@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.10

package/dist/platform/ops/admin.ops.js

@@ -0,0 +1,389 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { z } from "zod";
+import { DeploymentSettingsBody, PurposeParams } from "../../admin/admin.schemas.js";
+import { CatalogRequestsService } from "../../catalog/requests.service.js";
+import { ApiError } from "../../errors.js";
+import { ExtensionAdmin } from "../../extensions/admin-view.js";
+import { ExtensionDisplayNames } from "../../extensions/display-name.js";
+import { extensionNeedsAction } from "../../extensions/permission-view.js";
+import { ExtensionRegistry } from "../../extensions/registry.js";
+import { AccountsService } from "../../identity/accounts.js";
+import { DEPLOYMENT_SETTINGS_PATCH, SettingsService } from "../../identity/settings.js";
+import { ModelDisabledPatch, ModelProviderParams } from "../../models/enablement.controller.js";
+import { ModelEnablement } from "../../models/enablement.js";
+import { MODEL_PRICE_PUT, PricesService } from "../../models/prices.js";
+import { purposeTargetOf } from "../../models/purposes.controller.js";
+import { ModelPurposesService, PURPOSE_PUT, withDeclaredByNames } from "../../models/purposes.js";
+import { OrgsService } from "../../orgs/orgs.service.js";
+import { ProviderRegistry } from "../../runtime/providers.js";
+import { defineOperation } from "../operation.js";
+import { PlatformOperations } from "../registry.js";
+import { precheckBy, viaAgent } from "./errors.js";
+import { Cursor, pageOf, startOf } from "./paging.js";
+import { localized, named } from "./summary.js";
+const PAGE = 50;
+/** The deployment-wide settings `admin.update-settings` changes (the per-org limits are orgs.set-limits). */
+const SettingsInput = DEPLOYMENT_SETTINGS_PATCH.pick({
+    orgCreation: true,
+    priceCurrency: true,
+    customConnectors: true,
+    customSkills: true,
+    orgMarketplaceBrowse: true,
+}).strict();
+const ProviderId = ModelProviderParams.shape.provider.describe("The model provider (models.platform-list), e.g. the plugin name of its extension.");
+/** `provider/model` of a purpose target, or null. */
+const refOf = (t) => t === null ? null : `${t.model.provider}/${t.model.model}`;
+/**
+ * Admin console operations of the `Platform` tool (spec §14.2): the dashboard totals, the
+ * deployment settings, and the platform's models (the model catalog with the platform's disabled
+ * list, the price table, the default model per purpose). Super admin only, through their own
+ * private agent. The per-org overrides of models and purposes are the org's own pages.
+ */
+let AdminOperations = class AdminOperations {
+    registry;
+    extensions;
+    orgs;
+    accounts;
+    catalogRequests;
+    settings;
+    providers;
+    displayNames;
+    extensionRegistry;
+    enablement;
+    prices;
+    purposes;
+    constructor(registry, extensions, orgs, accounts, catalogRequests, settings, providers, displayNames, extensionRegistry, enablement, prices, purposes) {
+        this.registry = registry;
+        this.extensions = extensions;
+        this.orgs = orgs;
+        this.accounts = accounts;
+        this.catalogRequests = catalogRequests;
+        this.settings = settings;
+        this.providers = providers;
+        this.displayNames = displayNames;
+        this.extensionRegistry = extensionRegistry;
+        this.enablement = enablement;
+        this.prices = prices;
+        this.purposes = purposes;
+    }
+    assertProvider(provider) {
+        if (!this.extensionRegistry.list("model-provider").some((e) => e.plugin === provider)) {
+            throw new ApiError("model.provider_not_found", `Model provider ${provider} is not installed`);
+        }
+    }
+    onModuleInit() {
+        this.registry.register([
+            defineOperation({
+                id: "admin.overview",
+                description: "The admin console's dashboard totals (super admin): extensions that need the super admin's action, catalog requests waiting for deployment, and the numbers of orgs and accounts.",
+                input: z.object({}).strict(),
+                example: {},
+                authz: { superAdmin: true },
+                mirrors: ["GET /api/v1/admin/overview"],
+                confirm: "read",
+                run: async () => {
+                    const [plugins, orgs, accounts, catalogRequestsPending] = await Promise.all([
+                        this.extensions.list(),
+                        this.orgs.listAll(),
+                        this.accounts.count(),
+                        this.catalogRequests.countPendingDeployment(),
+                    ]);
+                    return {
+                        extensionsNeedingAction: plugins.filter((p) => extensionNeedsAction(p.status)).length,
+                        catalogRequestsPending,
+                        orgs: orgs.length,
+                        accounts,
+                    };
+                },
+            }),
+            defineOperation({
+                id: "admin.settings",
+                description: "Read the deployment settings (super admin): who may create orgs (orgCreation), the price currency, whether orgs may create their own connectors and skills, whether org admins may browse the marketplaces, and the per-org limit overrides keyed by org id (orgs.get reads one org's).",
+                input: z.object({}).strict(),
+                example: {},
+                authz: { superAdmin: true },
