@capybara-hq/kernel 0.1.0-rc.3 → 0.1.0-rc.5

package/bootstrap.json

@@ -3,24 +3,80 @@
   "schemaVersion": 1,
   "marketplace": {
     "url": "https://github.com/capybara-hq/plugins.git",
-    "commit": "08e336dafe124615622534683887120c81ec416b"
+    "commit": "77f0ac0c0bbb1e7e3ea66ae3bd7931f0ed06b777"
   },
   "plugins": [
     {
       "name": "openai-compatible",
       "source": "npm",
       "npm": "@capybara-hq/plugin-openai-compatible",
-      "version": "0.1.0-rc.0",
-      "integrity": "sha512-NYyjRfC2U6bAjjlFU0rmJuDs3IyuAwektV9KLBpnFcDVRDfRgBpcSBV/jp0tzXhv9ee5MWqzOKN20WNdKWO9fQ==",
+      "version": "0.1.0-rc.2",
+      "integrity": "sha512-HG3sPg9VjSldr/qP5647SV0LP3xEqIbtnMvl4VG0XHCHRPJ1wc9PBMb8hrTZ3FGc43OKTWgFyfAV3fNKm29JtQ==",
       "required": true
     },
     {
       "name": "object-store-s3",
       "source": "npm",
       "npm": "@capybara-hq/plugin-object-store-s3",
-      "version": "0.1.0-rc.0",
-      "integrity": "sha512-jFbstLMsMeZ3EqGEm/5OnYWm4aGM9nIw71DmIuPu/frk4/Y+nTnaBWgT1SUDEr6NbFb34V31NIVNMJSoxmvMww==",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-/HABg+/LsR+YJmRlJYB694hFFgZPTReN9BDwArdZpsNR0n/uBanRgaNnTT/C/wZd4uNTq9EVClYvZ4t3xmjKGQ==",
       "required": true
+    },
+    {
+      "name": "anthropic",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-anthropic",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-/Ptn4epXv38kBKqd3MDxhy21hP0vQLkLdEov6sUvn2BlKRltgLYAbiKD/9P+B1w2RZmoNXdhZgqoSZ0Q036LNw==",
+      "required": false
+    },
+    {
+      "name": "openai",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-openai",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-F714dJ023p8XcrPXYNZyjiow5BXza5KTdlJV4Uw8spgulgjPSF44n0SVMEA1iyYCwOFrr58NSvw51AqmOYg6Fw==",
+      "required": false
+    },
+    {
+      "name": "connector-mcp",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-connector-mcp",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-cMc/d7Tngzx7/kyyCmt9W4kVC8JkfH1q7dQ5bLpnTJfwg8iYrdwUGaD6Q7ImYCb3AiguM0Xe2Js4RlU7ed22Kw==",
+      "required": false
+    },
+    {
+      "name": "connector-openapi",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-connector-openapi",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-XahjgfA5hay/D32rUNrvql4SYAk0R04vGLyEzZg6Sq4ZNoqFHTKuj8Gndr5lD3AiwMqVngTva+x3hpVdosmEjA==",
+      "required": false
+    },
+    {
+      "name": "jina",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-jina",
+      "version": "0.1.0-rc.0",
+      "integrity": "sha512-fFquQfglzgaCoq3/tcRCYBdLfLe1BzIO5xDJHP1h0I7ugXGmUn9qdtFWOJ6Sw8TJvFeeqGSrkvtAUTVo5Phe2w==",
+      "required": false
+    },
+    {
+      "name": "sandbox-docker",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-sandbox-docker",
+      "version": "0.1.0-rc.2",
+      "integrity": "sha512-f5BiecQQvRLI8NaGHUy3l+nNvcCLXTQnHQ8od93PAbBpg6q0EkAvZ7R/M4yZ7dK7PeIan61VB+QfwlnpLLw27Q==",
+      "required": false
+    },
+    {
+      "name": "todo",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-todo",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-Qz2FX05Nxbbetf8rcbmA3QZqvGDFeBgJOz/+vckD0N7di8YVKs3qoqoU7mzvBKnImWK63LiJLotGNQUY2QsXhg==",
+      "required": false
     }
   ]
 }

