@capybara-hq/kernel 0.1.0-rc.3 → 0.1.0-rc.5

package/dist/infra/tokens.js

@@ -1,6 +1,11 @@
 /** Injection tokens of the global infra modules. */
-/** The process logger (`KernelLogger`). */
+/**
+ * A class's logger (`KernelLogger`): the process logger with `context` set to the injecting class's
+ * name. Transient, so `app.get` cannot resolve it; use `KERNEL_ROOT_LOGGER` outside an injection.
+ */
 export const KERNEL_LOGGER = Symbol("KERNEL_LOGGER");
+/** The process logger itself (`KernelLogger`), without a context. */
+export const KERNEL_ROOT_LOGGER = Symbol("KERNEL_ROOT_LOGGER");
 /** The startup input of `KernelConfigService`: `{ config, env }`. */
 export const KERNEL_CONFIG_INPUT = Symbol("KERNEL_CONFIG_INPUT");
 /** The Kysely pool, untyped (`Kysely<any>`); infra only, services inject `KernelDb`. */

package/dist/kernel.module.js

@@ -33,6 +33,8 @@ import { KernelLifecycle } from "./lifecycle/kernel-lifecycle.js";
 import { KERNEL_APP_OPTIONS } from "./lifecycle/tokens.js";
 import { createConfiguredLogger } from "./log-config.js";
 import { KERNEL_OVERRIDE_TOKENS } from "./overrides.js";
+import { PlatformModule } from "./platform/platform.module.js";
+import { PlatformOpsModule } from "./platform/platform-ops.module.js";
 import { GatewayModule } from "./roles/gateway.module.js";
 import { WorkerModule } from "./roles/worker.module.js";
 import { UsageReportModule } from "./runtime/usage-report.js";
@@ -108,6 +110,10 @@ let KernelModule = KernelModule_1 = class KernelModule {
                 TitlesModule,
                 UsageReportModule,
                 ChannelsModule,
+                // the Platform tool's operation registry and actor facts
+                PlatformModule,
+                // its operations (skills, agents, ...), registered at start on every role
+                PlatformOpsModule,
                 // the role modules, by `roles` (nest kernel spec §2)
                 ...(config.roles.includes("api") ? [ApiModule] : []),
                 ...(config.roles.includes("worker") ? [WorkerModule.forRoot(config)] : []),

package/dist/lifecycle/kernel-lifecycle.d.ts

@@ -123,7 +123,7 @@ export declare class KernelLifecycle implements OnApplicationBootstrap, BeforeAp
      * and the next start tries again while it stays incomplete.
      */
     private runBootstrap;
-    /** 部署尚无活跃企业管理员时提示去初始化；查询失败只记日志，不影响启动。 */
+    /** 部署尚无活跃超级管理员时提示去初始化；查询失败只记日志，不影响启动。 */
     private warnIfSetupPending;
     beforeApplicationShutdown(): Promise<void>;
     /** Logs the end of the stop phases (Redis and the pool close right after, in the infra modules). */

package/dist/lifecycle/kernel-lifecycle.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { SANDBOX_EXTENSION_POINT, } from "@capybara-hq/plugin-sdk";
+import { SANDBOX_EXTENSION_POINT } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable, Optional, } from "@nestjs/common";
 import { sql } from "kysely";
 import { MarketplacesService } from "../catalog/marketplaces.service.js";
@@ -237,7 +237,7 @@ let KernelLifecycle = class KernelLifecycle {
             .list("sandbox")
             .find((x) => x.capability === SANDBOX_EXTENSION_POINT);
         if (sandboxEntry !== undefined) {
-            for (const w of sandboxConfigWarnings(cfg(), sandboxEntry.plugin, sandboxEntry.impl)) {
+            for (const w of sandboxConfigWarnings(cfg(), sandboxEntry.plugin)) {
                 this.log[w.level](w.message);
             }
         }
@@ -318,10 +318,10 @@ let KernelLifecycle = class KernelLifecycle {
             throw e;
         }
     }
-    /** 部署尚无活跃企业管理员时提示去初始化；查询失败只记日志，不影响启动。 */
+    /** 部署尚无活跃超级管理员时提示去初始化；查询失败只记日志，不影响启动。 */
     async warnIfSetupPending() {
         try {
-            if ((await this.accounts.countEnterpriseAdmins()) === 0) {
+            if ((await this.accounts.countSuperAdmins()) === 0) {
                 this.log.warn("deployment is not set up; open the setup wizard or run `capybara admin create`");
             }
         }

