@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.2

package/dist/orgs/org.guard.js

@@ -10,8 +10,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { applyDecorators, createParamDecorator, Inject, Injectable, SetMetadata, UseGuards, } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
 import { ApiError } from "../errors.js";
-import { KERNEL_DB } from "../http/tokens.js";
 import { AllowService } from "../identity/principal.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
 import { can, HUMAN_ONLY } from "./roles.js";
 export const ORG_ACTION_KEY = "capybara:org:action";
 /**
@@ -90,6 +90,6 @@ let OrgGuard = class OrgGuard {
 OrgGuard = __decorate([
     Injectable(),
     __param(0, Inject(Reflector)),
-    __param(1, Inject(KERNEL_DB))
+    __param(1, Inject(KernelDb))
 ], OrgGuard);
 export { OrgGuard };

package/dist/orgs/orgs.controller.d.ts

@@ -1,22 +1,22 @@
 import { z } from "zod";
-import { type ApiTokenRecord, type ApiTokenService } from "../identity/api-tokens.js";
+import { type ApiTokenRecord, ApiTokenService } from "../identity/api-tokens.js";
 import { type Principal } from "../identity/principal.js";
-import type { Member, MembersService } from "./members.service.js";
+import { type Member, MembersService } from "./members.service.js";
 import { type OrgContext } from "./org.guard.js";
-import type { Org, OrgsService } from "./orgs.service.js";
+import { type Org, OrgsService } from "./orgs.service.js";
 import { type OrgRole } from "./roles.js";
-declare const CreateBody: z.ZodObject<{
+declare const CreateSchema: z.ZodObject<{
     name: z.ZodString;
     slug: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-declare const UpdateBody: z.ZodObject<{
+declare const UpdateSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
     slug: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-declare const TransferBody: z.ZodObject<{
+declare const TransferSchema: z.ZodObject<{
     toAccountId: z.ZodString;
 }, z.core.$strip>;
-declare const ServiceTokenBody: z.ZodObject<{
+declare const ServiceTokenSchema: z.ZodObject<{
     name: z.ZodString;
     role: z.ZodEnum<{
         admin: "admin";
@@ -25,7 +25,7 @@ declare const ServiceTokenBody: z.ZodObject<{
     }>;
     expiresAt: z.ZodOptional<z.ZodPipe<z.ZodISODateTime, z.ZodTransform<Date, string>>>;
 }, z.core.$strip>;
-declare const RoleBody: z.ZodObject<{
+declare const RoleSchema: z.ZodObject<{
     role: z.ZodEnum<{
         admin: "admin";
         guest: "guest";
@@ -39,7 +39,7 @@ export declare class OrgsController {
     private readonly members;
     private readonly tokens;
     constructor(orgs: OrgsService, members: MembersService, tokens: ApiTokenService);
-    create(principal: Principal, body: z.infer<typeof CreateBody>): Promise<{
+    create(principal: Principal, body: z.infer<typeof CreateSchema>): Promise<{
         org: Org;
         role: "owner";
     }>;
@@ -52,21 +52,21 @@ export declare class OrgsController {
         org: Org;
         role: OrgRole;
     }>;
-    update(principal: Principal, org: OrgContext, body: z.infer<typeof UpdateBody>): Promise<{
+    update(principal: Principal, org: OrgContext, body: z.infer<typeof UpdateSchema>): Promise<{
         org: Org;
     }>;
     remove(principal: Principal, org: OrgContext): Promise<void>;
-    transfer(principal: Principal, org: OrgContext, body: z.infer<typeof TransferBody>): Promise<void>;
+    transfer(principal: Principal, org: OrgContext, body: z.infer<typeof TransferSchema>): Promise<void>;
     leave(principal: Principal, org: OrgContext): Promise<void>;
     listMembers(org: OrgContext): Promise<{
         members: Member[];
     }>;
-    changeRole(principal: Principal, org: OrgContext, accountId: string, body: z.infer<typeof RoleBody>): Promise<{
+    changeRole(principal: Principal, org: OrgContext, accountId: string, body: z.infer<typeof RoleSchema>): Promise<{
         accountId: string;
         role: OrgRole;
     }>;
     removeMember(principal: Principal, org: OrgContext, accountId: string): Promise<void>;
-    createServiceToken(principal: Principal, org: OrgContext, body: z.infer<typeof ServiceTokenBody>): Promise<{
+    createServiceToken(principal: Principal, org: OrgContext, body: z.infer<typeof ServiceTokenSchema>): Promise<{
         token: string;
         record: ApiTokenRecord;
     }>;