package/dist/admin/admin.controller.d.ts

@@ -1,27 +1,46 @@
-import type { Logger } from "@capybara-hq/plugin-sdk";
+import type { LocalizedName, Logger } from "@capybara-hq/plugin-sdk";
 import { z } from "zod";
 import { CatalogRequestsService } from "../catalog/requests.service.js";
 import { ExtensionAdmin } from "../extensions/admin-view.js";
+import { ExtensionDisplayNames } from "../extensions/display-name.js";
 import { type Account, AccountsService } from "../identity/accounts.js";
 import { type Principal } from "../identity/principal.js";
 import { SessionService } from "../identity/sessions.js";
 import { type DeploymentSettings, SettingsService } from "../identity/settings.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { type ModelPrice, type ModelPricePut, PricesService } from "../models/prices.js";
-import { ModelPurposesService, type PurposePut, type PurposeView } from "../models/purposes.js";
+import { ModelPurposesService, type PurposeListing, type PurposePut } from "../models/purposes.js";
 import { type Org, OrgsService } from "../orgs/orgs.service.js";
 import { ProviderRegistry, type ProviderStatus } from "../runtime/providers.js";
+import type { SubagentLimits } from "../runtime/subagents/limits.js";
 /** 后台概览（`GET /api/v1/admin/overview`）的计数。 */
 export interface AdminOverview {
     /**
-     * Extensions an enterprise admin has to act on (pending approval or configuration, failed, missing
+     * Extensions a super admin has to act on (pending approval or configuration, failed, missing
      * dependency, replicas disagree); see `extensionNeedsAction`.
      */
     extensionsNeedingAction: number;
-    /** Catalog requests waiting for an enterprise admin (stage deployment, pending). */
+    /** Catalog requests waiting for a super admin (stage deployment, pending). */
     catalogRequestsPending: number;
     orgs: number;
     accounts: number;
 }
+/**
+ * The deployment's defaults of the per-org limits (with `GET /api/v1/admin/orgs`): what an
+ * organization without an override gets, from the live config. `subagents.maxDispatchesPerRun` and
+ * `maxTokensPerRun` of 0 mean no limit.
+ */
+export interface LimitDefaults {
+    /** `runtime.orgConcurrency`. */
+    runConcurrency: number;
+    /** `sandbox.limits.cpu` / `memoryMb`. */
+    sandbox: {
+        cpu: number;
+        memoryMb: number;
+    };
+    /** `subagents.*`. */
+    subagents: SubagentLimits;
+}
 declare const ListQuerySchema: z.ZodObject<{
     after: z.ZodOptional<z.ZodString>;
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -31,7 +50,7 @@ declare const CreateAccountSchema: z.ZodObject<{
     password: z.ZodString;
     displayName: z.ZodString;
     email: z.ZodOptional<z.ZodEmail>;
-    enterpriseAdmin: z.ZodOptional<z.ZodBoolean>;
+    superAdmin: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 declare const UpdateAccountSchema: z.ZodObject<{
     displayName: z.ZodOptional<z.ZodString>;
@@ -39,13 +58,13 @@ declare const UpdateAccountSchema: z.ZodObject<{
         active: "active";
         disabled: "disabled";
     }>>;
-    isEnterpriseAdmin: z.ZodOptional<z.ZodBoolean>;
+    isSuperAdmin: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /** 至少给出一个键；`runConcurrencyOverrides` 按组织合并，值为 null 删除该组织的覆盖。 */
 declare const SettingsSchema: z.ZodObject<{
     orgCreation: z.ZodOptional<z.ZodEnum<{
         anyone: "anyone";
-        enterprise_admin: "enterprise_admin";
+        super_admin: "super_admin";
     }>>;
     runConcurrencyOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodNumber>>>;
     priceCurrency: z.ZodOptional<z.ZodString>;
@@ -54,7 +73,8 @@ declare const SettingsSchema: z.ZodObject<{
         memoryMb: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>>>;
     subagentLimitOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodObject<{
-        maxConcurrentPerRun: z.ZodOptional<z.ZodNumber>;
+        maxDepth: z.ZodOptional<z.ZodNumber>;
+        maxConcurrentPerConversation: z.ZodOptional<z.ZodNumber>;
         maxDispatchesPerRun: z.ZodOptional<z.ZodNumber>;
         maxTokensPerRun: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>>>;
@@ -66,9 +86,10 @@ declare const SettingsSchema: z.ZodObject<{
         allow: "allow";
         deny: "deny";
     }>>;
+    orgMarketplaceBrowse: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 /**
- * 企业管理员端点（`/api/v1/admin/*`）：只接受企业管理员的 Web 会话或个人令牌；
+ * 超级管理员端点（`/api/v1/admin/*`）：只接受超级管理员的 Web 会话或个人令牌；
  * 服务令牌一律 `forbidden`（未标 `@AllowService`）。
  */
 export declare class AdminController {
@@ -82,7 +103,9 @@ export declare class AdminController {
     private readonly plugins;
     private readonly registry;
     private readonly catalogRequests;
-    constructor(accounts: AccountsService, sessions: SessionService, log: Logger, orgs: OrgsService, settings: SettingsService, prices: PricesService, purposes: ModelPurposesService, plugins: ExtensionAdmin, registry: ProviderRegistry, catalogRequests: CatalogRequestsService);
+    private readonly displayNames;
+    private readonly config;
+    constructor(accounts: AccountsService, sessions: SessionService, log: Logger, orgs: OrgsService, settings: SettingsService, prices: PricesService, purposes: ModelPurposesService, plugins: ExtensionAdmin, registry: ProviderRegistry, catalogRequests: CatalogRequestsService, displayNames: ExtensionDisplayNames, config: KernelConfigService);
     /** 后台概览的四个数字（只读计数，不含任何对话内容）。 */
     overview(): Promise<AdminOverview>;
     /**
@@ -96,24 +119,32 @@ export declare class AdminController {
     createAccount(principal: Principal, body: z.infer<typeof CreateAccountSchema>): Promise<{
         account: Account;
     }>;
-    /** 改显示名 / 状态 / 企业管理员；停用时同时吊销该账号的全部会话与个人令牌。 */
+    /** 改显示名 / 状态 / 超级管理员；停用时同时吊销该账号的全部会话与个人令牌。 */
     updateAccount(principal: Principal, accountId: string, body: z.infer<typeof UpdateAccountSchema>): Promise<{
         account: Account;
     }>;
-    /** 全部组织的元数据与成员数（不含成员明细）。 */
+    /**
+     * 全部组织的元数据与成员数（不含成员明细）, with the deployment's defaults of the limits an org
+     * can be given its own value of (the org limits dialog shows them for the values left empty).
+     */
     listOrgs(): Promise<{
         orgs: (Org & {
             memberCount: number;
         })[];
+        limitDefaults: LimitDefaults;
     }>;
     getSettings(): Promise<DeploymentSettings>;
+    private limitDefaults;
     putSettings(principal: Principal, body: z.infer<typeof SettingsSchema>): Promise<DeploymentSettings>;
     /**
      * 模型供应商与模型（后台「模型」页）：每个供应商带状态，列模型失败的标 `error`，不影响其他供应商；
-     * 一并返回价格表与币种（改价仍走 `PUT /admin/model-prices`）。
+     * 一并返回价格表与币种（改价仍走 `PUT /admin/model-prices`）。Each provider carries its extension's
+     * display name (null when it has none).
      */
     getModels(): Promise<{
-        providers: ProviderStatus[];
+        providers: (ProviderStatus & {
+            displayName: LocalizedName | null;
+        })[];
         prices: ModelPrice[];
         currency: string;
     }>;
@@ -129,11 +160,11 @@ export declare class AdminController {
     }>;
     /** 模型用途与部署默认映射（`override` 一律为 null；组织覆盖在组织侧接口）。 */
     getModelPurposes(): Promise<{
-        purposes: PurposeView[];
+        purposes: PurposeListing[];
     }>;
     /** 设置一个用途的部署默认，或 `target: null` 清除。 */
     putModelPurpose(principal: Principal, purpose: string, body: PurposePut): Promise<{
-        purpose: PurposeView;
+        purpose: PurposeListing;
     }>;
 }
 export {};

