@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.10

package/dist/models/enablement.controller.js

@@ -0,0 +1,74 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Inject, Patch } from "@nestjs/common";
+import { z } from "zod";
+import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
+import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { ModelEnablement } from "./enablement.js";
+/** `:provider` of a disabled-list route. */
+export const ModelProviderParams = z.object({ provider: z.string().min(1).max(200) });
+export class ModelProviderParamsDto extends createZodDto(ModelProviderParams, "ModelProviderParams") {
+}
+const modelIds = z.array(z.string().min(1).max(200)).max(5000).default([]);
+/**
+ * The body of a disabled-list PATCH: the model ids of the provider to disable and to enable. An id
+ * in neither list keeps its stored state (a page never drops ids it does not show); an id in both
+ * is a 400 `validation_failed`.
+ */
+export const ModelDisabledPatch = z
+    .object({ disable: modelIds, enable: modelIds })
+    .strict()
+    .superRefine((v, ctx) => {
+    const disable = new Set(v.disable);
+    const both = [...new Set(v.enable.filter((m) => disable.has(m)))];
+    if (both.length > 0) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["enable"],
+            message: `A model cannot be both disabled and enabled: ${both.join(", ")}`,
+        });
+    }
+});
+export class ModelDisabledPatchDto extends createZodDto(ModelDisabledPatch, "ModelDisabledPatch") {
+}
+/**
+ * The org's disabled models of one provider (`PATCH /api/v1/orgs/:orgId/models/:provider/disabled`,
+ * spec B §5.3): `org.models.manage`, people only. Disables and enables the ids the body names; the
+ * response lists the org's agents and purposes that now point at a newly disabled model (the
+ * disable is not refused for them).
+ */
+let ModelEnablementController = class ModelEnablementController {
+    enablement;
+    constructor(enablement) {
+        this.enablement = enablement;
+    }
+    async patch(principal, org, params, body) {
+        const p = requireUser(principal);
+        return this.enablement.setOrg(org.orgId, params.provider, body, {
+            accountId: p.account.id,
+            tokenId: patTokenId(p),
+        });
+    }
+};
+__decorate([
+    Patch(":provider/disabled"),
+    OrgAction("org.models.manage"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(ModelProviderParamsDto)),
+    __param(3, ZBody(ModelDisabledPatchDto))
+], ModelEnablementController.prototype, "patch", null);
+ModelEnablementController = __decorate([
+    Controller("api/v1/orgs/:orgId/models"),
+    __param(0, Inject(ModelEnablement))
+], ModelEnablementController);
+export { ModelEnablementController };

