@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.6

package/dist/extensions/admin-ops.js

@@ -14,13 +14,14 @@ import semver from "semver";
 import { pluginSchemaName } from "../ctx/create-ctx.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
+import { OrgLock } from "../orgs/org-lock.js";
 import { ExtensionAdmin } from "./admin-view.js";
 import { ExtensionBlobs } from "./blobs.js";
 import { ExtensionLifecycle, PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
@@ -28,19 +29,11 @@ import { PluginInstallLock } from "./locks.js";
 import { unrunMigrations } from "./migrate-lock.js";
 import { ExtensionPackageError, extensionPackageApiError, readExtensionPackage, } from "./package.js";
 import { ExtensionRegistry } from "./registry.js";
-/**
- * Deployment-level extension install / enable / disable / uninstall (C16 / D15): writes only the PG
- * desired state (`extension_installs`) and the audit, then publishes `kernel.plugins.changed` after
- * the commit (a failure only warns; the periodic reconcile catches up); replicas converge through
- * reconcile, no restart. It does not wait for replicas: the returned view may say `converging`.
- * Stateless, shared by every replica; the CLI uses it too (`actor` is null).
- * Every write runs in a transaction: first `lockEnterpriseAdminsAndAuthorize` (skipped by the CLI),
- * then an advisory lock by extension name and a lock on the install record row.
- */
 let ExtensionAdminOps = class ExtensionAdminOps {
     kdb;
     txHost;
     adminLock;
+    orgLock;
     installLock;
     admin;
     registry;
@@ -50,8 +43,10 @@ let ExtensionAdminOps = class ExtensionAdminOps {
     lifecycle;
     log;
     constructor(kdb, txHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
-    adminLock, installLock, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock, 
+    /** The owner org's lock: an owner's operation re-checks its admin under it. */
+    orgLock, installLock, 
     /**
      * The admin view after the operation, degraded when the package cannot be read
      * (`get(name, { allowUnreadable: true })`). If it throws, the operation has already committed:
@@ -73,6 +68,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         this.kdb = kdb;
         this.txHost = txHost;
         this.adminLock = adminLock;
+        this.orgLock = orgLock;
         this.installLock = installLock;
         this.admin = admin;
         this.registry = registry;
@@ -89,7 +85,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * New install or version change (upgrade / downgrade): the install record points at package
      * `sha256`; the desired state is unchanged (a new install is disabled). Audit `extension.installed`.
      * - Config-declared -> `extension.config_declared`; a required bootstrap plugin may be
-     *   installed at another version (an enterprise admin upgrades it; `required` is kept);
+     *   installed at another version (a super admin upgrades it; `required` is kept);
      * - package not in the package store -> `extension.package_not_found`; the extension name in the
      *   package is not `name` -> `extension.name_mismatch`;
      * - an install record of the same name exists but comes from another npm package ->
@@ -105,7 +101,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      *   go back to a version whose migrations are a subset of those already run).
      * Already pointing at the same package: nothing changes (no audit; for a changed source item only,
      * see below).
-     * `opts.catalogItemId`: the source item when installing through the enterprise catalog, stored
+     * `opts.catalogItemId`: the source item when installing through the platform catalog, stored
      * in `extension_installs.catalog_item_id` (F-AA) and registered in `extension_catalog_sources`;
      * installing outside the catalog (upload / npm / CLI) **keeps** the existing source items (T26
      * fix: clearing them would let org enablement bypass catalog policy, C22). The detail of the
@@ -140,8 +136,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
     }
     async writeInstall(name, sha256, pkg, target, actor, actorTokenId, opts) {
         const db = this.db;
-        if (actor !== null)
-            await this.adminLock.lockAndAuthorize(actor);
+        await this.authorize(actor, opts.owner);
         const row = await this.lockRow(name);
         // 不经目录重装时保留原来的来源条目（不清空，C22）
         const catalogItemId = opts.catalogItemId ?? row?.catalog_item_id ?? null;
@@ -221,13 +216,14 @@ let ExtensionAdminOps = class ExtensionAdminOps {
             .execute();
         await this.audit(actor, actorTokenId, "extension.installed", name, pkg.version, sha256, {
             catalogItemId,
+            ...ownerDetail(opts.owner),
         });
         afterCommit(() => this.notify(name));
         return { changed: true, state: row?.desired_state ?? "disabled" };
     }
     /** Enable on the deployment (audit `extension.enabled`); no change when already enabled. Org enablement is unchanged. */
-    enable(name, actor, actorTokenId) {
-        return this.setState(name, "enabled", actor, actorTokenId);
+    enable(name, actor, actorTokenId, owner) {
+        return this.setState(name, "enabled", actor, actorTokenId, owner);
     }
     /**
      * Disables on the deployment (audit `extension.disabled`); no change when already disabled. Every
@@ -235,8 +231,8 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * it; the org enablement switch is unchanged and the org page shows it as unavailable. A required
      * bootstrap plugin -> `extension.required`.