package/dist/admin/admin.controller.js

@@ -11,18 +11,20 @@ import { Controller, Get, HttpCode, Inject, Param, Patch, Post, Put } from "@nes
 import { z } from "zod";
 import { CatalogRequestsService } from "../catalog/requests.service.js";
 import { ExtensionAdmin } from "../extensions/admin-view.js";
+import { ExtensionDisplayNames } from "../extensions/display-name.js";
 import { extensionNeedsAction } from "../extensions/permission-view.js";
 import { AccountsService } from "../identity/accounts.js";
 import { MAX_PASSWORD_LENGTH } from "../identity/login.js";
-import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
+import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
 import { SessionService } from "../identity/sessions.js";
 import { DEPLOYMENT_SETTINGS_PATCH, SettingsService, } from "../identity/settings.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
 import { ZBody, ZQuery } from "../infra/validation/zod-params.js";
 import { MODEL_PRICE_PUT, PricesService, } from "../models/prices.js";
 import { purposeTargetOf } from "../models/purposes.controller.js";
-import { ModelPurposesService, PurposePutDto, } from "../models/purposes.js";
+import { ModelPurposesService, PurposePutDto, withDeclaredByNames, } from "../models/purposes.js";
 import { OrgsService } from "../orgs/orgs.service.js";
 import { ProviderRegistry } from "../runtime/providers.js";
 const ListQuerySchema = z.object({
@@ -36,14 +38,14 @@ const CreateAccountSchema = z.object({
     password: z.string().min(1).max(MAX_PASSWORD_LENGTH),
     displayName: z.string().trim().min(1).max(100),
     email: z.email().max(254).optional(),
-    enterpriseAdmin: z.boolean().optional(),
+    superAdmin: z.boolean().optional(),
 });
 class CreateAccountBody extends createZodDto(CreateAccountSchema, "CreateAccountBody") {
 }
 const UpdateAccountSchema = z.object({
     displayName: z.string().trim().min(1).max(100).optional(),
     status: z.enum(["active", "disabled"]).optional(),
-    isEnterpriseAdmin: z.boolean().optional(),
+    isSuperAdmin: z.boolean().optional(),
 });
 class UpdateAccountBody extends createZodDto(UpdateAccountSchema, "UpdateAccountBody") {
 }
@@ -56,7 +58,7 @@ class DeploymentSettingsBody extends createZodDto(SettingsSchema, "DeploymentSet
 // a union schema: a DTO value rather than a class (a class cannot extend a union instance type)
 const ModelPriceBody = createZodDto(MODEL_PRICE_PUT, "ModelPricePut");
 /**
- * 企业管理员端点（`/api/v1/admin/*`）：只接受企业管理员的 Web 会话或个人令牌；
+ * 超级管理员端点（`/api/v1/admin/*`）：只接受超级管理员的 Web 会话或个人令牌；
  * 服务令牌一律 `forbidden`（未标 `@AllowService`）。
  */
 let AdminController = class AdminController {
@@ -70,7 +72,9 @@ let AdminController = class AdminController {
     plugins;
     registry;
     catalogRequests;
-    constructor(accounts, sessions, log, orgs, settings, prices, purposes, plugins, registry, catalogRequests) {
+    displayNames;
+    config;
+    constructor(accounts, sessions, log, orgs, settings, prices, purposes, plugins, registry, catalogRequests, displayNames, config) {
         this.accounts = accounts;
         this.sessions = sessions;
         this.log = log;
@@ -81,6 +85,8 @@ let AdminController = class AdminController {
         this.plugins = plugins;
         this.registry = registry;
         this.catalogRequests = catalogRequests;
+        this.displayNames = displayNames;
+        this.config = config;
     }
     /** 后台概览的四个数字（只读计数，不含任何对话内容）。 */
     async overview() {
@@ -117,17 +123,17 @@ let AdminController = class AdminController {
             password: body.password,
             displayName: body.displayName,
             ...(body.email !== undefined && { email: body.email }),
-            ...(body.enterpriseAdmin !== undefined && { enterpriseAdmin: body.enterpriseAdmin }),
+            ...(body.superAdmin !== undefined && { superAdmin: body.superAdmin }),
         }, actor.account.id, patTokenId(actor));
         return { account };
     }
-    /** 改显示名 / 状态 / 企业管理员；停用时同时吊销该账号的全部会话与个人令牌。 */
+    /** 改显示名 / 状态 / 超级管理员；停用时同时吊销该账号的全部会话与个人令牌。 */
     async updateAccount(principal, accountId, body) {
         const actor = requireUser(principal);
         const patch = {
