@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.6

package/bootstrap.json

@@ -3,24 +3,80 @@
   "schemaVersion": 1,
   "marketplace": {
     "url": "https://github.com/capybara-hq/plugins.git",
-    "commit": "08e336dafe124615622534683887120c81ec416b"
+    "commit": "77f0ac0c0bbb1e7e3ea66ae3bd7931f0ed06b777"
   },
   "plugins": [
     {
       "name": "openai-compatible",
       "source": "npm",
       "npm": "@capybara-hq/plugin-openai-compatible",
-      "version": "0.1.0-rc.0",
-      "integrity": "sha512-NYyjRfC2U6bAjjlFU0rmJuDs3IyuAwektV9KLBpnFcDVRDfRgBpcSBV/jp0tzXhv9ee5MWqzOKN20WNdKWO9fQ==",
+      "version": "0.1.0-rc.2",
+      "integrity": "sha512-HG3sPg9VjSldr/qP5647SV0LP3xEqIbtnMvl4VG0XHCHRPJ1wc9PBMb8hrTZ3FGc43OKTWgFyfAV3fNKm29JtQ==",
       "required": true
     },
     {
       "name": "object-store-s3",
       "source": "npm",
       "npm": "@capybara-hq/plugin-object-store-s3",
-      "version": "0.1.0-rc.0",
-      "integrity": "sha512-jFbstLMsMeZ3EqGEm/5OnYWm4aGM9nIw71DmIuPu/frk4/Y+nTnaBWgT1SUDEr6NbFb34V31NIVNMJSoxmvMww==",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-/HABg+/LsR+YJmRlJYB694hFFgZPTReN9BDwArdZpsNR0n/uBanRgaNnTT/C/wZd4uNTq9EVClYvZ4t3xmjKGQ==",
       "required": true
+    },
+    {
+      "name": "anthropic",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-anthropic",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-/Ptn4epXv38kBKqd3MDxhy21hP0vQLkLdEov6sUvn2BlKRltgLYAbiKD/9P+B1w2RZmoNXdhZgqoSZ0Q036LNw==",
+      "required": false
+    },
+    {
+      "name": "openai",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-openai",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-F714dJ023p8XcrPXYNZyjiow5BXza5KTdlJV4Uw8spgulgjPSF44n0SVMEA1iyYCwOFrr58NSvw51AqmOYg6Fw==",
+      "required": false
+    },
+    {
+      "name": "connector-mcp",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-connector-mcp",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-cMc/d7Tngzx7/kyyCmt9W4kVC8JkfH1q7dQ5bLpnTJfwg8iYrdwUGaD6Q7ImYCb3AiguM0Xe2Js4RlU7ed22Kw==",
+      "required": false
+    },
+    {
+      "name": "connector-openapi",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-connector-openapi",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-XahjgfA5hay/D32rUNrvql4SYAk0R04vGLyEzZg6Sq4ZNoqFHTKuj8Gndr5lD3AiwMqVngTva+x3hpVdosmEjA==",
+      "required": false
+    },
+    {
+      "name": "jina",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-jina",
+      "version": "0.1.0-rc.0",
+      "integrity": "sha512-fFquQfglzgaCoq3/tcRCYBdLfLe1BzIO5xDJHP1h0I7ugXGmUn9qdtFWOJ6Sw8TJvFeeqGSrkvtAUTVo5Phe2w==",
+      "required": false
+    },
+    {
+      "name": "sandbox-docker",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-sandbox-docker",
+      "version": "0.1.0-rc.2",
+      "integrity": "sha512-f5BiecQQvRLI8NaGHUy3l+nNvcCLXTQnHQ8od93PAbBpg6q0EkAvZ7R/M4yZ7dK7PeIan61VB+QfwlnpLLw27Q==",
+      "required": false
+    },
+    {
+      "name": "todo",
+      "source": "npm",
+      "npm": "@capybara-hq/plugin-todo",
+      "version": "0.1.0-rc.1",
+      "integrity": "sha512-Qz2FX05Nxbbetf8rcbmA3QZqvGDFeBgJOz/+vckD0N7di8YVKs3qoqoU7mzvBKnImWK63LiJLotGNQUY2QsXhg==",
+      "required": false
     }
   ]
 }