package/dist/log.d.ts

@@ -30,6 +30,11 @@ export interface KernelLogger extends Logger {
     redact(text: string): string;
     /** Waits until buffered records reached every output (Loki); never rejects. Call before exit. */
     flush(): Promise<void>;
+    /**
+     * A logger that adds `fields` to every record (e.g. `{ context: "RunWorker" }`); call fields cannot
+     * overwrite them. It shares everything else with this logger: level, secrets, outputs.
+     */
+    child(fields: Record<string, string>): KernelLogger;
 }
 /**
  * 用与 logger 相同的匹配器打码任意文本（工具结果等不经过日志的内容用）：展开规则同 `addOrgSecrets`
@@ -37,13 +42,15 @@ export interface KernelLogger extends Logger {
  * 不得小于匹配器的分桶前缀长度 4）。没有可用的值时原样返回。
  */
 export declare function createRedactor(values: readonly unknown[], minLength?: number): (s: string) => string;
-/** Console format: `pretty` (pino-pretty, one line per record), `json`, or `auto` (pretty on a TTY). */
+/** Console format: `pretty` (pino-pretty), `json`, or `auto` (pretty on a TTY). */
 export declare const LOG_FORMATS: readonly ["auto", "pretty", "json"];
 /** Console format. */
 export type LogFormat = (typeof LOG_FORMATS)[number];
 /** A minimal writable the console output goes to (`process.stdout` by default). */
 export interface LogOutput {
     write(chunk: string): unknown;
+    /** A stream's `error` event (EPIPE when its reader is gone). */
+    on?(event: "error", listener: (err: unknown) => void): unknown;
 }
 /** Options of {@link createLogger}. */
 export interface LoggerOptions {
@@ -58,6 +65,11 @@ export interface LoggerOptions {
     out?: LogOutput;
     /** Whether the console is a terminal (picks `auto` and colors); default `process.stdout.isTTY`. */
     isTTY?: boolean;
+    /**
+     * Pretty output in colors; default: `FORCE_COLOR` (set and not `0`) turns them on, `NO_COLOR` off,
+     * else a TTY. `pnpm dev:kernel` forces them, since its output goes through `tee`.
+     */
+    colors?: boolean;
     /** Also push every record to Loki. */
     loki?: LokiOptions;
     /** Fields on every record (e.g. `role`); log calls cannot overwrite them. */