package/dist/models/enablement.d.ts

@@ -0,0 +1,101 @@
+import { ExtensionRegistry } from "../extensions/registry.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
+import { CacheService } from "../infra/cache/cache.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OrgLock } from "../orgs/org-lock.js";
+/** The key of a model in a disabled set: `provider\u0000model`. */
+export declare const modelKey: (provider: string, model: string) => string;
+/** An agent whose current version uses a newly disabled model as its main model or fallback. */
+export interface AffectedModelAgent {
+    id: string;
+    name: string;
+    orgId: string;
+}
+/** A purpose mapping targeting a newly disabled model: a deployment default (`orgId` null) or an org override. */
+export interface AffectedModelPurpose {
+    purpose: string;
+    orgId: string | null;
+}
+/** The result of a disabled-list write: what now points at a model it disabled (spec B §5.3). */
+export interface ModelDisableResult {
+    affected: {
+        agents: AffectedModelAgent[];
+        purposes: AffectedModelPurpose[];
+    };
+}
+/**
+ * A change to one layer's disabled list of a provider: ids to disable and ids to enable. An id in
+ * neither list keeps its stored state; an id in both is refused.
+ */
+export interface ModelDisableChange {
+    disable: string[];
+    enable: string[];
+}
+/** The acting person of a write. */
+export interface ModelDisableActor {
+    accountId: string;
+    tokenId?: string | undefined;
+    /** Merged into the audit detail (a write made through the Platform tool). */
+    auditDetail?: Record<string, unknown>;
+}
+/**
+ * Models disabled on two layers (spec B §5.3, table `model_disabled`): the platform's list (the
+ * super admin; such a model is invisible to every org) and each org's (an org admin). Every model a
+ * provider lists is enabled unless a layer disabled it; a row keys on the model id, so it applies to
+ * whichever list the org sees, and an id the list does not contain is kept harmlessly. Disabling
+ * never creates an org config copy.
+ *
+ * The lists are read from PG and cached in Redis (`@Cacheable`, evicted after the commit of each
+ * write), never in process memory. `ProviderRegistry` filters its lists and `resolve` with them;
+ * purposes check their targets with {@link isEnabled}.
+ */
+export declare class ModelEnablement {
+    private readonly kdb;
+    readonly txHost: TransactionHost;
+    readonly cacheService: CacheService;
+    private readonly extensions;
+    private readonly adminLock;
+    private readonly orgLock;
+    constructor(kdb: KernelDb, txHost: TransactionHost, cacheService: CacheService, extensions: Pick<ExtensionRegistry, "list">, adminLock: Pick<SuperAdminLock, "lockAndAuthorize">, orgLock: Pick<OrgLock, "lockAndAuthorize">);
+    private get db();
+    /** One layer's disabled models (keys {@link modelKey}): the platform's (`null`) or the org's own. */
+    disabled(orgId: string | null): Promise<Set<string>>;
+    private disabledKeys;
+    private rowsOf;
+    /**
+     * The extensions `orgId` explicitly turned off: a row of the org's own switch
+     * (`extension_org_configs.enabled = false`, what the org's extension or plugin switch writes when
+     * an org admin turns it off), never a required bootstrap plugin. An extension with no row for the
+     * org is not in the set (it keeps working as before: spec A §8 with B's no-breakage anti-goal).
+     * Read from PG on every call (one small query; the switch has its own writers, nothing to evict).
+     */
+    switchedOff(orgId: string): Promise<Set<string>>;
+    /** Whether neither the platform nor `orgId` disabled the model (the lists only; see the class). */
+    isEnabled(orgId: string, provider: string, model: string): Promise<boolean>;
+    /**
+     * Changes the platform's disabled ids of `provider` by `change` (super admin, re-checked under
+     * the lock): ids in neither list keep their stored state. Returns what now points at a newly
+     * disabled model, across orgs.
+     */
+    setPlatform(provider: string, change: ModelDisableChange, actor: ModelDisableActor): Promise<ModelDisableResult>;
+    /**
+     * Changes the org's disabled ids of `provider` by `change` (`org.models.manage`, re-checked under
+     * the org lock): ids in neither list keep their stored state, so rows for models the org's page
+     * does not show (platform-disabled, or no longer listed) survive. Returns what in the org now
+     * points at a newly disabled model (its agents, its overrides and the deployment defaults it uses).
+     */
+    setOrg(orgId: string, provider: string, change: ModelDisableChange, actor: ModelDisableActor): Promise<ModelDisableResult>;
+    private apply;
+    /** Live agents (of `orgId`, or of every org) whose current version uses one of `models`. */
+    private agentsUsing;
+    /**
+     * Purpose mappings targeting one of `models`: for the platform every default and override, for
+     * an org its overrides and the deployment defaults (an org that disabled a default's model has
+     * that purpose unconfigured).
+     */
+    private purposesUsing;
+}
+/** The one {@link ModelEnablement}: the provider registry, purposes and the controllers read it. */
+export declare class ModelEnablementModule {
+}

