@capybara-hq/kernel 0.1.0-rc.3 → 0.1.0-rc.5

package/dist/files/previewers.js

@@ -12,6 +12,7 @@ import { Inject, Injectable, Optional } from "@nestjs/common";
 import { sql } from "kysely";
 import { ConversationFiles } from "../conversations/files.js";
 import { ApiError } from "../errors.js";
+import { EffectiveConfigs } from "../extensions/effective-config.js";
 import { ExtensionHost } from "../extensions/host.js";
 import { audit } from "../identity/audit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
@@ -71,7 +72,7 @@ let PreviewerRegistry = class PreviewerRegistry {
     txHost;
     timeoutMs;
     d;
-    constructor(kdb, host, files, storage, log, txHost, timeoutMs = FILE_PREVIEW_TIMEOUT_MS) {
+    constructor(kdb, host, files, storage, effective, log, txHost, timeoutMs = FILE_PREVIEW_TIMEOUT_MS) {
         this.txHost = txHost;
         this.timeoutMs = timeoutMs;
         this.d = {
@@ -82,6 +83,7 @@ let PreviewerRegistry = class PreviewerRegistry {
             enabledPlugins: (orgId) => host.enabledPlugins(orgId),
             files,
             storage,
+            effective,
             log,
         };
     }
@@ -186,8 +188,33 @@ let PreviewerRegistry = class PreviewerRegistry {
         const file = await this.d.files.file(orgId, conversationId, viewer, fileId);
         return (await this.accepting(orgId, file)).map(item);
     }
+    /**
+     * The org's enabled previewers that take the file, each with its extension's effective config
+     * for the org. An extension whose effective config is not valid in the org (or cannot be read)
+     * previews nothing there (layering spec A §6): its previewers are left out, so the next one or a
+     * built-in takes the file.
+     */
     async accepting(orgId, file) {
-        return (await this.ordered(orgId)).filter((l) => !l.disabled && previewerAccepts(l.previewer, file));
+        const taking = (await this.ordered(orgId)).filter((l) => !l.disabled && previewerAccepts(l.previewer, file));
+        const configs = new Map();
+        for (const plugin of new Set(taking.map((l) => l.plugin))) {
+            try {
+                const e = await this.d.effective.get(orgId, plugin);
+                configs.set(plugin, e.ok ? { config: e.config } : null);
+            }
+            catch (err) {
+                this.d.log.warn("file previewer left out: cannot read its effective config", {
+                    orgId,
+                    plugin,
+                    err,
+                });
+                configs.set(plugin, null);
+            }
+        }
+        return taking.flatMap((l) => {
+            const c = configs.get(l.plugin);
+            return c ? [{ ...l, config: c.config }] : [];
+        });
     }
     /**
      * Renders a view previewer for one file: 404 `ui.not_found` when it does not take the file (or is
@@ -224,6 +251,7 @@ let PreviewerRegistry = class PreviewerRegistry {
                             accountId: t.accountId,
                             conversationId: t.conversationId,
                             locale: t.locale,
+                            config: l.config,
                             signal: s,
                             file: {
                                 id: file.id,
@@ -289,9 +317,10 @@ PreviewerRegistry = __decorate([
     __param(1, Inject(ExtensionHost)),
     __param(2, Inject(ConversationFiles)),
     __param(3, Inject(StorageService)),
-    __param(4, Inject(KERNEL_LOGGER)),
-    __param(5, Inject(TransactionHost)),
-    __param(6, Optional()),
-    __param(6, Inject(FILE_PREVIEW_TIMEOUT))
+    __param(4, Inject(EffectiveConfigs)),
+    __param(5, Inject(KERNEL_LOGGER)),
+    __param(6, Inject(TransactionHost)),
+    __param(7, Optional()),
+    __param(7, Inject(FILE_PREVIEW_TIMEOUT))
 ], PreviewerRegistry);
 export { PreviewerRegistry };