package/dist/admin/admin.controller.d.ts

@@ -7,22 +7,42 @@ import { type Account, AccountsService } from "../identity/accounts.js";
 import { type Principal } from "../identity/principal.js";
 import { SessionService } from "../identity/sessions.js";
 import { type DeploymentSettings, SettingsService } from "../identity/settings.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { type ModelDisabledPatch, type ModelProviderParams } from "../models/enablement.controller.js";
+import { type ModelDisableResult, ModelEnablement } from "../models/enablement.js";
 import { type ModelPrice, type ModelPricePut, PricesService } from "../models/prices.js";
-import { ModelPurposesService, type PurposePut, type PurposeView } from "../models/purposes.js";
+import { ModelPurposesService, type PurposeListing, type PurposePut } from "../models/purposes.js";
 import { type Org, OrgsService } from "../orgs/orgs.service.js";
 import { ProviderRegistry, type ProviderStatus } from "../runtime/providers.js";
+import type { SubagentLimits } from "../runtime/subagents/limits.js";
 /** 后台概览（`GET /api/v1/admin/overview`）的计数。 */
 export interface AdminOverview {
     /**
-     * Extensions an enterprise admin has to act on (pending approval or configuration, failed, missing
+     * Extensions a super admin has to act on (pending approval or configuration, failed, missing
      * dependency, replicas disagree); see `extensionNeedsAction`.
      */
     extensionsNeedingAction: number;
-    /** Catalog requests waiting for an enterprise admin (stage deployment, pending). */
+    /** Catalog requests waiting for a super admin (stage deployment, pending). */
     catalogRequestsPending: number;
     orgs: number;
     accounts: number;
 }
+/**
+ * The deployment's defaults of the per-org limits (with `GET /api/v1/admin/orgs`): what an
+ * organization without an override gets, from the live config. `subagents.maxDispatchesPerRun` and
+ * `maxTokensPerRun` of 0 mean no limit.
+ */
+export interface LimitDefaults {
+    /** `runtime.orgConcurrency`. */
+    runConcurrency: number;
+    /** `sandbox.limits.cpu` / `memoryMb`. */
+    sandbox: {
+        cpu: number;
+        memoryMb: number;
+    };
+    /** `subagents.*`. */
+    subagents: SubagentLimits;
+}
 declare const ListQuerySchema: z.ZodObject<{
     after: z.ZodOptional<z.ZodString>;
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -32,7 +52,7 @@ declare const CreateAccountSchema: z.ZodObject<{
     password: z.ZodString;
     displayName: z.ZodString;
     email: z.ZodOptional<z.ZodEmail>;
-    enterpriseAdmin: z.ZodOptional<z.ZodBoolean>;
+    superAdmin: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 declare const UpdateAccountSchema: z.ZodObject<{
     displayName: z.ZodOptional<z.ZodString>;
@@ -40,13 +60,13 @@ declare const UpdateAccountSchema: z.ZodObject<{
         active: "active";
         disabled: "disabled";
     }>>;
-    isEnterpriseAdmin: z.ZodOptional<z.ZodBoolean>;
+    isSuperAdmin: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /** 至少给出一个键；`runConcurrencyOverrides` 按组织合并，值为 null 删除该组织的覆盖。 */
 declare const SettingsSchema: z.ZodObject<{
     orgCreation: z.ZodOptional<z.ZodEnum<{
         anyone: "anyone";
-        enterprise_admin: "enterprise_admin";
+        super_admin: "super_admin";
     }>>;
     runConcurrencyOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodNumber>>>;
     priceCurrency: z.ZodOptional<z.ZodString>;
@@ -55,7 +75,8 @@ declare const SettingsSchema: z.ZodObject<{
         memoryMb: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>>>;
     subagentLimitOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodObject<{
-        maxConcurrentPerRun: z.ZodOptional<z.ZodNumber>;
+        maxDepth: z.ZodOptional<z.ZodNumber>;
+        maxConcurrentPerConversation: z.ZodOptional<z.ZodNumber>;
         maxDispatchesPerRun: z.ZodOptional<z.ZodNumber>;
         maxTokensPerRun: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>>>;
@@ -67,9 +88,10 @@ declare const SettingsSchema: z.ZodObject<{