package/dist/log.js

@@ -105,15 +105,16 @@ function expandSecret(value) {
     }
     return out;
 }
-/** Console format: `pretty` (pino-pretty, one line per record), `json`, or `auto` (pretty on a TTY). */
+/** Console format: `pretty` (pino-pretty), `json`, or `auto` (pretty on a TTY). */
 export const LOG_FORMATS = ["auto", "pretty", "json"];
-/** Fields shown in the pretty prefix instead of the trailing object, in this order. */
-const PREFIX_FIELDS = ["reqId", "traceId", "jobId", "runId", "plugin"];
-/** pino-pretty's message format: `[role] [reqId=…] [plugin=…] msg`, each part only when present. */
+/** Fields shown in the pretty prefix instead of the lines below, in this order. */
+const PREFIX_FIELDS = ["traceId", "reqId", "queue", "jobId", "runId", "context", "plugin"];
+/**
+ * pino-pretty's message format, the octok layout:
+ * `[pid=…] - [traceId=…] [reqId=…] [context=…] msg`, each bracket only when present.
+ */
 function prettyMessage(log, messageKey) {
-    const parts = [];
-    if (typeof log.role === "string")
-        parts.push(`[${log.role}]`);
+    const parts = [`[pid=${process.pid}] -`];
     for (const k of PREFIX_FIELDS) {
         const v = log[k];
         if (typeof v === "string" || typeof v === "number")
@@ -122,6 +123,24 @@ function prettyMessage(log, messageKey) {
     parts.push(String(log[messageKey] ?? ""));
     return parts.join(" ");
 }
+/** The HTTP access record (`http/app.ts`) as one sentence: method, path, status and duration. */
+function foldAccessLine(log) {
+    if (log.msg !== "request" || typeof log.method !== "string" || typeof log.url !== "string") {
+        return log;
+    }
+    const { method, url, status, ms, ...rest } = log;
+    return { ...rest, msg: `${method} ${url} ${status} ${ms}ms` };
+}
+function colorsOn(opts, isTTY) {
+    if (opts.colors !== undefined)
+        return opts.colors;
+    const force = process.env.FORCE_COLOR;
+    if (force !== undefined && force !== "0")
+        return true;
+    if (process.env.NO_COLOR)
+        return false;
+    return isTTY;
+}
 function consoleStream(opts) {
     if (opts.write) {
         const write = opts.write;
@@ -132,23 +151,50 @@ function consoleStream(opts) {
     if (!LOG_FORMATS.includes(format)) {
         throw new Error(`invalid log.format "${format}" (expected ${LOG_FORMATS.join(", ")})`);
     }
-    const out = opts.out ?? process.stdout;
+    const target = opts.out ?? process.stdout;
+    // A console whose reader is gone (the `tee` of `pnpm dev:kernel` stopped by Ctrl-C, a closed
+    // pipe) fails every write with EPIPE. Unhandled, each failure is an uncaught exception the
+    // process guard logs, which writes again: an endless chain that starves the event loop. So the
+    // first stream error ends console output for good (Loki, when configured, still gets records).
+    let broken = false;
+    target.on?.("error", () => {
+        broken = true;
+    });
+    const out = {
+        write: (s) => {
+            if (!broken)
+                target.write(s);
+        },
+    };
     const isTTY = opts.isTTY ?? process.stdout.isTTY === true;
     const pretty = format === "pretty" || (format === "auto" && isTTY);
     if (!pretty)
         return { write: (s) => out.write(s) };
-    // In process (no worker thread): pino-pretty formats each line synchronously.
+    const colors = colorsOn(opts, isTTY);
+    // In process (no worker thread): pino-pretty formats each record synchronously. The layout follows
+    // octok's buildPinoPrettyOptions: full local time, colored level, the bracket prefix, and
+    // the remaining fields as indented `key: value` lines below the message (errors with their stack).
     const format_ = prettyFactory({
-        colorize: isTTY,
-        colorizeObjects: isTTY,
-        singleLine: true,
-        // errors stay inside the one-line object instead of a multi-line stack block
-        errorLikeObjectKeys: [],
-        translateTime: "SYS:HH:MM:ss.l",
+        colorize: colors,
+        colorizeObjects: colors,
+        singleLine: false,
+        translateTime: "SYS:standard",
         ignore: ["pid", "hostname", "role", "spanId", ...PREFIX_FIELDS].join(","),
         messageFormat: (log, messageKey) => prettyMessage(log, messageKey),
     });
-    return { write: (s) => out.write(format_(s)) };
+    return {
+        write: (s) => {
+            let record;
+            try {
+                record = JSON.parse(s);
+            }
+            catch {
+                out.write(s);
+                return;
+            }
+            out.write(format_(foldAccessLine(record)));
+        },
+    };
 }
 /**
  * Creates the kernel logger on pino. Each record is `{ time, level, msg, ...base, ...fields }` with
@@ -254,7 +300,7 @@ export function createLogger(level = "info", opts = {}) {
         }
         sink[lvl](obj, redactMsg(msg));
     };
-    return {
+    const root = {
         debug: (msg, fields) => emit("debug", msg, fields),
         info: (msg, fields) => emit("info", msg, fields),
         warn: (msg, fields) => emit("warn", msg, fields),
@@ -299,5 +345,35 @@ export function createLogger(level = "info", opts = {}) {
                 }
             }
         },
+        // a method, so a wrapper of this logger (a test proxy) is the parent its children forward to
+        child(fields) {
+            return childLogger(this, fields);
+        },
+    };
+    return root;
+}
+/**
+ * A logger that adds `bound` to every record and forwards it to `parent`'s public methods (so a spy
+ * on the parent sees its children's records); call fields cannot overwrite the bound ones.
+ */
+function childLogger(parent, bound) {
+    const merged = (fields) => ({ ...fields, ...bound });
+    const child = {
+        debug: (msg, fields) => parent.debug(msg, merged(fields)),
+        info: (msg, fields) => parent.info(msg, merged(fields)),
+        warn: (msg, fields) => parent.warn(msg, merged(fields)),
+        error: (msg, fields) => parent.error(msg, merged(fields)),
+        get level() {
+            return parent.level;
+        },
+        setLevel: (level) => parent.setLevel(level),
+        addSecrets: (values) => parent.addSecrets(values),
+        addOrgSecrets: (values) => parent.addOrgSecrets(values),
+        redact: (text) => parent.redact(text),
+        flush: () => parent.flush(),
+        child(fields) {
+            return childLogger(this, fields);
+        },
     };
+    return child;
 }

