@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.2

package/dist/log-loki.js

@@ -0,0 +1,145 @@
+const PUSH_PATH = "/loki/api/v1/push";
+const PUSH_TIMEOUT_MS = 10_000;
+/** A batch is pushed right away once it reaches this many records. */
+const BATCH_SIZE = 1_000;
+const ERROR_NOTE_INTERVAL_MS = 60_000;
+function pushUrl(url) {
+    const u = new URL(url);
+    if (!u.pathname.endsWith(PUSH_PATH))
+        u.pathname = `${u.pathname.replace(/\/+$/, "")}${PUSH_PATH}`;
+    return u;
+}
+/**
+ * Batches JSON log lines and POSTs them to Loki's push API (JSON body), one stream per level with
+ * the labels `{ job: "capybara", ...labels, role, level }`. Pushing never blocks or throws into the
+ * caller: a failed push drops its batch and is reported to `onError` at most once per minute; while
+ * Loki is down at most `maxBuffer` records are kept. The interval timer is unref'd.
+ */
+export function createLokiStream(opts) {
+    const url = pushUrl(opts.url);
+    const intervalMs = opts.intervalMs ?? 2_000;
+    const maxBuffer = opts.maxBuffer ?? 10_000;
+    const now = opts.now ?? Date.now;
+    const onError = opts.onError ?? ((m) => void process.stderr.write(`capybara: ${m}\n`));
+    // the marker keeps these pushes out of HTTP client traces (apps/capybara tracing.ts)
+    const headers = {
+        "content-type": "application/json",
+        "x-capybara-log-push": "1",
+    };
+    if (opts.username !== undefined || opts.password !== undefined) {
+        const token = Buffer.from(`${opts.username ?? ""}:${opts.password ?? ""}`).toString("base64");
+        headers.authorization = `Basic ${token}`;
+    }
+    const baseLabels = { job: "capybara", ...opts.labels, role: opts.role };
+    let buffer = [];
+    let dropped = 0;
+    let inFlight;
+    let timer;
+    let lastNote = Number.NEGATIVE_INFINITY;
+    let closed = false;
+    /** Reports at most once a minute; `message` names the Loki origin only (a URL may carry credentials). */
+    const report = (message) => {
+        const t = now();
+        if (t - lastNote < ERROR_NOTE_INTERVAL_MS)
+            return;
+        lastNote = t;
+        onError(`${message}; further Loki errors are not reported for a minute`);
+    };
+    const note = (reason) => report(`cannot push logs to Loki at ${url.origin} (${reason}); records are dropped until it recovers`);
+    const pushBatch = async (batch, lost) => {
+        const streams = new Map();
+        for (const e of batch) {
+            const values = streams.get(e.level) ?? [];
+            values.push([e.ns, e.line]);
+            streams.set(e.level, values);
+        }
+        const body = JSON.stringify({
+            streams: [...streams].map(([level, values]) => ({
+                stream: { ...baseLabels, level },
+                values,
+            })),
+        });
+        try {
+            const res = await fetch(url, {
+                method: "POST",
+                headers,
+                body,
+                signal: AbortSignal.timeout(PUSH_TIMEOUT_MS),
+            });
+            await res.body?.cancel();
+            if (!res.ok)
+                note(`HTTP ${res.status}`);
+            else if (lost > 0) {
+                report(`${lost} log records for Loki at ${url.origin} were dropped: the buffer was full`);
+            }
+        }
+        catch (e) {
+            note(e instanceof Error ? (e.cause instanceof Error ? e.cause.message : e.message) : "error");
+        }
+    };
+    /** Starts a push of the current buffer unless one is in flight. */
+    const kick = () => {
+        if (inFlight || buffer.length === 0)
+            return inFlight ?? Promise.resolve();
+        const batch = buffer;
+        const lost = dropped;
+        buffer = [];
+        dropped = 0;
+        inFlight = pushBatch(batch, lost).finally(() => {
+            inFlight = undefined;
+        });
+        return inFlight;
+    };
+    const ensureTimer = () => {
+        if (timer || closed)
+            return;
+        timer = setInterval(() => void kick(), intervalMs);
+        timer.unref();
+    };
+    return {
+        write(chunk) {
+            for (const line of chunk.split("\n")) {
+                if (line === "")
+                    continue;
+                let level = "info";
+                let ms = Date.now();
+                try {
+                    const rec = JSON.parse(line);
+                    if (typeof rec.level === "string")
+                        level = rec.level;
+                    if (typeof rec.time === "string") {
+                        const t = Date.parse(rec.time);
+                        if (!Number.isNaN(t))
+                            ms = t;
+                    }
+                }
+                catch {
+                    // not JSON: push it as is
+                }
+                buffer.push({ level, ns: `${BigInt(ms) * 1000000n}`, line });
+                if (buffer.length > maxBuffer) {
+                    buffer.shift();
+                    dropped++;
+                }
+            }
+            ensureTimer();
+            if (buffer.length >= BATCH_SIZE)
+                void kick();
+        },
+        async flush() {
+            while (inFlight || buffer.length > 0) {
+                if (inFlight)
+                    await inFlight;
+                else
+                    await kick();
+            }
+        },
+        async close() {
+            closed = true;
+            if (timer)
+                clearInterval(timer);
+            timer = undefined;
+            await this.flush();
+        },
+    };
+}

