@objectstack/core 15.1.0 → 16.0.0-rc.0

package/dist/index.d.cts

@@ -257,6 +257,17 @@ declare class ObjectKernel {
      * Get plugin startup metrics
      */
     getPluginMetrics(): Map<string, number>;
+    /**
+     * Whether a plugin with the given name has been registered on this kernel.
+     *
+     * Registration happens synchronously in `use()` before any plugin's
+     * `start()` runs, so a plugin may use this during its own start() to make
+     * composition-dependent decisions deterministically — e.g. the dispatcher
+     * bridge cedes `${prefix}/discovery` to `com.objectstack.rest.api` when
+     * both are mounted (ADR-0076 D11: single owner per route, not
+     * first-registration-wins).
+     */
+    hasPlugin(name: string): boolean;
     /**
      * Get a service (sync helper)
      */
@@ -2030,6 +2041,47 @@ declare function calendarPartsInTz(d: Date, tz: string): CalendarParts;
  * must degrade to the historical UTC behavior rather than error.
  */
 declare function calendarPartsInTzOrUtc(d: Date, tz?: string): CalendarParts;
+/**
+ * The UTC instant (epoch ms) at which calendar day `ymd` (`YYYY-MM-DD`) *begins*
+ * in reference timezone `tz` — i.e. local **midnight** of that day rendered as a
+ * UTC instant. The inverse direction of {@link calendarPartsInTz}.
+ *
+ * DST-safe: the zone offset is read from the platform tz database via
+ * `Intl.DateTimeFormat` (never hand-computed), and a two-pass resolution settles
+ * the rare case where the offset differs side-to-side of the target instant. An
+ * unset, `'UTC'`, invalid, or unparseable input returns plain UTC midnight.
+ *
+ * Used by date-bucket drill ranges (#1752): a `datetime` field buckets on the
+ * reference-tz calendar, so its bucket boundary is that tz's midnight instant.
+ */
+declare function zonedDateStartToUtcMs(ymd: string, tz?: string): number;
+/**
+ * Granularity of a canonical date-bucket key. Mirrors `@objectstack/spec`'s
+ * `DateGranularity` enum but kept as a local literal union so this low-level
+ * package needs no dependency on spec.
+ */
+type BucketGranularity = 'day' | 'week' | 'month' | 'quarter' | 'year';
+/**
+ * The half-open calendar span `[start, end)` of a canonical date-bucket KEY,
+ * as `YYYY-MM-DD` strings (`start` inclusive, `end` exclusive — the next
+ * bucket's first day).
+ *
+ * The input MUST be the canonical key produced by `bucketDateValue` /
+ * `buildDateBucketExpr` (`2026`, `2026-Q2`, `2026-06`, `2026-06-15`,
+ * `2026-W23`) — NEVER a localized / humanized display label. The span is pure,
+ * timezone-naive calendar arithmetic; a caller that needs instant bounds for a
+ * `datetime` field in a reference timezone layers that on top (and, per
+ * ADR-0053, a `date` field compares against these `YYYY-MM-DD` bounds directly).
+ *
+ * Returns `null` for the null/empty bucket, an unparseable key, or a key that
+ * is shape-valid but out of range (e.g. `2026-13`, a `-W53` in a 52-week year,
+ * `2026-02-30`). Callers drop the range and fall back to an unscoped (superset)
+ * drill rather than emit a wrong bound.
+ */
+declare function bucketKeyToCalendarRange(key: string, granularity: BucketGranularity): {
+    start: string;
+    end: string;
+} | null;
 
 /**
  * `bulkWrite` — the shared batched-write helper used by BOTH the seed loader
@@ -2057,6 +2109,17 @@ declare function calendarPartsInTzOrUtc(d: Date, tz?: string): CalendarParts;
  *    can reassemble output in input order even though rows are processed in
  *    batches (and a batch's flush may be interleaved with other, immediate,
  *    per-row work such as updates).