+                mirrors: ["GET /api/v1/admin/settings"],
+                confirm: "read",
+                run: () => this.settings.get(),
+            }),
+            defineOperation({
+                id: "admin.update-settings",
+                description: "Change deployment settings (super admin); give only the keys to change: orgCreation (anyone or super_admin), priceCurrency (ISO 4217 code), customConnectors / customSkills (allow or deny: whether orgs may create their own instead of installing from the catalog), orgMarketplaceBrowse (true or false). Per-org limits are orgs.set-limits.",
+                input: SettingsInput.refine((b) => Object.keys(b).length > 0, {
+                    message: "at least one setting is required",
+                }),
+                example: { orgCreation: "super_admin" },
+                authz: { superAdmin: true },
+                mirrors: ["PUT /api/v1/admin/settings"],
+                // the per-org override records are orgs.set-limits (one org at a time)
+                omits: ["runConcurrencyOverrides", "sandboxLimitOverrides", "subagentLimitOverrides"],
+                confirm: "platform",
+                errors: [
+                    {
+                        code: "validation_failed",
+                        next: "Fix the values as the message says (admin.settings shows the current ones).",
+                    },
+                ],
+                precheck: async (i) => {
+                    const r = DeploymentSettingsBody.safeParse(i);
+                    return r.success
+                        ? { ok: true }
+                        : { ok: false, code: "validation_failed", message: r.error.issues[0]?.message ?? "" };
+                },
+                summary: (i) => {
+                    const parts = Object.entries(i).map(([k, v]) => `${k}=${String(v)}`);
+                    return {
+                        zh: `修改平台部署设置：${parts.join("，")}`,
+                        en: `Change the deployment settings: ${parts.join(", ")}`,
+                    };
+                },
+                run: (input, ctx) => this.settings.update(input, ctx.actorAccountId, undefined, viaAgent("admin.update-settings", ctx)),
+            }),
+            defineOperation({
+                id: "models.platform-list",
+                description: "The platform's model catalog (super admin). Without provider: one row per model provider with its state (ok, error with the reason, org_configured: each org configures it), its plugin and how many models it lists and how many the platform disabled. With provider: that provider's models, one row each (id, name, kind, disabled), paged by 50 (pass the returned next as params.cursor).",
+                input: z.object({ provider: ProviderId.optional(), cursor: Cursor.optional() }).strict(),
+                example: {},
+                authz: { superAdmin: true },
+                mirrors: ["GET /api/v1/admin/models"],
+                extras: ["provider", "cursor"],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "model.provider_not_found",
+                        next: "Pick a provider from models.platform-list.",
+                    },
+                ],
+                run: async (input) => {
+                    const providers = await this.providers.listWithStatus();
+                    if (input.provider === undefined) {
+                        const names = await this.displayNames.many(providers.map((p) => p.plugin));
+                        return {
+                            items: providers.map((p) => ({
+                                id: p.provider,
+                                name: localized(names.get(p.plugin), p.plugin).en,
+                                state: p.status,
+                                ...(p.error !== undefined && { reason: p.error }),
+                                plugin: p.plugin,
+                                models: p.models.length,
+                                disabled: p.models.filter((m) => m.disabled === true).length,
+                            })),
+                        };
+                    }
+                    const p = providers.find((x) => x.provider === input.provider);
+                    if (!p) {
+                        throw new ApiError("model.provider_not_found", `Model provider ${input.provider} is not installed`);
+                    }
+                    return pageOf(p.models.map((m) => ({
+                        id: m.id,
+                        name: m.displayName ?? m.id,
+                        kind: m.kind,
+                        disabled: m.disabled === true,
+                    })), startOf(input.cursor), PAGE);
+                },
+            }),
+            defineOperation({
+                id: "models.set-platform-disabled",
+                description: "Disable or enable models of one provider for the whole platform (super admin): disable and enable list model ids (models.platform-list with provider); ids in neither keep their state. A disabled model is invisible to every org. The result lists the agents and purposes, across orgs, that point at a newly disabled model (the disable is not refused for them).",
+                input: z
+                    .object({
+                    provider: ProviderId,
+                    disable: ModelDisabledPatch.shape.disable,
+                    enable: ModelDisabledPatch.shape.enable,
+                })
+                    .strict()
