@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.10

package/dist/platform/method.js

@@ -0,0 +1,15 @@
+/**
+ * The method of the `Platform` tool (spec §5.2): the rules the root `browse` result carries, after
+ * the domains. Model-visible English; a tool result, never part of the tool definition, so
+ * changing it changes no definition fingerprint.
+ */
+export const PLATFORM_METHOD = [
+    "How to work with the platform:",
+    "1. Read before you write: list or get what you are about to change.",
+    "2. Before a write, tell the person in one sentence what you will do and why; the platform then asks them to confirm.",
+    "3. A declined confirmation means stop; do not retry the same change another way.",
+    "4. An operation you may not call is not a dead end: its reason says who can (an org admin, the super admin) and whether a request operation exists; offer that.",
+    "5. Errors say what to do next; follow them.",
+    '6. When unsure how the platform works, use action "read" for the docs before acting.',
+    'Find an operation with "browse" (a domain) or "search": each lists its input keys in "params" ("?" marks an optional key, an id key takes the id field of the matching list or get result). "describe" gives the types, bounds and an example; describe before a call whose params you are unsure of, and never guess a key that params does not list.',
+].join("\n");

package/dist/platform/operation.d.ts

@@ -0,0 +1,169 @@
+import type { z } from "zod";
+import type { OrgAction } from "../orgs/roles.js";
+import type { ErrorRole } from "./errors.js";
+/**
+ * How an operation is confirmed (spec §6.2): `read` runs; `personal` asks each time and may be
+ * remembered; `org` / `platform` ask each time and are never remembered.
+ */
+export type ConfirmClass = "read" | "personal" | "org" | "platform";
+/** Who may call an operation: the org action of the route it mirrors, or the super admin. */
+export type OperationAuthz = {
+    orgAction: OrgAction;
+} | {
+    superAdmin: true;
+};
+/** What an operation's handler gets besides its input: the actor and where the call happens. */
+export interface OperationContext {
+    orgId: string;
+    /** The run's trigger account (spec §6.1), the principal the handler acts as. */
+    actorAccountId: string;
+    agentId: string;
+    conversationId: string;
+    runId: string | null;
+    /**
+     * The tool call being run (absent at confirmation time): what a result shown only on the web is
+     * keyed by, e.g. the generated password of `accounts.create`, read by the person who approved
+     * that call.
+     */
+    callId?: string;
+    signal: AbortSignal;
+    /**
+     * The actor's role for next steps, from the facts the tool read for this call (spec §14.5
+     * item 7). Absent where no tool call is behind the context (a test running `op.run`): read it
+     * then with `roleFor` in ./ops/unavailable.ts.
+     */
+    errorRole?: ErrorRole;
+}
+/**
+ * The next step after an error: one text, or one per role where the step differs (spec §14.5
+ * item 7). Only the super admin gets the `superAdmin` text (the admin console path); see
+ * `nextStepFor` in ./errors.ts for the fallbacks.
+ */
+export type OperationErrorNext = string | {
+    readonly superAdmin?: string;
+    readonly orgAdmin?: string;
+    readonly member?: string;
+};
+/** A notable error code of an operation and what to do next (model-visible English). */
+export interface OperationError {
+    code: string;
+    next: OperationErrorNext;
+}
+/**
+ * What {@link PlatformOperation.precheck} found: nothing known against the write, or why it fails.
+ * `next` replaces the operation's `errors[]` entry for the code when the step depends on the target
+ * (e.g. the admin console path naming the extension).
+ *
+ * Some codes exist only in the tool, never answered by a route: `marketplace.already_added` (the
+ * `marketplaces.add` duplicate check is tool policy; the web accepts a duplicate source),
+ * `plugin.needs_input` (input only a person enters on the web), `agent.visibility_web_only`,
+ * `catalog.org_owned` (`plugins.set-shown` leaves an org's own plugin to that org), and
+ * `account.self` / `account.no_change` (disabling your own account, a status that is set already).
