@capybara-hq/kernel 0.1.0-rc.4 → 0.1.0-rc.6

package/dist/extensions/bootstrap.d.ts

@@ -35,7 +35,7 @@ import { ExtensionRegistry } from "./registry.js";
  *   manifest's sha256 (written with the audit `bootstrap.completed` only when every entry
  *   succeeded; otherwise the next start runs it again, which is idempotent).
  * - Only entries new to the manifest are installed (Ruling 5): an optional entry that the last
- *   completed run already handled and that is not installed now (an enterprise admin uninstalled
+ *   completed run already handled and that is not installed now (a super admin uninstalled
  *   it) stays uninstalled -> `kept`. A required entry is always installed.
  * - Per entry, by the installed state of its extension:
  *   - not installed (and new, or required): imported into the catalog (source `bootstrap`, ref
@@ -44,8 +44,8 @@ import { ExtensionRegistry } from "./registry.js";
  *     and enabled -> `installed`;
  *   - installed from `bootstrap` at a lower version: upgraded the same way (core's release vouched
  *     for the version, so new permissions are pre-approved and audited), keeping the desired state
- *     an enterprise admin chose (a disabled optional plugin stays disabled) -> `upgraded`;
- *   - installed at a higher version, or from another source (an enterprise admin upgraded it), or
+ *     a super admin chose (a disabled optional plugin stays disabled) -> `upgraded`;
+ *   - installed at a higher version, or from another source (a super admin upgraded it), or
  *     the name is config-declared (`declared`: config wins, no install record is created):
  *     untouched, never downgraded -> `kept`;
  *   - a declarative plugin (no extension): imported into the catalog only -> `imported` (`kept`
@@ -175,6 +175,12 @@ export declare class BootstrapService {
         /** The plugin import a declarative entry (or an entry's catalog version) goes through. */
         imports: BootstrapImports;
     }): Promise<BootstrapResult>;
+    /**
+     * A pin whose plugin name an org holds (a live org-owned catalog item): the bootstrap takes no
+     * name over (ruling P3-28), so the entry fails; this warning tells the super admin why and
+     * which org holds it (final review M4).
+     */
+    private warnIfHeld;
     /** The `bootstrap_runs` row and the `bootstrap.completed` audit, in one transaction. */
     private recordDone;
     /**
@@ -186,10 +192,17 @@ export declare class BootstrapService {
     /** The entry names the last completed run handled (undefined before any run completed). */
     private lastRunNames;
     private entry;
+    /**
+     * The catalog item of a bootstrap entry follows `required`: a required entry is builtin, offered
+     * to every org (scope `all`) and not disabled (migration 0075 could leave a required plugin
+     * disabled); an entry that stops being required is no longer builtin and keeps scope `all` (the
+     * admin may change it from then on).
+     */
+    private markBuiltin;
     /** A declarative plugin: catalog only. Returns false when that version is already imported. */
     private importOnly;
     /**
-     * Imports, approves, installs and enables (one review, confirmed with `deployExtension`). When
+     * Imports, approves, installs and enables (one review; its confirm deploys the extension). When
      * the catalog already has this version (an earlier run stopped after importing, or the same
      * package came from a marketplace), the extension is deployed from the package store instead.
      */

