@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.5

package/dist/inbox/platform-inbox.service.js

@@ -0,0 +1,263 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { CatalogService } from "../catalog/catalog.service.js";
+import { CatalogRequestsService } from "../catalog/requests.service.js";
+import { ApiError } from "../errors.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+/** The most items one platform inbox read returns. */
+export const PLATFORM_INBOX_MAX_ITEMS = 100;
+/** The most open scope sync failures one read takes. */
+export const SCOPE_SYNC_FAILURES_LIST_MAX = 200;
+/**
+ * A platform components migration run unfinished this long after its start is stuck (its worker
+ * stopped mid-run; a run takes seconds, and the next one starts at the next worker start or day).
+ */
+export const MIGRATION_RUN_STUCK_MS = 60 * 60_000;
+/** Plugin install statuses of a plugin that is on in the org. */
+const LIVE_INSTALL = ["installing", "installed", "upgrading"];
+/**
+ * The super admin's inbox (plugin scope spec §5.1 rule 5, §13.5): what waits on the platform,
+ * gathered from the sources the admin pages read (the 待确认 tab's requests and permission
+ * confirmations), plus the scope sync's open failures and the platform components migration's
+ * latest run. Stateless, read live from PG.
+ */
+let PlatformInboxService = class PlatformInboxService {
+    requests;
+    catalog;
+    kdb;
+    constructor(requests, catalog, kdb) {
+        this.requests = requests;
+        this.catalog = catalog;
+        this.kdb = kdb;
+    }
+    async list() {
+        const [requests, requestCount, pending, failures, failureCount, run, notices, noticeCount] = await Promise.all([
+            this.requests.listDeployment(),
+            this.requests.countPendingDeployment(),
+            this.catalog.list({ pending: true }),
+            this.scopeSyncFailures(),
+            this.countScopeSyncFailures(),
+            this.migrationRun(),
+            this.notices(),
+            this.countNotices(),
+        ]);
+        const all = [
+            ...requests.map((r) => ({
+                type: "catalog_request",
+                id: r.id,
+                createdAt: r.createdAt,
+                request: r,
+            })),
+            ...pending.map((i) => ({
+                type: i.owner.kind === "org" ? "org_upload_pending" : "permission_confirmation",
+                id: i.id,
+                createdAt: i.updatedAt,
+                item: i,
+            })),
+            ...failures.map((f) => ({
+                type: "scope_sync_failed",
+                id: `${f.item.id}/${f.org.id}`,
+                createdAt: f.failedAt,
+                failure: f,
+            })),
+            ...notices.map((n) => ({
+                type: "ownership_transferred",
+                id: n.id,
+                createdAt: n.createdAt,
+                notice: n,
+            })),
+            ...(run === null
+                ? []
+                : [
+                    {
+                        type: "platform_migration",
+                        id: run.id,
+                        createdAt: run.finishedAt ?? run.startedAt,
+                        run,
+                    },
+                ]),
+        ];
+        // newest first; equal times by id (a stable order)
+        all.sort((a, b) => a.createdAt !== b.createdAt
+            ? a.createdAt < b.createdAt
+                ? 1
+                : -1
+            : a.id < b.id
+                ? -1
+                : a.id > b.id
+                    ? 1
+                    : 0);
+        const total = requestCount + pending.length + failureCount + (run === null ? 0 : 1) + noticeCount;
+        const items = all.slice(0, PLATFORM_INBOX_MAX_ITEMS);
+        return { items, truncated: total > items.length, total };
+    }
+    /**
+     * How many items wait (the sidebar's count): the same sources, counted where they can be (the
+     * requests and the failures; the permission confirmations are the catalog's pending list).
+     */
+    async count() {
+        const [requests, pending, failures, run, notices] = await Promise.all([
+            this.requests.countPendingDeployment(),
+            this.catalog.list({ pending: true }),
+            this.countScopeSyncFailures(),
+            this.migrationRun(),
+            this.countNotices(),
+        ]);
+        return requests + pending.length + failures + (run === null ? 0 : 1) + notices;
+    }
+    async countNotices() {
+        const r = await this.kdb.db
+            .selectFrom("platform_notices")
+            .select(sql `count(*)`.as("n"))
+            .where("dismissed_at", "is", null)
+            .executeTakeFirstOrThrow();
+        return Number(r.n);
+    }
+    /** The open platform notices, newest first, at most {@link PLATFORM_INBOX_MAX_ITEMS}. */
+    async notices() {
+        const rows = await this.kdb.db
+            .selectFrom("platform_notices")
+            .select(["id", "kind", "detail", "created_at"])
+            .where("dismissed_at", "is", null)
+            .orderBy("created_at", "desc")
+            .orderBy("id")
+            .limit(PLATFORM_INBOX_MAX_ITEMS)