package/dist/http/api.module.js

@@ -13,22 +13,31 @@ import { SetupController } from "../admin/setup.controller.js";
 import { AgentsController } from "../agents/agents.controller.js";
 import { AgentsModule } from "../agents/agents.module.js";
 import { ModelsController } from "../agents/models.controller.js";
-import { AgentTemplatesController } from "../agents/templates.controller.js";
+import { PendingConnectorsController } from "../agents/pending-connectors.controller.js";
+import { ReadinessController } from "../agents/readiness.controller.js";
+import { AgentSaveAsTemplateController, AgentTemplatesController, } from "../agents/templates.controller.js";
+import { BackgroundController } from "../background/background.controller.js";
+import { BackgroundModule } from "../background/background.module.js";
 import { AdminCatalogController } from "../catalog/admin-catalog.controller.js";
 import { CatalogModule } from "../catalog/catalog.module.js";
-import { MarketplacesController } from "../catalog/marketplaces.controller.js";
+import { AdminComponentsController, OrgComponentsController, } from "../catalog/component-scope.controller.js";
+import { MarketplacesController, OrgMarketplacesController, } from "../catalog/marketplaces.controller.js";
 import { AdminCatalogRequestsController, OrgCatalogController, } from "../catalog/org-catalog.controller.js";
+import { OrgExtensionConfigsController, OrgExtensionOverridesController, OrgExtensionToolSwitchesController, } from "../catalog/org-extension.controller.js";
+import { OrgOwnedPluginsController, OrgPluginUploadsController, } from "../catalog/org-plugin-uploads.controller.js";
 import { ChannelsModule } from "../channels/channels.module.js";
 import { ChannelConnectionsController } from "../channels/connections.controller.js";
 import { AttachmentsController } from "../conversations/attachments.controller.js";
 import { ConversationsController } from "../conversations/conversations.controller.js";
 import { ConversationsModule } from "../conversations/conversations.module.js";
+import { EnvironmentsController } from "../environments/environments.controller.js";
+import { EnvironmentsModule } from "../environments/environments.module.js";
 import { EvalsModule } from "../evals/evals.module.js";
 import { EvalRunsController } from "../evals/runs.controller.js";
 import { EvalSetsController } from "../evals/sets.controller.js";
 import { TrajectoryController } from "../evals/trajectory.controller.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
-import { OrgExtensionConfigsController } from "../extensions/org-config.controller.js";
+import { ExtensionPointDefaultsController } from "../extensions/point-defaults.controller.js";
 import { FilesModule } from "../files/files.module.js";
 import { FilePreviewersController } from "../files/previewers.controller.js";
 import { AuthController } from "../identity/auth.controller.js";
@@ -37,6 +46,7 @@ import { IdentityModule } from "../identity/identity.module.js";
 import { MeController } from "../identity/me.controller.js";
 import { BindController, MeIdentitiesController, SsoController, } from "../identity/sso.controller.js";
 import { InboxModule } from "../inbox/inbox.module.js";
+import { PlatformInboxController } from "../inbox/platform-inbox.controller.js";
 import { ModelsModule } from "../models/models.module.js";
 import { ModelPurposesController } from "../models/purposes.controller.js";
 import { DirectorySyncController } from "../orgs/directory-sync.controller.js";
@@ -54,6 +64,7 @@ import { StorageModule } from "../storage/storage.module.js";
 import { ApprovalsController, ToolGrantsController } from "../tools/approvals.controller.js";
 import { ConnectorContentController } from "../tools/connector-content.controller.js";
 import { ConnectorsController } from "../tools/connectors.controller.js";
+import { ExtensionToolsController } from "../tools/extension-tools.controller.js";
 import { OAuthCallbackController, OAuthConnectController, } from "../tools/oauth/oauth.controller.js";
 import { QuestionsController } from "../tools/questions.controller.js";
 import { ToolsModule } from "../tools/tools.module.js";
@@ -70,24 +81,35 @@ const CONTROLLERS = [
     AdminController,
     AdminExtensionsController,
     AdminCatalogController,
+    AdminComponentsController,
     MarketplacesController,
+    OrgMarketplacesController,
     OrgExtensionConfigsController,
+    OrgExtensionOverridesController,
+    OrgExtensionToolSwitchesController,
     AgentsController,
     AgentTemplatesController,
+    AgentSaveAsTemplateController,
+    PendingConnectorsController,
     ModelsController,
+    ReadinessController,
     ConversationsController,
+    BackgroundController,
+    EnvironmentsController,
     AttachmentsController,
     SkillsController,
     SkillChangesController,
     AgentSkillsController,
     InvocableSkillsController,
     InboxController,
+    PlatformInboxController,
     ConversationStreamController,
     ConnectorContentController,
     ConnectorsController,
     ApprovalsController,
     ToolGrantsController,
     QuestionsController,
+    ExtensionToolsController,
     OAuthConnectController,
     OAuthCallbackController,
     SsoController,
@@ -97,11 +119,15 @@ const CONTROLLERS = [
     DirectorySyncController,
     UiController,
     FilePreviewersController,
+    ExtensionPointDefaultsController,
     TrajectoryController,
     EvalSetsController,
     EvalRunsController,
     ModelPurposesController,
     OrgCatalogController,
+    OrgPluginUploadsController,
+    OrgOwnedPluginsController,
+    OrgComponentsController,
     AdminCatalogRequestsController,
 ];
 /**
@@ -126,6 +152,8 @@ ApiModule = __decorate([
             ToolsModule,
             AgentsModule,
             ConversationsModule,
+            BackgroundModule,
+            EnvironmentsModule,
             RuntimeModule,
             ChannelsModule,
             EvalsModule,