package/dist/extensions/bootstrap.js

@@ -15,6 +15,7 @@ import { parseBootstrapManifest, SDK_VERSION, } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable, Optional } from "@nestjs/common";
 import { sql } from "kysely";
 import semver from "semver";
+import { otherNameOwner } from "../catalog/ownership.js";
 import { catalogPackageError } from "../catalog/plugin-import.js";
 import { PluginPackageError, readPluginPackage } from "../catalog/plugin-package.js";
 import { ApiError } from "../errors.js";
@@ -57,7 +58,7 @@ import { ExtensionRegistry } from "./registry.js";
  *   manifest's sha256 (written with the audit `bootstrap.completed` only when every entry
  *   succeeded; otherwise the next start runs it again, which is idempotent).
  * - Only entries new to the manifest are installed (Ruling 5): an optional entry that the last
- *   completed run already handled and that is not installed now (an enterprise admin uninstalled
+ *   completed run already handled and that is not installed now (a super admin uninstalled
  *   it) stays uninstalled -> `kept`. A required entry is always installed.
  * - Per entry, by the installed state of its extension:
  *   - not installed (and new, or required): imported into the catalog (source `bootstrap`, ref
@@ -66,8 +67,8 @@ import { ExtensionRegistry } from "./registry.js";
  *     and enabled -> `installed`;
  *   - installed from `bootstrap` at a lower version: upgraded the same way (core's release vouched
  *     for the version, so new permissions are pre-approved and audited), keeping the desired state
- *     an enterprise admin chose (a disabled optional plugin stays disabled) -> `upgraded`;
- *   - installed at a higher version, or from another source (an enterprise admin upgraded it), or
+ *     a super admin chose (a disabled optional plugin stays disabled) -> `upgraded`;
+ *   - installed at a higher version, or from another source (a super admin upgraded it), or
  *     the name is config-declared (`declared`: config wins, no install record is created):
  *     untouched, never downgraded -> `kept`;
  *   - a declarative plugin (no extension): imported into the catalog only -> `imported` (`kept`
@@ -306,6 +307,7 @@ let BootstrapService = class BootstrapService {
             const failures = [];
             for (const e of o.manifest.plugins) {
                 signal.throwIfAborted();
+                await this.warnIfHeld(e);
                 try {
                     const r = await this.entry(e, files.get(e.name), handled, o.imports);
                     results.push(carried(r, o.carry));
@@ -334,6 +336,23 @@ let BootstrapService = class BootstrapService {
             return { manifestSha256, results };
         });
     }
+    /**
+     * A pin whose plugin name an org holds (a live org-owned catalog item): the bootstrap takes no
+     * name over (ruling P3-28), so the entry fails; this warning tells the super admin why and
+     * which org holds it (final review M4).
+     */
+    async warnIfHeld(e) {
+        const holder = await otherNameOwner(this.db, e.name, null);
+        if (holder?.kind !== "org")
+            return;
+        this.log.warn("bootstrap: the plugin name is held by an organization; the entry cannot take it over until the organization renames or deletes its plugin", {
+            plugin: e.name,
+            version: e.version,
+            required: e.required,
+            ownerOrgId: holder.orgId,
+            ownerOrg: holder.name,
+        });
+    }
     /** The `bootstrap_runs` row and the `bootstrap.completed` audit, in one transaction. */
     async recordDone(manifestSha256, results) {
         await this.db
@@ -400,9 +419,11 @@ let BootstrapService = class BootstrapService {
         // Not new to the manifest: an optional entry left out on purpose stays out (Ruling 5)
         const isNew = handled === undefined || !handled.has(e.name);
         if (!pkg.manifest.extension) {
+            await this.markBuiltin(e.name, e.required);
             if (!isNew)
                 return { name: e.name, action: "kept", version: e.version };
             const imported = await this.importOnly(e, bytes, ref, imports);
+            await this.markBuiltin(e.name, e.required);
             return { name: e.name, action: imported ? "imported" : "kept", version: e.version };
         }
         if (this.registry.declared().has(e.name)) {
@@ -451,8 +472,41 @@ let BootstrapService = class BootstrapService {
         if (e.required && row?.desired_state === "disabled") {
             await this.ops.enable(e.name, null);
         }
+        await this.markBuiltin(e.name, e.required);
         return result;
     }
+    /**
+     * The catalog item of a bootstrap entry follows `required`: a required entry is builtin, offered
+     * to every org (scope `all`) and not disabled (migration 0075 could leave a required plugin
+     * disabled); an entry that stops being required is no longer builtin and keeps scope `all` (the
+     * admin may change it from then on).
+     */
+    async markBuiltin(name, required) {
+        const touch = { updated_at: sql `now()` };
+        if (required) {
+            await this.db
+                .updateTable("catalog_items")
+                .set({
+                builtin: true,
+                scope: "all",
+                disabled: false,
+                scope_version: sql `scope_version + 1`,
+                ...touch,
+            })
+                .where("name", "=", name)
+                .where("deleted_at", "is", null)
+                .where((eb) => eb.or([eb("builtin", "=", false), eb("scope", "<>", "all"), eb("disabled", "=", true)]))
+                .execute();
+            return;
+        }
+        await this.db
+            .updateTable("catalog_items")
+            .set({ builtin: false, ...touch })
+            .where("name", "=", name)
+            .where("deleted_at", "is", null)
+            .where("builtin", "=", true)
+            .execute();
+    }
     /** A declarative plugin: catalog only. Returns false when that version is already imported. */
     async importOnly(e, bytes, ref, imports) {
         try {
@@ -461,10 +515,7 @@ let BootstrapService = class BootstrapService {
                 ref,
                 integrity: e.integrity,
             });
-            await imports.confirm(null, stagingId, {
-                reviewHash: review.reviewHash,
-                deployExtension: false,
-            });
+            await imports.confirm(null, stagingId, { reviewHash: review.reviewHash });
             return true;
         }
         catch (err) {
@@ -474,7 +525,7 @@ let BootstrapService = class BootstrapService {
         }
     }
     /**
-     * Imports, approves, installs and enables (one review, confirmed with `deployExtension`). When
+     * Imports, approves, installs and enables (one review; its confirm deploys the extension). When
      * the catalog already has this version (an earlier run stopped after importing, or the same
      * package came from a marketplace), the extension is deployed from the package store instead.
      */
@@ -496,7 +547,6 @@ let BootstrapService = class BootstrapService {
         }
         const r = await imports.confirm(null, staged.stagingId, {
             reviewHash: staged.review.reviewHash,
-            deployExtension: true,
             enable,
         });
         if (r.deploy?.result === "failed") {
@@ -552,6 +602,17 @@ let BootstrapService = class BootstrapService {
         if (names.length > 0)
             q = q.where("name", "not in", names);
         const rows = await q.returning(["name", "version"]).execute();
+        for (const r of rows)
+            await this.markBuiltin(r.name, false);
+        // A declarative plugin has no install record: clear builtin by catalog name
+        let items = this.db
+            .updateTable("catalog_items")
+            .set({ builtin: false, updated_at: sql `now()` })
+            .where("builtin", "=", true)
+            .where("deleted_at", "is", null);
+        if (names.length > 0)
+            items = items.where("name", "not in", names);
+        await items.execute();
         return rows.map((r) => ({ name: r.name, action: "required_cleared", version: r.version }));
     }
 };