         allow: "allow";
         deny: "deny";
     }>>;
+    orgMarketplaceBrowse: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 /**
- * 企业管理员端点（`/api/v1/admin/*`）：只接受企业管理员的 Web 会话或个人令牌；
+ * 超级管理员端点（`/api/v1/admin/*`）：只接受超级管理员的 Web 会话或个人令牌；
  * 服务令牌一律 `forbidden`（未标 `@AllowService`）。
  */
 export declare class AdminController {
@@ -84,7 +106,9 @@ export declare class AdminController {
     private readonly registry;
     private readonly catalogRequests;
     private readonly displayNames;
-    constructor(accounts: AccountsService, sessions: SessionService, log: Logger, orgs: OrgsService, settings: SettingsService, prices: PricesService, purposes: ModelPurposesService, plugins: ExtensionAdmin, registry: ProviderRegistry, catalogRequests: CatalogRequestsService, displayNames: ExtensionDisplayNames);
+    private readonly enablement;
+    private readonly config;
+    constructor(accounts: AccountsService, sessions: SessionService, log: Logger, orgs: OrgsService, settings: SettingsService, prices: PricesService, purposes: ModelPurposesService, plugins: ExtensionAdmin, registry: ProviderRegistry, catalogRequests: CatalogRequestsService, displayNames: ExtensionDisplayNames, enablement: ModelEnablement, config: KernelConfigService);
     /** 后台概览的四个数字（只读计数，不含任何对话内容）。 */
     overview(): Promise<AdminOverview>;
     /**
@@ -98,22 +122,28 @@ export declare class AdminController {
     createAccount(principal: Principal, body: z.infer<typeof CreateAccountSchema>): Promise<{
         account: Account;
     }>;
-    /** 改显示名 / 状态 / 企业管理员；停用时同时吊销该账号的全部会话与个人令牌。 */
+    /** 改显示名 / 状态 / 超级管理员；停用时同时吊销该账号的全部会话与个人令牌。 */
     updateAccount(principal: Principal, accountId: string, body: z.infer<typeof UpdateAccountSchema>): Promise<{
         account: Account;
     }>;
-    /** 全部组织的元数据与成员数（不含成员明细）。 */
+    /**
+     * 全部组织的元数据与成员数（不含成员明细）, with the deployment's defaults of the limits an org
+     * can be given its own value of (the org limits dialog shows them for the values left empty).
+     */
     listOrgs(): Promise<{
         orgs: (Org & {
             memberCount: number;
         })[];
+        limitDefaults: LimitDefaults;
     }>;
     getSettings(): Promise<DeploymentSettings>;
+    private limitDefaults;
     putSettings(principal: Principal, body: z.infer<typeof SettingsSchema>): Promise<DeploymentSettings>;
     /**
      * 模型供应商与模型（后台「模型」页）：每个供应商带状态，列模型失败的标 `error`，不影响其他供应商；
      * 一并返回价格表与币种（改价仍走 `PUT /admin/model-prices`）。Each provider carries its extension's
-     * display name (null when it has none).
+     * display name (null when it has none); every model of the platform's list carries `disabled`
+     * (the platform's disabled list, spec B §5.3).
      */
     getModels(): Promise<{
         providers: (ProviderStatus & {
@@ -122,6 +152,13 @@ export declare class AdminController {
         prices: ModelPrice[];
         currency: string;
     }>;
+    /**
+     * The platform's disabled models of one provider (spec B §5.3): disables and enables the ids the
+     * body names (others keep their state); such a model is invisible to every org. The response
+     * lists the agents and purposes, across orgs, that now point at a newly disabled model (the
+     * disable is not refused for them).
+     */
+    patchModelsDisabled(principal: Principal, params: z.infer<typeof ModelProviderParams>, body: z.infer<typeof ModelDisabledPatch>): Promise<ModelDisableResult>;
     /** 模型价格表（每百万 token）与币种（部署设置 `priceCurrency`）。 */
     getModelPrices(): Promise<{
         prices: ModelPrice[];
@@ -134,11 +171,11 @@ export declare class AdminController {
     }>;
     /** 模型用途与部署默认映射（`override` 一律为 null；组织覆盖在组织侧接口）。 */
     getModelPurposes(): Promise<{
-        purposes: PurposeView[];
+        purposes: PurposeListing[];
     }>;
     /** 设置一个用途的部署默认，或 `target: null` 清除。 */
     putModelPurpose(principal: Principal, purpose: string, body: PurposePut): Promise<{
-        purpose: PurposeView;
+        purpose: PurposeListing;
     }>;
 }
 export {};