+ *
+ * Delivery semantics: **at-least-once**. Transient retry and per-row
+ * degradation both RE-RUN a write whose outcome was unknown — e.g. a turso
+ * `fetch failed` that arrived *after* the row was already committed
+ * (framework#3149), or a result-count mismatch that voids the batch
+ * (framework#3151). A caller that needs exactly-once must make its
+ * `writeBatch`/`writeOne` idempotent; both receive an `attempt` counter for
+ * exactly this — see the natural-key recheck the seed loader and import
+ * runner perform on `attempt > 1`. `writeBatch` MUST also resolve exactly one
+ * record per input row, in input order: a short / long / non-array return is
+ * rejected as a failed batch (framework#3151), never silently backfilled.
  */
 interface BulkWriteRowResult<TRecord = any> {
     /** Index into the original `rows` array passed to {@link bulkWrite}. */
@@ -2084,10 +2147,40 @@ interface BulkWriteOptions<TRow, TRecord = any> extends RetryOptions {
      * `batch[i]` positionally (this is how every `bulkCreate` implementation in
      * this repo already behaves: sql's single `INSERT ... VALUES (...), (...)
      * RETURNING *`, memory's `Promise.all`, mongodb's ordered `insertMany`).
-     */
-    writeBatch: (batch: TRow[]) => Promise<TRecord[]>;
-    /** Write a single row — used only to degrade a failed batch. */
-    writeOne: (row: TRow) => Promise<TRecord>;
+     *
+     * `ctx.attempt` is the 1-based attempt number. `attempt > 1` means a prior
+     * attempt's outcome is UNKNOWN (a transient blip that may have landed after
+     * commit) — an exactly-once caller should recheck by natural key and skip
+     * rows already present before re-writing (framework#3149).
+     */
+    writeBatch: (batch: TRow[], ctx: {
+        attempt: number;
+    }) => Promise<TRecord[]>;
+    /**
+     * Write a single row — used only to degrade a failed batch. `ctx.attempt`
+     * carries the same recheck signal as {@link writeBatch}.
+     */
+    writeOne: (row: TRow, ctx: {
+        attempt: number;
+    }) => Promise<TRecord>;
+    /**
+     * Partial-success batch write (framework#3172). When provided it is used
+     * INSTEAD of {@link writeBatch}: it must resolve one outcome per input row,
+     * in input order — `{ ok: true, record }` for written rows, `{ ok: false,
+     * error }` for rows that failed individually (e.g. validation). Per-row
+     * failures are final verdicts: bulkWrite records them as-is and does NOT
+     * degrade to `writeOne` for them — that is the whole point (a degradation
+     * re-run would re-fire beforeInsert hooks on the good rows). Only a THROWN
+     * error (a transient infra failure, a result-count mismatch) falls back to
+     * the per-row `writeOne` degradation, exactly like `writeBatch`.
+     */
+    writeBatchPartial?: (batch: TRow[], ctx: {
+        attempt: number;
+    }) => Promise<Array<{
+        ok: boolean;
+        record?: TRecord;
+        error?: unknown;
+    }>>;
 }
 declare function defaultIsTransientError(err: unknown): boolean;
 /**
@@ -2096,7 +2189,7 @@ declare function defaultIsTransientError(err: unknown): boolean;
  * transient-error backoff {@link bulkWrite} applies to batches — so a
  * network blip doesn't drop an update the way it used to drop an insert.
  */
-declare function withTransientRetry<T>(fn: () => Promise<T>, opts?: RetryOptions): Promise<T>;
+declare function withTransientRetry<T>(fn: (attempt: number) => Promise<T>, opts?: RetryOptions): Promise<T>;
 /**
  * Write `rows` through `opts.writeBatch` in chunks of `opts.batchSize`,
  * retrying a whole-batch transient failure with backoff, and degrading to
@@ -2544,4 +2637,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };

package/dist/index.d.ts

@@ -257,6 +257,17 @@ declare class ObjectKernel {
      * Get plugin startup metrics
      */
     getPluginMetrics(): Map<string, number>;
+    /**
+     * Whether a plugin with the given name has been registered on this kernel.