      */
-    disable(name, actor, actorTokenId) {
-        return this.setState(name, "disabled", actor, actorTokenId);
+    disable(name, actor, actorTokenId, owner) {
+        return this.setState(name, "disabled", actor, actorTokenId, owner);
     }
     /**
      * Uninstall: a required bootstrap plugin -> `extension.required`; must be disabled first
@@ -246,14 +242,13 @@ let ExtensionAdminOps = class ExtensionAdminOps {
      * permission snapshot and the package in the package store are untouched (a reinstall picks them
      * up).
      */
-    async uninstall(name, actor, actorTokenId) {
+    async uninstall(name, actor, actorTokenId, owner) {
         this.assertInstallable(name);
-        await this.writeUninstall(name, actor, actorTokenId);
+        await this.writeUninstall(name, actor, actorTokenId, owner);
     }
-    async writeUninstall(name, actor, actorTokenId) {
+    async writeUninstall(name, actor, actorTokenId, owner) {
         const db = this.db;
-        if (actor !== null)
-            await this.adminLock.lockAndAuthorize(actor);
+        await this.authorize(actor, owner);
         const row = await this.lockRow(name);
         if (!row)
             throw notFound(name);
@@ -265,22 +260,21 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         await db.deleteFrom("extension_installs").where("name", "=", name).execute();
         // 来源条目随安装记录一起删：之后不经目录重新安装时不再受旧条目的策略约束（T26 裁决）
         await db.deleteFrom("extension_catalog_sources").where("plugin", "=", name).execute();
-        await this.audit(actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256);
+        await this.audit(actor, actorTokenId, "extension.uninstalled", name, row.version, row.sha256, ownerDetail(owner));
         afterCommit(() => this.notify(name));
     }
-    async setState(name, state, actor, actorTokenId) {
+    async setState(name, state, actor, actorTokenId, owner) {
         this.assertInstallable(name);
-        const result = await this.writeState(name, state, actor, actorTokenId);
+        const result = await this.writeState(name, state, actor, actorTokenId, owner);
         return this.viewAfterCommit(name, {
             version: result.row.version,
             sha256: result.row.sha256,
             state,
         });
     }
-    async writeState(name, state, actor, actorTokenId) {
+    async writeState(name, state, actor, actorTokenId, owner) {
         const db = this.db;
-        if (actor !== null)
-            await this.adminLock.lockAndAuthorize(actor);
+        await this.authorize(actor, owner);
         const row = await this.lockRow(name);
         if (!row)
             throw notFound(name);
@@ -297,7 +291,7 @@ let ExtensionAdminOps = class ExtensionAdminOps {
         })
             .where("name", "=", name)
             .execute();
-        await this.audit(actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256);
+        await this.audit(actor, actorTokenId, state === "enabled" ? "extension.enabled" : "extension.disabled", name, row.version, row.sha256, ownerDetail(owner));
         afterCommit(() => this.notify(name));
         return { row, changed: true };
     }
@@ -316,6 +310,22 @@ let ExtensionAdminOps = class ExtensionAdminOps {
             return fallbackView(name, known, err);
         }
     }
+    /**
+     * Re-checks the actor in the operation's transaction: a super admin, or for an owner's operation
+     * an admin of the owner org; no account (the CLI, the kernel itself) is not checked.
