@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.10

package/dist/admin/admin.schemas.d.ts

@@ -0,0 +1,57 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** `GET /api/v1/admin/accounts`: keyset paging by account id. */
+export declare const AccountListQuery: z.ZodObject<{
+    after: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export declare const CreateAccountBody: z.ZodObject<{
+    login: z.ZodString;
+    password: z.ZodString;
+    displayName: z.ZodString;
+    email: z.ZodOptional<z.ZodEmail>;
+    superAdmin: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const AccountParams: z.ZodObject<{
+    accountId: z.ZodString;
+}, z.core.$strip>;
+export declare const UpdateAccountBody: z.ZodObject<{
+    displayName: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>>;
+    isSuperAdmin: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/** At least one key; `runConcurrencyOverrides` merges by org, a null value drops that org's. */
+export declare const DeploymentSettingsBody: z.ZodObject<{
+    orgCreation: z.ZodOptional<z.ZodEnum<{
+        anyone: "anyone";
+        super_admin: "super_admin";
+    }>>;
+    runConcurrencyOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodNumber>>>;
+    priceCurrency: z.ZodOptional<z.ZodString>;
+    sandboxLimitOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodObject<{
+        cpu: z.ZodOptional<z.ZodNumber>;
+        memoryMb: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>>;
+    subagentLimitOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodObject<{
+        maxDepth: z.ZodOptional<z.ZodNumber>;
+        maxConcurrentPerConversation: z.ZodOptional<z.ZodNumber>;
+        maxDispatchesPerRun: z.ZodOptional<z.ZodNumber>;
+        maxTokensPerRun: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>>;
+    customConnectors: z.ZodOptional<z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>>;
+    customSkills: z.ZodOptional<z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>>;
+    orgMarketplaceBrowse: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const PurposeParams: z.ZodObject<{
+    purpose: z.ZodString;
+}, z.core.$strip>;
+export declare const ADMIN_ROUTES: readonly RouteSchemas[];

package/dist/admin/admin.schemas.js

@@ -0,0 +1,50 @@
+import { z } from "zod";
+import { MAX_PASSWORD_LENGTH } from "../identity/login.js";
+import { DEPLOYMENT_SETTINGS_PATCH } from "../identity/settings.js";
+import { ModelDisabledPatch, ModelProviderParams } from "../models/enablement.controller.js";
+import { MODEL_PRICE_PUT } from "../models/prices.js";
+import { PURPOSE_PUT } from "../models/purposes.js";
+/** `GET /api/v1/admin/accounts`: keyset paging by account id. */
+export const AccountListQuery = z.object({
+    after: z.string().min(1).optional(),
+    limit: z.coerce.number().int().min(1).max(200).default(50),
+});
+export const CreateAccountBody = z.object({
+    login: z.string().min(1).max(64),
+    password: z.string().min(1).max(MAX_PASSWORD_LENGTH),
+    displayName: z.string().trim().min(1).max(100),
+    email: z.email().max(254).optional(),
+    superAdmin: z.boolean().optional(),
+});
+export const AccountParams = z.object({ accountId: z.string().min(1).max(100) });
+export const UpdateAccountBody = z.object({
+    displayName: z.string().trim().min(1).max(100).optional(),
+    status: z.enum(["active", "disabled"]).optional(),
+    isSuperAdmin: z.boolean().optional(),
+});
+/** At least one key; `runConcurrencyOverrides` merges by org, a null value drops that org's. */
+export const DeploymentSettingsBody = DEPLOYMENT_SETTINGS_PATCH.refine((b) => Object.keys(b).length > 0, { message: "at least one setting is required" });
+export const PurposeParams = z.object({ purpose: z.string().min(1).max(100) });
+export const ADMIN_ROUTES = [
+    { route: "GET /api/v1/admin/overview" },
+    { route: "GET /api/v1/admin/accounts", query: AccountListQuery },
+    { route: "POST /api/v1/admin/accounts", body: CreateAccountBody },
+    {
+        route: "PATCH /api/v1/admin/accounts/:accountId",
+        params: AccountParams,
+        body: UpdateAccountBody,
+    },
+    { route: "GET /api/v1/admin/orgs" },
+    { route: "GET /api/v1/admin/settings" },
+    { route: "PUT /api/v1/admin/settings", body: DeploymentSettingsBody },
+    { route: "GET /api/v1/admin/models" },
+    {
+        route: "PATCH /api/v1/admin/models/:provider/disabled",
+        params: ModelProviderParams,
+        body: ModelDisabledPatch,
+    },
+    { route: "GET /api/v1/admin/model-prices" },
+    { route: "PUT /api/v1/admin/model-prices", body: MODEL_PRICE_PUT },
+    { route: "GET /api/v1/admin/model-purposes" },
+    { route: "PUT /api/v1/admin/model-purposes/:purpose", params: PurposeParams, body: PURPOSE_PUT },
+];