package/dist/admin/admin.controller.js

@@ -15,15 +15,18 @@ import { ExtensionDisplayNames } from "../extensions/display-name.js";
 import { extensionNeedsAction } from "../extensions/permission-view.js";
 import { AccountsService } from "../identity/accounts.js";
 import { MAX_PASSWORD_LENGTH } from "../identity/login.js";
-import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
+import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
 import { SessionService } from "../identity/sessions.js";
 import { DEPLOYMENT_SETTINGS_PATCH, SettingsService, } from "../identity/settings.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
-import { ZBody, ZQuery } from "../infra/validation/zod-params.js";
+import { ZBody, ZParam, ZQuery } from "../infra/validation/zod-params.js";
+import { ModelDisabledPatchDto, ModelProviderParamsDto, } from "../models/enablement.controller.js";
+import { ModelEnablement } from "../models/enablement.js";
 import { MODEL_PRICE_PUT, PricesService, } from "../models/prices.js";
 import { purposeTargetOf } from "../models/purposes.controller.js";
-import { ModelPurposesService, PurposePutDto, } from "../models/purposes.js";
+import { ModelPurposesService, PurposePutDto, withDeclaredByNames, } from "../models/purposes.js";
 import { OrgsService } from "../orgs/orgs.service.js";
 import { ProviderRegistry } from "../runtime/providers.js";
 const ListQuerySchema = z.object({
@@ -37,14 +40,14 @@ const CreateAccountSchema = z.object({
     password: z.string().min(1).max(MAX_PASSWORD_LENGTH),
     displayName: z.string().trim().min(1).max(100),
     email: z.email().max(254).optional(),
-    enterpriseAdmin: z.boolean().optional(),
+    superAdmin: z.boolean().optional(),
 });
 class CreateAccountBody extends createZodDto(CreateAccountSchema, "CreateAccountBody") {
 }
 const UpdateAccountSchema = z.object({
     displayName: z.string().trim().min(1).max(100).optional(),
     status: z.enum(["active", "disabled"]).optional(),
-    isEnterpriseAdmin: z.boolean().optional(),
+    isSuperAdmin: z.boolean().optional(),
 });
 class UpdateAccountBody extends createZodDto(UpdateAccountSchema, "UpdateAccountBody") {
 }
@@ -57,7 +60,7 @@ class DeploymentSettingsBody extends createZodDto(SettingsSchema, "DeploymentSet
 // a union schema: a DTO value rather than a class (a class cannot extend a union instance type)
 const ModelPriceBody = createZodDto(MODEL_PRICE_PUT, "ModelPricePut");
 /**
- * 企业管理员端点（`/api/v1/admin/*`）：只接受企业管理员的 Web 会话或个人令牌；
+ * 超级管理员端点（`/api/v1/admin/*`）：只接受超级管理员的 Web 会话或个人令牌；
  * 服务令牌一律 `forbidden`（未标 `@AllowService`）。
  */
 let AdminController = class AdminController {
@@ -72,7 +75,9 @@ let AdminController = class AdminController {
     registry;
     catalogRequests;
     displayNames;
-    constructor(accounts, sessions, log, orgs, settings, prices, purposes, plugins, registry, catalogRequests, displayNames) {
+    enablement;
+    config;
+    constructor(accounts, sessions, log, orgs, settings, prices, purposes, plugins, registry, catalogRequests, displayNames, enablement, config) {
         this.accounts = accounts;
         this.sessions = sessions;
         this.log = log;
@@ -84,6 +89,8 @@ let AdminController = class AdminController {
         this.registry = registry;
         this.catalogRequests = catalogRequests;
         this.displayNames = displayNames;
+        this.enablement = enablement;
+        this.config = config;
     }
     /** 后台概览的四个数字（只读计数，不含任何对话内容）。 */
     async overview() {
@@ -120,17 +127,17 @@ let AdminController = class AdminController {
             password: body.password,
             displayName: body.displayName,
             ...(body.email !== undefined && { email: body.email }),
-            ...(body.enterpriseAdmin !== undefined && { enterpriseAdmin: body.enterpriseAdmin }),
+            ...(body.superAdmin !== undefined && { superAdmin: body.superAdmin }),
         }, actor.account.id, patTokenId(actor));
         return { account };
     }
-    /** 改显示名 / 状态 / 企业管理员；停用时同时吊销该账号的全部会话与个人令牌。 */
+    /** 改显示名 / 状态 / 超级管理员；停用时同时吊销该账号的全部会话与个人令牌。 */
     async updateAccount(principal, accountId, body) {
         const actor = requireUser(principal);
         const patch = {
             ...(body.displayName !== undefined && { displayName: body.displayName }),
             ...(body.status !== undefined && { status: body.status }),
-            ...(body.isEnterpriseAdmin !== undefined && { isEnterpriseAdmin: body.isEnterpriseAdmin }),
+            ...(body.isSuperAdmin !== undefined && { isSuperAdmin: body.isSuperAdmin }),
         };
         // 停用时账号状态、会话与个人令牌的吊销在同一个 PG 事务里完成
         const { account, revokedSessionIds } = await this.accounts.updateAccount(accountId, patch, actor.account.id, patTokenId(actor));