+                    .refine((i) => i.disable.length > 0 || i.enable.length > 0, {
+                    message: "give disable or enable",
+                }),
+                example: { provider: "model-fake", disable: ["fake-1"], enable: [] },
+                authz: { superAdmin: true },
+                mirrors: ["PATCH /api/v1/admin/models/:provider/disabled"],
+                confirm: "platform",
+                errors: [
+                    {
+                        code: "model.provider_not_found",
+                        next: "Pick a provider from models.platform-list.",
+                    },
+                    {
+                        code: "validation_failed",
+                        next: "Fix the lists as the message says (an id in both is refused).",
+                    },
+                ],
+                precheck: async (i) => {
+                    const r = await precheckBy(async () => this.assertProvider(i.provider));
+                    if (!r.ok)
+                        return r;
+                    const disable = new Set(i.disable);
+                    const both = i.enable.filter((m) => disable.has(m));
+                    return both.length === 0
+                        ? { ok: true }
+                        : {
+                            ok: false,
+                            code: "validation_failed",
+                            message: `Both disabled and enabled: ${both.slice(0, 5).join(", ")}`,
+                        };
+                },
+                summary: (i) => {
+                    const list = (ids) => ids.slice(0, 5).map(named).join(", ") + (ids.length > 5 ? ` (+${ids.length - 5})` : "");
+                    const zh = [
+                        i.disable.length > 0 && `停用 ${list(i.disable)}`,
+                        i.enable.length > 0 && `启用 ${list(i.enable)}`,
+                    ].filter((p) => typeof p === "string");
+                    const en = [
+                        i.disable.length > 0 && `disable ${list(i.disable)}`,
+                        i.enable.length > 0 && `enable ${list(i.enable)}`,
+                    ].filter((p) => typeof p === "string");
+                    return {
+                        zh: `在全平台${zh.join("，")}（供应商 ${named(i.provider)}）`,
+                        en: `Platform-wide, ${en.join(" and ")} (provider ${named(i.provider)})`,
+                    };
+                },
+                run: (input, ctx) => this.enablement.setPlatform(input.provider, { disable: input.disable, enable: input.enable }, {
+                    accountId: ctx.actorAccountId,
+                    auditDetail: viaAgent("models.set-platform-disabled", ctx),
+                }),
+            }),
+            defineOperation({
+                id: "models.prices",
+                description: "The model price table (super admin): price per million tokens for input, output, cache read and cache write, by provider and model, in the deployment's currency. Pages by 50: pass the returned next as params.cursor.",
+                input: z.object({ cursor: Cursor.optional() }).strict(),
+                example: {},
+                authz: { superAdmin: true },
+                mirrors: ["GET /api/v1/admin/model-prices"],
+                extras: ["cursor"],
+                confirm: "read",
+                run: async (input) => {
+                    const [prices, s] = await Promise.all([this.prices.list(), this.settings.get()]);
+                    return { currency: s.priceCurrency, ...pageOf(prices, startOf(input.cursor), PAGE) };
+                },
+            }),
+            defineOperation({
+                id: "models.set-price",
+                description: "Set the price of one model per million tokens (super admin): provider, model, inputPerMTok, outputPerMTok, cacheReadPerMTok and cacheWritePerMTok (null when the model has none); or provider, model and price: null to remove its price. Prices only estimate costs in the deployment's currency.",
+                input: MODEL_PRICE_PUT,
+                example: {
+                    provider: "model-fake",
+                    model: "fake-1",
+                    inputPerMTok: 3,
+                    outputPerMTok: 15,
+                    cacheReadPerMTok: null,
+                    cacheWritePerMTok: null,
+                },
+                authz: { superAdmin: true },
+                mirrors: ["PUT /api/v1/admin/model-prices"],
+                confirm: "platform",
+                errors: [{ code: "validation_failed", next: "Fix the prices as the message says." }],
+                summary: (i) => {
+                    const m = `${named(i.provider)}/${named(i.model)}`;
+                    return "price" in i
+                        ? { zh: `删除模型 ${m} 的价格`, en: `Remove the price of model ${m}` }
+                        : {
+                            zh: `设置模型 ${m} 的价格（每百万 token）：输入 ${i.inputPerMTok}，输出 ${i.outputPerMTok}`,
+                            en: `Set the price of model ${m} per million tokens: input ${i.inputPerMTok}, output ${i.outputPerMTok}`,
+                        };
+                },
+                run: async (input, ctx) => {
+                    await this.prices.put(input, ctx.actorAccountId, undefined, viaAgent("models.set-price", ctx));
+                    const [prices, s] = await Promise.all([this.prices.list(), this.settings.get()]);
+                    const price = prices.find((p) => p.provider === input.provider && p.model === input.model);