package/dist/log.d.ts

@@ -1,4 +1,5 @@
 import type { Logger } from "@capybara-hq/plugin-sdk";
+import { type LokiOptions } from "./log-loki.js";
 /** 日志级别，按严重程度递增。 */
 export declare const LOG_LEVELS: readonly ["debug", "info", "warn", "error"];
 /** 日志级别。 */
@@ -11,7 +12,7 @@ export interface KernelLogger extends Logger {
     setLevel(level: string): void;
     /**
      * 登记部署方（运维）给的密钥值：内核配置与插件部署级配置里的 secret 字段。此后日志消息与字段里出现这些值都替换为
-     * `[REDACTED]`（顶层的 `ts` / `level` 不打码）。字符串与数字（转成字符串）登记，布尔不登记；
+     * `[REDACTED]`（顶层的 `time` / `level` 不打码）。字符串与数字（转成字符串）登记，布尔不登记；
      * 数组与对象递归展开其中的标量；短于 4 个字符的值不登记（会误伤普通文本）。
      * 数值字段的字符串形式等于已登记值时同样打码。
      */
@@ -27,6 +28,8 @@ export interface KernelLogger extends Logger {
      * 报错说明）之前用。
      */
     redact(text: string): string;
+    /** Waits until buffered records reached every output (Loki); never rejects. Call before exit. */
+    flush(): Promise<void>;
 }
 /**
  * 用与 logger 相同的匹配器打码任意文本（工具结果等不经过日志的内容用）：展开规则同 `addOrgSecrets`
@@ -34,15 +37,43 @@ export interface KernelLogger extends Logger {
  * 不得小于匹配器的分桶前缀长度 4）。没有可用的值时原样返回。
  */
 export declare function createRedactor(values: readonly unknown[], minLength?: number): (s: string) => string;
-/**
- * 创建结构化 JSON logger：每条日志写一行 `{ ts, level, msg, ...fields }`。
- * 字段不能覆盖 ts / level / msg；Error 序列化为 name / message / stack；
- * 经 `addSecrets` 登记的部署方密钥在消息与字段的任何字符串里都被打码；经 `addOrgSecrets` 登记的组织来源密钥
- * 只在字段里打码，不动顶层 msg；顶层 ts / level 从不打码。
- * `opts.orgSecretCapacity` 为组织来源密钥集合的容量（测试用）；`opts.onMatcherBuild` 在每次重建匹配器时调用（测试用）。
- */
-export declare function createLogger(level?: string, opts?: {
+/** Console format: `pretty` (pino-pretty, one line per record), `json`, or `auto` (pretty on a TTY). */
+export declare const LOG_FORMATS: readonly ["auto", "pretty", "json"];
+/** Console format. */
+export type LogFormat = (typeof LOG_FORMATS)[number];
+/** A minimal writable the console output goes to (`process.stdout` by default). */
+export interface LogOutput {
+    write(chunk: string): unknown;
+}
+/** Options of {@link createLogger}. */
+export interface LoggerOptions {
+    /**
+     * Receives every record as one JSON line (no trailing newline) instead of the console; the
+     * console format is ignored. Used by tests and embedders that collect records themselves.
+     */
     write?: (line: string) => void;
+    /** Console format; default `auto`. */
+    format?: LogFormat;
+    /** Console stream; default `process.stdout`. */
+    out?: LogOutput;
+    /** Whether the console is a terminal (picks `auto` and colors); default `process.stdout.isTTY`. */
+    isTTY?: boolean;
+    /** Also push every record to Loki. */
+    loki?: LokiOptions;
+    /** Fields on every record (e.g. `role`); log calls cannot overwrite them. */
+    base?: Record<string, string>;
+    /** Capacity of the org secret set (tests). */
     orgSecretCapacity?: number;
+    /** Called on every matcher rebuild (tests). */
     onMatcherBuild?: () => void;
-}): KernelLogger;
+}
+/**
+ * Creates the kernel logger on pino. Each record is `{ time, level, msg, ...base, ...fields }` with
+ * `level` the label and `time` ISO 8601; fields cannot overwrite time / level / msg or the base
+ * fields; an Error becomes name / message / stack (and cause). Redaction happens before pino, so
+ * every output sees the same redacted record: deployment secrets (`addSecrets`) in msg and every
+ * field string, org secrets (`addOrgSecrets`) in fields only; level and time are never redacted.
+ * The console gets pino-pretty or JSON lines per `opts.format`; `opts.write` replaces the console
+ * with a JSON line sink.
+ */
+export declare function createLogger(level?: string, opts?: LoggerOptions): KernelLogger;