package/dist/extensions/cli.d.ts

@@ -54,6 +54,18 @@ export interface ExtensionCli {
     publishChanged(plugin: string): Promise<boolean>;
     close(): Promise<void>;
 }
+/**
+ * The effective deployment config (the startup config `fileValue` completed by the `stored` PG
+ * fields) parsed as the host's load gate does: overridable fields may stay empty (spec A §5.4a),
+ * hidden and read-only ones must be complete.
+ */
+export declare function parseDeploymentConfig(schema: z.ZodTypeAny, stored: Record<string, unknown>, fileValue: unknown): {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    issues: ConfigIssue[];
+};
 /**
  * The CLI's extension management context (C18, F-Q): a Nest application context with
  * the extensions module over the database and a lazy Redis connection used only for publishing

package/dist/extensions/cli.js

@@ -13,7 +13,17 @@ import { ExtensionsModule } from "./extensions.module.js";
 import { ExtensionHost } from "./host.js";
 import { ExtensionInstalls } from "./installs.js";
 import { PLUGINS_CHANGED_TOPIC } from "./lifecycle-topics.js";
+import { parseLoadGate } from "./org-levels.js";
 import { ExtensionPackageError, extensionPackageApiError, permissionSetOfPackage, readExtensionPackage, } from "./package.js";
+/**
+ * The effective deployment config (the startup config `fileValue` completed by the `stored` PG
+ * fields) parsed as the host's load gate does: overridable fields may stay empty (spec A §5.4a),
+ * hidden and read-only ones must be complete.
+ */
+export function parseDeploymentConfig(schema, stored, fileValue) {
+    const r = parseLoadGate(schema, mergeDeploymentConfig(stored, fileValue, schemaFields(schema).map((f) => f.path)));
+    return r.success ? { ok: true, value: r.data } : { ok: false, issues: toIssues(r.error) };
+}
 /**
  * The CLI's extension management context (C18, F-Q): a Nest application context with
  * the extensions module over the database and a lazy Redis connection used only for publishing
@@ -44,8 +54,7 @@ export async function openExtensionCli(config, log, opts = {}) {
         const stored = await readStoredDeploymentConfig(db.db, keyring, name, {
             secretPaths: secretPathsOf(schemaFields(schema)),
         });
-        const r = schema.safeParse(mergeDeploymentConfig(stored, config.extensionConfig[name], schemaFields(schema).map((f) => f.path)));
-        return r.success ? { ok: true, value: r.data } : { ok: false, issues: toIssues(r.error) };
+        return parseDeploymentConfig(schema, stored, config.extensionConfig[name]);
     };
     const configIssues = new Map();
     const deploymentConfigs = new Map();