             ...(body.displayName !== undefined && { displayName: body.displayName }),
             ...(body.status !== undefined && { status: body.status }),
-            ...(body.isEnterpriseAdmin !== undefined && { isEnterpriseAdmin: body.isEnterpriseAdmin }),
+            ...(body.isSuperAdmin !== undefined && { isSuperAdmin: body.isSuperAdmin }),
         };
         // 停用时账号状态、会话与个人令牌的吊销在同一个 PG 事务里完成
         const { account, revokedSessionIds } = await this.accounts.updateAccount(accountId, patch, actor.account.id, patTokenId(actor));
@@ -143,27 +149,44 @@ let AdminController = class AdminController {
         }
         return { account };
     }
-    /** 全部组织的元数据与成员数（不含成员明细）。 */
+    /**
+     * 全部组织的元数据与成员数（不含成员明细）, with the deployment's defaults of the limits an org
+     * can be given its own value of (the org limits dialog shows them for the values left empty).
+     */
     async listOrgs() {
-        return { orgs: await this.orgs.listAll() };
+        return { orgs: await this.orgs.listAll(), limitDefaults: this.limitDefaults() };
     }
     async getSettings() {
         return this.settings.get();
     }
+    limitDefaults() {
+        const cfg = this.config.get();
+        const { maxDepth, maxConcurrentPerConversation, maxDispatchesPerRun, maxTokensPerRun } = cfg.subagents;
+        return {
+            runConcurrency: cfg.runtime.orgConcurrency,
+            sandbox: { cpu: cfg.sandbox.limits.cpu, memoryMb: cfg.sandbox.limits.memoryMb },
+            subagents: { maxDepth, maxConcurrentPerConversation, maxDispatchesPerRun, maxTokensPerRun },
+        };
+    }
     async putSettings(principal, body) {
         const actor = requireUser(principal);
         return this.settings.update(body, actor.account.id, patTokenId(actor));
     }
     /**
      * 模型供应商与模型（后台「模型」页）：每个供应商带状态，列模型失败的标 `error`，不影响其他供应商；
-     * 一并返回价格表与币种（改价仍走 `PUT /admin/model-prices`）。
+     * 一并返回价格表与币种（改价仍走 `PUT /admin/model-prices`）。Each provider carries its extension's
+     * display name (null when it has none).
      */
     async getModels() {
         const [providers, prices] = await Promise.all([
             this.registry.listWithStatus(),
             this.getModelPrices(),
         ]);
-        return { providers, ...prices };
+        const names = await this.displayNames.many(providers.map((p) => p.plugin));
+        return {
+            providers: providers.map((p) => ({ ...p, displayName: names.get(p.plugin) ?? null })),
+            ...prices,
+        };
     }
     /** 模型价格表（每百万 token）与币种（部署设置 `priceCurrency`）。 */
     async getModelPrices() {
@@ -178,14 +201,14 @@ let AdminController = class AdminController {
     }
     /** 模型用途与部署默认映射（`override` 一律为 null；组织覆盖在组织侧接口）。 */
     async getModelPurposes() {
-        return { purposes: await this.purposes.list() };
+        return { purposes: await withDeclaredByNames(await this.purposes.list(), this.displayNames) };
     }
     /** 设置一个用途的部署默认，或 `target: null` 清除。 */
     async putModelPurpose(principal, purpose, body) {
         const actor = requireUser(principal);
-        return {
-            purpose: await this.purposes.setDefault(purpose, purposeTargetOf(body), actor.account.id, patTokenId(actor)),
-        };
+        const view = await this.purposes.setDefault(purpose, purposeTargetOf(body), actor.account.id, patTokenId(actor));
+        const [listing] = await withDeclaredByNames([view], this.displayNames);
+        return { purpose: listing };
     }
 };
 __decorate([
@@ -240,7 +263,7 @@ __decorate([
 ], AdminController.prototype, "putModelPurpose", null);
 AdminController = __decorate([
     Controller("api/v1/admin"),
-    EnterpriseAdmin(),
+    SuperAdmin(),
     __param(0, Inject(AccountsService)),
     __param(1, Inject(SessionService)),
     __param(2, Inject(KERNEL_LOGGER)),
@@ -250,6 +273,8 @@ AdminController = __decorate([
     __param(6, Inject(ModelPurposesService)),
     __param(7, Inject(ExtensionAdmin)),
     __param(8, Inject(ProviderRegistry)),
-    __param(9, Inject(CatalogRequestsService))
+    __param(9, Inject(CatalogRequestsService)),
+    __param(10, Inject(ExtensionDisplayNames)),
+    __param(11, Inject(KernelConfigService))
 ], AdminController);
 export { AdminController };