package/dist/http/app.d.ts

@@ -45,7 +45,7 @@ export interface CreateHttpAppOptions {
     replicaId?: string | undefined;
     /**
      * The size limit for package uploads ({@link PACKAGE_UPLOAD_ROUTES}: extension packages and
-     * enterprise catalog packages, `application/octet-stream`), i.e. `packages.maxBytes`. The route
+     * platform catalog packages, `application/octet-stream`), i.e. `packages.maxBytes`. The route
      * bodyLimit is one byte more: a package exactly one byte over reaches the handler and returns
      * `extension.package_too_large`; larger ones are refused by Fastify itself (413
      * `payload_too_large`).
@@ -56,11 +56,20 @@ export interface CreateHttpAppOptions {
 export declare const EXTENSION_PACKAGE_UPLOAD_ROUTE = "/api/v1/admin/extensions/packages/file";
 /** The plugin package upload route of the catalog import (Fastify route template). */
 export declare const CATALOG_UPLOAD_ROUTE = "/api/v1/admin/catalog/import/file";
+/** The platform skill version upload route (a skill package zip as the raw body). */
+export declare const COMPONENT_SKILL_UPLOAD_ROUTE = "/api/v1/admin/components/skill/:id/versions";
 /**
  * The upload routes that take raw bytes (`application/octet-stream`, limit `packages.maxBytes`,
- * the enterprise admin is authenticated before the body is read).
+ * the super admin is authenticated before the body is read).
  */
 export declare const PACKAGE_UPLOAD_ROUTES: ReadonlySet<string>;
+/** An org admin's plugin package upload (spec §14, ruling P3-7; a tgz as the raw body). */
+export declare const ORG_PLUGIN_UPLOAD_ROUTE = "/api/v1/orgs/:orgId/catalog/uploads/file";
+/**
+ * The org routes that take raw package bytes (limit `packages.maxBytes`): before the body is read
+ * the caller is authenticated as a person with the org role of `catalog.upload` (ruling P3-29).
+ */
+export declare const ORG_PACKAGE_UPLOAD_ROUTES: ReadonlySet<string>;
 /**
  * Sets up the Fastify side of the kernel's Nest application (built by `buildKernelApp` from
  * `KernelModule`, which provides the health endpoints and the API) without connecting to anything,