+ */
+export type PrecheckResult = {
+    ok: true;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+    next?: OperationErrorNext;
+};
+/** How long a precheck may take before the tool skips it (spec §14.2 item 2). */
+export declare const PRECHECK_TIMEOUT_MS = 2000;
+/** One operation of the `Platform` tool (spec §7), defined next to its domain. */
+export interface PlatformOperation<I = unknown> {
+    /** `<domain>.<verb>`, matching {@link OPERATION_ID}; the domain is one of {@link PLATFORM_DOMAINS}. */
+    id: string;
+    /** English, one paragraph; the first sentence is the line `browse` and `search` show. */
+    description: string;
+    /** Every string bounded; `describe` shows its JSON Schema. */
+    input: z.ZodType<I>;
+    example: I;
+    /** The route's authorization, or the role the service enforces (spec §9). */
+    authz: OperationAuthz;
+    /**
+     * `"service-enforced"`: the service enforces a higher role than the mirrored route's decorator,
+     * so `authz` may name a stricter action (`check:platform-ops` requires its role to be at least
+     * the route's).
+     */
+    authzNote?: "service-enforced";
+    /** The HTTP routes it corresponds to, e.g. `POST /api/v1/orgs/:orgId/skills`; [] when synthetic. */
+    mirrors: readonly string[];
+    /**
+     * Fields of the mirrored route (body, query, path params but `:orgId`) the input leaves out, e.g.
+     * `uploadId` of `skills.create` (spec §14.5 item 3; the parity test in `tools/checks` holds it).
+     */
+    omits?: readonly string[];
+    /** Input fields the mirrored route lacks, e.g. `cursor` of a paged list. */
+    extras?: readonly string[];
+    /**
+     * Input fields compared with a route field of another name or path: `{ skillId: "id" }`, a
+     * flattened `{ name: "definition.name" }`. The route field counts as present.
+     */
+    renames?: Readonly<Record<string, string>>;
+    /**
+     * Input fields allowed to accept more than the route (bounds, pattern, required-ness, never the
+     * type), each with its reason, e.g. a confirm value that also takes `nothing-installed`.
+     */
+    loosens?: Readonly<Record<string, string>>;
+    confirm: ConfirmClass;
+    /**
+     * `false`: a confirmation is never remembered, whatever the class (a destructive personal write
+     * such as deleting a conversation). Static; absent: remembered only for the class `personal`.
+     */
+    rememberable?: false;
+    /**
+     * The class of one call when it depends on the target (read at confirmation time): e.g.
+     * `agents.update` is `personal` only on a private agent the actor owns and `org` otherwise, so a
+     * remembered grant never carries over to a shared agent. Only for writes, never returns `read`;
+     * absent: `confirm`. The tool treats a throw as not remembered.
+     */
+    confirmFor?(input: I, ctx: OperationContext): Promise<ConfirmClass>;
+    /**
+     * The notable error codes of the operation and what to do next (model-visible English), shown
+     * by `describe` (spec §3) and appended to an `ApiError` of that code (spec §14.5 item 7). `next`
+     * is keyed by role where the step differs (`check:platform-ops` rule `platform-op-errors`).
+     */
+    errors?: readonly OperationError[];
+    /**
+     * Preconditions read before the card (spec §14.2 item 2): a write known to fail (a taken name, a
+     * stale preview) is denied with this reason and the person is never asked. Reads only; runs
+     * again when an approved call resumes (a failure then returns the error, nothing runs). Bounded
+     * by the tool ({@link PRECHECK_TIMEOUT_MS}); a timeout or a throw skips it, and the write's own
+     * errors speak.
+     */
+    precheck?(input: I, ctx: OperationContext): Promise<PrecheckResult>;
+    /**
+     * The bilingual card summary of a write, rendered from the input and kernel reads (names of
+     * the targets, preview counts), never from model text; required unless `confirm` is `read`.
+     * May read PG; the tool falls back to the operation id when it throws. Method syntax so an
+     * operation of any input type is a `PlatformOperation` (the registry's element type).
+     */
+    summary?(input: I, ctx: OperationContext): {
+        zh: string;
+        en: string;
+    } | Promise<{
+        zh: string;
+        en: string;
+    }>;
+    run(input: I, ctx: OperationContext): Promise<unknown>;
+}
+/** Identity helper that types an operation's handler and summary from its input schema. */
+export declare function defineOperation<I>(op: PlatformOperation<I>): PlatformOperation<I>;
+/** The shape of an operation id: `<domain>.<verb>`, lower case words joined by `-`. */
+export declare const OPERATION_ID: RegExp;
+/** The domain part of an operation id (`skills` of `skills.list`). */
+export declare const operationDomain: (id: string) => string;
+/** The phase 1 domains (spec §7), in the order `browse` lists them; model-visible English. */
+export declare const PLATFORM_DOMAINS: readonly {
+    id: string;
+    description: string;
+}[];
+/**
+ * Something that contributes operations (a domain's provider). Kept as a type only: providers
+ * call `PlatformOperations.register` from their `onModuleInit` (ruling P2), so `PlatformModule`
+ * imports no domain module.
