@objectstack/core 15.0.0 → 15.1.0

package/dist/index.d.cts

@@ -1924,6 +1924,40 @@ declare function isAuthGateAllowlisted(rawPath: string | undefined | null): bool
  */
 declare function evaluateAuthGate(sessionUser: any, path: string): AuthGate | null;
 
+/** HTTP status every seam returns for an anonymous-denied request. */
+declare const ANONYMOUS_DENY_STATUS: 401;
+/** Stable machine code (mirrors the REST `enforceAuth` seam). */
+declare const ANONYMOUS_DENY_CODE: "unauthenticated";
+/** Human-facing message. */
+declare const ANONYMOUS_DENY_MESSAGE = "Authentication is required to access this endpoint.";
+/** The single 401 body shape every seam returns: `{ error, message }`. */
+declare const ANONYMOUS_DENY_BODY: {
+    readonly error: "unauthenticated";
+    readonly message: "Authentication is required to access this endpoint.";
+};
+interface AnonymousDenyInput {
+    /** The `requireAuth` posture. Falsy ⇒ no-op (demo / single-tenant). */
+    requireAuth: boolean | undefined;
+    /** Resolved caller id, if any. */
+    userId?: string | null;
+    /** Internal system context (never set on inbound HTTP; cannot be forged). */
+    isSystem?: boolean;
+    /** HTTP method — `OPTIONS` (CORS preflight) always passes. */
+    method?: string | null;
+    /**
+     * OPTIONAL request path. When a NON-EMPTY string, a control-plane path
+     * (auth / health / ready / discovery — see {@link isAuthGateAllowlisted}) is
+     * exempt. Body-routed seams (GraphQL) have no meaningful path and pass
+     * `undefined`; see the guard below for why that is load-bearing.
+     */
+    path?: string | null;
+}
+/**
+ * True when the request MUST be rejected with 401. The one decision every HTTP
+ * seam shares.
+ */
+declare function shouldDenyAnonymous(input: AnonymousDenyInput): boolean;
+
 /** The validity-window shape shared by both user-grant tables (ADR-0091 D1). */
 interface GrantValidityWindow {
     valid_from?: unknown;
@@ -2510,4 +2544,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { API_KEY_PREFIX, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry };

package/dist/index.d.ts

@@ -1924,6 +1924,40 @@ declare function isAuthGateAllowlisted(rawPath: string | undefined | null): bool
  */
 declare function evaluateAuthGate(sessionUser: any, path: string): AuthGate | null;
 
+/** HTTP status every seam returns for an anonymous-denied request. */
+declare const ANONYMOUS_DENY_STATUS: 401;
+/** Stable machine code (mirrors the REST `enforceAuth` seam). */
+declare const ANONYMOUS_DENY_CODE: "unauthenticated";
+/** Human-facing message. */
+declare const ANONYMOUS_DENY_MESSAGE = "Authentication is required to access this endpoint.";
+/** The single 401 body shape every seam returns: `{ error, message }`. */
+declare const ANONYMOUS_DENY_BODY: {
+    readonly error: "unauthenticated";
+    readonly message: "Authentication is required to access this endpoint.";
+};
+interface AnonymousDenyInput {
+    /** The `requireAuth` posture. Falsy ⇒ no-op (demo / single-tenant). */
+    requireAuth: boolean | undefined;
+    /** Resolved caller id, if any. */
+    userId?: string | null;
+    /** Internal system context (never set on inbound HTTP; cannot be forged). */
+    isSystem?: boolean;
+    /** HTTP method — `OPTIONS` (CORS preflight) always passes. */
+    method?: string | null;
+    /**
+     * OPTIONAL request path. When a NON-EMPTY string, a control-plane path
+     * (auth / health / ready / discovery — see {@link isAuthGateAllowlisted}) is
+     * exempt. Body-routed seams (GraphQL) have no meaningful path and pass
+     * `undefined`; see the guard below for why that is load-bearing.
+     */
+    path?: string | null;
+}
+/**
+ * True when the request MUST be rejected with 401. The one decision every HTTP
+ * seam shares.
+ */
+declare function shouldDenyAnonymous(input: AnonymousDenyInput): boolean;
+
 /** The validity-window shape shared by both user-grant tables (ADR-0091 D1). */
 interface GrantValidityWindow {
     valid_from?: unknown;
@@ -2510,4 +2544,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { API_KEY_PREFIX, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry };

package/dist/index.js

@@ -1554,6 +1554,8 @@ var ObjectKernel = class {
       this.validateSystemRequirements();
       this.logger.debug("Triggering kernel:ready hook");
       await this.context.trigger("kernel:ready");
+      this.logger.debug("Triggering kernel:bootstrapped hook");
+      await this.context.trigger("kernel:bootstrapped");
       this.logger.debug("Triggering kernel:listening hook");
       await this.context.trigger("kernel:listening");
       this.logger.info("\u2705 Bootstrap complete");
@@ -1837,6 +1839,7 @@ var LiteKernel = class extends ObjectKernelBase {
       await this.runPluginStart(plugin);
     }
     await this.triggerHook("kernel:ready");
+    await this.triggerHook("kernel:bootstrapped");
     await this.triggerHook("kernel:listening");
     this.logger.info("\u2705 Bootstrap complete", {
       pluginCount: this.plugins.size
@@ -4456,6 +4459,26 @@ function evaluateAuthGate(sessionUser, path) {
   };
 }
 
+// src/security/anonymous-deny.ts
+var ANONYMOUS_DENY_STATUS = 401;
+var ANONYMOUS_DENY_CODE = "unauthenticated";
+var ANONYMOUS_DENY_MESSAGE = "Authentication is required to access this endpoint.";
+var ANONYMOUS_DENY_BODY = {
+  error: ANONYMOUS_DENY_CODE,
+  message: ANONYMOUS_DENY_MESSAGE
+};
+function shouldDenyAnonymous(input) {
+  if (!input.requireAuth) return false;
+  if (typeof input.method === "string" && input.method.toUpperCase() === "OPTIONS") {
+    return false;
+  }
+  if (input.userId || input.isSystem) return false;
+  if (typeof input.path === "string" && input.path.length > 0 && isAuthGateAllowlisted(input.path)) {
+    return false;
+  }
+  return true;
+}
+
 // src/utils/datetime.ts
 function calendarPartsInTz(d, tz) {
   const parts = new Intl.DateTimeFormat("en-US", {
@@ -5476,6 +5499,10 @@ var NamespaceResolver = class {
   }
 };
 export {
+  ANONYMOUS_DENY_BODY,
+  ANONYMOUS_DENY_CODE,
+  ANONYMOUS_DENY_MESSAGE,
+  ANONYMOUS_DENY_STATUS,
   API_KEY_PREFIX,
   ApiRegistry,
   CORE_FALLBACK_FACTORIES,
@@ -5540,6 +5567,7 @@ export {
   resolveLocale,
   resolveLocalizationContext,
   safeExit,
+  shouldDenyAnonymous,
   signPayload,
   verifyPayload,
   verifyPlatformSignature,