package/dist/http/app.js

@@ -3,9 +3,11 @@ import fastifyCookie from "@fastify/cookie";
 import { ApiError, errorBody } from "../errors.js";
 import { AccountsService } from "../identity/accounts.js";
 import { ApiTokenService } from "../identity/api-tokens.js";
-import { authorizeEnterpriseAdmin } from "../identity/auth.guard.js";
+import { authenticateOrgUploader, authorizeSuperAdmin, } from "../identity/auth.guard.js";
 import { SessionService } from "../identity/sessions.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
 import { withLogContext } from "../log-context.js";
+import { authorizeOrgAction } from "../orgs/org.guard.js";
 import { redactPath } from "./error.filter.js";
 import { registerGatewayRoutes } from "./gateway-routes.js";
 import { createPluginRouter, registerPluginDispatch, staticRouteTable, } from "./plugin-dispatch.js";
@@ -13,14 +15,24 @@ import { createPluginRouter, registerPluginDispatch, staticRouteTable, } from ".
 export const EXTENSION_PACKAGE_UPLOAD_ROUTE = "/api/v1/admin/extensions/packages/file";
 /** The plugin package upload route of the catalog import (Fastify route template). */
 export const CATALOG_UPLOAD_ROUTE = "/api/v1/admin/catalog/import/file";
+/** The platform skill version upload route (a skill package zip as the raw body). */
+export const COMPONENT_SKILL_UPLOAD_ROUTE = "/api/v1/admin/components/skill/:id/versions";
 /**
  * The upload routes that take raw bytes (`application/octet-stream`, limit `packages.maxBytes`,
- * the enterprise admin is authenticated before the body is read).
+ * the super admin is authenticated before the body is read).
  */
 export const PACKAGE_UPLOAD_ROUTES = new Set([
     EXTENSION_PACKAGE_UPLOAD_ROUTE,
     CATALOG_UPLOAD_ROUTE,
+    COMPONENT_SKILL_UPLOAD_ROUTE,
 ]);
+/** An org admin's plugin package upload (spec §14, ruling P3-7; a tgz as the raw body). */
+export const ORG_PLUGIN_UPLOAD_ROUTE = "/api/v1/orgs/:orgId/catalog/uploads/file";
+/**
+ * The org routes that take raw package bytes (limit `packages.maxBytes`): before the body is read
+ * the caller is authenticated as a person with the org role of `catalog.upload` (ruling P3-29).
+ */
+export const ORG_PACKAGE_UPLOAD_ROUTES = new Set([ORG_PLUGIN_UPLOAD_ROUTE]);
 /** Paths without an access log line (probes). */
 const QUIET_PATHS = new Set(["/healthz", "/readyz"]);
 /**
@@ -92,11 +104,12 @@ export async function createHttpApp(opts, app) {
         if (LARGE_BODY_ROUTES.has(r.url) && [r.method].flat().includes("POST")) {
             r.bodyLimit = LARGE_BODY_LIMIT;
         }
-        if (PACKAGE_UPLOAD_ROUTES.has(r.url) && opts.packageMaxBytes !== undefined) {
+        const upload = PACKAGE_UPLOAD_ROUTES.has(r.url) || ORG_PACKAGE_UPLOAD_ROUTES.has(r.url);
+        if (upload && opts.packageMaxBytes !== undefined) {
             r.bodyLimit = opts.packageMaxBytes + 1;
         }
     });
-    // 读请求体之前：包上传（插件包、企业目录包）先认证（未认证 / 非企业管理员的大请求体不读进内存）；其余内核路由不收
+    // 读请求体之前：包上传（插件包、平台目录包）先认证（未认证 / 非超级管理员的大请求体不读进内存）；其余内核路由不收
     // application/octet-stream（415）。插件路由 /plugins/* 在自己的作用域里收任何类型，不受影响
     let authServices;
     const services = () => {
@@ -119,7 +132,20 @@ export async function createHttpApp(opts, app) {
             return;
         if (req.method === "POST" && PACKAGE_UPLOAD_ROUTES.has(req.routeOptions.url ?? "")) {
             try {
-                await authorizeEnterpriseAdmin(req, services());
+                await authorizeSuperAdmin(req, services());
+            }
+            catch (e) {
+                return sendError(reply, e, req.method, req.url);
+            }
+            return;
+        }
+        if (req.method === "POST" && ORG_PACKAGE_UPLOAD_ROUTES.has(req.routeOptions.url ?? "")) {
+            try {
+                // the org admin role before the body (ruling P3-29): no one else makes the kernel buffer
+                // a package-sized body
+                const principal = await authenticateOrgUploader(req, services());
+                const orgId = req.params.orgId ?? "";
+                await authorizeOrgAction(app.get(KernelDb, { strict: false }).db, principal, orgId, "catalog.upload");
             }
             catch (e) {
                 return sendError(reply, e, req.method, req.url);