package/dist/orgs/orgs.controller.js

@@ -7,30 +7,42 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post, } from "@nestjs/common";
+import { Controller, Delete, Get, HttpCode, Inject, Param, Patch, Post } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
-import { API_TOKENS, MEMBERS, ORGS } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
-import { FutureIsoDate, } from "../identity/api-tokens.js";
+import { ApiTokenService, FutureIsoDate } from "../identity/api-tokens.js";
 import { CurrentPrincipal, patTokenId, requireUser, SessionOnly, } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody } from "../infra/validation/zod-params.js";
+import { MembersService } from "./members.service.js";
 import { CurrentOrg, OrgAction } from "./org.guard.js";
+import { OrgsService } from "./orgs.service.js";
 import { ORG_ROLES } from "./roles.js";
-const CreateBody = z.object({
+const CreateSchema = z.object({
     name: z.string().min(1).max(100),
     slug: z.string().min(1).max(40).optional(),
 });
-const UpdateBody = z.object({
+class OrgCreateBody extends createZodDto(CreateSchema, "OrgCreateBody") {
+}
+const UpdateSchema = z.object({
     name: z.string().min(1).max(100).optional(),
     slug: z.string().min(1).max(40).optional(),
 });
-const TransferBody = z.object({ toAccountId: z.string().min(1) });
-const ServiceTokenBody = z.object({
+class OrgUpdateBody extends createZodDto(UpdateSchema, "OrgUpdateBody") {
+}
+const TransferSchema = z.object({ toAccountId: z.string().min(1) });
+class OrgTransferBody extends createZodDto(TransferSchema, "OrgTransferBody") {
+}
+const ServiceTokenSchema = z.object({
     name: z.string().min(1).max(100),
     role: z.enum(["admin", "member", "guest"]),
     expiresAt: FutureIsoDate.optional(),
 });
-const RoleBody = z.object({ role: z.enum(ORG_ROLES) });
+class ServiceTokenBody extends createZodDto(ServiceTokenSchema, "ServiceTokenBody") {
+}
+const RoleSchema = z.object({ role: z.enum(ORG_ROLES) });
+class MemberRoleBody extends createZodDto(RoleSchema, "MemberRoleBody") {
+}
 /** 组织与成员（`/api/v1/orgs`）。组织级路由由 `@OrgAction` + OrgGuard 每请求实时鉴权。 */
 let OrgsController = class OrgsController {
     orgs;
@@ -99,7 +111,7 @@ let OrgsController = class OrgsController {
 __decorate([
     Post(),
     __param(0, CurrentPrincipal()),
-    __param(1, Body(new ZodPipe(CreateBody)))
+    __param(1, ZBody(OrgCreateBody))
 ], OrgsController.prototype, "create", null);
 __decorate([
     Get(),
@@ -115,7 +127,7 @@ __decorate([
     OrgAction("org.update"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, Body(new ZodPipe(UpdateBody)))
+    __param(2, ZBody(OrgUpdateBody))
 ], OrgsController.prototype, "update", null);
 __decorate([
     Delete(":orgId"),
@@ -130,7 +142,7 @@ __decorate([
     HttpCode(204),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, Body(new ZodPipe(TransferBody)))
+    __param(2, ZBody(OrgTransferBody))
 ], OrgsController.prototype, "transfer", null);
 __decorate([
     Post(":orgId/leave"),
@@ -150,7 +162,7 @@ __decorate([
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
     __param(2, Param("accountId")),
-    __param(3, Body(new ZodPipe(RoleBody)))
+    __param(3, ZBody(MemberRoleBody))
 ], OrgsController.prototype, "changeRole", null);
 __decorate([
     Delete(":orgId/members/:accountId"),
@@ -166,7 +178,7 @@ __decorate([
     SessionOnly(),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, Body(new ZodPipe(ServiceTokenBody)))
+    __param(2, ZBody(ServiceTokenBody))
 ], OrgsController.prototype, "createServiceToken", null);
 __decorate([
     Get(":orgId/service-tokens"),
@@ -185,8 +197,8 @@ __decorate([
 ], OrgsController.prototype, "revokeServiceToken", null);
 OrgsController = __decorate([
     Controller("api/v1/orgs"),
-    __param(0, Inject(ORGS)),
-    __param(1, Inject(MEMBERS)),
-    __param(2, Inject(API_TOKENS))
+    __param(0, Inject(OrgsService)),
+    __param(1, Inject(MembersService)),
+    __param(2, Inject(ApiTokenService))
 ], OrgsController);
 export { OrgsController };