package/dist/extensions/config-hash.d.ts

@@ -0,0 +1,10 @@
+import type { core } from "zod";
+/**
+ * 插件部署配置（校验后）中非密钥部分的摘要：先把 schema 里所有 secret 叶子（`configFields` 可达路径，
+ * 加载时 `assertSecretsReachable` 已保证密钥都在这些路径上）换成固定占位值，再取 sha256(键排序 JSON) 前 16 位十六进制。
+ * 给需要「配置变了就失效」的缓存键用（如模型列表）。密钥不参与摘要：不加盐的短摘要写进 Redis 键名后，
+ * 低熵密钥可被离线猜测、泄露的密钥可被确认；代价是轮换密钥不会让缓存失效（缓存内容本来就不该依赖密钥）。
+ * 没有部署配置 schema 时无从得知哪些是密钥，摘要不按配置区分。同一份配置在各副本上得到同一摘要。
+ * 函数自己按 schema 遮蔽，调用方不必（也不能忘记）先打码。
+ */
+export declare function deploymentConfigHash(schema: core.$ZodType | undefined, config: unknown): string;

package/dist/extensions/config-hash.js

@@ -0,0 +1,38 @@
+import { createHash } from "node:crypto";
+import { configFields, getPath, setPath } from "../config/fields.js";
+/** 键排序后的 JSON（对象键顺序不影响结果）；undefined 字段与 JSON.stringify 一样省略。 */
+const canonicalJson = (v) => {
+    if (Array.isArray(v))
+        return `[${v.map((x) => (x === undefined ? "null" : canonicalJson(x))).join(",")}]`;
+    if (v !== null && typeof v === "object") {
+        const entries = Object.entries(v)
+            .filter(([, x]) => x !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+        return `{${entries.map(([k, x]) => `${JSON.stringify(k)}:${canonicalJson(x)}`).join(",")}}`;
+    }
+    return JSON.stringify(v) ?? "null";
+};
+/** 遮蔽 secret 字段后参与摘要的固定占位值。 */
+const SECRET_PLACEHOLDER = "<secret>";
+/**
+ * 插件部署配置（校验后）中非密钥部分的摘要：先把 schema 里所有 secret 叶子（`configFields` 可达路径，
+ * 加载时 `assertSecretsReachable` 已保证密钥都在这些路径上）换成固定占位值，再取 sha256(键排序 JSON) 前 16 位十六进制。
+ * 给需要「配置变了就失效」的缓存键用（如模型列表）。密钥不参与摘要：不加盐的短摘要写进 Redis 键名后，
+ * 低熵密钥可被离线猜测、泄露的密钥可被确认；代价是轮换密钥不会让缓存失效（缓存内容本来就不该依赖密钥）。
+ * 没有部署配置 schema 时无从得知哪些是密钥，摘要不按配置区分。同一份配置在各副本上得到同一摘要。
+ * 函数自己按 schema 遮蔽，调用方不必（也不能忘记）先打码。
+ */
+export function deploymentConfigHash(schema, config) {
+    let redacted = null;
+    if (schema) {
+        redacted = structuredClone(config);
+        if (redacted !== null && typeof redacted === "object") {
+            for (const f of configFields(schema)) {
+                if (f.meta?.secret && getPath(redacted, f.path) !== undefined) {
+                    setPath(redacted, f.path, SECRET_PLACEHOLDER);
+                }
+            }
+        }
+    }
+    return createHash("sha256").update(canonicalJson(redacted)).digest("hex").slice(0, 16);
+}