+                    return { price: price ?? null, currency: s.priceCurrency };
+                },
+            }),
+            defineOperation({
+                id: "models.platform-purposes",
+                description: "The model purposes (super admin): what the kernel and extensions use a model for (title generation, summaries, embeddings, …), one row each with its kind (chat or embedding), who declares it, and the platform's default model (provider/model, null when none). Orgs may override a purpose on their own page.",
+                input: z.object({}).strict(),
+                example: {},
+                authz: { superAdmin: true },
+                mirrors: ["GET /api/v1/admin/model-purposes"],
+                confirm: "read",
+                run: async () => {
+                    const list = await withDeclaredByNames(await this.purposes.list(), this.displayNames);
+                    return {
+                        items: list.map((p) => ({
+                            id: p.purpose,
+                            name: p.label.en,
+                            state: p.default === null ? "unconfigured" : "configured",
+                            kind: p.kind,
+                            declaredBy: p.declaredBy,
+                            default: refOf(p.default),
+                        })),
+                    };
+                },
+            }),
+            defineOperation({
+                id: "models.set-platform-purpose",
+                description: "Set the platform's default model of a purpose (super admin), or clear it with target: null. target is {model: {provider, model}, params?}; the model must be a platform model of the purpose's kind (models.platform-purposes, models.platform-list) and params must fit its declared parameters.",
+                input: z
+                    .object({ purpose: PurposeParams.shape.purpose, target: PURPOSE_PUT.shape.target })
+                    .strict(),
+                example: {
+                    purpose: "title",
+                    target: { model: { provider: "model-fake", model: "fake-1" } },
+                },
+                authz: { superAdmin: true },
+                mirrors: ["PUT /api/v1/admin/model-purposes/:purpose"],
+                confirm: "platform",
+                errors: [
+                    {
+                        code: "model.purpose_unknown",
+                        next: "Pick a purpose from models.platform-purposes.",
+                    },
+                    {
+                        code: "validation_failed",
+                        next: "Pick a model of the purpose's kind from models.platform-list, with params it declares.",
+                    },
+                ],
+                precheck: (i) => precheckBy(() => this.purposes.validate(null, i.purpose, purposeTargetOf({ target: i.target }))),
+                summary: (i) => {
+                    const target = refOf(i.target);
+                    return target === null
+                        ? {
+                            zh: `清除用途「${named(i.purpose)}」的平台默认模型`,
+                            en: `Clear the platform default model of purpose "${named(i.purpose)}"`,
+                        }
+                        : {
+                            zh: `把用途「${named(i.purpose)}」的平台默认模型设为 ${named(target)}`,
+                            en: `Set the platform default model of purpose "${named(i.purpose)}" to ${named(target)}`,
+                        };
+                },
+                run: async (input, ctx) => {
+                    const view = await this.purposes.setDefault(input.purpose, purposeTargetOf({ target: input.target }), ctx.actorAccountId, undefined, viaAgent("models.set-platform-purpose", ctx));
+                    return {
+                        purpose: {
+                            id: view.purpose,
+                            kind: view.kind,
+                            default: refOf(view.default),
+                            params: view.default?.params ?? null,
+                        },
+                    };
+                },
+            }),
+        ]);
+    }
+};
+AdminOperations = __decorate([
+    Injectable(),
+    __param(0, Inject(PlatformOperations)),
+    __param(1, Inject(ExtensionAdmin)),
+    __param(2, Inject(OrgsService)),
+    __param(3, Inject(AccountsService)),
+    __param(4, Inject(CatalogRequestsService)),
+    __param(5, Inject(SettingsService)),
+    __param(6, Inject(ProviderRegistry)),
+    __param(7, Inject(ExtensionDisplayNames)),
+    __param(8, Inject(ExtensionRegistry)),
+    __param(9, Inject(ModelEnablement)),
+    __param(10, Inject(PricesService)),
+    __param(11, Inject(ModelPurposesService))
+], AdminOperations);
+export { AdminOperations };

package/dist/platform/ops/agent-skills.ops.d.ts

@@ -0,0 +1,24 @@
+import { type OnModuleInit } from "@nestjs/common";
+import { AgentsService } from "../../agents/agents.service.js";
+import { SkillChangesService } from "../../skills/changes.service.js";
+import { SkillInvoker } from "../../skills/invoke.js";
+import { SkillsService } from "../../skills/skills.service.js";
+import { PlatformOperations } from "../registry.js";
+/**
+ * The skills of one agent and the skill change inbox detail (`Platform` tool, spec §14): reads of
+ * the agent's own skills and of the invocable ones, detaching a skill, and the detail of a pending
+ * skill change as the inbox shows it. Deciding a change stays `human-only`.