package/dist/admin/extensions.controller.d.ts

@@ -3,6 +3,7 @@ import { ExtensionAdminOps } from "../extensions/admin-ops.js";
 import { ExtensionAdmin } from "../extensions/admin-view.js";
 import { type DeploymentConfigView, ExtensionDeploymentConfigService } from "../extensions/deployment-config.js";
 import { ExtensionInstalls, type PackageReview } from "../extensions/installs.js";
+import { type OrgOverrideSummary, OrgOverrides } from "../extensions/org-overrides.js";
 import type { AdminExtensionView } from "../extensions/permission-view.js";
 import { type Principal } from "../identity/principal.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
@@ -15,13 +16,23 @@ declare const InstallSchema: z.ZodObject<{
 }, z.core.$strip>;
 declare const ConfigSchema: z.ZodObject<{
     values: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    secretEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        key: z.ZodString;
+        value: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        renameFrom: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
 }, z.core.$strip>;
 declare const NpmSchema: z.ZodObject<{
     package: z.ZodString;
     version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/** The `:name` route parameter of the org-overrides list (decision R20). */
+declare const NameParams: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
 /**
- * Deployment-level extension management (`/api/v1/admin/extensions/*`, enterprise admins): package
+ * Deployment-level extension management (`/api/v1/admin/extensions/*`, super admins): package
  * import (upload / npm, returns the review), the extension list and detail, web permission approval
  * (D8), install / enable / disable / uninstall (only writes the desired state and publishes
  * `kernel.plugins.changed`; every replica reconciles, no restart; replicas may still be converging
@@ -33,7 +44,8 @@ export declare class AdminExtensionsController {
     private readonly ops;
     private readonly deploymentConfigs;
     private readonly kernelConfig;
-    constructor(installs: ExtensionInstalls, admin: ExtensionAdmin, ops: ExtensionAdminOps, deploymentConfigs: ExtensionDeploymentConfigService, kernelConfig: KernelConfigService);
+    private readonly orgOverrides;
+    constructor(installs: ExtensionInstalls, admin: ExtensionAdmin, ops: ExtensionAdminOps, deploymentConfigs: ExtensionDeploymentConfigService, kernelConfig: KernelConfigService, orgOverrides: OrgOverrides);
     /**
      * 部署上的全部插件（内置、配置声明、安装记录）及其状态、权限与快照；`drainSeconds` 为停用 / 升级时
      * 在途工具调用最多等待的秒数（`extensionHost.drainSeconds`，界面提示用）。
@@ -50,6 +62,14 @@ export declare class AdminExtensionsController {
      * result. Unknown -> 404 `extension.not_found`.
      */
     config(name: string): Promise<DeploymentConfigView>;
+    /**
+     * The orgs keeping their own copy of the extension's overridable config (spec A §5.7): when it
+     * was made, which non-secret fields differ from the platform, whether each secret is set; never
+     * a secret value. The super admin cannot edit or drop a copy.
+     */
+    orgCopies({ name }: z.infer<typeof NameParams>): Promise<{
+        overrides: OrgOverrideSummary[];
+    }>;
     /**
      * Saves the deployment config (`values` keyed by field dot path; `null` clears, omitted keeps).
      * A field present in the startup config -> 409 `extension.config_readonly`; unknown or invalid
@@ -57,7 +77,8 @@ export declare class AdminExtensionsController {
      * (a value from the startup config) does not block the PUT: it saves anyway, the extension stays
      * pending configuration and the startup config has to change. Every replica re-reads after saving:
      * hot fields are replaced in place, other fields reload the extension, and a pending extension
-     * loads (no restart).
+     * loads (no restart). `secretEntries` set, rename or remove single keys of a secret record a
+     * config UI hint draws per item (a path no hint names -> 400 `validation_failed`).
      */
     putConfig(principal: Principal, name: string, body: z.infer<typeof ConfigSchema>): Promise<DeploymentConfigView>;
     /**