package/dist/orgs/orgs.module.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Organizations: orgs, org settings, members, invitations, offboarding (with its sweep cron) and
+ * directory sync (the hourly scan cron, one-off syncs on the maintenance queue).
+ */
+export declare class OrgsModule {
+}

package/dist/orgs/orgs.module.js

@@ -0,0 +1,68 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from "@nestjs/common";
+import { EventLogModule } from "../conversations/event-log.js";
+import { EvalBudgetModule } from "../evals/budget.js";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { IdentityModule } from "../identity/identity.module.js";
+import { QueueModule } from "../infra/queue/queue.module.js";
+import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
+import { RuntimeModule } from "../runtime/runtime.module.js";
+import { SandboxModule } from "../sandbox/sandbox.module.js";
+import { ToolsModule } from "../tools/tools.module.js";
+import { DirectorySync } from "./directory-sync.js";
+import { InvitationsService } from "./invitations.service.js";
+import { MembersService } from "./members.service.js";
+import { Offboarding } from "./offboarding.js";
+import { OrgLockModule } from "./org-lock.js";
+import { OrgsService } from "./orgs.service.js";
+import { OrgSettingsService } from "./settings.service.js";
+/**
+ * Organizations: orgs, org settings, members, invitations, offboarding (with its sweep cron) and
+ * directory sync (the hourly scan cron, one-off syncs on the maintenance queue).
+ */
+let OrgsModule = class OrgsModule {
+};
+OrgsModule = __decorate([
+    Module({
+        imports: [
+            IdentityModule,
+            // offboarding publishes the events it cancelled
+            EventLogModule,
+            OrgLockModule,
+            ExtensionsModule,
+            // offboarding clears credentials and cancels approvals and questions
+            ToolsModule,
+            // offboarding stops the member's runs
+            RuntimeModule,
+            // offboarding enqueues the destruction of the member's sandboxes
+            SandboxModule,
+            // cancels the deleted org's eval runs
+            EvalBudgetModule,
+            // the producer side of directory-sync jobs (the maintenance processor consumes them)
+            QueueModule.registerQueue(MAINTENANCE_QUEUE_NAME),
+        ],
+        providers: [
+            OrgsService,
+            OrgSettingsService,
+            MembersService,
+            InvitationsService,
+            Offboarding,
+            DirectorySync,
+        ],
+        exports: [
+            OrgLockModule,
+            OrgsService,
+            OrgSettingsService,
+            MembersService,
+            InvitationsService,
+            Offboarding,
+            DirectorySync,
+        ],
+    })
+], OrgsModule);
+export { OrgsModule };