+ */
+export declare class AgentSkillsOperations implements OnModuleInit {
+    private readonly registry;
+    private readonly agents;
+    private readonly skills;
+    private readonly changes;
+    private readonly invoker;
+    constructor(registry: PlatformOperations, agents: AgentsService, skills: SkillsService, changes: SkillChangesService, invoker: SkillInvoker);
+    /** Class of deleting a skill: your own private agent is personal; a shared agent is the org's. */
+    private deleteClass;
+    /** The route's refusals, read before the card: a visible agent, owned by the actor, with the skill. */
+    private deleteCheck;
+    onModuleInit(): void;
+}

package/dist/platform/ops/agent-skills.ops.js

@@ -0,0 +1,226 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { z } from "zod";
+import { AgentsService } from "../../agents/agents.service.js";
+import { ApiError } from "../../errors.js";
+import { SkillChangesService } from "../../skills/changes.service.js";
+import { SkillInvoker } from "../../skills/invoke.js";
+import { AgentSkillPathParams, AgentSkillsListParams, InvocableSkillsQuerySchema, SkillChangePathParams, } from "../../skills/skills.schemas.js";
+import { SkillsService } from "../../skills/skills.service.js";
+import { defineOperation, } from "../operation.js";
+import { PlatformOperations } from "../registry.js";
+import { precheckBy, viaAgent } from "./errors.js";
+import { named, orElse } from "./summary.js";
+const AgentId = AgentSkillsListParams.shape.agentId;
+const DESCRIPTION_MAX = 200;
+const clip = (s) => s.length > DESCRIPTION_MAX ? `${s.slice(0, DESCRIPTION_MAX)}…` : s;
+const skillRow = (s) => ({
+    id: s.id,
+    name: s.name,
+    state: "active",
+    description: clip(s.description),
+    version: s.currentVersion,
+    manual: s.manual,
+});
+/**
+ * The skills of one agent and the skill change inbox detail (`Platform` tool, spec §14): reads of
+ * the agent's own skills and of the invocable ones, detaching a skill, and the detail of a pending
+ * skill change as the inbox shows it. Deciding a change stays `human-only`.