package/dist/models/enablement.js

@@ -0,0 +1,264 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable, Module } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { ExtensionRegistry, ExtensionRegistryModule } from "../extensions/registry.js";
+import { audit } from "../identity/audit.js";
+import { SuperAdminLock, SuperAdminLockModule } from "../identity/super-admin.js";
+import { CacheService } from "../infra/cache/cache.service.js";
+import { Cacheable, CacheEvict } from "../infra/cache/cacheable.decorator.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OrgLock, OrgLockModule } from "../orgs/org-lock.js";
+/** The key of a model in a disabled set: `provider\u0000model`. */
+export const modelKey = (provider, model) => `${provider}\u0000${model}`;
+/** How long a disabled list stays cached (s); every write evicts it after its commit. */
+const DISABLED_TTL_SECONDS = 300;
+/** The cache key of a scope's disabled list (`platform` or `org.<id>`). */
+const PLATFORM_SCOPE = "platform";
+const orgScope = (orgId) => `org.${orgId}`;
+/**
+ * Models disabled on two layers (spec B §5.3, table `model_disabled`): the platform's list (the
+ * super admin; such a model is invisible to every org) and each org's (an org admin). Every model a
+ * provider lists is enabled unless a layer disabled it; a row keys on the model id, so it applies to
+ * whichever list the org sees, and an id the list does not contain is kept harmlessly. Disabling
+ * never creates an org config copy.
+ *
+ * The lists are read from PG and cached in Redis (`@Cacheable`, evicted after the commit of each
+ * write), never in process memory. `ProviderRegistry` filters its lists and `resolve` with them;
+ * purposes check their targets with {@link isEnabled}.
+ */
+let ModelEnablement = class ModelEnablement {
+    kdb;
+    txHost;
+    cacheService;
+    extensions;
+    adminLock;
+    orgLock;
+    constructor(kdb, txHost, cacheService, extensions, adminLock, orgLock) {
+        this.kdb = kdb;
+        this.txHost = txHost;
+        this.cacheService = cacheService;
+        this.extensions = extensions;
+        this.adminLock = adminLock;
+        this.orgLock = orgLock;
+    }
+    get db() {
+        return this.kdb.db;
+    }
+    /** One layer's disabled models (keys {@link modelKey}): the platform's (`null`) or the org's own. */
+    async disabled(orgId) {
+        return new Set(await this.disabledKeys(orgId === null ? PLATFORM_SCOPE : orgScope(orgId)));
+    }
+    async disabledKeys(scope) {
+        const orgId = scope === PLATFORM_SCOPE ? null : scope.slice("org.".length);
+        const rows = await this.rowsOf(orgId);
+        return rows.map((r) => modelKey(r.provider, r.model)).sort();
+    }
+    rowsOf(orgId, provider) {
+        let q = this.db
+            .selectFrom("model_disabled")
+            .select(["provider", "model"])
+            .where((eb) => (orgId === null ? eb("org_id", "is", null) : eb("org_id", "=", orgId)));
+        if (provider !== undefined)
+            q = q.where("provider", "=", provider);
+        return q.execute();
+    }
+    /**
+     * The extensions `orgId` explicitly turned off: a row of the org's own switch
+     * (`extension_org_configs.enabled = false`, what the org's extension or plugin switch writes when
+     * an org admin turns it off), never a required bootstrap plugin. An extension with no row for the
+     * org is not in the set (it keeps working as before: spec A §8 with B's no-breakage anti-goal).
+     * Read from PG on every call (one small query; the switch has its own writers, nothing to evict).
+     */
+    async switchedOff(orgId) {
+        const rows = await this.db
+            .selectFrom("extension_org_configs as eoc")
+            .leftJoin("extension_installs as ri", (j) => j.onRef("ri.name", "=", "eoc.plugin").on("ri.required", "=", true))
+            .select("eoc.plugin")
+            .where("eoc.org_id", "=", orgId)
+            .where("eoc.enabled", "=", false)
+            .where("ri.name", "is", null)
+            .execute();
+        return new Set(rows.map((r) => r.plugin));
+    }
+    /** Whether neither the platform nor `orgId` disabled the model (the lists only; see the class). */
+    async isEnabled(orgId, provider, model) {
+        const key = modelKey(provider, model);
+        const [platform, org] = await Promise.all([this.disabled(null), this.disabled(orgId)]);
+        return !platform.has(key) && !org.has(key);
+    }
+    /**
+     * Changes the platform's disabled ids of `provider` by `change` (super admin, re-checked under
+     * the lock): ids in neither list keep their stored state. Returns what now points at a newly
+     * disabled model, across orgs.
+     */
+    async setPlatform(provider, change, actor) {
+        await this.adminLock.lockAndAuthorize(actor.accountId);
+        return this.apply(null, provider, change, actor);
+    }
+    /**
+     * Changes the org's disabled ids of `provider` by `change` (`org.models.manage`, re-checked under
+     * the org lock): ids in neither list keep their stored state, so rows for models the org's page
+     * does not show (platform-disabled, or no longer listed) survive. Returns what in the org now
+     * points at a newly disabled model (its agents, its overrides and the deployment defaults it uses).
+     */
+    async setOrg(orgId, provider, change, actor) {
+        await this.orgLock.lockAndAuthorize(orgId, actor.accountId, "org.models.manage");
+        return this.apply(orgId, provider, change, actor);
+    }
+    async apply(orgId, provider, change, actor) {
+        if (!this.extensions.list("model-provider").some((e) => e.plugin === provider)) {
+            throw new ApiError("model.provider_not_found", `Model provider ${provider} is not installed`);
+        }
+        const disable = new Set(change.disable);
+        const both = change.enable.filter((m) => disable.has(m));