package/dist/admin/extensions.controller.d.ts

@@ -1,27 +1,38 @@
 import { z } from "zod";
-import type { KernelConfig } from "../config/schema.js";
-import type { ExtensionAdminOps } from "../extensions/admin-ops.js";
-import type { ExtensionAdmin } from "../extensions/admin-view.js";
-import type { DeploymentConfigView, ExtensionDeploymentConfigService } from "../extensions/deployment-config.js";
-import type { ExtensionInstalls, PackageReview } from "../extensions/installs.js";
+import { ExtensionAdminOps } from "../extensions/admin-ops.js";
+import { ExtensionAdmin } from "../extensions/admin-view.js";
+import { type DeploymentConfigView, ExtensionDeploymentConfigService } from "../extensions/deployment-config.js";
+import { ExtensionInstalls, type PackageReview } from "../extensions/installs.js";
+import { type OrgOverrideSummary, OrgOverrides } from "../extensions/org-overrides.js";
 import type { AdminExtensionView } from "../extensions/permission-view.js";
 import { type Principal } from "../identity/principal.js";
-declare const ApproveBody: z.ZodObject<{
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+declare const ApproveSchema: z.ZodObject<{
     sha256: z.ZodNullable<z.ZodString>;
     reviewHash: z.ZodString;
 }, z.core.$strip>;
-declare const InstallBody: z.ZodObject<{
+declare const InstallSchema: z.ZodObject<{
     sha256: z.ZodString;
 }, z.core.$strip>;
-declare const ConfigBody: z.ZodObject<{
+declare const ConfigSchema: z.ZodObject<{
     values: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    secretEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        key: z.ZodString;
+        value: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        renameFrom: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
 }, z.core.$strip>;
-declare const NpmBody: z.ZodObject<{
+declare const NpmSchema: z.ZodObject<{
     package: z.ZodString;
     version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/** The `:name` route parameter of the org-overrides list (decision R20). */
+declare const NameParams: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
 /**
- * Deployment-level extension management (`/api/v1/admin/extensions/*`, enterprise admins): package
+ * Deployment-level extension management (`/api/v1/admin/extensions/*`, super admins): package
  * import (upload / npm, returns the review), the extension list and detail, web permission approval
  * (D8), install / enable / disable / uninstall (only writes the desired state and publishes
  * `kernel.plugins.changed`; every replica reconciles, no restart; replicas may still be converging
@@ -33,7 +44,8 @@ export declare class AdminExtensionsController {
     private readonly ops;
     private readonly deploymentConfigs;
     private readonly kernelConfig;
-    constructor(installs: ExtensionInstalls, admin: ExtensionAdmin, ops: ExtensionAdminOps, deploymentConfigs: ExtensionDeploymentConfigService, kernelConfig: () => KernelConfig);
+    private readonly orgOverrides;
+    constructor(installs: ExtensionInstalls, admin: ExtensionAdmin, ops: ExtensionAdminOps, deploymentConfigs: ExtensionDeploymentConfigService, kernelConfig: KernelConfigService, orgOverrides: OrgOverrides);
     /**
      * 部署上的全部插件（内置、配置声明、安装记录）及其状态、权限与快照；`drainSeconds` 为停用 / 升级时
      * 在途工具调用最多等待的秒数（`extensionHost.drainSeconds`，界面提示用）。
@@ -50,6 +62,14 @@ export declare class AdminExtensionsController {
      * result. Unknown -> 404 `extension.not_found`.
      */
     config(name: string): Promise<DeploymentConfigView>;
+    /**
+     * The orgs keeping their own copy of the extension's overridable config (spec A §5.7): when it
+     * was made, which non-secret fields differ from the platform, whether each secret is set; never