package/dist/orgs/orgs.service.d.ts

@@ -1,10 +1,12 @@
-import { type Transaction } from "kysely";
-import type { KernelDatabase, KernelDb } from "../db/kernel-schema.js";
+import { EvalBudget } from "../evals/budget.js";
 import type { Account } from "../identity/accounts.js";
-import type { ApiTokenService } from "../identity/api-tokens.js";
-import type { SettingsService } from "../identity/settings.js";
+import { ApiTokenService } from "../identity/api-tokens.js";
+import { SettingsService } from "../identity/settings.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { KernelEvents } from "../infra/events/kernel-events.js";
+import { OrgLock } from "./org-lock.js";
 import type { OrgRole } from "./roles.js";
-type Trx = Transaction<KernelDatabase>;
 export type Org = {
     id: string;
     slug: string;
@@ -15,27 +17,34 @@ export type Org = {
 export declare const SLUG_RE: RegExp;
 /** 由名字生成 slug：转小写、非字母数字换 `-`、去首尾 `-`；为空则 `org-<6 位随机>`。 */
 export declare function slugFromName(name: string): string;
-/** 组织服务：创建、查询、修改与软删除。框架无关，由调用方注入依赖。 */
+/**
+ * Organizations: create, read, update and soft delete. A soft delete emits `org.deleted` on
+ * {@link KernelEvents} after the commit.
+ */
 export declare class OrgsService {
     private readonly db;
+    readonly txHost: TransactionHost;
     private readonly settings;
     private readonly apiTokens;
-    private readonly hooks;
-    constructor(db: KernelDb, settings: SettingsService, apiTokens: ApiTokenService, hooks?: {
-        /** 软删除提交之后（内核传：给该组织的渠道连接广播 `channel.changed`，长连接立即断开）。 */
-        afterDelete?: (orgId: string) => Promise<void>;
-    });
+    private readonly orgLock;
+    private readonly events;
+    /** Cancels the deleted org's running eval runs (in the delete's transaction). */
+    private readonly evalBudget;
+    constructor(db: KernelDb, txHost: TransactionHost, settings: SettingsService, apiTokens: ApiTokenService, orgLock: OrgLock, events: KernelEvents, 
+    /** Cancels the deleted org's running eval runs (in the delete's transaction). */
+    evalBudget: Pick<EvalBudget, "cancelRuns">);
     /**
-     * 建组织，创建者为 owner。传入 `opts.trx` 时在调用方的事务内执行（初始化向导与建账号同一事务）；
-     * 此时 slug 冲突同样转成 `org.slug_taken`，但该事务已中止，调用方只能回滚。
+     * Creates an org with the actor as owner, in the caller's transaction when there is one (the
+     * setup wizard creates it with the account); a slug conflict is `org.slug_taken` either way, but
+     * a caller's transaction is then aborted and can only roll back.
      */
     create(input: {
         name: string;
         slug?: string | undefined;
     }, actor: Account, opts?: {
-        trx?: Trx | undefined;
         actorTokenId?: string | undefined;
     }): Promise<Org>;
+    private createIn;
     /** 账号所属的（未软删除的）组织及其角色，按创建时间升序。 */
     listForAccount(accountId: string): Promise<(Org & {
         role: OrgRole;
@@ -46,16 +55,18 @@ export declare class OrgsService {
     })[]>;
     /** 未软删除的组织；不存在或已软删除为 undefined。 */
     get(orgId: string): Promise<Org | undefined>;
-    /** 改名 / slug（需 admin，锁内实时判定）。 */
+    /** Renames / re-slugs (needs admin, decided live under the org lock). */
     update(orgId: string, patch: {
         name?: string | undefined;
         slug?: string | undefined;
     }, actor: Account, actorTokenId?: string): Promise<Org>;
+    private updateIn;
     /**
-     * 软删除（需 owner，锁内实时判定）：同一事务吊销该组织的服务令牌、取消在执行的评测运行与挂着的目录申请、清空指向它的
-     * 会话当前组织；
-     * 提交后调用 `afterDelete`（渠道连接随组织失效：运行时读连接行时 join 组织过滤已删除的）。
+     * Soft delete (needs owner, decided live under the org lock): in the same transaction revokes
+     * the org's service tokens, cancels its running eval runs and pending catalog requests, and
+     * clears sessions' current org pointing at it; after the commit emits `org.deleted` (channel
+     * connections go with the org: the runtime's connection reads filter deleted orgs).
      */
     softDelete(orgId: string, actor: Account, actorTokenId?: string): Promise<void>;
+    private softDeleteIn;
 }
-export {};