+            .execute();
+        return rows.map((r) => ({
+            id: r.id,
+            kind: r.kind,
+            createdAt: r.created_at.toISOString(),
+            detail: r.detail,
+        }));
+    }
+    /**
+     * A super admin dismisses a platform notice (for every super admin). Dismissing one already
+     * dismissed is fine; no notice with that id -> `inbox.notice_not_found`.
+     */
+    async dismissNotice(accountId, id) {
+        if (!UUID_RE.test(id))
+            throw new ApiError("inbox.notice_not_found", "Notice not found");
+        const r = await this.kdb.db
+            .updateTable("platform_notices")
+            .set({ dismissed_at: sql `now()`, dismissed_by: accountId })
+            .where("id", "=", id)
+            .where("dismissed_at", "is", null)
+            .executeTakeFirst();
+        if (r.numUpdatedRows > 0n)
+            return;
+        const exists = await this.kdb.db
+            .selectFrom("platform_notices")
+            .select("id")
+            .where("id", "=", id)
+            .executeTakeFirst();
+        if (!exists)
+            throw new ApiError("inbox.notice_not_found", "Notice not found");
+    }
+    /**
+     * The open failures still worth a look, joined to their item and org: of a live item and org,
+     * and the pair still differs in the failed direction (a person may have converged it meanwhile):
+     * an install failure while the org has no live install of the item; an uninstall or dependencies
+     * failure while it has one.
+     */
+    failureRows() {
+        return this.kdb.db
+            .selectFrom("plugin_scope_sync_failures as f")
+            .innerJoin("catalog_items as i", "i.id", "f.item_id")
+            .innerJoin("orgs as o", "o.id", "f.org_id")
+            .where("i.deleted_at", "is", null)
+            .where("o.deleted_at", "is", null)
+            .where((eb) => {
+            const live = eb.exists(eb
+                .selectFrom("plugin_installs as p")
+                .select("p.id")
+                .whereRef("p.org_id", "=", "f.org_id")
+                .whereRef("p.item_id", "=", "f.item_id")
+                .where("p.status", "in", [...LIVE_INSTALL]));
+            return eb.or([
+                eb.and([eb("f.op", "=", "install"), eb.not(live)]),
+                eb.and([eb("f.op", "in", ["uninstall", "dependencies"]), live]),
+            ]);
+        });
+    }
+    async countScopeSyncFailures() {
+        const r = await this.failureRows()
+            .select(sql `count(*)`.as("n"))
+            .executeTakeFirstOrThrow();
+        return Number(r.n);
+    }
+    /** The open scope sync failures ({@link failureRows}), newest first. */
+    async scopeSyncFailures() {
+        const rows = await this.failureRows()
+            .select([
+            "f.item_id",
+            "i.name as item_name",
+            "i.display_name",
+            "f.org_id",
+            "o.name as org_name",
+            "f.op",
+            "f.code",
+            "f.message",
+            "f.failed_at",
+        ])
+            .orderBy("f.failed_at", "desc")
+            .orderBy("f.item_id")
+            .orderBy("f.org_id")
+            .limit(SCOPE_SYNC_FAILURES_LIST_MAX)
+            .execute();
+        return rows.map((r) => ({
+            item: { id: r.item_id, name: r.item_name, displayName: r.display_name },
+            org: { id: r.org_id, name: r.org_name },
+            op: r.op,
+            code: r.code,
+            message: r.message,
+            failedAt: r.failed_at.toISOString(),
+        }));
+    }
+    /**
+     * The latest migration run when it needs a look (see {@link MigrationRunView}); null when it
+     * finished without failed items, is still running, or there was none. An earlier run's failure
+     * is not shown: each run tries every unwritten item again.
+     */
+    async migrationRun() {
+        const run = await this.kdb.db
+            .selectFrom("platform_migration_runs")
+            .select(["id", "started_at", "finished_at", "stats"])
+            .orderBy("started_at", "desc")
+            .orderBy("id", "desc")
+            .limit(1)
+            .executeTakeFirst();
+        if (run === undefined)
+            return null;
+        const failed = run.stats.itemsFailed;
+        const itemsFailed = Array.isArray(failed)
+            ? failed.filter((x) => typeof x === "string")
+            : [];
+        const stuck = run.finished_at === null && run.started_at.getTime() < Date.now() - MIGRATION_RUN_STUCK_MS;
+        if (!stuck && (run.finished_at === null || itemsFailed.length === 0))
+            return null;
+        return {
+            id: run.id,
+            startedAt: run.started_at.toISOString(),
+            finishedAt: run.finished_at?.toISOString() ?? null,
+            stuck,
+            itemsFailed,
+        };
+    }
+};
+PlatformInboxService = __decorate([
+    Injectable(),
+    __param(0, Inject(CatalogRequestsService)),
+    __param(1, Inject(CatalogService)),
+    __param(2, Inject(KernelDb))
+], PlatformInboxService);
+export { PlatformInboxService };
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/inbox/platform-notices.d.ts