+ */
+export interface OperationProvider {
+    operations(): readonly PlatformOperation[];
+}

package/dist/platform/operation.js

@@ -0,0 +1,90 @@
+/** How long a precheck may take before the tool skips it (spec §14.2 item 2). */
+export const PRECHECK_TIMEOUT_MS = 2000;
+/** Identity helper that types an operation's handler and summary from its input schema. */
+export function defineOperation(op) {
+    return op;
+}
+/** The shape of an operation id: `<domain>.<verb>`, lower case words joined by `-`. */
+export const OPERATION_ID = /^[a-z][a-z-]*\.[a-z][a-z-]*$/;
+/** The domain part of an operation id (`skills` of `skills.list`). */
+export const operationDomain = (id) => id.slice(0, id.indexOf("."));
+/** The phase 1 domains (spec §7), in the order `browse` lists them; model-visible English. */
+export const PLATFORM_DOMAINS = [
+    {
+        id: "platform",
+        description: "What this platform is, its tool families, what you and this agent can do, and your own preferences (time zone).",
+    },
+    { id: "skills", description: "The org's skill library: list, read, create, switch on or off." },
+    {
+        id: "agents",
+        description: "Agents in the org: list, read, create private ones, update or delete those you may edit, their profile (avatar, quick actions), versions, pending connectors, readiness.",
+    },
+    {
+        id: "agent-templates",
+        description: "Agent templates: list, read, save an agent as a template, update, share or delete the org's own.",
+    },
+    {
+        id: "plugins",
+        description: "Plugins in the org and on the platform: list, read, enable, disable, update, scope, import, the org's own uploads.",
+    },
+    {
+        id: "marketplaces",
+        description: "Marketplace sources and their entries: list, browse, add, edit, refresh, remove, import, request a plugin.",
+    },
+    {
+        id: "requests",
+        description: "Requests to admins: list yours, create one; org admins list the members' pending ones; the super admin lists the platform's.",
+    },
+    {
+        id: "connectors",
+        description: "Connectors and connector templates: list and read, refresh tools, delete.",
+    },
+    {
+        id: "extensions",
+        description: "Extensions in the org (state, tool switches, extension point defaults, file previewers) and, for the super admin, on the platform (state, pending permission confirmations, enable, disable, uninstall).",
+    },
+    {
+        id: "conversations",
+        description: "Your own conversations: list, read, rename, archive, delete, read their events, list and stop their background tasks.",
+    },
+    {
+        id: "orgs",
+        description: "This org (read, rename, members) and, for the super admin, every org and its limits.",
+    },
+    {
+        id: "accounts",
+        description: "Platform accounts (super admin): list, read, create, disable, enable.",
+    },
+    {
+        id: "admin",
+        description: "The admin console (super admin): dashboard totals and deployment settings.",
+    },
+    {
+        id: "models",
+        description: "The org's model per purpose, the models available and the ones it switched off; for the super admin, the platform's models: catalog and disabled list, prices, default model per purpose.",
+    },
+    {
+        id: "evals",
+        description: "Eval sets, their cases and runs, results and labels (org admins): replay a candidate model or prompt over real cases.",
+    },
+    {
+        id: "inbox",
+        description: "Your inbox (what waits for you, as summaries; dismiss notices) and, for the super admin, the platform inbox. Deciding is done on the web.",
+    },
+    {
+        id: "approvals",
+        description: "Tool call approvals you can decide: list and read them as summaries, never the call's input. Deciding is done on the web.",
+    },
+    {
+        id: "channels",
+        description: "The org's channel connections (IM bots): list, read without credentials, change the binding, remove.",
+    },
+    {
+        id: "org-settings",
+        description: "The org's settings (tool search, language, sandbox policy, the Platform tool switch): read and change.",
+    },
+    {
+        id: "environments",
+        description: "Your own cloud environments (the workspaces your conversations run in): list, read, create, rename, delete, wipe the files.",
+    },
+];

package/dist/platform/ops/accounts.ops.d.ts

@@ -0,0 +1,32 @@