package/dist/models/prices.d.ts

@@ -1,10 +1,10 @@
 import type { ModelUsage } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 /**
- * 一个模型的价格（C2）：每百万 token，币种为部署设置 `priceCurrency`。由企业管理员录入，插件不声明价格。
+ * 一个模型的价格（C2）：每百万 token，币种为部署设置 `priceCurrency`。由超级管理员录入，插件不声明价格。
  * 缓存读 / 写价为 null 时按输入价计。
  */
 export interface ModelPrice {
@@ -40,13 +40,13 @@ export declare class PricesService {
     private readonly db;
     readonly txHost: TransactionHost;
     private readonly adminLock;
-    constructor(db: KernelDb, txHost: TransactionHost, adminLock: EnterpriseAdminLock);
+    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock);
     /** 全部价格，按 provider、model 排序。 */
     list(): Promise<ModelPrice[]>;
     /** 价格表（按 {@link priceKey} 查）。 */
     table(): Promise<PriceTable>;
     /**
-     * 设置或删除（`price: null`）一个模型的价格：事务内取企业管理员锁并复核发起人仍是活跃企业管理员
+     * 设置或删除（`price: null`）一个模型的价格：事务内取超级管理员锁并复核发起人仍是活跃超级管理员
      * （否则 `forbidden`），写审计 `model_price.updated` / `model_price.deleted`。
      */
     put(input: ModelPrice | {
@@ -54,6 +54,6 @@ export declare class PricesService {
         model: string;
         price: null;
     }, actorAccountId: string, actorTokenId?: string): Promise<void>;
-    /** The write of {@link put}, under the enterprise admin lock. */
+    /** The write of {@link put}, under the super admin lock. */
     private write;
 }