+     */
+    async authorize(actor, owner) {
+        if (owner?.rollback === true)
+            return;
+        if (owner !== undefined) {
+            if (actor === null)
+                throw new Error("an owner's extension operation has an actor");
+            await this.orgLock.lockAndAuthorize(owner.orgId, actor, "catalog.upload");
+        }
+        else if (actor !== null) {
+            await this.adminLock.lockAndAuthorize(actor);
+        }
+    }
     /** 配置声明的插件不经安装记录管理。 */
     assertInstallable(name) {
         const declared = this.registry.declared().get(name);
@@ -372,6 +382,9 @@ __decorate([
 __decorate([
     Transactional()
 ], ExtensionAdminOps.prototype, "writeState", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ExtensionAdminOps.prototype, "authorize", null);
 __decorate([
     Transactional({ propagation: "mandatory" })
 ], ExtensionAdminOps.prototype, "lockRow", null);
@@ -379,15 +392,16 @@ ExtensionAdminOps = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
-    __param(2, Inject(EnterpriseAdminLock)),
-    __param(3, Inject(PluginInstallLock)),
-    __param(4, Inject(ExtensionAdmin)),
-    __param(5, Inject(ExtensionRegistry)),
-    __param(6, Inject(ExtensionBlobs)),
-    __param(7, Inject(KernelConfigService)),
-    __param(8, Inject(KERNEL_BUS)),
-    __param(9, Inject(ExtensionLifecycle)),
-    __param(10, Inject(KERNEL_LOGGER))
+    __param(2, Inject(SuperAdminLock)),
+    __param(3, Inject(OrgLock)),
+    __param(4, Inject(PluginInstallLock)),
+    __param(5, Inject(ExtensionAdmin)),
+    __param(6, Inject(ExtensionRegistry)),
+    __param(7, Inject(ExtensionBlobs)),
+    __param(8, Inject(KernelConfigService)),
+    __param(9, Inject(KERNEL_BUS)),
+    __param(10, Inject(ExtensionLifecycle)),
+    __param(11, Inject(KERNEL_LOGGER))
 ], ExtensionAdminOps);
 export { ExtensionAdminOps };
 /**
@@ -418,6 +432,9 @@ function fallbackView(name, known, err) {
         configValid: true,
         removable: true,
         required: false,
+        scope: null,
+        enabledOrgs: 0,
+        builtin: false,
         installSource: null,
         error: `the change was saved, but its current status cannot be read: ${err instanceof Error ? err.message : String(err)}`,
     };
@@ -443,7 +460,13 @@ async function hasRetainedData(db, name) {
         .executeTakeFirst();
     return hit !== undefined;
 }
-const required = (name) => new ApiError("extension.required", `Extension ${name} is required by this deployment (a bootstrap plugin): it is enabled in every organization and cannot be disabled or uninstalled; an enterprise admin can upgrade it`);
+const required = (name) => new ApiError("extension.required", `Extension ${name} is required by this deployment (a bootstrap plugin): it is enabled in every organization and cannot be disabled or uninstalled; a super admin can upgrade it`);
 const notFound = (name) => new ApiError("extension.not_found", `Extension ${name} is not installed in this deployment`);
 /** `to` 比 `from` 旧（任一方不是合法 semver 时不算降级）。 */
 const isDowngrade = (to, from) => semver.valid(to) !== null && semver.valid(from) !== null && semver.lt(to, from);
+/** The audit detail of an owner's operation. */
+function ownerDetail(owner) {
+    if (owner === undefined)
+        return {};
+    return { ownerOrgId: owner.orgId, ...(owner.rollback === true && { rollback: true }) };
+}

package/dist/extensions/admin-view.d.ts

@@ -1,11 +1,13 @@
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
 import { ExtensionApprovals } from "./approvals.js";
 import { ExtensionBlobs } from "./blobs.js";
+import { ExtensionDeploymentConfigService } from "./deployment-config.js";
 import { ExtensionDisplayNames } from "./display-name.js";
+import { EffectiveConfigs } from "./effective-config.js";
 import { ExtensionHost } from "./host.js";
 import { ExtensionInstalls } from "./installs.js";
 import { ExtensionLifecycle, PLUGINS_CHANGED_TOPIC } from "./lifecycle.js";
@@ -23,13 +25,13 @@ export interface PublishBus {
     publish(topic: string, payload: unknown): Promise<void>;
 }
 /**
- * 部署级插件后台（企业管理员）：列表 / 详情与网页批准权限（D8）。无状态，多副本共用；
+ * 部署级插件后台（超级管理员）：列表 / 详情与网页批准权限（D8）。无状态，多副本共用；
  * 状态由 PG（安装记录、快照、各副本状态行）与本副本宿主（配置声明插件的清单）推出。
  */
 export declare class ExtensionAdmin {
     private readonly kdb;
     readonly txHost: TransactionHost;
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
     private readonly adminLock;
     private readonly approveLock;