+     * a secret value. The super admin cannot edit or drop a copy.
+     */
+    orgCopies({ name }: z.infer<typeof NameParams>): Promise<{
+        overrides: OrgOverrideSummary[];
+    }>;
     /**
      * Saves the deployment config (`values` keyed by field dot path; `null` clears, omitted keeps).
      * A field present in the startup config -> 409 `extension.config_readonly`; unknown or invalid
@@ -57,16 +77,27 @@ export declare class AdminExtensionsController {
      * (a value from the startup config) does not block the PUT: it saves anyway, the extension stays
      * pending configuration and the startup config has to change. Every replica re-reads after saving:
      * hot fields are replaced in place, other fields reload the extension, and a pending extension
-     * loads (no restart).
+     * loads (no restart). `secretEntries` set, rename or remove single keys of a secret record a
+     * config UI hint draws per item (a path no hint names -> 400 `validation_failed`).
+     */
+    putConfig(principal: Principal, name: string, body: z.infer<typeof ConfigSchema>): Promise<DeploymentConfigView>;
+    /**
+     * Clears the deployment config saved here: the stored fields and every stored secret value of
+     * the extension; audits `extension.config_cleared`. Fields from the startup config (file / Nacos
+     * / env) cannot be removed here: they stay in effect and the returned view still shows them
+     * (`readonly`, with their `source`). Every replica re-reads, the same way as after a PUT: the
+     * extension loads from what remains, or becomes pending configuration when that is missing or
+     * invalid (no restart). Nothing stored -> no change (no audit). Unknown -> 404
+     * `extension.not_found`.
      */
-    putConfig(principal: Principal, name: string, body: z.infer<typeof ConfigBody>): Promise<DeploymentConfigView>;
+    clearConfig(principal: Principal, name: string): Promise<DeploymentConfigView>;
     /**
      * Web approval: writes the snapshot (source web), audits `extension.permissions_approved` and
      * publishes `kernel.plugins.changed`. Package or
      * permissions changed after the review -> 409 `extension.approval_stale`; nothing to approve ->
      * 409 `extension.not_pending`.
      */
-    approve(principal: Principal, name: string, body: z.infer<typeof ApproveBody>): Promise<AdminExtensionView>;
+    approve(principal: Principal, name: string, body: z.infer<typeof ApproveSchema>): Promise<AdminExtensionView>;
     /**
      * New install or version change (upgrade / downgrade): the install record points at `sha256` in the
      * package store; the desired state is unchanged (a new install is disabled).
@@ -76,7 +107,7 @@ export declare class AdminExtensionsController {
      * `extension.name_conflict`; downgrade to a version with unrun migrations -> 409
      * `extension.downgrade_unsupported`.
      */
-    install(principal: Principal, name: string, body: z.infer<typeof InstallBody>): Promise<AdminExtensionView>;
+    install(principal: Principal, name: string, body: z.infer<typeof InstallSchema>): Promise<AdminExtensionView>;
     /** Enable on the deployment; not installed -> 404 `extension.not_found`; config-declared -> 409. */
     enable(principal: Principal, name: string): Promise<AdminExtensionView>;
     /**
@@ -95,6 +126,6 @@ export declare class AdminExtensionsController {
         body?: unknown;
     }): Promise<PackageReview>;
     /** 从配置的 npm registry 拉取（`version` 可以是版本、dist-tag 或范围，缺省 latest）。下载失败 → 502。 */
-    fromNpm(principal: Principal, body: z.infer<typeof NpmBody>): Promise<PackageReview>;
+    fromNpm(principal: Principal, body: z.infer<typeof NpmSchema>): Promise<PackageReview>;
 }
 export {};