@@ -0,0 +1,19 @@
+import type { OwnedRef } from "../catalog/ownership.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+export type PlatformNoticeKind = "ownership_transferred";
+/** The `detail` of each platform notice kind. */
+export interface PlatformNoticeDetails {
+    /** A deleted org's (or owner's) shared item now belongs to the platform. */
+    ownership_transferred: {
+        ref: OwnedRef;
+        name: string;
+        fromOrg: {
+            id: string;
+            name: string;
+        };
+        reason: "owner_deleted" | "org_deleted";
+        /** How many other orgs use it. */
+        usedBy: number;
+    };
+}
+export declare function addPlatformNotice<K extends PlatformNoticeKind>(db: KernelSchemaDb, kind: K, detail: PlatformNoticeDetails[K]): Promise<void>;

package/dist/inbox/platform-notices.js

@@ -0,0 +1,9 @@
+// Platform notices (`platform_notices`, plugin scope phase 3, ruling P3-22): what the super admins
+// are told, until any one of them dismisses it. Written in the caller's transaction.
+import { randomUUID } from "node:crypto";
+export async function addPlatformNotice(db, kind, detail) {
+    await db
+        .insertInto("platform_notices")
+        .values({ id: randomUUID(), kind, detail: JSON.stringify(detail) })
+        .execute();
+}

package/dist/index.d.ts

@@ -71,4 +71,4 @@ export { SANDBOX_DESTROY_JOB, SANDBOX_SUSPEND_JOB, } from "./sandbox/jobs.js";
 export { SANDBOX_LOCK_TTL_MS, SandboxService, type SandboxUseInfo, } from "./sandbox/sandbox.service.js";
 export { MAX_STORAGE_KEY_BYTES, StorageKeyError, } from "./storage/prefix.js";
 export { PrefixedStorage, StorageService, type StorageSource, } from "./storage/storage.service.js";
-export { SANDBOX_RECREATED_NOTICE, SANDBOX_STARTED_NOTICE, } from "./tools/builtins/sandbox/common.js";
+export { SANDBOX_RESTARTED_NOTICE, SANDBOX_STARTED_NOTICE, } from "./tools/builtins/sandbox/common.js";

package/dist/index.js

@@ -67,4 +67,4 @@ export { SANDBOX_DESTROY_JOB, SANDBOX_SUSPEND_JOB, } from "./sandbox/jobs.js";
 export { SANDBOX_LOCK_TTL_MS, SandboxService, } from "./sandbox/sandbox.service.js";
 export { MAX_STORAGE_KEY_BYTES, StorageKeyError, } from "./storage/prefix.js";
 export { PrefixedStorage, StorageService, } from "./storage/storage.service.js";
-export { SANDBOX_RECREATED_NOTICE, SANDBOX_STARTED_NOTICE, } from "./tools/builtins/sandbox/common.js";
+export { SANDBOX_RESTARTED_NOTICE, SANDBOX_STARTED_NOTICE, } from "./tools/builtins/sandbox/common.js";

