@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.6

package/dist/agents/pending-connectors.service.js

@@ -0,0 +1,282 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { connectorToolKey } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
+import { sql } from "kysely";
+import { ApiError } from "../errors.js";
+import { audit } from "../identity/audit.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { roleAtLeast } from "../orgs/roles.js";
+import { AgentLookup, isAgentVisibleTo } from "./agent-lookup.js";
+import { AgentsService } from "./agents.service.js";
+import { normalizeStoredDefinition, } from "./definition.js";
+import { PendingConnectorRequests } from "./pending-connector-requests.js";
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const RANK = { ask: 1, deny: 2 };
+const MISMATCH = {
+    template: "The connector was not made from the connector template this entry needs",
+    protocol: "The connector's protocol is not the one this entry needs",
+    tools: "The connector offers none of the tools this entry needs",
+    not_synced: "The connector has not listed its tools yet; authorize the connector first, then bind it",
+};
+const mismatch = (reason) => new ApiError("agent.pending_connector_mismatch", MISMATCH[reason], [{ reason }]);
+const connectorNotFound = () => new ApiError("connector.not_found", "Connector not found");
+/**
+ * Resolving an agent's pending connectors (rulings P4-6, P4-7): binding a connector of the org to a
+ * pending entry, and the agent's connector setup request (re-opening it, reading the latest).
+ * Writes run under the org row lock and the agent row lock ({@link AgentsService.lockForWrite}: the
+ * owner or an org admin+).
+ */
+let PendingConnectorsService = class PendingConnectorsService {
+    kdb;
+    agents;
+    lookup;
+    requests;
+    txHost;
+    constructor(kdb, agents, lookup, requests, txHost) {
+        this.kdb = kdb;
+        this.agents = agents;
+        this.lookup = lookup;
+        this.requests = requests;
+        this.txHost = txHost;
+    }
+    /** The current version's definition of a locked agent. */
+    async currentDefinition(agentId, version) {
+        const row = await this.kdb.db
+            .selectFrom("agent_versions")
+            .select("definition")
+            .where("agent_id", "=", agentId)
+            .where("version", "=", version)
+            .executeTakeFirstOrThrow();
+        return normalizeStoredDefinition(row.definition);
+    }
+    /**
+     * Binds connector `connectorId` to the agent's pending entry `key` (ruling P4-6; P4-T6-1,
+     * P4-T6-2): a new agent version with a connector ref to it (merged into an existing ref of that
+     * connector) for the entry's tools the connector offers (all of them when the entry names none),
+     * the entry's policies on those tools (the tighter one wins), and without the entry; then the
+     * setup request narrows or closes (`approved`). Refused: no entry `key` -> 404
+     * `agent.pending_connector_not_found`; a connector that is missing, deleted or of another org ->
+     * 404 `connector.not_found`; another connector template (a `template` entry), another protocol
+     * (a `needs` entry), no tool snapshot yet (`not_synced`: an authorization-code connector nobody
+     * authorized) or none of the entry's tools -> 400 `agent.pending_connector_mismatch`.
+     * Audits `agent.pending_connector_bound`.