package/dist/extensions/deployment-config.d.ts

@@ -4,7 +4,7 @@ import type { KernelAppOptions } from "../app.js";
 import { type ConfigSourceKind } from "../config/sources.js";
 import { type Keyring } from "../ctx/secrets.js";
 import type { KernelSchemaDb } from "../db/kernel-schema.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -20,6 +20,7 @@ import { ExtensionLifecycle } from "./lifecycle.js";
 import { PLUGIN_DEPLOYMENT_CONFIG_TOPIC } from "./lifecycle-topics.js";
 import { PluginDeploymentConfigLock } from "./locks.js";
 export { DEPLOYMENT_SECRETS_ORG, type DeploymentSchemaInfo, mergeDeploymentConfig, readStoredDeploymentConfig, schemaFields, secretPathsOf, };
+type Obj = Record<string, unknown>;
 export type { ConfigIssue };
 export { PLUGIN_DEPLOYMENT_CONFIG_TOPIC };
 /** 后台一个部署配置字段：来源、是否只读；非密钥字段给出生效值，密钥字段只给 `set`。 */
@@ -41,6 +42,11 @@ export interface DeploymentConfigField {
      * (item names, not secret values; spec §4.3). Other secret fields report only `set`.
      */
     keys?: string[];
+    /**
+     * What orgs may do with the field (spec A §5.1, the level of its top-level key): `readonly` (they
+     * see it) or `override` (they may bring their own value); absent = hidden from orgs.
+     */
+    org?: "readonly" | "override";
 }
 /**
  * One operation on a secret record drawn per item (spec §4.3), only for a path some
@@ -76,6 +82,11 @@ export interface DeploymentConfigView {
     validated: boolean;
     /** 校验失败的原因（只有路径与说明，不含值）。 */
     issues: ConfigIssue[];
+    /**
+     * The required `override` fields the platform left empty (spec A §5.4a): the extension still
+     * loads, and every org that follows the platform must configure them itself.
+     */
+    orgMustConfigure: string[];
 }
 /**
  * Deployment-level extension config (D8 / C10): non-secret fields are stored in
@@ -88,7 +99,7 @@ export interface DeploymentConfigView {
 export declare class ExtensionDeploymentConfigService {
     private readonly kdb;
     readonly txHost: TransactionHost;
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
     private readonly adminLock;
     private readonly configLock;
     private readonly keyring;
@@ -106,8 +117,8 @@ export declare class ExtensionDeploymentConfigService {
     /** Where each startup-config field comes from (see `extensionConfigSources`); those fields are read-only. */
     private readonly sources;
     constructor(kdb: KernelDb, txHost: TransactionHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
-    adminLock: EnterpriseAdminLock, configLock: PluginDeploymentConfigLock, keyring: Keyring, config: KernelConfigService, 
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
+    adminLock: SuperAdminLock, configLock: PluginDeploymentConfigLock, keyring: Keyring, config: KernelConfigService, 
     /** This replica's extension schemas (loaded, config-declared or prepared install records). */
     host: ExtensionHost, 
     /** The effective (stored plus startup) deployment config. */
@@ -142,7 +153,7 @@ export declare class ExtensionDeploymentConfigService {
      * is re-encrypted whole, then validated with `values`; the audit lists the record's path, no keys.
      * A path no hint names -> 400 `validation_failed`; one in the startup config -> 409
      * `extension.config_readonly`.
-     * In a transaction, first `lockEnterpriseAdminsAndAuthorize` (re-checks the enterprise admin under
+     * In a transaction, first `lockSuperAdminsAndAuthorize` (re-checks the super admin under
      * the lock), then an advisory lock per extension; audit `extension.deployment_config_updated`
      * (detail only `changedPaths`). After the commit publishes {@link PLUGIN_DEPLOYMENT_CONFIG_TOPIC} and
      * applies it on this replica right away.
@@ -157,6 +168,12 @@ export declare class ExtensionDeploymentConfigService {
     private write;
     private info;
     private render;
+    /**
+     * The required `override` fields the platform left empty ({@link DeploymentConfigView}
+     * `orgMustConfigure`); reads nothing when the extension has no `override` field. Unknown to the
+     * deployment -> `extension.not_found`.
+     */
+    orgMustConfigure(plugin: string): Promise<string[]>;
     /**
      * The form JSON Schema of the description: the zod schema's, else the package's static one. A
      * hint conversion that throws (a hand-made package) drops the hints: the plain schema, or none
@@ -167,6 +184,12 @@ export declare class ExtensionDeploymentConfigService {
     /** The secret record paths some hint of the form schema names. */
     private hintedPaths;
 }
+/**
+ * Applies secret entries in order to the decrypted config `next` (in place): each record is read
+ * from `next` at its path, renamed, set or removed, and put back; an empty record is removed (the
+ * field falls back to its default).
+ */
+export declare function applySecretEntries(next: Obj, entries: readonly SecretEntry[]): void;
 /**
  * 本副本拿不到模块时（未加载的安装记录）按包内审阅过的静态清单给出字段（没有 zod schema：不校验，加载时再校验）。
  * The package's `extension.configSchemas.deployment` (written by the packer) is the form schema;