+import type { Logger } from "@capybara-hq/plugin-sdk";
+import { type OnModuleInit } from "@nestjs/common";
+import { AccountsService } from "../../identity/accounts.js";
+import { InitialPasswords } from "../../identity/initial-passwords.js";
+import { SessionService } from "../../identity/sessions.js";
+import { OrgsService } from "../../orgs/orgs.service.js";
+import { PlatformOperations } from "../registry.js";
+/** What the tool result says instead of the password (model-visible English). */
+export declare const INITIAL_PASSWORD_NOTE = "The kernel generated a one-time initial password. It is shown once, on the web, to the person who approved this call (the approval card in this conversation); it is not available to you, so never ask for it or make one up. If it is not read within 24 hours it is lost: disable the account and create it again. The account must change it at first sign-in.";
+/**
+ * Account operations of the `Platform` tool (spec §14.2, admin console): the super admin lists,
+ * reads, creates, disables and enables accounts, only through their own private agent
+ * (`availability`). Creating takes no password: the kernel generates a one-time one, the account
+ * must change it at first sign-in, and only the approving person sees it, on the web (spec §14.5
+ * item 2); the result, the events, the audit and the logs never carry it. The super-admin flag
+ * stays a human-only change (a role change).
+ */
+export declare class AccountsOperations implements OnModuleInit {
+    private readonly registry;
+    private readonly accounts;
+    private readonly passwords;
+    private readonly sessions;
+    private readonly orgs;
+    private readonly log;
+    constructor(registry: PlatformOperations, accounts: AccountsService, passwords: InitialPasswords, sessions: SessionService, orgs: OrgsService, log: Logger);
+    private account;
+    /** Refuses a status change that cannot or need not run, before the card. */
+    private statusPrecheck;
+    private setStatus;
+    private statusSummary;
+    onModuleInit(): void;
+}

package/dist/platform/ops/accounts.ops.js

@@ -0,0 +1,291 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { z } from "zod";
+import { AccountListQuery, AccountParams, CreateAccountBody } from "../../admin/admin.schemas.js";
+import { ApiError } from "../../errors.js";
+import { AccountsService } from "../../identity/accounts.js";
+import { InitialPasswords } from "../../identity/initial-passwords.js";
+import { SessionService } from "../../identity/sessions.js";
+import { KERNEL_LOGGER } from "../../infra/tokens.js";
+import { OrgsService } from "../../orgs/orgs.service.js";
+import { defineOperation } from "../operation.js";
+import { PlatformOperations } from "../registry.js";
+import { precheckBy, viaAgent } from "./errors.js";
+import { named } from "./summary.js";
+const PAGE = 50;
+const AccountId = AccountParams.shape.accountId.describe("The account id (accounts.list).");
+/** What the tool result says instead of the password (model-visible English). */
+export const INITIAL_PASSWORD_NOTE = "The kernel generated a one-time initial password. It is shown once, on the web, to the person who approved this call (the approval card in this conversation); it is not available to you, so never ask for it or make one up. If it is not read within 24 hours it is lost: disable the account and create it again. The account must change it at first sign-in.";
+/** An account as a detail returns it (the admin console's account fields). */
+const accountView = (a, login) => ({
+    id: a.id,
+    login,
+    displayName: a.displayName,
+    email: a.email,
+    status: a.status,
+    superAdmin: a.isSuperAdmin,
+    mustChangePassword: a.mustChangePassword,
+    createdAt: a.createdAt,
+});
+/** The account's name as a card summary quotes it: display name and login. */
+const quoted = (a, login) => login ? `${named(a.displayName)} (${named(login)})` : named(a.displayName);
+/**
+ * Account operations of the `Platform` tool (spec §14.2, admin console): the super admin lists,
+ * reads, creates, disables and enables accounts, only through their own private agent
+ * (`availability`). Creating takes no password: the kernel generates a one-time one, the account
+ * must change it at first sign-in, and only the approving person sees it, on the web (spec §14.5
+ * item 2); the result, the events, the audit and the logs never carry it. The super-admin flag
+ * stays a human-only change (a role change).