package/dist/orgs/orgs.service.js

@@ -1,10 +1,27 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomBytes, randomUUID } from "node:crypto";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { cancelPendingRequests } from "../catalog/requests.service.js";
 import { ApiError } from "../errors.js";
-import { cancelEvalRuns } from "../evals/budget.js";
+import { EvalBudget } from "../evals/budget.js";
+import { ApiTokenService } from "../identity/api-tokens.js";
 import { audit } from "../identity/audit.js";
-import { lockOrgAndAuthorize } from "./org-lock.js";
+import { SettingsService } from "../identity/settings.js";
+import { afterCommit } from "../infra/database/after-commit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KernelEvents } from "../infra/events/kernel-events.js";
+import { OrgLock } from "./org-lock.js";
 /** 组织 slug：小写字母数字与 `-`，首尾不能是 `-`，1–40 个字符。 */
 export const SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
 const MAX_SLUG = 40;
@@ -52,53 +69,65 @@ async function slugGuard(p) {
         throw e;
     }
 }
-/** 组织服务：创建、查询、修改与软删除。框架无关，由调用方注入依赖。 */
-export class OrgsService {
+/**
+ * Organizations: create, read, update and soft delete. A soft delete emits `org.deleted` on
+ * {@link KernelEvents} after the commit.
+ */
+let OrgsService = class OrgsService {
     db;
+    txHost;
     settings;
     apiTokens;
-    hooks;
-    constructor(db, settings, apiTokens, hooks = {}) {
+    orgLock;
+    events;
+    evalBudget;
+    constructor(db, txHost, settings, apiTokens, orgLock, events, 
+    /** Cancels the deleted org's running eval runs (in the delete's transaction). */
+    evalBudget) {
         this.db = db;
+        this.txHost = txHost;
         this.settings = settings;
         this.apiTokens = apiTokens;
-        this.hooks = hooks;
+        this.orgLock = orgLock;
+        this.events = events;
+        this.evalBudget = evalBudget;
     }
     /**
-     * 建组织，创建者为 owner。传入 `opts.trx` 时在调用方的事务内执行（初始化向导与建账号同一事务）；
-     * 此时 slug 冲突同样转成 `org.slug_taken`，但该事务已中止，调用方只能回滚。
+     * Creates an org with the actor as owner, in the caller's transaction when there is one (the
+     * setup wizard creates it with the account); a slug conflict is `org.slug_taken` either way, but
+     * a caller's transaction is then aborted and can only roll back.
      */
     async create(input, actor, opts = {}) {
-        const { trx, actorTokenId } = opts;
-        // 在调用方事务内读设置：调用方已占着一个连接时再向池要第二个，并发下可能把池耗尽
-        const { orgCreation } = await this.settings.get(trx);
+        return slugGuard(this.createIn(input, actor, opts.actorTokenId));
+    }
+    async createIn(input, actor, actorTokenId) {
+        // read in the context's transaction: a caller holding a connection asking the pool for a
+        // second one could exhaust it under load
+        const { orgCreation } = await this.settings.get();
         if (orgCreation === "enterprise_admin" && !actor.isEnterpriseAdmin) {
             throw new ApiError("org.creation_disabled", "Only enterprise admins can create organizations");
         }
         const name = checkName(input.name);
         const slug = input.slug ?? slugFromName(name);
         checkSlug(slug);
-        const run = async (t) => {
-            const row = await t
-                .insertInto("orgs")
-                .values({ id: randomUUID(), slug, name, created_by: actor.id })
-                .returning(["id", "slug", "name", "created_at"])
-                .executeTakeFirstOrThrow();
-            await t
-                .insertInto("memberships")
-                .values({ org_id: row.id, account_id: actor.id, role: "owner" })
-                .execute();
-            await audit(t, {
-                actorAccountId: actor.id,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-                orgId: row.id,
-                action: "org.created",
-                target: row.id,
-                detail: { slug, name },
-            });