package/dist/log.js

@@ -1,9 +1,13 @@
+import { pino } from "pino";
+import { prettyFactory } from "pino-pretty";
 import { secretScalars } from "./config/fields.js";
+import { logContext } from "./log-context.js";
+import { createLokiStream } from "./log-loki.js";
 /** 日志级别，按严重程度递增。 */
 export const LOG_LEVELS = ["debug", "info", "warn", "error"];
 const LEVELS = LOG_LEVELS;
 const REDACTED = "[REDACTED]";
-const RESERVED = new Set(["ts", "level", "msg"]);
+const RESERVED = new Set(["time", "level", "msg"]);
 /** 部署方密钥的最短登记长度：过短的值打码会误伤普通文本。 */
 const MIN_SECRET_LEN = 4;
 /** 组织来源密钥的最短登记长度。 */
@@ -101,16 +105,64 @@ function expandSecret(value) {
     }
     return out;
 }
+/** Console format: `pretty` (pino-pretty, one line per record), `json`, or `auto` (pretty on a TTY). */
+export const LOG_FORMATS = ["auto", "pretty", "json"];
+/** Fields shown in the pretty prefix instead of the trailing object, in this order. */
+const PREFIX_FIELDS = ["reqId", "traceId", "jobId", "runId", "plugin"];
+/** pino-pretty's message format: `[role] [reqId=…] [plugin=…] msg`, each part only when present. */
+function prettyMessage(log, messageKey) {
+    const parts = [];
+    if (typeof log.role === "string")
+        parts.push(`[${log.role}]`);
+    for (const k of PREFIX_FIELDS) {
+        const v = log[k];
+        if (typeof v === "string" || typeof v === "number")
+            parts.push(`[${k}=${v}]`);
+    }
+    parts.push(String(log[messageKey] ?? ""));
+    return parts.join(" ");
+}
+function consoleStream(opts) {
+    if (opts.write) {
+        const write = opts.write;
+        // pino hands each record as one string ending in "\n"
+        return { write: (s) => write(s.endsWith("\n") ? s.slice(0, -1) : s) };
+    }
+    const format = opts.format ?? "auto";
+    if (!LOG_FORMATS.includes(format)) {
+        throw new Error(`invalid log.format "${format}" (expected ${LOG_FORMATS.join(", ")})`);
+    }
+    const out = opts.out ?? process.stdout;
+    const isTTY = opts.isTTY ?? process.stdout.isTTY === true;
+    const pretty = format === "pretty" || (format === "auto" && isTTY);
+    if (!pretty)
+        return { write: (s) => out.write(s) };
+    // In process (no worker thread): pino-pretty formats each line synchronously.
+    const format_ = prettyFactory({
+        colorize: isTTY,
+        colorizeObjects: isTTY,
+        singleLine: true,
+        // errors stay inside the one-line object instead of a multi-line stack block
+        errorLikeObjectKeys: [],
+        translateTime: "SYS:HH:MM:ss.l",
+        ignore: ["pid", "hostname", "role", "spanId", ...PREFIX_FIELDS].join(","),
+        messageFormat: (log, messageKey) => prettyMessage(log, messageKey),
+    });
+    return { write: (s) => out.write(format_(s)) };
+}
 /**
- * 创建结构化 JSON logger：每条日志写一行 `{ ts, level, msg, ...fields }`。
- * 字段不能覆盖 ts / level / msg；Error 序列化为 name / message / stack；
- * 经 `addSecrets` 登记的部署方密钥在消息与字段的任何字符串里都被打码；经 `addOrgSecrets` 登记的组织来源密钥
- * 只在字段里打码，不动顶层 msg；顶层 ts / level 从不打码。
- * `opts.orgSecretCapacity` 为组织来源密钥集合的容量（测试用）；`opts.onMatcherBuild` 在每次重建匹配器时调用（测试用）。
+ * Creates the kernel logger on pino. Each record is `{ time, level, msg, ...base, ...fields }` with
+ * `level` the label and `time` ISO 8601; fields cannot overwrite time / level / msg or the base
+ * fields; an Error becomes name / message / stack (and cause). Redaction happens before pino, so
+ * every output sees the same redacted record: deployment secrets (`addSecrets`) in msg and every
+ * field string, org secrets (`addOrgSecrets`) in fields only; level and time are never redacted.