package/dist/admin/extensions.controller.js

@@ -7,13 +7,19 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Controller, Delete, Get, HttpCode, Inject, Param, Post, Put, Req, } from "@nestjs/common";
+import { Controller, Delete, Get, HttpCode, Inject, Param, Post, Put, Req } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
-import { EXTENSION_ADMIN, EXTENSION_ADMIN_OPS, EXTENSION_DEPLOYMENT_CONFIGS, EXTENSION_INSTALLS, KERNEL_CONFIG, } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
-import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
-const ApproveBody = z.object({
+import { ExtensionAdminOps } from "../extensions/admin-ops.js";
+import { ExtensionAdmin } from "../extensions/admin-view.js";
+import { ExtensionDeploymentConfigService, } from "../extensions/deployment-config.js";
+import { ExtensionInstalls } from "../extensions/installs.js";
+import { OrgOverrides } from "../extensions/org-overrides.js";
+import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
+const ApproveSchema = z.object({
     /** 安装记录的包（审阅时的 sha256）；配置声明的插件为 null。 */
     sha256: z
         .string()
@@ -21,20 +27,51 @@ const ApproveBody = z.object({
         .nullable(),
     reviewHash: z.string().regex(/^[0-9a-f]{16}$/),
 });
-const InstallBody = z.object({
+const InstallSchema = z.object({
     /** 包存储里的包（上传 / npm 导入返回的 sha256）。 */
     sha256: z.string().regex(/^[0-9a-f]{64}$/),
 });
-const ConfigBody = z.object({
+const SecretEntrySchema = z
+    .object({
+    /** A secret record field some `x-ui.secrets[].path` names. */
+    path: z.string().min(1).max(256),
+    key: z.string().min(1).max(256),
+    /** A string sets the key, `null` removes it. */
+    value: z.string().max(65_536).nullable().optional(),
+    /** Moves the value at this key to `key` first. */
+    renameFrom: z.string().min(1).max(256).optional(),
+})
+    .strict()
+    .refine((e) => e.value !== undefined || e.renameFrom !== undefined, {
+    message: "an entry needs value or renameFrom",
+})
+    .refine((e) => e.key !== "__proto__" && e.renameFrom !== "__proto__", {
+    message: "__proto__ is not a valid key",
+});
+const ConfigSchema = z.object({
     /** 字段点路径 → 新值（`null` 清除）。 */
     values: z.record(z.string().min(1).max(256), z.unknown()),
+    /** Single keys of hinted secret records (extension config forms spec §4.3), applied in order. */
+    secretEntries: z.array(SecretEntrySchema).max(200).optional(),
 });
-const NpmBody = z.object({
+const NpmSchema = z.object({
     package: z.string().min(1).max(214),
     version: z.string().min(1).max(256).optional(),
 });
+class ExtensionApproveBody extends createZodDto(ApproveSchema, "ExtensionApproveBody") {
+}
+class ExtensionInstallBody extends createZodDto(InstallSchema, "ExtensionInstallBody") {
+}
+class ExtensionConfigBody extends createZodDto(ConfigSchema, "ExtensionConfigBody") {
+}
+class ExtensionNpmImportBody extends createZodDto(NpmSchema, "ExtensionNpmImportBody") {
+}
+/** The `:name` route parameter of the org-overrides list (decision R20). */
+const NameParams = z.object({ name: z.string().min(1).max(64) });
+class AdminExtensionNameParamsDto extends createZodDto(NameParams, "AdminExtensionNameParams") {
+}
 /**
- * Deployment-level extension management (`/api/v1/admin/extensions/*`, enterprise admins): package
+ * Deployment-level extension management (`/api/v1/admin/extensions/*`, super admins): package
  * import (upload / npm, returns the review), the extension list and detail, web permission approval
  * (D8), install / enable / disable / uninstall (only writes the desired state and publishes
  * `kernel.plugins.changed`; every replica reconciles, no restart; replicas may still be converging
@@ -46,14 +83,16 @@ let AdminExtensionsController = class AdminExtensionsController {
     ops;
     deploymentConfigs;
     kernelConfig;
+    orgOverrides;
     constructor(installs, admin, ops, deploymentConfigs, 
     // 字段名不能与路由方法同名（如 `config`）：实例字段会遮住原型上的处理函数
-    kernelConfig) {
+    kernelConfig, orgOverrides) {
         this.installs = installs;
         this.admin = admin;
         this.ops = ops;
         this.deploymentConfigs = deploymentConfigs;
         this.kernelConfig = kernelConfig;
+        this.orgOverrides = orgOverrides;
     }
     /**
      * 部署上的全部插件（内置、配置声明、安装记录）及其状态、权限与快照；`drainSeconds` 为停用 / 升级时
@@ -62,7 +101,7 @@ let AdminExtensionsController = class AdminExtensionsController {
     async list() {
         return {
             extensions: await this.admin.list(),
-            drainSeconds: this.kernelConfig().extensionHost.drainSeconds,
+            drainSeconds: this.kernelConfig.get().extensionHost.drainSeconds,
         };
     }
     /** A single extension; unknown -> 404 `extension.not_found`. */
@@ -77,6 +116,14 @@ let AdminExtensionsController = class AdminExtensionsController {
     config(name) {