+     */
+    async bind(orgId, agentId, key, connectorId, actor, actorTokenId) {
+        const t = this.kdb.db;
+        const before = await this.agents.lockForWrite(orgId, agentId, actor);
+        const def = await this.currentDefinition(agentId, before.current_version);
+        const pending = def.pendingConnectors ?? [];
+        const entry = pending.find((c) => c.key === key);
+        if (!entry) {
+            throw new ApiError("agent.pending_connector_not_found", "The agent has no pending connector with this key");
+        }
+        if (!UUID_RE.test(connectorId))
+            throw connectorNotFound();
+        const c = await t
+            .selectFrom("connectors")
+            .select(["id", "slug", "connector", "platform_template_id", "tools_synced_at"])
+            .where("id", "=", connectorId)
+            .where("org_id", "=", orgId)
+            .where("deleted_at", "is", null)
+            .executeTakeFirst();
+        if (!c)
+            throw connectorNotFound();
+        if ("template" in entry.source) {
+            if (c.platform_template_id !== entry.source.template)
+                throw mismatch("template");
+        }
+        else if (c.connector !== entry.source.needs.protocol) {
+            throw mismatch("protocol");
+        }
+        // an authorization-code connector before its first snapshot has no tools to pick from: never
+        // bind "all" blind and drop the entry's policies; the entry stays pending (fix round 1)
+        if (c.tools_synced_at === null)
+            throw mismatch("not_synced");
+        const rows = await t
+            .selectFrom("connector_tools")
+            .select(["name", "status"])
+            .where("connector_id", "=", c.id)
+            .orderBy("name")
+            .execute();
+        const offered = rows.map((r) => r.name);
+        const dropped = [];
+        // an entry naming no tools takes them all (P4-T6-2)
+        let names = "all";
+        if (entry.tools !== undefined && entry.tools.length > 0) {
+            const present = entry.tools.filter((n) => offered.includes(n));
+            if (present.length === 0)
+                throw mismatch("tools");
+            for (const n of entry.tools)
+                if (!present.includes(n))
+                    dropped.push(`tools.${n}`);
+            // naming every enabled tool of this connector is "all": 另存为模板 writes an agent's
+            // 全部工具 as the enabled names (P4-11), and binding gives it back as 全部工具 (P4-T6-12)
+            const enabled = rows.filter((r) => r.status === "enabled").map((r) => r.name);
+            const coversAll = enabled.length > 0 && enabled.every((n) => present.includes(n));
+            names = coversAll ? "all" : present;
+        }
+        const kept = names === "all" ? offered : names;
+        const toolPolicies = { ...def.toolPolicies };
+        for (const [n, p] of Object.entries(entry.policies ?? {})) {
+            if (!kept.includes(n)) {
+                dropped.push(`policies.${n}`);
+                continue;
+            }
+            const k = connectorToolKey(c.slug, n);
+            const prev = toolPolicies[k];
+            if (prev === undefined || RANK[p] > RANK[prev])
+                toolPolicies[k] = p;
+        }
+        let merged = false;
+        const tools = def.tools.map((r) => {
+            if (r.kind !== "connector" || r.connectorId !== c.id || merged)
+                return r;
+            merged = true;
+            if (r.tools === "all")
+                return r;
+            return {
+                ...r,
+                tools: names === "all" ? "all" : [...new Set([...r.tools, ...names])],
+            };
+        });
+        if (!merged)
+            tools.push({ kind: "connector", connectorId: c.id, tools: names });
+        const left = pending.filter((x) => x.key !== key);
+        const { pendingConnectors: _old, ...rest } = def;
+        const next = {
+            ...rest,
+            tools,
+            toolPolicies,
+            ...(left.length > 0 && { pendingConnectors: left }),
+        };
+        const toVersion = before.current_version + 1;
+        await t
+            .insertInto("agent_versions")
+            .values({
+            agent_id: agentId,
+            version: toVersion,
+            definition: JSON.stringify(next),
+            created_by: actor,
+        })
+            .execute();
+        await t
+            .updateTable("agents")
+            .set({ current_version: toVersion, updated_at: sql `now()` })
+            .where("id", "=", agentId)
+            .execute();
+        await audit(t, {
+            actorAccountId: actor,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            orgId,
+            action: "agent.pending_connector_bound",
+            target: agentId,
+            detail: { key, connectorId: c.id, fromVersion: before.current_version, toVersion },
+        });
+        await this.requests.settleIn({
+            orgId,
+            agentId,
+            keys: left.map((x) => x.key),
+            close: "approved",
+            actor,
+            actorTokenId,
+        });
+        return { agent: await this.lookup.view(agentId), dropped };
+    }
+    /**
+     * (Re-)opens the agent's connector setup request (ruling P4-T6-7; the owner or an org admin+):
+     * the pending one when it has one (`created` false), else a new one for the current pending
+     * keys, requested by the agent's owner (P4-T6-4). No pending connectors -> 409
+     * `agent.no_pending_connectors`.