package/dist/admin/extensions.controller.js

@@ -14,10 +14,11 @@ import { ExtensionAdminOps } from "../extensions/admin-ops.js";
 import { ExtensionAdmin } from "../extensions/admin-view.js";
 import { ExtensionDeploymentConfigService, } from "../extensions/deployment-config.js";
 import { ExtensionInstalls } from "../extensions/installs.js";
-import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
+import { OrgOverrides } from "../extensions/org-overrides.js";
+import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
-import { ZBody } from "../infra/validation/zod-params.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
 const ApproveSchema = z.object({
     /** 安装记录的包（审阅时的 sha256）；配置声明的插件为 null。 */
     sha256: z
@@ -30,9 +31,28 @@ const InstallSchema = z.object({
     /** 包存储里的包（上传 / npm 导入返回的 sha256）。 */
     sha256: z.string().regex(/^[0-9a-f]{64}$/),
 });
+const SecretEntrySchema = z
+    .object({
+    /** A secret record field some `x-ui.secrets[].path` names. */
+    path: z.string().min(1).max(256),
+    key: z.string().min(1).max(256),
+    /** A string sets the key, `null` removes it. */
+    value: z.string().max(65_536).nullable().optional(),
+    /** Moves the value at this key to `key` first. */
+    renameFrom: z.string().min(1).max(256).optional(),
+})
+    .strict()
+    .refine((e) => e.value !== undefined || e.renameFrom !== undefined, {
+    message: "an entry needs value or renameFrom",
+})
+    .refine((e) => e.key !== "__proto__" && e.renameFrom !== "__proto__", {
+    message: "__proto__ is not a valid key",
+});
 const ConfigSchema = z.object({
     /** 字段点路径 → 新值（`null` 清除）。 */
     values: z.record(z.string().min(1).max(256), z.unknown()),
+    /** Single keys of hinted secret records (extension config forms spec §4.3), applied in order. */
+    secretEntries: z.array(SecretEntrySchema).max(200).optional(),
 });
 const NpmSchema = z.object({
     package: z.string().min(1).max(214),
@@ -46,8 +66,12 @@ class ExtensionConfigBody extends createZodDto(ConfigSchema, "ExtensionConfigBod
 }
 class ExtensionNpmImportBody extends createZodDto(NpmSchema, "ExtensionNpmImportBody") {
 }
+/** The `:name` route parameter of the org-overrides list (decision R20). */
+const NameParams = z.object({ name: z.string().min(1).max(64) });
+class AdminExtensionNameParamsDto extends createZodDto(NameParams, "AdminExtensionNameParams") {
+}
 /**
- * Deployment-level extension management (`/api/v1/admin/extensions/*`, enterprise admins): package
+ * Deployment-level extension management (`/api/v1/admin/extensions/*`, super admins): package
  * import (upload / npm, returns the review), the extension list and detail, web permission approval
  * (D8), install / enable / disable / uninstall (only writes the desired state and publishes
  * `kernel.plugins.changed`; every replica reconciles, no restart; replicas may still be converging
@@ -59,14 +83,16 @@ let AdminExtensionsController = class AdminExtensionsController {
     ops;
     deploymentConfigs;
     kernelConfig;
+    orgOverrides;
     constructor(installs, admin, ops, deploymentConfigs, 
     // 字段名不能与路由方法同名（如 `config`）：实例字段会遮住原型上的处理函数
-    kernelConfig) {
+    kernelConfig, orgOverrides) {
         this.installs = installs;
         this.admin = admin;
         this.ops = ops;
         this.deploymentConfigs = deploymentConfigs;
         this.kernelConfig = kernelConfig;
+        this.orgOverrides = orgOverrides;
     }
     /**
      * 部署上的全部插件（内置、配置声明、安装记录）及其状态、权限与快照；`drainSeconds` 为停用 / 升级时
@@ -90,6 +116,14 @@ let AdminExtensionsController = class AdminExtensionsController {
     config(name) {
         return this.deploymentConfigs.view(name);
     }
+    /**
+     * The orgs keeping their own copy of the extension's overridable config (spec A §5.7): when it
+     * was made, which non-secret fields differ from the platform, whether each secret is set; never
+     * a secret value. The super admin cannot edit or drop a copy.
+     */
+    async orgCopies({ name }) {
+        return { overrides: await this.orgOverrides.listForPlugin(name) };
+    }
     /**
      * Saves the deployment config (`values` keyed by field dot path; `null` clears, omitted keeps).
      * A field present in the startup config -> 409 `extension.config_readonly`; unknown or invalid
@@ -97,11 +131,12 @@ let AdminExtensionsController = class AdminExtensionsController {
      * (a value from the startup config) does not block the PUT: it saves anyway, the extension stays
      * pending configuration and the startup config has to change. Every replica re-reads after saving:
      * hot fields are replaced in place, other fields reload the extension, and a pending extension
-     * loads (no restart).
+     * loads (no restart). `secretEntries` set, rename or remove single keys of a secret record a
+     * config UI hint draws per item (a path no hint names -> 400 `validation_failed`).
      */
     putConfig(principal, name, body) {
         const actor = requireUser(principal);
-        return this.deploymentConfigs.put(name, body.values, actor.account.id, patTokenId(actor));
+        return this.deploymentConfigs.put(name, body.values, actor.account.id, patTokenId(actor), body.secretEntries);
     }
     /**
      * Web approval: writes the snapshot (source web), audits `extension.permissions_approved` and
@@ -177,6 +212,10 @@ __decorate([
     Get(":name/config"),
     __param(0, Param("name"))
 ], AdminExtensionsController.prototype, "config", null);
+__decorate([
+    Get(":name/org-overrides"),
+    __param(0, ZParam(AdminExtensionNameParamsDto))
+], AdminExtensionsController.prototype, "orgCopies", null);
 __decorate([
     Put(":name/config"),
     __param(0, CurrentPrincipal()),
@@ -229,11 +268,12 @@ __decorate([
 ], AdminExtensionsController.prototype, "fromNpm", null);
 AdminExtensionsController = __decorate([
     Controller("api/v1/admin/extensions"),
-    EnterpriseAdmin(),
+    SuperAdmin(),
     __param(0, Inject(ExtensionInstalls)),
     __param(1, Inject(ExtensionAdmin)),
     __param(2, Inject(ExtensionAdminOps)),
     __param(3, Inject(ExtensionDeploymentConfigService)),
-    __param(4, Inject(KernelConfigService))
+    __param(4, Inject(KernelConfigService)),
+    __param(5, Inject(OrgOverrides))
 ], AdminExtensionsController);
 export { AdminExtensionsController };