package/dist/infra/cli/kernel-cli.module.js

@@ -13,6 +13,7 @@ import { NestFactory } from "@nestjs/core";
 import { Redis } from "ioredis";
 import { createBus } from "../../ctx/bus.js";
 import { KERNEL_APP_OPTIONS } from "../../lifecycle/tokens.js";
+import { CacheModule } from "../cache/cache.module.js";
 import { ConfigModule } from "../config/config.module.js";
 import { KernelConfigService } from "../config/kernel-config.service.js";
 import { DatabaseModule } from "../database/database.module.js";
@@ -20,6 +21,7 @@ import { KernelEventsModule } from "../events/kernel-events.js";
 import { GracefulShutdownModule } from "../lifecycle/graceful-shutdown.module.js";
 import { LockModule } from "../lock/lock.module.js";
 import { LoggingModule } from "../logging/logging.module.js";
+import { QueueModule } from "../queue/queue.module.js";
 import { KERNEL_BUS, KERNEL_LOGGER, REDIS, REDIS_SUBSCRIBER } from "../tokens.js";
 /** How long the CLI's Redis connection may take before a command fails (a publish only warns). */
 const CLI_REDIS_CONNECT_TIMEOUT_MS = 3_000;
@@ -108,7 +110,13 @@ let KernelCliModule = KernelCliModule_1 = class KernelCliModule {
                 ConfigModule.forRoot(config, opts.env !== undefined ? { env: opts.env } : {}),
                 GracefulShutdownModule,
                 DatabaseModule.forRoot(),
-                ...(opts.redis === false ? [] : [CliRedisModule, LockModule]),
+                // QueueModule's root gives the queues a command's modules register (the catalog's scope
+                // sync and maintenance queues) the configured Redis; without it BullMQ would connect to
+                // its default 127.0.0.1:6379
+                // CacheModule: `@Cacheable` providers of the domain modules (EffectiveConfigs) need it
+                ...(opts.redis === false
+                    ? []
+                    : [CliRedisModule, LockModule, CacheModule, QueueModule.forRoot()]),
                 KernelEventsModule,
                 ...opts.modules,
             ],

package/dist/infra/config/kernel-config.service.js

@@ -30,8 +30,11 @@ const HOT_APPLIERS = {
     "hooks.timeoutMs": () => { },
     // SandboxService reads the shared-lease cap at every acquisition.
     "sandbox.maxConcurrentCommands": () => { },
+    // The environments service reads the personal limit at every create.
+    "environments.maxPersonal": () => { },
     // Sub-agent limits are read at every dispatch, child step and tool resolution.
-    "subagents.maxConcurrentPerRun": () => { },
+    "subagents.maxDepth": () => { },
+    "subagents.maxConcurrentPerConversation": () => { },
     "subagents.maxDispatchesPerRun": () => { },
     "subagents.maxTokensPerRun": () => { },
     // The web tools read these limits through the config service on every call.
@@ -41,6 +44,18 @@ const HOT_APPLIERS = {
     "web.fetch.cacheSeconds": () => { },
     "web.fetch.timeoutMs": () => { },
 };
+/**
+ * Environment variables of renamed config keys, with their replacements: warned about once when
+ * the service starts (agent map spec §6: `subagents.maxConcurrentPerRun` became
+ * `subagents.maxConcurrentPerConversation`). A retired file or Nacos key cannot be told here: the
+ * schema strips unknown keys before the kernel receives its config.
+ */
+const RETIRED_ENV = [
+    [
+        "CAPYBARA_SUBAGENTS__MAX_CONCURRENT_PER_RUN",
+        "CAPYBARA_SUBAGENTS__MAX_CONCURRENT_PER_CONVERSATION",
+    ],
+];
 const HOT_PATHS = configFields(KernelConfigSchema)
     .filter((f) => f.meta?.hot)
     .map((f) => f.path);
@@ -61,6 +76,11 @@ let KernelConfigService = class KernelConfigService {
         this.env = input.env ?? process.env;
         log.setLevel(input.config.log.level);
         log.addSecrets(secretValues(KernelConfigSchema, input.config));
+        for (const [old, now] of RETIRED_ENV) {
+            if (this.env[old] !== undefined) {
+                log.warn(`${old} is no longer read and is ignored; set ${now} instead`, { env: old });
+            }
+        }
     }
     get() {
         return this.current;

