GetResultURL 获取任务结果 URL（视频地址等） 新数据存在 PrivateData.ResultURL 中；旧数据回退到 FailReason（历史兼容）

GetSSRFProtectedHTTPClient 返回带拨号时 SSRF 校验的客户端。 ssrfProtectedHTTPClient 由 InitHttpClient 在启动时初始化，运行期只读。

GetUserSessionCached validates cached state first and falls back to the database on a miss or Redis read failure. A deny tombstone never falls back.

JSONString returns the complete stored representation, including all privileged scopes. API projections must use the role-specific formatter.

Update subscription used amount by delta (positive consume more, negative refund).

RechargeEpay 原子完成易支付订单：订单行锁、状态校验、成功更新与用户额度增加 在同一个事务内完成，因此同一订单的并发/重复回调（包括多实例部署下）最多充值一次。 alreadyDone=true 表示订单此前已完成，本次为幂等重复回调。 进程内的 LockOrder 只是优化，正确性由本

RoutingMatchModelName returns the name used for channel-ability and token-limit fallback matching: strip @ modifiers and legacy aliases first, then ap

Snapshot returns a detached top-level view for tests and read-only inspection. Mutating it cannot add or replace fields in LogOther.

UpdateAbilities updates abilities of this channel. Make sure the channel is completed before calling this function.

attachQuotaSaturation records the request's quota clamp (if any) onto the consume log's other.admin_info and emits a request-correlated backend audit

creditTopUpQuota atomically enforces the wallet ceiling while adding quota. Keeping the predicate and increment in one UPDATE prevents two concurrent

metadataTransaction serializes changes to vendors and model ownership before acquiring model/vendor row locks. The option anchor also covers empty tab

syncCreditUserQuotaCache 在授信事务（充值/兑换等）提交后同步把增量补进缓存 余额。预扣以缓存值为准（存在期间），授信不能绕过它，否则新到账的额度在 缓存过期前不可用；缓存未命中无需处理，下次读取会从已提交的数据库余额水合。

AdvanceCurrentSessionToUserVersion is used when the security mutation and AuthVersion increment were committed in the same transaction (for example, a

ApplyToOpenAIChat writes the portable portion of an intent to the OpenAI pivot. reasoning_effort carries level-based strength; a JSON-excluded DTO sta

ClaimExternalIdentityWithTx atomically claims a provider subject for one user. Repeating the exact mapping is idempotent; every competing subject or u

Complete a subscription order (idempotent). Creates a UserSubscription snapshot from the plan. expectedPaymentProvider guards against cross-gateway ca

FormatAdminLogs removes root-only diagnostics while retaining operational admin_info. Root callers must not pass their results through this formatter.

GetByModel returns the deterministic effective plugin metadata used for a model-level host concern such as billing. When multiple providers expose the