+        if (both.length > 0) {
+            throw new ApiError("validation_failed", `A model cannot be both disabled and enabled: ${[...new Set(both)].join(", ")}`);
+        }
+        const had = new Set((await this.rowsOf(orgId, provider)).map((r) => r.model));
+        const added = [...disable].filter((m) => !had.has(m)).sort();
+        const removed = [...new Set(change.enable)].filter((m) => had.has(m)).sort();
+        if (removed.length > 0) {
+            await this.db
+                .deleteFrom("model_disabled")
+                .where((eb) => (orgId === null ? eb("org_id", "is", null) : eb("org_id", "=", orgId)))
+                .where("provider", "=", provider)
+                .where("model", "in", removed)
+                .execute();
+        }
+        if (added.length > 0) {
+            await this.db
+                .insertInto("model_disabled")
+                .values(added.map((model) => ({
+                org_id: orgId,
+                provider,
+                model,
+                disabled_by: actor.accountId,
+            })))
+                .execute();
+        }
+        if (added.length > 0 || removed.length > 0) {
+            await audit(this.db, {
+                actorAccountId: actor.accountId,
+                ...(actor.tokenId !== undefined && { actorTokenId: actor.tokenId }),
+                ...(orgId !== null && { orgId }),
+                action: orgId === null ? "model.disabled_set" : "org.model_disabled_set",
+                target: provider,
+                detail: {
+                    scope: orgId === null ? "platform" : "org",
+                    disabled: added,
+                    enabled: removed,
+                    ...actor.auditDetail,
+                },
+            });
+        }
+        return {
+            affected: {
+                agents: await this.agentsUsing(orgId, provider, added),
+                purposes: await this.purposesUsing(orgId, provider, added),
+            },
+        };
+    }
+    /** Live agents (of `orgId`, or of every org) whose current version uses one of `models`. */
+    async agentsUsing(orgId, provider, models) {
+        if (models.length === 0)
+            return [];
+        const wanted = new Set(models);
+        let q = this.db
+            .selectFrom("agents as a")
+            .innerJoin("agent_versions as v", (j) => j.onRef("v.agent_id", "=", "a.id").onRef("v.version", "=", "a.current_version"))
+            .select(["a.id", "a.org_id", "v.definition"])
+            .where("a.deleted_at", "is", null)
+            .orderBy("a.org_id")
+            .orderBy("a.id");
+        if (orgId !== null)
+            q = q.where("a.org_id", "=", orgId);
+        const out = [];
+        for (const r of await q.execute()) {
+            const def = r.definition;
+            const uses = [def?.model, def?.fallback].some((x) => {
+                const ref = x;
+                return ref?.provider === provider && typeof ref.model === "string" && wanted.has(ref.model);
+            });
+            if (uses) {
+                out.push({
+                    id: r.id,
+                    name: typeof def?.name === "string" ? def.name : r.id,
+                    orgId: r.org_id,
+                });
+            }
+        }
+        return out;
+    }
+    /**
+     * Purpose mappings targeting one of `models`: for the platform every default and override, for
+     * an org its overrides and the deployment defaults (an org that disabled a default's model has
+     * that purpose unconfigured).
+     */
+    async purposesUsing(orgId, provider, models) {
+        if (models.length === 0)
+            return [];
+        let q = this.db
+            .selectFrom("model_purpose_mappings")
+            .select(["purpose", "org_id"])
+            .where("provider", "=", provider)
+            .where("model", "in", models)
+            .orderBy("purpose")
+            .orderBy("org_id", (ob) => ob.nullsFirst());
+        if (orgId === null) {
+            return (await q.execute()).map((r) => ({ purpose: r.purpose, orgId: r.org_id }));
+        }
+        q = q.where((eb) => eb.or([eb("org_id", "is", null), eb("org_id", "=", orgId)]));
+        const rows = await q.execute();
+        // a default the org overrides is not what the org uses
+        const overridden = new Set((await this.db
+            .selectFrom("model_purpose_mappings")
+            .select("purpose")
+            .where("org_id", "=", orgId)
+            .execute()).map((r) => r.purpose));
+        return rows
+            .filter((r) => r.org_id !== null || !overridden.has(r.purpose))
+            .map((r) => ({ purpose: r.purpose, orgId: r.org_id }));
+    }
+};
+__decorate([
+    Cacheable({ key: "capk:model-disabled:#{0}", ttl: DISABLED_TTL_SECONDS })
+], ModelEnablement.prototype, "disabledKeys", null);
+__decorate([
+    Transactional(),
+    CacheEvict({ key: `capk:model-disabled:${PLATFORM_SCOPE}` })
+], ModelEnablement.prototype, "setPlatform", null);
+__decorate([
+    Transactional(),
+    CacheEvict({ key: "capk:model-disabled:org.#{0}" })
+], ModelEnablement.prototype, "setOrg", null);
+ModelEnablement = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(CacheService)),
+    __param(3, Inject(ExtensionRegistry)),
+    __param(4, Inject(SuperAdminLock)),
+    __param(5, Inject(OrgLock))
+], ModelEnablement);
+export { ModelEnablement };
+/** The one {@link ModelEnablement}: the provider registry, purposes and the controllers read it. */
+let ModelEnablementModule = class ModelEnablementModule {
+};
+ModelEnablementModule = __decorate([
+    Module({
+        imports: [ExtensionRegistryModule, SuperAdminLockModule, OrgLockModule],
+        providers: [ModelEnablement],
+        exports: [ModelEnablement],
+    })
+], ModelEnablementModule);
+export { ModelEnablementModule };