package/dist/models/prices.js

@@ -11,7 +11,7 @@ import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
@@ -87,7 +87,7 @@ let PricesService = class PricesService {
         return new Map((await this.list()).map((p) => [priceKey(p.provider, p.model), p]));
     }
     /**
-     * 设置或删除（`price: null`）一个模型的价格：事务内取企业管理员锁并复核发起人仍是活跃企业管理员
+     * 设置或删除（`price: null`）一个模型的价格：事务内取超级管理员锁并复核发起人仍是活跃超级管理员
      * （否则 `forbidden`），写审计 `model_price.updated` / `model_price.deleted`。
      */
     async put(input, actorAccountId, actorTokenId) {
@@ -97,7 +97,7 @@ let PricesService = class PricesService {
         }
         await this.write(check.data, actorAccountId, actorTokenId);
     }
-    /** The write of {@link put}, under the enterprise admin lock. */
+    /** The write of {@link put}, under the super admin lock. */
     async write(v, actorAccountId, actorTokenId) {
         await this.adminLock.lockAndAuthorize(actorAccountId);
         const target = `${v.provider}/${v.model}`;
@@ -144,6 +144,6 @@ PricesService = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
-    __param(2, Inject(EnterpriseAdminLock))
+    __param(2, Inject(SuperAdminLock))
 ], PricesService);
 export { PricesService };

package/dist/models/purposes.controller.d.ts

@@ -1,6 +1,7 @@
+import { ExtensionDisplayNames } from "../extensions/display-name.js";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
-import { ModelPurposesService, type PurposePut, type PurposeTarget, type PurposeView } from "./purposes.js";
+import { ModelPurposesService, type PurposeListing, type PurposePut, type PurposeTarget } from "./purposes.js";
 /** body 的目标（参数缺省为 `{}`）。 */
 export declare const purposeTargetOf: (b: PurposePut) => PurposeTarget | null;
 /**
@@ -9,11 +10,12 @@ export declare const purposeTargetOf: (b: PurposePut) => PurposeTarget | null;
  */
 export declare class ModelPurposesController {
     private readonly purposes;
-    constructor(purposes: ModelPurposesService);
+    private readonly displayNames;
+    constructor(purposes: ModelPurposesService, displayNames: ExtensionDisplayNames);
     list(principal: Principal, org: OrgContext): Promise<{
-        purposes: PurposeView[];
+        purposes: PurposeListing[];
     }>;
     put(principal: Principal, org: OrgContext, purpose: string, body: PurposePut): Promise<{
-        purpose: PurposeView;
+        purpose: PurposeListing;
     }>;
 }

package/dist/models/purposes.controller.js

@@ -8,10 +8,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Controller, Get, Inject, Param, Put } from "@nestjs/common";
+import { ExtensionDisplayNames } from "../extensions/display-name.js";
 import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
 import { ZBody } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
-import { ModelPurposesService, PurposePutDto, } from "./purposes.js";
+import { ModelPurposesService, PurposePutDto, withDeclaredByNames, } from "./purposes.js";
 /** body 的目标（参数缺省为 `{}`）。 */
 export const purposeTargetOf = (b) => b.target === null ? null : { model: b.target.model, params: b.target.params ?? {} };
 /**
@@ -20,18 +21,22 @@ export const purposeTargetOf = (b) => b.target === null ? null : { model: b.targ
  */
 let ModelPurposesController = class ModelPurposesController {
     purposes;
-    constructor(purposes) {
+    displayNames;
+    constructor(purposes, displayNames) {
         this.purposes = purposes;
+        this.displayNames = displayNames;
     }
     async list(principal, org) {
         requireUser(principal);
-        return { purposes: await this.purposes.list(org.orgId) };
+        return {
+            purposes: await withDeclaredByNames(await this.purposes.list(org.orgId), this.displayNames),
+        };
     }
     async put(principal, org, purpose, body) {
         const p = requireUser(principal);
-        return {
-            purpose: await this.purposes.setOrg(org.orgId, purpose, purposeTargetOf(body), p.account.id, patTokenId(p)),
-        };
+        const view = await this.purposes.setOrg(org.orgId, purpose, purposeTargetOf(body), p.account.id, patTokenId(p));
+        const [listing] = await withDeclaredByNames([view], this.displayNames);
+        return { purpose: listing };
     }
 };
 __decorate([
@@ -50,6 +55,7 @@ __decorate([
 ], ModelPurposesController.prototype, "put", null);
 ModelPurposesController = __decorate([
     Controller("api/v1/orgs/:orgId/model-purposes"),
-    __param(0, Inject(ModelPurposesService))
+    __param(0, Inject(ModelPurposesService)),
+    __param(1, Inject(ExtensionDisplayNames))
 ], ModelPurposesController);
 export { ModelPurposesController };