+ */
+let AccountsOperations = class AccountsOperations {
+    registry;
+    accounts;
+    passwords;
+    sessions;
+    orgs;
+    log;
+    constructor(registry, accounts, passwords, sessions, orgs, log) {
+        this.registry = registry;
+        this.accounts = accounts;
+        this.passwords = passwords;
+        this.sessions = sessions;
+        this.orgs = orgs;
+        this.log = log;
+    }
+    async account(id) {
+        const a = await this.accounts.get(id);
+        if (!a)
+            throw new ApiError("account.not_found", "Account not found");
+        return a;
+    }
+    /** Refuses a status change that cannot or need not run, before the card. */
+    async statusPrecheck(accountId, status, ctx) {
+        const r = await precheckBy(() => this.account(accountId));
+        if (!r.ok)
+            return r;
+        const a = await this.account(accountId);
+        if (a.status === status) {
+            return {
+                ok: false,
+                code: "account.no_change",
+                message: `The account is ${status} already`,
+            };
+        }
+        if (status === "disabled" && accountId === ctx.actorAccountId) {
+            return {
+                ok: false,
+                code: "account.self",
+                message: "You cannot disable your own account through your agent",
+            };
+        }
+        if (status === "disabled" &&
+            a.isSuperAdmin &&
+            a.status === "active" &&
+            (await this.accounts.countSuperAdmins()) <= 1) {
+            return {
+                ok: false,
+                code: "account.last_super_admin",
+                message: "This is the last active super admin",
+            };
+        }
+        return { ok: true };
+    }
+    async setStatus(operation, accountId, status, ctx) {
+        const { account, revokedSessionIds } = await this.accounts.updateAccount(accountId, { status }, ctx.actorAccountId, undefined, { auditDetail: viaAgent(operation, ctx) });
+        try {
+            await this.sessions.markRevoked(revokedSessionIds);
+        }
+        catch (err) {
+            // the Redis markers are only the fast path: auth reads PG revoked_at on every request
+            this.log.warn("failed to write session revocation markers after account deactivation", {
+                accountId,
+                err,
+            });
+        }
+        const login = (await this.accounts.localLogins([account.id])).get(account.id) ?? null;
+        return { account: accountView(account, login) };
+    }
+    async statusSummary(accountId, zh, en) {
+        const a = await this.accounts.get(accountId);
+        if (!a)
+            return { zh: `${zh}账号 ${accountId}`, en: `${en} account ${accountId}` };
+        const login = (await this.accounts.localLogins([a.id])).get(a.id);
+        return { zh: `${zh}账号「${quoted(a, login)}」`, en: `${en} account "${quoted(a, login)}"` };
+    }
+    onModuleInit() {
+        this.registry.register([
+            defineOperation({
+                id: "accounts.list",
+                description: "List the platform's accounts (super admin), one compact row each: id, display name, state (active or disabled), login, email and whether it is a super admin. Ordered by id; pages by 50: pass the returned next as params.after. Details come from accounts.get.",
+                input: z
+                    .object({ after: AccountListQuery.shape.after.unwrap().max(100).optional() })
+                    .strict(),
+                example: {},
+                authz: { superAdmin: true },
+                mirrors: ["GET /api/v1/admin/accounts"],
+                // the page size is fixed at 50 (compact rows)
+                omits: ["limit"],
+                confirm: "read",
+                run: async (input) => {
+                    const rows = await this.accounts.list({
+                        limit: PAGE + 1,
+                        ...(input.after !== undefined && { after: input.after }),
+                    });
+                    const page = rows.slice(0, PAGE);
+                    const logins = await this.accounts.localLogins(page.map((a) => a.id));
+                    return {
+                        items: page.map((a) => ({
+                            id: a.id,
+                            name: a.displayName,
+                            state: a.status,
+                            login: logins.get(a.id) ?? null,
+                            email: a.email,
+                            superAdmin: a.isSuperAdmin,
+                        })),
+                        next: rows.length > PAGE ? (page.at(-1)?.id ?? null) : null,
+                    };
+                },
+            }),
+            defineOperation({
+                id: "accounts.get",
+                description: "Read one account (super admin): login, display name, email, state, whether it is a super admin, whether it still has to change a generated initial password, when it was created, and the orgs it belongs to with its role in each.",