package/dist/extensions/deployment-config.js

@@ -14,7 +14,7 @@ import { configSourceKind, extensionConfigSources, fieldSource, } from "../confi
 import { createSecrets } from "../ctx/secrets.js";
 import { ApiError } from "../errors.js";
 import { audit } from "../identity/audit.js";
-import { EnterpriseAdminLock } from "../identity/enterprise-admin.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
@@ -30,6 +30,7 @@ import { ExtensionInstalls } from "./installs.js";
 import { ExtensionLifecycle } from "./lifecycle.js";
 import { PLUGIN_DEPLOYMENT_CONFIG_TOPIC } from "./lifecycle-topics.js";
 import { PluginDeploymentConfigLock } from "./locks.js";
+import { fieldLevels, jsonSchemaFieldLevels, missingOverridable, parseLoadGate, } from "./org-levels.js";
 export { DEPLOYMENT_SECRETS_ORG, mergeDeploymentConfig, readStoredDeploymentConfig, schemaFields, secretPathsOf, };
 export { PLUGIN_DEPLOYMENT_CONFIG_TOPIC };
 /** 某字段 zod 叶子上的默认值（整份配置不合法、校验没能补上默认值时，视图仍按它显示）。 */
@@ -64,7 +65,7 @@ let ExtensionDeploymentConfigService = class ExtensionDeploymentConfigService {
     /** Where each startup-config field comes from (see `extensionConfigSources`); those fields are read-only. */
     sources;
     constructor(kdb, txHost, 
-    /** The enterprise admin lock (identity/enterprise-admin.ts): joins the transaction. */
+    /** The super admin lock (identity/super-admin.ts): joins the transaction. */
     adminLock, configLock, keyring, config, 
     /** This replica's extension schemas (loaded, config-declared or prepared install records). */
     host, 
@@ -142,7 +143,7 @@ let ExtensionDeploymentConfigService = class ExtensionDeploymentConfigService {
      * is re-encrypted whole, then validated with `values`; the audit lists the record's path, no keys.
      * A path no hint names -> 400 `validation_failed`; one in the startup config -> 409
      * `extension.config_readonly`.
-     * In a transaction, first `lockEnterpriseAdminsAndAuthorize` (re-checks the enterprise admin under
+     * In a transaction, first `lockSuperAdminsAndAuthorize` (re-checks the super admin under
      * the lock), then an advisory lock per extension; audit `extension.deployment_config_updated`
      * (detail only `changedPaths`). After the commit publishes {@link PLUGIN_DEPLOYMENT_CONFIG_TOPIC} and
      * applies it on this replica right away.
@@ -241,7 +242,8 @@ let ExtensionDeploymentConfigService = class ExtensionDeploymentConfigService {
         applySecretEntries(next, secretEntries);
         const touched = new Set([...Object.keys(values), ...secretEntries.map((e) => e.path)]);
         if (info.schema) {
-            const r = info.schema.safeParse(mergeDeploymentConfig(next, fileValue, fieldPaths));
+            // overridable fields may stay empty on the platform (spec A §5.4a)
+            const r = parseLoadGate(info.schema, mergeDeploymentConfig(next, fileValue, fieldPaths));
             if (!r.success) {
                 // 启动配置里只读字段自己的问题这里改不了（照样保存，插件保持待配置），其余拒绝
                 const issues = toIssues(r.error, this.messagesOf(plugin, info)).filter((i) => i.path === "" || fieldSource(sources, i.path) === undefined);
@@ -303,7 +305,8 @@ let ExtensionDeploymentConfigService = class ExtensionDeploymentConfigService {
         let valid = true;
         let issues = [];
         if (info.schema) {
-            const r = info.schema.safeParse(raw);
+            // the load gate: overridable fields may stay empty (spec A §5.4a)
+            const r = parseLoadGate(info.schema, raw);
             if (r.success)
                 effective = r.data;
             else {
@@ -313,6 +316,7 @@ let ExtensionDeploymentConfigService = class ExtensionDeploymentConfigService {
         }
         const formSchema = this.formSchemaOf(plugin, info);
         const hinted = formSchema ? hintedSecretPaths(formSchema) : new Set();
+        const levels = levelsOf(info);