+     */
+    async reopen(orgId, agentId, actor, actorTokenId) {
+        const before = await this.agents.lockForWrite(orgId, agentId, actor);
+        const def = await this.currentDefinition(agentId, before.current_version);
+        const keys = (def.pendingConnectors ?? []).map((c) => c.key);
+        if (keys.length === 0) {
+            throw new ApiError("agent.no_pending_connectors", "The agent has no connectors waiting to be configured");
+        }
+        const owner = await this.kdb.db
+            .selectFrom("agents")
+            .select("owner_account_id")
+            .where("id", "=", agentId)
+            .executeTakeFirstOrThrow();
+        const r = await this.requests.open({
+            orgId,
+            agentId,
+            requestedBy: owner.owner_account_id,
+            actor,
+            actorTokenId,
+        });
+        // the agent row is locked above, so the keys read there are still pending
+        if (r === null)
+            throw new Error(`agent ${agentId} lost its pending connectors under its lock`);
+        return r;
+    }
+    /**
+     * The id of the agent's latest connector setup request (any status), or null. Authorized as the
+     * writes are (fix round 1): the agent's owner or an org admin+, whether or not the agent is
+     * visible to them; a member who sees the agent otherwise -> 403 `forbidden`; anyone else, or a
+     * deleted agent -> 404 `agent.not_found`.
+     */
+    async latestRequest(orgId, agentId, viewer) {
+        const t = this.kdb.db;
+        const [agent, member] = await Promise.all([
+            t
+                .selectFrom("agents")
+                .select("owner_account_id")
+                .where("id", "=", agentId)
+                .where("org_id", "=", orgId)
+                .where("deleted_at", "is", null)
+                .executeTakeFirst(),
+            t
+                .selectFrom("memberships")
+                .select("role")
+                .where("org_id", "=", orgId)
+                .where("account_id", "=", viewer)
+                .executeTakeFirst(),
+        ]);
+        if (!agent || !member)
+            throw new ApiError("agent.not_found", "Agent not found");
+        if (agent.owner_account_id !== viewer && !roleAtLeast(member.role, "admin")) {
+            if (await isAgentVisibleTo(t, agentId, viewer)) {
+                throw new ApiError("forbidden", "Only the agent owner or an organization admin can see its connector setup request");
+            }
+            throw new ApiError("agent.not_found", "Agent not found");
+        }
+        const row = await this.kdb.db
+            .selectFrom("catalog_requests")
+            .select("id")
+            .where("org_id", "=", orgId)
+            .where("agent_id", "=", agentId)
+            .where("kind", "=", "connector_setup")
+            .orderBy("created_at", "desc")
+            .orderBy("id", "desc")
+            .executeTakeFirst();
+        return row?.id ?? null;
+    }
+};
+__decorate([
+    Transactional()
+], PendingConnectorsService.prototype, "bind", null);
+__decorate([
+    Transactional()
+], PendingConnectorsService.prototype, "reopen", null);
+PendingConnectorsService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(AgentsService)),
+    __param(2, Inject(AgentLookup)),
+    __param(3, Inject(PendingConnectorRequests)),
+    __param(4, Inject(TransactionHost))
+], PendingConnectorsService);
+export { PendingConnectorsService };

package/dist/agents/readiness.controller.d.ts

@@ -9,11 +9,11 @@ import { AgentsService } from "./agents.service.js";
  * a vendor call; `agents` is the number of agents the caller can see (the agent list's
  * visibility). Humans and service tokens (`org.read`).
  *
- * `modelProvider` is deployment-wide, not about this org: model providers are not org-scoped
- * (an org's model purposes map onto the deployment's providers but cannot add one), so every org
- * of the deployment reads the same value. It is read from this replica's provider registry, which
- * follows the per-replica extension reconcile: right after a provider is enabled, a replica that
- * has not reconciled yet may still answer `none` for a moment.
+ * `modelProvider` counts the deployment's providers whose effective config is valid in this org
+ * (spec B §5.5: a provider the platform installed without a key needs each org's own). It is read
+ * from this replica's provider registry, which follows the per-replica extension reconcile: right
+ * after a provider is enabled, a replica that has not reconciled yet may still answer `none` for
+ * a moment.