@@ -146,13 +153,25 @@ let AdminController = class AdminController {
         }
         return { account };
     }
-    /** 全部组织的元数据与成员数（不含成员明细）。 */
+    /**
+     * 全部组织的元数据与成员数（不含成员明细）, with the deployment's defaults of the limits an org
+     * can be given its own value of (the org limits dialog shows them for the values left empty).
+     */
     async listOrgs() {
-        return { orgs: await this.orgs.listAll() };
+        return { orgs: await this.orgs.listAll(), limitDefaults: this.limitDefaults() };
     }
     async getSettings() {
         return this.settings.get();
     }
+    limitDefaults() {
+        const cfg = this.config.get();
+        const { maxDepth, maxConcurrentPerConversation, maxDispatchesPerRun, maxTokensPerRun } = cfg.subagents;
+        return {
+            runConcurrency: cfg.runtime.orgConcurrency,
+            sandbox: { cpu: cfg.sandbox.limits.cpu, memoryMb: cfg.sandbox.limits.memoryMb },
+            subagents: { maxDepth, maxConcurrentPerConversation, maxDispatchesPerRun, maxTokensPerRun },
+        };
+    }
     async putSettings(principal, body) {
         const actor = requireUser(principal);
         return this.settings.update(body, actor.account.id, patTokenId(actor));
@@ -160,7 +179,8 @@ let AdminController = class AdminController {
     /**
      * 模型供应商与模型（后台「模型」页）：每个供应商带状态，列模型失败的标 `error`，不影响其他供应商；
      * 一并返回价格表与币种（改价仍走 `PUT /admin/model-prices`）。Each provider carries its extension's
-     * display name (null when it has none).
+     * display name (null when it has none); every model of the platform's list carries `disabled`
+     * (the platform's disabled list, spec B §5.3).
      */
     async getModels() {
         const [providers, prices] = await Promise.all([
@@ -173,6 +193,19 @@ let AdminController = class AdminController {
             ...prices,
         };
     }
+    /**
+     * The platform's disabled models of one provider (spec B §5.3): disables and enables the ids the
+     * body names (others keep their state); such a model is invisible to every org. The response
+     * lists the agents and purposes, across orgs, that now point at a newly disabled model (the
+     * disable is not refused for them).
+     */
+    async patchModelsDisabled(principal, params, body) {
+        const actor = requireUser(principal);
+        return this.enablement.setPlatform(params.provider, body, {
+            accountId: actor.account.id,
+            tokenId: patTokenId(actor),
+        });
+    }
     /** 模型价格表（每百万 token）与币种（部署设置 `priceCurrency`）。 */
     async getModelPrices() {
         const [prices, settings] = await Promise.all([this.prices.list(), this.settings.get()]);
@@ -186,14 +219,14 @@ let AdminController = class AdminController {
     }
     /** 模型用途与部署默认映射（`override` 一律为 null；组织覆盖在组织侧接口）。 */
     async getModelPurposes() {
-        return { purposes: await this.purposes.list() };
+        return { purposes: await withDeclaredByNames(await this.purposes.list(), this.displayNames) };
     }
     /** 设置一个用途的部署默认，或 `target: null` 清除。 */
     async putModelPurpose(principal, purpose, body) {
         const actor = requireUser(principal);
-        return {
-            purpose: await this.purposes.setDefault(purpose, purposeTargetOf(body), actor.account.id, patTokenId(actor)),
-        };
+        const view = await this.purposes.setDefault(purpose, purposeTargetOf(body), actor.account.id, patTokenId(actor));
+        const [listing] = await withDeclaredByNames([view], this.displayNames);
+        return { purpose: listing };
     }
 };
 __decorate([
@@ -229,6 +262,12 @@ __decorate([
 __decorate([
     Get("models")
 ], AdminController.prototype, "getModels", null);
+__decorate([
+    Patch("models/:provider/disabled"),
+    __param(0, CurrentPrincipal()),
+    __param(1, ZParam(ModelProviderParamsDto)),
+    __param(2, ZBody(ModelDisabledPatchDto))
+], AdminController.prototype, "patchModelsDisabled", null);
 __decorate([
     Get("model-prices")
 ], AdminController.prototype, "getModelPrices", null);
@@ -248,7 +287,7 @@ __decorate([
 ], AdminController.prototype, "putModelPurpose", null);
 AdminController = __decorate([
     Controller("api/v1/admin"),
-    EnterpriseAdmin(),
+    SuperAdmin(),
     __param(0, Inject(AccountsService)),
     __param(1, Inject(SessionService)),
     __param(2, Inject(KERNEL_LOGGER)),
@@ -259,6 +298,8 @@ AdminController = __decorate([
     __param(7, Inject(ExtensionAdmin)),
     __param(8, Inject(ProviderRegistry)),
     __param(9, Inject(CatalogRequestsService)),
-    __param(10, Inject(ExtensionDisplayNames))
+    __param(10, Inject(ExtensionDisplayNames)),
+    __param(11, Inject(ModelEnablement)),
+    __param(12, Inject(KernelConfigService))
 ], AdminController);
 export { AdminController };