+ * The console gets pino-pretty or JSON lines per `opts.format`; `opts.write` replaces the console
+ * with a JSON line sink.
  */
 export function createLogger(level = "info", opts = {}) {
     let current = parseLevel(level);
-    const write = opts.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const base = opts.base ?? {};
+    const reserved = new Set([...RESERVED, ...Object.keys(base)]);
     const orgCapacity = opts.orgSecretCapacity ?? ORG_SECRET_CAPACITY;
     /** 部署方密钥（数量由配置决定，不淘汰）。 */
     const secrets = new Set();
@@ -136,12 +188,10 @@ export function createLogger(level = "info", opts = {}) {
         return deployMatcher(s);
     };
     const isSecret = (v) => secrets.has(v) || orgSecrets.has(v);
+    /** Redacts and serializes the fields to JSON (errors expanded, cycles cut). */
     const serialize = (entry) => {
         const seen = new WeakSet();
-        return JSON.stringify(entry, function (key, value) {
-            if (this === entry && RESERVED.has(key)) {
-                return key === "msg" && typeof value === "string" ? redactMsg(value) : value;
-            }
+        return JSON.stringify(entry, (_key, value) => {
             if (typeof value === "string")
                 return redact(value);
             if ((typeof value === "number" || typeof value === "bigint") && isSecret(String(value))) {
@@ -167,21 +217,42 @@ export function createLogger(level = "info", opts = {}) {
             return value;
         });
     };
+    const loki = opts.loki ? createLokiStream(opts.loki) : undefined;
+    const sink = pino({
+        level: "debug",
+        base,
+        messageKey: "msg",
+        timestamp: pino.stdTimeFunctions.isoTime,
+        formatters: { level: (label) => ({ level: label }) },
+        // request / job / trace fields of the current async context (log-context.ts)
+        mixin: () => ({ ...logContext() }),
+        // fields arrive already serialized: no pino serializers, no depth or size limits
+        serializers: { err: (e) => e },
+        depthLimit: Number.MAX_SAFE_INTEGER,
+        edgeLimit: Number.MAX_SAFE_INTEGER,
+    }, 
+    // level filtering is ours (setLevel); every stream takes everything that got this far
+    loki
+        ? pino.multistream([
+            { level: "debug", stream: consoleStream(opts) },
+            { level: "debug", stream: loki },
+        ])
+        : consoleStream(opts));
     const emit = (lvl, msg, fields) => {
         if (LEVELS.indexOf(lvl) < LEVELS.indexOf(current))
             return;
-        const entry = { ts: new Date().toISOString(), level: lvl, msg };
+        const entry = {};
         for (const [k, v] of Object.entries(fields ?? {}))
-            if (!RESERVED.has(k))
+            if (!reserved.has(k))
                 entry[k] = v;
-        let line;
+        let obj;
         try {
-            line = serialize(entry);
+            obj = JSON.parse(serialize(entry));
         }
         catch {
-            line = serialize({ ts: entry.ts, level: lvl, msg, logError: "unserializable fields" });
+            obj = { logError: "unserializable fields" };
         }
-        write(line);
+        sink[lvl](obj, redactMsg(msg));
     };
     return {
         debug: (msg, fields) => emit("debug", msg, fields),
@@ -192,6 +263,9 @@ export function createLogger(level = "info", opts = {}) {
             return current;
         },
         redact: (text) => redact(text),
+        flush: async () => {
+            await loki?.flush();
+        },
         setLevel(l) {
             current = parseLevel(l);
         },