         return this.deploymentConfigs.view(name);
     }
+    /**
+     * The orgs keeping their own copy of the extension's overridable config (spec A §5.7): when it
+     * was made, which non-secret fields differ from the platform, whether each secret is set; never
+     * a secret value. The super admin cannot edit or drop a copy.
+     */
+    async orgCopies({ name }) {
+        return { overrides: await this.orgOverrides.listForPlugin(name) };
+    }
     /**
      * Saves the deployment config (`values` keyed by field dot path; `null` clears, omitted keeps).
      * A field present in the startup config -> 409 `extension.config_readonly`; unknown or invalid
@@ -84,11 +131,25 @@ let AdminExtensionsController = class AdminExtensionsController {
      * (a value from the startup config) does not block the PUT: it saves anyway, the extension stays
      * pending configuration and the startup config has to change. Every replica re-reads after saving:
      * hot fields are replaced in place, other fields reload the extension, and a pending extension
-     * loads (no restart).
+     * loads (no restart). `secretEntries` set, rename or remove single keys of a secret record a
+     * config UI hint draws per item (a path no hint names -> 400 `validation_failed`).
      */
     putConfig(principal, name, body) {
         const actor = requireUser(principal);
-        return this.deploymentConfigs.put(name, body.values, actor.account.id, patTokenId(actor));
+        return this.deploymentConfigs.put(name, body.values, actor.account.id, patTokenId(actor), body.secretEntries);
+    }
+    /**
+     * Clears the deployment config saved here: the stored fields and every stored secret value of
+     * the extension; audits `extension.config_cleared`. Fields from the startup config (file / Nacos
+     * / env) cannot be removed here: they stay in effect and the returned view still shows them
+     * (`readonly`, with their `source`). Every replica re-reads, the same way as after a PUT: the
+     * extension loads from what remains, or becomes pending configuration when that is missing or
+     * invalid (no restart). Nothing stored -> no change (no audit). Unknown -> 404
+     * `extension.not_found`.
+     */
+    clearConfig(principal, name) {
+        const actor = requireUser(principal);
+        return this.deploymentConfigs.clear(name, actor.account.id, patTokenId(actor));
     }
     /**
      * Web approval: writes the snapshot (source web), audits `extension.permissions_approved` and
@@ -164,25 +225,34 @@ __decorate([
     Get(":name/config"),
     __param(0, Param("name"))
 ], AdminExtensionsController.prototype, "config", null);
+__decorate([
+    Get(":name/org-overrides"),
+    __param(0, ZParam(AdminExtensionNameParamsDto))
+], AdminExtensionsController.prototype, "orgCopies", null);
 __decorate([
     Put(":name/config"),
     __param(0, CurrentPrincipal()),
     __param(1, Param("name")),
-    __param(2, Body(new ZodPipe(ConfigBody)))
+    __param(2, ZBody(ExtensionConfigBody))
 ], AdminExtensionsController.prototype, "putConfig", null);
+__decorate([
+    Delete(":name/config"),
+    __param(0, CurrentPrincipal()),
+    __param(1, Param("name"))
+], AdminExtensionsController.prototype, "clearConfig", null);
 __decorate([
     Post(":name/approve"),
     HttpCode(200),
     __param(0, CurrentPrincipal()),
     __param(1, Param("name")),
-    __param(2, Body(new ZodPipe(ApproveBody)))
+    __param(2, ZBody(ExtensionApproveBody))
 ], AdminExtensionsController.prototype, "approve", null);
 __decorate([
     Post(":name/install"),
     HttpCode(200),
     __param(0, CurrentPrincipal()),
     __param(1, Param("name")),
-    __param(2, Body(new ZodPipe(InstallBody)))
+    __param(2, ZBody(ExtensionInstallBody))
 ], AdminExtensionsController.prototype, "install", null);
 __decorate([
     Post(":name/enable"),
@@ -212,15 +282,16 @@ __decorate([
     Post("packages/npm"),
     HttpCode(200),
     __param(0, CurrentPrincipal()),
-    __param(1, Body(new ZodPipe(NpmBody)))
+    __param(1, ZBody(ExtensionNpmImportBody))
 ], AdminExtensionsController.prototype, "fromNpm", null);
 AdminExtensionsController = __decorate([
     Controller("api/v1/admin/extensions"),
-    EnterpriseAdmin(),
-    __param(0, Inject(EXTENSION_INSTALLS)),
-    __param(1, Inject(EXTENSION_ADMIN)),
-    __param(2, Inject(EXTENSION_ADMIN_OPS)),
-    __param(3, Inject(EXTENSION_DEPLOYMENT_CONFIGS)),
-    __param(4, Inject(KERNEL_CONFIG))
+    SuperAdmin(),
+    __param(0, Inject(ExtensionInstalls)),
+    __param(1, Inject(ExtensionAdmin)),
+    __param(2, Inject(ExtensionAdminOps)),
+    __param(3, Inject(ExtensionDeploymentConfigService)),
+    __param(4, Inject(KernelConfigService)),
+    __param(5, Inject(OrgOverrides))
 ], AdminExtensionsController);
 export { AdminExtensionsController };