package/dist/admin/extensions.controller.d.ts

@@ -3,6 +3,7 @@ import { ExtensionAdminOps } from "../extensions/admin-ops.js";
 import { ExtensionAdmin } from "../extensions/admin-view.js";
 import { type DeploymentConfigView, ExtensionDeploymentConfigService } from "../extensions/deployment-config.js";
 import { ExtensionInstalls, type PackageReview } from "../extensions/installs.js";
+import { type OrgOverrideSummary, OrgOverrides } from "../extensions/org-overrides.js";
 import type { AdminExtensionView } from "../extensions/permission-view.js";
 import { type Principal } from "../identity/principal.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
@@ -26,8 +27,12 @@ declare const NpmSchema: z.ZodObject<{
     package: z.ZodString;
     version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/** The `:name` route parameter of the org-overrides list (decision R20). */
+declare const NameParams: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
 /**
- * Deployment-level extension management (`/api/v1/admin/extensions/*`, enterprise admins): package
+ * Deployment-level extension management (`/api/v1/admin/extensions/*`, super admins): package
  * import (upload / npm, returns the review), the extension list and detail, web permission approval
  * (D8), install / enable / disable / uninstall (only writes the desired state and publishes
  * `kernel.plugins.changed`; every replica reconciles, no restart; replicas may still be converging
@@ -39,7 +44,8 @@ export declare class AdminExtensionsController {
     private readonly ops;
     private readonly deploymentConfigs;
     private readonly kernelConfig;
-    constructor(installs: ExtensionInstalls, admin: ExtensionAdmin, ops: ExtensionAdminOps, deploymentConfigs: ExtensionDeploymentConfigService, kernelConfig: KernelConfigService);
+    private readonly orgOverrides;
+    constructor(installs: ExtensionInstalls, admin: ExtensionAdmin, ops: ExtensionAdminOps, deploymentConfigs: ExtensionDeploymentConfigService, kernelConfig: KernelConfigService, orgOverrides: OrgOverrides);
     /**
      * 部署上的全部插件（内置、配置声明、安装记录）及其状态、权限与快照；`drainSeconds` 为停用 / 升级时
      * 在途工具调用最多等待的秒数（`extensionHost.drainSeconds`，界面提示用）。
@@ -56,6 +62,14 @@ export declare class AdminExtensionsController {
      * result. Unknown -> 404 `extension.not_found`.
      */
     config(name: string): Promise<DeploymentConfigView>;
+    /**
+     * The orgs keeping their own copy of the extension's overridable config (spec A §5.7): when it
+     * was made, which non-secret fields differ from the platform, whether each secret is set; never
+     * a secret value. The super admin cannot edit or drop a copy.
+     */
+    orgCopies({ name }: z.infer<typeof NameParams>): Promise<{
+        overrides: OrgOverrideSummary[];
+    }>;
     /**
      * Saves the deployment config (`values` keyed by field dot path; `null` clears, omitted keeps).
      * A field present in the startup config -> 409 `extension.config_readonly`; unknown or invalid