  */
 export declare class ReadinessController {
     private readonly registry;

package/dist/agents/readiness.controller.js

@@ -21,11 +21,11 @@ const viewerOf = (p) => (p.kind === "user" ? p.account.id : null);
  * a vendor call; `agents` is the number of agents the caller can see (the agent list's
  * visibility). Humans and service tokens (`org.read`).
  *
- * `modelProvider` is deployment-wide, not about this org: model providers are not org-scoped
- * (an org's model purposes map onto the deployment's providers but cannot add one), so every org
- * of the deployment reads the same value. It is read from this replica's provider registry, which
- * follows the per-replica extension reconcile: right after a provider is enabled, a replica that
- * has not reconciled yet may still answer `none` for a moment.
+ * `modelProvider` counts the deployment's providers whose effective config is valid in this org
+ * (spec B §5.5: a provider the platform installed without a key needs each org's own). It is read
+ * from this replica's provider registry, which follows the per-replica extension reconcile: right
+ * after a provider is enabled, a replica that has not reconciled yet may still answer `none` for
+ * a moment.
  */
 let ReadinessController = class ReadinessController {
     registry;
@@ -37,7 +37,7 @@ let ReadinessController = class ReadinessController {
     async get(principal, org) {
         const visible = await this.agents.listVisible(org.orgId, viewerOf(principal));
         return {
-            modelProvider: this.registry.hasProvider() ? "ready" : "none",
+            modelProvider: (await this.registry.hasProvider(org.orgId)) ? "ready" : "none",
             agents: visible.length,
         };
     }

package/dist/agents/templates.controller.d.ts

@@ -1,15 +1,96 @@
+import { z } from "zod";
+import { OwnedItems, type OwnedSkillDeletePreview } from "../catalog/owned-items.js";
+import { type Principal } from "../identity/principal.js";
 import { type OrgContext } from "../orgs/org.guard.js";
+import { type AgentTemplateDetail, OrgAgentTemplates, type SaveAsOmission } from "./org-templates.js";
 import { AgentTemplatesService, type AgentTemplateView } from "./templates.js";
+declare const IdParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+declare const AgentIdParams: z.ZodObject<{
+    agentId: z.ZodString;
+}, z.core.$strip>;
+declare const ShareableBody: z.ZodObject<{
+    shareable: z.ZodBoolean;
+}, z.core.$strict>;
+declare const SaveAsBody: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+}, z.core.$strict>;
+declare const UpdateBody: z.ZodObject<{
+    definition: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
 /**
- * The org's agent templates installed from plugins (`/api/v1/orgs/:orgId/agent-templates`, phase C
- * spec §17): the agent page lists them to select as sub-agents. Read with `agents.create`, the
- * permission of its only consumer, the agent editor (members, people only); a template carries no
- * secret, but guests and service tokens have no use for the list.
+ * The org's agent templates (`/api/v1/orgs/:orgId/agent-templates`, phase C spec §17; plugin scope
+ * phase 4, rulings P4-9 to P4-13). Reads with `agents.create` (members, people only): the list
+ * the agent editor and the 模板 tab show, and one template's detail with its definition. The org's
+ * own templates (saved from an agent, `POST orgs/:orgId/agents/:agentId/save-as-template`) are
+ * edited, deleted and made 可共享 by the owner org's admins (`agents.manage`, the action that
+ * manages agent templates).
  */
 export declare class AgentTemplatesController {
     private readonly templates;
-    constructor(templates: AgentTemplatesService);
+    private readonly orgTemplates;
+    private readonly owned;
+    constructor(templates: AgentTemplatesService, orgTemplates: OrgAgentTemplates, owned: OwnedItems);
     list(org: OrgContext): Promise<{
         templates: AgentTemplateView[];
     }>;
+    /**
+     * One template usable in the org (an org template, a linked copy, a platform template on in
+     * the org) with its definition, owner and the org's flags (`owned`, `shareable`, `promoted`).
+     * Not usable here -> 404 `component.not_found`.