+                input: z.object({ accountId: AccountId }).strict(),
+                example: { accountId: "00000000-0000-4000-8000-000000000000" },
+                authz: { superAdmin: true },
+                mirrors: [],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "account.not_found",
+                        next: "Look the account up with accounts.list and pass its id.",
+                    },
+                ],
+                run: async (input) => {
+                    const a = await this.account(input.accountId);
+                    const [logins, orgs] = await Promise.all([
+                        this.accounts.localLogins([a.id]),
+                        this.orgs.listForAccount(a.id),
+                    ]);
+                    return {
+                        account: accountView(a, logins.get(a.id) ?? null),
+                        orgs: orgs.map((o) => ({ id: o.id, name: o.name, slug: o.slug, role: o.role })),
+                    };
+                },
+            }),
+            defineOperation({
+                id: "accounts.create",
+                description: "Create a local sign-in account (super admin): a login (3-64 characters: letters, digits, . _ @ + -), a display name and an optional email. You pass no password: the kernel generates a one-time initial password, shows it once to the person who approves this call, on the web (the approval card); it is lost if not read within 24 hours (then disable the account and create it again). The account must change it at first sign-in. The account is never a super admin; that and org memberships are set by a person on the web (add it to an org with an invitation).",
+                input: CreateAccountBody.pick({ login: true, displayName: true, email: true }).strict(),
+                example: { login: "alice", displayName: "Alice Chen", email: "alice@example.com" },
+                authz: { superAdmin: true },
+                mirrors: ["POST /api/v1/admin/accounts"],
+                // the password is generated by the kernel; the super-admin flag is a role change (human-only)
+                omits: ["password", "superAdmin"],
+                confirm: "platform",
+                errors: [
+                    {
+                        code: "account.login_taken",
+                        next: "Choose another login, or use the existing account (accounts.list).",
+                    },
+                    {
+                        code: "account.create_needs_approval",
+                        next: "Call it from a conversation with your private agent, where you approve the call yourself, or create the account on the web (admin console, Accounts).",
+                    },
+                    {
+                        code: "validation_failed",
+                        next: "Fix the login, display name or email as the message says, then call again.",
+                    },
+                ],
+                precheck: (i) => precheckBy(() => this.accounts.assertLoginFree(i.login)),
+                summary: (i) => ({
+                    zh: `新建账号「${quoted(i, i.login)}」，初始密码由平台生成，批准后仅向你显示一次`,
+                    en: `Create account "${quoted(i, i.login)}"; the platform generates the initial password and shows it once to you after approval`,
+                }),
+                run: async (input, ctx) => {
+                    if (ctx.callId === undefined || ctx.runId === null) {
+                        // the password reaches the approver through the approved call; without one it could
+                        // never be shown, so nothing is created
+                        throw new ApiError("account.create_needs_approval", "accounts.create runs only as a Platform call you approve in a conversation");
+                    }
+                    const account = await this.passwords.createAccount({
+                        login: input.login,
+                        displayName: input.displayName,
+                        ...(input.email !== undefined && { email: input.email }),
+                    }, ctx.actorAccountId, {
+                        conversationId: ctx.conversationId,
+                        runId: ctx.runId,
+                        callId: ctx.callId,
+                        recipientAccountId: ctx.actorAccountId,
+                    }, viaAgent("accounts.create", ctx));
+                    const login = (await this.accounts.localLogins([account.id])).get(account.id) ?? null;
+                    return { account: accountView(account, login), initialPassword: INITIAL_PASSWORD_NOTE };
+                },
+            }),
+            defineOperation({
+                id: "accounts.disable",
+                description: "Disable an account (super admin): it can no longer sign in, and its sessions and personal access tokens are revoked at once (enabling it again does not bring them back). You cannot disable your own account or the last active super admin.",
+                input: z.object({ accountId: AccountId }).strict(),
+                example: { accountId: "00000000-0000-4000-8000-000000000000" },
+                authz: { superAdmin: true },