package/dist/infra/database/xact-lock.d.ts

@@ -4,7 +4,7 @@ import { TransactionHost } from "./transaction-host.js";
  * Transaction-scoped advisory locks (decision R9 of the Nest kernel spec): `pg_advisory_xact_lock`
  * is transaction semantics, like `FOR UPDATE`. It is held by the caller's transaction and released
  * at its COMMIT or ROLLBACK, so it serializes writers whose invariant is checked inside that same
- * transaction ("never zero active enterprise admins", "set up once", "one account per external
+ * transaction ("never zero active super admins", "set up once", "one account per external
  * identity"). The one place that takes such a lock; `propagation: "mandatory"` makes a call outside
  * a transaction (where the lock would be released at once) throw.
  */

package/dist/infra/database/xact-lock.js

@@ -16,7 +16,7 @@ import { Transactional } from "./transactional.decorator.js";
  * Transaction-scoped advisory locks (decision R9 of the Nest kernel spec): `pg_advisory_xact_lock`
  * is transaction semantics, like `FOR UPDATE`. It is held by the caller's transaction and released
  * at its COMMIT or ROLLBACK, so it serializes writers whose invariant is checked inside that same
- * transaction ("never zero active enterprise admins", "set up once", "one account per external
+ * transaction ("never zero active super admins", "set up once", "one account per external
  * identity"). The one place that takes such a lock; `propagation: "mandatory"` makes a call outside
  * a transaction (where the lock would be released at once) throw.
  */

package/dist/infra/events/kernel-events.d.ts

@@ -72,12 +72,21 @@ export interface KernelEventMap {
         runId: string;
     };
     /**
-     * `ensureRun` marked an orphaned run failed (after the commit): the waits stop its active
-     * sub-agents at once. A lost event is repaired by the wait sweep (children of finished runs).
+     * `ensureRun` marked an orphaned run failed (after the commit): the waits stop its active fork
+     * sub-agent at once (background sub-agents keep running, agent map spec §5.4). A lost event is
+     * repaired by the wait sweep (fork children of finished runs).
      */
     "run.orphaned": {
         runId: string;
     };
+    /**
+     * A sub-agent's `subagent_delivery` was appended to its parent conversation (after the commit;
+     * `SubagentDeliveries`). Waking an idle parent follows it; a lost event is re-derived by the
+     * next `ensureRun` (a message, the end of a run, a page opening).
+     */
+    "subagent.delivered": {
+        conversationId: string;
+    };
     /**
      * A background task of the conversation finished (after the commit of its
      * `background_task_finished` event). `BackgroundWake` asks the run queue for a wake run; a lost

package/dist/infra/queue/add-job-once.d.ts

@@ -0,0 +1,14 @@
+import { type JobsOptions } from "bullmq";
+import type { Redis } from "ioredis";
+/** One job to add: its name, data and options (a deterministic `jobId` makes the add idempotent). */
+export interface OneJob<T> {
+    name: string;
+    data: T;
+    opts: JobsOptions;
+}
+/**
+ * Adds one job to a kernel queue from a process that hosts no queue of its own (a CLI command),
+ * over the caller's Redis connection (left open), with BullMQ's default key prefix like the
+ * kernel's queues. The queue handle is closed again before returning.
+ */
+export declare function addJobOnce<T>(connection: Redis, queue: string, job: OneJob<T>): Promise<void>;