package/dist/admin/setup-lock.d.ts

@@ -2,7 +2,7 @@ import { TransactionHost } from "../infra/database/transaction-host.js";
 import { XactLock } from "../infra/database/xact-lock.js";
 /**
  * The deployment setup lock (one provider per transaction-scoped lock): serializes the web setup
- * wizard and the CLI's `admin create --if-none`, so concurrent runs create exactly one enterprise
+ * wizard and the CLI's `admin create --if-none`, so concurrent runs create exactly one super
  * admin. Joins the caller's transaction (`mandatory`), which holds it until it ends.
  */
 export declare class SetupLock {

package/dist/admin/setup-lock.js

@@ -15,7 +15,7 @@ import { XactLock } from "../infra/database/xact-lock.js";
 const SETUP_LOCK = "capybara.setup";
 /**
  * The deployment setup lock (one provider per transaction-scoped lock): serializes the web setup
- * wizard and the CLI's `admin create --if-none`, so concurrent runs create exactly one enterprise
+ * wizard and the CLI's `admin create --if-none`, so concurrent runs create exactly one super
  * admin. Joins the caller's transaction (`mandatory`), which holds it until it ends.
  */
 let SetupLock = class SetupLock {

package/dist/admin/setup.controller.d.ts

@@ -24,7 +24,7 @@ export declare class SetupController {
         needsSetup: boolean;
     }>;
     /**
-     * 建首个企业管理员（可选同时建组织），成功后直接登录（设会话 Cookie）。
+     * 建首个超级管理员（可选同时建组织），成功后直接登录（设会话 Cookie）。
      * 配置了 `auth.setupToken` 时 body 中的 `setupToken` 必须与之相等，否则 `setup.token_invalid`；
      * 核对前先占用限流额度，超限 → 429 `auth.rate_limited`，核对通过后退还。
      */