package/dist/http/nest-logger.d.ts

@@ -1,12 +1,13 @@
 import type { Logger } from "@capybara-hq/plugin-sdk";
 import type { LoggerService } from "@nestjs/common";
-/** 可选带 debug 的 logger（内核 logger 有 debug；插件契约的 Logger 没有）。 */
+/** A logger with an optional debug (the kernel logger has one; the SDK Logger does not). */
 type MaybeDebugLogger = Logger & {
     debug?: (msg: string, fields?: Record<string, unknown>) => void;
 };
 /**
- * 把 Nest 自身的日志转给内核 logger：`log`（启动时的模块加载、路由映射等，每次启动几十行）降为 debug，
- * `warn` / `error` 原级别转发，`debug` / `verbose` 丢弃。logger 没有 debug 时 `log` 也丢弃。
+ * Forwards Nest's own log lines to the kernel logger, as octok does: `log` (module loading,
+ * the `Mapped {/api/v1/…, GET} route` lines at startup) at info, `warn` / `error` as they are,
+ * `debug` / `verbose` at debug. Nest's context name becomes the record's `context`.
  */
 export declare class NestLogAdapter implements LoggerService {
     private readonly logger;
@@ -14,7 +15,7 @@ export declare class NestLogAdapter implements LoggerService {
     log(message: unknown, ...params: unknown[]): void;
     warn(message: unknown, ...params: unknown[]): void;
     error(message: unknown, ...params: unknown[]): void;
-    debug(): void;
-    verbose(): void;
+    debug(message: unknown, ...params: unknown[]): void;
+    verbose(message: unknown, ...params: unknown[]): void;
 }
 export {};

package/dist/http/nest-logger.js

@@ -1,6 +1,7 @@
 /**
- * 把 Nest 自身的日志转给内核 logger：`log`（启动时的模块加载、路由映射等，每次启动几十行）降为 debug，
- * `warn` / `error` 原级别转发，`debug` / `verbose` 丢弃。logger 没有 debug 时 `log` 也丢弃。
+ * Forwards Nest's own log lines to the kernel logger, as octok does: `log` (module loading,
+ * the `Mapped {/api/v1/…, GET} route` lines at startup) at info, `warn` / `error` as they are,
+ * `debug` / `verbose` at debug. Nest's context name becomes the record's `context`.
  */
 export class NestLogAdapter {
     logger;
@@ -8,7 +9,7 @@ export class NestLogAdapter {
         this.logger = logger;
     }
     log(message, ...params) {
-        this.logger.debug?.(String(message), fields(params));
+        this.logger.info(String(message), fields(params));
     }
     warn(message, ...params) {
         this.logger.warn(String(message), fields(params));
@@ -16,13 +17,26 @@ export class NestLogAdapter {
     error(message, ...params) {
         this.logger.error(String(message), fields(params));
     }
-    debug() { }
-    verbose() { }
+    debug(message, ...params) {
+        this.logger.debug?.(String(message), fields(params));
+    }
+    verbose(message, ...params) {
+        this.logger.debug?.(String(message), fields(params));
+    }
 }
-/** Nest 把上下文名（如 `RoutesResolver`）、错误堆栈作为额外参数传入。 */
+/**
+ * Nest passes its context name (e.g. `RoutesResolver`) last and, for errors, the stack before it. The
+ * name becomes `context` (the pretty `[context=…]`), anything else `nest`.
+ */
 function fields(params) {
-    const ctx = params.filter((p) => p !== undefined);
-    if (ctx.length === 0)
-        return undefined;
-    return { nest: ctx.length === 1 ? ctx[0] : ctx };
+    const rest = params.filter((p) => p !== undefined);
+    const last = rest.at(-1);
+    const out = {};
+    if (typeof last === "string" && /^[A-Za-z][\w.-]*$/.test(last)) {
+        out.context = last;
+        rest.pop();
+    }
+    if (rest.length > 0)
+        out.nest = rest.length === 1 ? rest[0] : rest;
+    return Object.keys(out).length > 0 ? out : undefined;
 }