     private readonly blobs;
@@ -43,17 +45,29 @@ export declare class ExtensionAdmin {
     private readonly bus;
     private readonly log;
     private readonly displayNames;
+    /** Which required overridable fields the platform left empty (spec A §5.4a). */
+    private readonly deploymentConfig;
+    /** How many orgs still need their own config for such an extension. */
+    private readonly effectiveConfigs;
     private readonly packageSets;
     constructor(kdb: KernelDb, txHost: TransactionHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
-    adminLock: EnterpriseAdminLock, approveLock: PluginApproveLock, blobs: ExtensionBlobs, installs: ExtensionInstalls, approvals: ExtensionApprovals, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock: SuperAdminLock, approveLock: PluginApproveLock, blobs: ExtensionBlobs, installs: ExtensionInstalls, approvals: ExtensionApprovals, 
     /** The config-declared extensions (this replica's host; the CLI fills it from its inspection). */
     host: ExtensionHost, 
     /** This replica's reconcile after an approval (a no-op where the lifecycle never started: the CLI). */
-    lifecycle: ExtensionLifecycle, config: KernelConfigService, bus: PublishBus, log: KernelLogger, displayNames: ExtensionDisplayNames);
+    lifecycle: ExtensionLifecycle, config: KernelConfigService, bus: PublishBus, log: KernelLogger, displayNames: ExtensionDisplayNames, 
+    /** Which required overridable fields the platform left empty (spec A §5.4a). */
+    deploymentConfig: ExtensionDeploymentConfigService, 
+    /** How many orgs still need their own config for such an extension. */
+    effectiveConfigs: EffectiveConfigs);
     private get db();
-    /** 全部插件（配置声明 → 安装记录，各自按名字）。 */
-    list(): Promise<AdminExtensionView[]>;
+    /**
+     * Every extension (config-declared, then install records, each by name). With `names`, only
+     * those: no other package is read, so a caller that needs a few items (the catalog's pending
+     * check) neither pays for nor logs about the packages of unrelated extensions.
+     */
+    list(names?: ReadonlySet<string>): Promise<AdminExtensionView[]>;
     /**
      * A single extension; unknown -> `extension.not_found`; package unreadable ->
      * `extension.package_unavailable`. With `allowUnreadable` an unreadable package returns the same
@@ -66,7 +80,12 @@ export declare class ExtensionAdmin {
         allowUnreadable?: boolean;
     }): Promise<AdminExtensionView>;
     /**
-     * Web approval: re-checks the enterprise admin under the lock, compares the reviewed package
+     * The review digest of a stored package (the `reviewHash` its extension would show once
+     * installed); null when the package cannot be read.
+     */
+    packageReviewHash(sha256: string): Promise<string | null>;
+    /**
+     * Web approval: re-checks the super admin under the lock, compares the reviewed package
      * (`sha256`) and permission digest (`reviewHash`), writes the snapshot (source web) and the
      * `extension.permissions_approved` audit; after the commit publishes `kernel.plugins.changed` (a
      * failure only warns) and waits for one reconcile on this replica (other replicas converge through
@@ -76,10 +95,12 @@ export declare class ExtensionAdmin {
      *   recomputed now -> `extension.approval_stale`; a config-declared extension's `sha256` must be
      *   null (otherwise `validation_failed`);
      * - the snapshot already covers the current permission set (nothing to approve, F-N) ->
-     *   `extension.not_pending`.
+     *   `extension.not_pending`, except with `confirmBootstrap` when the snapshot is the bootstrap
+     *   step's (the catalog's confirm re-writes it with source web).
      */
     approve(actor: string, name: string, body: ApproveBody, opts?: {
         actorTokenId?: string;
+        confirmBootstrap?: boolean;
     }): Promise<AdminExtensionView>;
     private writeApproval;
     /** 配置声明 → 安装记录（与配置声明重名的安装记录不生效，不单列）。`only` 给出时只取这一个。 */
@@ -88,5 +109,11 @@ export declare class ExtensionAdmin {
      * 包的权限集合（静态清单 + 迁移 SQL，与上传时的审阅相同）、迁移审阅警告与是否有部署级配置字段；按 sha256 缓存。
      */
     private packageInfo;
+    /**
+     * For each configurable, readable extension whose platform config leaves required overridable
+     * fields empty (spec A §5.4a): the number of orgs still needing their own config. Extensions
+     * without overridable fields cost no read.