package/dist/models/purposes.d.ts

@@ -1,8 +1,8 @@
-import { type ContentBlock, type ModelRequest, type ModelUsage, type ParamValue, type StopReason } from "@capybara-hq/plugin-sdk";
+import { type ContentBlock, type LocalizedName, type ModelRequest, type ModelUsage, type ParamValue, type StopReason } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
 import { ModelRef } from "../agents/definition.js";
 import { ExtensionRegistry } from "../extensions/registry.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -11,7 +11,7 @@ import { ProviderRegistry } from "../runtime/providers.js";
 /**
  * 模型用途映射（C9）：内核与插件按「用途」取模型，不在代码里写死模型。
  * - 用途 = 内核用途 {@link KERNEL_PURPOSES}（目前只有评委 `eval`），或已加载插件 `permissions.models` 声明的；
- * - 映射 = 部署默认（`org_id` 为 null，企业管理员设）+ 组织覆盖（组织管理员设，`org.models.manage`）；
+ * - 映射 = 部署默认（`org_id` 为 null，超级管理员设）+ 组织覆盖（组织管理员设，`org.models.manage`）；
  *   生效的映射先取组织覆盖、再取部署默认，都没有 → `model.unconfigured`；
  * - 目标模型按部署范围解析（与运行时一致），参数按目标模型自己的声明严格校验；不做模型白名单；
  * - 每次都查 PG，不在进程内缓存（多副本下改映射立即生效）。`ctx.models` 仍预留，插件暂不能调用。
@@ -35,25 +35,32 @@ export declare const KERNEL_PURPOSES: readonly [{
         readonly zh: "会话标题";
         readonly en: "Conversation titles";
     };
+}, {
+    readonly purpose: "web_fetch";
+    readonly kind: "chat";
+    readonly label: {
+        readonly zh: "网页提取";
+        readonly en: "Web page extraction";
+    };
 }, {
     readonly purpose: "subagent_fast";
     readonly kind: "chat";
     readonly label: {
-        readonly zh: "子代理：快速";
+        readonly zh: "子智能体：快速";
         readonly en: "Sub-agent: fast";
     };
 }, {
     readonly purpose: "subagent_standard";
     readonly kind: "chat";
     readonly label: {
-        readonly zh: "子代理：标准";
+        readonly zh: "子智能体：标准";
         readonly en: "Sub-agent: standard";
     };
 }, {
     readonly purpose: "subagent_capable";
     readonly kind: "chat";
     readonly label: {
-        readonly zh: "子代理：最强";
+        readonly zh: "子智能体：最强";
         readonly en: "Sub-agent: capable";
     };
 }];
@@ -75,6 +82,17 @@ export interface PurposeView {
     override: PurposeTarget | null;
     effective: PurposeTarget | null;
 }
+/**
+ * A purpose as the purpose APIs return it: the view plus the declaring extension's display name
+ * (`null` for a kernel purpose, or an extension without one), so a page names the extension.
+ */
+export interface PurposeListing extends PurposeView {
+    declaredByName: LocalizedName | null;
+}
+/** {@link PurposeListing}s of `views`, the display names read in one call. */
+export declare function withDeclaredByNames(views: PurposeView[], names: {
+    many(names: string[]): Promise<Map<string, LocalizedName | null>>;
+}): Promise<PurposeListing[]>;
 /** `PUT …/model-purposes/:purpose` 的 body：设映射，或 `target: null` 清除。 */
 export declare const PURPOSE_PUT: z.ZodObject<{
     target: z.ZodNullable<z.ZodObject<{
@@ -121,7 +139,7 @@ export declare class ModelPurposesService {
     readonly txHost: TransactionHost;
     private readonly adminLock;
     private readonly orgLock;