package/dist/models/models.module.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Model prices, model purposes, the model disabled lists and the `ctx.models` embeddings broker.
+ * Below the extension host (the host injects {@link ModelEmbeddings} for `ctx.models`): it must not
+ * import `ExtensionsModule`.
+ */
+export declare class ModelsModule {
+}

package/dist/models/models.module.js

@@ -0,0 +1,36 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { ExtensionRegistryModule } from "../extensions/registry.js";
+import { IdentityModule } from "../identity/identity.module.js";
+import { OrgLockModule } from "../orgs/org-lock.js";
+import { ProvidersModule } from "../runtime/providers.js";
+import { ModelEmbeddings } from "./embeddings.js";
+import { ModelEnablementModule } from "./enablement.js";
+import { PricesService } from "./prices.js";
+import { ModelPurposesService } from "./purposes.js";
+/**
+ * Model prices, model purposes, the model disabled lists and the `ctx.models` embeddings broker.
+ * Below the extension host (the host injects {@link ModelEmbeddings} for `ctx.models`): it must not
+ * import `ExtensionsModule`.
+ */
+let ModelsModule = class ModelsModule {
+};
+ModelsModule = __decorate([
+    Module({
+        imports: [
+            ExtensionRegistryModule,
+            IdentityModule,
+            OrgLockModule,
+            ProvidersModule,
+            ModelEnablementModule,
+        ],
+        providers: [PricesService, ModelPurposesService, ModelEmbeddings],
+        exports: [PricesService, ModelPurposesService, ModelEnablementModule, ModelEmbeddings],
+    })
+], ModelsModule);
+export { ModelsModule };