package/dist/models/models.module.d.ts

@@ -0,0 +1,3 @@
+/** Model prices and model purposes. */
+export declare class ModelsModule {
+}

package/dist/models/models.module.js

@@ -0,0 +1,24 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { ExtensionRegistryModule } from "../extensions/registry.js";
+import { IdentityModule } from "../identity/identity.module.js";
+import { OrgLockModule } from "../orgs/org-lock.js";
+import { ProvidersModule } from "../runtime/providers.js";
+import { PricesService } from "./prices.js";
+import { ModelPurposesService } from "./purposes.js";
+/** Model prices and model purposes. */
+let ModelsModule = class ModelsModule {
+};
+ModelsModule = __decorate([
+    Module({
+        imports: [ExtensionRegistryModule, IdentityModule, OrgLockModule, ProvidersModule],
+        providers: [PricesService, ModelPurposesService],
+        exports: [PricesService, ModelPurposesService],
+    })
+], ModelsModule);
+export { ModelsModule };

package/dist/models/prices.d.ts

@@ -1,6 +1,8 @@
 import type { ModelUsage } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
-import type { KernelDb } from "../db/kernel-schema.js";
+import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
 /**
  * 一个模型的价格（C2）：每百万 token，币种为部署设置 `priceCurrency`。由企业管理员录入，插件不声明价格。
  * 缓存读 / 写价为 null 时按输入价计。
@@ -36,7 +38,9 @@ export type ModelPricePut = z.infer<typeof MODEL_PRICE_PUT>;
 /** 模型价格（PG `model_prices`）：每次读都查库，不在进程内缓存（多副本下改价立刻生效）。 */
 export declare class PricesService {
     private readonly db;
-    constructor(db: KernelDb);
+    readonly txHost: TransactionHost;
+    private readonly adminLock;
+    constructor(db: KernelDb, txHost: TransactionHost, adminLock: EnterpriseAdminLock);
     /** 全部价格，按 provider、model 排序。 */
     list(): Promise<ModelPrice[]>;
     /** 价格表（按 {@link priceKey} 查）。 */
@@ -50,4 +54,6 @@ export declare class PricesService {
         model: string;
         price: null;
     }, actorAccountId: string, actorTokenId?: string): Promise<void>;
+    /** The write of {@link put}, under the enterprise admin lock. */
+    private write;
 }