         const fields = info.fields.map((f) => {
             const from = fieldSource(sources, f.path);
             let value = getPath(effective, f.path);
@@ -327,12 +331,14 @@ let ExtensionDeploymentConfigService = class ExtensionDeploymentConfigService {
                     value = d.value;
                 source = value === undefined ? "unset" : "default";
             }
+            const level = levels.get(f.path.split(".")[0]);
             const base = {
                 path: f.path,
                 secret: f.secret,
                 hot: f.hot,
                 source,
                 readonly: from !== undefined,
+                ...(level !== undefined && level !== "hidden" && { org: level }),
             };
             // a schema default (e.g. `secret(record).default({})`) is no secret anybody set
             const set = value !== undefined && source !== "default";
@@ -354,8 +360,23 @@ let ExtensionDeploymentConfigService = class ExtensionDeploymentConfigService {
             valid,
             validated: info.schema !== undefined,
             issues,
+            orgMustConfigure: orgMustConfigureOf(info, raw, levels),
         };
     }
+    /**
+     * The required `override` fields the platform left empty ({@link DeploymentConfigView}
+     * `orgMustConfigure`); reads nothing when the extension has no `override` field. Unknown to the
+     * deployment -> `extension.not_found`.
+     */
+    async orgMustConfigure(plugin) {
+        const info = await this.info(plugin);
+        const levels = levelsOf(info);
+        if (![...levels.values()].includes("override"))
+            return [];
+        const stored = await this.readStored(plugin, info);
+        const raw = mergeDeploymentConfig(stored, this.fileConfig()[plugin], info.fields.map((f) => f.path));
+        return orgMustConfigureOf(info, raw, levels);
+    }
     /**
      * The form JSON Schema of the description: the zod schema's, else the package's static one. A
      * hint conversion that throws (a hand-made package) drops the hints: the plain schema, or none
@@ -391,7 +412,7 @@ ExtensionDeploymentConfigService = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
-    __param(2, Inject(EnterpriseAdminLock)),
+    __param(2, Inject(SuperAdminLock)),
     __param(3, Inject(PluginDeploymentConfigLock)),
     __param(4, Inject(KEYRING)),
     __param(5, Inject(KernelConfigService)),
@@ -404,12 +425,32 @@ ExtensionDeploymentConfigService = __decorate([
     __param(12, Inject(ExtensionDisplayNames))
 ], ExtensionDeploymentConfigService);
 export { ExtensionDeploymentConfigService };
+/** The org level of each top-level key: from the zod schema, else the package's form schema. */
+function levelsOf(info) {
+    return info.schema
+        ? fieldLevels(info.schema)
+        : jsonSchemaFieldLevels(info.jsonSchema);
+}
+/**
+ * The required `override` keys `raw` leaves empty: by the zod schema, else (a static form schema)
+ * the `required` keys marked `override` that have no value.
+ */
+function orgMustConfigureOf(info, raw, levels) {
+    if (info.schema)
+        return missingOverridable(info.schema, raw);
+    const required = info.jsonSchema?.required;
+    if (!Array.isArray(required))
+        return [];
+    return [...levels]
+        .filter(([k, l]) => l === "override" && required.includes(k) && getPath(raw, k) === undefined)
+        .map(([k]) => k);
+}
 /**
  * Applies secret entries in order to the decrypted config `next` (in place): each record is read
  * from `next` at its path, renamed, set or removed, and put back; an empty record is removed (the
  * field falls back to its default).
  */
-function applySecretEntries(next, entries) {
+export function applySecretEntries(next, entries) {
     for (const e of entries) {
         const cur = getPath(next, e.path);
         const rec = isObj(cur) ? { ...cur } : {};