package/dist/models/org-models.schemas.d.ts

@@ -0,0 +1,8 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** `:purpose` as the org purpose route takes it (`@Param`). */
+export declare const ModelPurposePathParams: z.ZodObject<{
+    purpose: z.ZodString;
+}, z.core.$strip>;
+/** The org's model routes (the admin console's are the platform-admin domain's). */
+export declare const ORG_MODEL_ROUTES: readonly RouteSchemas[];

package/dist/models/org-models.schemas.js

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { ModelsQuery } from "../agents/models.controller.js";
+import { ModelDisabledPatch, ModelProviderParams } from "./enablement.controller.js";
+import { PURPOSE_PUT } from "./purposes.js";
+/** `:purpose` as the org purpose route takes it (`@Param`). */
+export const ModelPurposePathParams = z.object({ purpose: z.string().min(1) });
+/** The org's model routes (the admin console's are the platform-admin domain's). */
+export const ORG_MODEL_ROUTES = [
+    { route: "GET /api/v1/orgs/:orgId/models", query: ModelsQuery },
+    { route: "GET /api/v1/orgs/:orgId/models/catalog" },
+    { route: "GET /api/v1/orgs/:orgId/model-purposes" },
+    {
+        route: "PUT /api/v1/orgs/:orgId/model-purposes/:purpose",
+        params: ModelPurposePathParams,
+        body: PURPOSE_PUT,
+    },
+    {
+        route: "PATCH /api/v1/orgs/:orgId/models/:provider/disabled",
+        params: ModelProviderParams,
+        body: ModelDisabledPatch,
+    },
+];

package/dist/models/prices.d.ts

@@ -1,8 +1,10 @@
 import type { ModelUsage } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
-import type { KernelDb } from "../db/kernel-schema.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
 /**
- * 一个模型的价格（C2）：每百万 token，币种为部署设置 `priceCurrency`。由企业管理员录入，插件不声明价格。
+ * 一个模型的价格（C2）：每百万 token，币种为部署设置 `priceCurrency`。由超级管理员录入，插件不声明价格。
  * 缓存读 / 写价为 null 时按输入价计。
  */
 export interface ModelPrice {
@@ -36,18 +38,24 @@ export type ModelPricePut = z.infer<typeof MODEL_PRICE_PUT>;
 /** 模型价格（PG `model_prices`）：每次读都查库，不在进程内缓存（多副本下改价立刻生效）。 */
 export declare class PricesService {
     private readonly db;
-    constructor(db: KernelDb);
+    readonly txHost: TransactionHost;
+    private readonly adminLock;
+    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock);
     /** 全部价格，按 provider、model 排序。 */
     list(): Promise<ModelPrice[]>;
     /** 价格表（按 {@link priceKey} 查）。 */
     table(): Promise<PriceTable>;
     /**
-     * 设置或删除（`price: null`）一个模型的价格：事务内取企业管理员锁并复核发起人仍是活跃企业管理员
+     * 设置或删除（`price: null`）一个模型的价格：事务内取超级管理员锁并复核发起人仍是活跃超级管理员
      * （否则 `forbidden`），写审计 `model_price.updated` / `model_price.deleted`。
      */
     put(input: ModelPrice | {
         provider: string;
         model: string;
         price: null;
-    }, actorAccountId: string, actorTokenId?: string): Promise<void>;
+    }, actorAccountId: string, actorTokenId?: string, 
+    /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail?: Record<string, unknown>): Promise<void>;
+    /** The write of {@link put}, under the super admin lock. */
+    private write;
 }