+     *
+     * Registration happens synchronously in `use()` before any plugin's
+     * `start()` runs, so a plugin may use this during its own start() to make
+     * composition-dependent decisions deterministically — e.g. the dispatcher
+     * bridge cedes `${prefix}/discovery` to `com.objectstack.rest.api` when
+     * both are mounted (ADR-0076 D11: single owner per route, not
+     * first-registration-wins).
+     */
+    hasPlugin(name: string): boolean;
     /**
      * Get a service (sync helper)
      */
@@ -2030,6 +2041,47 @@ declare function calendarPartsInTz(d: Date, tz: string): CalendarParts;
  * must degrade to the historical UTC behavior rather than error.
  */
 declare function calendarPartsInTzOrUtc(d: Date, tz?: string): CalendarParts;
+/**
+ * The UTC instant (epoch ms) at which calendar day `ymd` (`YYYY-MM-DD`) *begins*
+ * in reference timezone `tz` — i.e. local **midnight** of that day rendered as a
+ * UTC instant. The inverse direction of {@link calendarPartsInTz}.
+ *
+ * DST-safe: the zone offset is read from the platform tz database via
+ * `Intl.DateTimeFormat` (never hand-computed), and a two-pass resolution settles
+ * the rare case where the offset differs side-to-side of the target instant. An
+ * unset, `'UTC'`, invalid, or unparseable input returns plain UTC midnight.
+ *
+ * Used by date-bucket drill ranges (#1752): a `datetime` field buckets on the
+ * reference-tz calendar, so its bucket boundary is that tz's midnight instant.
+ */
+declare function zonedDateStartToUtcMs(ymd: string, tz?: string): number;
+/**
+ * Granularity of a canonical date-bucket key. Mirrors `@objectstack/spec`'s
+ * `DateGranularity` enum but kept as a local literal union so this low-level
+ * package needs no dependency on spec.
+ */
+type BucketGranularity = 'day' | 'week' | 'month' | 'quarter' | 'year';
+/**
+ * The half-open calendar span `[start, end)` of a canonical date-bucket KEY,
+ * as `YYYY-MM-DD` strings (`start` inclusive, `end` exclusive — the next
+ * bucket's first day).
+ *
+ * The input MUST be the canonical key produced by `bucketDateValue` /
+ * `buildDateBucketExpr` (`2026`, `2026-Q2`, `2026-06`, `2026-06-15`,
+ * `2026-W23`) — NEVER a localized / humanized display label. The span is pure,
+ * timezone-naive calendar arithmetic; a caller that needs instant bounds for a
+ * `datetime` field in a reference timezone layers that on top (and, per
+ * ADR-0053, a `date` field compares against these `YYYY-MM-DD` bounds directly).
+ *
+ * Returns `null` for the null/empty bucket, an unparseable key, or a key that
+ * is shape-valid but out of range (e.g. `2026-13`, a `-W53` in a 52-week year,
+ * `2026-02-30`). Callers drop the range and fall back to an unscoped (superset)
+ * drill rather than emit a wrong bound.
+ */
+declare function bucketKeyToCalendarRange(key: string, granularity: BucketGranularity): {
+    start: string;
+    end: string;
+} | null;
 
 /**
  * `bulkWrite` — the shared batched-write helper used by BOTH the seed loader
@@ -2057,6 +2109,17 @@ declare function calendarPartsInTzOrUtc(d: Date, tz?: string): CalendarParts;
  *    can reassemble output in input order even though rows are processed in
  *    batches (and a batch's flush may be interleaved with other, immediate,
  *    per-row work such as updates).
+ *
+ * Delivery semantics: **at-least-once**. Transient retry and per-row
+ * degradation both RE-RUN a write whose outcome was unknown — e.g. a turso
+ * `fetch failed` that arrived *after* the row was already committed
+ * (framework#3149), or a result-count mismatch that voids the batch
+ * (framework#3151). A caller that needs exactly-once must make its
+ * `writeBatch`/`writeOne` idempotent; both receive an `attempt` counter for
+ * exactly this — see the natural-key recheck the seed loader and import
+ * runner perform on `attempt > 1`. `writeBatch` MUST also resolve exactly one
+ * record per input row, in input order: a short / long / non-array return is
+ * rejected as a failed batch (framework#3151), never silently backfilled.