-            return toOrg(row);
-        };
-        return slugGuard(trx ? run(trx) : this.db.transaction().execute(run));
+        const row = await this.db
+            .insertInto("orgs")
+            .values({ id: randomUUID(), slug, name, created_by: actor.id })
+            .returning(["id", "slug", "name", "created_at"])
+            .executeTakeFirstOrThrow();
+        await this.db
+            .insertInto("memberships")
+            .values({ org_id: row.id, account_id: actor.id, role: "owner" })
+            .execute();
+        await audit(this.db.db, {
+            actorAccountId: actor.id,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            orgId: row.id,
+            action: "org.created",
+            target: row.id,
+            detail: { slug, name },
+        });
+        return toOrg(row);
     }
     /** 账号所属的（未软删除的）组织及其角色，按创建时间升序。 */
     async listForAccount(accountId) {
@@ -137,7 +166,7 @@ export class OrgsService {
             .executeTakeFirst();
         return row && toOrg(row);
     }
-    /** 改名 / slug（需 admin，锁内实时判定）。 */
+    /** Renames / re-slugs (needs admin, decided live under the org lock). */
     async update(orgId, patch, actor, actorTokenId) {
         const values = {};
         if (patch.name !== undefined)
@@ -146,64 +175,88 @@ export class OrgsService {
             checkSlug(patch.slug);
             values.slug = patch.slug;
         }
-        return slugGuard(this.db.transaction().execute(async (trx) => {
-            const { org: before } = await lockOrgAndAuthorize(trx, orgId, actor.id, "org.update");
-            if (Object.keys(values).length === 0) {
-                const row = await trx
-                    .selectFrom("orgs")
-                    .select(["id", "slug", "name", "created_at"])
-                    .where("id", "=", orgId)
-                    .executeTakeFirstOrThrow();
-                return toOrg(row);
-            }
-            const row = await trx
-                .updateTable("orgs")
-                .set(values)
+        return slugGuard(this.updateIn(orgId, values, actor, actorTokenId));
+    }
+    async updateIn(orgId, values, actor, actorTokenId) {
+        const { org: before } = await this.orgLock.lockAndAuthorize(orgId, actor.id, "org.update");
+        if (Object.keys(values).length === 0) {
+            const row = await this.db
+                .selectFrom("orgs")
+                .select(["id", "slug", "name", "created_at"])
                 .where("id", "=", orgId)
-                .returning(["id", "slug", "name", "created_at"])
                 .executeTakeFirstOrThrow();
-            await audit(trx, {
-                actorAccountId: actor.id,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-                orgId,
-                action: "org.updated",
-                target: orgId,
-                detail: { before, after: values },
-            });
             return toOrg(row);
-        }));
+        }
+        const row = await this.db
+            .updateTable("orgs")
+            .set(values)
+            .where("id", "=", orgId)
+            .returning(["id", "slug", "name", "created_at"])
+            .executeTakeFirstOrThrow();
+        await audit(this.db.db, {
+            actorAccountId: actor.id,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            orgId,
+            action: "org.updated",
+            target: orgId,
+            detail: { before, after: values },
+        });
+        return toOrg(row);
     }
     /**
-     * 软删除（需 owner，锁内实时判定）：同一事务吊销该组织的服务令牌、取消在执行的评测运行与挂着的目录申请、清空指向它的
-     * 会话当前组织；
-     * 提交后调用 `afterDelete`（渠道连接随组织失效：运行时读连接行时 join 组织过滤已删除的）。
+     * Soft delete (needs owner, decided live under the org lock): in the same transaction revokes
+     * the org's service tokens, cancels its running eval runs and pending catalog requests, and
+     * clears sessions' current org pointing at it; after the commit emits `org.deleted` (channel
