WARN; the
+     * holder may go on (the slot is a fair-share limit, not mutual exclusion).
+     */
+    enter(orgId: string, runId: string, limit: number, leaseMs?: number): Promise<LeaseHandle | undefined>;
 }
+/** The organization run quota (`capk:org-runs:<orgId>`). */
+export declare const RUN_QUOTA: unique symbol;
+/** The organization eval quota (`capk:org-evals:<orgId>`). */
+export declare const EVAL_QUOTA: unique symbol;
 /**
  * 组织的运行并发上限：部署设置 `runConcurrencyOverrides[orgId]`，没有则用 `runtime.orgConcurrency`
  * （热更新字段，每次经 `config()` 读当前值）。
  */
-export declare function orgRunLimit(settings: Pick<SettingsService, "get">, config: () => KernelConfig, orgId: string): Promise<number>;
+export declare function orgRunLimit(settings: Pick<SettingsService, "get">, config: Pick<KernelConfigService, "get">, orgId: string): Promise<number>;

package/dist/runtime/quota.js

@@ -38,13 +38,16 @@ return 0
  * 组织级运行并发配额（spec 4.3）：Redis ZSET `<keyPrefix><orgId>`（默认 `capk:org-runs:<orgId>`），
  * 成员 runId（评测为 jobId）、分数为租约到期时间。
  * 持有方崩溃时不 `leave`，成员在租约到期后被下一次 `tryEnter` 清理，名额不泄漏。
+ * One instance per key prefix, provided under {@link RUN_QUOTA} / {@link EVAL_QUOTA}.
  */
 export class OrgQuota {
     redis;
     keyPrefix;
-    constructor(redis, keyPrefix = RUN_QUOTA_PREFIX) {
+    locks;
+    constructor(redis, keyPrefix = RUN_QUOTA_PREFIX, locks) {
         this.redis = redis;
         this.keyPrefix = keyPrefix;
+        this.locks = locks;
     }
     key(orgId) {
         return `${this.keyPrefix}${orgId}`;
@@ -59,12 +62,34 @@ export class OrgQuota {
     async leave(orgId, runId) {
         await this.redis.zrem(this.key(orgId), runId);
     }
+    /**
+     * Takes a slot ({@link tryEnter}) and keeps it while held: renewed every `leaseMs / 3` by the
+     * lock service's watchdog; `release()` leaves. Undefined when the organization is at its limit.
+     * A slot that could not be renewed (it expired meanwhile) aborts `lost` with one WARN; the
+     * holder may go on (the slot is a fair-share limit, not mutual exclusion).
+     */
+    async enter(orgId, runId, limit, leaseMs = ORG_QUOTA_LEASE_MS) {
+        const locks = this.locks;
+        if (!locks)
+            throw new Error("OrgQuota.enter needs the lock service");
+        const sentAt = Date.now();
+        if (!(await this.tryEnter(orgId, runId, limit, leaseMs)))
+            return undefined;
+        return locks.keepAlive(`${this.key(orgId)}/${runId}`, leaseMs, {
+            renew: () => this.renew(orgId, runId, leaseMs),
+            release: () => this.leave(orgId, runId),
+        }, sentAt);
+    }
 }
+/** The organization run quota (`capk:org-runs:<orgId>`). */
+export const RUN_QUOTA = Symbol("RUN_QUOTA");
+/** The organization eval quota (`capk:org-evals:<orgId>`). */
+export const EVAL_QUOTA = Symbol("EVAL_QUOTA");
 /**
  * 组织的运行并发上限：部署设置 `runConcurrencyOverrides[orgId]`，没有则用 `runtime.orgConcurrency`
  * （热更新字段，每次经 `config()` 读当前值）。
  */
 export async function orgRunLimit(settings, config, orgId) {
     const { runConcurrencyOverrides } = await settings.get();
-    return runConcurrencyOverrides[orgId] ?? config().runtime.orgConcurrency;
+    return runConcurrencyOverrides[orgId] ?? config.get().runtime.orgConcurrency;
 }

package/dist/runtime/retired-schedulers.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Job scheduler ids of the maintenance queue's fixed-period jobs before they became `@LockedCron` /
+ * `@LockedInterval` jobs: an upgraded deployment still has them in Redis, so a starting worker
+ * role removes them (else BullMQ keeps firing a job no handler knows). Each id
+ * comes from its domain's leaf `job-ids.ts`, so this module imports no domain code.
+ */
+export declare const RETIRED_SCHEDULER_IDS: readonly string[];