+     */
+    private orgsNeedingConfig;
     private views;
 }

package/dist/extensions/admin-view.js

@@ -11,7 +11,7 @@ import { SDK_VERSION } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ApiError } from "../errors.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -19,7 +19,10 @@ import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
 import { ExtensionApprovals, snapshotCovers, writeSnapshot, } from "./approvals.js";
 import { ExtensionBlobs } from "./blobs.js";
+import { ExtensionDeploymentConfigService } from "./deployment-config.js";
 import { ExtensionDisplayNames } from "./display-name.js";
+import { EffectiveConfigs } from "./effective-config.js";
+import { enabledExtensionsByOrg } from "./enabled.js";
 import { ExtensionHost } from "./host.js";
 import { ExtensionInstalls } from "./installs.js";
 import { ExtensionLifecycle, PLUGINS_CHANGED_TOPIC, STALE_RECONCILE_PERIODS } from "./lifecycle.js";
@@ -27,6 +30,7 @@ import { PluginApproveLock } from "./locks.js";
 import { ExtensionPackageError, permissionSetOfPackage, readExtensionPackage } from "./package.js";
 import { buildPermissionSet, diffPermissions } from "./permission-set.js";
 import { deriveExtensionStatus, migrationWarnings, permissionGroups, permissionKeyItems, reviewHash, } from "./permission-view.js";
+import { pluginItemsOf } from "./plugin-items.js";
 export { PLUGINS_CHANGED_TOPIC };
 /** 内容寻址的包 → 权限集合（包不可变，缓存安全；只作缓存，不是跨副本状态）。 */
 const PACKAGE_SET_CACHE_MAX = 256;
@@ -48,7 +52,7 @@ function assertReadable(s) {
     }
 }
 /**
- * 部署级插件后台（企业管理员）：列表 / 详情与网页批准权限（D8）。无状态，多副本共用；
+ * 部署级插件后台（超级管理员）：列表 / 详情与网页批准权限（D8）。无状态，多副本共用；
  * 状态由 PG（安装记录、快照、各副本状态行）与本副本宿主（配置声明插件的清单）推出。
  */
 let ExtensionAdmin = class ExtensionAdmin {
@@ -65,14 +69,20 @@ let ExtensionAdmin = class ExtensionAdmin {
     bus;
     log;
     displayNames;
+    deploymentConfig;
+    effectiveConfigs;
     packageSets = new Map();
     constructor(kdb, txHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
     adminLock, approveLock, blobs, installs, approvals, 
     /** The config-declared extensions (this replica's host; the CLI fills it from its inspection). */
     host, 
     /** This replica's reconcile after an approval (a no-op where the lifecycle never started: the CLI). */
-    lifecycle, config, bus, log, displayNames) {
+    lifecycle, config, bus, log, displayNames, 
+    /** Which required overridable fields the platform left empty (spec A §5.4a). */
+    deploymentConfig, 
+    /** How many orgs still need their own config for such an extension. */
+    effectiveConfigs) {
         this.kdb = kdb;
         this.txHost = txHost;
         this.adminLock = adminLock;
@@ -86,13 +96,19 @@ let ExtensionAdmin = class ExtensionAdmin {
         this.bus = bus;
         this.log = log;
         this.displayNames = displayNames;
+        this.deploymentConfig = deploymentConfig;
+        this.effectiveConfigs = effectiveConfigs;
     }
     get db() {
         return this.kdb.db;
     }
-    /** 全部插件（配置声明 → 安装记录，各自按名字）。 */
-    async list() {
-        const subjects = await this.subjects();
+    /**
+     * Every extension (config-declared, then install records, each by name). With `names`, only
+     * those: no other package is read, so a caller that needs a few items (the catalog's pending
+     * check) neither pays for nor logs about the packages of unrelated extensions.
+     */
+    async list(names) {
+        const subjects = await this.subjects(undefined, names);
         return this.views(subjects);
     }
     /**
@@ -112,7 +128,20 @@ let ExtensionAdmin = class ExtensionAdmin {
         return (await this.views([s]))[0];
     }
     /**
-     * Web approval: re-checks the enterprise admin under the lock, compares the reviewed package
+     * The review digest of a stored package (the `reviewHash` its extension would show once
+     * installed); null when the package cannot be read.