+ */
+let AgentSkillsOperations = class AgentSkillsOperations {
+    registry;
+    agents;
+    skills;
+    changes;
+    invoker;
+    constructor(registry, agents, skills, changes, invoker) {
+        this.registry = registry;
+        this.agents = agents;
+        this.skills = skills;
+        this.changes = changes;
+        this.invoker = invoker;
+    }
+    /** Class of deleting a skill: your own private agent is personal; a shared agent is the org's. */
+    async deleteClass(agentId, ctx) {
+        const a = await this.agents.get(ctx.orgId, agentId, ctx.actorAccountId);
+        return a.visibility === "private" && a.ownerAccountId === ctx.actorAccountId
+            ? "personal"
+            : "org";
+    }
+    /** The route's refusals, read before the card: a visible agent, owned by the actor, with the skill. */
+    async deleteCheck(agentId, skillId, ctx) {
+        const seen = await precheckBy(async () => {
+            const a = await this.agents.get(ctx.orgId, agentId, ctx.actorAccountId);
+            if (a.ownerAccountId !== ctx.actorAccountId) {
+                throw new ApiError("forbidden", "Only the agent's owner can delete its skills");
+            }
+        });
+        if (!seen.ok)
+            return seen;
+        const list = await this.skills.listForAgent(ctx.orgId, agentId);
+        return list.some((s) => s.id === skillId)
+            ? { ok: true }
+            : { ok: false, code: "skill.not_found", message: "Skill not found" };
+    }
+    onModuleInit() {
+        this.registry.register([
+            defineOperation({
+                id: "agents.skills",
+                description: "List the skills an agent wrote for itself (its own skills, not org or platform ones), by name: id, name, description, version and whether it is manual-only. Takes the agent id from agents.list.",
+                input: z.object({ agentId: AgentId }).strict(),
+                example: { agentId: "7c1a5b0e-9a53-4c6b-8d64-2f5a1b0c3e77" },
+                authz: { orgAction: "agents.use" },
+                mirrors: ["GET /api/v1/orgs/:orgId/agents/:agentId/skills"],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "agent.not_found",
+                        next: "Check the agent id with agents.list: only agents you can see are readable.",
+                    },
+                ],
+                run: async (input, ctx) => {
+                    await this.agents.get(ctx.orgId, input.agentId, ctx.actorAccountId);
+                    return {
+                        items: (await this.skills.listForAgent(ctx.orgId, input.agentId)).map(skillRow),
+                    };
+                },
+            }),
+            defineOperation({
+                id: "agents.invocable-skills",
+                description: "List the skills a person can invoke with / on an agent (its effective skills: org, platform and its own), by name: id, name, state (manual for manual-only), description, version and the plugin. Optionally pass a conversation of yours with that agent to include its trial drafts.",
+                input: z
+                    .object({
+                    agentId: AgentId,
+                    conversationId: InvocableSkillsQuerySchema.shape.conversationId,
+                })
+                    .strict(),
+                example: { agentId: "7c1a5b0e-9a53-4c6b-8d64-2f5a1b0c3e77" },
+                authz: { orgAction: "agents.use" },
+                mirrors: ["GET /api/v1/orgs/:orgId/agents/:agentId/invocable-skills"],
+                confirm: "read",
+                errors: [
+                    {
+                        code: "agent.not_found",
+                        next: "Check the agent id with agents.list: only agents you can see are readable.",
+                    },
+                    {
+                        code: "conversation.not_found",
+                        next: "Pass one of your own conversations with this agent (conversations.list), or leave it out.",
+                    },
+                ],
+                run: async (input, ctx) => ({
+                    items: (await this.invoker.listFor(ctx.orgId, input.agentId, ctx.actorAccountId, input.conversationId)).map((s) => ({
+                        id: s.id,
+                        name: s.name,
+                        state: s.manual ? "manual" : "active",
+                        description: clip(s.description),
+                        version: s.version,
+                        ...(s.plugin !== undefined && { plugin: s.plugin }),
+                    })),
+                }),
+            }),
+            defineOperation({
+                id: "agents.delete-skill",
+                description: "Delete one of an agent's own skills (soft delete; a pending change of the same name is cancelled and the name can be written again). Only the agent's owner can; takes the agent id from agents.list and the skill id from agents.skills. The person confirms every delete; it is never remembered.",
+                input: z.object({ agentId: AgentId, skillId: AgentSkillPathParams.shape.skillId }).strict(),
+                example: {
+                    agentId: "7c1a5b0e-9a53-4c6b-8d64-2f5a1b0c3e77",
+                    skillId: "0b9f2c4e-1d3a-4c55-9e0a-7a2f6d1c8b11",
+                },
+                authz: { orgAction: "agents.create" },
+                mirrors: ["DELETE /api/v1/orgs/:orgId/agents/:agentId/skills/:skillId"],
+                confirm: "personal",
+                // destructive: a shared agent's skill is asked as an org write, every time
+                rememberable: false,