package/dist/admin/extensions.controller.js

@@ -14,10 +14,11 @@ import { ExtensionAdminOps } from "../extensions/admin-ops.js";
 import { ExtensionAdmin } from "../extensions/admin-view.js";
 import { ExtensionDeploymentConfigService, } from "../extensions/deployment-config.js";
 import { ExtensionInstalls } from "../extensions/installs.js";
-import { CurrentPrincipal, EnterpriseAdmin, patTokenId, requireUser, } from "../identity/principal.js";
+import { OrgOverrides } from "../extensions/org-overrides.js";
+import { CurrentPrincipal, patTokenId, requireUser, SuperAdmin, } from "../identity/principal.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { createZodDto } from "../infra/validation/create-zod-dto.js";
-import { ZBody } from "../infra/validation/zod-params.js";
+import { ZBody, ZParam } from "../infra/validation/zod-params.js";
 const ApproveSchema = z.object({
     /** 安装记录的包（审阅时的 sha256）；配置声明的插件为 null。 */
     sha256: z
@@ -65,8 +66,12 @@ class ExtensionConfigBody extends createZodDto(ConfigSchema, "ExtensionConfigBod
 }
 class ExtensionNpmImportBody extends createZodDto(NpmSchema, "ExtensionNpmImportBody") {
 }
+/** The `:name` route parameter of the org-overrides list (decision R20). */
+const NameParams = z.object({ name: z.string().min(1).max(64) });
+class AdminExtensionNameParamsDto extends createZodDto(NameParams, "AdminExtensionNameParams") {
+}
 /**
- * Deployment-level extension management (`/api/v1/admin/extensions/*`, enterprise admins): package
+ * Deployment-level extension management (`/api/v1/admin/extensions/*`, super admins): package
  * import (upload / npm, returns the review), the extension list and detail, web permission approval
  * (D8), install / enable / disable / uninstall (only writes the desired state and publishes
  * `kernel.plugins.changed`; every replica reconciles, no restart; replicas may still be converging
@@ -78,14 +83,16 @@ let AdminExtensionsController = class AdminExtensionsController {
     ops;
     deploymentConfigs;
     kernelConfig;
+    orgOverrides;
     constructor(installs, admin, ops, deploymentConfigs, 
     // 字段名不能与路由方法同名（如 `config`）：实例字段会遮住原型上的处理函数
-    kernelConfig) {
+    kernelConfig, orgOverrides) {
         this.installs = installs;
         this.admin = admin;
         this.ops = ops;
         this.deploymentConfigs = deploymentConfigs;
         this.kernelConfig = kernelConfig;
+        this.orgOverrides = orgOverrides;
     }
     /**
      * 部署上的全部插件（内置、配置声明、安装记录）及其状态、权限与快照；`drainSeconds` 为停用 / 升级时
@@ -109,6 +116,14 @@ let AdminExtensionsController = class AdminExtensionsController {
     config(name) {
         return this.deploymentConfigs.view(name);
     }
+    /**
+     * The orgs keeping their own copy of the extension's overridable config (spec A §5.7): when it
+     * was made, which non-secret fields differ from the platform, whether each secret is set; never
+     * a secret value. The super admin cannot edit or drop a copy.
+     */
+    async orgCopies({ name }) {
+        return { overrides: await this.orgOverrides.listForPlugin(name) };
+    }
     /**
      * Saves the deployment config (`values` keyed by field dot path; `null` clears, omitted keeps).
      * A field present in the startup config -> 409 `extension.config_readonly`; unknown or invalid
@@ -197,6 +212,10 @@ __decorate([
     Get(":name/config"),
     __param(0, Param("name"))
 ], AdminExtensionsController.prototype, "config", null);
+__decorate([
+    Get(":name/org-overrides"),
+    __param(0, ZParam(AdminExtensionNameParamsDto))
+], AdminExtensionsController.prototype, "orgCopies", null);
 __decorate([
     Put(":name/config"),
     __param(0, CurrentPrincipal()),
@@ -249,11 +268,12 @@ __decorate([
 ], AdminExtensionsController.prototype, "fromNpm", null);
 AdminExtensionsController = __decorate([
     Controller("api/v1/admin/extensions"),
-    EnterpriseAdmin(),
+    SuperAdmin(),
     __param(0, Inject(ExtensionInstalls)),
     __param(1, Inject(ExtensionAdmin)),
     __param(2, Inject(ExtensionAdminOps)),
     __param(3, Inject(ExtensionDeploymentConfigService)),
-    __param(4, Inject(KernelConfigService))
+    __param(4, Inject(KernelConfigService)),
+    __param(5, Inject(OrgOverrides))
 ], AdminExtensionsController);
 export { AdminExtensionsController };