+     */
+    async packageReviewHash(sha256) {
+        try {
+            const { set, warnings } = await this.packageInfo(sha256);
+            return reviewHash(set, warnings);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Web approval: re-checks the super admin under the lock, compares the reviewed package
      * (`sha256`) and permission digest (`reviewHash`), writes the snapshot (source web) and the
      * `extension.permissions_approved` audit; after the commit publishes `kernel.plugins.changed` (a
      * failure only warns) and waits for one reconcile on this replica (other replicas converge through
@@ -122,7 +151,8 @@ let ExtensionAdmin = class ExtensionAdmin {
      *   recomputed now -> `extension.approval_stale`; a config-declared extension's `sha256` must be
      *   null (otherwise `validation_failed`);
      * - the snapshot already covers the current permission set (nothing to approve, F-N) ->
-     *   `extension.not_pending`.
+     *   `extension.not_pending`, except with `confirmBootstrap` when the snapshot is the bootstrap
+     *   step's (the catalog's confirm re-writes it with source web).
      */
     async approve(actor, name, body, opts = {}) {
         const s = (await this.subjects(name))[0];
@@ -137,7 +167,7 @@ let ExtensionAdmin = class ExtensionAdmin {
             throw stale();
         if (body.reviewHash !== reviewHash(s.set, s.warnings))
             throw stale();
-        await this.writeApproval(actor, name, s, opts.actorTokenId, stale);
+        await this.writeApproval(actor, name, s, opts.actorTokenId, stale, opts.confirmBootstrap === true);
         try {
             await this.bus.publish(PLUGINS_CHANGED_TOPIC, { plugin: name });
         }
@@ -153,7 +183,7 @@ let ExtensionAdmin = class ExtensionAdmin {
         }
         return this.get(name);
     }
-    async writeApproval(actor, name, s, actorTokenId, stale) {
+    async writeApproval(actor, name, s, actorTokenId, stale, confirmBootstrap) {
         const db = this.db;
         await this.adminLock.lockAndAuthorize(actor);
         await this.approveLock.lock(name);
@@ -170,7 +200,7 @@ let ExtensionAdmin = class ExtensionAdmin {
         }
         const snapRow = await db
             .selectFrom("extension_permission_snapshots")
-            .select(["version", "permissions"])
+            .select(["version", "permissions", "source"])
             .where("plugin", "=", name)
             .forUpdate()
             .executeTakeFirst();
@@ -178,7 +208,9 @@ let ExtensionAdmin = class ExtensionAdmin {
             version: snapRow.version,
             permissions: snapRow.permissions,
         };
-        if (snapshotCovers(snap, s.set)) {
+        // `confirmBootstrap` (the catalog's confirm): a snapshot the bootstrap step wrote was never
+        // confirmed by a person, so a covered one is still taken over
+        if (snapshotCovers(snap, s.set) && !(confirmBootstrap && snapRow?.source === "bootstrap")) {
             throw new ApiError("extension.not_pending", `Extension ${name} ${s.version} has no new permissions awaiting approval`);
         }
         const { added, removed } = diffPermissions(snap?.permissions, s.set);
@@ -190,10 +222,9 @@ let ExtensionAdmin = class ExtensionAdmin {
         });
     }
     /** 配置声明 → 安装记录（与配置声明重名的安装记录不生效，不单列）。`only` 给出时只取这一个。 */
-    async subjects(only) {
-        const declared = this.host
-            .declaredPlugins()
-            .filter((p) => only === undefined || p.name === only);
+    async subjects(only, names) {
+        const wanted = (name) => (only === undefined || name === only) && (names === undefined || names.has(name));
+        const declared = this.host.declaredPlugins().filter((p) => wanted(p.name));
         const taken = new Set(this.host.declaredPlugins().map((p) => p.name));
         const out = [...declared]
             .sort((a, b) => a.name.localeCompare(b.name))
@@ -209,7 +240,7 @@ let ExtensionAdmin = class ExtensionAdmin {
         }));
         if (only !== undefined && out.length > 0)
             return out;
-        const rows = (await this.installs.list()).filter((r) => !taken.has(r.name) && (only === undefined || r.name === only));
+        const rows = (await this.installs.list()).filter((r) => !taken.has(r.name) && wanted(r.name));
         for (const r of rows) {
             let info;
             try {
@@ -276,6 +307,32 @@ let ExtensionAdmin = class ExtensionAdmin {
         }
         return { ...cached, configurable: cached.set.config.deployment.length > 0 };
     }
+    /**
+     * For each configurable, readable extension whose platform config leaves required overridable
+     * fields empty (spec A §5.4a): the number of orgs still needing their own config. Extensions
+     * without overridable fields cost no read.