-    constructor(db: KernelDb, extensions: ExtensionRegistry, config: KernelConfigService, providers: Pick<ProviderRegistry, "resolve">, txHost: TransactionHost, adminLock: EnterpriseAdminLock, orgLock: OrgLock);
+    constructor(db: KernelDb, extensions: ExtensionRegistry, config: KernelConfigService, providers: Pick<ProviderRegistry, "resolve">, txHost: TransactionHost, adminLock: SuperAdminLock, orgLock: OrgLock);
     /** 全部已声明的用途：内核的在前，其后按插件加载顺序。 */
     private declared;
     private find;
@@ -132,14 +150,27 @@ export declare class ModelPurposesService {
     /** 校验目标：模型可解析（部署范围）、参数按它的声明严格通过。 */
     private check;
     private set;
-    /** The mapping write of {@link set}, under the enterprise admin or org lock. */
+    /** The mapping write of {@link set}, under the super admin or org lock. */
     private write;
-    /** 设置（或 `null` 清除）部署默认；只有企业管理员（事务内复核）。 */
+    /** 设置（或 `null` 清除）部署默认；只有超级管理员（事务内复核）。 */
     setDefault(purpose: string, target: PurposeTarget | null, actor: string, actorTokenId?: string): Promise<PurposeView>;
     /** 设置（或 `null` 清除）组织覆盖；事务内锁组织并复核 `org.models.manage`。 */
     setOrg(orgId: string, purpose: string, target: PurposeTarget | null, actor: string, actorTokenId?: string): Promise<PurposeView>;
     /** 生效的映射：组织覆盖，否则部署默认；都没有 → `model.unconfigured`；用途未声明 → `model.purpose_unknown`。 */
     resolve(orgId: string, purpose: string): Promise<PurposeTarget>;
+    /** The target a {@link chat} call on `purpose` uses: the mapping, else `fallback` when unmapped. */
+    private chatTarget;
+    /**
+     * The limits of the model a {@link chat} call on `purpose` would use now (the same mapping and
+     * `fallback` rule): its context window and output cap, so a caller can size its request (e.g.
+     * the `WebFetch` page) before the call. Fails as `chat` does before sending.
+     */
+    chatLimits(orgId: string, purpose: string, opts?: {
+        fallback?: PurposeTarget;
+    }): Promise<{
+        contextWindow: number;
+        maxOutputTokens: number;
+    }>;
     /**
      * 按用途发一次对话请求：解析映射、按目标模型的声明宽松处理参数（补默认值，与运行时一致），用 `consumeModelStream`
      * 收完（只有流空闲看门狗）。输出上限取 `min(req.maxOutputTokens, 目标模型的 maxOutputTokens)`。
@@ -147,10 +178,13 @@ export declare class ModelPurposesService {
      * `opts.fallback`: the target used when the purpose is not mapped (`model.unconfigured`).
      * `opts.beforeSend`: called with the resolved target and the final request just before sending;
      * what it throws is thrown as is (a pre-send failure, e.g. a denied `model.request` hook).
+     * `opts.paramDefaults`: values for parameters the target does not set, kept only where the
+     * target model declares the key and the value fits it (e.g. `thinking: "off"` for a short call).
      */
     chat(orgId: string, purpose: string, req: Omit<ModelRequest, "model" | "params">, signal: AbortSignal, opts?: {
         fallback?: PurposeTarget;
         beforeSend?: (target: ModelRef, request: ModelRequest) => Promise<void>;
+        paramDefaults?: Record<string, ParamValue>;
     }): Promise<{
         content: ContentBlock[];
         stopReason: StopReason;