+     */
+    get(principal: Principal, org: OrgContext, params: z.infer<typeof IdParams>): Promise<{
+        template: AgentTemplateDetail;
+    }>;
+    /**
+     * A new version of the org's own template (ruling P4-12): `{ definition, expectedVersion }` ->
+     * 200 `{ template }`; a stale version -> 409 `agent_template.version_conflict`; a template the
+     * org does not own -> 409 `catalog.not_owned`.
+     */
+    update(principal: Principal, org: OrgContext, params: z.infer<typeof IdParams>, body: z.infer<typeof UpdateBody>): Promise<{
+        template: AgentTemplateDetail;
+    }>;
+    /**
+     * What deleting the org's own template does (nothing written): `outcome` `transferred` when it
+     * was shared and another org uses it (`orgs`), else `removed`; `agents` the org's agents whose
+     * roster loses it.
+     */
+    deletePreview(principal: Principal, org: OrgContext, params: z.infer<typeof IdParams>): Promise<OwnedSkillDeletePreview>;
+    /**
+     * Deletes the org's own template (the P3 owner rules, ruling P4-12): one it shared that another
+     * org uses becomes the platform's (platform notice `ownership_transferred`). 200 `{ outcome }`.
+     */
+    remove(principal: Principal, org: OrgContext, params: z.infer<typeof IdParams>): Promise<{
+        outcome: "transferred" | "removed";
+    }>;
+    /**
+     * Sets 可共享 on the org's own agent template (`{ shareable }` -> 200 `{ id, shareable }`; an org
+     * template, ruling P4-13): a plugin's template or a copy of another owner's platform template
+     * -> 409 `catalog.not_owned`; one the org promoted writes its platform row too (ruling P3-2).
+     */
+    setShareable(principal: Principal, org: OrgContext, params: z.infer<typeof IdParams>, body: z.infer<typeof ShareableBody>): Promise<{
+        id: string;
+        shareable: boolean;
+    }>;
+}
+/**
+ * 另存为模板 (ruling P4-9; `agents.manage`, org admins): `POST
+ * /api/v1/orgs/:orgId/agents/:agentId/save-as-template { name, description }` -> 201
+ * `{ template, omitted }`. `template` is the new org template's detail (version 1, the bare
+ * `name`); `omitted` lists what the template leaves out (`SaveAsOmission`: allowlisted org agents
+ * in the roster, the agent's own skills, connectors and sub-agents no longer usable, entries past
+ * a limit). A name the org can already use as a type -> 409 `agent_template.name_taken` (details
+ * `[{ owner, templateId }]`). Its own controller: the agents controller is the agent CRUD.
+ */
+export declare class AgentSaveAsTemplateController {
+    private readonly orgTemplates;
+    constructor(orgTemplates: OrgAgentTemplates);
+    saveAs(principal: Principal, org: OrgContext, params: z.infer<typeof AgentIdParams>, body: z.infer<typeof SaveAsBody>): Promise<{
+        template: AgentTemplateDetail;
+        omitted: SaveAsOmission[];
+    }>;
 }
+export {};

package/dist/agents/templates.controller.js

@@ -7,31 +7,195 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Controller, Get, Inject } from "@nestjs/common";
+import { AGENT_TEMPLATE_NAME_RE } from "@capybara-hq/plugin-sdk";
+import { Controller, Delete, Get, Inject, Post, Put } from "@nestjs/common";
+import { z } from "zod";
+import { OwnedItems } from "../catalog/owned-items.js";
+import { CurrentPrincipal, patTokenId, requireUser, } from "../identity/principal.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
 import { CurrentOrg, OrgAction } from "../orgs/org.guard.js";
+import { OrgAgentTemplates, } from "./org-templates.js";
 import { AgentTemplatesService } from "./templates.js";
+const IdParams = z.object({ id: z.string().min(1).max(100) });
+const AgentIdParams = z.object({ agentId: z.string().min(1).max(100) });
+const ShareableBody = z.object({ shareable: z.boolean() }).strict();
+const SaveAsBody = z
+    .object({
+    /** The bare template name (the template name rule); unique in the org's usable set. */
+    name: z.string().regex(AGENT_TEMPLATE_NAME_RE),