package/dist/admin/extensions.schemas.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+import type { RouteSchemas } from "../platform/route-schemas.js";
+/** `:name` as the lifecycle and detail routes take it (`@Param`). */
+export declare const AdminExtensionNamePathParams: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+export declare const ADMIN_EXTENSION_ROUTES: readonly RouteSchemas[];

package/dist/admin/extensions.schemas.js

@@ -0,0 +1,10 @@
+import { z } from "zod";
+/** `:name` as the lifecycle and detail routes take it (`@Param`). */
+export const AdminExtensionNamePathParams = z.object({ name: z.string().min(1) });
+export const ADMIN_EXTENSION_ROUTES = [
+    { route: "GET /api/v1/admin/extensions" },
+    { route: "GET /api/v1/admin/extensions/:name", params: AdminExtensionNamePathParams },
+    { route: "POST /api/v1/admin/extensions/:name/enable", params: AdminExtensionNamePathParams },
+    { route: "POST /api/v1/admin/extensions/:name/disable", params: AdminExtensionNamePathParams },
+    { route: "DELETE /api/v1/admin/extensions/:name", params: AdminExtensionNamePathParams },
+];

package/dist/admin/limit-defaults.d.ts

@@ -0,0 +1,20 @@
+import type { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import type { SubagentLimits } from "../runtime/subagents/limits.js";
+/**
+ * The deployment's defaults of the per-org limits (with `GET /api/v1/admin/orgs`): what an
+ * organization without an override gets, from the live config. `subagents.maxDispatchesPerRun` and
+ * `maxTokensPerRun` of 0 mean no limit.
+ */
+export interface LimitDefaults {
+    /** `runtime.orgConcurrency`. */
+    runConcurrency: number;
+    /** `sandbox.limits.cpu` / `memoryMb`. */
+    sandbox: {
+        cpu: number;
+        memoryMb: number;
+    };
+    /** `subagents.*`. */
+    subagents: SubagentLimits;
+}
+/** {@link LimitDefaults} from the live config. */
+export declare function limitDefaults(config: KernelConfigService): LimitDefaults;

package/dist/admin/limit-defaults.js

@@ -0,0 +1,10 @@
+/** {@link LimitDefaults} from the live config. */
+export function limitDefaults(config) {
+    const cfg = config.get();
+    const { maxDepth, maxConcurrentPerConversation, maxDispatchesPerRun, maxTokensPerRun } = cfg.subagents;
+    return {
+        runConcurrency: cfg.runtime.orgConcurrency,
+        sandbox: { cpu: cfg.sandbox.limits.cpu, memoryMb: cfg.sandbox.limits.memoryMb },
+        subagents: { maxDepth, maxConcurrentPerConversation, maxDispatchesPerRun, maxTokensPerRun },
+    };
+}