+                mirrors: ["PATCH /api/v1/admin/accounts/:accountId"],
+                // only the status, set by the operation; the display name and the super-admin flag (a role
+                // change, human-only) are changed on the web
+                omits: ["displayName", "status", "isSuperAdmin"],
+                confirm: "platform",
+                errors: [
+                    {
+                        code: "account.not_found",
+                        next: "Look the account up with accounts.list and pass its id.",
+                    },
+                    {
+                        code: "account.last_super_admin",
+                        next: "Make another account a super admin on the web first (admin console, Accounts).",
+                    },
+                    { code: "account.self", next: "Ask another super admin to do it on the web." },
+                    { code: "account.no_change", next: "Nothing to do: the account is disabled already." },
+                ],
+                precheck: (i, ctx) => this.statusPrecheck(i.accountId, "disabled", ctx),
+                summary: (i) => this.statusSummary(i.accountId, "停用", "Disable"),
+                run: (input, ctx) => this.setStatus("accounts.disable", input.accountId, "disabled", ctx),
+            }),
+            defineOperation({
+                id: "accounts.enable",
+                description: "Enable a disabled account again (super admin): it can sign in again with its password; its earlier sessions and tokens stay revoked.",
+                input: z.object({ accountId: AccountId }).strict(),
+                example: { accountId: "00000000-0000-4000-8000-000000000000" },
+                authz: { superAdmin: true },
+                mirrors: ["PATCH /api/v1/admin/accounts/:accountId"],
+                omits: ["displayName", "status", "isSuperAdmin"],
+                confirm: "platform",
+                errors: [
+                    {
+                        code: "account.not_found",
+                        next: "Look the account up with accounts.list and pass its id.",
+                    },
+                    { code: "account.no_change", next: "Nothing to do: the account is active already." },
+                ],
+                precheck: (i, ctx) => this.statusPrecheck(i.accountId, "active", ctx),
+                summary: (i) => this.statusSummary(i.accountId, "启用", "Enable"),
+                run: (input, ctx) => this.setStatus("accounts.enable", input.accountId, "active", ctx),
+            }),
+        ]);
+    }
+};
+AccountsOperations = __decorate([
+    Injectable(),
+    __param(0, Inject(PlatformOperations)),
+    __param(1, Inject(AccountsService)),
+    __param(2, Inject(InitialPasswords)),
+    __param(3, Inject(SessionService)),
+    __param(4, Inject(OrgsService)),
+    __param(5, Inject(KERNEL_LOGGER))
+], AccountsOperations);
+export { AccountsOperations };

package/dist/platform/ops/admin.ops.d.ts

@@ -0,0 +1,36 @@
+import { type OnModuleInit } from "@nestjs/common";
+import { CatalogRequestsService } from "../../catalog/requests.service.js";
+import { ExtensionAdmin } from "../../extensions/admin-view.js";
+import { ExtensionDisplayNames } from "../../extensions/display-name.js";
+import { ExtensionRegistry } from "../../extensions/registry.js";
+import { AccountsService } from "../../identity/accounts.js";
+import { SettingsService } from "../../identity/settings.js";
+import { ModelEnablement } from "../../models/enablement.js";
+import { PricesService } from "../../models/prices.js";
+import { ModelPurposesService } from "../../models/purposes.js";
+import { OrgsService } from "../../orgs/orgs.service.js";
+import { ProviderRegistry } from "../../runtime/providers.js";
+import { PlatformOperations } from "../registry.js";
+/**
+ * Admin console operations of the `Platform` tool (spec §14.2): the dashboard totals, the
+ * deployment settings, and the platform's models (the model catalog with the platform's disabled
+ * list, the price table, the default model per purpose). Super admin only, through their own
+ * private agent. The per-org overrides of models and purposes are the org's own pages.
+ */
+export declare class AdminOperations implements OnModuleInit {
+    private readonly registry;
+    private readonly extensions;
+    private readonly orgs;
+    private readonly accounts;
+    private readonly catalogRequests;
+    private readonly settings;
+    private readonly providers;
+    private readonly displayNames;
+    private readonly extensionRegistry;
+    private readonly enablement;
+    private readonly prices;
+    private readonly purposes;
+    constructor(registry: PlatformOperations, extensions: ExtensionAdmin, orgs: OrgsService, accounts: AccountsService, catalogRequests: CatalogRequestsService, settings: SettingsService, providers: ProviderRegistry, displayNames: ExtensionDisplayNames, extensionRegistry: ExtensionRegistry, enablement: ModelEnablement, prices: PricesService, purposes: ModelPurposesService);
+    private assertProvider;
+    onModuleInit(): void;
+}