+                confirmFor: (i, ctx) => this.deleteClass(i.agentId, ctx),
+                errors: [
+                    {
+                        code: "agent.not_found",
+                        next: "Check the agent id with agents.list: only agents you can see are readable.",
+                    },
+                    {
+                        code: "forbidden",
+                        next: {
+                            orgAdmin: "Only the agent's owner can delete its skills; the owner can change it on the web.",
+                            member: "Only the agent's owner can delete its skills; ask the owner.",
+                        },
+                    },
+                    {
+                        code: "skill.not_found",
+                        next: "Check the skill id with agents.skills; it may already be deleted.",
+                    },
+                ],
+                precheck: (i, ctx) => this.deleteCheck(i.agentId, i.skillId, ctx),
+                summary: async (i, ctx) => {
+                    const agent = await orElse(async () => named((await this.agents.get(ctx.orgId, i.agentId, ctx.actorAccountId)).definition.name), i.agentId);
+                    const skill = await orElse(async () => named((await this.skills.listForAgent(ctx.orgId, i.agentId)).find((s) => s.id === i.skillId)?.name ?? i.skillId), i.skillId);
+                    return {
+                        zh: `删除智能体「${agent}」的技能「${skill}」`,
+                        en: `Delete skill "${skill}" of agent "${agent}"`,
+                    };
+                },
+                run: async (input, ctx) => {
+                    await this.changes.deleteAgentSkill(ctx.orgId, input.agentId, input.skillId, ctx.actorAccountId, undefined, viaAgent("agents.delete-skill", ctx));
+                    return { id: input.skillId, deleted: true };
+                },
+            }),
+            defineOperation({
+                id: "skills.get-change",
+                description: "Read one skill change a shared agent proposed, as the inbox shows it: the agent, the skill name and description, the version it would become, its file paths and sizes, who asked, its state and who decided. Never file contents: review those on the web, where you also decide it (agents never decide skill changes). Only the agent's owner and the person who asked can read it.",
+                input: z.object({ changeId: SkillChangePathParams.shape.id }).strict(),
+                example: { changeId: "6a1d3e5f-2b4c-4d70-8e91-0f2a4c6e8b13" },
+                // approvals.decide is stricter than the service (a plain-member requester is refused by
+                // the gate), on purpose
+                authz: { orgAction: "approvals.decide" },
+                mirrors: ["GET /api/v1/orgs/:orgId/skill-changes/:id"],
+                renames: { changeId: "id" },
+                confirm: "read",
+                errors: [
+                    {
+                        code: "skill_change.not_found",
+                        next: "No change with this id is yours to read; the inbox lists those waiting for you (inbox.list).",
+                    },
+                ],
+                run: async (input, ctx) => {
+                    const d = await this.changes.get(ctx.orgId, input.changeId, ctx.actorAccountId);
+                    return {
+                        skillChange: {
+                            id: d.id,
+                            name: d.name,
+                            state: d.status,
+                            description: d.description,
+                            agent: d.agent,
+                            skillId: d.skillId,
+                            version: d.version,
+                            files: d.files.map((f) => ({ path: f.path, size: f.size })),
+                            requestedByName: d.requestedByName,
+                            conversationPath: d.conversationPath,
+                            decidedAt: d.decidedAt,
+                            createdAt: d.createdAt,
+                            ...(d.status === "pending" && {
+                                next: "Review the files and decide it on the web, in the inbox; agents never decide skill changes.",
+                            }),
+                        },
+                    };
+                },
+            }),
+        ]);
+    }
+};
+AgentSkillsOperations = __decorate([
+    Injectable(),
+    __param(0, Inject(PlatformOperations)),
+    __param(1, Inject(AgentsService)),
+    __param(2, Inject(SkillsService)),
+    __param(3, Inject(SkillChangesService)),
+    __param(4, Inject(SkillInvoker))
+], AgentSkillsOperations);
+export { AgentSkillsOperations };

package/dist/platform/ops/agent-templates.ops.d.ts

@@ -0,0 +1,17 @@
+import { type OnModuleInit } from "@nestjs/common";
+import { AgentsService } from "../../agents/agents.service.js";
+import { OrgAgentTemplates } from "../../agents/org-templates.js";
+import { AgentTemplatesService } from "../../agents/templates.js";
+import { OwnedItems } from "../../catalog/owned-items.js";
+import { PlatformOperations } from "../registry.js";
+/** Agent template operations of the `Platform` tool (spec §7). */
+export declare class AgentTemplatesOperations implements OnModuleInit {
+    private readonly registry;
+    private readonly templates;
+    private readonly orgTemplates;
+    private readonly agents;
+    private readonly owned;
+    constructor(registry: PlatformOperations, templates: AgentTemplatesService, orgTemplates: OrgAgentTemplates, agents: AgentsService, owned: OwnedItems);
+    private templateName;
+    onModuleInit(): void;
+}