  */
 interface BulkWriteRowResult<TRecord = any> {
     /** Index into the original `rows` array passed to {@link bulkWrite}. */
@@ -2084,10 +2147,40 @@ interface BulkWriteOptions<TRow, TRecord = any> extends RetryOptions {
      * `batch[i]` positionally (this is how every `bulkCreate` implementation in
      * this repo already behaves: sql's single `INSERT ... VALUES (...), (...)
      * RETURNING *`, memory's `Promise.all`, mongodb's ordered `insertMany`).
-     */
-    writeBatch: (batch: TRow[]) => Promise<TRecord[]>;
-    /** Write a single row — used only to degrade a failed batch. */
-    writeOne: (row: TRow) => Promise<TRecord>;
+     *
+     * `ctx.attempt` is the 1-based attempt number. `attempt > 1` means a prior
+     * attempt's outcome is UNKNOWN (a transient blip that may have landed after
+     * commit) — an exactly-once caller should recheck by natural key and skip
+     * rows already present before re-writing (framework#3149).
+     */
+    writeBatch: (batch: TRow[], ctx: {
+        attempt: number;
+    }) => Promise<TRecord[]>;
+    /**
+     * Write a single row — used only to degrade a failed batch. `ctx.attempt`
+     * carries the same recheck signal as {@link writeBatch}.
+     */
+    writeOne: (row: TRow, ctx: {
+        attempt: number;
+    }) => Promise<TRecord>;
+    /**
+     * Partial-success batch write (framework#3172). When provided it is used
+     * INSTEAD of {@link writeBatch}: it must resolve one outcome per input row,
+     * in input order — `{ ok: true, record }` for written rows, `{ ok: false,
+     * error }` for rows that failed individually (e.g. validation). Per-row
+     * failures are final verdicts: bulkWrite records them as-is and does NOT
+     * degrade to `writeOne` for them — that is the whole point (a degradation
+     * re-run would re-fire beforeInsert hooks on the good rows). Only a THROWN
+     * error (a transient infra failure, a result-count mismatch) falls back to
+     * the per-row `writeOne` degradation, exactly like `writeBatch`.
+     */
+    writeBatchPartial?: (batch: TRow[], ctx: {
+        attempt: number;
+    }) => Promise<Array<{
+        ok: boolean;
+        record?: TRecord;
+        error?: unknown;
+    }>>;
 }
 declare function defaultIsTransientError(err: unknown): boolean;
 /**
@@ -2096,7 +2189,7 @@ declare function defaultIsTransientError(err: unknown): boolean;
  * transient-error backoff {@link bulkWrite} applies to batches — so a
  * network blip doesn't drop an update the way it used to drop an insert.
  */
-declare function withTransientRetry<T>(fn: () => Promise<T>, opts?: RetryOptions): Promise<T>;
+declare function withTransientRetry<T>(fn: (attempt: number) => Promise<T>, opts?: RetryOptions): Promise<T>;
 /**
  * Write `rows` through `opts.writeBatch` in chunks of `opts.batchSize`,
  * retrying a whole-batch transient failure with backoff, and degrading to
@@ -2544,4 +2637,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry };
+export { ANONYMOUS_DENY_BODY, ANONYMOUS_DENY_CODE, ANONYMOUS_DENY_MESSAGE, ANONYMOUS_DENY_STATUS, API_KEY_PREFIX, type AnonymousDenyInput, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BucketGranularity, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, type LadderPrincipal, type LadderRow, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, POSTURE_INJECTION_RULE, POSTURE_LADDER, POSTURE_RANK, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PostureEvidence, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, bucketKeyToCalendarRange, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, derivePosture, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, postureVisibleRows, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, shouldDenyAnonymous, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry, zonedDateStartToUtcMs };