+    /** When to use it (trimmed, as a template file's). */
+    description: z.string().trim().min(1).max(4096),
+})
+    .strict();
+const UpdateBody = z
+    .object({
+    /** The whole definition (the `AgentTemplate` shape), validated like a template file. */
+    definition: z.record(z.string(), z.unknown()),
+    /** The `version` the editor read; another one -> 409 `agent_template.version_conflict`. */
+    expectedVersion: z.number().int().min(1),
+})
+    .strict();
+class AgentTemplateIdParams extends createZodDto(IdParams, "AgentTemplateIdParams") {
+}
+class SaveAsAgentIdParams extends createZodDto(AgentIdParams, "SaveAsAgentIdParams") {
+}
+class AgentTemplateShareableBody extends createZodDto(ShareableBody, "AgentTemplateShareableBody") {
+}
+class SaveAsTemplateBody extends createZodDto(SaveAsBody, "SaveAsTemplateBody") {
+}
+class AgentTemplateUpdateBody extends createZodDto(UpdateBody, "AgentTemplateUpdateBody") {
+}
+const actorOpts = (p) => {
+    const tokenId = patTokenId(p);
+    return tokenId !== undefined ? { actorTokenId: tokenId } : {};
+};
 /**
- * The org's agent templates installed from plugins (`/api/v1/orgs/:orgId/agent-templates`, phase C
- * spec §17): the agent page lists them to select as sub-agents. Read with `agents.create`, the
- * permission of its only consumer, the agent editor (members, people only); a template carries no
- * secret, but guests and service tokens have no use for the list.
+ * The org's agent templates (`/api/v1/orgs/:orgId/agent-templates`, phase C spec §17; plugin scope
+ * phase 4, rulings P4-9 to P4-13). Reads with `agents.create` (members, people only): the list
+ * the agent editor and the 模板 tab show, and one template's detail with its definition. The org's
+ * own templates (saved from an agent, `POST orgs/:orgId/agents/:agentId/save-as-template`) are
+ * edited, deleted and made 可共享 by the owner org's admins (`agents.manage`, the action that
+ * manages agent templates).
  */
 let AgentTemplatesController = class AgentTemplatesController {
     templates;
-    constructor(templates) {
+    orgTemplates;
+    owned;
+    constructor(templates, orgTemplates, owned) {
         this.templates = templates;
+        this.orgTemplates = orgTemplates;
+        this.owned = owned;
     }
     async list(org) {
         return { templates: await this.templates.listForOrg(org.orgId) };
     }
+    /**
+     * One template usable in the org (an org template, a linked copy, a platform template on in
+     * the org) with its definition, owner and the org's flags (`owned`, `shareable`, `promoted`).
+     * Not usable here -> 404 `component.not_found`.
+     */
+    async get(principal, org, params) {
+        requireUser(principal);
+        return { template: await this.orgTemplates.detail(org.orgId, params.id) };
+    }
+    /**
+     * A new version of the org's own template (ruling P4-12): `{ definition, expectedVersion }` ->
+     * 200 `{ template }`; a stale version -> 409 `agent_template.version_conflict`; a template the
+     * org does not own -> 409 `catalog.not_owned`.
+     */
+    async update(principal, org, params, body) {
+        const p = requireUser(principal);
+        const template = await this.orgTemplates.update(org.orgId, p.account.id, params.id, body, patTokenId(p));
+        return { template };
+    }
+    /**
+     * What deleting the org's own template does (nothing written): `outcome` `transferred` when it
+     * was shared and another org uses it (`orgs`), else `removed`; `agents` the org's agents whose
+     * roster loses it.
+     */
+    async deletePreview(principal, org, params) {
+        requireUser(principal);
+        return this.owned.previewAgentTemplateDelete(org.orgId, params.id);
+    }
+    /**
+     * Deletes the org's own template (the P3 owner rules, ruling P4-12): one it shared that another
+     * org uses becomes the platform's (platform notice `ownership_transferred`). 200 `{ outcome }`.