package/dist/admin/setup-lock.d.ts

@@ -2,7 +2,7 @@ import { TransactionHost } from "../infra/database/transaction-host.js";
 import { XactLock } from "../infra/database/xact-lock.js";
 /**
  * The deployment setup lock (one provider per transaction-scoped lock): serializes the web setup
- * wizard and the CLI's `admin create --if-none`, so concurrent runs create exactly one enterprise
+ * wizard and the CLI's `admin create --if-none`, so concurrent runs create exactly one super
  * admin. Joins the caller's transaction (`mandatory`), which holds it until it ends.
  */
 export declare class SetupLock {

package/dist/admin/setup-lock.js

@@ -15,7 +15,7 @@ import { XactLock } from "../infra/database/xact-lock.js";
 const SETUP_LOCK = "capybara.setup";
 /**
  * The deployment setup lock (one provider per transaction-scoped lock): serializes the web setup
- * wizard and the CLI's `admin create --if-none`, so concurrent runs create exactly one enterprise
+ * wizard and the CLI's `admin create --if-none`, so concurrent runs create exactly one super
  * admin. Joins the caller's transaction (`mandatory`), which holds it until it ends.
  */
 let SetupLock = class SetupLock {

package/dist/admin/setup.controller.d.ts

@@ -24,7 +24,7 @@ export declare class SetupController {
         needsSetup: boolean;
     }>;
     /**
-     * 建首个企业管理员（可选同时建组织），成功后直接登录（设会话 Cookie）。
+     * 建首个超级管理员（可选同时建组织），成功后直接登录（设会话 Cookie）。
      * 配置了 `auth.setupToken` 时 body 中的 `setupToken` 必须与之相等，否则 `setup.token_invalid`；
      * 核对前先占用限流额度，超限 → 429 `auth.rate_limited`，核对通过后退还。
      */

package/dist/admin/setup.controller.js

@@ -56,7 +56,7 @@ let SetupController = class SetupController {
         return this.setup.status();
     }
     /**
-     * 建首个企业管理员（可选同时建组织），成功后直接登录（设会话 Cookie）。
+     * 建首个超级管理员（可选同时建组织），成功后直接登录（设会话 Cookie）。
      * 配置了 `auth.setupToken` 时 body 中的 `setupToken` 必须与之相等，否则 `setup.token_invalid`；
      * 核对前先占用限流额度，超限 → 429 `auth.rate_limited`，核对通过后退还。
      */

package/dist/admin/setup.service.d.ts

@@ -4,8 +4,8 @@ import { TransactionHost } from "../infra/database/transaction-host.js";
 import { type Org, OrgsService } from "../orgs/orgs.service.js";
 import { SetupLock } from "./setup-lock.js";
 /**
- * The setup wizard. The CLI's enterprise admin creation (`createEnterpriseAdmin`,
- * `createEnterpriseAdminIfNone`) is on `AccountsService`, under the same {@link SetupLock}.
+ * The setup wizard. The CLI's super admin creation (`createSuperAdmin`,
+ * `createSuperAdminIfNone`) is on `AccountsService`, under the same {@link SetupLock}.
  */
 export declare class SetupService {
     private readonly db;
@@ -14,13 +14,13 @@ export declare class SetupService {
     private readonly accounts;
     private readonly orgs;
     constructor(db: KernelDb, txHost: TransactionHost, setupLock: SetupLock, accounts: AccountsService, orgs: OrgsService);
-    /** 不存在活跃企业管理员即需要初始化（每次实时查 PG，不缓存）。 */
+    /** 不存在活跃超级管理员即需要初始化（每次实时查 PG，不缓存）。 */
     status(): Promise<{
         needsSetup: boolean;
     }>;
     /**
      * Completes the setup in one transaction: {@link SetupLock} serializes concurrent setups, and
-     * under it there must still be no active enterprise admin; then creates the enterprise admin
+     * under it there must still be no active super admin; then creates the super admin
      * and (with `orgName`) an org it owns. Any failure rolls everything back. `inTx` runs last in the
      * same transaction (the wizard creates the session there), its result is `extra`; its failure
      * rolls back too.