package/dist/models/prices.js

@@ -1,7 +1,20 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { lockEnterpriseAdminsAndAuthorize } from "../identity/enterprise-admin.js";
+import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
 /** 价格表的键。供应商名与模型 id 不含换行，拼接不会撞键。 */
 export const priceKey = (provider, model) => `${provider}\n${model}`;
 /** 一次调用的估算成本；没有价格 → null。用量的四项互不重叠（见 plugin-sdk `ModelUsage`）。 */
@@ -36,10 +49,14 @@ export const MODEL_PRICE_PUT = z.union([
 const num = (v) => Number(v);
 const numOrNull = (v) => (v === null ? null : Number(v));
 /** 模型价格（PG `model_prices`）：每次读都查库，不在进程内缓存（多副本下改价立刻生效）。 */
-export class PricesService {
+let PricesService = class PricesService {
     db;
-    constructor(db) {
+    txHost;
+    adminLock;
+    constructor(db, txHost, adminLock) {
         this.db = db;
+        this.txHost = txHost;
+        this.adminLock = adminLock;
     }
     /** 全部价格，按 provider、model 排序。 */
     async list() {
@@ -78,44 +95,55 @@ export class PricesService {
         if (!check.success) {
             throw new ApiError("validation_failed", "Invalid model price", check.error.issues.map((i) => ({ path: i.path.join("."), message: i.message })));
         }
-        const v = check.data;
-        await this.db.transaction().execute(async (trx) => {
-            await lockEnterpriseAdminsAndAuthorize(trx, actorAccountId);
-            const target = `${v.provider}/${v.model}`;
-            if ("price" in v) {
-                await trx
-                    .deleteFrom("model_prices")
-                    .where("provider", "=", v.provider)
-                    .where("model", "=", v.model)
-                    .execute();
-                await audit(trx, {
-                    actorAccountId,
-                    ...(actorTokenId !== undefined && { actorTokenId }),
-                    action: "model_price.deleted",
-                    target,
-                    detail: { provider: v.provider, model: v.model },
-                });
-                return;
-            }
-            const values = {
-                input_per_mtok: v.inputPerMTok,
-                output_per_mtok: v.outputPerMTok,
-                cache_read_per_mtok: v.cacheReadPerMTok,
-                cache_write_per_mtok: v.cacheWritePerMTok,
-                updated_by: actorAccountId,
-            };
-            await trx
-                .insertInto("model_prices")
-                .values({ provider: v.provider, model: v.model, ...values })
-                .onConflict((oc) => oc.columns(["provider", "model"]).doUpdateSet({ ...values, updated_at: new Date() }))
+        await this.write(check.data, actorAccountId, actorTokenId);
+    }
+    /** The write of {@link put}, under the enterprise admin lock. */
+    async write(v, actorAccountId, actorTokenId) {
+        await this.adminLock.lockAndAuthorize(actorAccountId);
+        const target = `${v.provider}/${v.model}`;
+        if ("price" in v) {
+            await this.db
+                .deleteFrom("model_prices")
+                .where("provider", "=", v.provider)
+                .where("model", "=", v.model)
                 .execute();
-            await audit(trx, {
+            await audit(this.db.db, {
                 actorAccountId,
                 ...(actorTokenId !== undefined && { actorTokenId }),
-                action: "model_price.updated",
+                action: "model_price.deleted",
                 target,
-                detail: { ...v },
+                detail: { provider: v.provider, model: v.model },
             });
+            return;
+        }
+        const values = {
+            input_per_mtok: v.inputPerMTok,
+            output_per_mtok: v.outputPerMTok,
+            cache_read_per_mtok: v.cacheReadPerMTok,
+            cache_write_per_mtok: v.cacheWritePerMTok,
+            updated_by: actorAccountId,
+        };
+        await this.db
+            .insertInto("model_prices")
+            .values({ provider: v.provider, model: v.model, ...values })
+            .onConflict((oc) => oc.columns(["provider", "model"]).doUpdateSet({ ...values, updated_at: new Date() }))
+            .execute();
+        await audit(this.db.db, {
+            actorAccountId,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            action: "model_price.updated",
+            target,
+            detail: { ...v },
         });
     }
-}
+};
+__decorate([
+    Transactional()
+], PricesService.prototype, "write", null);
+PricesService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(EnterpriseAdminLock))
+], PricesService);
+export { PricesService };

package/dist/models/purposes.controller.d.ts

@@ -1,6 +1,6 @@
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
-import { type ModelPurposesService, type PurposePut, type PurposeTarget, type PurposeView } from "./purposes.js";
+import { ModelPurposesService, type PurposePut, type PurposeTarget, type PurposeView } from "./purposes.js";
 /** body 的目标（参数缺省为 `{}`）。 */
 export declare const purposeTargetOf: (b: PurposePut) => PurposeTarget | null;
 /**

package/dist/models/purposes.controller.js

@@ -7,12 +7,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Controller, Get, Inject, Param, Put } from "@nestjs/common";
-import { MODEL_PURPOSES } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
+import { Controller, Get, Inject, Param, Put } from "@nestjs/common";
 import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
+import { ZBody } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
-import { PURPOSE_PUT, } from "./purposes.js";
+import { ModelPurposesService, PurposePutDto, } from "./purposes.js";
 /** body 的目标（参数缺省为 `{}`）。 */
 export const purposeTargetOf = (b) => b.target === null ? null : { model: b.target.model, params: b.target.params ?? {} };
 /**
@@ -47,10 +46,10 @@ __decorate([
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
     __param(2, Param("purpose")),
-    __param(3, Body(new ZodPipe(PURPOSE_PUT)))
+    __param(3, ZBody(PurposePutDto))
 ], ModelPurposesController.prototype, "put", null);
 ModelPurposesController = __decorate([
     Controller("api/v1/orgs/:orgId/model-purposes"),
-    __param(0, Inject(MODEL_PURPOSES))
+    __param(0, Inject(ModelPurposesService))
 ], ModelPurposesController);
 export { ModelPurposesController };