+     */
+    async remove(principal, org, params) {
+        const p = requireUser(principal);
+        const outcome = await this.owned.deleteAgentTemplate(org.orgId, p.account.id, params.id, actorOpts(p));
+        return { outcome };
+    }
+    /**
+     * Sets 可共享 on the org's own agent template (`{ shareable }` -> 200 `{ id, shareable }`; an org
+     * template, ruling P4-13): a plugin's template or a copy of another owner's platform template
+     * -> 409 `catalog.not_owned`; one the org promoted writes its platform row too (ruling P3-2).
+     */
+    async setShareable(principal, org, params, body) {
+        const p = requireUser(principal);
+        await this.owned.setShareable(org.orgId, p.account.id, { kind: "agent_template", id: params.id }, body.shareable, actorOpts(p));
+        return { id: params.id, shareable: body.shareable };
+    }
 };
 __decorate([
     Get(),
     OrgAction("agents.create"),
     __param(0, CurrentOrg())
 ], AgentTemplatesController.prototype, "list", null);
+__decorate([
+    Get(":id"),
+    OrgAction("agents.create"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(AgentTemplateIdParams))
+], AgentTemplatesController.prototype, "get", null);
+__decorate([
+    Put(":id"),
+    OrgAction("agents.manage"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(AgentTemplateIdParams)),
+    __param(3, ZBody(AgentTemplateUpdateBody))
+], AgentTemplatesController.prototype, "update", null);
+__decorate([
+    Get(":id/delete-preview"),
+    OrgAction("agents.manage"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(AgentTemplateIdParams))
+], AgentTemplatesController.prototype, "deletePreview", null);
+__decorate([
+    Delete(":id"),
+    OrgAction("agents.manage"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(AgentTemplateIdParams))
+], AgentTemplatesController.prototype, "remove", null);
+__decorate([
+    Put(":id/shareable"),
+    OrgAction("agents.manage"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(AgentTemplateIdParams)),
+    __param(3, ZBody(AgentTemplateShareableBody))
+], AgentTemplatesController.prototype, "setShareable", null);
 AgentTemplatesController = __decorate([
     Controller("api/v1/orgs/:orgId/agent-templates"),
-    __param(0, Inject(AgentTemplatesService))
+    __param(0, Inject(AgentTemplatesService)),
+    __param(1, Inject(OrgAgentTemplates)),
+    __param(2, Inject(OwnedItems))
 ], AgentTemplatesController);
 export { AgentTemplatesController };
+/**
+ * 另存为模板 (ruling P4-9; `agents.manage`, org admins): `POST
+ * /api/v1/orgs/:orgId/agents/:agentId/save-as-template { name, description }` -> 201
+ * `{ template, omitted }`. `template` is the new org template's detail (version 1, the bare
+ * `name`); `omitted` lists what the template leaves out (`SaveAsOmission`: allowlisted org agents
+ * in the roster, the agent's own skills, connectors and sub-agents no longer usable, entries past
+ * a limit). A name the org can already use as a type -> 409 `agent_template.name_taken` (details
+ * `[{ owner, templateId }]`). Its own controller: the agents controller is the agent CRUD.
+ */
+let AgentSaveAsTemplateController = class AgentSaveAsTemplateController {
+    orgTemplates;
+    constructor(orgTemplates) {
+        this.orgTemplates = orgTemplates;
+    }
+    async saveAs(principal, org, params, body) {
+        const p = requireUser(principal);
+        return this.orgTemplates.saveAs(org.orgId, p.account.id, params.agentId, body, patTokenId(p));
+    }
+};
+__decorate([
+    Post(":agentId/save-as-template"),
+    OrgAction("agents.manage"),
+    __param(0, CurrentPrincipal()),
+    __param(1, CurrentOrg()),
+    __param(2, ZParam(SaveAsAgentIdParams)),
+    __param(3, ZBody(SaveAsTemplateBody))
+], AgentSaveAsTemplateController.prototype, "saveAs", null);
+AgentSaveAsTemplateController = __decorate([
+    Controller("api/v1/orgs/:orgId/agents"),
+    __param(0, Inject(OrgAgentTemplates))
+], AgentSaveAsTemplateController);
+export { AgentSaveAsTemplateController };