package/dist/admin/setup-lock.d.ts

@@ -0,0 +1,16 @@
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { XactLock } from "../infra/database/xact-lock.js";
+/**
+ * The deployment setup lock (one provider per transaction-scoped lock): serializes the web setup
+ * wizard and the CLI's `admin create --if-none`, so concurrent runs create exactly one super
+ * admin. Joins the caller's transaction (`mandatory`), which holds it until it ends.
+ */
+export declare class SetupLock {
+    private readonly xactLock;
+    readonly txHost: TransactionHost;
+    constructor(xactLock: XactLock, txHost: TransactionHost);
+    lock(): Promise<void>;
+}
+/** The one {@link SetupLock}: identity (the CLI's admin creation) and admin import it. */
+export declare class SetupLockModule {
+}

package/dist/admin/setup-lock.js

@@ -0,0 +1,47 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable, Module } from "@nestjs/common";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { XactLock } from "../infra/database/xact-lock.js";
+/** The transaction-scoped lock name of deployment setup. */
+const SETUP_LOCK = "capybara.setup";
+/**
+ * The deployment setup lock (one provider per transaction-scoped lock): serializes the web setup
+ * wizard and the CLI's `admin create --if-none`, so concurrent runs create exactly one super
+ * admin. Joins the caller's transaction (`mandatory`), which holds it until it ends.
+ */
+let SetupLock = class SetupLock {
+    xactLock;
+    txHost;
+    constructor(xactLock, txHost) {
+        this.xactLock = xactLock;
+        this.txHost = txHost;
+    }
+    async lock() {
+        await this.xactLock.lock(SETUP_LOCK);
+    }
+};
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], SetupLock.prototype, "lock", null);
+SetupLock = __decorate([
+    Injectable(),
+    __param(0, Inject(XactLock)),
+    __param(1, Inject(TransactionHost))
+], SetupLock);
+export { SetupLock };
+/** The one {@link SetupLock}: identity (the CLI's admin creation) and admin import it. */
+let SetupLockModule = class SetupLockModule {
+};
+SetupLockModule = __decorate([
+    Module({ providers: [SetupLock], exports: [SetupLock] })
+], SetupLockModule);
+export { SetupLockModule };

package/dist/admin/setup.controller.d.ts

@@ -1,12 +1,12 @@
 import type { FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
-import type { KernelConfig } from "../config/schema.js";
 import type { Account } from "../identity/accounts.js";
-import type { LoginRateLimiter } from "../identity/rate-limit.js";
-import type { SessionService } from "../identity/sessions.js";
+import { SessionService } from "../identity/sessions.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { CredentialThrottler } from "../infra/throttler/credential-throttler.js";
 import type { Org } from "../orgs/orgs.service.js";
-import type { SetupService } from "./setup.service.js";
-declare const SetupBody: z.ZodObject<{
+import { SetupService } from "./setup.service.js";
+declare const SetupSchema: z.ZodObject<{
     login: z.ZodString;
     password: z.ZodString;
     displayName: z.ZodString;
@@ -18,17 +18,17 @@ export declare class SetupController {
     private readonly setup;
     private readonly sessions;
     private readonly config;
-    private readonly limiter;
-    constructor(setup: SetupService, sessions: SessionService, config: () => KernelConfig, limiter: LoginRateLimiter);
+    private readonly throttler;
+    constructor(setup: SetupService, sessions: SessionService, config: KernelConfigService, throttler: CredentialThrottler);
     status(): Promise<{
         needsSetup: boolean;
     }>;
     /**
-     * 建首个企业管理员（可选同时建组织），成功后直接登录（设会话 Cookie）。
+     * 建首个超级管理员（可选同时建组织），成功后直接登录（设会话 Cookie）。
      * 配置了 `auth.setupToken` 时 body 中的 `setupToken` 必须与之相等，否则 `setup.token_invalid`；
      * 核对前先占用限流额度，超限 → 429 `auth.rate_limited`，核对通过后退还。
      */
-    complete(body: z.infer<typeof SetupBody>, req: FastifyRequest, reply: FastifyReply): Promise<{
+    complete(body: z.infer<typeof SetupSchema>, req: FastifyRequest, reply: FastifyReply): Promise<{
         account: Account;
         org?: Org;
     }>;