+     */
+    async orgsNeedingConfig(subjects) {
+        const out = new Map();
+        for (const s of subjects) {
+            if (!s.configurable || s.broken !== undefined)
+                continue;
+            try {
+                const missing = await this.deploymentConfig.orgMustConfigure(s.name);
+                if (missing.length > 0) {
+                    out.set(s.name, await this.effectiveConfigs.countNeedingConfig(s.name));
+                }
+            }
+            catch (err) {
+                // the list never fails for one extension's config; the field is then left out
+                this.log.warn("cannot tell whether orgs must configure the extension", {
+                    plugin: s.name,
+                    err,
+                });
+            }
+        }
+        return out;
+    }
     async views(subjects) {
         if (subjects.length === 0)
             return [];
@@ -290,7 +347,28 @@ let ExtensionAdmin = class ExtensionAdmin {
             .where("heartbeat_at", ">", sql `now() - make_interval(secs => ${staleSeconds})`)
             .orderBy("replica_id")
             .execute();
+        const items = await pluginItemsOf(this.db, names);
+        const needing = await this.orgsNeedingConfig(subjects);
+        const counts = new Map((await this.db
+            .selectFrom(enabledExtensionsByOrg(this.db).as("en"))
+            .innerJoin("orgs", "orgs.id", "en.org_id")
+            .select(["en.plugin", (eb) => eb.fn.countAll().as("n")])
+            .where("orgs.deleted_at", "is", null)
+            .where("en.plugin", "in", names)
+            .groupBy("en.plugin")
+            .execute()).map((r) => [r.plugin, Number(r.n)]));
         return subjects.map((s) => {
+            const of = items.get(s.name);
+            const builtin = of?.some((i) => i.builtin) === true || s.install?.required === true;
+            const scopeInfo = {
+                scope: of?.[0]
+                    ? builtin || of.some((i) => i.scope === "all")
+                        ? "all"
+                        : of[0].scope
+                    : null,
+                enabledOrgs: counts.get(s.name) ?? 0,
+                builtin,
+            };
             const replicas = rows.filter((r) => r.plugin === s.name);
             const snap = snapshots.get(s.name);
             const { added, removed } = diffPermissions(snap?.permissions, s.set);
@@ -325,6 +403,7 @@ let ExtensionAdmin = class ExtensionAdmin {
                     configValid,
                     removable: install?.required !== true,
                     required: install?.required === true,
+                    ...scopeInfo,
                     installSource: install?.source ?? null,
                     error: s.broken,
                 };
@@ -360,8 +439,10 @@ let ExtensionAdmin = class ExtensionAdmin {
                 snapshot: snapshotView(snap),
                 configurable: s.configurable,
                 configValid,
+                ...(needing.has(s.name) && { orgsNeedingConfig: needing.get(s.name) }),
                 removable: s.source === "install" && install?.required !== true,
                 required: install?.required === true,
+                ...scopeInfo,
                 installSource: install?.source ?? null,
             };
         });
@@ -374,7 +455,7 @@ ExtensionAdmin = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
-    __param(2, Inject(EnterpriseAdminLock)),
+    __param(2, Inject(SuperAdminLock)),
     __param(3, Inject(PluginApproveLock)),
     __param(4, Inject(ExtensionBlobs)),
     __param(5, Inject(ExtensionInstalls)),
@@ -384,7 +465,9 @@ ExtensionAdmin = __decorate([
     __param(9, Inject(KernelConfigService)),
     __param(10, Inject(KERNEL_BUS)),
     __param(11, Inject(KERNEL_LOGGER)),
-    __param(12, Inject(ExtensionDisplayNames))
+    __param(12, Inject(ExtensionDisplayNames)),
+    __param(13, Inject(ExtensionDeploymentConfigService)),
+    __param(14, Inject(EffectiveConfigs))
 ], ExtensionAdmin);
 export { ExtensionAdmin };
 const replicaView = (r) => ({