+     * connections go with the org: the runtime's connection reads filter deleted orgs).
      */
     async softDelete(orgId, actor, actorTokenId) {
-        await this.db.transaction().execute(async (trx) => {
-            await lockOrgAndAuthorize(trx, orgId, actor.id, "org.delete");
-            await trx
-                .updateTable("orgs")
-                .set({ deleted_at: sql `now()` })
-                .where("id", "=", orgId)
-                .execute();
-            await this.apiTokens.revokeAllForOrg(orgId, trx);
-            // 组织删除后评测运行不再花钱：显式取消（审计带原因）
-            await cancelEvalRuns(trx, { orgId }, { accountId: actor.id, ...(actorTokenId !== undefined && { tokenId: actorTokenId }) }, "org_deleted");
-            // 挂着的目录申请（含已交企业管理员的）一并取消
-            await cancelPendingRequests(trx, { orgId }, actor.id, "org_deleted", actorTokenId !== undefined ? { actorTokenId } : {});
-            await trx
-                .updateTable("sessions")
-                .set({ current_org_id: null })
-                .where("current_org_id", "=", orgId)
-                .execute();
-            await audit(trx, {
-                actorAccountId: actor.id,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-                orgId,
-                action: "org.deleted",
-                target: orgId,
-            });
+        await this.softDeleteIn(orgId, actor, actorTokenId);
+    }
+    async softDeleteIn(orgId, actor, actorTokenId) {
+        await this.orgLock.lockAndAuthorize(orgId, actor.id, "org.delete");
+        await this.db
+            .updateTable("orgs")
+            .set({ deleted_at: sql `now()` })
+            .where("id", "=", orgId)
+            .execute();
+        await this.apiTokens.revokeAllForOrg(orgId);
+        // eval runs of a deleted org stop spending: cancelled explicitly (audited with the reason)
+        await this.evalBudget.cancelRuns({ orgId }, { accountId: actor.id, ...(actorTokenId !== undefined && { tokenId: actorTokenId }) }, "org_deleted");
+        // pending catalog requests (including those passed to enterprise admins) are cancelled too
+        await cancelPendingRequests(this.db.db, { orgId }, actor.id, "org_deleted", actorTokenId !== undefined ? { actorTokenId } : {});
+        await this.db
+            .updateTable("sessions")
+            .set({ current_org_id: null })
+            .where("current_org_id", "=", orgId)
+            .execute();
+        await audit(this.db.db, {
+            actorAccountId: actor.id,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            orgId,
+            action: "org.deleted",
+            target: orgId,
         });
-        await this.hooks.afterDelete?.(orgId);
+        // channel connections follow the org after the root commit (none after a rollback)
+        afterCommit(() => this.events.emit("org.deleted", { orgId }));
     }
-}
+};
+__decorate([
+    Transactional()
+], OrgsService.prototype, "createIn", null);
+__decorate([
+    Transactional()
+], OrgsService.prototype, "updateIn", null);
+__decorate([
+    Transactional()
+], OrgsService.prototype, "softDeleteIn", null);
+OrgsService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(SettingsService)),
+    __param(3, Inject(ApiTokenService)),
+    __param(4, Inject(OrgLock)),
+    __param(5, Inject(KernelEvents)),
+    __param(6, Inject(EvalBudget))
+], OrgsService);
+export { OrgsService };

package/dist/orgs/settings.controller.d.ts

@@ -1,6 +1,6 @@
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "./org.guard.js";
-import { type OrgSandboxLimits, type OrgSettings, type OrgSettingsDeployment, type OrgSettingsPatch, type OrgSettingsService } from "./settings.service.js";
+import { type OrgSandboxLimits, type OrgSettings, type OrgSettingsDeployment, type OrgSettingsPatch, OrgSettingsService } from "./settings.service.js";
 /**
  * 组织设置（`/api/v1/orgs/:orgId/settings`）：成员可读，修改需 `org.update`（admin）。
  * 响应带 `deployment`（部署默认值，如沙箱出站），设置页据此展示「跟随部署」时的实际取值；