package/dist/identity/accounts.d.ts

@@ -3,31 +3,31 @@ import { SetupLock } from "../admin/setup-lock.js";
 import type { AccountsTable } from "../db/kernel-schema.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
-import { EnterpriseAdminLock } from "./enterprise-admin.js";
+import { SuperAdminLock } from "./super-admin.js";
 export interface Account {
     id: string;
     displayName: string;
     email: string | null;
     status: "active" | "disabled";
-    isEnterpriseAdmin: boolean;
+    isSuperAdmin: boolean;
     createdAt: Date;
 }
-/** 企业管理员可改的账号字段。 */
+/** 超级管理员可改的账号字段。 */
 export type AccountPatch = {
     displayName?: string;
     status?: "active" | "disabled";
-    isEnterpriseAdmin?: boolean;
+    isSuperAdmin?: boolean;
 };
 /** 构造 `Account` 所需的 accounts 列（供跨表查询 select 使用）。 */
-export declare const ACCOUNT_COLUMNS: readonly ["accounts.id", "accounts.display_name", "accounts.email", "accounts.status", "accounts.is_enterprise_admin", "accounts.created_at"];
-type AccountRow = Pick<Selectable<AccountsTable>, "id" | "display_name" | "email" | "status" | "is_enterprise_admin" | "created_at">;
+export declare const ACCOUNT_COLUMNS: readonly ["accounts.id", "accounts.display_name", "accounts.email", "accounts.status", "accounts.is_super_admin", "accounts.created_at"];
+type AccountRow = Pick<Selectable<AccountsTable>, "id" | "display_name" | "email" | "status" | "is_super_admin" | "created_at">;
 export declare function toAccount(r: AccountRow): Account;
 export interface LocalAccountInput {
     login: string;
     password: string;
     displayName: string;
     email?: string;
-    enterpriseAdmin?: boolean;
+    superAdmin?: boolean;
 }
 /**
  * Accounts: local account creation, authentication and administration. Every write is
@@ -39,7 +39,7 @@ export declare class AccountsService {
     readonly txHost: TransactionHost;
     private readonly adminLock;
     private readonly setupLock;
-    constructor(db: KernelDb, txHost: TransactionHost, adminLock: EnterpriseAdminLock, setupLock: SetupLock);
+    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock, setupLock: SetupLock);
     /** Checks the password length and hashes it (scrypt, slow): for callers that hash before their transaction opens. */
     hashNewPassword(password: string): Promise<string>;
     /**
@@ -49,28 +49,28 @@ export declare class AccountsService {
      */
     createLocal(input: LocalAccountInput, passwordHash?: string): Promise<Account>;
     /**
-     * An enterprise admin creates a local account (optionally an enterprise admin): under the
-     * enterprise admin lock, re-checks that the actor is still an active enterprise admin (else
+     * A super admin creates a local account (optionally a super admin): under the
+     * super admin lock, re-checks that the actor is still an active super admin (else
      * `forbidden`), creates the account and audits `account.created`. The hash is computed before
      * the lock.
      */
     createByAdmin(input: LocalAccountInput, actorAccountId: string, actorTokenId?: string): Promise<Account>;
     private createByAdminIn;
     /**
-     * CLI: creates an enterprise admin without checking whether the deployment is set up; a taken
+     * CLI: creates a super admin without checking whether the deployment is set up; a taken
      * login → `account.login_taken`.
      */
-    createEnterpriseAdmin(input: EnterpriseAdminInput): Promise<Account>;
+    createSuperAdmin(input: SuperAdminInput): Promise<Account>;
     /**
-     * CLI `admin create --if-none`: creates an enterprise admin only when no active one exists. The
+     * CLI `admin create --if-none`: creates a super admin only when no active one exists. The
      * check and the insert run in one transaction under {@link SetupLock}, the lock the web setup
      * takes, so concurrent runs (and a concurrent web setup) create exactly one. Returns undefined