package/dist/infra/queue/add-job-once.js

@@ -0,0 +1,16 @@
+import { Queue } from "bullmq";
+/**
+ * Adds one job to a kernel queue from a process that hosts no queue of its own (a CLI command),
+ * over the caller's Redis connection (left open), with BullMQ's default key prefix like the
+ * kernel's queues. The queue handle is closed again before returning.
+ */
+export async function addJobOnce(connection, queue, job) {
+    const q = new Queue(queue, { connection });
+    try {
+        // biome-ignore lint/suspicious/noExplicitAny: BullMQ's name and data generics do not line up here
+        await q.add(job.name, job.data, job.opts);
+    }
+    finally {
+        await q.close();
+    }
+}

package/dist/kernel.module.js

@@ -33,6 +33,8 @@ import { KernelLifecycle } from "./lifecycle/kernel-lifecycle.js";
 import { KERNEL_APP_OPTIONS } from "./lifecycle/tokens.js";
 import { createConfiguredLogger } from "./log-config.js";
 import { KERNEL_OVERRIDE_TOKENS } from "./overrides.js";
+import { PlatformModule } from "./platform/platform.module.js";
+import { PlatformOpsModule } from "./platform/platform-ops.module.js";
 import { GatewayModule } from "./roles/gateway.module.js";
 import { WorkerModule } from "./roles/worker.module.js";
 import { UsageReportModule } from "./runtime/usage-report.js";
@@ -108,6 +110,10 @@ let KernelModule = KernelModule_1 = class KernelModule {
                 TitlesModule,
                 UsageReportModule,
                 ChannelsModule,
+                // the Platform tool's operation registry and actor facts
+                PlatformModule,
+                // its operations (skills, agents, ...), registered at start on every role
+                PlatformOpsModule,
                 // the role modules, by `roles` (nest kernel spec §2)
                 ...(config.roles.includes("api") ? [ApiModule] : []),
                 ...(config.roles.includes("worker") ? [WorkerModule.forRoot(config)] : []),

package/dist/lifecycle/kernel-lifecycle.d.ts

@@ -123,7 +123,7 @@ export declare class KernelLifecycle implements OnApplicationBootstrap, BeforeAp
      * and the next start tries again while it stays incomplete.
      */
     private runBootstrap;
-    /** 部署尚无活跃企业管理员时提示去初始化；查询失败只记日志，不影响启动。 */
+    /** 部署尚无活跃超级管理员时提示去初始化；查询失败只记日志，不影响启动。 */
     private warnIfSetupPending;
     beforeApplicationShutdown(): Promise<void>;
     /** Logs the end of the stop phases (Redis and the pool close right after, in the infra modules). */

package/dist/lifecycle/kernel-lifecycle.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { SANDBOX_EXTENSION_POINT, } from "@capybara-hq/plugin-sdk";
+import { SANDBOX_EXTENSION_POINT } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable, Optional, } from "@nestjs/common";
 import { sql } from "kysely";
 import { MarketplacesService } from "../catalog/marketplaces.service.js";
@@ -237,7 +237,7 @@ let KernelLifecycle = class KernelLifecycle {
             .list("sandbox")
             .find((x) => x.capability === SANDBOX_EXTENSION_POINT);
         if (sandboxEntry !== undefined) {
-            for (const w of sandboxConfigWarnings(cfg(), sandboxEntry.plugin, sandboxEntry.impl)) {
+            for (const w of sandboxConfigWarnings(cfg(), sandboxEntry.plugin)) {
                 this.log[w.level](w.message);
             }
         }
@@ -318,10 +318,10 @@ let KernelLifecycle = class KernelLifecycle {
             throw e;
         }
     }
-    /** 部署尚无活跃企业管理员时提示去初始化；查询失败只记日志，不影响启动。 */
+    /** 部署尚无活跃超级管理员时提示去初始化；查询失败只记日志，不影响启动。 */
     async warnIfSetupPending() {
         try {
-            if ((await this.accounts.countEnterpriseAdmins()) === 0) {
+            if ((await this.accounts.countSuperAdmins()) === 0) {
                 this.log.warn("deployment is not set up; open the setup wizard or run `capybara admin create`");
             }
         }