-     * when an active enterprise admin already exists; a taken login still throws
+     * when an active super admin already exists; a taken login still throws
      * `account.login_taken`.
      */
-    createEnterpriseAdminIfNone(input: EnterpriseAdminInput): Promise<Account | undefined>;
-    private createEnterpriseAdminIfNoneIn;
-    private insertEnterpriseAdmin;
+    createSuperAdminIfNone(input: SuperAdminInput): Promise<Account | undefined>;
+    private createSuperAdminIfNoneIn;
+    private insertSuperAdmin;
     authenticateLocal(login: string, password: string): Promise<Account | null>;
     /** 按账号 id 校验本地密码（改密码时核对旧密码）；没有本地密码、超长或不符 → false。 */
     verifyPassword(accountId: string, password: string): Promise<boolean>;
@@ -92,7 +92,7 @@ export declare class AccountsService {
     private changePasswordIn;
     update(id: string, patch: AccountPatch, actorAccountId: string, actorTokenId?: string): Promise<Account>;
     /**
-     * An enterprise admin changes an account. Disabling (`status: "disabled"`) revokes the
+     * A super admin changes an account. Disabling (`status: "disabled"`) revokes the
      * account's sessions (`sessions.revoked_at`) and personal tokens in **the same PG transaction**,
      * all or nothing; returns the revoked session ids, whose Redis markers the caller writes after
      * the commit (the fast path; a failure is only a warning: auth reads PG).
@@ -102,35 +102,35 @@ export declare class AccountsService {
         revokedSessionIds: string[];
     }>;
     /**
-     * The CLI's `capybara admin grant|revoke <login>` (no actor account): changes the enterprise
-     * admin flag by local login under the enterprise admin lock; revoking keeps the
-     * {@link updateAccount} "last active enterprise admin" check (`account.last_enterprise_admin`),
+     * The CLI's `capybara admin grant|revoke <login>` (no actor account): changes the super
+     * admin flag by local login under the super admin lock; revoking keeps the
+     * {@link updateAccount} "last active super admin" check (`account.last_super_admin`),
      * decided under the lock, so it cannot race a web revoke into none. Audit `account.updated`
      * without an actor, `detail.via = "cli"`. Already in the target state → no change and no audit
      * (`changed: false`). Unknown login → `account.not_found`.
      */
-    setEnterpriseAdminByLogin(login: string, isEnterpriseAdmin: boolean): Promise<{
+    setSuperAdminByLogin(login: string, isSuperAdmin: boolean): Promise<{
         account: Account;
         changed: boolean;
     }>;
-    private setEnterpriseAdminIn;
+    private setSuperAdminIn;
     /** 全部账号数（含停用的；后台概览）。 */
     count(): Promise<number>;
-    /** Active (status = active) enterprise admins, in the context's transaction when there is one. */
-    countEnterpriseAdmins(): Promise<number>;
+    /** Active (status = active) super admins, in the context's transaction when there is one. */
+    countSuperAdmins(): Promise<number>;
     /** Inserts the account, its local identity and password; a taken login → `account.login_taken`. */
     private insertLocal;
     /** Writes (or replaces) the local password hash; a missing account → `account.not_found`. */
     private writePassword;
     /**
-     * Changes the account under the enterprise admin lock the caller holds: updates the row,
-     * re-checks "the last active enterprise admin", audits `account.updated`; disabling revokes the
+     * Changes the account under the super admin lock the caller holds: updates the row,
+     * re-checks "the last active super admin", audits `account.updated`; disabling revokes the
      * account's sessions and personal tokens.
      */
     private applyUpdate;
 }
-/** Input of the CLI enterprise admin creation. */
-export interface EnterpriseAdminInput {
+/** Input of the CLI super admin creation. */
+export interface SuperAdminInput {
     login: string;
     password: string;
     displayName: string;