package/dist/models/prices.d.ts

@@ -1,10 +1,10 @@
 import type { ModelUsage } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 /**
- * 一个模型的价格（C2）：每百万 token，币种为部署设置 `priceCurrency`。由企业管理员录入，插件不声明价格。
+ * 一个模型的价格（C2）：每百万 token，币种为部署设置 `priceCurrency`。由超级管理员录入，插件不声明价格。
  * 缓存读 / 写价为 null 时按输入价计。
  */
 export interface ModelPrice {
@@ -40,13 +40,13 @@ export declare class PricesService {
     private readonly db;
     readonly txHost: TransactionHost;
     private readonly adminLock;
-    constructor(db: KernelDb, txHost: TransactionHost, adminLock: EnterpriseAdminLock);
+    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock);
     /** 全部价格，按 provider、model 排序。 */
     list(): Promise<ModelPrice[]>;
     /** 价格表（按 {@link priceKey} 查）。 */
     table(): Promise<PriceTable>;
     /**
-     * 设置或删除（`price: null`）一个模型的价格：事务内取企业管理员锁并复核发起人仍是活跃企业管理员
+     * 设置或删除（`price: null`）一个模型的价格：事务内取超级管理员锁并复核发起人仍是活跃超级管理员
      * （否则 `forbidden`），写审计 `model_price.updated` / `model_price.deleted`。
      */
     put(input: ModelPrice | {
@@ -54,6 +54,6 @@ export declare class PricesService {
         model: string;
         price: null;
     }, actorAccountId: string, actorTokenId?: string): Promise<void>;
-    /** The write of {@link put}, under the enterprise admin lock. */
+    /** The write of {@link put}, under the super admin lock. */
     private write;
 }

package/dist/models/prices.js

@@ -11,7 +11,7 @@ import { Inject, Injectable } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
@@ -87,7 +87,7 @@ let PricesService = class PricesService {
         return new Map((await this.list()).map((p) => [priceKey(p.provider, p.model), p]));
     }
     /**
-     * 设置或删除（`price: null`）一个模型的价格：事务内取企业管理员锁并复核发起人仍是活跃企业管理员
+     * 设置或删除（`price: null`）一个模型的价格：事务内取超级管理员锁并复核发起人仍是活跃超级管理员
      * （否则 `forbidden`），写审计 `model_price.updated` / `model_price.deleted`。
      */
     async put(input, actorAccountId, actorTokenId) {
@@ -97,7 +97,7 @@ let PricesService = class PricesService {
         }
         await this.write(check.data, actorAccountId, actorTokenId);
     }
-    /** The write of {@link put}, under the enterprise admin lock. */
+    /** The write of {@link put}, under the super admin lock. */
     async write(v, actorAccountId, actorTokenId) {
         await this.adminLock.lockAndAuthorize(actorAccountId);
         const target = `${v.provider}/${v.model}`;
@@ -144,6 +144,6 @@ PricesService = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
-    __param(2, Inject(EnterpriseAdminLock))
+    __param(2, Inject(SuperAdminLock))
 ], PricesService);
 export { PricesService };

package/dist/models/purposes.controller.d.ts

@@ -1,6 +1,7 @@
+import { ExtensionDisplayNames } from "../extensions/display-name.js";
 import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
-import { ModelPurposesService, type PurposePut, type PurposeTarget, type PurposeView } from "./purposes.js";
+import { ModelPurposesService, type PurposeListing, type PurposePut, type PurposeTarget } from "./purposes.js";
 /** body 的目标（参数缺省为 `{}`）。 */
 export declare const purposeTargetOf: (b: PurposePut) => PurposeTarget | null;
 /**
@@ -9,11 +10,12 @@ export declare const purposeTargetOf: (b: PurposePut) => PurposeTarget | null;
  */
 export declare class ModelPurposesController {
     private readonly purposes;
-    constructor(purposes: ModelPurposesService);
+    private readonly displayNames;
+    constructor(purposes: ModelPurposesService, displayNames: ExtensionDisplayNames);
     list(principal: Principal, org: OrgContext): Promise<{
-        purposes: PurposeView[];
+        purposes: PurposeListing[];
     }>;
     put(principal: Principal, org: OrgContext, purpose: string, body: PurposePut): Promise<{
-        purpose: PurposeView;
+        purpose: PurposeListing;
     }>;
 }